diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7ea60dac..da9b611c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,5 +26,5 @@ jobs:
     with:
       only-latest-golang: false
       run-codeql: true
-      golangci-lint-version: "v2.12.1"
+      golangci-lint-version: "v2.13.2"
     secrets: inherit
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2d21ddea..53c63cc5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,12 +21,32 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ### Changed
 
+- Enforce the minimum HMAC key lengths from RFC 7518 §3.2 after migrating to
+  go-jose v4. `oct` keys must now be at least 32 bytes for HS256, 48 bytes for
+  HS384, and 64 bytes for HS512. `step crypto jwk create` rejects smaller values
+  for `--size`, and `--insecure` no longer overrides the minimum. Existing
+  shorter keys can no longer be used to sign or verify with the
+  `step crypto jwt` and `step crypto jws` commands and must be replaced
+  (smallstep/cli#1732, smallstep/crypto#1157).
+- Require the `--size` of `oct` keys in `step crypto jwk create` to match the
+  AES key wrap algorithm exactly: 16 bytes for A128KW and A128GCMKW, 24 bytes for
+  A192KW and A192GCMKW, and 32 bytes for A256KW and A256GCMKW. Existing keys
+  whose size does not match their algorithm, including keys created without
+  `--size` for A128KW, A192KW, A128GCMKW, or A192GCMKW, are now rejected by
+  `step crypto jwe decrypt` (smallstep/cli#1732, smallstep/crypto#1157).
+
 ### Deprecated
 
 ### Removed
 
 ### Fixed
 
+- Fix `step crypto jwe encrypt` with `oct` keys, which failed with
+  `unsupported key type '<nil>'` (smallstep/cli#1732).
+- Keep the original protected header in `step crypto jose format`, reordering
+  its fields invalidated the signature or authentication tag of the token
+  (smallstep/cli#1732).
+
 ### Security
 
 ---
diff --git a/Makefile b/Makefile
index 4bb594ae..d1fbc2d7 100644
--- a/Makefile
+++ b/Makefile
@@ -26,6 +26,13 @@ GORELEASER_BUILD_ID?=default
 
 # all go files
 SRC=$(shell find . -type f -name '*.go' -or -name go.mod -or -name go.sum)
+GOSRC=$(shell find . -type f -name '*.go')
+
+# tools run with `go tool`, their versions are defined in go.mod
+GOIMPORTS=golang.org/x/tools/cmd/goimports
+GOLANGCI_LINT=github.com/golangci/golangci-lint/v2/cmd/golangci-lint
+GOTESTSUM=gotest.tools/gotestsum
+GOVULNCHECK=golang.org/x/vuln/cmd/govulncheck
 
 all: lint test build
 
@@ -104,10 +111,6 @@ GORELEASER_SKIP=$(if $(filter true,$(shell goreleaser --version | grep -q gorele
 TMPDIR := $(shell mktemp -d)
 bootstra%: GOPATH=$(shell go env GOPATH)
 bootstra%:
-	$Q curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $$(go env GOPATH)/bin latest
-	$Q go install golang.org/x/vuln/cmd/govulncheck@latest
-	$Q go install gotest.tools/gotestsum@latest
-	$Q go install golang.org/x/tools/cmd/goimports@latest
 	@echo "Installing GoReleaser Pro into $(GOPATH)/bin"
 	$Q curl -o $(TMPDIR)/goreleaser.tar.gz -L $(GORELEASER_PRO_URL)
 	$Q ls $(TMPDIR)
@@ -149,10 +152,10 @@ goreleaser:
 #########################################
 
 test:
-	$Q $(CGO_OVERRIDE) $(GOFLAGS) gotestsum -- -coverprofile=coverage.out -short -covermode=atomic ./...
+	$Q $(CGO_OVERRIDE) $(GOFLAGS) go tool $(GOTESTSUM) -- -coverprofile=coverage.out -short -covermode=atomic ./...
 
 race:
-	$Q $(CGO_OVERRIDE) $(GOFLAGS) gotestsum -- -race ./...
+	$Q $(CGO_OVERRIDE) $(GOFLAGS) go tool $(GOTESTSUM) -- -race ./...
 
 .PHONY: test race
 
@@ -161,16 +164,16 @@ race:
 #########################################
 
 fmt:
-	$Q goimports -local github.com/golangci/golangci-lint -l -w $(SRC)
+	$Q go tool $(GOIMPORTS) -local github.com/smallstep/cli/ -l -w $(GOSRC)
 
 lint: golint govulncheck
 
 golint: SHELL:=/bin/bash
 golint:
-	$Q LOG_LEVEL=error golangci-lint run --config <(curl -s https://raw.githubusercontent.com/smallstep/workflows/master/.golangci.yml) --timeout=30m
+	$Q LOG_LEVEL=error go tool $(GOLANGCI_LINT) run --config <(curl -s https://raw.githubusercontent.com/smallstep/workflows/master/.golangci.yml) --timeout=30m
 
 govulncheck:
-	$Q govulncheck ./...
+	$Q go tool $(GOVULNCHECK) ./...
 
 .PHONY: fmt lint golint govulncheck
 
diff --git a/command/ca/acme/eab/add.go b/command/ca/acme/eab/add.go
index 2fe70c79..96c26979 100644
--- a/command/ca/acme/eab/add.go
+++ b/command/ca/acme/eab/add.go
@@ -87,7 +87,7 @@ func addAction(ctx *cli.Context) (err error) {
 	// TODO(hs): JSON output, so that executing this command can be more easily automated?
 
 	out := os.Stdout
-	format := "%-36s%-28s%-48s%s\n"
+	format := "%-40s%-28s%-48s%s\n"
 	fmt.Fprintf(out, format, "Key ID", "Provisioner", "Key (base64, raw url encoded)", "Reference")
 	fmt.Fprintf(out, format, cliEAK.id, cliEAK.provisioner, cliEAK.key, cliEAK.reference)
 
diff --git a/command/ca/acme/eab/eab.go b/command/ca/acme/eab/eab.go
index b989482b..4f90bbbf 100644
--- a/command/ca/acme/eab/eab.go
+++ b/command/ca/acme/eab/eab.go
@@ -9,10 +9,9 @@ import (
 	"github.com/pkg/errors"
 	"github.com/urfave/cli"
 
-	"github.com/smallstep/linkedca"
-
 	"github.com/smallstep/certificates/authority/admin"
 	"github.com/smallstep/certificates/ca"
+	"github.com/smallstep/linkedca"
 )
 
 type cliEAK struct {
diff --git a/command/ca/acme/eab/list.go b/command/ca/acme/eab/list.go
index 51e1bfe5..2b9566a5 100644
--- a/command/ca/acme/eab/list.go
+++ b/command/ca/acme/eab/list.go
@@ -128,7 +128,7 @@ func listAction(ctx *cli.Context) (err error) {
 	}
 
 	cursor := ""
-	format := "%-36s%-28s%-16s%-30s%-30s%-40s%s\n"
+	format := "%-40s%-28s%-16s%-30s%-30s%-40s%s\n"
 	firstIteration := true
 	startedPager := false
 
diff --git a/command/ca/health_test.go b/command/ca/health_test.go
index 3c3c330b..4c21a1eb 100644
--- a/command/ca/health_test.go
+++ b/command/ca/health_test.go
@@ -13,11 +13,10 @@ import (
 	"github.com/stretchr/testify/require"
 	"github.com/urfave/cli"
 
-	"go.step.sm/crypto/minica"
-	"go.step.sm/crypto/pemutil"
-
 	"github.com/smallstep/certificates/authority/config"
 	stepca "github.com/smallstep/certificates/ca"
+	"go.step.sm/crypto/minica"
+	"go.step.sm/crypto/pemutil"
 )
 
 // reservePort "reserves" a TCP port by opening a listener on a random
diff --git a/command/ca/policy/x509/wildcards.go b/command/ca/policy/x509/wildcards.go
index 108d4945..0c9e8321 100644
--- a/command/ca/policy/x509/wildcards.go
+++ b/command/ca/policy/x509/wildcards.go
@@ -3,10 +3,11 @@ package x509
 import (
 	"context"
 
+	"github.com/urfave/cli"
+
 	"github.com/smallstep/cli/command/ca/policy/actions"
 	"github.com/smallstep/cli/flags"
 	"github.com/smallstep/cli/internal/command"
-	"github.com/urfave/cli"
 )
 
 var provisionerFilterFlag = cli.StringFlag{
diff --git a/command/ca/provisioner/remove.go b/command/ca/provisioner/remove.go
index f4d0855e..892350eb 100644
--- a/command/ca/provisioner/remove.go
+++ b/command/ca/provisioner/remove.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/smallstep/certificates/ca"
 	"github.com/smallstep/cli-utils/errs"
+
 	"github.com/smallstep/cli/flags"
 )
 
diff --git a/command/ca/provisioner/update.go b/command/ca/provisioner/update.go
index 5ecd7f34..d0f1b8fa 100644
--- a/command/ca/provisioner/update.go
+++ b/command/ca/provisioner/update.go
@@ -16,7 +16,6 @@ import (
 	"github.com/smallstep/certificates/ca"
 	"github.com/smallstep/cli-utils/errs"
 	"github.com/smallstep/cli-utils/ui"
-
 	"github.com/smallstep/linkedca"
 	"go.step.sm/crypto/jose"
 	"go.step.sm/crypto/mldsa"
diff --git a/command/ca/revoke.go b/command/ca/revoke.go
index 026d1514..1be767a8 100644
--- a/command/ca/revoke.go
+++ b/command/ca/revoke.go
@@ -14,6 +14,7 @@ import (
 
 	"github.com/pkg/errors"
 	"github.com/urfave/cli"
+	"golang.org/x/crypto/ocsp"
 
 	"github.com/smallstep/certificates/api"
 	"github.com/smallstep/certificates/authority/provisioner"
@@ -25,7 +26,6 @@ import (
 	"go.step.sm/crypto/jose"
 	"go.step.sm/crypto/pemutil"
 	"go.step.sm/crypto/x509util"
-	"golang.org/x/crypto/ocsp"
 
 	"github.com/smallstep/cli/flags"
 	"github.com/smallstep/cli/utils/cautils"
diff --git a/command/ca/token.go b/command/ca/token.go
index e074171c..42f4b849 100644
--- a/command/ca/token.go
+++ b/command/ca/token.go
@@ -7,13 +7,14 @@ import (
 	"github.com/pkg/errors"
 	"github.com/urfave/cli"
 
+	"golang.org/x/crypto/ssh"
+
 	"github.com/smallstep/certificates/api"
 	"github.com/smallstep/certificates/pki"
 	"github.com/smallstep/cli-utils/command"
 	"github.com/smallstep/cli-utils/errs"
 	"github.com/smallstep/cli-utils/fileutil"
 	"go.step.sm/crypto/pemutil"
-	"golang.org/x/crypto/ssh"
 
 	"github.com/smallstep/cli/flags"
 	"github.com/smallstep/cli/utils"
diff --git a/command/certificate/fingerprint.go b/command/certificate/fingerprint.go
index edac3693..f5ef95bb 100644
--- a/command/certificate/fingerprint.go
+++ b/command/certificate/fingerprint.go
@@ -5,9 +5,6 @@ import (
 	"crypto/x509"
 	"fmt"
 
-	//nolint:gosec // support for sha1 fingerprints
-	_ "crypto/sha1"
-
 	"github.com/pkg/errors"
 	"github.com/urfave/cli"
 
@@ -17,6 +14,9 @@ import (
 
 	"github.com/smallstep/cli/flags"
 	"github.com/smallstep/cli/utils"
+
+	//nolint:gosec // support for sha1 fingerprints
+	_ "crypto/sha1"
 )
 
 func fingerprintCommand() cli.Command {
diff --git a/command/certificate/inspect_test.go b/command/certificate/inspect_test.go
index 9a0d2e69..238420b2 100644
--- a/command/certificate/inspect_test.go
+++ b/command/certificate/inspect_test.go
@@ -6,8 +6,9 @@ import (
 	"flag"
 	"testing"
 
-	"github.com/smallstep/assert"
 	"github.com/urfave/cli"
+
+	"github.com/smallstep/assert"
 	"go.step.sm/crypto/pemutil"
 )
 
diff --git a/command/certificate/remote.go b/command/certificate/remote.go
index 211de504..ce7850ca 100644
--- a/command/certificate/remote.go
+++ b/command/certificate/remote.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	"github.com/pkg/errors"
+
 	"go.step.sm/crypto/x509util"
 )
 
diff --git a/command/certificate/sign.go b/command/certificate/sign.go
index 07e2fa1d..cfb02fe2 100644
--- a/command/certificate/sign.go
+++ b/command/certificate/sign.go
@@ -12,9 +12,10 @@ import (
 	"time"
 
 	"github.com/pkg/errors"
+	"github.com/urfave/cli"
+
 	"github.com/smallstep/cli-utils/errs"
 	"github.com/smallstep/cli-utils/ui"
-	"github.com/urfave/cli"
 	"go.step.sm/crypto/mldsa"
 	"go.step.sm/crypto/pemutil"
 	"go.step.sm/crypto/x509util"
diff --git a/command/crypto/hash/hash.go b/command/crypto/hash/hash.go
index 0c997adb..42ab7619 100644
--- a/command/crypto/hash/hash.go
+++ b/command/crypto/hash/hash.go
@@ -1,6 +1,13 @@
 package hash
 
 import (
+	"github.com/pkg/errors"
+	"github.com/urfave/cli"
+
+	"github.com/smallstep/cli-utils/errs"
+
+	"github.com/smallstep/cli/flags"
+
 	//nolint:gosec // md5 can only be used with --insecure flag
 	"crypto/md5"
 	//nolint:gosec // sha1 is being used to calculate a hash, not a key
@@ -16,13 +23,6 @@ import (
 	"os"
 	"path"
 	"strings"
-
-	"github.com/pkg/errors"
-	"github.com/urfave/cli"
-
-	"github.com/smallstep/cli-utils/errs"
-
-	"github.com/smallstep/cli/flags"
 )
 
 type hashConstructor func() hash.Hash
diff --git a/command/crypto/jose/jose.go b/command/crypto/jose/jose.go
index 50726cfe..f3c8f5f0 100644
--- a/command/crypto/jose/jose.go
+++ b/command/crypto/jose/jose.go
@@ -1,6 +1,7 @@
 package jose
 
 import (
+	"encoding/json"
 	"fmt"
 	"io"
 	"os"
@@ -9,7 +10,10 @@ import (
 
 	"github.com/pkg/errors"
 	"github.com/urfave/cli"
+
 	"go.step.sm/crypto/jose"
+
+	"github.com/smallstep/cli/internal/joseutil"
 )
 
 // Command returns the cli.Command for jose related subcommands.
@@ -75,10 +79,10 @@ func formatAction(*cli.Context) error {
 	// Attempt to parse an encrypted
 	// If it fails parse a regular JWS
 	var srz serializer
-	if enc, err := jose.ParseEncrypted(token); err == nil {
+	if enc, err := joseutil.ParseEncryptedInsecure(token); err == nil {
 		srz = enc
 	} else {
-		tok, err := jose.ParseJWS(token)
+		tok, err := joseutil.ParseSignedInsecure(token)
 		if err != nil {
 			return errors.Wrap(jose.TrimPrefix(err), "error parsing data")
 		}
@@ -90,14 +94,56 @@ func formatAction(*cli.Context) error {
 		if err != nil {
 			return errors.Wrap(jose.TrimPrefix(err), "error serializing data")
 		}
-		fmt.Println(str)
+		fmt.Println(withCompactProtected(str, token))
 	} else {
-		fmt.Println(srz.FullSerialize())
+		fmt.Println(withJSONProtected(srz.FullSerialize(), token))
 	}
 
 	return nil
 }
 
+// withCompactProtected returns the given compact serialization with the protected
+// header of the original token in JSON format. go-jose marshals the header again
+// when it serializes a token, which changes the bytes that the signature or the
+// authentication tag cover if the fields are in a different order.
+func withCompactProtected(compact, token string) string {
+	var jws struct {
+		Protected  string `json:"protected"`
+		Signatures []struct {
+			Protected string `json:"protected"`
+		} `json:"signatures"`
+	}
+	if err := json.Unmarshal([]byte(token), &jws); err != nil {
+		return compact
+	}
+
+	protected := jws.Protected
+	if protected == "" && len(jws.Signatures) == 1 {
+		protected = jws.Signatures[0].Protected
+	}
+	_, rest, ok := strings.Cut(compact, ".")
+	if protected == "" || !ok {
+		return compact
+	}
+	return strings.TrimRight(protected, "=") + "." + rest
+}
+
+// withJSONProtected returns the given JSON serialization with the protected header
+// of the original token in compact format, see withCompactProtected.
+func withJSONProtected(full, token string) string {
+	var serialized struct {
+		Protected string `json:"protected"`
+	}
+	if err := json.Unmarshal([]byte(full), &serialized); err != nil {
+		return full
+	}
+
+	protected, _, _ := strings.Cut(token, ".")
+	return strings.Replace(full,
+		`"protected":"`+serialized.Protected+`"`,
+		`"protected":"`+protected+`"`, 1)
+}
+
 var stripWhitespaceRegex = regexp.MustCompile(`\s`)
 
 // stripWhitespace strip all newlines and whitespace
diff --git a/command/crypto/jwe/encrypt.go b/command/crypto/jwe/encrypt.go
index a5e73beb..7060dde9 100644
--- a/command/crypto/jwe/encrypt.go
+++ b/command/crypto/jwe/encrypt.go
@@ -240,9 +240,12 @@ func encryptAction(ctx *cli.Context) error {
 			KeyID:     kid,
 		}
 	} else {
-		// Public keys are used for encryption
-		jwkPub := jwk.Public()
-		jwk = &jwkPub
+		// Public keys are used for encryption. go-jose JSONWebKey.Public() returns
+		// an empty key for oct, which are symmetric and are used as they are.
+		if !jose.IsSymmetric(jwk) {
+			jwkPub := jwk.Public()
+			jwk = &jwkPub
+		}
 
 		if jwk.Use == "sig" {
 			return errors.New("invalid jwk use: found 'sig' (signature), expecting 'enc' (encryption)")
diff --git a/command/crypto/jwk/create.go b/command/crypto/jwk/create.go
index af4bb992..d53fd3ac 100644
--- a/command/crypto/jwk/create.go
+++ b/command/crypto/jwk/create.go
@@ -150,18 +150,18 @@ $ step crypto jwk create jwk.pub.json jwk.json \
     --from-pem key.pem
 '''
 
-Create an 4096 bit RSA encryption key:
+Create a 4096-bit RSA encryption key:
 
 '''
 $ step crypto jwk create rsa-enc.pub.json rsa-enc.json \
    --kty RSA --size 4096 --use enc
 '''
 
-Create a 192 bit symmetric encryption key for use with AES Key Wrap:
+Create a 24-byte (192-bit) symmetric encryption key for use with AES GCM key wrapping:
 
 '''
 $ step crypto jwk create kw.pub.json kw.json \
-    --kty oct --size 192 --use enc --alg A192GCMKW
+    --kty oct --size 24 --use enc --alg A192GCMKW
 '''
 `,
 		Flags: []cli.Flag{
@@ -186,7 +186,13 @@ If unset, default is EC.
     :  Create an **RSA** keypair
 `,
 			},
-			flags.Size,
+			cli.IntFlag{
+				Name: "size",
+				Usage: `The <size> of the key for RSA and oct key types, in bits for RSA keys and in
+bytes for oct keys. RSA keys require a minimum key size of 2048 bits. If unset,
+default is 2048 bits for RSA keys. For oct keys, default is the size required
+by the algorithm, or 32 bytes if the algorithm does not define one.`,
+			},
 			flags.Curve,
 			cli.StringFlag{
 				Name: "alg, algorithm",
@@ -446,7 +452,7 @@ func createAction(ctx *cli.Context) (err error) {
 				return errs.MinSizeInsecureFlag(ctx, "size", strconv.Itoa(minimalSize))
 			}
 			if size <= 0 {
-				return errs.MinSizeFlag(ctx, "size", "0")
+				return errs.MinSizeFlag(ctx, "size", "1")
 			}
 		}
 	case "OKP":
@@ -457,13 +463,38 @@ func createAction(ctx *cli.Context) (err error) {
 		if ctx.IsSet("crv") {
 			return errs.IncompatibleFlag(ctx, "crv", "--kty oct")
 		}
-		// If size is not set it will use a safe default
+		// If size is not set it will use a safe default. GenerateJWK also checks
+		// the size of HMAC and AES key wrap algorithms, these checks report the
+		// problem in terms of the flag.
 		if ctx.IsSet("size") {
+			sizeAlg := alg
+			if sizeAlg == "" {
+				// Same defaults as GenerateJWK, which uses the signature algorithm for
+				// any use other than enc.
+				if use == "enc" {
+					sizeAlg = string(jose.DefaultOctKeyAlgorithm)
+				} else {
+					sizeAlg = jose.DefaultOctSigAlgorithm
+				}
+			}
+			// go-jose v4 enforces RFC 7518 §3.2, which says an HMAC key must be at
+			// least as long as the hash output.
+			if n := hmacKeySize(sizeAlg); n > 0 && size < n {
+				return errs.MinSizeFlag(ctx, "size", strconv.Itoa(n)+" bytes")
+			}
+			// go-jose selects the AES variant from the key size, so the size must
+			// match the algorithm exactly.
+			if n := aesKeySize(sizeAlg); n > 0 && size != n {
+				return fmt.Errorf("flag '--size' must be equal to %d bytes", n)
+			}
+			// Other algorithms only have a minimum. The size of a dir key depends on
+			// the content encryption algorithm, which is not known until encrypting.
 			if size < 16 && !ctx.Bool("insecure") {
-				return errs.MinSizeInsecureFlag(ctx, "size", "16")
+				return errs.MinSizeInsecureFlag(ctx, "size", "16 bytes")
 			}
+			// GenerateJWK would treat a size of 0 as unset and use the default.
 			if size <= 0 {
-				return errs.MinSizeFlag(ctx, "size", "0")
+				return errs.MinSizeFlag(ctx, "size", "1 byte")
 			}
 		}
 	default:
@@ -598,3 +629,33 @@ func createAction(ctx *cli.Context) (err error) {
 	ui.Printf("Your private key has been saved in %s.\n", privFile)
 	return nil
 }
+
+// hmacKeySize returns the minimum size in bytes of the key for the given HMAC
+// algorithm, or 0 if alg is not an HMAC algorithm.
+func hmacKeySize(alg string) int {
+	switch alg {
+	case jose.HS256:
+		return 32
+	case jose.HS384:
+		return 48
+	case jose.HS512:
+		return 64
+	default:
+		return 0
+	}
+}
+
+// aesKeySize returns the exact size in bytes of the key for the given AES key
+// wrap algorithm, or 0 if alg is not an AES key wrap algorithm.
+func aesKeySize(alg string) int {
+	switch jose.KeyAlgorithm(alg) {
+	case jose.A128KW, jose.A128GCMKW:
+		return 16
+	case jose.A192KW, jose.A192GCMKW:
+		return 24
+	case jose.A256KW, jose.A256GCMKW:
+		return 32
+	default:
+		return 0
+	}
+}
diff --git a/command/crypto/jws/inspect.go b/command/crypto/jws/inspect.go
index bae78663..7612dde5 100644
--- a/command/crypto/jws/inspect.go
+++ b/command/crypto/jws/inspect.go
@@ -14,6 +14,7 @@ import (
 	"go.step.sm/crypto/jose"
 
 	"github.com/smallstep/cli/flags"
+	"github.com/smallstep/cli/internal/joseutil"
 	"github.com/smallstep/cli/utils"
 )
 
@@ -54,7 +55,7 @@ func inspectAction(ctx *cli.Context) error {
 		return err
 	}
 
-	tok, err := jose.ParseJWS(token)
+	tok, err := joseutil.ParseSignedInsecure(token)
 	if err != nil {
 		return errors.Wrap(jose.TrimPrefix(err), "error parsing token")
 	}
diff --git a/command/crypto/jws/sign.go b/command/crypto/jws/sign.go
index b5ae0e55..e4faa691 100644
--- a/command/crypto/jws/sign.go
+++ b/command/crypto/jws/sign.go
@@ -4,15 +4,15 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/smallstep/cli/flags"
-	"github.com/smallstep/cli/utils"
-
 	"github.com/pkg/errors"
 	"github.com/urfave/cli"
 
 	"github.com/smallstep/cli-utils/errs"
 	"go.step.sm/crypto/jose"
 	"go.step.sm/crypto/pemutil"
+
+	"github.com/smallstep/cli/flags"
+	"github.com/smallstep/cli/utils"
 )
 
 func signCommand() cli.Command {
diff --git a/command/crypto/jwt/inspect.go b/command/crypto/jwt/inspect.go
index a6f68aac..10036d76 100644
--- a/command/crypto/jwt/inspect.go
+++ b/command/crypto/jwt/inspect.go
@@ -13,6 +13,7 @@ import (
 	"github.com/smallstep/cli-utils/errs"
 	"go.step.sm/crypto/jose"
 
+	"github.com/smallstep/cli/internal/joseutil"
 	"github.com/smallstep/cli/utils"
 )
 
@@ -55,7 +56,7 @@ func inspectAction(ctx *cli.Context) error {
 }
 
 func printToken(token string) error {
-	tok, err := jose.ParseJWS(token)
+	tok, err := joseutil.ParseSignedInsecure(token)
 	if err != nil {
 		return errors.Wrap(jose.TrimPrefix(err), "error parsing token")
 	}
diff --git a/command/crypto/jwt/sign.go b/command/crypto/jwt/sign.go
index db47946e..97c91171 100644
--- a/command/crypto/jwt/sign.go
+++ b/command/crypto/jwt/sign.go
@@ -454,7 +454,7 @@ func signAction(ctx *cli.Context) error {
 		aud["aud"] = c.Audience[0]
 	}
 
-	raw, err := jose.Signed(signer).Claims(c).Claims(aud).Claims(payload).CompactSerialize()
+	raw, err := jose.Signed(signer).Claims(c).Claims(aud).Claims(payload).Serialize()
 	if err != nil {
 		return errors.Wrapf(err, "error serializing JWT")
 	}
diff --git a/command/crypto/jwt/verify.go b/command/crypto/jwt/verify.go
index 2cc6a12d..4f57a13c 100644
--- a/command/crypto/jwt/verify.go
+++ b/command/crypto/jwt/verify.go
@@ -236,7 +236,7 @@ func verifyAction(ctx *cli.Context) error {
 
 	expected := jose.Expected{Issuer: iss}
 	if aud != "" {
-		expected.Audience = jose.Audience{aud}
+		expected.AnyAudience = jose.Audience{aud}
 	}
 	if tClaims.Expiry != nil || tClaims.NotBefore != nil {
 		expected.Time = time.Now()
@@ -268,7 +268,7 @@ func validateClaimsWithLeeway(ctx *cli.Context, c jose.Claims, e jose.Expected,
 		ers = append(ers, "invalid ID claim (jti)")
 	}
 
-	for _, v := range e.Audience {
+	for _, v := range e.AnyAudience {
 		if !c.Audience.Contains(v) {
 			ers = append(ers, "invalid audience claim (aud)")
 			break
diff --git a/command/crypto/key/fingerprint.go b/command/crypto/key/fingerprint.go
index 2ff03608..db89f025 100644
--- a/command/crypto/key/fingerprint.go
+++ b/command/crypto/key/fingerprint.go
@@ -9,19 +9,20 @@ import (
 	"fmt"
 	"os"
 
-	//nolint:gosec // support for sha1 fingerprints
-	_ "crypto/sha1"
-
 	"github.com/pkg/errors"
 	"github.com/urfave/cli"
 
+	"golang.org/x/crypto/ssh"
+
 	"github.com/smallstep/cli-utils/errs"
 	"go.step.sm/crypto/fingerprint"
 	"go.step.sm/crypto/pemutil"
-	"golang.org/x/crypto/ssh"
 
 	"github.com/smallstep/cli/flags"
 	"github.com/smallstep/cli/utils"
+
+	//nolint:gosec // support for sha1 fingerprints
+	_ "crypto/sha1"
 )
 
 func fingerprintCommand() cli.Command {
diff --git a/command/crypto/key/format.go b/command/crypto/key/format.go
index dcd98a8f..cf34786a 100644
--- a/command/crypto/key/format.go
+++ b/command/crypto/key/format.go
@@ -13,6 +13,8 @@ import (
 	"github.com/pkg/errors"
 	"github.com/urfave/cli"
 
+	"golang.org/x/crypto/ssh"
+
 	"github.com/smallstep/cli-utils/command"
 	"github.com/smallstep/cli-utils/errs"
 	"github.com/smallstep/cli-utils/fileutil"
@@ -20,7 +22,6 @@ import (
 	"go.step.sm/crypto/jose"
 	"go.step.sm/crypto/mldsa"
 	"go.step.sm/crypto/pemutil"
-	"golang.org/x/crypto/ssh"
 
 	"github.com/smallstep/cli/flags"
 	"github.com/smallstep/cli/utils"
diff --git a/command/crypto/rand/rand.go b/command/crypto/rand/rand.go
index 1f252532..1cf62a55 100644
--- a/command/crypto/rand/rand.go
+++ b/command/crypto/rand/rand.go
@@ -13,7 +13,6 @@ import (
 
 	"github.com/smallstep/cli-utils/command"
 	"github.com/smallstep/cli-utils/errs"
-
 	"go.step.sm/crypto/fingerprint"
 	"go.step.sm/crypto/randutil"
 )
diff --git a/command/oauth/cmd.go b/command/oauth/cmd.go
index 1e1ea6ea..8e50df91 100644
--- a/command/oauth/cmd.go
+++ b/command/oauth/cmd.go
@@ -1015,7 +1015,7 @@ func (o *oauth) DoTwoLeggedAuthorization(issuer string) (*token, error) {
 		return nil, errors.Wrapf(err, "error creating JWT signer")
 	}
 
-	raw, err := jose.Signed(signer).Claims(c).CompactSerialize()
+	raw, err := jose.Signed(signer).Claims(c).Serialize()
 	if err != nil {
 		return nil, errors.Wrapf(err, "error serializing JWT")
 	}
@@ -1078,7 +1078,7 @@ func (o *oauth) DoJWTAuthorization(issuer, aud string) (*token, error) {
 		return nil, errors.Wrapf(err, "error creating JWT signer")
 	}
 
-	raw, err := jose.Signed(signer).Claims(c).CompactSerialize()
+	raw, err := jose.Signed(signer).Claims(c).Serialize()
 	if err != nil {
 		return nil, errors.Wrapf(err, "error serializing JWT")
 	}
diff --git a/command/ssh/config.go b/command/ssh/config.go
index 3c14a40d..d5450ae1 100644
--- a/command/ssh/config.go
+++ b/command/ssh/config.go
@@ -10,6 +10,8 @@ import (
 	"github.com/pkg/errors"
 	"github.com/urfave/cli"
 
+	"golang.org/x/crypto/ssh"
+
 	"github.com/smallstep/certificates/api"
 	"github.com/smallstep/certificates/authority/provisioner"
 	"github.com/smallstep/certificates/ca"
@@ -18,7 +20,6 @@ import (
 	"github.com/smallstep/cli-utils/errs"
 	"github.com/smallstep/cli-utils/step"
 	"github.com/smallstep/cli-utils/ui"
-	"golang.org/x/crypto/ssh"
 
 	"github.com/smallstep/cli/flags"
 	"github.com/smallstep/cli/internal/sshutil"
diff --git a/command/ssh/list.go b/command/ssh/list.go
index 3067a747..82238d77 100644
--- a/command/ssh/list.go
+++ b/command/ssh/list.go
@@ -8,7 +8,6 @@ import (
 
 	"github.com/smallstep/cli-utils/command"
 	"github.com/smallstep/cli-utils/errs"
-
 	libsshutil "go.step.sm/crypto/sshutil"
 
 	"github.com/smallstep/cli/internal/sshutil"
diff --git a/command/ssh/rekey.go b/command/ssh/rekey.go
index a384f9a4..0be528ad 100644
--- a/command/ssh/rekey.go
+++ b/command/ssh/rekey.go
@@ -15,7 +15,6 @@ import (
 	"github.com/smallstep/cli-utils/errs"
 	"github.com/smallstep/cli-utils/fileutil"
 	"github.com/smallstep/cli-utils/ui"
-
 	"go.step.sm/crypto/keyutil"
 	"go.step.sm/crypto/pemutil"
 
diff --git a/docs/local-development.md b/docs/local-development.md
index e1045831..3104e766 100644
--- a/docs/local-development.md
+++ b/docs/local-development.md
@@ -29,10 +29,11 @@ learn more about `$GOPATH` in the
 ### Installing Dependencies and Bootstrapping
 
 Once you've cloned the repository to the appropriate location, you will now be
-able to install any other dependencies via the `make bootstrap` command.
+able to install GoReleaser Pro, which `make goreleaser` uses, via the
+`make bootstrap` command.
 
-You should only ever need to run this command once, as it will ensure you have
-the right version of `golangci-lint` installed.
+The other development tools, like `golangci-lint`, are defined in `go.mod` and
+run with `go tool`, so the `make` targets that use them do not need any setup.
 
 ### Building step
 
diff --git a/exec/exec.go b/exec/exec.go
index e5899117..f1c2dc78 100644
--- a/exec/exec.go
+++ b/exec/exec.go
@@ -13,6 +13,7 @@ import (
 	"syscall"
 
 	"github.com/pkg/errors"
+
 	"github.com/smallstep/cli/utils/sysutils"
 )
 
diff --git a/flags/flags.go b/flags/flags.go
index f767b21d..a320f5eb 100644
--- a/flags/flags.go
+++ b/flags/flags.go
@@ -53,8 +53,8 @@ If unset, default is EC.
 	// Size is the flag to set the key size.
 	Size = cli.IntFlag{
 		Name: "size",
-		Usage: `The <size> (in bits) of the key for RSA and oct key types. RSA keys require a
-minimum key size of 2048 bits. If unset, default is 2048 bits for RSA keys and 128 bits for oct keys.`,
+		Usage: `The <size> (in bits) of the key for RSA key types. RSA keys require a
+minimum key size of 2048 bits. If unset, default is 2048 bits for RSA keys.`,
 	}
 
 	// Curve is the flag to se the key curve.
diff --git a/flags/flags_test.go b/flags/flags_test.go
index b1b1d4bc..14272184 100644
--- a/flags/flags_test.go
+++ b/flags/flags_test.go
@@ -10,9 +10,10 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/smallstep/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/urfave/cli"
+
+	"github.com/smallstep/assert"
 	"go.step.sm/crypto/fingerprint"
 )
 
diff --git a/go.mod b/go.mod
index 844574e2..ebf53a21 100644
--- a/go.mod
+++ b/go.mod
@@ -6,7 +6,7 @@ require (
 	github.com/Microsoft/go-winio v0.6.4
 	github.com/ccoveille/go-safecast/v2 v2.0.1
 	github.com/fxamacker/cbor/v2 v2.10.0
-	github.com/go-jose/go-jose/v3 v3.0.5
+	github.com/go-jose/go-jose/v4 v4.1.9
 	github.com/google/go-cmp v0.7.0
 	github.com/google/go-tpm v0.9.8
 	github.com/google/uuid v1.6.0
@@ -16,9 +16,9 @@ require (
 	github.com/rogpeppe/go-internal v1.16.0
 	github.com/slackhq/nebula v1.11.2
 	github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262
-	github.com/smallstep/certificates v0.30.2
+	github.com/smallstep/certificates v0.30.3-0.20261105213751-6d5a251fbe01
 	github.com/smallstep/certinfo v1.18.0
-	github.com/smallstep/cli-utils v0.12.2
+	github.com/smallstep/cli-utils v0.13.0
 	github.com/smallstep/go-attestation v0.4.4-0.20260814222900-a849f4e2cd68
 	github.com/smallstep/linkedca v0.26.0
 	github.com/smallstep/truststore v0.13.0
@@ -27,7 +27,7 @@ require (
 	github.com/stretchr/testify v1.12.1
 	github.com/urfave/cli v1.22.17
 	go.mozilla.org/pkcs7 v0.10.0
-	go.step.sm/crypto v0.91.1
+	go.step.sm/crypto v0.92.0
 	golang.org/x/crypto v0.58.0
 	golang.org/x/sys v0.49.0
 	golang.org/x/term v0.47.0
@@ -36,109 +36,312 @@ require (
 )
 
 require (
+	4d63.com/gocheckcompilerdirectives v1.4.0 // indirect
+	4d63.com/gochecknoglobals v0.2.2 // indirect
+	charm.land/lipgloss/v2 v2.0.6 // indirect
 	cloud.google.com/go v0.123.0 // indirect
 	cloud.google.com/go/auth v0.24.1-0.20261001053825-dbc26066f70a // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.3.0 // indirect
 	cloud.google.com/go/compute/metadata v0.10.0 // indirect
-	cloud.google.com/go/iam v1.12.0 // indirect
-	cloud.google.com/go/longrunning v1.2.0 // indirect
-	cloud.google.com/go/security v1.26.0 // indirect
+	cloud.google.com/go/iam v1.14.0 // indirect
+	cloud.google.com/go/longrunning v1.3.0 // indirect
+	cloud.google.com/go/security v1.29.1 // indirect
+	codeberg.org/chavacava/garif v0.2.0 // indirect
+	codeberg.org/polyfloyd/go-errorlint v1.9.0 // indirect
 	dario.cat/mergo v1.0.2 // indirect
+	dev.gaijin.team/go/exhaustruct/v4 v4.0.0 // indirect
+	dev.gaijin.team/go/exhaustruct/v5 v5.0.3 // indirect
+	dev.gaijin.team/go/golib v0.8.1 // indirect
 	filippo.io/bigmod v0.1.0 // indirect
 	filippo.io/edwards25519 v1.2.0 // indirect
+	github.com/4meepo/tagalign v1.4.3 // indirect
+	github.com/Abirdcfly/dupword v0.1.8 // indirect
+	github.com/AdminBenni/iota-mixing v1.0.0 // indirect
+	github.com/AlwxSin/noinlineerr v1.0.6 // indirect
 	github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96 // indirect
+	github.com/Antonboom/errname v1.1.2 // indirect
+	github.com/Antonboom/nilnil v1.1.2 // indirect
+	github.com/Antonboom/testifylint v1.6.4 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.15.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.13.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.10.1 // indirect
+	github.com/BurntSushi/toml v1.6.0 // indirect
+	github.com/ClickHouse/clickhouse-go-linter v1.2.1 // indirect
+	github.com/Djarvur/go-err113 v0.1.1 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.5.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
+	github.com/MirrexOne/unqueryvet v1.5.4 // indirect
+	github.com/OpenPeeDeeP/depguard/v2 v2.2.1 // indirect
+	github.com/alecthomas/chroma/v2 v2.27.0 // indirect
+	github.com/alecthomas/go-check-sumtype v0.3.1 // indirect
+	github.com/alexkohler/nakedret/v2 v2.0.6 // indirect
+	github.com/alexkohler/prealloc v1.1.0 // indirect
+	github.com/alfatraining/structtag v1.0.0 // indirect
+	github.com/alingse/asasalint v0.0.11 // indirect
+	github.com/alingse/nilnesserr v0.2.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
+	github.com/ashanbrown/forbidigo/v2 v2.3.1 // indirect
+	github.com/ashanbrown/makezero/v2 v2.2.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/bitfield/gotestdox v0.2.2 // indirect
+	github.com/bkielbasa/cyclop v1.2.3 // indirect
+	github.com/blizzy78/varnamelen v0.8.0 // indirect
+	github.com/bombsimon/wsl/v4 v4.7.0 // indirect
+	github.com/bombsimon/wsl/v5 v5.9.0 // indirect
 	github.com/boombuler/barcode v1.0.1 // indirect
+	github.com/breml/bidichk v0.3.3 // indirect
+	github.com/breml/errchkjson v0.4.1 // indirect
+	github.com/butuzov/ireturn v0.4.1 // indirect
+	github.com/butuzov/mirror v1.3.3 // indirect
+	github.com/catenacyber/perfsprint v0.10.1 // indirect
+	github.com/ccojocar/zxcvbn-go v1.0.4 // indirect
 	github.com/cespare/xxhash v1.1.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/charithe/durationcheck v0.0.11 // indirect
+	github.com/charmbracelet/colorprofile v0.4.3 // indirect
+	github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 // indirect
+	github.com/charmbracelet/x/ansi v0.11.8 // indirect
+	github.com/charmbracelet/x/term v0.2.2 // indirect
+	github.com/charmbracelet/x/termios v0.1.1 // indirect
+	github.com/charmbracelet/x/windows v0.2.2 // indirect
 	github.com/chzyer/readline v1.5.1 // indirect
-	github.com/coreos/go-oidc/v3 v3.17.0 // indirect
+	github.com/ckaznocha/intrange v0.3.1 // indirect
+	github.com/clipperhouse/displaywidth v0.11.0 // indirect
+	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
+	github.com/coreos/go-oidc/v3 v3.21.0 // indirect
 	github.com/coreos/go-systemd/v22 v22.7.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
+	github.com/curioswitch/go-reassign v0.3.0 // indirect
+	github.com/daixiang0/gci v0.13.7 // indirect
+	github.com/dave/dst v0.27.3 // indirect
+	github.com/denis-tingaikin/go-header v0.5.0 // indirect
 	github.com/dgraph-io/badger v1.6.2 // indirect
 	github.com/dgraph-io/badger/v2 v2.2007.4 // indirect
 	github.com/dgraph-io/ristretto v0.1.1 // indirect
 	github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 // indirect
+	github.com/dlclark/regexp2/v2 v2.2.1 // indirect
+	github.com/dnephin/pflag v1.0.7 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/ettle/strcase v0.2.0 // indirect
+	github.com/fatih/color v1.19.0 // indirect
+	github.com/fatih/structtag v1.2.0 // indirect
 	github.com/felixge/httpsnoop v1.1.0 // indirect
-	github.com/go-chi/chi/v5 v5.4.0 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.6 // indirect
+	github.com/firefart/nonamedreturns v1.0.8 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/fzipp/gocyclo v0.6.0 // indirect
+	github.com/ghostiam/protogetter v0.3.21 // indirect
+	github.com/go-chi/chi/v5 v5.5.0 // indirect
+	github.com/go-critic/go-critic v0.14.4 // indirect
 	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-sql-driver/mysql v1.9.3 // indirect
+	github.com/go-toolsmith/astcast v1.1.0 // indirect
+	github.com/go-toolsmith/astcopy v1.1.0 // indirect
+	github.com/go-toolsmith/astequal v1.2.0 // indirect
+	github.com/go-toolsmith/astfmt v1.1.0 // indirect
+	github.com/go-toolsmith/astp v1.1.0 // indirect
+	github.com/go-toolsmith/strparse v1.1.0 // indirect
+	github.com/go-toolsmith/typep v1.1.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
+	github.com/go-xmlfmt/xmlfmt v1.1.3 // indirect
+	github.com/gobwas/glob v0.2.3 // indirect
+	github.com/godoc-lint/godoc-lint v0.11.2 // indirect
+	github.com/gofrs/flock v0.13.0 // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
 	github.com/golang/glog v1.2.5 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
+	github.com/golangci/asciicheck v0.5.0 // indirect
+	github.com/golangci/canonicalheader v0.0.0-20260827115959-a25c71c521f6 // indirect
+	github.com/golangci/dupl v0.0.0-20260401084720-c99c5cf5c202 // indirect
+	github.com/golangci/go-printf-func-name v0.1.1 // indirect
+	github.com/golangci/gofmt v0.0.0-20260820135601-e84e05053792 // indirect
+	github.com/golangci/golangci-lint/v2 v2.13.2 // indirect
+	github.com/golangci/golines v0.15.0 // indirect
+	github.com/golangci/misspell v0.8.0 // indirect
+	github.com/golangci/plugin-module-register v0.1.2 // indirect
+	github.com/golangci/revgrep v0.8.0 // indirect
+	github.com/golangci/rowserrcheck v0.0.0-20260419091836-c5f79b8a11ba // indirect
+	github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e // indirect
+	github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e // indirect
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/certificate-transparency-go v1.3.2 // indirect
 	github.com/google/go-tpm-tools v0.4.11 // indirect
 	github.com/google/go-tspi v0.3.0 // indirect
+	github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 // indirect
 	github.com/google/s2a-go v0.1.11 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.23 // indirect
-	github.com/googleapis/gax-go/v2 v2.26.2 // indirect
+	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.24 // indirect
+	github.com/googleapis/gax-go/v2 v2.27.0 // indirect
+	github.com/gordonklaus/ineffassign v0.2.0 // indirect
+	github.com/gostaticanalysis/analysisutil v0.7.1 // indirect
+	github.com/gostaticanalysis/comment v1.5.0 // indirect
+	github.com/gostaticanalysis/forcetypeassert v0.2.0 // indirect
+	github.com/gostaticanalysis/nilerr v0.1.2 // indirect
+	github.com/hashicorp/go-immutable-radix/v2 v2.1.0 // indirect
+	github.com/hashicorp/go-version v1.9.0 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
+	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
+	github.com/hexops/gotextdiff v1.0.3 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/pgx/v5 v5.9.2 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
-	github.com/klauspost/compress v1.18.7 // indirect
+	github.com/jgautheron/goconst v1.11.0 // indirect
+	github.com/jjti/go-spancheck v0.6.5 // indirect
+	github.com/julz/importas v0.2.0 // indirect
+	github.com/karamaru-alpha/copyloopvar v1.2.2 // indirect
+	github.com/kisielk/errcheck v1.20.0 // indirect
+	github.com/kkHAIKE/contextcheck v1.1.6 // indirect
+	github.com/klauspost/compress v1.20.3 // indirect
+	github.com/kulti/thelper v0.7.1 // indirect
+	github.com/kunwardeep/paralleltest v1.0.15 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
+	github.com/ldez/exptostd v0.4.5 // indirect
+	github.com/ldez/gomoddirectives v0.9.0 // indirect
+	github.com/ldez/grignotin v0.10.1 // indirect
+	github.com/ldez/structtags v0.6.1 // indirect
+	github.com/ldez/tagliatelle v0.7.2 // indirect
+	github.com/ldez/usetesting v0.5.0 // indirect
+	github.com/leonklingele/grouper v1.1.2 // indirect
+	github.com/lucasb-eyer/go-colorful v1.4.1 // indirect
+	github.com/macabu/inamedparam v0.2.0 // indirect
+	github.com/magiconair/properties v1.8.6 // indirect
+	github.com/manuelarte/embeddedstructfieldcheck v0.4.0 // indirect
+	github.com/manuelarte/funcorder v0.6.0 // indirect
+	github.com/maratori/testableexamples v1.0.1 // indirect
+	github.com/maratori/testpackage v1.1.2 // indirect
+	github.com/matoous/godox v1.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.15 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
+	github.com/mattn/go-runewidth v0.0.24 // indirect
+	github.com/mgechev/revive v1.15.0 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/moricho/tparallel v0.3.2 // indirect
+	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/newrelic/go-agent/v3 v3.42.0 // indirect
+	github.com/nakabonne/nestif v0.3.1 // indirect
+	github.com/newrelic/go-agent/v3 v3.45.0 // indirect
+	github.com/nishanths/exhaustive v0.12.0 // indirect
+	github.com/nishanths/predeclared v0.2.2 // indirect
+	github.com/nunnatsa/ginkgolinter v0.24.0 // indirect
+	github.com/pelletier/go-toml v1.9.5 // indirect
+	github.com/pelletier/go-toml/v2 v2.4.3 // indirect
 	github.com/peterbourgon/diskv/v3 v3.0.1 // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
-	github.com/prometheus/client_golang v1.23.2 // indirect
-	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.67.5 // indirect
-	github.com/prometheus/procfs v0.19.2 // indirect
+	github.com/prometheus/client_golang v1.25.0 // indirect
+	github.com/prometheus/client_model v0.6.3 // indirect
+	github.com/prometheus/common v0.72.0 // indirect
+	github.com/prometheus/procfs v0.22.0 // indirect
+	github.com/quasilyte/go-ruleguard v0.4.5 // indirect
+	github.com/quasilyte/go-ruleguard/dsl v0.3.23 // indirect
+	github.com/quasilyte/gogrep v0.5.0 // indirect
+	github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727 // indirect
+	github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 // indirect
+	github.com/raeperd/recvcheck v0.3.0 // indirect
+	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/ryancurrah/gomodguard v1.4.1 // indirect
+	github.com/ryancurrah/gomodguard/v2 v2.1.3 // indirect
+	github.com/ryanrolds/sqlclosecheck v0.6.0 // indirect
+	github.com/sanposhiho/wastedassign/v2 v2.1.0 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 // indirect
+	github.com/sashamelentyev/interfacebloat v1.1.0 // indirect
+	github.com/sashamelentyev/usestdlibvars v1.29.0 // indirect
 	github.com/schollz/jsonstore v1.1.0 // indirect
+	github.com/securego/gosec/v2 v2.28.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/shurcooL/sanitized_anchor_name v1.0.0 // indirect
 	github.com/sirupsen/logrus v1.10.2 // indirect
+	github.com/sivchari/containedctx v1.0.3 // indirect
+	github.com/smallstep/android-attestation v0.0.0-20260722204520-a51b1564ebda // indirect
 	github.com/smallstep/nosql v0.8.0 // indirect
-	github.com/smallstep/pkcs7 v0.2.1 // indirect
+	github.com/smallstep/pkcs7 v0.2.3 // indirect
 	github.com/smallstep/scep v0.0.0-20250318231241-a25cabb69492 // indirect
+	github.com/sonatard/noctx v0.5.1 // indirect
+	github.com/sourcegraph/go-diff v0.8.0 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.7.0 // indirect
+	github.com/spf13/cobra v1.10.2 // indirect
+	github.com/spf13/jwalterweatherman v1.1.0 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/spf13/viper v1.12.0 // indirect
+	github.com/ssgreg/nlreturn/v2 v2.2.1 // indirect
+	github.com/stbenjam/no-sprintf-host-port v0.3.1 // indirect
+	github.com/stretchr/objx v0.5.3 // indirect
+	github.com/subosito/gotenv v1.4.1 // indirect
+	github.com/tetafro/godot v1.5.6 // indirect
+	github.com/timakin/bodyclose v0.0.0-20260129054331-73d1f95b84b4 // indirect
+	github.com/timonwong/loggercheck v0.11.0 // indirect
+	github.com/tomarrell/wrapcheck/v2 v2.12.0 // indirect
+	github.com/tommy-muehle/go-mnd/v2 v2.5.1 // indirect
+	github.com/ultraware/funlen v0.2.0 // indirect
+	github.com/ultraware/whitespace v0.2.0 // indirect
+	github.com/uudashr/gocognit v1.2.1 // indirect
+	github.com/uudashr/iface v1.5.1 // indirect
 	github.com/weppos/publicsuffix-go v0.20.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
+	github.com/xen0n/gosmopolitan v1.3.0 // indirect
+	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
+	github.com/yagipy/maintidx v1.0.0 // indirect
+	github.com/yeya24/promlinter v0.3.0 // indirect
+	github.com/ykadowak/zerologlint v0.1.5 // indirect
+	gitlab.com/bosi/decorder v0.4.2 // indirect
+	go-simpler.org/musttag v0.14.0 // indirect
+	go-simpler.org/sloglint v0.12.0 // indirect
+	go.augendre.info/arangolint v0.4.0 // indirect
+	go.augendre.info/fatcontext v0.10.0 // indirect
 	go.etcd.io/bbolt v1.4.3 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
-	go.opentelemetry.io/otel v1.45.0 // indirect
-	go.opentelemetry.io/otel/metric v1.45.0 // indirect
-	go.opentelemetry.io/otel/trace v1.45.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	go.opentelemetry.io/otel v1.47.0 // indirect
+	go.opentelemetry.io/otel/log v1.47.0 // indirect
+	go.opentelemetry.io/otel/metric v1.47.0 // indirect
+	go.opentelemetry.io/otel/trace v1.47.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go.uber.org/zap v1.27.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/exp/typeparams v0.0.0-20260811152304-ee035b5b010f // indirect
+	golang.org/x/mod v0.42.0 // indirect
 	golang.org/x/net v0.62.0 // indirect
 	golang.org/x/oauth2 v0.37.0 // indirect
 	golang.org/x/sync v0.24.0 // indirect
+	golang.org/x/telemetry v0.0.0-20261010193011-f71dc92da45e // indirect
 	golang.org/x/text v0.43.0 // indirect
 	golang.org/x/time v0.16.0 // indirect
-	golang.org/x/tools v0.51.0 // indirect
-	google.golang.org/api v0.308.0 // indirect
-	google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d // indirect
+	golang.org/x/tools v0.52.0 // indirect
+	golang.org/x/vuln v1.9.0 // indirect
+	google.golang.org/api v0.310.0 // indirect
+	google.golang.org/genproto v0.0.0-20261012220534-4341edf3f941 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20261012220534-4341edf3f941 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20261019180522-ce908d29299b // indirect
-	google.golang.org/grpc v1.84.0 // indirect
+	google.golang.org/grpc v1.85.0 // indirect
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	gotest.tools/gotestsum v1.13.0 // indirect
+	honnef.co/go/tools v0.8.1 // indirect
 	howett.net/plist v1.0.0 // indirect
+	mvdan.cc/gofumpt v0.11.0 // indirect
+	mvdan.cc/unparam v0.0.0-20260823230713-2fa3d841b0c8 // indirect
+)
+
+tool (
+	github.com/golangci/golangci-lint/v2/cmd/golangci-lint
+	golang.org/x/tools/cmd/goimports
+	golang.org/x/vuln/cmd/govulncheck
+	gotest.tools/gotestsum
 )
diff --git a/go.sum b/go.sum
index 220eca99..9e6bdbd0 100644
--- a/go.sum
+++ b/go.sum
@@ -1,3 +1,9 @@
+4d63.com/gocheckcompilerdirectives v1.4.0 h1:ZLq62rbGWVmQhiZ8kuNVIT/M09xCSTdJz9K3xOdT/CY=
+4d63.com/gocheckcompilerdirectives v1.4.0/go.mod h1:9ZOAiMOjqC/nRwci2fcUXVHUNLG/cH6r6rhUh+jTFtQ=
+4d63.com/gochecknoglobals v0.2.2 h1:H1vdnwnMaZdQW/N+NrkT1SZMTBmcwHe9Vq8lJcYYTtU=
+4d63.com/gochecknoglobals v0.2.2/go.mod h1:lLxwTQjL5eIesRbvnzIP3jZtG140FnTdz+AlMa+ogt0=
+charm.land/lipgloss/v2 v2.0.6 h1:EaGKeuA8FvF+v2BT5VmZd2LoYLaMZJXA5n34th8nCIQ=
+charm.land/lipgloss/v2 v2.0.6/go.mod h1:ipDDJNSGa1hlwDtSfW1s2/xR8Vdhbut4PXh2zEKZd0Q=
 cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
 cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
 cloud.google.com/go/auth v0.24.1-0.20261001053825-dbc26066f70a h1:jW1ZLFy9oa5ai8LOI40z6s+DL1cO/L1KSm9hVGnibn8=
@@ -6,22 +12,46 @@ cloud.google.com/go/auth/oauth2adapt v0.3.0 h1:FY8oSZpCYoUNv6QxVODuMjQz4IlSOVeiQ
 cloud.google.com/go/auth/oauth2adapt v0.3.0/go.mod h1:7+2uCm7++XFO+/lN06c2HXpDXb/NMNn2/UwyBPbTnkk=
 cloud.google.com/go/compute/metadata v0.10.0 h1:pyKMUQSwchgkIBBJGdILqQbs/BNJXqwSA7Ej6LAvvtY=
 cloud.google.com/go/compute/metadata v0.10.0/go.mod h1:rGFHRrIif570kSibjFTMbt6/4/tzgJWFGI/HVol4GIk=
-cloud.google.com/go/iam v1.12.0 h1:Aki3bX9aHUDKPHfnRJfDcTdVedvy6quGBQcTqx3DRXk=
-cloud.google.com/go/iam v1.12.0/go.mod h1:FEZ4lXpADAC2AIpQY7LANNjjwyQ2jK439CI2VaD+sLY=
+cloud.google.com/go/iam v1.14.0 h1:YRIB1/4xxwJ+NfI6RQr1WaOoHHeV0MizJEj940nBXJA=
+cloud.google.com/go/iam v1.14.0/go.mod h1:JTPZfbHdGXJrOYREtkRoFzCDGaBdbA7ILLKO/DDuav0=
 cloud.google.com/go/kms v1.36.0 h1:Yewd4nwxa5IOaYJX0dpfzEM5PMCcg6d2LOdrW7V7bbQ=
 cloud.google.com/go/kms v1.36.0/go.mod h1:BZZ2mD9XlonF2JRr7DVIokrTeHKG/CKde5aSPHqeuS4=
-cloud.google.com/go/longrunning v1.2.0 h1:WjYH3YHBGCxGJP9M4dWGHBfXr/cFIjMkNgWcJj7/iMM=
-cloud.google.com/go/longrunning v1.2.0/go.mod h1:5KMQALFGOCtFoi2xSOA1u3H7WKlhmckgiyFw7+LGQp0=
-cloud.google.com/go/security v1.26.0 h1:xp/htSPHpyqo225Ju6PjNS9jxfcOEQMxnF229Oze62g=
-cloud.google.com/go/security v1.26.0/go.mod h1:nd0i5OHXtJduMt0n6UnEojy7fiTfnfj/PSDeD7LAD+c=
+cloud.google.com/go/longrunning v1.3.0 h1:lZ6c8SJJBmILp/Wnr3vGnBLa0q+cYfSHRCcUfVI2hpI=
+cloud.google.com/go/longrunning v1.3.0/go.mod h1:wpgLxCn+UA3/TZ1bj/fW39mfDpwVlMPu1xKJyoMt7V0=
+cloud.google.com/go/security v1.29.1 h1:irh7axea3e1bgtMa5TGQhbXr7ikZzY5hFicCRKYxfdw=
+cloud.google.com/go/security v1.29.1/go.mod h1:Y0eV8RDggumXx3Aq3l92z/fq+4AFDr0pH/gTqEV88Q4=
+codeberg.org/chavacava/garif v0.2.0 h1:F0tVjhYbuOCnvNcU3YSpO6b3Waw6Bimy4K0mM8y6MfY=
+codeberg.org/chavacava/garif v0.2.0/go.mod h1:P2BPbVbT4QcvLZrORc2T29szK3xEOlnl0GiPTJmEqBQ=
+codeberg.org/polyfloyd/go-errorlint v1.9.0 h1:VkdEEmA1VBpH6ecQoMR4LdphVI3fA4RrCh2an7YmodI=
+codeberg.org/polyfloyd/go-errorlint v1.9.0/go.mod h1:GPRRu2LzVijNn4YkrZYJfatQIdS+TrcK8rL5Xs24qw8=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
+dev.gaijin.team/go/exhaustruct/v4 v4.0.0 h1:873r7aNneqoBB3IaFIzhvt2RFYTuHgmMjoKfwODoI1Y=
+dev.gaijin.team/go/exhaustruct/v4 v4.0.0/go.mod h1:aZ/k2o4Y05aMJtiux15x8iXaumE88YdiB0Ai4fXOzPI=
+dev.gaijin.team/go/exhaustruct/v5 v5.0.3 h1:yOeA7DNjlT8y4yfmN6nWWYYggA13N523YAj9/TXbuTM=
+dev.gaijin.team/go/exhaustruct/v5 v5.0.3/go.mod h1:KwtBsX8nHHH1YxhxkpiBq6bfsmw5WnazWpNvJPHgY9Y=
+dev.gaijin.team/go/golib v0.8.1 h1:JYju4x9BSo+QD/AYeHULVDcvEhiFg8wOi6pT0IaZF5E=
+dev.gaijin.team/go/golib v0.8.1/go.mod h1:c5fu7t1RSGMxSQgcUYO1sODbzsYnOCXJLmHeNG1Eb+0=
 filippo.io/bigmod v0.1.0 h1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=
 filippo.io/bigmod v0.1.0/go.mod h1:OjOXDNlClLblvXdwgFFOQFJEocLhhtai8vGLy0JCZlI=
 filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
 filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
+github.com/4meepo/tagalign v1.4.3 h1:Bnu7jGWwbfpAie2vyl63Zup5KuRv21olsPIha53BJr8=
+github.com/4meepo/tagalign v1.4.3/go.mod h1:00WwRjiuSbrRJnSVeGWPLp2epS5Q/l4UEy0apLLS37c=
+github.com/Abirdcfly/dupword v0.1.8 h1:SrhcUuGsROBuChFxHALRYzyyPODWn9zwghmzPvD9Cd8=
+github.com/Abirdcfly/dupword v0.1.8/go.mod h1:XZrhVnI7YGpsTiWZANSQaBJ4QpL/Tq5vIEdKJJAs9WI=
+github.com/AdminBenni/iota-mixing v1.0.0 h1:Os6lpjG2dp/AE5fYBPAA1zfa2qMdCAWwPMCgpwKq7wo=
+github.com/AdminBenni/iota-mixing v1.0.0/go.mod h1:i4+tpAaB+qMVIV9OK3m4/DAynOd5bQFaOu+2AhtBCNY=
+github.com/AlwxSin/noinlineerr v1.0.6 h1:KAvuxunTe9QxvqrFB7nZTdb/7Wzas4AvifslTnG0Ld8=
+github.com/AlwxSin/noinlineerr v1.0.6/go.mod h1:+QgkkoYrMH7RHvcdxdlI7vYYEdgeoFOVjU9sUhw/rQc=
 github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96 h1:cTp8I5+VIoKjsnZuH8vjyaysT/ses3EvZeaV/1UkF2M=
 github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96/go.mod h1:bOvUY6CB00SOBii9/FifXqc0awNKxLFCL/+pkDPuyl8=
+github.com/Antonboom/errname v1.1.2 h1:dxwONZJua3VB8Xh/VaCjqAcqF645sWWv7xj26zy7tdQ=
+github.com/Antonboom/errname v1.1.2/go.mod h1:YeZIpgLMxT+SNkruGgYkLhzq/9vs3fsolTZegKaKDZI=
+github.com/Antonboom/nilnil v1.1.2 h1:aNlFuJhaEseXe4fHO3xbjXlSeEiQVYa2lEkWD2s2hAY=
+github.com/Antonboom/nilnil v1.1.2/go.mod h1:0ynwvphOLmAuMwTNDyBnDZmSwZoDpcFXmUHmzoHH2WA=
+github.com/Antonboom/testifylint v1.6.4 h1:gs9fUEy+egzxkEbq9P4cpcMB6/G0DYdMeiFS87UiqmQ=
+github.com/Antonboom/testifylint v1.6.4/go.mod h1:YO33FROXX2OoUfwjz8g+gUxQXio5i9qpVy7nXGbxDD4=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3 h1:qgnWTiWs1G7AqcKZegFvkJD1bmXJcaDU3uC0ELSgZ5U=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3/go.mod h1:XtxD48QPInqoj+GMlcRlXHEYsoOxFnP6w2JgIZ9rDS4=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.15.0 h1:w3gDUJlJ0BfBsHH02DCBDwbkmMSXJqBj6nBOCo9iocY=
@@ -40,6 +70,12 @@ github.com/AzureAD/microsoft-authentication-library-for-go v1.10.1 h1:0O6j18nQDo
 github.com/AzureAD/microsoft-authentication-library-for-go v1.10.1/go.mod h1:xdYAf5bjkOpsd3auA8riiJW4vneBubt9caavL7626jQ=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
+github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/ClickHouse/clickhouse-go-linter v1.2.1 h1:zGEKIyd5YL08ieWG/LOUmlau2DxbxPVOfAeo+4Jz3ck=
+github.com/ClickHouse/clickhouse-go-linter v1.2.1/go.mod h1:pLorS7ffPTfuUV9M0SJgfHA/h/WQPQUk2FWG9x74cQ4=
+github.com/Djarvur/go-err113 v0.1.1 h1:eHfopDqXRwAi+YmCUas75ZE0+hoBHJ2GQNLYRSxao4g=
+github.com/Djarvur/go-err113 v0.1.1/go.mod h1:IaWJdYFLg76t2ihfflPZnM1LIQszWOsFDh2hhhAVF6k=
 github.com/GoogleCloudPlatform/confidential-space/server v0.0.0-20260915221818-a6c0685fb9fc h1:LPSfe+IaXHrYCNzEVZ4O48UdwNxtiNIEwKgIyU4Aawg=
 github.com/GoogleCloudPlatform/confidential-space/server v0.0.0-20260915221818-a6c0685fb9fc/go.mod h1:M77DH8QPPCBBzfdwZPIWpAZdDHJZu0icyq6HTZAEojI=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
@@ -50,31 +86,57 @@ github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe
 github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
 github.com/Microsoft/go-winio v0.6.4 h1:kJF2pamtYCWXf0xAT8sAkwKC0pMl2HYBrRPHAqyUc+g=
 github.com/Microsoft/go-winio v0.6.4/go.mod h1:1xl5JXG4ze/m74GH6Dc4Mwxfc3VL5siRVQjIAlHH07U=
+github.com/MirrexOne/unqueryvet v1.5.4 h1:38QOxShO7JmMWT+eCdDMbcUgGCOeJphVkzzRgyLJgsQ=
+github.com/MirrexOne/unqueryvet v1.5.4/go.mod h1:fs9Zq6eh1LRIhsDIsxf9PONVUjYdFHdtkHIgZdJnyPU=
 github.com/OneOfOne/xxhash v1.2.2 h1:KMrpdQIwFcEqXDklaen+P1axHaj9BSKzvpUUfnHldSE=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
+github.com/OpenPeeDeeP/depguard/v2 v2.2.1 h1:vckeWVESWp6Qog7UZSARNqfu/cZqvki8zsuj3piCMx4=
+github.com/OpenPeeDeeP/depguard/v2 v2.2.1/go.mod h1:q4DKzC4UcVaAvcfd41CZh0PWpGgzrVxUYBlgKNGquUo=
+github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
+github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
+github.com/alecthomas/chroma/v2 v2.27.0 h1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v/r5BXYZs=
+github.com/alecthomas/chroma/v2 v2.27.0/go.mod h1:NjJ3ciIgrqBNeIkWZ4e46nseoLDslxU1LmfCoL+wcY8=
+github.com/alecthomas/go-check-sumtype v0.3.1 h1:u9aUvbGINJxLVXiFvHUlPEaD7VDULsrxJb4Aq31NLkU=
+github.com/alecthomas/go-check-sumtype v0.3.1/go.mod h1:A8TSiN3UPRw3laIgWEUOHHLPa6/r9MtoigdlP5h3K/E=
+github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
+github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
+github.com/alexkohler/nakedret/v2 v2.0.6 h1:ME3Qef1/KIKr3kWX3nti3hhgNxw6aqN5pZmQiFSsuzQ=
+github.com/alexkohler/nakedret/v2 v2.0.6/go.mod h1:l3RKju/IzOMQHmsEvXwkqMDzHHvurNQfAgE1eVmT40Q=
+github.com/alexkohler/prealloc v1.1.0 h1:cKGRBqlXw5iyQGLYhrXrDlcHxugXpTq4tQ5c91wkf8M=
+github.com/alexkohler/prealloc v1.1.0/go.mod h1:fT39Jge3bQrfA7nPMDngUfvUbQGQeJyGQnR+913SCig=
+github.com/alfatraining/structtag v1.0.0 h1:2qmcUqNcCoyVJ0up879K614L9PazjBSFruTB0GOFjCc=
+github.com/alfatraining/structtag v1.0.0/go.mod h1:p3Xi5SwzTi+Ryj64DqjLWz7XurHxbGsq6y3ubePJPus=
+github.com/alingse/asasalint v0.0.11 h1:SFwnQXJ49Kx/1GghOFz1XGqHYKp21Kq1nHad/0WQRnw=
+github.com/alingse/asasalint v0.0.11/go.mod h1:nCaoMhw7a9kSJObvQyVzNTPBDbNpdocqrSP7t/cW5+I=
+github.com/alingse/nilnesserr v0.2.0 h1:raLem5KG7EFVb4UIDAXgrv3N2JIaffeKNtcEXkEWd/w=
+github.com/alingse/nilnesserr v0.2.0/go.mod h1:1xJPrXonEtX7wyTq8Dytns5P2hNzoWymVUIaKm4HNFg=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
 github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d h1:Byv0BzEl3/e6D5CLfI0j/7hiIEtvGVFPCZ7Ei2oq8iQ=
 github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/aws/aws-sdk-go-v2 v1.47.4 h1:bTvk6UdSSSvaQsfLVj1JRDEEqj/PDRwGf1KanaRzau0=
-github.com/aws/aws-sdk-go-v2 v1.47.4/go.mod h1:XkrjAZvr705Nytv6PkPUhoSB2W9+vVHBp5oAWpkh8Ak=
+github.com/ashanbrown/forbidigo/v2 v2.3.1 h1:KAZijvQ7zeIBKbhikT4jCm0TLYXC4u78bTiLh/8JROI=
+github.com/ashanbrown/forbidigo/v2 v2.3.1/go.mod h1:2QDkLTzU6TV937eFROamXrW92M3paehdae4HCDCOZCM=
+github.com/ashanbrown/makezero/v2 v2.2.1 h1:A7uU8dgB1PA9aelTxHMfHIQ8Qev8AB3JLxJUBUsejqM=
+github.com/ashanbrown/makezero/v2 v2.2.1/go.mod h1:aEGT/9q3S8DHeE57C88z2a6xydvgx8J5hgXIGWgo0MY=
+github.com/aws/aws-sdk-go-v2 v1.47.5 h1:5yA+A+BiXbDq1ZLbYwPViwhEGDMdR0MEhL8Jh2LnLS4=
+github.com/aws/aws-sdk-go-v2 v1.47.5/go.mod h1:iNIkogrRvFwm+1OQIUOP2lPBtlXZboOIUWiCa+pHEMw=
 github.com/aws/aws-sdk-go-v2/config v1.33.10 h1:RRb0GghYqq2ikMXzfT4r9NO9lVhOld3FIhJJWDIdk+w=
 github.com/aws/aws-sdk-go-v2/config v1.33.10/go.mod h1:BDSA7QGh6yrNQA5Z5aBnHWKMWdJDMD4IOlB4QjYSp5E=
 github.com/aws/aws-sdk-go-v2/credentials v1.20.10 h1:ItSjcLk+2M15RnRxO105uVIqLiVQn8y3gaeHC7W0iqs=
 github.com/aws/aws-sdk-go-v2/credentials v1.20.10/go.mod h1:eO4GlmGXB+gx+zDbhu3IENEFOmjrbVKJtOptJiIhngc=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.4 h1:7ksj/zMap9+831SmNQZkcpmfuATp3DKr4BfLNnBdYXM=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.4/go.mod h1:zhi8vDrD1dj76ysTWS6Ny1y6/EEW1Jrq2y8lzKeoqfs=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.7 h1:fSNAt6hs4qLjb9tMZc6vj3PHlOCYGXK2JjJZ7AW2tf4=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.7/go.mod h1:TMav+EuXQu5kNpZZz/6rIC8xx4mCsW+6AKHrjvOSAsE=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.7 h1:7NS6kqBjkWIN8P/AEdmtyq6eQGAhN1oHTZdzXclpH6Y=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.7/go.mod h1:1PFqtAUsIgF1nEVojzRJSf/v88zjzqrGW+w+UAtkXyQ=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.8 h1:gzIWc3DTPfPbWKrQnmL6BV6WD7NPD1htxzgdk/bQ/Z4=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.8/go.mod h1:vvUA5cDAZWGo4R14FZPZfXfJCmgsafOWEq78Kg0D+ug=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.8 h1:PWv+vG8aCLS8qd+HPdYhK7Vees90aKHWFFQ1AGYD/8E=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.8/go.mod h1:xxPZEpflYHJA12366ZGyq66z9dHPCoeCIu99Jck+MPw=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.7 h1:wYu55QUHARwu9YzeuY5yEJUTsIu8ahkmp1l3QmbzHn8=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.7/go.mod h1:OteEkhFAgFwQtZft/3myWo3tVWxdAo7cwV+7AbcpAtQ=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.22 h1:qHfXn1Tm2Rh8kic/DvdKaiSVlHQRSr5C+rMuBR29D44=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.22/go.mod h1:D4ytxJbGXu82l+2XF0q60bibysf+KkIbWfAOldAQwf8=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.7 h1:6MSlRo7aiUVBftQ8XmW7XIh3EZqCbkN9zI0YlGW8nl0=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.7/go.mod h1:OqapjZfp6VW4YJKKO4l68UdPvS4FIEYuEoq1JNkxCL0=
-github.com/aws/aws-sdk-go-v2/service/kms v1.61.6 h1:FjwjlpoKphz6KCGH5/MnV5sAMuU83QE8c1AAy7ovEIs=
-github.com/aws/aws-sdk-go-v2/service/kms v1.61.6/go.mod h1:hlPq3LmJknBzJ7P5GmOoi6HCL0DWSQp2PvKPuJ+ZS9Q=
+github.com/aws/aws-sdk-go-v2/service/kms v1.62.2 h1:f0+3opcARrLmWoMciHVzlc1Ww8qFXhvrlscmPShpM+s=
+github.com/aws/aws-sdk-go-v2/service/kms v1.62.2/go.mod h1:YVEFrNMhrD35Z6qdvzvpGHDbmFmhZ/Nf58Ubv9dROVU=
 github.com/aws/aws-sdk-go-v2/service/signin v1.10.5 h1:oFsZ3u5PPFSO1YZDGKFgyDuwgpbv/sTmVShEZfRnyaE=
 github.com/aws/aws-sdk-go-v2/service/signin v1.10.5/go.mod h1:P+IzYJeldxO0mHt8fX4cglzexP3akO94C/UuEA2ojP0=
 github.com/aws/aws-sdk-go-v2/service/sso v1.38.5 h1:EYD6E6CsgRQPazaOfZ6suyTgfZjg07HoT4S3qB9Exkg=
@@ -83,13 +145,35 @@ github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.5 h1:v6V0AnJ0aDmivAIie/6iT7sG
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.5/go.mod h1:P2Lqn27Kph9z400MFOYIebFnKjZEwyUIAva6fFFMiRY=
 github.com/aws/aws-sdk-go-v2/service/sts v1.51.5 h1:OuyNaMncYP4ftrvcnOHJ9j3AxO3zsC5C/ewD0HoHdjQ=
 github.com/aws/aws-sdk-go-v2/service/sts v1.51.5/go.mod h1:Bhu66tgvf94uunUSiAc0Ew0avhnpSm0J8Hl1MYocRbo=
-github.com/aws/smithy-go v1.28.6 h1:Pj+/sUviNYjow8ELRtNwKHZ9ECeF+7pATX3+shjLIrw=
-github.com/aws/smithy-go v1.28.6/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/smithy-go v1.28.7 h1:h/n1SHrwVtaDYLz8mR1/Kq4Xh4RaFbFW7bOYckg9mfE=
+github.com/aws/smithy-go v1.28.7/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bitfield/gotestdox v0.2.2 h1:x6RcPAbBbErKLnapz1QeAlf3ospg8efBsedU93CDsnE=
+github.com/bitfield/gotestdox v0.2.2/go.mod h1:D+gwtS0urjBrzguAkTM2wodsTQYFHdpx8eqRJ3N+9pY=
+github.com/bkielbasa/cyclop v1.2.3 h1:faIVMIGDIANuGPWH031CZJTi2ymOQBULs9H21HSMa5w=
+github.com/bkielbasa/cyclop v1.2.3/go.mod h1:kHTwA9Q0uZqOADdupvcFJQtp/ksSnytRMe8ztxG8Fuo=
+github.com/blizzy78/varnamelen v0.8.0 h1:oqSblyuQvFsW1hbBHh1zfwrKe3kcSj0rnXkKzsQ089M=
+github.com/blizzy78/varnamelen v0.8.0/go.mod h1:V9TzQZ4fLJ1DSrjVDfl89H7aMnTvKkApdHeyESmyR7k=
+github.com/bombsimon/wsl/v4 v4.7.0 h1:1Ilm9JBPRczjyUs6hvOPKvd7VL1Q++PL8M0SXBDf+jQ=
+github.com/bombsimon/wsl/v4 v4.7.0/go.mod h1:uV/+6BkffuzSAVYD+yGyld1AChO7/EuLrCF/8xTiapg=
+github.com/bombsimon/wsl/v5 v5.9.0 h1:WCrgZ7RQnZO5oEwbVTlYgBdU3wL294kR1BSWV8vTfsU=
+github.com/bombsimon/wsl/v5 v5.9.0/go.mod h1:kjo4HiAV5FDkHC8/uzJq9mBffEEd6WT/nvN7DoMovDM=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/boombuler/barcode v1.0.1 h1:NDBbPmhS+EqABEs5Kg3n/5ZNjy73Pz7SIV+KCeqyXcs=
 github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
+github.com/breml/bidichk v0.3.3 h1:WSM67ztRusf1sMoqH6/c4OBCUlRVTKq+CbSeo0R17sE=
+github.com/breml/bidichk v0.3.3/go.mod h1:ISbsut8OnjB367j5NseXEGGgO/th206dVa427kR8YTE=
+github.com/breml/errchkjson v0.4.1 h1:keFSS8D7A2T0haP9kzZTi7o26r7kE3vymjZNeNDRDwg=
+github.com/breml/errchkjson v0.4.1/go.mod h1:a23OvR6Qvcl7DG/Z4o0el6BRAjKnaReoPQFciAl9U3s=
+github.com/butuzov/ireturn v0.4.1 h1:vWb3NO4t77iku/sjCQ/2pHTQeOmxEhjIriJqRLg1Y+I=
+github.com/butuzov/ireturn v0.4.1/go.mod h1:q+DXKzTDV5guNuXLnIab9fKXizTn2miZHLhxH7V/GB4=
+github.com/butuzov/mirror v1.3.3 h1:v0RsWBhfFc1RQqE/f3sHpSttKDtodFn0gFmtYyD4/hA=
+github.com/butuzov/mirror v1.3.3/go.mod h1:h9BzzwYnTiHO0GzgvaTqIg7VSsOUhdIv51cHFFBmX1w=
+github.com/catenacyber/perfsprint v0.10.1 h1:u7Riei30bk46XsG8nknMhKLXG9BcXz3+3tl/WpKm0PQ=
+github.com/catenacyber/perfsprint v0.10.1/go.mod h1:DJTGsi/Zufpuus6XPGJyKOTMELe347o6akPvWG9Zcsc=
+github.com/ccojocar/zxcvbn-go v1.0.4 h1:FWnCIRMXPj43ukfX000kvBZvV6raSxakYr1nzyNrUcc=
+github.com/ccojocar/zxcvbn-go v1.0.4/go.mod h1:3GxGX+rHmueTUMvm5ium7irpyjmm7ikxYFOSJB21Das=
 github.com/ccoveille/go-safecast/v2 v2.0.1 h1:2+mIu3gXtwmWelBia2kkxfB8eP4orTHDH7ClSlWkd6I=
 github.com/ccoveille/go-safecast/v2 v2.0.1/go.mod h1:JIYA4CAR33blIDuE6fSwCp2sz1oOBahXnvmdBhOAABs=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
@@ -97,6 +181,20 @@ github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghf
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/charithe/durationcheck v0.0.11 h1:g1/EX1eIiKS57NTWsYtHDZ/APfeXKhye1DidBcABctk=
+github.com/charithe/durationcheck v0.0.11/go.mod h1:x5iZaixRNl8ctbM+3B2RrPG5t856TxRyVQEnbIEM2X4=
+github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=
+github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q=
+github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 h1:rdnVWKgJpTVXKuKuJyxDJ+NFJdUaUqGvyGy61OcvlbA=
+github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886/go.mod h1:nAw0d9PhFp1qdzi2xhQU5YOu5sVpDIHWlaW2Uz/bCro=
+github.com/charmbracelet/x/ansi v0.11.8 h1:JMFwp0CgDC2+jcOB162HH5k7I3FVbgFSMMYg7dSPBQQ=
+github.com/charmbracelet/x/ansi v0.11.8/go.mod h1:ZNN+3mXny/516oTQPLMPIBeSINvNJJQ8uQXDgbeJxY0=
+github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
+github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI=
+github.com/charmbracelet/x/termios v0.1.1 h1:o3Q2bT8eqzGnGPOYheoYS8eEleT5ZVNYNy8JawjaNZY=
+github.com/charmbracelet/x/termios v0.1.1/go.mod h1:rB7fnv1TgOPOyyKRJ9o+AsTU/vK5WHJ2ivHeut/Pcwo=
+github.com/charmbracelet/x/windows v0.2.2 h1:IofanmuvaxnKHuV04sC0eBy/smG6kIKrWG2/jYn2GuM=
+github.com/charmbracelet/x/windows v0.2.2/go.mod h1:/8XtdKZzedat74NQFn0NGlGL4soHB0YQZrETF96h75k=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/logex v1.2.1 h1:XHDu3E6q+gdHgsdTPH6ImJMIp436vR6MPtH8gP05QzM=
 github.com/chzyer/logex v1.2.1/go.mod h1:JLbx6lG2kDbNRFnfkgvh4eRJRPX1QCoOIWomwysCBrQ=
@@ -106,20 +204,39 @@ github.com/chzyer/readline v1.5.1/go.mod h1:Eh+b79XXUwfKfcPLepksvw2tcLE/Ct21YObk
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/chzyer/test v1.0.0 h1:p3BQDXSxOhOG0P9z6/hGnII4LGiEPOYBhs8asl/fC04=
 github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38GC8=
+github.com/ckaznocha/intrange v0.3.1 h1:j1onQyXvHUsPWujDH6WIjhyH26gkRt/txNlV7LspvJs=
+github.com/ckaznocha/intrange v0.3.1/go.mod h1:QVepyz1AkUoFQkpEqksSYpNpUo3c5W7nWh/s6SHIJJk=
+github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8=
+github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0=
+github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
+github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik=
 github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4=
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
-github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc=
-github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8=
+github.com/coreos/go-oidc/v3 v3.21.0 h1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=
+github.com/coreos/go-oidc/v3 v3.21.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=
 github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/coreos/go-systemd/v22 v22.7.0 h1:LAEzFkke61DFROc7zNLX/WA2i5J8gYqe0rSj9KI28KA=
 github.com/coreos/go-systemd/v22 v22.7.0/go.mod h1:xNUYtjHu2EDXbsxz1i41wouACIwT7Ybq9o0BQhMwD0w=
 github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
 github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/curioswitch/go-reassign v0.3.0 h1:dh3kpQHuADL3cobV/sSGETA8DOv457dwl+fbBAhrQPs=
+github.com/curioswitch/go-reassign v0.3.0/go.mod h1:nApPCCTtqLJN/s8HfItCcKV0jIPwluBOvZP+dsJGA88=
+github.com/daixiang0/gci v0.13.7 h1:+0bG5eK9vlI08J+J/NWGbWPTNiXPG4WhNLJOkSxWITQ=
+github.com/daixiang0/gci v0.13.7/go.mod h1:812WVN6JLFY9S6Tv76twqmNqevN0pa3SX3nih0brVzQ=
+github.com/dave/dst v0.27.3 h1:P1HPoMza3cMEquVf9kKy8yXsFirry4zEnWOdYPOoIzY=
+github.com/dave/dst v0.27.3/go.mod h1:jHh6EOibnHgcUW3WjKHisiooEkYwqpHLBSX1iOBhEyc=
+github.com/dave/jennifer v1.7.1 h1:B4jJJDHelWcDhlRQxWeo0Npa/pYKBLrirAQoTN45txo=
+github.com/dave/jennifer v1.7.1/go.mod h1:nXbxhEmQfOZhWml3D1cDK5M1FLnMSozpbFN/m3RmGZc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/denis-tingaikin/go-header v0.5.0 h1:SRdnP5ZKvcO9KKRP1KJrhFR3RrlGuD+42t4429eC9k8=
+github.com/denis-tingaikin/go-header v0.5.0/go.mod h1:mMenU5bWrok6Wl2UsZjy+1okegmwQ3UgWl4V1D8gjlY=
 github.com/dgraph-io/badger v1.6.2 h1:mNw0qs90GVgGGWylh0umH5iag1j6n/PeJtNvL6KY/x8=
 github.com/dgraph-io/badger v1.6.2/go.mod h1:JW2yswe3V058sS0kZ2h/AXeDSqFjxnZcRrVH//y2UQE=
 github.com/dgraph-io/badger/v2 v2.2007.4 h1:TRWBQg8UrlUhaFdco01nO2uXwzKS7zd+HVdwV/GHc4o=
@@ -131,34 +248,87 @@ github.com/dgraph-io/ristretto v0.1.1/go.mod h1:S1GPSBCYCIhmVNfcth17y2zZtQT6wzkz
 github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
 github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 h1:fAjc9m62+UWV/WAFKLNi6ZS0675eEUC9y3AlwSbQu1Y=
 github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
+github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
+github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dlclark/regexp2/v2 v2.2.1 h1:mf4KkFUj0gJuarK8P+LgiS+Lit7m9N1yAwEfPbee7R0=
+github.com/dlclark/regexp2/v2 v2.2.1/go.mod h1:avUrQvPaLz2DrFNHJF0taWAFFX2C1GMSSoeiqFjcBmU=
+github.com/dnephin/pflag v1.0.7 h1:oxONGlWxhmUct0YzKTgrpQv9AUA1wtPBn7zuSjJqptk=
+github.com/dnephin/pflag v1.0.7/go.mod h1:uxE91IoWURlOiTUIA8Mq5ZZkAv3dPUfZNaT80Zm7OQE=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
-github.com/envoyproxy/go-control-plane/envoy v1.37.0 h1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ=
-github.com/envoyproxy/go-control-plane/envoy v1.37.0/go.mod h1:DReE9MMrmecPy+YvQOAOHNYMALuowAnbjjEMkkWOi6A=
+github.com/envoyproxy/go-control-plane/envoy v1.39.1-0.20260819172001-e6e3fd93e4be h1:SWe0x6yfglnxuvOiYgTTnNq7QD/yvqthOh1RBI8Bj8w=
+github.com/envoyproxy/go-control-plane/envoy v1.39.1-0.20260819172001-e6e3fd93e4be/go.mod h1:PYEOlng9XcrulfyWpm49jECTPV0LT4q8cO7fLW/xwgk=
 github.com/envoyproxy/protoc-gen-validate v1.3.3 h1:MVQghNeW+LZcmXe7SY1V36Z+WFMDjpqGAGacLe2T0ds=
 github.com/envoyproxy/protoc-gen-validate v1.3.3/go.mod h1:TsndJ/ngyIdQRhMcVVGDDHINPLWB7C82oDArY51KfB0=
+github.com/ettle/strcase v0.2.0 h1:fGNiVF21fHXpX1niBgk0aROov1LagYsOwV/xqKDKR/Q=
+github.com/ettle/strcase v0.2.0/go.mod h1:DajmHElDSaX76ITe3/VHVyMin4LWSJN5Z909Wp+ED1A=
+github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
+github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
+github.com/fatih/structtag v1.2.0 h1:/OdNE99OxoI/PqaW/SuSK9uxxT3f/tcSZgon/ssNSx4=
+github.com/fatih/structtag v1.2.0/go.mod h1:mBJUNpUnHmRKrKlQQlmCrh5PuhftFbNv8Ys4/aAZl94=
 github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
 github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
+github.com/firefart/nonamedreturns v1.0.8 h1:iB32Dl17zJl1zlVEj/WlUWgx0HiRyQ85OUw1WHa4/II=
+github.com/firefart/nonamedreturns v1.0.8/go.mod h1:vxFNvm5AfP/8rgAKFzYmnqx0yp1HjrYsErZ9pHPTznA=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/fxamacker/cbor/v2 v2.10.0 h1:HVF3T5vYwLqO81ebPirWEPNv2SMrUMD3HLnKgEr6uWE=
 github.com/fxamacker/cbor/v2 v2.10.0/go.mod h1:uSwlToFuT9BZAKRxxVm3qQC8DR4tlWl7D6pf20iRYH4=
-github.com/go-chi/chi/v5 v5.4.0 h1:+ufzvFTGKyin26Or5DLrlIDq4ygIDBVcj7oVNeeaYFE=
-github.com/go-chi/chi/v5 v5.4.0/go.mod h1:d1IG7GtKPSjPyBP365PH8sAGVHk3qfB/IhjFNRH1wWM=
-github.com/go-jose/go-jose/v3 v3.0.5 h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=
-github.com/go-jose/go-jose/v3 v3.0.5/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
-github.com/go-jose/go-jose/v4 v4.1.6 h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=
-github.com/go-jose/go-jose/v4 v4.1.6/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/fzipp/gocyclo v0.6.0 h1:lsblElZG7d3ALtGMx9fmxeTKZaLLpU8mET09yN4BBLo=
+github.com/fzipp/gocyclo v0.6.0/go.mod h1:rXPyn8fnlpa0R2csP/31uerbiVBugk5whMdlyaLkLoA=
+github.com/ghostiam/protogetter v0.3.21 h1:EeWTGvL/Eyosp653hiWb6Byx4b69iJC4/E+za7vQHoI=
+github.com/ghostiam/protogetter v0.3.21/go.mod h1:iAKSpyoHwYzay+OpjoWgwzRtPFthEfuUvmlomTThck0=
+github.com/go-chi/chi/v5 v5.5.0 h1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg=
+github.com/go-chi/chi/v5 v5.5.0/go.mod h1:d1IG7GtKPSjPyBP365PH8sAGVHk3qfB/IhjFNRH1wWM=
+github.com/go-critic/go-critic v0.14.4 h1:dSX4C3pWSeuMVxvQh6yG8U0ReSf3YOmKi4nwX5q7n/8=
+github.com/go-critic/go-critic v0.14.4/go.mod h1:xwntfW6SYAd7h1OqDzmN6hBX/JxsEKl5up/Y2bsxgVQ=
+github.com/go-jose/go-jose/v4 v4.1.9 h1:pKfeQkig1NmgK4hJrZYXLEYURXfoJB61Larw0uIW4gY=
+github.com/go-jose/go-jose/v4 v4.1.9/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
 github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474=
+github.com/go-quicktest/qt v1.102.0/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI=
 github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
 github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
+github.com/go-toolsmith/astcast v1.1.0 h1:+JN9xZV1A+Re+95pgnMgDboWNVnIMMQXwfBwLRPgSC8=
+github.com/go-toolsmith/astcast v1.1.0/go.mod h1:qdcuFWeGGS2xX5bLM/c3U9lewg7+Zu4mr+xPwZIB4ZU=
+github.com/go-toolsmith/astcopy v1.1.0 h1:YGwBN0WM+ekI/6SS6+52zLDEf8Yvp3n2seZITCUBt5s=
+github.com/go-toolsmith/astcopy v1.1.0/go.mod h1:hXM6gan18VA1T/daUEHCFcYiW8Ai1tIwIzHY6srfEAw=
+github.com/go-toolsmith/astequal v1.0.3/go.mod h1:9Ai4UglvtR+4up+bAD4+hCj7iTo4m/OXVTSLnCyTAx4=
+github.com/go-toolsmith/astequal v1.1.0/go.mod h1:sedf7VIdCL22LD8qIvv7Nn9MuWJruQA/ysswh64lffQ=
+github.com/go-toolsmith/astequal v1.2.0 h1:3Fs3CYZ1k9Vo4FzFhwwewC3CHISHDnVUPC4x0bI2+Cw=
+github.com/go-toolsmith/astequal v1.2.0/go.mod h1:c8NZ3+kSFtFY/8lPso4v8LuJjdJiUFVnSuU3s0qrrDY=
+github.com/go-toolsmith/astfmt v1.1.0 h1:iJVPDPp6/7AaeLJEruMsBUlOYCmvg0MoCfJprsOmcco=
+github.com/go-toolsmith/astfmt v1.1.0/go.mod h1:OrcLlRwu0CuiIBp/8b5PYF9ktGVZUjlNMV634mhwuQ4=
+github.com/go-toolsmith/astp v1.1.0 h1:dXPuCl6u2llURjdPLLDxJeZInAeZ0/eZwFJmqZMnpQA=
+github.com/go-toolsmith/astp v1.1.0/go.mod h1:0T1xFGz9hicKs8Z5MfAqSUitoUYS30pDMsRVIDHs8CA=
+github.com/go-toolsmith/pkgload v1.2.2 h1:0CtmHq/02QhxcF7E9N5LIFcYFsMR5rdovfqTtRKkgIk=
+github.com/go-toolsmith/pkgload v1.2.2/go.mod h1:R2hxLNRKuAsiXCo2i5J6ZQPhnPMOVtU+f0arbFPWCus=
+github.com/go-toolsmith/strparse v1.0.0/go.mod h1:YI2nUKP9YGZnL/L1/DLFBfixrcjslWct4wyljWhSRy8=
+github.com/go-toolsmith/strparse v1.1.0 h1:GAioeZUK9TGxnLS+qfdqNbA4z0SSm5zVNtCQiyP2Bvw=
+github.com/go-toolsmith/strparse v1.1.0/go.mod h1:7ksGy58fsaQkGQlY8WVoBFNyEPMGuJin1rfoPS4lBSQ=
+github.com/go-toolsmith/typep v1.1.0 h1:fIRYDyF+JywLfqzyhdiHzRop/GQDxxNhLGQ6gFUNHus=
+github.com/go-toolsmith/typep v1.1.0/go.mod h1:fVIw+7zjdsMxDA3ITWnH1yOiw1rnTQKCsF/sk2H/qig=
+github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
+github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-xmlfmt/xmlfmt v1.1.3 h1:t8Ey3Uy7jDSEisW2K3somuMKIpzktkWptA0iFCnRUWY=
+github.com/go-xmlfmt/xmlfmt v1.1.3/go.mod h1:aUCEOzzezBEjDBbFBoSiya/gduyIiWYRP6CnSFIV8AM=
+github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
+github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
+github.com/godoc-lint/godoc-lint v0.11.2 h1:Bp0FkJWoSdNsBikdNgIcgtaoo+xz6I/Y9s5WSBQUeeM=
+github.com/godoc-lint/godoc-lint v0.11.2/go.mod h1:iVpGdL1JCikNH2gGeAn3Hh+AgN5Gx/I/cxV+91L41jo=
+github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
+github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
 github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
 github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
@@ -170,13 +340,43 @@ github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6
 github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/golangci/asciicheck v0.5.0 h1:jczN/BorERZwK8oiFBOGvlGPknhvq0bjnysTj4nUfo0=
+github.com/golangci/asciicheck v0.5.0/go.mod h1:5RMNAInbNFw2krqN6ibBxN/zfRFa9S6tA1nPdM0l8qQ=
+github.com/golangci/canonicalheader v0.0.0-20260827115959-a25c71c521f6 h1:fVLolA3dG6s0brGetsiDAtcnpMSwVa2LqXJEw/9RJG4=
+github.com/golangci/canonicalheader v0.0.0-20260827115959-a25c71c521f6/go.mod h1:1xo+NFW5S+bEf2DKXhaxuzvcDN5AR6o/KMwvqC5Mkpo=
+github.com/golangci/dupl v0.0.0-20260401084720-c99c5cf5c202 h1:CbTB8KpqnViI6lIXxp03Oclc4VFHi3K4BWC1TacsZ+A=
+github.com/golangci/dupl v0.0.0-20260401084720-c99c5cf5c202/go.mod h1:NUw9Zr2Sy7+HxzdjIULge71wI6yEg1lWQr7Evcu8K0E=
+github.com/golangci/go-printf-func-name v0.1.1 h1:hIYTFJqAGp1iwoIfsNTpoq1xZAarogrvjO9AfiW3B4U=
+github.com/golangci/go-printf-func-name v0.1.1/go.mod h1:Es64MpWEZbh0UBtTAICOZiB+miW53w/K9Or/4QogJss=
+github.com/golangci/gofmt v0.0.0-20260820135601-e84e05053792 h1:WL8YKrt3UbOBqSRU7GpP5BTtQTMWtVtj+mfPijgZeIg=
+github.com/golangci/gofmt v0.0.0-20260820135601-e84e05053792/go.mod h1:te5hX0dW4C5r6YbXs+6ysNr8Q5UTmdIqGbb+mlFiYmA=
+github.com/golangci/golangci-lint/v2 v2.13.2 h1:bCyq3E4vo9qwzifjpzJqYndEt7Ncva80qkk8G2B4TXU=
+github.com/golangci/golangci-lint/v2 v2.13.2/go.mod h1:5xaMd1kAxV7GSBPEyngw8gnnjoRocqW9UVKdBR6627w=
+github.com/golangci/golines v0.15.0 h1:Qnph25g8Y1c5fdo1X7GaRDGgnMHgnxh4Gk4VfPTtRx0=
+github.com/golangci/golines v0.15.0/go.mod h1:AZjXd23tbHMpowhtnGlj9KCNsysj72aeZVVHnVcZx10=
+github.com/golangci/misspell v0.8.0 h1:qvxQhiE2/5z+BVRo1kwYA8yGz+lOlu5Jfvtx2b04Jbg=
+github.com/golangci/misspell v0.8.0/go.mod h1:WZyyI2P3hxPY2UVHs3cS8YcllAeyfquQcKfdeE9AFVg=
+github.com/golangci/plugin-module-register v0.1.2 h1:e5WM6PO6NIAEcij3B053CohVp3HIYbzSuP53UAYgOpg=
+github.com/golangci/plugin-module-register v0.1.2/go.mod h1:1+QGTsKBvAIvPvoY/os+G5eoqxWn70HYDm2uvUyGuVw=
+github.com/golangci/revgrep v0.8.0 h1:EZBctwbVd0aMeRnNUsFogoyayvKHyxlV3CdUA46FX2s=
+github.com/golangci/revgrep v0.8.0/go.mod h1:U4R/s9dlXZsg8uJmaR1GrloUr14D7qDl8gi2iPXJH8k=
+github.com/golangci/rowserrcheck v0.0.0-20260419091836-c5f79b8a11ba h1:lqtcnSMDuuJdu/LrKWi5RJzpSNLOJXYe/nzQutTI5kg=
+github.com/golangci/rowserrcheck v0.0.0-20260419091836-c5f79b8a11ba/go.mod h1:sCBNcpRmhJCtbFGz49+IM3ETTFf7QdJ30AeYCd43NKk=
+github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e h1:ai0EfmVYE2bRA5htgAG9r7s3tHsfjIhN98WshBTJ9jM=
+github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e/go.mod h1:Vrn4B5oR9qRwM+f54koyeH3yzphlecwERs0el27Fr/s=
+github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e h1:gD6P7NEo7Eqtt0ssnqSJNNndxe69DOQ24A5h7+i3KpM=
+github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e/go.mod h1:h+wZwLjUTJnm/P2rwlbJdRPZXOzaT36/FwnPnY2inzc=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 github.com/google/certificate-transparency-go v1.0.21/go.mod h1:QeJfpSbVSfYc7RgB3gJFj9cbuQMMchQxrWXz8Ruopmg=
 github.com/google/certificate-transparency-go v1.3.2 h1:9ahSNZF2o7SYMaKaXhAumVEzXB2QaayzII9C8rv7v+A=
 github.com/google/certificate-transparency-go v1.3.2/go.mod h1:H5FpMUaGa5Ab2+KCYsxg6sELw3Flkl7pGZzWdBoYLXs=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmdtest v0.4.1-0.20220921163831-55ab3332a786 h1:rcv+Ippz6RAtvaGgKxc+8FQIpxHgsF+HBzPyYL2cyVU=
+github.com/google/go-cmdtest v0.4.1-0.20220921163831-55ab3332a786/go.mod h1:apVn/GCasLZUVpAJ6oWAuyP7Ne7CEsQbTnc0plM3m+o=
+github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
@@ -196,18 +396,53 @@ github.com/google/go-tspi v0.3.0 h1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=
 github.com/google/go-tspi v0.3.0/go.mod h1:xfMGI3G0PhxCdNVcYr1C4C+EizojDg/TXuX5by8CiHI=
 github.com/google/logger v1.1.1 h1:+6Z2geNxc9G+4D4oDO9njjjn2d0wN5d7uOo0vOIW1NQ=
 github.com/google/logger v1.1.1/go.mod h1:BkeJZ+1FhQ+/d087r4dzojEg1u2ZX+ZqG1jTUrLM+zQ=
+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
+github.com/google/renameio v0.1.0 h1:GOZbcHa3HfsPKPlmyPyN2KEohoMXOhdMbHrvbpl2QaA=
+github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/s2a-go v0.1.11 h1:7v1V1TraNGP63WptsAkNqr2w8jgm4vM6A6qx6Lsw9iM=
 github.com/google/s2a-go v0.1.11/go.mod h1:pz4tyvwXvJLLbyrkh6FW1eS2zPUXMaTmyNhYtyP2tNw=
+github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
+github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.23 h1:J+VGF1wjAM2dU2kKUXZxJdDppRLReWP7KWcclfngQhc=
-github.com/googleapis/enterprise-certificate-proxy v0.3.23/go.mod h1:Y8NO/15GNLkrXI3OR5xOFmeU3XLX1sLSdtlXgJ0zmIw=
-github.com/googleapis/gax-go/v2 v2.26.2 h1:ydkmNXxj7bEmmeK5AihkKnWxyOyBR9TDebvp5L5izk8=
-github.com/googleapis/gax-go/v2 v2.26.2/go.mod h1:sMKqnMesnKH+3wiRJROcttA+cJoZoGbZl1vDQ8XYtGk=
+github.com/googleapis/enterprise-certificate-proxy v0.3.24 h1:G9iCJIY+AYVmUskKdjX8FVy7sG+nbzjOQ41cvlmhcvg=
+github.com/googleapis/enterprise-certificate-proxy v0.3.24/go.mod h1:hEjCmnoakQzv5ImLUp6alkY7XgLlNoAxwTXmhHHNIsI=
+github.com/googleapis/gax-go/v2 v2.27.0 h1:qe2iQOUzxb3fd6x6ewpIEixPQhJ+0Ihc/RRZhKA/2g0=
+github.com/googleapis/gax-go/v2 v2.27.0/go.mod h1:RofiqDw3ehcG4L0H1zO3D2Itpwd3/uS/7wdmbNDF1DE=
+github.com/gordonklaus/ineffassign v0.2.0 h1:Uths4KnmwxNJNzq87fwQQDDnbNb7De00VOk9Nu0TySs=
+github.com/gordonklaus/ineffassign v0.2.0/go.mod h1:TIpymnagPSexySzs7F9FnO1XFTy8IT3a59vmZp5Y9Lw=
+github.com/gostaticanalysis/analysisutil v0.7.1 h1:ZMCjoue3DtDWQ5WyU16YbjbQEQ3VuzwxALrpYd+HeKk=
+github.com/gostaticanalysis/analysisutil v0.7.1/go.mod h1:v21E3hY37WKMGSnbsw2S/ojApNWb6C1//mXO48CXbVc=
+github.com/gostaticanalysis/comment v1.4.2/go.mod h1:KLUTGDv6HOCotCH8h2erHKmpci2ZoR8VPu34YA2uzdM=
+github.com/gostaticanalysis/comment v1.5.0 h1:X82FLl+TswsUMpMh17srGRuKaaXprTaytmEpgnKIDu8=
+github.com/gostaticanalysis/comment v1.5.0/go.mod h1:V6eb3gpCv9GNVqb6amXzEUX3jXLVK/AdA+IrAMSqvEc=
+github.com/gostaticanalysis/forcetypeassert v0.2.0 h1:uSnWrrUEYDr86OCxWa4/Tp2jeYDlogZiZHzGkWFefTk=
+github.com/gostaticanalysis/forcetypeassert v0.2.0/go.mod h1:M5iPavzE9pPqWyeiVXSFghQjljW1+l/Uke3PXHS6ILY=
+github.com/gostaticanalysis/nilerr v0.1.2 h1:S6nk8a9N8g062nsx63kUkF6AzbHGw7zzyHMcpu52xQU=
+github.com/gostaticanalysis/nilerr v0.1.2/go.mod h1:A19UHhoY3y8ahoL7YKz6sdjDtduwTSI4CsymaC2htPA=
+github.com/gostaticanalysis/testutil v0.3.1-0.20210208050101-bfb5c8eec0e4/go.mod h1:D+FIZ+7OahH3ePw/izIEeH5I06eKs1IKI4Xr64/Am3M=
+github.com/gostaticanalysis/testutil v0.5.0 h1:Dq4wT1DdTwTGCQQv3rl3IvD5Ld0E6HiY+3Zh0sUGqw8=
+github.com/gostaticanalysis/testutil v0.5.0/go.mod h1:OLQSbuM6zw2EvCcXTz1lVq5unyoNft372msDY0nY5Hs=
+github.com/hashicorp/go-immutable-radix/v2 v2.1.0 h1:CUW5RYIcysz+D3B+l1mDeXrQ7fUvGGCwJfdASSzbrfo=
+github.com/hashicorp/go-immutable-radix/v2 v2.1.0/go.mod h1:hgdqLXA4f6NIjRVisM1TJ9aOJVNRqKZj+xDGF6m7PBw=
+github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
+github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-version v1.2.1/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/go-version v1.9.0 h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaXPSCnA=
+github.com/hashicorp/go-version v1.9.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
+github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
+github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
+github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
 github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
@@ -217,11 +452,23 @@ github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
+github.com/jgautheron/goconst v1.11.0 h1:KgN90z5qXt5f0Uzf3cWXev3hfMMFUyNeKdpkSBRvLDk=
+github.com/jgautheron/goconst v1.11.0/go.mod h1:0p+wv1lFOiUr0IlNNT1nrm6+8DB8u2sU6KHGzFRXHDc=
+github.com/jjti/go-spancheck v0.6.5 h1:lmi7pKxa37oKYIMScialXUK6hP3iY5F1gu+mLBPgYB8=
+github.com/jjti/go-spancheck v0.6.5/go.mod h1:aEogkeatBrbYsyW6y5TgDfihCulDYciL1B7rG2vSsrU=
+github.com/julz/importas v0.2.0 h1:y+MJN/UdL63QbFJHws9BVC5RpA2iq0kpjrFajTGivjQ=
+github.com/julz/importas v0.2.0/go.mod h1:pThlt589EnCYtMnmhmRYY/qn9lCf/frPOK+WMx3xiJY=
+github.com/karamaru-alpha/copyloopvar v1.2.2 h1:yfNQvP9YaGQR7VaWLYcfZUlRP2eo2vhExWKxD/fP6q0=
+github.com/karamaru-alpha/copyloopvar v1.2.2/go.mod h1:oY4rGZqZ879JkJMtX3RRkcXRkmUvH0x35ykgaKgsgJY=
 github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU=
 github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k=
+github.com/kisielk/errcheck v1.20.0 h1:9rwHBNKzd4wkDWcROy3DvFGNqEPlkxBg305rvk7HabI=
+github.com/kisielk/errcheck v1.20.0/go.mod h1:O+f80MKNwX8Oor2jwgpeQ9An7uJm+hRSgT+h22knRJU=
+github.com/kkHAIKE/contextcheck v1.1.6 h1:7HIyRcnyzxL9Lz06NGhiKvenXq7Zw6Q0UQu/ttjfJCE=
+github.com/kkHAIKE/contextcheck v1.1.6/go.mod h1:3dDbMRNBFaq8HFXWC1JyvDSPm43CmE6IuHam8Wr0rkg=
 github.com/klauspost/compress v1.12.3/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
-github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=
-github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.20.3 h1:zWNoFqq/lSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=
+github.com/klauspost/compress v1.20.3/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -230,28 +477,100 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kulti/thelper v0.7.1 h1:fI8QITAoFVLx+y+vSyuLBP+rcVIB8jKooNSCT2EiI98=
+github.com/kulti/thelper v0.7.1/go.mod h1:NsMjfQEy6sd+9Kfw8kCP61W1I0nerGSYSFnGaxQkcbs=
+github.com/kunwardeep/paralleltest v1.0.15 h1:ZMk4Qt306tHIgKISHWFJAO1IDQJLc6uDyJMLyncOb6w=
+github.com/kunwardeep/paralleltest v1.0.15/go.mod h1:di4moFqtfz3ToSKxhNjhOZL+696QtJGCFe132CbBLGk=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/ldez/exptostd v0.4.5 h1:kv2ZGUVI6VwRfp/+bcQ6Nbx0ghFWcGIKInkG/oFn1aQ=
+github.com/ldez/exptostd v0.4.5/go.mod h1:QRjHRMXJrCTIm9WxVNH6VW7oN7KrGSht69bIRwvdFsM=
+github.com/ldez/gomoddirectives v0.9.0 h1:2YV/EX7nVlWL4jySusYTzBKHuE3D2fgcRsQuMa3yIoo=
+github.com/ldez/gomoddirectives v0.9.0/go.mod h1:DdZzfm9MdXCjn2/UGYXCFfo+tzrp2Ib4iD2Q0kIJkwE=
+github.com/ldez/grignotin v0.10.1 h1:keYi9rYsgbvqAZGI1liek5c+jv9UUjbvdj3Tbn5fn4o=
+github.com/ldez/grignotin v0.10.1/go.mod h1:UlDbXFCARrXbWGNGP3S5vsysNXAPhnSuBufpTEbwOas=
+github.com/ldez/structtags v0.6.1 h1:bUooFLbXx41tW8SvkfwfFkkjPYvFFs59AAMgVg6DUBk=
+github.com/ldez/structtags v0.6.1/go.mod h1:YDxVSgDy/MON6ariaxLF2X09bh19qL7MtGBN5MrvbdY=
+github.com/ldez/tagliatelle v0.7.2 h1:KuOlL70/fu9paxuxbeqlicJnCspCRjH0x8FW+NfgYUk=
+github.com/ldez/tagliatelle v0.7.2/go.mod h1:PtGgm163ZplJfZMZ2sf5nhUT170rSuPgBimoyYtdaSI=
+github.com/ldez/usetesting v0.5.0 h1:3/QtzZObBKLy1F4F8jLuKJiKBjjVFi1IavpoWbmqLwc=
+github.com/ldez/usetesting v0.5.0/go.mod h1:Spnb4Qppf8JTuRgblLrEWb7IE6rDmUpGvxY3iRrzvDQ=
+github.com/leonklingele/grouper v1.1.2 h1:o1ARBDLOmmasUaNDesWqWCIFH3u7hoFlM84YrjT3mIY=
+github.com/leonklingele/grouper v1.1.2/go.mod h1:6D0M/HVkhs2yRKRFZUoGjeDy7EZTfFBE9gl4kjmIGkA=
+github.com/lucasb-eyer/go-colorful v1.4.1 h1:1EO+WB73+EH8EVbzlrG3KLAfEypQWVHIBqlTf+2hNss=
+github.com/lucasb-eyer/go-colorful v1.4.1/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/macabu/inamedparam v0.2.0 h1:VyPYpOc10nkhI2qeNUdh3Zket4fcZjEWe35poddBCpE=
+github.com/macabu/inamedparam v0.2.0/go.mod h1:+Pee9/YfGe5LJ62pYXqB89lJ+0k5bsR8Wgz/C0Zlq3U=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
+github.com/magiconair/properties v1.8.6 h1:5ibWZ6iY0NctNGWo87LalDlEZ6R41TqbbDamhfG/Qzo=
+github.com/magiconair/properties v1.8.6/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
 github.com/manifoldco/promptui v0.9.0 h1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=
 github.com/manifoldco/promptui v0.9.0/go.mod h1:ka04sppxSGFAtxX0qhlYQjISsg9mR4GWtQEhdbn6Pgg=
+github.com/manuelarte/embeddedstructfieldcheck v0.4.0 h1:3mAIyaGRtjK6EO9E73JlXLtiy7ha80b2ZVGyacxgfww=
+github.com/manuelarte/embeddedstructfieldcheck v0.4.0/go.mod h1:z8dFSyXqp+fC6NLDSljRJeNQJJDWnY7RoWFzV3PC6UM=
+github.com/manuelarte/funcorder v0.6.0 h1:0hBngc4fa1IgNiI65A7sFGkMvoMCc878RjqB5V7rWP0=
+github.com/manuelarte/funcorder v0.6.0/go.mod h1:id3NDhXdQBmeqXH7eVC6Z89xS6JxvZ8kF9xUxpArU/g=
+github.com/maratori/testableexamples v1.0.1 h1:HfOQXs+XgfeRBJ+Wz0XfH+FHnoY9TVqL6Fcevpzy4q8=
+github.com/maratori/testableexamples v1.0.1/go.mod h1:XE2F/nQs7B9N08JgyRmdGjYVGqxWwClLPCGSQhXQSrQ=
+github.com/maratori/testpackage v1.1.2 h1:ffDSh+AgqluCLMXhM19f/cpvQAKygKAJXFl9aUjmbqs=
+github.com/maratori/testpackage v1.1.2/go.mod h1:8F24GdVDFW5Ew43Et02jamrVMNXLUNaOynhDssITGfc=
+github.com/matoous/godox v1.1.0 h1:W5mqwbyWrwZv6OQ5Z1a/DHGMOvXYCBP3+Ht7KMoJhq4=
+github.com/matoous/godox v1.1.0/go.mod h1:jgE/3fUXiTurkdHOLT5WEkThTSuE7yxHv5iWPa80afs=
+github.com/matryer/is v1.4.0 h1:sosSmIWwkYITGrxZ25ULNDeKiMNzFSr4V/eqBQP0PeE=
+github.com/matryer/is v1.4.0/go.mod h1:8I/i5uYgLzgsgEloJE1U6xx5HkBQpAZvepWuujKwMRU=
 github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
 github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
 github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/mattn/go-runewidth v0.0.24 h1:cpokDiIn0MGnhdHwuWnJBITySJ20QyNGnY2kR/ay2DU=
+github.com/mattn/go-runewidth v0.0.24/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
+github.com/mgechev/revive v1.15.0 h1:vJ0HzSBzfNyPbHKolgiFjHxLek9KUijhqh42yGoqZ8Q=
+github.com/mgechev/revive v1.15.0/go.mod h1:LlAKO3QQe9OJ0pVZzI2GPa8CbXGZ/9lNpCGvK4T/a8A=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
+github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
+github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/moricho/tparallel v0.3.2 h1:odr8aZVFA3NZrNybggMkYO3rgPRcqjeQUlBBFVxKHTI=
+github.com/moricho/tparallel v0.3.2/go.mod h1:OQ+K3b4Ln3l2TZveGCywybl68glfLEwFGqvnjok8b+U=
+github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
+github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/newrelic/go-agent/v3 v3.42.0 h1:aA2Ea1RT5eD59LtOS1KGFXSmaDs6kM3Jeqo7PpuQoFQ=
-github.com/newrelic/go-agent/v3 v3.42.0/go.mod h1:sCgxDCVydoKD/C4S8BFxDtmFHvdWHtaIz/a3kiyNB/k=
+github.com/nakabonne/nestif v0.3.1 h1:wm28nZjhQY5HyYPx+weN3Q65k6ilSBxDb8v5S81B81U=
+github.com/nakabonne/nestif v0.3.1/go.mod h1:9EtoZochLn5iUprVDmDjqGKPofoUEBL8U4Ngq6aY7OE=
+github.com/newrelic/go-agent/v3 v3.45.0 h1:6Y/NvrdVOY+UuvGDPytBDqAECuvCb2uvU6k0qq8gxnE=
+github.com/newrelic/go-agent/v3 v3.45.0/go.mod h1:2aY3paC/QaI9wf/qz9iD0lWP5AQ7UQ9Ks35iDA40ndU=
+github.com/nishanths/exhaustive v0.12.0 h1:vIY9sALmw6T/yxiASewa4TQcFsVYZQQRUQJhKRf3Swg=
+github.com/nishanths/exhaustive v0.12.0/go.mod h1:mEZ95wPIZW+x8kC4TgC+9YCUgiST7ecevsVDTgc2obs=
+github.com/nishanths/predeclared v0.2.2 h1:V2EPdZPliZymNAn79T8RkNApBjMmVKh5XRpLm/w98Vk=
+github.com/nishanths/predeclared v0.2.2/go.mod h1:RROzoN6TnGQupbC+lqggsOlcgysk3LMK/HI84Mp280c=
+github.com/nsf/jsondiff v0.0.0-20260207060731-8e8d90c4c0ac h1:4YV96Dzy2csSnhzl14/Qk5YsSrKAQusGsIADDn/4/g8=
+github.com/nsf/jsondiff v0.0.0-20260207060731-8e8d90c4c0ac/go.mod h1:mpRZBD8SJ55OIICQ3iWH0Yz3cjzA61JdqMLoWXeB2+8=
+github.com/nunnatsa/ginkgolinter v0.24.0 h1:Mp0EagluLFP98JatP6nqp/gGEoljNG97uf9AcxcBVy8=
+github.com/nunnatsa/ginkgolinter v0.24.0/go.mod h1:2ZMRuzX6+3XXyY6UZOwb6n+MCocVGbkIsDBC4vuWz5c=
+github.com/onsi/ginkgo/v2 v2.32.0 h1:Hw7s2pVrQo/8Yz5N77qdnpHaoc+c6cC9WIV1Jce+J6E=
+github.com/onsi/ginkgo/v2 v2.32.0/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
+github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
+github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/otiai10/copy v1.2.0/go.mod h1:rrF5dJ5F0t/EWSYODDu4j9/vEeYHMkc8jt0zJChqQWw=
+github.com/otiai10/copy v1.14.0 h1:dCI/t1iTdYGtkvCuBG2BgR6KZa83PTclw4U5n2wAllU=
+github.com/otiai10/copy v1.14.0/go.mod h1:ECfuL02W+/FkTWZWgQqXPWZgW9oeKCSQ5qVfSc4qc4w=
+github.com/otiai10/curr v0.0.0-20150429015615-9b4961190c95/go.mod h1:9qAhocn7zKJG+0mI8eUu6xqkFDYS2kb2saOteoSB3cE=
+github.com/otiai10/curr v1.0.0/go.mod h1:LskTG5wDwr8Rs+nNQ+1LlxRjAtTZZjtJW4rMXl6j4vs=
+github.com/otiai10/mint v1.3.0/go.mod h1:F5AjcsTsWUqX+Na9fpHb52P8pcRX2CI6A3ctIT91xUo=
+github.com/otiai10/mint v1.3.1/go.mod h1:/yxELlJQ0ufhjUwhshSj+wFjZ78CnZ48/1wtmBH1OTc=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
+github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
+github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
+github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdDPYVpY=
+github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/peterbourgon/diskv/v3 v3.0.1 h1:x06SQA46+PKIUftmEujdwSEpIx8kR+M9eLYsUxeYveU=
 github.com/peterbourgon/diskv/v3 v3.0.1/go.mod h1:kJ5Ny7vLdARGU3WUuy6uzO6T0nb/2gWcT1JiBvRmb5o=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
@@ -264,14 +583,28 @@ github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
 github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
-github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
-github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
-github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
-github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
-github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
-github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws=
-github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
+github.com/prometheus/client_golang v1.25.0 h1:cDtW1TcFsMi1RJc8khwCKB4VhzwV04aKqbYtNOXuiK0=
+github.com/prometheus/client_golang v1.25.0/go.mod h1:j2X/4/kaQHLPnmyEU8zjmkndo1T317VpCIQEml8LTKk=
+github.com/prometheus/client_model v0.6.3 h1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=
+github.com/prometheus/client_model v0.6.3/go.mod h1:gpN5P9S7Rr6Yr92PiQ+Ixvhf6JZEkF1dnxsYL2aPBEM=
+github.com/prometheus/common v0.72.0 h1:tAYsE+sPJxIncDAobm4H5aQjmox9ZxEIIqPbiffa8G4=
+github.com/prometheus/common v0.72.0/go.mod h1:77NWqAQ2tXT7BIK40qjJdw5Acrsrg1TlHAnsQi3i6mk=
+github.com/prometheus/procfs v0.22.0 h1:6q9+/JL9IKAPbCmBrv9n5O5Ty3NKnciV5X7YGw0oics=
+github.com/prometheus/procfs v0.22.0/go.mod h1:CvmFr/GVhIjIvWJZW3tgkODBQMRIf0EyWMQLHCHab58=
+github.com/quasilyte/go-ruleguard v0.4.5 h1:AGY0tiOT5hJX9BTdx/xBdoCubQUAE2grkqY2lSwvZcA=
+github.com/quasilyte/go-ruleguard v0.4.5/go.mod h1:Vl05zJ538vcEEwu16V/Hdu7IYZWyKSwIy4c88Ro1kRE=
+github.com/quasilyte/go-ruleguard/dsl v0.3.23 h1:lxjt5B6ZCiBeeNO8/oQsegE6fLeCzuMRoVWSkXC4uvY=
+github.com/quasilyte/go-ruleguard/dsl v0.3.23/go.mod h1:KeCP03KrjuSO0H1kTuZQCWlQPulDV6YMIXmpQss17rU=
+github.com/quasilyte/gogrep v0.5.0 h1:eTKODPXbI8ffJMN+W2aE0+oL0z/nh8/5eNdiO34SOAo=
+github.com/quasilyte/gogrep v0.5.0/go.mod h1:Cm9lpz9NZjEoL1tgZ2OgeUKPIxL1meE7eo60Z6Sk+Ng=
+github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727 h1:TCg2WBOl980XxGFEZSS6KlBGIV0diGdySzxATTWoqaU=
+github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727/go.mod h1:rlzQ04UMyJXu/aOvhd8qT+hvDrFpiwqp8MRXDY9szc0=
+github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 h1:M8mH9eK4OUR4lu7Gd+PU1fV2/qnDNfzT635KRSObncs=
+github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567/go.mod h1:DWNGW8A4Y+GyBgPuaQJuWiy0XYftx4Xm/y5Jqk9I6VQ=
+github.com/raeperd/recvcheck v0.3.0 h1:PM+XYvyxIj3bo+kobJfFTdTuU3Lmfu96mKDbyHDbRt8=
+github.com/raeperd/recvcheck v0.3.0/go.mod h1:PZNwG+HztFYMH2ZPq0Hu3QgkV2yiA6VrtNz9c1fXWJo=
+github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
+github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.16.0 h1:O9DK+vNMDVGLr2BeZqmpLeMjiMNkuXfcqntWbZV6S5g=
 github.com/rogpeppe/go-internal v1.16.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/rs/xid v1.6.0 h1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=
@@ -279,32 +612,55 @@ github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/ryancurrah/gomodguard v1.4.1 h1:eWC8eUMNZ/wM/PWuZBv7JxxqT5fiIKSIyTvjb7Elr+g=
+github.com/ryancurrah/gomodguard v1.4.1/go.mod h1:qnMJwV1hX9m+YJseXEBhd2s90+1Xn6x9dLz11ualI1I=
+github.com/ryancurrah/gomodguard/v2 v2.1.3 h1:E7sz3PJwE9Ba1reVxSpF6XLCPJZ74Kfw/LabTNM4GIA=
+github.com/ryancurrah/gomodguard/v2 v2.1.3/go.mod h1:CQicdLGatWMxLX53JzoBjYlsNZhHbmLv2AVa0s2aivU=
+github.com/ryanrolds/sqlclosecheck v0.6.0 h1:pEyL9okISdg1F1SEpJNlrEotkTGerv5BMk7U4AG0eVg=
+github.com/ryanrolds/sqlclosecheck v0.6.0/go.mod h1:xyX16hsDaCMXHrMJ3JMzGf5OpDfHTOTTQrT7HOFUmeU=
+github.com/sanposhiho/wastedassign/v2 v2.1.0 h1:crurBF7fJKIORrV85u9UUpePDYGWnwvv3+A96WvwXT0=
+github.com/sanposhiho/wastedassign/v2 v2.1.0/go.mod h1:+oSmSC+9bQ+VUAxA66nBb0Z7N8CK7mscKTDYC6aIek4=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/sashamelentyev/interfacebloat v1.1.0 h1:xdRdJp0irL086OyW1H/RTZTr1h/tMEOsumirXcOJqAw=
+github.com/sashamelentyev/interfacebloat v1.1.0/go.mod h1:+Y9yU5YdTkrNvoX0xHc84dxiN1iBi9+G8zZIhPVoNjQ=
+github.com/sashamelentyev/usestdlibvars v1.29.0 h1:8J0MoRrw4/NAXtjQqTHrbW9NN+3iMf7Knkq057v4XOQ=
+github.com/sashamelentyev/usestdlibvars v1.29.0/go.mod h1:8PpnjHMk5VdeWlVb4wCdrB8PNbLqZ3wBZTZWkrpZZL8=
 github.com/schollz/jsonstore v1.1.0 h1:WZBDjgezFS34CHI+myb4s8GGpir3UMpy7vWoCeO0n6E=
 github.com/schollz/jsonstore v1.1.0/go.mod h1:15c6+9guw8vDRyozGjN3FoILt0wpruJk9Pi66vjaZfg=
+github.com/securego/gosec/v2 v2.28.0 h1:ZsSdiDb0AtTpLFVol5z91gbMei9ZiLEPG/pZjZujp7c=
+github.com/securego/gosec/v2 v2.28.0/go.mod h1:lb4/9AHe+lJy/kjWmWRWWsEipvbwGKuxf+tY1Pmjdnk=
+github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
+github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
 github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/sirupsen/logrus v1.10.2 h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=
 github.com/sirupsen/logrus v1.10.2/go.mod h1:SLEg8TqYulVKKfIGHldVp2K2aYz2DKSVBq4g/H5bR7Q=
+github.com/sivchari/containedctx v1.0.3 h1:x+etemjbsh2fB5ewm5FeLNi5bUjK0V8n0RB+Wwfd0XE=
+github.com/sivchari/containedctx v1.0.3/go.mod h1:c1RDvCbnJLtH4lLcYD/GqwiBSSf4F5Qk0xld2rBqzJ4=
 github.com/slackhq/nebula v1.11.2 h1:eP61cSfUuoEVGViD50gZBsAbBLPUAhoNOYewPmEwPG4=
 github.com/slackhq/nebula v1.11.2/go.mod h1:xz3SEyYeEhXY8MDlVu8S3Qt+SjncsSJ8bl4RXUgxtXQ=
+github.com/smallstep/android-attestation v0.0.0-20260722204520-a51b1564ebda h1:IfbkxDvPbdr00RD5kgdzdCkPp4ANOLgXyVI8NkWjQ+I=
+github.com/smallstep/android-attestation v0.0.0-20260722204520-a51b1564ebda/go.mod h1:WEOYAQ4qnt6LhEcreLGA0woxzE8k5e0vjGuIq72J5tw=
 github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262 h1:unQFBIznI+VYD1/1fApl1A+9VcBk+9dcqGfnePY87LY=
 github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262/go.mod h1:MyOHs9Po2fbM1LHej6sBUT8ozbxmMOFG+E+rx/GSGuc=
-github.com/smallstep/certificates v0.30.2 h1:1G3xBi8sJ740iA1mMPW2Svv7EIZKJ4Zf/iQtA5QlN0Y=
-github.com/smallstep/certificates v0.30.2/go.mod h1:oyaE/aEYUGDr+YiCZLAxxP22bOQqcSHTeDgp8Vv2rlY=
+github.com/smallstep/certificates v0.30.3-0.20261105213751-6d5a251fbe01 h1:37RUToHubGV3jBtmuW1I6mwINrVYjljzRbGvg4S2P5s=
+github.com/smallstep/certificates v0.30.3-0.20261105213751-6d5a251fbe01/go.mod h1:5H7gEyq41/ZNlGh/0oyrOwmnZtxDKbN5QuqDOcFtkzU=
 github.com/smallstep/certinfo v1.18.0 h1:q9T0DSkHSmD3gobEqy+3J6HbHpQIOUPEL1IOSvelRIQ=
 github.com/smallstep/certinfo v1.18.0/go.mod h1:OPwtFVAOx29OjOYsVtj9cDliDFywkVYPt+ExDg43kPs=
-github.com/smallstep/cli-utils v0.12.2 h1:lGzM9PJrH/qawbzMC/s2SvgLdJPKDWKwKzx9doCVO+k=
-github.com/smallstep/cli-utils v0.12.2/go.mod h1:uCPqefO29goHLGqFnwk0i8W7XJu18X3WHQFRtOm/00Y=
+github.com/smallstep/cli-utils v0.13.0 h1:yoGBkW9DJJ6cEZS+UhoBPiYDUIXDz3SjAyBKrK7d/EY=
+github.com/smallstep/cli-utils v0.13.0/go.mod h1:1k5tKEGCKpJZHipYTUzN1LhlMW3GoWwlrG7976WDMOY=
 github.com/smallstep/go-attestation v0.4.4-0.20260814222900-a849f4e2cd68 h1:KcK2guFXrE5sX/nvF1b+atHP6DjRB1gCv3ppyTXB2Zk=
 github.com/smallstep/go-attestation v0.4.4-0.20260814222900-a849f4e2cd68/go.mod h1:vNAduivU014fubg6ewygkAvQC0IQVXqdc8vaGl/0er4=
 github.com/smallstep/linkedca v0.26.0 h1:NsxTVo3zI3KwOFFiVodeHtuGgKq0b5kOUXVLjjNTvXY=
 github.com/smallstep/linkedca v0.26.0/go.mod h1:Z8c7EgVrSHNhshIhRnUGfKfE796+TwF2eyErhqANmJQ=
 github.com/smallstep/nosql v0.8.0 h1:FBTCUfKPmWYbrozW+RBKu+fnvbn+zr5rVli/XB4Jp4A=
 github.com/smallstep/nosql v0.8.0/go.mod h1:5dUpNotHLHhOUapP0PLBVVfp3tG1DFC31VRccg+Cqwo=
-github.com/smallstep/pkcs7 v0.2.1 h1:6Kfzr/QizdIuB6LSv8y1LJdZ3aPSfTNhTLqAx9CTLfA=
 github.com/smallstep/pkcs7 v0.2.1/go.mod h1:RcXHsMfL+BzH8tRhmrF1NkkpebKpq3JEM66cOFxanf0=
+github.com/smallstep/pkcs7 v0.2.3 h1:bhoQ3TeZmdoXTatcwxCbk+FMcdsyr0gYrrW2Xq2qr+s=
+github.com/smallstep/pkcs7 v0.2.3/go.mod h1:7STkdKhZaZe4xNEXTtY4j1NGeST1gYM4GA40kC5iqr8=
 github.com/smallstep/scep v0.0.0-20250318231241-a25cabb69492 h1:k23+s51sgYix4Zgbvpmy+1ZgXLjr4ZTkBTqXmpnImwA=
 github.com/smallstep/scep v0.0.0-20250318231241-a25cabb69492/go.mod h1:QQhwLqCS13nhv8L5ov7NgusowENUtXdEzdytjmJHdZQ=
 github.com/smallstep/truststore v0.13.0 h1:90if9htAOblavbMeWlqNLnO9bsjjgVv2hQeQJCi/py4=
@@ -313,21 +669,43 @@ github.com/smallstep/zcrypto v0.0.0-20221001003018-1ab2364d2a91 h1:XE0cgVBMkYPxO
 github.com/smallstep/zcrypto v0.0.0-20221001003018-1ab2364d2a91/go.mod h1:9AA5+s5DF+8sE93nQ7HUalesU2SDqNfvrwn+dls9upw=
 github.com/smallstep/zlint v0.0.0-20220930192201-67fb4aa21910 h1:eIjaqvVEq+8eWaZd56yA7Ux5W6gJ9kqvq9ZWTsp3fkc=
 github.com/smallstep/zlint v0.0.0-20220930192201-67fb4aa21910/go.mod h1:GeHHT7sJDI9ti3oEaFnvx1F4N8n3ZSw2YM1+sbEoxc4=
+github.com/sonatard/noctx v0.5.1 h1:wklWg9c9ZYugOAk7qG4yP4PBrlQsmSLPTvW1K4PRQMs=
+github.com/sonatard/noctx v0.5.1/go.mod h1:64XdbzFb18XL4LporKXp8poqZtPKbCrqQ402CV+kJas=
+github.com/sourcegraph/go-diff v0.8.0 h1:ipIyu4cTsLbIrln4l0qtHA3r0a7gyK4ntKjtQytHhvY=
+github.com/sourcegraph/go-diff v0.8.0/go.mod h1:hWlcO7Al+UZStZAP8rBumHpCK5ZHQ5BXsMls8p4+F5E=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spaolacci/murmur3 v1.1.0 h1:7c1g84S4BPRrfL5Xrdp6fOJ206sU9y293DDHaoy0bLI=
 github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
+github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
+github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cast v1.7.0 h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w=
 github.com/spf13/cast v1.7.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
 github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
+github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk=
+github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
+github.com/spf13/viper v1.12.0 h1:CZ7eSOd3kZoaYDLbXnmzgQI5RlciuXBMA+18HwHRfZQ=
+github.com/spf13/viper v1.12.0/go.mod h1:b6COn30jlNxbm/V2IqWiNWkJ+vZNiMNksliPCiuKtSI=
+github.com/ssgreg/nlreturn/v2 v2.2.1 h1:X4XDI7jstt3ySqGU86YGAURbxw3oTDPK9sPEi6YEwQ0=
+github.com/ssgreg/nlreturn/v2 v2.2.1/go.mod h1:E/iiPB78hV7Szg2YfRgyIrk1AD6JVMTRkkxBiELzh2I=
+github.com/stbenjam/no-sprintf-host-port v0.3.1 h1:AyX7+dxI4IdLBPtDbsGAyqiTSLpCP9hWRrXQDU4Cm/g=
+github.com/stbenjam/no-sprintf-host-port v0.3.1/go.mod h1:ODbZesTCHMVKthBHskvUUexdcNHAQRXk9NpSsL8p/HQ=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
+github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
@@ -338,17 +716,67 @@ github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXl
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
 github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+github.com/subosito/gotenv v1.4.1 h1:jyEFiXpy21Wm81FBN71l9VoMMV8H8jG+qIK3GCpY6Qs=
+github.com/subosito/gotenv v1.4.1/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
+github.com/tenntenn/modver v1.0.1 h1:2klLppGhDgzJrScMpkj9Ujy3rXPUspSjAcev9tSEBgA=
+github.com/tenntenn/modver v1.0.1/go.mod h1:bePIyQPb7UeioSRkw3Q0XeMhYZSMx9B8ePqg6SAMGH0=
+github.com/tenntenn/text/transform v0.0.0-20200319021203-7eef512accb3 h1:f+jULpRQGxTSkNYKJ51yaw6ChIqO+Je8UqsTKN/cDag=
+github.com/tenntenn/text/transform v0.0.0-20200319021203-7eef512accb3/go.mod h1:ON8b8w4BN/kE1EOhwT0o+d62W65a6aPw1nouo9LMgyY=
+github.com/tetafro/godot v1.5.6 h1:IEkrFCwXaYHlOn4mGzGS3F3dkP6m9t0jpwqBFPIkKiA=
+github.com/tetafro/godot v1.5.6/go.mod h1:eOkMrVQurDui411nBY2FA05EYH01r14LuWY/NrVDVcU=
+github.com/timakin/bodyclose v0.0.0-20260129054331-73d1f95b84b4 h1:SiHe5XLTn9sFWJ5pBwJ5FN/4j34q9ZlOAD//kMoMYp0=
+github.com/timakin/bodyclose v0.0.0-20260129054331-73d1f95b84b4/go.mod h1:sDHLK7rb/59v/ZxZ7KtymgcoxuUMxjXq8gtu9VMOK8M=
+github.com/timonwong/loggercheck v0.11.0 h1:jdaMpYBl+Uq9mWPXv1r8jc5fC3gyXx4/WGwTnnNKn4M=
+github.com/timonwong/loggercheck v0.11.0/go.mod h1:HEAWU8djynujaAVX7QI65Myb8qgfcZ1uKbdpg3ZzKl8=
+github.com/tomarrell/wrapcheck/v2 v2.12.0 h1:H/qQ1aNWz/eeIhxKAFvkfIA+N7YDvq6TWVFL27Of9is=
+github.com/tomarrell/wrapcheck/v2 v2.12.0/go.mod h1:AQhQuZd0p7b6rfW+vUwHm5OMCGgp63moQ9Qr/0BpIWo=
+github.com/tommy-muehle/go-mnd/v2 v2.5.1 h1:NowYhSdyE/1zwK9QCLeRb6USWdoif80Ie+v+yU8u1Zw=
+github.com/tommy-muehle/go-mnd/v2 v2.5.1/go.mod h1:WsUAkMJMYww6l/ufffCD3m+P7LEvr8TnZn9lwVDlgzw=
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
+github.com/ultraware/funlen v0.2.0 h1:gCHmCn+d2/1SemTdYMiKLAHFYxTYz7z9VIDRaTGyLkI=
+github.com/ultraware/funlen v0.2.0/go.mod h1:ZE0q4TsJ8T1SQcjmkhN/w+MceuatI6pBFSxxyteHIJA=
+github.com/ultraware/whitespace v0.2.0 h1:TYowo2m9Nfj1baEQBjuHzvMRbp19i+RCcRYrSWoFa+g=
+github.com/ultraware/whitespace v0.2.0/go.mod h1:XcP1RLD81eV4BW8UhQlpaR+SDc2givTvyI8a586WjW8=
 github.com/urfave/cli v1.22.17 h1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=
 github.com/urfave/cli v1.22.17/go.mod h1:b0ht0aqgH/6pBYzzxURyrM4xXNgsoT/n2ZzwQiEhNVo=
+github.com/uudashr/gocognit v1.2.1 h1:CSJynt5txTnORn/DkhiB4mZjwPuifyASC8/6Q0I/QS4=
+github.com/uudashr/gocognit v1.2.1/go.mod h1:acaubQc6xYlXFEMb9nWX2dYBzJ/bIjEkc1zzvyIZg5Q=
+github.com/uudashr/iface v1.5.1 h1:BS3yrgaT55s3dAtJoxuTnsZNbsejq/mVuzp49YDyfBA=
+github.com/uudashr/iface v1.5.1/go.mod h1:5UWoT6SvTdTww/KToRj6clO+n4Kg3/NrAQvgOB+5Ggw=
 github.com/weppos/publicsuffix-go v0.12.0/go.mod h1:z3LCPQ38eedDQSwmsSRW4Y7t2L8Ln16JPQ02lHAdn5k=
 github.com/weppos/publicsuffix-go v0.20.0 h1:59ypvSUbW3Dunc6zVm+v+MmXf2Q6cGiNDkxgRIzEnaA=
 github.com/weppos/publicsuffix-go v0.20.0/go.mod h1:5ZC/Uv3fIEUE0eP6o9+Yg4+5+W8V0/BieMi05feGXVA=
 github.com/weppos/publicsuffix-go/publicsuffix/generator v0.0.0-20220704091424-e0182326a282/go.mod h1:GHfoeIdZLdZmLjMlzBftbTDntahTttUMWjxZwQJhULE=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+github.com/xen0n/gosmopolitan v1.3.0 h1:zAZI1zefvo7gcpbCOrPSHJZJYA9ZgLfJqtKzZ5pHqQM=
+github.com/xen0n/gosmopolitan v1.3.0/go.mod h1:rckfr5T6o4lBtM1ga7mLGKZmLxswUoH1zxHgNXOsEt4=
+github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
+github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
+github.com/yagipy/maintidx v1.0.0 h1:h5NvIsCz+nRDapQ0exNv4aJ0yXSI0420omVANTv3GJM=
+github.com/yagipy/maintidx v1.0.0/go.mod h1:0qNf/I/CCZXSMhsRsrEPDZ+DkekpKLXAJfsTACwgXLk=
+github.com/yeya24/promlinter v0.3.0 h1:JVDbMp08lVCP7Y6NP3qHroGAO6z2yGKQtS5JsjqtoFs=
+github.com/yeya24/promlinter v0.3.0/go.mod h1:cDfJQQYv9uYciW60QT0eeHlFodotkYZlL+YcPQN+mW4=
+github.com/ykadowak/zerologlint v0.1.5 h1:Gy/fMz1dFQN9JZTPjv1hxEk+sRWm05row04Yoolgdiw=
+github.com/ykadowak/zerologlint v0.1.5/go.mod h1:KaUskqF3e/v59oPmdq1U1DnKcuHokl2/K1U4pmIELKg=
+github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+gitlab.com/bosi/decorder v0.4.2 h1:qbQaV3zgwnBZ4zPMhGLW4KZe7A7NwxEhJx39R3shffo=
+gitlab.com/bosi/decorder v0.4.2/go.mod h1:muuhHoaJkA9QLcYHq4Mj8FJUwDZ+EirSHRiaTcTf6T8=
+go-simpler.org/assert v0.9.0 h1:PfpmcSvL7yAnWyChSjOz6Sp6m9j5lyK8Ok9pEL31YkQ=
+go-simpler.org/assert v0.9.0/go.mod h1:74Eqh5eI6vCK6Y5l3PI8ZYFXG4Sa+tkr70OIPJAUr28=
+go-simpler.org/musttag v0.14.0 h1:XGySZATqQYSEV3/YTy+iX+aofbZZllJaqwFWs+RTtSo=
+go-simpler.org/musttag v0.14.0/go.mod h1:uP8EymctQjJ4Z1kUnjX0u2l60WfUdQxCwSNKzE1JEOE=
+go-simpler.org/sloglint v0.12.0 h1:UzWDlLWNE5FLqsvyq3tWYHuQMbqrervOhT8qPl4Mmw4=
+go-simpler.org/sloglint v0.12.0/go.mod h1:jBjjC2bm8rYrs88oTRlFX497kWjJsyZWYoNaXkGRI6I=
+go.augendre.info/arangolint v0.4.0 h1:xSCZjRoS93nXazBSg5d0OGCi9APPLNMmmLrC995tR50=
+go.augendre.info/arangolint v0.4.0/go.mod h1:l+f/b4plABuFISuKnTGD4RioXiCCgghv2xqst/xOvAA=
+go.augendre.info/fatcontext v0.10.0 h1:HhFopmivh8U1+AU7f0kuwUeg2eiIns7YsGQOMHwSJ90=
+go.augendre.info/fatcontext v0.10.0/go.mod h1:pqpGvA9GlrXy+aXkp8L2dKz12Zp4g2FhzcAtwToU+2w=
 go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
 go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
 go.mozilla.org/pkcs7 v0.10.0 h1:jmljzDzNYFzaP1dFlgmCiQml9e+iEMmv8/NNs4evQbg=
@@ -359,30 +787,37 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.6
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI=
-go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
-go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
-go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
-go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
-go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=
-go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA=
-go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=
-go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA=
-go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
-go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
-go.step.sm/crypto v0.91.1 h1:ZMMdj/A2rQ+Zr8hyCo4BHJd++c5T8VQIXJ8Sljg57p0=
-go.step.sm/crypto v0.91.1/go.mod h1:Sin2AcA+BgYfx1Ulku2Rt0NwS1ky22joBoETFTG1fD4=
+go.opentelemetry.io/otel v1.47.0 h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM=
+go.opentelemetry.io/otel v1.47.0/go.mod h1:8wS9O2qfXrYrzp6hIF/HOYJJf/wIhFPhR2xLuP+iXQU=
+go.opentelemetry.io/otel/log v1.47.0 h1:cOTS1CcLbSQeZKanGJ+0JpF/+t4PELi3O3bbl2lqCcI=
+go.opentelemetry.io/otel/log v1.47.0/go.mod h1:9byitSQ5pLC6PpqwGXjqdMKya6ZTswHRZh2vvXT33nw=
+go.opentelemetry.io/otel/metric v1.47.0 h1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY=
+go.opentelemetry.io/otel/metric v1.47.0/go.mod h1:ADGSXxRrXM6bjbvLo535EstVFlPpPYZm4LBKixjDHwU=
+go.opentelemetry.io/otel/sdk v1.47.0 h1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I=
+go.opentelemetry.io/otel/sdk v1.47.0/go.mod h1:VUc24kiOeoGsxG8G9ULx3fWKvB7jMhnGE8Oi607lgR0=
+go.opentelemetry.io/otel/sdk/metric v1.47.0 h1:lfISg2j93VT6yqdk9OfUaZmw/GfcZqCCV3jdXtsPnKw=
+go.opentelemetry.io/otel/sdk/metric v1.47.0/go.mod h1:ypLp+mW1Nt2x+Szt3b5/i1syodyts49lMOwxpDI3VGw=
+go.opentelemetry.io/otel/trace v1.47.0 h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrFNWSrM=
+go.opentelemetry.io/otel/trace v1.47.0/go.mod h1:jNaSLa2PZEYFG6fRjJABAu+bw4FS08uDmPg28lTghu0=
+go.step.sm/crypto v0.92.0 h1:ifhnf9D2X12SokY000OL9GX038hJJ1xfoFzyX7FzgAs=
+go.step.sm/crypto v0.92.0/go.mod h1:3ypkxvcrqPtpvPhRpNgHwoNQcJfFqWd401rxKbrlO5s=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
 go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
-go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
@@ -390,14 +825,31 @@ golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v
 golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M=
 golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
 golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
+golang.org/x/exp/typeparams v0.0.0-20220428152302-39d4317da171/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
+golang.org/x/exp/typeparams v0.0.0-20230203172020-98cc5a0785f9/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
+golang.org/x/exp/typeparams v0.0.0-20260811152304-ee035b5b010f h1:+lI8cDJ4uceLipg2f1ODay7fEuLkk0BIHXd6PB8icxo=
+golang.org/x/exp/typeparams v0.0.0-20260811152304-ee035b5b010f/go.mod h1:PqrXSW65cXDZH0k4IeUbhmg/bcAZDbzNz3byBpKCsXo=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg=
+golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
@@ -409,6 +861,10 @@ golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
 golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
@@ -420,9 +876,16 @@ golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190626221950-04f50cda93cb/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211105183446-c75c47738b0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -437,6 +900,8 @@ golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
 golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
+golang.org/x/telemetry v0.0.0-20261010193011-f71dc92da45e h1:P6NGsugec4oASJ+yKMNgTndeo0h2CbixZLvQIe9h5R4=
+golang.org/x/telemetry v0.0.0-20261010193011-f71dc92da45e/go.mod h1:GNu+nb+E5axfGmP+Uu3ZVQu5lE/Xk42MjZOHWUD94/o=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
@@ -448,7 +913,9 @@ golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
 golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
 golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
@@ -462,25 +929,39 @@ golang.org/x/time v0.16.0 h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE=
 golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200329025819-fd4102a86c65/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
+golang.org/x/tools v0.0.0-20200724022722-7017fd6b1305/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.1.1-0.20210205202024-ef80cdb6ec6d/go.mod h1:9bzcO0MWcOuT0tm1iBGzDVPshzfwoVvREIui8C+MHqU=
+golang.org/x/tools v0.1.1-0.20210302220138-2ac05c832e1a/go.mod h1:9bzcO0MWcOuT0tm1iBGzDVPshzfwoVvREIui8C+MHqU=
+golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI=
-golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA=
+golang.org/x/tools v0.52.0 h1:ryxg4U63oaUYk7uOLTF37n43f4qgtGvqV4Ioit1BaEs=
+golang.org/x/tools v0.52.0/go.mod h1:ItcP5UNaVGG+Yc4eIYmaFLNJ4soEopkx5Y2d4lcEurs=
+golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
+golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
+golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
+golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8=
+golang.org/x/vuln v1.9.0 h1:12VaqnI9kJfqwRoPptxoqsUhQtdfrSbdksT7X/KY/sc=
+golang.org/x/vuln v1.9.0/go.mod h1:E/Frwm0xp49fTyBW+6CQHdkvobknbwUM49yEpMGUauw=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/api v0.308.0 h1:iGb+4qT3nVb3uuIzwor3yP2nyu+rMZr31PvLFiRNJQk=
-google.golang.org/api v0.308.0/go.mod h1:4XMH+b/ZEfuTbK7FnrFRY9c4xfFHVflGTKuy/i5wUmE=
-google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d h1:C9v1o0/4quuhOAfmRXA2j+we0PqZIp8traLdeogF3Ms=
-google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d/go.mod h1:Wz2wFJntZFmLGo7pLDXZ3wYk5hyc0Mb+SkHhDDXT+lU=
-google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d h1:QwnJwPte4XXAkhPu26LTDIahnsMSUV0kK8HkxbC+Pc4=
-google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d/go.mod h1:WRrQ7/7N19PypuT0fxLOL5Lq0waoiRri4FbtHDEKrGE=
+google.golang.org/api v0.310.0 h1:537ccDDmbwuwX1iof3Vtdz9vow6uJCgrSZJWedAWM0I=
+google.golang.org/api v0.310.0/go.mod h1:5NUthU+LmGMKzYgRaScb+TTe1Lo7x4A+J7g+Yj8BRzA=
+google.golang.org/genproto v0.0.0-20261012220534-4341edf3f941 h1:CXq2XEi5aEyLjjPZIwqrmQH8ZY4ctUwK7uyAx3mjX/U=
+google.golang.org/genproto v0.0.0-20261012220534-4341edf3f941/go.mod h1:3gK0ehnhP0V7/x3ypGoLyT3d0n6TSi/EcsphIjHrcz4=
+google.golang.org/genproto/googleapis/api v0.0.0-20261012220534-4341edf3f941 h1:DS/w3N8rsfrwxwgGSj6WhMsPo7aNQGmDx74J81zd0NQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20261012220534-4341edf3f941/go.mod h1:AuGAdi9KnXss7xbLxIKhCvk+Ro/SxpET/iS45DNYN+M=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20261019180522-ce908d29299b h1:6WNWHZk91dp4gZ25642OALkuG1UVNZbwENJD19DnB8k=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20261019180522-ce908d29299b/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc=
-google.golang.org/grpc v1.84.0 h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=
-google.golang.org/grpc v1.84.0/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0=
+google.golang.org/grpc v1.85.0 h1:BPBCfuVRQ1qvBhKDOq9uvQllMvO59rKsYhXpp7Dd8vw=
+google.golang.org/grpc v1.85.0/go.mod h1:0rQrOD58yjal/0EaVbGBANindixsCZNQPDV3VKtaKuQ=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2 h1:rgSNvqscFZ1JgV/4wH5GOsZFSFkR2Eua9As3KIr2LlM=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2/go.mod h1:iMEtFwDlAhjDU9L5mY6U1XLwlIId/G3h+QcBHDIvrJ8=
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
@@ -489,12 +970,26 @@ gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
+gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gotest.tools/gotestsum v1.13.0 h1:+Lh454O9mu9AMG1APV4o0y7oDYKyik/3kBOiCqiEpRo=
+gotest.tools/gotestsum v1.13.0/go.mod h1:7f0NS5hFb0dWr4NtcsAsF0y1kzjEFfAil0HiBQJE03Q=
+gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
+gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
+honnef.co/go/tools v0.8.1 h1:+JKf3xJ1ni4CwrhVg4/pqsfPGP6vNAXcKbMXJodYx3w=
+honnef.co/go/tools v0.8.1/go.mod h1:XA+OnlRA9EDh/ukGvXMNSZNKGwFQJ+5dER0ioUkOxks=
 howett.net/plist v1.0.0 h1:7CrbWYbPPO/PyNy38b2EB/+gYbjCe2DXBxgtOOZbSQM=
 howett.net/plist v1.0.0/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
+mvdan.cc/gofumpt v0.11.0 h1:0H01XB95PnN2QgCSR9ELdZyTlJqNZ7181B0BTMh5VZc=
+mvdan.cc/gofumpt v0.11.0/go.mod h1:BeT5wCsOJt6J9zT2MZIOGszjUHzFkn1/l9g6xAzqsXo=
+mvdan.cc/unparam v0.0.0-20260823230713-2fa3d841b0c8 h1:Re1NRyLpiAt9kB+ImaaoapwWiQXrKwER4tY8fLOkDew=
+mvdan.cc/unparam v0.0.0-20260823230713-2fa3d841b0c8/go.mod h1:MrS/+zJ1M2xvGXhKktiHbNQeQPyg3Qel+KkzT+f7/i4=
 software.sslmate.com/src/go-pkcs12 v0.7.4 h1:OvJ7g/OB9RuVAOzahlFLns6HeIcP+SJotsDqmLfhd8w=
 software.sslmate.com/src/go-pkcs12 v0.7.4/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=
diff --git a/integration/crypto_test.go b/integration/crypto_test.go
index 1b282214..878c7183 100644
--- a/integration/crypto_test.go
+++ b/integration/crypto_test.go
@@ -17,7 +17,6 @@ import (
 	"testing"
 	"time"
 
-	gojose "github.com/go-jose/go-jose/v3"
 	"github.com/pquerna/otp"
 	"github.com/pquerna/otp/totp"
 	"github.com/rogpeppe/go-internal/testscript"
@@ -87,6 +86,7 @@ func TestCryptoJWKCreateOctCommand(t *testing.T) {
 		Cmds: map[string]func(ts *testscript.TestScript, neg bool, args []string){
 			"check_jwk":                  checkKeyPair,
 			"check_jwk_without_password": checkKeyPairWithoutPassword,
+			"check_oct_size":             checkOctKeySize,
 		},
 	})
 }
@@ -192,7 +192,7 @@ func TestCryptoJWTCommand(t *testing.T) {
 			require.NoError(t, err)
 			err = os.WriteFile(filepath.Join(e.Cd, "invalid-header-bad-json.txt"), []byte(createFakeToken(t, `{"kty":"EC","alg":"ES256","}`, parts[1], parts[2])), 0600)
 			require.NoError(t, err)
-			err = os.WriteFile(filepath.Join(e.Cd, "invalid-payload.txt"), []byte(createFakeToken(t, parts[0], "foo", parts[2])), 0600)
+			err = os.WriteFile(filepath.Join(e.Cd, "invalid-payload.txt"), []byte(createTokenWithPayload(t, ed25519JWK, "foo")), 0600)
 			require.NoError(t, err)
 
 			// write tokens created by OpenSSL
@@ -233,6 +233,24 @@ func TestCryptoJWTCommand(t *testing.T) {
 	})
 }
 
+func TestCryptoJWSInspectCommand(t *testing.T) {
+	testscript.Run(t, testscript.Params{
+		Files: []string{"testdata/crypto/jws-inspect.txtar"},
+	})
+}
+
+func TestCryptoJOSEFormatCommand(t *testing.T) {
+	testscript.Run(t, testscript.Params{
+		Files: []string{"testdata/crypto/jose-format.txtar"},
+	})
+}
+
+func TestCryptoJWEEncryptCommand(t *testing.T) {
+	testscript.Run(t, testscript.Params{
+		Files: []string{"testdata/crypto/jwe-encrypt.txtar"},
+	})
+}
+
 func TestCryptoKeyPair(t *testing.T) {
 	testscript.Run(t, testscript.Params{
 		Files: []string{"testdata/crypto/keypair.txtar"},
@@ -347,6 +365,29 @@ func checkKeyPairWithoutPassword(ts *testscript.TestScript, _ bool, args []strin
 	checkKeyDetails(ts, pub, priv, args)
 }
 
+// checkOctKeySize checks that the password protected oct key in the file in the
+// first argument has the size in bytes given in the second argument.
+func checkOctKeySize(ts *testscript.TestScript, neg bool, args []string) {
+	if neg {
+		ts.Fatalf("unsupported: ! check_oct_size")
+	}
+	if len(args) != 2 {
+		ts.Fatalf("expected 2 arguments, got %d", len(args))
+	}
+
+	want, err := strconv.Atoi(args[1])
+	ts.Check(err)
+	jwk, err := jose.ParseKey([]byte(ts.ReadFile(args[0])), jose.WithPassword([]byte("password")))
+	ts.Check(err)
+	key, ok := jwk.Key.([]byte)
+	if !ok {
+		ts.Fatalf("expected key %s to be a byte slice; got %T", args[0], jwk.Key)
+	}
+	if len(key) != want {
+		ts.Fatalf("expected key %s to have %d bytes; got %d", args[0], want, len(key))
+	}
+}
+
 // checkKeyDetails checks that the public/private key pair is valid. It performs
 // the following checks:
 //
@@ -502,7 +543,7 @@ func createToken(t *testing.T, jwk *jose.JSONWebKey, now time.Time) string {
 	require.NoError(t, err)
 
 	payload := make(map[string]any)
-	raw, err := jose.Signed(signer).Claims(c).Claims(payload).CompactSerialize()
+	raw, err := jose.Signed(signer).Claims(c).Claims(payload).Serialize()
 	require.NoError(t, err)
 
 	return raw
@@ -527,11 +568,11 @@ func readKey(t *testing.T, file string) (*jose.JSONWebKey, []byte) {
 	return jwk, b
 }
 
-func readKeySet(t *testing.T, file string) (*gojose.JSONWebKeySet, []byte) {
+func readKeySet(t *testing.T, file string) (*jose.JSONWebKeySet, []byte) {
 	t.Helper()
 
 	b := readBytes(t, file)
-	var jwks gojose.JSONWebKeySet
+	var jwks jose.JSONWebKeySet
 	err := json.Unmarshal(b, &jwks)
 	require.NoError(t, err)
 
@@ -557,6 +598,25 @@ func generateJWK(t *testing.T, kty, crv string) (*jose.JSONWebKey, []byte) {
 	return &jwk, b
 }
 
+// createTokenWithPayload returns a token with a valid signature over the given
+// payload, so that verification reaches the payload.
+func createTokenWithPayload(t *testing.T, jwk *jose.JSONWebKey, payload string) string {
+	t.Helper()
+
+	so := new(jose.SignerOptions).WithType("JWT").WithHeader("kid", jwk.KeyID)
+	signer, err := jose.NewSigner(jose.SigningKey{
+		Algorithm: jose.SignatureAlgorithm(jwk.Algorithm),
+		Key:       jwk.Key,
+	}, so)
+	require.NoError(t, err)
+
+	jws, err := signer.Sign([]byte(payload))
+	require.NoError(t, err)
+	raw, err := jws.CompactSerialize()
+	require.NoError(t, err)
+	return raw
+}
+
 func createFakeToken(t *testing.T, header, payload, signature string) string {
 	t.Helper()
 
diff --git a/integration/testdata/crypto/jose-format.txtar b/integration/testdata/crypto/jose-format.txtar
new file mode 100644
index 00000000..56192985
--- /dev/null
+++ b/integration/testdata/crypto/jose-format.txtar
@@ -0,0 +1,114 @@
+# format token with none-nosig header, and back to compact
+stdin none-nosig.txt
+exec step crypto jose format
+stdout '"protected":'
+cp stdout none-nosig.json
+stdin none-nosig.json
+exec step crypto jose format
+stdout '^eyJhbGciOiJub25lIn0.eyJzdWIiOiJ4In0.$'
+
+
+# format token with none header, and back to compact
+stdin none.txt
+exec step crypto jose format
+stdout '"protected":'
+cp stdout none.json
+stdin none.json
+exec step crypto jose format
+stdout '^eyJhbGciOiJub25lIn0.eyJzdWIiOiJ4In0.c2lnbmF0dXJl$'
+
+
+# format token with es256k header, and back to compact
+stdin es256k.txt
+exec step crypto jose format
+stdout '"protected":'
+cp stdout es256k.json
+stdin es256k.json
+exec step crypto jose format
+stdout '^eyJhbGciOiJFUzI1NksifQ.eyJzdWIiOiJ4In0.c2lnbmF0dXJl$'
+
+
+# format token with unknown header, and back to compact
+stdin unknown.txt
+exec step crypto jose format
+stdout '"protected":'
+cp stdout unknown.json
+stdin unknown.json
+exec step crypto jose format
+stdout '^eyJhbGciOiJGT08ifQ.eyJzdWIiOiJ4In0.c2lnbmF0dXJl$'
+
+
+# format token with noalg header, and back to compact
+stdin noalg.txt
+exec step crypto jose format
+stdout '"protected":'
+cp stdout noalg.json
+stdin noalg.json
+exec step crypto jose format
+stdout '^eyJ0eXAiOiJKV1QifQ.eyJzdWIiOiJ4In0.c2lnbmF0dXJl$'
+
+
+# format fails for invalid token
+exec echo foo
+stdin stdout
+! exec step crypto jose format
+stderr 'error parsing data: compact JWS format must have three parts'
+
+
+# format keeps the protected header of jws-order
+stdin jws-order.txt
+exec step crypto jose format
+stdout '"protected":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9"'
+cp stdout jws-order.json
+stdin jws-order.json
+exec step crypto jose format
+stdout '^eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ4In0.c2lnbmF0dXJl$'
+
+
+# format keeps the protected header of jwe-order
+stdin jwe-order.txt
+exec step crypto jose format
+stdout '"protected":"eyJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiQTI1NktXIn0"'
+cp stdout jwe-order.json
+stdin jwe-order.json
+exec step crypto jose format
+stdout '^eyJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiQTI1NktXIn0.YWFhYWFhYWE.YWFhYWFhYWE.YWFhYWFhYWE.YWFhYWFhYWE$'
+
+
+# format keeps the protected header of jwe-unknown-alg
+stdin jwe-unknown-alg.txt
+exec step crypto jose format
+stdout '"protected":"eyJhbGciOiJGT08iLCJlbmMiOiJBMjU2R0NNIn0"'
+cp stdout jwe-unknown-alg.json
+stdin jwe-unknown-alg.json
+exec step crypto jose format
+stdout '^eyJhbGciOiJGT08iLCJlbmMiOiJBMjU2R0NNIn0.YWFhYWFhYWE.YWFhYWFhYWE.YWFhYWFhYWE.YWFhYWFhYWE$'
+
+
+# format keeps the protected header of jwe-unknown-enc
+stdin jwe-unknown-enc.txt
+exec step crypto jose format
+stdout '"protected":"eyJhbGciOiJBMjU2S1ciLCJlbmMiOiJCQVIifQ"'
+cp stdout jwe-unknown-enc.json
+stdin jwe-unknown-enc.json
+exec step crypto jose format
+stdout '^eyJhbGciOiJBMjU2S1ciLCJlbmMiOiJCQVIifQ.YWFhYWFhYWE.YWFhYWFhYWE.YWFhYWFhYWE.YWFhYWFhYWE$'
+
+-- none-nosig.txt --
+eyJhbGciOiJub25lIn0.eyJzdWIiOiJ4In0.
+-- none.txt --
+eyJhbGciOiJub25lIn0.eyJzdWIiOiJ4In0.c2lnbmF0dXJl
+-- es256k.txt --
+eyJhbGciOiJFUzI1NksifQ.eyJzdWIiOiJ4In0.c2lnbmF0dXJl
+-- unknown.txt --
+eyJhbGciOiJGT08ifQ.eyJzdWIiOiJ4In0.c2lnbmF0dXJl
+-- noalg.txt --
+eyJ0eXAiOiJKV1QifQ.eyJzdWIiOiJ4In0.c2lnbmF0dXJl
+-- jws-order.txt --
+eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ4In0.c2lnbmF0dXJl
+-- jwe-order.txt --
+eyJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiQTI1NktXIn0.YWFhYWFhYWE.YWFhYWFhYWE.YWFhYWFhYWE.YWFhYWFhYWE
+-- jwe-unknown-alg.txt --
+eyJhbGciOiJGT08iLCJlbmMiOiJBMjU2R0NNIn0.YWFhYWFhYWE.YWFhYWFhYWE.YWFhYWFhYWE.YWFhYWFhYWE
+-- jwe-unknown-enc.txt --
+eyJhbGciOiJBMjU2S1ciLCJlbmMiOiJCQVIifQ.YWFhYWFhYWE.YWFhYWFhYWE.YWFhYWFhYWE.YWFhYWFhYWE
diff --git a/integration/testdata/crypto/jwe-encrypt.txtar b/integration/testdata/crypto/jwe-encrypt.txtar
new file mode 100644
index 00000000..c366c70c
--- /dev/null
+++ b/integration/testdata/crypto/jwe-encrypt.txtar
@@ -0,0 +1,193 @@
+# oct A128KW round trip
+exec step crypto jwk create --no-password --insecure --kty oct --use enc --alg A128KW a128kw.pub a128kw.priv
+stdin secret.txt
+exec step crypto jwe encrypt --key a128kw.priv --enc A256GCM
+cp stdout a128kw.jwe
+stdin a128kw.jwe
+exec step crypto jwe decrypt --key a128kw.priv
+stdout '^secret$'
+
+stdin secret.txt
+exec step crypto jwe encrypt --key a128kw.pub --enc A256GCM
+cp stdout a128kw-pub.jwe
+stdin a128kw-pub.jwe
+exec step crypto jwe decrypt --key a128kw.priv
+stdout '^secret$'
+
+
+# oct A192KW round trip
+exec step crypto jwk create --no-password --insecure --kty oct --use enc --alg A192KW a192kw.pub a192kw.priv
+stdin secret.txt
+exec step crypto jwe encrypt --key a192kw.priv --enc A256GCM
+cp stdout a192kw.jwe
+stdin a192kw.jwe
+exec step crypto jwe decrypt --key a192kw.priv
+stdout '^secret$'
+
+stdin secret.txt
+exec step crypto jwe encrypt --key a192kw.pub --enc A256GCM
+cp stdout a192kw-pub.jwe
+stdin a192kw-pub.jwe
+exec step crypto jwe decrypt --key a192kw.priv
+stdout '^secret$'
+
+
+# oct A256KW round trip
+exec step crypto jwk create --no-password --insecure --kty oct --use enc --alg A256KW a256kw.pub a256kw.priv
+stdin secret.txt
+exec step crypto jwe encrypt --key a256kw.priv --enc A256GCM
+cp stdout a256kw.jwe
+stdin a256kw.jwe
+exec step crypto jwe decrypt --key a256kw.priv
+stdout '^secret$'
+
+stdin secret.txt
+exec step crypto jwe encrypt --key a256kw.pub --enc A256GCM
+cp stdout a256kw-pub.jwe
+stdin a256kw-pub.jwe
+exec step crypto jwe decrypt --key a256kw.priv
+stdout '^secret$'
+
+
+# oct A128GCMKW round trip
+exec step crypto jwk create --no-password --insecure --kty oct --use enc --alg A128GCMKW a128gcmkw.pub a128gcmkw.priv
+stdin secret.txt
+exec step crypto jwe encrypt --key a128gcmkw.priv --enc A256GCM
+cp stdout a128gcmkw.jwe
+stdin a128gcmkw.jwe
+exec step crypto jwe decrypt --key a128gcmkw.priv
+stdout '^secret$'
+
+stdin secret.txt
+exec step crypto jwe encrypt --key a128gcmkw.pub --enc A256GCM
+cp stdout a128gcmkw-pub.jwe
+stdin a128gcmkw-pub.jwe
+exec step crypto jwe decrypt --key a128gcmkw.priv
+stdout '^secret$'
+
+
+# oct A192GCMKW round trip
+exec step crypto jwk create --no-password --insecure --kty oct --use enc --alg A192GCMKW a192gcmkw.pub a192gcmkw.priv
+stdin secret.txt
+exec step crypto jwe encrypt --key a192gcmkw.priv --enc A256GCM
+cp stdout a192gcmkw.jwe
+stdin a192gcmkw.jwe
+exec step crypto jwe decrypt --key a192gcmkw.priv
+stdout '^secret$'
+
+stdin secret.txt
+exec step crypto jwe encrypt --key a192gcmkw.pub --enc A256GCM
+cp stdout a192gcmkw-pub.jwe
+stdin a192gcmkw-pub.jwe
+exec step crypto jwe decrypt --key a192gcmkw.priv
+stdout '^secret$'
+
+
+# oct A256GCMKW round trip
+exec step crypto jwk create --no-password --insecure --kty oct --use enc --alg A256GCMKW a256gcmkw.pub a256gcmkw.priv
+stdin secret.txt
+exec step crypto jwe encrypt --key a256gcmkw.priv --enc A256GCM
+cp stdout a256gcmkw.jwe
+stdin a256gcmkw.jwe
+exec step crypto jwe decrypt --key a256gcmkw.priv
+stdout '^secret$'
+
+stdin secret.txt
+exec step crypto jwe encrypt --key a256gcmkw.pub --enc A256GCM
+cp stdout a256gcmkw-pub.jwe
+stdin a256gcmkw-pub.jwe
+exec step crypto jwe decrypt --key a256gcmkw.priv
+stdout '^secret$'
+
+
+# oct dir round trip
+exec step crypto jwk create --no-password --insecure --kty oct --use enc --alg dir dir.pub dir.priv
+stdin secret.txt
+exec step crypto jwe encrypt --key dir.priv --enc A256GCM
+cp stdout dir.jwe
+stdin dir.jwe
+exec step crypto jwe decrypt --key dir.priv
+stdout '^secret$'
+
+stdin secret.txt
+exec step crypto jwe encrypt --key dir.pub --enc A256GCM
+cp stdout dir-pub.jwe
+stdin dir-pub.jwe
+exec step crypto jwe decrypt --key dir.priv
+stdout '^secret$'
+
+
+# oct default algorithm round trip
+exec step crypto jwk create --no-password --insecure --kty oct --use enc default.pub default.priv
+stdin secret.txt
+exec step crypto jwe encrypt --key default.priv
+cp stdout default.jwe
+stdin default.jwe
+exec step crypto jwe decrypt --key default.priv
+stdout '^secret$'
+
+
+# oct round trip with a key set
+stdin secret.txt
+exec step crypto jwe encrypt --jwks oct-set.json --kid k1
+cp stdout jwks.jwe
+stdin jwks.jwe
+exec step crypto jwe decrypt --jwks oct-set.json --kid k1
+stdout '^secret$'
+
+
+# RSA round trip uses the public key
+exec step crypto jwk create --no-password --insecure --kty RSA --use enc --alg RSA-OAEP-256 rsa.pub rsa.priv
+stdin secret.txt
+exec step crypto jwe encrypt --key rsa.priv
+cp stdout rsa.jwe
+stdin rsa.jwe
+exec step crypto jwe decrypt --key rsa.priv
+stdout '^secret$'
+
+stdin secret.txt
+exec step crypto jwe encrypt --key rsa.pub
+cp stdout rsa-pub.jwe
+stdin rsa-pub.jwe
+exec step crypto jwe decrypt --key rsa.priv
+stdout '^secret$'
+
+
+# EC round trip uses the public key
+exec step crypto jwk create --no-password --insecure --kty EC --use enc --alg ECDH-ES ec.pub ec.priv
+stdin secret.txt
+exec step crypto jwe encrypt --key ec.priv
+cp stdout ec.jwe
+stdin ec.jwe
+exec step crypto jwe decrypt --key ec.priv
+stdout '^secret$'
+
+
+# oct key does not leak in the output
+stdin secret.txt
+exec step crypto jwe encrypt --key leak.json
+! stdout '"k"'
+! stdout 'AAECAwQFBgcICQoLDA0ODw'
+
+
+# oct key with the wrong size for its algorithm fails
+stdin secret.txt
+! exec step crypto jwe encrypt --key mismatch.json
+stderr 'alg ''A128KW'' requires a key of 16 bytes'
+
+
+# oct key for signatures fails
+stdin secret.txt
+! exec step crypto jwe encrypt --key sig.json
+stderr 'invalid jwk use: found ''sig'' \(signature\), expecting ''enc'' \(encryption\)'
+
+-- secret.txt --
+secret
+-- leak.json --
+{"kty":"oct","alg":"A128KW","use":"enc","k":"AAECAwQFBgcICQoLDA0ODw"}
+-- mismatch.json --
+{"kty":"oct","alg":"A128KW","use":"enc","k":"AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8"}
+-- sig.json --
+{"kty":"oct","alg":"HS256","use":"sig","k":"AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8"}
+-- oct-set.json --
+{"keys":[{"kty":"oct","alg":"A256KW","use":"enc","kid":"k1","k":"AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8"}]}
diff --git a/integration/testdata/crypto/jwk-create-oct.txtar b/integration/testdata/crypto/jwk-create-oct.txtar
index 733d5e04..29c415b7 100644
--- a/integration/testdata/crypto/jwk-create-oct.txtar
+++ b/integration/testdata/crypto/jwk-create-oct.txtar
@@ -1,81 +1,215 @@
 # oct defaults
-exec step crypto jwk create --password-file password.txt --kty oct oct-defaults.pub oct-defaults.priv 
+exec step crypto jwk create --password-file password.txt --kty oct oct-defaults.pub oct-defaults.priv
 check_jwk oct-defaults.pub oct-defaults.priv oct HS256
 
 
-# oct too small without insecure fails
-! exec step crypto jwk create --password-file password.txt --size 4 --kty oct fail.pub fail.priv 
-stderr 'flag ''--size'' requires at least 16 unless ''--insecure'' flag is provided'
+# oct default sizes
+check_oct_size oct-defaults.priv 32
 
+exec step crypto jwk create --password-file password.txt --kty oct --use enc oct-default-enc.pub oct-default-enc.priv
+check_jwk oct-default-enc.pub oct-default-enc.priv oct A256GCMKW
+check_oct_size oct-default-enc.priv 32
 
-# oct small size with insecure
-exec step crypto jwk create --password-file password.txt --kty oct --size 4 --insecure oct-small.pub oct-small.priv 
-check_jwk oct-small.pub oct-small.priv oct HS256
+exec step crypto jwk create --password-file password.txt --kty oct --alg HS384 oct-default-hs384.pub oct-default-hs384.priv
+check_jwk oct-default-hs384.pub oct-default-hs384.priv oct HS384
+check_oct_size oct-default-hs384.priv 48
 
+exec step crypto jwk create --password-file password.txt --kty oct --alg HS512 oct-default-hs512.pub oct-default-hs512.priv
+check_jwk oct-default-hs512.pub oct-default-hs512.priv oct HS512
+check_oct_size oct-default-hs512.priv 64
 
-# oct size 0 with insecure fails
-! exec step crypto jwk create --password-file password.txt --size 0 --insecure --kty oct fail.pub fail.priv 
-stderr 'must be greater than or equal to 0'
+exec step crypto jwk create --password-file password.txt --kty oct --alg A128KW --use enc oct-default-a128kw.pub oct-default-a128kw.priv
+check_jwk oct-default-a128kw.pub oct-default-a128kw.priv oct A128KW
+check_oct_size oct-default-a128kw.priv 16
 
+exec step crypto jwk create --password-file password.txt --kty oct --alg A192GCMKW --use enc oct-default-a192gcmkw.pub oct-default-a192gcmkw.priv
+check_jwk oct-default-a192gcmkw.pub oct-default-a192gcmkw.priv oct A192GCMKW
+check_oct_size oct-default-a192gcmkw.priv 24
 
-# oct HS256
-exec step crypto jwk create --password-file password.txt --kty oct --alg HS256 --size 64 oct-hs256.pub oct-hs256.priv 
+exec step crypto jwk create --password-file password.txt --kty oct --alg dir --use enc oct-default-dir.pub oct-default-dir.priv
+check_jwk oct-default-dir.pub oct-default-dir.priv oct dir
+check_oct_size oct-default-dir.priv 32
+
+
+# oct has no default kid
+! grep '"kid"' oct-defaults.pub
+
+
+# oct with kid
+exec step crypto jwk create --password-file password.txt --kty oct --kid foo oct-kid.pub oct-kid.priv
+check_jwk oct-kid.pub oct-kid.priv oct HS256
+grep '"kid": "foo"' oct-kid.pub
+
+
+# oct algorithm without a defined size too small
+! exec step crypto jwk create --password-file password.txt --kty oct --alg foo --use foo --size 15 fail.pub fail.priv
+stderr 'flag ''--size'' requires at least 16 bytes unless ''--insecure'' flag is provided'
+
+
+# oct size checks do not set the algorithm of a PEM key
+exec step crypto keypair --no-password --insecure --kty RSA rsa.pub rsa.pem
+! exec step crypto jwk create --password-file password.txt --from-pem rsa.pem --kty oct --size 32 fail.pub fail.priv
+stderr 'flag ''--alg'' is required with the given key'
+
+
+# oct too small
+! exec step crypto jwk create --password-file password.txt --size 4 --kty oct fail.pub fail.priv
+stderr 'flag ''--size'' must be greater than or equal to 32 bytes'
+
+
+# oct custom use too small
+! exec step crypto jwk create --password-file password.txt --size 4 --kty oct --use foo fail.pub fail.priv
+stderr 'flag ''--size'' must be greater than or equal to 32 bytes'
+
+
+# oct HS256 too small
+! exec step crypto jwk create --password-file password.txt --size 31 --kty oct --alg HS256 fail.pub fail.priv
+stderr 'flag ''--size'' must be greater than or equal to 32 bytes'
+
+
+# oct HS384 too small
+! exec step crypto jwk create --password-file password.txt --size 47 --kty oct --alg HS384 fail.pub fail.priv
+stderr 'flag ''--size'' must be greater than or equal to 48 bytes'
+
+
+# oct HS512 too small
+! exec step crypto jwk create --password-file password.txt --size 63 --kty oct --alg HS512 fail.pub fail.priv
+stderr 'flag ''--size'' must be greater than or equal to 64 bytes'
+
+
+# oct HS256 min size
+exec step crypto jwk create --password-file password.txt --kty oct --alg HS256 --size 32 oct-hs256.pub oct-hs256.priv
 check_jwk oct-hs256.pub oct-hs256.priv oct HS256
 
 
-# oct HS384
-exec step crypto jwk create --password-file password.txt --kty oct --alg HS384 --size 64 oct-hs384.pub oct-hs384.priv 
+# oct HS384 min size
+exec step crypto jwk create --password-file password.txt --kty oct --alg HS384 --size 48 oct-hs384.pub oct-hs384.priv
 check_jwk oct-hs384.pub oct-hs384.priv oct HS384
 
 
-# oct HS512
-exec step crypto jwk create --password-file password.txt --kty oct --alg HS512 --size 64 oct-hs512.pub oct-hs512.priv 
+# oct HS512 min size
+exec step crypto jwk create --password-file password.txt --kty oct --alg HS512 --size 64 oct-hs512.pub oct-hs512.priv
 check_jwk oct-hs512.pub oct-hs512.priv oct HS512
 
 
+# oct HS256 larger size
+exec step crypto jwk create --password-file password.txt --kty oct --alg HS256 --size 48 oct-hs256-48.pub oct-hs256-48.priv
+check_jwk oct-hs256-48.pub oct-hs256-48.priv oct HS256
+
+
+# oct HS384 larger size
+exec step crypto jwk create --password-file password.txt --kty oct --alg HS384 --size 64 oct-hs384-64.pub oct-hs384-64.priv
+check_jwk oct-hs384-64.pub oct-hs384-64.priv oct HS384
+
+
+# oct HS512 larger size
+exec step crypto jwk create --password-file password.txt --kty oct --alg HS512 --size 80 oct-hs512-80.pub oct-hs512-80.priv
+check_jwk oct-hs512-80.pub oct-hs512-80.priv oct HS512
+
+
 # oct HS256 with enc use fails
 ! exec step crypto jwk create --password-file password.txt --kty oct --alg HS256 --size 32 --use enc fail.pub fail.priv
 stderr 'alg ''HS256'' is not compatible with kty ''oct'''
 
 
 # oct enc dir
-exec step crypto jwk create --password-file password.txt --kty oct --alg dir --size 64 --use enc oct-enc-dir.pub oct-enc-dir.priv 
+exec step crypto jwk create --password-file password.txt --kty oct --alg dir --size 64 --use enc oct-enc-dir.pub oct-enc-dir.priv
 check_jwk oct-enc-dir.pub oct-enc-dir.priv oct dir
 
 
+# oct enc dir min size
+exec step crypto jwk create --password-file password.txt --kty oct --alg dir --size 16 --use enc oct-enc-dir-16.pub oct-enc-dir-16.priv
+check_jwk oct-enc-dir-16.pub oct-enc-dir-16.priv oct dir
+
+
+# oct enc dir too small
+! exec step crypto jwk create --password-file password.txt --kty oct --alg dir --size 15 --use enc fail.pub fail.priv
+stderr 'flag ''--size'' requires at least 16 bytes unless ''--insecure'' flag is provided'
+
+
+# oct enc dir too small with insecure
+exec step crypto jwk create --password-file password.txt --insecure --kty oct --alg dir --size 15 --use enc oct-enc-dir-15.pub oct-enc-dir-15.priv
+check_jwk oct-enc-dir-15.pub oct-enc-dir-15.priv oct dir
+
+
+# oct enc dir negative size
+! exec step crypto jwk create --password-file password.txt --kty oct --alg dir --size -1 --use enc fail.pub fail.priv
+stderr 'flag ''--size'' requires at least 16 bytes unless ''--insecure'' flag is provided'
+
+
+# oct enc dir negative size with insecure
+! exec step crypto jwk create --password-file password.txt --insecure --kty oct --alg dir --size -1 --use enc fail.pub fail.priv
+stderr 'flag ''--size'' must be greater than or equal to 1 byte'
+
+
+# oct enc dir zero size
+! exec step crypto jwk create --password-file password.txt --kty oct --alg dir --size 0 --use enc fail.pub fail.priv
+stderr 'flag ''--size'' requires at least 16 bytes unless ''--insecure'' flag is provided'
+
+
+# oct enc dir zero size with insecure
+! exec step crypto jwk create --password-file password.txt --insecure --kty oct --alg dir --size 0 --use enc fail.pub fail.priv
+stderr 'flag ''--size'' must be greater than or equal to 1 byte'
+
+
 # oct A128KW
-exec step crypto jwk create --password-file password.txt --kty oct --alg A128KW --size 32 --use enc oct-a128kw.pub oct-a128kw.priv 
+exec step crypto jwk create --password-file password.txt --kty oct --alg A128KW --size 16 --use enc oct-a128kw.pub oct-a128kw.priv
 check_jwk oct-a128kw.pub oct-a128kw.priv oct A128KW
 
 
 # oct A192KW
-exec step crypto jwk create --password-file password.txt --kty oct --alg A192KW --size 32 --use enc oct-a192kw.pub oct-a192kw.priv 
+exec step crypto jwk create --password-file password.txt --kty oct --alg A192KW --size 24 --use enc oct-a192kw.pub oct-a192kw.priv
 check_jwk oct-a192kw.pub oct-a192kw.priv oct A192KW
 
 
 # oct A256KW
-exec step crypto jwk create --password-file password.txt --kty oct --alg A256KW --size 32 --use enc oct-a256kw.pub oct-a256kw.priv 
+exec step crypto jwk create --password-file password.txt --kty oct --alg A256KW --size 32 --use enc oct-a256kw.pub oct-a256kw.priv
 check_jwk oct-a256kw.pub oct-a256kw.priv oct A256KW
 
 
 # oct A128GCMKW
-exec step crypto jwk create --password-file password.txt --kty oct --alg A128GCMKW --size 32 --use enc oct-a128gcmkw.pub oct-a128gcmkw.priv 
+exec step crypto jwk create --password-file password.txt --kty oct --alg A128GCMKW --size 16 --use enc oct-a128gcmkw.pub oct-a128gcmkw.priv
 check_jwk oct-a128gcmkw.pub oct-a128gcmkw.priv oct A128GCMKW
 
 
 # oct A192GCMKW
-exec step crypto jwk create --password-file password.txt --kty oct --alg A192GCMKW --size 32 --use enc oct-a192gcmkw.pub oct-a192gcmkw.priv 
+exec step crypto jwk create --password-file password.txt --kty oct --alg A192GCMKW --size 24 --use enc oct-a192gcmkw.pub oct-a192gcmkw.priv
 check_jwk oct-a192gcmkw.pub oct-a192gcmkw.priv oct A192GCMKW
 
 
 # oct A256GCMKW
-exec step crypto jwk create --password-file password.txt --kty oct --alg A256GCMKW --size 32 --use enc oct-a256gcmkw.pub oct-a256gcmkw.priv 
+exec step crypto jwk create --password-file password.txt --kty oct --alg A256GCMKW --size 32 --use enc oct-a256gcmkw.pub oct-a256gcmkw.priv
 check_jwk oct-a256gcmkw.pub oct-a256gcmkw.priv oct A256GCMKW
 
 
-# oct 256 HS256 
-exec step crypto jwk create --password-file password.txt --kty oct --alg HS256 --size 32 --kid foo oct-256-hs256.pub oct-256-hs256.priv 
-check_jwk oct-256-hs256.pub oct-256-hs256.priv oct HS256
+# oct A128KW fail
+! exec step crypto jwk create --password-file password.txt --kty oct --alg A128KW --size 32 --use enc fail.pub fail.priv
+stderr 'flag ''--size'' must be equal to 16 bytes'
+
+
+# oct A192KW fail
+! exec step crypto jwk create --password-file password.txt --kty oct --alg A192KW --size 48 --use enc fail.pub fail.priv
+stderr 'flag ''--size'' must be equal to 24 bytes'
+
+
+# oct A256KW fail
+! exec step crypto jwk create --password-file password.txt --kty oct --alg A256KW --size 64 --use enc fail.pub fail.priv
+stderr 'flag ''--size'' must be equal to 32 bytes'
+
+
+# oct A128GCMKW fail
+! exec step crypto jwk create --password-file password.txt --kty oct --alg A128GCMKW --size 32 --use enc fail.pub fail.priv
+stderr 'flag ''--size'' must be equal to 16 bytes'
+
+
+# oct A192GCMKW fail
+! exec step crypto jwk create --password-file password.txt --kty oct --alg A192GCMKW --size 48 --use enc fail.pub fail.priv
+stderr 'flag ''--size'' must be equal to 24 bytes'
+
+
+# oct A256GCMKW fail
+! exec step crypto jwk create --password-file password.txt --kty oct --alg A256GCMKW --size 64 --use enc fail.pub fail.priv
+stderr 'flag ''--size'' must be equal to 32 bytes'
 
 
 # oct with RSA algorithm fails
@@ -83,16 +217,16 @@ check_jwk oct-256-hs256.pub oct-256-hs256.priv oct HS256
 stderr 'alg ''RS256'' is not compatible with kty ''oct'''
 
 
-# oct with curve fails 
+# oct with curve fails
 ! exec step crypto jwk create --password-file password.txt --kty oct --alg HS256 --size 32 --curve P-256 fail.pub fail.priv
 stderr 'flag ''--crv'' is incompatible with ''--kty oct'''
 
 
 # oct without password
-exec step crypto jwk create --no-password --insecure --kty oct oct-no-pass.pub oct-no-pass.priv 
+exec step crypto jwk create --no-password --insecure --kty oct oct-no-pass.pub oct-no-pass.priv
 check_jwk_without_password oct-no-pass.pub oct-no-pass.priv oct HS256
 
 
 # oct without password without insecure fails
-! exec step crypto jwk create --no-password --kty oct fail.pub fail.priv 
+! exec step crypto jwk create --no-password --kty oct fail.pub fail.priv
 stderr 'flag ''--no-password'' requires the ''--insecure'' flag'
\ No newline at end of file
diff --git a/integration/testdata/crypto/jwk-create-rsa.txtar b/integration/testdata/crypto/jwk-create-rsa.txtar
index ad2e0f17..56c143f2 100644
--- a/integration/testdata/crypto/jwk-create-rsa.txtar
+++ b/integration/testdata/crypto/jwk-create-rsa.txtar
@@ -60,7 +60,7 @@ stderr 'the size of the RSA key should be at least 2048 bits'
 
 # RSA 0, PS256
 ! exec step crypto jwk create --password-file password.txt --kty RSA --size 0 --alg PS256 --insecure fail.pub fail.priv 
-stderr 'flag ''--size'' must be greater than or equal to 0'
+stderr 'flag ''--size'' must be greater than or equal to 1$'
 
 
 # RSA 2048, bad alg
diff --git a/integration/testdata/crypto/jws-inspect.txtar b/integration/testdata/crypto/jws-inspect.txtar
new file mode 100644
index 00000000..02ce008a
--- /dev/null
+++ b/integration/testdata/crypto/jws-inspect.txtar
@@ -0,0 +1,84 @@
+# inspect token with none-nosig header
+stdin none-nosig.txt
+exec step crypto jws inspect --insecure
+stdout '"sub":"x"'
+
+stdin none-nosig.txt
+exec step crypto jws inspect --insecure --json
+stdout '"alg": "none"'
+
+
+# inspect token with none header
+stdin none.txt
+exec step crypto jws inspect --insecure
+stdout '"sub":"x"'
+
+stdin none.txt
+exec step crypto jws inspect --insecure --json
+stdout '"alg": "none"'
+
+
+# inspect token with es256k header
+stdin es256k.txt
+exec step crypto jws inspect --insecure
+stdout '"sub":"x"'
+
+stdin es256k.txt
+exec step crypto jws inspect --insecure --json
+stdout '"alg": "ES256K"'
+
+
+# inspect token with unknown header
+stdin unknown.txt
+exec step crypto jws inspect --insecure
+stdout '"sub":"x"'
+
+stdin unknown.txt
+exec step crypto jws inspect --insecure --json
+stdout '"alg": "FOO"'
+
+
+# inspect token with noalg header
+stdin noalg.txt
+exec step crypto jws inspect --insecure
+stdout '"sub":"x"'
+
+stdin noalg.txt
+exec step crypto jws inspect --insecure --json
+stdout '"typ": "JWT"'
+
+
+# inspect fails for invalid token
+exec echo foo
+stdin stdout
+! exec step crypto jws inspect --insecure
+stderr 'error parsing token: compact JWS format must have three parts'
+
+
+# verify keeps rejecting algorithms that are not allowed
+exec step crypto jwk create --no-password --insecure --kty EC key.pub key.priv
+
+stdin none.txt
+! exec step crypto jws verify --key key.pub
+stderr 'error parsing token: unexpected signature algorithm "none"'
+
+stdin es256k.txt
+! exec step crypto jws verify --key key.pub
+stderr 'error parsing token: unexpected signature algorithm "ES256K"'
+
+
+# jwt verify keeps rejecting algorithms that are not allowed
+stdin none.txt
+! exec step crypto jwt verify --key key.pub --iss a --aud b
+stderr 'error parsing token: unexpected signature algorithm "none"'
+
+-- none-nosig.txt --
+eyJhbGciOiJub25lIn0.eyJzdWIiOiJ4In0.
+-- none.txt --
+eyJhbGciOiJub25lIn0.eyJzdWIiOiJ4In0.c2lnbmF0dXJl
+-- es256k.txt --
+eyJhbGciOiJFUzI1NksifQ.eyJzdWIiOiJ4In0.c2lnbmF0dXJl
+-- unknown.txt --
+eyJhbGciOiJGT08ifQ.eyJzdWIiOiJ4In0.c2lnbmF0dXJl
+-- noalg.txt --
+eyJ0eXAiOiJKV1QifQ.eyJzdWIiOiJ4In0.c2lnbmF0dXJl
diff --git a/integration/testdata/crypto/jwt-inspect.txtar b/integration/testdata/crypto/jwt-inspect.txtar
index 34e2241a..30aee410 100644
--- a/integration/testdata/crypto/jwt-inspect.txtar
+++ b/integration/testdata/crypto/jwt-inspect.txtar
@@ -13,4 +13,45 @@ stderr '''step crypto jwt inspect'' requires the ''--insecure'' flag'
 exec echo foo
 stdin stdout
 ! exec step crypto jwt inspect --insecure
-stderr 'error parsing token: compact JWS format must have three parts'
\ No newline at end of file
+stderr 'error parsing token: compact JWS format must have three parts'
+
+# inspect token with none-nosig header
+stdin none-nosig.txt
+exec step crypto jwt inspect --insecure
+stdout '"alg": "none"'
+stdout '"sub": "x"'
+
+# inspect token with none header
+stdin none.txt
+exec step crypto jwt inspect --insecure
+stdout '"alg": "none"'
+stdout '"sub": "x"'
+
+# inspect token with es256k header
+stdin es256k.txt
+exec step crypto jwt inspect --insecure
+stdout '"alg": "ES256K"'
+stdout '"sub": "x"'
+
+# inspect token with unknown header
+stdin unknown.txt
+exec step crypto jwt inspect --insecure
+stdout '"alg": "FOO"'
+stdout '"sub": "x"'
+
+# inspect token with noalg header
+stdin noalg.txt
+exec step crypto jwt inspect --insecure
+stdout '"typ": "JWT"'
+stdout '"sub": "x"'
+
+-- none-nosig.txt --
+eyJhbGciOiJub25lIn0.eyJzdWIiOiJ4In0.
+-- none.txt --
+eyJhbGciOiJub25lIn0.eyJzdWIiOiJ4In0.c2lnbmF0dXJl
+-- es256k.txt --
+eyJhbGciOiJFUzI1NksifQ.eyJzdWIiOiJ4In0.c2lnbmF0dXJl
+-- unknown.txt --
+eyJhbGciOiJGT08ifQ.eyJzdWIiOiJ4In0.c2lnbmF0dXJl
+-- noalg.txt --
+eyJ0eXAiOiJKV1QifQ.eyJzdWIiOiJ4In0.c2lnbmF0dXJl
diff --git a/integration/testdata/crypto/jwt-verify.txtar b/integration/testdata/crypto/jwt-verify.txtar
index 0ba3ca70..7cc7dfd4 100644
--- a/integration/testdata/crypto/jwt-verify.txtar
+++ b/integration/testdata/crypto/jwt-verify.txtar
@@ -1,17 +1,17 @@
 # P-256 verification
 stdin p256token.txt
-exec step crypto jwt verify -key p256.pem -iss TestIssuer -aud TestAudience 
+exec step crypto jwt verify -key p256.pem -iss TestIssuer -aud TestAudience
 
 
 # P-256 verify fails with RS256 alg
 stdin p256token.txt
-! exec step crypto jwt verify -key p256.pem -alg RS256 -iss TestIssuer -aud TestAudience 
+! exec step crypto jwt verify -key p256.pem -alg RS256 -iss TestIssuer -aud TestAudience
 stderr 'alg ''RS256'' is not compatible with kty ''EC'' and crv ''P-256'''
 
 
 # P-256 verify fail with RSA384 alg
 stdin p256token.txt
-! exec step crypto jwt verify -key p256.pem -alg RS384 -iss TestIssuer -aud TestAudience 
+! exec step crypto jwt verify -key p256.pem -alg RS384 -iss TestIssuer -aud TestAudience
 stderr 'alg ''RS384'' is not compatible with kty ''EC'' and crv ''P-256'''
 
 
@@ -25,8 +25,8 @@ stdin rsatoken.txt
 ! exec step crypto jwt verify -key rsa.pem -iss TestIssuer -aud TestAudience
 stderr 'flag ''--alg'' is required with the given key'
 
-# Ed25519 verification 
-stdin ed25519token.txt 
+# Ed25519 verification
+stdin ed25519token.txt
 exec step crypto jwt verify -key ed25519.json -iss TestIssuer -aud TestAudience
 
 
@@ -37,7 +37,7 @@ stdin stdout
 stderr 'error parsing token: compact JWS format must have three parts'
 
 
-# Ed25519 verification fails with invalid signature 
+# Ed25519 verification fails with invalid signature
 stdin incomplete-signature.txt
 ! exec step crypto jwt verify -key ed25519.json -iss TestIssuer -aud TestAudience
 stderr 'validation failed: invalid signature'
@@ -58,13 +58,13 @@ stderr 'validation failed: invalid audience claim'
 # Ed25519 verification fails with invalid data
 stdin invalid-header.txt
 ! exec step crypto jwt verify -key ed25519.json -iss TestIssuer -aud TestAudience
-stderr 'error parsing token: invalid character ''o'' in literal false'
+stderr 'error parsing token: invalid protected header'
 
 
 # Ed25519 verification fails with invalid JSON
 stdin invalid-header-json.txt
 ! exec step crypto jwt verify -key ed25519.json -iss TestIssuer -aud TestAudience
-stderr 'error parsing token: json: cannot unmarshal array into Go value of type jose.rawHeader'
+stderr 'error parsing token: invalid protected header'
 
 
 # Ed25519 verification fails with changed attribute
@@ -76,13 +76,13 @@ stderr 'validation failed: invalid signature'
 # Ed25519 verification fails with bad header JSON
 stdin invalid-header-bad-json.txt
 ! exec step crypto jwt verify -key ed25519.json -iss TestIssuer -aud TestAudience
-stderr 'error parsing token: unexpected end of JSON input'
+stderr 'error parsing token: invalid protected header'
 
 
 # Ed25519 verification fails with invalid payload
 stdin invalid-payload.txt
 ! exec step crypto jwt verify -key ed25519.json -iss TestIssuer -aud TestAudience
-stderr 'error parsing token: invalid character ''e'' looking for beginning of value'
+stderr 'claim verify failed'
 
 
 # Verify with JWKS and KID 1
@@ -149,28 +149,28 @@ exec step crypto jwt verify -key rsa.pem -alg RS256 -iss TestIssuer -aud TestAud
 
 # Verify token created by OpenSSL without expiry succeeds
 stdin no-expiry-ossltoken.txt
-exec step crypto jwt verify -key rsa.pem -alg RS256 -iss TestIssuer -aud TestAudience 
+exec step crypto jwt verify -key rsa.pem -alg RS256 -iss TestIssuer -aud TestAudience
 
 
 # Verify token created by OpenSSL without nbf succeeds
 stdin zero-not-before-ossltoken.txt
-exec step crypto jwt verify -key rsa.pem -alg RS256 -iss TestIssuer -aud TestAudience 
+exec step crypto jwt verify -key rsa.pem -alg RS256 -iss TestIssuer -aud TestAudience
 
 
-# Verify unsupported JSON serialized token 
+# Verify unsupported JSON serialized token
 stdin jwt-json-serialization.json
 ! exec step crypto jwt verify -key rsa.pem -alg RS256 -iss TestIssuer -aud TestAudience --no-exp-check
-stderr 'error parsing token: unexpected end of JSON input'
+stderr 'error parsing token: error parsing JWS: unexpected end of JSON input'
 
 
-# Verify unsupported JSON serialized token 
+# Verify unsupported JSON serialized token
 stdin jwt-json-serialization-flattened.json
 ! exec step crypto jwt verify -key rsa.pem -alg RS256 -iss TestIssuer -aud TestAudience --no-exp-check
-stderr 'error parsing token: unexpected end of JSON input'
+stderr 'error parsing token: error parsing JWS: unexpected end of JSON input'
 
 
-# Verify unsupported JSON serialized token 
+# Verify unsupported JSON serialized token
 stdin jwt-json-serialization-multi.json
 ! exec step crypto jwt verify -key rsa.pem -alg RS256 -iss TestIssuer -aud TestAudience --no-exp-check
-stderr 'error parsing token: unexpected end of JSON input'
+stderr 'error parsing token: error parsing JWS: unexpected end of JSON input'
 
diff --git a/integration/testdata/crypto/keypair.txtar b/integration/testdata/crypto/keypair.txtar
index fcaf65f6..4d6f1cdf 100644
--- a/integration/testdata/crypto/keypair.txtar
+++ b/integration/testdata/crypto/keypair.txtar
@@ -64,7 +64,7 @@ stderr 'flag ''--size'' requires at least 2048 unless ''--insecure'' flag is pro
 
 # RSA negative size 
 ! exec step crypto keypair --kty RSA --size -1 --insecure rsa-error.pub rsa-error.priv
-stderr 'flag ''--size'' must be greater than or equal to 0'
+stderr 'flag ''--size'' must be greater than or equal to 1$'
 
 
 # RSA size 16 with insecure flag
diff --git a/internal/cmd/root.go b/internal/cmd/root.go
index 3e8e4984..5a2cd76a 100644
--- a/internal/cmd/root.go
+++ b/internal/cmd/root.go
@@ -17,11 +17,12 @@ import (
 	"github.com/smallstep/cli-utils/step"
 	"github.com/smallstep/cli-utils/ui"
 	"github.com/smallstep/cli-utils/usage"
-	"github.com/smallstep/cli/command/version"
-	"github.com/smallstep/cli/internal/plugin"
 	"go.step.sm/crypto/jose"
 	"go.step.sm/crypto/pemutil"
 
+	"github.com/smallstep/cli/command/version"
+	"github.com/smallstep/cli/internal/plugin"
+
 	// Enabled cas interfaces.
 	_ "github.com/smallstep/certificates/cas/cloudcas"
 	_ "github.com/smallstep/certificates/cas/softcas"
diff --git a/internal/crlutil/crlutil.go b/internal/crlutil/crlutil.go
index a704d6c7..245d6108 100644
--- a/internal/crlutil/crlutil.go
+++ b/internal/crlutil/crlutil.go
@@ -16,6 +16,7 @@ import (
 	"time"
 
 	"github.com/pkg/errors"
+
 	"go.step.sm/crypto/mldsa"
 )
 
diff --git a/internal/cryptoutil/cryptoutil.go b/internal/cryptoutil/cryptoutil.go
index 5178655e..6c6c17ee 100644
--- a/internal/cryptoutil/cryptoutil.go
+++ b/internal/cryptoutil/cryptoutil.go
@@ -16,12 +16,13 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/smallstep/cli/internal/plugin"
 	"go.step.sm/crypto/jose"
 	"go.step.sm/crypto/kms"
 	"go.step.sm/crypto/kms/apiv1"
 	"go.step.sm/crypto/mldsa"
 	"go.step.sm/crypto/pemutil"
+
+	"github.com/smallstep/cli/internal/plugin"
 )
 
 // IsKMS returns true if the given uri is a KMS URI. It will return false if a
diff --git a/internal/joseutil/joseutil.go b/internal/joseutil/joseutil.go
new file mode 100644
index 00000000..00eca4ee
--- /dev/null
+++ b/internal/joseutil/joseutil.go
@@ -0,0 +1,143 @@
+// Package joseutil contains helpers for parsing JOSE objects.
+package joseutil
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"strings"
+	"unicode"
+
+	jose "github.com/go-jose/go-jose/v4"
+)
+
+// ParseSignedInsecure parses a JWS in compact or JSON serialization format
+// accepting any signature algorithm, including none, unknown, or missing ones. It
+// does not verify the signature.
+//
+// It is meant for commands that only display a token, which must be able to show
+// tokens that go.step.sm/crypto/jose.ParseJWS rejects. Only the algorithm check
+// is relaxed, go-jose still rejects other invalid headers, like an embedded key
+// that it does not support. Do not use it to parse a token that will be verified.
+func ParseSignedInsecure(s string) (*jose.JSONWebSignature, error) {
+	s = stripWhitespace(s)
+	if strings.HasPrefix(s, "{") {
+		return jose.ParseSignedJSON(s, signedJSONAlgorithms(s))
+	}
+	protected, _, _ := strings.Cut(s, ".")
+	return jose.ParseSignedCompact(s, []jose.SignatureAlgorithm{
+		"", jose.SignatureAlgorithm(protectedField(protected, "alg")),
+	})
+}
+
+// ParseEncryptedInsecure parses a JWE in compact or JSON serialization format
+// accepting any key and content encryption algorithm, including unknown ones.
+// They must still be present. It does not decrypt the content.
+//
+// It is meant for commands that only display a token, which must be able to show
+// tokens that go.step.sm/crypto/jose.ParseEncrypted rejects. Only the algorithm
+// checks are relaxed, see ParseSignedInsecure. Do not use it to parse a token that
+// will be decrypted.
+func ParseEncryptedInsecure(s string) (*jose.JSONWebEncryption, error) {
+	s = stripWhitespace(s)
+	headers := encryptedHeaders(s)
+
+	// go-jose requires non-empty lists, and it reports missing headers itself.
+	keyAlgorithms := []jose.KeyAlgorithm{""}
+	contentEncryption := []jose.ContentEncryption{""}
+	for _, header := range headers {
+		keyAlgorithms = append(keyAlgorithms, jose.KeyAlgorithm(headerField(header, "alg")))
+		contentEncryption = append(contentEncryption, jose.ContentEncryption(headerField(header, "enc")))
+	}
+	if strings.HasPrefix(s, "{") {
+		return jose.ParseEncryptedJSON(s, keyAlgorithms, contentEncryption)
+	}
+	return jose.ParseEncryptedCompact(s, keyAlgorithms, contentEncryption)
+}
+
+// signedJSONAlgorithms returns the algorithms that the given JWS in JSON
+// serialization format declares. Parsing problems are ignored, as go-jose will
+// report them. The result always includes the empty algorithm, which is the one
+// go-jose reads when a header does not have an alg.
+func signedJSONAlgorithms(s string) []jose.SignatureAlgorithm {
+	type signature struct {
+		Protected string          `json:"protected"`
+		Header    json.RawMessage `json:"header"`
+	}
+	var jws struct {
+		signature
+		Signatures []signature `json:"signatures"`
+	}
+	algs := []jose.SignatureAlgorithm{""}
+	if err := json.Unmarshal([]byte(s), &jws); err != nil {
+		return algs
+	}
+	for _, sig := range append(jws.Signatures, jws.signature) {
+		algs = append(algs,
+			jose.SignatureAlgorithm(protectedField(sig.Protected, "alg")),
+			jose.SignatureAlgorithm(headerField(sig.Header, "alg")),
+		)
+	}
+	return algs
+}
+
+// encryptedHeaders returns the JSON headers of the given JWE. Parsing problems
+// are ignored, as go-jose will report them.
+func encryptedHeaders(s string) [][]byte {
+	if !strings.HasPrefix(s, "{") {
+		protected, _, _ := strings.Cut(s, ".")
+		return [][]byte{decodeProtected(protected)}
+	}
+
+	var jwe struct {
+		Protected   string          `json:"protected"`
+		Unprotected json.RawMessage `json:"unprotected"`
+		Header      json.RawMessage `json:"header"`
+		Recipients  []struct {
+			Header json.RawMessage `json:"header"`
+		} `json:"recipients"`
+	}
+	if err := json.Unmarshal([]byte(s), &jwe); err != nil {
+		return nil
+	}
+	headers := [][]byte{decodeProtected(jwe.Protected), jwe.Unprotected, jwe.Header}
+	for _, recipient := range jwe.Recipients {
+		headers = append(headers, recipient.Header)
+	}
+	return headers
+}
+
+// decodeProtected returns the JSON of a base64url encoded protected header, or
+// nil if it cannot be decoded.
+func decodeProtected(protected string) []byte {
+	header, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(protected, "="))
+	if err != nil {
+		return nil
+	}
+	return header
+}
+
+// protectedField returns a string field of a base64url encoded protected header,
+// or an empty string if it does not have one.
+func protectedField(protected, name string) string {
+	return headerField(decodeProtected(protected), name)
+}
+
+// headerField returns a string field of a JSON header, or an empty string if it
+// does not have one.
+func headerField(header []byte, name string) string {
+	var fields map[string]any
+	if err := json.Unmarshal(header, &fields); err != nil {
+		return ""
+	}
+	value, _ := fields[name].(string)
+	return value
+}
+
+func stripWhitespace(s string) string {
+	return strings.Map(func(r rune) rune {
+		if unicode.IsSpace(r) {
+			return -1
+		}
+		return r
+	}, s)
+}
diff --git a/internal/joseutil/joseutil_test.go b/internal/joseutil/joseutil_test.go
new file mode 100644
index 00000000..8348a900
--- /dev/null
+++ b/internal/joseutil/joseutil_test.go
@@ -0,0 +1,170 @@
+package joseutil
+
+import (
+	"encoding/base64"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func b64(s string) string {
+	return base64.RawURLEncoding.EncodeToString([]byte(s))
+}
+
+func TestParseSignedInsecure(t *testing.T) {
+	payload := b64(`{"sub":"x"}`)
+	sig := b64("signature")
+	compact := func(header string) string {
+		return b64(header) + "." + payload + "." + sig
+	}
+
+	tests := []struct {
+		name  string
+		token string
+		want  []string
+	}{
+		{"supported alg", compact(`{"alg":"ES256"}`), []string{"ES256"}},
+		{"none", compact(`{"alg":"none"}`), []string{"none"}},
+		{"none without signature", b64(`{"alg":"none"}`) + "." + payload + ".", []string{"none"}},
+		{"not allow-listed alg", compact(`{"alg":"ES256K"}`), []string{"ES256K"}},
+		{"unknown alg", compact(`{"alg":"FOO"}`), []string{"FOO"}},
+		{"no alg", compact(`{"typ":"JWT"}`), []string{""}},
+		{"null alg", compact(`{"alg":null}`), []string{""}},
+		{"whitespace", " " + compact(`{"alg":"none"}`) + "\n", []string{"none"}},
+		{
+			"flattened JSON",
+			`{"payload":"` + payload + `","protected":"` + b64(`{"alg":"none"}`) + `","signature":"` + sig + `"}`,
+			[]string{"none"},
+		},
+		{
+			"flattened JSON with alg in the unprotected header",
+			`{"payload":"` + payload + `","protected":"` + b64(`{"typ":"JWT"}`) + `","header":{"alg":"FOO"},"signature":"` + sig + `"}`,
+			[]string{"FOO"},
+		},
+		{
+			"general JSON with multiple signatures",
+			`{"payload":"` + payload + `","signatures":[` +
+				`{"protected":"` + b64(`{"alg":"none"}`) + `","signature":"` + sig + `"},` +
+				`{"protected":"` + b64(`{"alg":"ES256K"}`) + `","signature":"` + sig + `"},` +
+				`{"protected":"` + b64(`{"typ":"JWT"}`) + `","header":{"alg":"FOO"},"signature":"` + sig + `"}]}`,
+			[]string{"none", "ES256K", "FOO"},
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			tok, err := ParseSignedInsecure(tc.token)
+			require.NoError(t, err)
+
+			got := make([]string, len(tok.Signatures))
+			for i := range tok.Signatures {
+				got[i] = tok.Signatures[i].Header.Algorithm
+			}
+			assert.Equal(t, tc.want, got)
+			assert.JSONEq(t, `{"sub":"x"}`, string(tok.UnsafePayloadWithoutVerification()))
+		})
+	}
+}
+
+func TestParseSignedInsecure_errors(t *testing.T) {
+	tests := []struct {
+		name    string
+		token   string
+		wantErr string
+	}{
+		{"not a token", "foo", "compact JWS format must have three parts"},
+		{"invalid header encoding", "!!!." + b64("{}") + ".", "illegal base64 data"},
+		{"invalid header JSON", b64("foo") + "." + b64("{}") + ".", "invalid protected header"},
+		{"alg is not a string", b64(`{"alg":42}`) + "." + b64("{}") + ".", "failed to unmarshal algorithm"},
+		{"invalid JSON", `{"payload":`, "unexpected end of JSON input"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := ParseSignedInsecure(tc.token)
+			assert.ErrorContains(t, err, tc.wantErr)
+		})
+	}
+}
+
+func TestParseSignedInsecure_jsonWithoutSignature(t *testing.T) {
+	tok, err := ParseSignedInsecure(`{"payload":"` + b64(`{"sub":"x"}`) + `"}`)
+	require.NoError(t, err)
+	assert.JSONEq(t, `{"sub":"x"}`, string(tok.UnsafePayloadWithoutVerification()))
+}
+
+// The result of ParseSignedInsecure must not make it possible to accept a token
+// without a valid signature.
+func TestParseSignedInsecure_doesNotVerify(t *testing.T) {
+	tok, err := ParseSignedInsecure(b64(`{"alg":"none"}`) + "." + b64(`{"sub":"x"}`) + ".")
+	require.NoError(t, err)
+
+	_, err = tok.Verify([]byte("a-key-that-does-not-sign-this-token"))
+	assert.Error(t, err)
+}
+
+func TestParseEncryptedInsecure(t *testing.T) {
+	part := b64("aaaaaaaa")
+	rest := "." + part + "." + part + "." + part + "." + part
+	jsonRest := `"iv":"` + part + `","ciphertext":"` + part + `","tag":"` + part + `"`
+
+	tests := []struct {
+		name    string
+		token   string
+		wantAlg string
+		wantEnc string
+	}{
+		{"supported", b64(`{"alg":"A256KW","enc":"A256GCM"}`) + rest, "A256KW", "A256GCM"},
+		{"unknown alg", b64(`{"alg":"FOO","enc":"A256GCM"}`) + rest, "FOO", "A256GCM"},
+		{"unknown enc", b64(`{"alg":"A256KW","enc":"BAR"}`) + rest, "A256KW", "BAR"},
+		{"whitespace", " " + b64(`{"alg":"FOO","enc":"BAR"}`) + rest + "\n", "FOO", "BAR"},
+		{
+			"flattened JSON",
+			`{"protected":"` + b64(`{"alg":"FOO","enc":"BAR"}`) + `","encrypted_key":"` + part + `",` + jsonRest + `}`,
+			"FOO", "BAR",
+		},
+		{
+			"flattened JSON with shared unprotected header",
+			`{"protected":"` + b64(`{"typ":"JWT"}`) + `","unprotected":{"alg":"FOO","enc":"BAR"},"encrypted_key":"` + part + `",` + jsonRest + `}`,
+			"FOO", "BAR",
+		},
+		{
+			"flattened JSON with per-recipient header",
+			`{"protected":"` + b64(`{"enc":"BAR"}`) + `","header":{"alg":"FOO"},"encrypted_key":"` + part + `",` + jsonRest + `}`,
+			"", "BAR",
+		},
+		{
+			"general JSON with multiple recipients",
+			`{"protected":"` + b64(`{"enc":"BAR"}`) + `","recipients":[` +
+				`{"header":{"alg":"FOO"},"encrypted_key":"` + part + `"},` +
+				`{"header":{"alg":"BAZ"},"encrypted_key":"` + part + `"}],` + jsonRest + `}`,
+			"", "BAR",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			tok, err := ParseEncryptedInsecure(tc.token)
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantAlg, tok.Header.Algorithm)
+			assert.Equal(t, tc.wantEnc, tok.Header.ExtraHeaders["enc"])
+		})
+	}
+}
+
+func TestParseEncryptedInsecure_errors(t *testing.T) {
+	_, err := ParseEncryptedInsecure("foo")
+	assert.Error(t, err)
+
+	part := b64("aaaaaaaa")
+	rest := "." + part + "." + part + "." + part + "." + part
+	_, err = ParseEncryptedInsecure(b64(`{"enc":"A256GCM"}`) + rest)
+	assert.ErrorContains(t, err, `missing header "alg"`)
+
+	_, err = ParseEncryptedInsecure(b64(`{"alg":"A256KW"}`) + rest)
+	assert.ErrorContains(t, err, `missing header "enc"`)
+
+	_, err = ParseEncryptedInsecure(b64(`{"alg":"none"}`) + "." + b64("{}") + ".")
+	assert.Error(t, err)
+
+	_, err = ParseEncryptedInsecure(`{"protected":`)
+	assert.Error(t, err)
+}
diff --git a/internal/kdf/argon2.go b/internal/kdf/argon2.go
index b5a9cb5b..5d3fe077 100644
--- a/internal/kdf/argon2.go
+++ b/internal/kdf/argon2.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 
 	"github.com/pkg/errors"
+
 	"github.com/smallstep/cli/internal/cast"
 )
 
diff --git a/internal/sshutil/agent.go b/internal/sshutil/agent.go
index 51c36211..f10bca22 100644
--- a/internal/sshutil/agent.go
+++ b/internal/sshutil/agent.go
@@ -7,9 +7,10 @@ import (
 	"time"
 
 	"github.com/pkg/errors"
-	"github.com/smallstep/cli/internal/cast"
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/crypto/ssh/agent"
+
+	"github.com/smallstep/cli/internal/cast"
 )
 
 type options struct {
diff --git a/token/parse.go b/token/parse.go
index 4c409345..7fe72928 100644
--- a/token/parse.go
+++ b/token/parse.go
@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/pkg/errors"
+
 	"go.step.sm/crypto/jose"
 )
 
diff --git a/token/provision/provision.go b/token/provision/provision.go
index a931c03d..53004863 100644
--- a/token/provision/provision.go
+++ b/token/provision/provision.go
@@ -1,8 +1,9 @@
 package provision
 
 import (
-	"github.com/smallstep/cli/token"
 	"go.step.sm/crypto/jose"
+
+	"github.com/smallstep/cli/token"
 )
 
 // Token defines a one time use token that is intended to be exchanged
diff --git a/token/provision/provision_test.go b/token/provision/provision_test.go
index fe400177..352baa74 100644
--- a/token/provision/provision_test.go
+++ b/token/provision/provision_test.go
@@ -6,10 +6,12 @@ import (
 	"testing"
 	"time"
 
-	"github.com/smallstep/cli/token"
 	"github.com/stretchr/testify/assert"
+
 	"go.step.sm/crypto/jose"
 	"go.step.sm/crypto/pemutil"
+
+	"github.com/smallstep/cli/token"
 )
 
 func withFixedTime(tok *Token, t time.Time) {
diff --git a/token/token.go b/token/token.go
index a8e5eed7..4e4a8277 100644
--- a/token/token.go
+++ b/token/token.go
@@ -4,6 +4,7 @@ import (
 	"time"
 
 	"github.com/pkg/errors"
+
 	"go.step.sm/crypto/jose"
 	"go.step.sm/crypto/keyutil"
 )
@@ -96,7 +97,7 @@ func (c *Claims) Sign(alg jose.SignatureAlgorithm, key any) (string, error) {
 		c.Set("aud", c.Audience[0])
 	}
 
-	raw, err := jose.Signed(signer).Claims(c.Claims).Claims(c.ExtraClaims).CompactSerialize()
+	raw, err := jose.Signed(signer).Claims(c.Claims).Claims(c.ExtraClaims).Serialize()
 	if err != nil {
 		return "", errors.Wrapf(err, "error serializing JWT")
 	}
diff --git a/utils/cautils/client.go b/utils/cautils/client.go
index f1801cc7..80e88fa4 100644
--- a/utils/cautils/client.go
+++ b/utils/cautils/client.go
@@ -17,7 +17,6 @@ import (
 	"github.com/smallstep/certificates/pki"
 	"github.com/smallstep/cli-utils/errs"
 	"github.com/smallstep/cli-utils/ui"
-
 	"go.step.sm/crypto/keyutil"
 	"go.step.sm/crypto/pemutil"
 
diff --git a/utils/cautils/tpm.go b/utils/cautils/tpm.go
index d1976073..1f136d6b 100644
--- a/utils/cautils/tpm.go
+++ b/utils/cautils/tpm.go
@@ -21,13 +21,13 @@ import (
 
 	"github.com/fxamacker/cbor/v2"
 	"github.com/google/go-tpm/legacy/tpm2"
-	"github.com/smallstep/go-attestation/attest"
 	"github.com/urfave/cli"
 
 	"github.com/smallstep/certificates/acme"
 	"github.com/smallstep/certificates/ca"
 	"github.com/smallstep/cli-utils/errs"
 	"github.com/smallstep/cli-utils/ui"
+	"github.com/smallstep/go-attestation/attest"
 	"go.step.sm/crypto/jose"
 	"go.step.sm/crypto/keyutil"
 	"go.step.sm/crypto/kms/uri"
diff --git a/utils/cli.go b/utils/cli.go
index c2d06f65..7803976e 100644
--- a/utils/cli.go
+++ b/utils/cli.go
@@ -38,7 +38,7 @@ func GetKeyDetailsFromCLI(ctx *cli.Context, insecure bool, ktyKey, curveKey, siz
 				return kty, crv, size, errs.MinSizeInsecureFlag(ctx, sizeKey, strconv.Itoa(minimalSize))
 			}
 			if size <= 0 {
-				return kty, crv, size, errs.MinSizeFlag(ctx, sizeKey, "0")
+				return kty, crv, size, errs.MinSizeFlag(ctx, sizeKey, "1")
 			}
 		case "EC":
 			if ctx.IsSet(sizeKey) {