Freeze v0.0.12 (#547 )

### Changed - Upgraded pulumi-go-provider to v1.0.0-rc2. ### Fixed - Builds now respect cancellation. (https://github.com/pulumi/pulumi-docker-build/issues/533, https://github.com/pulumi/pulumi-docker-build/pull/522)
Update GitHub Actions workflows. (#546 )
2025-05-16 12:08:02 -07:00 · 2025-05-16 05:50:09 +00:00 · 2025-05-15 16:38:58 -07:00 · 2025-05-15 05:45:20 +00:00 · 2025-05-14 05:47:00 +00:00 · 2025-05-05 16:12:48 -07:00
32 changed files with 962 additions and 1048 deletions
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -75,19 +75,19 @@ jobs:
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
-      uses: pulumi/actions@9519177da243fd32cab35cdbf19cce1ab7472fcc # v6.2.0
+      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - if: github.event_name == 'pull_request'
      name: Install Schema Tools
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/schema-tools
    - name: Build codegen binaries
@@ -220,16 +220,16 @@ jobs:
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
-      uses: pulumi/actions@9519177da243fd32cab35cdbf19cce1ab7472fcc # v6.2.0
+      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Setup Node
      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
      with:
@@ -364,16 +364,16 @@ jobs:
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
-      uses: pulumi/actions@9519177da243fd32cab35cdbf19cce1ab7472fcc # v6.2.0
+      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Setup Node
      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
      with:
@@ -438,13 +438,13 @@ jobs:
        requested-token-type: urn:pulumi:token-type:access_token:organization
        export-environment-variables: false
    - name: Export AWS Credentials
-      uses: pulumi/esc-action@41fd832f44f4820124b5350b5f84a00f741f234e # v1.3.0
+      uses: pulumi/esc-action@efb0bc8946938f0dfbfa00e829196ec95f0d0ea7 # v1.4.0
      env:
        PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
      with:
        environment: logins/pulumi-ci
    - name: Authenticate to Google Cloud
-      uses: google-github-actions/auth@7b53cdc2a387814ed14eec026287aac689ae8c9b # v2.1.9
+      uses: google-github-actions/auth@ba79af03959ebeac9769e648f473a284504d9193 # v2.1.10
      with:
        workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
          }}/locations/global/workloadIdentityPools/${{
@@ -487,7 +487,7 @@ jobs:
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
@@ -501,13 +501,13 @@ jobs:
        swap-storage: true
        large-packages: false
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
-      uses: pulumi/actions@9519177da243fd32cab35cdbf19cce1ab7472fcc # v6.2.0
+      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
+      uses: aws-actions/configure-aws-credentials@f24d7193d98baebaeacc7e2227925dd47cc267f5 # v4.2.0
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-region: us-east-2
@@ -551,16 +551,16 @@ jobs:
        repository: pulumi/scripts
    - run: echo "ci-scripts" >> .git/info/exclude
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
-      uses: pulumi/actions@9519177da243fd32cab35cdbf19cce1ab7472fcc # v6.2.0
+      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Setup Node
      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
      with:
@@ -622,7 +622,7 @@ jobs:
        persist-credentials: false
        ref: ${{ env.PR_COMMIT_SHA }}
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
--- a/.github/workflows/prerelease.yml
+++ b/.github/workflows/prerelease.yml
@@ -67,19 +67,19 @@ jobs:
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
-      uses: pulumi/actions@9519177da243fd32cab35cdbf19cce1ab7472fcc # v6.2.0
+      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - if: github.event_name == 'pull_request'
      name: Install Schema Tools
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/schema-tools
    - name: Build codegen binaries
@@ -212,16 +212,16 @@ jobs:
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
-      uses: pulumi/actions@9519177da243fd32cab35cdbf19cce1ab7472fcc # v6.2.0
+      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Setup Node
      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
      with:
@@ -355,16 +355,16 @@ jobs:
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
-      uses: pulumi/actions@9519177da243fd32cab35cdbf19cce1ab7472fcc # v6.2.0
+      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Setup Node
      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
      with:
@@ -429,13 +429,13 @@ jobs:
        requested-token-type: urn:pulumi:token-type:access_token:organization
        export-environment-variables: false
    - name: Export AWS Credentials
-      uses: pulumi/esc-action@41fd832f44f4820124b5350b5f84a00f741f234e # v1.3.0
+      uses: pulumi/esc-action@efb0bc8946938f0dfbfa00e829196ec95f0d0ea7 # v1.4.0
      env:
        PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
      with:
        environment: logins/pulumi-ci
    - name: Authenticate to Google Cloud
-      uses: google-github-actions/auth@7b53cdc2a387814ed14eec026287aac689ae8c9b # v2.1.9
+      uses: google-github-actions/auth@ba79af03959ebeac9769e648f473a284504d9193 # v2.1.10
      with:
        workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
          }}/locations/global/workloadIdentityPools/${{
@@ -478,7 +478,7 @@ jobs:
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
@@ -492,13 +492,13 @@ jobs:
        swap-storage: true
        large-packages: false
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
-      uses: pulumi/actions@9519177da243fd32cab35cdbf19cce1ab7472fcc # v6.2.0
+      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
+      uses: aws-actions/configure-aws-credentials@f24d7193d98baebaeacc7e2227925dd47cc267f5 # v4.2.0
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-region: us-east-2
@@ -542,16 +542,16 @@ jobs:
        repository: pulumi/scripts
    - run: echo "ci-scripts" >> .git/info/exclude
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
-      uses: pulumi/actions@9519177da243fd32cab35cdbf19cce1ab7472fcc # v6.2.0
+      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Setup Node
      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
      with:
@@ -619,16 +619,16 @@ jobs:
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
-      uses: pulumi/actions@9519177da243fd32cab35cdbf19cce1ab7472fcc # v6.2.0
+      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Setup Java
      uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
      with:
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -67,19 +67,19 @@ jobs:
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
-      uses: pulumi/actions@9519177da243fd32cab35cdbf19cce1ab7472fcc # v6.2.0
+      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - if: github.event_name == 'pull_request'
      name: Install Schema Tools
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/schema-tools
    - name: Build codegen binaries
@@ -212,16 +212,16 @@ jobs:
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
-      uses: pulumi/actions@9519177da243fd32cab35cdbf19cce1ab7472fcc # v6.2.0
+      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Setup Node
      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
      with:
@@ -355,16 +355,16 @@ jobs:
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
-      uses: pulumi/actions@9519177da243fd32cab35cdbf19cce1ab7472fcc # v6.2.0
+      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Setup Node
      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
      with:
@@ -429,13 +429,13 @@ jobs:
        requested-token-type: urn:pulumi:token-type:access_token:organization
        export-environment-variables: false
    - name: Export AWS Credentials
-      uses: pulumi/esc-action@41fd832f44f4820124b5350b5f84a00f741f234e # v1.3.0
+      uses: pulumi/esc-action@efb0bc8946938f0dfbfa00e829196ec95f0d0ea7 # v1.4.0
      env:
        PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
      with:
        environment: logins/pulumi-ci
    - name: Authenticate to Google Cloud
-      uses: google-github-actions/auth@7b53cdc2a387814ed14eec026287aac689ae8c9b # v2.1.9
+      uses: google-github-actions/auth@ba79af03959ebeac9769e648f473a284504d9193 # v2.1.10
      with:
        workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
          }}/locations/global/workloadIdentityPools/${{
@@ -478,7 +478,7 @@ jobs:
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
@@ -492,13 +492,13 @@ jobs:
        swap-storage: true
        large-packages: false
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
-      uses: pulumi/actions@9519177da243fd32cab35cdbf19cce1ab7472fcc # v6.2.0
+      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
+      uses: aws-actions/configure-aws-credentials@f24d7193d98baebaeacc7e2227925dd47cc267f5 # v4.2.0
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-region: us-east-2
@@ -542,16 +542,16 @@ jobs:
        repository: pulumi/scripts
    - run: echo "ci-scripts" >> .git/info/exclude
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
-      uses: pulumi/actions@9519177da243fd32cab35cdbf19cce1ab7472fcc # v6.2.0
+      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Setup Node
      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
      with:
@@ -619,16 +619,16 @@ jobs:
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
-      uses: pulumi/actions@9519177da243fd32cab35cdbf19cce1ab7472fcc # v6.2.0
+      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Setup Java
      uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
      with:
@@ -692,7 +692,7 @@ jobs:
    needs: publish_go_sdk
    steps:
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Dispatch Event
--- a/.github/workflows/run-acceptance-tests.yml
+++ b/.github/workflows/run-acceptance-tests.yml
@@ -6,8 +6,6 @@ on:
    types:
    - run-acceptance-tests-command
  pull_request:
-    paths-ignore:
-    - CHANGELOG.md
  workflow_dispatch: {}
 env:
  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
@@ -83,19 +81,19 @@ jobs:
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
-      uses: pulumi/actions@9519177da243fd32cab35cdbf19cce1ab7472fcc # v6.2.0
+      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - if: github.event_name == 'pull_request'
      name: Install Schema Tools
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/schema-tools
    - name: Build codegen binaries
@@ -232,16 +230,16 @@ jobs:
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
-      uses: pulumi/actions@9519177da243fd32cab35cdbf19cce1ab7472fcc # v6.2.0
+      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Setup Node
      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
      with:
@@ -380,16 +378,16 @@ jobs:
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
-      uses: pulumi/actions@9519177da243fd32cab35cdbf19cce1ab7472fcc # v6.2.0
+      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Setup Node
      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
      with:
@@ -454,13 +452,13 @@ jobs:
        requested-token-type: urn:pulumi:token-type:access_token:organization
        export-environment-variables: false
    - name: Export AWS Credentials
-      uses: pulumi/esc-action@41fd832f44f4820124b5350b5f84a00f741f234e # v1.3.0
+      uses: pulumi/esc-action@efb0bc8946938f0dfbfa00e829196ec95f0d0ea7 # v1.4.0
      env:
        PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
      with:
        environment: logins/pulumi-ci
    - name: Authenticate to Google Cloud
-      uses: google-github-actions/auth@7b53cdc2a387814ed14eec026287aac689ae8c9b # v2.1.9
+      uses: google-github-actions/auth@ba79af03959ebeac9769e648f473a284504d9193 # v2.1.10
      with:
        workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
          }}/locations/global/workloadIdentityPools/${{
@@ -520,7 +518,7 @@ jobs:
        persist-credentials: false
        ref: ${{ env.PR_COMMIT_SHA }}
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
--- a/.github/workflows/weekly-pulumi-update.yml
+++ b/.github/workflows/weekly-pulumi-update.yml
@@ -53,16 +53,16 @@ jobs:
      with:
        lfs: true
    - name: Install Go
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@4304621e8c48d66093a8a214af5d5b5bc3b3d943 # v2.0.0
+      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
-      uses: pulumi/actions@9519177da243fd32cab35cdbf19cce1ab7472fcc # v6.2.0
+      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Setup DotNet
      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
      with:
--- a/.pulumi.version
+++ b/.pulumi.version
@@ -1 +1 @@
-3.163.0
+3.169.0
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,8 +1,14 @@
 ## Unreleased

+## 0.0.12 (2025-05-16)
+
 ### Changed

- Respond to cancel for exec builds. (<https://github.com/pulumi/pulumi-docker-build/pull/522>)
+- Upgraded pulumi-go-provider to v1.0.0-rc2.
+
+### Fixed
+
+- Builds now respect cancellation. (https://github.com/pulumi/pulumi-docker-build/issues/533, https://github.com/pulumi/pulumi-docker-build/pull/522)

 ## 0.0.11 (2025-04-11)

--- a/2
+++ b/2
@@ -89,7 +89,7 @@ ${PULUMI}: go.sum
 	GOBIN=${WORKING_DIR}/bin go install github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3
 	GOBIN=${WORKING_DIR}/bin go install github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3
 	GOBIN=${WORKING_DIR}/bin go install github.com/pulumi/pulumi-java/pkg/cmd/pulumi-language-java
-	GOBIN=${WORKING_DIR}/bin go install github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet
+	GOBIN=${WORKING_DIR}/bin go install github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3
 	GOBIN=${WORKING_DIR}/bin go install github.com/pulumi/pulumi-yaml/cmd/pulumi-converter-yaml

 ${GOGLANGCILINT}: go.sum
--- a/examples/python/main.py
+++ b/examples/python/main.py
@@ -5,151 +5,151 @@ config = pulumi.Config()
 docker_hub_password = config.require("dockerHubPassword")
 multi_platform = docker_build.Image("multiPlatform",
    push=False,
-    dockerfile=docker_build.DockerfileArgs(
-        location="./app/Dockerfile.multiPlatform",
-    ),
-    context=docker_build.BuildContextArgs(
-        location="./app",
-    ),
+    dockerfile={
+        "location": "./app/Dockerfile.multiPlatform",
+    },
+    context={
+        "location": "./app",
+    },
    platforms=[
        docker_build.Platform.PLAN9_AMD64,
        docker_build.Platform.PLAN9_386,
    ])
 registry_push = docker_build.Image("registryPush",
    push=False,
-    context=docker_build.BuildContextArgs(
-        location="./app",
-    ),
+    context={
+        "location": "./app",
+    },
    tags=["docker.io/pulumibot/buildkit-e2e:example"],
-    exports=[docker_build.ExportArgs(
-        registry=docker_build.ExportRegistryArgs(
-            oci_media_types=True,
-            push=False,
-        ),
-    )],
-    registries=[docker_build.RegistryArgs(
-        address="docker.io",
-        username="pulumibot",
-        password=docker_hub_password,
-    )])
+    exports=[{
+        "registry": {
+            "oci_media_types": True,
+            "push": False,
+        },
+    }],
+    registries=[{
+        "address": "docker.io",
+        "username": "pulumibot",
+        "password": docker_hub_password,
+    }])
 cached = docker_build.Image("cached",
    push=False,
-    context=docker_build.BuildContextArgs(
-        location="./app",
-    ),
-    cache_to=[docker_build.CacheToArgs(
-        local=docker_build.CacheToLocalArgs(
-            dest="tmp/cache",
-            mode=docker_build.CacheMode.MAX,
-        ),
-    )],
-    cache_from=[docker_build.CacheFromArgs(
-        local=docker_build.CacheFromLocalArgs(
-            src="tmp/cache",
-        ),
-    )])
+    context={
+        "location": "./app",
+    },
+    cache_to=[{
+        "local": {
+            "dest": "tmp/cache",
+            "mode": docker_build.CacheMode.MAX,
+        },
+    }],
+    cache_from=[{
+        "local": {
+            "src": "tmp/cache",
+        },
+    }])
 build_args = docker_build.Image("buildArgs",
    push=False,
-    dockerfile=docker_build.DockerfileArgs(
-        location="./app/Dockerfile.buildArgs",
-    ),
-    context=docker_build.BuildContextArgs(
-        location="./app",
-    ),
+    dockerfile={
+        "location": "./app/Dockerfile.buildArgs",
+    },
+    context={
+        "location": "./app",
+    },
    build_args={
        "SET_ME_TO_TRUE": "true",
    })
 extra_hosts = docker_build.Image("extraHosts",
    push=False,
-    dockerfile=docker_build.DockerfileArgs(
-        location="./app/Dockerfile.extraHosts",
-    ),
-    context=docker_build.BuildContextArgs(
-        location="./app",
-    ),
+    dockerfile={
+        "location": "./app/Dockerfile.extraHosts",
+    },
+    context={
+        "location": "./app",
+    },
    add_hosts=["metadata.google.internal:169.254.169.254"])
 ssh_mount = docker_build.Image("sshMount",
    push=False,
-    dockerfile=docker_build.DockerfileArgs(
-        location="./app/Dockerfile.sshMount",
-    ),
-    context=docker_build.BuildContextArgs(
-        location="./app",
-    ),
-    ssh=[docker_build.SSHArgs(
-        id="default",
-    )])
+    dockerfile={
+        "location": "./app/Dockerfile.sshMount",
+    },
+    context={
+        "location": "./app",
+    },
+    ssh=[{
+        "id": "default",
+    }])
 secrets = docker_build.Image("secrets",
    push=False,
-    dockerfile=docker_build.DockerfileArgs(
-        location="./app/Dockerfile.secrets",
-    ),
-    context=docker_build.BuildContextArgs(
-        location="./app",
-    ),
+    dockerfile={
+        "location": "./app/Dockerfile.secrets",
+    },
+    context={
+        "location": "./app",
+    },
    secrets={
        "password": "hunter2",
    })
 labels = docker_build.Image("labels",
    push=False,
-    context=docker_build.BuildContextArgs(
-        location="./app",
-    ),
+    context={
+        "location": "./app",
+    },
    labels={
        "description": "This image will get a descriptive label 👍",
    })
 target = docker_build.Image("target",
    push=False,
-    dockerfile=docker_build.DockerfileArgs(
-        location="./app/Dockerfile.target",
-    ),
-    context=docker_build.BuildContextArgs(
-        location="./app",
-    ),
+    dockerfile={
+        "location": "./app/Dockerfile.target",
+    },
+    context={
+        "location": "./app",
+    },
    target="build-me")
 named_contexts = docker_build.Image("namedContexts",
    push=False,
-    dockerfile=docker_build.DockerfileArgs(
-        location="./app/Dockerfile.namedContexts",
-    ),
-    context=docker_build.BuildContextArgs(
-        location="./app",
-        named={
-            "golang:latest": docker_build.ContextArgs(
-                location="docker-image://golang@sha256:b8e62cf593cdaff36efd90aa3a37de268e6781a2e68c6610940c48f7cdf36984",
-            ),
+    dockerfile={
+        "location": "./app/Dockerfile.namedContexts",
+    },
+    context={
+        "location": "./app",
+        "named": {
+            "golang:latest": {
+                "location": "docker-image://golang@sha256:b8e62cf593cdaff36efd90aa3a37de268e6781a2e68c6610940c48f7cdf36984",
+            },
        },
-    ))
+    })
 remote_context = docker_build.Image("remoteContext",
    push=False,
-    context=docker_build.BuildContextArgs(
-        location="https://raw.githubusercontent.com/pulumi/pulumi-docker/api-types/provider/testdata/Dockerfile",
-    ))
+    context={
+        "location": "https://raw.githubusercontent.com/pulumi/pulumi-docker/api-types/provider/testdata/Dockerfile",
+    })
 remote_context_with_inline = docker_build.Image("remoteContextWithInline",
    push=False,
-    dockerfile=docker_build.DockerfileArgs(
-        inline="""FROM busybox
+    dockerfile={
+        "inline": """FROM busybox
 COPY hello.c ./
 """,
-    ),
-    context=docker_build.BuildContextArgs(
-        location="https://github.com/docker-library/hello-world.git",
-    ))
+    },
+    context={
+        "location": "https://github.com/docker-library/hello-world.git",
+    })
 inline = docker_build.Image("inline",
    push=False,
-    dockerfile=docker_build.DockerfileArgs(
-        inline="""FROM alpine
+    dockerfile={
+        "inline": """FROM alpine
 RUN echo "This uses an inline Dockerfile! 👍"
 """,
-    ))
+    })
 docker_load = docker_build.Image("dockerLoad",
    push=False,
-    context=docker_build.BuildContextArgs(
-        location="./app",
-    ),
-    exports=[docker_build.ExportArgs(
-        docker=docker_build.ExportDockerArgs(
-            tar=True,
-        ),
-    )])
+    context={
+        "location": "./app",
+    },
+    exports=[{
+        "docker": {
+            "tar": True,
+        },
+    }])
 pulumi.export("platforms", multi_platform.platforms)
--- a/go.mod
+++ b/go.mod
@@ -15,27 +15,26 @@ require (
 	github.com/muesli/reflow v0.3.0
 	github.com/otiai10/copy v1.14.0
 	github.com/pulumi/providertest v0.3.1
-	github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet v0.0.0-20241219213128-b19d8c8da35b
-	github.com/pulumi/pulumi-go-provider v0.26.0
-	github.com/pulumi/pulumi-java/pkg v1.10.1-0.20250501074704-87881c4a7c04
+	github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3 v3.0.0-20250515194217-855e3e4c894c
+	github.com/pulumi/pulumi-go-provider v1.0.0-rc.2
+	github.com/pulumi/pulumi-java/pkg v1.11.0
 	github.com/pulumi/pulumi-yaml v1.17.0
-	github.com/pulumi/pulumi/pkg/v3 v3.165.0
-	github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3 v3.0.0-20250417110128-49fb14839a5a
-	github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3 v3.0.0-20250417110128-49fb14839a5a
-	github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3 v3.0.0-20250417110128-49fb14839a5a
-	github.com/pulumi/pulumi/sdk/v3 v3.165.0
+	github.com/pulumi/pulumi/pkg/v3 v3.169.0
+	github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3 v3.0.0-20250508095305-a4bdc94d01aa
+	github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3 v3.0.0-20250508095305-a4bdc94d01aa
+	github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3 v3.0.0-20250508095305-a4bdc94d01aa
+	github.com/pulumi/pulumi/sdk/v3 v3.169.0
 	github.com/regclient/regclient v0.7.1
 	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/afero v1.14.0
 	github.com/stretchr/testify v1.10.0
-	github.com/theupdateframework/notary v0.7.0
 	github.com/tonistiigi/fsutil v0.0.0-20250113203817-b14e27f4135a
 	github.com/tonistiigi/go-csvvalue v0.0.0-20240710180619-ddb21b71c0b4
 	go.opentelemetry.io/otel/metric v1.35.0
 	go.opentelemetry.io/otel/sdk v1.35.0
 	go.opentelemetry.io/otel/trace v1.35.0
-	go.uber.org/mock v0.5.0
-	golang.org/x/crypto v0.37.0
+	go.uber.org/mock v0.5.2
+	golang.org/x/crypto v0.38.0
 	golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0
 	google.golang.org/protobuf v1.36.6
 	gopkg.in/yaml.v3 v3.0.1
@@ -160,7 +159,6 @@ require (
 	github.com/docker/cli-docs-tool v0.9.0 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.8.2 // indirect
-	github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c // indirect
 	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-metrics v0.0.1 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
@@ -299,7 +297,6 @@ require (
 	github.com/mgechev/revive v1.3.7 // indirect
 	github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b // indirect
 	github.com/microcosm-cc/bluemonday v1.0.21 // indirect
-	github.com/miekg/pkcs11 v1.1.1 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
@@ -462,12 +459,12 @@ require (
 	gocloud.dev/secrets/hashivault v0.37.0 // indirect
 	golang.org/x/exp/typeparams v0.0.0-20240314144324-c7f7c6466f7f // indirect
 	golang.org/x/mod v0.24.0 // indirect
-	golang.org/x/net v0.39.0 // indirect
+	golang.org/x/net v0.40.0 // indirect
 	golang.org/x/oauth2 v0.25.0 // indirect
-	golang.org/x/sync v0.13.0 // indirect
-	golang.org/x/sys v0.32.0 // indirect
-	golang.org/x/term v0.31.0 // indirect
-	golang.org/x/text v0.24.0 // indirect
+	golang.org/x/sync v0.14.0 // indirect
+	golang.org/x/sys v0.33.0 // indirect
+	golang.org/x/term v0.32.0 // indirect
+	golang.org/x/text v0.25.0 // indirect
 	golang.org/x/time v0.6.0 // indirect
 	golang.org/x/tools v0.32.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
--- a/go.sum
+++ b/go.sum
@@ -19,8 +19,6 @@ cloud.google.com/go/storage v1.39.1 h1:MvraqHKhogCOTXTlct/9C3K3+Uy2jBmFYb3/Sp6dV
 cloud.google.com/go/storage v1.39.1/go.mod h1:xK6xZmxZmo+fyP7+DEF6FhNc24/JAe95OLyOHCXFH1o=
 dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
 dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
-filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
-filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 github.com/4meepo/tagalign v1.3.4 h1:P51VcvBnf04YkHzjfclN6BbsopfJR5rxs1n+5zHt+w8=
 github.com/4meepo/tagalign v1.3.4/go.mod h1:M+pnkHH2vG8+qhE5bVc/zeP7HS/j910Fwa9TUSyZVI0=
 github.com/Abirdcfly/dupword v0.0.14 h1:3U4ulkc8EUo+CaT105/GJ1BQwtgyj6+VaBVbAX11Ba8=
@@ -87,9 +85,6 @@ github.com/OpenPeeDeeP/depguard/v2 v2.2.0 h1:vDfG60vDtIuf0MEOhmLlLLSzqaRM8EMcgJP
 github.com/OpenPeeDeeP/depguard/v2 v2.2.0/go.mod h1:CIzddKRvLBC4Au5aYP/i3nyaWQ+ClszLIuVocRiCYFQ=
 github.com/ProtonMail/go-crypto v1.2.0 h1:+PhXXn4SPGd+qk76TlEePBfOfivE0zkWFenhGhFLzWs=
 github.com/ProtonMail/go-crypto v1.2.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
-github.com/Shopify/logrus-bugsnag v0.0.0-20170309145241-6dbc35f2c30d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
-github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d h1:UrqY+r/OJnIp5u0s1SbQ8dVfLCZJsnvazdBP5hS4iRs=
-github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
 github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=
@@ -178,13 +173,10 @@ github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiE
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
-github.com/beorn7/perks v0.0.0-20150223135152-b965b613227f/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bitly/go-hostpool v0.1.0/go.mod h1:4gOCgp6+NZnVqlKyZ/iBZFTAJKembaVENUpMkpg42fw=
-github.com/bitly/go-simplejson v0.5.0/go.mod h1:cXHtHw4XUPsvGaxgjIAn8PhEWG9NfngEKAMDJEczWVA=
 github.com/bkielbasa/cyclop v1.2.1 h1:AeF71HZDob1P2/pRm1so9cd1alZnrpyc4q2uP2l0gJY=
 github.com/bkielbasa/cyclop v1.2.1/go.mod h1:K/dT/M0FPAiYjBgQGau7tz+3TMh4FWAEqlMhzFWCrgM=
 github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
@@ -192,19 +184,12 @@ github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnweb
 github.com/blizzy78/varnamelen v0.8.0 h1:oqSblyuQvFsW1hbBHh1zfwrKe3kcSj0rnXkKzsQ089M=
 github.com/blizzy78/varnamelen v0.8.0/go.mod h1:V9TzQZ4fLJ1DSrjVDfl89H7aMnTvKkApdHeyESmyR7k=
 github.com/bmatcuk/doublestar v1.1.5/go.mod h1:wiQtGV+rzVYxB7WIlirSN++5HPtPlXEo9MEoZQC/PmE=
-github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
 github.com/bombsimon/wsl/v4 v4.2.1 h1:Cxg6u+XDWff75SIFFmNsqnIOgob+Q9hG6y/ioKbRFiM=
 github.com/bombsimon/wsl/v4 v4.2.1/go.mod h1:Xu/kDxGZTofQcDGCtQe9KCzhHphIe0fDuyWTxER9Feo=
 github.com/breml/bidichk v0.2.7 h1:dAkKQPLl/Qrk7hnP6P+E0xOodrq8Us7+U0o4UBOAlQY=
 github.com/breml/bidichk v0.2.7/go.mod h1:YodjipAGI9fGcYM7II6wFvGhdMYsC5pHDlGzqvEW3tQ=
 github.com/breml/errchkjson v0.3.6 h1:VLhVkqSBH96AvXEyclMR37rZslRrY2kcyq+31HCsVrA=
 github.com/breml/errchkjson v0.3.6/go.mod h1:jhSDoFheAF2RSDOlCfhHO9KqhZgAYLyvHe7bRCX8f/U=
-github.com/bugsnag/bugsnag-go v1.0.5-0.20150529004307-13fd6b8acda0 h1:s7+5BfS4WFJoVF9pnB8kBk03S7pZXRdKamnV0FOl5Sc=
-github.com/bugsnag/bugsnag-go v1.0.5-0.20150529004307-13fd6b8acda0/go.mod h1:2oa8nejYd4cQ/b0hMIopN0lCRxU0bueqREvZLWFrtK8=
-github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b h1:otBG+dV+YK+Soembjv71DPz3uX/V/6MMlSyD9JBQ6kQ=
-github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
-github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0 h1:nvj0OLI3YqYXer/kZD8Ri1aaunCxIEsOst1BVJswV0o=
-github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
 github.com/butuzov/ireturn v0.3.0 h1:hTjMqWw3y5JC3kpnC5vXmFJAWI/m31jaCYQqzkS6PL0=
 github.com/butuzov/ireturn v0.3.0/go.mod h1:A09nIiwiqzN/IoVo9ogpa0Hzi9fex1kd9PSD6edP5ZA=
 github.com/butuzov/mirror v1.2.0 h1:9YVK1qIjNspaqWutSv8gsge2e/Xpq1eqEkslEUHy5cs=
@@ -245,8 +230,6 @@ github.com/cheggaaa/pb v1.0.29/go.mod h1:W40334L7FMC5JKWldsTWbdGjLo0RxUKK73K+TuP
 github.com/ckaznocha/intrange v0.1.2 h1:3Y4JAxcMntgb/wABQ6e8Q8leMd26JbX2790lIss9MTI=
 github.com/ckaznocha/intrange v0.1.2/go.mod h1:RWffCw/vKBwHeOEwWdCikAtY0q4gGt8VhJZEEA5n+RE=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cloudflare/cfssl v0.0.0-20180223231731-4e2dcbde5004 h1:lkAMpLVBDaj17e85keuznYcH5rqI438v41pKcBl4ZxQ=
-github.com/cloudflare/cfssl v0.0.0-20180223231731-4e2dcbde5004/go.mod h1:yMWuSON2oQp+43nFtAV/uvKQIFpSPerB57DCt9t8sSA=
 github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
 github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
@@ -305,7 +288,6 @@ github.com/deckarep/golang-set/v2 v2.5.0 h1:hn6cEZtQ0h3J8kFrHR/NrzyOoTnjgW1+FmNJ
 github.com/deckarep/golang-set/v2 v2.5.0/go.mod h1:VAky9rY/yGXJOLEDv3OMci+7wtDpOF4IN+y82NBOac4=
 github.com/denis-tingaikin/go-header v0.5.0 h1:SRdnP5ZKvcO9KKRP1KJrhFR3RrlGuD+42t4429eC9k8=
 github.com/denis-tingaikin/go-header v0.5.0/go.mod h1:mMenU5bWrok6Wl2UsZjy+1okegmwQ3UgWl4V1D8gjlY=
-github.com/denisenkom/go-mssqldb v0.0.0-20191128021309-1d7a30a10f73/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
@@ -321,7 +303,6 @@ github.com/docker/cli v28.0.4+incompatible h1:pBJSJeNd9QeIWPjRcV91RVJihd/TXB77q1
 github.com/docker/cli v28.0.4+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/cli-docs-tool v0.9.0 h1:CVwQbE+ZziwlPqrJ7LRyUF6GvCA+6gj7MTCsayaK9t0=
 github.com/docker/cli-docs-tool v0.9.0/go.mod h1:ClrwlNW+UioiRyH9GiAOe1o3J/TsY3Tr1ipoypjAUtc=
-github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v28.0.1+incompatible h1:FCHjSRdXhNRFjlHMTv4jUNlIBbTeRjrWfeFuJp7jpo0=
@@ -330,10 +311,8 @@ github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZ
 github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c h1:lzqkGL9b3znc+ZUgi7FlLnqjQhcXxkNM/quxIjBVMD0=
 github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c/go.mod h1:CADgU4DSXK5QUlFslkQu2yW2TKzFZcXq/leZfM0UH5Q=
-github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
 github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
-github.com/docker/go-metrics v0.0.0-20180209012529-399ea8c73916/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
 github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
 github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
@@ -342,7 +321,6 @@ github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 h1:UhxFibDNY/bfvqU
 github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/dvsekhvalnov/jose2go v0.0.0-20170216131308-f21a8cedbbae/go.mod h1:7BvyPhdbLxMXIYTFPLsyJRFMsKmOZnQmzh6Gb+uquuM=
 github.com/edsrzf/mmap-go v1.2.0 h1:hXLYlkbaPzt1SaQk+anYwKSRNhufIDCchSPkUD6dD84=
 github.com/edsrzf/mmap-go v1.2.0/go.mod h1:19H/e8pUPLicwkyNgOykDXkJ9F0MHE+Z52B8EIth78Q=
 github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o=
@@ -359,7 +337,6 @@ github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
 github.com/erikgeiser/promptkit v0.9.0 h1:3qL1mS/ntCrXdb8sTP/ka82CJ9kEQaGuYXNrYJkWYBc=
 github.com/erikgeiser/promptkit v0.9.0/go.mod h1:pU9dtogSe3Jlc2AY77EP7R4WFP/vgD4v+iImC83KsCo=
-github.com/erikstmartin/go-testdb v0.0.0-20160219214506-8d10e4a1bae5/go.mod h1:a2zkGnVExMxdzMo3M0Hi/3sEU+cWnZpSni0O6/Yb/P0=
 github.com/ettle/strcase v0.2.0 h1:fGNiVF21fHXpX1niBgk0aROov1LagYsOwV/xqKDKR/Q=
 github.com/ettle/strcase v0.2.0/go.mod h1:DajmHElDSaX76ITe3/VHVyMin4LWSJN5Z909Wp+ED1A=
 github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
@@ -373,7 +350,6 @@ github.com/firefart/nonamedreturns v1.0.5 h1:tM+Me2ZaXs8tfdDw3X6DOX++wMCOqzYUho6
 github.com/firefart/nonamedreturns v1.0.5/go.mod h1:gHJjDqhGM4WyPt639SOZs+G89Ko7QKH5R5BhnO6xJhw=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
@@ -422,9 +398,6 @@ github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En
 github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
 github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
 github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/go-sql-driver/mysql v1.3.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
-github.com/go-sql-driver/mysql v1.8.0 h1:UtktXaU2Nb64z/pLiGIxY4431SJ4/dR5cjMmlVHgnT4=
-github.com/go-sql-driver/mysql v1.8.0/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
@@ -461,14 +434,12 @@ github.com/gofrs/flock v0.12.1 h1:MTLVXXHf8ekldpJk3AKicLij9MdwOWkZ+a/jHHZby9E=
 github.com/gofrs/flock v0.12.1/go.mod h1:9zxTsyu5xtJ9DK+1tFZyibEV7y3uwDxPPfbxeeHCoD0=
 github.com/gofrs/uuid v4.2.0+incompatible h1:yyYWMnhkhrKwwr8gAOcOCYxOOscHgDS9yZgBrnJfGa0=
 github.com/gofrs/uuid v4.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
-github.com/gogo/protobuf v1.0.0/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
 github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
-github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/glog v1.2.4 h1:CNNw5U8lSiiBk7druxtSHHTsRWcxKoac6kZKm2peBBc=
 github.com/golang/glog v1.2.4/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
@@ -480,7 +451,6 @@ github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5y
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
 github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
@@ -506,8 +476,6 @@ github.com/golangci/revgrep v0.5.3 h1:3tL7c1XBMtWHHqVpS5ChmiAAoe4PF/d5+ULzV9sLAz
 github.com/golangci/revgrep v0.5.3/go.mod h1:U4R/s9dlXZsg8uJmaR1GrloUr14D7qDl8gi2iPXJH8k=
 github.com/golangci/unconvert v0.0.0-20240309020433-c5143eacb3ed h1:IURFTjxeTfNFP0hTEi1YKjB/ub8zkpaOqFFMApi2EAs=
 github.com/golangci/unconvert v0.0.0-20240309020433-c5143eacb3ed/go.mod h1:XLXN8bNw4CGRPaqgl3bv/lhz7bsGPh4/xSaMTbo2vkQ=
-github.com/google/certificate-transparency-go v1.0.10-0.20180222191210-5ab67e519c93 h1:jc2UWq7CbdszqeH6qu1ougXMIUBfSy8Pbh/anURYbGI=
-github.com/google/certificate-transparency-go v1.0.10-0.20180222191210-5ab67e519c93/go.mod h1:QeJfpSbVSfYc7RgB3gJFj9cbuQMMchQxrWXz8Ruopmg=
 github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
 github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
@@ -556,7 +524,6 @@ github.com/gordonklaus/ineffassign v0.1.0 h1:y2Gd/9I7MdY1oEIt+n+rowjBNDcLQq3RsH5
 github.com/gordonklaus/ineffassign v0.1.0/go.mod h1:Qcp2HIAYhR7mNUVSIxZww3Guk4it82ghYcEXIAk+QT0=
 github.com/gorilla/css v1.0.0 h1:BQqNyPTi50JCFMTw/b67hByjMVXZRwGha6wxVGkeihY=
 github.com/gorilla/css v1.0.0/go.mod h1:Dn721qIggHpt4+EFCcTLTU/vk5ySda2ReITrtgBl60c=
-github.com/gorilla/mux v1.7.0/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
@@ -577,8 +544,6 @@ github.com/grpc-ecosystem/grpc-gateway/v2 v2.25.1 h1:VNqngBF40hVlDloBruUehVYC3Ar
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.25.1/go.mod h1:RBRO7fro65R6tjKzYgLAFo0t1QEXY1Dp+i/bvpRiqiQ=
 github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 h1:MJG/KsmcqMwFAkh8mTnAwhyKoB+sTAnY4CACC110tbU=
 github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645/go.mod h1:6iZfnjpejD4L/4DwD7NryNaJyCQdzwWwH2MWhCA90Kw=
-github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed h1:5upAirOpQc1Q53c0bnx2ufif5kANL7bfZWcc6VJWJd8=
-github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -620,7 +585,6 @@ github.com/hexops/valast v1.4.4/go.mod h1:Jcy1pNH7LNraVaAZDLyv21hHg2WBv9Nf9FL6fG
 github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec/go.mod h1:Q48J4R4DvxnHolD5P8pOtXigYlRuPLGl6moFx3ulM68=
 github.com/hinshun/vt10x v0.0.0-20220301184237-5011da428d02 h1:AgcIVYPa6XJnU3phs104wLj8l5GEththEw6+F79YsIY=
 github.com/hinshun/vt10x v0.0.0-20220301184237-5011da428d02/go.mod h1:Q48J4R4DvxnHolD5P8pOtXigYlRuPLGl6moFx3ulM68=
-github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/iancoleman/strcase v0.3.0 h1:nTXanmYxhfFAMjZL34Ov6gkzEsSJZ5DbhxWjvSASxEI=
 github.com/iancoleman/strcase v0.3.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho=
 github.com/ijc/Gotty v0.0.0-20170406111628-a8b993ba6abd h1:anPrsicrIi2ColgWTVPk+TrN42hJIWlfPHSBP9S0ZkM=
@@ -629,7 +593,6 @@ github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
 github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/in-toto/in-toto-golang v0.5.0 h1:hb8bgwr0M2hGdDsLjkJ3ZqJ8JFLL/tgYdAxF/XEFBbY=
 github.com/in-toto/in-toto-golang v0.5.0/go.mod h1:/Rq0IZHLV7Ku5gielPT4wPHJfH1GdHMCq8+WPxw8/BE=
-github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/iwdgo/sigintwindows v0.2.2 h1:P6oWzpvV7MrEAmhUgs+zmarrWkyL77ycZz4v7+1gYAE=
@@ -640,11 +603,6 @@ github.com/jgautheron/goconst v1.7.1 h1:VpdAG7Ca7yvvJk5n8dMwQhfEZJh95kl/Hl9S1OI5
 github.com/jgautheron/goconst v1.7.1/go.mod h1:aAosetZ5zaeC/2EfMeRswtxUFBpe2Hr7HzkgX4fanO4=
 github.com/jingyugao/rowserrcheck v1.1.1 h1:zibz55j/MJtLsjP1OF4bSdgXxwL1b+Vn7Tjzq7gFzUs=
 github.com/jingyugao/rowserrcheck v1.1.1/go.mod h1:4yvlZSDb3IyDTUZJUmpZfm2Hwok+Dtp+nu2qOq+er9c=
-github.com/jinzhu/gorm v0.0.0-20170222002820-5409931a1bb8 h1:CZkYfurY6KGhVtlalI4QwQ6T0Cu6iuY3e0x5RLu96WE=
-github.com/jinzhu/gorm v0.0.0-20170222002820-5409931a1bb8/go.mod h1:Vla75njaFJ8clLU1W44h34PjIkijhjHIYnZxMqCdxqo=
-github.com/jinzhu/inflection v0.0.0-20170102125226-1c35d901db3d h1:jRQLvyVGL+iVtDElaEIDdKwpPqUIZJfzkNLV34htpEc=
-github.com/jinzhu/inflection v0.0.0-20170102125226-1c35d901db3d/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
-github.com/jinzhu/now v1.1.1/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
 github.com/jirfag/go-printf-func-name v0.0.0-20200119135958-7558a9eaa5af h1:KA9BjwUk7KlCh6S9EAGWBt1oExIUv9WyNCiRz5amv48=
 github.com/jirfag/go-printf-func-name v0.0.0-20200119135958-7558a9eaa5af/go.mod h1:HEWGJkRDzjJY2sqdDwxccsGicWEf9BQOZsq2tV+xzM0=
 github.com/jjti/go-spancheck v0.6.1 h1:ZK/wE5Kyi1VX3PJpUO2oEgeoI4FWOUm7Shb2Gbv5obI=
@@ -661,7 +619,6 @@ github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCV
 github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/juju/loggo v0.0.0-20190526231331-6e530bcce5d8/go.mod h1:vgyd7OREkbtVEN/8IXZe5Ooef3LQePvuBm9UWj6ZL8U=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/julz/importas v0.1.0 h1:F78HnrsjY3cR7j0etXy5+TU1Zuy7Xt08X/1aJnH5xXY=
 github.com/julz/importas v0.1.0/go.mod h1:oSFU2R4XK/P7kNBrnL/FEQlDGN1/6WoxXEjSSXO0DV0=
@@ -683,7 +640,6 @@ github.com/kkHAIKE/contextcheck v1.1.5/go.mod h1:O930cpht4xb1YQpK+1+AgoM3mFsvxr7
 github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
 github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
@@ -709,7 +665,6 @@ github.com/ldez/tagliatelle v0.5.0 h1:epgfuYt9v0CG3fms0pEgIMNPuFf/LpPIfjk4kyqSio
 github.com/ldez/tagliatelle v0.5.0/go.mod h1:rj1HmWiL1MiKQuOONhd09iySTEkUuE/8+5jtPYz9xa4=
 github.com/leonklingele/grouper v1.1.2 h1:o1ARBDLOmmasUaNDesWqWCIFH3u7hoFlM84YrjT3mIY=
 github.com/leonklingele/grouper v1.1.2/go.mod h1:6D0M/HVkhs2yRKRFZUoGjeDy7EZTfFBE9gl4kjmIGkA=
-github.com/lib/pq v0.0.0-20150723085316-0dad96c0b94f/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/liquidgecka/testlib v0.0.0-20180123051607-561e6b271c63 h1:E1gsAMD4TysLS1Vt2CGR1EK/RtNPIT7YkiVOy9PS1IM=
 github.com/liquidgecka/testlib v0.0.0-20180123051607-561e6b271c63/go.mod h1:vwMPvLIhXhkJaBfsk/6l+eDuiQaIVHC0b6eCvUVBsB0=
 github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
@@ -720,7 +675,6 @@ github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
 github.com/macabu/inamedparam v0.1.3 h1:2tk/phHkMlEL/1GNe/Yf6kkR/hkcUdAEY3L0hjYV1Mk=
 github.com/macabu/inamedparam v0.1.3/go.mod h1:93FLICAIk/quk7eaPPQvbzihUdn/QkGDwIZEoLtpH6I=
-github.com/magiconair/properties v1.5.3/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.6 h1:5ibWZ6iY0NctNGWo87LalDlEZ6R41TqbbDamhfG/Qzo=
 github.com/magiconair/properties v1.8.6/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
@@ -753,7 +707,6 @@ github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6T
 github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
 github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
-github.com/mattn/go-sqlite3 v1.6.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mgechev/revive v1.3.7 h1:502QY0vQGe9KtYJ9FpxMz9rL+Fc/P13CI5POL4uHCcE=
 github.com/mgechev/revive v1.3.7/go.mod h1:RJ16jUbF0OWC3co/+XTxmFNgEpUPwnnA0BRllX2aDNA=
@@ -761,7 +714,6 @@ github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b h1:j7+1HpAFS1zy5+Q4qx1f
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
 github.com/microcosm-cc/bluemonday v1.0.21 h1:dNH3e4PSyE4vNX+KlRGHT5KrSvjeUkoNPwEORjffHJg=
 github.com/microcosm-cc/bluemonday v1.0.21/go.mod h1:ytNkv4RrDrLJ2pqlsSI46O6IVXmZOBBD4SaJyDwwTkM=
-github.com/miekg/pkcs11 v1.0.2/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU=
 github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
@@ -774,7 +726,6 @@ github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQ
 github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
 github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4=
 github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE=
-github.com/mitchellh/mapstructure v0.0.0-20150613213606-2caf8efc9366/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
@@ -834,7 +785,6 @@ github.com/natefinch/atomic v1.0.1 h1:ZPYKxkqQOx3KZ+RsbnP/YsgvxWQPGxjC0oBt2AhwV0
 github.com/natefinch/atomic v1.0.1/go.mod h1:N/D/ELrljoqDyT3rZrsUmtsuzvHkeB/wWjHV22AZRbM=
 github.com/nbutton23/zxcvbn-go v0.0.0-20180912185939-ae427f1e4c1d h1:AREM5mwr4u1ORQBMvzfzBgpsctsbQikCVpvC+tX285E=
 github.com/nbutton23/zxcvbn-go v0.0.0-20180912185939-ae427f1e4c1d/go.mod h1:o96djdrsSGy3AWPyBgZMAGfxZNfgntdJG+11KU4QvbU=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/nightlyone/lockfile v1.0.0 h1:RHep2cFKK4PonZJDdEl4GmkabuhbsRMgk/k3uAmxBiA=
 github.com/nightlyone/lockfile v1.0.0/go.mod h1:rywoIealpdNse2r832aiD9jRk8ErCatROs6LzC841CI=
 github.com/nishanths/exhaustive v0.12.0 h1:vIY9sALmw6T/yxiASewa4TQcFsVYZQQRUQJhKRf3Swg=
@@ -849,19 +799,12 @@ github.com/olareg/olareg v0.1.0 h1:1dXBOgPrig5N7zoXyIZVQqU0QBo6sD9pbL6UYjY75CA=
 github.com/olareg/olareg v0.1.0/go.mod h1:RBuU7JW7SoIIxZKzLRhq8sVtQeAHzCAtRrXEBx2KlM4=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
-github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.12.0 h1:Iw5WCbBcaAAd0fpRb1c9r5YCylv4XDoCSigm1zLevwU=
-github.com/onsi/ginkgo v1.12.0/go.mod h1:oUhWkIvk5aDxtKvDDuw8gItl8pKl42LzjC9KZE0HfGg=
 github.com/onsi/ginkgo/v2 v2.19.0 h1:9Cnnf7UHo57Hy3k6/m5k3dRfGTMXGvxhHFvkDTCTpvA=
 github.com/onsi/ginkgo/v2 v2.19.0/go.mod h1:rlwLi9PilAFJ8jCg9UE1QP6VBpd6/xj3SRC0d6TU0To=
-github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
-github.com/onsi/gomega v1.9.0/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=
 github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
 github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
-github.com/opencontainers/go-digest v0.0.0-20170106003457-a6d0ee40d420/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
 github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
 github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
 github.com/opencontainers/runtime-spec v1.2.0 h1:z97+pHb3uELt/yiAWD691HNHQIF07bE7dzrbT927iTk=
@@ -901,7 +844,6 @@ github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxu
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/term v1.1.0 h1:xIAAdCMh3QIAy+5FrE8Ad8XoDhEU4ufwbaSozViP9kk=
@@ -917,24 +859,20 @@ github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
 github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
-github.com/prometheus/client_golang v0.9.0-pre1.0.20180209125602-c332b6f63c06/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
 github.com/prometheus/client_golang v1.20.5 h1:cxppBPuYhUnsO6yo/aoRol4L7q7UFfdm+bR9r+8l63Y=
 github.com/prometheus/client_golang v1.20.5/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
-github.com/prometheus/client_model v0.0.0-20171117100541-99fa1f4be8e5/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
 github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
-github.com/prometheus/common v0.0.0-20180110214958-89604d197083/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
 github.com/prometheus/common v0.55.0 h1:KEi6DK7lXW/m7Ig5i47x0vRzuBsHuvJdi5ee6Y3G1dc=
 github.com/prometheus/common v0.55.0/go.mod h1:2SECS4xJG1kd8XF9IcM1gMX6510RAEL65zxzNImwdc8=
-github.com/prometheus/procfs v0.0.0-20180125133057-cb4147076ac7/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
@@ -948,24 +886,24 @@ github.com/pulumi/inflector v0.2.1 h1:bqyiish3tq//vLeLiEstSFE5K7RNjy/ce47ed4QATu
 github.com/pulumi/inflector v0.2.1/go.mod h1:HUFCjcPTz96YtTuUlwG3i3EZG4WlniBvR9bd+iJxCUY=
 github.com/pulumi/providertest v0.3.1 h1:vlftr7TZlObh81mL88IhhF0/9ZbLrZZos4NAvR4HUUw=
 github.com/pulumi/providertest v0.3.1/go.mod h1:fFHUP4/9DRyYnHWiRnwcynMtM/a7hHR/QcJfcuZKO3A=
-github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet v0.0.0-20241219213128-b19d8c8da35b h1:pyYHkDsogl5q4dorkTKVk4/87l+fFUEIIVuwBqKJMHM=
-github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet v0.0.0-20241219213128-b19d8c8da35b/go.mod h1:5LjEUmPDpUyXzFbQCy3s1oFgeU9K3gVA6tX+xn1Xvbo=
-github.com/pulumi/pulumi-go-provider v0.26.0 h1:3ia10+irvv7qPph2NZ2YwUGI/KCf6li8Frlc1luv7D4=
-github.com/pulumi/pulumi-go-provider v0.26.0/go.mod h1:zJiGxY5xnodPzLulpRS+fsS960MzeCdlsdiVCZ5TMRA=
-github.com/pulumi/pulumi-java/pkg v1.10.1-0.20250501074704-87881c4a7c04 h1:JtnozyKVJrV3ITXhnZL82lO3V8pbqrA+p5co8b3hbr4=
-github.com/pulumi/pulumi-java/pkg v1.10.1-0.20250501074704-87881c4a7c04/go.mod h1:fE/A/3U2rpqpQKG0RrmmHjf0q+7shjsSfi74mhmLF6g=
+github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3 v3.0.0-20250515194217-855e3e4c894c h1:UTPnj4E06/n+T6ffEevqvS2f+zKLdRBeM81aQwhwNlE=
+github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3 v3.0.0-20250515194217-855e3e4c894c/go.mod h1:4XmrdCzJ36AigIW8B0HWjkjfgmY2DZTLqv4BQal3hSg=
+github.com/pulumi/pulumi-go-provider v1.0.0-rc.2 h1:Fkv+MVGOE4XBwZ7M3Tp4vVWu3YE6w1pCod0vmMkukm0=
+github.com/pulumi/pulumi-go-provider v1.0.0-rc.2/go.mod h1:84yaWdhVcyPG+Vq3HfcDPPeGsNEMIQCD+S1WsymEw9A=
+github.com/pulumi/pulumi-java/pkg v1.11.0 h1:M8C7CKxwBSE/c5RcoGF0sAUSFZywjd7CjmTRQh8nvNk=
+github.com/pulumi/pulumi-java/pkg v1.11.0/go.mod h1:zoQdTjj488DhUx8dNed6SW1fJnAE4GwGLBVDRpsQVE8=
 github.com/pulumi/pulumi-yaml v1.17.0 h1:ebzggygqBcQrtmdBUqi28B1L/fAyHCFVIt0dS5re8Oc=
 github.com/pulumi/pulumi-yaml v1.17.0/go.mod h1:4cpS4ITkIAXgVedTZB3JY/DnZu9XSh+RhrKB5WlB/fs=
-github.com/pulumi/pulumi/pkg/v3 v3.165.0 h1:a0UOxhM+yUi5NH+SP5lv0YHxac3JOaeaZ/VINVkK+bM=
-github.com/pulumi/pulumi/pkg/v3 v3.165.0/go.mod h1:wJDlCqph9G1OCX8BYfjRp8yOtqBXZLij57fGbn1lXsM=
-github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3 v3.0.0-20250417110128-49fb14839a5a h1:4V6DbJaLLSvOc9J/7ODqQEg892LaPD2JZtB9pKpHPI0=
-github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3 v3.0.0-20250417110128-49fb14839a5a/go.mod h1:kle5wfWZA+tNa8M/8tBVk6yLE2kGqYtD3VEIpl8Vc6Y=
-github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3 v3.0.0-20250417110128-49fb14839a5a h1:5QPCsb+EAqwB2N70hXHPJig8eKi02Gttm9pGs9PQf2I=
-github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3 v3.0.0-20250417110128-49fb14839a5a/go.mod h1:9z23xCno15uQcyMDfFgXpISVExs/yXDuPsi5L8ykeRU=
-github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3 v3.0.0-20250417110128-49fb14839a5a h1:4JkTGfh7AMYWlngOHk1V5m3US5JQsphUsQBpfCCW5yg=
-github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3 v3.0.0-20250417110128-49fb14839a5a/go.mod h1:IhJFvQ3XHlTfik9Gmlw5A7KMGXOK+UMQuslTS0cuojA=
-github.com/pulumi/pulumi/sdk/v3 v3.165.0 h1:cglplKZOJDpqH8wa/2J250G9az/sE9eKp9fS2bC+vi8=
-github.com/pulumi/pulumi/sdk/v3 v3.165.0/go.mod h1:GAaHrdv3kWJHbzkFFFflGbTBQXUYu6SF1ZCo+O9jo44=
+github.com/pulumi/pulumi/pkg/v3 v3.169.0 h1:q1f36HRYhXEKZVe3b0SQGKJjl+9llCHzAztn+aiidtE=
+github.com/pulumi/pulumi/pkg/v3 v3.169.0/go.mod h1:ofgvwLttErApwvvvvmx40VhxEoNl34q0XVSraK40RqQ=
+github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3 v3.0.0-20250508095305-a4bdc94d01aa h1:b0CMni/Q621ChYaTe6FMHXYfrcH1FzAXjUsOsUO24nc=
+github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3 v3.0.0-20250508095305-a4bdc94d01aa/go.mod h1:5Vs9hUjv9+R4K97UUul5KjFIpUi0AmZdVZVE+Yl0UoY=
+github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3 v3.0.0-20250508095305-a4bdc94d01aa h1:RB9e9Gc4PMyX+IRdfR7VipRQeBdc3K93ROrnbmHS6V0=
+github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3 v3.0.0-20250508095305-a4bdc94d01aa/go.mod h1:5lah9DjodVv9BURtk2ykbJams7TclP+Xr7h+NK4B0gQ=
+github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3 v3.0.0-20250508095305-a4bdc94d01aa h1:3eGefORCsSeUrIYe9GIklycGRoKsKAGq3dfg1RYb3nM=
+github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3 v3.0.0-20250508095305-a4bdc94d01aa/go.mod h1:6LYkwLXNHz68cnVIgdsthaUaxZZDIJp1Ag0RyUnPNek=
+github.com/pulumi/pulumi/sdk/v3 v3.169.0 h1:bgz1fp2rl28khSXgF4FaRQiB9wh3lSKWtzUOGalf+x4=
+github.com/pulumi/pulumi/sdk/v3 v3.169.0/go.mod h1:Qhe4dOjqedyLr47kGGnG6ULIbzaPTlmjAvPqNQ1Ollo=
 github.com/quasilyte/go-ruleguard v0.4.2 h1:htXcXDK6/rO12kiTHKfHuqR4kr3Y4M0J0rOL6CH/BYs=
 github.com/quasilyte/go-ruleguard v0.4.2/go.mod h1:GJLgqsLeo4qgavUoL8JeGFNS7qcisx3awV/w9eWTmNI=
 github.com/quasilyte/go-ruleguard/dsl v0.3.22 h1:wd8zkOhSNr+I+8Qeciml08ivDt1pSXe60+5DqOpCjPE=
@@ -1032,9 +970,7 @@ github.com/shurcooL/httpfs v0.0.0-20190707220628-8d4bc4ba7749 h1:bUGsEnyNbVPw06B
 github.com/shurcooL/httpfs v0.0.0-20190707220628-8d4bc4ba7749/go.mod h1:ZY1cvUeJuFPAdZ/B6v7RHavJWZn2YPVFQ1OSXhCGOkg=
 github.com/shurcooL/vfsgen v0.0.0-20200824052919-0d455de96546 h1:pXY9qYc/MP5zdvqWEUH6SjNiu7VhSjuVFTFiTcphaLU=
 github.com/shurcooL/vfsgen v0.0.0-20200824052919-0d455de96546/go.mod h1:TrYk7fJVaAttu97ZZKrO9UbRa8izdowaMIZcxYMbVaw=
-github.com/sirupsen/logrus v1.0.6/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
-github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
@@ -1054,20 +990,15 @@ github.com/spdx/tools-golang v0.5.3 h1:ialnHeEYUC4+hkm5vJm4qz2x+oEJbS0mAMFrNXdQr
 github.com/spdx/tools-golang v0.5.3/go.mod h1:/ETOahiAo96Ob0/RAIBmFZw6XN0yTnyr/uFZm2NTMhI=
 github.com/spf13/afero v1.14.0 h1:9tH6MapGnn/j0eb0yIXiLjERO8RB6xIVZRDCX7PtqWA=
 github.com/spf13/afero v1.14.0/go.mod h1:acJQ8t0ohCGuMN3O+Pv0V0hgMxNYDlvdk+VTfyZmbYo=
-github.com/spf13/cast v0.0.0-20150508191742-4d07383ffe94/go.mod h1:r2rcYCSwa1IExKTDiTfzaxqT2FNHs8hODu4LnUfgKEg=
 github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
 github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU=
-github.com/spf13/cobra v0.0.1/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
 github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
 github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/jwalterweatherman v0.0.0-20141219030609-3d60171a6431/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
 github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk=
 github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
-github.com/spf13/pflag v1.0.0/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
 github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v0.0.0-20150530192845-be5ff3e4840c/go.mod h1:A8kyI5cUJhb8N+3pkfONlcEcZbueH6nhAm0Fq7SrnBM=
 github.com/spf13/viper v1.12.0 h1:CZ7eSOd3kZoaYDLbXnmzgQI5RlciuXBMA+18HwHRfZQ=
 github.com/spf13/viper v1.12.0/go.mod h1:b6COn30jlNxbm/V2IqWiNWkJ+vZNiMNksliPCiuKtSI=
 github.com/ssgreg/nlreturn/v2 v2.2.1 h1:X4XDI7jstt3ySqGU86YGAURbxw3oTDPK9sPEi6YEwQ0=
@@ -1076,7 +1007,6 @@ github.com/stbenjam/no-sprintf-host-port v0.1.1 h1:tYugd/yrm1O0dV+ThCbaKZh195Dfm
 github.com/stbenjam/no-sprintf-host-port v0.1.1/go.mod h1:TLhvtIvONRzdmkFiio4O8LHsN9N74I+PhRquPsxpL0I=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
@@ -1245,8 +1175,8 @@ go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
 go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.uber.org/mock v0.5.0 h1:KAMbZvZPyBPWgD14IrIQ38QCyjwpvVVV6K/bHl1IwQU=
-go.uber.org/mock v0.5.0/go.mod h1:ge71pBPLYDk7QIi1LupWxdAykm7KIEFchiOqd6z7qMM=
+go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
+go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
@@ -1257,20 +1187,17 @@ gocloud.dev/secrets/hashivault v0.37.0 h1:5ehGtUBP29DFAgAs6bPw7fVSgqQ3TxaoK2xVcL
 gocloud.dev/secrets/hashivault v0.37.0/go.mod h1:4ClUWjBfP8wLdGts56acjHz3mWLuATMoH9vi74FjIv8=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200422194213-44a606286825/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20201117144127-c1f2f97bffc9/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
-golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
-golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
+golang.org/x/crypto v0.38.0 h1:jt+WWG8IZlBnVbomuhg2Mdq0+BBQaHbtqHEFEigjUV8=
+golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 h1:R84qjqJb5nVJMxqWYb3np9L5ZsaDtB+a39EqjV0JSUM=
 golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0/go.mod h1:S9Xr4PYopiDyqSyp5NjCrhFrqg6A5zA2E/iPHPhqnS8=
@@ -1299,7 +1226,6 @@ golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
 golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -1324,8 +1250,8 @@ golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
-golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
-golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
+golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
+golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
 golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
@@ -1341,11 +1267,10 @@ golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
-golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=
+golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1353,7 +1278,6 @@ golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190801041406-cbf593c0f2f3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1387,9 +1311,8 @@ golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
-golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
+golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -1400,8 +1323,8 @@ golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
-golang.org/x/term v0.31.0 h1:erwDkOK1Msy6offm1mOgvspSkslFnIGsFnxOKoufg3o=
-golang.org/x/term v0.31.0/go.mod h1:R4BeIy7D95HzImkxGkTW1UQTtP54tio2RyHz7PwK0aw=
+golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg=
+golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -1413,8 +1336,8 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
-golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
+golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
+golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
 golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U=
 golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -1471,7 +1394,6 @@ google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422 h1:
 google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422/go.mod h1:b6h1vNKhxaSoEI+5jc3PJUCustfli/mRab7295pY7rw=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250414145226-207652e42e2e h1:ztQaXfzEXTmCBvbtWYRhJxW+0iJcz2qXfd38/e9l7bA=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250414145226-207652e42e2e/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
-google.golang.org/grpc v1.0.5/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
@@ -1490,31 +1412,22 @@ google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpAD
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
 google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
-gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
-gopkg.in/cenkalti/backoff.v2 v2.2.1 h1:eJ9UAg01/HIHG987TwxvnzK2MgxXq97YY6rYDpY9aII=
-gopkg.in/cenkalti/backoff.v2 v2.2.1/go.mod h1:S0QdOvT2AlerfSBkp0O+dk+bbIMaNbEmVk876gPCthU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
-gopkg.in/gemnasium/logrus-airbrake-hook.v2 v2.1.2/go.mod h1:Xk6kEKp8OKb+X14hQBKWaSkCsqBpgog8nAV2xsGOxlo=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
-gopkg.in/rethinkdb/rethinkdb-go.v6 v6.2.1 h1:d4KQkxAaAiRY2h5Zqis161Pv91A37uZyJOx73duwUwM=
-gopkg.in/rethinkdb/rethinkdb-go.v6 v6.2.1/go.mod h1:WbjuEoo1oadwzQ4apSDU+JTvmllEHtsNHS6y7vFc7iw=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
 gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
--- a/provider/internal/cli.go
+++ b/provider/internal/cli.go
@@ -57,11 +57,11 @@ type cli struct {
 	auths map[string]cfgtypes.AuthConfig
 	host  *host

-	in       string        // stdin
-	r, w     *os.File      // stdout
-	err      bytes.Buffer  // stderr
-	dumplogs bool          // if true then tail() will re-log status messages
-	done     chan struct{} // signaled when all logs have been forwarded to the engine.
+	in       string       // stdin
+	r, w     *os.File     // stdout
+	err      bytes.Buffer // stderr
+	dumplogs bool         // if true then tail() will re-log status messages
+	builder  Builder      // for mocking build daemon responses
 }

 // Cli wraps the Docker interface for mock generation.
@@ -120,11 +120,12 @@ func wrap(host *host, registries ...Registry) (*cli, error) {
 	}

 	wrapped := &cli{
-		Cli:   docker,
-		host:  host,
-		auths: auths,
-		r:     r,
-		w:     w,
+		Cli:     docker,
+		host:    host,
+		auths:   auths,
+		r:       r,
+		w:       w,
+		builder: defaultBuilder{},
 	}

 	return wrapped, nil
@@ -163,14 +164,6 @@ func (c *cli) rc() *regclient.RegClient {
 // tail is meant to be called as a goroutine and will pipe output from the CLI
 // back to the Pulumi engine. Requires a corresponding call to close.
 func (c *cli) tail(ctx context.Context) {
-	c.done = make(chan struct{}, 1)
-	defer func() {
-		c.done <- struct{}{}
-		if err := recover(); err != nil {
-			fmt.Fprintf(os.Stderr, "recovered: %s\n", err)
-		}
-	}()
-
 	b := bytes.Buffer{}

 	s := bufio.NewScanner(c.r)
@@ -194,11 +187,7 @@ func (c *cli) tail(ctx context.Context) {

 // close flushes any outstanding logs and cleans up resources.
 func (c *cli) Close() error {
-	err := errors.Join(c.w.Close(), c.r.Close())
-	if c.done != nil {
-		<-c.done
-	}
-	return err
+	return errors.Join(c.w.Close(), c.r.Close())
 }

 // execBuild performs a build by os.Exec'ing the docker-buildx binary.
--- a/provider/internal/client.go
+++ b/provider/internal/client.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-//go:generate go run go.uber.org/mock/mockgen -typed -package internal -source client.go -destination mockclient_test.go --self_package github.com/pulumi/pulumi-docker-build/provider/internal
+//go:generate go run go.uber.org/mock/mockgen -typed -package internal -source client.go -destination mockclient_test.go --self_package github.com/pulumi/pulumi-docker-build/provider/internal -imports buildx=github.com/docker/buildx/build

 package internal

@@ -26,6 +26,7 @@ import (

 	"github.com/distribution/reference"
 	buildx "github.com/docker/buildx/build"
+	"github.com/docker/buildx/builder"
 	"github.com/docker/buildx/commands"
 	controllerapi "github.com/docker/buildx/controller/pb"
 	"github.com/docker/buildx/util/confutil"
@@ -62,6 +63,36 @@ type Client interface {
 	SupportsMultipleExports() bool
 }

+// registryGetter is something that can return a list of [Registry].
+type registryGetter interface {
+	GetRegistries() []Registry
+}
+
+// clientF builds a Docker client. The order of registryGetters is significant.
+// We typically prefer credentials from args, then provider config, then the
+// host. Provide them to this function in order of increasing priority: host,
+// config, args.
+//
+// We ignore state because if its creds differ from those in args then they are
+// likely volatile and also likely expired.
+type clientF func(context.Context, *host, ...registryGetter) (Client, error)
+
+// RealClientF builds a real Docker client with auth layered on top of the
+// host's latent credentials.
+func RealClientF(_ context.Context, host *host, getters ...registryGetter) (Client, error) {
+	auths := []Registry{}
+	for _, rg := range getters {
+		auths = append(auths, rg.GetRegistries()...)
+	}
+	return wrap(host, auths...)
+}
+
+func mockClientF(c Client) clientF {
+	return func(context.Context, *host, ...registryGetter) (Client, error) {
+		return c, nil
+	}
+}
+
 // Build encapsulates all of the user-provider build parameters and options.
 type Build interface {
 	BuildOptions() controllerapi.BuildOptions
@@ -123,9 +154,15 @@ func (c *cli) Build(
 	if err != nil {
 		return nil, fmt.Errorf("creating printer: %w", err)
 	}
+
 	defer func() {
-		// Log any warnings when we're done.
-		_ = printer.Wait()
+		// Wait for logs to flush if the build finished, but not if we're
+		// exiting early.
+		if ctx.Err() == nil {
+			_ = printer.Wait()
+		}
+
+		// Log any warnings we got, separated by newlines.
 		for _, w := range printer.Warnings() {
 			b := &bytes.Buffer{}
 			_, _ = b.Write(w.Short)
@@ -224,21 +261,40 @@ func (c *cli) Build(
 		},
 	}

-	// Perform the build.
-	results, err := buildx.Build(
-		ctx,
-		b.nodes,
-		payload,
-		dockerutil.NewClient(c),
-		confutil.NewConfig(c),
-		printer,
-	)
-	if err != nil {
+	resultC := make(chan map[string]*client.SolveResponse)
+	errC := make(chan error)
+
+	// buildx.Build doesn't handle context cancellation, so we monitor it in a
+	// goroutine. cli.Close cleans up our file descriptors, so if we do exit
+	// early the remote build should terminate as soon as it sees the pipe has
+	// broken.
+	go func() {
+		defer close(resultC)
+		defer close(errC)
+		results, err := c.builder.Build(
+			ctx,
+			b.nodes,
+			payload,
+			dockerutil.NewClient(c),
+			confutil.NewConfig(c),
+			printer,
+		)
+		if err != nil {
+			errC <- err
+			return
+		}
+		resultC <- results
+	}()
+
+	select {
+	case results := <-resultC:
+		return results[target], nil
+	case err := <-errC:
 		c.dumplogs = true
 		return nil, err
+	case <-ctx.Done():
+		return nil, ctx.Err()
 	}
-
-	return results[target], err
 }

 // BuildKitEnabled returns true if the client supports buildkit.
@@ -354,6 +410,31 @@ func (c *cli) Delete(ctx context.Context, r string) error {
 	return nil
 }

+// Builder allows injecting mock responses from the build daemon.
+type Builder interface {
+	Build(
+		ctx context.Context,
+		nodes []builder.Node,
+		opts map[string]buildx.Options,
+		docker *dockerutil.Client,
+		cfg *confutil.Config,
+		w progress.Writer,
+	) (resp map[string]*client.SolveResponse, err error)
+}
+
+type defaultBuilder struct{}
+
+func (defaultBuilder) Build(
+	ctx context.Context,
+	nodes []builder.Node,
+	opts map[string]buildx.Options,
+	docker *dockerutil.Client,
+	cfg *confutil.Config,
+	w progress.Writer,
+) (resp map[string]*client.SolveResponse, err error) {
+	return buildx.Build(ctx, nodes, opts, docker, cfg, w)
+}
+
 func normalizeReference(ref string) (reference.Named, error) {
 	namedRef, err := reference.ParseNormalizedNamed(ref)
 	if err != nil {
--- a/provider/internal/client_test.go
+++ b/provider/internal/client_test.go
@@ -17,15 +17,23 @@ package internal
 import (
 	"bytes"
 	"context"
+	"errors"
 	"io"
 	"log/slog"
 	"os"
 	"path/filepath"
 	"testing"

+	buildx "github.com/docker/buildx/build"
+	"github.com/docker/buildx/builder"
+	"github.com/docker/buildx/util/confutil"
+	"github.com/docker/buildx/util/dockerutil"
+	"github.com/docker/buildx/util/progress"
 	"github.com/docker/docker/api/types/registry"
+	"github.com/moby/buildkit/client"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 )

 func TestAuth(t *testing.T) {
@@ -432,6 +440,35 @@ func TestBuildExecError(t *testing.T) {
 	}
 }

+func TestBuildCancelation(t *testing.T) {
+	t.Parallel()
+	cli := testcli(t, true)
+
+	ctrl := gomock.NewController(t)
+
+	ctx, cancel := context.WithCancel(context.Background())
+
+	b := NewMockBuilder(ctrl)
+	b.EXPECT().Build(
+		gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(),
+	).DoAndReturn(func(
+		_ context.Context,
+		_ []builder.Node,
+		_ map[string]buildx.Options,
+		_ *dockerutil.Client,
+		_ *confutil.Config,
+		_ progress.Writer,
+	) (map[string]*client.SolveResponse, error) {
+		cancel()
+		return nil, errors.New("cancel wasn't respected")
+	})
+	cli.builder = b
+
+	resp, err := cli.Build(ctx, &build{})
+	assert.ErrorIs(t, err, context.Canceled)
+	assert.Nil(t, resp)
+}
+
 // testcli returns a new standalone CLI instance. Set ping to true if a live
 // daemon is required -- the test will be skipped if the daemon is not available.
 func testcli(t *testing.T, ping bool, auths ...Registry) *cli {
--- a/provider/internal/image.go
+++ b/provider/internal/image.go
@@ -38,7 +38,7 @@ import (

 	provider "github.com/pulumi/pulumi-go-provider"
 	"github.com/pulumi/pulumi-go-provider/infer"
-	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
+	"github.com/pulumi/pulumi/sdk/v3/go/property"
 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
 )

@@ -61,7 +61,10 @@ var _imageExamples string
 var _migration string

 // Image is a Docker image build using buildkit.
-type Image struct{}
+type Image struct {
+	clientF clientF
+	config  *Config
+}

 // Annotate provides a description of the Image resource.
 func (i *Image) Annotate(a infer.Annotator) {
@@ -281,6 +284,11 @@ func (ia *ImageArgs) Annotate(a infer.Annotator) {
 	a.SetDefault(&ia.Network, Default)
 }

+// GetRegistries returns the image's registries, if any.
+func (ia ImageArgs) GetRegistries() []Registry {
+	return ia.Registries
+}
+
 // ImageState is serialized to the program's state file.
 type ImageState struct {
 	ImageArgs
@@ -329,38 +337,25 @@ func (is *ImageState) Annotate(a infer.Annotator) {

 // client produces a CLI client scoped to this resource and layered on top of
 // any host-level credentials.
-func (i *Image) client(ctx context.Context, state ImageState, args ImageArgs) (Client, error) {
-	cfg := infer.GetConfig[Config](ctx)
-
-	if cli, ok := ctx.Value(_mockClientKey).(Client); ok {
-		return cli, nil
-	}
-
-	// We prefer auth from args, the provider, and state in that order. We
-	// build a slice in reverse order because wrap() will overwrite earlier
-	// entries with later ones.
-	auths := []Registry{}
-	auths = append(auths, cfg.Registries...)
-	auths = append(auths, args.Registries...)
-
-	return wrap(cfg.host, auths...)
+func (i *Image) client(ctx context.Context, args ImageArgs) (Client, error) {
+	return i.clientF(ctx, i.config.getHost(), i.config, args)
 }

 // Check validates ImageArgs, sets defaults, and ensures our client is
 // authenticated.
 func (i *Image) Check(
 	ctx context.Context,
-	_ string,
-	_ resource.PropertyMap,
-	news resource.PropertyMap,
-) (ImageArgs, []provider.CheckFailure, error) {
-	args, failures, err := infer.DefaultCheck[ImageArgs](ctx, news)
+	req infer.CheckRequest,
+) (infer.CheckResponse[ImageArgs], error) {
+	args, failures, err := infer.DefaultCheck[ImageArgs](ctx, req.NewInputs)
 	if err != nil || len(failures) != 0 {
-		return args, failures, err
+		return infer.CheckResponse[ImageArgs]{Failures: failures, Inputs: args}, err
 	}

-	// :(
-	preview := news.ContainsUnknowns()
+	// If the inputs aren't fully resolved we perform a weaker validation, for
+	// example we might not be able to check the Dockerfile for syntactic
+	// correctness.
+	preview := property.New(req.NewInputs).HasComputed()

 	cfg := infer.GetConfig[Config](ctx)
 	supportsMultipleExports := true
@@ -376,7 +371,7 @@ func (i *Image) Check(
 		}
 	}

-	return args, failures, err
+	return infer.CheckResponse[ImageArgs]{Failures: failures, Inputs: args}, err
 }

 type checkFailure struct {
@@ -683,12 +678,11 @@ func (ia *ImageArgs) validate(supportsMultipleExports, preview bool) (controller
 // Create builds an image using buildkit.
 func (i *Image) Create(
 	ctx context.Context,
-	name string,
-	input ImageArgs,
-	preview bool,
-) (string, ImageState, error) {
+	req infer.CreateRequest[ImageArgs],
+) (infer.CreateResponse[ImageState], error) {
+	input := req.Inputs
 	state := ImageState{ImageArgs: input}
-	id := name
+	id := req.Name

 	// Default our ref to one of our tags.
 	for _, tag := range state.Tags {
@@ -699,22 +693,31 @@ func (i *Image) Create(
 		break
 	}

-	cli, err := i.client(ctx, state, input)
+	cli, err := i.client(ctx, input)
 	if err != nil {
-		return id, state, err
+		return infer.CreateResponse[ImageState]{ID: id, Output: state}, err
 	}

 	ok, err := cli.BuildKitEnabled()
 	if err != nil {
-		return id, state, fmt.Errorf("checking buildkit compatibility: %w", err)
+		return infer.CreateResponse[ImageState]{
+			ID:     id,
+			Output: state,
+		}, fmt.Errorf("checking buildkit compatibility: %w", err)
 	}
 	if !ok {
-		return id, state, errors.New("buildkit is not supported on this host")
+		return infer.CreateResponse[ImageState]{
+			ID:     id,
+			Output: state,
+		}, errors.New("buildkit is not supported on this host")
 	}

-	build, err := input.toBuild(ctx, cli.SupportsMultipleExports(), preview)
+	build, err := input.toBuild(ctx, cli.SupportsMultipleExports(), req.DryRun)
 	if err != nil {
-		return id, state, fmt.Errorf("preparing: %w", err)
+		return infer.CreateResponse[ImageState]{
+			ID:     id,
+			Output: state,
+		}, fmt.Errorf("preparing: %w", err)
 	}

 	hash, err := hashBuildContext(
@@ -723,21 +726,24 @@ func (i *Image) Create(
 		input.Context.Named.Map(),
 	)
 	if err != nil {
-		return id, state, fmt.Errorf("hashing build context: %w", err)
+		return infer.CreateResponse[ImageState]{
+			ID:     id,
+			Output: state,
+		}, fmt.Errorf("hashing build context: %w", err)
 	}
 	state.ContextHash = hash

-	if preview && !input.shouldBuildOnPreview() {
-		return id, state, nil
+	if req.DryRun && !input.shouldBuildOnPreview() {
+		return infer.CreateResponse[ImageState]{ID: id, Output: state}, nil
 	}
-	if preview && !input.buildable() {
+	if req.DryRun && !input.buildable() {
 		provider.GetLogger(ctx).Warning("Skipping preview build because some inputs are unknown.")
-		return id, state, nil
+		return infer.CreateResponse[ImageState]{ID: id, Output: state}, nil
 	}

 	result, err := cli.Build(ctx, build)
 	if err != nil {
-		return id, state, err
+		return infer.CreateResponse[ImageState]{ID: id, Output: state}, err
 	}

 	if d, ok := result.ExporterResponse[exptypes.ExporterImageDigestKey]; ok {
@@ -747,7 +753,7 @@ func (i *Image) Create(

 	if state.Digest == "" {
 		// Can't construct a ref, nothing else to do.
-		return id, state, nil
+		return infer.CreateResponse[ImageState]{ID: id, Output: state}, nil
 	}

 	// Take the first registry tag we find and add a digest to it. That becomes
@@ -762,7 +768,7 @@ func (i *Image) Create(
 		break
 	}

-	return id, state, nil
+	return infer.CreateResponse[ImageState]{ID: id, Output: state}, nil
 }

 // Update builds a new image. Normally we create-replace resources, but for
@@ -770,36 +776,41 @@ func (i *Image) Create(
 // updates and simply re-build the image without deleting anything.
 func (i *Image) Update(
 	ctx context.Context,
-	name string,
-	_ ImageState,
-	input ImageArgs,
-	preview bool,
-) (ImageState, error) {
-	_, state, err := i.Create(ctx, name, input, preview)
-	return state, err
+	req infer.UpdateRequest[ImageArgs, ImageState],
+) (infer.UpdateResponse[ImageState], error) {
+	resp, err := i.Create(ctx,
+		infer.CreateRequest[ImageArgs]{Name: req.ID, Inputs: req.Inputs, DryRun: req.DryRun},
+	)
+	return infer.UpdateResponse[ImageState]{Output: resp.Output}, err
 }

 // Read attempts to read manifests from an image's exports. An image without
 // exports will have no manifests.
 func (i *Image) Read(
 	ctx context.Context,
-	name string,
-	input ImageArgs,
-	state ImageState,
+	req infer.ReadRequest[ImageArgs, ImageState],
 ) (
-	string, // id
-	ImageArgs, // normalized inputs
-	ImageState, // normalized state
+	infer.ReadResponse[ImageArgs, ImageState],
 	error,
 ) {
-	cli, err := i.client(ctx, state, input)
+	state, input := req.State, req.Inputs
+
+	cli, err := i.client(ctx, input)
 	if err != nil {
-		return name, input, state, err
+		return infer.ReadResponse[ImageArgs, ImageState]{
+			ID:     req.ID,
+			Inputs: input,
+			State:  state,
+		}, err
 	}

 	if !state.isExported() {
 		// Nothing was pushed -- all done.
-		return name, input, state, nil
+		return infer.ReadResponse[ImageArgs, ImageState]{
+			ID:     req.ID,
+			Inputs: input,
+			State:  state,
+		}, nil
 	}

 	tagsToKeep := []string{}
@@ -835,29 +846,29 @@ func (i *Image) Read(
 	// If we couldn't find the tags we expected then return an empty ID to
 	// delete the resource.
 	if len(input.Tags) > 0 && len(tagsToKeep) == 0 {
-		return "", input, state, nil
+		return infer.ReadResponse[ImageArgs, ImageState]{ID: "", Inputs: input, State: state}, nil
 	}

 	state.Tags = tagsToKeep

-	return name, input, state, nil
+	return infer.ReadResponse[ImageArgs, ImageState]{ID: req.ID, Inputs: input, State: state}, nil
 }

 // Delete deletes an Image. If the Image was already deleted out-of-band it is
 // treated as a success.
 func (i *Image) Delete(
 	ctx context.Context,
-	_ string,
-	state ImageState,
-) error {
-	cli, err := i.client(ctx, state, state.ImageArgs)
+	req infer.DeleteRequest[ImageState],
+) (infer.DeleteResponse, error) {
+	state := req.State
+	cli, err := i.client(ctx, state.ImageArgs)
 	if err != nil {
-		return err
+		return infer.DeleteResponse{}, err
 	}

 	if state.Digest == "" {
 		// Nothing was exported. Just try to delete the local image.
-		return cli.Delete(ctx, state.Ref)
+		return infer.DeleteResponse{}, cli.Delete(ctx, state.Ref)
 	}

 	digests := []string{}
@@ -885,17 +896,17 @@ func (i *Image) Delete(
 		multierr = errors.Join(multierr, err)
 	}

-	return multierr
+	return infer.DeleteResponse{}, multierr
 }

 // Diff re-implements most of the default diff behavior, with the exception of
 // ignoring "password" changes on registry inputs.
 func (*Image) Diff(
 	_ context.Context,
-	_ string,
-	olds ImageState,
-	news ImageArgs,
+	req infer.DiffRequest[ImageArgs, ImageState],
 ) (provider.DiffResponse, error) {
+	olds, news := req.State, req.Inputs
+
 	diff := map[string]provider.PropertyDiff{}
 	update := provider.PropertyDiff{Kind: provider.Update}

--- a/provider/internal/image_test.go
+++ b/provider/internal/image_test.go
@@ -35,9 +35,11 @@ import (
 	"go.uber.org/mock/gomock"

 	provider "github.com/pulumi/pulumi-go-provider"
+	"github.com/pulumi/pulumi-go-provider/infer"
 	"github.com/pulumi/pulumi-go-provider/integration"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/util/mapper"
+	"github.com/pulumi/pulumi/sdk/v3/go/property"
 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
 )

@@ -84,46 +86,44 @@ func TestImageLifecycle(t *testing.T) {
 			},
 			op: func(t *testing.T) integration.Operation {
 				return integration.Operation{
-					Inputs: resource.PropertyMap{
-						"push": resource.NewBoolProperty(false),
-						"tags": resource.NewArrayProperty(
-							[]resource.PropertyValue{
-								resource.NewStringProperty("docker.io/pulumibot/buildkit-e2e"),
-								resource.NewStringProperty("docker.io/pulumibot/buildkit-e2e:main"),
+					Inputs: property.NewMap(map[string]property.Value{
+						"push": property.New(false),
+						"tags": property.New(
+							[]property.Value{
+								property.New("docker.io/pulumibot/buildkit-e2e"),
+								property.New("docker.io/pulumibot/buildkit-e2e:main"),
 							},
 						),
-						"platforms": resource.NewArrayProperty(
-							[]resource.PropertyValue{
-								resource.NewStringProperty("linux/arm64"),
-								resource.NewStringProperty("linux/amd64"),
+						"platforms": property.New(
+							[]property.Value{
+								property.New("linux/arm64"),
+								property.New("linux/amd64"),
 							},
 						),
-						"context": resource.NewObjectProperty(resource.PropertyMap{
-							"location": resource.NewStringProperty("testdata/noop"),
+						"context": property.New(map[string]property.Value{
+							"location": property.New("testdata/noop"),
 						}),
-						"dockerfile": resource.NewObjectProperty(resource.PropertyMap{
-							"location": resource.NewStringProperty("testdata/noop/Dockerfile"),
+						"dockerfile": property.New(map[string]property.Value{
+							"location": property.New("testdata/noop/Dockerfile"),
 						}),
-						"exports": resource.NewArrayProperty(
-							[]resource.PropertyValue{
-								resource.NewObjectProperty(resource.PropertyMap{
-									"raw": resource.NewStringProperty("type=registry"),
+						"exports": property.New(
+							[]property.Value{
+								property.New(map[string]property.Value{
+									"raw": property.New("type=registry"),
 								},
 								),
 							},
 						),
-						"registries": resource.NewArrayProperty(
-							[]resource.PropertyValue{
-								resource.NewObjectProperty(resource.PropertyMap{
-									"address":  resource.NewStringProperty("fakeaddress"),
-									"username": resource.NewStringProperty("fakeuser"),
-									"password": resource.MakeSecret(
-										resource.NewStringProperty("password"),
-									),
+						"registries": property.New(
+							[]property.Value{
+								property.New(map[string]property.Value{
+									"address":  property.New("fakeaddress"),
+									"username": property.New("fakeuser"),
+									"password": property.New("password").WithSecret(true),
 								}),
 							},
 						),
-					},
+					}),
 				}
 			},
 		},
@@ -132,20 +132,20 @@ func TestImageLifecycle(t *testing.T) {
 			client: noClient,
 			op: func(t *testing.T) integration.Operation {
 				return integration.Operation{
-					Inputs: resource.PropertyMap{
-						"push": resource.NewBoolProperty(false),
-						"tags": resource.NewArrayProperty([]resource.PropertyValue{}),
-						"context": resource.NewObjectProperty(resource.PropertyMap{
-							"location": resource.NewStringProperty("testdata/noop"),
+					Inputs: property.NewMap(map[string]property.Value{
+						"push": property.New(false),
+						"tags": property.New([]property.Value{}),
+						"context": property.New(map[string]property.Value{
+							"location": property.New("testdata/noop"),
 						}),
-						"exports": resource.NewArrayProperty(
-							[]resource.PropertyValue{
-								resource.NewObjectProperty(resource.PropertyMap{
-									"raw": resource.NewStringProperty("type=registry"),
+						"exports": property.New(
+							[]property.Value{
+								property.New(map[string]property.Value{
+									"raw": property.New("type=registry"),
 								}),
 							},
 						),
-					},
+					}),
 					ExpectFailure: true,
 					CheckFailures: []provider.CheckFailure{
 						{
@@ -161,19 +161,19 @@ func TestImageLifecycle(t *testing.T) {
 			client: noClient,
 			op: func(t *testing.T) integration.Operation {
 				return integration.Operation{
-					Inputs: resource.PropertyMap{
-						"push": resource.NewBoolProperty(false),
-						"tags": resource.NewArrayProperty(
-							[]resource.PropertyValue{resource.NewStringProperty("invalid-exports")},
+					Inputs: property.NewMap(map[string]property.Value{
+						"push": property.New(false),
+						"tags": property.New(
+							[]property.Value{property.New("invalid-exports")},
 						),
-						"exports": resource.NewArrayProperty(
-							[]resource.PropertyValue{
-								resource.NewObjectProperty(resource.PropertyMap{
-									"raw": resource.NewStringProperty("type="),
+						"exports": property.New(
+							[]property.Value{
+								property.New(map[string]property.Value{
+									"raw": property.New("type="),
 								}),
 							},
 						),
-					},
+					}),
 					ExpectFailure: true,
 					CheckFailures: []provider.CheckFailure{{
 						Property: "exports[0]",
@@ -194,15 +194,15 @@ func TestImageLifecycle(t *testing.T) {
 			},
 			op: func(t *testing.T) integration.Operation {
 				return integration.Operation{
-					Inputs: resource.PropertyMap{
-						"push": resource.NewBoolProperty(false),
-						"tags": resource.NewArrayProperty(
-							[]resource.PropertyValue{resource.NewStringProperty("foo")},
+					Inputs: property.NewMap(map[string]property.Value{
+						"push": property.New(false),
+						"tags": property.New(
+							[]property.Value{property.New("foo")},
 						),
-						"context": resource.NewObjectProperty(resource.PropertyMap{
-							"location": resource.NewStringProperty("testdata/noop"),
+						"context": property.New(map[string]property.Value{
+							"location": property.New("testdata/noop"),
 						}),
-					},
+					}),
 					ExpectFailure: true,
 				}
 			},
@@ -221,15 +221,15 @@ func TestImageLifecycle(t *testing.T) {
 			},
 			op: func(t *testing.T) integration.Operation {
 				return integration.Operation{
-					Inputs: resource.PropertyMap{
-						"push": resource.NewBoolProperty(false),
-						"tags": resource.NewArrayProperty(
-							[]resource.PropertyValue{resource.NewStringProperty("foo")},
+					Inputs: property.NewMap(map[string]property.Value{
+						"push": property.New(false),
+						"tags": property.New(
+							[]property.Value{property.New("foo")},
 						),
-						"context": resource.NewObjectProperty(resource.PropertyMap{
-							"location": resource.NewStringProperty("testdata/noop"),
+						"context": property.New(map[string]property.Value{
+							"location": property.New("testdata/noop"),
 						}),
-					},
+					}),
 					ExpectFailure: true,
 				}
 			},
@@ -254,24 +254,24 @@ func TestImageLifecycle(t *testing.T) {
 			},
 			op: func(t *testing.T) integration.Operation {
 				return integration.Operation{
-					Inputs: resource.PropertyMap{
-						"push": resource.NewBoolProperty(false),
-						"tags": resource.NewArrayProperty(
-							[]resource.PropertyValue{
-								resource.NewStringProperty("default-dockerfile"),
+					Inputs: property.NewMap(map[string]property.Value{
+						"push": property.New(false),
+						"tags": property.New(
+							[]property.Value{
+								property.New("default-dockerfile"),
 							},
 						),
-						"context": resource.NewObjectProperty(resource.PropertyMap{
-							"location": resource.NewStringProperty("testdata/noop"),
+						"context": property.New(map[string]property.Value{
+							"location": property.New("testdata/noop"),
 						}),
-					},
-					Hook: func(_, output resource.PropertyMap) {
-						dockerfile := output["dockerfile"]
+					}),
+					Hook: func(_, output property.Map) {
+						dockerfile := output.Get("dockerfile")
 						require.NotNil(t, dockerfile)
-						require.True(t, dockerfile.IsObject())
-						location := dockerfile.ObjectValue()["location"]
+						require.True(t, dockerfile.IsMap())
+						location := dockerfile.AsMap().Get("location")
 						require.True(t, location.IsString())
-						assert.Equal(t, "testdata/noop/Dockerfile", location.StringValue())
+						assert.Equal(t, "testdata/noop/Dockerfile", location.AsString())
 					},
 				}
 			},
@@ -296,25 +296,25 @@ func TestImageLifecycle(t *testing.T) {
 			},
 			op: func(t *testing.T) integration.Operation {
 				return integration.Operation{
-					Inputs: resource.PropertyMap{
-						"push": resource.NewBoolProperty(false),
-						"tags": resource.NewArrayProperty(
-							[]resource.PropertyValue{
-								resource.NewStringProperty("inline-dockerfile"),
+					Inputs: property.NewMap(map[string]property.Value{
+						"push": property.New(false),
+						"tags": property.New(
+							[]property.Value{
+								property.New("inline-dockerfile"),
 							},
 						),
-						"buildOnPreview": resource.NewBoolProperty(true),
-						"dockerfile": resource.NewObjectProperty(resource.PropertyMap{
-							"inline": resource.NewStringProperty("FROM alpine:latest"),
+						"buildOnPreview": property.New(true),
+						"dockerfile": property.New(map[string]property.Value{
+							"inline": property.New("FROM alpine:latest"),
 						}),
-					},
-					Hook: func(_, output resource.PropertyMap) {
-						context := output["context"]
+					}),
+					Hook: func(_, output property.Map) {
+						context := output.Get("context")
 						require.NotNil(t, context)
-						require.True(t, context.IsObject())
-						location := context.ObjectValue()["location"]
+						require.True(t, context.IsMap())
+						location := context.AsMap().Get("location")
 						require.True(t, location.IsString())
-						assert.Equal(t, ".", location.StringValue())
+						assert.Equal(t, ".", location.AsString())
 					},
 				}
 			},
@@ -328,7 +328,7 @@ func TestImageLifecycle(t *testing.T) {
 				Resource: "docker-build:index:Image",
 				Create:   tt.op(t),
 			}
-			s := newServer(tt.client(t))
+			s := newServer(t.Context(), t, mockClientF(tt.client(t)))

 			err := s.Configure(provider.ConfigureRequest{})
 			require.NoError(t, err)
@@ -353,21 +353,16 @@ func TestDelete(t *testing.T) {
 			Delete(gomock.Any(), "docker.io/pulumi/test@sha256:foo").
 			Return(errNotFound{})

-		s := newServer(client)
-		err := s.Configure(provider.ConfigureRequest{})
-		require.NoError(t, err)
+		i := &Image{clientF: mockClientF(client)}

-		err = s.Delete(provider.DeleteRequest{
-			ID:  "foo,bar",
-			Urn: _fakeURN,
-			Properties: resource.PropertyMap{
-				"tags": resource.NewArrayProperty([]resource.PropertyValue{
-					resource.NewStringProperty("docker.io/pulumi/test:foo"),
-				}),
-				"push":        resource.NewBoolProperty(true),
-				"digest":      resource.NewStringProperty("sha256:foo"),
-				"contextHash": resource.NewStringProperty(""),
-				"ref":         resource.NewStringProperty(""),
+		_, err := i.Delete(t.Context(), infer.DeleteRequest[ImageState]{
+			ID: "foo,bar",
+			State: ImageState{
+				ImageArgs: ImageArgs{
+					Tags: []string{"docker.io/pulumi/test:foo"},
+					Push: true,
+				},
+				Digest: "sha256:foo",
 			},
 		})
 		assert.NoError(t, err)
@@ -391,27 +386,21 @@ func TestRead(t *testing.T) {
 			},
 		}, nil)

-	s := newServer(client)
-	err := s.Configure(provider.ConfigureRequest{})
-	require.NoError(t, err)
+	i := &Image{clientF: mockClientF(client)}

-	resp, err := s.Read(provider.ReadRequest{
-		ID:  "my-image",
-		Urn: _fakeURN,
-		Properties: resource.PropertyMap{
-			"exports": resource.NewArrayProperty([]resource.PropertyValue{
-				resource.NewObjectProperty(resource.PropertyMap{
-					"raw": resource.NewStringProperty("type=registry"),
-				}),
-			}),
-			"tags": resource.NewArrayProperty([]resource.PropertyValue{
-				resource.NewStringProperty(tag),
-			}),
-			"digest": resource.NewStringProperty(digest),
+	resp, err := i.Read(t.Context(), infer.ReadRequest[ImageArgs, ImageState]{
+		ID: "my-image",
+		State: ImageState{
+			ImageArgs: ImageArgs{
+				Exports: []Export{{Raw: "type=registry"}},
+				Tags:    []string{tag},
+			},
+			Digest: digest,
 		},
 	})
+
 	require.NoError(t, err)
-	assert.NotNil(t, resp.Properties["exports"].ArrayValue()[0].ObjectValue()["manifest"])
+	assert.Equal(t, []string{tag}, resp.State.Tags)
 }

 func TestImageDiff(t *testing.T) {
@@ -432,21 +421,21 @@ func TestImageDiff(t *testing.T) {
 	}

 	tests := []struct {
-		name string
-		olds func(*testing.T, ImageState) ImageState
-		news func(*testing.T, ImageArgs) ImageArgs
+		name   string
+		state  func(*testing.T, ImageState) ImageState
+		inputs func(*testing.T, ImageArgs) ImageArgs

 		wantChanges bool
 	}{
 		{
 			name:        "no diff if build context is unchanged",
-			olds:        func(*testing.T, ImageState) ImageState { return baseState },
-			news:        func(*testing.T, ImageArgs) ImageArgs { return baseArgs },
+			state:       func(*testing.T, ImageState) ImageState { return baseState },
+			inputs:      func(*testing.T, ImageArgs) ImageArgs { return baseArgs },
 			wantChanges: false,
 		},
 		{
 			name: "no diff if registry password changes",
-			olds: func(_ *testing.T, s ImageState) ImageState {
+			state: func(_ *testing.T, s ImageState) ImageState {
 				s.Registries = []Registry{{
 					Address:  "foo",
 					Username: "foo",
@@ -454,7 +443,7 @@ func TestImageDiff(t *testing.T) {
 				}}
 				return s
 			},
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+			inputs: func(_ *testing.T, a ImageArgs) ImageArgs {
 				a.Registries = []Registry{{
 					Address:  "foo",
 					Username: "foo",
@@ -466,11 +455,11 @@ func TestImageDiff(t *testing.T) {
 		},
 		{
 			name: "no diff if pull=true but no exports",
-			olds: func(_ *testing.T, is ImageState) ImageState {
+			state: func(_ *testing.T, is ImageState) ImageState {
 				is.Pull = true
 				return is
 			},
-			news: func(t *testing.T, ia ImageArgs) ImageArgs {
+			inputs: func(t *testing.T, ia ImageArgs) ImageArgs {
 				ia.Pull = true
 				return ia
 			},
@@ -478,12 +467,12 @@ func TestImageDiff(t *testing.T) {
 		},
 		{
 			name: "diff if pull=true with exports",
-			olds: func(_ *testing.T, is ImageState) ImageState {
+			state: func(_ *testing.T, is ImageState) ImageState {
 				is.Pull = true
 				is.Load = true
 				return is
 			},
-			news: func(t *testing.T, ia ImageArgs) ImageArgs {
+			inputs: func(t *testing.T, ia ImageArgs) ImageArgs {
 				ia.Pull = true
 				ia.Load = true
 				return ia
@@ -491,9 +480,9 @@ func TestImageDiff(t *testing.T) {
 			wantChanges: true,
 		},
 		{
-			name: "diff if build context changes",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(t *testing.T, a ImageArgs) ImageArgs {
+			name:  "diff if build context changes",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(t *testing.T, a ImageArgs) ImageArgs {
 				tmp := filepath.Join(a.Context.Location, "tmp")
 				err := os.WriteFile(tmp, []byte{}, 0o600)
 				require.NoError(t, err)
@@ -503,9 +492,9 @@ func TestImageDiff(t *testing.T) {
 			wantChanges: true,
 		},
 		{
-			name: "diff if registry added",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+			name:  "diff if registry added",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(_ *testing.T, a ImageArgs) ImageArgs {
 				a.Registries = []Registry{{}}
 				return a
 			},
@@ -513,7 +502,7 @@ func TestImageDiff(t *testing.T) {
 		},
 		{
 			name: "diff if registry user changes",
-			olds: func(_ *testing.T, s ImageState) ImageState {
+			state: func(_ *testing.T, s ImageState) ImageState {
 				s.Registries = []Registry{{
 					Address:  "foo",
 					Username: "foo",
@@ -521,7 +510,7 @@ func TestImageDiff(t *testing.T) {
 				}}
 				return s
 			},
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+			inputs: func(_ *testing.T, a ImageArgs) ImageArgs {
 				a.Registries = []Registry{{
 					Address:  "DIFFERENT USER",
 					Username: "foo",
@@ -532,9 +521,9 @@ func TestImageDiff(t *testing.T) {
 			wantChanges: true,
 		},
 		{
-			name: "diff if buildArgs changes",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+			name:  "diff if buildArgs changes",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(_ *testing.T, a ImageArgs) ImageArgs {
 				a.BuildArgs = map[string]string{
 					"foo": "bar",
 				}
@@ -543,36 +532,36 @@ func TestImageDiff(t *testing.T) {
 			wantChanges: true,
 		},
 		{
-			name: "diff if pull changes",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(t *testing.T, ia ImageArgs) ImageArgs {
+			name:  "diff if pull changes",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(t *testing.T, ia ImageArgs) ImageArgs {
 				ia.Pull = true
 				return ia
 			},
 			wantChanges: true,
 		},
 		{
-			name: "diff if load changes",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(t *testing.T, ia ImageArgs) ImageArgs {
+			name:  "diff if load changes",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(t *testing.T, ia ImageArgs) ImageArgs {
 				ia.Load = true
 				return ia
 			},
 			wantChanges: true,
 		},
 		{
-			name: "diff if push changes",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(t *testing.T, ia ImageArgs) ImageArgs {
+			name:  "diff if push changes",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(t *testing.T, ia ImageArgs) ImageArgs {
 				ia.Push = true
 				return ia
 			},
 			wantChanges: true,
 		},
 		{
-			name: "diff if buildOnPreview doesn't change",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(t *testing.T, ia ImageArgs) ImageArgs {
+			name:  "diff if buildOnPreview doesn't change",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(t *testing.T, ia ImageArgs) ImageArgs {
 				val := true
 				ia.BuildOnPreview = &val
 				return ia
@@ -580,9 +569,9 @@ func TestImageDiff(t *testing.T) {
 			wantChanges: true,
 		},
 		{
-			name: "diff if buildOnPreview changes",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(t *testing.T, ia ImageArgs) ImageArgs {
+			name:  "diff if buildOnPreview changes",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(t *testing.T, ia ImageArgs) ImageArgs {
 				val := false
 				ia.BuildOnPreview = &val
 				return ia
@@ -590,171 +579,171 @@ func TestImageDiff(t *testing.T) {
 			wantChanges: true,
 		},
 		{
-			name: "diff if ssh changes",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(t *testing.T, ia ImageArgs) ImageArgs {
+			name:  "diff if ssh changes",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(t *testing.T, ia ImageArgs) ImageArgs {
 				ia.SSH = []SSH{{ID: "default"}}
 				return ia
 			},
 			wantChanges: true,
 		},
 		{
-			name: "diff if hosts change",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(t *testing.T, ia ImageArgs) ImageArgs {
+			name:  "diff if hosts change",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(t *testing.T, ia ImageArgs) ImageArgs {
 				ia.AddHosts = []string{"localhost"}
 				return ia
 			},
 			wantChanges: true,
 		},
 		{
-			name: "diff if cacheFrom changes",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+			name:  "diff if cacheFrom changes",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(_ *testing.T, a ImageArgs) ImageArgs {
 				a.CacheFrom = []CacheFrom{{Raw: "a"}}
 				return a
 			},
 			wantChanges: true,
 		},
 		{
-			name: "diff if cacheTo changes",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+			name:  "diff if cacheTo changes",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(_ *testing.T, a ImageArgs) ImageArgs {
 				a.CacheTo = []CacheTo{{Raw: "a"}}
 				return a
 			},
 			wantChanges: true,
 		},
 		{
-			name: "diff if context changes",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+			name:  "diff if context changes",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(_ *testing.T, a ImageArgs) ImageArgs {
 				a.Context = &BuildContext{Context: Context{Location: "testdata/ignores"}}
 				return a
 			},
 			wantChanges: true,
 		},
 		{
-			name: "diff if named context changes",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+			name:  "diff if named context changes",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(_ *testing.T, a ImageArgs) ImageArgs {
 				a.Context = &BuildContext{Named: NamedContexts{"foo": Context{Location: "bar"}}}
 				return a
 			},
 			wantChanges: true,
 		},
 		{
-			name: "diff if network changes",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+			name:  "diff if network changes",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(_ *testing.T, a ImageArgs) ImageArgs {
 				a.Network = &host
 				return a
 			},
 			wantChanges: true,
 		},
 		{
-			name: "diff if dockerfile location changes",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+			name:  "diff if dockerfile location changes",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(_ *testing.T, a ImageArgs) ImageArgs {
 				a.Dockerfile = &Dockerfile{Location: "testdata/ignores/basedir/Dockerfile"}
 				return a
 			},
 			wantChanges: true,
 		},
 		{
-			name: "diff if dockerfile inline changes",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+			name:  "diff if dockerfile inline changes",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(_ *testing.T, a ImageArgs) ImageArgs {
 				a.Dockerfile = &Dockerfile{Inline: "FROM scratch"}
 				return a
 			},
 			wantChanges: true,
 		},
 		{
-			name: "diff if platforms change",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+			name:  "diff if platforms change",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(_ *testing.T, a ImageArgs) ImageArgs {
 				a.Platforms = []Platform{"linux/amd64"}
 				return a
 			},
 			wantChanges: true,
 		},
 		{
-			name: "diff if pull changes",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+			name:  "diff if pull changes",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(_ *testing.T, a ImageArgs) ImageArgs {
 				a.Pull = true
 				return a
 			},
 			wantChanges: true,
 		},
 		{
-			name: "diff if builder changes",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+			name:  "diff if builder changes",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(_ *testing.T, a ImageArgs) ImageArgs {
 				a.Builder = &BuilderConfig{Name: "foo"}
 				return a
 			},
 			wantChanges: true,
 		},
 		{
-			name: "diff if tags change",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+			name:  "diff if tags change",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(_ *testing.T, a ImageArgs) ImageArgs {
 				a.Tags = []string{"foo"}
 				return a
 			},
 			wantChanges: true,
 		},
 		{
-			name: "diff if exports change",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+			name:  "diff if exports change",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(_ *testing.T, a ImageArgs) ImageArgs {
 				a.Exports = []Export{{Raw: "foo"}}
 				return a
 			},
 			wantChanges: true,
 		},
 		{
-			name: "diff if target changes",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+			name:  "diff if target changes",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(_ *testing.T, a ImageArgs) ImageArgs {
 				a.Target = "foo"
 				return a
 			},
 			wantChanges: true,
 		},
 		{
-			name: "diff if pulling",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+			name:  "diff if pulling",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(_ *testing.T, a ImageArgs) ImageArgs {
 				a.Pull = true
 				return a
 			},
 			wantChanges: true,
 		},
 		{
-			name: "diff if noCache changes",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+			name:  "diff if noCache changes",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(_ *testing.T, a ImageArgs) ImageArgs {
 				a.NoCache = true
 				return a
 			},
 			wantChanges: true,
 		},
 		{
-			name: "diff if labels change",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+			name:  "diff if labels change",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(_ *testing.T, a ImageArgs) ImageArgs {
 				a.Labels = map[string]string{"foo": "bar"}
 				return a
 			},
 			wantChanges: true,
 		},
 		{
-			name: "diff if secrets change",
-			olds: func(*testing.T, ImageState) ImageState { return baseState },
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+			name:  "diff if secrets change",
+			state: func(*testing.T, ImageState) ImageState { return baseState },
+			inputs: func(_ *testing.T, a ImageArgs) ImageArgs {
 				a.Secrets = map[string]string{"foo": "bar"}
 				return a
 			},
@@ -762,13 +751,13 @@ func TestImageDiff(t *testing.T) {
 		},
 		{
 			name: "diff if local export doesn't exist",
-			olds: func(t *testing.T, state ImageState) ImageState {
+			state: func(t *testing.T, state ImageState) ImageState {
 				state.Exports = []Export{
 					{Local: &ExportLocal{Dest: "not-real"}},
 				}
 				return state
 			},
-			news: func(_ *testing.T, args ImageArgs) ImageArgs {
+			inputs: func(_ *testing.T, args ImageArgs) ImageArgs {
 				args.Exports = []Export{
 					{Local: &ExportLocal{Dest: "not-real"}},
 				}
@@ -778,13 +767,13 @@ func TestImageDiff(t *testing.T) {
 		},
 		{
 			name: "diff if tar export doesn't exist",
-			olds: func(t *testing.T, state ImageState) ImageState {
+			state: func(t *testing.T, state ImageState) ImageState {
 				state.Exports = []Export{
 					{Tar: &ExportTar{ExportLocal: ExportLocal{Dest: "not-real"}}},
 				}
 				return state
 			},
-			news: func(_ *testing.T, args ImageArgs) ImageArgs {
+			inputs: func(_ *testing.T, args ImageArgs) ImageArgs {
 				args.Exports = []Export{
 					{Tar: &ExportTar{ExportLocal: ExportLocal{Dest: "not-real"}}},
 				}
@@ -794,12 +783,12 @@ func TestImageDiff(t *testing.T) {
 		},
 	}

-	s := newServer(nil)
+	s := newServer(t.Context(), t, nil)

-	encode := func(t *testing.T, x any) resource.PropertyMap {
+	encode := func(t *testing.T, x any) property.Map {
 		raw, err := mapper.New(&mapper.Opts{IgnoreMissing: true}).Encode(x)
 		require.NoError(t, err)
-		return resource.NewPropertyMapFromMap(raw)
+		return resource.FromResourcePropertyMap(resource.NewPropertyMapFromMap(raw))
 	}

 	for _, tt := range tests {
@@ -808,9 +797,9 @@ func TestImageDiff(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			resp, err := s.Diff(provider.DiffRequest{
-				Urn:  _fakeURN,
-				Olds: encode(t, tt.olds(t, baseState)),
-				News: encode(t, tt.news(t, baseArgs)),
+				Urn:    _fakeURN,
+				State:  encode(t, tt.state(t, baseState)),
+				Inputs: encode(t, tt.inputs(t, baseArgs)),
 			})
 			assert.NoError(t, err)
 			assert.Equal(t, tt.wantChanges, resp.HasChanges, resp.DetailedDiff)
--- a/provider/internal/index.go
+++ b/provider/internal/index.go
@@ -28,7 +28,6 @@ import (

 	provider "github.com/pulumi/pulumi-go-provider"
 	"github.com/pulumi/pulumi-go-provider/infer"
-	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
 )

 var (
@@ -47,7 +46,10 @@ var (
 var _indexExamples string

 // Index is an OCI index or manifest list on a remote registry.
-type Index struct{}
+type Index struct {
+	clientF clientF
+	config  *Config
+}

 // IndexArgs instantiate an Index.
 type IndexArgs struct {
@@ -64,6 +66,14 @@ func (i IndexArgs) isPushed() bool {
 	return *i.Push
 }

+// GetRegistries returns the index's registry.
+func (i IndexArgs) GetRegistries() []Registry {
+	if i.Registry == nil {
+		return nil
+	}
+	return []Registry{*i.Registry}
+}
+
 // IndexState captures the state of an Index.
 type IndexState struct {
 	IndexArgs
@@ -132,66 +142,82 @@ func (i *IndexState) Annotate(a infer.Annotator) {
 // Create is a passthrough to Update.
 func (i *Index) Create(
 	ctx context.Context,
-	name string,
-	input IndexArgs,
-	preview bool,
-) (string, IndexState, error) {
-	state, err := i.Update(ctx, name, IndexState{}, input, preview)
-	return name, state, err
+	req infer.CreateRequest[IndexArgs],
+) (infer.CreateResponse[IndexState], error) {
+	resp, err := i.Update(ctx,
+		infer.UpdateRequest[IndexArgs, IndexState]{
+			ID:     req.Name,
+			State:  IndexState{},
+			Inputs: req.Inputs,
+			DryRun: req.DryRun,
+		},
+	)
+	return infer.CreateResponse[IndexState]{ID: req.Name, Output: resp.Output}, err
 }

 // Update performs `buildx imagetools create` to create a new OCI index /
 // manifest list.
 func (i *Index) Update(
 	ctx context.Context,
-	name string,
-	state IndexState,
-	input IndexArgs,
-	preview bool,
-) (IndexState, error) {
+	req infer.UpdateRequest[IndexArgs, IndexState],
+) (infer.UpdateResponse[IndexState], error) {
+	state, input := req.State, req.Inputs
+
 	state.IndexArgs = input
 	state.Ref = input.Tag

-	cli, err := i.client(ctx, state, input)
+	cli, err := i.client(ctx, input)
 	if err != nil {
-		return state, err
+		return infer.UpdateResponse[IndexState]{Output: state}, err
 	}

-	if preview {
-		return state, nil
+	if req.DryRun {
+		return infer.UpdateResponse[IndexState]{Output: state}, nil
 	}

-	provider.GetLogger(ctx).Debugf("creating index with tag %s and sources %s", input.Tag, input.Sources)
+	provider.GetLogger(ctx).
+		Debugf("creating index with tag %s and sources %s", input.Tag, input.Sources)

 	err = cli.ManifestCreate(ctx, input.isPushed(), input.Tag, input.Sources...)
 	if err != nil {
-		return state, fmt.Errorf("creating: %w", err)
+		return infer.UpdateResponse[IndexState]{Output: state}, fmt.Errorf("creating: %w", err)
 	}

-	_, _, state, err = i.Read(ctx, name, input, state)
+	// Read remote manifest information, if it exists.
+	live, err := i.Read(ctx,
+		infer.ReadRequest[IndexArgs, IndexState]{ID: req.ID, Inputs: input, State: state},
+	)
 	if err != nil {
-		return state, fmt.Errorf("reading: %w", err)
+		return infer.UpdateResponse[IndexState]{Output: state}, fmt.Errorf("reading: %w", err)
 	}
-	return state, nil
+	return infer.UpdateResponse[IndexState]{Output: live.State}, nil
 }

 func (i *Index) Read(
 	ctx context.Context,
-	name string,
-	input IndexArgs,
-	state IndexState,
-) (string, IndexArgs, IndexState, error) {
+	req infer.ReadRequest[IndexArgs, IndexState],
+) (infer.ReadResponse[IndexArgs, IndexState], error) {
+	state, input := req.State, req.Inputs
+
 	state.IndexArgs = input
 	state.Ref = input.Tag

 	if !input.isPushed() {
 		provider.GetLogger(ctx).Debug("skipping read because index was not pushed")
-		return name, input, state, nil // Nothing to read.
+		return infer.ReadResponse[IndexArgs, IndexState]{
+			ID:     req.ID,
+			Inputs: input,
+			State:  state,
+		}, nil // Nothing to read.
 	}

-	cli, err := i.client(ctx, state, input)
+	cli, err := i.client(ctx, input)
 	if err != nil {
-		return name, input, state, err
+		return infer.ReadResponse[IndexArgs, IndexState]{
+			ID:     req.ID,
+			Inputs: input,
+			State:  state,
+		}, err
 	}

 	provider.GetLogger(ctx).Debug("reading index with tag " + input.Tag)
@@ -199,21 +225,29 @@ func (i *Index) Read(
 	digest, err := cli.ManifestInspect(ctx, input.Tag)
 	if errors.Is(err, errs.ErrNotFound) {
 		// A remote tag was expected but isn't there -- delete the resource.
-		return "", input, state, nil
+		return infer.ReadResponse[IndexArgs, IndexState]{ID: "", Inputs: input, State: state}, nil
 	}
 	if errors.Is(err, errs.ErrHTTPUnauthorized) {
 		provider.GetLogger(ctx).Warning("invalid credentials, skipping")
-		return name, input, state, nil
+		return infer.ReadResponse[IndexArgs, IndexState]{
+			ID:     req.ID,
+			Inputs: input,
+			State:  state,
+		}, nil
 	}
 	if err != nil {
-		return name, input, state, err
+		return infer.ReadResponse[IndexArgs, IndexState]{
+			ID:     req.ID,
+			Inputs: input,
+			State:  state,
+		}, err
 	}

 	if ref, ok := addDigest(input.Tag, digest); ok {
 		state.Ref = ref
 	}

-	return name, input, state, nil
+	return infer.ReadResponse[IndexArgs, IndexState]{ID: req.ID, Inputs: input, State: state}, nil
 }

 // Check confirms the Index's tag and source refs are all valid. This doesn't
@@ -222,13 +256,11 @@ func (i *Index) Read(
 // cases for now.
 func (i *Index) Check(
 	ctx context.Context,
-	_ string,
-	_ resource.PropertyMap,
-	news resource.PropertyMap,
-) (IndexArgs, []provider.CheckFailure, error) {
-	args, failures, err := infer.DefaultCheck[IndexArgs](ctx, news)
+	req infer.CheckRequest,
+) (infer.CheckResponse[IndexArgs], error) {
+	args, failures, err := infer.DefaultCheck[IndexArgs](ctx, req.NewInputs)
 	if err != nil {
-		return args, failures, err
+		return infer.CheckResponse[IndexArgs]{Failures: failures, Inputs: args}, err
 	}

 	if _, err := normalizeReference(args.Tag); args.Tag != "" && err != nil {
@@ -253,27 +285,31 @@ func (i *Index) Check(
 		}
 	}

-	return args, failures, nil
+	return infer.CheckResponse[IndexArgs]{Failures: failures, Inputs: args}, nil
 }

 // Delete attempts to delete the remote manifest.
-func (i *Index) Delete(ctx context.Context, _ string, state IndexState) error {
+func (i *Index) Delete(
+	ctx context.Context,
+	req infer.DeleteRequest[IndexState],
+) (infer.DeleteResponse, error) {
+	state := req.State
 	if !state.isPushed() {
-		return nil // Nothing to delete.
+		return infer.DeleteResponse{}, nil // Nothing to delete.
 	}

-	cli, err := i.client(ctx, state, state.IndexArgs)
+	cli, err := i.client(ctx, state.IndexArgs)
 	if err != nil {
-		return err
+		return infer.DeleteResponse{}, err
 	}

 	err = cli.ManifestDelete(ctx, state.Ref)
 	// TODO: Upstream buildx swallows the error types we'd like to test for
 	// here.
 	if err != nil && strings.Contains(err.Error(), "No such manifest:") {
-		return nil
+		return infer.DeleteResponse{}, nil
 	}
-	return err
+	return infer.DeleteResponse{}, err
 }

 // Diff returns a diff of proposed changes against current state. Ideally we
@@ -282,10 +318,10 @@ func (i *Index) Delete(ctx context.Context, _ string, state IndexState) error {
 // change all the time due to short-lived AWS credentials).
 func (i *Index) Diff(
 	_ context.Context,
-	_ string,
-	olds IndexState,
-	news IndexArgs,
+	req infer.DiffRequest[IndexArgs, IndexState],
 ) (provider.DiffResponse, error) {
+	olds, news := req.State, req.Inputs
+
 	diff := map[string]provider.PropertyDiff{}
 	update := provider.PropertyDiff{Kind: provider.Update}
 	replace := provider.PropertyDiff{Kind: provider.UpdateReplace}
@@ -323,23 +359,7 @@ func (i *Index) Diff(
 // any host-level credentials.
 func (i *Index) client(
 	ctx context.Context,
-	_ IndexState,
 	args IndexArgs,
 ) (Client, error) {
-	cfg := infer.GetConfig[Config](ctx)
-
-	if cli, ok := ctx.Value(_mockClientKey).(Client); ok {
-		return cli, nil
-	}
-
-	// We prefer auth from args, the provider, and state in that order. We
-	// build a slice in reverse order because wrap() will overwrite earlier
-	// entries with later ones.
-	auths := []Registry{}
-	auths = append(auths, cfg.Registries...)
-	if args.Registry != nil {
-		auths = append(auths, *args.Registry)
-	}
-
-	return wrap(cfg.host, auths...)
+	return i.clientF(ctx, i.config.getHost(), i.config, args)
 }
--- a/provider/internal/index_test.go
+++ b/provider/internal/index_test.go
@@ -27,34 +27,35 @@ import (
 	"github.com/pulumi/pulumi-go-provider/integration"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/util/mapper"
+	"github.com/pulumi/pulumi/sdk/v3/go/property"
 )

 func TestIndexLifecycle(t *testing.T) {
 	t.Parallel()
-	realClient := func(t *testing.T) Client { return nil }
+	realClient := func(t *testing.T) clientF { return RealClientF }

 	tests := []struct {
 		name string
 		skip bool

 		op     func(t *testing.T) integration.Operation
-		client func(t *testing.T) Client
+		client func(t *testing.T) clientF
 	}{
 		{
 			name:   "not pushed",
 			client: realClient,
 			op: func(t *testing.T) integration.Operation {
 				return integration.Operation{
-					Inputs: resource.PropertyMap{
-						"tag": resource.NewStringProperty(
+					Inputs: property.NewMap(map[string]property.Value{
+						"tag": property.New(
 							"docker.io/pulumibot/buildkit-e2e:manifest-unit",
 						),
-						"sources": resource.NewArrayProperty([]resource.PropertyValue{
-							resource.NewStringProperty("docker.io/pulumibot/buildkit-e2e:arm64"),
-							resource.NewStringProperty("docker.io/pulumibot/buildkit-e2e:amd64"),
+						"sources": property.New([]property.Value{
+							property.New("docker.io/pulumibot/buildkit-e2e:arm64"),
+							property.New("docker.io/pulumibot/buildkit-e2e:amd64"),
 						}),
-						"push": resource.NewBoolProperty(false),
-					},
+						"push": property.New(false),
+					}),
 				}
 			},
 		},
@@ -64,59 +65,51 @@ func TestIndexLifecycle(t *testing.T) {
 			client: realClient,
 			op: func(t *testing.T) integration.Operation {
 				return integration.Operation{
-					Inputs: resource.PropertyMap{
-						"tag": resource.NewStringProperty(
+					Inputs: property.NewMap(map[string]property.Value{
+						"tag": property.New(
 							"docker.io/pulumibot/buildkit-e2e:manifest",
 						),
-						"sources": resource.NewArrayProperty([]resource.PropertyValue{
-							resource.NewStringProperty("docker.io/pulumibot/buildkit-e2e:arm64"),
-							resource.NewStringProperty("docker.io/pulumibot/buildkit-e2e:amd64"),
+						"sources": property.New([]property.Value{
+							property.New("docker.io/pulumibot/buildkit-e2e:arm64"),
+							property.New("docker.io/pulumibot/buildkit-e2e:amd64"),
 						}),
-						"push": resource.NewBoolProperty(true),
-						"registry": resource.NewObjectProperty(resource.PropertyMap{
-							"address":  resource.NewStringProperty("docker.io"),
-							"username": resource.NewStringProperty("pulumibot"),
-							"password": resource.NewSecretProperty(&resource.Secret{
-								Element: resource.NewStringProperty(
-									os.Getenv("DOCKER_HUB_PASSWORD"),
-								),
-							}),
+						"push": property.New(true),
+						"registry": property.New(map[string]property.Value{
+							"address":  property.New("docker.io"),
+							"username": property.New("pulumibot"),
+							"password": property.New(os.Getenv("DOCKER_HUB_PASSWORD")).WithSecret(true),
 						}),
-					},
+					}),
 				}
 			},
 		},
 		{
 			name: "expired credentials",
-			client: func(t *testing.T) Client {
+			client: func(t *testing.T) clientF {
 				ctrl := gomock.NewController(t)
 				c := NewMockClient(ctrl)
 				c.EXPECT().ManifestCreate(gomock.Any(), true, gomock.Any(), gomock.Any())
 				c.EXPECT().ManifestInspect(gomock.Any(), gomock.Any()).Return("", errs.ErrHTTPUnauthorized)
 				c.EXPECT().ManifestDelete(gomock.Any(), gomock.Any()).Return(nil)
-				return c
+				return mockClientF(c)
 			},
 			op: func(t *testing.T) integration.Operation {
 				return integration.Operation{
-					Inputs: resource.PropertyMap{
-						"tag": resource.NewStringProperty(
+					Inputs: property.NewMap(map[string]property.Value{
+						"tag": property.New(
 							"docker.io/pulumibot/buildkit-e2e:manifest",
 						),
-						"sources": resource.NewArrayProperty([]resource.PropertyValue{
-							resource.NewStringProperty("docker.io/pulumibot/buildkit-e2e:arm64"),
-							resource.NewStringProperty("docker.io/pulumibot/buildkit-e2e:amd64"),
+						"sources": property.New([]property.Value{
+							property.New("docker.io/pulumibot/buildkit-e2e:arm64"),
+							property.New("docker.io/pulumibot/buildkit-e2e:amd64"),
 						}),
-						"push": resource.NewBoolProperty(true),
-						"registry": resource.NewObjectProperty(resource.PropertyMap{
-							"address":  resource.NewStringProperty("docker.io"),
-							"username": resource.NewStringProperty("pulumibot"),
-							"password": resource.NewSecretProperty(&resource.Secret{
-								Element: resource.NewStringProperty(
-									os.Getenv("DOCKER_HUB_PASSWORD"),
-								),
-							}),
+						"push": property.New(true),
+						"registry": property.New(map[string]property.Value{
+							"address":  property.New("docker.io"),
+							"username": property.New("pulumibot"),
+							"password": property.New(os.Getenv("DOCKER_HUB_PASSWORD")).WithSecret(true),
 						}),
-					},
+					}),
 				}
 			},
 		},
@@ -132,7 +125,7 @@ func TestIndexLifecycle(t *testing.T) {
 				Resource: "docker-build:index:Index",
 				Create:   tt.op(t),
 			}
-			s := newServer(tt.client(t))
+			s := newServer(t.Context(), t, tt.client(t))

 			err := s.Configure(provider.ConfigureRequest{})
 			require.NoError(t, err)
@@ -149,22 +142,22 @@ func TestIndexDiff(t *testing.T) {
 	baseState := IndexState{IndexArgs: baseArgs}

 	tests := []struct {
-		name string
-		olds func(*testing.T, IndexState) IndexState
-		news func(*testing.T, IndexArgs) IndexArgs
+		name   string
+		state  func(*testing.T, IndexState) IndexState
+		inputs func(*testing.T, IndexArgs) IndexArgs

 		wantChanges bool
 	}{
 		{
 			name:        "no diff if no changes",
-			olds:        func(*testing.T, IndexState) IndexState { return baseState },
-			news:        func(*testing.T, IndexArgs) IndexArgs { return baseArgs },
+			state:       func(*testing.T, IndexState) IndexState { return baseState },
+			inputs:      func(*testing.T, IndexArgs) IndexArgs { return baseArgs },
 			wantChanges: false,
 		},
 		{
-			name: "diff if tag changes",
-			olds: func(*testing.T, IndexState) IndexState { return baseState },
-			news: func(t *testing.T, a IndexArgs) IndexArgs {
+			name:  "diff if tag changes",
+			state: func(*testing.T, IndexState) IndexState { return baseState },
+			inputs: func(t *testing.T, a IndexArgs) IndexArgs {
 				a.Tag = "new-tag"
 				return a
 			},
@@ -172,7 +165,7 @@ func TestIndexDiff(t *testing.T) {
 		},
 		{
 			name: "no diff if registry password changes",
-			olds: func(_ *testing.T, s IndexState) IndexState {
+			state: func(_ *testing.T, s IndexState) IndexState {
 				s.Registry = &Registry{
 					Address:  "foo",
 					Username: "foo",
@@ -180,7 +173,7 @@ func TestIndexDiff(t *testing.T) {
 				}
 				return s
 			},
-			news: func(_ *testing.T, a IndexArgs) IndexArgs {
+			inputs: func(_ *testing.T, a IndexArgs) IndexArgs {
 				a.Registry = &Registry{
 					Address:  "foo",
 					Username: "foo",
@@ -191,9 +184,9 @@ func TestIndexDiff(t *testing.T) {
 			wantChanges: false,
 		},
 		{
-			name: "diff if registry added",
-			olds: func(*testing.T, IndexState) IndexState { return baseState },
-			news: func(_ *testing.T, a IndexArgs) IndexArgs {
+			name:  "diff if registry added",
+			state: func(*testing.T, IndexState) IndexState { return baseState },
+			inputs: func(_ *testing.T, a IndexArgs) IndexArgs {
 				a.Registry = &Registry{Address: "foo.com", Username: "foo", Password: "foo"}
 				return a
 			},
@@ -201,7 +194,7 @@ func TestIndexDiff(t *testing.T) {
 		},
 		{
 			name: "diff if registry user changes",
-			olds: func(_ *testing.T, s IndexState) IndexState {
+			state: func(_ *testing.T, s IndexState) IndexState {
 				s.Registry = &Registry{
 					Address:  "foo",
 					Username: "foo",
@@ -209,7 +202,7 @@ func TestIndexDiff(t *testing.T) {
 				}
 				return s
 			},
-			news: func(_ *testing.T, a IndexArgs) IndexArgs {
+			inputs: func(_ *testing.T, a IndexArgs) IndexArgs {
 				a.Registry = &Registry{
 					Address:  "DIFFERENT USER",
 					Username: "foo",
@@ -221,21 +214,21 @@ func TestIndexDiff(t *testing.T) {
 		},
 	}

-	s := newServer(nil)
+	s := newServer(t.Context(), t, nil)

-	encode := func(t *testing.T, x any) resource.PropertyMap {
+	encode := func(t *testing.T, x any) property.Map {
 		raw, err := mapper.New(&mapper.Opts{IgnoreMissing: true}).Encode(x)
 		require.NoError(t, err)
-		return resource.NewPropertyMapFromMap(raw)
+		return resource.FromResourcePropertyMap(resource.NewPropertyMapFromMap(raw))
 	}

 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			resp, err := s.Diff(provider.DiffRequest{
-				Urn:  urn,
-				Olds: encode(t, tt.olds(t, baseState)),
-				News: encode(t, tt.news(t, baseArgs)),
+				Urn:    urn,
+				State:  encode(t, tt.state(t, baseState)),
+				Inputs: encode(t, tt.inputs(t, baseArgs)),
 			})
 			assert.NoError(t, err)
 			assert.Equal(t, tt.wantChanges, resp.HasChanges, resp.DetailedDiff)
--- a/provider/internal/mockcli_test.go
+++ b/provider/internal/mockcli_test.go
@@ -16,12 +16,8 @@ import (
 	configfile "github.com/docker/cli/cli/config/configfile"
 	docker "github.com/docker/cli/cli/context/docker"
 	store "github.com/docker/cli/cli/context/store"
-	store0 "github.com/docker/cli/cli/manifest/store"
-	client "github.com/docker/cli/cli/registry/client"
 	streams "github.com/docker/cli/cli/streams"
-	trust "github.com/docker/cli/cli/trust"
-	client0 "github.com/docker/docker/client"
-	client1 "github.com/theupdateframework/notary/client"
+	client "github.com/docker/docker/client"
 	metric "go.opentelemetry.io/otel/metric"
 	resource "go.opentelemetry.io/otel/sdk/resource"
 	trace "go.opentelemetry.io/otel/trace"
@@ -134,10 +130,10 @@ func (c *MockCliBuildKitEnabledCall) DoAndReturn(f func() (bool, error)) *MockCl
 }

 // Client mocks base method.
-func (m *MockCli) Client() client0.APIClient {
+func (m *MockCli) Client() client.APIClient {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "Client")
-	ret0, _ := ret[0].(client0.APIClient)
+	ret0, _ := ret[0].(client.APIClient)
 	return ret0
 }

@@ -154,19 +150,19 @@ type MockCliClientCall struct {
 }

 // Return rewrite *gomock.Call.Return
-func (c *MockCliClientCall) Return(arg0 client0.APIClient) *MockCliClientCall {
+func (c *MockCliClientCall) Return(arg0 client.APIClient) *MockCliClientCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }

 // Do rewrite *gomock.Call.Do
-func (c *MockCliClientCall) Do(f func() client0.APIClient) *MockCliClientCall {
+func (c *MockCliClientCall) Do(f func() client.APIClient) *MockCliClientCall {
 	c.Call = c.Call.Do(f)
 	return c
 }

 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliClientCall) DoAndReturn(f func() client0.APIClient) *MockCliClientCall {
+func (c *MockCliClientCall) DoAndReturn(f func() client.APIClient) *MockCliClientCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -513,44 +509,6 @@ func (c *MockCliInCall) DoAndReturn(f func() *streams.In) *MockCliInCall {
 	return c
 }

-// ManifestStore mocks base method.
-func (m *MockCli) ManifestStore() store0.Store {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "ManifestStore")
-	ret0, _ := ret[0].(store0.Store)
-	return ret0
-}
-
-// ManifestStore indicates an expected call of ManifestStore.
-func (mr *MockCliMockRecorder) ManifestStore() *MockCliManifestStoreCall {
-	mr.mock.ctrl.T.Helper()
-	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ManifestStore", reflect.TypeOf((*MockCli)(nil).ManifestStore))
-	return &MockCliManifestStoreCall{Call: call}
-}
-
-// MockCliManifestStoreCall wrap *gomock.Call
-type MockCliManifestStoreCall struct {
-	*gomock.Call
-}
-
-// Return rewrite *gomock.Call.Return
-func (c *MockCliManifestStoreCall) Return(arg0 store0.Store) *MockCliManifestStoreCall {
-	c.Call = c.Call.Return(arg0)
-	return c
-}
-
-// Do rewrite *gomock.Call.Do
-func (c *MockCliManifestStoreCall) Do(f func() store0.Store) *MockCliManifestStoreCall {
-	c.Call = c.Call.Do(f)
-	return c
-}
-
-// DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliManifestStoreCall) DoAndReturn(f func() store0.Store) *MockCliManifestStoreCall {
-	c.Call = c.Call.DoAndReturn(f)
-	return c
-}
-
 // MeterProvider mocks base method.
 func (m *MockCli) MeterProvider() metric.MeterProvider {
 	m.ctrl.T.Helper()
@@ -589,45 +547,6 @@ func (c *MockCliMeterProviderCall) DoAndReturn(f func() metric.MeterProvider) *M
 	return c
 }

-// NotaryClient mocks base method.
-func (m *MockCli) NotaryClient(imgRefAndAuth trust.ImageRefAndAuth, actions []string) (client1.Repository, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "NotaryClient", imgRefAndAuth, actions)
-	ret0, _ := ret[0].(client1.Repository)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// NotaryClient indicates an expected call of NotaryClient.
-func (mr *MockCliMockRecorder) NotaryClient(imgRefAndAuth, actions any) *MockCliNotaryClientCall {
-	mr.mock.ctrl.T.Helper()
-	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "NotaryClient", reflect.TypeOf((*MockCli)(nil).NotaryClient), imgRefAndAuth, actions)
-	return &MockCliNotaryClientCall{Call: call}
-}
-
-// MockCliNotaryClientCall wrap *gomock.Call
-type MockCliNotaryClientCall struct {
-	*gomock.Call
-}
-
-// Return rewrite *gomock.Call.Return
-func (c *MockCliNotaryClientCall) Return(arg0 client1.Repository, arg1 error) *MockCliNotaryClientCall {
-	c.Call = c.Call.Return(arg0, arg1)
-	return c
-}
-
-// Do rewrite *gomock.Call.Do
-func (c *MockCliNotaryClientCall) Do(f func(trust.ImageRefAndAuth, []string) (client1.Repository, error)) *MockCliNotaryClientCall {
-	c.Call = c.Call.Do(f)
-	return c
-}
-
-// DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliNotaryClientCall) DoAndReturn(f func(trust.ImageRefAndAuth, []string) (client1.Repository, error)) *MockCliNotaryClientCall {
-	c.Call = c.Call.DoAndReturn(f)
-	return c
-}
-
 // Out mocks base method.
 func (m *MockCli) Out() *streams.Out {
 	m.ctrl.T.Helper()
@@ -666,44 +585,6 @@ func (c *MockCliOutCall) DoAndReturn(f func() *streams.Out) *MockCliOutCall {
 	return c
 }

-// RegistryClient mocks base method.
-func (m *MockCli) RegistryClient(arg0 bool) client.RegistryClient {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RegistryClient", arg0)
-	ret0, _ := ret[0].(client.RegistryClient)
-	return ret0
-}
-
-// RegistryClient indicates an expected call of RegistryClient.
-func (mr *MockCliMockRecorder) RegistryClient(arg0 any) *MockCliRegistryClientCall {
-	mr.mock.ctrl.T.Helper()
-	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RegistryClient", reflect.TypeOf((*MockCli)(nil).RegistryClient), arg0)
-	return &MockCliRegistryClientCall{Call: call}
-}
-
-// MockCliRegistryClientCall wrap *gomock.Call
-type MockCliRegistryClientCall struct {
-	*gomock.Call
-}
-
-// Return rewrite *gomock.Call.Return
-func (c *MockCliRegistryClientCall) Return(arg0 client.RegistryClient) *MockCliRegistryClientCall {
-	c.Call = c.Call.Return(arg0)
-	return c
-}
-
-// Do rewrite *gomock.Call.Do
-func (c *MockCliRegistryClientCall) Do(f func(bool) client.RegistryClient) *MockCliRegistryClientCall {
-	c.Call = c.Call.Do(f)
-	return c
-}
-
-// DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliRegistryClientCall) DoAndReturn(f func(bool) client.RegistryClient) *MockCliRegistryClientCall {
-	c.Call = c.Call.DoAndReturn(f)
-	return c
-}
-
 // Resource mocks base method.
 func (m *MockCli) Resource() *resource.Resource {
 	m.ctrl.T.Helper()
--- a/provider/internal/mockclient_test.go
+++ b/provider/internal/mockclient_test.go
@@ -3,7 +3,7 @@
 //
 // Generated by this command:
 //
-//	mockgen -typed -package internal -source client.go -destination mockclient_test.go --self_package github.com/pulumi/pulumi-docker-build/provider/internal
+//	mockgen -typed -package internal -source client.go -destination mockclient_test.go --self_package github.com/pulumi/pulumi-docker-build/provider/internal -imports buildx=github.com/docker/buildx/build
 //

 // Package internal is a generated GoMock package.
@@ -13,7 +13,12 @@ import (
 	context "context"
 	reflect "reflect"

+	buildx "github.com/docker/buildx/build"
+	builder "github.com/docker/buildx/builder"
 	pb "github.com/docker/buildx/controller/pb"
+	confutil "github.com/docker/buildx/util/confutil"
+	dockerutil "github.com/docker/buildx/util/dockerutil"
+	progress "github.com/docker/buildx/util/progress"
 	client "github.com/moby/buildkit/client"
 	session "github.com/moby/buildkit/session"
 	descriptor "github.com/regclient/regclient/types/descriptor"
@@ -532,3 +537,66 @@ func (c *MockBuildShouldExecCall) DoAndReturn(f func() bool) *MockBuildShouldExe
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
+
+// MockBuilder is a mock of Builder interface.
+type MockBuilder struct {
+	ctrl     *gomock.Controller
+	recorder *MockBuilderMockRecorder
+	isgomock struct{}
+}
+
+// MockBuilderMockRecorder is the mock recorder for MockBuilder.
+type MockBuilderMockRecorder struct {
+	mock *MockBuilder
+}
+
+// NewMockBuilder creates a new mock instance.
+func NewMockBuilder(ctrl *gomock.Controller) *MockBuilder {
+	mock := &MockBuilder{ctrl: ctrl}
+	mock.recorder = &MockBuilderMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockBuilder) EXPECT() *MockBuilderMockRecorder {
+	return m.recorder
+}
+
+// Build mocks base method.
+func (m *MockBuilder) Build(ctx context.Context, nodes []builder.Node, opts map[string]buildx.Options, docker *dockerutil.Client, cfg *confutil.Config, w progress.Writer) (map[string]*client.SolveResponse, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Build", ctx, nodes, opts, docker, cfg, w)
+	ret0, _ := ret[0].(map[string]*client.SolveResponse)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Build indicates an expected call of Build.
+func (mr *MockBuilderMockRecorder) Build(ctx, nodes, opts, docker, cfg, w any) *MockBuilderBuildCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Build", reflect.TypeOf((*MockBuilder)(nil).Build), ctx, nodes, opts, docker, cfg, w)
+	return &MockBuilderBuildCall{Call: call}
+}
+
+// MockBuilderBuildCall wrap *gomock.Call
+type MockBuilderBuildCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockBuilderBuildCall) Return(resp map[string]*client.SolveResponse, err error) *MockBuilderBuildCall {
+	c.Call = c.Call.Return(resp, err)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockBuilderBuildCall) Do(f func(context.Context, []builder.Node, map[string]buildx.Options, *dockerutil.Client, *confutil.Config, progress.Writer) (map[string]*client.SolveResponse, error)) *MockBuilderBuildCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockBuilderBuildCall) DoAndReturn(f func(context.Context, []builder.Node, map[string]buildx.Options, *dockerutil.Client, *confutil.Config, progress.Writer) (map[string]*client.SolveResponse, error)) *MockBuilderBuildCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
--- a/provider/internal/provider.go
+++ b/provider/internal/provider.go
@@ -45,9 +45,6 @@ type Config struct {
 	host *host
 }

-// _mockClientKey is used by tests to inject a mock Docker client.
-var _mockClientKey any = "mock-client"
-
 // Annotate provides user-facing descriptions and defaults for Config's fields.
 func (c *Config) Annotate(a infer.Annotator) {
 	a.Describe(&c.Host, "The build daemon's address.")
@@ -64,8 +61,23 @@ func (c *Config) Configure(ctx context.Context) error {
 	return nil
 }

+// GetRegistries returns the config's registries, if any.
+func (c Config) GetRegistries() []Registry {
+	return c.Registries
+}
+
+// getHost returns the config's host, or nil if the config is also nil.
+func (c *Config) getHost() *host {
+	if c == nil {
+		return nil
+	}
+	return c.host
+}
+
 // NewBuildxProvider returns a new buildx provider.
-func NewBuildxProvider() provider.Provider {
+func NewBuildxProvider(clientF clientF) provider.Provider {
+	config := &Config{}
+
 	prov := infer.Provider(
 		infer.Options{
 			Metadata: pschema.Metadata{
@@ -113,41 +125,22 @@ func NewBuildxProvider() provider.Provider {
 				},
 			},
 			Resources: []infer.InferredResource{
-				infer.Resource[*Image](),
-				infer.Resource[*Index](),
+				infer.Resource(&Image{clientF: clientF, config: config}),
+				infer.Resource(&Index{clientF: clientF, config: config}),
 			},
 			ModuleMap: map[tokens.ModuleName]tokens.ModuleName{
 				"internal": "index",
 			},
-			Config: infer.Config[*Config](),
+			Config: infer.Config(config),
 		},
 	)

-	prov.DiffConfig = diffConfigIgnoreInternal(prov.DiffConfig)
-
 	return prov
 }

-// TODO(pulumi/pulumi-docker-build#404): Remove this function once the bug is fixed in either
-// upstream pu/pu or pulumi-go-provider.
-
-// diffConfigInternalIgnore is a custom DiffConfig implementation for the buildx provider. This is required to
-// circumvent the bug identified in https://github.com/pulumi/pulumi-docker-build/issues/404.
-// Since `__internal` is currently populated in new inputs, but stripped in old state, we need to
-// ignore this field in the diff. There is no easy way to override DiffConfig to compare inputs only.
-func diffConfigIgnoreInternal(
-	diffConfig func(ctx context.Context, req provider.DiffRequest) (provider.DiffResponse, error),
-) func(ctx context.Context, req provider.DiffRequest) (provider.DiffResponse, error) {
-	return func(ctx context.Context, req provider.DiffRequest) (provider.DiffResponse, error) {
-		delete(req.News, "__internal")
-
-		return diffConfig(ctx, req)
-	}
-}
-
 // Schema returns our package specification.
 func Schema(ctx context.Context, version string) schema.PackageSpec {
-	p := NewBuildxProvider()
+	p := NewBuildxProvider(nil)
 	spec, err := provider.GetSchema(ctx, "docker-build", version, p)
 	contract.AssertNoErrorf(err, "missing schema")
 	return spec
--- a/provider/internal/provider_test.go
+++ b/provider/internal/provider_test.go
@@ -20,18 +20,18 @@ import (

 	"github.com/blang/semver"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"

 	provider "github.com/pulumi/pulumi-go-provider"
 	"github.com/pulumi/pulumi-go-provider/infer"
 	"github.com/pulumi/pulumi-go-provider/integration"
-	mwcontext "github.com/pulumi/pulumi-go-provider/middleware/context"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/tokens"
 )

 func TestConfigure(t *testing.T) {
 	t.Parallel()

-	s := newServer(nil)
+	s := newServer(t.Context(), t, nil)

 	err := s.Configure(
 		provider.ConfigureRequest{},
@@ -60,7 +60,7 @@ func TestAnnotate(t *testing.T) {
 func TestSchema(t *testing.T) {
 	t.Parallel()

-	s := newServer(nil)
+	s := newServer(t.Context(), t, nil)

 	_, err := s.GetSchema(provider.GetSchemaRequest{Version: 0})
 	assert.NoError(t, err)
@@ -68,21 +68,27 @@ func TestSchema(t *testing.T) {

 type annotator struct{}

+func (annotator) Deprecate(_ any, _ string)                   {}
 func (annotator) Describe(_ any, _ string)                    {}
 func (annotator) SetDefault(_, _ any, _ ...string)            {}
 func (annotator) SetToken(tokens.ModuleName, tokens.TypeName) {}
 func (annotator) AddAlias(tokens.ModuleName, tokens.TypeName) {}
 func (annotator) SetResourceDeprecationMessage(_ string)      {}

-func newServer(client Client) integration.Server {
-	p := NewBuildxProvider()
+func newServer(ctx context.Context, t *testing.T, clientF clientF) integration.Server {
+	t.Helper()

-	// Inject a mock client if provided.
-	if client != nil {
-		p = mwcontext.Wrap(p, func(ctx context.Context) context.Context {
-			return context.WithValue(ctx, _mockClientKey, client)
-		})
+	if clientF == nil {
+		clientF = RealClientF
 	}

-	return integration.NewServer("docker-build", semver.Version{Major: 0}, p)
+	p := NewBuildxProvider(clientF)
+
+	s, err := integration.NewServer(
+		ctx,
+		"docker-build", semver.Version{Major: 0},
+		integration.WithProvider(p),
+	)
+	require.NoError(t, err)
+	return s
 }
--- a/provider/provider.go
+++ b/provider/provider.go
@@ -15,13 +15,8 @@
 package provider

 import (
-	"context"
-	"encoding/json"
-
 	"github.com/pulumi/pulumi-docker-build/provider/internal"
-	"github.com/pulumi/pulumi-docker-build/provider/internal/deprecated"
 	gp "github.com/pulumi/pulumi-go-provider"
-	"github.com/pulumi/pulumi/pkg/v3/codegen/schema"
 	"github.com/pulumi/pulumi/pkg/v3/resource/provider"
 	rpc "github.com/pulumi/pulumi/sdk/v3/proto/go"
 )
@@ -39,37 +34,5 @@ func Serve() error {

 // New creates a new provider.
 func New(host *provider.HostClient) (rpc.ResourceProviderServer, error) {
-	return gp.RawServer(Name, Version, configurableProvider(internal.NewBuildxProvider()))(host)
-}
-
-// configurableProvider is a workaround for
-// https://github.com/pulumi/pulumi-go-provider/issues/171 and
-// In short, our SDKs send provider Configure requests as simple strings
-// instead of rich objects. We don't want to preserve this behavior in
-// pulumi-go-provider, but we also haven't updated SDKs yet to send rich types.
-//
-// If you find yourself in a position where you need to copy this -- STOP!
-// https://github.com/pulumi/pulumi/pull/15032 should be merged with this fix.
-func configurableProvider(p gp.Provider) gp.Provider {
-	configure := p.Configure
-
-	p.Configure = func(ctx context.Context, req gp.ConfigureRequest) error {
-		r, err := p.GetSchema(ctx, gp.GetSchemaRequest{Version: 0})
-		if err != nil {
-			return err
-		}
-		spec := schema.PackageSpec{}
-		err = json.Unmarshal([]byte(r.Schema), &spec)
-		if err != nil {
-			return err
-		}
-
-		ce := deprecated.New(spec.Config)
-		if props, err := ce.UnmarshalProperties(req.Args); err == nil {
-			req.Args = props
-		}
-		return configure(ctx, req)
-	}
-
-	return p
+	return gp.RawServer(Name, Version, internal.NewBuildxProvider(internal.RealClientF))(host)
 }
--- a/provider/provider_test.go
+++ b/provider/provider_test.go
@@ -22,37 +22,8 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	emptypb "google.golang.org/protobuf/types/known/emptypb"
-	"google.golang.org/protobuf/types/known/structpb"
-
-	"github.com/pulumi/pulumi-docker-build/provider/internal"
-	provider "github.com/pulumi/pulumi-go-provider"
-	"github.com/pulumi/pulumi-go-provider/integration"
-	"github.com/pulumi/pulumi/sdk/v3/go/common/resource/plugin"
 )

-// TestConfigure checks backwards-compatibility with SDKs that still send
-// provider config as JSON-encoded strings. This test can be removed once we
-// upgrade to a version of pulumi that no longer generates SDKs with that
-// behavior.
-func TestConfigure(t *testing.T) {
-	t.Parallel()
-
-	p := configurableProvider(internal.NewBuildxProvider())
-
-	args, err := structpb.NewStruct(map[string]any{
-		"registries": `[{"address": "docker.io"}]`,
-	})
-	require.NoError(t, err)
-	argsMap, err := plugin.UnmarshalProperties(args, plugin.MarshalOptions{})
-	require.NoError(t, err)
-
-	s := integration.NewServer("docker-build", semver.Version{Major: 0}, p)
-	err = s.Configure(provider.ConfigureRequest{
-		Args: argsMap,
-	})
-	assert.NoError(t, err)
-}
-
 func TestVersion(t *testing.T) {
 	t.Parallel()

--- a/sdk/go/dockerbuild/go.mod
+++ b/sdk/go/dockerbuild/go.mod
@@ -4,7 +4,7 @@ go 1.24.1

 require (
 	github.com/blang/semver v3.5.1+incompatible
-	github.com/pulumi/pulumi/sdk/v3 v3.165.0
+	github.com/pulumi/pulumi/sdk/v3 v3.169.0
 )

 require (
@@ -83,14 +83,14 @@ require (
 	go.opentelemetry.io/otel v1.35.0 // indirect
 	go.opentelemetry.io/otel/sdk v1.35.0 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
-	golang.org/x/crypto v0.37.0 // indirect
+	golang.org/x/crypto v0.38.0 // indirect
 	golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
 	golang.org/x/mod v0.24.0 // indirect
-	golang.org/x/net v0.39.0 // indirect
-	golang.org/x/sync v0.13.0 // indirect
-	golang.org/x/sys v0.32.0 // indirect
-	golang.org/x/term v0.31.0 // indirect
-	golang.org/x/text v0.24.0 // indirect
+	golang.org/x/net v0.40.0 // indirect
+	golang.org/x/sync v0.14.0 // indirect
+	golang.org/x/sys v0.33.0 // indirect
+	golang.org/x/term v0.32.0 // indirect
+	golang.org/x/text v0.25.0 // indirect
 	golang.org/x/tools v0.32.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250414145226-207652e42e2e // indirect
 	google.golang.org/grpc v1.71.1 // indirect
--- a/sdk/go/dockerbuild/go.sum
+++ b/sdk/go/dockerbuild/go.sum
@@ -162,8 +162,8 @@ github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE=
 github.com/pulumi/esc v0.13.0 h1:O2MPR2koScaQ2fXwyer8Q3Dd7z+DCnaDfsgNl5mVNMk=
 github.com/pulumi/esc v0.13.0/go.mod h1:IIQo6W6Uzajt6f1RW4QvNxIRDlbK3TNQysnrwBHNo3U=
-github.com/pulumi/pulumi/sdk/v3 v3.165.0 h1:cglplKZOJDpqH8wa/2J250G9az/sE9eKp9fS2bC+vi8=
-github.com/pulumi/pulumi/sdk/v3 v3.165.0/go.mod h1:GAaHrdv3kWJHbzkFFFflGbTBQXUYu6SF1ZCo+O9jo44=
+github.com/pulumi/pulumi/sdk/v3 v3.169.0 h1:bgz1fp2rl28khSXgF4FaRQiB9wh3lSKWtzUOGalf+x4=
+github.com/pulumi/pulumi/sdk/v3 v3.169.0/go.mod h1:Qhe4dOjqedyLr47kGGnG6ULIbzaPTlmjAvPqNQ1Ollo=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
@@ -228,8 +228,8 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
-golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
+golang.org/x/crypto v0.38.0 h1:jt+WWG8IZlBnVbomuhg2Mdq0+BBQaHbtqHEFEigjUV8=
+golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw=
 golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 h1:R84qjqJb5nVJMxqWYb3np9L5ZsaDtB+a39EqjV0JSUM=
 golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0/go.mod h1:S9Xr4PYopiDyqSyp5NjCrhFrqg6A5zA2E/iPHPhqnS8=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
@@ -244,13 +244,13 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200421231249-e086a090c8fd/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
-golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
+golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
+golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
-golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=
+golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -266,16 +266,16 @@ golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
-golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.31.0 h1:erwDkOK1Msy6offm1mOgvspSkslFnIGsFnxOKoufg3o=
-golang.org/x/term v0.31.0/go.mod h1:R4BeIy7D95HzImkxGkTW1UQTtP54tio2RyHz7PwK0aw=
+golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg=
+golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
-golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
+golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
+golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
--- a/sdk/python/pulumi_docker_build/_enums.py
+++ b/sdk/python/pulumi_docker_build/_enums.py
@@ -3,7 +3,7 @@
 # *** Do not edit by hand unless you're certain you know what you are doing! ***

 import builtins
-import builtins
+import pulumi
 from enum import Enum

 __all__ = [
@@ -14,6 +14,7 @@ __all__ = [
 ]


+@pulumi.type_token("docker-build:index:CacheMode")
 class CacheMode(builtins.str, Enum):
    MIN = "min"
    """
@@ -25,6 +26,7 @@ class CacheMode(builtins.str, Enum):
    """


+@pulumi.type_token("docker-build:index:CompressionType")
 class CompressionType(builtins.str, Enum):
    GZIP = "gzip"
    """
@@ -40,6 +42,7 @@ class CompressionType(builtins.str, Enum):
    """


+@pulumi.type_token("docker-build:index:NetworkMode")
 class NetworkMode(builtins.str, Enum):
    DEFAULT = "default"
    """
@@ -55,6 +58,7 @@ class NetworkMode(builtins.str, Enum):
    """


+@pulumi.type_token("docker-build:index:Platform")
 class Platform(builtins.str, Enum):
    DARWIN_386 = "darwin/386"
    DARWIN_AMD64 = "darwin/amd64"
--- a/sdk/python/pulumi_docker_build/image.py
+++ b/sdk/python/pulumi_docker_build/image.py
@@ -583,10 +583,8 @@ class ImageArgs:
        pulumi.set(self, "target", value)


+@pulumi.type_token("docker-build:index:Image")
 class Image(pulumi.CustomResource):
-
-    pulumi_type = "docker-build:index:Image"
-
    @overload
    def __init__(__self__,
                 resource_name: str,
--- a/sdk/python/pulumi_docker_build/index.py
+++ b/sdk/python/pulumi_docker_build/index.py
@@ -99,10 +99,8 @@ class IndexArgs:
        pulumi.set(self, "registry", value)


+@pulumi.type_token("docker-build:index:Index")
 class Index(pulumi.CustomResource):
-
-    pulumi_type = "docker-build:index:Index"
-
    @overload
    def __init__(__self__,
                 resource_name: str,
--- a/sdk/python/pulumi_docker_build/provider.py
+++ b/sdk/python/pulumi_docker_build/provider.py
@@ -56,10 +56,8 @@ class ProviderArgs:
        pulumi.set(self, "registries", value)


+@pulumi.type_token("pulumi:providers:docker-build")
 class Provider(pulumi.ProviderResource):
-
-    pulumi_type = "pulumi:providers:docker-build"
-
    @overload
    def __init__(__self__,
                 resource_name: str,
--- a/sdk/python/pyproject.toml
+++ b/sdk/python/pyproject.toml
@@ -1,7 +1,7 @@
 [project]
  name = "pulumi_docker_build"
  description = "A Pulumi provider for building modern Docker images with buildx and BuildKit."
-  dependencies = ["parver>=0.2.1", "pulumi>=3.142.0,<4.0.0", "semver>=2.8.1", "typing-extensions>=4.11,<5; python_version < \"3.11\""]
+  dependencies = ["parver>=0.2.1", "pulumi>=3.165.0,<4.0.0", "semver>=2.8.1", "typing-extensions>=4.11,<5; python_version < \"3.11\""]
  keywords = ["docker", "buildkit", "buildx", "kind/native"]
  readme = "README.md"
  requires-python = ">=3.9"
--- a/tools/tools.go
+++ b/tools/tools.go
@@ -6,7 +6,7 @@ package tools

 import (
 	_ "github.com/golangci/golangci-lint/cmd/golangci-lint"
-	_ "github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet"
+	_ "github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3"
 	_ "github.com/pulumi/pulumi-java/pkg/cmd/pulumi-language-java"
 	_ "github.com/pulumi/pulumi-yaml/cmd/pulumi-converter-yaml"
 	_ "github.com/pulumi/pulumi-yaml/cmd/pulumi-language-yaml"
Author	SHA1	Message	Date
Bryce Lampe	82057d3065	Freeze v0.0.12 (#547 ) ### Changed - Upgraded pulumi-go-provider to v1.0.0-rc2. ### Fixed - Builds now respect cancellation. (https://github.com/pulumi/pulumi-docker-build/issues/533, https://github.com/pulumi/pulumi-docker-build/pull/522)	2025-05-16 12:08:02 -07:00
Pulumi Bot	4ea5b9a5d0	Update GitHub Actions workflows. (#546 ) This PR was automatically generated by the update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt repo, from commit 06a4a07bc11ada9498ce86091ac0d55443ee294b.	2025-05-16 05:50:09 +00:00
Bryce Lampe	4436ab5e76	Changes for upcoming go-provider v1.0 (#525 ) Fixes #535	2025-05-15 16:38:58 -07:00
Pulumi Bot	a59206e63c	Update GitHub Actions workflows. (#545 ) This PR was automatically generated by the update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt repo, from commit cbb506c8323134f33314a4877d8cd305b127d6da.	2025-05-15 05:45:20 +00:00
Pulumi Bot	27abab8846	Update GitHub Actions workflows. (#544 ) This PR was automatically generated by the update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt repo, from commit 5e6b747e32eb956036f294bce851d4f17a9fb91d.	2025-05-14 05:47:00 +00:00
Bryce Lampe	30a01b6893	Handle context cancellation during builds (#539 ) `buildx.Build` doesn't terminate if context is canceled, so this PR rearranges things such that we can wait for the build or context to finish. Fixes #533.	2025-05-05 16:12:48 -07:00
Pulumi Bot	1cba556bd2	Update GitHub Actions workflows. (#541 ) This PR was automatically generated by the update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt repo, from commit 32350b582889a810aa1e8465fc4f7a65666fa1c1.	2025-05-05 05:47:20 +00:00
Pulumi Bot	6722ef8f68	Update GitHub Actions workflows. (#540 ) This PR was automatically generated by the update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt repo, from commit 2fc5dd575a82667c4703a7fcb031c73ad98d0d6c.	2025-05-03 05:48:02 +00:00
@@ -1 +1 @@
 .163.0
 .169.0