Update Rust crate tower-http to 0.7

Update infra go dependencies
updated makefiles and added dependency installation for ODIN
2026-09-06 20:01:47 +00:00 · 2026-09-02 21:07:16 +00:00 · 2026-09-02 11:37:29 -06:00 · 2026-08-31 14:03:26 -06:00 · 2026-08-31 13:45:58 -06:00 · 2026-08-31 13:30:26 -06:00
34 changed files with 1793 additions and 141 deletions
@@ -1,4 +1,9 @@
 # Runs on pull requests: unit tests plus a compile check.
+# Split into separate jobs (Odin, API, Infra) so they can run concurrently,
+# and gated by changed paths so each only runs when its code changes.
+# Infra always runs (unit tests + vet) regardless of what changed; its Pulumi
+# preview (posted as a PR comment) runs when the infra, gui, or api code
+# changed, since any of those can change what gets deployed.

 name: CI

@@ -16,18 +21,51 @@ env:
  ODIN_VERSION: dev-2026-07

 jobs:
-  test:
-    name: Unit tests
+  changes:
+    name: Detect changed paths
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      odin: ${{ steps.filter.outputs.odin }}
+      api: ${{ steps.filter.outputs.api }}
+      infra: ${{ steps.filter.outputs.infra }}
+      preview: ${{ steps.decide.outputs.run }}
+    steps:
+      - uses: dorny/paths-filter@v4
+        id: filter
+        with:
+          filters: |
+            odin:
+              - 'gui/**'
+              - 'scripts/**'
+            api:
+              - 'api/**'
+            infra:
+              - 'infra/**'
+
+      - name: Decide whether to run the infra preview
+        id: decide
+        run: |
+          if [ "${{ steps.filter.outputs.infra }}" = "true" ] || \
+             [ "${{ steps.filter.outputs.odin }}" = "true" ] || \
+             [ "${{ steps.filter.outputs.api }}" = "true" ]; then
+            echo "run=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "run=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  odin:
+    name: Odin unit tests and build
+    needs: changes
+    if: ${{ needs.changes.outputs.odin == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: recursive

-      - uses: actions/setup-go@v6
-        with:
-          go-version: '1.26'
-
      - name: Install Odin ${{ env.ODIN_VERSION }}
        run: scripts/install_odin.sh

@@ -42,14 +80,55 @@ jobs:
          fi

      - name: Run Odin unit tests
-        run: |
-          mkdir -p lib/local
-          odin test src -collection:lib=lib/local
+        run: make -C gui test

      - name: Verify build
+        run: make -C gui build
+
+  api:
+    name: API unit tests and lint
+    needs: changes
+    if: ${{ needs.changes.outputs.api == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Test Rust API
        run: |
-          mkdir -p bin
-          odin build src -collection:lib=lib/local -o:speed -out:bin/desi_explorer
+          cd api
+          cargo test
+
+      - name: Lint Rust API
+        run: |
+          cd api
+          cargo clippy --all-targets -- -D warnings
+
+      - name: Format-check Rust API
+        run: |
+          cd api
+          cargo fmt --all --check
+
+  infra:
+    name: Infra unit tests, vet, and preview
+    needs: changes
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version: '1.26'

      - name: Run Go tests
        run: |
@@ -61,3 +140,70 @@ jobs:
        run: |
          cd infra
          go vet ./...
+
+      # Pulumi CLI. State uses the local file backend (infra/Pulumi.yaml ->
+      # file://~/.pulumi), so no Pulumi Cloud token is needed. Preview diffs
+      # the current source against the last-known stack state; on an ephemeral
+      # runner the self-hosted environment must persist ~/.pulumi to get a
+      # meaningful diff (otherwise preview shows the pending creates).
+      - name: Install Pulumi
+        if: ${{ needs.changes.outputs.preview == 'true' }}
+        run: |
+          curl -fsSL https://get.pulumi.com | sh
+          echo "$HOME/.pulumi/bin" >> "$GITHUB_PATH"
+
+      # The runner must reach the on-prem k3s cluster for preview to diff
+      # against live state. For a self-hosted runner this is the ambient
+      # kubeconfig; otherwise populate it from the KUBECONFIG secret here.
+      - name: Configure kubeconfig
+        if: ${{ needs.changes.outputs.preview == 'true' }}
+        run: |
+          mkdir -p "$HOME/.kube"
+          if [ -n "$KUBECONFIG_B64" ]; then
+            printf '%s' "$KUBECONFIG_B64" | base64 -d > "$HOME/.kube/config"
+          fi
+        env:
+          KUBECONFIG_B64: ${{ secrets.KUBECONFIG }}
+
+      - name: Pulumi preview
+        if: ${{ needs.changes.outputs.preview == 'true' }}
+        working-directory: infra
+        env:
+          PULUMI_SKIP_UPDATE_CHECK: 'true'
+        run: |
+          go mod download
+          pulumi preview --diff 2>&1 | tee /tmp/pulumi-preview.txt || true
+
+      - name: Comment preview on PR
+        if: ${{ needs.changes.outputs.preview == 'true' }}
+        env:
+          GITEA_API: ${{ gitea.api_url }}
+          REPO: ${{ gitea.repository }}
+          TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          python3 - <<'PY'
+          import json, os, urllib.request
+
+          with open('/tmp/pulumi-preview.txt') as f:
+              preview = f.read().strip() or '(no changes)'
+
+          body = "### Pulumi preview\n\n```\n" + preview + "\n```"
+          payload = json.dumps({"body": body}).encode()
+
+          url = (
+              f"{os.environ['GITEA_API']}/repos/{os.environ['REPO']}"
+              f"/issues/{os.environ['PR_NUMBER']}/comments"
+          )
+          req = urllib.request.Request(
+              url,
+              data=payload,
+              method='POST',
+              headers={
+                  'Authorization': f"token {os.environ['TOKEN']}",
+                  'Content-Type': 'application/json',
+              },
+          )
+          urllib.request.urlopen(req)
+          print('Posted Pulumi preview comment')
+          PY
@@ -0,0 +1,164 @@
+# Runs on version tags (e.g. `v1.0.0`) tagged off `main`: detects which
+# sections changed since the previous tag, builds only those, and runs
+# `pulumi up` to deploy. Infra always runs (it reconciles the cluster) while
+# the Odin web build and the API are only built/deployed when their code
+# changed.
+
+name: Deploy
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+concurrency:
+  group: desi-explorer-deploy-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  # Odin release to use (matches `dev-2026-07`, the version used locally).
+  ODIN_VERSION: dev-2026-07
+
+jobs:
+  changes:
+    name: Detect what changed since previous tag
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      odin: ${{ steps.filter.outputs.odin }}
+      api: ${{ steps.filter.outputs.api }}
+      infra: ${{ steps.filter.outputs.infra }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Determine previous tag
+        id: prev
+        run: |
+          git fetch --tags --force
+          PREV="$(git tag --sort=-v:refname --list 'v*' | sed -n 2p)"
+          if [ -z "$PREV" ]; then PREV="origin/main"; fi
+          echo "prev=${PREV}" >> "$GITHUB_OUTPUT"
+          echo "Comparing ${GITHUB_REF_NAME} against ${PREV}"
+
+      - uses: dorny/paths-filter@v4
+        id: filter
+        with:
+          base: ${{ steps.prev.outputs.prev }}
+          filters: |
+            odin:
+              - 'gui/**'
+              - 'scripts/**'
+            api:
+              - 'api/**'
+            infra:
+              - 'infra/**'
+
+  build-web:
+    name: Build web (Odin/WASM)
+    needs: changes
+    if: ${{ needs.changes.outputs.odin == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Install Odin ${{ env.ODIN_VERSION }}
+        run: scripts/install_odin.sh
+
+      - name: Install Emscripten
+        run: |
+          git clone --depth 1 https://github.com/emscripten-core/emsdk.git /tmp/emsdk
+          /tmp/emsdk/emsdk install latest
+          /tmp/emsdk/emsdk activate latest
+
+      - name: Build WebAssembly
+        run: |
+          source /tmp/emsdk/emsdk_env.sh
+          gui/scripts/build_web.sh
+
+      - name: Package
+        run: |
+          mkdir -p dist
+          cd build/web
+          python3 - <<'EOF'
+          import glob, zipfile
+          z = zipfile.ZipFile('../../dist/desi-explorer-web.zip', 'w', zipfile.ZIP_DEFLATED)
+          for f in glob.glob('*'):
+              z.write(f)
+          EOF
+
+      - uses: christopherHX/gitea-upload-artifact@v4
+        with:
+          name: web
+          path: dist/desi-explorer-web.zip
+
+  build-api:
+    name: Build API (Rust)
+    needs: changes
+    if: ${{ needs.changes.outputs.api == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Build release binary
+        run: |
+          cd api
+          cargo build --release
+
+      - uses: christopherHX/gitea-upload-artifact@v4
+        with:
+          name: api
+          path: api/target/release/desi-explorer-api
+
+  deploy:
+    name: Deploy (infra up)
+    needs: [changes, build-web, build-api]
+    if: ${{ !failure() && !cancelled() }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version: '1.26'
+
+      # Pulumi CLI. State uses the local file backend (infra/Pulumi.yaml ->
+      # file://~/.pulumi), so no Pulumi Cloud token is needed — but the
+      # self-hosted runner must persist ~/.pulumi between runs to keep state.
+      - name: Install Pulumi
+        run: |
+          curl -fsSL https://get.pulumi.com | sh
+          echo "$HOME/.pulumi/bin" >> "$GITHUB_PATH"
+
+      # The runner must reach the on-prem k3s cluster. For a self-hosted runner
+      # this is the ambient kubeconfig; otherwise populate it from a KUBECONFIG
+      # secret here:
+      - name: Configure kubeconfig
+        run: |
+          mkdir -p "$HOME/.kube"
+          if [ -n "$KUBECONFIG_B64" ]; then
+            printf '%s' "$KUBECONFIG_B64" | base64 -d > "$HOME/.kube/config"
+          fi
+        env:
+          KUBECONFIG_B64: ${{ secrets.KUBECONFIG }}
+
+      - name: Deploy with Pulumi
+        run: |
+          go mod download
+          pulumi up --yes --skip-preview
+        working-directory: infra
@@ -49,8 +49,8 @@ jobs:

      - name: Build
        run: |
-          mkdir -p lib/local build/linux
-          odin build src -o:speed -collection:lib=lib/local -out:build/linux/desi_explorer
+          mkdir -p build/linux
+          odin build gui/src -o:speed -collection:lib=gui/lib/local -out:build/linux/desi_explorer

      - name: Package
        run: |
@@ -110,10 +110,10 @@ jobs:
      # next to desi_explorer.exe.
      - name: Build
        run: |
-          mkdir -p lib/local build/windows
-          odin build src -target:windows_amd64 -build-mode:obj \
+          mkdir -p build/windows
+          odin build gui/src -target:windows_amd64 -build-mode:obj \
            -define:RAYLIB_SHARED=true -o:speed \
-            -collection:lib=lib/local -out:build/windows/desi_explorer
+            -collection:lib=gui/lib/local -out:build/windows/desi_explorer
          x86_64-w64-mingw32-gcc -O2 -o build/windows/desi_explorer.exe \
            build/windows/desi_explorer.obj \
            /tmp/odin-win/dist/vendor/raylib/windows/raylibdll.lib \
@@ -151,7 +151,7 @@ jobs:
      - name: Build WebAssembly
        run: |
          source /tmp/emsdk/emsdk_env.sh
-          scripts/build_web.sh
+          gui/scripts/build_web.sh

      - name: Package
        run: |
@@ -6,3 +6,4 @@ build/
 resources/ai/sessions
 infra/Pulumi.*.yaml.backup
 infra/desi-explorer-infra
+api/target/
@@ -1,26 +1,30 @@
 # AGENTS.md

-Odin + raylib interactive 3D universe map (DESI data), with Go + Pulumi infra and Gitea Actions CI. A clean `odin build` + `go test` is the verification step.
+Odin + raylib interactive 3D universe map (DESI data), a Rust + axum API, with Go + Pulumi infra and Gitea Actions CI. A clean `odin build` + `cargo test` + `go test` is the verification step.

-## Commands (root Makefile)
- Run: `make run` (`odin run src`); Build: `make build` (`odin build src -collection:lib=lib/local -out:bin/desi_explorer`)
- Web: `make build-web` (Emscripten/WASM -> build/web); Debug: `make build-debug`
- Test: `make test` (runs `odin test` for src/ and `go test` for infra/); Clean: `make clean`
- Setup: `make setup` (submodules + `go mod tidy` in infra/)
- Infra: `make infra-preview`, `make infra-up`, `make infra-down`, `make infra-refresh` (Pulumi, `--cwd infra`)
+## Commands
+The root `Makefile` is a lean delegator: base commands (`run`, `build`, `test`, ...) forward into the per-project Makefiles in `gui/`, `api/`, and `infra/`. Project-specific commands are reached via `make -C <dir> <target>`.
+- Run: `make run`; Build: `make build` (`-> bin/desi_explorer`); Web: `make build-web` (Emscripten/WASM -> `build/web`); Debug: `make build-debug`; Run Web: `make run-web` (WASM build + API server)
+- Test: `make test` (runs `odin test` in gui/, `cargo test` in api/, `go test` in infra/); Clean: `make clean`; Format: `make fmt`
+- API: `make api-run`, `make api-test`, `make api-check` (thin passthroughs to `make -C api <target>`)
+- Setup: `make setup` (submodules + gui lib/local + `cargo fetch` + `go mod tidy` in infra/)
+- Add dependency: `make -C gui add-dep DEP=<name>` (searches Codeberg/GitHub/GitLab, adds as submodule to `gui/lib/local/`)
+- Infra: `make infra-preview`, `make infra-up`, `make infra-down`, `make infra-refresh` (passthroughs to `make -C infra <target>`)
 - Renovate: `make renovate-validate` (npx renovate-config-validator)
- Format Odin with `odinfmt` (config `odinfmt.json`: tabs, width 80)
+- Format Odin with `odinfmt` (config `gui/odinfmt.json`: tabs, width 80); format Rust with `cargo fmt`

 ## Layout
- `src/main.odin` — entrypoint; loop is `update()` → `draw()`; resizable window with an orbital `Camera3D`; point cloud generated procedurally in `make_universe`.
- `lib/` — third-party Odin deps (submodules / vendored libs). raylib is **not** here: it ships vendored with Odin and is imported as `vendor:raylib`. `lib/local/` is the default `-collection:lib` target and is currently empty.
- `infra/` — Go + Pulumi (`runtime: go`) targeting the on-prem k3s cluster via the default kubeconfig, mirroring the `homelab` repo's pattern. Module name is `desi-explorer-infra`.
- `.gitea/workflows/` — `ci.yml` (PR: install Odin, `odin test` + build, `go test`) and `release.yml` (tag `v*`: build native + WASM + publish a Gitea release).
+- `gui/` — the Odin + raylib renderer. `gui/src/main.odin` is the entrypoint (loop is `update()` → `draw()`; resizable window with an orbital `Camera3D`; point cloud generated procedurally in `make_universe`). `gui/lib/` holds third-party Odin deps (see below), `gui/www/` the Web GUI (WASM shell / static web assets), and `gui/scripts/` the build scripts. `gui/Makefile` owns the Odin targets.
+- `gui/lib/` — third-party Odin deps (submodules / vendored libs). raylib is **not** here: it ships vendored with Odin and is imported as `vendor:raylib`. `gui/lib/local/` is the default `-collection:lib` target and is currently empty.
+- `api/` — Rust + axum backend API that will serve DESI catalog data. `src/lib.rs` exposes `routes`/`models`/`config`; `src/main.rs` is the server entrypoint (binds `API_BIND_ADDR`, default `0.0.0.0:8080`). Crate name is `desi-explorer-api` (lib `desi_explorer_api`); Rust version pinned in `api/rust-toolchain.toml`. `api/Makefile` owns the Rust targets.
+- `infra/` — Go + Pulumi (`runtime: go`) targeting the on-prem k3s cluster via the default kubeconfig, mirroring the `homelab` repo's pattern. Module name is `desi-explorer-infra`. `infra/Makefile` owns the Pulumi/Go targets.
+- `scripts/` — repo-level build helpers (Odin toolchain install).
+- `.gitea/workflows/` — `ci.yml` (PR: `odin test` + build, `cargo test` + clippy, `go test` + vet; infra always runs tests/vet and posts a `pulumi preview --diff` as a PR comment when infra/gui/api changed) and `release.yml` (tag `v*`: build native + WASM + publish a Gitea release).

 ## Conventions
- Odin code lives in `src/`; external deps go in `lib/` and are wired via `-collection:lib=lib/local` (or a git submodule imported by relative path).
+- Odin code lives in `gui/src/`; external deps go in `gui/lib/` and are wired via `-collection:lib=lib/local` (or a git submodule imported by relative path).
 - Everything is plain `make` — no Taskfile — so CI (Gitea Actions) can call `make` directly.
- Keep the renderer (src/) and infra (infra/) logically separated; the root Makefile is the only place that ties them together.
+- Keep the renderer (gui/), API (api/), and infra (infra/) logically separated; each owns its own Makefile, and the root Makefile is the only place that ties them together.

 ## Gotchas
 - Odin version is pinned in `.gitea/workflows/*.yml` (`ODIN_VERSION`) and defaults in `scripts/install_odin.sh`; bump both together when tracking a new release.
@@ -32,4 +36,4 @@ Odin + raylib interactive 3D universe map (DESI data), with Go + Pulumi infra an
 Export session information to `resources/ai/sessions` at the end of every session — for both plans and builds. (Gitignored.)

 ## Gitignored
-`bin/`, `build/`, `*.bin`, `*.o`, `*.log`, `resources/ai/sessions`, `infra/Pulumi.*.yaml.backup`.
+`bin/`, `build/`, `*.bin`, `*.o`, `*.log`, `resources/ai/sessions`, `infra/Pulumi.*.yaml.backup`, `api/target/`.
@@ -1,75 +1,84 @@
 # DESI Explorer — root Makefile
 #
-# Orchestrates the Odin renderer (src/) and the Go/Pulumi infrastructure
-# (infra/). Intended to be called directly by Gitea Actions CI.
+# Lean orchestrator: the "base" commands (`run`, `build`, `test`, ...) delegate
+# into the per-project Makefiles in `gui/`, `api/`, and `infra/`. Project-
+# specific commands live in those directories and are reached with
+# `make -C <dir> <target>` (or the thin passthrough targets below).

-ODIN         ?= odin
-BIN          ?= bin
-BINARY       := $(BIN)/desi_explorer
-ODIN_FLAGS   := -collection:lib=lib/local
-WASM_DEFINE  := RAYLIB_WASM_LIB=env.o
+GUI          := gui
+API          := api
+INFRA        := infra

-.PHONY: help setup run build build-debug build-web test clean fmt \
-        infra-preview infra-up infra-down infra-refresh infra-static \
+.PHONY: help setup run run-web build build-debug build-web test clean fmt \
        renovate-validate

 help: ## List available targets
 	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | \
 		awk 'BEGIN {FS = ":.*?## "}; {printf "  \033[36m%-18s\033[0m %s\n", $$1, $$2}'
+	@echo ""
+	@echo "Sub-project targets:"
+	@echo "  \033[36mmake -C gui help\033[0m     Odin renderer (run, build, build-web, test, fmt, ...)"
+	@echo "  \033[36mmake -C api help\033[0m     Rust API (run, build, test, check, fmt, ...)"
+	@echo "  \033[36mmake -C infra help\033[0m   Infra (preview, up, down, refresh, test, ...)"

 ## ---- Setup ---------------------------------------------------------------

-setup: ## Pull submodules + tidy Go deps
+setup: ## Setup all sub-projects (submodules, gui deps, api deps, infra deps)
 	@git submodule update --init --recursive
-	@mkdir -p lib/local
-	@cd infra && go mod tidy
+	@$(MAKE) -C $(GUI) setup
+	@$(MAKE) -C $(API) setup
+	@$(MAKE) -C $(INFRA) tidy

 ## ---- Renderer (Odin) -----------------------------------------------------

-run: ## Run the native app
-	@mkdir -p lib/local
-	$(ODIN) run src $(ODIN_FLAGS)
+run: ## Run the native app (gui/)
+	@$(MAKE) -C $(API) run & api_pid=$$!; \
+	trap 'kill $$api_pid 2>/dev/null' INT TERM EXIT; \
+	$(MAKE) -C $(GUI) run; \
+	kill $$api_pid 2>/dev/null

-build: ## Release build -> bin/desi_explorer
-	@mkdir -p lib/local $(BIN)
-	$(ODIN) build src $(ODIN_FLAGS) -o:speed -out:$(BINARY)
+build: ## Release build (gui/ + api/)
+	@$(MAKE) -C $(GUI) build
+	@$(MAKE) -C $(API) build

-build-debug: ## Debug build -> bin/desi_explorer
-	@mkdir -p lib/local $(BIN)
-	$(ODIN) build src $(ODIN_FLAGS) -o:none -debug -out:$(BINARY)
+build-debug: ## Debug build (gui/ + api/)
+	@$(MAKE) -C $(GUI) build-debug
+	@$(MAKE) -C $(API) build

-build-web: ## WebAssembly build -> build/web (needs emscripten)
-	@scripts/build_web.sh
+build-web: ## WebAssembly build -> build/web (gui/, needs emscripten)
+	@$(MAKE) -C $(GUI) build-web

-test: ## Run tests (Odin src/ + Go infra/)
-	@mkdir -p lib/local
-	$(ODIN) test src $(ODIN_FLAGS)
-	@cd infra && go test ./...
+run-web: ## Start WASM build + API server for web dev
+	@$(MAKE) -C $(API) run & api_pid=$$!; \
+	trap 'kill $$api_pid 2>/dev/null' INT TERM EXIT; \
+	$(MAKE) -C $(GUI) build-web; \
+	kill $$api_pid 2>/dev/null

-clean: ## Remove build artifacts
-	rm -rf $(BIN) build
+## ---- Aggregates ----------------------------------------------------------

-fmt: ## Format Odin sources with odinfmt
-	odinfmt src
+test: ## Test all projects (odin + cargo + go)
+	@$(MAKE) -C $(GUI) test
+	@$(MAKE) -C $(API) test
+	@$(MAKE) -C $(INFRA) test

-## ---- Infrastructure (Go + Pulumi) ----------------------------------------
+clean: ## Remove build artifacts from all projects
+	@$(MAKE) -C $(GUI) clean
+	@$(MAKE) -C $(API) clean
+	@$(MAKE) -C $(INFRA) clean

-infra-preview: ## Preview infra changes against the cluster
-	@pulumi preview --cwd infra
+fmt: ## Format all projects (odin + rust)
+	@$(MAKE) -C $(GUI) fmt
+	@$(MAKE) -C $(API) fmt

-infra-up: ## Deploy/update infra
-	@pulumi up --cwd infra
+## ---- Passthrough to sub-project Makefiles --------------------------------

-infra-down: ## Tear down the stack's resources
-	@pulumi destroy --cwd infra
+api-%: ## Forward a target to the api/ Makefile
+	@$(MAKE) -C $(API) $*

-infra-refresh: ## Refresh Pulumi state against the live cluster
-	@pulumi refresh --cwd infra
-
-infra-static: ## Typecheck + vet the Go infra without Pulumi
-	@cd infra && go build -o /dev/null . && go vet ./...
+infra-%: ## Forward a target to the infra/ Makefile
+	@$(MAKE) -C $(INFRA) $*

 ## ---- Tooling -------------------------------------------------------------

 renovate-validate: ## Validate renovate.json
-	npx --yes renovate-config-validator
+	bunx --package renovate renovate-config-validator renovate.json --strict
@@ -42,36 +42,56 @@ Early scaffolding. The application currently:
 ## Repository Layout

 ```
-src/       Odin source — the interactive 3D experience (entrypoint: src/main.odin)
-lib/       Third-party Odin dependencies (submodules / vendored libs)
+gui/           Odin renderer — the interactive 3D experience (entrypoint: gui/src/main.odin)
+  gui/lib/     Third-party Odin dependencies (submodules / vendored libs)
+  gui/www/     Web GUI — WASM shell / static web assets
+  gui/scripts/ Build scripts (WASM build helper)
+api/           Rust backend API (axum) for serving DESI catalog data
 infra/         Go + Pulumi infrastructure-as-code (deploys the experience to k8s)
-scripts/   Build helpers (Odin install, WASM build)
+scripts/       Repo-level build helpers (Odin install)
 .gitea/        Gitea Actions CI/CD workflows
 ```

-The renderer (`src/`) and the infrastructure (`infra/`) are kept in separate
-directories so their logic stays cleanly separated; both are orchestrated by the
-root `Makefile`.
+The renderer (`gui/`), the API (`api/`), and the infrastructure (`infra/`) are
+kept in separate directories so their logic stays cleanly separated. Each
+project carries its own `Makefile`; the root `Makefile` delegates the base
+commands (`run`, `build`, `test`, ...) into them.

 ## Building & Running

 Requires [Odin](https://odin-lang.org/docs/install) with the bundled raylib
 vendor bindings. The web build additionally requires [Emscripten](https://emscripten.org)
-(`emcc`). The infrastructure requires [Go](https://go.dev) and
-[Pulumi](https://www.pulumi.com).
+(`emcc`). The API requires [Rust](https://www.rust-lang.org) (stable toolchain,
+pinned via `api/rust-toolchain.toml`). The infrastructure requires
+[Go](https://go.dev) and [Pulumi](https://www.pulumi.com).

-All project commands live in the root `Makefile` (`make help` lists them):
+The root `Makefile` delegates everything to the per-project Makefiles
+(`make help` lists the base targets):

 ```sh
 make setup        # pull submodules + tidy Go deps
-make run          # run the native app
-make build        # -> bin/desi_explorer
-make build-debug  # debug native build
-make build-web    # -> build/web (wasm + html)
-make test         # odin test + go test
-make clean        # remove build artifacts
+make run          # run the native app (gui/)
+make build        # -> bin/desi_explorer (gui/)
+make build-debug  # debug native build (gui/)
+make build-web    # -> build/web (wasm + html, gui/)
+make test         # odin test + go test + cargo test
+make clean        # remove build artifacts from all projects
+make fmt          # format all projects
 ```

+Project-specific targets live in their own `Makefile` and are reached with
+`make -C <dir> <target>`:
+
+```sh
+make -C gui help    # Odin renderer (run, build, build-debug, build-web, test, fmt)
+make -C api help    # Rust API (run, build, test, check, fmt)
+make -C infra help  # Infra (preview, up, down, refresh, static, test)
+```
+
+The root also provides thin passthroughs: `make api-<target>` and
+`make infra-<target>` forward to the corresponding sub-project (e.g.
+`make api-check` -> `make -C api check`).
+
 ## Dependency Updates (Renovate)

 [Renovate](https://github.com/renovatebot/renovate) keeps dependencies up to
@@ -82,8 +102,9 @@ hour (`renovate` workflow in the `homelab` repo) with autodiscovery filtered to
 picked up automatically. Config for this repo lives in `renovate.json` and is
 validated with `make renovate-validate`.

-It manages three categories:
+It manages four categories:

 - **Infra dependencies** — `infra/go.mod` (`gomod` manager); minor/patch updates grouped into a single PR.
- **Submodules** — `lib/` submodules via `.gitmodules` (`git-submodules` manager).
+- **API dependencies** — `api/Cargo.toml` (`cargo` manager); minor/patch updates grouped into a single PR.
+- **Submodules** — `gui/lib/` submodules via `.gitmodules` (`git-submodules` manager).
 - **Workflow actions** — action versions in `.gitea/workflows/*.yml` (`github-actions` manager, which understands Gitea's `.gitea` layout).
@@ -0,0 +1,2 @@
+# Cargo build artifacts
+target/
@@ -0,0 +1,687 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "axum"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
+dependencies = [
+ "axum-core",
+ "bytes",
+ "form_urlencoded",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde_core",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "bitflags"
+version = "2.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "desi-explorer-api"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "axum",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tower",
+ "tower-http",
+ "tracing",
+ "tracing-subscriber",
+]
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
+
+[[package]]
+name = "futures-task"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
+
+[[package]]
+name = "futures-util"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "http"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hyper"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "bytes",
+ "http",
+ "http-body",
+ "hyper",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "log"
+version = "0.4.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
+
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "mio"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys",
+]
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
+dependencies = [
+ "itoa",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+
+[[package]]
+name = "thread_local"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "tokio"
+version = "1.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
+dependencies = [
+ "libc",
+ "mio",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08a05a66a4fdd61cbbe0a1d755ffe0ca6aba159dd4820936a0ff8a8278245b9c"
+dependencies = [
+ "bitflags",
+ "bytes",
+ "http",
+ "http-body",
+ "percent-encoding",
+ "pin-project-lite",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
@@ -0,0 +1,22 @@
+[package]
+name = "desi-explorer-api"
+version = "0.1.0"
+edition = "2021"
+description = "Backend API for DESI Explorer — serves DESI survey catalog data"
+
+[dependencies]
+axum = "0.8"
+tokio = { version = "1", features = ["macros", "rt-multi-thread", "signal"] }
+serde = { version = "1", features = ["derive"] }
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+tower-http = { version = "0.7", features = ["cors", "trace"] }
+anyhow = "1"
+
+[dev-dependencies]
+tower = { version = "0.5", features = ["util"] }
+serde_json = "1"
+
+[profile.release]
+lto = true
+strip = true
@@ -0,0 +1,33 @@
+# api/Makefile — the Rust + axum backend API.
+#
+# Driven directly with `make -C api <target>` (or via the root Makefile's
+# `api-*` convenience targets).
+
+CARGO ?= cargo
+
+.PHONY: help setup run build test check fmt clean
+
+help: ## List available targets
+	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | \
+		awk 'BEGIN {FS = ":.*?## "}; {printf "  \033[36m%-18s\033[0m %s\n", $$1, $$2}'
+
+setup: ## Fetch dependencies
+	$(CARGO) fetch
+
+run: ## Run the API server (dev)
+	$(CARGO) run
+
+build: ## Release build -> target/release/
+	$(CARGO) build --release
+
+test: ## Run unit/integration tests
+	$(CARGO) test
+
+check: ## Format-check + lint (clippy -D warnings)
+	$(CARGO) fmt --all --check && $(CARGO) clippy --all-targets -- -D warnings
+
+fmt: ## Format Rust sources with rustfmt
+	$(CARGO) fmt
+
+clean: ## Remove Cargo build artifacts
+	$(CARGO) clean
@@ -0,0 +1,2 @@
+[toolchain]
+channel = "stable"
@@ -0,0 +1,12 @@
+pub struct Config {
+    pub bind_addr: String,
+}
+
+impl Config {
+    pub fn from_env() -> anyhow::Result<Self> {
+        let bind_addr =
+            std::env::var("API_BIND_ADDR").unwrap_or_else(|_| "0.0.0.0:8080".to_string());
+
+        Ok(Self { bind_addr })
+    }
+}
@@ -0,0 +1,3 @@
+pub mod config;
+pub mod models;
+pub mod routes;
@@ -0,0 +1,30 @@
+use desi_explorer_api::{config, routes};
+
+use tracing_subscriber::EnvFilter;
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    tracing_subscriber::fmt()
+        .with_env_filter(
+            EnvFilter::try_from_default_env()
+                .unwrap_or_else(|_| EnvFilter::new("desi_explorer_api=info")),
+        )
+        .init();
+
+    let config = config::Config::from_env()?;
+    let app = routes::app();
+
+    let listener = tokio::net::TcpListener::bind(&config.bind_addr).await?;
+    tracing::info!("DESI Explorer API listening on {}", config.bind_addr);
+
+    axum::serve(listener, app)
+        .with_graceful_shutdown(shutdown_signal())
+        .await?;
+
+    Ok(())
+}
+
+async fn shutdown_signal() {
+    let _ = tokio::signal::ctrl_c().await;
+    tracing::info!("shutting down");
+}
@@ -0,0 +1,22 @@
+use serde::Serialize;
+
+/// Catalog metadata for a DESI data release/survey.
+#[derive(Debug, Clone, Serialize)]
+pub struct Catalog {
+    pub name: String,
+    pub release: String,
+    pub description: &'static str,
+    pub object_count: Option<u64>,
+}
+
+/// A single catalog object (galaxy / quasar / star) with its survey
+/// coordinates. `ra` and `dec` are in degrees; `redshift` is dimensionless.
+#[derive(Debug, Serialize)]
+pub struct CatalogObject {
+    pub id: String,
+    pub catalog: String,
+    pub object_type: String,
+    pub ra: f64,
+    pub dec: f64,
+    pub redshift: f64,
+}
@@ -0,0 +1,54 @@
+use axum::{
+    extract::Query,
+    http::StatusCode,
+    response::{IntoResponse, Response},
+    Json,
+};
+use serde::Deserialize;
+use std::sync::LazyLock;
+
+use crate::models::{Catalog, CatalogObject};
+
+/// Placeholder catalogs until real DESI EDR/DR1 ingestion lands.
+static CATALOGS: LazyLock<Vec<Catalog>> = LazyLock::new(|| {
+    vec![
+        Catalog {
+            name: "edr".to_string(),
+            release: "EDR".to_string(),
+            description: "DESI Early Data Release",
+            object_count: None,
+        },
+        Catalog {
+            name: "dr1".to_string(),
+            release: "DR1".to_string(),
+            description: "DESI Data Release 1",
+            object_count: None,
+        },
+    ]
+});
+
+pub async fn list_catalogs() -> Json<Vec<Catalog>> {
+    Json(CATALOGS.clone())
+}
+
+#[derive(Debug, Deserialize)]
+pub struct ObjectQuery {
+    catalog: Option<String>,
+    #[serde(default)]
+    limit: Option<usize>,
+}
+
+/// Placeholder object query. Real implementation will page through the
+/// centralized DESI catalog store rather than return an empty result set.
+pub async fn list_objects(Query(query): Query<ObjectQuery>) -> Response {
+    let limit = query.limit.unwrap_or(100).min(10_000);
+
+    tracing::debug!(
+        %limit,
+        catalog = query.catalog.as_deref().unwrap_or("all"),
+        "querying catalog objects (placeholder)"
+    );
+
+    let objects: Vec<CatalogObject> = Vec::new();
+    (StatusCode::OK, Json(objects)).into_response()
+}
@@ -0,0 +1,11 @@
+use axum::Json;
+use serde::Serialize;
+
+#[derive(Serialize)]
+pub struct Health {
+    pub status: &'static str,
+}
+
+pub async fn health() -> Json<Health> {
+    Json(Health { status: "ok" })
+}
@@ -0,0 +1,13 @@
+pub mod catalogs;
+pub mod health;
+
+use axum::{routing::get, Router};
+
+/// Builds the application router. Kept separate from `main` so tests can
+/// construct it without binding a socket.
+pub fn app() -> Router {
+    Router::new()
+        .route("/health", get(health::health))
+        .route("/api/v1/catalogs", get(catalogs::list_catalogs))
+        .route("/api/v1/objects", get(catalogs::list_objects))
+}
@@ -0,0 +1,44 @@
+use axum::body::{to_bytes, Body};
+use axum::http::{Request, StatusCode};
+use tower::ServiceExt;
+
+use desi_explorer_api::routes;
+
+#[tokio::test]
+async fn health_returns_ok() {
+    let app = routes::app();
+
+    let response = app
+        .oneshot(
+            Request::builder()
+                .uri("/health")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+
+    assert_eq!(response.status(), StatusCode::OK);
+}
+
+#[tokio::test]
+async fn catalogs_is_nonempty() {
+    let app = routes::app();
+
+    let response = app
+        .oneshot(
+            Request::builder()
+                .uri("/api/v1/catalogs")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+
+    assert_eq!(response.status(), StatusCode::OK);
+
+    let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+    let json: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    let catalogs = json.as_array().unwrap();
+    assert!(!catalogs.is_empty());
+}
@@ -0,0 +1,7 @@
+{
+  "lockfileVersion": 2,
+  "configVersion": 1, 
+  "packages": {
+    "renovate-config-validator": ["renovate-config-validator@0.0.1-placeholder", "", {}, "sha512-m4CJJH+haatkFvNgMavpM8DrpppPhV8uGm/b//d0LdKVe7D+6aeYL1VLdy04Fm0kOBcVs71Rv5fQVDh2m4LJeA=="],
+  }
+}
@@ -0,0 +1,55 @@
+# gui/Makefile — the Odin + raylib renderer (the interactive 3D universe map).
+#
+# This is the Odin sub-project. It is normally invoked from the repo root via
+# `make run`, `make build`, etc. (which delegate here through the root
+# Makefile), but it can also be driven directly with `make -C gui <target>`.
+#
+# `lib/` (third-party Odin deps) lives under `gui/lib`; the `bin/` / `build/`
+# output dirs live at the repo root and are referenced through `$(ROOT)`.
+
+ODIN         ?= odin
+ROOT         := ..
+BIN          := $(ROOT)/bin
+BINARY       := $(BIN)/desi_explorer
+ODIN_FLAGS   := -collection:lib=lib/local
+WASM_DEFINE  := RAYLIB_WASM_LIB=env.o
+
+.PHONY: help setup add-dep run build build-debug build-web test clean fmt
+
+help: ## List available targets
+	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | \
+		awk 'BEGIN {FS = ":.*?## "}; {printf "  \033[36m%-18s\033[0m %s\n", $$1, $$2}'
+
+setup: ## Prepare build environment (lib/local)
+	@mkdir -p lib/local
+
+add-dep: ## Add a dependency from Codeberg/GitHub/GitLab as a submodule (DEP=name)
+ifndef DEP
+	$(error Usage: make add-dep DEP=<dependency-name>)
+endif
+	@scripts/add_dep.sh "$(DEP)"
+
+run: ## Run the native app
+	@mkdir -p lib/local
+	$(ODIN) run src $(ODIN_FLAGS)
+
+build: ## Release build -> bin/desi_explorer
+	@mkdir -p lib/local $(BIN)
+	$(ODIN) build src $(ODIN_FLAGS) -o:speed -out:$(BINARY)
+
+build-debug: ## Debug build -> bin/desi_explorer
+	@mkdir -p lib/local $(BIN)
+	$(ODIN) build src $(ODIN_FLAGS) -o:none -debug -out:$(BINARY)
+
+build-web: ## WebAssembly build -> build/web (needs emscripten)
+	@scripts/build_web.sh
+
+test: ## Run Odin unit tests
+	@mkdir -p lib/local
+	$(ODIN) test src $(ODIN_FLAGS)
+
+clean: ## Remove build artifacts
+	rm -rf $(BIN) build
+
+fmt: ## Format Odin sources with odinfmt
+	odinfmt src
@@ -1,7 +1,8 @@
 # Libraries

 Third-party libraries for the DESI Explorer renderer live here, either as git
-submodules or vendored directly and wired in via `-collection:lib=lib/local`.
+submodules or vendored directly and wired in via `-collection:lib=lib/local`
+(as resolved from the `gui/` directory).

 - `raylib` is bundled with Odin and imported as `vendor:raylib` — it does **not**
  live in this directory.
@@ -0,0 +1,151 @@
+#!/usr/bin/env bash
+# Search Codeberg, GitHub, and GitLab for an Odin dependency and add it
+# as a git submodule under gui/lib/local/.  Run via `make -C gui add-dep`.
+#
+# Usage:  add_dep.sh <dependency-name>
+#
+# Requires: curl, jq
+# Optional: fzf (interactive selector; falls back to numbered menu)
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+GUI_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+ROOT_DIR="$(cd "${GUI_DIR}/.." && pwd)"
+LIB_DIR="${GUI_DIR}/lib/local"
+
+# ---- Args ------------------------------------------------------------------
+
+if [[ $# -lt 1 ]]; then
+  echo "Usage: $0 <dependency-name>" >&2
+  exit 1
+fi
+
+QUERY="$1"
+
+# ---- Helpers ---------------------------------------------------------------
+
+TMPDIR_WORK="$(mktemp -d)"
+trap 'rm -rf "${TMPDIR_WORK}"' EXIT
+
+RESULTS="${TMPDIR_WORK}/results"
+touch "$RESULTS"
+
+search_codeberg() {
+  local url
+  url="https://codeberg.org/api/v1/repos/search?q=$(printf '%s' "$QUERY" | jq -sRr @uri)&limit=10"
+  local data
+  data=$(curl -sf --max-time 10 "$url" 2>/dev/null) || return 0
+  printf '%s' "$data" | jq -r '.data[]? | [.owner.username, .name, "codeberg", (.description // "")] | @tsv' 2>/dev/null \
+    | while IFS=$'\t' read -r owner name _ desc; do
+        printf '%s\t%s\t%s\t%s\n' "$owner" "$name" "codeberg" "$desc"
+      done >> "$RESULTS"
+}
+
+search_github() {
+  local url
+  url="https://api.github.com/search/repositories?q=$(printf '%s' "$QUERY" | jq -sRr @uri)&per_page=10"
+  local data
+  data=$(curl -sf --max-time 10 -H "Accept: application/vnd.github+json" "$url" 2>/dev/null) || return 0
+  printf '%s' "$data" | jq -r '.items[]? | [.owner.login, .name, "github", (.description // "")] | @tsv' 2>/dev/null \
+    | while IFS=$'\t' read -r owner name _ desc; do
+        printf '%s\t%s\t%s\t%s\n' "$owner" "$name" "github" "$desc"
+      done >> "$RESULTS"
+}
+
+search_gitlab() {
+  local url
+  url="https://gitlab.com/api/v4/projects?search=$(printf '%s' "$QUERY" | jq -sRr @uri)&per_page=10"
+  local data
+  data=$(curl -sf --max-time 10 "$url" 2>/dev/null) || return 0
+  printf '%s' "$data" | jq -r '.[]? | [.namespace.full_path, .name, "gitlab", (.description // "")] | @tsv' 2>/dev/null \
+    | while IFS=$'\t' read -r owner name _ desc; do
+        printf '%s\t%s\t%s\t%s\n' "$owner" "$name" "gitlab" "$desc"
+      done >> "$RESULTS"
+}
+
+# ---- Search (Codeberg → GitHub → GitLab) -----------------------------------
+
+echo "Searching for '${QUERY}'..." >&2
+
+search_codeberg
+search_github
+search_gitlab
+
+TOTAL=$(wc -l < "$RESULTS" | tr -d ' ')
+
+if [[ "$TOTAL" -eq 0 ]]; then
+  echo "No results found for '${QUERY}' on Codeberg, GitHub, or GitLab." >&2
+  exit 1
+fi
+
+# ---- Select ----------------------------------------------------------------
+
+SELECTED=""
+
+if command -v fzf >/dev/null 2>&1; then
+  SELECTED=$(while IFS=$'\t' read -r owner name forge desc; do
+    printf '%-20s %-30s [%s]  %s\n' "$owner" "$name" "$forge" "$desc"
+  done < "$RESULTS" \
+    | fzf --prompt="Select dependency > " \
+          --header="${TOTAL} result(s) for '${QUERY}'" \
+          --height=40% \
+          --reverse)
+else
+  echo "" >&2
+  echo "Results for '${QUERY}':" >&2
+  echo "---" >&2
+  IDX=0
+  while IFS=$'\t' read -r owner name forge desc; do
+    IDX=$((IDX + 1))
+    printf '  %2d) %-20s %-30s [%s]  %s\n' "$IDX" "$owner" "$name" "$forge" "$desc" >&2
+  done < "$RESULTS"
+  echo "---" >&2
+  printf 'Select [1-%d]: ' "$TOTAL" >&2
+  read -r CHOICE
+
+  if ! [[ "$CHOICE" =~ ^[0-9]+$ ]] || [[ "$CHOICE" -lt 1 ]] || [[ "$CHOICE" -gt "$TOTAL" ]]; then
+    echo "Invalid selection." >&2
+    exit 1
+  fi
+  SELECTED=$(sed -n "${CHOICE}p" "$RESULTS")
+fi
+
+if [[ -z "$SELECTED" ]]; then
+  echo "No selection made." >&2
+  exit 1
+fi
+
+# ---- Parse & Add -----------------------------------------------------------
+
+ENTRYowner=$(printf '%s' "$SELECTED" | cut -f1)
+ENTRYname=$(printf '%s' "$SELECTED" | cut -f2)
+ENTRYforge=$(printf '%s' "$SELECTED" | cut -f3)
+
+case "$ENTRYforge" in
+  codeberg) URL="https://codeberg.org/${ENTRYowner}/${ENTRYname}.git" ;;
+  github)   URL="https://github.com/${ENTRYowner}/${ENTRYname}.git" ;;
+  gitlab)   URL="https://gitlab.com/${ENTRYowner}/${ENTRYname}.git" ;;
+esac
+
+MODULE_PATH="lib/local/${ENTRYname}"
+
+# Check for name collisions (same dir, different repo).
+if [[ -d "${GUI_DIR}/${MODULE_PATH}" ]]; then
+  EXISTING=$(git -C "${ROOT_DIR}" config --get "submodule.${MODULE_PATH}.url" 2>/dev/null || true)
+  if [[ -n "$EXISTING" ]]; then
+    echo "Dependency '${ENTRYname}' is already installed from ${EXISTING}." >&2
+    exit 1
+  fi
+  echo "Error: '${MODULE_PATH}' already exists but is not a submodule." >&2
+  exit 1
+fi
+
+echo "Adding ${ENTRYowner}/${ENTRYname} (${ENTRYforge}) as submodule..." >&2
+
+mkdir -p "${LIB_DIR}"
+git -C "${ROOT_DIR}" submodule add "$URL" "$MODULE_PATH"
+
+echo "" >&2
+echo "Done — added ${ENTRYowner}/${ENTRYname} from ${ENTRYforge}" >&2
+echo "  path: ${MODULE_PATH}" >&2
+echo "  The Makefile's -collection:lib=lib/local will pick it up automatically." >&2
@@ -1,30 +1,36 @@
 #!/usr/bin/env bash
 # Builds the WebAssembly ("web") build of DESI Explorer with Odin
-# (js_wasm32) + emscripten. Output: build/web/index.html (+ index.wasm, odin.js).
+# (js_wasm32) + emscripten. Output: build/web/index.html (+ index.wasm,
+# odin.js) at the repo root. Run via `make -C gui build-web`.
 #
 # Requires:
 #   - `odin` on PATH with the js_wasm32 target
 #   - emcc / emscripten active in PATH
 # Optional:
 #   - ODIN_ROOT (defaults to `odin root`)
-#   - OUT_DIR   (defaults to build/web)
+#   - OUT_DIR   (defaults to <repo>/build/web)
 set -euo pipefail

-OUT_DIR="${OUT_DIR:-build/web}"
+# Resolve the gui/ project root so this script works regardless of CWD.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+GUI_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+ROOT_DIR="$(cd "${GUI_DIR}/.." && pwd)"
+
+OUT_DIR="${OUT_DIR:-${ROOT_DIR}/build/web}"
 ODIN_ROOT="${ODIN_ROOT:-$(odin root)}"

-mkdir -p lib/local
+mkdir -p "${GUI_DIR}/lib/local"
 mkdir -p "$OUT_DIR"

 # The Odin compiler emits a wasm object; raylib's C code is linked later by
 # emcc. `-define:RAYLIB_WASM_LIB=env.o` stops the compiler from trying to
 # link the raylib lib itself (emcc does that; it ends up in the final module).
-odin build src \
+odin build "${GUI_DIR}/src" \
  -target:js_wasm32 \
  -build-mode:obj \
  -define:RAYLIB_WASM_LIB=env.o \
  -o:speed \
-  -collection:lib=lib/local \
+  -collection:lib="${GUI_DIR}/lib/local" \
  -out:"${OUT_DIR}/game"

 # Odin's JS runtime glue; the generated module imports functions from it.
@@ -36,7 +42,7 @@ emcc \
  -o "${OUT_DIR}/index.html" \
  "${OUT_DIR}/game.obj" \
  "${ODIN_ROOT}/vendor/raylib/wasm/libraylib.web.a" \
-  --shell-file scripts/web/index_template.html \
+  --shell-file "${GUI_DIR}/www/index_template.html" \
  -sEXPORTED_RUNTIME_METHODS="['HEAPF32']" \
  -sUSE_GLFW=3 \
  -sWASM_BIGINT \
@@ -0,0 +1,35 @@
+# infra/Makefile — Go + Pulumi infrastructure-as-code.
+#
+# Driven directly with `make -C infra <target>` (or via the root Makefile's
+# `infra-*` convenience targets). Targets that interact with the live cluster
+# run Pulumi against the stack defined in Pulumi.yaml.
+
+.PHONY: help preview up down refresh static test clean tidy
+
+help: ## List available targets
+	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | \
+		awk 'BEGIN {FS = ":.*?## "}; {printf "  \033[36m%-18s\033[0m %s\n", $$1, $$2}'
+
+preview: ## Preview infra changes against the cluster
+	pulumi preview
+
+up: ## Deploy/update infra
+	pulumi up
+
+down: ## Tear down the stack's resources
+	pulumi destroy
+
+refresh: ## Refresh Pulumi state against the live cluster
+	pulumi refresh
+
+static: ## Typecheck + vet without Pulumi
+	go build -o /dev/null . && go vet ./...
+
+test: ## Run Go unit tests
+	go test ./...
+
+clean: ## Remove local Go build artifact
+	rm -f desi-explorer-infra
+
+tidy: ## Tidy Go modules
+	go mod tidy
@@ -1,17 +1,17 @@
 module desi-explorer-infra

-go 1.26
+go 1.26.6

 require (
-	github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.31.1
-	github.com/pulumi/pulumi/sdk/v3 v3.244.0
+	github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.34.0
+	github.com/pulumi/pulumi/sdk/v3 v3.261.0
 )

 require (
 	dario.cat/mergo v1.0.0 // indirect
 	github.com/BurntSushi/toml v1.6.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/ProtonMail/go-crypto v1.1.6 // indirect
+	github.com/ProtonMail/go-crypto v1.4.1 // indirect
 	github.com/agext/levenshtein v1.2.3 // indirect
 	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
@@ -24,7 +24,7 @@ require (
 	github.com/charmbracelet/bubbletea v1.3.10 // indirect
 	github.com/charmbracelet/colorprofile v0.4.3 // indirect
 	github.com/charmbracelet/lipgloss v1.1.0 // indirect
-	github.com/charmbracelet/x/ansi v0.11.6 // indirect
+	github.com/charmbracelet/x/ansi v0.11.8 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
 	github.com/charmbracelet/x/term v0.2.2 // indirect
 	github.com/cheggaaa/pb v1.0.29 // indirect
@@ -32,34 +32,42 @@ require (
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/cloudflare/circl v1.6.3 // indirect
 	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
+	github.com/danieljoos/wincred v1.2.3 // indirect
+	github.com/deckarep/golang-set/v2 v2.5.0 // indirect
 	github.com/djherbis/times v1.5.0 // indirect
+	github.com/ebitengine/purego v0.10.2 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
+	github.com/go-git/gcfg/v2 v2.0.2 // indirect
 	github.com/go-git/go-billy/v5 v5.9.0 // indirect
+	github.com/go-git/go-billy/v6 v6.0.0-alpha.1 // indirect
 	github.com/go-git/go-git/v5 v5.19.1 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-git/go-git/v6 v6.0.0-alpha.4 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/godbus/dbus/v5 v5.2.2 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/glog v1.2.5 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
+	github.com/google/go-tpm v0.9.8 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
 	github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-version v1.8.0 // indirect
-	github.com/hashicorp/hcl/v2 v2.22.0 // indirect
+	github.com/hashicorp/go-version v1.9.0 // indirect
+	github.com/hashicorp/hcl/v2 v2.24.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/kevinburke/ssh_config v1.6.0 // indirect
+	github.com/klauspost/compress v1.18.7 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
-	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/lucasb-eyer/go-colorful v1.4.1 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
-	github.com/mattn/go-runewidth v0.0.21 // indirect
+	github.com/mattn/go-runewidth v0.0.28 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
@@ -87,33 +95,38 @@ require (
 	github.com/uber/jaeger-client-go v2.30.0+incompatible // indirect
 	github.com/uber/jaeger-lib v2.4.1+incompatible // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
-	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	github.com/zclconf/go-cty v1.13.2 // indirect
+	github.com/xo/terminfo v1.0.0 // indirect
+	github.com/zalando/go-keyring v0.2.8 // indirect
+	github.com/zclconf/go-cty v1.16.3 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/collector/featuregate v1.53.0 // indirect
-	go.opentelemetry.io/collector/pdata v1.53.0 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 // indirect
-	go.opentelemetry.io/otel/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
+	go.opentelemetry.io/collector/featuregate v1.65.0 // indirect
+	go.opentelemetry.io/collector/pdata v1.65.0 // indirect
+	go.opentelemetry.io/contrib/bridges/otelslog v0.20.0 // indirect
+	go.opentelemetry.io/otel v1.45.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.21.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 // indirect
+	go.opentelemetry.io/otel/log v0.21.0 // indirect
+	go.opentelemetry.io/otel/metric v1.45.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.45.0 // indirect
+	go.opentelemetry.io/otel/sdk/log v0.21.0 // indirect
+	go.opentelemetry.io/otel/trace v1.45.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/crypto v0.50.0 // indirect
+	golang.org/x/crypto v0.55.0 // indirect
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
-	golang.org/x/mod v0.35.0 // indirect
-	golang.org/x/net v0.53.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.43.0 // indirect
-	golang.org/x/term v0.42.0 // indirect
-	golang.org/x/text v0.36.0 // indirect
-	golang.org/x/tools v0.44.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260311181403-84a4fc48630c // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c // indirect
-	google.golang.org/grpc v1.80.0 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
+	golang.org/x/mod v0.38.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/term v0.45.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/tools v0.48.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect
+	google.golang.org/grpc v1.83.1 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	lukechampine.com/frand v1.5.1 // indirect
@@ -9,6 +9,8 @@ github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERo
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw=
 github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
+github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM=
+github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo=
 github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=
 github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
@@ -39,6 +41,8 @@ github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoF
 github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
 github.com/charmbracelet/x/ansi v0.11.6 h1:GhV21SiDz/45W9AnV2R61xZMRri5NlLnl6CVF7ihZW8=
 github.com/charmbracelet/x/ansi v0.11.6/go.mod h1:2JNYLgQUsyqaiLovhU2Rv/pb8r6ydXKS3NIttu3VGZQ=
+github.com/charmbracelet/x/ansi v0.11.8 h1:JMFwp0CgDC2+jcOB162HH5k7I3FVbgFSMMYg7dSPBQQ=
+github.com/charmbracelet/x/ansi v0.11.8/go.mod h1:ZNN+3mXny/516oTQPLMPIBeSINvNJJQ8uQXDgbeJxY0=
 github.com/charmbracelet/x/cellbuf v0.0.15 h1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI=
 github.com/charmbracelet/x/cellbuf v0.0.15/go.mod h1:J1YVbR7MUuEGIFPCaaZ96KDl5NoS0DAWkskup+mOY+Q=
 github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
@@ -54,11 +58,17 @@ github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJ
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE=
 github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
+github.com/danieljoos/wincred v1.2.3 h1:v7dZC2x32Ut3nEfRH+vhoZGvN72+dQ/snVXo/vMFLdQ=
+github.com/danieljoos/wincred v1.2.3/go.mod h1:6qqX0WNrS4RzPZ1tnroDzq9kY3fu1KwE7MRLQK4X0bs=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/deckarep/golang-set/v2 v2.5.0 h1:hn6cEZtQ0h3J8kFrHR/NrzyOoTnjgW1+FmNJzQ7y/sA=
+github.com/deckarep/golang-set/v2 v2.5.0/go.mod h1:VAky9rY/yGXJOLEDv3OMci+7wtDpOF4IN+y82NBOac4=
 github.com/djherbis/times v1.5.0 h1:79myA211VwPhFTqUk8xehWrsEO+zcIZj0zT8mXPVARU=
 github.com/djherbis/times v1.5.0/go.mod h1:5q7FDLvbNg1L/KaBmPcWlVR9NmoKo3+ucqUA3ijQhA0=
+github.com/ebitengine/purego v0.10.2 h1:W809HbnvzAxgdm+aOvlSekrM16wGCdT/e76+9tS7gzE=
+github.com/ebitengine/purego v0.10.2/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o=
 github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
@@ -72,17 +82,27 @@ github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
+github.com/go-git/gcfg/v2 v2.0.2 h1:MY5SIIfTGGEMhdA7d7JePuVVxtKL7Hp+ApGDJAJ7dpo=
+github.com/go-git/gcfg/v2 v2.0.2/go.mod h1:/lv2NsxvhepuMrldsFilrgct6pxzpGdSRC13ydTLSLs=
 github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA=
 github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
+github.com/go-git/go-billy/v6 v6.0.0-alpha.1 h1:xVjAR4oUvrKy7/Xuw/lLlV3gkxR3KO2H8W+MamuVVsQ=
+github.com/go-git/go-billy/v6 v6.0.0-alpha.1/go.mod h1:eaCUpHbedW7//EwcYmUDfJe2N6sJC9O12AT0OTqJR1E=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
 github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00=
 github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
+github.com/go-git/go-git/v6 v6.0.0-alpha.4 h1:aDTc2UGanmaE7FkGLSlBEB9nohMnQ+RKXcfq/D+esDQ=
+github.com/go-git/go-git/v6 v6.0.0-alpha.4/go.mod h1:4ODa/G7hPWrh4Y+7lmt59Ij3zW38IEfvRoAZxLYYBhc=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
+github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
 github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
@@ -94,11 +114,15 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
+github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY=
 github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 h1:MJG/KsmcqMwFAkh8mTnAwhyKoB+sTAnY4CACC110tbU=
 github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645/go.mod h1:6iZfnjpejD4L/4DwD7NryNaJyCQdzwWwH2MWhCA90Kw=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -108,8 +132,12 @@ github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+l
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-version v1.8.0 h1:KAkNb1HAiZd1ukkxDFGmokVZe1Xy9HG6NUp+bPle2i4=
 github.com/hashicorp/go-version v1.8.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/go-version v1.9.0 h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaXPSCnA=
+github.com/hashicorp/go-version v1.9.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/hcl/v2 v2.22.0 h1:hkZ3nCtqeJsDhPRFz5EA9iwcG1hNWGePOTw6oyul12M=
 github.com/hashicorp/hcl/v2 v2.22.0/go.mod h1:62ZYHrXgPoX8xBnzl8QzbWq4dyDsDtfCRgIq1rbJEvA=
+github.com/hashicorp/hcl/v2 v2.24.0 h1:2QJdZ454DSsYGoaE6QheQZjtKZSUs9Nh2izTWiwQxvE=
+github.com/hashicorp/hcl/v2 v2.24.0/go.mod h1:oGoO1FIQYfn/AgyOhlg9qLC6/nOJPX3qGbkZpYAcqfM=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
@@ -118,11 +146,15 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
 github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
+github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY=
+github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M=
 github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=
+github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
@@ -134,6 +166,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag=
 github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/lucasb-eyer/go-colorful v1.4.1 h1:1EO+WB73+EH8EVbzlrG3KLAfEypQWVHIBqlTf+2hNss=
+github.com/lucasb-eyer/go-colorful v1.4.1/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
@@ -141,11 +175,15 @@ github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hd
 github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
 github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
 github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.21 h1:jJKAZiQH+2mIinzCJIaIG9Be1+0NR+5sz/lYEEjdM8w=
 github.com/mattn/go-runewidth v0.0.21/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
+github.com/mattn/go-runewidth v0.0.28 h1:rPyg2ybwEKPebvpzVWe1gKBkH8EQFkxO4Y0hjBeLaBU=
+github.com/mattn/go-runewidth v0.0.28/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
 github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
 github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg=
 github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
@@ -187,8 +225,12 @@ github.com/pulumi/esc v0.24.0 h1:sCtiB0qbyrlU1ZNzJn4dTLYiChl8xeCBFbHWl1YoXJg=
 github.com/pulumi/esc v0.24.0/go.mod h1:eCOOkcDJS6eooGwdE4/E0+pOsvUWG254+KBmPCFwJpA=
 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.31.1 h1:Hg9RK9zqIU9kFbD5KeiON06gPP7cLgS68jvsgMBmPgw=
 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.31.1/go.mod h1:BAWI9R3JEEGOp1JlXLPSZKwBGANSrPGUWKtMnS5w5qw=
+github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.34.0 h1:r00p17ecoDVWqBg38/Is/9jU/JsWLPxnWzhfYqKitx0=
+github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.34.0/go.mod h1:/klrd3ib4AMRlFMjrxkv5r76x3Bdr68wIMEKfRkRzHU=
 github.com/pulumi/pulumi/sdk/v3 v3.244.0 h1:oyQ9bwDE58wrQOqS70JrojJSlNoLcVhVcQgK4yusgcg=
 github.com/pulumi/pulumi/sdk/v3 v3.244.0/go.mod h1:BPWWuYPXcPH5YbXGoyy9Rrfa+evrh6IdM51AjDhcDpM=
+github.com/pulumi/pulumi/sdk/v3 v3.261.0 h1:1C2V6bxzO9UBe91PRebO/zeiUIQ2C05eRNkVFvJuuqc=
+github.com/pulumi/pulumi/sdk/v3 v3.261.0/go.mod h1:xlOo55i2hj5tDyMY8diTS5LfFAn2sFew+50d67sVNdg=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
@@ -225,34 +267,66 @@ github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM
 github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
+github.com/xo/terminfo v1.0.0 h1:2ZpYzqWzyyytjk3TP6aJVDhkMAkc99/1xKQdA3TDTBY=
+github.com/xo/terminfo v1.0.0/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPccHs=
+github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0=
 github.com/zclconf/go-cty v1.13.2 h1:4GvrUxe/QUDYuJKAav4EYqdM47/kZa672LwmXFmEKT0=
 github.com/zclconf/go-cty v1.13.2/go.mod h1:YKQzy/7pZ7iq2jNFzy5go57xdxdWoLLpaEp4u238AE0=
+github.com/zclconf/go-cty v1.16.3 h1:osr++gw2T61A8KVYHoQiFbFd1Lh3JOCXc/jFLJXKTxk=
+github.com/zclconf/go-cty v1.16.3/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/collector/featuregate v1.53.0 h1:cgjXdtl7jezWxq6V0eohe/JqjY4PBotZGb5+bTR2OJw=
 go.opentelemetry.io/collector/featuregate v1.53.0/go.mod h1:PS7zY/zaCb28EqciePVwRHVhc3oKortTFXsi3I6ee4g=
+go.opentelemetry.io/collector/featuregate v1.65.0 h1:Dh+uYVB+POc5DTebZRWjtKJolGhevkiIpbHn+zhkq2o=
+go.opentelemetry.io/collector/featuregate v1.65.0/go.mod h1:4ga1QBMPEejXXmpyJS8lmaRpknJ3Lb9Bvk6e420bUFU=
 go.opentelemetry.io/collector/internal/testutil v0.147.0 h1:DFlRxBRp23/sZnpTITK25yqe0d56yNvK+63IaWc6OsU=
 go.opentelemetry.io/collector/internal/testutil v0.147.0/go.mod h1:Jkjs6rkqs973LqgZ0Fe3zrokQRKULYXPIf4HuqStiEE=
 go.opentelemetry.io/collector/pdata v1.53.0 h1:DlYDbRwammEZaxDZHINx5v0n8SEOVNniPbi6FRTlVkA=
 go.opentelemetry.io/collector/pdata v1.53.0/go.mod h1:LRSYGNjKXaUrZEwZv3Yl+8/zV2HmRGKXW62zB2bysms=
+go.opentelemetry.io/collector/pdata v1.65.0 h1:6bQ3sIrEzOdapetxYFjdCns90kKXg1qCoIZ3la1aR5E=
+go.opentelemetry.io/collector/pdata v1.65.0/go.mod h1:r5vRY0p7nZcEif06twUW09Sf6vaNsyPzij+EpwI/xeI=
+go.opentelemetry.io/contrib/bridges/otelslog v0.20.0 h1:oEl2Pw/i4OQwhAuda2pAHFAcOMivA+Xa+iTccBfab/g=
+go.opentelemetry.io/contrib/bridges/otelslog v0.20.0/go.mod h1:yMSQaiiq5dpfrSJCYLBcqFeJkFFI67seT4ngvx6jfVo=
 go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
 go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
+go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
+go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.21.0 h1:WseeVYf5dJZTsyPiyW5L14k5qsSibqXAMTSiFEDiWr0=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.21.0/go.mod h1:SiLZnQS6Qk2eCpvr2CH/XMAOa64TWGXxEZJZCpD2Lmc=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 h1:THuZiwpQZuHPul65w4WcwEnkX2QIuMT+UFoOrygtoJw=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0/go.mod h1:J2pvYM5NGHofZ2/Ru6zw/TNWnEQp5crgyDeSrYpXkAw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 h1:QRefszxJmfPdjXUUm3j6iDzY03mTPXMjqErFqQ67vUg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0/go.mod h1:Tiz03lTBVBrm7eWZBOidzEaYaJa8tjwGUGv6d8mlTyk=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 h1:zWWrB1U6nqhS/k6zYB74CjRpuiitRtLLi68VcgmOEto=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0/go.mod h1:2qXPNBX1OVRC0IwOnfo1ljoid+RD0QK3443EaqVlsOU=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 h1:fG5MCxGz8+2VtrN/WgqSpJFctVz24gpxj8CxkKmc8Ww=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0/go.mod h1:BmAYTn+3ysbRe+IU2msxmf5Rx3g6DHvex+tWI3LdhYI=
+go.opentelemetry.io/otel/log v0.21.0 h1:SLsVDGmtyBrdw8/a2Z0bOIxou/+bN4z56GebH7T0LvA=
+go.opentelemetry.io/otel/log v0.21.0/go.mod h1:iReetQrZL9Wyg84cCkOoCmqDHS5RCFfyxC7J+r8fn8g=
 go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
 go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
+go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
+go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
 go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
 go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
+go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=
+go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA=
+go.opentelemetry.io/otel/sdk/log v0.21.0 h1:QsE7XSR0ktQdKmRKGnR+f1ObGF32WG+7MER/P9KgmYc=
+go.opentelemetry.io/otel/sdk/log v0.21.0/go.mod h1:m9mApjCoD2/1QuKCAptjv+BrG9WKOvQLVdNx+iBldTo=
 go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
 go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
 go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
 go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
+go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
+go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
 go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
 go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
+go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk=
+go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E=
 go.opentelemetry.io/proto/slim/otlp v1.9.0 h1:fPVMv8tP3TrsqlkH1HWYUpbCY9cAIemx184VGkS6vlE=
 go.opentelemetry.io/proto/slim/otlp v1.9.0/go.mod h1:xXdeJJ90Gqyll+orzUkY4bOd2HECo5JofeoLpymVqdI=
 go.opentelemetry.io/proto/slim/otlp/collector/profiles/v1development v0.2.0 h1:o13nadWDNkH/quoDomDUClnQBpdQQ2Qqv0lQBjIXjE8=
@@ -272,6 +346,8 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
 golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
@@ -280,6 +356,8 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
 golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
+golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
+golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -288,11 +366,15 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
 golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -309,14 +391,20 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
 golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
 golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
 golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -325,6 +413,8 @@ golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roY
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
 golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
+golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
+golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -333,12 +423,20 @@ gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/genproto/googleapis/api v0.0.0-20260311181403-84a4fc48630c h1:OyQPd6I3pN/9gDxz6L13kYGJgqkpdrAohJRBeXyxlgI=
 google.golang.org/genproto/googleapis/api v0.0.0-20260311181403-84a4fc48630c/go.mod h1:X2gu9Qwng7Nn009s/r3RUxqkzQNqOrAy79bluY7ojIg=
+google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 h1:ax2KzoSRIZU/M0cIxri3pKxy99vniH1PVxWC6si/eZI=
+google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688/go.mod h1:1RJ9BQGyNdZwkGc1eTqkErfRZ6RJyYPHZo73BZ1vQqI=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c h1:xgCzyF2LFIO/0X2UAoVRiXKU5Xg6VjToG4i2/ecSswk=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 h1:cYNAzI2sUwhmCcoj9TxvihSrqsxt6uIkj3rDRhSDmW4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA=
 google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
 google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
+google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y=
+google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
@@ -2,7 +2,7 @@
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "gitAuthor": "Renovate Bot <renovate@samoneal.io>",
-  "enabledManagers": ["gomod", "git-submodules", "github-actions"],
+  "enabledManagers": ["gomod", "cargo", "git-submodules", "github-actions"],
  "git-submodules": {
    "enabled": true
  },
@@ -13,6 +13,12 @@
      "matchManagers": ["gomod"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "infra go dependencies"
+    },
+    {
+      "description": "Group non-breaking API (Rust) updates into one PR",
+      "matchManagers": ["cargo"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "api rust dependencies"
    }
  ]
 }
Author	SHA1	Message	Date
renovate	e034565ea2	Update Rust crate tower-http to 0.7 CI / Detect changed paths (pull_request) Successful in 11s Details CI / Odin unit tests and build (pull_request) Has been skipped Details CI / API unit tests and lint (pull_request) Failing after 2m8s Details CI / Infra unit tests, vet, and preview (pull_request) Failing after 22s Details	2026-09-06 20:01:47 +00:00
renovate	a6cbc49401	Update infra go dependencies CI / Detect changed paths (pull_request) Successful in 1m8s Details CI / Odin unit tests and build (pull_request) Has been skipped Details CI / API unit tests and lint (pull_request) Has been skipped Details CI / Infra unit tests, vet, and preview (pull_request) Successful in 13m2s Details	2026-09-02 21:07:16 +00:00
sam_oneal	9e6cb03b8a	updated makefiles and added dependency installation for ODIN CI / Detect changed paths (pull_request) Failing after 1s Details CI / Infra unit tests, vet, and preview (pull_request) Has been skipped Details CI / Odin unit tests and build (pull_request) Has been skipped Details CI / API unit tests and lint (pull_request) Has been skipped Details	2026-09-02 11:37:29 -06:00
sam_oneal	920fcd6a1a	Add Pulumi preview to CI infra job CI / Detect changed paths (pull_request) Failing after 0s Details CI / Infra unit tests, vet, and preview (pull_request) Has been skipped Details CI / Odin unit tests and build (pull_request) Has been skipped Details CI / API unit tests and lint (pull_request) Has been skipped Details Infra now always runs unit tests + vet on PRs, and additionally runs `pulumi preview --diff` (posted as a PR comment) when the infra, gui, or api code changes — since any of those can change what gets deployed.	2026-08-31 14:03:26 -06:00
sam_oneal	bd8a7da379	Move Odin renderer into gui/ with per-project Makefiles CI / Detect changed paths (pull_request) Failing after 1s Details CI / Infra unit tests and vet (pull_request) Failing after 1s Details CI / Odin unit tests and build (pull_request) Has been skipped Details CI / API unit tests and lint (pull_request) Has been skipped Details Each sub-project (gui, api, infra) now owns its own Makefile, and the root Makefile is a lean delegator for the base commands (run, build, test, clean, fmt). Odin source, deps, and web assets live under gui/ (gui/src, gui/lib, gui/www), with scripts kept under gui/scripts for build tooling only.	2026-08-31 13:45:58 -06:00
sam_oneal	175bb4acad	updated workflow of CI CI / Detect changed paths (pull_request) Failing after 0s Details CI / Infra unit tests and vet (pull_request) Failing after 0s Details CI / Odin unit tests and build (pull_request) Has been skipped Details CI / API unit tests and lint (pull_request) Has been skipped Details	2026-08-31 13:30:26 -06:00
sam_oneal	5148d7e54f	added rust api to control DESI data distribution; updated to utilize bun for renovate CI / Unit tests (pull_request) Failing after 8m55s Details	2026-08-31 13:17:05 -06:00