diff --git a/build/bazel/go.MODULE.bazel b/build/bazel/go.MODULE.bazel
index d83abc6..c17ce55 100644
--- a/build/bazel/go.MODULE.bazel
+++ b/build/bazel/go.MODULE.bazel
@@ -17,7 +17,6 @@
     "com_github_adrg_xdg",
     "com_github_cavaliergopher_cpio",
     "com_github_cenkalti_backoff_v4",
-    "com_github_cockroachdb_cockroach_go_v2",
     "com_github_container_storage_interface_spec",
     "com_github_containerd_containerd_v2",
     "com_github_containernetworking_plugins",
@@ -26,7 +25,6 @@
     "com_github_diskfs_go_diskfs",
     "com_github_gdamore_tcell_v2",
     "com_github_go_delve_delve",
-    "com_github_golang_migrate_migrate_v4",
     "com_github_golangci_gofmt",
     "com_github_google_cel_go",
     "com_github_google_certificate_transparency_go",
@@ -36,13 +34,10 @@
     "com_github_google_gopacket",
     "com_github_google_nftables",
     "com_github_google_uuid",
-    "com_github_iancoleman_strcase",
-    "com_github_improbable_eng_grpc_web",
     "com_github_insomniacslk_dhcp",
     "com_github_joho_godotenv",
     "com_github_kballard_go_shellquote",
     "com_github_klauspost_compress",
-    "com_github_lib_pq",
     "com_github_mattfenwick_cyclonus",
     "com_github_mattn_go_shellwords",
     "com_github_mdlayher_arp",
@@ -57,7 +52,6 @@
     "com_github_opencontainers_go_digest",
     "com_github_opencontainers_image_spec",
     "com_github_opencontainers_runc",
-    "com_github_packethost_packngo",
     "com_github_pkg_errors",
     "com_github_pkg_sftp",
     "com_github_prometheus_client_golang",
@@ -86,7 +80,6 @@
     "io_k8s_cli_runtime",
     "io_k8s_client_go",
     "io_k8s_component_base",
-    "io_k8s_klog_v2",
     "io_k8s_kubectl",
     "io_k8s_kubelet",
     "io_k8s_kubernetes",
diff --git a/build/bazel/third_party.MODULE.bazel b/build/bazel/third_party.MODULE.bazel
index ebdd2fd..d218d2f 100644
--- a/build/bazel/third_party.MODULE.bazel
+++ b/build/bazel/third_party.MODULE.bazel
@@ -78,25 +78,10 @@
     ],
 )
 
-# CockroachDB binary used for tests.
-#
-# WARNING: Not distributed under an OSI certified license. Must only be used in
-# tests, not be redistributed!
+# CockroachDB repository used for linter passes.
 COCKROACH_VERSION = "22.1.6"
 
 http_archive(
-    name = "cockroach",
-    build_file = "//third_party/cockroach:cockroach.bzl",
-    integrity = "sha256-CCHP9XcEAPuUyLbCqzONlvQRT78rMga8im3PYvnA9Oo=",
-    strip_prefix = "cockroach-v%s.linux-amd64" % COCKROACH_VERSION,
-    urls = [
-        # TODO: select() to pick other host architectures.
-        "https://binaries.cockroachdb.com/cockroach-v%s.linux-amd64.tgz" % COCKROACH_VERSION,
-    ],
-)
-
-# CockroachDB repository used for linter passes.
-http_archive(
     name = "com_github_cockroachdb_cockroach",
     integrity = "sha256-bDVo7yRM5rh0aU7u7Lg+1PXV3/bPA3yVLs3naCimxQI=",
     strip_prefix = "cockroach-" + COCKROACH_VERSION,
diff --git a/cloud/BUILD.bazel b/cloud/BUILD.bazel
deleted file mode 100644
index cfafaa7..0000000
--- a/cloud/BUILD.bazel
+++ /dev/null
@@ -1,68 +0,0 @@
-load("@aspect_bazel_lib//lib:expand_template.bzl", "expand_template")
-load("@bazel_skylib//rules:write_file.bzl", "write_file")
-load("@rules_multirun//:defs.bzl", "multirun")
-load("@rules_oci//oci:defs.bzl", "oci_push")
-
-write_file(
-    name = "tags_tmpl",
-    out = "tags.txt.tmpl",
-    content = [
-        "BUILD_VERSION",
-    ],
-)
-
-# Use the value of --embed_label under --stamp, otherwise use a deterministic constant
-# value to ensure cache hits for actions that depend on this.
-expand_template(
-    name = "stamped",
-    out = "_stamped.tags.txt",
-    stamp_substitutions = {"BUILD_VERSION": "{{STABLE_MONOGON_cloud_version}}"},
-    substitutions = {"BUILD_VERSION": "0.0.0"},
-    template = "tags_tmpl",
-)
-
-oci_push(
-    name = "apigw_image",
-    image = "//cloud/apigw:apigw_image",
-    remote_tags = ":stamped",
-    repository = "gcr.io/monogon-infra/cloud/apigw",
-)
-
-oci_push(
-    name = "shepherd_equinix",
-    image = "//cloud/shepherd/provider/equinix:equinix_image",
-    remote_tags = ":stamped",
-    repository = "gcr.io/monogon-infra/cloud/shepherd/equinix",
-)
-
-oci_push(
-    name = "bmsrv",
-    image = "//cloud/bmaas/server/cmd:cmd_image",
-    remote_tags = ":stamped",
-    repository = "gcr.io/monogon-infra/cloud/bmsrv",
-)
-
-oci_push(
-    name = "scruffy",
-    image = "//cloud/bmaas/scruffy/cmd:cmd_image",
-    remote_tags = ":stamped",
-    repository = "gcr.io/monogon-infra/cloud/scruffy",
-)
-
-oci_push(
-    name = "shepherd_mini",
-    image = "//cloud/shepherd/mini:mini_image",
-    remote_tags = ":stamped",
-    repository = "gcr.io/monogon-infra/cloud/shepherd/mini",
-)
-
-multirun(
-    name = "push",
-    commands = [
-        ":apigw_image",
-        ":shepherd_equinix",
-        ":bmsrv",
-        ":scruffy",
-        ":shepherd_mini",
-    ],
-)
diff --git a/cloud/README.md b/cloud/README.md
deleted file mode 100644
index eafb512..0000000
--- a/cloud/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# `//cloud`
-
-`//cloud` contains tooling and libraries for orchestrating Monogon OS clusters.
diff --git a/cloud/agent/BUILD.bazel b/cloud/agent/BUILD.bazel
index bfb2147..48e7d20 100644
--- a/cloud/agent/BUILD.bazel
+++ b/cloud/agent/BUILD.bazel
@@ -14,7 +14,6 @@
     visibility = ["//visibility:private"],
     deps = [
         "//cloud/agent/api",
-        "//cloud/bmaas/server/api",
         "//metropolis/node/core/devmgr",
         "//metropolis/node/core/network",
         "//osbase/blockdev",
diff --git a/cloud/agent/agent.go b/cloud/agent/agent.go
index 05b2daf..665351a 100644
--- a/cloud/agent/agent.go
+++ b/cloud/agent/agent.go
@@ -22,7 +22,6 @@
 	"google.golang.org/protobuf/proto"
 
 	apb "source.monogon.dev/cloud/agent/api"
-	bpb "source.monogon.dev/cloud/bmaas/server/api"
 
 	"source.monogon.dev/metropolis/node/core/devmgr"
 	"source.monogon.dev/metropolis/node/core/network"
@@ -103,32 +102,32 @@
 	if err != nil {
 		return fmt.Errorf("error creating BMaaS gRPC client: %w", err)
 	}
-	c := bpb.NewAgentCallbackClient(conn)
+	c := apb.NewAgentCallbackClient(conn)
 
 	supervisor.Signal(ctx, supervisor.SignalHealthy)
 
-	assembleHWReport := func() *bpb.AgentHardwareReport {
+	assembleHWReport := func() *apb.AgentHardwareReport {
 		report, warnings := gatherHWReport()
 		var warningStrings []string
 		for _, w := range warnings {
 			l.Warningf("Hardware Report Warning: %v", w)
 			warningStrings = append(warningStrings, w.Error())
 		}
-		return &bpb.AgentHardwareReport{
+		return &apb.AgentHardwareReport{
 			Report:  report,
 			Warning: warningStrings,
 		}
 	}
 
 	var sentFirstHeartBeat, hwReportSent bool
-	var installationReport *bpb.OSInstallationReport
+	var installationReport *apb.OSInstallationReport
 	var installationGeneration int64
 	b := backoff.NewExponentialBackOff()
 	// Never stop retrying, there is nothing else to do
 	b.MaxElapsedTime = 0
 	// Main heartbeat loop
 	for {
-		req := bpb.HeartbeatRequest{
+		req := apb.HeartbeatRequest{
 			MachineId: agentInit.TakeoverInit.MachineId,
 		}
 		if sentFirstHeartBeat && !hwReportSent {
@@ -167,21 +166,21 @@
 				// This installation request has already been attempted
 				continue
 			}
-			installationReport = &bpb.OSInstallationReport{
+			installationReport = &apb.OSInstallationReport{
 				Generation: res.InstallationRequest.Generation,
 			}
 			installCtx, cancel := context.WithTimeout(ctx, 15*time.Minute)
 			if err := install(installCtx, res.InstallationRequest, agentInit.NetworkConfig); err != nil {
 				l.Errorf("Installation failed: %v", err)
-				installationReport.Result = &bpb.OSInstallationReport_Error_{
-					Error: &bpb.OSInstallationReport_Error{
+				installationReport.Result = &apb.OSInstallationReport_Error_{
+					Error: &apb.OSInstallationReport_Error{
 						Error: err.Error(),
 					},
 				}
 			} else {
 				l.Info("Installation succeeded")
-				installationReport.Result = &bpb.OSInstallationReport_Success_{
-					Success: &bpb.OSInstallationReport_Success{},
+				installationReport.Result = &apb.OSInstallationReport_Success_{
+					Success: &apb.OSInstallationReport_Success{},
 				}
 			}
 			cancel()
diff --git a/cloud/agent/api/BUILD.bazel b/cloud/agent/api/BUILD.bazel
index 48139f2..45d30e4 100644
--- a/cloud/agent/api/BUILD.bazel
+++ b/cloud/agent/api/BUILD.bazel
@@ -9,6 +9,7 @@
         "PACKAGE_VERSION_SUFFIX",
         "MESSAGE_PASCAL_CASE",
         "ENUM_ZERO_VALUE_SUFFIX",
+        "SERVICE_SUFFIX",
     ],
     protos = [":api_proto"],
     use_rules = [
@@ -25,15 +26,22 @@
         "takeover.proto",
     ],
     visibility = ["//visibility:public"],
-    deps = ["//osbase/net/proto:proto_proto"],
+    deps = [
+        "//metropolis/proto/api:api_proto",
+        "//osbase/net/proto:proto_proto",
+    ],
 )
 
 go_proto_library(
     name = "api_go_proto",
+    compilers = ["@io_bazel_rules_go//proto:go_grpc"],
     importpath = "source.monogon.dev/cloud/agent/api",
     proto = ":api_proto",
     visibility = ["//visibility:public"],
-    deps = ["//osbase/net/proto"],
+    deps = [
+        "//metropolis/proto/api",
+        "//osbase/net/proto",
+    ],
 )
 
 go_library(
diff --git a/cloud/agent/api/agent.proto b/cloud/agent/api/agent.proto
index c2ac0f7..f62b2b0 100644
--- a/cloud/agent/api/agent.proto
+++ b/cloud/agent/api/agent.proto
@@ -2,17 +2,111 @@
 package cloud.agent.api;
 import "osbase/net/proto/net.proto";
 import "cloud/agent/api/takeover.proto";
+import "cloud/agent/api/hwreport.proto";
+import "metropolis/proto/api/configuration.proto";
+import "metropolis/proto/api/management.proto";
 option go_package = "source.monogon.dev/cloud/agent/api";
 
 // AgentInit contains initialization information passed to the agent from the 
 // initial takeover process.
 message AgentInit {
-  // Original takeover init message which contains data to contact the BMaaS
-  // service with.
+  // Original takeover init message which contains data to contact the API
+  // server with.
   TakeoverInit takeover_init = 1;
-  // The Ed25519 private key to connect to the BMaaS service.
+  // The Ed25519 private key to connect to the API server.
   bytes private_key = 2;
   // A network configuration in case automatic configuration does not work or is
   // not desired. If left unset, automatic configuration is used.
   osbase.net.proto.Net network_config = 3;
-}
\ No newline at end of file
+}
+
+// AgentCallback runs on the API Server and exposes a gRPC interface to agents
+// running on machines. These APIs are served over TLS using component-style
+// server certificates, but clients are authenticated using ephemeral
+// certificates proving ownership of an agent keypair.
+service AgentCallback {
+  // Heartbeat is called by agents repeatedly to upload a hardware report, signal
+  // liveness and retrieve actions to be performed on a host.
+  //
+  // This isn't a streaming RPC as the current server implementation actually
+  // isn't reactive, so it would have to do its own inner polling to create
+  // a stream of updates. To keep things simple, we instead let the agent decide
+  // on the cadence of updates it wants to keep up with.
+  rpc Heartbeat(HeartbeatRequest) returns (HeartbeatResponse);
+}
+
+message AgentHardwareReport {
+  cloud.agent.api.Node report = 1;
+  // List of human-readable warnings which occurred during hardware report
+  // generation.
+  repeated string warning = 2;
+}
+
+// OSInstallationReport is submitted from the agent to the API server after
+// successful OS installation.
+message OSInstallationReport {
+  // generation must be set to the same value as 'generation' in the
+  // OSInstallation request which triggered the OS installation
+  int64 generation = 1;
+
+  // Success is set by the agent when the installation request has been
+  // successfully fulfilled. It is currently empty but is specified as a
+  // message to allow it to be expanded in the future.
+  message Success {}
+  // Error is set by the agent when the installation request could not be
+  // fulfilled due to an error.
+  message Error {
+    // A human-readable message of what went wrong.
+    string error = 1;
+  }
+  oneof result {
+    Success success = 2;
+    Error error = 3;
+  }
+}
+
+message HeartbeatRequest {
+  // MachineID that this agent represents. Technically not necessary since
+  // keypairs between agents should be unique, but this provides an extra layer
+  // of protection against programming bugs.
+  string machine_id = 1;
+  // Optional hardware report to be upserted for this machine. An agent should
+  // submit one at least once after it's started, as early as it can.
+  AgentHardwareReport hardware_report = 2;
+  // Optional installation report sent to be upserted to this machine. An agent
+  // should submit one after it successfully installed an operating system for
+  // a given OSInstallationRequest.
+  OSInstallationReport installation_report = 3;
+}
+
+message MetropolisInstallationRequest {
+  reserved 1;
+  // Parameters for fetching the OS image to install.
+  metropolis.proto.api.OSImageRef os_image = 4;
+  // Node parameters to be supplied to the new node. Note that network_config
+  // is automatically filled out if coming from the takeover.
+  metropolis.proto.api.NodeParameters node_parameters = 2;
+  // Name of the block device to be used as the root device for the install.
+  // A list of block devices can be taken from the node hardware report.
+  string root_device = 3;
+}
+
+// OSInstallationRequest is provided to the agent API server.
+message OSInstallationRequest {
+  // generation is the 'version' of the OS installation request, and will always
+  // be incremented within the API when a new OS installation request is
+  // submitted. The agent must pipe this through to the OSInstallationReport to
+  // let the rest of the system know which OS installation request it actually
+  // fulfilled.
+  int64 generation = 1;
+  // Selects which operating system installation flow is used.
+  oneof type {
+    MetropolisInstallationRequest metropolis = 2;
+  }
+}
+
+message HeartbeatResponse {
+  // If set, the control plane is requesting the installation of an operating
+  // system.
+  OSInstallationRequest installation_request = 1;
+}
diff --git a/cloud/agent/e2e/BUILD.bazel b/cloud/agent/e2e/BUILD.bazel
index 7df7ad6..91f09ce 100644
--- a/cloud/agent/e2e/BUILD.bazel
+++ b/cloud/agent/e2e/BUILD.bazel
@@ -19,7 +19,6 @@
     },
     deps = [
         "//cloud/agent/api",
-        "//cloud/bmaas/server/api",
         "//metropolis/proto/api",
         "//osbase/oci",
         "//osbase/oci/registry",
diff --git a/cloud/agent/e2e/main_test.go b/cloud/agent/e2e/main_test.go
index 8dbce49..dc3108e 100644
--- a/cloud/agent/e2e/main_test.go
+++ b/cloud/agent/e2e/main_test.go
@@ -31,8 +31,8 @@
 	"google.golang.org/protobuf/proto"
 
 	apb "source.monogon.dev/cloud/agent/api"
-	bpb "source.monogon.dev/cloud/bmaas/server/api"
 	mpb "source.monogon.dev/metropolis/proto/api"
+
 	"source.monogon.dev/osbase/oci"
 	"source.monogon.dev/osbase/oci/registry"
 	"source.monogon.dev/osbase/pki"
@@ -63,13 +63,13 @@
 }
 
 type fakeServer struct {
-	hardwareReport      *bpb.AgentHardwareReport
-	installationRequest *bpb.OSInstallationRequest
-	installationReport  *bpb.OSInstallationReport
+	hardwareReport      *apb.AgentHardwareReport
+	installationRequest *apb.OSInstallationRequest
+	installationReport  *apb.OSInstallationReport
 }
 
-func (f *fakeServer) Heartbeat(ctx context.Context, req *bpb.HeartbeatRequest) (*bpb.HeartbeatResponse, error) {
-	var res bpb.HeartbeatResponse
+func (f *fakeServer) Heartbeat(ctx context.Context, req *apb.HeartbeatRequest) (*apb.HeartbeatResponse, error) {
+	var res apb.HeartbeatResponse
 	if req.HardwareReport != nil {
 		f.hardwareReport = req.HardwareReport
 	}
@@ -106,9 +106,9 @@
 		t.Fatal(err)
 	}
 
-	f.installationRequest = &bpb.OSInstallationRequest{
+	f.installationRequest = &apb.OSInstallationRequest{
 		Generation: 5,
-		Type: &bpb.OSInstallationRequest_Metropolis{Metropolis: &bpb.MetropolisInstallationRequest{
+		Type: &apb.OSInstallationRequest_Metropolis{Metropolis: &apb.MetropolisInstallationRequest{
 			OsImage: &mpb.OSImageRef{
 				Scheme:     "http",
 				Host:       registryAddr.String(),
@@ -169,7 +169,7 @@
 		Certificate: [][]byte{serverCert},
 		PrivateKey:  serverPrivKey,
 	})))
-	bpb.RegisterAgentCallbackServer(s, &f)
+	apb.RegisterAgentCallbackServer(s, &f)
 	grpcLis, err := net.Listen("tcp", "127.0.0.1:0")
 	if err != nil {
 		panic(err)
diff --git a/cloud/agent/install.go b/cloud/agent/install.go
index 6deffab..2ba9859 100644
--- a/cloud/agent/install.go
+++ b/cloud/agent/install.go
@@ -15,7 +15,7 @@
 	"github.com/cenkalti/backoff/v4"
 	"google.golang.org/protobuf/proto"
 
-	bpb "source.monogon.dev/cloud/bmaas/server/api"
+	apb "source.monogon.dev/cloud/agent/api"
 	npb "source.monogon.dev/osbase/net/proto"
 
 	"source.monogon.dev/osbase/blockdev"
@@ -32,16 +32,16 @@
 
 // install dispatches OSInstallationRequests to the appropriate installer
 // method
-func install(ctx context.Context, req *bpb.OSInstallationRequest, netConfig *npb.Net) error {
+func install(ctx context.Context, req *apb.OSInstallationRequest, netConfig *npb.Net) error {
 	switch reqT := req.Type.(type) {
-	case *bpb.OSInstallationRequest_Metropolis:
+	case *apb.OSInstallationRequest_Metropolis:
 		return installMetropolis(ctx, reqT.Metropolis, netConfig)
 	default:
 		return errors.New("unknown installation request type")
 	}
 }
 
-func installMetropolis(ctx context.Context, req *bpb.MetropolisInstallationRequest, netConfig *npb.Net) error {
+func installMetropolis(ctx context.Context, req *apb.MetropolisInstallationRequest, netConfig *npb.Net) error {
 	l := supervisor.Logger(ctx)
 	// Validate we are running via EFI.
 	if _, err := os.Stat("/sys/firmware/efi"); os.IsNotExist(err) {
diff --git a/cloud/api/BUILD.bazel b/cloud/api/BUILD.bazel
deleted file mode 100644
index 7d471af..0000000
--- a/cloud/api/BUILD.bazel
+++ /dev/null
@@ -1,38 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
-load("@rules_proto//proto:defs.bzl", "proto_library")
-load("@rules_proto_grpc_buf//:defs.bzl", "buf_proto_lint_test")
-
-buf_proto_lint_test(
-    name = "api_proto_lint_test",
-    except_rules = [
-        "PACKAGE_VERSION_SUFFIX",
-        "SERVICE_SUFFIX",
-    ],
-    protos = [":api_proto"],
-    use_rules = [
-        "DEFAULT",
-        "COMMENTS",
-    ],
-)
-
-proto_library(
-    name = "api_proto",
-    srcs = ["iam.proto"],
-    visibility = ["//visibility:public"],
-)
-
-go_proto_library(
-    name = "api_go_proto",
-    compilers = ["@io_bazel_rules_go//proto:go_grpc"],
-    importpath = "source.monogon.dev/cloud/api",
-    proto = ":api_proto",
-    visibility = ["//visibility:public"],
-)
-
-go_library(
-    name = "api",
-    embed = [":api_go_proto"],
-    importpath = "source.monogon.dev/cloud/api",
-    visibility = ["//visibility:public"],
-)
diff --git a/cloud/api/gomod-generated-placeholder.go b/cloud/api/gomod-generated-placeholder.go
deleted file mode 100644
index da08b30..0000000
--- a/cloud/api/gomod-generated-placeholder.go
+++ /dev/null
@@ -1,4 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package api
diff --git a/cloud/api/iam.proto b/cloud/api/iam.proto
deleted file mode 100644
index 2bfc4ed..0000000
--- a/cloud/api/iam.proto
+++ /dev/null
@@ -1,18 +0,0 @@
-syntax = "proto3";
-package cloud.api;
-option go_package = "source.monogon.dev/cloud/api";
-
-service IAM {
-  rpc WhoAmI(WhoAmIRequest) returns (WhoAmIResponse);
-}
-
-message WhoAmIRequest {
-}
-
-message WhoAmIResponse {
-  // Opaque identifier (eg. UUID) of the acting account. Immutable.
-  string account_id = 1;
-  // Primary email address of the acting account. Can change, must not be used
-  // as a foreign key in other systems.
-  string email = 2;
-}
\ No newline at end of file
diff --git a/cloud/apigw/BUILD.bazel b/cloud/apigw/BUILD.bazel
deleted file mode 100644
index 7d2114d..0000000
--- a/cloud/apigw/BUILD.bazel
+++ /dev/null
@@ -1,34 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("@rules_oci//oci:defs.bzl", "oci_image")
-load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
-
-go_library(
-    name = "apigw_lib",
-    srcs = ["main.go"],
-    importpath = "source.monogon.dev/cloud/apigw",
-    visibility = ["//visibility:private"],
-    deps = [
-        "//cloud/apigw/server",
-        "@io_k8s_klog_v2//:klog",
-    ],
-)
-
-go_binary(
-    name = "apigw",
-    embed = [":apigw_lib"],
-    visibility = ["//visibility:public"],
-)
-
-pkg_tar(
-    name = "apigw_layer",
-    srcs = [":apigw"],
-)
-
-oci_image(
-    name = "apigw_image",
-    base = "@distroless_base",
-    entrypoint = ["/apigw"],
-    tars = [":apigw_layer"],
-    visibility = ["//visibility:public"],
-    workdir = "/app",
-)
diff --git a/cloud/apigw/main.go b/cloud/apigw/main.go
deleted file mode 100644
index 4d2ca31..0000000
--- a/cloud/apigw/main.go
+++ /dev/null
@@ -1,29 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package main
-
-import (
-	"context"
-	"flag"
-
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/apigw/server"
-)
-
-func main() {
-	s := &server.Server{}
-	s.Config.RegisterFlags()
-	flag.Parse()
-	if flag.NArg() > 0 {
-		klog.Exitf("unexpected positional arguments: %v", flag.Args())
-	}
-
-	ctx, ctxC := context.WithCancel(context.Background())
-	// TODO: context cancel on interrupt.
-	_ = ctxC
-
-	s.Start(ctx)
-	select {}
-}
diff --git a/cloud/apigw/model/BUILD.bazel b/cloud/apigw/model/BUILD.bazel
deleted file mode 100644
index 4720654..0000000
--- a/cloud/apigw/model/BUILD.bazel
+++ /dev/null
@@ -1,28 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//build/sqlc:sqlc.bzl", "sqlc_go_library")
-
-sqlc_go_library(
-    name = "sqlc_model",
-    dialect = "cockroachdb",
-    importpath = "source.monogon.dev/cloud/apigw/model",
-    migrations = glob(["migrations/*.sql"]),
-    queries = [
-        "queries.sql",
-    ],
-)
-
-go_library(
-    name = "model",
-    srcs = ["migrations.go"],
-    embed = [
-        ":sqlc_model",  # keep
-    ],
-    embedsrcs = glob(["migrations/*.sql"]),  # keep
-    importpath = "source.monogon.dev/cloud/apigw/model",
-    visibility = ["//visibility:public"],
-    deps = [
-        "@com_github_golang_migrate_migrate_v4//source",
-        "@com_github_golang_migrate_migrate_v4//source/iofs",
-        "@com_github_google_uuid//:uuid",  # keep
-    ],
-)
diff --git a/cloud/apigw/model/migrations.go b/cloud/apigw/model/migrations.go
deleted file mode 100644
index 95b5dcf..0000000
--- a/cloud/apigw/model/migrations.go
+++ /dev/null
@@ -1,18 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package model
-
-import (
-	"embed"
-
-	"github.com/golang-migrate/migrate/v4/source"
-	"github.com/golang-migrate/migrate/v4/source/iofs"
-)
-
-//go:embed migrations/*.sql
-var migrationData embed.FS
-
-func MigrationsSource() (source.Driver, error) {
-	return iofs.New(migrationData, "migrations")
-}
diff --git a/cloud/apigw/model/migrations/1663155947_initial.down.sql b/cloud/apigw/model/migrations/1663155947_initial.down.sql
deleted file mode 100644
index 032d6cf..0000000
--- a/cloud/apigw/model/migrations/1663155947_initial.down.sql
+++ /dev/null
@@ -1 +0,0 @@
-DROP TABLE accounts;
\ No newline at end of file
diff --git a/cloud/apigw/model/migrations/1663155947_initial.up.sql b/cloud/apigw/model/migrations/1663155947_initial.up.sql
deleted file mode 100644
index 4812e00..0000000
--- a/cloud/apigw/model/migrations/1663155947_initial.up.sql
+++ /dev/null
@@ -1,17 +0,0 @@
-CREATE TABLE accounts (
-    -- Internal account ID. Never changes.
-    account_id UUID NOT NULL DEFAULT gen_random_uuid() PRIMARY KEY,
-
-    -- Identity used to tied this account to OIDC.
-    -- OpenID Connect Core, 2. ID Token: “It MUST NOT exceed 255 ASCII
-    -- characters in length”.
-    account_oidc_sub STRING(255) NOT NULL UNIQUE,
-
-    --- Copy/cache of user data retrieved from OIDC IdP on login. Currently this
-    --- is only updated on first login, but we should find a way to trigger
-    --- a re-retrieval.
-    -- Display name preferred by user.
-    -- Self-limiting ourselves to 255 unicode codepoints here. This is also
-    -- supposedly what keycloak also defaults to for user attributes.
-    account_display_name STRING(255) NOT NULL
-);
\ No newline at end of file
diff --git a/cloud/apigw/model/queries.sql b/cloud/apigw/model/queries.sql
deleted file mode 100644
index 564f91d..0000000
--- a/cloud/apigw/model/queries.sql
+++ /dev/null
@@ -1,13 +0,0 @@
--- name: GetAccountByOIDC :many
-SELECT
-    accounts.*
-FROM accounts
-WHERE account_oidc_sub = $1;
-
--- name: InitializeAccountFromOIDC :one
-INSERT INTO accounts (
-    account_oidc_sub, account_display_name
-) VALUES (
-    $1, $2
-)
-RETURNING *;
\ No newline at end of file
diff --git a/cloud/apigw/server/BUILD.bazel b/cloud/apigw/server/BUILD.bazel
deleted file mode 100644
index a15ff6d..0000000
--- a/cloud/apigw/server/BUILD.bazel
+++ /dev/null
@@ -1,36 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-
-go_library(
-    name = "server",
-    srcs = ["server.go"],
-    importpath = "source.monogon.dev/cloud/apigw/server",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//cloud/api",
-        "//cloud/apigw/model",
-        "//cloud/lib/component",
-        "@com_github_improbable_eng_grpc_web//go/grpcweb",
-        "@io_k8s_klog_v2//:klog",
-        "@org_golang_google_grpc//:grpc",
-        "@org_golang_google_grpc//codes",
-        "@org_golang_google_grpc//credentials/insecure",
-        "@org_golang_google_grpc//reflection",
-        "@org_golang_google_grpc//status",
-    ],
-)
-
-go_test(
-    name = "server_test",
-    srcs = ["server_test.go"],
-    data = [
-        "@cockroach",
-    ],
-    embed = [":server"],
-    deps = [
-        "//cloud/api",
-        "//cloud/apigw/model",
-        "//cloud/lib/component",
-        "@org_golang_google_grpc//codes",
-        "@org_golang_google_protobuf//proto",
-    ],
-)
diff --git a/cloud/apigw/server/server.go b/cloud/apigw/server/server.go
deleted file mode 100644
index d075e98..0000000
--- a/cloud/apigw/server/server.go
+++ /dev/null
@@ -1,128 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package server
-
-import (
-	"context"
-	"errors"
-	"flag"
-	"net"
-	"net/http"
-
-	"github.com/improbable-eng/grpc-web/go/grpcweb"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/credentials/insecure"
-	"google.golang.org/grpc/reflection"
-	"google.golang.org/grpc/status"
-	"k8s.io/klog/v2"
-
-	apb "source.monogon.dev/cloud/api"
-	"source.monogon.dev/cloud/apigw/model"
-	"source.monogon.dev/cloud/lib/component"
-)
-
-// Config is the main configuration of the apigw server. It's usually populated
-// from flags via RegisterFlags, but can also be set manually (eg. in tests).
-type Config struct {
-	Component component.ComponentConfig
-	Database  component.CockroachConfig
-
-	PublicListenAddress string
-}
-
-// RegisterFlags registers the component configuration to be provided by flags.
-// This must be called exactly once before then calling flags.Parse().
-func (c *Config) RegisterFlags() {
-	c.Component.RegisterFlags("apigw")
-	c.Database.RegisterFlags("apigw_db")
-	flag.StringVar(&c.PublicListenAddress, "apigw_public_grpc_listen_address", ":8080", "Address to listen at for public/user gRPC connections for apigw")
-}
-
-// Server runs the apigw server. It listens on two interfaces:
-//   - Internal gRPC, which is authenticated using TLS and authorized by CA. This
-//     is to be used for internal RPCs, eg. management/debug.
-//   - Public gRPC-Web, which is currently unauthenticated.
-type Server struct {
-	Config Config
-
-	// ListenGRPC will contain the address at which the internal gRPC server is
-	// listening after .Start() has been called. This can differ from the configured
-	// value if the configuration requests any port (via :0).
-	ListenGRPC string
-	// ListenPublic will contain the address at which the public API server is
-	// listening after .Start() has been called. This can differ from the configured
-	// value if the configuration requests any port (via :0).
-	ListenPublic string
-}
-
-func (s *Server) startInternalGRPC(ctx context.Context) {
-	g := grpc.NewServer(s.Config.Component.GRPCServerOptions()...)
-	lis, err := net.Listen("tcp", s.Config.Component.GRPCListenAddress)
-	if err != nil {
-		klog.Exitf("Could not listen: %v", err)
-	}
-	s.ListenGRPC = lis.Addr().String()
-
-	reflection.Register(g)
-
-	klog.Infof("Internal gRPC listening on %s", s.ListenGRPC)
-	go func() {
-		err := g.Serve(lis)
-		if !errors.Is(err, ctx.Err()) {
-			klog.Exitf("Internal gRPC serve failed: %v", err)
-		}
-	}()
-}
-
-func (s *Server) startPublic(ctx context.Context) {
-	g := grpc.NewServer(grpc.Creds(insecure.NewCredentials()))
-	lis, err := net.Listen("tcp", s.Config.PublicListenAddress)
-	if err != nil {
-		klog.Exitf("Could not listen: %v", err)
-	}
-	s.ListenPublic = lis.Addr().String()
-
-	reflection.Register(g)
-	apb.RegisterIAMServer(g, s)
-
-	wrapped := grpcweb.WrapServer(g)
-	server := http.Server{
-		Addr:    s.Config.PublicListenAddress,
-		Handler: http.HandlerFunc(wrapped.ServeHTTP),
-	}
-	klog.Infof("Public API listening on %s", s.ListenPublic)
-	go func() {
-		err := server.Serve(lis)
-		if !errors.Is(err, ctx.Err()) {
-			klog.Exitf("Public API serve failed: %v", err)
-		}
-	}()
-}
-
-// Start runs the two listeners of the server. The process will fail (via
-// klog.Exit) if any of the listeners/servers fail to start.
-func (s *Server) Start(ctx context.Context) {
-	if s.Config.Database.Migrations == nil {
-		klog.Infof("Using default migrations source.")
-		m, err := model.MigrationsSource()
-		if err != nil {
-			klog.Exitf("failed to prepare migrations source: %v", err)
-		}
-		s.Config.Database.Migrations = m
-	}
-
-	klog.Infof("Running migrations...")
-	if err := s.Config.Database.MigrateUp(); err != nil {
-		klog.Exitf("Migrations failed: %v", err)
-	}
-	klog.Infof("Migrations done.")
-	s.startInternalGRPC(ctx)
-	s.startPublic(ctx)
-}
-
-func (s *Server) WhoAmI(ctx context.Context, req *apb.WhoAmIRequest) (*apb.WhoAmIResponse, error) {
-	klog.Infof("req: %+v", req)
-	return nil, status.Error(codes.Unimplemented, "unimplemented")
-}
diff --git a/cloud/apigw/server/server_test.go b/cloud/apigw/server/server_test.go
deleted file mode 100644
index 1455f63..0000000
--- a/cloud/apigw/server/server_test.go
+++ /dev/null
@@ -1,129 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package server
-
-import (
-	"bytes"
-	"context"
-	"encoding/binary"
-	"fmt"
-	"net/http"
-	"strconv"
-	"testing"
-
-	"google.golang.org/grpc/codes"
-	"google.golang.org/protobuf/proto"
-
-	apb "source.monogon.dev/cloud/api"
-	"source.monogon.dev/cloud/apigw/model"
-	"source.monogon.dev/cloud/lib/component"
-)
-
-func dut() *Server {
-	return &Server{
-		Config: Config{
-			Component: component.ComponentConfig{
-				GRPCListenAddress: ":0",
-				DevCerts:          true,
-				DevCertsPath:      "/tmp/foo",
-			},
-			Database: component.CockroachConfig{
-				InMemory: true,
-			},
-			PublicListenAddress: ":0",
-		},
-	}
-}
-
-// TestPublicSimple ensures the public grpc-web listener is working.
-func TestPublicSimple(t *testing.T) {
-	s := dut()
-	ctx := context.Background()
-	s.Start(ctx)
-
-	// Craft a gRPC-Web request from scratch. There doesn't seem to be a
-	// well-supported library to do this.
-
-	// The request is \0 ++ uint32be(len(req)) ++ req.
-	msgBytes, err := proto.Marshal(&apb.WhoAmIRequest{})
-	if err != nil {
-		t.Fatalf("Could not marshal request body: %v", err)
-	}
-	buf := bytes.NewBuffer(nil)
-	binary.Write(buf, binary.BigEndian, byte(0))
-	binary.Write(buf, binary.BigEndian, uint32(len(msgBytes)))
-	buf.Write(msgBytes)
-
-	// Perform the request. Set minimum headers required for gRPC-Web to recognize
-	// this as a gRPC-Web request.
-	req, err := http.NewRequest("POST", fmt.Sprintf("http://%s/cloud.api.IAM/WhoAmI", s.ListenPublic), buf)
-	if err != nil {
-		t.Fatalf("Could not create request: %v", err)
-	}
-	req.Header.Set("Content-Type", "application/grpc-web+proto")
-	req.Header.Set("X-Grpc-Web", "1")
-
-	res, err := http.DefaultClient.Do(req)
-	if err != nil {
-		t.Fatalf("Could not perform request: %v", err)
-	}
-	// Regardless for RPC status, 200 should always be returned.
-	if want, got := 200, res.StatusCode; want != got {
-		t.Errorf("Wanted code %d, got %d", want, got)
-	}
-
-	// Expect endpoint to return 'unimplemented'.
-	code, _ := strconv.Atoi(res.Header.Get("Grpc-Status"))
-	if want, got := uint32(codes.Unimplemented), uint32(code); want != got {
-		t.Errorf("Wanted code %d, got %d", want, got)
-	}
-	if want, got := "unimplemented", res.Header.Get("Grpc-Message"); want != got {
-		t.Errorf("Wanted message %q, got %q", want, got)
-	}
-}
-
-// TestUserSimple makes sure we can add and retrieve users. This is a low-level
-// test which mostly exercises the machinery to bring up a working database in
-// tests.
-func TestUserSimple(t *testing.T) {
-	s := dut()
-	ctx := context.Background()
-	s.Start(ctx)
-
-	db, err := s.Config.Database.Connect()
-	if err != nil {
-		t.Fatalf("Connecting to the database failed: %v", err)
-	}
-	q := model.New(db)
-
-	// Start out with no account by sub 'test'.
-	accounts, err := q.GetAccountByOIDC(ctx, "test")
-	if err != nil {
-		t.Fatalf("Retrieving accounts failed: %v", err)
-	}
-	if want, got := 0, len(accounts); want != got {
-		t.Fatalf("Expected no accounts at first, got %d", got)
-	}
-
-	// Create a new test account for sub 'test'.
-	_, err = q.InitializeAccountFromOIDC(ctx, model.InitializeAccountFromOIDCParams{
-		AccountOidcSub:     "test",
-		AccountDisplayName: "Test User",
-	})
-	if err != nil {
-		t.Fatalf("Creating new account failed: %v", err)
-	}
-
-	// Expect this account to be available now.
-	accounts, err = q.GetAccountByOIDC(ctx, "test")
-	if err != nil {
-		t.Fatalf("Retrieving accounts failed: %v", err)
-	}
-	if want, got := 1, len(accounts); want != got {
-		t.Fatalf("Expected exactly one account after creation, got %d", got)
-	}
-	if want, got := "Test User", accounts[0].AccountDisplayName; want != got {
-		t.Fatalf("Expected to read back display name %q, got %q", want, got)
-	}
-}
diff --git a/cloud/bmaas/DEPLOYING.md b/cloud/bmaas/DEPLOYING.md
deleted file mode 100644
index a1326f6..0000000
--- a/cloud/bmaas/DEPLOYING.md
+++ /dev/null
@@ -1,40 +0,0 @@
-Schema/Version compatibility
-===
-
-Live migration
----
-
-BMaaS supports live migrating schemas. On startup, every component using the BMaaS
-will attempt to migrate the database up to the newest version of the schema it
-was built with.
-
-Components are implemented to support a range of schemas, and operators should
-sequence upgrades in the following way:
-
-1. Make sure that all components are at the newest possible CL, but not so new
-   that they ship a newer version of the schema than is currently running.
-2. Upgrade components in a rolling fashion to a CL version that ships the newest
-   possible schema version which is still compatible with the previous CL
-   versions of the components.
-3. Repeat from point 1 until the newest wanted CL version is running.
-
-| ID | Schema range  | CL range | Notes                        |
-|----|---------------|----------|------------------------------|
-| 0  | < 1672749980  | >= 0     | Initial production schema.   |
-| 1  | >= 1672768890 | >= 1565  | Exponential backoff support. |
-
-For example, if the cluster is at version 1200, it should first be upgraded to 
-< 1565 (to reach row 0), then to anything higher than 1565 (to reach row 1).
-
-Offline migration
----
-
-For simple deployments, an offline migration is easiest. To perform an offline migration:
-
-1. Turn down all BMaaS components that communicate with the BMDB.
-2. Upgrade all components to the newer version (either newest or otherwise
-   wanted, but all components have to be at the same CL version).
-3. Turn up a single component of BMaaS torn down in 1., making sure the database is migrated.
-4. Turn up the rest of the components.
-
-This allows migrating across many incompatible schema migrations, but requires downtime.
\ No newline at end of file
diff --git a/cloud/bmaas/bmdb/BUILD.bazel b/cloud/bmaas/bmdb/BUILD.bazel
deleted file mode 100644
index 64f0df4..0000000
--- a/cloud/bmaas/bmdb/BUILD.bazel
+++ /dev/null
@@ -1,50 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-
-go_library(
-    name = "bmdb",
-    srcs = [
-        "bmdb.go",
-        "connection.go",
-        "sessions.go",
-    ],
-    importpath = "source.monogon.dev/cloud/bmaas/bmdb",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//cloud/bmaas/bmdb/metrics",
-        "//cloud/bmaas/bmdb/model",
-        "//cloud/bmaas/bmdb/reflection",
-        "//cloud/lib/component",
-        "@com_github_cockroachdb_cockroach_go_v2//crdb",
-        "@com_github_google_uuid//:uuid",
-        "@com_github_lib_pq//:pq",
-        "@com_github_prometheus_client_golang//prometheus",
-        "@io_k8s_klog_v2//:klog",
-    ],
-)
-
-go_test(
-    name = "bmdb_test",
-    srcs = [
-        "backoff_test.go",
-        "migrations_test.go",
-        "queries_test.go",
-        "reflection_test.go",
-        "sessions_test.go",
-    ],
-    data = [
-        "@cockroach",
-    ],
-    embed = [":bmdb"],
-    # TODO: https://github.com/monogon-dev/monogon/issues/213
-    flaky = True,
-    deps = [
-        "//cloud/agent/api",
-        "//cloud/bmaas/bmdb/model",
-        "//cloud/bmaas/bmdb/reflection",
-        "//cloud/bmaas/server/api",
-        "//cloud/lib/component",
-        "@com_github_google_go_cmp//cmp",
-        "@com_github_google_uuid//:uuid",
-        "@org_golang_google_protobuf//proto",
-    ],
-)
diff --git a/cloud/bmaas/bmdb/backoff_test.go b/cloud/bmaas/bmdb/backoff_test.go
deleted file mode 100644
index 19d3f51..0000000
--- a/cloud/bmaas/bmdb/backoff_test.go
+++ /dev/null
@@ -1,64 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package bmdb
-
-import (
-	"testing"
-	"time"
-
-	"github.com/google/go-cmp/cmp"
-)
-
-// TestBackoffMath exercises the rules of Backoff.
-func TestBackoffMath(t *testing.T) {
-	for _, te := range []struct {
-		name     string
-		b        *Backoff
-		existing *existingBackoff
-		wantSecs []int64
-	}{
-		{"NoBackoffSet", nil, nil, []int64{1, 1, 1}},
-		{"EmptyBackoff", &Backoff{}, nil, []int64{1, 1, 1}},
-		{"SimpleBackoff", &Backoff{Initial: time.Minute}, nil, []int64{60, 60, 60}},
-		{"ExponentialWithMax",
-			&Backoff{Initial: time.Minute, Exponent: 1.1, Maximum: time.Minute * 2},
-			nil,
-			[]int64{60, 66, 73, 81, 90, 99, 109, 120, 120},
-		},
-
-		{"SimpleOverridePrevious",
-			&Backoff{Initial: time.Minute},
-			&existingBackoff{lastInterval: time.Second * 2},
-			[]int64{60, 60, 60},
-		},
-		{"ExponentialOverridePrevious",
-			&Backoff{Initial: time.Minute, Exponent: 2.0, Maximum: time.Minute * 2},
-			&existingBackoff{lastInterval: time.Second * 2},
-			[]int64{4, 8, 16, 32, 64, 120, 120},
-		},
-
-		{"ContinueExisting", nil, &existingBackoff{lastInterval: time.Minute}, []int64{60, 60, 60}},
-		{"ContinueExistingInvalid1", nil, &existingBackoff{lastInterval: 0}, []int64{1, 1, 1}},
-		{"ContinueExistingInvalid2", nil, &existingBackoff{lastInterval: time.Millisecond}, []int64{1, 1, 1}},
-
-		{"InvalidBackoff1", &Backoff{Exponent: 0.2}, nil, []int64{1, 1, 1}},
-		{"InvalidBackoff2", &Backoff{Maximum: time.Millisecond, Initial: time.Millisecond}, nil, []int64{1, 1, 1}},
-	} {
-		t.Run(te.name, func(t *testing.T) {
-			existing := te.existing
-
-			gotSecs := make([]int64, len(te.wantSecs))
-			for j := 0; j < len(te.wantSecs); j++ {
-				gotSecs[j] = te.b.next(existing)
-				existing = &existingBackoff{
-					lastInterval: time.Duration(gotSecs[j]) * time.Second,
-				}
-			}
-
-			if diff := cmp.Diff(te.wantSecs, gotSecs); diff != "" {
-				t.Errorf("Difference: %s", diff)
-			}
-		})
-	}
-}
diff --git a/cloud/bmaas/bmdb/bmdb.go b/cloud/bmaas/bmdb/bmdb.go
deleted file mode 100644
index 400aa4a..0000000
--- a/cloud/bmaas/bmdb/bmdb.go
+++ /dev/null
@@ -1,64 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-// Package bmdb implements a connector to the Bare Metal Database, which is the
-// main data store backing information about bare metal machines.
-//
-// All components of the BMaaS project connect directly to the underlying
-// CockroachDB database storing this data via this library. In the future, this
-// library might turn into a shim which instead connects to a coordinator
-// service over gRPC.
-package bmdb
-
-import (
-	"github.com/prometheus/client_golang/prometheus"
-
-	"source.monogon.dev/cloud/bmaas/bmdb/metrics"
-	"source.monogon.dev/cloud/lib/component"
-)
-
-// BMDB is the Bare Metal Database, a common schema to store information about
-// bare metal machines in CockroachDB. This struct is supposed to be
-// embedded/contained by different components that interact with the BMDB, and
-// provides a common interface to BMDB operations to these components.
-//
-// The BMDB provides two mechanisms facilitating a 'reactive work system' being
-// implemented on the bare metal machine data:
-//
-//   - Sessions, which are maintained by heartbeats by components and signal the
-//     liveness of said components to other components operating on the BMDB. These
-//     effectively extend CockroachDB's transactions to be visible as row data. Any
-//     session that is not actively being updated by a component can be expired by a
-//     component responsible for lease garbage collection.
-//   - Work locking, which bases on Sessions and allows long-standing
-//     multi-transaction work to be performed on given machines, preventing
-//     conflicting work from being performed by other components. As both Work
-//     locking and Sessions are plain row data, other components can use SQL queries
-//     to exclude machines to act on by constraining SELECT queries to not return
-//     machines with some active work being performed on them.
-type BMDB struct {
-	Config
-
-	metrics *metrics.MetricsSet
-}
-
-// Config is the configuration of the BMDB connector.
-type Config struct {
-	Database component.CockroachConfig
-
-	// ComponentName is a human-readable name of the component connecting to the
-	// BMDB, and is stored in any Sessions managed by this component's connector.
-	ComponentName string
-	// RuntimeInfo is a human-readable 'runtime information' (eg. software version,
-	// host machine/job information, IP address, etc.) stored alongside the
-	// ComponentName in active Sessions.
-	RuntimeInfo string
-}
-
-// EnableMetrics configures BMDB metrics collection and registers it on the given
-// registry. This method should only be called once, and is not goroutine safe.
-func (b *BMDB) EnableMetrics(registry *prometheus.Registry) {
-	if b.metrics == nil {
-		b.metrics = metrics.New(registry)
-	}
-}
diff --git a/cloud/bmaas/bmdb/connection.go b/cloud/bmaas/bmdb/connection.go
deleted file mode 100644
index 8024eb8..0000000
--- a/cloud/bmaas/bmdb/connection.go
+++ /dev/null
@@ -1,97 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package bmdb
-
-import (
-	"context"
-	"database/sql"
-	"fmt"
-
-	"github.com/google/uuid"
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/cloud/bmaas/bmdb/reflection"
-)
-
-// Open creates a new Connection to the BMDB for the calling component. Multiple
-// connections can be opened (although there is no advantage to doing so, as
-// Connections manage an underlying CockroachDB connection pool, which performs
-// required reconnects and connection pooling automatically).
-func (b *BMDB) Open(migrate bool) (*Connection, error) {
-	if b.Config.Database.Migrations == nil {
-		klog.Infof("Using default migrations source.")
-		m, err := model.MigrationsSource()
-		if err != nil {
-			klog.Exitf("failed to prepare migrations source: %v", err)
-		}
-		b.Config.Database.Migrations = m
-	}
-	if migrate {
-		if err := b.Database.MigrateUp(); err != nil {
-			return nil, fmt.Errorf("migration failed: %w", err)
-		}
-	}
-	db, err := b.Database.Connect()
-	if err != nil {
-		return nil, err
-	}
-	return &Connection{
-		bmdb: b,
-		db:   db,
-
-		DatabaseName: b.Config.Database.DatabaseName,
-		Address:      b.Config.Database.EndpointHost,
-		InMemory:     b.Config.Database.InMemory,
-	}, nil
-}
-
-// Connection to the BMDB. Internally, this contains a sql.DB connection pool,
-// so components can (and likely should) reuse Connections as much as possible
-// internally.
-type Connection struct {
-	bmdb *BMDB
-	db   *sql.DB
-
-	// The database name that we're connected to.
-	DatabaseName string
-	// The address of the CockroachDB endpoint we've connected to.
-	Address string
-	// Whether this connection is to an in-memory database. Note: this only works if
-	// this Connection came directly from calling Open on a BMDB that was defined to
-	// be in-memory. If you just connect to an in-memory CRDB manually, this will
-	// still be false.
-	InMemory bool
-}
-
-// Reflect returns a reflection.Schema as detected by inspecting the table
-// information of this connection to the BMDB. The Schema can then be used to
-// retrieve arbitrary tag/machine information without going through the
-// concurrency/ordering mechanism of the BMDB.
-//
-// This should only be used to implement debugging tooling and should absolutely
-// not be in the path of any user requests.
-//
-// This Connection will be used not only to query the Schema information, but
-// also for all subsequent data retrieval operations on it. Please ensure that
-// the Schema is rebuilt in the event of a database connection failure. Ideally,
-// you should be rebuilding the schema often, to follow what is currently
-// available on the production database - but not for every request. Use a cache
-// or something.
-func (c *Connection) Reflect(ctx context.Context) (*reflection.Schema, error) {
-	return reflection.Reflect(ctx, c.db)
-}
-
-// ListHistoryOf retrieves a full audit history of a machine, sorted
-// chronologically. It can be read without a session / transaction for debugging
-// purposes.
-func (c *Connection) ListHistoryOf(ctx context.Context, machine uuid.UUID) ([]model.WorkHistory, error) {
-	return model.New(c.db).ListHistoryOf(ctx, machine)
-}
-
-// GetSession retrieves all information about a session. It can be read without a
-// session/transaction for debugging purposes.
-func (c *Connection) GetSession(ctx context.Context, session uuid.UUID) ([]model.Session, error) {
-	return model.New(c.db).GetSession(ctx, session)
-}
diff --git a/cloud/bmaas/bmdb/metrics/BUILD.bazel b/cloud/bmaas/bmdb/metrics/BUILD.bazel
deleted file mode 100644
index d5eb8a5..0000000
--- a/cloud/bmaas/bmdb/metrics/BUILD.bazel
+++ /dev/null
@@ -1,12 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-
-go_library(
-    name = "metrics",
-    srcs = ["metrics.go"],
-    importpath = "source.monogon.dev/cloud/bmaas/bmdb/metrics",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//cloud/bmaas/bmdb/model",
-        "@com_github_prometheus_client_golang//prometheus",
-    ],
-)
diff --git a/cloud/bmaas/bmdb/metrics/metrics.go b/cloud/bmaas/bmdb/metrics/metrics.go
deleted file mode 100644
index 242ac2d..0000000
--- a/cloud/bmaas/bmdb/metrics/metrics.go
+++ /dev/null
@@ -1,216 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-// Package metrics implements a Prometheus metrics submission interface for BMDB
-// client components. A Metrics object can be attached to a BMDB object, which
-// will make all BMDB sessions/transactions/work statistics be submitted to that
-// Metrics object.
-package metrics
-
-import (
-	"github.com/prometheus/client_golang/prometheus"
-
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-)
-
-// Processor describes some cloud component and possibly sub-component which acts
-// upon the BMDB. When starting a BMDB session, this Processor can be provided to
-// contextualize the metrics emitted by this session. Because the selected
-// Processor ends up directly as a Prometheus metric label, it must be
-// low-cardinality - thus all possible values are defined as an enum here. If a
-// Session is not configured with a Processor, the default (ProcessorUnknown)
-// will be used.
-type Processor string
-
-const (
-	ProcessorUnknown             Processor = ""
-	ProcessorShepherdInitializer Processor = "shepherd-initializer"
-	ProcessorShepherdProvisioner Processor = "shepherd-provisioner"
-	ProcessorShepherdRecoverer   Processor = "shepherd-recoverer"
-	ProcessorShepherdUpdater     Processor = "shepherd-updater"
-	ProcessorBMSRV               Processor = "bmsrv"
-	ProcessorScruffyStats        Processor = "scruffy-stats"
-)
-
-// String returns the Prometheus label value for use with the 'processor' label
-// key.
-func (p Processor) String() string {
-	switch p {
-	case ProcessorUnknown:
-		return "unknown"
-	default:
-		return string(p)
-	}
-}
-
-// MetricsSet contains all the Prometheus metrics objects related to a BMDB
-// client.
-//
-// The MetricsSet object is goroutine-safe.
-//
-// An empty MetricsSet object is not valid, and should be instead constructed
-// using New.
-//
-// A nil MetricsSet object is valid and represents a no-op metrics recorder
-// that's never collected.
-type MetricsSet struct {
-	sessionStarted      *prometheus.CounterVec
-	transactionExecuted *prometheus.CounterVec
-	transactionRetried  *prometheus.CounterVec
-	transactionFailed   *prometheus.CounterVec
-	workStarted         *prometheus.CounterVec
-	workFinished        *prometheus.CounterVec
-}
-
-func processorCounter(name, help string, labels ...string) *prometheus.CounterVec {
-	labels = append([]string{"processor"}, labels...)
-	return prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Name: name,
-			Help: help,
-		},
-		labels,
-	)
-}
-
-// New creates a new BMDB MetricsSet object which can be then attached to a BMDB
-// object by calling BMDB.EnableMetrics on the MetricsSet object.
-//
-// The given registry must be a valid Prometheus registry, and all metrics
-// contained in this MetricsSet object will be registered into it.
-//
-// The MetricsSet object can be shared between multiple BMDB object.
-//
-// The MetricsSet object is goroutine-safe.
-func New(registry *prometheus.Registry) *MetricsSet {
-	m := &MetricsSet{
-		sessionStarted:      processorCounter("bmdb_session_started", "How many sessions this worker started"),
-		transactionExecuted: processorCounter("bmdb_transaction_executed", "How many transactions were performed by this worker"),
-		transactionRetried:  processorCounter("bmdb_transaction_retried", "How many transaction retries were performed by this worker"),
-		transactionFailed:   processorCounter("bmdb_transaction_failed", "How many transactions failed permanently on this worker"),
-		workStarted:         processorCounter("bmdb_work_started", "How many work items were performed by this worker, partitioned by process", "process"),
-		workFinished:        processorCounter("bmdb_work_finished", "How many work items were finished by this worker, partitioned by process and result", "process", "result"),
-	}
-	registry.MustRegister(
-		m.sessionStarted,
-		m.transactionExecuted,
-		m.transactionRetried,
-		m.transactionFailed,
-		m.workStarted,
-		m.workFinished,
-	)
-	return m
-}
-
-// ProcessorRecorder wraps a MetricsSet object with the context of some
-// Processor. It exposes methods that record specific events into the managed
-// Metrics.
-//
-// The ProcessorRecorder object is goroutine safe.
-//
-// An empty ProcessorRecorder object is not valid, and should be instead
-// constructed using Metrics.Recorder.
-//
-// A nil ProcessorRecorder object is valid and represents a no-op metrics
-// recorder.
-type ProcessorRecorder struct {
-	m      *MetricsSet
-	labels prometheus.Labels
-}
-
-// Recorder builds a ProcessorRecorder for the given Metrics and a given
-// Processor.
-func (m *MetricsSet) Recorder(p Processor) *ProcessorRecorder {
-	if m == nil {
-		return nil
-	}
-	return &ProcessorRecorder{
-		m: m,
-		labels: prometheus.Labels{
-			"processor": p.String(),
-		},
-	}
-}
-
-// OnTransactionStarted should be called any time a BMDB client starts or
-// re-starts a BMDB Transaction. The attempt should either be '1' (for the first
-// attempt) or a number larger than 1 for any subsequent attempt (i.e. retry) of
-// a transaction.
-func (r *ProcessorRecorder) OnTransactionStarted(attempt int64) {
-	if r == nil {
-		return
-	}
-	if attempt == 1 {
-		r.m.transactionExecuted.With(r.labels).Inc()
-	} else {
-		r.m.transactionRetried.With(r.labels).Inc()
-	}
-}
-
-// OnTransactionFailed should be called any time a BMDB client fails a
-// BMDB Transaction permanently.
-func (r *ProcessorRecorder) OnTransactionFailed() {
-	if r == nil {
-		return
-	}
-	r.m.transactionFailed.With(r.labels).Inc()
-}
-
-// OnSessionStarted should be called any time a BMDB client opens a new BMDB
-// Session.
-func (r *ProcessorRecorder) OnSessionStarted() {
-	if r == nil {
-		return
-	}
-	r.m.sessionStarted.With(r.labels).Inc()
-}
-
-// ProcessRecorder wraps a ProcessorRecorder with an additional model.Process.
-// The resulting object can then record work-specific events.
-//
-// The PusherWithProcess object is goroutine-safe.
-type ProcessRecorder struct {
-	*ProcessorRecorder
-	labels prometheus.Labels
-}
-
-// WithProcess wraps a given Pusher with a Process.
-//
-// The resulting PusherWithProcess object is goroutine-safe.
-func (r *ProcessorRecorder) WithProcess(process model.Process) *ProcessRecorder {
-	if r == nil {
-		return nil
-	}
-	return &ProcessRecorder{
-		ProcessorRecorder: r,
-		labels: prometheus.Labels{
-			"processor": r.labels["processor"],
-			"process":   string(process),
-		},
-	}
-}
-
-// OnWorkStarted should be called any time a BMDB client starts a new Work item.
-func (r *ProcessRecorder) OnWorkStarted() {
-	if r == nil {
-		return
-	}
-	r.m.workStarted.With(r.labels).Inc()
-}
-
-type WorkResult string
-
-const (
-	WorkResultFinished WorkResult = "finished"
-	WorkResultCanceled WorkResult = "canceled"
-	WorkResultFailed   WorkResult = "failed"
-)
-
-// OnWorkFinished should be called any time a BMDB client finishes, cancels or
-// fails a Work item.
-func (r *ProcessRecorder) OnWorkFinished(result WorkResult) {
-	if r == nil {
-		return
-	}
-	r.m.workFinished.MustCurryWith(r.labels).With(prometheus.Labels{"result": string(result)}).Inc()
-}
diff --git a/cloud/bmaas/bmdb/migrations_test.go b/cloud/bmaas/bmdb/migrations_test.go
deleted file mode 100644
index fe5b75c..0000000
--- a/cloud/bmaas/bmdb/migrations_test.go
+++ /dev/null
@@ -1,150 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package bmdb
-
-import (
-	"context"
-	"testing"
-
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-)
-
-// TestMigrateUpDown performs a full-up and full-down migration test on an
-// in-memory database twice.
-//
-// Doing this the first time allows us to check the up migrations are valid and
-// that the down migrations clean up enough after themselves for earlier down
-// migrations to success.
-//
-// Doing this the second time allows us to make sure the down migrations cleaned
-// up enough after themselves that they have left no table/type behind.
-func TestMigrateUpDown(t *testing.T) {
-	// Start with an empty database.
-	b := dut()
-	_, err := b.Open(false)
-	if err != nil {
-		t.Fatalf("Starting empty database failed: %v", err)
-	}
-
-	// Migrations go up.
-	if err := b.Database.MigrateUp(); err != nil {
-		t.Fatalf("Initial up migration failed: %v", err)
-	}
-	// Migrations go down.
-	if err := b.Database.MigrateDownDangerDanger(); err != nil {
-		t.Fatalf("Initial down migration failed: %v", err)
-	}
-	// Migrations go up.
-	if err := b.Database.MigrateUp(); err != nil {
-		t.Fatalf("Second up migration failed: %v", err)
-	}
-	// Migrations go down.
-	if err := b.Database.MigrateDownDangerDanger(); err != nil {
-		t.Fatalf("Second down migration failed: %v", err)
-	}
-}
-
-// TestMigrateTwice makes sure we don't hit https://review.monogon.dev/1502 again.
-func TestMigrateTwice(t *testing.T) {
-	// Start with an empty database.
-	b := dut()
-	_, err := b.Open(false)
-	if err != nil {
-		t.Fatalf("Starting empty database failed: %v", err)
-	}
-
-	// Migrations go up.
-	if err := b.Database.MigrateUp(); err != nil {
-		t.Fatalf("Initial up migration failed: %v", err)
-	}
-	// Migrations go up again.
-	if err := b.Database.MigrateUp(); err != nil {
-		t.Fatalf("Initial up migration failed: %v", err)
-	}
-}
-
-func TestMigration1681826233(t *testing.T) {
-	// This migration adds a new nullable field to backoffs.
-
-	// This guarantees that versions [prev, ver] can run concurrently in a cluster.
-	minVer := uint(1672749980)
-	maxVer := uint(1681826233)
-
-	ctx, ctxC := context.WithCancel(context.Background())
-	defer t.Cleanup(ctxC)
-
-	b := dut()
-	conn, err := b.Open(false)
-	if err != nil {
-		t.Fatalf("Starting empty database failed: %v", err)
-	}
-
-	// First, make sure the change can actually progress if we have some backoffs
-	// already.
-	if err := b.Database.MigrateUpToIncluding(minVer); err != nil {
-		t.Fatalf("Migration to minimum version failed: %v", err)
-	}
-
-	// Create machine and old-style backoff.
-	q := model.New(conn.db)
-	machine, err := q.NewMachine(ctx)
-	if err != nil {
-		t.Fatalf("Could not create machine: %v", err)
-	}
-	_, err = conn.db.Exec(`
-		INSERT INTO work_backoff
-		    (machine_id, process, until, cause)
-		VALUES
-		    ($1, 'UnitTest1', now(), 'test');
-	`, machine.MachineID)
-	if err != nil {
-		t.Fatalf("Could not create old-style backoff on old version: %v", err)
-	}
-
-	// Migrate to newer version.
-	if err := b.Database.MigrateUpToIncluding(maxVer); err != nil {
-		t.Fatalf("Migration to maximum version failed: %v", err)
-	}
-
-	// The migration should be read succesfully.
-	boffs, err := q.WorkBackoffOf(ctx, model.WorkBackoffOfParams{
-		MachineID: machine.MachineID,
-		Process:   "UnitTest1",
-	})
-	if err != nil {
-		t.Fatalf("Reading backoff failed: %v", err)
-	}
-	if len(boffs) != 1 {
-		t.Errorf("No backoff found")
-	} else {
-		boff := boffs[0]
-		if boff.LastIntervalSeconds.Valid {
-			t.Errorf("Expected interval to be NULL")
-		}
-	}
-
-	// Simultaneously, any concurrently running bmdb user on an older version should
-	// still be able to insert and read backoffs old style.
-	_, err = conn.db.Exec(`
-		INSERT INTO work_backoff
-		    (machine_id, process, until, cause)
-		VALUES
-		    ($1, 'UnitTest2', now(), 'test');
-	`, machine.MachineID)
-	if err != nil {
-		t.Fatalf("Could not create old-style backoff on new version: %v", err)
-	}
-	rows, err := conn.db.Query(`
-		SELECT machine_id, process, until, cause FROM work_backoff
-	`)
-	if err != nil {
-		t.Fatalf("Could not fetch old-style backoff data: %v", err)
-	}
-	for rows.Next() {
-		var mid, process, until, cause string
-		if err := rows.Scan(&mid, &process, &until, &cause); err != nil {
-			t.Errorf("Scan failed: %v", err)
-		}
-	}
-}
diff --git a/cloud/bmaas/bmdb/model/BUILD.bazel b/cloud/bmaas/bmdb/model/BUILD.bazel
deleted file mode 100644
index 04cac8c..0000000
--- a/cloud/bmaas/bmdb/model/BUILD.bazel
+++ /dev/null
@@ -1,34 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//build/sqlc:sqlc.bzl", "sqlc_go_library")
-
-sqlc_go_library(
-    name = "sqlc_model",
-    dialect = "cockroachdb",
-    importpath = "source.monogon.dev/cloud/bmaas/bmdb/model",
-    migrations = glob(["migrations/*.sql"]),
-    queries = [
-        "queries_base.sql",
-        "queries_stats.sql",
-        "queries_tags.sql",
-        "queries_workflows.sql",
-    ],
-)
-
-go_library(
-    name = "model",
-    srcs = [
-        "interfaces.go",
-        "migrations.go",
-    ],
-    embed = [
-        ":sqlc_model",  # keep
-    ],
-    embedsrcs = glob(["migrations/*.sql"]),  # keep
-    importpath = "source.monogon.dev/cloud/bmaas/bmdb/model",
-    visibility = ["//visibility:public"],
-    deps = [
-        "@com_github_golang_migrate_migrate_v4//source",
-        "@com_github_golang_migrate_migrate_v4//source/iofs",
-        "@com_github_google_uuid//:uuid",  # keep
-    ],
-)
diff --git a/cloud/bmaas/bmdb/model/interfaces.go b/cloud/bmaas/bmdb/model/interfaces.go
deleted file mode 100644
index 1d559d6..0000000
--- a/cloud/bmaas/bmdb/model/interfaces.go
+++ /dev/null
@@ -1,76 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package model
-
-import "context"
-
-// MetricValue is a prometheus-style labeled numerical metric value. In other
-// words, it's a number accompanied by string key/value pairs.
-type MetricValue struct {
-	Count  int64
-	Labels map[string]string
-}
-
-// WrapSimpleMetric turns a SQL model function which returns a single number into
-// a function which returns one-length MetricValue list with no labels.
-func WrapSimpleMetric(fn func(*Queries, context.Context) (int64, error)) func(*Queries, context.Context) ([]MetricValue, error) {
-	return func(q *Queries, ctx context.Context) ([]MetricValue, error) {
-		v, err := fn(q, ctx)
-		if err != nil {
-			return nil, err
-		}
-		return []MetricValue{
-			{
-				Count:  v,
-				Labels: nil,
-			},
-		}, nil
-	}
-}
-
-// A SQLMetricRow is a row that is the result of some kind of SQL 'metric query'.
-// For each such query we define in our *.sql files, a corresponding
-// implementation exists here.
-type SQLMetricRow interface {
-	Value() MetricValue
-}
-
-// Value implements SQLMetricRow for a row of the result of the
-// CountActiveBackoffs SQL metric query.
-func (c CountActiveBackoffsRow) Value() MetricValue {
-	return MetricValue{
-		Count: c.Count,
-		Labels: map[string]string{
-			"process": string(c.Process),
-		},
-	}
-}
-
-// Value implements SQLMetricRow for a row of the result of the
-// CountActiveWork SQL metric query.
-func (c CountActiveWorkRow) Value() MetricValue {
-	return MetricValue{
-		Count: c.Count,
-		Labels: map[string]string{
-			"process": string(c.Process),
-		},
-	}
-}
-
-// WrapLabeledMetric turns a SQL model function which returns a list of rows
-// implementing SQLMetricRow into a function which returns a list of MetricValues
-// with labels corresponding to the data returned in the rows.
-func WrapLabeledMetric[M SQLMetricRow](fn func(*Queries, context.Context) ([]M, error)) func(*Queries, context.Context) ([]MetricValue, error) {
-	return func(q *Queries, ctx context.Context) ([]MetricValue, error) {
-		v, err := fn(q, ctx)
-		if err != nil {
-			return nil, err
-		}
-		res := make([]MetricValue, len(v))
-		for i, vv := range v {
-			res[i] = vv.Value()
-		}
-		return res, nil
-	}
-}
diff --git a/cloud/bmaas/bmdb/model/migrations.go b/cloud/bmaas/bmdb/model/migrations.go
deleted file mode 100644
index 95b5dcf..0000000
--- a/cloud/bmaas/bmdb/model/migrations.go
+++ /dev/null
@@ -1,18 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package model
-
-import (
-	"embed"
-
-	"github.com/golang-migrate/migrate/v4/source"
-	"github.com/golang-migrate/migrate/v4/source/iofs"
-)
-
-//go:embed migrations/*.sql
-var migrationData embed.FS
-
-func MigrationsSource() (source.Driver, error) {
-	return iofs.New(migrationData, "migrations")
-}
diff --git a/cloud/bmaas/bmdb/model/migrations/1662136250_initial.down.sql b/cloud/bmaas/bmdb/model/migrations/1662136250_initial.down.sql
deleted file mode 100644
index 5c0ebe9..0000000
--- a/cloud/bmaas/bmdb/model/migrations/1662136250_initial.down.sql
+++ /dev/null
@@ -1,4 +0,0 @@
-DROP TABLE work;
-DROP TABLE sessions;
-DROP TABLE machines;
-DROP TYPE process;
\ No newline at end of file
diff --git a/cloud/bmaas/bmdb/model/migrations/1662136250_initial.up.sql b/cloud/bmaas/bmdb/model/migrations/1662136250_initial.up.sql
deleted file mode 100644
index 7b5b812..0000000
--- a/cloud/bmaas/bmdb/model/migrations/1662136250_initial.up.sql
+++ /dev/null
@@ -1,52 +0,0 @@
-CREATE TABLE machines (
-    machine_id UUID NOT NULL DEFAULT gen_random_uuid() PRIMARY KEY,
-    machine_created_at TIMESTAMPTZ NOT NULL
-);
-
-
--- Sessions are maintained by components as they work on the rest of the machine
--- database. Once a session is created, it must be maintained by its owning
--- component by repeatedly 'poking' it, ie. updating the heartbeat_deadline
--- value to be some point in the future.
---
--- TODO: garbage collect old sessions.
-CREATE TABLE sessions (
-    session_id UUID NOT NULL DEFAULT gen_random_uuid() PRIMARY KEY,
-    -- Name of component which created this session. Human-readable.
-    session_component_name STRING NOT NULL,
-    -- Node name, hostname:port, pod name, whatever. Something to tell where
-    -- a particular component is running. Human-readable.
-    session_runtime_info STRING NOT NULL,
-    -- Time at which this session was created.
-    session_created_at TIMESTAMPTZ NOT NULL,
-    -- Number of seconds by which session_deadline (counting from now())
-    -- is bumped up every time the session is poked.
-    session_interval_seconds INT NOT NULL,
-    -- Deadline after which this session should not be considered valid anymore.
-    session_deadline TIMESTAMPTZ NOT NULL
-);
-
-CREATE TYPE process AS ENUM (
-    -- Reserved for unit tests.
-    'UnitTest1',
-    'UnitTest2'
-);
-
--- Work items map a session to work performed on a machine. Multiple work items
--- can exist per session, and thus, a session can back multiple items of work
--- acting on multiple machines. These are optionally created by components to
--- indicate some long-running process being performed on a machine, and will
--- lock out the same process from being run simultaneously, eg. in a
--- concurrently running instance of the same component.
-CREATE TABLE work (
-    -- Machine that this work is being performed on. Prevent deleting machines
-    -- that have active work on them.
-    machine_id UUID NOT NULL REFERENCES machines(machine_id) ON DELETE RESTRICT,
-    -- Session that this work item is tied to. If the session expires, so does
-    -- the work item.
-    session_id UUID NOT NULL REFERENCES sessions(session_id) ON DELETE CASCADE,
-    -- Human-readable process name.
-    process process NOT NULL,
-    UNIQUE (machine_id, process),
-    CONSTRAINT "primary" PRIMARY KEY (machine_id, session_id, process)
-);
\ No newline at end of file
diff --git a/cloud/bmaas/bmdb/model/migrations/1667232160_agent_tags.down.sql b/cloud/bmaas/bmdb/model/migrations/1667232160_agent_tags.down.sql
deleted file mode 100644
index 8630143..0000000
--- a/cloud/bmaas/bmdb/model/migrations/1667232160_agent_tags.down.sql
+++ /dev/null
@@ -1,5 +0,0 @@
-DROP TABLE machine_agent_heartbeat;
-DROP TABLE machine_agent_started;
-DROP TABLE machine_provided;
-DROP TABLE machine_hardware_report;
-DROP type provider;
diff --git a/cloud/bmaas/bmdb/model/migrations/1667232160_agent_tags.up.sql b/cloud/bmaas/bmdb/model/migrations/1667232160_agent_tags.up.sql
deleted file mode 100644
index 341e606..0000000
--- a/cloud/bmaas/bmdb/model/migrations/1667232160_agent_tags.up.sql
+++ /dev/null
@@ -1,59 +0,0 @@
-CREATE TYPE provider AS ENUM (
-    'Equinix'
-    -- More providers will follow in subsequent migrations.
-);
-
--- tag MachineProvided {
---     Provider Provider
---     ProviderID String
--- }
--- Represents the fact that a machine is backed by a machine from a given
--- provider identified there with a given provider id.
-CREATE TABLE machine_provided (
-    machine_id UUID NOT NULL REFERENCES machines(machine_id) ON DELETE RESTRICT,
-    provider provider NOT NULL,
-    provider_id STRING(128) NOT NULL,
-    CONSTRAINT "primary" PRIMARY KEY (machine_id),
-    UNIQUE (provider, provider_id)
-);
-
--- tag AgentStarted {
---     StartedAt time.Time
---     PublicKey []byte
--- }
--- Represents the fact that a machine has had the Agent started on it at some
--- given time, and that the agent returned a given public key which it will use
--- to authenticate itself to the bmdb API server.
-CREATE TABLE machine_agent_started (
-    machine_id UUID NOT NULL REFERENCES machines(machine_id) ON DELETE RESTRICT,
-    agent_started_at TIMESTAMPTZ NOT NULL,
-    agent_public_key BYTES NOT NULL,
-    CONSTRAINT "primary" PRIMARY KEY(machine_id)
-);
-
--- tag AgentHeartbeat {
---     At time.Time
--- }
--- Represents a successful heartbeat send by the Agent running on a machine at
--- some given time.
-CREATE TABLE machine_agent_heartbeat (
-    machine_id UUID NOT NULL REFERENCES machines(machine_id) ON DELETE RESTRICT,
-    agent_heartbeat_at TIMESTAMPTZ NOT NULL,
-    CONSTRAINT "primary" PRIMARY KEY(machine_id)
-);
-
--- tag HardwareReport {
---     Raw []byte
--- }
--- Represents a hardware report submitted by an Agent running on a machine.
--- Usually a report is submitted only once after an agent has been started.
-CREATE TABLE machine_hardware_report (
-    machine_id UUID NOT NULL REFERENCES machines(machine_id) ON DELETE RESTRICT,
-    -- Serialized proto of type cloud.bmaas.server.api.AgentHardwareReport.
-    hardware_report_raw BYTES NOT NULL,
-    CONSTRAINT "primary" PRIMARY KEY(machine_id)
-);
-
--- Used by the Shepherd when performing mutations against the underlying machine
--- (eg. SSH access, restarts, ...).
-ALTER TYPE process ADD VALUE IF NOT EXISTS 'ShepherdAccess';
diff --git a/cloud/bmaas/bmdb/model/migrations/1672743627_installation_tags.down.sql b/cloud/bmaas/bmdb/model/migrations/1672743627_installation_tags.down.sql
deleted file mode 100644
index 0345be6..0000000
--- a/cloud/bmaas/bmdb/model/migrations/1672743627_installation_tags.down.sql
+++ /dev/null
@@ -1,2 +0,0 @@
-DROP TABLE machine_os_installation_report;
-DROP TABLE machine_os_installation_request;
\ No newline at end of file
diff --git a/cloud/bmaas/bmdb/model/migrations/1672743627_installation_tags.up.sql b/cloud/bmaas/bmdb/model/migrations/1672743627_installation_tags.up.sql
deleted file mode 100644
index 37f7b3a..0000000
--- a/cloud/bmaas/bmdb/model/migrations/1672743627_installation_tags.up.sql
+++ /dev/null
@@ -1,19 +0,0 @@
-CREATE TABLE machine_os_installation_request (
-    machine_id UUID NOT NULL REFERENCES machines(machine_id) ON DELETE RESTRICT,
-    -- Version of this request, for example monotonic epoch counter. Used to
-    -- match successful installation (represented by OS installation report) to
-    -- pending request, making sure that we don't perform spurious re-installs.
-    generation INT NOT NULL,
-    -- Serialized cloud.bmaas.server.api.OSInstallationRequest.
-    os_installation_request_raw BYTEA NOT NULL,
-    CONSTRAINT "primary" PRIMARY KEY (machine_id)
-);
-
-CREATE TABLE machine_os_installation_report (
-    machine_id UUID NOT NULL REFERENCES machines(machine_id) ON DELETE RESTRICT,
-    -- Matches generation in machine_os_installation_request. Not constrained on
-    -- purpose, as a mismatch between generations implies an actionable
-    -- installation request and is a valid state of the system.
-    generation INT NOT NULL,
-    CONSTRAINT "primary" PRIMARY KEY (machine_id)
-);
diff --git a/cloud/bmaas/bmdb/model/migrations/1672749980_backoff.down.sql b/cloud/bmaas/bmdb/model/migrations/1672749980_backoff.down.sql
deleted file mode 100644
index 2aa3ced..0000000
--- a/cloud/bmaas/bmdb/model/migrations/1672749980_backoff.down.sql
+++ /dev/null
@@ -1,3 +0,0 @@
-DROP TABLE work_backoff;
-DROP TABLE work_history;
-DROP TYPE work_history_event;
\ No newline at end of file
diff --git a/cloud/bmaas/bmdb/model/migrations/1672749980_backoff.up.sql b/cloud/bmaas/bmdb/model/migrations/1672749980_backoff.up.sql
deleted file mode 100644
index 24f90e5..0000000
--- a/cloud/bmaas/bmdb/model/migrations/1672749980_backoff.up.sql
+++ /dev/null
@@ -1,53 +0,0 @@
-CREATE TYPE work_history_event AS ENUM (
-    'Started',
-    'Finished',
-    'Failed',
-    'Canceled'
-);
-
--- Audit trail of work history for a given machine.
-CREATE TABLE work_history(
-    -- The machine subject to this audit entry. As we want to allow keeping
-    -- information about deleted machines, this is not a foreign key.
-    machine_id UUID NOT NULL,
-
-    -- TODO(q3k): session history?
-
-    -- Process acting on this machine which caused an audit entry to be created.
-    process process NOT NULL,
-    -- Process lifecycle event (started, finished, etc) that caused this audit
-    -- entry to be created.
-    event work_history_event NOT NULL,
-    -- Time at which this entry was created.
-    timestamp TIMESTAMPTZ NOT NULL,
-
-    -- Failure cause, only set when event == Failed.
-    failed_cause STRING
-);
-
-CREATE INDEX ON work_history (machine_id);
-
--- Backoff entries are created by failed work items, and effectively act as
--- a Lockout-tagout entry for a given machine and a given process.
---
--- Currently, there is no way to fully backoff an entire machine, just
--- individual processes from a given machine.
---
--- Backoff entries are only valid as long as 'until' is before now(), after that
--- they are ignored by workflow queries. Insertion queries act as upserts,
--- and thus the backoff entries do not need to be garbage collected, as they do
--- not grow unbounded (maximumum one entry per process/machine).
-CREATE TABLE work_backoff(
-    -- The machine affected by this backoff.
-    machine_id UUID NOT NULL REFERENCES machines(machine_id) ON DELETE CASCADE,
-    -- The process that this machine should not be subjected to.
-    process process NOT NULL,
-    -- Until when the backoff is enforced.
-    until TIMESTAMPTZ NOT NULL,
-
-    -- Error reported by process/work when this backoff was inserted.
-    -- Human-readable.
-    cause STRING NOT NULL,
-
-    UNIQUE(machine_id, process)
-);
\ No newline at end of file
diff --git a/cloud/bmaas/bmdb/model/migrations/1681826233_exponential_backoff.down.sql b/cloud/bmaas/bmdb/model/migrations/1681826233_exponential_backoff.down.sql
deleted file mode 100644
index e0cea5f..0000000
--- a/cloud/bmaas/bmdb/model/migrations/1681826233_exponential_backoff.down.sql
+++ /dev/null
@@ -1,2 +0,0 @@
-ALTER TABLE work_backoff
-DROP COLUMN last_interval_seconds;
\ No newline at end of file
diff --git a/cloud/bmaas/bmdb/model/migrations/1681826233_exponential_backoff.up.sql b/cloud/bmaas/bmdb/model/migrations/1681826233_exponential_backoff.up.sql
deleted file mode 100644
index 94fd8a5..0000000
--- a/cloud/bmaas/bmdb/model/migrations/1681826233_exponential_backoff.up.sql
+++ /dev/null
@@ -1,5 +0,0 @@
--- Add interval, in seconds. This is used to calculate subsequent backoff values
--- for exponential backoffs. A future migration should make this field
--- non-nullable.
-ALTER TABLE work_backoff
-ADD COLUMN last_interval_seconds BIGINT NULL;
\ No newline at end of file
diff --git a/cloud/bmaas/bmdb/model/migrations/1681909788_extra_provider_data.down.sql b/cloud/bmaas/bmdb/model/migrations/1681909788_extra_provider_data.down.sql
deleted file mode 100644
index 986637c..0000000
--- a/cloud/bmaas/bmdb/model/migrations/1681909788_extra_provider_data.down.sql
+++ /dev/null
@@ -1,6 +0,0 @@
-ALTER TABLE machine_provided
-DROP COLUMN provider_reservation_id,
-DROP COLUMN provider_ip_address,
-DROP COLUMN provider_location,
-DROP COLUMN provider_status;
-DROP type provider_status;
diff --git a/cloud/bmaas/bmdb/model/migrations/1681909788_extra_provider_data.up.sql b/cloud/bmaas/bmdb/model/migrations/1681909788_extra_provider_data.up.sql
deleted file mode 100644
index c297e69..0000000
--- a/cloud/bmaas/bmdb/model/migrations/1681909788_extra_provider_data.up.sql
+++ /dev/null
@@ -1,44 +0,0 @@
-CREATE TYPE provider_status AS ENUM (
-    -- The provider has no idea about this machine. This likely means something
-    -- went really wrong and should be investigated.
-    'Missing',
-    -- The provider is attempting to install the initial operating system and
-    -- give us control over the machine.
-    'Provisioning',
-    -- The provider has failed to provide this machine and is not expected to
-    -- be able to provision it without deprovisioning it first.
-    'ProvisioningFailedPermanent',
-
-    -- The provider sees this machine as running/healthy and ready for use by us.
-    'Running',
-
-    -- The provider sees that machine as administratively stopped/down, but not
-    -- failed. It can be enabled / turned back on and should become Running.
-    'Stopped',
-
-    -- Any other state that we're not able to parse. Likely should be
-    -- investigated.
-    'Unknown'
-);
-
-ALTER TABLE machine_provided
--- Optional hardware reservation ID for this provider. Currently only implemented
--- for Equinix.
-ADD COLUMN provider_reservation_id STRING(128) NULL,
--- Optional 'main' IP address as seen by provider. 'Main' is provider specific,
--- but generally should be the IP address that system operators would consider
--- the primary IP address of the machine, generally the one that operators would
--- SSH into. It might be a publicly routable address or might not be. It might
--- be a single IP address or a CIDR. Regardless, it's some human-readable
--- representation of the address, and generally should not be machine-parsed.
---
--- On Equinix, we pick the first IP address marked as 'public'.
-ADD COLUMN provider_ip_address STRING(128) NULL,
--- Optional location/region as seen by provider. This is provider-specific: it
--- might be a city name, some internal metro ID, a PoP name, a slug, or even an
--- opaque string.
-ADD COLUMN provider_location STRING(128) NULL,
--- Optional status as seen by provider. This is converted from provider-specific
--- data into an internal type. This field is machine-usable and with time should
--- be moved to be non-null.
-ADD COLUMN provider_status provider_status NULL;
\ No newline at end of file
diff --git a/cloud/bmaas/bmdb/model/migrations/1681980576_extra_shepherd_processes.down.sql b/cloud/bmaas/bmdb/model/migrations/1681980576_extra_shepherd_processes.down.sql
deleted file mode 100644
index e01997f..0000000
--- a/cloud/bmaas/bmdb/model/migrations/1681980576_extra_shepherd_processes.down.sql
+++ /dev/null
@@ -1,2 +0,0 @@
--- Not removing added enum values, as the 'up' migration has 'if not exists',
--- and there is no harm in keeping unused enum values around.
\ No newline at end of file
diff --git a/cloud/bmaas/bmdb/model/migrations/1681980576_extra_shepherd_processes.up.sql b/cloud/bmaas/bmdb/model/migrations/1681980576_extra_shepherd_processes.up.sql
deleted file mode 100644
index 6e7c630..0000000
--- a/cloud/bmaas/bmdb/model/migrations/1681980576_extra_shepherd_processes.up.sql
+++ /dev/null
@@ -1,6 +0,0 @@
--- Add two more process kinds, ShepherdAgentStart and ShepherdRecovery, for agent
--- start and recovery by the shepherd respectively. These deprecate the previous
--- ShepherdAccess process. The two processes mutually exclude each other.
-
-ALTER TYPE process ADD VALUE IF NOT EXISTS 'ShepherdAgentStart';
-ALTER TYPE process ADD VALUE IF NOT EXISTS 'ShepherdRecovery';
\ No newline at end of file
diff --git a/cloud/bmaas/bmdb/model/migrations/1686656942_add_indexes.down.sql b/cloud/bmaas/bmdb/model/migrations/1686656942_add_indexes.down.sql
deleted file mode 100644
index 5828d1d..0000000
--- a/cloud/bmaas/bmdb/model/migrations/1686656942_add_indexes.down.sql
+++ /dev/null
@@ -1,3 +0,0 @@
-DROP INDEX work_backoff@process_machine_id_idx;
-DROP INDEX sessions@session_id_deadline_idx;
-DROP INDEX machine_agent_started@agent_public_key_idx;
\ No newline at end of file
diff --git a/cloud/bmaas/bmdb/model/migrations/1686656942_add_indexes.up.sql b/cloud/bmaas/bmdb/model/migrations/1686656942_add_indexes.up.sql
deleted file mode 100644
index a789e10..0000000
--- a/cloud/bmaas/bmdb/model/migrations/1686656942_add_indexes.up.sql
+++ /dev/null
@@ -1,14 +0,0 @@
--- Used by the agent gRPC server to retrieve agent information by public key.
-CREATE INDEX agent_public_key_idx
-ON machine_agent_started (agent_public_key)
-INCLUDE (agent_started_at);
-
--- Used by queries which require a live session.
-CREATE INDEX session_id_deadline_idx
-ON sessions (session_id, session_deadline)
-INCLUDE (session_component_name, session_runtime_info, session_Created_at, session_interval_seconds);
-
--- Used by work retrieval/scheduling queries to exclude machines that have a given process backed off.
-CREATE INDEX process_machine_id_idx
-ON work_backoff (process, machine_id)
-INCLUDE (until);
\ No newline at end of file
diff --git a/cloud/bmaas/bmdb/model/migrations/1687875953_add_installation_report.down.sql b/cloud/bmaas/bmdb/model/migrations/1687875953_add_installation_report.down.sql
deleted file mode 100644
index 6c2cb40..0000000
--- a/cloud/bmaas/bmdb/model/migrations/1687875953_add_installation_report.down.sql
+++ /dev/null
@@ -1,5 +0,0 @@
-ALTER TABLE machine_os_installation_report
-DROP COLUMN os_installation_result,
-DROP COLUMN os_installation_report_raw;
-
-DROP TYPE machine_os_installation_result;
diff --git a/cloud/bmaas/bmdb/model/migrations/1687875953_add_installation_report.up.sql b/cloud/bmaas/bmdb/model/migrations/1687875953_add_installation_report.up.sql
deleted file mode 100644
index 4f25589..0000000
--- a/cloud/bmaas/bmdb/model/migrations/1687875953_add_installation_report.up.sql
+++ /dev/null
@@ -1,10 +0,0 @@
-CREATE TYPE machine_os_installation_result AS ENUM (
-    'Success',
-    'Error'
-    );
-
--- Add column for storing the serialized cloud.bmaas.server.api.OSInstallationReport
--- also add a column to display if the installation was successful or not.
-ALTER TABLE machine_os_installation_report
-    ADD COLUMN os_installation_result machine_os_installation_result NOT NULL,
-    ADD COLUMN os_installation_report_raw BYTEA NOT NULL;
\ No newline at end of file
diff --git a/cloud/bmaas/bmdb/model/migrations/1698288577_add_providers.down.sql b/cloud/bmaas/bmdb/model/migrations/1698288577_add_providers.down.sql
deleted file mode 100644
index b0b22d0..0000000
--- a/cloud/bmaas/bmdb/model/migrations/1698288577_add_providers.down.sql
+++ /dev/null
@@ -1,2 +0,0 @@
-ALTER TYPE provider DROP VALUE 'Lumen';
-ALTER TYPE provider DROP VALUE 'None';
diff --git a/cloud/bmaas/bmdb/model/migrations/1698288577_add_providers.up.sql b/cloud/bmaas/bmdb/model/migrations/1698288577_add_providers.up.sql
deleted file mode 100644
index d309d7a..0000000
--- a/cloud/bmaas/bmdb/model/migrations/1698288577_add_providers.up.sql
+++ /dev/null
@@ -1,2 +0,0 @@
-ALTER TYPE provider ADD VALUE 'Lumen';
-ALTER TYPE provider ADD VALUE 'None';
diff --git a/cloud/bmaas/bmdb/model/queries_base.sql b/cloud/bmaas/bmdb/model/queries_base.sql
deleted file mode 100644
index e150fbb..0000000
--- a/cloud/bmaas/bmdb/model/queries_base.sql
+++ /dev/null
@@ -1,90 +0,0 @@
--- name: NewMachine :one
-INSERT INTO machines (
-    machine_created_at
-) VALUES (
-    now()
-)
-RETURNING *;
-
--- name: NewSession :one
-INSERT INTO sessions (
-    session_component_name, session_runtime_info, session_created_at, session_interval_seconds, session_deadline
-) VALUES (
-    $1, $2, now(), $3, (now() + $3 * interval '1 second')
-)
-RETURNING *;
-
--- name: SessionPoke :exec
--- Update a given session with a new deadline. Must be called in the same
--- transaction as SessionCheck to ensure the session is still alive.
-UPDATE sessions
-SET session_deadline = now() + session_interval_seconds * interval '1 second'
-WHERE session_id = $1;
-
--- name: SessionCheck :many
--- SessionCheck returns a session by ID if that session is still valid (ie. its
--- deadline hasn't expired).
-SELECT *
-FROM sessions
-WHERE session_id = $1
-AND session_deadline > now();
-
--- name: StartWork :exec
-INSERT INTO work (
-    machine_id, session_id, process
-) VALUES (
-    $1, $2, $3
-);
-
--- name: FinishWork :exec
-DELETE FROM work
-WHERE machine_id = $1
-  AND session_id = $2
-  AND process = $3;
-
-
--- name: WorkHistoryInsert :exec
--- Insert an entry into the work_history audit table.
-INSERT INTO work_history (
-    machine_id, process, event, timestamp, failed_cause
-) VALUES (
-    $1, $2, $3, now(), $4
-);
-
--- name: WorkBackoffInsert :exec
--- Upsert a backoff for a given machine/process.
-INSERT INTO work_backoff (
-    machine_id, process, cause, until, last_interval_seconds
-) VALUES (
-    $1, $2, $3,
-    now() + (sqlc.arg(seconds)::int * interval '1 second'),
-    sqlc.arg(seconds)::bigint
-) ON CONFLICT (machine_id, process) DO UPDATE SET
-    cause = $3,
-    until = now() + (sqlc.arg(seconds)::int * interval '1 second'),
-    last_interval_seconds = sqlc.arg(seconds)::bigint
-;
-
--- name: WorkBackoffDelete :exec
-DELETE FROM work_backoff
-WHERE machine_id = $1
-  AND process = $2;
-
--- name: WorkBackoffOf :many
-SELECT *
-FROM work_backoff
-WHERE machine_id = $1
-  AND process = $2;
-
--- name: ListHistoryOf :many
--- Retrieve full audit history of a machine.
-SELECT *
-FROM work_history
-WHERE machine_id = $1
-ORDER BY timestamp ASC;
-
--- name: GetSession :many
--- Retrieve session information by session ID.
-SELECT *
-FROM sessions
-WHERE session_id = $1;
\ No newline at end of file
diff --git a/cloud/bmaas/bmdb/model/queries_stats.sql b/cloud/bmaas/bmdb/model/queries_stats.sql
deleted file mode 100644
index d868a6c..0000000
--- a/cloud/bmaas/bmdb/model/queries_stats.sql
+++ /dev/null
@@ -1,110 +0,0 @@
--- name: CountActiveWork :many
--- Return number of active work, grouped by process.
-SELECT COUNT(*), work.process
-FROM work
-GROUP BY (work.process);
-
--- name: CountActiveBackoffs :many
--- Return number of active backoffs, grouped by process.
-SELECT COUNT(*), work_backoff.process
-FROM work_backoff
-GROUP BY (work_backoff.process);
-
--- name: CountMachines :one
-SELECT COUNT(*)
-FROM machines;
-
--- name: CountMachinesProvided :one
-SELECT COUNT(*)
-FROM machine_provided;
-
--- name: CountMachinesAgentHeartbeating :one
-SELECT COUNT(*)
-FROM machines
-    INNER JOIN machine_provided ON machines.machine_id = machine_provided.machine_id
-    INNER JOIN machine_agent_heartbeat ON machines.machine_id = machine_agent_heartbeat.machine_id
-WHERE
-    now() < machine_agent_heartbeat.agent_heartbeat_at + interval '10 minute';
-
--- name: CountMachinesInstallationPending :one
-SELECT COUNT(*)
-FROM machines
-    INNER JOIN machine_provided ON machines.machine_id = machine_provided.machine_id
-    INNER JOIN machine_os_installation_request ON machines.machine_id = machine_os_installation_request.machine_id
-    LEFT JOIN machine_os_installation_report ON machines.machine_id = machine_os_installation_report.machine_id
-WHERE
-        machine_os_installation_request.generation IS DISTINCT FROM machine_os_installation_report.generation;
-
--- name: CountMachinesInstallationComplete :one
-SELECT COUNT(*)
-FROM machines
-         INNER JOIN machine_provided ON machines.machine_id = machine_provided.machine_id
-         INNER JOIN machine_os_installation_request ON machines.machine_id = machine_os_installation_request.machine_id
-         INNER JOIN machine_os_installation_report ON machines.machine_id = machine_os_installation_report.machine_id
-WHERE
-    machine_os_installation_request.generation IS NOT DISTINCT FROM machine_os_installation_report.generation;
-
--- name: CountMachinesForAgentStart :one
--- Return number of machines eligible for agent start.
--- ONCHANGE(queries_workflows.sql): constraints must be kept in sync with GetMachinesForAgentStart.
-SELECT COUNT(machine_provided)
-FROM machines
-         INNER JOIN machine_provided ON machines.machine_id = machine_provided.machine_id
-         LEFT JOIN work ON machines.machine_id = work.machine_id AND work.process IN ('ShepherdAccess', 'ShepherdAgentStart', 'ShepherdRecovery')
-         LEFT JOIN work_backoff ON machines.machine_id = work_backoff.machine_id AND work_backoff.until > now() AND work_backoff.process = 'ShepherdAgentStart'
-         LEFT JOIN machine_agent_started ON machines.machine_id = machine_agent_started.machine_id
-         LEFT JOIN machine_os_installation_request ON machines.machine_id = machine_os_installation_request.machine_id
-         LEFT JOIN machine_os_installation_report ON machines.machine_id = machine_os_installation_report.machine_id
-WHERE
-    work.machine_id IS NULL
-    AND work_backoff.machine_id IS NULL
-    AND machine_agent_started.machine_id IS NULL
-    -- If there is a pending installation request, it must not have been fulfilled already.
-    AND (
-        machine_os_installation_request.machine_id IS NULL
-        OR machine_os_installation_report.generation IS DISTINCT FROM machine_os_installation_request.generation
-    );
-
--- name: CountMachinesForAgentRecovery :one
--- Return number of machines eligible for agent recovery.
--- ONCHANGE(queries_workflows.sql): constraints must be kept in sync with GetMachineForAgentRecovery.
-SELECT COUNT(machine_provided)
-FROM machines
-         INNER JOIN machine_provided ON machines.machine_id = machine_provided.machine_id
-         LEFT JOIN work ON machines.machine_id = work.machine_id AND work.process IN ('ShepherdAccess', 'ShepherdAgentStart', 'ShepherdRecovery')
-         LEFT JOIN work_backoff ON machines.machine_id = work_backoff.machine_id AND work_backoff.until > now() AND work_backoff.process = 'ShepherdRecovery'
-         INNER JOIN machine_agent_started ON machines.machine_id = machine_agent_started.machine_id
-         LEFT JOIN machine_agent_heartbeat ON machines.machine_id = machine_agent_heartbeat.machine_id
-         LEFT JOIN machine_os_installation_request ON machines.machine_id = machine_os_installation_request.machine_id
-         LEFT JOIN machine_os_installation_report ON machines.machine_id = machine_os_installation_report.machine_id
-WHERE
-    work.machine_id IS NULL
-    AND work_backoff.machine_id IS NULL
-    -- Only act on machines where the agent is expected to have been started:
-    -- 1. If there is a pending installation request, it must not have been fulfilled already.
-    AND (
-        machine_os_installation_request.machine_id IS NULL
-        OR machine_os_installation_report.generation IS DISTINCT FROM machine_os_installation_request.generation
-    )
-    -- 2. The agent must have never heartbeat or must have stopped heartbeating.
-    AND (
-        -- No heartbeat 30 minutes after starting the agent.
-        ( machine_agent_heartbeat.machine_id IS NULL
-          AND now() > (machine_agent_started.agent_started_at + interval '30 minutes')
-        )
-        -- Heartbeats ceased for 10 minutes.
-        OR ( machine_agent_heartbeat.machine_id IS NOT NULL
-          AND now() > (machine_agent_heartbeat.agent_heartbeat_at + interval '10 minutes')
-        )
-    );
-
--- name: ListMachineHardware :many
-SELECT
-    machine_provided.*,
-    machine_hardware_report.*
-FROM machines
-         INNER JOIN machine_provided ON machines.machine_id = machine_provided.machine_id
-         INNER JOIN machine_hardware_report ON machines.machine_id = machine_hardware_report.machine_id
-WHERE machines.machine_id > $1
-ORDER BY machines.machine_id ASC
-LIMIT $2;
diff --git a/cloud/bmaas/bmdb/model/queries_tags.sql b/cloud/bmaas/bmdb/model/queries_tags.sql
deleted file mode 100644
index 58e2d96..0000000
--- a/cloud/bmaas/bmdb/model/queries_tags.sql
+++ /dev/null
@@ -1,74 +0,0 @@
--- name: MachineAddProvided :exec
-INSERT INTO machine_provided (
-    machine_id, provider, provider_id
-) VALUES (
-    $1, $2, $3
-);
-
--- name: MachineSetAgentStarted :exec
-INSERT INTO machine_agent_started (
-    machine_id, agent_started_at, agent_public_key
-) VALUES (
-    $1, $2, $3
-) ON CONFLICT (machine_id) DO UPDATE SET
-    agent_started_at = $2,
-    agent_public_key = $3
-;
-
--- name: MachineSetAgentHeartbeat :exec
-INSERT INTO machine_agent_heartbeat (
-    machine_id, agent_heartbeat_at
-) VALUES (
-    $1, $2
-) ON CONFLICT (machine_id) DO UPDATE SET
-    agent_heartbeat_at = $2
-;
-
--- name: MachineSetHardwareReport :exec
-INSERT INTO machine_hardware_report (
-    machine_id, hardware_report_raw
-) VALUES (
-    $1, $2
-) ON CONFLICT (machine_id) DO UPDATE SET
-    hardware_report_raw = $2
-;
-
--- name: MachineSetOSInstallationRequest :exec
-INSERT INTO machine_os_installation_request (
-    machine_id, generation, os_installation_request_raw
-) VALUES (
-    $1, $2, $3
-) ON CONFLICT (machine_id) DO UPDATE SET
-    generation = $2,
-    os_installation_request_raw = $3
-;
-
--- name: MachineSetOSInstallationReport :exec
-INSERT INTO machine_os_installation_report (
-    machine_id, generation, os_installation_result, os_installation_report_raw
-) VALUES (
-    $1, $2, $3, $4
-) ON CONFLICT (machine_id) DO UPDATE SET
-    generation = $2,
-    os_installation_result = $3,
-    os_installation_report_raw = $4
-;
-
-
--- name: MachineDeleteAgentStarted :exec
-DELETE FROM machine_agent_started
-WHERE machine_id = $1;
-
--- name: MachineDeleteAgentHeartbeat :exec
-DELETE FROM machine_agent_heartbeat
-WHERE machine_id = $1;
-
--- name: MachineUpdateProviderStatus :exec
-UPDATE machine_provided
-SET
-    provider_reservation_id = COALESCE($3, provider_reservation_id),
-    provider_ip_address = COALESCE($4, provider_ip_address),
-    provider_location = COALESCE($5, provider_location),
-    provider_status = COALESCE($6, provider_status)
-WHERE provider_id = $1
-AND   provider = $2;
\ No newline at end of file
diff --git a/cloud/bmaas/bmdb/model/queries_workflows.sql b/cloud/bmaas/bmdb/model/queries_workflows.sql
deleted file mode 100644
index 49622d8..0000000
--- a/cloud/bmaas/bmdb/model/queries_workflows.sql
+++ /dev/null
@@ -1,103 +0,0 @@
--- name: GetProvidedMachines :many
-SELECT
-    machine_provided.*
-FROM machines
-INNER JOIN machine_provided ON machines.machine_id = machine_provided.machine_id
-WHERE machine_provided.provider = $1;
-
--- name: GetMachinesForAgentStart :many
--- Get machines that need agent started for the first time. Machine can be
--- assumed to be 'new', with no previous attempts or failures.
--- ONCHANGE(queries_stats.sql): constraints must be kept in sync with StatsMachinesForAgentStart.
-SELECT
-    machine_provided.*
-FROM machines
-INNER JOIN machine_provided ON machines.machine_id = machine_provided.machine_id
-LEFT JOIN work ON machines.machine_id = work.machine_id AND work.process IN ('ShepherdAccess', 'ShepherdAgentStart', 'ShepherdRecovery')
-LEFT JOIN work_backoff ON machines.machine_id = work_backoff.machine_id AND work_backoff.until > now() AND work_backoff.process = 'ShepherdAgentStart'
-LEFT JOIN machine_agent_started ON machines.machine_id = machine_agent_started.machine_id
-LEFT JOIN machine_os_installation_request ON machines.machine_id = machine_os_installation_request.machine_id
-LEFT JOIN machine_os_installation_report ON machines.machine_id = machine_os_installation_report.machine_id
-WHERE
-  machine_agent_started.machine_id IS NULL
-  -- Do not start on machines that have a fulfilled OS installation request.
-  AND (
-      machine_os_installation_request.machine_id IS NULL
-      OR machine_os_installation_request.generation IS DISTINCT FROM machine_os_installation_report.generation
-  )
-  AND work.machine_id IS NULL
-  AND work_backoff.machine_id IS NULL
-  AND machine_provided.provider = $2
-LIMIT $1;
-
--- name: GetMachineForAgentRecovery :many
--- Get machines that need agent restarted after something went wrong. Either
--- the agent started but never responded, or the agent stopped responding at
--- some point, or the machine got rebooted or somehow else lost the agent. Assume
--- some work needs to be performed on the shepherd side to diagnose and recover
--- whatever state the machine truly is in.
--- ONCHANGE(queries_stats.sql): constraints must be kept in sync with StatsMachinesForAgentRecovery.
-SELECT
-    machine_provided.*
-FROM machines
-INNER JOIN machine_provided ON machines.machine_id = machine_provided.machine_id
-LEFT JOIN work ON machines.machine_id = work.machine_id AND work.process IN ('ShepherdAccess', 'ShepherdAgentStart', 'ShepherdRecovery')
-LEFT JOIN work_backoff ON machines.machine_id = work_backoff.machine_id AND work_backoff.until > now() AND work_backoff.process = 'ShepherdRecovery'
-INNER JOIN machine_agent_started ON machines.machine_id = machine_agent_started.machine_id
-LEFT JOIN machine_agent_heartbeat ON machines.machine_id = machine_agent_heartbeat.machine_id
-LEFT JOIN machine_os_installation_request ON machines.machine_id = machine_os_installation_request.machine_id
-LEFT JOIN machine_os_installation_report ON machines.machine_id = machine_os_installation_report.machine_id AND machine_os_installation_report.os_installation_result = 'Success'
-WHERE
-  -- Do not recover machines that have a fulfilled OS installation request.
-  (
-      machine_os_installation_request.machine_id IS NULL
-      OR machine_os_installation_request.generation IS DISTINCT FROM machine_os_installation_report.generation
-  )
-  AND (
-    -- No heartbeat 30 minutes after starting the agent.
-    (
-        machine_agent_heartbeat.machine_id IS NULL
-        AND now() > (machine_agent_started.agent_started_at + interval '30 minutes')
-    )
-    -- Heartbeats ceased for 10 minutes.
-    OR (
-        machine_agent_heartbeat.machine_id IS NOT NULL
-        AND now() > (machine_agent_heartbeat.agent_heartbeat_at + interval '10 minutes')
-    )
-  )
-  AND work.machine_id IS NULL
-  AND work_backoff.machine_id IS NULL
-  AND machine_provided.provider = $2
-LIMIT $1;
-
--- name: AuthenticateAgentConnection :many
--- Used by bmdb server to verify incoming connections.
-SELECT
-    machine_agent_started.*
-FROM machines
-INNER JOIN machine_agent_started ON machines.machine_id = machine_agent_started.machine_id
-WHERE
-    machines.machine_id = $1
-    AND machine_agent_started.agent_public_key = $2;
-
--- name: GetExactMachineForOSInstallation :many
--- Get OS installation request for a given machine ID. Used by the bmdb server
--- to tell agent whether there's a pending installation request for the machine
--- it's running on.
-SELECT
-    machine_os_installation_request.*
-FROM machines
-LEFT JOIN machine_os_installation_request ON machines.machine_id = machine_os_installation_request.machine_id
-LEFT JOIN machine_os_installation_report ON machines.machine_id = machine_os_installation_report.machine_id
-WHERE
-    -- We are only interested in one concrete machine.
-    machines.machine_id = $1
-    -- We must have an installation request.
-    AND machine_os_installation_request.machine_id IS NOT NULL
-    -- And we either must have no installation report, or the installation
-    -- report's generation must not match the installation request's generation.
-    AND (
-        machine_os_installation_report.machine_id IS NULL
-        OR machine_os_installation_report.generation != machine_os_installation_request.generation
-    )
-LIMIT $2;
diff --git a/cloud/bmaas/bmdb/queries_test.go b/cloud/bmaas/bmdb/queries_test.go
deleted file mode 100644
index 917033f..0000000
--- a/cloud/bmaas/bmdb/queries_test.go
+++ /dev/null
@@ -1,279 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package bmdb
-
-import (
-	"context"
-	"fmt"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-)
-
-// TestAgentStart exercises GetMachinesForAgentStart.
-func TestAgentStart(t *testing.T) {
-	b := dut()
-	conn, err := b.Open(true)
-	if err != nil {
-		t.Fatalf("Open failed: %v", err)
-	}
-
-	ctx, ctxC := context.WithCancel(context.Background())
-	defer ctxC()
-
-	session, err := conn.StartSession(ctx)
-	if err != nil {
-		t.Fatalf("Starting session failed: %v", err)
-	}
-
-	// Create a test machine.
-	var machine model.Machine
-	err = session.Transact(ctx, func(q *model.Queries) error {
-		machine, err = q.NewMachine(ctx)
-		return err
-	})
-	if err != nil {
-		t.Fatalf("Creating machine failed: %v", err)
-	}
-
-	// It should be, by default, not a candidate for agent start as it's not yet
-	// provided by any provider.
-	expectCandidates := func(want int) {
-		t.Helper()
-		if err := session.Transact(ctx, func(q *model.Queries) error {
-			candidates, err := q.GetMachinesForAgentStart(ctx, model.GetMachinesForAgentStartParams{
-				Limit:    1,
-				Provider: model.ProviderEquinix,
-			})
-			if err != nil {
-				t.Fatalf("Could not retrieve machines for agent start: %v", err)
-			}
-			if got := len(candidates); want != got {
-				t.Fatalf("Wanted %d machines for agent start, got %+v", want, candidates)
-			}
-			return nil
-		}); err != nil {
-			t.Fatal(err)
-		}
-	}
-
-	// Provide machine, and check it is now a candidate.
-	if err := session.Transact(ctx, func(q *model.Queries) error {
-		return q.MachineAddProvided(ctx, model.MachineAddProvidedParams{
-			MachineID:  machine.MachineID,
-			Provider:   model.ProviderEquinix,
-			ProviderID: "123",
-		})
-	}); err != nil {
-		t.Fatalf("could not add provided tag to machine: %v", err)
-	}
-	expectCandidates(1)
-
-	// Add a start tag. Machine shouldn't be a candidate anymore.
-	if err := session.Transact(ctx, func(q *model.Queries) error {
-		return q.MachineSetAgentStarted(ctx, model.MachineSetAgentStartedParams{
-			MachineID:      machine.MachineID,
-			AgentStartedAt: time.Now(),
-			AgentPublicKey: []byte("fakefakefakefake"),
-		})
-	}); err != nil {
-		t.Fatalf("could not add provided tag to machine: %v", err)
-	}
-	expectCandidates(0)
-
-	// Add a new machine which has an unfulfilled installation request. It should be
-	// a candidate.
-	if err = session.Transact(ctx, func(q *model.Queries) error {
-		machine, err = q.NewMachine(ctx)
-		if err != nil {
-			return err
-		}
-		if err := q.MachineAddProvided(ctx, model.MachineAddProvidedParams{
-			MachineID:  machine.MachineID,
-			Provider:   model.ProviderEquinix,
-			ProviderID: "234",
-		}); err != nil {
-			return err
-		}
-		if err := q.MachineSetOSInstallationRequest(ctx, model.MachineSetOSInstallationRequestParams{
-			MachineID:  machine.MachineID,
-			Generation: 10,
-		}); err != nil {
-			return err
-		}
-		return nil
-	}); err != nil {
-		t.Fatalf("could not add new machine with installation request: %v", err)
-	}
-	expectCandidates(1)
-
-	// Fulfill installation request on machine with an older generation. it should
-	// remain a candidate.
-	if err = session.Transact(ctx, func(q *model.Queries) error {
-		if err := q.MachineSetOSInstallationReport(ctx, model.MachineSetOSInstallationReportParams{
-			MachineID:            machine.MachineID,
-			Generation:           9,
-			OsInstallationResult: model.MachineOsInstallationResultSuccess,
-		}); err != nil {
-			return err
-		}
-		return nil
-	}); err != nil {
-		t.Fatalf("could not fulfill installation request with older generation: %v", err)
-	}
-	expectCandidates(1)
-
-	// Fulfill installation request with correct generation. The machine should not
-	// be a candidate anymore.
-	if err = session.Transact(ctx, func(q *model.Queries) error {
-		if err := q.MachineSetOSInstallationReport(ctx, model.MachineSetOSInstallationReportParams{
-			MachineID:            machine.MachineID,
-			Generation:           10,
-			OsInstallationResult: model.MachineOsInstallationResultSuccess,
-		}); err != nil {
-			return err
-		}
-		return nil
-	}); err != nil {
-		t.Fatalf("could not fulfill installation request with current generation: %v", err)
-	}
-	expectCandidates(0)
-}
-
-// TestAgentRecovery exercises GetMachinesForAgentRecovery though a few
-// different scenarios in which a test machine is present with different tags
-// set.
-func TestAgentRecovery(t *testing.T) {
-	b := dut()
-	conn, err := b.Open(true)
-	if err != nil {
-		t.Fatalf("Open failed: %v", err)
-	}
-
-	ctx, ctxC := context.WithCancel(context.Background())
-	defer ctxC()
-
-	session, err := conn.StartSession(ctx)
-	if err != nil {
-		t.Fatalf("Starting session failed: %v", err)
-	}
-
-	for i, scenario := range []struct {
-		// Whether recovery is expected to run.
-		wantRun bool
-		// started will add a AgentStarted tag for a given time, if set.
-		started time.Time
-		// heartbeat will add a AgentHeartbeat tag for a given time, if set.
-		heartbeat time.Time
-		// requestGeneration will populate a OSInstallationRequest if not zero.
-		requestGeneration int64
-		// requestGeneration will populate a OSInstallationResponse if not zero.
-		reportGeneration int64
-	}{
-		// No start, no heartbeat -> no recovery expected.
-		{false, time.Time{}, time.Time{}, 0, 0},
-		// Started recently, no heartbeat -> no recovery expected.
-		{false, time.Now(), time.Time{}, 0, 0},
-		// Started a while ago, heartbeat active -> no recovery expected.
-		{false, time.Now().Add(-40 * time.Minute), time.Now(), 0, 0},
-
-		// Started a while ago, no heartbeat -> recovery expected.
-		{true, time.Now().Add(-40 * time.Minute), time.Time{}, 0, 0},
-		// Started a while ago, no recent heartbeat -> recovery expected.
-		{true, time.Now().Add(-40 * time.Minute), time.Now().Add(-20 * time.Minute), 0, 0},
-
-		// Installation request without report -> recovery expected.
-		{true, time.Now().Add(-40 * time.Minute), time.Time{}, 10, 0},
-		{true, time.Now().Add(-40 * time.Minute), time.Now().Add(-20 * time.Minute), 10, 0},
-		// Installation request mismatching report -> recovery expected.
-		{true, time.Now().Add(-40 * time.Minute), time.Time{}, 10, 9},
-		{true, time.Now().Add(-40 * time.Minute), time.Now().Add(-20 * time.Minute), 10, 9},
-		// Installation request matching report -> no recovery expected.
-		{false, time.Now().Add(-40 * time.Minute), time.Time{}, 10, 10},
-		{false, time.Now().Add(-40 * time.Minute), time.Now().Add(-20 * time.Minute), 10, 10},
-	} {
-		var machineID uuid.UUID
-		if err := session.Transact(ctx, func(q *model.Queries) error {
-			machine, err := q.NewMachine(ctx)
-			if err != nil {
-				return fmt.Errorf("NewMachine: %w", err)
-			}
-			machineID = machine.MachineID
-			if err := q.MachineAddProvided(ctx, model.MachineAddProvidedParams{
-				MachineID:  machine.MachineID,
-				Provider:   model.ProviderEquinix,
-				ProviderID: fmt.Sprintf("test-%d", i),
-			}); err != nil {
-				return fmt.Errorf("MachineAddProvided: %w", err)
-			}
-			if !scenario.started.IsZero() {
-				if err := q.MachineSetAgentStarted(ctx, model.MachineSetAgentStartedParams{
-					MachineID:      machine.MachineID,
-					AgentStartedAt: scenario.started,
-					AgentPublicKey: []byte("fake"),
-				}); err != nil {
-					return fmt.Errorf("MachineSetAgentStarted: %w", err)
-				}
-			}
-			if !scenario.heartbeat.IsZero() {
-				if err := q.MachineSetAgentHeartbeat(ctx, model.MachineSetAgentHeartbeatParams{
-					MachineID:        machine.MachineID,
-					AgentHeartbeatAt: scenario.heartbeat,
-				}); err != nil {
-					return fmt.Errorf("MachineSetAgentHeartbeat: %w", err)
-				}
-			}
-			if scenario.requestGeneration != 0 {
-				if err := q.MachineSetOSInstallationRequest(ctx, model.MachineSetOSInstallationRequestParams{
-					MachineID:  machine.MachineID,
-					Generation: scenario.requestGeneration,
-				}); err != nil {
-					return fmt.Errorf("MachineSetOSInstallationRequest: %w", err)
-				}
-			}
-			if scenario.reportGeneration != 0 {
-				if err := q.MachineSetOSInstallationReport(ctx, model.MachineSetOSInstallationReportParams{
-					MachineID:            machine.MachineID,
-					Generation:           scenario.reportGeneration,
-					OsInstallationResult: model.MachineOsInstallationResultSuccess,
-				}); err != nil {
-					return fmt.Errorf("MachineSetOSInstallationReport: %w", err)
-				}
-			}
-			return nil
-		}); err != nil {
-			t.Errorf("%d: setup failed: %v", i, err)
-			continue
-		}
-
-		found := false
-		if err := session.Transact(ctx, func(q *model.Queries) error {
-			candidates, err := q.GetMachineForAgentRecovery(ctx, model.GetMachineForAgentRecoveryParams{
-				Limit:    100,
-				Provider: model.ProviderEquinix,
-			})
-			if err != nil {
-				return fmt.Errorf("GetMachinesForAgentRecovery: %w", err)
-			}
-			for _, c := range candidates {
-				if c.MachineID == machineID {
-					found = true
-					break
-				}
-			}
-			return nil
-		}); err != nil {
-			t.Errorf("%d: failed to retrieve candidates: %v", i, err)
-		}
-		if scenario.wantRun && !found {
-			t.Errorf("%d: expected recovery but not scheduled", i)
-		}
-		if !scenario.wantRun && found {
-			t.Errorf("%d: expected no recovery but is scheduled", i)
-		}
-	}
-}
diff --git a/cloud/bmaas/bmdb/reflection/BUILD.bazel b/cloud/bmaas/bmdb/reflection/BUILD.bazel
deleted file mode 100644
index 0922542..0000000
--- a/cloud/bmaas/bmdb/reflection/BUILD.bazel
+++ /dev/null
@@ -1,22 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-
-go_library(
-    name = "reflection",
-    srcs = [
-        "reflection.go",
-        "schema.go",
-    ],
-    importpath = "source.monogon.dev/cloud/bmaas/bmdb/reflection",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//cloud/bmaas/server/api",
-        "@com_github_google_uuid//:uuid",
-        "@com_github_iancoleman_strcase//:strcase",
-        "@io_k8s_klog_v2//:klog",
-        "@org_golang_google_protobuf//encoding/prototext",
-        "@org_golang_google_protobuf//proto",
-        "@org_golang_google_protobuf//reflect/protopath",
-        "@org_golang_google_protobuf//reflect/protorange",
-        "@org_golang_google_protobuf//reflect/protoreflect",
-    ],
-)
diff --git a/cloud/bmaas/bmdb/reflection/reflection.go b/cloud/bmaas/bmdb/reflection/reflection.go
deleted file mode 100644
index 0976905..0000000
--- a/cloud/bmaas/bmdb/reflection/reflection.go
+++ /dev/null
@@ -1,499 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-// Package reflection implements facilities to retrieve information about the
-// implemented Tags and their types from a plain CockroachDB SQL connection,
-// bypassing the queries/types defined in models. Then, the retrieved Schema can
-// be used to retrieve information about machines.
-//
-// This is designed to be used in debugging facilities to allow arbitrary machine
-// introspection. It must _not_ be used in the user path, as the schema
-// extraction functionality is implemented best-effort.
-package reflection
-
-import (
-	"context"
-	"database/sql"
-	"encoding/hex"
-	"fmt"
-	"sort"
-	"strings"
-	"time"
-
-	"k8s.io/klog/v2"
-
-	"github.com/google/uuid"
-	"google.golang.org/protobuf/encoding/prototext"
-	"google.golang.org/protobuf/proto"
-	"google.golang.org/protobuf/reflect/protopath"
-	"google.golang.org/protobuf/reflect/protorange"
-)
-
-// GetMachinesOpts influences the behaviour of GetMachines.
-type GetMachinesOpts struct {
-	// FilterMachine, if set, will only retrieve information about the machine with
-	// the given UUID. In case the given machine UUID does not exist in the database,
-	// an empty result will be returned and _no_ error will be set.
-	FilterMachine *uuid.UUID
-	// Strict enables strict consistency. This is not recommended for use when
-	// retrieving all machines, as such queries will compete against all currently
-	// running operations. When not enabled, the retrieval will be executed AS OF
-	// SYSTEM TIME follower_timestamp(), meaning the data might be a few seconds out
-	// of date. Regardless of the option, the returned machine data will be
-	// internally consistent, even across machines - but when not enabled the data
-	// might be stale.
-	Strict bool
-	// ExpiredBackoffs enables the retrieval of information about all machine
-	// backoffs, including expired backoff. Note that expired backoffs might be
-	// garbage collected in the future, and their long-term storage is not
-	// guaranteed.
-	ExpiredBackoffs bool
-}
-
-// GetMachines retrieves all available BMDB data about one or more machines. The
-// Schema's embedded SQL connection is used to performed the retrieval.
-//
-// Options can be specified to influenced the exact operation performed. By
-// default (with a zeroed structure or nil pointer), all machines with active
-// backoffs are retrieved with weak consistency. See GetMachineOpts to influence
-// this behaviour.
-func (r *Schema) GetMachines(ctx context.Context, opts *GetMachinesOpts) (*Reflected[[]*Machine], error) {
-	if opts == nil {
-		opts = &GetMachinesOpts{}
-	}
-
-	// We're about to build a pretty big SELECT query with a ton of joins.
-	//
-	// First, we join against work_backoff and work to get information about active
-	// work and backoffs on the machines we're retrieving.
-	//
-	// Second, we join against all the tags that are declared in the schema.
-
-	// These are the colums we'll SELECT <...> FROM
-	columns := []string{
-		"machines.machine_id",
-		"machines.machine_created_at",
-		"work_backoff.process",
-		"work_backoff.cause",
-		"work_backoff.until",
-		"work.process",
-		"work.session_id",
-		// ... tag columns will come after this.
-	}
-	// These are tha args we'll pass to the query.
-	var args []any
-
-	// Start building joins. First, against work_backoff and work.
-	backoffFilter := " AND work_backoff.until > now()"
-	if opts.ExpiredBackoffs {
-		backoffFilter = ""
-	}
-	joins := []string{
-		"LEFT JOIN work_backoff ON machines.machine_id = work_backoff.machine_id" + backoffFilter,
-		"LEFT JOIN work ON machines.machine_id = work.machine_id",
-	}
-
-	// Then, against tags. Also populate columns as we go along.
-	for _, tagType := range r.TagTypes {
-		joins = append(joins, fmt.Sprintf("LEFT JOIN %s ON machines.machine_id = %s.machine_id", tagType.NativeName, tagType.NativeName))
-		columns = append(columns, fmt.Sprintf("%s.machine_id", tagType.NativeName))
-		for _, fieldType := range tagType.Fields {
-			columns = append(columns, fmt.Sprintf("%s.%s", tagType.NativeName, fieldType.NativeName))
-		}
-	}
-
-	// Finalize query.
-	q := []string{
-		"SELECT",
-		strings.Join(columns, ", "),
-		"FROM machines",
-	}
-	q = append(q, joins...)
-	if !opts.Strict {
-		q = append(q, "AS OF SYSTEM TIME follower_read_timestamp()")
-	}
-	if opts.FilterMachine != nil {
-		q = append(q, "WHERE machines.machine_id = $1")
-		args = append(args, *opts.FilterMachine)
-	}
-	q = append(q, "ORDER BY machines.machine_id")
-
-	rows, err := r.db.QueryContext(ctx, strings.Join(q, "\n"), args...)
-	if err != nil {
-		return nil, fmt.Errorf("query failed: %w", err)
-	}
-	defer rows.Close()
-
-	// Okay, we can start scanning the result rows.
-	//
-	// As this is a complex join, we need to merge some rows together and discard
-	// some NULLs. We do merging/deduplication using machine_id values for the
-	// machine data, and abuse UNIQUE constraints in the work_backoff/work tables to
-	// deduplicate these.
-	//
-	// The alternative would be to rewrite this query to use array_agg, and we might
-	// do that at some point. This is only really a problem if we
-	// have _a lot_ of active work/backoffs (as that effectively duplicates all
-	// machine/tag data), which isn't the case yet. But we should keep an eye out for
-	// this.
-
-	var machines []*Machine
-	for rows.Next() {
-
-		// We need to scan this row back into columns. For constant columns we'll just
-		// create the data here and refer to it later.
-		var dests []any
-
-		// Add non-tag always-retrieved constants.
-		var mid uuid.UUID
-		var machineCreated time.Time
-		var workSession uuid.NullUUID
-		var backoffProcess, backoffCause, workProcess sql.NullString
-		var backoffUntil sql.NullTime
-
-		dests = append(dests, &mid, &machineCreated, &backoffProcess, &backoffCause, &backoffUntil, &workProcess, &workSession)
-
-		// For dynamic data, we need to keep a reference to a list of columns that are
-		// part of tags, and then refer to them later. We can't just refer back to dests
-		// as the types are erased into `any`. scannedTags is that data storage.
-		type scannedTag struct {
-			ty     *TagType
-			id     uuid.NullUUID
-			fields []*TagField
-		}
-		var scannedTags []*scannedTag
-		for _, tagType := range r.TagTypes {
-			tagType := tagType
-			st := scannedTag{
-				ty: &tagType,
-			}
-			scannedTags = append(scannedTags, &st)
-			dests = append(dests, &st.id)
-			for _, fieldType := range tagType.Fields {
-				fieldType := fieldType
-				field := TagField{
-					Type: &fieldType,
-				}
-				dests = append(dests, &field)
-				st.fields = append(st.fields, &field)
-
-			}
-		}
-
-		if err := rows.Scan(dests...); err != nil {
-			return nil, fmt.Errorf("scan failed: %w", err)
-		}
-
-		// Now comes the merging/deduplication.
-
-		// First, check if we are processing a new machine. If so, create a new
-		// Machine. Otherwise, pick up the previous one.
-		var machine *Machine
-		if len(machines) == 0 || machines[len(machines)-1].ID.String() != mid.String() {
-			// New machine or no machine yet.
-			machine = &Machine{
-				ID:       mid,
-				Created:  machineCreated,
-				Tags:     make(map[string]*Tag),
-				Backoffs: make(map[string]Backoff),
-				Work:     make(map[string]Work),
-			}
-
-			// Collect tags into machine.
-			for _, st := range scannedTags {
-				if !st.id.Valid {
-					continue
-				}
-				var fields []TagField
-				for _, f := range st.fields {
-					fields = append(fields, *f)
-				}
-				machine.Tags[st.ty.Name()] = &Tag{
-					Type:   st.ty,
-					Fields: fields,
-				}
-			}
-			machines = append(machines, machine)
-		} else {
-			// Continue previous machine.
-			machine = machines[len(machines)-1]
-		}
-
-		// Do we have a backoff? Upsert it to the machine. This works because there's a
-		// UNIQUE(machine_id, process) constraint on the work_backoff table, and we're
-		// effectively rebuilding that keyspace here by indexing first by machine then by
-		// process.
-		if backoffCause.Valid && backoffProcess.Valid && backoffUntil.Valid {
-			process := backoffProcess.String
-			machine.Backoffs[process] = Backoff{
-				Cause:   backoffCause.String,
-				Process: process,
-				Until:   backoffUntil.Time,
-			}
-		}
-
-		// Do we have an active work item? Upsert it to the machine. Same UNIQUE
-		// constraint abuse happening here.
-		if workProcess.Valid && workSession.Valid {
-			process := workProcess.String
-			machine.Work[process] = Work{
-				SessionID: workSession.UUID,
-				Process:   process,
-			}
-		}
-	}
-
-	return &Reflected[[]*Machine]{
-		Data:  machines,
-		Query: strings.Join(q, " "),
-	}, nil
-}
-
-// Reflected wraps data retrieved by reflection (T) with metadata about the
-// retrieval.
-type Reflected[T any] struct {
-	Data T
-	// Effective SQL query performed on the database.
-	Query string
-}
-
-// Machine retrieved from BMDB.
-type Machine struct {
-	ID      uuid.UUID
-	Created time.Time
-
-	// Tags on this machine, keyed by Tag type name (canonical, not native).
-	Tags map[string]*Tag
-
-	// Backoffs on this machine, keyed by process name. By default these are only
-	// active backoffs, unless ExpiredBackoffs was set on GetMachineOptions.
-	Backoffs map[string]Backoff
-
-	// Work active on this machine, keyed by process name.
-	Work map[string]Work
-}
-
-// ActiveBackoffs retrieves a copy of a Machine's active backoffs. Note: the
-// expiration check is performed according tu current system time, so it might
-// not be consistent with the data snapshot retrieved from the database.
-func (r *Machine) ActiveBackoffs() []*Backoff {
-	var res []*Backoff
-	for _, bo := range r.Backoffs {
-		bo := bo
-		if !bo.Active() {
-			continue
-		}
-		res = append(res, &bo)
-	}
-	sort.Slice(res, func(i, j int) bool { return res[i].Process < res[j].Process })
-	return res
-}
-
-// ExpiredBackoffs retrieves a copy of a Machine's expired backoffs. Note: the
-// expiration check is performed according tu current system time, so it might
-// not be consistent with the data snapshot retrieved from the database.
-func (r *Machine) ExpiredBackoffs() []*Backoff {
-	var res []*Backoff
-	for _, bo := range r.Backoffs {
-		bo := bo
-		if bo.Active() {
-			continue
-		}
-		res = append(res, &bo)
-	}
-	sort.Slice(res, func(i, j int) bool { return res[i].Process < res[j].Process })
-	return res
-}
-
-// Tag value set on a Machine.
-type Tag struct {
-	// Type describing this tag.
-	Type *TagType
-	// Field data contained in this tag, sorted alphabetically by name.
-	Fields []TagField
-}
-
-// Field is a shorthand for returning a TagField by its name.
-func (r *Tag) Field(name string) *TagField {
-	for _, f := range r.Fields {
-		if f.Type.NativeName == name {
-			return &f
-		}
-	}
-	return nil
-}
-
-// DisplayOption is an opaque argument used to influence the display style of a
-// tag value when returned from HumanValue.
-type DisplayOption string
-
-const (
-	// DisplaySingleLine limits display to a single line (i.e. don't try to
-	// pretty-print long values by inserting newlines and indents).
-	DisplaySingleLine DisplayOption = "single-line"
-)
-
-func (r *Tag) HumanValue(opts ...DisplayOption) string {
-	var kvs []string
-	for _, field := range r.Fields {
-		kvs = append(kvs, fmt.Sprintf("%s: %s", field.Type.NativeName, field.HumanValue(opts...)))
-	}
-	return strings.Join(kvs, ", ")
-}
-
-// TagField value which is part of a Tag set on a Machine.
-type TagField struct {
-	// Type describing this field.
-	Type *TagFieldType
-
-	text  *string
-	bytes *[]byte
-	time  *time.Time
-	proto proto.Message
-}
-
-// HumanValue returns a human-readable (best effort) representation of the field
-// value.
-func (r *TagField) HumanValue(opts ...DisplayOption) string {
-	switch {
-	case r.proto != nil:
-		mopts := prototext.MarshalOptions{
-			Multiline: true,
-			Indent:    "\t",
-		}
-		for _, opt := range opts {
-			if opt == DisplaySingleLine {
-				mopts.Multiline = false
-			}
-		}
-		return mopts.Format(r.proto)
-	case r.text != nil:
-		return *r.text
-	case r.bytes != nil:
-		return hex.EncodeToString(*r.bytes)
-	case r.time != nil:
-		return r.time.String()
-	default:
-		return "<unknown>"
-	}
-}
-
-// Index attempts to index into a structured tag field (currently only protobuf
-// fields) by a 'field.subfield.subsubfield' selector.
-//
-// The selector for Protobuf fields follows the convention from 'protorange',
-// which is a semi-standardized format used in the Protobuf ecosystem. See
-// https://pkg.go.dev/google.golang.org/protobuf/reflect/protorange for more
-// details.
-//
-// An error will be returned if the TagField is not a protobuf field or if the
-// given selector does not point to a known message field.
-func (r *TagField) Index(k string) (string, error) {
-	if r.Type.ProtoType == nil {
-		return "", fmt.Errorf("can only index proto fields")
-	}
-	k = fmt.Sprintf("(%s).%s", r.Type.ProtoType.Descriptor().FullName(), k)
-
-	var res string
-	var found bool
-	ref := r.proto.ProtoReflect()
-	protorange.Range(ref, func(values protopath.Values) error {
-		if values.Path.String() == k {
-			res = values.Index(-1).Value.String()
-			found = true
-		}
-		return nil
-	})
-
-	if !found {
-		return "", fmt.Errorf("protobuf field not found")
-	}
-	return res, nil
-}
-
-// Backoff on a Machine.
-type Backoff struct {
-	// Process which established Backoff.
-	Process string
-	// Time when Backoff expires.
-	Until time.Time
-	// Cause for the Backoff as emitted by worker.
-	Cause string
-}
-
-// Active returns whether this Backoff is _currently_ active per the _local_ time.
-func (r Backoff) Active() bool {
-	return time.Now().Before(r.Until)
-}
-
-// Work being actively performed on a Machine.
-type Work struct {
-	// SessionID of the worker performing this Work.
-	SessionID uuid.UUID
-	// Process name of this Work.
-	Process string
-}
-
-// Scan implements sql.Scanner for direct scanning of query results into a
-// reflected tag value. This method is not meant to by used outside the
-// reflection package.
-func (r *TagField) Scan(src any) error {
-	if src == nil {
-		return nil
-	}
-
-	switch r.Type.NativeType {
-	case "text":
-		src2, ok := src.(string)
-		if !ok {
-			return fmt.Errorf("SQL type %q, but got %+v", r.Type.NativeType, src)
-		}
-		r.text = &src2
-	case "bytea":
-		src2, ok := src.([]byte)
-		if !ok {
-			return fmt.Errorf("SQL type %q, but got %+v", r.Type.NativeType, src)
-		}
-		// Copy the bytes, as they are otherwise going to be reused by the pq library.
-		copied := make([]byte, len(src2))
-		copy(copied[:], src2)
-		r.bytes = &copied
-
-		if r.Type.ProtoType != nil {
-			msg := r.Type.ProtoType.New().Interface()
-			err := proto.Unmarshal(*r.bytes, msg)
-			if err != nil {
-				klog.Warningf("Could not unmarshal %s: %v", r.Type.NativeName, err)
-			} else {
-				r.proto = msg
-			}
-		}
-	case "USER-DEFINED":
-		switch r.Type.NativeUDTName {
-		case "provider", "provider_status":
-			src2, ok := src.([]byte)
-			if !ok {
-				return fmt.Errorf("SQL type %q, but got %+v", r.Type.NativeType, src)
-			}
-			src3 := string(src2)
-			r.text = &src3
-		}
-	case "timestamp with time zone":
-		src2, ok := src.(time.Time)
-		if !ok {
-			return fmt.Errorf("SQL type %q, but got %+v", r.Type.NativeType, src)
-		}
-		r.time = &src2
-	case "bigint":
-		src2, ok := src.(int64)
-		if !ok {
-			return fmt.Errorf("SQL type %q, but got %+v", r.Type.NativeType, src)
-		}
-		src3 := fmt.Sprintf("%d", src2)
-		r.text = &src3
-	default:
-		return fmt.Errorf("unimplemented SQL type %q", r.Type.NativeType)
-	}
-
-	return nil
-}
diff --git a/cloud/bmaas/bmdb/reflection/schema.go b/cloud/bmaas/bmdb/reflection/schema.go
deleted file mode 100644
index bceb931..0000000
--- a/cloud/bmaas/bmdb/reflection/schema.go
+++ /dev/null
@@ -1,200 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package reflection
-
-import (
-	"context"
-	"database/sql"
-	"fmt"
-	"strings"
-
-	"github.com/iancoleman/strcase"
-	"google.golang.org/protobuf/proto"
-	"google.golang.org/protobuf/reflect/protoreflect"
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/bmaas/server/api"
-)
-
-// Schema contains information about the tag types in a BMDB. It also contains an
-// active connection to the BMDB, allowing retrieval of data based on the
-// detected schema.
-//
-// It also contains an embedded connection to the CockroachDB database backing
-// this BMDB which is then used to retrieve data described by this schema.
-type Schema struct {
-	// TagTypes is the list of tag types extracted from the BMDB.
-	TagTypes []TagType
-	// Version is the go-migrate schema version of the BMDB this schema was extracted
-	// from. By convention, it is a stringified base-10 number representing the number
-	// of seconds since UNIX epoch of when the migration version was created, but
-	// this is not guaranteed.
-	Version string
-
-	db *sql.DB
-}
-
-// TagType describes the type of a BMDB Tag. Each tag in turn corresponds to a
-// CockroachDB database.
-type TagType struct {
-	// NativeName is the name of the table that holds tags of this type.
-	NativeName string
-	// Fields are the types of fields contained in this tag type.
-	Fields []TagFieldType
-}
-
-// Name returns the canonical name of this tag type. For example, a table named
-// machine_agent_started will have a canonical name AgentStarted.
-func (r *TagType) Name() string {
-	tableSuffix := strings.TrimPrefix(r.NativeName, "machine_")
-	parts := strings.Split(tableSuffix, "_")
-	// Capitalize some known acronyms.
-	for i, p := range parts {
-		parts[i] = strings.ReplaceAll(p, "os", "OS")
-	}
-	return strcase.ToCamel(strings.Join(parts, "_"))
-}
-
-// TagFieldType is the type of a field within a BMDB Tag. Each tag field in turn
-// corresponds to a column inside its Tag table.
-type TagFieldType struct {
-	// NativeName is the name of the column that holds this field type. It is also
-	// the canonical name of the field type.
-	NativeName string
-	// NativeType is the CockroachDB type name of this field.
-	NativeType string
-	// NativeUDTName is the CockroachDB user-defined-type name of this field. This is
-	// only valid if NativeType is 'USER-DEFINED'.
-	NativeUDTName string
-	// ProtoType is set non-nil if the field is a serialized protobuf of the same
-	// type as the given protoreflect.Message.
-	ProtoType protoreflect.Message
-}
-
-// knownProtoFields is a mapping from column name of a field containing a
-// serialized protobuf to an instance of a proto.Message that will be used to
-// parse that column's data.
-//
-// Just mapping from column name is fine enough for now as we have mostly unique
-// column names, and these column names uniquely map to a single type.
-var knownProtoFields = map[string]proto.Message{
-	"hardware_report_raw":         &api.AgentHardwareReport{},
-	"os_installation_request_raw": &api.OSInstallationRequest{},
-	"os_installation_report_raw":  &api.OSInstallationReport{},
-}
-
-// HumanType returns a human-readable representation of the field's type. This is
-// not well-defined, and should be used only informatively.
-func (r *TagFieldType) HumanType() string {
-	if r.ProtoType != nil {
-		return string(r.ProtoType.Descriptor().FullName())
-	}
-	switch r.NativeType {
-	case "USER-DEFINED":
-		return r.NativeUDTName
-	case "timestamp with time zone":
-		return "timestamp"
-	case "bytea":
-		return "bytes"
-	case "bigint":
-		return "int"
-	default:
-		return r.NativeType
-	}
-}
-
-// Reflect builds a runtime BMDB schema from a raw SQL connection to the BMDB
-// database. You're probably looking for bmdb.Connection.Reflect.
-func Reflect(ctx context.Context, db *sql.DB) (*Schema, error) {
-	// Get all tables in the currently connected to database.
-	rows, err := db.QueryContext(ctx, `
-		SELECT table_name
-		FROM information_schema.tables
-		WHERE table_catalog = current_database()
-          AND table_schema = 'public'
-          AND table_name LIKE 'machine\_%'
-	`)
-	if err != nil {
-		return nil, fmt.Errorf("could not query table names: %w", err)
-	}
-	defer rows.Close()
-
-	// Collect all table names for further processing.
-	var tableNames []string
-	for rows.Next() {
-		var name string
-		if err := rows.Scan(&name); err != nil {
-			return nil, fmt.Errorf("table name scan failed: %w", err)
-		}
-		tableNames = append(tableNames, name)
-	}
-
-	// Start processing each table into a TagType.
-	tags := make([]TagType, 0, len(tableNames))
-	for _, tagName := range tableNames {
-		// Get all columns of the table.
-		rows, err := db.QueryContext(ctx, `
-			SELECT column_name, data_type, udt_name
-			FROM information_schema.columns
-		    WHERE table_catalog = current_database()
-			  AND table_schema = 'public'
-		      AND table_name = $1
-		`, tagName)
-		if err != nil {
-			return nil, fmt.Errorf("could not query columns: %w", err)
-		}
-
-		tag := TagType{
-			NativeName: tagName,
-		}
-
-		// Build field types from columns.
-		foundMachineID := false
-		for rows.Next() {
-			var column_name, data_type, udt_name string
-			if err := rows.Scan(&column_name, &data_type, &udt_name); err != nil {
-				rows.Close()
-				return nil, fmt.Errorf("column scan failed: %w", err)
-			}
-			if column_name == "machine_id" {
-				foundMachineID = true
-				continue
-			}
-			field := TagFieldType{
-				NativeName:    column_name,
-				NativeType:    data_type,
-				NativeUDTName: udt_name,
-			}
-			if t, ok := knownProtoFields[column_name]; ok {
-				field.ProtoType = t.ProtoReflect()
-			}
-			tag.Fields = append(tag.Fields, field)
-		}
-
-		// Make sure there's a machine_id key in the table, then remove it.
-		if !foundMachineID {
-			klog.Warningf("Table %q has no machine_id column, skipping", tag.NativeName)
-			continue
-		}
-
-		tags = append(tags, tag)
-	}
-
-	// Retrieve version information from go-migrate's schema_migrations table.
-	var version string
-	var dirty bool
-	if err := db.QueryRowContext(ctx, "SELECT version, dirty FROM schema_migrations").Scan(&version, &dirty); err != nil {
-		return nil, fmt.Errorf("could not select schema version: %w", err)
-	}
-	if dirty {
-		version += " DIRTY!!!"
-	}
-
-	return &Schema{
-		TagTypes: tags,
-		Version:  version,
-
-		db: db,
-	}, nil
-}
diff --git a/cloud/bmaas/bmdb/reflection_test.go b/cloud/bmaas/bmdb/reflection_test.go
deleted file mode 100644
index 17abc9d..0000000
--- a/cloud/bmaas/bmdb/reflection_test.go
+++ /dev/null
@@ -1,300 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package bmdb
-
-import (
-	"context"
-	"fmt"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-	"google.golang.org/protobuf/proto"
-
-	apb "source.monogon.dev/cloud/agent/api"
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/cloud/bmaas/bmdb/reflection"
-	"source.monogon.dev/cloud/bmaas/server/api"
-)
-
-// TestReflection exercises the BMDB reflection schema reflection and data
-// retrieval code. Ideally this code would live in //cloud/bmaas/bmdb/reflection,
-// but due to namespacing issues it lives here.
-func TestReflection(t *testing.T) {
-	b := dut()
-	conn, err := b.Open(true)
-	if err != nil {
-		t.Fatalf("Open failed: %v", err)
-	}
-
-	ctx, ctxC := context.WithCancel(context.Background())
-	defer ctxC()
-
-	sess, err := conn.StartSession(ctx)
-	if err != nil {
-		t.Fatalf("StartSession: %v", err)
-	}
-
-	// Create 10 test machines.
-	var mids []uuid.UUID
-	err = sess.Transact(ctx, func(q *model.Queries) error {
-		for i := 0; i < 10; i += 1 {
-			mach, err := q.NewMachine(ctx)
-			if err != nil {
-				return err
-			}
-			err = q.MachineAddProvided(ctx, model.MachineAddProvidedParams{
-				MachineID:  mach.MachineID,
-				Provider:   model.ProviderEquinix,
-				ProviderID: fmt.Sprintf("test-%d", i),
-			})
-			if err != nil {
-				return err
-			}
-			mids = append(mids, mach.MachineID)
-		}
-		return nil
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	// Start and fail work on one of the machines with an hour long backoff.
-	w, err := sess.Work(ctx, model.ProcessUnitTest1, func(q *model.Queries) ([]uuid.UUID, error) {
-		return mids[0:1], nil
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	backoff := Backoff{
-		Initial: time.Hour,
-	}
-	w.Fail(ctx, &backoff, "failure test")
-
-	// On another machine, create a failure with a 1 second backoff.
-	w, err = sess.Work(ctx, model.ProcessUnitTest1, func(q *model.Queries) ([]uuid.UUID, error) {
-		return mids[1:2], nil
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	backoff = Backoff{
-		Initial: time.Second,
-	}
-	w.Fail(ctx, &backoff, "failure test")
-	// Later on in the test we must wait for this backoff to actually elapse. Start
-	// counting now.
-	elapsed := time.NewTicker(time.Second * 1)
-	defer elapsed.Stop()
-
-	// On another machine, create work and don't finish it yet.
-	_, err = sess.Work(ctx, model.ProcessUnitTest1, func(q *model.Queries) ([]uuid.UUID, error) {
-		return mids[2:3], nil
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	schema, err := conn.Reflect(ctx)
-	if err != nil {
-		t.Fatalf("ReflectTagTypes: %v", err)
-	}
-
-	// Dump all in strict mode.
-	opts := &reflection.GetMachinesOpts{
-		Strict: true,
-	}
-	res, err := schema.GetMachines(ctx, opts)
-	if err != nil {
-		t.Fatalf("Dump failed: %v", err)
-	}
-	if res.Query == "" {
-		t.Errorf("Query not set on result")
-	}
-	machines := res.Data
-	if want, got := 10, len(machines); want != got {
-		t.Fatalf("Expected %d machines in dump, got %d", want, got)
-	}
-
-	// Expect Provided tag on all machines. Do a detailed check on fields, too.
-	for _, machine := range machines {
-		tag, ok := machine.Tags["Provided"]
-		if !ok {
-			t.Errorf("No Provided tag on machine.")
-			continue
-		}
-		if want, got := "Provided", tag.Type.Name(); want != got {
-			t.Errorf("Provided tag should have type %q, got %q", want, got)
-		}
-		if provider := tag.Field("provider"); provider != nil {
-			if want, got := provider.HumanValue(), "Equinix"; want != got {
-				t.Errorf("Wanted Provided.provider value %q, got %q", want, got)
-			}
-		} else {
-			t.Errorf("Provider tag has no provider field")
-		}
-		if providerId := tag.Field("provider_id"); providerId != nil {
-			if !strings.HasPrefix(providerId.HumanValue(), "test-") {
-				t.Errorf("Unexpected provider_id value %q", providerId.HumanValue())
-			}
-		} else {
-			t.Errorf("Provider tag has no provider_id field")
-		}
-	}
-
-	// Now just dump one machine.
-	opts.FilterMachine = &mids[0]
-	res, err = schema.GetMachines(ctx, opts)
-	if err != nil {
-		t.Fatalf("Dump failed: %v", err)
-	}
-	machines = res.Data
-	if want, got := 1, len(machines); want != got {
-		t.Fatalf("Expected %d machines in dump, got %d", want, got)
-	}
-	if want, got := mids[0].String(), machines[0].ID.String(); want != got {
-		t.Fatalf("Expected machine %s, got %s", want, got)
-	}
-
-	// Now dump a machine that doesn't exist. That should just return an empty list.
-	fakeMid := uuid.New()
-	opts.FilterMachine = &fakeMid
-	res, err = schema.GetMachines(ctx, opts)
-	if err != nil {
-		t.Fatalf("Dump failed: %v", err)
-	}
-	machines = res.Data
-	if want, got := 0, len(machines); want != got {
-		t.Fatalf("Expected %d machines in dump, got %d", want, got)
-	}
-
-	// Finally, check the special case machines. The first one should have an active
-	// backoff.
-	opts.FilterMachine = &mids[0]
-	res, err = schema.GetMachines(ctx, opts)
-	if err != nil {
-		t.Errorf("Dump failed: %v", err)
-	} else {
-		machine := res.Data[0]
-		if _, ok := machine.Backoffs["UnitTest1"]; !ok {
-			t.Errorf("Expected UnitTest1 backoff on machine")
-		}
-	}
-	// The second one should have an expired backoff that shouldn't be reported in a
-	// normal call..
-	<-elapsed.C
-	opts.FilterMachine = &mids[1]
-	res, err = schema.GetMachines(ctx, opts)
-	if err != nil {
-		t.Errorf("Dump failed: %v", err)
-	} else {
-		machine := res.Data[0]
-		if _, ok := machine.Backoffs["UnitTest1"]; ok {
-			t.Errorf("Expected no UnitTest1 backoff on machine")
-		}
-	}
-	// But if we ask for expired backoffs, we should get it.
-	opts.ExpiredBackoffs = true
-	res, err = schema.GetMachines(ctx, opts)
-	if err != nil {
-		t.Errorf("Dump failed: %v", err)
-	} else {
-		machine := res.Data[0]
-		if _, ok := machine.Backoffs["UnitTest1"]; !ok {
-			t.Errorf("Expected UnitTest1 backoff on machine")
-		}
-	}
-	// Finally, the third machine should have an active Work item.
-	opts.FilterMachine = &mids[2]
-	res, err = schema.GetMachines(ctx, opts)
-	if err != nil {
-		t.Errorf("Dump failed: %v", err)
-	} else {
-		machine := res.Data[0]
-		if _, ok := machine.Work["UnitTest1"]; !ok {
-			t.Errorf("Expected UnitTest1 work item on machine")
-		}
-	}
-}
-
-// TestReflectionProtoFields ensures that the basic proto field introspection
-// functionality works.
-func TestReflectionProtoFields(t *testing.T) {
-	s := dut()
-	ctx, ctxC := context.WithCancel(context.Background())
-	defer ctxC()
-
-	bmdb, err := s.Open(true)
-	if err != nil {
-		t.Fatalf("Open: %v", err)
-	}
-	sess, err := bmdb.StartSession(ctx)
-	if err != nil {
-		t.Fatalf("StartSession: %v", err)
-	}
-	var machine model.Machine
-	err = sess.Transact(ctx, func(q *model.Queries) error {
-		machine, err = q.NewMachine(ctx)
-		if err != nil {
-			return err
-		}
-
-		report := &api.AgentHardwareReport{
-			Report: &apb.Node{
-				Manufacturer:         "Charles Babbage",
-				Product:              "Analytical Engine",
-				SerialNumber:         "183701",
-				MemoryInstalledBytes: 14375,
-				MemoryUsableRatio:    1.0,
-				Cpu: []*apb.CPU{
-					{
-						Architecture:    nil,
-						HardwareThreads: 1,
-						Cores:           1,
-					},
-				},
-			},
-			Warning: []string{"something went wrong"},
-		}
-		b, _ := proto.Marshal(report)
-		return q.MachineSetHardwareReport(ctx, model.MachineSetHardwareReportParams{
-			MachineID:         machine.MachineID,
-			HardwareReportRaw: b,
-		})
-	})
-	if err != nil {
-		t.Fatalf("Failed to submit hardware report: %v", err)
-	}
-
-	schem, err := bmdb.Reflect(ctx)
-	if err != nil {
-		t.Fatalf("Failed to reflect on database: %v", err)
-	}
-
-	machines, err := schem.GetMachines(ctx, &reflection.GetMachinesOpts{FilterMachine: &machine.MachineID, Strict: true})
-	if err != nil {
-		t.Fatalf("Failed to get machine: %v", err)
-	}
-	if len(machines.Data) != 1 {
-		t.Errorf("Expected one machine, got %d", len(machines.Data))
-	} else {
-		machine := machines.Data[0]
-		ty := machine.Tags["HardwareReport"].Field("hardware_report_raw").Type.HumanType()
-		if want, got := "cloud.bmaas.server.api.AgentHardwareReport", ty; want != got {
-			t.Errorf("Mismatch in type: wanted %q, got %q", want, got)
-		}
-		v := machine.Tags["HardwareReport"].Field("hardware_report_raw").HumanValue()
-		if !strings.Contains(v, "manufacturer:") {
-			t.Errorf("Invalid serialized prototext: %s", v)
-		}
-		fv, err := machine.Tags["HardwareReport"].Field("hardware_report_raw").Index("report.cpu[0].cores")
-		if err != nil {
-			t.Errorf("Could not get report.cpu[0].cores from hardware_report_raw: %v", err)
-		} else {
-			if want, got := "1", fv; want != got {
-				t.Errorf("report.cpu[0].cores should be %q, got %q", want, got)
-			}
-		}
-	}
-}
diff --git a/cloud/bmaas/bmdb/sessions.go b/cloud/bmaas/bmdb/sessions.go
deleted file mode 100644
index 22ea3fd..0000000
--- a/cloud/bmaas/bmdb/sessions.go
+++ /dev/null
@@ -1,637 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package bmdb
-
-import (
-	"context"
-	"database/sql"
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/cockroachdb/cockroach-go/v2/crdb"
-	"github.com/google/uuid"
-	"github.com/lib/pq"
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/bmaas/bmdb/metrics"
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-)
-
-// StartSession creates a new BMDB session which will be maintained in a
-// background goroutine as long as the given context is valid. Each Session is
-// represented by an entry in a sessions table within the BMDB, and subsequent
-// Transact calls emit SQL transactions which depend on that entry still being
-// present and up to date. A garbage collection system (to be implemented) will
-// remove expired sessions from the BMDB, but this mechanism is not necessary
-// for the session expiry mechanism to work.
-//
-// When the session becomes invalid (for example due to network partition),
-// subsequent attempts to call Transact will fail with ErrSessionExpired. This
-// means that the caller within the component is responsible for recreating a
-// new Session if a previously used one expires.
-func (c *Connection) StartSession(ctx context.Context, opts ...SessionOption) (*Session, error) {
-	intervalSeconds := 5
-
-	res, err := model.New(c.db).NewSession(ctx, model.NewSessionParams{
-		SessionComponentName:   c.bmdb.ComponentName,
-		SessionRuntimeInfo:     c.bmdb.RuntimeInfo,
-		SessionIntervalSeconds: int64(intervalSeconds),
-	})
-	if err != nil {
-		return nil, fmt.Errorf("creating session failed: %w", err)
-	}
-
-	klog.Infof("Started session %s", res.SessionID)
-
-	ctx2, ctxC := context.WithCancel(ctx)
-
-	var processor metrics.Processor
-	for _, opt := range opts {
-		if opt.Processor != "" {
-			processor = opt.Processor
-		}
-	}
-
-	s := &Session{
-		connection: c,
-		interval:   time.Duration(intervalSeconds) * time.Second,
-
-		UUID: res.SessionID,
-
-		ctx:  ctx2,
-		ctxC: ctxC,
-		m:    c.bmdb.metrics.Recorder(processor),
-	}
-	s.m.OnSessionStarted()
-	go s.maintainHeartbeat(ctx2)
-	return s, nil
-}
-
-type SessionOption struct {
-	Processor metrics.Processor
-}
-
-// Session is a session (identified by UUID) that has been started in the BMDB.
-// Its liveness is maintained by a background goroutine, and as long as that
-// session is alive, it can perform transactions and work on the BMDB.
-type Session struct {
-	connection *Connection
-	interval   time.Duration
-
-	UUID uuid.UUID
-
-	ctx  context.Context
-	ctxC context.CancelFunc
-
-	m *metrics.ProcessorRecorder
-}
-
-// Expired returns true if this session is expired and will fail all subsequent
-// transactions/work.
-func (s *Session) Expired() bool {
-	return s.ctx.Err() != nil
-}
-
-// expire is a helper which marks this session as expired and returns
-// ErrSessionExpired.
-func (s *Session) expire() error {
-	s.ctxC()
-	return ErrSessionExpired
-}
-
-var (
-	// ErrSessionExpired is returned when attempting to Transact or Work on a
-	// Session that has expired or been canceled. Once a Session starts returning
-	// these errors, it must be re-created by another StartSession call, as no other
-	// calls will succeed.
-	ErrSessionExpired = errors.New("session expired")
-	// ErrWorkConflict is returned when attempting to Work on a Session with a
-	// process name that's already performing some work, concurrently, on the
-	// requested machine.
-	ErrWorkConflict = errors.New("conflicting work on machine")
-)
-
-// maintainHeartbeat will attempt to repeatedly poke the session at a frequency
-// twice of that of the minimum frequency mandated by the configured 5-second
-// interval. It will exit if it detects that the session cannot be maintained
-// anymore, canceling the session's internal context and causing future
-// Transact/Work calls to fail.
-func (s *Session) maintainHeartbeat(ctx context.Context) {
-	// Internal deadline, used to check whether we haven't dropped the ball on
-	// performing the updates due to a lot of transient errors.
-	deadline := time.Now().Add(s.interval)
-	for {
-		if ctx.Err() != nil {
-			klog.Infof("Session %s: context over, exiting: %v", s.UUID, ctx.Err())
-			return
-		}
-
-		err := s.Transact(ctx, func(q *model.Queries) error {
-			sessions, err := q.SessionCheck(ctx, s.UUID)
-			if err != nil {
-				return fmt.Errorf("when retrieving session: %w", err)
-			}
-			if len(sessions) < 1 {
-				return s.expire()
-			}
-			err = q.SessionPoke(ctx, s.UUID)
-			if err != nil {
-				return fmt.Errorf("when poking session: %w", err)
-			}
-			return nil
-		})
-		if err != nil {
-			klog.Errorf("Session %s: update failed: %v", s.UUID, err)
-			if errors.Is(err, ErrSessionExpired) || deadline.After(time.Now()) {
-				// No way to recover.
-				klog.Errorf("Session %s: exiting", s.UUID)
-				s.ctxC()
-				return
-			}
-			// Just retry in a bit. One second seems about right for a 5 second interval.
-			//
-			// TODO(q3k): calculate this based on the configured interval.
-			time.Sleep(time.Second)
-		}
-		// Success. Keep going.
-		deadline = time.Now().Add(s.interval)
-		select {
-		case <-ctx.Done():
-			// Do nothing, next loop iteration will exit.
-		case <-time.After(s.interval / 2):
-			// Do nothing, next loop iteration will heartbeat.
-		}
-	}
-}
-
-// Transact runs a given function in the context of both a CockroachDB and BMDB
-// transaction, retrying as necessary.
-//
-// Most pure (meaning without side effects outside the database itself) BMDB
-// transactions should be run this way.
-func (s *Session) Transact(ctx context.Context, fn func(q *model.Queries) error) error {
-	var attempts int64
-
-	err := crdb.ExecuteTx(ctx, s.connection.db, nil, func(tx *sql.Tx) error {
-		attempts += 1
-		s.m.OnTransactionStarted(attempts)
-
-		qtx := model.New(tx)
-		sessions, err := qtx.SessionCheck(ctx, s.UUID)
-		if err != nil {
-			return fmt.Errorf("when retrieving session: %w", err)
-		}
-		if len(sessions) < 1 {
-			return s.expire()
-		}
-
-		if err := fn(qtx); err != nil {
-			return err
-		}
-
-		return nil
-	})
-	if err != nil {
-		s.m.OnTransactionFailed()
-	}
-	return err
-}
-
-var (
-	ErrNothingToDo = errors.New("nothing to do")
-	// PostgresUniqueViolation is returned by the lib/pq driver when a mutation
-	// cannot be performed due to a UNIQUE constraint being violated as a result of
-	// the query.
-	postgresUniqueViolation = pq.ErrorCode("23505")
-)
-
-// Work starts work on a machine. Full work execution is performed in three
-// phases:
-//
-//  1. Retrieval phase. This is performed by 'fn' given to this function.
-//     The retrieval function must return zero or more machines that some work
-//     should be performed on per the BMDB. The first returned machine will be
-//     locked for work under the given process and made available in the Work
-//     structure returned by this call. The function may be called multiple times,
-//     as it's run within a CockroachDB transaction which may be retried an
-//     arbitrary number of times. Thus, it should be side-effect free, ideally only
-//     performing read queries to the database.
-//  2. Work phase. This is performed by user code while holding on to the Work
-//     structure instance.
-//  3. Commit phase. This is performed by the function passed to Work.Finish. See
-//     that method's documentation for more details.
-//
-// Important: after retrieving Work successfully, either Finish or Cancel must be
-// called, otherwise the machine will be locked until the parent session expires
-// or is closed! It's safe and recommended to `defer work.Close()` after calling
-// Work().
-//
-// If no machine is eligible for work, ErrNothingToDo should be returned by the
-// retrieval function, and the same error (wrapped) will be returned by Work. In
-// case the retrieval function returns no machines and no error, that error will
-// also be returned.
-//
-// The returned Work object is _not_ goroutine safe.
-func (s *Session) Work(ctx context.Context, process model.Process, fn func(q *model.Queries) ([]uuid.UUID, error)) (*Work, error) {
-	var mid *uuid.UUID
-	var exisingingBackoff *existingBackoff
-	err := s.Transact(ctx, func(q *model.Queries) error {
-		mids, err := fn(q)
-		if err != nil {
-			return fmt.Errorf("could not retrieve machines for work: %w", err)
-		}
-		if len(mids) < 1 {
-			return ErrNothingToDo
-		}
-		mid = &mids[0]
-		err = q.StartWork(ctx, model.StartWorkParams{
-			MachineID: mids[0],
-			SessionID: s.UUID,
-			Process:   process,
-		})
-		if err != nil {
-			var perr *pq.Error
-			if errors.As(err, &perr) && perr.Code == postgresUniqueViolation {
-				return ErrWorkConflict
-			}
-			return fmt.Errorf("could not start work on %q: %w", mids[0], err)
-		}
-		err = q.WorkHistoryInsert(ctx, model.WorkHistoryInsertParams{
-			MachineID: mids[0],
-			Event:     model.WorkHistoryEventStarted,
-			Process:   process,
-		})
-		if err != nil {
-			return fmt.Errorf("could not insert history event: %w", err)
-		}
-		backoffs, err := q.WorkBackoffOf(ctx, model.WorkBackoffOfParams{
-			MachineID: mids[0],
-			Process:   process,
-		})
-		if err != nil {
-			return fmt.Errorf("could not get backoffs: %w", err)
-		}
-		if len(backoffs) > 0 {
-			// If the backoff exists but the last interval is null (e.g. is from a previous
-			// version of the schema when backoffs had no interval data) pretend it doesn't
-			// exist. Then the backoff mechanism can restart from a clean slate and populate
-			// a new, full backoff row.
-			if backoff := backoffs[0]; backoff.LastIntervalSeconds.Valid {
-				klog.Infof("Existing backoff: %d seconds", backoff.LastIntervalSeconds.Int64)
-				exisingingBackoff = &existingBackoff{
-					lastInterval: time.Second * time.Duration(backoff.LastIntervalSeconds.Int64),
-				}
-			}
-		}
-		return nil
-	})
-	if err != nil {
-		return nil, err
-	}
-	w := &Work{
-		Machine: *mid,
-		s:       s,
-		process: process,
-		backoff: exisingingBackoff,
-		m:       s.m.WithProcess(process),
-	}
-	w.m.OnWorkStarted()
-	klog.Infof("Started work %q on machine %q (sess %q)", process, *mid, s.UUID)
-	return w, nil
-}
-
-// existingBackoff contains backoff information retrieved from a work item that
-// has previously failed with a backoff.
-type existingBackoff struct {
-	// lastInterval is the last interval as stored in the backoff table.
-	lastInterval time.Duration
-}
-
-// Backoff describes the configuration of backoff for a failed work item. It can
-// be passed to Work.Fail to cause an item to not be processed again (to be 'in
-// backoff') for a given period of time. Exponential backoff can be configured so
-// that subsequent failures of a process will have exponentially increasing
-// backoff periods, up to some maximum length.
-//
-// The underlying unit of backoff period length in the database is one second.
-// What that means is that all effective calculated backoff periods must be an
-// integer number of seconds. This is performed by always rounding up this period
-// to the nearest second. A side effect of this is that with exponential backoff,
-// non-integer exponents will be less precisely applied for small backoff values,
-// e.g. an exponent of 1.1 with initial backoff of 1s will generate the following
-// sequence of backoff periods:
-//
-// 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17
-//
-// Which corresponds to the following approximate multipliers in between periods:
-//
-// 2.00, 1.50, 1.33, 1.25, 1.20, 1.17, 1.14, 1.12, 1.11, 1.10, 1.18, 1.15, 1.13
-//
-// Thus, the exponent value should be treated more as a limit that the sequence
-// of periods will approach than a hard rule for calculating the periods.
-// However, if the exponent is larger than 1 (i.e. any time exponential backoff
-// is requested), this guarantees that the backoff won't get 'stuck' on a
-// repeated period value due to a rounding error.
-//
-// A zero backoff structure is valid and represents a non-exponential backoff of
-// one second.
-//
-// A partially filled structure is also valid. See the field comments for more
-// information about how fields are capped if not set. The described behaviour
-// allows for two useful shorthands:
-//
-//  1. If only Initial is set, then the backoff is non-exponential and will always
-//     be of value Initial (or whatever the previous period already persisted the
-//     database).
-//  2. If only Maximum and Exponent are set, the backoff will be exponential,
-//     starting at one second, and exponentially increasing to Maximum.
-//
-// It is recommended to construct Backoff structures as const values and treat
-// them as read-only 'descriptors', one per work kind / process.
-//
-// One feature currently missing from the Backoff implementation is jitter. This
-// might be introduced in the future if deemed necessary.
-type Backoff struct {
-	// Initial backoff period, used for the backoff if this item failed for the first
-	// time (i.e. has not had a Finish call in between two Fail calls).
-	//
-	// Subsequent calls will ignore this field if the backoff is exponential. If
-	// non-exponential, the initial time will always override whatever was previously
-	// persisted in the database, i.e. the backoff will always be of value 'Initial'.
-	//
-	// Cannot be lower than one second. If it is, it will be capped to it.
-	Initial time.Duration `u:"initial"`
-
-	// Maximum time for backoff. If the calculation of the next back off period
-	// (based on the Exponent and last backoff value) exceeds this maximum, it will
-	// be capped to it.
-	//
-	// Maximum is not persisted in the database. Instead, it is always read from this
-	// structure.
-	//
-	// Cannot be lower than Initial. If it is, it will be capped to it.
-	Maximum time.Duration `u:"maximum"`
-
-	// Exponent used for next backoff calculation. Any time a work item fails
-	// directly after another failure, the previous backoff period will be multiplied
-	// by the exponent to yield the new backoff period. The new period will then be
-	// capped to Maximum.
-	//
-	// Exponent is not persisted in the database. Instead, it is always read from
-	// this structure.
-	//
-	// Cannot be lower than 1.0. If it is, it will be capped to it.
-	Exponent float64 `u:"exponent"`
-}
-
-// normalized copies the given backoff and returns a 'normalized' version of it,
-// with the 'when zero/unset' rules described in the Backoff documentation
-// strings.
-func (b *Backoff) normalized() *Backoff {
-	c := *b
-
-	if c.Exponent < 1.0 {
-		c.Exponent = 1.0
-	}
-	if c.Initial < time.Second {
-		c.Initial = time.Second
-	}
-	if c.Maximum < c.Initial {
-		c.Maximum = c.Initial
-	}
-	return &c
-}
-
-func (b *Backoff) simple() bool {
-	// Non-normalized simple backoffs will have a zero exponent.
-	if b.Exponent == 0.0 {
-		return true
-	}
-	// Normalized simple backoffs will have a 1.0 exponent.
-	if b.Exponent == 1.0 {
-		return true
-	}
-	return false
-}
-
-// next calculates the backoff period based on a backoff descriptor and previous
-// existing backoff information. Both or either can be nil.
-func (b *Backoff) next(e *existingBackoff) int64 {
-	second := time.Second.Nanoseconds()
-
-	// Minimum interval is one second. Start with that.
-	last := second
-	// Then, if we have a previous interval, and it's greater than a second, use that
-	// as the last interval.
-	if e != nil {
-		if previous := e.lastInterval.Nanoseconds(); previous > second {
-			last = previous
-		}
-	}
-
-	// If no backoff is configured, go with either the minimum of one second, or
-	// whatever the last previous interval was.
-	if b == nil {
-		return last / second
-	}
-
-	// Make a copy of the backoff descriptor, normalizing as necessary.
-	c := b.normalized()
-
-	// Simple backoffs always return Initial.
-	if b.simple() {
-		return c.Initial.Nanoseconds() / second
-	}
-
-	// If there is no existing backoff, return the initial backoff value directly.
-	if e == nil {
-		return c.Initial.Nanoseconds() / second
-	}
-
-	// Start out with the persisted interval.
-	next := last
-	// If by any chance we persisted an interval less than one second, clamp it.
-	if next < second {
-		next = second
-	}
-
-	// Multiply by exponent from descriptor.
-	next = int64(float64(next) * c.Exponent)
-
-	// Handle overflows. If multiplying by a positive number resulted in a lower
-	// value than what we started with, it means we overflowed and wrapped around. If
-	// so, clamp to maximum.
-	if next < last {
-		next = c.Maximum.Nanoseconds()
-	}
-
-	// Clamp to maximum.
-	if next > c.Maximum.Nanoseconds() {
-		next = c.Maximum.Nanoseconds()
-	}
-	// Round up to the nearest second.
-	if next%second == 0 {
-		return next / second
-	} else {
-		return next/second + 1
-	}
-}
-
-// Work being performed on a machine.
-type Work struct {
-	// Machine that this work is being performed on, as retrieved by the retrieval
-	// function passed to the Work method.
-	Machine uuid.UUID
-	// s is the parent session.
-	s *Session
-	// done marks that this work has already been canceled or finished.
-	done bool
-	// process that this work performs.
-	process model.Process
-
-	backoff *existingBackoff
-
-	m *metrics.ProcessRecorder
-}
-
-// Cancel the Work started on a machine. If the work has already been finished
-// or canceled, this is a no-op. In case of error, a log line will be emitted.
-func (w *Work) Cancel(ctx context.Context) {
-	if w.done {
-		return
-	}
-	w.done = true
-	w.m.OnWorkFinished(metrics.WorkResultCanceled)
-
-	klog.Infof("Canceling work %q on machine %q (sess %q)", w.process, w.Machine, w.s.UUID)
-	// Eat error and log. There's nothing we can do if this fails, and if it does, it's
-	// probably because our connectivity to the BMDB has failed. If so, our session
-	// will be invalidated soon and so will the work being performed on this
-	// machine.
-	err := w.s.Transact(ctx, func(q *model.Queries) error {
-		err := q.FinishWork(ctx, model.FinishWorkParams{
-			MachineID: w.Machine,
-			SessionID: w.s.UUID,
-			Process:   w.process,
-		})
-		if err != nil {
-			return err
-		}
-		return q.WorkHistoryInsert(ctx, model.WorkHistoryInsertParams{
-			MachineID: w.Machine,
-			Process:   w.process,
-			Event:     model.WorkHistoryEventCanceled,
-		})
-	})
-	if err != nil {
-		klog.Errorf("Failed to cancel work %q on %q (sess %q): %v", w.process, w.Machine, w.s.UUID, err)
-	}
-}
-
-// Finish work by executing a commit function 'fn' and releasing the machine
-// from the work performed. The function given should apply tags to the
-// processed machine in a way that causes it to not be eligible for retrieval
-// again. As with the retriever function, the commit function might be called an
-// arbitrary number of times as part of cockroachdb transaction retries.
-//
-// This may be called only once.
-func (w *Work) Finish(ctx context.Context, fn func(q *model.Queries) error) error {
-	if w.done {
-		return fmt.Errorf("already finished")
-	}
-	w.done = true
-	w.m.OnWorkFinished(metrics.WorkResultFinished)
-
-	klog.Infof("Finishing work %q on machine %q (sess %q)", w.process, w.Machine, w.s.UUID)
-	return w.s.Transact(ctx, func(q *model.Queries) error {
-		err := q.FinishWork(ctx, model.FinishWorkParams{
-			MachineID: w.Machine,
-			SessionID: w.s.UUID,
-			Process:   w.process,
-		})
-		if err != nil {
-			return err
-		}
-		err = q.WorkBackoffDelete(ctx, model.WorkBackoffDeleteParams{
-			MachineID: w.Machine,
-			Process:   w.process,
-		})
-		if err != nil {
-			return err
-		}
-		err = q.WorkHistoryInsert(ctx, model.WorkHistoryInsertParams{
-			MachineID: w.Machine,
-			Process:   w.process,
-			Event:     model.WorkHistoryEventFinished,
-		})
-		if err != nil {
-			return err
-		}
-		return fn(q)
-	})
-}
-
-// Fail work and introduce backoff. The given cause is an operator-readable
-// string that will be persisted alongside the backoff and the work history/audit
-// table.
-//
-// The backoff describes a period during which the same process will not be
-// retried on this machine until its expiration.
-//
-// The given backoff is a structure which describes both the initial backoff
-// period if the work failed for the first time, and a mechanism to exponentially
-// increase the backoff period if that work failed repeatedly. The work is
-// defined to have failed repeatedly if it only resulted in Cancel/Fail calls
-// without any Finish calls in the meantime.
-//
-// Only the last backoff period is persisted in the database. The exponential
-// backoff behaviour (including its maximum time) is always calculated based on
-// the given backoff structure.
-//
-// If nil, the backoff defaults to a non-exponential, one second backoff. This is
-// the minimum designed to keep the system chugging along without repeatedly
-// trying a failed job in a loop. However, the backoff should generally be set to
-// some well engineered value to prevent spurious retries.
-func (w *Work) Fail(ctx context.Context, backoff *Backoff, cause string) error {
-	if w.done {
-		return fmt.Errorf("already finished")
-	}
-	w.done = true
-	w.m.OnWorkFinished(metrics.WorkResultFailed)
-
-	return w.s.Transact(ctx, func(q *model.Queries) error {
-		err := q.FinishWork(ctx, model.FinishWorkParams{
-			MachineID: w.Machine,
-			SessionID: w.s.UUID,
-			Process:   w.process,
-		})
-		if err != nil {
-			return err
-		}
-		err = q.WorkHistoryInsert(ctx, model.WorkHistoryInsertParams{
-			MachineID: w.Machine,
-			Process:   w.process,
-			Event:     model.WorkHistoryEventFailed,
-			FailedCause: sql.NullString{
-				String: cause,
-				Valid:  true,
-			},
-		})
-		if err != nil {
-			return err
-		}
-		if backoff == nil {
-			klog.Warningf("Nil backoff for %q on machine %q: defaulting to one second non-exponential.", w.process, w.Machine)
-		}
-		seconds := backoff.next(w.backoff)
-		klog.Infof("Adding backoff for %q on machine %q: %d seconds", w.process, w.Machine, seconds)
-		return q.WorkBackoffInsert(ctx, model.WorkBackoffInsertParams{
-			MachineID: w.Machine,
-			Process:   w.process,
-			Cause:     cause,
-			Seconds:   seconds,
-		})
-	})
-}
diff --git a/cloud/bmaas/bmdb/sessions_test.go b/cloud/bmaas/bmdb/sessions_test.go
deleted file mode 100644
index 8839c17..0000000
--- a/cloud/bmaas/bmdb/sessions_test.go
+++ /dev/null
@@ -1,643 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package bmdb
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/cloud/lib/component"
-)
-
-func dut() *BMDB {
-	return &BMDB{
-		Config: Config{
-			Database: component.CockroachConfig{
-				InMemory: true,
-			},
-		},
-	}
-}
-
-// TestSessionExpiry exercises the session heartbeat logic, making sure that if
-// a session stops being maintained subsequent Transact calls will fail.
-func TestSessionExpiry(t *testing.T) {
-	b := dut()
-	conn, err := b.Open(true)
-	if err != nil {
-		t.Fatalf("Open failed: %v", err)
-	}
-
-	ctx, ctxC := context.WithCancel(context.Background())
-	defer ctxC()
-
-	session, err := conn.StartSession(ctx)
-	if err != nil {
-		t.Fatalf("Starting session failed: %v", err)
-	}
-
-	// A transaction in a brand-new session should work.
-	var machine model.Machine
-	err = session.Transact(ctx, func(q *model.Queries) error {
-		machine, err = q.NewMachine(ctx)
-		return err
-	})
-	if err != nil {
-		t.Fatalf("First transaction failed: %v", err)
-	}
-
-	time.Sleep(6 * time.Second)
-
-	// A transaction after the 5-second session interval should continue to work.
-	err = session.Transact(ctx, func(q *model.Queries) error {
-		_, err = q.NewMachine(ctx)
-		return err
-	})
-	if err != nil {
-		t.Fatalf("Second transaction failed: %v", err)
-	}
-
-	// A transaction after the 5-second session interval should fail if we don't
-	// maintain its heartbeat.
-	session.ctxC()
-	time.Sleep(6 * time.Second)
-
-	err = session.Transact(ctx, func(q *model.Queries) error {
-		return q.MachineAddProvided(ctx, model.MachineAddProvidedParams{
-			MachineID:  machine.MachineID,
-			Provider:   "foo",
-			ProviderID: "bar",
-		})
-	})
-	if !errors.Is(err, ErrSessionExpired) {
-		t.Fatalf("Second transaction should've failed due to expired session, got %v", err)
-	}
-
-}
-
-// TestWork exercises the per-{process,machine} mutual exclusion mechanism of
-// Work items.
-func TestWork(t *testing.T) {
-	b := dut()
-	conn, err := b.Open(true)
-	if err != nil {
-		t.Fatalf("Open failed: %v", err)
-	}
-
-	ctx, ctxC := context.WithCancel(context.Background())
-	defer ctxC()
-
-	// Start two session for testing.
-	session1, err := conn.StartSession(ctx)
-	if err != nil {
-		t.Fatalf("Starting session failed: %v", err)
-	}
-	session2, err := conn.StartSession(ctx)
-	if err != nil {
-		t.Fatalf("Starting session failed: %v", err)
-	}
-
-	var machine model.Machine
-	err = session1.Transact(ctx, func(q *model.Queries) error {
-		machine, err = q.NewMachine(ctx)
-		return err
-	})
-	if err != nil {
-		t.Fatalf("Creating machine failed: %v", err)
-	}
-
-	// Create a subcontext for a long-term work request. We'll cancel it later as
-	// part of the test.
-	ctxB, ctxBC := context.WithCancel(ctx)
-	defer ctxBC()
-
-	constantRetriever := func(_ *model.Queries) ([]uuid.UUID, error) {
-		return []uuid.UUID{machine.MachineID}, nil
-	}
-
-	// Start work on machine which we're not gonna finish for a while.
-	work1, err := session1.Work(ctxB, model.ProcessUnitTest1, constantRetriever)
-	if err != nil {
-		t.Fatalf("Starting first work failed: %v", err)
-	}
-
-	// Starting more work on the same machine but a different process should still
-	// be allowed.
-	for _, session := range []*Session{session1, session2} {
-		work2, err := session.Work(ctxB, model.ProcessUnitTest2, constantRetriever)
-		if err != nil {
-			t.Errorf("Could not run concurrent process on machine: %v", err)
-		} else {
-			work2.Cancel(ctxB)
-		}
-	}
-
-	// However, starting work with the same process on the same machine should
-	// fail.
-	for _, session := range []*Session{session1, session2} {
-		work2, err := session.Work(ctxB, model.ProcessUnitTest1, constantRetriever)
-		if !errors.Is(err, ErrWorkConflict) {
-			t.Errorf("Concurrent work with same process should've been forbidden, got %v", err)
-			work2.Cancel(ctxB)
-		}
-	}
-
-	// Now, finish the long-running work.
-	work1.Cancel(ctx)
-
-	// We should now be able to perform 'test1' work again against this machine.
-	for _, session := range []*Session{session1, session2} {
-		work1, err := session.Work(ctxB, model.ProcessUnitTest1, constantRetriever)
-		if err != nil {
-			t.Errorf("Could not run work against machine: %v", err)
-		} else {
-			work1.Cancel(ctxB)
-		}
-	}
-}
-
-// TestWorkBackoff exercises the backoff functionality within the BMDB.
-func TestWorkBackoff(t *testing.T) {
-	b := dut()
-	conn, err := b.Open(true)
-	if err != nil {
-		t.Fatalf("Open failed: %v", err)
-	}
-
-	ctx, ctxC := context.WithCancel(context.Background())
-	defer ctxC()
-
-	session, err := conn.StartSession(ctx)
-	if err != nil {
-		t.Fatalf("Starting session failed: %v", err)
-	}
-
-	var machine model.Machine
-	// Create machine.
-	err = session.Transact(ctx, func(q *model.Queries) error {
-		machine, err = q.NewMachine(ctx)
-		if err != nil {
-			return err
-		}
-		return q.MachineAddProvided(ctx, model.MachineAddProvidedParams{
-			MachineID:  machine.MachineID,
-			Provider:   model.ProviderEquinix,
-			ProviderID: "123",
-		})
-	})
-	if err != nil {
-		t.Fatalf("Creating machine failed: %v", err)
-	}
-
-	waitMachine := func(nsec int64) *Work {
-		t.Helper()
-
-		deadline := time.Now().Add(time.Duration(nsec) * 2 * time.Second)
-		for {
-			if time.Now().After(deadline) {
-				t.Fatalf("Deadline expired")
-			}
-			work, err := session.Work(ctx, model.ProcessShepherdAgentStart, func(q *model.Queries) ([]uuid.UUID, error) {
-				machines, err := q.GetMachinesForAgentStart(ctx, model.GetMachinesForAgentStartParams{
-					Limit:    1,
-					Provider: model.ProviderEquinix,
-				})
-				if err != nil {
-					return nil, err
-				}
-				if len(machines) < 1 {
-					return nil, ErrNothingToDo
-				}
-				return []uuid.UUID{machines[0].MachineID}, nil
-			})
-			if err == nil {
-				return work
-			}
-			if !errors.Is(err, ErrNothingToDo) {
-				t.Fatalf("Unexpected work error: %v", err)
-			}
-			time.Sleep(100 * time.Millisecond)
-		}
-	}
-
-	// Work on machine, but fail it with a backoff.
-	work := waitMachine(1)
-	backoff := Backoff{
-		Initial:  time.Second,
-		Maximum:  5 * time.Second,
-		Exponent: 2,
-	}
-	if err := work.Fail(ctx, &backoff, "test"); err != nil {
-		t.Fatalf("Failing work failed: %v", err)
-	}
-
-	expect := func(count int) {
-		t.Helper()
-
-		var machines []model.MachineProvided
-		var err error
-		err = session.Transact(ctx, func(q *model.Queries) error {
-			machines, err = q.GetMachinesForAgentStart(ctx, model.GetMachinesForAgentStartParams{
-				Limit:    1,
-				Provider: model.ProviderEquinix,
-			})
-			if err != nil {
-				return err
-			}
-			return nil
-		})
-		if err != nil {
-			t.Errorf("Failed to retrieve machines for agent start: %v", err)
-		}
-		if want, got := count, len(machines); want != got {
-			t.Errorf("Expected %d machines, got %d", want, got)
-		}
-	}
-
-	// The machine shouldn't be returned now.
-	expect(0)
-
-	// Wait for the backoff to expire.
-	time.Sleep(1100 * time.Millisecond)
-
-	// The machine should now be returned again.
-	expect(1)
-
-	// Prepare helper for checking exponential backoffs.
-	failAndCheck := func(nsec int64) {
-		t.Helper()
-		work := waitMachine(nsec)
-		if err := work.Fail(ctx, &backoff, "test"); err != nil {
-			t.Fatalf("Failing work failed: %v", err)
-		}
-
-		var backoffs []model.WorkBackoff
-		err = session.Transact(ctx, func(q *model.Queries) error {
-			var err error
-			backoffs, err = q.WorkBackoffOf(ctx, model.WorkBackoffOfParams{
-				MachineID: machine.MachineID,
-				Process:   model.ProcessShepherdAgentStart,
-			})
-			return err
-		})
-		if err != nil {
-			t.Errorf("Failed to retrieve machines for agent start: %v", err)
-		}
-		if len(backoffs) < 1 {
-			t.Errorf("No backoff")
-		} else {
-			backoff := backoffs[0]
-			if want, got := nsec, backoff.LastIntervalSeconds.Int64; want != got {
-				t.Fatalf("Wanted backoff of %d seconds, got %d", want, got)
-			}
-		}
-	}
-
-	// Exercise exponential backoff functionality.
-	failAndCheck(2)
-	failAndCheck(4)
-	failAndCheck(5)
-	failAndCheck(5)
-
-	// If the job now succeeds, subsequent failures should start from 1 again.
-	work = waitMachine(5)
-	err = work.Finish(ctx, func(q *model.Queries) error {
-		// Not setting any tags that would cause subsequent queries to not return the
-		// machine anymore.
-		return nil
-	})
-	if err != nil {
-		t.Fatalf("Could not finish work: %v", err)
-	}
-
-	failAndCheck(1)
-	failAndCheck(2)
-}
-
-// TestAgentStartWorkflow exercises the agent start workflow within the BMDB.
-func TestAgentStartWorkflow(t *testing.T) {
-	b := dut()
-	conn, err := b.Open(true)
-	if err != nil {
-		t.Fatalf("Open failed: %v", err)
-	}
-
-	ctx, ctxC := context.WithCancel(context.Background())
-	defer ctxC()
-
-	session, err := conn.StartSession(ctx)
-	if err != nil {
-		t.Fatalf("Starting session failed: %v", err)
-	}
-
-	// Create machine. Drop its ID.
-	err = session.Transact(ctx, func(q *model.Queries) error {
-		machine, err := q.NewMachine(ctx)
-		if err != nil {
-			return err
-		}
-		return q.MachineAddProvided(ctx, model.MachineAddProvidedParams{
-			MachineID:  machine.MachineID,
-			Provider:   model.ProviderEquinix,
-			ProviderID: "123",
-		})
-	})
-	if err != nil {
-		t.Fatalf("Creating machine failed: %v", err)
-	}
-
-	// Start working on a machine.
-	var machine uuid.UUID
-	startedC := make(chan struct{})
-	doneC := make(chan struct{})
-	errC := make(chan error)
-	go func() {
-		work, err := session.Work(ctx, model.ProcessShepherdAgentStart, func(q *model.Queries) ([]uuid.UUID, error) {
-			machines, err := q.GetMachinesForAgentStart(ctx, model.GetMachinesForAgentStartParams{
-				Limit:    1,
-				Provider: model.ProviderEquinix,
-			})
-			if err != nil {
-				return nil, err
-			}
-			if len(machines) < 1 {
-				return nil, ErrNothingToDo
-			}
-			machine = machines[0].MachineID
-			return []uuid.UUID{machines[0].MachineID}, nil
-		})
-		defer work.Cancel(ctx)
-
-		if err != nil {
-			close(startedC)
-			errC <- err
-			return
-		}
-
-		// Simulate work by blocking on a channel.
-		close(startedC)
-
-		<-doneC
-
-		err = work.Finish(ctx, func(q *model.Queries) error {
-			return q.MachineSetAgentStarted(ctx, model.MachineSetAgentStartedParams{
-				MachineID:      work.Machine,
-				AgentStartedAt: time.Now(),
-				AgentPublicKey: []byte("fakefakefake"),
-			})
-		})
-		errC <- err
-	}()
-	<-startedC
-
-	// Work on the machine has started. Attempting to get more machines now should
-	// return no machines.
-
-	// Mutual exclusion with AgentStart:
-	err = session.Transact(ctx, func(q *model.Queries) error {
-		machines, err := q.GetMachinesForAgentStart(ctx, model.GetMachinesForAgentStartParams{
-			Limit:    1,
-			Provider: model.ProviderEquinix,
-		})
-		if err != nil {
-			return err
-		}
-		if len(machines) > 0 {
-			t.Errorf("Expected no machines ready for agent start.")
-		}
-		return nil
-	})
-	if err != nil {
-		t.Fatalf("Failed to retrieve machines for start in parallel: %v", err)
-	}
-
-	// Mutual exclusion with Recovery:
-	err = session.Transact(ctx, func(q *model.Queries) error {
-		machines, err := q.GetMachineForAgentRecovery(ctx, model.GetMachineForAgentRecoveryParams{
-			Limit:    1,
-			Provider: model.ProviderEquinix,
-		})
-		if err != nil {
-			return err
-		}
-		if len(machines) > 0 {
-			t.Errorf("Expected no machines ready for agent recovery.")
-		}
-		return nil
-	})
-	if err != nil {
-		t.Fatalf("Failed to retrieve machines for recovery in parallel: %v", err)
-	}
-
-	// Finish working on machine.
-	close(doneC)
-	err = <-errC
-	if err != nil {
-		t.Fatalf("Failed to finish work on machine: %v", err)
-	}
-	// That machine has its agent started, so we still expect no work to have to be
-	// done.
-	err = session.Transact(ctx, func(q *model.Queries) error {
-		machines, err := q.GetMachinesForAgentStart(ctx, model.GetMachinesForAgentStartParams{
-			Limit:    1,
-			Provider: model.ProviderEquinix,
-		})
-		if err != nil {
-			return err
-		}
-		if len(machines) > 0 {
-			t.Errorf("Expected still no machines ready for agent start.")
-		}
-		return nil
-	})
-	if err != nil {
-		t.Fatalf("Failed to retrieve machines for agent start after work finished: %v", err)
-	}
-
-	// Check history has been recorded.
-	var history []model.WorkHistory
-	err = session.Transact(ctx, func(q *model.Queries) error {
-		history, err = q.ListHistoryOf(ctx, machine)
-		return err
-	})
-	if err != nil {
-		t.Fatalf("Failed to retrieve machine history: %v", err)
-	}
-	// Expect two history items: started and finished.
-	if want, got := 2, len(history); want != got {
-		t.Errorf("Wanted %d history items, got %d", want, got)
-	} else {
-		if want, got := model.WorkHistoryEventStarted, history[0].Event; want != got {
-			t.Errorf("Wanted first history event to be %s, got %s", want, got)
-		}
-		if want, got := model.WorkHistoryEventFinished, history[1].Event; want != got {
-			t.Errorf("Wanted second history event to be %s, got %s", want, got)
-		}
-	}
-	// Check all other history event data.
-	for i, el := range history {
-		if want, got := machine, el.MachineID; want.String() != got.String() {
-			t.Errorf("Wanted %d history event machine ID to be %s, got %s", i, want, got)
-		}
-		if want, got := model.ProcessShepherdAgentStart, el.Process; want != got {
-			t.Errorf("Wanted %d history event process to be %s, got %s", i, want, got)
-		}
-	}
-}
-
-// TestAgentStartWorkflowParallel starts work on three machines by six workers
-// and makes sure that there are no scheduling conflicts between them.
-func TestAgentStartWorkflowParallel(t *testing.T) {
-	b := dut()
-	conn, err := b.Open(true)
-	if err != nil {
-		t.Fatalf("Open failed: %v", err)
-	}
-
-	ctx, ctxC := context.WithCancel(context.Background())
-	defer ctxC()
-
-	makeMachine := func(providerID string) {
-		ctxS, ctxC := context.WithCancel(ctx)
-		defer ctxC()
-		session, err := conn.StartSession(ctxS)
-		if err != nil {
-			t.Fatalf("Starting session failed: %v", err)
-		}
-		err = session.Transact(ctx, func(q *model.Queries) error {
-			machine, err := q.NewMachine(ctx)
-			if err != nil {
-				return err
-			}
-			return q.MachineAddProvided(ctx, model.MachineAddProvidedParams{
-				MachineID:  machine.MachineID,
-				Provider:   model.ProviderEquinix,
-				ProviderID: providerID,
-			})
-		})
-		if err != nil {
-			t.Fatalf("Creating machine failed: %v", err)
-		}
-	}
-	// Make six machines for testing.
-	for i := 0; i < 6; i++ {
-		makeMachine(fmt.Sprintf("test%d", i))
-	}
-
-	workStarted := make(chan struct{})
-	workDone := make(chan struct {
-		machine  uuid.UUID
-		workerID int
-	})
-
-	workOnce := func(ctx context.Context, workerID int, session *Session) error {
-		work, err := session.Work(ctx, model.ProcessShepherdAgentStart, func(q *model.Queries) ([]uuid.UUID, error) {
-			machines, err := q.GetMachinesForAgentStart(ctx, model.GetMachinesForAgentStartParams{
-				Limit:    1,
-				Provider: model.ProviderEquinix,
-			})
-			if err != nil {
-				return nil, err
-			}
-			if len(machines) < 1 {
-				return nil, ErrNothingToDo
-			}
-			return []uuid.UUID{machines[0].MachineID}, nil
-		})
-
-		if err != nil {
-			return err
-		}
-		defer work.Cancel(ctx)
-
-		select {
-		case <-workStarted:
-		case <-ctx.Done():
-			return ctx.Err()
-		}
-
-		select {
-		case workDone <- struct {
-			machine  uuid.UUID
-			workerID int
-		}{
-			machine:  work.Machine,
-			workerID: workerID,
-		}:
-		case <-ctx.Done():
-			return ctx.Err()
-		}
-
-		return work.Finish(ctx, func(q *model.Queries) error {
-			return q.MachineSetAgentStarted(ctx, model.MachineSetAgentStartedParams{
-				MachineID:      work.Machine,
-				AgentStartedAt: time.Now(),
-				AgentPublicKey: []byte("fakefakefake"),
-			})
-		})
-	}
-
-	worker := func(workerID int) {
-		ctxS, ctxSC := context.WithCancel(ctx)
-		defer ctxSC()
-		session, err := conn.StartSession(ctxS)
-		if err != nil {
-			t.Errorf("Starting session failed: %v", err)
-			ctxC()
-			return
-		}
-		for {
-			err := workOnce(ctxS, workerID, session)
-			if err != nil {
-				if errors.Is(err, ErrNothingToDo) {
-					continue
-				}
-				if errors.Is(err, ctxS.Err()) {
-					return
-				}
-				t.Errorf("worker failed: %v", err)
-				ctxC()
-				return
-			}
-		}
-	}
-	// Start three workers.
-	for i := 0; i < 3; i++ {
-		go worker(i)
-	}
-
-	// Wait for at least three workers to be alive.
-	for i := 0; i < 3; i++ {
-		select {
-		case workStarted <- struct{}{}:
-		case <-ctx.Done():
-			t.FailNow()
-		}
-	}
-
-	// Allow all workers to continue running from now on.
-	close(workStarted)
-
-	// Expect six machines to have been handled in parallel by three workers.
-	seenWorkers := make(map[int]bool)
-	seenMachines := make(map[string]bool)
-	for i := 0; i < 6; i++ {
-		res := <-workDone
-		seenWorkers[res.workerID] = true
-		seenMachines[res.machine.String()] = true
-	}
-
-	if want, got := 3, len(seenWorkers); want != got {
-		t.Errorf("Expected %d workers, got %d", want, got)
-	}
-	if want, got := 6, len(seenMachines); want != got {
-		t.Errorf("Expected %d machines, got %d", want, got)
-	}
-}
diff --git a/cloud/bmaas/bmdb/webug/BUILD.bazel b/cloud/bmaas/bmdb/webug/BUILD.bazel
deleted file mode 100644
index bbcaed4..0000000
--- a/cloud/bmaas/bmdb/webug/BUILD.bazel
+++ /dev/null
@@ -1,28 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-
-go_library(
-    name = "webug",
-    srcs = [
-        "functions.go",
-        "views.go",
-        "webug.go",
-    ],
-    embedsrcs = [
-        "templates/base.gohtml",
-        "templates/fragment_tag.gohtml",
-        "templates/fragment_tag_default.gohtml",
-        "templates/fragment_tag_provided.gohtml",
-        "templates/machines.gohtml",
-        "templates/machine.gohtml",
-    ],
-    importpath = "source.monogon.dev/cloud/bmaas/bmdb/webug",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//cloud/bmaas/bmdb",
-        "//cloud/bmaas/bmdb/model",
-        "//cloud/bmaas/bmdb/reflection",
-        "@com_github_cenkalti_backoff_v4//:backoff",
-        "@com_github_google_uuid//:uuid",
-        "@io_k8s_klog_v2//:klog",
-    ],
-)
diff --git a/cloud/bmaas/bmdb/webug/functions.go b/cloud/bmaas/bmdb/webug/functions.go
deleted file mode 100644
index 3c8f43b..0000000
--- a/cloud/bmaas/bmdb/webug/functions.go
+++ /dev/null
@@ -1,39 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package webug
-
-import (
-	"strings"
-)
-
-var (
-	// templateFuncs are helper functions accessible to the rendered templates.
-	templateFuncs = map[string]any{
-		// summarizeError attempts to make a Go-style "foo: bar: baz" error short by
-		// using some ugly heuristics. This is currently used to show a shorter error
-		// message in the backoff column of the machine list.
-		//
-		// TODO(q3k): fix backoff causes to be less verbose and nuke this.
-		"summarizeError": func(in string) string {
-			parts := strings.Split(in, ": ")
-			for i, p := range parts {
-				// Attempt to strip some common error prefixes.
-				if strings.HasPrefix(p, "failed to ") {
-					continue
-				}
-				if strings.HasPrefix(p, "when ") {
-					continue
-				}
-				if strings.HasPrefix(p, "while ") {
-					continue
-				}
-				// If we had some prefixes stripped but suddenly reached a part that is not
-				// prefixed
-				return "[...] " + strings.Join(parts[i:], ": ")
-			}
-			// If we stripped every single segment then just return the whole thing.
-			return in
-		},
-	}
-)
diff --git a/cloud/bmaas/bmdb/webug/templates/base.gohtml b/cloud/bmaas/bmdb/webug/templates/base.gohtml
deleted file mode 100644
index fef098d..0000000
--- a/cloud/bmaas/bmdb/webug/templates/base.gohtml
+++ /dev/null
@@ -1,104 +0,0 @@
-<!DOCTYPE html>
-<meta charset="utf-8">
-<title>BMDB webug</title>
-<style>
-    body {
-        font-family: sans-serif;
-        background: #fff;
-    }
-
-    /* Logotype. */
-    h1 {
-        clear: both;
-        padding-left: 1em;
-        padding-top: 0.5em;
-    }
-    h1 a {
-        text-decoration: none;
-    }
-    h1 a, h1 a:visited, h1 a:hover, h1 a:active {
-        color: inherit;
-    }
-    h1 span.red {
-        background-color: red;
-        color: white;
-        padding: 0.1em;
-        border-radius: 0.4em;
-    }
-    h1 span.info {
-        font-size: 0.5em;
-        font-weight: normal;
-        font-style: italic;
-    }
-
-    /* Section headers. */
-    h2 {
-        clear: both;
-        width: 100%;
-        text-align: center;
-        font-size: 120%;
-        background: #eeeeff;
-    }
-
-    /* Stylish tables. */
-    table, th, td {
-        background-color: #eee;
-        padding: 0.2em 0.4em 0.2em 0.4em;
-    }
-    table th {
-        background-color: #c0c0c0;
-    }
-    table {
-        background-color: #fff;
-        border-spacing: 0.2em;
-    }
-
-    /* Colouring of the Work History log in machine.gohtml. */
-    tr.EventFailed td,
-    tr.EventCanceled td {
-        background-color: #f8e8e8;
-    }
-    tr.EventFinished td {
-        background-color: #e8f8e8;
-    }
-
-    /* Colouring of the Machine State in fragment_tag_provided.gohtml. */
-    b.StatusMissing,
-    b.StatusProvisioning,
-    b.StatusProvisioningFailedPermanent,
-    b.StatusStopped
-    {
-        color: red;
-    }
-    b.StatusRunning {
-        color: green;
-    }
-
-    /* Generic font style tags for any element. */
-    .small {
-        font-size: 0.8em;
-    }
-    .faint {
-        color: #333;
-    }
-    .mono {
-        font-family: monospace;
-        tab-size: 2;
-    }
-    .error {
-        color: #f00;
-    }
-
-    /* For simple column style layouts. */
-    .vsplit {
-        display: flex;
-        flex-direction: row;
-        flex-wrap: nowrap;
-        align-items: stretch;
-    }
-    .column {
-        flex-grow: 1;
-        padding: 0.5em;
-    }
-</style>
-<h1><a href="/">we<span class="red">bug</span></a> <span class="info">BMDB at {{ .BMDBAddress }} schema {{ .BMDBSchema }}</span></h1>
\ No newline at end of file
diff --git a/cloud/bmaas/bmdb/webug/templates/fragment_tag.gohtml b/cloud/bmaas/bmdb/webug/templates/fragment_tag.gohtml
deleted file mode 100644
index 341cd78..0000000
--- a/cloud/bmaas/bmdb/webug/templates/fragment_tag.gohtml
+++ /dev/null
@@ -1,5 +0,0 @@
-{{- if eq .Type.Name "Provided" -}}
-    {{- template "fragment_tag_provided.gohtml" . -}}
-{{- else -}}
-    {{- template "fragment_tag_default.gohtml" . -}}
-{{- end -}}
diff --git a/cloud/bmaas/bmdb/webug/templates/fragment_tag_default.gohtml b/cloud/bmaas/bmdb/webug/templates/fragment_tag_default.gohtml
deleted file mode 100644
index 464d517..0000000
--- a/cloud/bmaas/bmdb/webug/templates/fragment_tag_default.gohtml
+++ /dev/null
@@ -1 +0,0 @@
-<b>{{ .Type.Name }}</b>(...)
diff --git a/cloud/bmaas/bmdb/webug/templates/fragment_tag_provided.gohtml b/cloud/bmaas/bmdb/webug/templates/fragment_tag_provided.gohtml
deleted file mode 100644
index 0a7da82..0000000
--- a/cloud/bmaas/bmdb/webug/templates/fragment_tag_provided.gohtml
+++ /dev/null
@@ -1,6 +0,0 @@
-{{- $provider := (.Field "provider").HumanValue }}
-{{- $pid := (.Field "provider_id").HumanValue }}
-{{- $location := (.Field "provider_location").HumanValue }}
-{{- $status := (.Field "provider_status").HumanValue }}
-{{- $address := (.Field "provider_ip_address").HumanValue }}
-<b class="Status{{ $status }}">{{ .Type.Name }}</b>({{- $provider }}, {{ $location }}, {{ $address }}, <a href="/provider/{{ $provider }}/{{ $pid }}" style="font-family: mono">{{ $pid }}</a>)
diff --git a/cloud/bmaas/bmdb/webug/templates/machine.gohtml b/cloud/bmaas/bmdb/webug/templates/machine.gohtml
deleted file mode 100644
index 73c8118..0000000
--- a/cloud/bmaas/bmdb/webug/templates/machine.gohtml
+++ /dev/null
@@ -1,176 +0,0 @@
-{{ template "base.gohtml" .Base }}
-<h2>Machine {{ .Machine.ID }}</h2>
-
-{{ $sessions := .Sessions }}
-
-<table>
-    <tr>
-        <td><b>Machine ID</b></td>
-        <td class="mono">{{ .Machine.ID }}</td>
-    </tr>
-    <tr>
-        <td><b>Created</b></td>
-        <td>{{ .Machine.Created }}</td>
-    </tr>
-    <tr>
-        <td><b>Active Backoffs</b></td>
-        <td>{{ len .Machine.ActiveBackoffs }}</td>
-    </tr>
-    <tr>
-        <td><b>Active Work</b></td>
-        <td>{{ len .Machine.Work }}</td>
-    </tr>
-</table>
-
-<div class="vsplit">
-    <div class="column">
-        <h2>Tags</h2>
-        {{ range $name, $tag := .Machine.Tags }}
-        <table>
-            <tr>
-                <th colspan="2">
-                    {{ template "fragment_tag.gohtml" $tag }}
-                </th>
-            </tr>
-            {{ range $tag.Fields }}
-            <tr>
-                <td>
-                    <b>{{ .Type.NativeName }}:</b>
-                </td>
-                <td class="mono">
-                    <pre>{{ .HumanValue }}</pre>
-                </td>
-            </tr>
-            {{ end }}
-        </table>
-        {{ else }}
-        <i>No tags.</i>
-        {{ end }}
-        <h2>Work</h2>
-        {{ range $name, $work := .Machine.Work }}
-        <table>
-            <tr>
-                <th colspan="3">
-                    <b>{{ $work.Process }}</b>
-                </th>
-            </tr>
-            <tr>
-                <td><b>Process:</b></td>
-                <td class="mono" colspan="2">
-                    {{ $work.Process }}
-                </td>
-            </tr>
-            {{ $sessionOrErr := index $sessions $name }}
-            {{ if ne $sessionOrErr.Error "" }}
-            <tr>
-                <td colspan="3" class="error">
-                    Could not retrieve session information: {{ $sessionOrErr.Error }}
-                </td>
-            </tr>
-            {{ else }}
-            {{ $session := $sessionOrErr.Session }}
-            <tr>
-                <td rowspan="5" style="vertical-align: top;"><b>Session</b></td>
-                <td><b>ID:</b></td>
-                <td class="mono" colspan="2">
-                    <a href="/session/{{ $session.SessionID }}">{{ $session.SessionID }}</a>
-                </td>
-            </tr>
-            <tr>
-                <td><b>Component:</b></td>
-                <td class="mono">{{ $session.SessionComponentName }}</td>
-            </tr>
-            <tr>
-                <td><b>Runtime:</b></td>
-                <td class="mono">{{ $session.SessionRuntimeInfo }}</td>
-            </tr>
-            <tr>
-                <td><b>Created At:</b></td>
-                <td>{{ $session.SessionCreatedAt }}</td>
-            </tr>
-            <tr>
-                <td><b>Liveness:</b></td>
-                <td>Interval {{ $session.SessionIntervalSeconds }}s, deadline {{ $session.SessionDeadline }}</td>
-            </tr>
-            {{ end }}
-        </table>
-        {{ else }}
-        <i>No active work.</i>
-        {{ end }}
-        <h2>Backoffs</h2>
-        <h3>Active</h3>
-        {{ range $name, $backoff := .Machine.ActiveBackoffs }}
-        <table>
-            <tr>
-                <th colspan="2">
-                    <b>{{ $backoff.Process }}</b>
-                </th>
-            </tr>
-            <tr>
-                <td><b>Process:</b></td>
-                <td class="mono">{{ $backoff.Process }}</td>
-            </tr>
-            <tr>
-                <td><b>Until:</b></td>
-                <td class="mono">{{ $backoff.Until }}</td>
-            </tr>
-            <tr>
-                <td><b>Cause:</b></td>
-                <td class="mono">{{ $backoff.Cause }}</td>
-            </tr>
-        </table>
-        {{ else }}
-        <i>No active backoffs.</i>
-        {{ end }}
-        <h3>Expired</h3>
-        {{ range $name, $backoff := .Machine.ExpiredBackoffs }}
-        <table style="opacity: 0.4">
-            <tr>
-                <th colspan="2">
-                    <b>{{ $backoff.Process }}</b>
-                </th>
-            </tr>
-            <tr>
-                <td><b>Process:</b></td>
-                <td class="mono">{{ $backoff.Process }}</td>
-            </tr>
-            <tr>
-                <td><b>Until:</b></td>
-                <td class="mono">{{ $backoff.Until }}</td>
-            </tr>
-            <tr>
-                <td><b>Cause:</b></td>
-                <td class="mono">{{ $backoff.Cause }}</td>
-            </tr>
-        </table>
-        {{ else }}
-        <i>No expired backoffs.</i>
-        {{ end }}
-    </div>
-    <div class="column">
-        <h2>Work History</h2>
-        {{ if ne .HistoryError "" }}
-        <b class="error">Unavailable: {{ .HistoryError }}</b>
-        {{ else }}
-        <i>Note: reverse chronological order.</i>
-        <table>
-            <tr>
-                <th>Time</th>
-                <th>Process</th>
-                <th>Event</th>
-            </tr>
-            {{ range .History }}
-            <tr class="Event{{.Event}}">
-                <td>{{ .Timestamp }}</td>
-                <td><b>{{ .Process }}</b></td>
-                {{ if eq .Event "Failed" }}
-                <td>{{ .Event }}: <span class="mono">{{ .FailedCause.String }}</span></td>
-                {{ else }}
-                <td>{{ .Event }}</td>
-                {{ end }}
-            </tr>
-            {{ end }}
-        </table>
-        {{ end }}
-    </div>
-</div>
\ No newline at end of file
diff --git a/cloud/bmaas/bmdb/webug/templates/machines.gohtml b/cloud/bmaas/bmdb/webug/templates/machines.gohtml
deleted file mode 100644
index b31f9b6..0000000
--- a/cloud/bmaas/bmdb/webug/templates/machines.gohtml
+++ /dev/null
@@ -1,48 +0,0 @@
-{{ template "base.gohtml" .Base }}
-<h2>Machine List</h2>
-<p>
-    Click on a Machine ID to explore it further. Commonly viewed tags are expanded.
-</p>
-<table>
-    <tr>
-        <th>Machine ID</th>
-        <th>Work</th>
-        <th>Backoffs</th>
-        <th>Tags</th>
-    </tr>
-    {{ range .Machines -}}
-    <tr>
-        <td class="mono"><a href="/machine/{{ .ID }}">{{ .ID }}</a></td>
-        <td>
-            {{- range $process, $work := .Work -}}
-            <b><a href="/session/{{ $work.SessionID }}">{{ $process }}</a></b>
-            {{- end -}}
-        </td>
-        <td>
-            {{- range $process, $backoff := .Backoffs -}}
-            <b>{{ $backoff.Process }}</b>(<span class="small">{{ summarizeError .Cause }}</span>)
-            {{- end -}}
-        </td>
-        <td>
-            {{- range $name, $tag := .Tags -}}
-            {{- template "fragment_tag.gohtml" $tag -}}
-            {{- end -}}
-        </td>
-    </tr>
-    {{ end -}}
-</table>
-<table>
-    <tr>
-        {{ range $name, $count := .TagCount -}}
-        <th>{{ $name }}</th>
-        {{ end -}}
-    </tr>
-    <tr>
-        {{ range $name, $count := .TagCount -}}
-        <td>{{ $count }}</td>
-        {{ end -}}
-    </tr>
-</table>
-<p class="small faint mono">
-    {{ .NMachines }} rows, rendered in {{ .RenderTime }}. Query: {{ .Query }}
-</p>
\ No newline at end of file
diff --git a/cloud/bmaas/bmdb/webug/views.go b/cloud/bmaas/bmdb/webug/views.go
deleted file mode 100644
index a0bab7b..0000000
--- a/cloud/bmaas/bmdb/webug/views.go
+++ /dev/null
@@ -1,183 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package webug
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-	"time"
-
-	"github.com/google/uuid"
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/cloud/bmaas/bmdb/reflection"
-)
-
-// baseParams are passed to all rendered templates, and are consumed by tags in
-// templates/base.gohtml.
-type baseParams struct {
-	// Address to display in page header.
-	BMDBAddress string
-	// Schema version to display in page header.
-	BMDBSchema string
-}
-
-// makeBase builds baseParams from information about the current connection.
-func (s *server) makeBase() baseParams {
-	address := fmt.Sprintf("%s@%s", s.conn.DatabaseName, s.conn.Address)
-	if s.conn.InMemory {
-		address += " (in memory)"
-	}
-	return baseParams{
-		BMDBAddress: address,
-		BMDBSchema:  s.curSchema().Version,
-	}
-}
-
-// viewMachines renders a list of all machines in the BMDB.
-func (s *server) viewMachines(w http.ResponseWriter, r *http.Request, args ...string) {
-	start := time.Now()
-	res, err := s.curSchema().GetMachines(r.Context(), &reflection.GetMachinesOpts{Strict: s.strictConsistency})
-	if err != nil {
-		w.WriteHeader(http.StatusInternalServerError)
-		fmt.Fprintf(w, "could not dump BMDB: %v", err)
-		return
-	}
-	duration := time.Since(start)
-
-	tagCount := make(map[string]int)
-	for _, d := range res.Data {
-		for _, t := range d.Tags {
-			tagCount[t.Type.Name()]++
-		}
-	}
-
-	type params struct {
-		Base       baseParams
-		Query      string
-		Machines   []*reflection.Machine
-		NMachines  int
-		RenderTime time.Duration
-		TagCount   map[string]int
-	}
-	err = templates.ExecuteTemplate(w, "machines.gohtml", &params{
-		Base:       s.makeBase(),
-		Query:      res.Query,
-		Machines:   res.Data,
-		NMachines:  len(res.Data),
-		RenderTime: duration,
-		TagCount:   tagCount,
-	})
-	if err != nil {
-		klog.Errorf("Template rendering failed: %v", err)
-	}
-}
-
-// viewMachineDetail renders a detailed page for a single machine.
-func (s *server) viewMachineDetail(w http.ResponseWriter, r *http.Request, args ...string) {
-	mid, err := uuid.Parse(args[0])
-	if err != nil {
-		w.WriteHeader(http.StatusUnprocessableEntity)
-		fmt.Fprintf(w, "invalid machine UUID")
-		return
-	}
-
-	opts := reflection.GetMachinesOpts{
-		FilterMachine:   &mid,
-		Strict:          s.strictConsistency,
-		ExpiredBackoffs: true,
-	}
-	res, err := s.curSchema().GetMachines(r.Context(), &opts)
-	if err != nil {
-		w.WriteHeader(http.StatusInternalServerError)
-		fmt.Fprintf(w, "could not dump BMDB: %v", err)
-		return
-	}
-	if len(res.Data) == 0 {
-		w.WriteHeader(http.StatusNotFound)
-		fmt.Fprintf(w, "machine not found")
-		return
-	}
-	machine := res.Data[0]
-
-	// Params to pass to template.
-	type sessionOrError struct {
-		Session *model.Session
-		Error   string
-	}
-	type params struct {
-		Base    baseParams
-		Machine *reflection.Machine
-
-		HistoryError string
-		History      []model.WorkHistory
-
-		Sessions map[string]sessionOrError
-	}
-	p := params{
-		Base:     s.makeBase(),
-		Machine:  machine,
-		Sessions: make(map[string]sessionOrError),
-	}
-
-	// History retrieval is performed with strict consistency guarantees, and thus
-	// might block. Make sure we don't block the entire page.
-	subQueriesCtx, subQueriesCtxC := context.WithTimeout(r.Context(), time.Second)
-	defer subQueriesCtxC()
-	history, err := s.conn.ListHistoryOf(subQueriesCtx, mid)
-	if err != nil {
-		p.HistoryError = err.Error()
-	}
-
-	// Same for sessions.
-	for name, work := range machine.Work {
-		sessions, err := s.conn.GetSession(subQueriesCtx, work.SessionID)
-		if err != nil {
-			p.Sessions[name] = sessionOrError{Error: err.Error()}
-		} else {
-			if len(sessions) == 0 {
-				// This can happen if the session literally just disappeared.
-				//
-				// TODO(q3k): put all of these operations in a DB TX so that we don't end up with
-				// possible inconsistencies?
-				p.Sessions[name] = sessionOrError{Error: "not found"}
-				continue
-			}
-			p.Sessions[name] = sessionOrError{Session: &sessions[0]}
-		}
-	}
-
-	p.History = make([]model.WorkHistory, len(history))
-	for i := 0; i < len(history); i += 1 {
-		p.History[i] = history[len(history)-(i+1)]
-	}
-	if err := templates.ExecuteTemplate(w, "machine.gohtml", &p); err != nil {
-		klog.Errorf("Template rendering failed: %v", err)
-	}
-}
-
-// viewProviderRedirects redirects a given provider and provider_id into a
-// provider's web portal for more detailed information about an underlying
-// machine.
-func (s *server) viewProviderRedirect(w http.ResponseWriter, r *http.Request, args ...string) {
-	providerUrls := map[string]string{
-		"Equinix": "https://console.equinix.com/devices/%s/overview",
-	}
-	if providerUrls[args[0]] == "" {
-		w.WriteHeader(http.StatusNotFound)
-		fmt.Fprintf(w, "Usage: /provider/Equinix/<id>")
-		return
-	}
-	url := fmt.Sprintf(providerUrls[args[0]], args[1])
-	http.Redirect(w, r, url, http.StatusFound)
-}
-
-// viewSession shows detailed information about a BMDB session.
-func (s *server) viewSession(w http.ResponseWriter, r *http.Request, args ...string) {
-	// TODO(q3k): implement this once we add session info to work history so that
-	// this can actually display something useful.
-	fmt.Fprintf(w, "underconstruction.gif")
-}
diff --git a/cloud/bmaas/bmdb/webug/webug.go b/cloud/bmaas/bmdb/webug/webug.go
deleted file mode 100644
index 137a0fd..0000000
--- a/cloud/bmaas/bmdb/webug/webug.go
+++ /dev/null
@@ -1,187 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-// Package webug implements a web-based debug/troubleshooting/introspection
-// system for the BMDB. It's optimized for use by developers and trained
-// operators, prioritizing information density, fast navigation and heavy
-// interlinking.
-package webug
-
-import (
-	"context"
-	"embed"
-	"flag"
-	"fmt"
-	"html/template"
-	"net/http"
-	"regexp"
-	"sync"
-	"time"
-
-	"github.com/cenkalti/backoff/v4"
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/reflection"
-)
-
-var (
-	//go:embed templates/*.gohtml
-	templateFS embed.FS
-	templates  = template.Must(template.New("base.gohtml").Funcs(templateFuncs).ParseFS(templateFS, "templates/*"))
-)
-
-// server holds the state of an active webug interface.
-type server struct {
-	// connection pool to BMDB.
-	conn *bmdb.Connection
-	// schema retrieved from BMDB.
-	schema *reflection.Schema
-	// muSchema locks schema for updates.
-	muSchema sync.RWMutex
-	// strictConsistency, when enabled, makes webug render its views with the
-	// freshest available data, potentially conflicting with online
-	// transactions. This should only be enabled during testing, as it tends to
-	// clog up the database query planner and make everything slow.
-	strictConsistency bool
-}
-
-// curSchema returns the current cached BMDB schema.
-func (s *server) curSchema() *reflection.Schema {
-	s.muSchema.Lock()
-	defer s.muSchema.Unlock()
-	return s.schema
-}
-
-// schemaWorker runs a background goroutine which attempts to update the server's
-// cached BMDB schema every hour.
-func (s *server) schemaWorker(ctx context.Context) {
-	t := time.NewTicker(time.Hour)
-	defer t.Stop()
-
-	for {
-		// Wait for the timer to tick, or for the context to expire.
-		select {
-		case <-ctx.Done():
-			klog.Infof("Schema fetch worker exiting: %v", ctx.Err())
-			return
-		case <-t.C:
-		}
-
-		// Time to check the schema. Do that in an exponential backoff loop until
-		// successful.
-		bo := backoff.NewExponentialBackOff()
-		bo.MaxElapsedTime = 0
-		var schema *reflection.Schema
-		err := backoff.Retry(func() error {
-			var err error
-			schema, err = s.conn.Reflect(ctx)
-			if err != nil {
-				klog.Warningf("Failed to fetch new schema: %v", err)
-				return err
-			}
-			return nil
-		}, backoff.WithContext(bo, ctx))
-		// This will only happen due to context expiration.
-		if err != nil {
-			klog.Errorf("Giving up on schema fetch: %v", err)
-			continue
-		}
-
-		// Swap the current schema if necessary.
-		cur := s.curSchema().Version
-		newVer := schema.Version
-		if cur != newVer {
-			klog.Infof("Got new schema: %s -> %s", cur, newVer)
-			s.muSchema.Lock()
-			s.schema = schema
-			s.muSchema.Unlock()
-		}
-	}
-}
-
-// Register webug on an HTTP mux, using a BMDB connection pool.
-//
-// The given context will be used not only to time out the registration call, but
-// also used to run a BMDB schema fetching goroutine that will attempt to fetch
-// newer versions of the schema every hour.
-//
-// This is a low-level function useful when tying webug into an existing web
-// application. If you just want to run webug on a separate port that's
-// configured by flags, use Config and Config.RegisterFlags.
-func Register(ctx context.Context, conn *bmdb.Connection, mux *http.ServeMux, enableStrictConsistency bool) error {
-	schema, err := conn.Reflect(ctx)
-	if err != nil {
-		return fmt.Errorf("could not get BMDB schema for webug: %w", err)
-	}
-	s := server{
-		conn:              conn,
-		schema:            schema,
-		strictConsistency: enableStrictConsistency,
-	}
-	go s.schemaWorker(ctx)
-
-	type route struct {
-		pattern *regexp.Regexp
-		handler func(w http.ResponseWriter, r *http.Request, args ...string)
-	}
-
-	routes := []route{
-		{regexp.MustCompile(`^/$`), s.viewMachines},
-		{regexp.MustCompile(`^/machine/([a-fA-F0-9\-]+)$`), s.viewMachineDetail},
-		{regexp.MustCompile(`^/provider/([^/]+)/([^/]+)$`), s.viewProviderRedirect},
-		{regexp.MustCompile(`^/session/([^/]+)`), s.viewSession},
-	}
-
-	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
-		for _, route := range routes {
-			match := route.pattern.FindStringSubmatch(r.URL.Path)
-			if match == nil {
-				continue
-			}
-			route.handler(w, r, match[1:]...)
-			return
-		}
-		http.NotFound(w, r)
-	})
-	return nil
-}
-
-// Config describes the webug interface configuration. This should be embedded
-// inside your component's Config object.
-//
-// To configure, either set values or call RegisterFlags before flag.Parse.
-//
-// To run after configuration, call Start.
-type Config struct {
-	// If set, start a webug interface on an HTTP listener bound to the given address.
-	WebugListenAddress string
-
-	// Enables strict consistency
-	WebugDBFetchStrict bool
-}
-
-// RegisterFlags for webug interface.
-func (c *Config) RegisterFlags() {
-	flag.StringVar(&c.WebugListenAddress, "webug_listen_address", "", "Address to start BMDB webug on. If not set, webug will not be started.")
-	flag.BoolVar(&c.WebugDBFetchStrict, "webug_dbfetch_strict", false, "Enables strict consistency")
-}
-
-// Start the webug interface in the foreground if enabled. The returned error
-// will be either a configuration/connection error returned as soon as possible,
-// or a context expiration error.
-//
-// The given context will be used for all connections from the webug interface to
-// the given BMDB connection.
-func (c *Config) Start(ctx context.Context, conn *bmdb.Connection) error {
-	if c.WebugListenAddress == "" {
-		return nil
-	}
-	mux := http.NewServeMux()
-	if err := Register(ctx, conn, mux, c.WebugDBFetchStrict); err != nil {
-		return err
-	}
-
-	klog.Infof("Webug listening at %s", c.WebugListenAddress)
-	return http.ListenAndServe(c.WebugListenAddress, mux)
-}
diff --git a/cloud/bmaas/scruffy/BUILD.bazel b/cloud/bmaas/scruffy/BUILD.bazel
deleted file mode 100644
index 4934ad2..0000000
--- a/cloud/bmaas/scruffy/BUILD.bazel
+++ /dev/null
@@ -1,48 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-
-go_library(
-    name = "scruffy",
-    srcs = [
-        "bmdb_stats.go",
-        "hw_stats.go",
-        "labels.go",
-        "server.go",
-    ],
-    importpath = "source.monogon.dev/cloud/bmaas/scruffy",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//cloud/bmaas/bmdb",
-        "//cloud/bmaas/bmdb/metrics",
-        "//cloud/bmaas/bmdb/model",
-        "//cloud/bmaas/bmdb/webug",
-        "//cloud/bmaas/server/api",
-        "//cloud/lib/component",
-        "//go/algorithm/cartesian",
-        "@com_github_cenkalti_backoff_v4//:backoff",
-        "@com_github_google_uuid//:uuid",
-        "@com_github_prometheus_client_golang//prometheus",
-        "@io_k8s_klog_v2//:klog",
-        "@org_golang_google_protobuf//proto",
-    ],
-)
-
-go_test(
-    name = "scruffy_test",
-    srcs = [
-        "bmdb_stats_test.go",
-        "hw_stats_test.go",
-    ],
-    data = [
-        "@cockroach",
-    ],
-    embed = [":scruffy"],
-    deps = [
-        "//cloud/agent/api",
-        "//cloud/bmaas/bmdb",
-        "//cloud/bmaas/bmdb/model",
-        "//cloud/bmaas/server/api",
-        "//cloud/lib/component",
-        "@com_github_prometheus_client_golang//prometheus",
-        "@org_golang_google_protobuf//proto",
-    ],
-)
diff --git a/cloud/bmaas/scruffy/bmdb_stats.go b/cloud/bmaas/scruffy/bmdb_stats.go
deleted file mode 100644
index 90b2df2..0000000
--- a/cloud/bmaas/scruffy/bmdb_stats.go
+++ /dev/null
@@ -1,205 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package scruffy
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/prometheus/client_golang/prometheus"
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-)
-
-// bmdbStatsRunner collects metrics from the BMDB and exposes them as Prometheus
-// metrics via a registry passed to newBMDBStatsRunner.
-type bmdbStatsRunner struct {
-	s          *Server
-	collectors []*statsCollector
-}
-
-// A statsCollectorDefinition describes how to gather a given metric via a BMDB
-// SQL query.
-type statsCollectorDefinition struct {
-	// name of the metric. Used in actual metric name, prefixed with 'bmdb_stats_'.
-	name string
-	// help string emitted in prometheus endpoint.
-	help string
-	// labels is the label 'type definition', containing information about the
-	// dimensions of this metric.
-	labels labelDefinitions
-	// query used to retrieve the metric data.
-	query func(*model.Queries, context.Context) ([]model.MetricValue, error)
-}
-
-// labelProcess is the type definition of the 'process' label 'type', which is a
-// fixed-cardinality representation of the database Process enum.
-var labelProcess = labelDefinition{
-	name: "process",
-	initialValues: []string{
-		string(model.ProcessShepherdAccess),
-		string(model.ProcessShepherdAgentStart),
-		string(model.ProcessShepherdRecovery),
-	},
-}
-
-var collectorDefs = []statsCollectorDefinition{
-	{
-		name:   "active_backoffs",
-		help:   "Number of active backoffs, partitioned by process. There may be more than one active backoff per machine.",
-		query:  model.WrapLabeledMetric((*model.Queries).CountActiveBackoffs),
-		labels: []labelDefinition{labelProcess},
-	},
-	{
-		name:   "active_work",
-		help:   "Number of active work, partitioned by process. There may be more than one active work item per machine.",
-		query:  model.WrapLabeledMetric((*model.Queries).CountActiveWork),
-		labels: []labelDefinition{labelProcess},
-	},
-	{
-		name:  "machines",
-		help:  "Number of machines in the BMDB.",
-		query: model.WrapSimpleMetric((*model.Queries).CountMachines),
-	},
-	{
-		name:  "machines_provided",
-		help:  "Number of provided machines in the BMDB.",
-		query: model.WrapSimpleMetric((*model.Queries).CountMachinesProvided),
-	},
-	{
-		name:  "machines_heartbeating",
-		help:  "Number of machines with a currently heartbeating agent.",
-		query: model.WrapSimpleMetric((*model.Queries).CountMachinesAgentHeartbeating),
-	},
-	{
-		name:  "machines_pending_installation",
-		help:  "Number of machines pending installation.",
-		query: model.WrapSimpleMetric((*model.Queries).CountMachinesInstallationPending),
-	},
-	{
-		name:  "machines_installed",
-		help:  "Number of machines succesfully installed.",
-		query: model.WrapSimpleMetric((*model.Queries).CountMachinesInstallationComplete),
-	},
-	{
-		name:  "machines_pending_agent_start",
-		help:  "Number of machines pending the agent start workflow.",
-		query: model.WrapSimpleMetric((*model.Queries).CountMachinesForAgentStart),
-	},
-	{
-		name:  "machines_pending_agent_recovery",
-		help:  "Number of machines pending the agent recovery workflow.",
-		query: model.WrapSimpleMetric((*model.Queries).CountMachinesForAgentRecovery),
-	},
-}
-
-// A statsCollector is an instantiated statsCollectorDefinition which carries the
-// actual prometheus gauge backing the metric.
-type statsCollector struct {
-	gauge *prometheus.GaugeVec
-	def   *statsCollectorDefinition
-}
-
-// setDefaults emits gauges with zero values for all metrics of the runner, using
-// the initialLabel data gathered from each metric definition.
-func (b *bmdbStatsRunner) setDefaults() {
-	for _, collector := range b.collectors {
-		info := collector.def
-		initial := info.labels.initialLabels()
-		if len(initial) == 0 {
-			collector.gauge.With(nil).Set(0.0)
-		} else {
-			for _, labels := range initial {
-				collector.gauge.With(labels).Set(0.0)
-			}
-		}
-	}
-}
-
-// newBMDBStatsRunner builds a bmdbStatsRunner from the collectorDefs above. The
-// bmdbStatsRunner then has the given's Server BMDB connection bound to it and
-// can perform actual database statistic gathering.
-func newBMDBStatsRunner(s *Server, reg *prometheus.Registry) *bmdbStatsRunner {
-	var collectors []*statsCollector
-
-	for _, info := range collectorDefs {
-		info := info
-		gauge := prometheus.NewGaugeVec(prometheus.GaugeOpts{
-			Name: "bmdb_stats_" + info.name,
-			Help: info.help,
-		}, info.labels.names())
-		reg.MustRegister(gauge)
-
-		collectors = append(collectors, &statsCollector{
-			gauge: gauge,
-			def:   &info,
-		})
-	}
-
-	res := &bmdbStatsRunner{
-		s:          s,
-		collectors: collectors,
-	}
-	res.setDefaults()
-	return res
-}
-
-func (b *bmdbStatsRunner) run(ctx context.Context) {
-	klog.Infof("Starting stats runner...")
-
-	ti := time.NewTicker(b.s.Config.StatsRunnerRate)
-
-	for {
-		err := b.runOnce(ctx)
-		if err != nil {
-			if errors.Is(err, ctx.Err()) {
-				return
-			}
-			klog.Errorf("Stats run failed: %v", err)
-		}
-		select {
-		case <-ti.C:
-		case <-ctx.Done():
-			klog.Infof("Exiting stats runner (%v)...", ctx.Err())
-			return
-		}
-	}
-}
-
-func (b *bmdbStatsRunner) runOnce(ctx context.Context) error {
-	sess, err := b.s.session(ctx)
-	if err != nil {
-		return err
-	}
-
-	results := make(map[string][]model.MetricValue)
-	// TODO(q3k): don't fail entire run if we can't collect just one metric.
-	err = sess.Transact(ctx, func(q *model.Queries) error {
-		for _, c := range b.collectors {
-			res, err := c.def.query(q, ctx)
-			if err != nil {
-				return fmt.Errorf("collecting %s failed: %w", c.def.name, err)
-			} else {
-				results[c.def.name] = res
-			}
-		}
-		return nil
-	})
-	if err != nil {
-		return err
-	}
-
-	b.setDefaults()
-	for _, c := range b.collectors {
-		for _, m := range results[c.def.name] {
-			klog.Infof("Setting %s (%v) to %d", c.def.name, m.Labels, m.Count)
-			c.gauge.With(m.Labels).Set(float64(m.Count))
-		}
-	}
-
-	return nil
-}
diff --git a/cloud/bmaas/scruffy/bmdb_stats_test.go b/cloud/bmaas/scruffy/bmdb_stats_test.go
deleted file mode 100644
index 0e28755..0000000
--- a/cloud/bmaas/scruffy/bmdb_stats_test.go
+++ /dev/null
@@ -1,172 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package scruffy
-
-import (
-	"context"
-	"fmt"
-	"sort"
-	"strings"
-	"testing"
-
-	"github.com/prometheus/client_golang/prometheus"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/cloud/lib/component"
-)
-
-func TestBMDBStats(t *testing.T) {
-	s := Server{
-		Config: Config{
-			BMDB: bmdb.BMDB{
-				Config: bmdb.Config{
-					Database: component.CockroachConfig{
-						InMemory: true,
-					},
-				},
-			},
-		},
-	}
-
-	registry := prometheus.NewRegistry()
-	runner := newBMDBStatsRunner(&s, registry)
-
-	ctx, ctxC := context.WithCancel(context.Background())
-	defer ctxC()
-
-	expect := func(wantValues map[string]int64) {
-		t.Helper()
-		res, err := registry.Gather()
-		if err != nil {
-			t.Fatalf("Gather: %v", err)
-		}
-		gotValues := make(map[string]bool)
-		for _, mf := range res {
-			if len(mf.Metric) != 1 {
-				for _, m := range mf.Metric {
-					var lvs []string
-					for _, lp := range m.Label {
-						lvs = append(lvs, fmt.Sprintf("%s=%s", *lp.Name, *lp.Value))
-					}
-					sort.Strings(lvs)
-					name := fmt.Sprintf("%s[%s]", *mf.Name, strings.Join(lvs, ","))
-					gotValues[name] = true
-					if _, ok := wantValues[name]; !ok {
-						t.Errorf("MetricFamily %s: unexpected", name)
-					}
-					if want, got := wantValues[name], int64(*m.Gauge.Value); want != got {
-						t.Errorf("MetricFamily %s: wanted %d, got %d", *mf.Name, want, got)
-					}
-				}
-			} else {
-				m := mf.Metric[0]
-				gotValues[*mf.Name] = true
-				if want, got := wantValues[*mf.Name], int64(*m.Gauge.Value); want != got {
-					t.Errorf("MetricFamily %s: wanted %d, got %d", *mf.Name, want, got)
-				}
-				if _, ok := wantValues[*mf.Name]; !ok {
-					t.Errorf("MetricFamily %s: unexpected", *mf.Name)
-				}
-			}
-		}
-		for mf := range wantValues {
-			if !gotValues[mf] {
-				t.Errorf("MetricFamily %s: missing", mf)
-			}
-		}
-	}
-
-	expect(map[string]int64{
-		"bmdb_stats_machines":                                    0,
-		"bmdb_stats_machines_provided":                           0,
-		"bmdb_stats_machines_heartbeating":                       0,
-		"bmdb_stats_machines_pending_installation":               0,
-		"bmdb_stats_machines_installed":                          0,
-		"bmdb_stats_machines_pending_agent_start":                0,
-		"bmdb_stats_machines_pending_agent_recovery":             0,
-		"bmdb_stats_active_backoffs[process=ShepherdAccess]":     0,
-		"bmdb_stats_active_backoffs[process=ShepherdAgentStart]": 0,
-		"bmdb_stats_active_backoffs[process=ShepherdRecovery]":   0,
-		"bmdb_stats_active_work[process=ShepherdAccess]":         0,
-		"bmdb_stats_active_work[process=ShepherdAgentStart]":     0,
-		"bmdb_stats_active_work[process=ShepherdRecovery]":       0,
-	})
-
-	conn, err := s.Config.BMDB.Open(true)
-	if err != nil {
-		t.Fatalf("Open: %v", err)
-	}
-	sess, err := conn.StartSession(ctx)
-	if err != nil {
-		t.Fatalf("StartSession: %v", err)
-	}
-
-	s.bmdb = conn
-	s.sessionC = make(chan *bmdb.Session)
-	go s.sessionWorker(ctx)
-	if err := runner.runOnce(ctx); err != nil {
-		t.Fatal(err)
-	}
-
-	expect(map[string]int64{
-		"bmdb_stats_machines":                                    0,
-		"bmdb_stats_machines_provided":                           0,
-		"bmdb_stats_machines_heartbeating":                       0,
-		"bmdb_stats_machines_pending_installation":               0,
-		"bmdb_stats_machines_installed":                          0,
-		"bmdb_stats_machines_pending_agent_start":                0,
-		"bmdb_stats_machines_pending_agent_recovery":             0,
-		"bmdb_stats_active_backoffs[process=ShepherdAccess]":     0,
-		"bmdb_stats_active_backoffs[process=ShepherdAgentStart]": 0,
-		"bmdb_stats_active_backoffs[process=ShepherdRecovery]":   0,
-		"bmdb_stats_active_work[process=ShepherdAccess]":         0,
-		"bmdb_stats_active_work[process=ShepherdAgentStart]":     0,
-		"bmdb_stats_active_work[process=ShepherdRecovery]":       0,
-	})
-
-	f := fill().
-		// Provided, needs installation.
-		machine().providedE("1").build().
-		// Three machines needing recovery.
-		machine().providedE("2").agentNeverHeartbeat().build().
-		machine().providedE("3").agentNeverHeartbeat().build().
-		machine().providedE("4").agentNeverHeartbeat().build().
-		// One machine correctly heartbeating.
-		machine().providedE("5").agentHealthy().build().
-		// Two machines heartbeating and pending installation.
-		machine().providedE("6").agentHealthy().installRequested(10).build().
-		machine().providedE("7").agentHealthy().installRequested(10).installReported(9).build().
-		// Machine which is pending installation _and_ recovery.
-		machine().providedE("8").agentNeverHeartbeat().installRequested(10).build().
-		// Machine which has been successfully installed.
-		machine().providedE("9").agentStoppedHeartbeating().installRequested(10).installReported(10).build()
-
-	err = sess.Transact(ctx, func(q *model.Queries) error {
-		return f(ctx, q)
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if err := runner.runOnce(ctx); err != nil {
-		t.Fatal(err)
-	}
-
-	expect(map[string]int64{
-		"bmdb_stats_machines":                                    9,
-		"bmdb_stats_machines_provided":                           9,
-		"bmdb_stats_machines_heartbeating":                       3,
-		"bmdb_stats_machines_pending_installation":               3,
-		"bmdb_stats_machines_installed":                          1,
-		"bmdb_stats_machines_pending_agent_start":                1,
-		"bmdb_stats_machines_pending_agent_recovery":             4,
-		"bmdb_stats_active_backoffs[process=ShepherdAccess]":     0,
-		"bmdb_stats_active_backoffs[process=ShepherdAgentStart]": 0,
-		"bmdb_stats_active_backoffs[process=ShepherdRecovery]":   0,
-		"bmdb_stats_active_work[process=ShepherdAccess]":         0,
-		"bmdb_stats_active_work[process=ShepherdAgentStart]":     0,
-		"bmdb_stats_active_work[process=ShepherdRecovery]":       0,
-	})
-}
diff --git a/cloud/bmaas/scruffy/cmd/BUILD.bazel b/cloud/bmaas/scruffy/cmd/BUILD.bazel
deleted file mode 100644
index 9284aae..0000000
--- a/cloud/bmaas/scruffy/cmd/BUILD.bazel
+++ /dev/null
@@ -1,31 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("@rules_oci//oci:defs.bzl", "oci_image")
-load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
-
-go_library(
-    name = "cmd_lib",
-    srcs = ["main.go"],
-    importpath = "source.monogon.dev/cloud/bmaas/scruffy/cmd",
-    visibility = ["//visibility:private"],
-    deps = ["//cloud/bmaas/scruffy"],
-)
-
-go_binary(
-    name = "cmd",
-    embed = [":cmd_lib"],
-    visibility = ["//visibility:public"],
-)
-
-pkg_tar(
-    name = "cmd_layer",
-    srcs = [":cmd"],
-)
-
-oci_image(
-    name = "cmd_image",
-    base = "@distroless_base",
-    entrypoint = ["/cmd"],
-    tars = [":cmd_layer"],
-    visibility = ["//visibility:public"],
-    workdir = "/app",
-)
diff --git a/cloud/bmaas/scruffy/cmd/main.go b/cloud/bmaas/scruffy/cmd/main.go
deleted file mode 100644
index 457c05a..0000000
--- a/cloud/bmaas/scruffy/cmd/main.go
+++ /dev/null
@@ -1,23 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package main
-
-import (
-	"context"
-	"flag"
-	"os"
-	"os/signal"
-
-	"source.monogon.dev/cloud/bmaas/scruffy"
-)
-
-func main() {
-	s := &scruffy.Server{}
-	s.Config.RegisterFlags()
-	flag.Parse()
-
-	ctx, _ := signal.NotifyContext(context.Background(), os.Interrupt)
-	s.Start(ctx)
-	<-ctx.Done()
-}
diff --git a/cloud/bmaas/scruffy/hw_stats.go b/cloud/bmaas/scruffy/hw_stats.go
deleted file mode 100644
index 0006ef2..0000000
--- a/cloud/bmaas/scruffy/hw_stats.go
+++ /dev/null
@@ -1,167 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package scruffy
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/google/uuid"
-	"github.com/prometheus/client_golang/prometheus"
-	"google.golang.org/protobuf/proto"
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/cloud/bmaas/server/api"
-)
-
-// hwStatsRunner collects metrics from the machine hardware inventory in BMDB and
-// exposes them as Prometheus metrics via a registry passed to newHWStatsRunner.
-type hwStatsRunner struct {
-	s *Server
-
-	nodesPerRegion      *prometheus.GaugeVec
-	memoryPerRegion     *prometheus.GaugeVec
-	cpuThreadsPerRegion *prometheus.GaugeVec
-}
-
-// newHWStatsRunner builds a hwStatsRunner. The hwStatsRunner then has the
-// given's Server BMDB connection bound to it and can perform actual database
-// statistic gathering.
-func newHWStatsRunner(s *Server, reg *prometheus.Registry) *hwStatsRunner {
-	hwsr := &hwStatsRunner{
-		s: s,
-
-		nodesPerRegion: prometheus.NewGaugeVec(prometheus.GaugeOpts{
-			Name: "bmdb_hwstats_region_nodes",
-		}, []string{"provider", "location"}),
-
-		memoryPerRegion: prometheus.NewGaugeVec(prometheus.GaugeOpts{
-			Name: "bmdb_hwstats_region_ram_bytes",
-		}, []string{"provider", "location"}),
-
-		cpuThreadsPerRegion: prometheus.NewGaugeVec(prometheus.GaugeOpts{
-			Name: "bmdb_hwstats_region_cpu_threads",
-		}, []string{"provider", "location"}),
-	}
-	reg.MustRegister(hwsr.nodesPerRegion, hwsr.memoryPerRegion, hwsr.cpuThreadsPerRegion)
-	return hwsr
-}
-
-func (h *hwStatsRunner) run(ctx context.Context) {
-	klog.Infof("Starting stats runner...")
-
-	ti := time.NewTicker(time.Minute)
-
-	for {
-		err := h.runOnce(ctx)
-		if err != nil {
-			if errors.Is(err, ctx.Err()) {
-				return
-			}
-			klog.Errorf("Stats run failed: %v", err)
-		}
-		select {
-		case <-ti.C:
-		case <-ctx.Done():
-			klog.Infof("Exiting stats runner (%v)...", ctx.Err())
-			return
-		}
-	}
-}
-
-// statsPerRegion are gathered and aggregated (summed) per region.
-type statsPerRegion struct {
-	nodes      uint64
-	ramBytes   uint64
-	numThreads uint64
-}
-
-// add a given AgentHardwareReport to this region's data.
-func (s *statsPerRegion) add(hwrep *api.AgentHardwareReport) {
-	s.nodes++
-	s.ramBytes += uint64(hwrep.Report.MemoryInstalledBytes)
-	for _, cpu := range hwrep.Report.Cpu {
-		s.numThreads += uint64(cpu.HardwareThreads)
-	}
-}
-
-// regionKey is used to uniquely identify each region per each provider.
-type regionKey struct {
-	provider model.Provider
-	location string
-}
-
-func (r *regionKey) String() string {
-	return fmt.Sprintf("%s/%s", r.provider, r.location)
-}
-
-func (h *hwStatsRunner) runOnce(ctx context.Context) error {
-	sess, err := h.s.session(ctx)
-	if err != nil {
-		return err
-	}
-
-	var start uuid.UUID
-
-	perRegion := make(map[regionKey]*statsPerRegion)
-	var total statsPerRegion
-
-	for {
-		var res []model.ListMachineHardwareRow
-		err = sess.Transact(ctx, func(q *model.Queries) error {
-			res, err = q.ListMachineHardware(ctx, model.ListMachineHardwareParams{
-				Limit:     100,
-				MachineID: start,
-			})
-			return err
-		})
-		if err != nil {
-			return err
-		}
-		klog.Infof("Machines: %d chunk", len(res))
-		if len(res) == 0 {
-			break
-		}
-		for _, row := range res {
-			var hwrep api.AgentHardwareReport
-			err = proto.Unmarshal(row.HardwareReportRaw.([]byte), &hwrep)
-			if err != nil {
-				klog.Warningf("Could not decode hardware report from %s: %v", row.MachineID, err)
-				continue
-			}
-
-			if !row.ProviderLocation.Valid {
-				klog.Warningf("%s has no provider location, skipping", row.MachineID)
-				continue
-			}
-
-			key := regionKey{
-				provider: row.Provider,
-				location: row.ProviderLocation.String,
-			}
-			if _, ok := perRegion[key]; !ok {
-				perRegion[key] = &statsPerRegion{}
-			}
-			perRegion[key].add(&hwrep)
-			total.add(&hwrep)
-
-			start = row.MachineID
-		}
-	}
-
-	for k, st := range perRegion {
-		labels := prometheus.Labels{
-			"provider": string(k.provider),
-			"location": k.location,
-		}
-
-		h.nodesPerRegion.With(labels).Set(float64(st.nodes))
-		h.memoryPerRegion.With(labels).Set(float64(st.ramBytes))
-		h.cpuThreadsPerRegion.With(labels).Set(float64(st.numThreads))
-	}
-	return nil
-}
diff --git a/cloud/bmaas/scruffy/hw_stats_test.go b/cloud/bmaas/scruffy/hw_stats_test.go
deleted file mode 100644
index 7dc8139..0000000
--- a/cloud/bmaas/scruffy/hw_stats_test.go
+++ /dev/null
@@ -1,324 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package scruffy
-
-import (
-	"context"
-	"database/sql"
-	"testing"
-	"time"
-
-	"github.com/prometheus/client_golang/prometheus"
-	"google.golang.org/protobuf/proto"
-
-	aapi "source.monogon.dev/cloud/agent/api"
-	"source.monogon.dev/cloud/bmaas/server/api"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/cloud/lib/component"
-)
-
-type filler func(ctx context.Context, q *model.Queries) error
-
-func fill() filler {
-	return func(ctx context.Context, q *model.Queries) error {
-		return nil
-	}
-}
-
-func (f filler) chain(n func(ctx context.Context, q *model.Queries) error) filler {
-	return func(ctx context.Context, q *model.Queries) error {
-		if err := f(ctx, q); err != nil {
-			return err
-		}
-		return n(ctx, q)
-	}
-}
-
-type fillerMachine struct {
-	f filler
-
-	provider   *model.Provider
-	providerID *string
-
-	location *string
-
-	threads *int32
-	ramgb   *int64
-
-	agentStartedAt *time.Time
-
-	agentHeartbeatAt *time.Time
-
-	installationRequestGeneration *int64
-
-	installationReportGeneration *int64
-}
-
-func (f filler) machine() *fillerMachine {
-	return &fillerMachine{
-		f: f,
-	}
-}
-
-func (m *fillerMachine) provided(p model.Provider, pid string) *fillerMachine {
-	m.provider = &p
-	m.providerID = &pid
-	return m
-}
-
-func (m *fillerMachine) providedE(pid string) *fillerMachine {
-	return m.provided(model.ProviderEquinix, pid)
-}
-
-func (m *fillerMachine) located(location string) *fillerMachine {
-	m.location = &location
-	return m
-}
-
-func (m *fillerMachine) hardware(threads int32, ramgb int64) *fillerMachine {
-	m.threads = &threads
-	m.ramgb = &ramgb
-	return m
-}
-
-func (m *fillerMachine) agentStarted(t time.Time) *fillerMachine {
-	m.agentStartedAt = &t
-	return m
-}
-
-func (m *fillerMachine) agentHeartbeat(t time.Time) *fillerMachine {
-	m.agentHeartbeatAt = &t
-	return m
-}
-
-func (m *fillerMachine) agentHealthy() *fillerMachine {
-	now := time.Now()
-	return m.agentStarted(now.Add(-30 * time.Minute)).agentHeartbeat(now.Add(-1 * time.Minute))
-}
-
-func (m *fillerMachine) agentStoppedHeartbeating() *fillerMachine {
-	now := time.Now()
-	return m.agentStarted(now.Add(-30 * time.Minute)).agentHeartbeat(now.Add(-20 * time.Minute))
-}
-
-func (m *fillerMachine) agentNeverHeartbeat() *fillerMachine {
-	now := time.Now()
-	return m.agentStarted(now.Add(-30 * time.Minute))
-}
-
-func (m *fillerMachine) installRequested(gen int64) *fillerMachine {
-	m.installationRequestGeneration = &gen
-	return m
-}
-
-func (m *fillerMachine) installReported(gen int64) *fillerMachine {
-	m.installationReportGeneration = &gen
-	return m
-}
-
-func (m *fillerMachine) build() filler {
-	return m.f.chain(func(ctx context.Context, q *model.Queries) error {
-		mach, err := q.NewMachine(ctx)
-		if err != nil {
-			return err
-		}
-		if m.providerID != nil {
-			err = q.MachineAddProvided(ctx, model.MachineAddProvidedParams{
-				MachineID:  mach.MachineID,
-				Provider:   *m.provider,
-				ProviderID: *m.providerID,
-			})
-			if err != nil {
-				return err
-			}
-			if m.location != nil {
-				err = q.MachineUpdateProviderStatus(ctx, model.MachineUpdateProviderStatusParams{
-					ProviderID:       *m.providerID,
-					Provider:         *m.provider,
-					ProviderLocation: sql.NullString{Valid: true, String: *m.location},
-				})
-				if err != nil {
-					return err
-				}
-			}
-		}
-		if m.threads != nil {
-			report := api.AgentHardwareReport{
-				Report: &aapi.Node{
-					MemoryInstalledBytes: *m.ramgb << 30,
-					MemoryUsableRatio:    1.0,
-					Cpu: []*aapi.CPU{
-						{
-							HardwareThreads: *m.threads,
-							Cores:           *m.threads,
-						},
-					},
-				},
-				Warning: nil,
-			}
-			raw, err := proto.Marshal(&report)
-			if err != nil {
-				return err
-			}
-			err = q.MachineSetHardwareReport(ctx, model.MachineSetHardwareReportParams{
-				MachineID:         mach.MachineID,
-				HardwareReportRaw: raw,
-			})
-			if err != nil {
-				return err
-			}
-		}
-		if m.agentStartedAt != nil {
-			err = q.MachineSetAgentStarted(ctx, model.MachineSetAgentStartedParams{
-				MachineID:      mach.MachineID,
-				AgentStartedAt: *m.agentStartedAt,
-				AgentPublicKey: []byte("fakefakefake"),
-			})
-			if err != nil {
-				return err
-			}
-		}
-		if m.agentHeartbeatAt != nil {
-			err = q.MachineSetAgentHeartbeat(ctx, model.MachineSetAgentHeartbeatParams{
-				MachineID:        mach.MachineID,
-				AgentHeartbeatAt: *m.agentHeartbeatAt,
-			})
-			if err != nil {
-				return err
-			}
-		}
-		if m.installationRequestGeneration != nil {
-			err = q.MachineSetOSInstallationRequest(ctx, model.MachineSetOSInstallationRequestParams{
-				MachineID:  mach.MachineID,
-				Generation: *m.installationRequestGeneration,
-			})
-			if err != nil {
-				return err
-			}
-		}
-		if m.installationReportGeneration != nil {
-			err = q.MachineSetOSInstallationReport(ctx, model.MachineSetOSInstallationReportParams{
-				MachineID:            mach.MachineID,
-				Generation:           *m.installationReportGeneration,
-				OsInstallationResult: model.MachineOsInstallationResultSuccess,
-			})
-			if err != nil {
-				return err
-			}
-		}
-		return nil
-	})
-}
-
-func TestHWStats(t *testing.T) {
-	s := Server{
-		Config: Config{
-			BMDB: bmdb.BMDB{
-				Config: bmdb.Config{
-					Database: component.CockroachConfig{
-						InMemory: true,
-					},
-				},
-			},
-		},
-	}
-
-	registry := prometheus.NewRegistry()
-	runner := newHWStatsRunner(&s, registry)
-
-	ctx, ctxC := context.WithCancel(context.Background())
-	defer ctxC()
-
-	res, err := registry.Gather()
-	if err != nil {
-		t.Fatalf("Gather: %v", err)
-	}
-	if want, got := 0, len(res); want != got {
-		t.Fatalf("Expected no metrics with empty database, got %d", got)
-	}
-
-	conn, err := s.Config.BMDB.Open(true)
-	if err != nil {
-		t.Fatalf("Open: %v", err)
-	}
-	sess, err := conn.StartSession(ctx)
-	if err != nil {
-		t.Fatalf("StartSession: %v", err)
-	}
-	// Populate database with some test data.
-	err = sess.Transact(ctx, func(q *model.Queries) error {
-		f := fill().
-			machine().provided(model.ProviderEquinix, "1").hardware(32, 256).located("dark-bramble").build().
-			machine().provided(model.ProviderEquinix, "2").hardware(32, 256).located("dark-bramble").build().
-			machine().provided(model.ProviderEquinix, "3").hardware(32, 256).located("dark-bramble").build().
-			machine().provided(model.ProviderEquinix, "4").hardware(32, 256).located("brittle-hollow").build().
-			machine().provided(model.ProviderEquinix, "5").hardware(32, 256).located("timber-hearth").build().
-			machine().provided(model.ProviderEquinix, "6").hardware(32, 256).located("timber-hearth").build()
-		return f(ctx, q)
-	})
-	if err != nil {
-		t.Fatalf("Transact: %v", err)
-	}
-
-	s.bmdb = conn
-	s.sessionC = make(chan *bmdb.Session)
-	go s.sessionWorker(ctx)
-
-	// Do a statistics run and check results.
-	if err := runner.runOnce(ctx); err != nil {
-		t.Fatalf("runOnce: %v", err)
-	}
-
-	mfs, err := registry.Gather()
-	if err != nil {
-		t.Fatalf("Gatcher: %v", err)
-	}
-
-	// metric name -> provider -> location -> value
-	values := make(map[string]map[string]map[string]float64)
-	for _, mf := range mfs {
-		values[*mf.Name] = make(map[string]map[string]float64)
-		for _, m := range mf.Metric {
-			var provider, location string
-			for _, pair := range m.Label {
-				switch *pair.Name {
-				case "location":
-					location = *pair.Value
-				case "provider":
-					provider = *pair.Value
-				}
-			}
-			if _, ok := values[*mf.Name][provider]; !ok {
-				values[*mf.Name][provider] = make(map[string]float64)
-			}
-			switch {
-			case m.Gauge != nil && m.Gauge.Value != nil:
-				values[*mf.Name][provider][location] = *m.Gauge.Value
-			}
-		}
-	}
-
-	for _, te := range []struct {
-		provider model.Provider
-		location string
-		threads  int32
-		ramgb    int64
-	}{
-		{model.ProviderEquinix, "dark-bramble", 96, 768},
-		{model.ProviderEquinix, "brittle-hollow", 32, 256},
-		{model.ProviderEquinix, "timber-hearth", 64, 512},
-	} {
-		threads := values["bmdb_hwstats_region_cpu_threads"][string(te.provider)][te.location]
-		bytes := values["bmdb_hwstats_region_ram_bytes"][string(te.provider)][te.location]
-
-		if want, got := te.threads, int32(threads); want != got {
-			t.Errorf("Wanted %d threads in %s/%s, got %d", want, te.provider, te.location, got)
-		}
-		if want, got := te.ramgb, int64(bytes)>>30; want != got {
-			t.Errorf("Wanted %d GB RAM in %s/%s, got %d", want, te.provider, te.location, got)
-		}
-	}
-}
diff --git a/cloud/bmaas/scruffy/labels.go b/cloud/bmaas/scruffy/labels.go
deleted file mode 100644
index c90e43a..0000000
--- a/cloud/bmaas/scruffy/labels.go
+++ /dev/null
@@ -1,97 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package scruffy
-
-import (
-	"github.com/prometheus/client_golang/prometheus"
-
-	"source.monogon.dev/go/algorithm/cartesian"
-)
-
-// A labelDefinition describes a key/value pair that's a metric dimension. It
-// consists of the label key/name (a string), and a list of possible values of
-// this key. The list of values will be used to initialize the metrics at startup
-// with zero values.
-//
-// The initialValues system is intended to be used with labels that are
-// low-cardinality enums, e.g. the name of a subsystem.
-//
-// All labelDefinitions for a single metric will then create a cartesian product
-// of all initialValues.
-type labelDefinition struct {
-	// name/key of the label.
-	name string
-	// initialValues defines the default values for this label key/name that will be
-	// used to generate a list of initial zero-filled metrics.
-	initialValues []string
-}
-
-// labelDefinitions is a list of labelDefinition which define the label
-// dimensions of a metric. All the initialValues of the respective
-// labelDefinitions will create a cartesian set of default zero-filled metric
-// values when the metric susbsystem gets initialized. These zero values will
-// then get overridden by real data as it is collected.
-type labelDefinitions []labelDefinition
-
-// initialLabels generates the list of initial labels key/values that should be
-// used to generate zero-filled metrics on startup. This is a cartesian product
-// of all initialValues of all labelDefinitions.
-func (l labelDefinitions) initialLabels() []prometheus.Labels {
-	// Nothing to do if this is an empty labelDefinitions.
-	if len(l) == 0 {
-		return nil
-	}
-
-	// Given:
-	//
-	// labelDefinitions := []labelDefinition{
-	//    { name: "a", initialValues: []string{"foo", "bar"}},
-	//    { name: "b", initialValues: []string{"baz", "barf"}},
-	// }
-	//
-	// This creates:
-	//
-	// values := []string{
-	//    { "foo", "bar" }, // label 'a'
-	//    { "baz", "barf" }, // label 'b'
-	// }
-	var values [][]string
-	for _, ld := range l {
-		values = append(values, ld.initialValues)
-	}
-
-	// Given the above:
-	//
-	// valuesProduct := []string{
-	//    //  a      b
-	//    { "foo", "baz" },
-	//    { "foo", "barf" },
-	//    { "bar", "baz" },
-	//    { "bar", "barf" },
-	// }
-	valuesProduct := cartesian.Product[string](values...)
-
-	// This converts valuesProduct into an actual prometheus-compatible type,
-	// re-attaching the label names back into the columns as seen above.
-	var res []prometheus.Labels
-	for _, vp := range valuesProduct {
-		labels := make(prometheus.Labels)
-		for i, lv := range vp {
-			labelDef := l[i]
-			labels[labelDef.name] = lv
-		}
-		res = append(res, labels)
-	}
-	return res
-}
-
-// names returns the keys/names of all the metric labels from these
-// labelDefinitions.
-func (l labelDefinitions) names() []string {
-	var res []string
-	for _, ld := range l {
-		res = append(res, ld.name)
-	}
-	return res
-}
diff --git a/cloud/bmaas/scruffy/server.go b/cloud/bmaas/scruffy/server.go
deleted file mode 100644
index d020a77..0000000
--- a/cloud/bmaas/scruffy/server.go
+++ /dev/null
@@ -1,131 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-// Package scruffy implements Scruffy, The Janitor.
-//
-// Scruffy is a BMaaS component which runs a bunch of important, housekeeping-ish
-// processes that aren't tied to any particular provider and are mostly
-// batch-oriented.
-//
-// Currently Scruffy just collects metrics from the BMDB.
-package scruffy
-
-import (
-	"context"
-	"errors"
-	"flag"
-	"fmt"
-	"os"
-	"time"
-
-	"github.com/cenkalti/backoff/v4"
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/metrics"
-	"source.monogon.dev/cloud/bmaas/bmdb/webug"
-	"source.monogon.dev/cloud/lib/component"
-)
-
-type Config struct {
-	Component component.ComponentConfig
-	BMDB      bmdb.BMDB
-	Webug     webug.Config
-
-	StatsRunnerRate time.Duration
-}
-
-// TODO(q3k): factor this out to BMDB library?
-func runtimeInfo() string {
-	hostname, _ := os.Hostname()
-	if hostname == "" {
-		hostname = "UNKNOWN"
-	}
-	return fmt.Sprintf("host %s", hostname)
-}
-
-func (c *Config) RegisterFlags() {
-	c.Component.RegisterFlags("scruffy")
-	c.BMDB.ComponentName = "scruffy"
-	c.BMDB.RuntimeInfo = runtimeInfo()
-	c.BMDB.Database.RegisterFlags("bmdb")
-	c.Webug.RegisterFlags()
-
-	flag.DurationVar(&c.StatsRunnerRate, "scruffy_stats_collection_rate", time.Minute, "How often the stats collection loop will run against BMDB")
-}
-
-type Server struct {
-	Config Config
-
-	bmdb     *bmdb.Connection
-	sessionC chan *bmdb.Session
-}
-
-func (s *Server) Start(ctx context.Context) {
-	reg := s.Config.Component.PrometheusRegistry()
-	s.Config.BMDB.EnableMetrics(reg)
-	s.Config.Component.StartPrometheus(ctx)
-
-	conn, err := s.Config.BMDB.Open(true)
-	if err != nil {
-		klog.Exitf("Failed to connect to BMDB: %v", err)
-	}
-	s.bmdb = conn
-	s.sessionC = make(chan *bmdb.Session)
-	go s.sessionWorker(ctx)
-
-	bsr := newBMDBStatsRunner(s, reg)
-	go bsr.run(ctx)
-
-	hwr := newHWStatsRunner(s, reg)
-	go hwr.run(ctx)
-
-	go func() {
-		if err := s.Config.Webug.Start(ctx, conn); err != nil && !errors.Is(err, ctx.Err()) {
-			klog.Exitf("Failed to start webug: %v", err)
-		}
-	}()
-}
-
-// sessionWorker emits a valid BMDB session to sessionC as long as ctx is active.
-//
-// TODO(q3k): factor out into bmdb client lib
-func (s *Server) sessionWorker(ctx context.Context) {
-	var session *bmdb.Session
-	for {
-		if session == nil || session.Expired() {
-			klog.Infof("Starting new session...")
-			bo := backoff.NewExponentialBackOff()
-			err := backoff.Retry(func() error {
-				var err error
-				session, err = s.bmdb.StartSession(ctx, bmdb.SessionOption{Processor: metrics.ProcessorScruffyStats})
-				if err != nil {
-					klog.Errorf("Failed to start session: %v", err)
-					return err
-				} else {
-					return nil
-				}
-			}, backoff.WithContext(bo, ctx))
-			if err != nil {
-				// If something's really wrong just crash.
-				klog.Exitf("Gave up on starting session: %v", err)
-			}
-			klog.Infof("New session: %s", session.UUID)
-		}
-
-		select {
-		case <-ctx.Done():
-			return
-		case s.sessionC <- session:
-		}
-	}
-}
-
-func (s *Server) session(ctx context.Context) (*bmdb.Session, error) {
-	select {
-	case sess := <-s.sessionC:
-		return sess, nil
-	case <-ctx.Done():
-		return nil, ctx.Err()
-	}
-}
diff --git a/cloud/bmaas/server/BUILD.bazel b/cloud/bmaas/server/BUILD.bazel
deleted file mode 100644
index d23f56b..0000000
--- a/cloud/bmaas/server/BUILD.bazel
+++ /dev/null
@@ -1,47 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-
-go_library(
-    name = "server",
-    srcs = [
-        "agent_callback_service.go",
-        "server.go",
-    ],
-    importpath = "source.monogon.dev/cloud/bmaas/server",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//cloud/bmaas/bmdb",
-        "//cloud/bmaas/bmdb/metrics",
-        "//cloud/bmaas/bmdb/model",
-        "//cloud/bmaas/bmdb/webug",
-        "//cloud/bmaas/server/api",
-        "//cloud/lib/component",
-        "//metropolis/node/core/rpc",
-        "@com_github_cenkalti_backoff_v4//:backoff",
-        "@com_github_google_uuid//:uuid",
-        "@io_k8s_klog_v2//:klog",
-        "@org_golang_google_grpc//:grpc",
-        "@org_golang_google_grpc//codes",
-        "@org_golang_google_grpc//reflection",
-        "@org_golang_google_grpc//status",
-        "@org_golang_google_protobuf//proto",
-    ],
-)
-
-go_test(
-    name = "server_test",
-    srcs = ["agent_callback_service_test.go"],
-    data = [
-        "@cockroach",
-    ],
-    embed = [":server"],
-    deps = [
-        "//cloud/bmaas/bmdb",
-        "//cloud/bmaas/bmdb/model",
-        "//cloud/bmaas/server/api",
-        "//cloud/lib/component",
-        "//metropolis/node/core/rpc",
-        "@com_github_google_uuid//:uuid",
-        "@org_golang_google_grpc//:grpc",
-        "@org_golang_google_protobuf//proto",
-    ],
-)
diff --git a/cloud/bmaas/server/README.md b/cloud/bmaas/server/README.md
deleted file mode 100644
index b84ae25..0000000
--- a/cloud/bmaas/server/README.md
+++ /dev/null
@@ -1,27 +0,0 @@
-BMaaS Server
-===
-
-Background
----
-
-This server provides an interface to the BMaaS database/state over a gRPC API. Most components of the BMaaS system talk to the database directly whenever possible. Everything else communicates through this server.
-
-Currently this is:
-
-1. Agents running on machines, as they should only be allowed to access/update information about the machine they're running on, and they're generally considered untrusted since they run on end-user available machines.
-
-In the future this server will likely also take care of:
-
-1. A debug web API for developers/administrators to inspect database/BMDB state.
-2. Periodic batch jobs across the entire BMDB, like consistency checks.
-3. Exporting BMDB state into monitoring systems.
-4. Coordinating access to the BMDB systems if the current direct-access-to-database architecture stops scaling.
-
-Running
----
-
-    bazel run //cloud/bmaas/server/cmd -- -srv_dev_certs -bmdb_eat_my_data
-
-Although that's not very useful in itself currently. Instead, most functionality is currently exercised through automated tests.
-
-TODO(q3k): document complete BMaaS dev deployment (multi-component, single BMDB).
\ No newline at end of file
diff --git a/cloud/bmaas/server/agent_callback_service.go b/cloud/bmaas/server/agent_callback_service.go
deleted file mode 100644
index b664231..0000000
--- a/cloud/bmaas/server/agent_callback_service.go
+++ /dev/null
@@ -1,166 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package server
-
-import (
-	"context"
-	"crypto/ed25519"
-	"encoding/hex"
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/google/uuid"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-	"google.golang.org/protobuf/proto"
-	"k8s.io/klog/v2"
-
-	apb "source.monogon.dev/cloud/bmaas/server/api"
-
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/metropolis/node/core/rpc"
-)
-
-type agentCallbackService struct {
-	s *Server
-}
-
-var (
-	errAgentUnauthenticated = errors.New("machine id or public key unknown")
-)
-
-func (a *agentCallbackService) Heartbeat(ctx context.Context, req *apb.HeartbeatRequest) (*apb.HeartbeatResponse, error) {
-	// Extract ED25519 self-signed certificate from client connection.
-	cert, err := rpc.GetPeerCertificate(ctx)
-	if err != nil {
-		return nil, err
-	}
-	pk := cert.PublicKey.(ed25519.PublicKey)
-	machineId, err := uuid.Parse(req.MachineId)
-	if err != nil {
-		return nil, status.Error(codes.InvalidArgument, "machine_id invalid")
-	}
-
-	session, err := a.s.session(ctx)
-	if err != nil {
-		klog.Errorf("Could not start session: %v", err)
-		return nil, status.Error(codes.Unavailable, "could not start session")
-	}
-
-	// Verify that machine ID and connection public key match up to a machine in the
-	// BMDB. Prevent leaking information about a machine's existence to unauthorized
-	// agents.
-	err = session.Transact(ctx, func(q *model.Queries) error {
-		agents, err := q.AuthenticateAgentConnection(ctx, model.AuthenticateAgentConnectionParams{
-			MachineID:      machineId,
-			AgentPublicKey: pk,
-		})
-		if err != nil {
-			return fmt.Errorf("AuthenticateAgentConnection: %w", err)
-		}
-		if len(agents) < 1 {
-			klog.Errorf("No agent for %s/%s", machineId.String(), hex.EncodeToString(pk))
-			return errAgentUnauthenticated
-		}
-		return nil
-	})
-	if err != nil {
-		if errors.Is(err, errAgentUnauthenticated) {
-			return nil, status.Error(codes.Unauthenticated, err.Error())
-		}
-		klog.Errorf("Could not authenticate agent: %v", err)
-		return nil, status.Error(codes.Unavailable, "could not authenticate agent")
-	}
-
-	// Request is now authenticated.
-
-	// Serialize hardware report if submitted alongside heartbeat.
-	var hwraw []byte
-	if req.HardwareReport != nil {
-		hwraw, err = proto.Marshal(req.HardwareReport)
-		if err != nil {
-			return nil, status.Errorf(codes.InvalidArgument, "could not serialize hardware report: %v", err)
-		}
-	}
-
-	var installRaw []byte
-	if req.InstallationReport != nil {
-		installRaw, err = proto.Marshal(req.InstallationReport)
-		if err != nil {
-			return nil, status.Errorf(codes.InvalidArgument, "could not serialize installation report: %v", err)
-		}
-	}
-
-	// Upsert heartbeat time and hardware report.
-	err = session.Transact(ctx, func(q *model.Queries) error {
-		// Upsert hardware report if submitted.
-		if len(hwraw) != 0 {
-			err = q.MachineSetHardwareReport(ctx, model.MachineSetHardwareReportParams{
-				MachineID:         machineId,
-				HardwareReportRaw: hwraw,
-			})
-			if err != nil {
-				return fmt.Errorf("hardware report upsert: %w", err)
-			}
-		}
-		// Upsert os installation report if submitted.
-		if len(installRaw) != 0 {
-			var result model.MachineOsInstallationResult
-			switch req.InstallationReport.Result.(type) {
-			case *apb.OSInstallationReport_Success_:
-				result = model.MachineOsInstallationResultSuccess
-			case *apb.OSInstallationReport_Error_:
-				result = model.MachineOsInstallationResultError
-			default:
-				return fmt.Errorf("unknown installation report result: %T", req.InstallationReport.Result)
-			}
-			err = q.MachineSetOSInstallationReport(ctx, model.MachineSetOSInstallationReportParams{
-				MachineID:               machineId,
-				Generation:              req.InstallationReport.Generation,
-				OsInstallationResult:    result,
-				OsInstallationReportRaw: installRaw,
-			})
-		}
-		return q.MachineSetAgentHeartbeat(ctx, model.MachineSetAgentHeartbeatParams{
-			MachineID:        machineId,
-			AgentHeartbeatAt: time.Now(),
-		})
-	})
-	if err != nil {
-		klog.Errorf("Could not submit heartbeat: %v", err)
-		return nil, status.Error(codes.Unavailable, "could not submit heartbeat")
-	}
-	klog.Infof("Heartbeat from %s/%s", machineId.String(), hex.EncodeToString(pk))
-
-	// Get installation request for machine if present.
-	var installRequest *apb.OSInstallationRequest
-	err = session.Transact(ctx, func(q *model.Queries) error {
-		reqs, err := q.GetExactMachineForOSInstallation(ctx, model.GetExactMachineForOSInstallationParams{
-			MachineID: machineId,
-			Limit:     1,
-		})
-		if err != nil {
-			return fmt.Errorf("GetExactMachineForOSInstallation: %w", err)
-		}
-		if len(reqs) > 0 {
-			raw := reqs[0].OsInstallationRequestRaw
-			var preq apb.OSInstallationRequest
-			if err := proto.Unmarshal(raw, &preq); err != nil {
-				return fmt.Errorf("could not decode stored OS installation request: %w", err)
-			}
-			installRequest = &preq
-		}
-		return nil
-	})
-	if err != nil {
-		// Do not fail entire request. Instead, just log an error.
-		// TODO(q3k): alert on this
-		klog.Errorf("Failure during OS installation request retrieval: %v", err)
-	}
-
-	return &apb.HeartbeatResponse{
-		InstallationRequest: installRequest,
-	}, nil
-}
diff --git a/cloud/bmaas/server/agent_callback_service_test.go b/cloud/bmaas/server/agent_callback_service_test.go
deleted file mode 100644
index a055d1d..0000000
--- a/cloud/bmaas/server/agent_callback_service_test.go
+++ /dev/null
@@ -1,256 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package server
-
-import (
-	"context"
-	"crypto/ed25519"
-	"crypto/rand"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-	"google.golang.org/grpc"
-	"google.golang.org/protobuf/proto"
-
-	apb "source.monogon.dev/cloud/bmaas/server/api"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/cloud/lib/component"
-	"source.monogon.dev/metropolis/node/core/rpc"
-)
-
-func dut() *Server {
-	return &Server{
-		Config: Config{
-			Component: component.ComponentConfig{
-				GRPCListenAddress: ":0",
-				DevCerts:          true,
-				DevCertsPath:      "/tmp/foo",
-			},
-			BMDB: bmdb.BMDB{
-				Config: bmdb.Config{
-					Database: component.CockroachConfig{
-						InMemory: true,
-					},
-				},
-			},
-			PublicListenAddress: ":0",
-		},
-	}
-}
-
-// TestAgentCallbackService exercises the basic flow for submitting an agent
-// heartbeat and hardware report.
-func TestAgentCallbackService(t *testing.T) {
-	s := dut()
-	ctx, ctxC := context.WithCancel(context.Background())
-	defer ctxC()
-	s.Start(ctx)
-
-	pub, priv, err := ed25519.GenerateKey(rand.Reader)
-	if err != nil {
-		t.Fatalf("could not generate keypair: %v", err)
-	}
-
-	sess, err := s.bmdb.StartSession(ctx)
-	if err != nil {
-		t.Fatalf("could not start session")
-	}
-
-	heartbeat := func(mid uuid.UUID) error {
-		creds, err := rpc.NewEphemeralCredentials(priv, rpc.WantInsecure())
-		if err != nil {
-			t.Fatalf("could not generate ephemeral credentials: %v", err)
-		}
-		conn, err := grpc.NewClient(s.ListenPublic, grpc.WithTransportCredentials(creds))
-		if err != nil {
-			t.Fatalf("NewClient failed: %v", err)
-		}
-		defer conn.Close()
-
-		stub := apb.NewAgentCallbackClient(conn)
-		_, err = stub.Heartbeat(ctx, &apb.HeartbeatRequest{
-			MachineId:      mid.String(),
-			HardwareReport: &apb.AgentHardwareReport{},
-		})
-		return err
-	}
-
-	// First, attempt to heartbeat for some totally made up machine ID. That should
-	// fail.
-	if err := heartbeat(uuid.New()); err == nil {
-		t.Errorf("heartbeat for made up UUID should've failed")
-	}
-
-	// Create an actual machine in the BMDB alongside the expected pubkey within an
-	// AgentStarted tag.
-	var machine model.Machine
-	err = sess.Transact(ctx, func(q *model.Queries) error {
-		machine, err = q.NewMachine(ctx)
-		if err != nil {
-			return err
-		}
-		err = q.MachineAddProvided(ctx, model.MachineAddProvidedParams{
-			MachineID:  machine.MachineID,
-			Provider:   model.ProviderEquinix,
-			ProviderID: "123",
-		})
-		if err != nil {
-			return err
-		}
-		return q.MachineSetAgentStarted(ctx, model.MachineSetAgentStartedParams{
-			MachineID:      machine.MachineID,
-			AgentStartedAt: time.Now(),
-			AgentPublicKey: pub,
-		})
-	})
-	if err != nil {
-		t.Fatalf("could not create machine: %v", err)
-	}
-
-	// Now heartbeat with correct machine ID and key. This should succeed.
-	if err := heartbeat(machine.MachineID); err != nil {
-		t.Errorf("heartbeat should've succeeded, got: %v", err)
-	}
-
-	// TODO(q3k): test hardware report being attached once we have some debug API
-	// for tags.
-}
-
-// TestOSInstallationFlow exercises the agent's OS installation request/report
-// functionality.
-func TestOSInstallationFlow(t *testing.T) {
-	s := dut()
-	ctx, ctxC := context.WithCancel(context.Background())
-	defer ctxC()
-	s.Start(ctx)
-
-	pub, priv, err := ed25519.GenerateKey(rand.Reader)
-	if err != nil {
-		t.Fatalf("could not generate keypair: %v", err)
-	}
-
-	sess, err := s.bmdb.StartSession(ctx)
-	if err != nil {
-		t.Fatalf("could not start session")
-	}
-
-	heartbeat := func(mid uuid.UUID, report *apb.OSInstallationReport) (*apb.HeartbeatResponse, error) {
-		creds, err := rpc.NewEphemeralCredentials(priv, rpc.WantInsecure())
-		if err != nil {
-			t.Fatalf("could not generate ephemeral credentials: %v", err)
-		}
-		conn, err := grpc.NewClient(s.ListenPublic, grpc.WithTransportCredentials(creds))
-		if err != nil {
-			t.Fatalf("NewClient failed: %v", err)
-		}
-		defer conn.Close()
-
-		stub := apb.NewAgentCallbackClient(conn)
-		return stub.Heartbeat(ctx, &apb.HeartbeatRequest{
-			MachineId:          mid.String(),
-			HardwareReport:     &apb.AgentHardwareReport{},
-			InstallationReport: report,
-		})
-	}
-
-	// Create machine with no OS installation request.
-	var machine model.Machine
-	err = sess.Transact(ctx, func(q *model.Queries) error {
-		machine, err = q.NewMachine(ctx)
-		if err != nil {
-			return err
-		}
-		err = q.MachineAddProvided(ctx, model.MachineAddProvidedParams{
-			MachineID:  machine.MachineID,
-			Provider:   model.ProviderEquinix,
-			ProviderID: "123",
-		})
-		if err != nil {
-			return err
-		}
-		return q.MachineSetAgentStarted(ctx, model.MachineSetAgentStartedParams{
-			MachineID:      machine.MachineID,
-			AgentStartedAt: time.Now(),
-			AgentPublicKey: pub,
-		})
-	})
-	if err != nil {
-		t.Fatalf("could not create machine: %v", err)
-	}
-
-	// Expect successful heartbeat, but no OS installation request.
-	hbr, err := heartbeat(machine.MachineID, nil)
-	if err != nil {
-		t.Fatalf("heartbeat: %v", err)
-	}
-	if hbr.InstallationRequest != nil {
-		t.Fatalf("expected no installation request")
-	}
-
-	// Now add an OS installation request tag, and expect it to be returned.
-	err = sess.Transact(ctx, func(q *model.Queries) error {
-		req := apb.OSInstallationRequest{
-			Generation: 123,
-		}
-		raw, _ := proto.Marshal(&req)
-		return q.MachineSetOSInstallationRequest(ctx, model.MachineSetOSInstallationRequestParams{
-			MachineID:                machine.MachineID,
-			Generation:               req.Generation,
-			OsInstallationRequestRaw: raw,
-		})
-	})
-	if err != nil {
-		t.Fatalf("could not add os installation request to machine: %v", err)
-	}
-
-	// Heartbeat a few times just to make sure every response is as expected.
-	for i := 0; i < 3; i++ {
-		hbr, err = heartbeat(machine.MachineID, nil)
-		if err != nil {
-			t.Fatalf("heartbeat: %v", err)
-		}
-		if hbr.InstallationRequest == nil || hbr.InstallationRequest.Generation != 123 {
-			t.Fatalf("expected installation request for generation 123, got %+v", hbr.InstallationRequest)
-		}
-	}
-
-	// Submit a report, expect no more request.
-	hbr, err = heartbeat(machine.MachineID, &apb.OSInstallationReport{Generation: 123, Result: &apb.OSInstallationReport_Success_{}})
-	if err != nil {
-		t.Fatalf("heartbeat: %v", err)
-	}
-	if hbr.InstallationRequest != nil {
-		t.Fatalf("expected no installation request")
-	}
-
-	// Submit a newer request, expect it to be returned.
-	err = sess.Transact(ctx, func(q *model.Queries) error {
-		req := apb.OSInstallationRequest{
-			Generation: 234,
-		}
-		raw, _ := proto.Marshal(&req)
-		return q.MachineSetOSInstallationRequest(ctx, model.MachineSetOSInstallationRequestParams{
-			MachineID:                machine.MachineID,
-			Generation:               req.Generation,
-			OsInstallationRequestRaw: raw,
-		})
-	})
-	if err != nil {
-		t.Fatalf("could not update installation request: %v", err)
-	}
-
-	// Heartbeat a few times just to make sure every response is as expected.
-	for i := 0; i < 3; i++ {
-		hbr, err = heartbeat(machine.MachineID, nil)
-		if err != nil {
-			t.Fatalf("heartbeat: %v", err)
-		}
-		if hbr.InstallationRequest == nil || hbr.InstallationRequest.Generation != 234 {
-			t.Fatalf("expected installation request for generation 234, got %+v", hbr.InstallationRequest)
-		}
-	}
-}
diff --git a/cloud/bmaas/server/api/BUILD.bazel b/cloud/bmaas/server/api/BUILD.bazel
deleted file mode 100644
index 56a9426..0000000
--- a/cloud/bmaas/server/api/BUILD.bazel
+++ /dev/null
@@ -1,46 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
-load("@rules_proto//proto:defs.bzl", "proto_library")
-load("@rules_proto_grpc_buf//:defs.bzl", "buf_proto_lint_test")
-
-buf_proto_lint_test(
-    name = "api_proto_lint_test",
-    except_rules = [
-        "PACKAGE_VERSION_SUFFIX",
-        "SERVICE_SUFFIX",
-    ],
-    protos = [":api_proto"],
-    use_rules = [
-        "DEFAULT",
-        "COMMENTS",
-    ],
-)
-
-proto_library(
-    name = "api_proto",
-    srcs = ["agent.proto"],
-    visibility = ["//visibility:public"],
-    deps = [
-        "//cloud/agent/api:api_proto",
-        "//metropolis/proto/api:api_proto",
-    ],
-)
-
-go_proto_library(
-    name = "api_go_proto",
-    compilers = ["@io_bazel_rules_go//proto:go_grpc"],
-    importpath = "source.monogon.dev/cloud/bmaas/server/api",
-    proto = ":api_proto",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//cloud/agent/api",
-        "//metropolis/proto/api",
-    ],
-)
-
-go_library(
-    name = "api",
-    embed = [":api_go_proto"],
-    importpath = "source.monogon.dev/cloud/bmaas/server/api",
-    visibility = ["//visibility:public"],
-)
diff --git a/cloud/bmaas/server/api/agent.proto b/cloud/bmaas/server/api/agent.proto
deleted file mode 100644
index 3b3c5b2..0000000
--- a/cloud/bmaas/server/api/agent.proto
+++ /dev/null
@@ -1,99 +0,0 @@
-syntax = "proto3";
-package cloud.bmaas.server.api;
-option go_package = "source.monogon.dev/cloud/bmaas/server/api";
-
-import "metropolis/proto/api/configuration.proto";
-import "metropolis/proto/api/management.proto";
-import "cloud/agent/api/hwreport.proto";
-
-// AgentCallback runs on the BMDB Server and exposes a gRPC interface to agents
-// running on machines. These APIs are served over TLS using component-style
-// server certificates, but clients are authenticated using ephemeral
-// certificates proving ownership of an agent keypair.
-service AgentCallback {
-  // Heartbeat is called by agents repeatedly to upload a hardware report, signal
-  // liveness and retrieve actions to be performed on a host.
-  //
-  // This isn't a streaming RPC as the current server implementation actually
-  // isn't reactive, so it would have to do its own inner polling to create
-  // a stream of updates. To keep things simple, we instead let the agent decide
-  // on the cadence of updates it wants to keep up with.
-  rpc Heartbeat(HeartbeatRequest) returns (HeartbeatResponse);
-}
-
-message AgentHardwareReport {
-  cloud.agent.api.Node report = 1;
-  // List of human-readable warnings which occurred during hardware report
-  // generation.
-  repeated string warning = 2;
-}
-
-// OSInstallationReport is submitted from the agent to the BMDB server after
-// successful OS installation.
-message OSInstallationReport {
-  // generation must be set to the same value as 'generation' in the
-  // OSInstallation request which triggered the OS installation
-  int64 generation = 1;
-
-  // Success is set by the agent when the installation request has been
-  // successfully fulfilled. It is currently empty but is specified as a
-  // message to allow it to be expanded in the future.
-  message Success {}
-  // Error is set by the agent when the installation request could not be
-  // fulfilled due to an error.
-  message Error {
-    // A human-readable message of what went wrong.
-    string error = 1;
-  }
-  oneof result {
-    Success success = 2;
-    Error error = 3;
-  }
-}
-
-message HeartbeatRequest {
-  // MachineID that this agent represents. Technically not necessary since
-  // keypairs between agents should be unique, but this provides an extra layer
-  // of protection against programming bugs.
-  string machine_id = 1;
-  // Optional hardware report to be upserted for this machine. An agent should
-  // submit one at least once after it's started, as early as it can.
-  AgentHardwareReport hardware_report = 2;
-  // Optional installation report sent to be upserted to this machine. An agent
-  // should submit one after it successfully installed an operating system for
-  // a given OSInstallationRequest.
-  OSInstallationReport installation_report = 3;
-}
-
-message MetropolisInstallationRequest {
-  reserved 1;
-  // Parameters for fetching the OS image to install.
-  metropolis.proto.api.OSImageRef os_image = 4;
-  // Node parameters to be supplied to the new node. Note that network_config
-  // is automatically filled out if coming from the takeover.
-  metropolis.proto.api.NodeParameters node_parameters = 2;
-  // Name of the block device to be used as the root device for the install.
-  // A list of block devices can be taken from the node hardware report.
-  string root_device = 3;
-}
-
-// OSInstallationRequest is provided to the agent by the BMDB server, from
-// a responding BMDB tag, when an OS installation request is pending.
-message OSInstallationRequest {
-  // generation is the 'version' of the OS installation request, and will always
-  // be incremented within the BMDB when a new OS installation request is
-  // submitted. The agent must pipe this through to the OSInstallationReport to
-  // let the rest of the system know which OS installation request it actually
-  // fulfilled.
-  int64 generation = 1;
-  // Selects which operating system installation flow is used.
-  oneof type {
-    MetropolisInstallationRequest metropolis = 2;
-  }
-}
-
-message HeartbeatResponse {
-  // If set, the control plane is requesting the installation of an operating
-  // system.
-  OSInstallationRequest installation_request = 1;
-}
diff --git a/cloud/bmaas/server/api/gomod-generated-placeholder.go b/cloud/bmaas/server/api/gomod-generated-placeholder.go
deleted file mode 100644
index da08b30..0000000
--- a/cloud/bmaas/server/api/gomod-generated-placeholder.go
+++ /dev/null
@@ -1,4 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package api
diff --git a/cloud/bmaas/server/cmd/BUILD.bazel b/cloud/bmaas/server/cmd/BUILD.bazel
deleted file mode 100644
index cbfdfed..0000000
--- a/cloud/bmaas/server/cmd/BUILD.bazel
+++ /dev/null
@@ -1,34 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("@rules_oci//oci:defs.bzl", "oci_image")
-load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
-
-go_library(
-    name = "cmd_lib",
-    srcs = ["main.go"],
-    importpath = "source.monogon.dev/cloud/bmaas/server/cmd",
-    visibility = ["//visibility:private"],
-    deps = [
-        "//cloud/bmaas/server",
-        "@io_k8s_klog_v2//:klog",
-    ],
-)
-
-go_binary(
-    name = "cmd",
-    embed = [":cmd_lib"],
-    visibility = ["//visibility:public"],
-)
-
-pkg_tar(
-    name = "cmd_layer",
-    srcs = [":cmd"],
-)
-
-oci_image(
-    name = "cmd_image",
-    base = "@distroless_base",
-    entrypoint = ["/cmd"],
-    tars = [":cmd_layer"],
-    visibility = ["//visibility:public"],
-    workdir = "/app",
-)
diff --git a/cloud/bmaas/server/cmd/main.go b/cloud/bmaas/server/cmd/main.go
deleted file mode 100644
index 6c14ab3..0000000
--- a/cloud/bmaas/server/cmd/main.go
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package main
-
-import (
-	"context"
-	"flag"
-	"os"
-	"os/signal"
-
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/bmaas/server"
-)
-
-func main() {
-	s := &server.Server{}
-	s.Config.RegisterFlags()
-	flag.Parse()
-	if flag.NArg() > 0 {
-		klog.Exitf("unexpected positional arguments: %v", flag.Args())
-	}
-
-	ctx, _ := signal.NotifyContext(context.Background(), os.Interrupt)
-	s.Start(ctx)
-	select {}
-}
diff --git a/cloud/bmaas/server/server.go b/cloud/bmaas/server/server.go
deleted file mode 100644
index 8cedf2b..0000000
--- a/cloud/bmaas/server/server.go
+++ /dev/null
@@ -1,174 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package server
-
-import (
-	"context"
-	"errors"
-	"flag"
-	"fmt"
-	"net"
-	"os"
-
-	"github.com/cenkalti/backoff/v4"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/reflection"
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/metrics"
-	"source.monogon.dev/cloud/bmaas/bmdb/webug"
-	apb "source.monogon.dev/cloud/bmaas/server/api"
-	"source.monogon.dev/cloud/lib/component"
-)
-
-type Config struct {
-	Component component.ComponentConfig
-	BMDB      bmdb.BMDB
-	Webug     webug.Config
-
-	// PublicListenAddress is the address at which the 'public' (agent-facing) gRPC
-	// server listener will run.
-	PublicListenAddress string
-}
-
-// TODO(q3k): factor this out to BMDB library?
-func runtimeInfo() string {
-	hostname, _ := os.Hostname()
-	if hostname == "" {
-		hostname = "UNKNOWN"
-	}
-	return fmt.Sprintf("host %s", hostname)
-}
-
-func (c *Config) RegisterFlags() {
-	c.Component.RegisterFlags("srv")
-	c.BMDB.ComponentName = "srv"
-	c.BMDB.RuntimeInfo = runtimeInfo()
-	c.BMDB.Database.RegisterFlags("bmdb")
-	c.Webug.RegisterFlags()
-
-	flag.StringVar(&c.PublicListenAddress, "srv_public_grpc_listen_address", ":8080", "Address to listen at for public/user gRPC connections for bmdbsrv")
-}
-
-type Server struct {
-	Config Config
-
-	// ListenGRPC will contain the address at which the internal gRPC server is
-	// listening after .Start() has been called. This can differ from the configured
-	// value if the configuration requests any port (via :0).
-	ListenGRPC string
-	// ListenPublic will contain the address at which the 'public' (agent-facing)
-	// gRPC server is lsitening after .Start() has been called.
-	ListenPublic string
-
-	bmdb  *bmdb.Connection
-	acsvc *agentCallbackService
-
-	sessionC chan *bmdb.Session
-}
-
-// sessionWorker emits a valid BMDB session to sessionC as long as ctx is active.
-func (s *Server) sessionWorker(ctx context.Context) {
-	var session *bmdb.Session
-	for {
-		if session == nil || session.Expired() {
-			klog.Infof("Starting new session...")
-			bo := backoff.NewExponentialBackOff()
-			err := backoff.Retry(func() error {
-				var err error
-				session, err = s.bmdb.StartSession(ctx, bmdb.SessionOption{Processor: metrics.ProcessorBMSRV})
-				if err != nil {
-					klog.Errorf("Failed to start session: %v", err)
-					return err
-				} else {
-					return nil
-				}
-			}, backoff.WithContext(bo, ctx))
-			if err != nil {
-				// If something's really wrong just crash.
-				klog.Exitf("Gave up on starting session: %v", err)
-			}
-			klog.Infof("New session: %s", session.UUID)
-		}
-
-		select {
-		case <-ctx.Done():
-			return
-		case s.sessionC <- session:
-		}
-	}
-}
-
-func (s *Server) session(ctx context.Context) (*bmdb.Session, error) {
-	select {
-	case sess := <-s.sessionC:
-		return sess, nil
-	case <-ctx.Done():
-		return nil, ctx.Err()
-	}
-}
-
-func (s *Server) startPublic(ctx context.Context) {
-	g := grpc.NewServer(s.Config.Component.GRPCServerOptionsPublic()...)
-	lis, err := net.Listen("tcp", s.Config.PublicListenAddress)
-	if err != nil {
-		klog.Exitf("Could not listen: %v", err)
-	}
-	s.ListenPublic = lis.Addr().String()
-	apb.RegisterAgentCallbackServer(g, s.acsvc)
-	reflection.Register(g)
-
-	klog.Infof("Public API listening on %s", s.ListenPublic)
-	go func() {
-		err := g.Serve(lis)
-		if !errors.Is(err, ctx.Err()) {
-			klog.Exitf("Public gRPC serve failed: %v", err)
-		}
-	}()
-}
-
-func (s *Server) startInternalGRPC(ctx context.Context) {
-	g := grpc.NewServer(s.Config.Component.GRPCServerOptions()...)
-	lis, err := net.Listen("tcp", s.Config.Component.GRPCListenAddress)
-	if err != nil {
-		klog.Exitf("Could not listen: %v", err)
-	}
-	s.ListenGRPC = lis.Addr().String()
-
-	reflection.Register(g)
-	klog.Infof("Internal gRPC listening on %s", s.ListenGRPC)
-	go func() {
-		err := g.Serve(lis)
-		if !errors.Is(err, ctx.Err()) {
-			klog.Exitf("Internal gRPC serve failed: %v", err)
-		}
-	}()
-}
-
-// Start the BMaaS Server in background goroutines. This should only be called
-// once. The process will exit with debug logs if starting the server failed.
-func (s *Server) Start(ctx context.Context) {
-	reg := s.Config.Component.PrometheusRegistry()
-	s.Config.BMDB.EnableMetrics(reg)
-	s.Config.Component.StartPrometheus(ctx)
-
-	conn, err := s.Config.BMDB.Open(true)
-	if err != nil {
-		klog.Exitf("Failed to connect to BMDB: %v", err)
-	}
-	s.acsvc = &agentCallbackService{
-		s: s,
-	}
-	s.bmdb = conn
-	s.sessionC = make(chan *bmdb.Session)
-	go s.sessionWorker(ctx)
-	s.startInternalGRPC(ctx)
-	s.startPublic(ctx)
-	go func() {
-		if err := s.Config.Webug.Start(ctx, conn); err != nil && !errors.Is(err, ctx.Err()) {
-			klog.Exitf("Failed to start webug: %v", err)
-		}
-	}()
-}
diff --git a/cloud/equinix/cli/BUILD.bazel b/cloud/equinix/cli/BUILD.bazel
deleted file mode 100644
index 020e93c..0000000
--- a/cloud/equinix/cli/BUILD.bazel
+++ /dev/null
@@ -1,27 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-
-go_library(
-    name = "cli_lib",
-    srcs = [
-        "cmd_delete.go",
-        "cmd_list.go",
-        "cmd_move.go",
-        "cmd_reboot.go",
-        "cmd_yoink.go",
-        "main.go",
-    ],
-    importpath = "source.monogon.dev/cloud/equinix/cli",
-    visibility = ["//visibility:private"],
-    deps = [
-        "//cloud/equinix/wrapngo",
-        "@com_github_packethost_packngo//:packngo",
-        "@com_github_spf13_cobra//:cobra",
-        "@io_k8s_klog_v2//:klog",
-    ],
-)
-
-go_binary(
-    name = "cli",
-    embed = [":cli_lib"],
-    visibility = ["//visibility:public"],
-)
diff --git a/cloud/equinix/cli/cmd_delete.go b/cloud/equinix/cli/cmd_delete.go
deleted file mode 100644
index 5e1d132..0000000
--- a/cloud/equinix/cli/cmd_delete.go
+++ /dev/null
@@ -1,65 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package main
-
-import (
-	"context"
-	"os"
-	"os/signal"
-	"time"
-
-	"github.com/packethost/packngo"
-	"github.com/spf13/cobra"
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/equinix/wrapngo"
-)
-
-var deleteCmd = &cobra.Command{
-	Use:   "delete [target]",
-	Short: "Delete all devices from one project",
-	Args:  cobra.ExactArgs(1),
-	Run:   doDelete,
-}
-
-func init() {
-	rootCmd.AddCommand(deleteCmd)
-}
-
-func doDelete(cmd *cobra.Command, args []string) {
-	ctx, _ := signal.NotifyContext(context.Background(), os.Interrupt)
-	api := wrapngo.New(&c)
-
-	klog.Infof("Listing devices for %q", args[0])
-
-	devices, err := api.ListDevices(ctx, args[0])
-	if err != nil {
-		klog.Exitf("failed listing devices: %v", err)
-	}
-
-	if len(devices) == 0 {
-		klog.Infof("No devices found in %s", args[0])
-		return
-	}
-
-	klog.Infof("Deleting %d Devices in %s. THIS WILL DELETE SERVERS! You have five seconds to cancel!", len(devices), args[0])
-	time.Sleep(5 * time.Second)
-
-	for _, d := range devices {
-		h := "deleted-" + d.Hostname
-		_, err := api.UpdateDevice(ctx, d.ID, &packngo.DeviceUpdateRequest{
-			Hostname: &h,
-		})
-		if err != nil {
-			klog.Infof("failed updating device %s (%s): %v", d.ID, d.Hostname, err)
-			continue
-		}
-
-		klog.Infof("deleting %s (%s)...", d.ID, d.Hostname)
-		if err := api.DeleteDevice(ctx, d.ID); err != nil {
-			klog.Infof("failed deleting device %s (%s): %v", d.ID, d.Hostname, err)
-			continue
-		}
-	}
-}
diff --git a/cloud/equinix/cli/cmd_list.go b/cloud/equinix/cli/cmd_list.go
deleted file mode 100644
index 917494a..0000000
--- a/cloud/equinix/cli/cmd_list.go
+++ /dev/null
@@ -1,108 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package main
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"os/signal"
-	"slices"
-	"strings"
-
-	"github.com/packethost/packngo"
-	"github.com/spf13/cobra"
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/equinix/wrapngo"
-)
-
-var listCmd = &cobra.Command{
-	Use:  "list",
-	Long: `This lists all hardware reservations inside a specified organization or project.`,
-	Args: cobra.NoArgs,
-	Run:  doList,
-}
-
-func init() {
-	listCmd.Flags().String("equinix_organization", "", "from which organization to list from")
-	listCmd.Flags().String("equinix_project", "", "from which project to list from")
-	rootCmd.AddCommand(listCmd)
-}
-
-func doList(cmd *cobra.Command, args []string) {
-	organization, err := cmd.Flags().GetString("equinix_organization")
-	if err != nil {
-		klog.Exitf("flag: %v", err)
-	}
-
-	project, err := cmd.Flags().GetString("equinix_project")
-	if err != nil {
-		klog.Exitf("flag: %v", err)
-	}
-
-	if organization == "" && project == "" {
-		klog.Exitf("missing organization or project flag")
-	}
-
-	ctx, _ := signal.NotifyContext(context.Background(), os.Interrupt)
-	api := wrapngo.New(&c)
-
-	var (
-		reservations []packngo.HardwareReservation
-	)
-	switch {
-	case project != "" && organization == "":
-		klog.Infof("Listing reservations for project: %s", project)
-		reservations, err = api.ListReservations(ctx, project)
-	case organization != "" && project == "":
-		klog.Infof("Listing reservations for organization: %s", organization)
-		reservations, err = api.ListOrganizationReservations(ctx, organization)
-	default:
-		klog.Exitf("exactly one of organization or project flags has to be set")
-	}
-
-	if err != nil {
-		klog.Fatalf("Failed to list reservations: %v", err)
-	}
-
-	type configDC struct {
-		config string
-		dc     string
-	}
-	type configDCP struct {
-		configDC
-		project string
-	}
-	mtypes := make(map[configDC]int)
-	mptypes := make(map[configDCP]int)
-
-	klog.Infof("Got %d reservations", len(reservations))
-	for _, r := range reservations {
-		curType := configDC{config: strings.ToLower(r.Plan.Name), dc: strings.ToLower(r.Facility.Metro.Code)}
-		curPType := configDCP{curType, r.Project.Name}
-		mtypes[curType]++
-		mptypes[curPType]++
-	}
-
-	klog.Infof("Found the following configurations:")
-	var mStrings []string
-	for dc, c := range mtypes {
-		mStrings = append(mStrings, fmt.Sprintf("%s | %s | %d", dc.dc, dc.config, c))
-	}
-	slices.Sort(mStrings)
-	for _, s := range mStrings {
-		klog.Info(s)
-	}
-
-	klog.Infof("Found the following configurations (per project):")
-	var mpStrings []string
-	for dc, c := range mptypes {
-		mpStrings = append(mpStrings, fmt.Sprintf("%s | %s | %s | %d", dc.project, dc.dc, dc.config, c))
-	}
-	slices.Sort(mpStrings)
-	for _, s := range mpStrings {
-		klog.Info(s)
-	}
-}
diff --git a/cloud/equinix/cli/cmd_move.go b/cloud/equinix/cli/cmd_move.go
deleted file mode 100644
index e835a7e..0000000
--- a/cloud/equinix/cli/cmd_move.go
+++ /dev/null
@@ -1,47 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package main
-
-import (
-	"context"
-	"os"
-	"os/signal"
-
-	"github.com/spf13/cobra"
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/equinix/wrapngo"
-)
-
-var moveCmd = &cobra.Command{
-	Use:   "move [source] [target]",
-	Short: "Move all reserved hardware from one to another project",
-	Args:  cobra.ExactArgs(2),
-	Run:   doMove,
-}
-
-func init() {
-	rootCmd.AddCommand(moveCmd)
-}
-
-func doMove(cmd *cobra.Command, args []string) {
-	ctx, _ := signal.NotifyContext(context.Background(), os.Interrupt)
-	api := wrapngo.New(&c)
-
-	klog.Infof("Listing reservations for %q", args[0])
-	reservations, err := api.ListReservations(ctx, args[0])
-	if err != nil {
-		klog.Exitf("failed listing reservations: %v", err)
-	}
-
-	klog.Infof("Got %d reservations. Moving machines", len(reservations))
-	for _, r := range reservations {
-		_, err := api.MoveReservation(ctx, r.ID, args[1])
-		if err != nil {
-			klog.Errorf("failed moving reservation: %v", err)
-			continue
-		}
-		klog.Infof("Moved Device %s", r.ID)
-	}
-}
diff --git a/cloud/equinix/cli/cmd_reboot.go b/cloud/equinix/cli/cmd_reboot.go
deleted file mode 100644
index 0f7f317..0000000
--- a/cloud/equinix/cli/cmd_reboot.go
+++ /dev/null
@@ -1,50 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package main
-
-import (
-	"context"
-	"os"
-	"os/signal"
-
-	"github.com/spf13/cobra"
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/equinix/wrapngo"
-)
-
-var rebootCmd = &cobra.Command{
-	Use:   "reboot [project] [id]",
-	Short: "Reboots all or one specific node",
-	Args:  cobra.MaximumNArgs(1),
-	Run:   doReboot,
-}
-
-func init() {
-	rootCmd.AddCommand(rebootCmd)
-}
-
-func doReboot(cmd *cobra.Command, args []string) {
-	ctx, _ := signal.NotifyContext(context.Background(), os.Interrupt)
-	api := wrapngo.New(&c)
-
-	klog.Infof("Requesting device list...")
-	devices, err := api.ListDevices(ctx, args[0])
-	if err != nil {
-		klog.Fatal(err)
-	}
-
-	for _, d := range devices {
-		if len(args) == 2 && args[1] != d.ID {
-			continue
-		}
-
-		err := api.RebootDevice(ctx, d.ID)
-		if err != nil {
-			klog.Error(err)
-			continue
-		}
-		klog.Infof("rebooted %s", d.ID)
-	}
-}
diff --git a/cloud/equinix/cli/cmd_yoink.go b/cloud/equinix/cli/cmd_yoink.go
deleted file mode 100644
index 1de5803..0000000
--- a/cloud/equinix/cli/cmd_yoink.go
+++ /dev/null
@@ -1,173 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package main
-
-import (
-	"bufio"
-	"context"
-	"os"
-	"os/signal"
-	"sort"
-	"strconv"
-	"strings"
-
-	"github.com/packethost/packngo"
-	"github.com/spf13/cobra"
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/equinix/wrapngo"
-)
-
-var yoinkCmd = &cobra.Command{
-	Use: "yoink",
-	Long: `This moves a specified amount of servers that match the given spec to a different metro.
-While spec is a easy to find argument that matches the equinix system spec e.g. w3amd.75xx24c.512.8160.x86, 
-metro does not represent the public facing name. Instead it is the acutal datacenter name e.g. fr2"`,
-	Short: "Move a server base on the spec from one to another project",
-	Args:  cobra.NoArgs,
-	Run:   doYoink,
-}
-
-func init() {
-	yoinkCmd.Flags().Int("count", 1, "how many machines should be moved")
-	yoinkCmd.Flags().String("equinix_source_project", "", "from which project should the machine be yoinked")
-	yoinkCmd.Flags().String("equinix_target_project", "", "to which project should the machine be moved")
-	yoinkCmd.Flags().String("spec", "", "which device spec should be moved")
-	yoinkCmd.Flags().String("metro", "", "to which metro should be moved")
-	rootCmd.AddCommand(yoinkCmd)
-}
-
-func doYoink(cmd *cobra.Command, args []string) {
-	srcProject, err := cmd.Flags().GetString("equinix_source_project")
-	if err != nil {
-		klog.Exitf("flag: %v", err)
-	}
-
-	dstProject, err := cmd.Flags().GetString("equinix_target_project")
-	if err != nil {
-		klog.Exitf("flag: %v", err)
-	}
-
-	if srcProject == "" || dstProject == "" {
-		klog.Exitf("missing project flags")
-	}
-
-	count, err := cmd.Flags().GetInt("count")
-	if err != nil {
-		klog.Exitf("flag: %v", err)
-	}
-
-	spec, err := cmd.Flags().GetString("spec")
-	if err != nil {
-		klog.Exitf("flag: %v", err)
-	}
-
-	if spec == "" {
-		klog.Exitf("missing spec flag")
-	}
-
-	metro, err := cmd.Flags().GetString("metro")
-	if err != nil {
-		klog.Exitf("flag: %v", err)
-	}
-
-	if metro == "" {
-		klog.Exitf("missing metro flag")
-	}
-
-	ctx, _ := signal.NotifyContext(context.Background(), os.Interrupt)
-	api := wrapngo.New(&c)
-
-	klog.Infof("Listing reservations for %q", srcProject)
-	reservations, err := api.ListReservations(ctx, srcProject)
-	if err != nil {
-		klog.Exitf("Failed to list reservations: %v", err)
-	}
-
-	type configDC struct {
-		config string
-		dc     string
-	}
-	mtypes := make(map[configDC]int)
-
-	var matchingReservations []packngo.HardwareReservation
-	reqType := configDC{config: strings.ToLower(spec), dc: strings.ToLower(metro)}
-
-	klog.Infof("Got %d reservations", len(reservations))
-	for _, r := range reservations {
-		curType := configDC{config: strings.ToLower(r.Plan.Name), dc: strings.ToLower(r.Facility.Metro.Code)}
-
-		mtypes[curType]++
-		if curType == reqType {
-			matchingReservations = append(matchingReservations, r)
-		}
-	}
-
-	klog.Infof("Found the following configurations:")
-	for dc, c := range mtypes {
-		klog.Infof("%s | %s | %d", dc.dc, dc.config, c)
-	}
-
-	if len(matchingReservations) == 0 {
-		klog.Exitf("Configuration not found: %s - %s", reqType.dc, reqType.config)
-	}
-
-	if len(matchingReservations)-count < 0 {
-		klog.Exitf("Not enough machines with matching configuration found ")
-	}
-
-	// prefer hosts that are not deployed
-	sort.Slice(matchingReservations, func(i, j int) bool {
-		return matchingReservations[i].Device == nil && matchingReservations[j].Device != nil
-	})
-
-	toMove := matchingReservations[:count]
-	var toDelete []string
-	for _, r := range toMove {
-		if r.Device != nil {
-			toDelete = append(toDelete, r.Device.Hostname)
-		}
-	}
-
-	stdInReader := bufio.NewReader(os.Stdin)
-	klog.Infof("Will move %d machines with spec %s in %s from %s to %s.", count, spec, metro, srcProject, dstProject)
-	if len(toDelete) > 0 {
-		klog.Warningf("Not enough free machines found. This will delete %d provisioned hosts! Hosts scheduled for deletion: ", len(toDelete))
-		klog.Warningf("%s", strings.Join(toDelete, ", "))
-		klog.Warningf("Please confirm by inputting in the number of machines that will be moved.")
-
-		read, err := stdInReader.ReadString('\n')
-		if err != nil {
-			klog.Exitf("failed reading input: %v", err)
-		}
-
-		atoi, err := strconv.Atoi(strings.TrimSpace(read))
-		if err != nil {
-			klog.Exitf("failed parsing number: %v", err)
-		}
-
-		if atoi != len(toDelete) {
-			klog.Exitf("Confirmation failed! Wanted \"%q\" got \"%d\"", len(toDelete), atoi)
-		} else {
-			klog.Infof("Thanks for the confirmation! continuing...")
-		}
-	}
-
-	klog.Infof("Note: It can be normal for a device move to fail for project validation issues. This is a known issue and can be ignored")
-	for _, r := range matchingReservations[:count] {
-		if r.Device != nil {
-			klog.Warningf("Deleting server %s (%s) on %s", r.Device.ID, r.Device.Hostname, r.ID)
-
-			if err := api.DeleteDevice(ctx, r.Device.ID); err != nil {
-				klog.Errorf("failed deleting device %s (%s): %v", r.Device.ID, r.Device.Hostname, err)
-				continue
-			}
-		}
-
-		_, err := api.MoveReservation(ctx, r.ID, dstProject)
-		if err != nil {
-			klog.Errorf("failed moving device %s: %v", r.ID, err)
-		}
-	}
-}
diff --git a/cloud/equinix/cli/main.go b/cloud/equinix/cli/main.go
deleted file mode 100644
index 85de18b..0000000
--- a/cloud/equinix/cli/main.go
+++ /dev/null
@@ -1,35 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package main
-
-import (
-	"flag"
-
-	"github.com/spf13/cobra"
-
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/equinix/wrapngo"
-)
-
-// rootCmd represents the base command when called without any subcommands
-var rootCmd = &cobra.Command{
-	PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
-		if c.APIKey == "" || c.User == "" {
-			klog.Exitf("-equinix_api_username and -equinix_api_key must be set")
-		}
-		return nil
-	},
-}
-
-var c wrapngo.Opts
-
-func init() {
-	c.RegisterFlags()
-	rootCmd.PersistentFlags().AddGoFlagSet(flag.CommandLine)
-}
-
-func main() {
-	cobra.CheckErr(rootCmd.Execute())
-}
diff --git a/cloud/equinix/wrapngo/BUILD.bazel b/cloud/equinix/wrapngo/BUILD.bazel
deleted file mode 100644
index 1574a6a..0000000
--- a/cloud/equinix/wrapngo/BUILD.bazel
+++ /dev/null
@@ -1,31 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-
-go_library(
-    name = "wrapngo",
-    srcs = [
-        "duct_tape.go",
-        "metrics.go",
-        "wrapn.go",
-    ],
-    importpath = "source.monogon.dev/cloud/equinix/wrapngo",
-    visibility = ["//visibility:public"],
-    deps = [
-        "@com_github_cenkalti_backoff_v4//:backoff",
-        "@com_github_google_uuid//:uuid",
-        "@com_github_packethost_packngo//:packngo",
-        "@com_github_prometheus_client_golang//prometheus",
-        "@io_k8s_klog_v2//:klog",
-    ],
-)
-
-go_test(
-    name = "wrapngo_test",
-    timeout = "eternal",
-    srcs = ["wrapngo_live_test.go"],
-    args = ["-test.v"],
-    embed = [":wrapngo"],
-    deps = [
-        "@com_github_packethost_packngo//:packngo",
-        "@org_golang_x_crypto//ssh",
-    ],
-)
diff --git a/cloud/equinix/wrapngo/duct_tape.go b/cloud/equinix/wrapngo/duct_tape.go
deleted file mode 100644
index 21581ce..0000000
--- a/cloud/equinix/wrapngo/duct_tape.go
+++ /dev/null
@@ -1,129 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package wrapngo
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net/http"
-	"time"
-
-	"github.com/cenkalti/backoff/v4"
-	"github.com/packethost/packngo"
-	"k8s.io/klog/v2"
-)
-
-// wrap a given fn in some reliability-increasing duct tape: context support and
-// exponential backoff retries for intermittent connectivity issues. This allows
-// us to use packngo code instead of writing our own API stub for Equinix Metal.
-//
-// The given fn will be retried until it returns a 'permanent' Equinix error (see
-// isPermanentEquinixError) or the given context expires. Additionally, fn will
-// be called with a brand new packngo client tied to the context of the wrap
-// call. Finally, the given client will also have some logging middleware
-// attached to it which can be activated by setting verbosity 5 (or greater) on
-// this file.
-//
-// The wrapped fn can be either just a plain packngo method or some complicated
-// idempotent logic, as long as it cooperates with the above contract.
-func wrap[U any](ctx context.Context, cl *client, fn func(*packngo.Client) (U, error)) (U, error) {
-	var zero U
-	if err := cl.serializer.up(ctx); err != nil {
-		return zero, err
-	}
-	defer cl.serializer.down()
-
-	bc := backoff.WithContext(cl.o.BackOff(), ctx)
-	pngo, err := cl.clientForContext(ctx)
-	if err != nil {
-		// Generally this shouldn't happen other than with programming errors, so we
-		// don't back this off.
-		return zero, fmt.Errorf("could not crate equinix client: %w", err)
-	}
-
-	var res U
-	err = backoff.Retry(func() error {
-		res, err = fn(pngo)
-		if isPermanentEquinixError(err) {
-			return backoff.Permanent(err)
-		}
-		return err
-	}, bc)
-	if err != nil {
-		return zero, err
-	}
-	return res, nil
-}
-
-type injectContextRoundTripper struct {
-	ctx      context.Context
-	original http.RoundTripper
-	metrics  *metricsSet
-}
-
-func (r *injectContextRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
-	klog.V(5).Infof("Request -> %v", req.URL.String())
-	start := time.Now()
-	res, err := r.original.RoundTrip(req.WithContext(r.ctx))
-	latency := time.Since(start)
-	r.metrics.onAPIRequestDone(req, res, err, latency)
-
-	if err != nil {
-		klog.V(5).Infof("HTTP error <- %v", err)
-	} else {
-		klog.V(5).Infof("Response <- %v", res.Status)
-	}
-	return res, err
-}
-
-func (c *client) clientForContext(ctx context.Context) (*packngo.Client, error) {
-	httpcl := &http.Client{
-		Transport: &injectContextRoundTripper{
-			ctx:      ctx,
-			original: http.DefaultTransport,
-			metrics:  c.metrics,
-		},
-	}
-	return packngo.NewClient(packngo.WithAuth(c.username, c.token), packngo.WithHTTPClient(httpcl))
-}
-
-// httpStatusCode extracts the status code from error values returned by
-// packngo methods.
-func httpStatusCode(err error) int {
-	var er *packngo.ErrorResponse
-	if err != nil && errors.As(err, &er) {
-		return er.Response.StatusCode
-	}
-	return -1
-}
-
-// IsNotFound returns true if the given error is an Equinix packngo/wrapngo 'not
-// found' error.
-func IsNotFound(err error) bool {
-	return httpStatusCode(err) == http.StatusNotFound
-}
-
-func isPermanentEquinixError(err error) bool {
-	// Invalid argument/state errors from wrapping.
-	if errors.Is(err, ErrRaceLost) {
-		return true
-	}
-	if errors.Is(err, ErrNoReservationProvided) {
-		return true
-	}
-	// Real errors returned from equinix.
-	st := httpStatusCode(err)
-	switch st {
-	case http.StatusUnauthorized:
-		return true
-	case http.StatusForbidden:
-		return true
-	case http.StatusNotFound:
-		return true
-	case http.StatusUnprocessableEntity:
-		return true
-	}
-	return false
-}
diff --git a/cloud/equinix/wrapngo/metrics.go b/cloud/equinix/wrapngo/metrics.go
deleted file mode 100644
index f6cabcb..0000000
--- a/cloud/equinix/wrapngo/metrics.go
+++ /dev/null
@@ -1,132 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package wrapngo
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net/http"
-	"regexp"
-	"strings"
-	"time"
-
-	"github.com/prometheus/client_golang/prometheus"
-	"k8s.io/klog/v2"
-)
-
-// metricsSet contains all the Prometheus metrics collected by wrapngo.
-type metricsSet struct {
-	requestLatencies *prometheus.HistogramVec
-	waiting          prometheus.GaugeFunc
-	inFlight         prometheus.GaugeFunc
-}
-
-func newMetricsSet(ser *serializer) *metricsSet {
-	return &metricsSet{
-		requestLatencies: prometheus.NewHistogramVec(
-			prometheus.HistogramOpts{
-				Name: "equinix_api_latency",
-				Help: "Equinix API request latency in seconds, partitioned by endpoint status code",
-			},
-			[]string{"endpoint", "status_code"},
-		),
-		waiting: prometheus.NewGaugeFunc(
-			prometheus.GaugeOpts{
-				Name: "equinix_api_waiting",
-				Help: "Number of API requests pending to be sent to Equinix but waiting on semaphore",
-			},
-			func() float64 {
-				_, waiting := ser.stats()
-				return float64(waiting)
-			},
-		),
-		inFlight: prometheus.NewGaugeFunc(
-			prometheus.GaugeOpts{
-				Name: "equinix_api_in_flight",
-				Help: "Number of API requests currently being processed by Equinix",
-			},
-			func() float64 {
-				inFlight, _ := ser.stats()
-				return float64(inFlight)
-			},
-		),
-	}
-}
-
-// getEndpointForPath converts from an Equinix API method and path (eg.
-// /metal/v1/devices/deadbeef) into an 'endpoint' name, which is an imaginary,
-// Monogon-specific name for the API endpoint accessed by this call.
-//
-// If the given path is unknown and thus cannot be converted to an endpoint name,
-// 'Unknown' is return and a warning is logged.
-//
-// We use this function to partition request statistics per API 'endpoint'. An
-// alternative to this would be to record high-level packngo function names, but
-// one packngo function call might actually emit multiple HTTP API requests - so
-// we're stuck recording the low-level requests and gathering statistics from
-// there instead.
-func getEndpointForPath(method, path string) string {
-	path = strings.TrimPrefix(path, "/metal/v1")
-	for name, match := range endpointNames {
-		if match.matches(method, path) {
-			return name
-		}
-	}
-	klog.Warningf("Unknown Equinix API %s %s - cannot determine metric endpoint name", method, path)
-	return "Unknown"
-}
-
-// requestMatch is used to match a HTTP request method/path.
-type requestMatch struct {
-	method string
-	regexp *regexp.Regexp
-}
-
-func (r *requestMatch) matches(method, path string) bool {
-	if r.method != method {
-		return false
-	}
-	return r.regexp.MatchString(path)
-}
-
-var (
-	endpointNames = map[string]requestMatch{
-		"GetDevice":           {"GET", regexp.MustCompile(`^/devices/[^/]+$`)},
-		"ListDevices":         {"GET", regexp.MustCompile(`^/(organizations|projects)/[^/]+/devices$`)},
-		"CreateDevice":        {"POST", regexp.MustCompile(`^/projects/[^/]+/devices$`)},
-		"ListReservations":    {"GET", regexp.MustCompile(`^/projects/[^/]+/hardware-reservations$`)},
-		"ListSSHKeys":         {"GET", regexp.MustCompile(`^/ssh-keys$`)},
-		"CreateSSHKey":        {"POST", regexp.MustCompile(`^/project/[^/]+/ssh-keys$`)},
-		"GetSSHKey":           {"GET", regexp.MustCompile(`^/ssh-keys/[^/]+$`)},
-		"UpdateSSHKey":        {"PATCH", regexp.MustCompile(`^/ssh-keys/[^/]+$`)},
-		"PerformDeviceAction": {"POST", regexp.MustCompile(`^/devices/[^/]+/actions$`)},
-	}
-)
-
-// onAPIRequestDone is called by the wrapngo code on every API response from
-// Equinix, and records the given parameters into metrics.
-func (m *metricsSet) onAPIRequestDone(req *http.Request, res *http.Response, err error, latency time.Duration) {
-	if m == nil {
-		return
-	}
-
-	code := "unknown"
-	if err == nil {
-		code = fmt.Sprintf("%d", res.StatusCode)
-	} else {
-		switch {
-		case errors.Is(err, context.Canceled):
-			code = "ctx canceled"
-		case errors.Is(err, context.DeadlineExceeded):
-			code = "deadline exceeded"
-		}
-	}
-	if code == "unknown" {
-		klog.Warningf("Unexpected HTTP result: req %s %s, error: %v", req.Method, req.URL.Path, res)
-	}
-
-	endpoint := getEndpointForPath(req.Method, req.URL.Path)
-	m.requestLatencies.With(prometheus.Labels{"endpoint": endpoint, "status_code": code}).Observe(latency.Seconds())
-}
diff --git a/cloud/equinix/wrapngo/wrapn.go b/cloud/equinix/wrapngo/wrapn.go
deleted file mode 100644
index eee0b57..0000000
--- a/cloud/equinix/wrapngo/wrapn.go
+++ /dev/null
@@ -1,446 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-// Package wrapngo wraps packngo methods providing the following usability
-// enhancements:
-// - API call rate limiting
-// - resource-aware call retries
-// - use of a configurable back-off algorithm implementation
-// - context awareness
-//
-// The implementation is provided with the following caveats:
-//
-// There can be only one call in flight. Concurrent calls to API-related
-// methods of the same client will block. Calls returning packngo structs will
-// return nil data when a non-nil error value is returned. An
-// os.ErrDeadlineExceeded will be returned after the underlying API calls time
-// out beyond the chosen back-off algorithm implementation's maximum allowed
-// retry interval. Other errors, excluding context.Canceled and
-// context.DeadlineExceeded, indicate either an error originating at Equinix'
-// API endpoint (which may still stem from invalid call inputs), or a network
-// error.
-//
-// Packngo wrappers included below may return timeout errors even after the
-// wrapped calls succeed in the event server reply could not have been
-// received.
-//
-// This implies that effects of mutating calls can't always be verified
-// atomically, requiring explicit synchronization between API users, regardless
-// of the retry/recovery logic used.
-//
-// Having that in mind, some call wrappers exposed by this package will attempt
-// to recover from this kind of situations by requesting information on any
-// resources created, and retrying the call if needed. This approach assumes
-// any concurrent mutating API users will be synchronized, as it should be in
-// any case.
-//
-// Another way of handling this problem would be to leave it up to the user to
-// retry calls if needed, though this would leak Equinix Metal API, and
-// complicate implementations depending on this package. Due to that, the prior
-// approach was chosen.
-package wrapngo
-
-import (
-	"context"
-	"errors"
-	"flag"
-	"fmt"
-	"net/http"
-	"sync/atomic"
-	"time"
-
-	"github.com/cenkalti/backoff/v4"
-	"github.com/google/uuid"
-	"github.com/packethost/packngo"
-	"github.com/prometheus/client_golang/prometheus"
-)
-
-// Opts conveys configurable Client parameters.
-type Opts struct {
-	// User and APIKey are the credentials used to authenticate with
-	// Metal API.
-
-	User   string
-	APIKey string
-
-	// Optional parameters:
-
-	// BackOff controls the client's behavior in the event of API calls failing
-	// due to IO timeouts by adjusting the lower bound on time taken between
-	// subsequent calls.
-	BackOff func() backoff.BackOff
-
-	// APIRate is the minimum time taken between subsequent API calls.
-	APIRate time.Duration
-
-	// Parallelism defines how many calls to the Equinix API will be issued in
-	// parallel. When this limit is reached, subsequent attmepts to call the API will
-	// block. The order of serving of pending calls is currently undefined.
-	//
-	// If not defined (ie. 0), defaults to 1.
-	Parallelism int
-
-	MetricsRegistry *prometheus.Registry
-}
-
-func (o *Opts) RegisterFlags() {
-	flag.StringVar(&o.User, "equinix_api_username", "", "Username for Equinix API")
-	flag.StringVar(&o.APIKey, "equinix_api_key", "", "Key/token/password for Equinix API")
-	flag.IntVar(&o.Parallelism, "equinix_parallelism", 3, "How many parallel connections to the Equinix API will be allowed")
-}
-
-// Client is a limited interface of methods that the Shepherd uses on Equinix. It
-// is provided to allow for dependency injection of a fake equinix API for tests.
-type Client interface {
-	// GetDevice wraps packngo's cl.Devices.Get.
-	//
-	// TODO(q3k): remove unused pid parameter.
-	GetDevice(ctx context.Context, pid, did string, opts *packngo.ListOptions) (*packngo.Device, error)
-	// ListDevices wraps packngo's cl.Device.List.
-	ListDevices(ctx context.Context, pid string) ([]packngo.Device, error)
-	// CreateDevice attempts to create a new device according to the provided
-	// request. The request _must_ configure a HardwareReservationID. This call
-	// attempts to be as idempotent as possible, and will return ErrRaceLost if a
-	// retry was needed but in the meantime the requested hardware reservation from
-	// which this machine was requested got lost.
-	CreateDevice(ctx context.Context, request *packngo.DeviceCreateRequest) (*packngo.Device, error)
-
-	UpdateDevice(ctx context.Context, id string, request *packngo.DeviceUpdateRequest) (*packngo.Device, error)
-	RebootDevice(ctx context.Context, did string) error
-	DeleteDevice(ctx context.Context, id string) error
-
-	// ListReservations returns a complete list of hardware reservations associated
-	// with project pid. This is an expensive method that takes a while to execute,
-	// handle with care.
-	ListReservations(ctx context.Context, pid string) ([]packngo.HardwareReservation, error)
-
-	ListOrganizationReservations(ctx context.Context, oid string) ([]packngo.HardwareReservation, error)
-
-	// MoveReservation moves a reserved device to the given project.
-	MoveReservation(ctx context.Context, hardwareReservationDID, projectID string) (*packngo.HardwareReservation, error)
-
-	// ListSSHKeys wraps packngo's cl.Keys.List.
-	ListSSHKeys(ctx context.Context) ([]packngo.SSHKey, error)
-	// CreateSSHKey is idempotent - the key label can be used only once. Further
-	// calls referring to the same label and key will not yield errors. See the
-	// package comment for more info on this method's behavior and returned error
-	// values.
-	CreateSSHKey(ctx context.Context, req *packngo.SSHKeyCreateRequest) (*packngo.SSHKey, error)
-	// UpdateSSHKey is idempotent - values included in r can be applied only once,
-	// while subsequent updates using the same data don't produce errors. See the
-	// package comment for information on this method's behavior and returned error
-	// values.
-	UpdateSSHKey(ctx context.Context, kid string, req *packngo.SSHKeyUpdateRequest) (*packngo.SSHKey, error)
-
-	Close()
-}
-
-// client implements the Client interface.
-type client struct {
-	username string
-	token    string
-	o        *Opts
-	rlt      *time.Ticker
-
-	serializer *serializer
-	metrics    *metricsSet
-}
-
-// serializer is an N-semaphore channel (configured by opts.Parallelism) which is
-// used to limit the number of concurrent calls to the Equinix API.
-//
-// In addition, it implements some simple waiting/usage statistics for
-// metrics/introspection.
-type serializer struct {
-	sem     chan struct{}
-	usage   int64
-	waiting int64
-}
-
-// up blocks until the serializer has at least one available concurrent call
-// slot. If the given context expires before such a slot is available, the
-// context error is returned.
-func (s *serializer) up(ctx context.Context) error {
-	atomic.AddInt64(&s.waiting, 1)
-	select {
-	case s.sem <- struct{}{}:
-		atomic.AddInt64(&s.waiting, -1)
-		atomic.AddInt64(&s.usage, 1)
-		return nil
-	case <-ctx.Done():
-		atomic.AddInt64(&s.waiting, -1)
-		return ctx.Err()
-	}
-}
-
-// down releases a previously acquire concurrent call slot.
-func (s *serializer) down() {
-	atomic.AddInt64(&s.usage, -1)
-	<-s.sem
-}
-
-// stats returns the number of in-flight and waiting-for-semaphore requests.
-func (s *serializer) stats() (usage, waiting int64) {
-	usage = atomic.LoadInt64(&s.usage)
-	waiting = atomic.LoadInt64(&s.waiting)
-	return
-}
-
-// New creates a Client instance based on Opts. PACKNGO_DEBUG environment
-// variable can be set prior to the below call to enable verbose packngo
-// debug logs.
-func New(opts *Opts) Client {
-	return newClient(opts)
-}
-
-func newClient(opts *Opts) *client {
-	// Apply the defaults.
-	if opts.APIRate == 0 {
-		opts.APIRate = 2 * time.Second
-	}
-	if opts.BackOff == nil {
-		opts.BackOff = func() backoff.BackOff {
-			return backoff.NewExponentialBackOff()
-		}
-	}
-	if opts.Parallelism == 0 {
-		opts.Parallelism = 1
-	}
-
-	cl := &client{
-		username: opts.User,
-		token:    opts.APIKey,
-		o:        opts,
-		rlt:      time.NewTicker(opts.APIRate),
-
-		serializer: &serializer{
-			sem: make(chan struct{}, opts.Parallelism),
-		},
-	}
-	if opts.MetricsRegistry != nil {
-		ms := newMetricsSet(cl.serializer)
-		opts.MetricsRegistry.MustRegister(ms.inFlight, ms.waiting, ms.requestLatencies)
-		cl.metrics = ms
-	}
-	return cl
-}
-
-func (c *client) Close() {
-	c.rlt.Stop()
-}
-
-var (
-	ErrRaceLost              = errors.New("race lost with another API user")
-	ErrNoReservationProvided = errors.New("hardware reservation must be set")
-)
-
-func (c *client) PowerOffDevice(ctx context.Context, pid string) error {
-	_, err := wrap(ctx, c, func(p *packngo.Client) (*packngo.Response, error) {
-		r, err := p.Devices.PowerOff(pid)
-		if err != nil {
-			return nil, fmt.Errorf("Devices.PowerOff: %w", err)
-		}
-		return r, nil
-	})
-	return err
-}
-
-func (c *client) PowerOnDevice(ctx context.Context, pid string) error {
-	_, err := wrap(ctx, c, func(p *packngo.Client) (*packngo.Response, error) {
-		r, err := p.Devices.PowerOn(pid)
-		if err != nil {
-			return nil, fmt.Errorf("Devices.PowerOn: %w", err)
-		}
-		return r, nil
-	})
-	return err
-}
-
-func (c *client) DeleteDevice(ctx context.Context, id string) error {
-	_, err := wrap(ctx, c, func(p *packngo.Client) (*packngo.Response, error) {
-		r, err := p.Devices.Delete(id, false)
-		if err != nil {
-			return nil, fmt.Errorf("Devices.Delete: %w", err)
-		}
-		return r, nil
-	})
-	return err
-}
-
-func (c *client) CreateDevice(ctx context.Context, r *packngo.DeviceCreateRequest) (*packngo.Device, error) {
-	if r.HardwareReservationID == "" {
-		return nil, ErrNoReservationProvided
-	}
-	// Add a tag to the request to detect if someone snatches a hardware reservation
-	// from under us.
-	witnessTag := fmt.Sprintf("wrapngo-idempotency-%s", uuid.New().String())
-	r.Tags = append(r.Tags, witnessTag)
-
-	return wrap(ctx, c, func(cl *packngo.Client) (*packngo.Device, error) {
-		//Does the device already exist?
-		res, _, err := cl.HardwareReservations.Get(r.HardwareReservationID, nil)
-		if err != nil {
-			return nil, fmt.Errorf("couldn't check if device already exists: %w", err)
-		}
-		if res == nil {
-			return nil, fmt.Errorf("unexpected nil response")
-		}
-		if res.Device != nil {
-			// Check if we lost the race for this hardware reservation.
-			tags := make(map[string]bool)
-			for _, tag := range res.Device.Tags {
-				tags[tag] = true
-			}
-			if !tags[witnessTag] {
-				return nil, ErrRaceLost
-			}
-			return res.Device, nil
-		}
-
-		// No device yet. Try to create it.
-		dev, _, err := cl.Devices.Create(r)
-		if err == nil {
-			return dev, nil
-		}
-		// In case of a transient failure (eg. network issue), we retry the whole
-		// operation, which means we first check again if the device already exists. If
-		// it's a permanent error from the API, the backoff logic will fail immediately.
-		return nil, fmt.Errorf("couldn't create device: %w", err)
-	})
-}
-
-func (c *client) UpdateDevice(ctx context.Context, id string, r *packngo.DeviceUpdateRequest) (*packngo.Device, error) {
-	return wrap(ctx, c, func(cl *packngo.Client) (*packngo.Device, error) {
-		dev, _, err := cl.Devices.Update(id, r)
-		return dev, err
-	})
-}
-
-func (c *client) ListDevices(ctx context.Context, pid string) ([]packngo.Device, error) {
-	return wrap(ctx, c, func(cl *packngo.Client) ([]packngo.Device, error) {
-		// to increase the chances of a stable pagination, we sort the devices by hostname
-		res, _, err := cl.Devices.List(pid, &packngo.GetOptions{SortBy: "hostname"})
-		return res, err
-	})
-}
-
-func (c *client) GetDevice(ctx context.Context, pid, did string, opts *packngo.ListOptions) (*packngo.Device, error) {
-	return wrap(ctx, c, func(cl *packngo.Client) (*packngo.Device, error) {
-		d, _, err := cl.Devices.Get(did, opts)
-		return d, err
-	})
-}
-
-// Currently unexported, only used in tests.
-func (c *client) deleteDevice(ctx context.Context, did string) error {
-	_, err := wrap(ctx, c, func(cl *packngo.Client) (*struct{}, error) {
-		_, err := cl.Devices.Delete(did, false)
-		if httpStatusCode(err) == http.StatusNotFound {
-			// 404s may pop up as an after effect of running the back-off
-			// algorithm, and as such should not be propagated.
-			return nil, nil
-		}
-		return nil, err
-	})
-	return err
-}
-
-func (c *client) ListReservations(ctx context.Context, pid string) ([]packngo.HardwareReservation, error) {
-	return wrap(ctx, c, func(cl *packngo.Client) ([]packngo.HardwareReservation, error) {
-		res, _, err := cl.HardwareReservations.List(pid, &packngo.ListOptions{Includes: []string{"facility", "device"}})
-		return res, err
-	})
-}
-
-func (c *client) ListOrganizationReservations(ctx context.Context, pid string) ([]packngo.HardwareReservation, error) {
-	return wrap(ctx, c, func(cl *packngo.Client) ([]packngo.HardwareReservation, error) {
-		res, _, err := cl.Organizations.ListHardwareReservations(pid, &packngo.ListOptions{Includes: []string{"facility", "device", "project"}})
-		return res, err
-	})
-}
-
-func (c *client) MoveReservation(ctx context.Context, hardwareReservationDID, projectID string) (*packngo.HardwareReservation, error) {
-	return wrap(ctx, c, func(cl *packngo.Client) (*packngo.HardwareReservation, error) {
-		hr, _, err := cl.HardwareReservations.Move(hardwareReservationDID, projectID)
-		if err != nil {
-			return nil, fmt.Errorf("HardwareReservations.Move: %w", err)
-		}
-		return hr, err
-	})
-}
-
-func (c *client) CreateSSHKey(ctx context.Context, r *packngo.SSHKeyCreateRequest) (*packngo.SSHKey, error) {
-	return wrap(ctx, c, func(cl *packngo.Client) (*packngo.SSHKey, error) {
-		// Does the key already exist?
-		ks, _, err := cl.SSHKeys.List()
-		if err != nil {
-			return nil, fmt.Errorf("SSHKeys.List: %w", err)
-		}
-		for _, k := range ks {
-			if k.Label == r.Label {
-				if k.Key != r.Key {
-					return nil, fmt.Errorf("key label already in use for a different key")
-				}
-				return &k, nil
-			}
-		}
-
-		// No key yet. Try to create it.
-		k, _, err := cl.SSHKeys.Create(r)
-		if err != nil {
-			return nil, fmt.Errorf("SSHKeys.Create: %w", err)
-		}
-		return k, nil
-	})
-}
-
-func (c *client) UpdateSSHKey(ctx context.Context, id string, r *packngo.SSHKeyUpdateRequest) (*packngo.SSHKey, error) {
-	return wrap(ctx, c, func(cl *packngo.Client) (*packngo.SSHKey, error) {
-		k, _, err := cl.SSHKeys.Update(id, r)
-		if err != nil {
-			return nil, fmt.Errorf("SSHKeys.Update: %w", err)
-		}
-		return k, err
-	})
-}
-
-// Currently unexported, only used in tests.
-func (c *client) deleteSSHKey(ctx context.Context, id string) error {
-	_, err := wrap(ctx, c, func(cl *packngo.Client) (struct{}, error) {
-		_, err := cl.SSHKeys.Delete(id)
-		if err != nil {
-			return struct{}{}, fmt.Errorf("SSHKeys.Delete: %w", err)
-		}
-		return struct{}{}, err
-	})
-	return err
-}
-
-func (c *client) ListSSHKeys(ctx context.Context) ([]packngo.SSHKey, error) {
-	return wrap(ctx, c, func(cl *packngo.Client) ([]packngo.SSHKey, error) {
-		ks, _, err := cl.SSHKeys.List()
-		if err != nil {
-			return nil, fmt.Errorf("SSHKeys.List: %w", err)
-		}
-		return ks, nil
-	})
-}
-
-// Currently unexported, only used in tests.
-func (c *client) getSSHKey(ctx context.Context, id string) (*packngo.SSHKey, error) {
-	return wrap(ctx, c, func(cl *packngo.Client) (*packngo.SSHKey, error) {
-		k, _, err := cl.SSHKeys.Get(id, nil)
-		if err != nil {
-			return nil, fmt.Errorf("SSHKeys.Get: %w", err)
-		}
-		return k, nil
-	})
-}
-
-func (c *client) RebootDevice(ctx context.Context, did string) error {
-	_, err := wrap(ctx, c, func(cl *packngo.Client) (struct{}, error) {
-		_, err := cl.Devices.Reboot(did)
-		return struct{}{}, err
-	})
-	return err
-}
diff --git a/cloud/equinix/wrapngo/wrapngo_live_test.go b/cloud/equinix/wrapngo/wrapngo_live_test.go
deleted file mode 100644
index 0ccce37..0000000
--- a/cloud/equinix/wrapngo/wrapngo_live_test.go
+++ /dev/null
@@ -1,350 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package wrapngo
-
-import (
-	"context"
-	"crypto/ed25519"
-	"crypto/rand"
-	"errors"
-	"fmt"
-	"log"
-	"os"
-	"testing"
-	"time"
-
-	"github.com/packethost/packngo"
-	"golang.org/x/crypto/ssh"
-)
-
-type liveTestClient struct {
-	cl  *client
-	ctx context.Context
-
-	apipid string
-	apios  string
-
-	sshKeyLabel        string
-	testDeviceHostname string
-}
-
-func newLiveTestClient(t *testing.T) *liveTestClient {
-	t.Helper()
-
-	apiuser := os.Getenv("EQUINIX_USER")
-	apikey := os.Getenv("EQUINIX_APIKEY")
-	apipid := os.Getenv("EQUINIX_PROJECT_ID")
-	apios := os.Getenv("EQUINIX_DEVICE_OS")
-
-	if apiuser == "" {
-		t.Skip("EQUINIX_USER must be set.")
-	}
-	if apikey == "" {
-		t.Skip("EQUINIX_APIKEY must be set.")
-	}
-	if apipid == "" {
-		t.Skip("EQUINIX_PROJECT_ID must be set.")
-	}
-	if apios == "" {
-		t.Skip("EQUINIX_DEVICE_OS must be set.")
-	}
-	ctx, ctxC := context.WithCancel(context.Background())
-	t.Cleanup(ctxC)
-	return &liveTestClient{
-		cl: newClient(&Opts{
-			User:   apiuser,
-			APIKey: apikey,
-		}),
-		ctx: ctx,
-
-		apipid: apipid,
-		apios:  apios,
-
-		sshKeyLabel:        "shepherd-livetest-client",
-		testDeviceHostname: "shepherd-livetest-device",
-	}
-}
-
-// awaitDeviceState returns nil after device matching the id reaches one of the
-// provided states. It will return a non-nil value in case of an API error, and
-// particularly if there exists no device matching id.
-func (l *liveTestClient) awaitDeviceState(t *testing.T, id string, states ...string) error {
-	t.Helper()
-
-	for {
-		d, err := l.cl.GetDevice(l.ctx, l.apipid, id, nil)
-		if err != nil {
-			if errors.Is(err, os.ErrDeadlineExceeded) {
-				continue
-			}
-			return fmt.Errorf("while fetching device info: %w", err)
-		}
-		if d == nil {
-			return fmt.Errorf("expected the test device (ID: %s) to exist.", id)
-		}
-		for _, s := range states {
-			if d.State == s {
-				return nil
-			}
-		}
-		t.Logf("Waiting for device to be provisioned (ID: %s, current state: %q)", id, d.State)
-		time.Sleep(time.Second)
-	}
-}
-
-// cleanup ensures both the test device and the test key are deleted at
-// Equinix.
-func (l *liveTestClient) cleanup(t *testing.T) {
-	t.Helper()
-
-	t.Logf("Cleaning up.")
-
-	// Ensure the device matching testDeviceHostname is deleted.
-	ds, err := l.cl.ListDevices(l.ctx, l.apipid)
-	if err != nil {
-		log.Fatalf("while listing devices: %v", err)
-	}
-	var td *packngo.Device
-	for _, d := range ds {
-		if d.Hostname == l.testDeviceHostname {
-			td = &d
-			break
-		}
-	}
-	if td != nil {
-		t.Logf("Found a test device (ID: %s) that needs to be deleted before progressing further.", td.ID)
-
-		// Devices currently being provisioned can't be deleted. After it's
-		// provisioned, device's state will match either "active", or "failed".
-		if err := l.awaitDeviceState(t, "active", "failed"); err != nil {
-			t.Fatalf("while waiting for device to be provisioned: %v", err)
-		}
-		if err := l.cl.deleteDevice(l.ctx, td.ID); err != nil {
-			t.Fatalf("while deleting test device: %v", err)
-		}
-	}
-
-	// Ensure the key matching sshKeyLabel is deleted.
-	ks, err := l.cl.ListSSHKeys(l.ctx)
-	if err != nil {
-		t.Fatalf("while listing SSH keys: %v", err)
-	}
-	for _, k := range ks {
-		if k.Label == l.sshKeyLabel {
-			t.Logf("Found a SSH test key (ID: %s) - deleting...", k.ID)
-			if err := l.cl.deleteSSHKey(l.ctx, k.ID); err != nil {
-				t.Fatalf("while deleting an SSH key: %v", err)
-			}
-			t.Logf("Deleted a SSH test key (ID: %s).", k.ID)
-		}
-	}
-}
-
-// createSSHAuthKey returns an SSH public key in OpenSSH authorized_keys
-// format.
-func createSSHAuthKey(t *testing.T) string {
-	t.Helper()
-	pub, _, err := ed25519.GenerateKey(rand.Reader)
-	if err != nil {
-		t.Errorf("while generating SSH key: %v", err)
-	}
-
-	sshpub, err := ssh.NewPublicKey(pub)
-	if err != nil {
-		t.Errorf("while generating SSH public key: %v", err)
-	}
-	return string(ssh.MarshalAuthorizedKey(sshpub))
-}
-
-// TestLiveAPI performs smoke tests of wrapngo against the real Equinix API. See
-// newLiveTestClient to see which environment variables need to be provided in
-// order for this test to run.
-func TestLiveAPI(t *testing.T) {
-	ltc := newLiveTestClient(t)
-	ltc.cleanup(t)
-
-	cl := ltc.cl
-	ctx := ltc.ctx
-
-	t.Run("ListReservations", func(t *testing.T) {
-		_, err := cl.ListReservations(ctx, ltc.apipid)
-		if err != nil {
-			t.Errorf("while listing hardware reservations: %v", err)
-		}
-	})
-
-	var sshKeyID string
-	t.Run("CreateSSHKey", func(t *testing.T) {
-		nk, err := cl.CreateSSHKey(ctx, &packngo.SSHKeyCreateRequest{
-			Label:     ltc.sshKeyLabel,
-			Key:       createSSHAuthKey(t),
-			ProjectID: ltc.apipid,
-		})
-		if err != nil {
-			t.Fatalf("while creating an SSH key: %v", err)
-		}
-		if nk.Label != ltc.sshKeyLabel {
-			t.Errorf("key labels don't match.")
-		}
-		t.Logf("Created an SSH key (ID: %s)", nk.ID)
-		sshKeyID = nk.ID
-	})
-
-	var dummySSHPK2 string
-	t.Run("UpdateSSHKey", func(t *testing.T) {
-		if sshKeyID == "" {
-			t.Skip("SSH key couldn't have been created - skipping...")
-		}
-
-		dummySSHPK2 = createSSHAuthKey(t)
-		k, err := cl.UpdateSSHKey(ctx, sshKeyID, &packngo.SSHKeyUpdateRequest{
-			Key: &dummySSHPK2,
-		})
-		if err != nil {
-			t.Fatalf("while updating an SSH key: %v", err)
-		}
-		if k.Key != dummySSHPK2 {
-			t.Errorf("updated SSH key doesn't match the original.")
-		}
-	})
-	t.Run("GetSSHKey", func(t *testing.T) {
-		if sshKeyID == "" {
-			t.Skip("SSH key couldn't have been created - skipping...")
-		}
-
-		k, err := cl.getSSHKey(ctx, sshKeyID)
-		if err != nil {
-			t.Fatalf("while getting an SSH key: %v", err)
-		}
-		if k.Key != dummySSHPK2 {
-			t.Errorf("got key contents that don't match the original.")
-		}
-	})
-	t.Run("ListSSHKeys", func(t *testing.T) {
-		if sshKeyID == "" {
-			t.Skip("SSH key couldn't have been created - skipping...")
-		}
-
-		ks, err := cl.ListSSHKeys(ctx)
-		if err != nil {
-			t.Fatalf("while listing SSH keys: %v", err)
-		}
-
-		// Check that our key is part of the list.
-		found := false
-		for _, k := range ks {
-			if k.ID == sshKeyID {
-				found = true
-				break
-			}
-		}
-		if !found {
-			t.Errorf("SSH key not listed.")
-		}
-	})
-
-	var testDevice *packngo.Device
-	t.Run("CreateDevice", func(t *testing.T) {
-		// Find a provisionable hardware reservation the device will be created with.
-		rvs, err := cl.ListReservations(ctx, ltc.apipid)
-		if err != nil {
-			t.Errorf("while listing hardware reservations: %v", err)
-		}
-		var rv *packngo.HardwareReservation
-		for _, r := range rvs {
-			if r.Provisionable {
-				rv = &r
-				break
-			}
-		}
-		if rv == nil {
-			t.Skip("could not find a provisionable hardware reservation - skipping...")
-		}
-
-		// nolint:SA5011
-		d, err := cl.CreateDevice(ctx, &packngo.DeviceCreateRequest{
-			Hostname:              ltc.testDeviceHostname,
-			OS:                    ltc.apios,
-			Plan:                  rv.Plan.Slug,
-			HardwareReservationID: rv.ID,
-			ProjectID:             ltc.apipid,
-		})
-		if err != nil {
-			t.Fatalf("while creating a device: %v", err)
-		}
-		t.Logf("Created a new test device (ID: %s)", d.ID)
-		testDevice = d
-	})
-	t.Run("GetDevice", func(t *testing.T) {
-		if testDevice == nil {
-			t.Skip("the test device couldn't have been created - skipping...")
-		}
-
-		d, err := cl.GetDevice(ctx, ltc.apipid, testDevice.ID, nil)
-		if err != nil {
-			t.Fatalf("while fetching device info: %v", err)
-		}
-		if d == nil {
-			t.Fatalf("expected the test device (ID: %s) to exist.", testDevice.ID)
-			return
-		}
-		if d.ID != testDevice.ID {
-			t.Errorf("got device ID that doesn't match the original.")
-			return
-		}
-	})
-	t.Run("ListDevices", func(t *testing.T) {
-		if testDevice == nil {
-			t.Skip("the test device couldn't have been created - skipping...")
-		}
-
-		ds, err := cl.ListDevices(ctx, ltc.apipid)
-		if err != nil {
-			t.Errorf("while listing devices: %v", err)
-		}
-		if len(ds) == 0 {
-			t.Errorf("expected at least one device.")
-		}
-	})
-	t.Run("DeleteDevice", func(t *testing.T) {
-		if testDevice == nil {
-			t.Skip("the test device couldn't have been created - skipping...")
-		}
-
-		// Devices currently being provisioned can't be deleted. After it's
-		// provisioned, device's state will match either "active", or "failed".
-		if err := ltc.awaitDeviceState(t, testDevice.ID, "active", "failed"); err != nil {
-			t.Fatalf("while waiting for device to be provisioned: %v", err)
-		}
-		t.Logf("Deleting the test device (ID: %s)", testDevice.ID)
-		if err := cl.deleteDevice(ctx, testDevice.ID); err != nil {
-			t.Fatalf("while deleting a device: %v", err)
-		}
-		d, err := cl.GetDevice(ctx, ltc.apipid, testDevice.ID, nil)
-		if err != nil && !IsNotFound(err) {
-			t.Fatalf("while fetching device info: %v", err)
-		}
-		if d != nil {
-			t.Fatalf("device should not exist.")
-		}
-		t.Logf("Deleted the test device (ID: %s)", testDevice.ID)
-	})
-	t.Run("DeleteSSHKey", func(t *testing.T) {
-		if sshKeyID == "" {
-			t.Skip("SSH key couldn't have been created - skipping...")
-		}
-
-		t.Logf("Deleting the test SSH key (ID: %s)", sshKeyID)
-		if err := cl.deleteSSHKey(ctx, sshKeyID); err != nil {
-			t.Fatalf("couldn't delete an SSH key: %v", err)
-		}
-		_, err := cl.getSSHKey(ctx, sshKeyID)
-		if err == nil {
-			t.Fatalf("SSH key should not exist")
-		}
-		t.Logf("Deleted the test SSH key (ID: %s)", sshKeyID)
-	})
-
-	ltc.cleanup(t)
-}
diff --git a/cloud/lib/component/BUILD.bazel b/cloud/lib/component/BUILD.bazel
deleted file mode 100644
index e751aaf..0000000
--- a/cloud/lib/component/BUILD.bazel
+++ /dev/null
@@ -1,28 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-
-go_library(
-    name = "component",
-    srcs = [
-        "component.go",
-        "crdb.go",
-        "devcerts.go",
-    ],
-    importpath = "source.monogon.dev/cloud/lib/component",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//osbase/pki",
-        "@com_github_adrg_xdg//:xdg",
-        "@com_github_cockroachdb_cockroach_go_v2//testserver",
-        "@com_github_golang_migrate_migrate_v4//:migrate",
-        "@com_github_golang_migrate_migrate_v4//database/cockroachdb",
-        "@com_github_golang_migrate_migrate_v4//source",
-        "@com_github_lib_pq//:pq",
-        "@com_github_prometheus_client_golang//prometheus",
-        "@com_github_prometheus_client_golang//prometheus/collectors",
-        "@com_github_prometheus_client_golang//prometheus/promhttp",
-        "@io_bazel_rules_go//go/runfiles",
-        "@io_k8s_klog_v2//:klog",
-        "@org_golang_google_grpc//:grpc",
-        "@org_golang_google_grpc//credentials",
-    ],
-)
diff --git a/cloud/lib/component/component.go b/cloud/lib/component/component.go
deleted file mode 100644
index 46fa58a..0000000
--- a/cloud/lib/component/component.go
+++ /dev/null
@@ -1,214 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-// Package component implements reusable bits for cloud service components. Each
-// component is currently defined as being a standalone Go binary with its own
-// internal gRPC listener. Subsequent listeners (eg. public gRPC or HTTP) can be
-// defined by users of this library.
-package component
-
-import (
-	"context"
-	"crypto/tls"
-	"crypto/x509"
-	"flag"
-	"net"
-	"net/http"
-	"os"
-	"path/filepath"
-
-	"github.com/adrg/xdg"
-	"github.com/prometheus/client_golang/prometheus"
-	"github.com/prometheus/client_golang/prometheus/collectors"
-	"github.com/prometheus/client_golang/prometheus/promhttp"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials"
-	"k8s.io/klog/v2"
-)
-
-// ComponentConfig is the common configuration of a component. It's
-// supposed to be instantiated within a Configuration struct of a component.
-//
-// It can be configured by flags (via RegisterFlags) or manually (eg. in tests).
-type ComponentConfig struct {
-	// GRPCKeyPath is the filesystem path of the x509 key used to serve internal
-	// gRPC traffic.
-	GRPCKeyPath string
-	// GRPCCertificatePath is the filesystem path of the x509 certificate used to
-	// serve internal gRPC traffic.
-	GRPCCertificatePath string
-	// GRPCCAPath is the filesystem path of of the x509 CA certificate used to
-	// verify incoming connections on internal gRPC traffic.
-	GRPCCAPath string
-	// GRPCListenAddress is the address on which the component should server
-	// internal gRPC traffic.
-	GRPCListenAddress string
-
-	// DevCerts, if enabled, automatically generates development CA and component
-	// certificates/keys at DevCertsPath, uses these to serve traffic.
-	DevCerts bool
-	// DevCertsPath sets the prefix in which DevCerts are generated. All components
-	// should have the same path set so that they reuse the CA certificate.
-	DevCertsPath string
-
-	// ComponentName is the name of this component, which should be [a-z0-9+]. It's
-	// used to prefix all flags set by the Configuration.
-	ComponentName string
-
-	// PrometheusListenAddress is the address on which the component should serve
-	// Prometheus metrics.
-	PrometheusListenAddress string
-	// PrometheusInsecure enables serving Prometheus metrics without any TLS, running
-	// a plain HTTP listener. If disabled, Prometheus metrics are served using the
-	// same PKI setup as the components' gRPC server.
-	PrometheusInsecure bool
-
-	prometheusRegistry *prometheus.Registry
-}
-
-// RegisterFlags registers the component configuration to be provided by flags.
-// This must be called exactly once before then calling flags.Parse().
-func (c *ComponentConfig) RegisterFlags(componentName string) {
-	flag.StringVar(&c.GRPCKeyPath, componentName+"_grpc_key_path", "", "Path to gRPC server/client key for "+componentName)
-	flag.StringVar(&c.GRPCCertificatePath, componentName+"_grpc_certificate_path", "", "Path to gRPC server/client certificate for "+componentName)
-	flag.StringVar(&c.GRPCCAPath, componentName+"_grpc_ca_certificate_path", "", "Path to gRPC CA certificate for "+componentName)
-	flag.StringVar(&c.GRPCListenAddress, componentName+"_grpc_listen_address", ":4242", "Address to listen at for gRPC connections for "+componentName)
-	flag.StringVar(&c.PrometheusListenAddress, componentName+"_prometheus_listen_address", ":4243", "Address to listen at for Prometheus connections for "+componentName)
-	flag.BoolVar(&c.PrometheusInsecure, componentName+"_prometheus_insecure", false, "Serve plain HTTP prometheus without mTLS. If not set, main gRPC TLS credentials/certificates are used")
-
-	flag.BoolVar(&c.DevCerts, componentName+"_dev_certs", false, "Use developer certificates (autogenerated) for "+componentName)
-	flag.StringVar(&c.DevCertsPath, componentName+"_dev_certs_path", filepath.Join(xdg.ConfigHome, "monogon-dev-certs"), "Path for storing developer certificates")
-
-	c.ComponentName = componentName
-}
-
-func (c *ComponentConfig) getTLSConfig() *tls.Config {
-	var certPath, keyPath, caPath string
-	if c.DevCerts {
-		// Use devcerts if requested.
-		certPath, keyPath, caPath = c.GetDevCerts()
-	} else {
-		// Otherwise, use data from flags.
-		if c.GRPCKeyPath == "" {
-			klog.Exitf("-grpc_key_path must be set")
-		}
-		if c.GRPCCertificatePath == "" {
-			klog.Exitf("-grpc_certificate_path must be set")
-		}
-		if c.GRPCCAPath == "" {
-			klog.Exitf("-grpc_ca_certificate_path must be set")
-		}
-		keyPath = c.GRPCKeyPath
-		certPath = c.GRPCCertificatePath
-		caPath = c.GRPCCAPath
-	}
-
-	ca, err := os.ReadFile(caPath)
-	if err != nil {
-		klog.Exitf("Could not read GRPC CA: %v", err)
-	}
-	certPool := x509.NewCertPool()
-	if !certPool.AppendCertsFromPEM(ca) {
-		klog.Exitf("Could not load GRPC CA: %v", err)
-	}
-
-	pair, err := tls.LoadX509KeyPair(certPath, keyPath)
-	if err != nil {
-		klog.Exitf("Could not load GRPC TLS keypair: %v", err)
-	}
-	return &tls.Config{
-		Certificates: []tls.Certificate{pair},
-		ClientAuth:   tls.RequireAndVerifyClientCert,
-		ClientCAs:    certPool,
-	}
-}
-
-// PrometheusRegistry returns this component's singleton Prometheus registry,
-// creating it as needed. This method is not goroutine-safe, and should only be
-// called during the setup process of the Component.
-func (c *ComponentConfig) PrometheusRegistry() *prometheus.Registry {
-	if c.prometheusRegistry == nil {
-		c.prometheusRegistry = prometheus.NewRegistry()
-		c.prometheusRegistry.Register(collectors.NewGoCollector())
-		c.prometheusRegistry.Register(collectors.NewProcessCollector(collectors.ProcessCollectorOpts{}))
-	}
-	return c.prometheusRegistry
-}
-
-// StartPrometheus starts a Prometheus metrics server in a goroutine. It will
-// serve any metrics that have been registered with the registry returned by
-// PrometheusRegistry.
-func (c *ComponentConfig) StartPrometheus(ctx context.Context) {
-	reg := c.PrometheusRegistry()
-
-	mux := http.NewServeMux()
-	mux.Handle("/metrics", promhttp.HandlerFor(reg, promhttp.HandlerOpts{}))
-
-	var lis net.Listener
-	var err error
-
-	if c.PrometheusInsecure {
-		lis, err = net.Listen("tcp", c.PrometheusListenAddress)
-	} else {
-		lis, err = tls.Listen("tcp", c.PrometheusListenAddress, c.getTLSConfig())
-	}
-	if err != nil {
-		klog.Exitf("Could not listen on prometheus address: %v", err)
-	}
-
-	srv := http.Server{
-		Handler: mux,
-	}
-	go func() {
-		klog.Infof("Prometheus listening on %s", lis.Addr())
-		if err := srv.Serve(lis); err != nil && ctx.Err() == nil {
-			klog.Exitf("Prometheus serve failed: %v", err)
-		}
-	}()
-	go func() {
-		<-ctx.Done()
-		srv.Close()
-	}()
-}
-
-// GRPCServerOptions returns pre-built grpc.ServerOptions that this component
-// should use to serve internal gRPC.
-func (c *ComponentConfig) GRPCServerOptions() []grpc.ServerOption {
-	return []grpc.ServerOption{
-		grpc.Creds(credentials.NewTLS(c.getTLSConfig())),
-	}
-}
-
-// GRPCServerOptionsPublic returns pre-built grpc.ServerOptions that this
-// component should use to serve public gRPC. Any client will be allowed to
-// connect, and it's up to the server implementation to authenticate incoming
-// requests.
-func (c *ComponentConfig) GRPCServerOptionsPublic() []grpc.ServerOption {
-	var certPath, keyPath string
-	if c.DevCerts {
-		// Use devcerts if requested.
-		certPath, keyPath, _ = c.GetDevCerts()
-	} else {
-		// Otherwise, use data from flags.
-		if c.GRPCKeyPath == "" {
-			klog.Exitf("-grpc_key_path must be set")
-		}
-		if c.GRPCCertificatePath == "" {
-			klog.Exitf("-grpc_certificate_path must be set")
-		}
-		keyPath = c.GRPCKeyPath
-		certPath = c.GRPCCertificatePath
-	}
-
-	pair, err := tls.LoadX509KeyPair(certPath, keyPath)
-	if err != nil {
-		klog.Exitf("Could not load GRPC TLS keypair: %v", err)
-	}
-	tlsConf := &tls.Config{
-		Certificates: []tls.Certificate{pair},
-		ClientAuth:   tls.RequestClientCert,
-	}
-	return []grpc.ServerOption{
-		grpc.Creds(credentials.NewTLS(tlsConf)),
-	}
-}
diff --git a/cloud/lib/component/crdb.go b/cloud/lib/component/crdb.go
deleted file mode 100644
index 07306d1..0000000
--- a/cloud/lib/component/crdb.go
+++ /dev/null
@@ -1,202 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package component
-
-import (
-	"database/sql"
-	"errors"
-	"flag"
-	"fmt"
-	"net/url"
-	"os"
-	"sync"
-
-	"github.com/bazelbuild/rules_go/go/runfiles"
-	"github.com/cockroachdb/cockroach-go/v2/testserver"
-	"github.com/golang-migrate/migrate/v4"
-	_ "github.com/golang-migrate/migrate/v4/database/cockroachdb"
-	"github.com/golang-migrate/migrate/v4/source"
-	_ "github.com/lib/pq"
-	"k8s.io/klog/v2"
-)
-
-// CockroachConfig is the common configuration of a components' connection to
-// CockroachDB. It's supposed to be instantiated within a Configuration struct
-// of a component.
-//
-// It can be configured by flags (via RegisterFlags) or manually (eg. in tests).
-type CockroachConfig struct {
-	// Migrations is the go-migrate source of migrations for this database. Usually
-	// this can be taken from a go-embedded set of migration files.
-	Migrations source.Driver
-
-	// EndpointHost is the host part of the endpoint address of the database server.
-	EndpointHost string
-	// TLSKeyPath is the filesystem path of the x509 key used to authenticate to the
-	// database server.
-	TLSKeyPath string
-	// TLSKeyPath is the filesystem path of the x509 certificate used to
-	// authenticate to the database server.
-	TLSCertificatePath string
-	// TLSCACertificatePath is the filesystem path of the x509 CA certificate used
-	// to verify the database server's certificate.
-	TLSCACertificatePath string
-	// UserName is the username to be used on the database server.
-	UserName string
-	// UserName is the database name to be used on the database server.
-	DatabaseName string
-
-	// InMemory indicates that an in-memory CockroachDB instance should be used.
-	// Data will be lost after the component shuts down.
-	InMemory bool
-
-	// mu guards inMemoryInstance.
-	mu sync.Mutex
-	// inMemoryInstance is populated with a CockroachDB test server handle when
-	// InMemory is set and Connect()/MigrateUp() is called.
-	inMemoryInstance testserver.TestServer
-}
-
-// RegisterFlags registers the connection configuration to be provided by flags.
-// This must be called exactly once before then calling flags.Parse().
-func (c *CockroachConfig) RegisterFlags(prefix string) {
-	flag.StringVar(&c.EndpointHost, prefix+"_endpoint_host", "", "Host of CockroachDB endpoint for "+prefix)
-	flag.StringVar(&c.TLSKeyPath, prefix+"_tls_key_path", "", "Path to CockroachDB TLS client key for "+prefix)
-	flag.StringVar(&c.TLSCertificatePath, prefix+"_tls_certificate_path", "", "Path to CockroachDB TLS client certificate for "+prefix)
-	flag.StringVar(&c.TLSCACertificatePath, prefix+"_tls_ca_certificate_path", "", "Path to CockroachDB CA certificate for "+prefix)
-	flag.StringVar(&c.UserName, prefix+"_user_name", prefix, "CockroachDB user name for "+prefix)
-	flag.StringVar(&c.DatabaseName, prefix+"_database_name", prefix, "CockroachDB database name for "+prefix)
-	flag.BoolVar(&c.InMemory, prefix+"_eat_my_data", false, "Use in-memory CockroachDB for "+prefix+". Warning: Data will be lost at process shutdown!")
-}
-
-// startInMemory starts an in-memory cockroachdb server as a subprocess, and
-// returns a DSN that connects to the newly created database.
-func (c *CockroachConfig) startInMemory(scheme string) string {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	klog.Warningf("STARTING IN-MEMORY COCKROACHDB FOR TESTS")
-	klog.Warningf("ALL DATA WILL BE LOST AFTER SERVER SHUTDOWN!")
-
-	if c.inMemoryInstance == nil {
-		opts := []testserver.TestServerOpt{
-			testserver.SecureOpt(),
-		}
-		if path, err := runfiles.Rlocation("cockroach/cockroach"); err == nil {
-			opts = append(opts, testserver.CockroachBinaryPathOpt(path))
-		} else {
-			if os.Getenv("TEST_TMPDIR") != "" {
-				klog.Exitf("In test which requires in-memory cockroachdb, but @cockroach//:cockroach missing as a dependency. Failing.")
-			}
-			klog.Warningf("CockroachDB in-memory database requested, but not available as a build dependency. Trying to download it...")
-		}
-
-		inst, err := testserver.NewTestServer(opts...)
-		if err != nil {
-			klog.Exitf("Failed to create crdb test server: %v", err)
-		}
-		c.inMemoryInstance = inst
-	}
-
-	u := *c.inMemoryInstance.PGURL()
-	u.Scheme = scheme
-	return u.String()
-}
-
-// buildDSN returns a DSN to the configured database connection with a given DSN
-// scheme. The scheme will usually be 'postgres' or 'cockroach', depending on
-// whether it's used for lib/pq or for golang-migrate.
-func (c *CockroachConfig) buildDSN(scheme string) string {
-	if c.InMemory {
-		return c.startInMemory(scheme)
-	}
-
-	query := make(url.Values)
-	query.Set("sslmode", "verify-full")
-	query.Set("sslcert", c.TLSCertificatePath)
-	query.Set("sslkey", c.TLSKeyPath)
-	query.Set("sslrootcert", c.TLSCACertificatePath)
-	u := url.URL{
-		Scheme:   scheme,
-		User:     url.User(c.UserName),
-		Host:     c.EndpointHost,
-		Path:     c.DatabaseName,
-		RawQuery: query.Encode(),
-	}
-	return u.String()
-}
-
-// Connect returns a working *sql.DB handle to the database described by this
-// CockroachConfig.
-func (c *CockroachConfig) Connect() (*sql.DB, error) {
-	dsn := c.buildDSN("postgres")
-	klog.Infof("Connecting to %s...", dsn)
-	return sql.Open("postgres", c.buildDSN("postgres"))
-}
-
-// MigrateUp performs all possible migrations upwards for the database described
-// by this CockroachConfig.
-func (c *CockroachConfig) MigrateUp() error {
-	dsn := c.buildDSN("cockroachdb")
-	klog.Infof("Running migrations up...")
-	m, err := migrate.NewWithSourceInstance("iofs", c.Migrations, dsn)
-	if err != nil {
-		return err
-	}
-	err = m.Up()
-	switch {
-	case err == nil:
-		return nil
-	case errors.Is(err, migrate.ErrNoChange):
-		return nil
-	default:
-		return err
-	}
-}
-
-func (c *CockroachConfig) MigrateUpToIncluding(ver uint) error {
-	dsn := c.buildDSN("cockroachdb")
-	klog.Infof("Running migrations up to %d...", ver)
-	m, err := migrate.NewWithSourceInstance("iofs", c.Migrations, dsn)
-	if err != nil {
-		return err
-	}
-
-	return m.Migrate(ver)
-}
-
-// MigrateDownDangerDanger removes all data from the database by performing a
-// full migration down.
-//
-// Let me reiterate: this function, by design, DESTROYS YOUR DATA.
-//
-// Obviously, this is a dangerous method. Thus, to prevent accidental nuking of
-// production data, we currently only allow this to be performed on InMemory
-// databases.
-func (c *CockroachConfig) MigrateDownDangerDanger() error {
-	if !c.InMemory {
-		return fmt.Errorf("refusing to migrate down a non-in-memory database")
-	}
-	// Sneaky extra check to make sure the caller didn't just set InMemory after
-	// connecting to an external database. We really need to be safe here.
-	if c.inMemoryInstance == nil {
-		return fmt.Errorf("no really, this cannot be run on non-in-memory databases")
-	}
-	dsn := c.buildDSN("cockroachdb")
-	klog.Infof("Running migrations down...")
-	m, err := migrate.NewWithSourceInstance("iofs", c.Migrations, dsn)
-	if err != nil {
-		return err
-	}
-	// Final sneaky check, make sure the remote schema version is our maximum locally
-	// supported version.
-	v, _, err := m.Version()
-	if err != nil {
-		return fmt.Errorf("could not retrieve remote version: %w", err)
-	}
-	if v2, err := c.Migrations.Next(v); !os.IsNotExist(err) {
-		return fmt.Errorf("remote running version %d, but we know %d which is newer", v, v2)
-	}
-	return m.Down()
-}
diff --git a/cloud/lib/component/devcerts.go b/cloud/lib/component/devcerts.go
deleted file mode 100644
index 837ad98..0000000
--- a/cloud/lib/component/devcerts.go
+++ /dev/null
@@ -1,191 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package component
-
-import (
-	"crypto/ed25519"
-	"crypto/rand"
-	"crypto/tls"
-	"crypto/x509"
-	"encoding/pem"
-	"fmt"
-	"math/big"
-	"os"
-	"time"
-
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/osbase/pki"
-)
-
-// GetDevCerts returns paths to this component's development certificate, key
-// and CA, or panics if unavailable.
-func (c *ComponentConfig) GetDevCerts() (certPath, keyPath, caPath string) {
-	klog.Infof("Using developer certificates at %s", c.DevCertsPath)
-
-	caPath = c.ensureDevCA()
-	certPath, keyPath = c.ensureDevComponent()
-	return
-}
-
-// ensureDevComponent ensures that a development certificate/key exists for this
-// component and returns paths to them. This data is either read from disk if it
-// already exists, or is generated when this function is called. If any problem
-// occurs, the code panics.
-func (c *ComponentConfig) ensureDevComponent() (certPath, keyPath string) {
-	caKeyPath := c.DevCertsPath + "/ca.key"
-	caCertPath := c.DevCertsPath + "/ca.cert"
-
-	// Load CA. By convention, we are always called after ensureDevCA.
-	ca, err := tls.LoadX509KeyPair(caCertPath, caKeyPath)
-	if err != nil {
-		klog.Exitf("Could not load Dev CA: %v", err)
-	}
-	caCert, err := x509.ParseCertificate(ca.Certificate[0])
-	if err != nil {
-		klog.Exitf("Could not parse Dev CA: %v", err)
-	}
-
-	// Check if we have keys already.
-	keyPath = c.DevCertsPath + fmt.Sprintf("/%s.key", c.ComponentName)
-	certPath = c.DevCertsPath + fmt.Sprintf("/%s.crt", c.ComponentName)
-	noKey := false
-	if _, err := os.Stat(keyPath); os.IsNotExist(err) {
-		noKey = true
-	}
-	noCert := false
-	if _, err := os.Stat(certPath); os.IsNotExist(err) {
-		noCert = true
-	}
-
-	if noKey || noCert {
-		klog.Infof("Generating developer %s certificate...", c.ComponentName)
-	} else {
-		return
-	}
-
-	// Generate key/certificate.
-	cert := pki.Server([]string{
-		fmt.Sprintf("%s.local", c.ComponentName),
-	}, nil)
-
-	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 127)
-	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
-	if err != nil {
-		klog.Exitf("Failed to generate %s serial number: %v", c.ComponentName, err)
-	}
-	cert.ExtKeyUsage = append(cert.ExtKeyUsage, x509.ExtKeyUsageClientAuth)
-	cert.SerialNumber = serialNumber
-	cert.NotBefore = time.Now()
-	cert.NotAfter = pki.UnknownNotAfter
-	cert.BasicConstraintsValid = true
-
-	pub, priv, err := ed25519.GenerateKey(rand.Reader)
-	if err != nil {
-		klog.Exitf("Failed to generate %s key: %v", c.ComponentName, err)
-	}
-	certBytes, err := x509.CreateCertificate(rand.Reader, &cert, caCert, pub, ca.PrivateKey)
-	if err != nil {
-		klog.Exitf("Failed to generate %s certificate: %v", c.ComponentName, err)
-	}
-
-	// And marshal them to disk.
-	privPKCS, err := x509.MarshalPKCS8PrivateKey(priv)
-	if err != nil {
-		klog.Exitf("Failed to marshal %s private key: %v", c.ComponentName, err)
-	}
-	err = os.WriteFile(keyPath, pem.EncodeToMemory(&pem.Block{
-		Type:  "PRIVATE KEY",
-		Bytes: privPKCS,
-	}), 0600)
-	if err != nil {
-		klog.Exitf("Failed to write %s private key: %v", c.ComponentName, err)
-	}
-	err = os.WriteFile(certPath, pem.EncodeToMemory(&pem.Block{
-		Type:  "CERTIFICATE",
-		Bytes: certBytes,
-	}), 0644)
-	if err != nil {
-		klog.Exitf("Failed to write %s certificate: %v", c.ComponentName, err)
-	}
-
-	return
-}
-
-// ensureDevCA ensures that a development CA certificate/key exists and returns
-// paths to them. This data is either read from disk if it already exists, or is
-// generated when this function is called. If any problem occurs, the code
-// panics.
-func (c *ComponentConfig) ensureDevCA() (caCertPath string) {
-	caKeyPath := c.DevCertsPath + "/ca.key"
-	caCertPath = c.DevCertsPath + "/ca.cert"
-
-	if err := os.MkdirAll(c.DevCertsPath, 0700); err != nil {
-		klog.Exitf("Failed to make developer certificate directory: %v", err)
-	}
-
-	// Check if we already have a key/certificate.
-	noKey := false
-	if _, err := os.Stat(caKeyPath); os.IsNotExist(err) {
-		noKey = true
-	}
-	noCert := false
-	if _, err := os.Stat(caCertPath); os.IsNotExist(err) {
-		noCert = true
-	}
-
-	if noKey || noCert {
-		klog.Infof("Generating developer CA certificate...")
-	} else {
-		return
-	}
-	hostname, err := os.Hostname()
-	if err != nil {
-		hostname = "unknown"
-	}
-
-	// No key/certificate, generate them.
-	ca := pki.CA(fmt.Sprintf("monogon dev certs CA (%s)", hostname))
-
-	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 127)
-	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
-	if err != nil {
-		klog.Exitf("Failed to generate CA serial number: %v", err)
-	}
-	ca.SerialNumber = serialNumber
-	ca.NotBefore = time.Now()
-	ca.NotAfter = pki.UnknownNotAfter
-	ca.BasicConstraintsValid = true
-
-	caPub, caPriv, err := ed25519.GenerateKey(rand.Reader)
-	if err != nil {
-		klog.Exitf("Failed to generate CA key: %v", err)
-	}
-	caBytes, err := x509.CreateCertificate(rand.Reader, &ca, &ca, caPub, caPriv)
-	if err != nil {
-		klog.Exitf("Failed to generate CA certificate: %v", err)
-	}
-
-	// And marshal them to disk.
-	caPrivPKCS, err := x509.MarshalPKCS8PrivateKey(caPriv)
-	if err != nil {
-		klog.Exitf("Failed to marshal %s private key: %v", c.ComponentName, err)
-	}
-	err = os.WriteFile(caKeyPath, pem.EncodeToMemory(&pem.Block{
-		Type:  "PRIVATE KEY",
-		Bytes: caPrivPKCS,
-	}), 0600)
-	if err != nil {
-		klog.Exitf("Failed to write CA private key: %v", err)
-	}
-	err = os.WriteFile(caCertPath, pem.EncodeToMemory(&pem.Block{
-		Type:  "CERTIFICATE",
-		Bytes: caBytes,
-	}), 0644)
-	if err != nil {
-		klog.Exitf("Failed to write CA certificate: %v", err)
-	}
-
-	return
-}
diff --git a/cloud/lib/sinbin/BUILD.bazel b/cloud/lib/sinbin/BUILD.bazel
deleted file mode 100644
index df9203f..0000000
--- a/cloud/lib/sinbin/BUILD.bazel
+++ /dev/null
@@ -1,14 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-
-go_library(
-    name = "sinbin",
-    srcs = ["sinbin.go"],
-    importpath = "source.monogon.dev/cloud/lib/sinbin",
-    visibility = ["//visibility:public"],
-)
-
-go_test(
-    name = "sinbin_test",
-    srcs = ["sinbin_test.go"],
-    embed = [":sinbin"],
-)
diff --git a/cloud/lib/sinbin/sinbin.go b/cloud/lib/sinbin/sinbin.go
deleted file mode 100644
index b1c905b..0000000
--- a/cloud/lib/sinbin/sinbin.go
+++ /dev/null
@@ -1,93 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-// Package sinbin implements a sinbin for naughty processed elements that we wish
-// to time out for a while. This is kept in memory, and effectively implements a
-// simplified version of the Circuit Breaker pattern.
-//
-// “sin bin”, noun, informal: (in sport) a box or bench to which offending
-// players can be sent for a period as a penalty during a game, especially in ice
-// hockey.
-package sinbin
-
-import (
-	"sync"
-	"time"
-)
-
-type entry struct {
-	until time.Time
-}
-
-// A Sinbin contains a set of entries T which are added with a deadline, and will
-// be automatically collected when that deadline expires.
-//
-// The zero value of a Sinbin is ready to use, and can be called from multiple
-// goroutines.
-type Sinbin[T comparable] struct {
-	mu    sync.RWMutex
-	bench map[T]*entry
-
-	lastSweep time.Time
-}
-
-func (s *Sinbin[T]) initializeUnlocked() {
-	if s.bench == nil {
-		s.bench = make(map[T]*entry)
-	}
-}
-
-func (s *Sinbin[T]) sweepUnlocked() {
-	if s.lastSweep.Add(time.Minute).After(time.Now()) {
-		return
-	}
-	now := time.Now()
-	for k, e := range s.bench {
-		if now.After(e.until) {
-			delete(s.bench, k)
-		}
-	}
-	s.lastSweep = now
-}
-
-// Add an element 't' to a Sinbin with a given deadline. From now until that
-// deadline Penalized(t) will return true.
-func (s *Sinbin[T]) Add(t T, until time.Time) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	s.initializeUnlocked()
-	s.sweepUnlocked()
-
-	existing, ok := s.bench[t]
-	if ok {
-		if until.After(existing.until) {
-			existing.until = until
-		}
-		return
-	}
-	s.bench[t] = &entry{
-		until: until,
-	}
-}
-
-// Penalized returns whether the given element is currently sitting on the
-// time-out bench after having been Added previously.
-func (s *Sinbin[T]) Penalized(t T) bool {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-
-	if s.bench == nil {
-		return false
-	}
-
-	existing, ok := s.bench[t]
-	if !ok {
-		return false
-	}
-	if time.Now().After(existing.until) {
-		delete(s.bench, t)
-		return false
-	}
-	return true
-}
diff --git a/cloud/lib/sinbin/sinbin_test.go b/cloud/lib/sinbin/sinbin_test.go
deleted file mode 100644
index 715ac94..0000000
--- a/cloud/lib/sinbin/sinbin_test.go
+++ /dev/null
@@ -1,37 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package sinbin
-
-import (
-	"testing"
-	"time"
-)
-
-// TestSinbinBasics performs some basic tests on the Sinbin.
-func TestSinbinBasics(t *testing.T) {
-	var s Sinbin[string]
-
-	if s.Penalized("foo") {
-		t.Errorf("'foo' should not be penalized as it hasn't yet been added")
-	}
-	s.Add("foo", time.Now().Add(-1*time.Second))
-	if s.Penalized("foo") {
-		t.Errorf("'foo' should not be penalized as it has been added with an expired time")
-	}
-	s.Add("bar", time.Now().Add(time.Hour))
-	if !s.Penalized("bar") {
-		t.Errorf("'bar' should be penalized as it has been added with an hour long penalty")
-	}
-
-	// Force sweep.
-	s.lastSweep = time.Now().Add(-1 * time.Hour)
-	s.sweepUnlocked()
-
-	if len(s.bench) != 1 {
-		t.Errorf("there should only be one element on the bench")
-	}
-	if _, ok := s.bench["bar"]; !ok {
-		t.Errorf("the bench should contain 'bar'")
-	}
-}
diff --git a/cloud/shepherd/BUILD.bazel b/cloud/shepherd/BUILD.bazel
deleted file mode 100644
index 512ebed..0000000
--- a/cloud/shepherd/BUILD.bazel
+++ /dev/null
@@ -1,12 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-
-go_library(
-    name = "shepherd",
-    srcs = ["shepherd.go"],
-    importpath = "source.monogon.dev/cloud/shepherd",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//cloud/bmaas/bmdb",
-        "//cloud/bmaas/bmdb/model",
-    ],
-)
diff --git a/cloud/shepherd/manager/BUILD.bazel b/cloud/shepherd/manager/BUILD.bazel
deleted file mode 100644
index 92a2ffe..0000000
--- a/cloud/shepherd/manager/BUILD.bazel
+++ /dev/null
@@ -1,54 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-
-go_library(
-    name = "manager",
-    srcs = [
-        "control_loop.go",
-        "fake_ssh_client.go",
-        "initializer.go",
-        "manager.go",
-        "provisioner.go",
-        "recoverer.go",
-        "ssh_key_signer.go",
-    ],
-    importpath = "source.monogon.dev/cloud/shepherd/manager",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//cloud/agent/api",
-        "//cloud/bmaas/bmdb",
-        "//cloud/bmaas/bmdb/metrics",
-        "//cloud/bmaas/bmdb/model",
-        "//cloud/shepherd",
-        "//go/mflags",
-        "//osbase/net/sshtakeover",
-        "@com_github_google_uuid//:uuid",
-        "@io_k8s_klog_v2//:klog",
-        "@org_golang_google_protobuf//proto",
-        "@org_golang_x_crypto//ssh",
-        "@org_golang_x_sync//errgroup",
-        "@org_golang_x_time//rate",
-    ],
-)
-
-go_test(
-    name = "manager_test",
-    srcs = [
-        "initializer_test.go",
-        "provider_test.go",
-        "provisioner_test.go",
-    ],
-    data = [
-        "@cockroach",
-    ],
-    embed = [":manager"],
-    deps = [
-        "//cloud/bmaas/bmdb",
-        "//cloud/bmaas/bmdb/model",
-        "//cloud/lib/component",
-        "//cloud/shepherd",
-        "@com_github_google_uuid//:uuid",
-        "@io_k8s_klog_v2//:klog",
-        "@org_golang_x_crypto//ssh",
-        "@org_golang_x_time//rate",
-    ],
-)
diff --git a/cloud/shepherd/manager/README.md b/cloud/shepherd/manager/README.md
deleted file mode 100644
index d5a17c3..0000000
--- a/cloud/shepherd/manager/README.md
+++ /dev/null
@@ -1,54 +0,0 @@
-Equinix Shepherd
-===
-
-Manages Equinix machines in sync with BMDB contents. Made up of two components:
-
-Provisioner
----
-
-Brings up machines from hardware reservations and populates BMDB with new Provided machines.
-
-Initializer
----
-
-Starts the Agent over SSH (wherever necessary per the BMDB) and reports success into the BMDB.
-
-
-Running
-===
-
-Unit Tests
----
-
-The Shepherd has some basic smoke tests which run against a Fakequinix.
-
-Manual Testing
----
-
-If you have Equinix credentials, you can run:
-
-```
-$ bazel build //cloud/shepherd/provider/equinix
-$ bazel build //cloud/shepherd/manager/test_agent
-$ bazel-bin/cloud/shepherd/provider/equinix/equinix_/equinix \
-    -bmdb_eat_my_data \
-    -equinix_project_id FIXME \
-    -equinix_api_username FIXME \
-    -equinix_api_key FIXME \
-    -agent_executable_path bazel-bin/cloud/shepherd/manager/test_agent/test_agent_/test_agent \
-    -agent_endpoint example.com \
-    -equinix_ssh_key_label $USER-FIXME \
-    -equinix_device_prefix $USER-FIXME- \
-    -provisioner_assimilate -provisioner_max_machines 10
-```
-
-Replace $USER-FIXME with `<your username>-test` or some other unique name/prefix.
-
-This will start a single instance of the provisioner accompanied by a single instance of the initializer.
-
-A persistent SSH key will be created in your current working directory.
-
-Prod Deployment
----
-
-TODO(q3k): split server binary into separate provisioner/initializer for initializer scalability, as that's the main bottleneck.
\ No newline at end of file
diff --git a/cloud/shepherd/manager/control_loop.go b/cloud/shepherd/manager/control_loop.go
deleted file mode 100644
index 138b6cb..0000000
--- a/cloud/shepherd/manager/control_loop.go
+++ /dev/null
@@ -1,224 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package manager
-
-import (
-	"context"
-	"errors"
-	"flag"
-	"fmt"
-	"time"
-
-	"github.com/google/uuid"
-	"golang.org/x/sync/errgroup"
-	"golang.org/x/time/rate"
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/metrics"
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/go/mflags"
-)
-
-// task describes a single server currently being processed by a control loop.
-type task struct {
-	// machine is the machine data (including provider and provider ID) retrieved
-	// from the BMDB.
-	machine *model.MachineProvided
-	// work is a machine lock facilitated by BMDB that prevents machines from
-	// being processed by multiple workers at the same time.
-	work *bmdb.Work
-	// backoff is configured from processInfo.defaultBackoff but can be overridden by
-	// processMachine to set a different backoff policy for specific failure modes.
-	backoff bmdb.Backoff
-}
-
-// controlLoop is implemented by any component which should act as a BMDB-based
-// control loop. Implementing these methods allows the given component to be
-// started using RunControlLoop.
-type controlLoop interface {
-	getProcessInfo() processInfo
-
-	// getMachines must return the list of machines ready to be processed by the
-	// control loop for a given control loop implementation.
-	getMachines(ctx context.Context, q *model.Queries, limit int32) ([]model.MachineProvided, error)
-	// processMachine will be called within the scope of an active task/BMDB work by
-	// the control loop logic.
-	processMachine(ctx context.Context, t *task) error
-
-	// getControlLoopConfig is implemented by ControlLoopConfig which should be
-	// embedded by the control loop component. If not embedded, this method will have
-	// to be implemented, too.
-	getControlLoopConfig() *ControlLoopConfig
-}
-
-type processInfo struct {
-	process        model.Process
-	processor      metrics.Processor
-	defaultBackoff bmdb.Backoff
-}
-
-// ControlLoopConfig should be embedded the every component which acts as a
-// control loop. RegisterFlags should be called by the component whenever it is
-// registering its own flags. Check should be called whenever the component is
-// instantiated, after RegisterFlags has been called.
-type ControlLoopConfig struct {
-	// DBQueryLimiter limits the rate at which BMDB is queried for servers ready
-	// for BMaaS agent initialization. Must be set.
-	DBQueryLimiter *rate.Limiter
-
-	// Parallelism is how many instances of the Initializer will be allowed to run in
-	// parallel against the BMDB. This speeds up the process of starting/restarting
-	// agents significantly, as one initializer instance can handle at most one agent
-	// (re)starting process.
-	//
-	// If not set (ie. 0), default to 1. A good starting value for production
-	// deployments is 10 or so.
-	Parallelism int
-}
-
-func (c *ControlLoopConfig) getControlLoopConfig() *ControlLoopConfig {
-	return c
-}
-
-// RegisterFlags should be called on this configuration whenever the embeddeding
-// component/configuration is registering its own flags. The prefix should be the
-// name of the component.
-func (c *ControlLoopConfig) RegisterFlags(prefix string) {
-	mflags.Limiter(&c.DBQueryLimiter, prefix+"_db_query_rate", "250ms,8", "Rate limiting for BMDB queries")
-	flag.IntVar(&c.Parallelism, prefix+"_loop_parallelism", 1, "How many initializer instances to run in parallel, ie. how many agents to attempt to (re)start at once")
-}
-
-// Check should be called after RegisterFlags but before the control loop is ran.
-// If an error is returned, the control loop cannot start.
-func (c *ControlLoopConfig) Check() error {
-	if c.DBQueryLimiter == nil {
-		return fmt.Errorf("DBQueryLimiter must be configured")
-	}
-	if c.Parallelism == 0 {
-		c.Parallelism = 1
-	}
-	return nil
-}
-
-// RunControlLoop runs the given controlLoop implementation against the BMDB. The
-// loop will be run with the parallelism and rate configured by the
-// ControlLoopConfig embedded or otherwise returned by the controlLoop.
-func RunControlLoop(ctx context.Context, conn *bmdb.Connection, loop controlLoop) error {
-	clr := &controlLoopRunner{
-		loop:   loop,
-		config: loop.getControlLoopConfig(),
-	}
-	return clr.run(ctx, conn)
-}
-
-// controlLoopRunner is a configured control loop with an underlying control loop
-// implementation.
-type controlLoopRunner struct {
-	config *ControlLoopConfig
-	loop   controlLoop
-}
-
-// run the control loops(s) (depending on opts.Parallelism) blocking the current
-// goroutine until the given context expires and all provisioners quit.
-func (r *controlLoopRunner) run(ctx context.Context, conn *bmdb.Connection) error {
-	pinfo := r.loop.getProcessInfo()
-
-	var eg errgroup.Group
-	for j := 0; j < r.config.Parallelism; j += 1 {
-		eg.Go(func() error {
-			return r.runOne(ctx, conn, &pinfo)
-		})
-	}
-	return eg.Wait()
-}
-
-// run the control loop blocking the current goroutine until the given context
-// expires.
-func (r *controlLoopRunner) runOne(ctx context.Context, conn *bmdb.Connection, pinfo *processInfo) error {
-	var err error
-
-	// Maintain a BMDB session as long as possible.
-	var sess *bmdb.Session
-	for {
-		if sess == nil {
-			sess, err = conn.StartSession(ctx, bmdb.SessionOption{Processor: pinfo.processor})
-			if err != nil {
-				return fmt.Errorf("could not start BMDB session: %w", err)
-			}
-		}
-		// Inside that session, run the main logic.
-		err := r.runInSession(ctx, sess, pinfo)
-
-		switch {
-		case err == nil:
-		case errors.Is(err, ctx.Err()):
-			return err
-		case errors.Is(err, bmdb.ErrSessionExpired):
-			klog.Errorf("Session expired, restarting...")
-			sess = nil
-			time.Sleep(time.Second)
-		default:
-			klog.Errorf("Processing failed: %v", err)
-			// TODO(q3k): close session
-			time.Sleep(time.Second)
-		}
-	}
-}
-
-// runInSession executes one iteration of the control loop within a BMDB session.
-// This control loop attempts to start or re-start the agent on any machines that
-// need this per the BMDB.
-func (r *controlLoopRunner) runInSession(ctx context.Context, sess *bmdb.Session, pinfo *processInfo) error {
-	t, err := r.source(ctx, sess, pinfo)
-	if err != nil {
-		return fmt.Errorf("could not source machine: %w", err)
-	}
-	if t == nil {
-		return nil
-	}
-	defer t.work.Cancel(ctx)
-
-	if err := r.loop.processMachine(ctx, t); err != nil {
-		klog.Errorf("Failed to process machine %s: %v", t.machine.MachineID, err)
-		err = t.work.Fail(ctx, &t.backoff, fmt.Sprintf("failed to process: %v", err))
-		return err
-	}
-	return nil
-}
-
-// source supplies returns a BMDB-locked server ready for processing by the
-// control loop, locked by a work item. If both task and error are nil, then
-// there are no machines needed to be initialized. The returned work item in task
-// _must_ be canceled or finished by the caller.
-func (r *controlLoopRunner) source(ctx context.Context, sess *bmdb.Session, pinfo *processInfo) (*task, error) {
-	r.config.DBQueryLimiter.Wait(ctx)
-
-	var machine *model.MachineProvided
-	work, err := sess.Work(ctx, pinfo.process, func(q *model.Queries) ([]uuid.UUID, error) {
-		machines, err := r.loop.getMachines(ctx, q, 1)
-		if err != nil {
-			return nil, err
-		}
-		if len(machines) < 1 {
-			return nil, bmdb.ErrNothingToDo
-		}
-		machine = &machines[0]
-		return []uuid.UUID{machines[0].MachineID}, nil
-	})
-
-	if errors.Is(err, bmdb.ErrNothingToDo) {
-		return nil, nil
-	}
-
-	if err != nil {
-		return nil, fmt.Errorf("while querying BMDB agent candidates: %w", err)
-	}
-
-	return &task{
-		machine: machine,
-		work:    work,
-		backoff: pinfo.defaultBackoff,
-	}, nil
-}
diff --git a/cloud/shepherd/manager/fake_ssh_client.go b/cloud/shepherd/manager/fake_ssh_client.go
deleted file mode 100644
index 97de575..0000000
--- a/cloud/shepherd/manager/fake_ssh_client.go
+++ /dev/null
@@ -1,60 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package manager
-
-import (
-	"context"
-	"crypto/ed25519"
-	"crypto/rand"
-	"fmt"
-	"io"
-
-	"golang.org/x/crypto/ssh"
-	"google.golang.org/protobuf/proto"
-
-	apb "source.monogon.dev/cloud/agent/api"
-)
-
-type fakeSSHClient struct{}
-
-// FakeSSHDial pretends to start an agent, but in reality just responds with
-// what an agent would respond on every execution attempt.
-func FakeSSHDial(ctx context.Context, address string, config *ssh.ClientConfig) (SSHClient, error) {
-	return &fakeSSHClient{}, nil
-}
-
-func (f *fakeSSHClient) Execute(ctx context.Context, command string, stdin []byte) (stdout []byte, stderr []byte, err error) {
-	var aim apb.TakeoverInit
-	if err := proto.Unmarshal(stdin, &aim); err != nil {
-		return nil, nil, fmt.Errorf("while unmarshaling TakeoverInit message: %w", err)
-	}
-
-	// Agent should send back apb.TakeoverResponse on its standard output.
-	pub, _, err := ed25519.GenerateKey(rand.Reader)
-	if err != nil {
-		return nil, nil, fmt.Errorf("while generating agent public key: %w", err)
-	}
-	arsp := apb.TakeoverResponse{
-		Result: &apb.TakeoverResponse_Success{Success: &apb.TakeoverSuccess{
-			InitMessage: &aim,
-			Key:         pub,
-		}},
-	}
-	arspb, err := proto.Marshal(&arsp)
-	if err != nil {
-		return nil, nil, fmt.Errorf("while marshaling TakeoverResponse message: %w", err)
-	}
-	return arspb, nil, nil
-}
-
-func (f *fakeSSHClient) UploadExecutable(ctx context.Context, targetPath string, _ io.Reader) error {
-	if targetPath != "/fake/path" {
-		return fmt.Errorf("unexpected target path in test")
-	}
-	return nil
-}
-
-func (f *fakeSSHClient) Close() error {
-	return nil
-}
diff --git a/cloud/shepherd/manager/initializer.go b/cloud/shepherd/manager/initializer.go
deleted file mode 100644
index d9e3579..0000000
--- a/cloud/shepherd/manager/initializer.go
+++ /dev/null
@@ -1,288 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package manager
-
-import (
-	"bytes"
-	"context"
-	"crypto/ed25519"
-	"crypto/x509"
-	"encoding/hex"
-	"encoding/pem"
-	"flag"
-	"fmt"
-	"io"
-	"net"
-	"os"
-	"strings"
-	"time"
-
-	"github.com/google/uuid"
-	"golang.org/x/crypto/ssh"
-	"google.golang.org/protobuf/proto"
-	"k8s.io/klog/v2"
-
-	apb "source.monogon.dev/cloud/agent/api"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/metrics"
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/cloud/shepherd"
-	"source.monogon.dev/osbase/net/sshtakeover"
-)
-
-// InitializerConfig configures how the Initializer will deploy Agents on
-// machines. In CLI scenarios, this should be populated from flags via
-// RegisterFlags.
-type InitializerConfig struct {
-	ControlLoopConfig
-
-	// Executable is the contents of the agent binary created and run
-	// at the provisioned servers. Must be set.
-	Executable []byte
-
-	// TargetPath is a filesystem destination path used while uploading the BMaaS
-	// agent executable to hosts as part of the initialization process. Must be set.
-	TargetPath string
-
-	// Endpoint is the address Agent will use to contact the BMaaS
-	// infrastructure. Must be set.
-	Endpoint string
-
-	// EndpointCACertificate is an optional DER-encoded (but not PEM-armored) X509
-	// certificate used to populate the trusted CA store of the agent. It should be
-	// set to the CA certificate of the endpoint if not using a system-trusted CA
-	// certificate.
-	EndpointCACertificate []byte
-
-	SSHConfig ssh.ClientConfig
-	// SSHExecTimeout is the amount of time set aside for executing the agent and
-	// getting its output once the SSH connection has been established. Upon timeout,
-	// the iteration would be declared as failure. Must be set.
-	SSHExecTimeout time.Duration
-
-	// DialSSH can be set in tests to override how ssh connections are started.
-	DialSSH func(ctx context.Context, address string, config *ssh.ClientConfig) (SSHClient, error)
-}
-
-type SSHClient interface {
-	Execute(ctx context.Context, command string, stdin []byte) (stdout []byte, stderr []byte, err error)
-	UploadExecutable(ctx context.Context, targetPath string, src io.Reader) error
-	Close() error
-}
-
-func (ic *InitializerConfig) RegisterFlags() {
-	ic.ControlLoopConfig.RegisterFlags("initializer")
-
-	flag.Func("agent_executable_path", "Local filesystem path of agent binary to be uploaded", func(val string) error {
-		if val == "" {
-			return nil
-		}
-		data, err := os.ReadFile(val)
-		if err != nil {
-			return fmt.Errorf("could not read: %w", err)
-		}
-		ic.Executable = data
-		return nil
-	})
-	flag.StringVar(&ic.TargetPath, "agent_target_path", "/root/agent", "Filesystem path where the agent will be uploaded to and ran from")
-	flag.StringVar(&ic.Endpoint, "agent_endpoint", "", "Address of BMDB Server to which the agent will attempt to connect")
-	flag.Func("agent_endpoint_ca_certificate_path", "Path to PEM X509 CA certificate that the agent endpoint is serving with. If not set, the agent will attempt to use system CA certificates to authenticate the endpoint.", func(val string) error {
-		if val == "" {
-			return nil
-		}
-		data, err := os.ReadFile(val)
-		if err != nil {
-			return fmt.Errorf("could not read: %w", err)
-		}
-		block, _ := pem.Decode(data)
-		if block.Type != "CERTIFICATE" {
-			return fmt.Errorf("not a certificate")
-		}
-		_, err = x509.ParseCertificate(block.Bytes)
-		if err != nil {
-			return fmt.Errorf("invalid certificate: %w", err)
-		}
-		ic.EndpointCACertificate = block.Bytes
-		return nil
-	})
-	flag.DurationVar(&ic.SSHConfig.Timeout, "agent_ssh_connect_timeout", 2*time.Second, "Timeout for connecting over SSH to a machine")
-	flag.DurationVar(&ic.SSHExecTimeout, "agent_ssh_exec_timeout", 60*time.Second, "Timeout for connecting over SSH to a machine")
-}
-
-func (ic *InitializerConfig) Check() error {
-	if err := ic.ControlLoopConfig.Check(); err != nil {
-		return err
-	}
-
-	if len(ic.Executable) == 0 {
-		return fmt.Errorf("agent executable not configured")
-	}
-	if ic.TargetPath == "" {
-		return fmt.Errorf("agent target path must be set")
-	}
-	if ic.Endpoint == "" {
-		return fmt.Errorf("agent endpoint must be set")
-	}
-	if ic.SSHConfig.Timeout == 0 {
-		return fmt.Errorf("agent SSH connection timeout must be set")
-	}
-	if ic.SSHExecTimeout == 0 {
-		return fmt.Errorf("agent SSH execution timeout must be set")
-	}
-
-	return nil
-}
-
-// The Initializer starts the agent on machines that aren't yet running it.
-type Initializer struct {
-	InitializerConfig
-
-	p shepherd.Provider
-}
-
-// NewInitializer creates an Initializer instance, checking the
-// InitializerConfig, SharedConfig and AgentConfig for errors.
-func NewInitializer(p shepherd.Provider, ic InitializerConfig) (*Initializer, error) {
-	if err := ic.Check(); err != nil {
-		return nil, err
-	}
-
-	return &Initializer{
-		InitializerConfig: ic,
-
-		p: p,
-	}, nil
-}
-
-func (i *Initializer) getProcessInfo() processInfo {
-	return processInfo{
-		process: model.ProcessShepherdAgentStart,
-		defaultBackoff: bmdb.Backoff{
-			Initial:  5 * time.Minute,
-			Maximum:  4 * time.Hour,
-			Exponent: 1.2,
-		},
-		processor: metrics.ProcessorShepherdInitializer,
-	}
-}
-
-func (i *Initializer) getMachines(ctx context.Context, q *model.Queries, limit int32) ([]model.MachineProvided, error) {
-	return q.GetMachinesForAgentStart(ctx, model.GetMachinesForAgentStartParams{
-		Limit:    limit,
-		Provider: i.p.Type(),
-	})
-}
-
-func (i *Initializer) processMachine(ctx context.Context, t *task) error {
-	machine, err := i.p.GetMachine(ctx, shepherd.ProviderID(t.machine.ProviderID))
-	if err != nil {
-		return fmt.Errorf("while fetching machine %q: %w", t.machine.ProviderID, err)
-	}
-
-	// Start the agent.
-	klog.Infof("Starting agent on machine (ID: %s, PID %s)", t.machine.MachineID, t.machine.ProviderID)
-	apk, err := i.startAgent(ctx, machine, t.machine.MachineID)
-	if err != nil {
-		return fmt.Errorf("while starting the agent: %w", err)
-	}
-
-	// Agent startup succeeded. Set the appropriate BMDB tag, and release the
-	// lock.
-	klog.Infof("Setting AgentStarted (ID: %s, PID: %s, Agent public key: %s).", t.machine.MachineID, t.machine.ProviderID, hex.EncodeToString(apk))
-	err = t.work.Finish(ctx, func(q *model.Queries) error {
-		return q.MachineSetAgentStarted(ctx, model.MachineSetAgentStartedParams{
-			MachineID:      t.machine.MachineID,
-			AgentStartedAt: time.Now(),
-			AgentPublicKey: apk,
-		})
-	})
-	if err != nil {
-		return fmt.Errorf("while setting AgentStarted tag: %w", err)
-	}
-	return nil
-}
-
-// startAgent runs the agent executable on the target machine m, returning the
-// agent's public key on success.
-func (i *Initializer) startAgent(ctx context.Context, m shepherd.Machine, mid uuid.UUID) ([]byte, error) {
-	// Provide a bound on execution time in case we get stuck after the SSH
-	// connection is established.
-	sctx, sctxC := context.WithTimeout(ctx, i.SSHExecTimeout)
-	defer sctxC()
-
-	// Use the machine's IP address
-	ni := m.Addr()
-	if !ni.IsValid() {
-		return nil, fmt.Errorf("machine (machine ID: %s) has no available addresses", mid)
-	}
-
-	addr := net.JoinHostPort(ni.String(), "22")
-	klog.V(1).Infof("Dialing machine (machine ID: %s, addr: %s).", mid, addr)
-
-	var conn SSHClient
-	var err error
-	if i.DialSSH != nil {
-		conn, err = i.DialSSH(sctx, addr, &i.SSHConfig)
-	} else {
-		conn, err = sshtakeover.Dial(sctx, addr, &i.SSHConfig)
-	}
-	if err != nil {
-		return nil, fmt.Errorf("while dialing the machine: %w", err)
-	}
-	defer conn.Close()
-
-	// Upload the agent executable.
-
-	klog.Infof("Uploading the agent executable (machine ID: %s, addr: %s).", mid, addr)
-	if err := conn.UploadExecutable(sctx, i.TargetPath, bytes.NewReader(i.Executable)); err != nil {
-		return nil, fmt.Errorf("while uploading agent executable: %w", err)
-	}
-	klog.V(1).Infof("Upload successful (machine ID: %s, addr: %s).", mid, addr)
-
-	// The initialization protobuf message will be sent to the agent on its
-	// standard input.
-	imsg := apb.TakeoverInit{
-		MachineId:     mid.String(),
-		BmaasEndpoint: i.Endpoint,
-		CaCertificate: i.EndpointCACertificate,
-	}
-	imsgb, err := proto.Marshal(&imsg)
-	if err != nil {
-		return nil, fmt.Errorf("while marshaling agent message: %w", err)
-	}
-
-	// Start the agent and wait for the agent's output to arrive.
-	klog.V(1).Infof("Starting the agent executable at path %q (machine ID: %s).", i.TargetPath, mid)
-	stdout, stderr, err := conn.Execute(ctx, i.TargetPath, imsgb)
-	stderrStr := strings.TrimSpace(string(stderr))
-	if stderrStr != "" {
-		klog.Warningf("Agent stderr: %q", stderrStr)
-	}
-	if err != nil {
-		return nil, fmt.Errorf("while starting the agent executable: %w", err)
-	}
-
-	var arsp apb.TakeoverResponse
-	if err := proto.Unmarshal(stdout, &arsp); err != nil {
-		return nil, fmt.Errorf("agent reply couldn't be unmarshaled: %w", err)
-	}
-	var successResp *apb.TakeoverSuccess
-	switch r := arsp.Result.(type) {
-	case *apb.TakeoverResponse_Error:
-		return nil, fmt.Errorf("agent returned error: %v", r.Error.Message)
-	case *apb.TakeoverResponse_Success:
-		successResp = r.Success
-	default:
-		return nil, fmt.Errorf("agent returned unknown result of type %T", arsp.Result)
-	}
-	if !proto.Equal(&imsg, successResp.InitMessage) {
-		return nil, fmt.Errorf("agent did not send back the init message")
-	}
-	if len(successResp.Key) != ed25519.PublicKeySize {
-		return nil, fmt.Errorf("agent key length mismatch")
-	}
-	klog.Infof("Started the agent (machine ID: %s, key: %s).", mid, hex.EncodeToString(successResp.Key))
-	return successResp.Key, nil
-}
diff --git a/cloud/shepherd/manager/initializer_test.go b/cloud/shepherd/manager/initializer_test.go
deleted file mode 100644
index 3b41044..0000000
--- a/cloud/shepherd/manager/initializer_test.go
+++ /dev/null
@@ -1,100 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package manager
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"golang.org/x/crypto/ssh"
-	"golang.org/x/time/rate"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/cloud/lib/component"
-)
-
-// TestInitializerSmokes makes sure the Initializer doesn't go up in flames on
-// the happy path.
-func TestInitializerSmokes(t *testing.T) {
-	provider := newDummyProvider(100)
-
-	ic := InitializerConfig{
-		ControlLoopConfig: ControlLoopConfig{
-			DBQueryLimiter: rate.NewLimiter(rate.Every(time.Second), 10),
-		},
-		Executable: []byte("beep boop i'm a real program"),
-		TargetPath: "/fake/path",
-		Endpoint:   "example.com:1234",
-		SSHConfig: ssh.ClientConfig{
-			Timeout: time.Second,
-		},
-		SSHExecTimeout: time.Second,
-		DialSSH:        provider.FakeSSHDial,
-	}
-
-	i, err := NewInitializer(provider, ic)
-	if err != nil {
-		t.Fatalf("Could not create Initializer: %v", err)
-	}
-
-	b := bmdb.BMDB{
-		Config: bmdb.Config{
-			Database: component.CockroachConfig{
-				InMemory: true,
-			},
-			ComponentName: "test",
-			RuntimeInfo:   "test",
-		},
-	}
-	conn, err := b.Open(true)
-	if err != nil {
-		t.Fatalf("Could not create in-memory BMDB: %v", err)
-	}
-
-	ctx, ctxC := context.WithCancel(context.Background())
-	t.Cleanup(ctxC)
-
-	go RunControlLoop(ctx, conn, i)
-
-	sess, err := conn.StartSession(ctx)
-	if err != nil {
-		t.Fatalf("Failed to create BMDB session for verifiaction: %v", err)
-	}
-
-	// Create 10 provided machines for testing.
-	if _, err := provider.createDummyMachines(ctx, sess, 10); err != nil {
-		t.Fatalf("Failed to create dummy machines: %v", err)
-	}
-
-	// Expect to find 0 machines needing start.
-	for {
-		time.Sleep(100 * time.Millisecond)
-
-		var machines []model.MachineProvided
-		err = sess.Transact(ctx, func(q *model.Queries) error {
-			var err error
-			machines, err = q.GetMachinesForAgentStart(ctx, model.GetMachinesForAgentStartParams{
-				Limit:    100,
-				Provider: provider.Type(),
-			})
-			return err
-		})
-		if err != nil {
-			t.Fatalf("Failed to run Transaction: %v", err)
-		}
-		if len(machines) == 0 {
-			break
-		}
-	}
-
-	provider.muMachines.RLock()
-	defer provider.muMachines.RUnlock()
-	for _, m := range provider.machines {
-		if !m.agentStarted {
-			t.Fatalf("Initializer didn't start agent on machine %q", m.id)
-		}
-	}
-}
diff --git a/cloud/shepherd/manager/manager.go b/cloud/shepherd/manager/manager.go
deleted file mode 100644
index ae8115e..0000000
--- a/cloud/shepherd/manager/manager.go
+++ /dev/null
@@ -1,21 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-// Package manager, itself a part of BMaaS project, provides implementation
-// governing Equinix bare metal server lifecycle according to conditions set by
-// Bare Metal Database (BMDB).
-//
-// The implementation will attempt to provide as many machines as possible and
-// register them with BMDB. This is limited by the count of Hardware
-// Reservations available in the Equinix Metal project used. The BMaaS agent
-// will then be started on these machines as soon as they become ready.
-//
-// The implementation is provided in the form of a library, to which interface is
-// exported through Provisioner and Initializer types, each taking servers
-// through a single stage of their lifecycle.
-//
-// See the included test code for usage examples.
-//
-// The terms "device" and "machine" are used interchangeably throughout this
-// package due to differences in Equinix Metal and BMDB nomenclature.
-package manager
diff --git a/cloud/shepherd/manager/provider_test.go b/cloud/shepherd/manager/provider_test.go
deleted file mode 100644
index 2dc3fa9..0000000
--- a/cloud/shepherd/manager/provider_test.go
+++ /dev/null
@@ -1,190 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package manager
-
-import (
-	"context"
-	"fmt"
-	"net/netip"
-	"sync"
-
-	"github.com/google/uuid"
-	"golang.org/x/crypto/ssh"
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/cloud/shepherd"
-)
-
-type dummyMachine struct {
-	id           shepherd.ProviderID
-	addr         netip.Addr
-	availability shepherd.Availability
-	agentStarted bool
-}
-
-func (dm *dummyMachine) Failed() bool {
-	return false
-}
-
-func (dm *dummyMachine) ID() shepherd.ProviderID {
-	return dm.id
-}
-
-func (dm *dummyMachine) Addr() netip.Addr {
-	return dm.addr
-}
-
-func (dm *dummyMachine) Availability() shepherd.Availability {
-	return dm.availability
-}
-
-type dummySSHClient struct {
-	SSHClient
-	m *dummyMachine
-}
-
-func (dsc *dummySSHClient) Execute(ctx context.Context, command string, stdin []byte) ([]byte, []byte, error) {
-	stdout, stderr, err := dsc.SSHClient.Execute(ctx, command, stdin)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	dsc.m.agentStarted = true
-	return stdout, stderr, nil
-}
-
-func (dp *dummyProvider) FakeSSHDial(ctx context.Context, address string, config *ssh.ClientConfig) (SSHClient, error) {
-	conn, err := FakeSSHDial(ctx, address, config)
-	if err != nil {
-		return nil, err
-	}
-
-	addrPort := netip.MustParseAddrPort(address)
-	uid, err := uuid.FromBytes(addrPort.Addr().AsSlice())
-	if err != nil {
-		return nil, err
-	}
-
-	dp.muMachines.RLock()
-	m := dp.machines[shepherd.ProviderID(uid.String())]
-	dp.muMachines.RUnlock()
-	if m == nil {
-		return nil, fmt.Errorf("failed finding machine in map")
-	}
-
-	return &dummySSHClient{conn, m}, nil
-}
-
-func newDummyProvider(cap int) *dummyProvider {
-	return &dummyProvider{
-		capacity: cap,
-		machines: make(map[shepherd.ProviderID]*dummyMachine),
-	}
-}
-
-type dummyProvider struct {
-	capacity   int
-	machines   map[shepherd.ProviderID]*dummyMachine
-	muMachines sync.RWMutex
-}
-
-func (dp *dummyProvider) createDummyMachines(ctx context.Context, session *bmdb.Session, count int) ([]shepherd.Machine, error) {
-	dp.muMachines.RLock()
-	if len(dp.machines)+count > dp.capacity {
-		dp.muMachines.RUnlock()
-		return nil, fmt.Errorf("no capacity left")
-	}
-	dp.muMachines.RUnlock()
-
-	var machines []shepherd.Machine
-	for i := 0; i < count; i++ {
-		uid := uuid.Must(uuid.NewRandom())
-		m, err := dp.CreateMachine(ctx, session, shepherd.CreateMachineRequest{
-			UnusedMachine: &dummyMachine{
-				id:           shepherd.ProviderID(uid.String()),
-				availability: shepherd.AvailabilityKnownUsed,
-				addr:         netip.AddrFrom16(uid),
-			},
-		})
-		if err != nil {
-			return nil, err
-		}
-		machines = append(machines, m)
-	}
-
-	return machines, nil
-}
-
-func (dp *dummyProvider) ListMachines(ctx context.Context) ([]shepherd.Machine, error) {
-	var machines []shepherd.Machine
-	dp.muMachines.RLock()
-	for _, m := range dp.machines {
-		machines = append(machines, m)
-	}
-	dp.muMachines.RUnlock()
-
-	unusedMachineCount := dp.capacity - len(machines)
-	for i := 0; i < unusedMachineCount; i++ {
-		uid := uuid.Must(uuid.NewRandom())
-		machines = append(machines, &dummyMachine{
-			id:           shepherd.ProviderID(uid.String()),
-			availability: shepherd.AvailabilityKnownUnused,
-			addr:         netip.AddrFrom16(uid),
-		})
-	}
-
-	return machines, nil
-}
-
-func (dp *dummyProvider) GetMachine(ctx context.Context, id shepherd.ProviderID) (shepherd.Machine, error) {
-	dp.muMachines.RLock()
-	defer dp.muMachines.RUnlock()
-	for _, m := range dp.machines {
-		if m.ID() == id {
-			return m, nil
-		}
-	}
-
-	return nil, shepherd.ErrMachineNotFound
-}
-
-func (dp *dummyProvider) CreateMachine(ctx context.Context, session *bmdb.Session, request shepherd.CreateMachineRequest) (shepherd.Machine, error) {
-	dm := request.UnusedMachine.(*dummyMachine)
-
-	err := session.Transact(ctx, func(q *model.Queries) error {
-		// Create a new machine record within BMDB.
-		m, err := q.NewMachine(ctx)
-		if err != nil {
-			return fmt.Errorf("while creating a new machine record in BMDB: %w", err)
-		}
-
-		p := model.MachineAddProvidedParams{
-			MachineID:  m.MachineID,
-			ProviderID: string(dm.id),
-			Provider:   dp.Type(),
-		}
-		klog.Infof("Setting \"provided\" tag (ID: %s, PID: %s, Provider: %s).", p.MachineID, p.ProviderID, p.Provider)
-		if err := q.MachineAddProvided(ctx, p); err != nil {
-			return fmt.Errorf("while tagging machine active: %w", err)
-		}
-		return nil
-	})
-
-	if err != nil {
-		return nil, err
-	}
-
-	dm.availability = shepherd.AvailabilityKnownUsed
-	dp.muMachines.Lock()
-	dp.machines[dm.id] = dm
-	dp.muMachines.Unlock()
-
-	return dm, nil
-}
-
-func (dp *dummyProvider) Type() model.Provider {
-	return model.ProviderNone
-}
diff --git a/cloud/shepherd/manager/provisioner.go b/cloud/shepherd/manager/provisioner.go
deleted file mode 100644
index e13c63e..0000000
--- a/cloud/shepherd/manager/provisioner.go
+++ /dev/null
@@ -1,424 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package manager
-
-import (
-	"context"
-	"errors"
-	"flag"
-	"fmt"
-	"net/netip"
-	"sort"
-	"time"
-
-	"github.com/google/uuid"
-	"golang.org/x/time/rate"
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/metrics"
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/cloud/shepherd"
-	"source.monogon.dev/go/mflags"
-)
-
-// Provisioner implements the server provisioning logic. Provisioning entails
-// bringing all available machines (subject to limits) into BMDB.
-type Provisioner struct {
-	ProvisionerConfig
-	p shepherd.Provider
-}
-
-// ProvisionerConfig configures the provisioning process.
-type ProvisionerConfig struct {
-	// MaxCount is the maximum count of managed servers. No new devices will be
-	// created after reaching the limit. No attempt will be made to reduce the
-	// server count.
-	MaxCount uint
-
-	// ReconcileLoopLimiter limits the rate of the main reconciliation loop
-	// iterating.
-	ReconcileLoopLimiter *rate.Limiter
-
-	// DeviceCreation limits the rate at which devices are created.
-	DeviceCreationLimiter *rate.Limiter
-
-	// ChunkSize is how many machines will try to be spawned in a
-	// single reconciliation loop. Higher numbers allow for faster initial
-	// provisioning, but lower numbers decrease potential raciness with other systems
-	// and make sure that other parts of the reconciliation logic are ran regularly.
-	//
-	// 20 is decent starting point.
-	ChunkSize uint
-}
-
-func (pc *ProvisionerConfig) RegisterFlags() {
-	flag.UintVar(&pc.MaxCount, "provisioner_max_machines", 50, "Limit of machines that the provisioner will attempt to pull into the BMDB. Zero for no limit.")
-	mflags.Limiter(&pc.ReconcileLoopLimiter, "provisioner_reconciler_rate", "1m,1", "Rate limiting for main provisioner reconciliation loop")
-	mflags.Limiter(&pc.DeviceCreationLimiter, "provisioner_device_creation_rate", "5s,1", "Rate limiting for machine creation")
-	flag.UintVar(&pc.ChunkSize, "provisioner_reservation_chunk_size", 20, "How many machines will the provisioner attempt to create in a single reconciliation loop iteration")
-}
-
-func (pc *ProvisionerConfig) check() error {
-	// If these are unset, it's probably because someone is using us as a library.
-	// Provide error messages useful to code users instead of flag names.
-	if pc.ReconcileLoopLimiter == nil {
-		return fmt.Errorf("ReconcileLoopLimiter must be set")
-	}
-	if pc.DeviceCreationLimiter == nil {
-		return fmt.Errorf("DeviceCreationLimiter must be set")
-	}
-	if pc.ChunkSize == 0 {
-		return fmt.Errorf("ChunkSize must be set")
-	}
-	return nil
-}
-
-// NewProvisioner creates a Provisioner instance, checking ProvisionerConfig and
-// providerConfig for errors.
-func NewProvisioner(p shepherd.Provider, pc ProvisionerConfig) (*Provisioner, error) {
-	if err := pc.check(); err != nil {
-		return nil, err
-	}
-
-	return &Provisioner{
-		ProvisionerConfig: pc,
-		p:                 p,
-	}, nil
-}
-
-// Run the provisioner blocking the current goroutine until the given context
-// expires.
-func (p *Provisioner) Run(ctx context.Context, conn *bmdb.Connection) error {
-
-	var sess *bmdb.Session
-	var err error
-	for {
-		if sess == nil {
-			sess, err = conn.StartSession(ctx, bmdb.SessionOption{Processor: metrics.ProcessorShepherdProvisioner})
-			if err != nil {
-				return fmt.Errorf("could not start BMDB session: %w", err)
-			}
-		}
-		err = p.runInSession(ctx, sess)
-
-		switch {
-		case err == nil:
-		case errors.Is(err, ctx.Err()):
-			return err
-		case errors.Is(err, bmdb.ErrSessionExpired):
-			klog.Errorf("Session expired, restarting...")
-			sess = nil
-			time.Sleep(time.Second)
-		default:
-			klog.Errorf("Processing failed: %v", err)
-			// TODO(q3k): close session
-			time.Sleep(time.Second)
-		}
-	}
-}
-
-type machineListing struct {
-	machines []shepherd.Machine
-	err      error
-}
-
-// runInSession executes one iteration of the provisioner's control loop within a
-// BMDB session. This control loop attempts to bring all capacity into machines in
-// the BMDB, subject to limits.
-func (p *Provisioner) runInSession(ctx context.Context, sess *bmdb.Session) error {
-	if err := p.ReconcileLoopLimiter.Wait(ctx); err != nil {
-		return err
-	}
-
-	providerC := make(chan *machineListing, 1)
-	bmdbC := make(chan *machineListing, 1)
-
-	klog.Infof("Getting provider and bmdb machines...")
-
-	// Make sub-context for two parallel operations, and so that we can cancel one
-	// immediately if the other fails.
-	subCtx, subCtxC := context.WithCancel(ctx)
-	defer subCtxC()
-
-	go func() {
-		machines, err := p.listInProvider(subCtx)
-		providerC <- &machineListing{
-			machines: machines,
-			err:      err,
-		}
-	}()
-	go func() {
-		machines, err := p.listInBMDB(subCtx, sess)
-		bmdbC <- &machineListing{
-			machines: machines,
-			err:      err,
-		}
-	}()
-	var inProvider, inBMDB *machineListing
-	for {
-		select {
-		case inProvider = <-providerC:
-			if err := inProvider.err; err != nil {
-				return fmt.Errorf("listing provider machines failed: %w", err)
-			}
-			klog.Infof("Got %d machines in provider.", len(inProvider.machines))
-		case inBMDB = <-bmdbC:
-			if err := inBMDB.err; err != nil {
-				return fmt.Errorf("listing BMDB machines failed: %w", err)
-			}
-			klog.Infof("Got %d machines in BMDB.", len(inBMDB.machines))
-		}
-		if inProvider != nil && inBMDB != nil {
-			break
-		}
-	}
-
-	subCtxC()
-	if err := p.reconcile(ctx, sess, inProvider.machines, inBMDB.machines); err != nil {
-		return fmt.Errorf("reconciliation failed: %w", err)
-	}
-	return nil
-}
-
-// listInProviders returns all machines that the provider thinks we should be
-// managing.
-func (p *Provisioner) listInProvider(ctx context.Context) ([]shepherd.Machine, error) {
-	machines, err := p.p.ListMachines(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("while fetching managed machines: %w", err)
-	}
-	sort.Slice(machines, func(i, j int) bool {
-		return machines[i].ID() < machines[j].ID()
-	})
-	return machines, nil
-}
-
-type providedMachine struct {
-	model.MachineProvided
-}
-
-func (p providedMachine) Failed() bool {
-	if !p.MachineProvided.ProviderStatus.Valid {
-		// If we don't have any ProviderStatus to check for, return false
-		// to trigger the validation inside the reconciler loop.
-		return false
-	}
-	switch p.MachineProvided.ProviderStatus.ProviderStatus {
-	case model.ProviderStatusProvisioningFailedPermanent:
-		return true
-	}
-	return false
-}
-
-func (p providedMachine) ID() shepherd.ProviderID {
-	return shepherd.ProviderID(p.ProviderID)
-}
-
-func (p providedMachine) Addr() netip.Addr {
-	if !p.ProviderIpAddress.Valid {
-		return netip.Addr{}
-	}
-
-	addr, err := netip.ParseAddr(p.ProviderIpAddress.String)
-	if err != nil {
-		return netip.Addr{}
-	}
-	return addr
-}
-
-func (p providedMachine) Availability() shepherd.Availability {
-	return shepherd.AvailabilityKnownUsed
-}
-
-// listInBMDB returns all the machines that the BMDB thinks we should be managing.
-func (p *Provisioner) listInBMDB(ctx context.Context, sess *bmdb.Session) ([]shepherd.Machine, error) {
-	var res []shepherd.Machine
-	err := sess.Transact(ctx, func(q *model.Queries) error {
-		machines, err := q.GetProvidedMachines(ctx, p.p.Type())
-		if err != nil {
-			return err
-		}
-		res = make([]shepherd.Machine, 0, len(machines))
-		for _, machine := range machines {
-			_, err := uuid.Parse(machine.ProviderID)
-			if err != nil {
-				klog.Errorf("BMDB machine %s has unparseable provider ID %q", machine.MachineID, machine.ProviderID)
-				continue
-			}
-
-			res = append(res, providedMachine{machine})
-		}
-		return nil
-	})
-	if err != nil {
-		return nil, err
-	}
-	sort.Slice(res, func(i, j int) bool {
-		return res[i].ID() < res[j].ID()
-	})
-	return res, nil
-}
-
-// resolvePossiblyUsed checks if the availability is set to possibly used and
-// resolves it to the correct one.
-func (p *Provisioner) resolvePossiblyUsed(machine shepherd.Machine, providedMachines map[shepherd.ProviderID]shepherd.Machine) shepherd.Availability {
-	state, id := machine.Availability(), machine.ID()
-
-	// Bail out if this isn't possibly used.
-	if state != shepherd.AvailabilityPossiblyUsed {
-		return state
-	}
-
-	// If a machine does not have a valid id, its always seen as unused.
-	if !id.IsValid() {
-		return shepherd.AvailabilityKnownUnused
-	}
-
-	// If the machine is not inside the bmdb, it's seen as unused.
-	if _, ok := providedMachines[id]; !ok {
-		return shepherd.AvailabilityKnownUnused
-	}
-
-	return shepherd.AvailabilityKnownUsed
-}
-
-// reconcile takes a list of machines that the provider thinks we should be
-// managing and that the BMDB thinks we should be managing, and tries to make
-// sense of that. First, some checks are performed across the two lists to make
-// sure we haven't dropped anything. Then, additional machines are deployed from
-// hardware reservations as needed.
-func (p *Provisioner) reconcile(ctx context.Context, sess *bmdb.Session, inProvider, bmdbMachines []shepherd.Machine) error {
-	klog.Infof("Reconciling...")
-
-	bmdb := make(map[shepherd.ProviderID]shepherd.Machine)
-	for _, machine := range bmdbMachines {
-		// Dont check the availability here as its hardcoded to be known used.
-		bmdb[machine.ID()] = machine
-	}
-
-	var availableMachines []shepherd.Machine
-	provider := make(map[shepherd.ProviderID]shepherd.Machine)
-	for _, machine := range inProvider {
-		state := p.resolvePossiblyUsed(machine, bmdb)
-
-		switch state {
-		case shepherd.AvailabilityKnownUnused:
-			availableMachines = append(availableMachines, machine)
-
-		case shepherd.AvailabilityKnownUsed:
-			provider[machine.ID()] = machine
-
-		default:
-			return fmt.Errorf("machine has invalid availability (ID: %s, Addr: %s): %s", machine.ID(), machine.Addr(), state)
-		}
-	}
-
-	managed := make(map[shepherd.ProviderID]bool)
-
-	// We discovered that a machine mostly fails either when provisioning or
-	// deprovisioning. A already deployed and running machine can only switch
-	// into failed state if any api interaction happend, e.g. rebooting the
-	// machine into recovery mode. If such a machine is returned to the
-	// reconciling loop, it will trigger the badbadnotgood safety switch and
-	// return with an error. To reduce the manual intervention required we
-	// filter out these machines on both sides (bmdb and provider).
-	isBadBadNotGood := func(known map[shepherd.ProviderID]shepherd.Machine, machine shepherd.Machine) bool {
-		// If the machine is missing and not failed, its a bad case.
-		if known[machine.ID()] == nil && !machine.Failed() {
-			return true
-		}
-		return false
-	}
-
-	// Some desynchronization between the BMDB and Provider point of view might be so
-	// bad we shouldn't attempt to do any work, at least not any time soon.
-	badbadnotgood := false
-
-	// Find any machines supposedly managed by us in the provider, but not in the
-	// BMDB.
-	for id, machine := range provider {
-		if isBadBadNotGood(bmdb, machine) {
-			klog.Errorf("Provider machine has no corresponding machine in BMDB. (PID: %s)", id)
-			badbadnotgood = true
-			continue
-		}
-
-		managed[id] = true
-	}
-
-	// Find any machines in the BMDB but not in the provider.
-	for id, machine := range bmdb {
-		if isBadBadNotGood(provider, machine) {
-			klog.Errorf("Provider machine referred to in BMDB but missing in provider. (PID: %s)", id)
-			badbadnotgood = true
-		}
-	}
-
-	// Bail if things are weird.
-	if badbadnotgood {
-		klog.Errorf("Something's very wrong. Bailing early and refusing to do any work.")
-		return fmt.Errorf("fatal discrepency between BMDB and provider")
-	}
-
-	// Summarize all managed machines, which is the intersection of BMDB and
-	// Provisioner machines, usually both of these sets being equal.
-	nmanaged := len(managed)
-	klog.Infof("Total managed machines: %d", nmanaged)
-
-	if p.MaxCount != 0 && p.MaxCount <= uint(nmanaged) {
-		klog.Infof("Not bringing up more machines (at limit of %d machines)", p.MaxCount)
-		return nil
-	}
-
-	limitName := "no limit"
-	if p.MaxCount != 0 {
-		limitName = fmt.Sprintf("%d", p.MaxCount)
-	}
-	klog.Infof("Below managed machine limit (%s), bringing up more...", limitName)
-
-	if len(availableMachines) == 0 {
-		klog.Infof("No more capacity available.")
-		return nil
-	}
-
-	toProvision := availableMachines
-	// Limit them to MaxCount, if applicable.
-	if p.MaxCount != 0 {
-		needed := int(p.MaxCount) - nmanaged
-		if len(toProvision) < needed {
-			needed = len(toProvision)
-		}
-		toProvision = toProvision[:needed]
-	}
-
-	// Limit them to an arbitrary 'chunk' size so that we don't do too many things in
-	// a single reconciliation operation.
-	if uint(len(toProvision)) > p.ChunkSize {
-		toProvision = toProvision[:p.ChunkSize]
-	}
-
-	if len(toProvision) == 0 {
-		klog.Infof("No more unused machines available, or all filtered out.")
-		return nil
-	}
-
-	klog.Infof("Bringing up %d machines...", len(toProvision))
-	for _, machine := range toProvision {
-		if err := p.DeviceCreationLimiter.Wait(ctx); err != nil {
-			return err
-		}
-
-		nd, err := p.p.CreateMachine(ctx, sess, shepherd.CreateMachineRequest{
-			UnusedMachine: machine,
-		})
-		if err != nil {
-			klog.Errorf("while creating new device (ID: %s, Addr: %s, Availability: %s): %v", machine.ID(), machine.Addr(), machine.Availability(), err)
-			continue
-		}
-		klog.Infof("Created new machine with ID: %s", nd.ID())
-	}
-
-	return nil
-}
diff --git a/cloud/shepherd/manager/provisioner_test.go b/cloud/shepherd/manager/provisioner_test.go
deleted file mode 100644
index eba178c..0000000
--- a/cloud/shepherd/manager/provisioner_test.go
+++ /dev/null
@@ -1,143 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package manager
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"golang.org/x/time/rate"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/cloud/lib/component"
-	"source.monogon.dev/cloud/shepherd"
-)
-
-// TestProvisionerSmokes makes sure the Provisioner doesn't go up in flames on
-// the happy path.
-func TestProvisionerSmokes(t *testing.T) {
-	pc := ProvisionerConfig{
-		MaxCount: 10,
-		// We need 3 iterations to provide 10 machines with a chunk size of 4.
-		ReconcileLoopLimiter:  rate.NewLimiter(rate.Every(10*time.Second), 3),
-		DeviceCreationLimiter: rate.NewLimiter(rate.Every(time.Second), 10),
-		ChunkSize:             4,
-	}
-
-	provider := newDummyProvider(100)
-
-	p, err := NewProvisioner(provider, pc)
-	if err != nil {
-		t.Fatalf("Could not create Provisioner: %v", err)
-	}
-
-	ctx, ctxC := context.WithCancel(context.Background())
-	defer ctxC()
-
-	b := bmdb.BMDB{
-		Config: bmdb.Config{
-			Database: component.CockroachConfig{
-				InMemory: true,
-			},
-			ComponentName: "test",
-			RuntimeInfo:   "test",
-		},
-	}
-	conn, err := b.Open(true)
-	if err != nil {
-		t.Fatalf("Could not create in-memory BMDB: %v", err)
-	}
-
-	go p.Run(ctx, conn)
-
-	sess, err := conn.StartSession(ctx)
-	if err != nil {
-		t.Fatalf("Failed to create BMDB session for verification: %v", err)
-	}
-	for {
-		time.Sleep(100 * time.Millisecond)
-
-		var provided []model.MachineProvided
-		err = sess.Transact(ctx, func(q *model.Queries) error {
-			var err error
-			provided, err = q.GetProvidedMachines(ctx, provider.Type())
-			return err
-		})
-		if err != nil {
-			t.Fatalf("Transact failed: %v", err)
-		}
-		if len(provided) < 10 {
-			continue
-		}
-		if len(provided) > 10 {
-			t.Fatalf("%d machines provided (limit: 10)", len(provided))
-		}
-
-		for _, mp := range provided {
-			provider.muMachines.RLock()
-			if provider.machines[shepherd.ProviderID(mp.ProviderID)] == nil {
-				t.Fatalf("BMDB machine %q has unknown provider ID %q", mp.MachineID, mp.ProviderID)
-			}
-			provider.muMachines.RUnlock()
-		}
-
-		return
-	}
-}
-
-// TestProvisioner_resolvePossiblyUsed makes sure the PossiblyUsed availability is
-// resolved correctly.
-func TestProvisioner_resolvePossiblyUsed(t *testing.T) {
-	const providedMachineID = "provided-machine"
-
-	providedMachines := map[shepherd.ProviderID]shepherd.Machine{
-		providedMachineID: nil,
-	}
-
-	tests := []struct {
-		name                string
-		machineID           shepherd.ProviderID
-		machineAvailability shepherd.Availability
-		wantedAvailability  shepherd.Availability
-	}{
-		{
-			name:                "skip KnownUsed",
-			machineAvailability: shepherd.AvailabilityKnownUsed,
-			wantedAvailability:  shepherd.AvailabilityKnownUsed,
-		},
-		{
-			name:                "skip KnownUnused",
-			machineAvailability: shepherd.AvailabilityKnownUnused,
-			wantedAvailability:  shepherd.AvailabilityKnownUnused,
-		},
-		{
-			name:                "invalid ID",
-			machineID:           shepherd.InvalidProviderID,
-			machineAvailability: shepherd.AvailabilityPossiblyUsed,
-			wantedAvailability:  shepherd.AvailabilityKnownUnused,
-		},
-		{
-			name:                "valid ID, not in providedMachines",
-			machineID:           "unused-machine",
-			machineAvailability: shepherd.AvailabilityPossiblyUsed,
-			wantedAvailability:  shepherd.AvailabilityKnownUnused,
-		},
-		{
-			name:                "valid ID, in providedMachines",
-			machineID:           providedMachineID,
-			machineAvailability: shepherd.AvailabilityPossiblyUsed,
-			wantedAvailability:  shepherd.AvailabilityKnownUsed,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			p := &Provisioner{}
-			if got := p.resolvePossiblyUsed(&dummyMachine{id: tt.machineID, availability: tt.machineAvailability}, providedMachines); got != tt.wantedAvailability {
-				t.Fatalf("resolvePossiblyUsed() = %v, want %v", got, tt.wantedAvailability)
-			}
-		})
-	}
-}
diff --git a/cloud/shepherd/manager/recoverer.go b/cloud/shepherd/manager/recoverer.go
deleted file mode 100644
index 8925f17..0000000
--- a/cloud/shepherd/manager/recoverer.go
+++ /dev/null
@@ -1,84 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package manager
-
-import (
-	"context"
-	"fmt"
-	"time"
-
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/metrics"
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/cloud/shepherd"
-)
-
-type RecovererConfig struct {
-	ControlLoopConfig
-}
-
-func (r *RecovererConfig) RegisterFlags() {
-	r.ControlLoopConfig.RegisterFlags("recoverer")
-}
-
-// The Recoverer reboots machines whose agent has stopped sending heartbeats or
-// has not sent any heartbeats at all.
-type Recoverer struct {
-	RecovererConfig
-	r shepherd.Recoverer
-}
-
-func NewRecoverer(r shepherd.Recoverer, rc RecovererConfig) (*Recoverer, error) {
-	if err := rc.ControlLoopConfig.Check(); err != nil {
-		return nil, err
-	}
-	return &Recoverer{
-		RecovererConfig: rc,
-		r:               r,
-	}, nil
-}
-
-func (r *Recoverer) getProcessInfo() processInfo {
-	return processInfo{
-		process: model.ProcessShepherdRecovery,
-		defaultBackoff: bmdb.Backoff{
-			Initial:  1 * time.Minute,
-			Maximum:  1 * time.Hour,
-			Exponent: 1.2,
-		},
-		processor: metrics.ProcessorShepherdRecoverer,
-	}
-}
-
-func (r *Recoverer) getMachines(ctx context.Context, q *model.Queries, limit int32) ([]model.MachineProvided, error) {
-	return q.GetMachineForAgentRecovery(ctx, model.GetMachineForAgentRecoveryParams{
-		Limit:    limit,
-		Provider: r.r.Type(),
-	})
-}
-
-func (r *Recoverer) processMachine(ctx context.Context, t *task) error {
-	klog.Infof("Starting recovery of machine (ID: %s, PID %s)", t.machine.MachineID, t.machine.ProviderID)
-
-	if err := r.r.RebootMachine(ctx, shepherd.ProviderID(t.machine.ProviderID)); err != nil {
-		return fmt.Errorf("failed to reboot machine: %w", err)
-	}
-
-	klog.Infof("Removing AgentStarted/AgentHeartbeat (ID: %s, PID: %s)...", t.machine.MachineID, t.machine.ProviderID)
-	err := t.work.Finish(ctx, func(q *model.Queries) error {
-		if err := q.MachineDeleteAgentStarted(ctx, t.machine.MachineID); err != nil {
-			return fmt.Errorf("while deleting AgentStarted: %w", err)
-		}
-		if err := q.MachineDeleteAgentHeartbeat(ctx, t.machine.MachineID); err != nil {
-			return fmt.Errorf("while deleting AgentHeartbeat: %w", err)
-		}
-		return nil
-	})
-	if err != nil {
-		return fmt.Errorf("while deleting AgentStarted/AgentHeartbeat tags: %w", err)
-	}
-	return nil
-}
diff --git a/cloud/shepherd/manager/ssh_key_signer.go b/cloud/shepherd/manager/ssh_key_signer.go
deleted file mode 100644
index b28b0b5..0000000
--- a/cloud/shepherd/manager/ssh_key_signer.go
+++ /dev/null
@@ -1,111 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package manager
-
-import (
-	"crypto/ed25519"
-	"crypto/rand"
-	"flag"
-	"fmt"
-	"os"
-	"sync"
-
-	"golang.org/x/crypto/ssh"
-	"k8s.io/klog/v2"
-)
-
-type SSHKey struct {
-	// myKey guards Key.
-	muKey sync.Mutex
-
-	// SSH key to use when creating machines and then connecting to them. If not
-	// provided, it will be automatically loaded from KeyPersistPath, and if that
-	// doesn't exist either, it will be first generated and persisted there.
-	Key ed25519.PrivateKey
-
-	// Path at which the SSH key will be loaded from and persisted to, if Key is not
-	// explicitly set. Either KeyPersistPath or Key must be set.
-	KeyPersistPath string
-}
-
-func (c *SSHKey) RegisterFlags() {
-	flag.StringVar(&c.KeyPersistPath, "ssh_key_path", "", "Local filesystem path to read SSH key from, and save generated key to")
-}
-
-// sshKey returns the SSH key as defined by the Key and KeyPersistPath options,
-// loading/generating/persisting it as necessary.
-func (c *SSHKey) sshKey() (ed25519.PrivateKey, error) {
-	c.muKey.Lock()
-	defer c.muKey.Unlock()
-
-	if c.Key != nil {
-		return c.Key, nil
-	}
-	if c.KeyPersistPath == "" {
-		return nil, fmt.Errorf("-ssh_key_path must be set")
-	}
-
-	data, err := os.ReadFile(c.KeyPersistPath)
-	switch {
-	case err == nil:
-		if len(data) != ed25519.PrivateKeySize {
-			return nil, fmt.Errorf("%s is not a valid ed25519 private key", c.KeyPersistPath)
-		}
-		c.Key = data
-		klog.Infof("Loaded SSH key from %s", c.KeyPersistPath)
-		return c.Key, nil
-	case os.IsNotExist(err):
-		if err := c.sshGenerateUnlocked(); err != nil {
-			return nil, err
-		}
-		if err := os.WriteFile(c.KeyPersistPath, c.Key, 0400); err != nil {
-			return nil, fmt.Errorf("could not persist key: %w", err)
-		}
-		return c.Key, nil
-	default:
-		return nil, fmt.Errorf("could not load peristed key: %w", err)
-	}
-}
-
-// PublicKey returns the SSH public key marshaled for use, based on sshKey.
-func (c *SSHKey) PublicKey() (string, error) {
-	private, err := c.sshKey()
-	if err != nil {
-		return "", err
-	}
-	// Marshal the public key part in OpenSSH authorized_keys.
-	sshpub, err := ssh.NewPublicKey(private.Public())
-	if err != nil {
-		return "", fmt.Errorf("while building SSH public key: %w", err)
-	}
-	return string(ssh.MarshalAuthorizedKey(sshpub)), nil
-}
-
-// Signer builds an ssh.Signer (for use in SSH connections) based on sshKey.
-func (c *SSHKey) Signer() (ssh.Signer, error) {
-	private, err := c.sshKey()
-	if err != nil {
-		return nil, err
-	}
-	// Set up the internal ssh.Signer to be later used to initiate SSH
-	// connections with newly provided hosts.
-	signer, err := ssh.NewSignerFromKey(private)
-	if err != nil {
-		return nil, fmt.Errorf("while building SSH signer: %w", err)
-	}
-	return signer, nil
-}
-
-// sshGenerateUnlocked saves a new private key into SharedConfig.Key.
-func (c *SSHKey) sshGenerateUnlocked() error {
-	if c.Key != nil {
-		return nil
-	}
-	_, priv, err := ed25519.GenerateKey(rand.Reader)
-	if err != nil {
-		return fmt.Errorf("while generating SSH key: %w", err)
-	}
-	c.Key = priv
-	return nil
-}
diff --git a/cloud/shepherd/manager/test_agent/BUILD.bazel b/cloud/shepherd/manager/test_agent/BUILD.bazel
deleted file mode 100644
index 7636cdd..0000000
--- a/cloud/shepherd/manager/test_agent/BUILD.bazel
+++ /dev/null
@@ -1,28 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("//build/static_binary_tarball:def.bzl", "static_binary_tarball")
-
-go_binary(
-    name = "test_agent",
-    embed = [":test_agent_lib"],
-    visibility = [
-        "//cloud/shepherd/manager:__pkg__",
-    ],
-)
-
-go_library(
-    name = "test_agent_lib",
-    srcs = ["main.go"],
-    importpath = "source.monogon.dev/cloud/shepherd/manager/test_agent",
-    visibility = ["//visibility:private"],
-    deps = [
-        "//cloud/agent/api",
-        "@org_golang_google_protobuf//proto",
-    ],
-)
-
-# Used by container_images, forces a static build of the test_agent.
-static_binary_tarball(
-    name = "test_agent_layer",
-    executable = ":test_agent",
-    visibility = ["//visibility:public"],
-)
diff --git a/cloud/shepherd/manager/test_agent/main.go b/cloud/shepherd/manager/test_agent/main.go
deleted file mode 100644
index 98daf1b..0000000
--- a/cloud/shepherd/manager/test_agent/main.go
+++ /dev/null
@@ -1,57 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-// test_agent is used by the Equinix Metal Manager test code. Its only role
-// is to ensure successful delivery of the BMaaS agent executable to the test
-// hosts, together with its subsequent execution.
-package main
-
-import (
-	"crypto/ed25519"
-	"crypto/rand"
-	"fmt"
-	"io"
-	"os"
-
-	"google.golang.org/protobuf/proto"
-
-	apb "source.monogon.dev/cloud/agent/api"
-)
-
-func main() {
-	// The agent initialization message will arrive from Shepherd on Agent's
-	// standard input.
-	aimb, err := io.ReadAll(os.Stdin)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "while reading AgentInit message: %v\n", err)
-		return
-	}
-	var aim apb.TakeoverInit
-	if err := proto.Unmarshal(aimb, &aim); err != nil {
-		fmt.Fprintf(os.Stderr, "while unmarshaling TakeoverInit message: %v\n", err)
-		return
-	}
-
-	// Agent should send back apb.TakeoverResponse on its standard output.
-	pub, _, err := ed25519.GenerateKey(rand.Reader)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "while generating agent public key: %v\n", err)
-		return
-	}
-	arsp := apb.TakeoverResponse{
-		Result: &apb.TakeoverResponse_Success{Success: &apb.TakeoverSuccess{
-			InitMessage: &aim,
-			Key:         pub,
-		}},
-	}
-	arspb, err := proto.Marshal(&arsp)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "while marshaling TakeoverResponse message: %v\n", err)
-		return
-	}
-	if _, err := os.Stdout.Write(arspb); err != nil {
-		fmt.Fprintf(os.Stderr, "while writing TakeoverResponse message: %v\n", err)
-	}
-	// The agent must detach and/or terminate after sending back the reply.
-	// Failure to do so will leave the session hanging.
-}
diff --git a/cloud/shepherd/mini/BUILD.bazel b/cloud/shepherd/mini/BUILD.bazel
deleted file mode 100644
index 7b1a7ad..0000000
--- a/cloud/shepherd/mini/BUILD.bazel
+++ /dev/null
@@ -1,47 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("@rules_oci//oci:defs.bzl", "oci_image")
-load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
-
-go_library(
-    name = "mini_lib",
-    srcs = [
-        "main.go",
-        "provider.go",
-        "ssh.go",
-    ],
-    importpath = "source.monogon.dev/cloud/shepherd/mini",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//cloud/bmaas/bmdb",
-        "//cloud/bmaas/bmdb/model",
-        "//cloud/bmaas/bmdb/webug",
-        "//cloud/lib/component",
-        "//cloud/shepherd",
-        "//cloud/shepherd/manager",
-        "@io_k8s_klog_v2//:klog",
-        "@org_golang_x_crypto//ssh",
-    ],
-)
-
-go_binary(
-    name = "mini",
-    embed = [":mini_lib"],
-    visibility = ["//visibility:public"],
-)
-
-pkg_tar(
-    name = "mini_layer",
-    srcs = [":mini"],
-)
-
-oci_image(
-    name = "mini_image",
-    base = "@distroless_base",
-    entrypoint = ["/mini"],
-    tars = [
-        ":mini_layer",
-        "//cloud/agent/takeover:takeover_layer",
-    ],
-    visibility = ["//visibility:public"],
-    workdir = "/app",
-)
diff --git a/cloud/shepherd/mini/main.go b/cloud/shepherd/mini/main.go
deleted file mode 100644
index b056d20..0000000
--- a/cloud/shepherd/mini/main.go
+++ /dev/null
@@ -1,195 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"flag"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"os"
-	"os/signal"
-	"strings"
-
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/cloud/bmaas/bmdb/webug"
-	"source.monogon.dev/cloud/lib/component"
-	"source.monogon.dev/cloud/shepherd"
-	"source.monogon.dev/cloud/shepherd/manager"
-)
-
-type Config struct {
-	Component   component.ComponentConfig
-	BMDB        bmdb.BMDB
-	WebugConfig webug.Config
-
-	InitializerConfig manager.InitializerConfig
-	ProvisionerConfig manager.ProvisionerConfig
-	RecovererConfig   manager.RecovererConfig
-
-	SSHConfig        sshConfig
-	DeviceListSource string
-	ProviderType     model.Provider
-}
-
-// TODO(q3k): factor this out to BMDB library?
-func runtimeInfo() string {
-	hostname, _ := os.Hostname()
-	if hostname == "" {
-		hostname = "UNKNOWN"
-	}
-	return fmt.Sprintf("host %s", hostname)
-}
-
-func (c *Config) RegisterFlags() {
-	c.Component.RegisterFlags("shepherd")
-	c.BMDB.ComponentName = "shepherd-mini"
-	c.BMDB.RuntimeInfo = runtimeInfo()
-	c.BMDB.Database.RegisterFlags("bmdb")
-	c.WebugConfig.RegisterFlags()
-
-	c.InitializerConfig.RegisterFlags()
-	c.ProvisionerConfig.RegisterFlags()
-	c.RecovererConfig.RegisterFlags()
-
-	c.SSHConfig.RegisterFlags()
-	flag.StringVar(&c.DeviceListSource, "mini_device_list_url", "", "The url from where to fetch the device list. For local paths use file:// as scheme")
-	flag.Func("mini_provider", "The provider this mini shepherd should emulate. Supported values are: lumen,equinix", func(s string) error {
-		switch s {
-		case strings.ToLower(string(model.ProviderEquinix)):
-			c.ProviderType = model.ProviderEquinix
-		case strings.ToLower(string(model.ProviderLumen)):
-			c.ProviderType = model.ProviderLumen
-		default:
-			return fmt.Errorf("invalid provider name")
-		}
-		return nil
-	})
-}
-
-type deviceList []machine
-
-func (dl deviceList) asMap() map[shepherd.ProviderID]machine {
-	mm := make(map[shepherd.ProviderID]machine)
-	for _, m := range dl {
-		mm[m.ProviderID] = m
-	}
-	return mm
-}
-
-func fetchDeviceList(s string) (deviceList, error) {
-	var r io.Reader
-	u, err := url.Parse(s)
-	if err != nil {
-		return nil, fmt.Errorf("failed parsing device list url: %w", err)
-	}
-
-	if u.Scheme != "file" {
-		resp, err := http.Get(u.String())
-		if err != nil {
-			return nil, err
-		}
-		defer resp.Body.Close()
-
-		if resp.StatusCode != http.StatusOK {
-			return nil, fmt.Errorf("invalid status code: %d != %v", http.StatusOK, resp.StatusCode)
-		}
-		r = resp.Body
-	} else {
-		f, err := os.Open(u.Path)
-		if err != nil {
-			return nil, err
-		}
-		defer f.Close()
-		r = f
-	}
-
-	var d deviceList
-	dec := json.NewDecoder(r)
-	dec.DisallowUnknownFields()
-	if err := dec.Decode(&d); err != nil {
-		return nil, err
-	}
-
-	klog.Infof("Fetched device list with %d entries", len(d))
-
-	return d, nil
-}
-
-func main() {
-	var c Config
-	c.RegisterFlags()
-
-	flag.Parse()
-	if flag.NArg() > 0 {
-		klog.Exitf("unexpected positional arguments: %v", flag.Args())
-	}
-
-	registry := c.Component.PrometheusRegistry()
-	c.BMDB.EnableMetrics(registry)
-
-	ctx, _ := signal.NotifyContext(context.Background(), os.Interrupt)
-	c.Component.StartPrometheus(ctx)
-
-	conn, err := c.BMDB.Open(true)
-	if err != nil {
-		klog.Exitf("Failed to open BMDB connection: %v", err)
-	}
-
-	err = c.SSHConfig.Configure(&c.InitializerConfig.SSHConfig)
-	if err != nil {
-		klog.Exitf("Failed to create SSH client: %v", err)
-	}
-
-	if c.DeviceListSource == "" {
-		klog.Exitf("-mini_device_list_source must be set")
-	}
-
-	list, err := fetchDeviceList(c.DeviceListSource)
-	if err != nil {
-		klog.Exitf("Failed to fetch device list: %v", err)
-	}
-
-	mini := &provider{
-		providerType: c.ProviderType,
-		machines:     list.asMap(),
-	}
-
-	provisioner, err := manager.NewProvisioner(mini, c.ProvisionerConfig)
-	if err != nil {
-		klog.Exitf("%v", err)
-	}
-
-	initializer, err := manager.NewInitializer(mini, c.InitializerConfig)
-	if err != nil {
-		klog.Exitf("%v", err)
-	}
-
-	go func() {
-		err = provisioner.Run(ctx, conn)
-		if err != nil {
-			klog.Exit(err)
-		}
-	}()
-	go func() {
-		err = manager.RunControlLoop(ctx, conn, initializer)
-		if err != nil {
-			klog.Exit(err)
-		}
-	}()
-	go func() {
-		if err := c.WebugConfig.Start(ctx, conn); err != nil && !errors.Is(err, ctx.Err()) {
-			klog.Exitf("Failed to start webug: %v", err)
-		}
-	}()
-
-	<-ctx.Done()
-}
diff --git a/cloud/shepherd/mini/provider.go b/cloud/shepherd/mini/provider.go
deleted file mode 100644
index 1ee55c4..0000000
--- a/cloud/shepherd/mini/provider.go
+++ /dev/null
@@ -1,133 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package main
-
-import (
-	"context"
-	"database/sql"
-	"fmt"
-	"net/netip"
-
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/cloud/shepherd"
-)
-
-// provider represents a shepherd.Provider that works entirely on a
-// static device list. It requires a provider type and a device list.
-type provider struct {
-	providerType model.Provider
-	machines     map[shepherd.ProviderID]machine
-}
-
-type machine struct {
-	ProviderID shepherd.ProviderID `json:"ID"`
-	Address    netip.Addr          `json:"Addr"`
-	Location   string              `json:"Location"`
-}
-
-func (d machine) Failed() bool {
-	return false
-}
-
-func (d machine) ID() shepherd.ProviderID {
-	return d.ProviderID
-}
-
-func (d machine) Addr() netip.Addr {
-	return d.Address
-}
-
-func (d machine) Availability() shepherd.Availability {
-	return shepherd.AvailabilityPossiblyUsed
-}
-
-func (p *provider) ListMachines(ctx context.Context) ([]shepherd.Machine, error) {
-	machines := make([]shepherd.Machine, 0, len(p.machines))
-	for _, m := range p.machines {
-		machines = append(machines, m)
-	}
-
-	return machines, nil
-}
-
-func (p *provider) GetMachine(ctx context.Context, id shepherd.ProviderID) (shepherd.Machine, error) {
-	// If the provided machine is not inside our known machines,
-	// bail-out early as this is unsupported.
-	if _, ok := p.machines[id]; !ok {
-		return nil, fmt.Errorf("unknown provided machine requested")
-	}
-
-	return p.machines[id], nil
-}
-
-func (p *provider) CreateMachine(ctx context.Context, session *bmdb.Session, request shepherd.CreateMachineRequest) (shepherd.Machine, error) {
-	if request.UnusedMachine == nil {
-		return nil, fmt.Errorf("parameter UnusedMachine is missing")
-	}
-
-	//TODO: Do we just trust the implementation to be correct?
-	m, ok := request.UnusedMachine.(machine)
-	if !ok {
-		return nil, fmt.Errorf("invalid type for parameter UnusedMachine")
-	}
-
-	if err := p.assimilate(ctx, session, m); err != nil {
-		klog.Errorf("Failed to provision machine %s: %v", m.ProviderID, err)
-		return nil, err
-	}
-
-	return m, nil
-}
-
-func (p *provider) assimilate(ctx context.Context, sess *bmdb.Session, machine machine) error {
-	return sess.Transact(ctx, func(q *model.Queries) error {
-		// Create a new machine record within BMDB.
-		m, err := q.NewMachine(ctx)
-		if err != nil {
-			return fmt.Errorf("while creating a new machine record in BMDB: %w", err)
-		}
-
-		// Link the new machine with the device, and tag it "provided".
-		addParams := model.MachineAddProvidedParams{
-			MachineID:  m.MachineID,
-			ProviderID: string(machine.ProviderID),
-			Provider:   p.providerType,
-		}
-		klog.Infof("Setting \"provided\" tag (ID: %s, PID: %s, Provider: %s).", addParams.MachineID, addParams.ProviderID, addParams.Provider)
-		if err := q.MachineAddProvided(ctx, addParams); err != nil {
-			return fmt.Errorf("while tagging machine active: %w", err)
-		}
-
-		upParams := model.MachineUpdateProviderStatusParams{
-			ProviderID: string(machine.ProviderID),
-			Provider:   p.providerType,
-			ProviderIpAddress: sql.NullString{
-				String: machine.Address.String(),
-				Valid:  true,
-			},
-			ProviderLocation: sql.NullString{
-				String: machine.Location,
-				Valid:  machine.Location != "",
-			},
-			ProviderStatus: model.NullProviderStatus{
-				ProviderStatus: model.ProviderStatusUnknown,
-				Valid:          true,
-			},
-		}
-
-		klog.Infof("Setting \"provided\" tag status parameter (ID: %s, PID: %s, Provider: %s).", addParams.MachineID, upParams.ProviderID, upParams.Provider)
-		if err := q.MachineUpdateProviderStatus(ctx, upParams); err != nil {
-			return fmt.Errorf("while setting machine params: %w", err)
-		}
-
-		return nil
-	})
-}
-
-func (p *provider) Type() model.Provider {
-	return p.providerType
-}
diff --git a/cloud/shepherd/mini/ssh.go b/cloud/shepherd/mini/ssh.go
deleted file mode 100644
index 59cefca..0000000
--- a/cloud/shepherd/mini/ssh.go
+++ /dev/null
@@ -1,73 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package main
-
-import (
-	"flag"
-	"fmt"
-
-	"golang.org/x/crypto/ssh"
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/shepherd/manager"
-)
-
-type sshConfig struct {
-	User   string
-	Pass   string
-	SSHKey manager.SSHKey
-}
-
-func (sc *sshConfig) check() error {
-	if sc.User == "" {
-		return fmt.Errorf("-ssh_user must be set")
-	}
-
-	if sc.Pass == "" && sc.SSHKey.KeyPersistPath == "" {
-		//TODO: The flag name -ssh_key_path could change, which would make this
-		// error very confusing.
-		return fmt.Errorf("-ssh_pass or -ssh_key_path must be set")
-	}
-
-	return nil
-}
-
-func (sc *sshConfig) RegisterFlags() {
-	flag.StringVar(&sc.User, "ssh_user", "", "SSH username to log into the machines")
-	flag.StringVar(&sc.Pass, "ssh_pass", "", "SSH password to log into the machines")
-	sc.SSHKey.RegisterFlags()
-}
-
-func (sc *sshConfig) Configure(config *ssh.ClientConfig) error {
-	if err := sc.check(); err != nil {
-		return err
-	}
-
-	config.User = sc.User
-
-	switch {
-	case sc.Pass != "":
-		config.Auth = []ssh.AuthMethod{ssh.Password(sc.Pass)}
-	case sc.SSHKey.KeyPersistPath != "":
-		signer, err := sc.SSHKey.Signer()
-		if err != nil {
-			return err
-		}
-
-		pubKey, err := sc.SSHKey.PublicKey()
-		if err != nil {
-			return err
-		}
-
-		klog.Infof("Using ssh key auth with public key: %s", pubKey)
-
-		config.Auth = []ssh.AuthMethod{ssh.PublicKeys(signer)}
-	}
-
-	// Ignore the host key, since it's likely the first time anything logs into
-	// this device, and also because there's no way of knowing its fingerprint.
-	config.HostKeyCallback = ssh.InsecureIgnoreHostKey()
-
-	return nil
-}
diff --git a/cloud/shepherd/provider/equinix/BUILD.bazel b/cloud/shepherd/provider/equinix/BUILD.bazel
deleted file mode 100644
index e0333b1..0000000
--- a/cloud/shepherd/provider/equinix/BUILD.bazel
+++ /dev/null
@@ -1,77 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library", "go_test")
-load("@rules_oci//oci:defs.bzl", "oci_image")
-load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
-
-go_library(
-    name = "equinix_lib",
-    srcs = [
-        "main.go",
-        "provider.go",
-        "provider_config.go",
-        "updater.go",
-    ],
-    importpath = "source.monogon.dev/cloud/shepherd/provider/equinix",
-    visibility = ["//visibility:private"],
-    deps = [
-        "//cloud/bmaas/bmdb",
-        "//cloud/bmaas/bmdb/metrics",
-        "//cloud/bmaas/bmdb/model",
-        "//cloud/bmaas/bmdb/webug",
-        "//cloud/equinix/wrapngo",
-        "//cloud/lib/component",
-        "//cloud/lib/sinbin",
-        "//cloud/shepherd",
-        "//cloud/shepherd/manager",
-        "@com_github_packethost_packngo//:packngo",
-        "@io_k8s_klog_v2//:klog",
-        "@org_golang_x_crypto//ssh",
-    ],
-)
-
-go_test(
-    name = "equinix_test",
-    srcs = [
-        "fakequinix_test.go",
-        "initializer_test.go",
-        "provisioner_test.go",
-        "recoverer_test.go",
-        "updater_test.go",
-    ],
-    data = [
-        "@cockroach",
-    ],
-    embed = [":equinix_lib"],
-    deps = [
-        "//cloud/bmaas/bmdb",
-        "//cloud/bmaas/bmdb/model",
-        "//cloud/lib/component",
-        "//cloud/shepherd/manager",
-        "@com_github_google_uuid//:uuid",
-        "@com_github_packethost_packngo//:packngo",
-        "@org_golang_x_crypto//ssh",
-        "@org_golang_x_time//rate",
-    ],
-)
-
-go_binary(
-    name = "equinix",
-    embed = [":equinix_lib"],
-    visibility = ["//visibility:public"],
-)
-
-pkg_tar(
-    name = "equinix_layer",
-    srcs = [":equinix"],
-)
-
-oci_image(
-    name = "equinix_image",
-    base = "@distroless_base",
-    entrypoint = ["/equinix"],
-    tars = [
-        ":equinix_layer",
-        "//cloud/agent/takeover:takeover_layer",
-    ],
-    visibility = ["//visibility:public"],
-    workdir = "/app",
-)
diff --git a/cloud/shepherd/provider/equinix/fakequinix_test.go b/cloud/shepherd/provider/equinix/fakequinix_test.go
deleted file mode 100644
index aa0b234..0000000
--- a/cloud/shepherd/provider/equinix/fakequinix_test.go
+++ /dev/null
@@ -1,228 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package main
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-	"sync"
-
-	"github.com/google/uuid"
-	"github.com/packethost/packngo"
-)
-
-// fakequinix implements a wrapngo.Client for testing. It starts out with a
-// number of made up hardware reservations, and allows for creating devices and
-// SSH keys.
-type fakequinix struct {
-	mu sync.Mutex
-
-	pid          string
-	devices      map[string]*packngo.Device
-	reservations map[string]*packngo.HardwareReservation
-	sshKeys      map[string]*packngo.SSHKey
-	reboots      map[string]int
-}
-
-func (f *fakequinix) ListOrganizationReservations(ctx context.Context, oid string) ([]packngo.HardwareReservation, error) {
-	return nil, fmt.Errorf("not implemented")
-}
-
-// newFakequinix makes a fakequinix with a given fake project ID and number of
-// hardware reservations to create.
-func newFakequinix(pid string, numReservations int) *fakequinix {
-	f := fakequinix{
-		pid:          pid,
-		devices:      make(map[string]*packngo.Device),
-		reservations: make(map[string]*packngo.HardwareReservation),
-		sshKeys:      make(map[string]*packngo.SSHKey),
-		reboots:      make(map[string]int),
-	}
-
-	for i := 0; i < numReservations; i++ {
-		uid := uuid.New()
-		f.reservations[uid.String()] = &packngo.HardwareReservation{
-			ID:            uid.String(),
-			ShortID:       uid.String(),
-			Provisionable: true,
-		}
-	}
-
-	return &f
-}
-
-func (f *fakequinix) notFound() error {
-	return &packngo.ErrorResponse{
-		Response: &http.Response{
-			StatusCode: http.StatusNotFound,
-		},
-	}
-}
-
-func (f *fakequinix) GetDevice(_ context.Context, pid, did string, _ *packngo.ListOptions) (*packngo.Device, error) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	val := f.devices[did]
-	if val == nil {
-		return nil, f.notFound()
-	}
-	return val, nil
-}
-
-func (f *fakequinix) ListDevices(_ context.Context, pid string) ([]packngo.Device, error) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	if pid != f.pid {
-		return nil, nil
-	}
-	var res []packngo.Device
-	for _, dev := range f.devices {
-		res = append(res, *dev)
-	}
-	return res, nil
-}
-
-func (f *fakequinix) UpdateDevice(ctx context.Context, id string, r *packngo.DeviceUpdateRequest) (*packngo.Device, error) {
-	return nil, fmt.Errorf("not implemented")
-}
-
-// MoveReservation is not implemented in fakequinix
-func (f *fakequinix) MoveReservation(_ context.Context, hardwareReservationDID, projectID string) (*packngo.HardwareReservation, error) {
-	return nil, &packngo.ErrorResponse{
-		Response: &http.Response{
-			StatusCode: http.StatusNotImplemented,
-		},
-	}
-}
-
-func (f *fakequinix) DeleteDevice(_ context.Context, id string) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	if _, ok := f.devices[id]; !ok {
-		return f.notFound()
-	}
-
-	delete(f.devices, id)
-
-	return nil
-}
-
-func (f *fakequinix) CreateDevice(_ context.Context, request *packngo.DeviceCreateRequest) (*packngo.Device, error) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	rid := request.HardwareReservationID
-	res := f.reservations[rid]
-	if res == nil {
-		return nil, f.notFound()
-	}
-	if res.Device != nil {
-		return nil, f.notFound()
-	}
-
-	dev := &packngo.Device{
-		ID:    uuid.New().String(),
-		State: "active",
-		HardwareReservation: &packngo.HardwareReservation{
-			ID: rid,
-		},
-		Network: []*packngo.IPAddressAssignment{
-			{
-				IpAddressCommon: packngo.IpAddressCommon{
-					Public:  true,
-					Address: "1.2.3.4",
-				},
-			},
-		},
-		Facility: &packngo.Facility{
-			Code: "wad",
-		},
-		Hostname: request.Hostname,
-		OS: &packngo.OS{
-			Name: request.OS,
-			Slug: request.OS,
-		},
-	}
-	res.Device = dev
-	res.Provisionable = false
-
-	f.devices[dev.ID] = dev
-	return dev, nil
-}
-
-func (f *fakequinix) ListReservations(_ context.Context, pid string) ([]packngo.HardwareReservation, error) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	var res []packngo.HardwareReservation
-	for _, r := range f.reservations {
-		res = append(res, *r)
-	}
-
-	return res, nil
-}
-
-func (f *fakequinix) ListSSHKeys(_ context.Context) ([]packngo.SSHKey, error) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	var res []packngo.SSHKey
-	for _, key := range f.sshKeys {
-		res = append(res, *key)
-	}
-
-	return res, nil
-}
-
-func (f *fakequinix) CreateSSHKey(_ context.Context, req *packngo.SSHKeyCreateRequest) (*packngo.SSHKey, error) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	for _, k := range f.sshKeys {
-		if k.Key == req.Key {
-			return nil, f.notFound()
-		}
-		if k.Label == req.Label {
-			return nil, f.notFound()
-		}
-	}
-
-	uid := uuid.New().String()
-	f.sshKeys[uid] = &packngo.SSHKey{
-		ID:    uid,
-		Label: req.Label,
-		Key:   req.Key,
-	}
-
-	return f.sshKeys[uid], nil
-}
-
-func (f *fakequinix) UpdateSSHKey(_ context.Context, kid string, req *packngo.SSHKeyUpdateRequest) (*packngo.SSHKey, error) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	key := f.sshKeys[kid]
-	if key == nil {
-		return nil, f.notFound()
-	}
-	key.Key = *req.Key
-
-	return key, nil
-}
-
-func (f *fakequinix) RebootDevice(_ context.Context, did string) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	f.reboots[did]++
-
-	return nil
-}
-
-func (f *fakequinix) Close() {
-}
diff --git a/cloud/shepherd/provider/equinix/initializer_test.go b/cloud/shepherd/provider/equinix/initializer_test.go
deleted file mode 100644
index fc34a10..0000000
--- a/cloud/shepherd/provider/equinix/initializer_test.go
+++ /dev/null
@@ -1,178 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package main
-
-import (
-	"context"
-	"crypto/ed25519"
-	"crypto/rand"
-	"fmt"
-	"testing"
-	"time"
-
-	"github.com/packethost/packngo"
-	"golang.org/x/crypto/ssh"
-	"golang.org/x/time/rate"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/cloud/lib/component"
-	"source.monogon.dev/cloud/shepherd/manager"
-)
-
-type initializerDut struct {
-	f        *fakequinix
-	i        *manager.Initializer
-	bmdb     *bmdb.Connection
-	ctx      context.Context
-	provider *equinixProvider
-}
-
-func newInitializerDut(t *testing.T) *initializerDut {
-	t.Helper()
-
-	sc := providerConfig{
-		ProjectId:    "noproject",
-		KeyLabel:     "somekey",
-		DevicePrefix: "test-",
-	}
-	_, key, _ := ed25519.GenerateKey(rand.Reader)
-	k := manager.SSHKey{
-		Key: key,
-	}
-
-	f := newFakequinix(sc.ProjectId, 100)
-	provider, err := sc.New(&k, f)
-	if err != nil {
-		t.Fatalf("Could not create Provider: %v", err)
-	}
-
-	ic := manager.InitializerConfig{
-		ControlLoopConfig: manager.ControlLoopConfig{
-			DBQueryLimiter: rate.NewLimiter(rate.Every(time.Second), 10),
-		},
-		Executable: []byte("beep boop i'm a real program"),
-		TargetPath: "/fake/path",
-		Endpoint:   "example.com:1234",
-		SSHConfig: ssh.ClientConfig{
-			Timeout: time.Second,
-		},
-		SSHExecTimeout: time.Second,
-		DialSSH:        manager.FakeSSHDial,
-	}
-
-	i, err := manager.NewInitializer(provider, ic)
-	if err != nil {
-		t.Fatalf("Could not create Initializer: %v", err)
-	}
-
-	b := bmdb.BMDB{
-		Config: bmdb.Config{
-			Database: component.CockroachConfig{
-				InMemory: true,
-			},
-			ComponentName: "test",
-			RuntimeInfo:   "test",
-		},
-	}
-	conn, err := b.Open(true)
-	if err != nil {
-		t.Fatalf("Could not create in-memory BMDB: %v", err)
-	}
-
-	ctx, ctxC := context.WithCancel(context.Background())
-	t.Cleanup(ctxC)
-
-	if err := provider.SSHEquinixEnsure(ctx); err != nil {
-		t.Fatalf("Failed to ensure SSH key: %v", err)
-	}
-	go manager.RunControlLoop(ctx, conn, i)
-
-	return &initializerDut{
-		f:        f,
-		i:        i,
-		bmdb:     conn,
-		ctx:      ctx,
-		provider: provider,
-	}
-}
-
-// TestInitializerSmokes makes sure the Initializer doesn't go up in flames on
-// the happy path.
-func TestInitializerSmokes(t *testing.T) {
-	dut := newInitializerDut(t)
-	f := dut.f
-	ctx := dut.ctx
-	conn := dut.bmdb
-
-	reservations, _ := f.ListReservations(ctx, f.pid)
-	kid, err := dut.provider.sshEquinixId(ctx)
-	if err != nil {
-		t.Fatalf("Failed to retrieve equinix key ID: %v", err)
-	}
-	sess, err := conn.StartSession(ctx)
-	if err != nil {
-		t.Fatalf("Failed to create BMDB session for verifiaction: %v", err)
-	}
-
-	// Create 10 provided machines for testing.
-	for i := 0; i < 10; i++ {
-		res := reservations[i]
-		dev, _ := f.CreateDevice(ctx, &packngo.DeviceCreateRequest{
-			Hostname:              fmt.Sprintf("test-%d", i),
-			OS:                    "fake",
-			ProjectID:             f.pid,
-			HardwareReservationID: res.ID,
-			ProjectSSHKeys:        []string{kid},
-		})
-		f.mu.Lock()
-		f.devices[dev.ID].Network = []*packngo.IPAddressAssignment{
-			{
-				IpAddressCommon: packngo.IpAddressCommon{
-					ID:            "fake",
-					Address:       "1.2.3.4",
-					Management:    true,
-					AddressFamily: 4,
-					Public:        true,
-				},
-			},
-		}
-		f.mu.Unlock()
-		err = sess.Transact(ctx, func(q *model.Queries) error {
-			machine, err := q.NewMachine(ctx)
-			if err != nil {
-				return err
-			}
-			return q.MachineAddProvided(ctx, model.MachineAddProvidedParams{
-				MachineID:  machine.MachineID,
-				Provider:   model.ProviderEquinix,
-				ProviderID: dev.ID,
-			})
-		})
-		if err != nil {
-			t.Fatalf("Failed to create BMDB machine: %v", err)
-		}
-	}
-
-	// Expect to find 0 machines needing start.
-	for {
-		time.Sleep(100 * time.Millisecond)
-
-		var machines []model.MachineProvided
-		err = sess.Transact(ctx, func(q *model.Queries) error {
-			var err error
-			machines, err = q.GetMachinesForAgentStart(ctx, model.GetMachinesForAgentStartParams{
-				Limit:    100,
-				Provider: model.ProviderEquinix,
-			})
-			return err
-		})
-		if err != nil {
-			t.Fatalf("Failed to run Transaction: %v", err)
-		}
-		if len(machines) == 0 {
-			break
-		}
-	}
-}
diff --git a/cloud/shepherd/provider/equinix/main.go b/cloud/shepherd/provider/equinix/main.go
deleted file mode 100644
index 9903b04..0000000
--- a/cloud/shepherd/provider/equinix/main.go
+++ /dev/null
@@ -1,159 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package main
-
-import (
-	"context"
-	"errors"
-	"flag"
-	"fmt"
-	"os"
-	"os/signal"
-
-	"golang.org/x/crypto/ssh"
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/webug"
-	"source.monogon.dev/cloud/equinix/wrapngo"
-	"source.monogon.dev/cloud/lib/component"
-	"source.monogon.dev/cloud/shepherd/manager"
-)
-
-type Config struct {
-	Component   component.ComponentConfig
-	BMDB        bmdb.BMDB
-	WebugConfig webug.Config
-
-	SSHKey            manager.SSHKey
-	InitializerConfig manager.InitializerConfig
-	ProvisionerConfig manager.ProvisionerConfig
-	RecovererConfig   manager.RecovererConfig
-
-	API           wrapngo.Opts
-	Provider      providerConfig
-	UpdaterConfig UpdaterConfig
-}
-
-// TODO(q3k): factor this out to BMDB library?
-func runtimeInfo() string {
-	hostname, _ := os.Hostname()
-	if hostname == "" {
-		hostname = "UNKNOWN"
-	}
-	return fmt.Sprintf("host %s", hostname)
-}
-
-func (c *Config) RegisterFlags() {
-	c.Component.RegisterFlags("shepherd")
-	c.BMDB.ComponentName = "shepherd-equinix"
-	c.BMDB.RuntimeInfo = runtimeInfo()
-	c.BMDB.Database.RegisterFlags("bmdb")
-	c.WebugConfig.RegisterFlags()
-
-	c.SSHKey.RegisterFlags()
-	c.InitializerConfig.RegisterFlags()
-	c.ProvisionerConfig.RegisterFlags()
-	c.RecovererConfig.RegisterFlags()
-
-	c.API.RegisterFlags()
-	c.Provider.RegisterFlags()
-	c.UpdaterConfig.RegisterFlags()
-}
-
-func main() {
-	var c Config
-	c.RegisterFlags()
-
-	flag.Parse()
-	if flag.NArg() > 0 {
-		klog.Exitf("unexpected positional arguments: %v", flag.Args())
-	}
-
-	registry := c.Component.PrometheusRegistry()
-	c.BMDB.EnableMetrics(registry)
-
-	ctx, _ := signal.NotifyContext(context.Background(), os.Interrupt)
-	c.Component.StartPrometheus(ctx)
-
-	if c.API.APIKey == "" || c.API.User == "" {
-		klog.Exitf("-equinix_api_username and -equinix_api_key must be set")
-	}
-	c.API.MetricsRegistry = registry
-	api := wrapngo.New(&c.API)
-
-	provider, err := c.Provider.New(&c.SSHKey, api)
-	if err != nil {
-		klog.Exitf("%v", err)
-	}
-
-	sshSigner, err := c.SSHKey.Signer()
-	if err != nil {
-		klog.Exitf("%v", err)
-	}
-
-	c.InitializerConfig.SSHConfig.Auth = []ssh.AuthMethod{ssh.PublicKeys(sshSigner)}
-	// Equinix OS installations always use root.
-	c.InitializerConfig.SSHConfig.User = "root"
-	// Ignore the host key, since it's likely the first time anything logs into
-	// this device, and also because there's no way of knowing its fingerprint.
-	c.InitializerConfig.SSHConfig.HostKeyCallback = ssh.InsecureIgnoreHostKey()
-
-	provisioner, err := manager.NewProvisioner(provider, c.ProvisionerConfig)
-	if err != nil {
-		klog.Exitf("%v", err)
-	}
-
-	initializer, err := manager.NewInitializer(provider, c.InitializerConfig)
-	if err != nil {
-		klog.Exitf("%v", err)
-	}
-
-	recoverer, err := manager.NewRecoverer(provider, c.RecovererConfig)
-	if err != nil {
-		klog.Exitf("%v", err)
-	}
-
-	updater, err := c.UpdaterConfig.New(api)
-	if err != nil {
-		klog.Exitf("%v", err)
-	}
-
-	conn, err := c.BMDB.Open(true)
-	if err != nil {
-		klog.Exitf("Failed to open BMDB connection: %v", err)
-	}
-
-	go func() {
-		err = provisioner.Run(ctx, conn)
-		if err != nil {
-			klog.Exit(err)
-		}
-	}()
-	go func() {
-		err = manager.RunControlLoop(ctx, conn, initializer)
-		if err != nil {
-			klog.Exit(err)
-		}
-	}()
-	go func() {
-		err = manager.RunControlLoop(ctx, conn, recoverer)
-		if err != nil {
-			klog.Exit(err)
-		}
-	}()
-	go func() {
-		err = updater.Run(ctx, conn)
-		if err != nil {
-			klog.Exit(err)
-		}
-	}()
-	go func() {
-		if err := c.WebugConfig.Start(ctx, conn); err != nil && !errors.Is(err, ctx.Err()) {
-			klog.Exitf("Failed to start webug: %v", err)
-		}
-	}()
-
-	<-ctx.Done()
-}
diff --git a/cloud/shepherd/provider/equinix/provider.go b/cloud/shepherd/provider/equinix/provider.go
deleted file mode 100644
index 16dedf0..0000000
--- a/cloud/shepherd/provider/equinix/provider.go
+++ /dev/null
@@ -1,381 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net/netip"
-	"slices"
-	"strings"
-	"time"
-
-	"github.com/packethost/packngo"
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/cloud/equinix/wrapngo"
-	"source.monogon.dev/cloud/lib/sinbin"
-	"source.monogon.dev/cloud/shepherd"
-	"source.monogon.dev/cloud/shepherd/manager"
-)
-
-type equinixProvider struct {
-	config *providerConfig
-	api    wrapngo.Client
-	sshKey *manager.SSHKey
-
-	// badReservations is a holiday resort for Equinix hardware reservations which
-	// failed to be provisioned for some reason or another. We keep a list of them in
-	// memory just so that we don't repeatedly try to provision the same known bad
-	// machines.
-	badReservations sinbin.Sinbin[string]
-
-	reservationDeadline time.Time
-	reservationCache    []packngo.HardwareReservation
-}
-
-func (ep *equinixProvider) RebootMachine(ctx context.Context, id shepherd.ProviderID) error {
-	if err := ep.api.RebootDevice(ctx, string(id)); err != nil {
-		return fmt.Errorf("failed to reboot device: %w", err)
-	}
-
-	// TODO(issue/215): replace this
-	// This is required as Equinix doesn't reboot the machines synchronously
-	// during the API call.
-	select {
-	case <-time.After(time.Duration(ep.config.RebootWaitSeconds) * time.Second):
-	case <-ctx.Done():
-		return fmt.Errorf("while waiting for reboot: %w", ctx.Err())
-	}
-	return nil
-}
-
-func (ep *equinixProvider) ReinstallMachine(ctx context.Context, id shepherd.ProviderID) error {
-	return shepherd.ErrNotImplemented
-}
-
-func (ep *equinixProvider) GetMachine(ctx context.Context, id shepherd.ProviderID) (shepherd.Machine, error) {
-	machines, err := ep.ListMachines(ctx)
-	if err != nil {
-		return nil, err
-	}
-
-	for _, machine := range machines {
-		if machine.ID() == id {
-			return machine, nil
-		}
-	}
-
-	return nil, shepherd.ErrMachineNotFound
-}
-
-func (ep *equinixProvider) ListMachines(ctx context.Context) ([]shepherd.Machine, error) {
-	if ep.reservationDeadline.Before(time.Now()) {
-		reservations, err := ep.listReservations(ctx)
-		if err != nil {
-			return nil, err
-		}
-		ep.reservationCache = reservations
-		ep.reservationDeadline = time.Now().Add(ep.config.ReservationCacheTimeout)
-	}
-
-	devices, err := ep.managedDevices(ctx)
-	if err != nil {
-		return nil, err
-	}
-
-	machines := make([]shepherd.Machine, 0, len(ep.reservationCache)+len(devices))
-	for _, device := range devices {
-		machines = append(machines, &machine{device})
-	}
-
-	for _, res := range ep.reservationCache {
-		machines = append(machines, reservation{res})
-	}
-
-	return machines, nil
-}
-
-func (ep *equinixProvider) CreateMachine(ctx context.Context, session *bmdb.Session, request shepherd.CreateMachineRequest) (shepherd.Machine, error) {
-	if request.UnusedMachine == nil {
-		return nil, fmt.Errorf("parameter UnusedMachine is missing")
-	}
-
-	//TODO: Do we just trust the implementation to be correct?
-	res, ok := request.UnusedMachine.(reservation)
-	if !ok {
-		return nil, fmt.Errorf("invalid type for parameter UnusedMachine")
-	}
-
-	d, err := ep.provision(ctx, session, res.HardwareReservation)
-	if err != nil {
-		klog.Errorf("Failed to provision reservation %s: %v", res.HardwareReservation.ID, err)
-		until := time.Now().Add(time.Hour)
-		klog.Errorf("Adding hardware reservation %s to sinbin until %s", res.HardwareReservation.ID, until)
-		ep.badReservations.Add(res.HardwareReservation.ID, until)
-		return nil, err
-	}
-
-	return &machine{*d}, nil
-}
-
-func (ep *equinixProvider) Type() model.Provider {
-	return model.ProviderEquinix
-}
-
-type reservation struct {
-	packngo.HardwareReservation
-}
-
-func (e reservation) Failed() bool {
-	return false
-}
-
-func (e reservation) ID() shepherd.ProviderID {
-	return shepherd.InvalidProviderID
-}
-
-func (e reservation) Addr() netip.Addr {
-	return netip.Addr{}
-}
-
-func (e reservation) Availability() shepherd.Availability {
-	return shepherd.AvailabilityKnownUnused
-}
-
-type machine struct {
-	packngo.Device
-}
-
-func (e *machine) Failed() bool {
-	return e.State == "failed"
-}
-
-func (e *machine) ID() shepherd.ProviderID {
-	return shepherd.ProviderID(e.Device.ID)
-}
-
-func (e *machine) Addr() netip.Addr {
-	ni := e.GetNetworkInfo()
-
-	var addr string
-	if ni.PublicIPv4 != "" {
-		addr = ni.PublicIPv4
-	} else if ni.PublicIPv6 != "" {
-		addr = ni.PublicIPv6
-	} else {
-		klog.Errorf("missing address for machine: %v", e.ID())
-		return netip.Addr{}
-	}
-
-	a, err := netip.ParseAddr(addr)
-	if err != nil {
-		klog.Errorf("failed parsing address %q: %v", addr, err)
-		return netip.Addr{}
-	}
-
-	return a
-}
-
-func (e *machine) Availability() shepherd.Availability {
-	return shepherd.AvailabilityKnownUsed
-}
-
-// listReservations doesn't lock the mutex and expects the caller to lock.
-func (ep *equinixProvider) listReservations(ctx context.Context) ([]packngo.HardwareReservation, error) {
-	klog.Infof("Retrieving hardware reservations, this will take a while...")
-	reservations, err := ep.api.ListReservations(ctx, ep.config.ProjectId)
-	if err != nil {
-		return nil, fmt.Errorf("failed to list reservations: %w", err)
-	}
-
-	var available []packngo.HardwareReservation
-	var inUse, notProvisionable, penalized int
-	for _, reservation := range reservations {
-		if reservation.Device != nil {
-			inUse++
-			continue
-		}
-		if !reservation.Provisionable {
-			notProvisionable++
-			continue
-		}
-		if ep.badReservations.Penalized(reservation.ID) {
-			penalized++
-			continue
-		}
-		available = append(available, reservation)
-	}
-	klog.Infof("Retrieved hardware reservations: %d (total), %d (available), %d (in use), %d (not provisionable), %d (penalized)", len(reservations), len(available), inUse, notProvisionable, penalized)
-
-	return available, nil
-}
-
-// provision attempts to create a device within Equinix using given Hardware
-// Reservation rsv. The resulting device is registered with BMDB, and tagged as
-// "provided" in the process.
-func (ep *equinixProvider) provision(ctx context.Context, sess *bmdb.Session, rsv packngo.HardwareReservation) (*packngo.Device, error) {
-	klog.Infof("Creating a new device using reservation ID %s.", rsv.ID)
-	hostname := ep.config.DevicePrefix + rsv.ID[:18]
-	kid, err := ep.sshEquinixId(ctx)
-	if err != nil {
-		return nil, err
-	}
-	req := &packngo.DeviceCreateRequest{
-		Hostname:              hostname,
-		OS:                    ep.config.OS,
-		Plan:                  rsv.Plan.Slug,
-		ProjectID:             ep.config.ProjectId,
-		HardwareReservationID: rsv.ID,
-		ProjectSSHKeys:        []string{kid},
-	}
-	if ep.config.UseProjectKeys {
-		klog.Warningf("INSECURE: Machines will be created with ALL PROJECT SSH KEYS!")
-		req.ProjectSSHKeys = nil
-	}
-
-	nd, err := ep.api.CreateDevice(ctx, req)
-	if err != nil {
-		return nil, fmt.Errorf("while creating new device within Equinix: %w", err)
-	}
-	klog.Infof("Created a new device within Equinix (RID: %s, PID: %s, HOST: %s)", rsv.ID, nd.ID, hostname)
-
-	ep.reservationCache = slices.DeleteFunc(ep.reservationCache, func(v packngo.HardwareReservation) bool {
-		return rsv.ID == v.ID
-	})
-
-	err = ep.assimilate(ctx, sess, nd.ID)
-	if err != nil {
-		// TODO(serge@monogon.tech) at this point the device at Equinix isn't
-		// matched by a BMDB record. Schedule device deletion or make sure this
-		// case is being handled elsewhere.
-		return nil, err
-	}
-	return nd, nil
-}
-
-// assimilate brings in an already existing machine from Equinix into the BMDB.
-// This is only used in manual testing.
-func (ep *equinixProvider) assimilate(ctx context.Context, sess *bmdb.Session, deviceID string) error {
-	return sess.Transact(ctx, func(q *model.Queries) error {
-		// Create a new machine record within BMDB.
-		m, err := q.NewMachine(ctx)
-		if err != nil {
-			return fmt.Errorf("while creating a new machine record in BMDB: %w", err)
-		}
-
-		// Link the new machine with the Equinix device, and tag it "provided".
-		p := model.MachineAddProvidedParams{
-			MachineID:  m.MachineID,
-			ProviderID: deviceID,
-			Provider:   model.ProviderEquinix,
-		}
-		klog.Infof("Setting \"provided\" tag (ID: %s, PID: %s, Provider: %s).", p.MachineID, p.ProviderID, p.Provider)
-		if err := q.MachineAddProvided(ctx, p); err != nil {
-			return fmt.Errorf("while tagging machine active: %w", err)
-		}
-		return nil
-	})
-}
-
-// sshEquinixGet looks up the Equinix key matching providerConfig.KeyLabel,
-// returning its packngo.SSHKey instance.
-func (ep *equinixProvider) sshEquinix(ctx context.Context) (*packngo.SSHKey, error) {
-	ks, err := ep.api.ListSSHKeys(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("while listing SSH keys: %w", err)
-	}
-
-	for _, k := range ks {
-		if k.Label == ep.config.KeyLabel {
-			return &k, nil
-		}
-	}
-	return nil, ErrNoSuchKey
-}
-
-// sshEquinixId looks up the Equinix key identified by providerConfig.KeyLabel,
-// returning its Equinix-assigned UUID.
-func (ep *equinixProvider) sshEquinixId(ctx context.Context) (string, error) {
-	k, err := ep.sshEquinix(ctx)
-	if err != nil {
-		return "", err
-	}
-	return k.ID, nil
-}
-
-// sshEquinixUpdate makes sure the existing SSH key registered with Equinix
-// matches the one from sshPub.
-func (ep *equinixProvider) sshEquinixUpdate(ctx context.Context, kid string) error {
-	pub, err := ep.sshKey.PublicKey()
-	if err != nil {
-		return err
-	}
-	_, err = ep.api.UpdateSSHKey(ctx, kid, &packngo.SSHKeyUpdateRequest{
-		Key: &pub,
-	})
-	if err != nil {
-		return fmt.Errorf("while updating the SSH key: %w", err)
-	}
-	return nil
-}
-
-// sshEquinixUpload registers a new SSH key from sshPub.
-func (ep *equinixProvider) sshEquinixUpload(ctx context.Context) error {
-	pub, err := ep.sshKey.PublicKey()
-	if err != nil {
-		return fmt.Errorf("while generating public key: %w", err)
-	}
-	_, err = ep.api.CreateSSHKey(ctx, &packngo.SSHKeyCreateRequest{
-		Label:     ep.config.KeyLabel,
-		Key:       pub,
-		ProjectID: ep.config.ProjectId,
-	})
-	if err != nil {
-		return fmt.Errorf("while creating an SSH key: %w", err)
-	}
-	return nil
-}
-
-// SSHEquinixEnsure initializes the locally managed SSH key (from a persistence
-// path or explicitly set key) and updates or uploads it to Equinix. The key is
-// generated as needed The key is generated as needed
-func (ep *equinixProvider) SSHEquinixEnsure(ctx context.Context) error {
-	k, err := ep.sshEquinix(ctx)
-	switch {
-	case errors.Is(err, ErrNoSuchKey):
-		if err := ep.sshEquinixUpload(ctx); err != nil {
-			return fmt.Errorf("while uploading key: %w", err)
-		}
-		return nil
-	case err == nil:
-		if err := ep.sshEquinixUpdate(ctx, k.ID); err != nil {
-			return fmt.Errorf("while updating key: %w", err)
-		}
-		return nil
-	default:
-		return err
-	}
-}
-
-// managedDevices provides a map of device provider IDs to matching
-// packngo.Device instances. It calls Equinix API's ListDevices. The returned
-// devices are filtered according to DevicePrefix provided through Opts. The
-// returned error value, if not nil, will originate in wrapngo.
-func (ep *equinixProvider) managedDevices(ctx context.Context) (map[string]packngo.Device, error) {
-	ds, err := ep.api.ListDevices(ctx, ep.config.ProjectId)
-	if err != nil {
-		return nil, err
-	}
-	dm := map[string]packngo.Device{}
-	for _, d := range ds {
-		if strings.HasPrefix(d.Hostname, ep.config.DevicePrefix) {
-			dm[d.ID] = d
-		}
-	}
-	return dm, nil
-}
diff --git a/cloud/shepherd/provider/equinix/provider_config.go b/cloud/shepherd/provider/equinix/provider_config.go
deleted file mode 100644
index 146b010..0000000
--- a/cloud/shepherd/provider/equinix/provider_config.go
+++ /dev/null
@@ -1,100 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package main
-
-import (
-	"errors"
-	"flag"
-	"fmt"
-	"strings"
-	"time"
-
-	"source.monogon.dev/cloud/equinix/wrapngo"
-	"source.monogon.dev/cloud/shepherd/manager"
-)
-
-var (
-	ErrNoSuchKey = errors.New("no such key")
-)
-
-// providerConfig contains configuration options used by both the Initializer and
-// Provisioner components of the Shepherd. In CLI scenarios, RegisterFlags should
-// be called to configure this struct from CLI flags. Otherwise, this structure
-// should be explicitly configured, as the default values are not valid.
-type providerConfig struct {
-	// ProjectId is the Equinix project UUID used by the manager. See Equinix API
-	// documentation for details. Must be set.
-	ProjectId string
-
-	// KeyLabel specifies the ID to use when handling the Equinix-registered SSH
-	// key used to authenticate to newly created servers. Must be set.
-	KeyLabel string
-
-	// DevicePrefix applied to all devices (machines) created by the Provisioner,
-	// and used by the Provisioner to identify machines which it managed.
-	// Must be set.
-	DevicePrefix string
-
-	// OS defines the operating system new devices are created with. Its format
-	// is specified by Equinix API.
-	OS string
-
-	// UseProjectKeys defines if the provisioner adds all ssh keys defined inside
-	// the used project to every new machine. This is only used for debug purposes.
-	UseProjectKeys bool
-
-	// RebootWaitSeconds defines how many seconds to sleep after a reboot call
-	// to ensure a reboot actually happened.
-	RebootWaitSeconds int
-
-	// ReservationCacheTimeout defines how after which time the reservations should be
-	// refreshed.
-	ReservationCacheTimeout time.Duration
-}
-
-func (pc *providerConfig) check() error {
-	if pc.ProjectId == "" {
-		return fmt.Errorf("-equinix_project_id must be set")
-	}
-	if pc.KeyLabel == "" {
-		return fmt.Errorf("-equinix_ssh_key_label must be set")
-	}
-	if pc.DevicePrefix == "" {
-		return fmt.Errorf("-equinix_device_prefix must be set")
-	}
-
-	// These variables are _very_ important to configure correctly, otherwise someone
-	// running this locally with prod creds will actually destroy production
-	// data.
-	if strings.Contains(pc.KeyLabel, "FIXME") {
-		return fmt.Errorf("refusing to run with -equinix_ssh_key_label %q, please set it to something unique", pc.KeyLabel)
-	}
-	if strings.Contains(pc.DevicePrefix, "FIXME") {
-		return fmt.Errorf("refusing to run with -equinix_device_prefix %q, please set it to something unique", pc.DevicePrefix)
-	}
-
-	return nil
-}
-
-func (pc *providerConfig) RegisterFlags() {
-	flag.StringVar(&pc.ProjectId, "equinix_project_id", "", "Equinix project ID where resources will be managed")
-	flag.StringVar(&pc.KeyLabel, "equinix_ssh_key_label", "shepherd-FIXME", "Label used to identify managed SSH key in Equinix project")
-	flag.StringVar(&pc.DevicePrefix, "equinix_device_prefix", "shepherd-FIXME-", "Prefix applied to all devices (machines) in Equinix project, used to identify managed machines")
-	flag.StringVar(&pc.OS, "equinix_os", "ubuntu_20_04", "OS that provisioner will deploy on Equinix machines. Not the target OS for cluster customers.")
-	flag.BoolVar(&pc.UseProjectKeys, "equinix_use_project_keys", false, "Add all Equinix project keys to newly provisioned machines, not just the provisioner's managed key. Debug/development only.")
-	flag.IntVar(&pc.RebootWaitSeconds, "equinix_reboot_wait_seconds", 30, "How many seconds to sleep to ensure a reboot happend")
-	flag.DurationVar(&pc.ReservationCacheTimeout, "equinix_reservation_cache_timeout", time.Minute*15, "Reservation cache validity timeo")
-}
-
-func (pc *providerConfig) New(sshKey *manager.SSHKey, api wrapngo.Client) (*equinixProvider, error) {
-	if err := pc.check(); err != nil {
-		return nil, err
-	}
-
-	return &equinixProvider{
-		config: pc,
-		sshKey: sshKey,
-		api:    api,
-	}, nil
-}
diff --git a/cloud/shepherd/provider/equinix/provisioner_test.go b/cloud/shepherd/provider/equinix/provisioner_test.go
deleted file mode 100644
index 6a5b0c6..0000000
--- a/cloud/shepherd/provider/equinix/provisioner_test.go
+++ /dev/null
@@ -1,106 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package main
-
-import (
-	"context"
-	"crypto/ed25519"
-	"crypto/rand"
-	"testing"
-	"time"
-
-	"golang.org/x/time/rate"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/cloud/lib/component"
-	"source.monogon.dev/cloud/shepherd/manager"
-)
-
-// TestProvisionerSmokes makes sure the Provisioner doesn't go up in flames on
-// the happy path.
-func TestProvisionerSmokes(t *testing.T) {
-	pc := manager.ProvisionerConfig{
-		MaxCount: 10,
-		// We need 3 iterations to provide 10 machines with a chunk size of 4.
-		ReconcileLoopLimiter:  rate.NewLimiter(rate.Every(10*time.Second), 3),
-		DeviceCreationLimiter: rate.NewLimiter(rate.Every(time.Second), 10),
-		ChunkSize:             4,
-	}
-	sc := providerConfig{
-		ProjectId:    "noproject",
-		KeyLabel:     "somekey",
-		DevicePrefix: "test-",
-	}
-
-	_, key, _ := ed25519.GenerateKey(rand.Reader)
-	k := manager.SSHKey{
-		Key: key,
-	}
-
-	f := newFakequinix(sc.ProjectId, 100)
-	provider, err := sc.New(&k, f)
-	if err != nil {
-		t.Fatalf("Could not create Provider: %v", err)
-	}
-
-	p, err := manager.NewProvisioner(provider, pc)
-	if err != nil {
-		t.Fatalf("Could not create Provisioner: %v", err)
-	}
-
-	ctx, ctxC := context.WithCancel(context.Background())
-	defer ctxC()
-
-	b := bmdb.BMDB{
-		Config: bmdb.Config{
-			Database: component.CockroachConfig{
-				InMemory: true,
-			},
-			ComponentName: "test",
-			RuntimeInfo:   "test",
-		},
-	}
-	conn, err := b.Open(true)
-	if err != nil {
-		t.Fatalf("Could not create in-memory BMDB: %v", err)
-	}
-
-	if err := provider.SSHEquinixEnsure(ctx); err != nil {
-		t.Fatalf("Failed to ensure SSH key: %v", err)
-	}
-	go p.Run(ctx, conn)
-
-	sess, err := conn.StartSession(ctx)
-	if err != nil {
-		t.Fatalf("Failed to create BMDB session for verification: %v", err)
-	}
-	for {
-		time.Sleep(100 * time.Millisecond)
-
-		var provided []model.MachineProvided
-		err = sess.Transact(ctx, func(q *model.Queries) error {
-			var err error
-			provided, err = q.GetProvidedMachines(ctx, model.ProviderEquinix)
-			return err
-		})
-		if err != nil {
-			t.Errorf("Transact failed: %v", err)
-		}
-		if len(provided) < 10 {
-			continue
-		}
-		if len(provided) > 10 {
-			t.Errorf("%d machines provided (limit: 10)", len(provided))
-		}
-
-		for _, mp := range provided {
-			if f.devices[mp.ProviderID] == nil {
-				t.Errorf("BMDB machine %q has unknown provider ID %q", mp.MachineID, mp.ProviderID)
-			}
-		}
-
-		return
-	}
-}
diff --git a/cloud/shepherd/provider/equinix/recoverer_test.go b/cloud/shepherd/provider/equinix/recoverer_test.go
deleted file mode 100644
index 6d1447f..0000000
--- a/cloud/shepherd/provider/equinix/recoverer_test.go
+++ /dev/null
@@ -1,184 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package main
-
-import (
-	"context"
-	"crypto/ed25519"
-	"crypto/rand"
-	"testing"
-	"time"
-
-	"github.com/packethost/packngo"
-	"golang.org/x/time/rate"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/cloud/lib/component"
-	"source.monogon.dev/cloud/shepherd/manager"
-)
-
-type recovererDut struct {
-	f    *fakequinix
-	r    *manager.Recoverer
-	bmdb *bmdb.Connection
-	ctx  context.Context
-}
-
-func newRecovererDut(t *testing.T) *recovererDut {
-	t.Helper()
-
-	rc := manager.RecovererConfig{
-		ControlLoopConfig: manager.ControlLoopConfig{
-			DBQueryLimiter: rate.NewLimiter(rate.Every(time.Second), 10),
-		},
-	}
-
-	sc := providerConfig{
-		ProjectId:    "noproject",
-		KeyLabel:     "somekey",
-		DevicePrefix: "test-",
-	}
-
-	_, key, _ := ed25519.GenerateKey(rand.Reader)
-	k := manager.SSHKey{
-		Key: key,
-	}
-
-	f := newFakequinix(sc.ProjectId, 100)
-	provider, err := sc.New(&k, f)
-	if err != nil {
-		t.Fatalf("Could not create Provider: %v", err)
-	}
-
-	r, err := manager.NewRecoverer(provider, rc)
-	if err != nil {
-		t.Fatalf("Could not create Initializer: %v", err)
-	}
-
-	b := bmdb.BMDB{
-		Config: bmdb.Config{
-			Database: component.CockroachConfig{
-				InMemory: true,
-			},
-			ComponentName: "test",
-			RuntimeInfo:   "test",
-		},
-	}
-	conn, err := b.Open(true)
-	if err != nil {
-		t.Fatalf("Could not create in-memory BMDB: %v", err)
-	}
-
-	ctx, ctxC := context.WithCancel(context.Background())
-	t.Cleanup(ctxC)
-
-	go manager.RunControlLoop(ctx, conn, r)
-
-	return &recovererDut{
-		f:    f,
-		r:    r,
-		bmdb: conn,
-		ctx:  ctx,
-	}
-}
-
-// TestRecoverySmokes makes sure that the Initializer in recovery mode doesn't go
-// up in flames on the happy path.
-func TestRecoverySmokes(t *testing.T) {
-	dut := newRecovererDut(t)
-	f := dut.f
-	ctx := dut.ctx
-	conn := dut.bmdb
-
-	reservations, _ := f.ListReservations(ctx, "fake")
-
-	sess, err := conn.StartSession(ctx)
-	if err != nil {
-		t.Fatalf("Failed to create BMDB session: %v", err)
-	}
-
-	// Create test machine that should be selected for recovery.
-	// First in Fakequinix...
-	dev, _ := f.CreateDevice(ctx, &packngo.DeviceCreateRequest{
-		Hostname:              "test-devices",
-		OS:                    "fake",
-		ProjectID:             "fake",
-		HardwareReservationID: reservations[0].ID,
-		ProjectSSHKeys:        []string{},
-	})
-	// ... and in BMDB.
-	err = sess.Transact(ctx, func(q *model.Queries) error {
-		machine, err := q.NewMachine(ctx)
-		if err != nil {
-			return err
-		}
-		err = q.MachineAddProvided(ctx, model.MachineAddProvidedParams{
-			MachineID:  machine.MachineID,
-			Provider:   model.ProviderEquinix,
-			ProviderID: dev.ID,
-		})
-		if err != nil {
-			return err
-		}
-		return q.MachineSetAgentStarted(ctx, model.MachineSetAgentStartedParams{
-			MachineID:      machine.MachineID,
-			AgentStartedAt: time.Now().Add(time.Hour * -10),
-			AgentPublicKey: []byte("fakefakefakefake"),
-		})
-	})
-	if err != nil {
-		t.Fatalf("Failed to create test machine: %v", err)
-	}
-
-	// Expect to find 0 machines needing recovery.
-	deadline := time.Now().Add(10 * time.Second)
-	for {
-		if time.Now().After(deadline) {
-			t.Fatalf("Machines did not get processed in time")
-		}
-		time.Sleep(100 * time.Millisecond)
-
-		var machines []model.MachineProvided
-		err = sess.Transact(ctx, func(q *model.Queries) error {
-			var err error
-			machines, err = q.GetMachineForAgentRecovery(ctx, model.GetMachineForAgentRecoveryParams{
-				Limit:    100,
-				Provider: model.ProviderEquinix,
-			})
-			return err
-		})
-		if err != nil {
-			t.Fatalf("Failed to run Transaction: %v", err)
-		}
-		if len(machines) == 0 {
-			break
-		}
-	}
-
-	// Expect the target machine to have been rebooted.
-	dut.f.mu.Lock()
-	reboots := dut.f.reboots[dev.ID]
-	dut.f.mu.Unlock()
-	if want, got := 1, reboots; want != got {
-		t.Fatalf("Wanted %d reboot, got %d", want, got)
-	}
-
-	// Expect machine to now be available again for agent start.
-	var machines []model.MachineProvided
-	err = sess.Transact(ctx, func(q *model.Queries) error {
-		var err error
-		machines, err = q.GetMachinesForAgentStart(ctx, model.GetMachinesForAgentStartParams{
-			Limit:    100,
-			Provider: model.ProviderEquinix,
-		})
-		return err
-	})
-	if err != nil {
-		t.Fatalf("Failed to run Transaction: %v", err)
-	}
-	if want, got := 1, len(machines); want != got {
-		t.Fatalf("Wanted %d machine ready for agent start, got %d", want, got)
-	}
-}
diff --git a/cloud/shepherd/provider/equinix/updater.go b/cloud/shepherd/provider/equinix/updater.go
deleted file mode 100644
index 5b6e089..0000000
--- a/cloud/shepherd/provider/equinix/updater.go
+++ /dev/null
@@ -1,266 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package main
-
-import (
-	"context"
-	"database/sql"
-	"errors"
-	"flag"
-	"fmt"
-	"time"
-
-	"github.com/packethost/packngo"
-	"k8s.io/klog/v2"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/metrics"
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	ecl "source.monogon.dev/cloud/equinix/wrapngo"
-	"source.monogon.dev/cloud/lib/sinbin"
-)
-
-type UpdaterConfig struct {
-	// Enable starts the updater.
-	Enable bool
-	// IterationRate is the minimu mtime taken between subsequent iterations of the
-	// updater.
-	IterationRate time.Duration
-}
-
-func (u *UpdaterConfig) RegisterFlags() {
-	flag.BoolVar(&u.Enable, "updater_enable", true, "Enable the updater, which periodically scans equinix machines and updates their status in the BMDB")
-	flag.DurationVar(&u.IterationRate, "updater_iteration_rate", time.Minute, "Rate limiting for updater iteration loop")
-}
-
-// The Updater periodically scans all machines backed by the equinix provider and
-// updaters their Provided status fields based on data retrieved from the Equinix
-// API.
-type Updater struct {
-	config *UpdaterConfig
-	sinbin sinbin.Sinbin[string]
-
-	cl ecl.Client
-}
-
-func (u *UpdaterConfig) New(cl ecl.Client) (*Updater, error) {
-	return &Updater{
-		config: u,
-		cl:     cl,
-	}, nil
-}
-
-func (u *Updater) Run(ctx context.Context, conn *bmdb.Connection) error {
-	var sess *bmdb.Session
-	var err error
-
-	if !u.config.Enable {
-		return nil
-	}
-
-	for {
-		if sess == nil {
-			sess, err = conn.StartSession(ctx, bmdb.SessionOption{Processor: metrics.ProcessorShepherdUpdater})
-			if err != nil {
-				return fmt.Errorf("could not start BMDB session: %w", err)
-			}
-		}
-		limit := time.After(u.config.IterationRate)
-
-		err = u.runInSession(ctx, sess)
-		switch {
-		case err == nil:
-			<-limit
-		case errors.Is(err, ctx.Err()):
-			return err
-		case errors.Is(err, bmdb.ErrSessionExpired):
-			klog.Errorf("Session expired, restarting...")
-			sess = nil
-			time.Sleep(time.Second)
-		default:
-			klog.Errorf("Processing failed: %v", err)
-			// TODO(q3k): close session
-			time.Sleep(time.Second)
-		}
-	}
-}
-
-// applyNullStringUpdate returns true if 'up' supersedes 'cur'. Otherwise, it
-// returns false and zeroes out up.
-func applyNullStringUpdate(up, cur *sql.NullString) bool {
-	if up.Valid {
-		if !cur.Valid {
-			return true
-		}
-		if up.String != cur.String {
-			return true
-		}
-	}
-	up.String = ""
-	up.Valid = false
-	return false
-}
-
-// applyNullProviderStatusUpdate returns true if 'up' supersedes 'cur'.
-// Otherwise, it returns false and zeroes out up.
-func applyNullProviderStatusUpdate(up, cur *model.NullProviderStatus) bool {
-	if up.Valid {
-		if !cur.Valid {
-			return true
-		}
-		if up.ProviderStatus != cur.ProviderStatus {
-			return true
-		}
-	}
-	up.ProviderStatus = model.ProviderStatusUnknown
-	up.Valid = false
-	return false
-}
-
-// applyUpdate returns true if 'up' supersedes 'cur'. Otherwise, it returns false
-// and zeroes out up.
-func applyUpdate(up *model.MachineUpdateProviderStatusParams, cur *model.MachineProvided) bool {
-	res := false
-	res = res || applyNullStringUpdate(&up.ProviderReservationID, &cur.ProviderReservationID)
-	res = res || applyNullStringUpdate(&up.ProviderIpAddress, &cur.ProviderIpAddress)
-	res = res || applyNullStringUpdate(&up.ProviderLocation, &cur.ProviderLocation)
-	res = res || applyNullProviderStatusUpdate(&up.ProviderStatus, &cur.ProviderStatus)
-	return res
-}
-
-// updateLog logs information about the given update as calculated by applyUpdate.
-func updateLog(up *model.MachineUpdateProviderStatusParams) {
-	if up.ProviderReservationID.Valid {
-		klog.Infof("   Machine %s: new reservation ID %s", up.ProviderID, up.ProviderReservationID.String)
-	}
-	if up.ProviderIpAddress.Valid {
-		klog.Infof("   Machine %s: new IP address %s", up.ProviderID, up.ProviderIpAddress.String)
-	}
-	if up.ProviderLocation.Valid {
-		klog.Infof("   Machine %s: new location %s", up.ProviderID, up.ProviderLocation.String)
-	}
-	if up.ProviderStatus.Valid {
-		klog.Infof("   Machine %s: new status %s", up.ProviderID, up.ProviderStatus.ProviderStatus)
-	}
-}
-
-func (u *Updater) runInSession(ctx context.Context, sess *bmdb.Session) error {
-	// Get all machines provided by us into the BMDB.
-	// TODO(q3k): do not load all machines into memory.
-
-	var machines []model.MachineProvided
-	err := sess.Transact(ctx, func(q *model.Queries) error {
-		var err error
-		machines, err = q.GetProvidedMachines(ctx, model.ProviderEquinix)
-		return err
-	})
-	if err != nil {
-		return fmt.Errorf("when fetching provided machines: %w", err)
-	}
-
-	// Limit how many machines we check by timing them out if they're likely to not
-	// get updated soon.
-	penalized := 0
-	var check []model.MachineProvided
-	for _, m := range machines {
-		if u.sinbin.Penalized(m.ProviderID) {
-			penalized += 1
-		} else {
-			check = append(check, m)
-		}
-	}
-
-	klog.Infof("Machines to check %d, skipping: %d", len(check), penalized)
-	for _, m := range check {
-		dev, err := u.cl.GetDevice(ctx, "", m.ProviderID, &packngo.ListOptions{
-			Includes: []string{
-				"hardware_reservation",
-			},
-			Excludes: []string{
-				"created_by", "customdata", "network_ports", "operating_system", "actions",
-				"plan", "provisioning_events", "ssh_keys", "tags", "volumes",
-			},
-		})
-		if err != nil {
-			klog.Warningf("Fetching device %s failed: %v", m.ProviderID, err)
-			continue
-		}
-
-		// nextCheck will be used to sinbin the machine for some given time if there is
-		// no difference between the current state and new state.
-		//
-		// Some conditions override this to be shorter (when the machine doesn't yet have
-		// all data available or is in an otherwise unstable state).
-		nextCheck := time.Minute * 30
-
-		up := model.MachineUpdateProviderStatusParams{
-			Provider:   m.Provider,
-			ProviderID: m.ProviderID,
-		}
-
-		if dev.HardwareReservation != nil {
-			up.ProviderReservationID.Valid = true
-			up.ProviderReservationID.String = dev.HardwareReservation.ID
-		} else {
-			nextCheck = time.Minute
-		}
-
-		for _, addr := range dev.Network {
-			if !addr.Public {
-				continue
-			}
-			up.ProviderIpAddress.Valid = true
-			up.ProviderIpAddress.String = addr.Address
-			break
-		}
-		if !up.ProviderIpAddress.Valid {
-			nextCheck = time.Minute
-		}
-
-		if dev.Facility != nil {
-			up.ProviderLocation.Valid = true
-			up.ProviderLocation.String = dev.Facility.Code
-		} else {
-			nextCheck = time.Minute
-		}
-
-		up.ProviderStatus.Valid = true
-		switch dev.State {
-		case "active":
-			up.ProviderStatus.ProviderStatus = model.ProviderStatusRunning
-		case "deleted":
-			up.ProviderStatus.ProviderStatus = model.ProviderStatusMissing
-		case "failed":
-			up.ProviderStatus.ProviderStatus = model.ProviderStatusProvisioningFailedPermanent
-		case "inactive":
-			up.ProviderStatus.ProviderStatus = model.ProviderStatusStopped
-		case "powering_on", "powering_off":
-			nextCheck = time.Minute
-			up.ProviderStatus.ProviderStatus = model.ProviderStatusStopped
-		case "queued", "provisioning", "reinstalling", "post_provisioning":
-			nextCheck = time.Minute
-			up.ProviderStatus.ProviderStatus = model.ProviderStatusProvisioning
-		default:
-			klog.Warningf("Device %s has unexpected status: %q", m.ProviderID, dev.State)
-			nextCheck = time.Minute
-			up.ProviderStatus.ProviderStatus = model.ProviderStatusUnknown
-		}
-
-		if !applyUpdate(&up, &m) {
-			u.sinbin.Add(m.ProviderID, time.Now().Add(nextCheck))
-			continue
-		}
-
-		klog.Infof("Device %s has new data:", m.ProviderID)
-		updateLog(&up)
-		err = sess.Transact(ctx, func(q *model.Queries) error {
-			return q.MachineUpdateProviderStatus(ctx, up)
-		})
-		if err != nil {
-			klog.Warningf("Device %s failed to update: %v", m.ProviderID, err)
-		}
-		u.sinbin.Add(m.ProviderID, time.Now().Add(time.Minute))
-	}
-	return nil
-}
diff --git a/cloud/shepherd/provider/equinix/updater_test.go b/cloud/shepherd/provider/equinix/updater_test.go
deleted file mode 100644
index ed3da7a..0000000
--- a/cloud/shepherd/provider/equinix/updater_test.go
+++ /dev/null
@@ -1,146 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package main
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/packethost/packngo"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-	"source.monogon.dev/cloud/lib/component"
-)
-
-type updaterDut struct {
-	f    *fakequinix
-	u    *Updater
-	bmdb *bmdb.Connection
-	ctx  context.Context
-}
-
-func newUpdaterDut(t *testing.T) *updaterDut {
-	t.Helper()
-
-	uc := UpdaterConfig{
-		Enable:        true,
-		IterationRate: time.Second,
-	}
-
-	f := newFakequinix("fake", 100)
-	u, err := uc.New(f)
-	if err != nil {
-		t.Fatalf("Could not create Updater: %v", err)
-	}
-
-	b := bmdb.BMDB{
-		Config: bmdb.Config{
-			Database: component.CockroachConfig{
-				InMemory: true,
-			},
-			ComponentName: "test",
-			RuntimeInfo:   "test",
-		},
-	}
-	conn, err := b.Open(true)
-	if err != nil {
-		t.Fatalf("Could not create in-memory BMDB: %v", err)
-	}
-
-	ctx, ctxC := context.WithCancel(context.Background())
-	t.Cleanup(ctxC)
-
-	go u.Run(ctx, conn)
-
-	return &updaterDut{
-		f:    f,
-		u:    u,
-		bmdb: conn,
-		ctx:  ctx,
-	}
-}
-
-func TestUpdater(t *testing.T) {
-	dut := newUpdaterDut(t)
-	f := dut.f
-	ctx := dut.ctx
-	conn := dut.bmdb
-
-	reservations, _ := f.ListReservations(ctx, "fake")
-
-	sess, err := conn.StartSession(ctx)
-	if err != nil {
-		t.Fatalf("Failed to create BMDB session: %v", err)
-	}
-
-	// Create test machine that should be selected for updating.
-	// First in Fakequinix...
-	dev, _ := f.CreateDevice(ctx, &packngo.DeviceCreateRequest{
-		Hostname:              "test-devices",
-		OS:                    "fake",
-		ProjectID:             "fake",
-		HardwareReservationID: reservations[0].ID,
-		ProjectSSHKeys:        []string{},
-	})
-	// ... and in BMDB.
-	err = sess.Transact(ctx, func(q *model.Queries) error {
-		machine, err := q.NewMachine(ctx)
-		if err != nil {
-			return err
-		}
-		err = q.MachineAddProvided(ctx, model.MachineAddProvidedParams{
-			MachineID:  machine.MachineID,
-			Provider:   model.ProviderEquinix,
-			ProviderID: dev.ID,
-		})
-		if err != nil {
-			return err
-		}
-		return q.MachineSetAgentStarted(ctx, model.MachineSetAgentStartedParams{
-			MachineID:      machine.MachineID,
-			AgentStartedAt: time.Now().Add(time.Hour * -10),
-			AgentPublicKey: []byte("fakefakefakefake"),
-		})
-	})
-	if err != nil {
-		t.Fatalf("failed to execute bmdb transaction: %v", err)
-	}
-
-	deadline := time.Now().Add(time.Second * 10)
-	for {
-		time.Sleep(100 * time.Millisecond)
-		if time.Now().After(deadline) {
-			t.Fatalf("Deadline exceeded")
-		}
-
-		var provided []model.MachineProvided
-		err = sess.Transact(ctx, func(q *model.Queries) error {
-			var err error
-			provided, err = q.GetProvidedMachines(ctx, model.ProviderEquinix)
-			return err
-		})
-		if err != nil {
-			t.Fatalf("Transact: %v", err)
-		}
-		if len(provided) < 1 {
-			continue
-		}
-		p := provided[0]
-		if p.ProviderStatus.ProviderStatus != model.ProviderStatusRunning {
-			continue
-		}
-		if p.ProviderLocation.String != "wad" {
-			continue
-		}
-		if p.ProviderIpAddress.String != "1.2.3.4" {
-			continue
-		}
-		if p.ProviderReservationID.String != reservations[0].ID {
-			continue
-		}
-		break
-	}
-}
diff --git a/cloud/shepherd/shepherd.go b/cloud/shepherd/shepherd.go
deleted file mode 100644
index aeaab46..0000000
--- a/cloud/shepherd/shepherd.go
+++ /dev/null
@@ -1,126 +0,0 @@
-// Copyright The Monogon Project Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package shepherd
-
-import (
-	"context"
-	"fmt"
-	"net/netip"
-
-	"source.monogon.dev/cloud/bmaas/bmdb"
-	"source.monogon.dev/cloud/bmaas/bmdb/model"
-)
-
-var ErrMachineNotFound = fmt.Errorf("machine not found")
-var ErrNotImplemented = fmt.Errorf("not implemented")
-
-// ProviderID is an opaque unique identifier for a machine within a single
-// provider instance. It is generated by the Provider and usually the same
-// as the ID of the machine within the system that the Provider managed.
-// The Shepherd (and BMaaS in general) requires these IDs to be unique
-// within a provider and stable.
-type ProviderID string
-
-const InvalidProviderID ProviderID = "invalid"
-
-// IsValid reports whether the ProviderID is valid.
-func (p ProviderID) IsValid() bool {
-	return p != InvalidProviderID
-}
-
-// Availability defines the availability state according to the provider.
-// See the different states for more information.
-type Availability int
-
-const (
-	// AvailabilityUndefined is used as a placeholder to prevent that the default
-	// value can create any type of bad behaviour.
-	AvailabilityUndefined Availability = iota
-	// AvailabilityPossiblyUsed defines the state where a machine is possibly used,
-	// this is a state for use in stateless providers where the shepherd has
-	// to check against the bmdb if Machine.ID is already provisioned or not.
-	// These machines must have a valid ID and Addr.
-	AvailabilityPossiblyUsed
-	// AvailabilityKnownUnused defines the state where a machine is know to be free,
-	// e.g. a hardware reservation at equinix. These machines may not have an
-	// ID or Addr.
-	AvailabilityKnownUnused
-	// AvailabilityKnownUsed defines the state where a machine is known to be used,
-	// e.g. a deployed machine that is in use. These machines must have a
-	// valid ID and Addr.
-	AvailabilityKnownUsed
-)
-
-func (a Availability) String() string {
-	switch a {
-	case AvailabilityUndefined:
-		return "Undefined"
-	case AvailabilityKnownUnused:
-		return "KnownUnused"
-	case AvailabilityKnownUsed:
-		return "KnownUsed"
-	case AvailabilityPossiblyUsed:
-		return "PossiblyUsed"
-	default:
-		return fmt.Sprintf("<invalid value %d>", a)
-	}
-}
-
-type Machine interface {
-	// ID returns the provider id, see ProviderID for more information.
-	ID() ProviderID
-	// Addr returns the machines ip address that is reachable from the
-	// shepherd. It is used to connect to the machine via SSH to execute
-	// all takeover tasks, etc.
-	Addr() netip.Addr
-	// Availability returns the availability of the machine.
-	Availability() Availability
-	// Failed should return true if the machine is in a failed state and
-	// should be ignored if there are inconsistencies between the provider
-	// and BMDB.
-	Failed() bool
-}
-
-type CreateMachineRequest struct {
-	// UnusedMachine resembles a machine to use as deployment target.
-	UnusedMachine Machine
-}
-
-// Provider is the interface that is used to abstract the interaction between
-// the shepherd and machine providers like Equinix. All methods inside this
-// interface must not be called concurrently.
-type Provider interface {
-	// ListMachines returns all existing machines for a provider. Machines
-	// that are still in the state of being created by CreateMachine should
-	// not be returned.
-	ListMachines(context.Context) ([]Machine, error)
-
-	// GetMachine returns an existing machine for a provider. Machines
-	// that are still in the state of being created by CreateMachine should
-	// not be returned. If a there are no machines found after these filters
-	// an error should be returned.
-	GetMachine(context.Context, ProviderID) (Machine, error)
-
-	// CreateMachine creates a new machine with the given parameters and
-	// returns the created instance. The provider is required to create the
-	// entry into the machine table and MachineProvided tag. If there are no
-	// more machines avaiable, an error should be returned.
-	CreateMachine(context.Context, *bmdb.Session, CreateMachineRequest) (Machine, error)
-
-	// Type returns the value that represents this provider inside the database.
-	Type() model.Provider
-}
-
-type Recoverer interface {
-	Provider
-
-	// RebootMachine tries to bring a machine back from the dead by e.g. rebooting
-	RebootMachine(context.Context, ProviderID) error
-
-	// ReinstallMachine should reinstall the given machine and if the provider
-	// does not support reinstallation, the function should return an error
-	// stating this. If reinstalled, the installed tag should be updated to
-	// allow the reconcile loop to restart the takeover process.
-	ReinstallMachine(context.Context, ProviderID) error
-}
diff --git a/go.mod b/go.mod
index 5077a2b..1118465 100644
--- a/go.mod
+++ b/go.mod
@@ -58,7 +58,6 @@
 	github.com/bazelbuild/rules_go v0.54.0
 	github.com/cavaliergopher/cpio v1.0.1
 	github.com/cenkalti/backoff/v4 v4.3.0
-	github.com/cockroachdb/cockroach-go/v2 v2.2.10
 	github.com/container-storage-interface/spec v1.9.0
 	github.com/containerd/containerd/v2 v2.0.1
 	github.com/containernetworking/plugins v1.6.1
@@ -67,7 +66,6 @@
 	github.com/diskfs/go-diskfs v1.2.0
 	github.com/gdamore/tcell/v2 v2.7.4
 	github.com/go-delve/delve v1.24.0
-	github.com/golang-migrate/migrate/v4 v4.15.2
 	github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d
 	github.com/google/cel-go v0.22.1
 	github.com/google/certificate-transparency-go v1.1.2
@@ -77,13 +75,10 @@
 	github.com/google/gopacket v1.1.19
 	github.com/google/nftables v0.3.1-0.20250326085720-8095c5167898
 	github.com/google/uuid v1.6.0
-	github.com/iancoleman/strcase v0.3.0
-	github.com/improbable-eng/grpc-web v0.15.0
 	github.com/insomniacslk/dhcp v0.0.0-20240829085014-a3a4c1f04475
 	github.com/joho/godotenv v1.4.0
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
 	github.com/klauspost/compress v1.17.11
-	github.com/lib/pq v1.10.9
 	github.com/mattfenwick/cyclonus v0.5.6
 	github.com/mattn/go-shellwords v1.0.12
 	github.com/mdlayher/arp v0.0.0-20220512170110-6706a2966875
@@ -98,7 +93,6 @@
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.0
 	github.com/opencontainers/runc v1.2.2
-	github.com/packethost/packngo v0.29.0
 	github.com/pkg/errors v0.9.1
 	github.com/pkg/sftp v1.13.8
 	github.com/prometheus/client_golang v1.21.0
@@ -142,7 +136,6 @@
 	k8s.io/cli-runtime v0.32.0
 	k8s.io/client-go v0.32.0
 	k8s.io/component-base v0.32.0
-	k8s.io/klog/v2 v2.130.1
 	k8s.io/kubectl v0.32.0
 	k8s.io/kubelet v0.32.0
 	k8s.io/kubernetes v1.32.0
@@ -222,7 +215,6 @@
 	github.com/dennwc/btrfs v0.0.0-20240418142341-0167142bde7a // indirect
 	github.com/dennwc/ioctl v1.0.0 // indirect
 	github.com/derekparker/trie v0.0.0-20230829180723-39f4de51ef7d // indirect
-	github.com/desertbit/timer v0.0.0-20180107155436-c41aec40b27f // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
 	github.com/docker/go-metrics v0.0.1 // indirect
@@ -238,7 +230,6 @@
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
 	github.com/gdamore/encoding v1.0.0 // indirect
-	github.com/gin-gonic/gin v1.9.1 // indirect
 	github.com/go-delve/liner v1.2.3-0.20231231155935-4726ab1d7f62 // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-jose/go-jose/v4 v4.0.4 // indirect
@@ -275,9 +266,7 @@
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway v1.16.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 // indirect
-	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-envparse v0.1.0 // indirect
-	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/golang-lru v1.0.2 // indirect
 	github.com/hodgesds/perf-utils v0.7.0 // indirect
 	github.com/igrmk/treemap/v2 v2.0.1 // indirect
@@ -365,7 +354,6 @@
 	github.com/riza-io/grpc-go v0.2.0 // indirect
 	github.com/robfig/cron/v3 v3.0.1 // indirect
 	github.com/rogpeppe/go-internal v1.13.1 // indirect
-	github.com/rs/cors v1.8.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/safchain/ethtool v0.5.10 // indirect
 	github.com/sassoftware/go-rpmutils v0.1.1 // indirect
@@ -439,6 +427,7 @@
 	k8s.io/endpointslice v0.0.0 // indirect
 	k8s.io/externaljwt v0.0.0 // indirect
 	k8s.io/klog v1.0.0 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kms v0.32.0 // indirect
 	k8s.io/kube-aggregator v0.0.0 // indirect
 	k8s.io/kube-controller-manager v0.0.0 // indirect
@@ -446,7 +435,6 @@
 	k8s.io/kube-scheduler v0.0.0 // indirect
 	k8s.io/metrics v0.32.0 // indirect
 	k8s.io/mount-utils v0.0.0 // indirect
-	nhooyr.io/websocket v1.8.6 // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.0 // indirect
 	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
 	sigs.k8s.io/knftables v0.0.18 // indirect
diff --git a/go.sum b/go.sum
index c35454b..d7d264a 100644
--- a/go.sum
+++ b/go.sum
@@ -1,9 +1,7 @@
 4d63.com/gocheckcompilerdirectives v1.2.1 h1:AHcMYuw56NPjq/2y615IGg2kYkBdTvOaojYCBcRE7MA=
 4d63.com/gocheckcompilerdirectives v1.2.1/go.mod h1:yjDJSxmDTtIHHCqX0ufRYZDL6vQtMG7tJdKVeWwsqvs=
 4d63.com/gochecknoinits v0.0.0-20200108094044-eb73b47b9fc4/go.mod h1:4o1i5aXtIF5tJFt3UD1knCVmWOXg7fLYdHVu6jeNcnM=
-bazil.org/fuse v0.0.0-20160811212531-371fbbdaa898/go.mod h1:Xbm+BRKSBEpa4q4hTSxohYNQpsxXPbPry4JJWOB3LB8=
 bazil.org/fuse v0.0.0-20180421153158-65cc252bf669/go.mod h1:Xbm+BRKSBEpa4q4hTSxohYNQpsxXPbPry4JJWOB3LB8=
-bazil.org/fuse v0.0.0-20200407214033-5883e5a4b512/go.mod h1:FbcW6z/2VytnFDhZfumh8Ss8zxHE6qpMP5sHTRe0EaM=
 bitbucket.org/bertimus9/systemstat v0.5.0/go.mod h1:EkUWPp8lKFPMXP8vnbpT5JDI0W/sTiLZAvN8ONWErHY=
 bitbucket.org/creachadair/shell v0.0.6/go.mod h1:8Qqi/cYk7vPnsOePHroKXDJYmb5x7ENhtiFtfZq8K+M=
 cel.dev/expr v0.15.0/go.mod h1:TRSuuV7DlVCE/uwv5QbAiW/v8l5O8C4eEPHeu7gf7Sg=
@@ -43,7 +41,6 @@
 cloud.google.com/go v0.93.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
 cloud.google.com/go v0.94.1/go.mod h1:qAlAugsXlC+JWO+Bke5vCtc9ONxjQT3drlTTnAplMW4=
 cloud.google.com/go v0.97.0/go.mod h1:GF7l59pYBVlXQIBLx3a761cZ41F9bBH3JUlihCt2Udc=
-cloud.google.com/go v0.98.0/go.mod h1:ua6Ush4NALrHk5QXDWnjvZHN93OuF0HfuEPq9I1X0cM=
 cloud.google.com/go v0.99.0/go.mod h1:w0Xx2nLzqWJPuozYQX+hFfCSI8WioryfRDzkoI/Y2ZA=
 cloud.google.com/go v0.100.1/go.mod h1:fs4QogzfH5n2pBXBP9vRiU+eCny7lD2vmFZy79Iuw1U=
 cloud.google.com/go v0.100.2/go.mod h1:4Xra9TjzAeYHrl5+oeLlzbM2k3mjVhZh4UqTZ//w99A=
@@ -1160,7 +1157,6 @@
 cloud.google.com/go/spanner v1.17.0/go.mod h1:+17t2ixFwRG4lWRwE+5kipDR9Ef07Jkmc8z0IbMDKUs=
 cloud.google.com/go/spanner v1.18.0/go.mod h1:LvAjUXPeJRGNuGpikMULjhLj/t9cRvdc+fxRoLiugXA=
 cloud.google.com/go/spanner v1.25.0/go.mod h1:kQUft3x355hzzaeFbObjsvkzZDgpDkesp3v75WBnI8w=
-cloud.google.com/go/spanner v1.28.0/go.mod h1:7m6mtQZn/hMbMfx62ct5EWrGND4DNqkXyrmBPRS+OJo=
 cloud.google.com/go/spanner v1.41.0/go.mod h1:MLYDBJR/dY4Wt7ZaMIQ7rXOTLjYrmxLE/5ve9vFfWos=
 cloud.google.com/go/spanner v1.44.0/go.mod h1:G8XIgYdOK+Fbcpbs7p2fiprDw4CaZX63whnSMLVBxjk=
 cloud.google.com/go/spanner v1.45.0/go.mod h1:FIws5LowYz8YAE1J8fOS7DJup8ff7xJeetWEo5REA2M=
@@ -1369,39 +1365,25 @@
 git.dolansoft.org/dolansoft/k8s-nft-npc v0.0.0-20250227164540-47778d43dcec h1:z+Ov7vv6XDd9JGgpTD4zwKNHYkFi0crSFTFNpZHM90E=
 git.dolansoft.org/dolansoft/k8s-nft-npc v0.0.0-20250227164540-47778d43dcec/go.mod h1:5eIJqMVpmmf5Ox4Hy1oZ/qqoeX8p37+ivO1TXi5//pY=
 git.sr.ht/~sbinet/gg v0.3.1/go.mod h1:KGYtlADtqsqANL9ueOFkWymvzUvLMQllU5Ixo+8v3pc=
-github.com/AdaLogics/go-fuzz-headers v0.0.0-20210715213245-6c3934b029d8/go.mod h1:CzsSbkDixRphAF5hS6wbMKq0eI6ccJRb7/A0M6JBnwg=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
 github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20231105174938-2b5cbb29f3e2 h1:dIScnXFlF784X79oi7MzVT6GWqr/W1uUt0pB5CsDs9M=
 github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20231105174938-2b5cbb29f3e2/go.mod h1:gCLVsLfv1egrcZu+GoJATN5ts75F2s62ih/457eWzOw=
 github.com/Azure/azure-amqp-common-go/v2 v2.1.0/go.mod h1:R8rea+gJRuJR6QxTir/XuEd+YuKoUiazDC/N96FiDEU=
 github.com/Azure/azure-pipeline-go v0.2.1/go.mod h1:UGSo8XybXnIGZ3epmeBw7Jdz+HiUVpqIlpz/HKHylF4=
-github.com/Azure/azure-pipeline-go v0.2.3/go.mod h1:x841ezTBIMG6O3lAcl8ATHnsOPVl2bqk7S3ta6S6u4k=
-github.com/Azure/azure-sdk-for-go v16.2.1+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
 github.com/Azure/azure-sdk-for-go v29.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
 github.com/Azure/azure-sdk-for-go v30.1.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
 github.com/Azure/azure-service-bus-go v0.9.1/go.mod h1:yzBx6/BUGfjfeqbRZny9AQIbIe3AcV9WZbAdpkoXOa0=
 github.com/Azure/azure-storage-blob-go v0.8.0/go.mod h1:lPI3aLPpuLTeUwh1sViKXFxwl2B6teiRqI0deQUvsw0=
-github.com/Azure/azure-storage-blob-go v0.14.0/go.mod h1:SMqIBi+SuiQH32bvyjngEewEeXoPfKMgWlBDaYf6fck=
-github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
 github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
-github.com/Azure/go-autorest v10.8.1+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
 github.com/Azure/go-autorest v12.0.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
-github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
-github.com/Azure/go-autorest/autorest/adal v0.9.13/go.mod h1:W/MM4U6nLxnIskrw4UwWzlHfGjwUS50aOsc/I3yuU8M=
-github.com/Azure/go-autorest/autorest/adal v0.9.16/go.mod h1:tGMin8I49Yij6AQ+rvV+Xa/zwxYQB5hmsd6DkfAx2+A=
-github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSYnokU+TrmwEsOqdt8Y6sso74=
-github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
-github.com/Azure/go-autorest/logger v0.2.1/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8=
-github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c h1:pxW6RcqyfI9/kWtOwnv/G+AzdKuy2ZrqINhenH4HyNs=
 github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/ClickHouse/clickhouse-go v1.4.3/go.mod h1:EaI/sW7Azgz9UATzd5ZdZHRUhHgv5+JMS9NSr2smCJI=
 github.com/GoogleCloudPlatform/cloudsql-proxy v0.0.0-20191009163259-e802c2cb94ae/go.mod h1:mjwGPas4yKduTyubHvD1Atl9r1rUq8DfVy+gkVvZ+oo=
 github.com/JeffAshton/win_pdh v0.0.0-20161109143554-76bb4ee9f0ab h1:UKkYhof1njT1/xq4SEg5z+VpTgjmNeHwPGRQl7takDI=
 github.com/JeffAshton/win_pdh v0.0.0-20161109143554-76bb4ee9f0ab/go.mod h1:3VYc5hodBMJ5+l/7J4xAyMeuM2PNuepvHlGs8yilUCA=
@@ -1414,43 +1396,19 @@
 github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
 github.com/Masterminds/semver/v3 v3.0.3/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
 github.com/Masterminds/semver/v3 v3.1.0/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
-github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
 github.com/Masterminds/sprig v2.15.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuNhlNS5hqE0NB0E6fgfo2Br3o=
 github.com/Masterminds/sprig v2.22.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuNhlNS5hqE0NB0E6fgfo2Br3o=
-github.com/Microsoft/go-winio v0.4.11/go.mod h1:VhR8bwka0BXejwEJY73c50VrPtXAaKcyvVC4A4RozmA=
 github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
-github.com/Microsoft/go-winio v0.4.15-0.20190919025122-fc70bd9a86b5/go.mod h1:tTuCMEN+UleMWgg9dVx4Hu52b1bJo+59jBh3ajtinzw=
-github.com/Microsoft/go-winio v0.4.16-0.20201130162521-d1ffc52c7331/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=
-github.com/Microsoft/go-winio v0.4.16/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=
-github.com/Microsoft/go-winio v0.4.17-0.20210211115548-6eac466e5fa3/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
-github.com/Microsoft/go-winio v0.4.17-0.20210324224401-5516f17a5958/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
-github.com/Microsoft/go-winio v0.4.17/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
-github.com/Microsoft/go-winio v0.5.1/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
-github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/Microsoft/hcsshim v0.8.6/go.mod h1:Op3hHsoHPAvb6lceZHDtd9OkTew38wNoXnJs8iY7rUg=
-github.com/Microsoft/hcsshim v0.8.7-0.20190325164909-8abdbb8205e4/go.mod h1:Op3hHsoHPAvb6lceZHDtd9OkTew38wNoXnJs8iY7rUg=
-github.com/Microsoft/hcsshim v0.8.7/go.mod h1:OHd7sQqRFrYd3RmSgbgji+ctCwkbq2wbEYNSzOYtcBQ=
-github.com/Microsoft/hcsshim v0.8.9/go.mod h1:5692vkUqntj1idxauYlpoINNKeqCiG6Sg38RRsjT5y8=
-github.com/Microsoft/hcsshim v0.8.14/go.mod h1:NtVKoYxQuTLx6gEq0L96c9Ju4JbRJ4nY2ow3VK6a9Lg=
-github.com/Microsoft/hcsshim v0.8.15/go.mod h1:x38A4YbHbdxJtc0sF6oIz+RG0npwSCAvn69iY6URG00=
-github.com/Microsoft/hcsshim v0.8.16/go.mod h1:o5/SZqmR7x9JNKsW3pu+nqHm0MF8vbA+VxGOoXdC600=
-github.com/Microsoft/hcsshim v0.8.20/go.mod h1:+w2gRZ5ReXQhFOrvSQeNfhrYB/dg3oDwTOcER2fw4I4=
-github.com/Microsoft/hcsshim v0.8.21/go.mod h1:+w2gRZ5ReXQhFOrvSQeNfhrYB/dg3oDwTOcER2fw4I4=
-github.com/Microsoft/hcsshim v0.8.23/go.mod h1:4zegtUJth7lAvFyc6cH2gGQ5B3OFQim01nnU2M8jKDg=
-github.com/Microsoft/hcsshim v0.9.2/go.mod h1:7pLA8lDk46WKDWlVsENo92gC0XFa8rbKfyFRBqxEbCc=
 github.com/Microsoft/hcsshim v0.12.9 h1:2zJy5KA+l0loz1HzEGqyNnjd3fyZA31ZBCGKacp6lLg=
 github.com/Microsoft/hcsshim v0.12.9/go.mod h1:fJ0gkFAna6ukt0bLdKB8djt4XIJhF/vEPuoIWYVvZ8Y=
-github.com/Microsoft/hcsshim/test v0.0.0-20201218223536-d3e5debf77da/go.mod h1:5hlzMzRKMLyo42nCZ9oml8AdTlq/0cvIaBv6tK1RehU=
-github.com/Microsoft/hcsshim/test v0.0.0-20210227013316-43a75bb4edd3/go.mod h1:mw7qgWloBUl75W/gVH3cQszUg1+gUITj7D6NY7ywVnY=
 github.com/Microsoft/hnslib v0.0.8 h1:EBrIiRB7i/UYIXEC2yw22dn+RLzOmsc5S0bw2xf0Qus=
 github.com/Microsoft/hnslib v0.0.8/go.mod h1:EYveQJlhKh2obmEIRB3uKN6dBd9pj1frPsrTGFppKuk=
 github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
 github.com/NYTimes/gziphandler v1.1.1 h1:ZUDjpQae29j0ryrS0u/B8HZfJBtBQHjqw2rQ2cqUQ3I=
 github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMomdKFjzJNB0c=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
 github.com/Shopify/sarama v1.19.0/go.mod h1:FVkBWblsNy7DGZRfXLU0O9RCGt5g3g3yEuWXgklEdEo=
 github.com/Shopify/toxiproxy v2.1.4+incompatible/go.mod h1:OXgGpZ6Cli1/URJOF1DMxUHB2q5Ap20/P/eIdh4G0pI=
 github.com/VividCortex/gohistogram v1.0.0/go.mod h1:Pf5mBqqDxYaXu3hDrrU+w6nw50o/4+TcAqDqk/vUH7g=
@@ -1479,8 +1437,6 @@
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 h1:s6gZFSlWYmbqAuRjVTiNNhvNRfY2Wxp9nhfyel4rklc=
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
-github.com/alexflint/go-filemutex v0.0.0-20171022225611-72bdc8eae2ae/go.mod h1:CgnQgUtFrFz9mxFNtED3jI5tLDjKlOM+oUF/sTk6ps0=
-github.com/alexflint/go-filemutex v1.1.0/go.mod h1:7P4iRhttt/nUvUOrYIhcpMzv2G6CY9UnI16Z+UJqRyk=
 github.com/alexflint/go-filemutex v1.3.0 h1:LgE+nTUWnQCyRKbpoceKZsPQbs84LivvgwUymZXdOcM=
 github.com/alexflint/go-filemutex v1.3.0/go.mod h1:U0+VA/i30mGBlLCrFPGtTe9y6wGQfNAWPBTekHQ+c8A=
 github.com/andybalholm/brotli v1.0.4/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
@@ -1493,8 +1449,6 @@
 github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
 github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g=
 github.com/aokoli/goutils v1.0.1/go.mod h1:SijmP0QR8LtwsmDs8Yii5Z/S4trXFGFC2oO5g9DP+DQ=
-github.com/apache/arrow/go/arrow v0.0.0-20210818145353-234c94e4ce64/go.mod h1:2qMFB56yOP3KzkB3PbYZ4AlUFg3a88F67TIx5lB/WwY=
-github.com/apache/arrow/go/arrow v0.0.0-20211013220434-5962184e7a30/go.mod h1:Q7yQnSMnLvcXlZ8RV+jwz/6y1rQTqbX6C82SndT52Zs=
 github.com/apache/arrow/go/v10 v10.0.1/go.mod h1:YvhnlEePVnBS4+0z3fhPfUy7W1Ikj0Ih0vcRo/gZ1M0=
 github.com/apache/arrow/go/v11 v11.0.0/go.mod h1:Eg5OsL5H+e299f7u5ssuXsuHQVEGC4xei5aX110hRiI=
 github.com/apache/arrow/go/v12 v12.0.0/go.mod h1:d+tV/eHZZ7Dz7RPrFKtPK02tpr+c9/PEd/zm8mDS9Vg=
@@ -1522,9 +1476,7 @@
 github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4B6AGu/h5Sxe66HYVdqdGu2l9Iebqhi/AEoA=
 github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/aws/aws-lambda-go v1.13.3/go.mod h1:4UKl9IzQMoD+QF79YdCuzCwp8VbmG4VAQwij/eHl5CU=
-github.com/aws/aws-sdk-go v1.15.11/go.mod h1:mFuSZ37Z9YOHbQEwBWztmVzqXrEkub65tZoCYDt7FT0=
 github.com/aws/aws-sdk-go v1.15.27/go.mod h1:mFuSZ37Z9YOHbQEwBWztmVzqXrEkub65tZoCYDt7FT0=
-github.com/aws/aws-sdk-go v1.17.7/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/aws/aws-sdk-go v1.19.18/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/aws/aws-sdk-go v1.19.45/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/aws/aws-sdk-go v1.20.6/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
@@ -1534,44 +1486,18 @@
 github.com/aws/aws-sdk-go v1.27.0/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/aws/aws-sdk-go v1.37.0/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
 github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g=
-github.com/aws/aws-sdk-go-v2 v1.8.0/go.mod h1:xEFuWz+3TYdlPRuo+CqATbeDWIWyaT5uAPwPaWtgse0=
-github.com/aws/aws-sdk-go-v2 v1.9.2/go.mod h1:cK/D0BBs0b/oWPIcX/Z/obahJK1TT7IPVjy53i/mX/4=
 github.com/aws/aws-sdk-go-v2 v1.30.1/go.mod h1:nIQjQVp5sfpQcTc9mPSr1B0PaWK5ByX9MOoDadSN4lc=
-github.com/aws/aws-sdk-go-v2/config v1.6.0/go.mod h1:TNtBVmka80lRPk5+S9ZqVfFszOQAGJJ9KbT3EM3CHNU=
-github.com/aws/aws-sdk-go-v2/config v1.8.3/go.mod h1:4AEiLtAb8kLs7vgw2ZV3p2VZ1+hBavOc84hqxVNpCyw=
 github.com/aws/aws-sdk-go-v2/config v1.27.24/go.mod h1:aXzi6QJTuQRVVusAO8/NxpdTeTyr/wRcybdDtfUwJSs=
-github.com/aws/aws-sdk-go-v2/credentials v1.3.2/go.mod h1:PACKuTJdt6AlXvEq8rFI4eDmoqDFC5DpVKQbWysaDgM=
-github.com/aws/aws-sdk-go-v2/credentials v1.4.3/go.mod h1:FNNC6nQZQUuyhq5aE5c7ata8o9e4ECGmS4lAXC7o1mQ=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.24/go.mod h1:Hld7tmnAkoBQdTMNYZGzztzKRdA4fCdn9L83LOoigac=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.4.0/go.mod h1:Mj/U8OpDbcVcoctrYwA2bak8k/HFPdcLzI/vaiXMwuM=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.6.0/go.mod h1:gqlclDEZp4aqJOancXK6TN24aKhT0W0Ae9MHk3wzTMM=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.9/go.mod h1:WQr3MY7AxGNxaqAtsDWn+fBxmd4XvLkzeqQ8P1VM0/w=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.4.0/go.mod h1:eHwXu2+uE/T6gpnYWwBwqoeqRf9IXyCcolyOWDRAErQ=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.5.4/go.mod h1:Ex7XQmbFmgFHrjUX6TN3mApKW5Hglyga+F7wZHTtYhA=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.13/go.mod h1:+rdA6ZLpaSeM7tSg/B0IEDinCIBJGmW8rKDFkYpP04g=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.13/go.mod h1:i+kbfa76PQbWw/ULoWnp51EYVWH4ENln76fLQE3lXT8=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.2.0/go.mod h1:Q5jATQc+f1MfZp3PDMhn6ry18hGvE0i8yvbXoKbnZaE=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.2.4/go.mod h1:ZcBrrI3zBKlhGFNYWvju0I3TR93I7YIgAfy82Fh4lcQ=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0/go.mod h1:8tu/lYfQfFe6IGnaOdrpVgEL2IrrDOf6/m9RQum4NkY=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.2.2/go.mod h1:EASdTcM1lGhUe1/p4gkojHwlGJkeoRjjr1sRCzup3Is=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.3.0/go.mod h1:v8ygadNyATSm6elwJ/4gzJwcFhri9RqS8skgHKiwXPU=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3/go.mod h1:GlAeCkHwugxdHaueRr4nhPuY+WW+gR8UjlcqzPr1SPI=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.2.2/go.mod h1:NXmNI41bdEsJMrD0v9rUvbGCB5GwdBEpKvUvIY3vTFg=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.3.2/go.mod h1:72HRZDLMtmVQiLG2tLfQcaWLCssELvGl+Zf2WVxMmR8=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.15/go.mod h1:9xWJ3Q/S6Ojusz1UIkfycgD1mGirJfLLKqq3LPT7WN8=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.5.2/go.mod h1:QuL2Ym8BkrLmN4lUofXYq6000/i5jPjosCNK//t6gak=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.7.2/go.mod h1:np7TMuJNT83O0oDOSF8i4dF3dvGqA6hPYYo6YYkzgRA=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.12.0/go.mod h1:6J++A5xpo7QDsIeSqPK4UHqMSyPOCopa+zKtqAMhqVQ=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.16.1/go.mod h1:CQe/KvWV1AqRc65KqeJjrLzr5X2ijnFTTVzJW0VBRCI=
-github.com/aws/aws-sdk-go-v2/service/sso v1.3.2/go.mod h1:J21I6kF+d/6XHVk7kp/cx9YVD2TMD2TbLwtRGVcinXo=
-github.com/aws/aws-sdk-go-v2/service/sso v1.4.2/go.mod h1:NBvT9R1MEF+Ud6ApJKM0G+IkPchKS7p7c2YPKwHmBOk=
 github.com/aws/aws-sdk-go-v2/service/sso v1.22.1/go.mod h1:/vWdhoIoYA5hYoPZ6fm7Sv4d8701PiG5VKe8/pPJL60=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.2/go.mod h1:xyFHA4zGxgYkdD73VeezHt3vSKEG9EmFnGwoKlP00u4=
-github.com/aws/aws-sdk-go-v2/service/sts v1.6.1/go.mod h1:hLZ/AnkIKHLuPGjEiyghNEdvJ2PP0MgOxcmv9EBJ4xs=
-github.com/aws/aws-sdk-go-v2/service/sts v1.7.2/go.mod h1:8EzeIqfWt2wWT4rJVu3f21TfrhJ8AEMzVybRNSb/b4g=
 github.com/aws/aws-sdk-go-v2/service/sts v1.30.1/go.mod h1:jiNR3JqT15Dm+QWq2SRgh0x0bCNSRP2L25+CqPNpJlQ=
-github.com/aws/smithy-go v1.7.0/go.mod h1:SObp3lf9smib00L/v3U2eAKG8FyQ7iLrJnQiAmR5n+E=
-github.com/aws/smithy-go v1.8.0/go.mod h1:SObp3lf9smib00L/v3U2eAKG8FyQ7iLrJnQiAmR5n+E=
 github.com/aws/smithy-go v1.20.3/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
 github.com/aybabtme/rgbterm v0.0.0-20170906152045-cc83f3b3ce59/go.mod h1:q/89r3U2H7sSsE2t6Kca0lfwTK8JdoNGS/yzM/4iH5I=
 github.com/bazelbuild/buildtools v0.0.0-20231103205921-433ea8554e82 h1:HTepWP/jhtWTC1gvK0RnvKCgjh4gLqiwaOwGozAXcbw=
@@ -1582,34 +1508,19 @@
 github.com/beevik/ntp v1.4.3/go.mod h1:Unr8Zg+2dRn7d8bHFuehIMSvvUYssHMxW3Q5Nx4RW5Q=
 github.com/benbjohnson/clock v1.0.3/go.mod h1:bGMdMPoPVvcYyt1gHDf4J2KE153Yf9BuiUKYMaxlTDM=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
-github.com/beorn7/perks v0.0.0-20160804104726-4c0e84591b9a/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932/go.mod h1:NOuUCSz6Q9T7+igc/hlvDOUdtWKryOrtFyIVABv/p7k=
-github.com/bitly/go-simplejson v0.5.0/go.mod h1:cXHtHw4XUPsvGaxgjIAn8PhEWG9NfngEKAMDJEczWVA=
-github.com/bits-and-blooms/bitset v1.2.0/go.mod h1:gIdJ4wp64HaoK2YrL1Q5/N7Y16edYb8uY+O0FJTyyDA=
-github.com/bkaradzic/go-lz4 v1.0.0/go.mod h1:0YdlkowM3VswSROI7qDxhRvJ3sLhlFrRRwjwegp5jy4=
 github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84=
 github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb/go.mod h1:PkYb9DJNAwrSvRx5DYA+gUcOIgTGVMNkfSCbZM8cWpI=
-github.com/blang/semver v3.1.0+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
-github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
 github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
-github.com/bshuster-repo/logrus-logstash-hook v0.4.1/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
-github.com/buger/jsonparser v0.0.0-20180808090653-f4dd9f5a6b44/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
-github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
-github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd/go.mod h1:2oa8nejYd4cQ/b0hMIopN0lCRxU0bueqREvZLWFrtK8=
-github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
-github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
 github.com/bytecodealliance/wasmtime-go/v14 v14.0.0 h1:ur7S3P+PAeJmgllhSrKnGQOAmmtUbLQxb/nw2NZiaEM=
 github.com/bytecodealliance/wasmtime-go/v14 v14.0.0/go.mod h1:tqOVEUjnXY6aGpSfM9qdVRR6G//Yc513fFYUdzZb/DY=
-github.com/bytedance/sonic v1.9.1 h1:6iJ6NqdoxCDr6mbY8h18oSO+cShGSMRGCEo7F2h0x8s=
-github.com/bytedance/sonic v1.9.1/go.mod h1:i736AoUSYt75HyZLoJW9ERYxcy6eaN6h4BZXU064P/U=
 github.com/caarlos0/ctrlc v1.0.0/go.mod h1:CdXpj4rmq0q/1Eb44M9zi2nKB0QraNKuRGYGrrHhcQw=
 github.com/campoy/unique v0.0.0-20180121183637-88950e537e7e/go.mod h1:9IOqJGCPMSc6E5ydlp5NIonxObaeu/Iub/X03EKPVYo=
 github.com/casbin/casbin/v2 v2.1.2/go.mod h1:YcPU1XXisHhLzuxH9coDNf2FbKpjGlbCg3n9yuLkIJQ=
@@ -1618,8 +1529,6 @@
 github.com/cavaliergopher/cpio v1.0.1/go.mod h1:pBdaqQjnvXxdS/6CvNDwIANIFSP0xRKI16PX4xejRQc=
 github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4=
 github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
-github.com/cenkalti/backoff/v4 v4.1.1/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
-github.com/cenkalti/backoff/v4 v4.1.2/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
 github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
@@ -1639,15 +1548,11 @@
 github.com/chai2010/gettext-go v1.0.2/go.mod h1:y+wnP2cHYaVj19NZhYKAwEMH2CI1gNHeQQ+5AjwawxA=
 github.com/checkpoint-restore/checkpointctl v1.3.0 h1:bNz5b6s+lxFdG5ZGDba3qSkBtXDDTCG2494dfAbQJ4E=
 github.com/checkpoint-restore/checkpointctl v1.3.0/go.mod h1:dqZH4wDvbjnsqFGK2LdUDk21yFQ1dCAtzgRMlG44KDM=
-github.com/checkpoint-restore/go-criu/v4 v4.1.0/go.mod h1:xUQBLp4RLc5zJtWY++yjOoMoB5lihDt7fai+75m+rGw=
-github.com/checkpoint-restore/go-criu/v5 v5.0.0/go.mod h1:cfwC0EG7HMUenopBsUf9d89JlCLQIfgVcNsNN0t6T2M=
 github.com/checkpoint-restore/go-criu/v5 v5.3.0/go.mod h1:E/eQpaFtUKGOOSEBZgmKAcn+zUUwWxqcaKZlF54wK8E=
 github.com/checkpoint-restore/go-criu/v6 v6.3.0 h1:mIdrSO2cPNWQY1truPg6uHLXyKHk3Z5Odx4wjKOASzA=
 github.com/checkpoint-restore/go-criu/v6 v6.3.0/go.mod h1:rrRTN/uSwY2X+BPRl/gkulo9gsKOSAeVp9/K2tv7xZI=
 github.com/checkpoint-restore/go-criu/v7 v7.2.0 h1:qGiWA4App1gGlEfIJ68WR9jbezV9J7yZdjzglezcqKo=
 github.com/checkpoint-restore/go-criu/v7 v7.2.0/go.mod h1:u0LCWLg0w4yqqu14aXhiB4YD3a1qd8EcCEg7vda5dwo=
-github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 h1:qSGYFH7+jGhDF8vLC+iwCD4WpbV1EBDSzWkJODFLams=
-github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311/go.mod h1:b583jCggY9gE99b6G5LEC39OIiVsWj+R97kbl5odCEk=
 github.com/chromedp/cdproto v0.0.0-20230802225258-3cf4e6d46a89/go.mod h1:GKljq0VrfU4D5yc+2qA6OVr8pmO/MBbPEWqWQ/oqGEs=
 github.com/chromedp/chromedp v0.9.2/go.mod h1:LkSXJKONWTCHAfQasKFUZI+mxqS4tZqhmtGzzhLsnLs=
 github.com/chromedp/sysutil v1.0.0/go.mod h1:kgWmDdq8fTzXYcKIBqIYvRRTnYb9aNS9moAV0xufSww=
@@ -1660,18 +1565,12 @@
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/chzyer/test v0.0.0-20210722231415-061457976a23/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38GC8=
-github.com/cilium/ebpf v0.0.0-20200110133405-4032b1d8aae3/go.mod h1:MA5e5Lr8slmEg9bt0VpxxWqJlO4iwu3FBdHUzV7wQVg=
-github.com/cilium/ebpf v0.0.0-20200702112145-1c8d4c9ef775/go.mod h1:7cR51M8ViRLIdUjrmSXlK9pkrsDlLHbO8jiB8X8JnOc=
-github.com/cilium/ebpf v0.2.0/go.mod h1:To2CFviqOWL/M0gIMsvSMlqe7em/l1ALkX1PyjrX2Qs=
-github.com/cilium/ebpf v0.4.0/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
-github.com/cilium/ebpf v0.6.2/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
 github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2usCA=
 github.com/cilium/ebpf v0.12.3/go.mod h1:TctK1ivibvI3znr66ljgi4hqOT8EYQjz1KWBfb1UVgM=
 github.com/cilium/ebpf v0.16.0 h1:+BiEnHL6Z7lXnlGUsXQPPAE7+kenAd4ES8MQ5min0Ok=
 github.com/cilium/ebpf v0.16.0/go.mod h1:L7u2Blt2jMM/vLAVgjxluxtBKlz3/GWjB0dMOEngfwE=
 github.com/clbanning/x2j v0.0.0-20191024224557-825249438eec/go.mod h1:jMjuTZXRI4dUb/I5gc9Hdhagfvm9+RyrPryS/auMzxE=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cloudflare/golz4 v0.0.0-20150217214814-ef862a3cdc58/go.mod h1:EOBUe0h4xcZ5GoxqC5SDxFQ8gwyZPKQoEzownBlhI80=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
@@ -1682,7 +1581,6 @@
 github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211130200136-a8f946100490/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20220314180256-7f1daf1720fc/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20230105202645-06c439db220b/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20230310173818-32f1caf87195/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
@@ -1692,10 +1590,6 @@
 github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa/go.mod h1:x/1Gn8zydmfq8dk6e9PdstVsDgu9RuyIIJqAaF//0IM=
 github.com/cncf/xds/go v0.0.0-20240318125728-8a4994d93e50/go.mod h1:5e1+Vvlzido69INQaVO6d87Qn543Xr6nooe9Kz7oBFM=
 github.com/cncf/xds/go v0.0.0-20240423153145-555b57ec207b/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
-github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
-github.com/cockroachdb/cockroach-go/v2 v2.1.1/go.mod h1:7NtUnP6eK+l6k483WSYNrq3Kb23bWV10IRV1TyeSpwM=
-github.com/cockroachdb/cockroach-go/v2 v2.2.10 h1:O7Hl8m0rs/oJNBmRr14ED3Q3+AmugMK9DtJwRDHZ2DA=
-github.com/cockroachdb/cockroach-go/v2 v2.2.10/go.mod h1:xZ2VHjUEb/cySv0scXBx7YsBnHtLHkR1+w/w73b5i3M=
 github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8=
 github.com/cockroachdb/datadriven v0.0.0-20200714090401-bf6692d28da5/go.mod h1:h6jFvWxBdQXxjopDMZyH2UVceIRfR84bdzbkoKrsWNo=
 github.com/cockroachdb/datadriven v1.0.2 h1:H9MtNqVoVhvd9nCBwOyDjUEdZCREqbIdCJD93PBm/jA=
@@ -1705,63 +1599,18 @@
 github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd/go.mod h1:sE/e/2PUdi/liOCUjSTXgM1o87ZssimdTWN964YiIeI=
 github.com/container-storage-interface/spec v1.9.0 h1:zKtX4STsq31Knz3gciCYCi1SXtO2HJDecIjDVboYavY=
 github.com/container-storage-interface/spec v1.9.0/go.mod h1:ZfDu+3ZRyeVqxZM0Ds19MVLkN2d1XJ5MAfi1L3VjlT0=
-github.com/containerd/aufs v0.0.0-20200908144142-dab0cbea06f4/go.mod h1:nukgQABAEopAHvB6j7cnP5zJ+/3aVcE7hCYqvIwAHyE=
-github.com/containerd/aufs v0.0.0-20201003224125-76a6863f2989/go.mod h1:AkGGQs9NM2vtYHaUen+NljV0/baGCAPELGm2q9ZXpWU=
-github.com/containerd/aufs v0.0.0-20210316121734-20793ff83c97/go.mod h1:kL5kd6KM5TzQjR79jljyi4olc1Vrx6XBlcyj3gNv2PU=
-github.com/containerd/aufs v1.0.0/go.mod h1:kL5kd6KM5TzQjR79jljyi4olc1Vrx6XBlcyj3gNv2PU=
-github.com/containerd/btrfs v0.0.0-20201111183144-404b9149801e/go.mod h1:jg2QkJcsabfHugurUvvPhS3E08Oxiuh5W/g1ybB4e0E=
-github.com/containerd/btrfs v0.0.0-20210316141732-918d888fb676/go.mod h1:zMcX3qkXTAi9GI50+0HOeuV8LU2ryCE/V2vG/ZBiTss=
-github.com/containerd/btrfs v1.0.0/go.mod h1:zMcX3qkXTAi9GI50+0HOeuV8LU2ryCE/V2vG/ZBiTss=
 github.com/containerd/btrfs/v2 v2.0.0 h1:FN4wsx7KQrYoLXN7uLP0vBV4oVWHOIKDRQ1G2Z0oL5M=
 github.com/containerd/btrfs/v2 v2.0.0/go.mod h1:swkD/7j9HApWpzl8OHfrHNxppPd9l44DFZdF94BUj9k=
-github.com/containerd/cgroups v0.0.0-20190717030353-c4b9ac5c7601/go.mod h1:X9rLEHIqSf/wfK8NsPqxJmeZgW4pcfzdXITDrUSJ6uI=
-github.com/containerd/cgroups v0.0.0-20190919134610-bf292b21730f/go.mod h1:OApqhQ4XNSNC13gXIwDjhOQxjWa/NxkwZXJ1EvqT0ko=
-github.com/containerd/cgroups v0.0.0-20200531161412-0dbf7f05ba59/go.mod h1:pA0z1pT8KYB3TCXK/ocprsh7MAkoW8bZVzPdih9snmM=
-github.com/containerd/cgroups v0.0.0-20200710171044-318312a37340/go.mod h1:s5q4SojHctfxANBDvMeIaIovkq29IP48TKAxnhYRxvo=
-github.com/containerd/cgroups v0.0.0-20200824123100-0b889c03f102/go.mod h1:s5q4SojHctfxANBDvMeIaIovkq29IP48TKAxnhYRxvo=
-github.com/containerd/cgroups v0.0.0-20210114181951-8a68de567b68/go.mod h1:ZJeTFisyysqgcCdecO57Dj79RfL0LNeGiFUqLYQRYLE=
-github.com/containerd/cgroups v1.0.1/go.mod h1:0SJrPIenamHDcZhEcJMNBB85rHcUsw4f25ZfBiPYRkU=
-github.com/containerd/cgroups v1.0.3/go.mod h1:/ofk34relqNjSGyqPrmEULrO4Sc8LJhvJmWbUCUKqj8=
 github.com/containerd/cgroups/v3 v3.0.3 h1:S5ByHZ/h9PMe5IOQoN7E+nMc2UcLEM/V48DGDJ9kip0=
 github.com/containerd/cgroups/v3 v3.0.3/go.mod h1:8HBe7V3aWGLFPd/k03swSIsGjZhHI2WzJmticMgVuz0=
-github.com/containerd/console v0.0.0-20180822173158-c12b1e7919c1/go.mod h1:Tj/on1eG8kiEhd0+fhSDzsPAFESxzBBvdyEgyryXffw=
-github.com/containerd/console v0.0.0-20181022165439-0650fd9eeb50/go.mod h1:Tj/on1eG8kiEhd0+fhSDzsPAFESxzBBvdyEgyryXffw=
-github.com/containerd/console v0.0.0-20191206165004-02ecf6a7291e/go.mod h1:8Pf4gM6VEbTNRIT26AyyU7hxdQU3MvAvxVI0sc00XBE=
-github.com/containerd/console v1.0.1/go.mod h1:XUsP6YE/mKtz6bxc+I8UiKKTP04qjQL4qcS3XoQ5xkw=
-github.com/containerd/console v1.0.2/go.mod h1:ytZPjGgY2oeTkAONYafi2kSj0aYggsf8acV1PGKCbzQ=
 github.com/containerd/console v1.0.3/go.mod h1:7LqA/THxQ86k76b8c/EMSiaJ3h1eZkMkXar0TQ1gf3U=
 github.com/containerd/console v1.0.4 h1:F2g4+oChYvBTsASRTz8NP6iIAi97J3TtSAsLbIFn4ro=
 github.com/containerd/console v1.0.4/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
-github.com/containerd/containerd v1.2.10/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.3.0-beta.2.0.20190828155532-0293cbd26c69/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.3.0/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.3.1-0.20191213020239-082f7e3aed57/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.3.2/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.4.0-beta.2.0.20200729163537-40b22ef07410/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.4.1/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.4.3/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.4.9/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.5.0-beta.1/go.mod h1:5HfvG1V2FsKesEGQ17k5/T7V960Tmcumvqn8Mc+pCYQ=
-github.com/containerd/containerd v1.5.0-beta.3/go.mod h1:/wr9AVtEM7x9c+n0+stptlo/uBBoBORwEx6ardVcmKU=
-github.com/containerd/containerd v1.5.0-beta.4/go.mod h1:GmdgZd2zA2GYIBZ0w09ZvgqEq8EfBp/m3lcVZIvPHhI=
-github.com/containerd/containerd v1.5.0-rc.0/go.mod h1:V/IXoMqNGgBlabz3tHD2TWDoTJseu1FGOKuoA4nNb2s=
-github.com/containerd/containerd v1.5.1/go.mod h1:0DOxVqwDy2iZvrZp2JUx/E+hS0UNTVn7dJnIOwtYR4g=
-github.com/containerd/containerd v1.5.7/go.mod h1:gyvv6+ugqY25TiXxcZC3L5yOeYgEw0QMhscqVp1AR9c=
-github.com/containerd/containerd v1.5.8/go.mod h1:YdFSv5bTFLpG2HIYmfqDpSYYTDX+mc5qtSuYx1YUb/s=
-github.com/containerd/containerd v1.6.1/go.mod h1:1nJz5xCZPusx6jJU8Frfct988y0NpumIq9ODB0kLtoE=
 github.com/containerd/containerd/api v1.7.19/go.mod h1:fwGavl3LNwAV5ilJ0sbrABL44AQxmNjDRcwheXDb6Ig=
 github.com/containerd/containerd/api v1.8.0 h1:hVTNJKR8fMc/2Tiw60ZRijntNMd1U+JVMyTRdsD2bS0=
 github.com/containerd/containerd/api v1.8.0/go.mod h1:dFv4lt6S20wTu/hMcP4350RL87qPWLVa/OHOwmmdnYc=
 github.com/containerd/containerd/v2 v2.0.1 h1:xqSar9cjkGhfQ2YvanCu7FMLk6+pNCFMCAroM2ALPp0=
 github.com/containerd/containerd/v2 v2.0.1/go.mod h1:A9DyAg+lXTiSBOsBTqQtJL4O3AGaM1aa4UHmVh4uFhM=
-github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
-github.com/containerd/continuity v0.0.0-20190815185530-f2a389ac0a02/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
-github.com/containerd/continuity v0.0.0-20191127005431-f65d91d395eb/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
-github.com/containerd/continuity v0.0.0-20200710164510-efbc4488d8fe/go.mod h1:cECdGN1O8G9bgKTlLhuPJimka6Xb/Gg7vYzCTNVxhvo=
-github.com/containerd/continuity v0.0.0-20201208142359-180525291bb7/go.mod h1:kR3BEg7bDFaEddKm54WSmrol1fKWDU1nKYkgrcgZT7Y=
-github.com/containerd/continuity v0.0.0-20210208174643-50096c924a4e/go.mod h1:EXlVlkqNba9rJe3j7w3Xa924itAMLgZH4UD/Q4PExuQ=
-github.com/containerd/continuity v0.1.0/go.mod h1:ICJu0PwR54nI0yPEnJ6jcS+J7CZAUXrLh8lPo2knzsM=
-github.com/containerd/continuity v0.2.2/go.mod h1:pWygW9u7LtS1o4N/Tn0FoCFDIXZ7rxcMX7HX1Dmibvk=
 github.com/containerd/continuity v0.4.4 h1:/fNVfTJ7wIl/YPMHjf+5H32uFhl63JucB34PlCpMKII=
 github.com/containerd/continuity v0.4.4/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v0.1.0/go.mod h1:YgWiiHtLmSeBrvpw+UfPijzbLaB77mEG1WwJTDETIV0=
@@ -1769,39 +1618,16 @@
 github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
 github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
-github.com/containerd/fifo v0.0.0-20180307165137-3d5202aec260/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=
-github.com/containerd/fifo v0.0.0-20190226154929-a9fb20d87448/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=
-github.com/containerd/fifo v0.0.0-20200410184934-f15a3290365b/go.mod h1:jPQ2IAeZRCYxpS/Cm1495vGFww6ecHmMk1YJH2Q5ln0=
-github.com/containerd/fifo v0.0.0-20201026212402-0724c46b320c/go.mod h1:jPQ2IAeZRCYxpS/Cm1495vGFww6ecHmMk1YJH2Q5ln0=
-github.com/containerd/fifo v0.0.0-20210316144830-115abcc95a1d/go.mod h1:ocF/ME1SX5b1AOlWi9r677YJmCPSwwWnQ9O123vzpE4=
-github.com/containerd/fifo v1.0.0/go.mod h1:ocF/ME1SX5b1AOlWi9r677YJmCPSwwWnQ9O123vzpE4=
 github.com/containerd/fifo v1.1.0 h1:4I2mbh5stb1u6ycIABlBw9zgtlK8viPI9QkQNRQEEmY=
 github.com/containerd/fifo v1.1.0/go.mod h1:bmC4NWMbXlt2EZ0Hc7Fx7QzTFxgPID13eH0Qu+MAb2o=
-github.com/containerd/go-cni v1.0.1/go.mod h1:+vUpYxKvAF72G9i1WoDOiPGRtQpqsNW/ZHtSlv++smU=
-github.com/containerd/go-cni v1.0.2/go.mod h1:nrNABBHzu0ZwCug9Ije8hL2xBCYh/pjfMb1aZGrrohk=
-github.com/containerd/go-cni v1.1.0/go.mod h1:Rflh2EJ/++BA2/vY5ao3K6WJRR/bZKsX123aPk+kUtA=
-github.com/containerd/go-cni v1.1.3/go.mod h1:Rflh2EJ/++BA2/vY5ao3K6WJRR/bZKsX123aPk+kUtA=
 github.com/containerd/go-cni v1.1.11 h1:fWt1K15AmSLsEfa57N+qYw4NeGPiQKYq1pjNGJwV9mc=
 github.com/containerd/go-cni v1.1.11/go.mod h1:/Y/sL8yqYQn1ZG1om1OncJB1W4zN3YmjfP/ShCzG/OY=
-github.com/containerd/go-runc v0.0.0-20180907222934-5a6d9f37cfa3/go.mod h1:IV7qH3hrUgRmyYrtgEeGWJfWbgcHL9CSRruz2Vqcph0=
-github.com/containerd/go-runc v0.0.0-20190911050354-e029b79d8cda/go.mod h1:IV7qH3hrUgRmyYrtgEeGWJfWbgcHL9CSRruz2Vqcph0=
-github.com/containerd/go-runc v0.0.0-20200220073739-7016d3ce2328/go.mod h1:PpyHrqVs8FTi9vpyHwPwiNEGaACDxT/N/pLcvMSRA9g=
-github.com/containerd/go-runc v0.0.0-20201020171139-16b287bc67d0/go.mod h1:cNU0ZbCgCQVZK4lgG3P+9tn9/PaJNmoDXPpoJhDR+Ok=
-github.com/containerd/go-runc v1.0.0/go.mod h1:cNU0ZbCgCQVZK4lgG3P+9tn9/PaJNmoDXPpoJhDR+Ok=
 github.com/containerd/go-runc v1.1.0 h1:OX4f+/i2y5sUT7LhmcJH7GYrjjhHa1QI4e8yO0gGleA=
 github.com/containerd/go-runc v1.1.0/go.mod h1:xJv2hFF7GvHtTJd9JqTS2UVxMkULUYw4JN5XAUZqH5U=
-github.com/containerd/imgcrypt v1.0.1/go.mod h1:mdd8cEPW7TPgNG4FpuP3sGBiQ7Yi/zak9TYCG3juvb0=
-github.com/containerd/imgcrypt v1.0.4-0.20210301171431-0ae5c75f59ba/go.mod h1:6TNsg0ctmizkrOgXRNQjAPFWpMYRWuiB6dSF4Pfa5SA=
-github.com/containerd/imgcrypt v1.1.1-0.20210312161619-7ed62a527887/go.mod h1:5AZJNI6sLHJljKuI9IHnw1pWqo/F0nGDOuR9zgTs7ow=
-github.com/containerd/imgcrypt v1.1.1/go.mod h1:xpLnwiQmEUJPvQoAapeb2SNCxz7Xr6PJrXQb0Dpc4ms=
-github.com/containerd/imgcrypt v1.1.3/go.mod h1:/TPA1GIDXMzbj01yd8pIbQiLdQxed5ue1wb8bP7PQu4=
 github.com/containerd/imgcrypt/v2 v2.0.0-rc.1 h1:7OMu5otk5Z2GeQs24JBPOmYbTc50+q6jo02qWNJc0p8=
 github.com/containerd/imgcrypt/v2 v2.0.0-rc.1/go.mod h1:3/Ab3iliBt/aBVNYOwecT1YagCqAiHidOmVsrjtHF1A=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
-github.com/containerd/nri v0.0.0-20201007170849-eb1350a75164/go.mod h1:+2wGSDGFYfE5+So4M5syatU0N0f0LbWpuqyMi4/BE8c=
-github.com/containerd/nri v0.0.0-20210316161719-dbaa18c31c14/go.mod h1:lmxnXF6oMkbqs39FiCt1s0R2HSMhcLel9vNL3m4AaeY=
-github.com/containerd/nri v0.1.0/go.mod h1:lmxnXF6oMkbqs39FiCt1s0R2HSMhcLel9vNL3m4AaeY=
 github.com/containerd/nri v0.8.0 h1:n1S753B9lX8RFrHYeSgwVvS1yaUcHjxbB+f+xzEncRI=
 github.com/containerd/nri v0.8.0/go.mod h1:uSkgBrCdEtAiEz4vnrq8gmAC4EnVAM5Klt0OuK5rZYQ=
 github.com/containerd/otelttrpc v0.0.0-20240305015340-ea5083fda723 h1:swk9KxrmARZjSMrHc1Lzb39XhcDwAhYpqkBhinCFLCQ=
@@ -1810,47 +1636,20 @@
 github.com/containerd/platforms v1.0.0-rc.0/go.mod h1:T1XAzzOdYs3it7l073MNXyxRwQofJfqwi/8cRjufIk4=
 github.com/containerd/plugin v1.0.0 h1:c8Kf1TNl6+e2TtMHZt+39yAPDbouRH9WAToRjex483Y=
 github.com/containerd/plugin v1.0.0/go.mod h1:hQfJe5nmWfImiqT1q8Si3jLv3ynMUIBB47bQ+KexvO8=
-github.com/containerd/stargz-snapshotter/estargz v0.4.1/go.mod h1:x7Q9dg9QYb4+ELgxmo4gBUeJB0tl5dqH1Sdz0nJU1QM=
-github.com/containerd/ttrpc v0.0.0-20190828154514-0e0f228740de/go.mod h1:PvCDdDGpgqzQIzDW1TphrGLssLDZp2GuS+X5DkEJB8o=
-github.com/containerd/ttrpc v0.0.0-20190828172938-92c8520ef9f8/go.mod h1:PvCDdDGpgqzQIzDW1TphrGLssLDZp2GuS+X5DkEJB8o=
-github.com/containerd/ttrpc v0.0.0-20191028202541-4f1b8fe65a5c/go.mod h1:LPm1u0xBw8r8NOKoOdNMeVHSawSsltak+Ihv+etqsE8=
-github.com/containerd/ttrpc v1.0.1/go.mod h1:UAxOpgT9ziI0gJrmKvgcZivgxOp8iFPSk8httJEt98Y=
-github.com/containerd/ttrpc v1.0.2/go.mod h1:UAxOpgT9ziI0gJrmKvgcZivgxOp8iFPSk8httJEt98Y=
-github.com/containerd/ttrpc v1.1.0/go.mod h1:XX4ZTnoOId4HklF4edwc4DcqskFZuvXB1Evzy5KFQpQ=
 github.com/containerd/ttrpc v1.2.2/go.mod h1:sIT6l32Ph/H9cvnJsfXM5drIVzTr5A2flTf1G5tYZak=
 github.com/containerd/ttrpc v1.2.5/go.mod h1:YCXHsb32f+Sq5/72xHubdiJRQY9inL4a4ZQrAbN1q9o=
 github.com/containerd/ttrpc v1.2.6 h1:zG+Kn5EZ6MUYCS1t2Hmt2J4tMVaLSFEJVOraDQwNPC4=
 github.com/containerd/ttrpc v1.2.6/go.mod h1:YCXHsb32f+Sq5/72xHubdiJRQY9inL4a4ZQrAbN1q9o=
-github.com/containerd/typeurl v0.0.0-20180627222232-a93fcdb778cd/go.mod h1:Cm3kwCdlkCfMSHURc+r6fwoGH6/F1hH3S4sg0rLFWPc=
-github.com/containerd/typeurl v0.0.0-20190911142611-5eb25027c9fd/go.mod h1:GeKYzf2pQcqv7tJ0AoCuuhtnqhva5LNU3U+OyKxxJpk=
-github.com/containerd/typeurl v1.0.1/go.mod h1:TB1hUtrpaiO88KEK56ijojHS1+NeF0izUACaJW2mdXg=
-github.com/containerd/typeurl v1.0.2/go.mod h1:9trJWW2sRlGub4wZJRTW83VtbOLS6hwcDZXTn6oPz9s=
 github.com/containerd/typeurl/v2 v2.1.1/go.mod h1:IDp2JFvbwZ31H8dQbEIY7sDl2L3o3HZj1hsSQlywkQ0=
 github.com/containerd/typeurl/v2 v2.2.0/go.mod h1:8XOOxnyatxSWuG8OfsZXVnAF4iZfedjS/8UHSPJnX4g=
 github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++dYSw40=
 github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
-github.com/containerd/zfs v0.0.0-20200918131355-0a33824f23a2/go.mod h1:8IgZOBdv8fAgXddBT4dBXJPtxyRsejFIpXoklgxgEjw=
-github.com/containerd/zfs v0.0.0-20210301145711-11e8f1707f62/go.mod h1:A9zfAbMlQwE+/is6hi0Xw8ktpL+6glmqZYtevJgaB8Y=
-github.com/containerd/zfs v0.0.0-20210315114300-dde8f0fda960/go.mod h1:m+m51S1DvAP6r3FcmYCp54bQ34pyOwTieQDNRIRHsFY=
-github.com/containerd/zfs v0.0.0-20210324211415-d5c4544f0433/go.mod h1:m+m51S1DvAP6r3FcmYCp54bQ34pyOwTieQDNRIRHsFY=
-github.com/containerd/zfs v1.0.0/go.mod h1:m+m51S1DvAP6r3FcmYCp54bQ34pyOwTieQDNRIRHsFY=
 github.com/containerd/zfs/v2 v2.0.0-rc.0 h1:0dRlgpoaepW7HuovtcvYQMF7NlpceQVdn7+3Udeth4M=
 github.com/containerd/zfs/v2 v2.0.0-rc.0/go.mod h1:g36g/XCEGDRxUXIFdM3oWAEvmTvhfz/eKWElqg4Secw=
-github.com/containernetworking/cni v0.7.1/go.mod h1:LGwApLUm2FpoOfxTDEeq8T9ipbpZ61X79hmU3w8FmsY=
-github.com/containernetworking/cni v0.8.0/go.mod h1:LGwApLUm2FpoOfxTDEeq8T9ipbpZ61X79hmU3w8FmsY=
-github.com/containernetworking/cni v0.8.1/go.mod h1:LGwApLUm2FpoOfxTDEeq8T9ipbpZ61X79hmU3w8FmsY=
-github.com/containernetworking/cni v1.0.1/go.mod h1:AKuhXbN5EzmD4yTNtfSsX3tPcmtrBI6QcRV0NiNt15Y=
 github.com/containernetworking/cni v1.2.3 h1:hhOcjNVUQTnzdRJ6alC5XF+wd9mfGIUaj8FuJbEslXM=
 github.com/containernetworking/cni v1.2.3/go.mod h1:DuLgF+aPd3DzcTQTtp/Nvl1Kim23oFKdm2okJzBQA5M=
-github.com/containernetworking/plugins v0.8.6/go.mod h1:qnw5mN19D8fIwkqW7oHHYDHVlzhJpcY6TQxn/fUyDDM=
-github.com/containernetworking/plugins v0.9.1/go.mod h1:xP/idU2ldlzN6m4p5LmGiwRDjeJr6FLK6vuiUwoH7P8=
-github.com/containernetworking/plugins v1.0.1/go.mod h1:QHCfGpaTwYTbbH+nZXKVTxNBDZcxSOplJT5ico8/FLE=
 github.com/containernetworking/plugins v1.6.1 h1:bYd2bpE6hEBqexyaiI2/sst0xJ+v7pEMWrjA5qtkxiU=
 github.com/containernetworking/plugins v1.6.1/go.mod h1:SP5UG3jDO9LtmfbBJdP+nl3A1atOtbj2MBOYsnaxy64=
-github.com/containers/ocicrypt v1.0.1/go.mod h1:MeJDzk1RJHv89LjsH0Sp5KTY3ZYkjXO/C+bKAeWFIrc=
-github.com/containers/ocicrypt v1.1.0/go.mod h1:b8AOe0YR67uU8OqfVNcznfFpAzu3rdgUV4GP9qXPfu4=
-github.com/containers/ocicrypt v1.1.1/go.mod h1:Dm55fwWm1YZAjYRaJ94z2mfZikIyIN4B0oB3dj3jFxY=
-github.com/containers/ocicrypt v1.1.2/go.mod h1:Dm55fwWm1YZAjYRaJ94z2mfZikIyIN4B0oB3dj3jFxY=
 github.com/containers/ocicrypt v1.2.0 h1:X14EgRK3xNFvJEfI5O4Qn4T3E25ANudSOZz/sirVuPM=
 github.com/containers/ocicrypt v1.2.0/go.mod h1:ZNviigQajtdlxIZGibvblVuIFBKIuUI2M0QM12SD31U=
 github.com/coredns/caddy v1.1.1/go.mod h1:A6ntJQlAWuQfFlsd9hvigKbo2WS0VUs2l1e2F+BawD4=
@@ -1859,9 +1658,6 @@
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/etcd v3.3.13+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
-github.com/coreos/go-iptables v0.4.5/go.mod h1:/mVI274lEDI2ns62jHCDnCyBF9Iwsmekav8Dbxlm1MU=
-github.com/coreos/go-iptables v0.5.0/go.mod h1:/mVI274lEDI2ns62jHCDnCyBF9Iwsmekav8Dbxlm1MU=
-github.com/coreos/go-iptables v0.6.0/go.mod h1:Qe8Bv2Xik5FyTXwgIbLAnv2sWSBmvWdFETJConOQ//Q=
 github.com/coreos/go-iptables v0.8.0 h1:MPc2P89IhuVpLI7ETL/2tx3XZ61VeICZjYqDEgNsPRc=
 github.com/coreos/go-iptables v0.8.0/go.mod h1:Qe8Bv2Xik5FyTXwgIbLAnv2sWSBmvWdFETJConOQ//Q=
 github.com/coreos/go-oidc v2.2.1+incompatible h1:mh48q/BqXqgjVHpy2ZY7WnWAbenxRjsz9N1i1YxjHAk=
@@ -1870,12 +1666,9 @@
 github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
-github.com/coreos/go-systemd v0.0.0-20161114122254-48702e0da86b/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/coreos/go-systemd v0.0.0-20180511133405-39ca1b05acc7/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/coreos/go-systemd v0.0.0-20190620071333-e64a0ec8b42a/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
-github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
-github.com/coreos/go-systemd/v22 v22.0.0/go.mod h1:xO0FLkIi5MaZafQlIrOotqXZ90ih+1atmu1JpKERPPk=
 github.com/coreos/go-systemd/v22 v22.1.0/go.mod h1:xO0FLkIi5MaZafQlIrOotqXZ90ih+1atmu1JpKERPPk=
 github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
@@ -1904,71 +1697,42 @@
 github.com/crillab/gophersat v1.3.1/go.mod h1:S91tHga1PCZzYhCkStwZAhvp1rCc+zqtSi55I+vDWGc=
 github.com/cubicdaiya/gonp v1.0.4 h1:ky2uIAJh81WiLcGKBVD5R7KsM/36W6IqqTy6Bo6rGws=
 github.com/cubicdaiya/gonp v1.0.4/go.mod h1:iWGuP/7+JVTn02OWhRemVbMmG1DOUnmrGTYYACpOI0I=
-github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4=
-github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
 github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
 github.com/cyphar/filepath-securejoin v0.3.4 h1:VBWugsJh2ZxJmLFSM06/0qzQyiQX2Qs0ViKrUAcqdZ8=
 github.com/cyphar/filepath-securejoin v0.3.4/go.mod h1:8s/MCNJREmFK0H02MF6Ihv1nakJe4L/w3WZLHNkvlYM=
-github.com/cznic/mathutil v0.0.0-20180504122225-ca4c9f2c1369/go.mod h1:e6NPNENfs9mPDVNRekM7lKScauxd5kXTr1Mfyig6TDM=
 github.com/cznic/mathutil v0.0.0-20181122101859-297441e03548 h1:iwZdTE0PVqJCos1vaoKsclOGD3ADKpshg3SRtYBbwso=
 github.com/cznic/mathutil v0.0.0-20181122101859-297441e03548/go.mod h1:e6NPNENfs9mPDVNRekM7lKScauxd5kXTr1Mfyig6TDM=
-github.com/d2g/dhcp4 v0.0.0-20170904100407-a1d1b6c41b1c/go.mod h1:Ct2BUK8SB0YC1SMSibvLzxjeJLnrYEVLULFNiHY9YfQ=
-github.com/d2g/dhcp4client v1.0.0/go.mod h1:j0hNfjhrt2SxUOw55nL0ATM/z4Yt3t2Kd1mW34z5W5s=
-github.com/d2g/dhcp4server v0.0.0-20181031114812-7d4a0a7f59a5/go.mod h1:Eo87+Kg/IX2hfWJfwxMzLyuSZyxSoAug2nGa1G2QAi8=
-github.com/d2g/hardwareaddr v0.0.0-20190221164911-e7d9fbe030e4/go.mod h1:bMl4RjIciD2oAxI7DmWRx6gbeqrkoLqv3MV0vzNad+I=
 github.com/davecgh/go-spew v0.0.0-20161028175848-04cdfd42973b/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/denisenkom/go-mssqldb v0.10.0/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
 github.com/dennwc/btrfs v0.0.0-20240418142341-0167142bde7a h1:KfFsGLJFVdCXlySUkV2FmxNtmiztpJb6tV+XYBmmv8E=
 github.com/dennwc/btrfs v0.0.0-20240418142341-0167142bde7a/go.mod h1:MYsOV9Dgsec3FFSOjywi0QK5r6TeBbdWxdrMGtiYXHA=
 github.com/dennwc/ioctl v1.0.0 h1:DsWAAjIxRqNcLn9x6mwfuf2pet3iB7aK90K4tF16rLg=
 github.com/dennwc/ioctl v1.0.0/go.mod h1:ellh2YB5ldny99SBU/VX7Nq0xiZbHphf1DrtHxxjMk0=
-github.com/denverdino/aliyungo v0.0.0-20190125010748-a747050bb1ba/go.mod h1:dV8lFg6daOBZbT6/BDGIz6Y3WFGn8juu6G+CQ6LHtl0=
 github.com/derekparker/trie v0.0.0-20230829180723-39f4de51ef7d h1:hUWoLdw5kvo2xCsqlsIBMvWUc1QCSsCYD2J2+Fg6YoU=
 github.com/derekparker/trie v0.0.0-20230829180723-39f4de51ef7d/go.mod h1:C7Es+DLenIpPc9J6IYw4jrK0h7S9bKj4DNl8+KxGEXU=
-github.com/desertbit/timer v0.0.0-20180107155436-c41aec40b27f h1:U5y3Y5UE0w7amNe7Z5G/twsBW0KEalRQXZzf8ufSh9I=
-github.com/desertbit/timer v0.0.0-20180107155436-c41aec40b27f/go.mod h1:xH/i4TFMt8koVQZ6WFms69WAsDWr2XsYL3Hkl7jkoLE=
 github.com/devigned/tab v0.1.1/go.mod h1:XG9mPq0dFghrYvoBF3xdRrJzSTX1b7IQrvaL9mzjeJY=
-github.com/dgrijalva/jwt-go v0.0.0-20170104182250-a601269ab70c/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
-github.com/dhui/dktest v0.3.10 h1:0frpeeoM9pHouHjhLeZDuDTJ0PqjDTrycaHaMmkJAo8=
-github.com/dhui/dktest v0.3.10/go.mod h1:h5Enh0nG3Qbo9WjNFRrwmKUaePEBhXMOygbz3Ww7Sz0=
 github.com/dimchansky/utfbom v1.1.0/go.mod h1:rO41eb7gLfo8SF1jd9F8HplJm1Fewwi4mQvIirEdv+8=
 github.com/diskfs/go-diskfs v1.2.0 h1:Ow4xorEDw1VNYKbC+SA/qQNwi5gWIwdKUxmUcLFST24=
 github.com/diskfs/go-diskfs v1.2.0/go.mod h1:ZTeTbzixuyfnZW5y5qKMtjV2o+GLLHo1KfMhotJI4Rk=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
-github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
-github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
-github.com/docker/cli v0.0.0-20191017083524-a8ff7f821017/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TTO4EOBfRPhZXAeF1Vu+W3hHZ8eLp8PgKVZlcvtFY=
-github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/distribution v2.8.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v1.4.2-0.20190924003213-a8608b5b67c7/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v20.10.13+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker v26.1.4+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker v27.1.1+incompatible h1:hO/M4MtV36kzKldqnA37IWhebRA+LnqqcqDja6kVaKY=
 github.com/docker/docker v27.1.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
-github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
 github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
-github.com/docker/go-events v0.0.0-20170721190031-9461782956ad/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
-github.com/docker/go-metrics v0.0.0-20180209012529-399ea8c73916/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
 github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
 github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
 github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
 github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
@@ -1977,11 +1741,9 @@
 github.com/eapache/go-resiliency v1.1.0/go.mod h1:kFI+JgMyC7bLPUVY133qvEBtVayf5mFgVsvEsIPBvNs=
 github.com/eapache/go-xerial-snappy v0.0.0-20180814174437-776d5712da21/go.mod h1:+020luEh2TKB4/GOp8oxxtq0Daoen/Cii55CzbTV6DU=
 github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I=
-github.com/edsrzf/mmap-go v0.0.0-20170320065105-0bce6a688712/go.mod h1:YO35OhQPt3KJa3ryjFM5Bs14WD66h8eGKpfaBNrHW5M=
 github.com/edsrzf/mmap-go v1.0.0/go.mod h1:YO35OhQPt3KJa3ryjFM5Bs14WD66h8eGKpfaBNrHW5M=
 github.com/ema/qdisc v1.0.0 h1:EHLG08FVRbWLg8uRICa3xzC9Zm0m7HyMHfXobWFnXYg=
 github.com/ema/qdisc v1.0.0/go.mod h1:FhIc0fLYi7f+lK5maMsesDqwYojIOh3VfRs8EVd5YJQ=
-github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
 github.com/emicklei/go-restful/v3 v3.8.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/emicklei/go-restful/v3 v3.10.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
@@ -1996,7 +1758,6 @@
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
 github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
-github.com/envoyproxy/go-control-plane v0.10.1/go.mod h1:AY7fTTXNdv/aJ2O5jwpxAPOWUZ7hQAEvzN5Pf27BkQQ=
 github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1/go.mod h1:KJwIaB5Mv44NWtYuAOFCVOjcI94vtpEz2JU/D2v6IjE=
 github.com/envoyproxy/go-control-plane v0.10.3/go.mod h1:fJJn/j26vwOu972OllsvAgJJM//w9BV6Fxbg2LuVd34=
 github.com/envoyproxy/go-control-plane v0.11.0/go.mod h1:VnHyVMpzcLvCFt9yUz1UnCwHLhwx1WguiVDV7pTG/tI=
@@ -2006,7 +1767,6 @@
 github.com/envoyproxy/protoc-gen-validate v0.0.14/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/envoyproxy/protoc-gen-validate v0.3.0-java/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/envoyproxy/protoc-gen-validate v0.6.2/go.mod h1:2t7qjJNvHPx8IjnBOzl9E9/baC+qXE/TeeyBRzgJDws=
 github.com/envoyproxy/protoc-gen-validate v0.6.7/go.mod h1:dyJXwwfPK2VSqiB9Klm1J6romD608Ba7Hij42vrOBCo=
 github.com/envoyproxy/protoc-gen-validate v0.9.1/go.mod h1:OKNgG7TCp5pF4d6XftA0++PMirau2/yoOwVac3AbF2w=
 github.com/envoyproxy/protoc-gen-validate v0.10.0/go.mod h1:DRjgyB0I43LtJapqN6NiRwroiAU2PaFuvk/vjgh61ss=
@@ -2035,7 +1795,6 @@
 github.com/fogleman/gg v1.3.0/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
 github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
 github.com/form3tech-oss/jwt-go v3.2.3+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
-github.com/form3tech-oss/jwt-go v3.2.5+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
 github.com/fortytw2/leaktest v1.2.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
 github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
 github.com/franela/goblin v0.0.0-20200105215937-c9ffbefa60db/go.mod h1:7dvUGVsVBjqR7JHJk0brhHOZYGmfBYOrK0ZhYMEtBr4=
@@ -2047,31 +1806,20 @@
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
-github.com/fsouza/fake-gcs-server v1.17.0/go.mod h1:D1rTE4YCyHFNa99oyJJ5HyclvN/0uQR+pM/VdlL83bw=
-github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa/go.mod h1:KnogPXtdwXqoenmZCw6S+25EAm2MkxbG0deNDu4cbSA=
 github.com/fullstorydev/grpcurl v1.6.0/go.mod h1:ZQ+ayqbKMJNhzLmbpCiurTVlaK2M/3nqZCxaQ2Ze/sM=
 github.com/fullstorydev/grpcurl v1.8.0/go.mod h1:Mn2jWbdMrQGJQ8UD62uNyMumT2acsZUCkZIqFxsQf1o=
 github.com/fullstorydev/grpcurl v1.8.1/go.mod h1:3BWhvHZwNO7iLXaQlojdg5NA6SxUDePli4ecpK1N7gw=
 github.com/fullstorydev/grpcurl v1.8.2/go.mod h1:YvWNT3xRp2KIRuvCphFodG0fKkMXwaxA9CJgKCcyzUQ=
 github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
 github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
-github.com/gabriel-vasile/mimetype v1.3.1/go.mod h1:fA8fi6KUiG7MgQQ+mEWotXoEOvmxRtOJlERCzSmRvr8=
-github.com/gabriel-vasile/mimetype v1.4.0/go.mod h1:fA8fi6KUiG7MgQQ+mEWotXoEOvmxRtOJlERCzSmRvr8=
-github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q7OhCmWKU=
-github.com/gabriel-vasile/mimetype v1.4.2/go.mod h1:zApsH/mKG4w07erKIaJPFiX0Tsq9BFQgN3qGY5GnNgA=
-github.com/garyburd/redigo v0.0.0-20150301180006-535138d7bcd7/go.mod h1:NR3MbYisc3/PwhQ00EMzDiPmrwpPxAn5GI05/YaO1SY=
 github.com/gdamore/encoding v1.0.0 h1:+7OoQ1Bc6eTm5niUzBa0Ctsh6JbMW6Ra+YNuAtDBdko=
 github.com/gdamore/encoding v1.0.0/go.mod h1:alR0ol34c49FCSBLjhosxzcPHQbf2trDkoo5dl+VrEg=
 github.com/gdamore/tcell/v2 v2.7.4 h1:sg6/UnTM9jGpZU+oFYAsDahfchWAFW8Xx2yFinNSAYU=
 github.com/gdamore/tcell/v2 v2.7.4/go.mod h1:dSXtXTSK0VsW1biw65DZLZ2NKr7j0qP/0J7ONmsraWg=
 github.com/getsentry/raven-go v0.2.0/go.mod h1:KungGk8q33+aIAZUIVWZDr2OfAEBsO49PX4NzFV5kcQ=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
 github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
 github.com/gin-gonic/gin v1.5.0/go.mod h1:Nd6IXA8m5kNZdNEHMBd93KT+mdY3+bewLgRvmCsR2Do=
-github.com/gin-gonic/gin v1.6.3/go.mod h1:75u5sXoLsGZoRN5Sgbi1eraJ4GU3++wFwWzhwvtwp4M=
-github.com/gin-gonic/gin v1.9.1 h1:4idEAncQnU5cB7BeOkPtxjfCSye0AAm1R0RVIqJ+Jmg=
-github.com/gin-gonic/gin v1.9.1/go.mod h1:hPrL7YrpYKXt5YId3A/Tnip5kqbEAP+KLuI3SUcPTeU=
 github.com/gliderlabs/ssh v0.2.2/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
 github.com/go-delve/delve v1.24.0 h1:M1auuI7kyfXZm5LMDQEqhqr4koKWOzGKhCgwMxsLQfo=
 github.com/go-delve/delve v1.24.0/go.mod h1:yNWXOuo4yslMOOj7O8gIRrf/trDBrFy5ZXwJL4ZzOos=
@@ -2105,7 +1853,6 @@
 github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
 github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
 github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.2.1/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -2113,7 +1860,6 @@
 github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-logr/stdr v1.2.0/go.mod h1:YkVgnZu1ZjjL7xTxrfm/LLZBfkhTqSR1ydtm6jTKKwI=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
@@ -2133,16 +1879,9 @@
 github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
 github.com/go-playground/locales v0.12.1/go.mod h1:IUMDtCfWo/w/mtMfIE/IG2K+Ey3ygWanZIBtBW0W2TM=
 github.com/go-playground/locales v0.13.0/go.mod h1:taPMhCMXrRLJO55olJkUXHZBHCxTMfnGwq/HNwmWNS8=
-github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
-github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
 github.com/go-playground/universal-translator v0.16.0/go.mod h1:1AnU7NaIRDWWzGEKwgtJRd2xk99HeFyHw3yid4rvQIY=
 github.com/go-playground/universal-translator v0.17.0/go.mod h1:UkSxE5sNxxRwHyU+Scu5vgOQjsIJAF8j9muTVoKLVtA=
-github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
-github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
-github.com/go-playground/validator/v10 v10.2.0/go.mod h1:uOYAAleCW8F/7oMFd6aG0GOhaH6EGOAJShg8Id5JGkI=
 github.com/go-playground/validator/v10 v10.4.1/go.mod h1:nlOn6nFhuKACm19sB/8EGNn9GlaMV7XkbRSipzJ0Ii4=
-github.com/go-playground/validator/v10 v10.14.0 h1:vgvQWe3XCz3gIeFDm/HnTIbj6UGmg/+t63MyGU2n5js=
-github.com/go-playground/validator/v10 v10.14.0/go.mod h1:9iXMNT7sEkjXb0I+enO7QXmzG6QCsPWY4zveKFVRSyU=
 github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
 github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
 github.com/go-redis/redis v6.15.8+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8wamY7mA7PouImQ2Jvg6kA=
@@ -2160,49 +1899,13 @@
 github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
-github.com/gobuffalo/attrs v0.0.0-20190224210810-a9411de4debd/go.mod h1:4duuawTqi2wkkpB4ePgWMaai6/Kc6WEz83bhFwpHzj0=
-github.com/gobuffalo/depgen v0.0.0-20190329151759-d478694a28d3/go.mod h1:3STtPUQYuzV0gBVOY3vy6CfMm/ljR4pABfrTeHNLHUY=
-github.com/gobuffalo/depgen v0.1.0/go.mod h1:+ifsuy7fhi15RWncXQQKjWS9JPkdah5sZvtHc2RXGlg=
-github.com/gobuffalo/envy v1.6.15/go.mod h1:n7DRkBerg/aorDM8kbduw5dN3oXGswK5liaSCx4T5NI=
-github.com/gobuffalo/envy v1.7.0/go.mod h1:n7DRkBerg/aorDM8kbduw5dN3oXGswK5liaSCx4T5NI=
-github.com/gobuffalo/flect v0.1.0/go.mod h1:d2ehjJqGOH/Kjqcoz+F7jHTBbmDb38yXA598Hb50EGs=
-github.com/gobuffalo/flect v0.1.1/go.mod h1:8JCgGVbRjJhVgD6399mQr4fx5rRfGKVzFjbj6RE/9UI=
-github.com/gobuffalo/flect v0.1.3/go.mod h1:8JCgGVbRjJhVgD6399mQr4fx5rRfGKVzFjbj6RE/9UI=
-github.com/gobuffalo/genny v0.0.0-20190329151137-27723ad26ef9/go.mod h1:rWs4Z12d1Zbf19rlsn0nurr75KqhYp52EAGGxTbBhNk=
-github.com/gobuffalo/genny v0.0.0-20190403191548-3ca520ef0d9e/go.mod h1:80lIj3kVJWwOrXWWMRzzdhW3DsrdjILVil/SFKBzF28=
-github.com/gobuffalo/genny v0.1.0/go.mod h1:XidbUqzak3lHdS//TPu2OgiFB+51Ur5f7CSnXZ/JDvo=
-github.com/gobuffalo/genny v0.1.1/go.mod h1:5TExbEyY48pfunL4QSXxlDOmdsD44RRq4mVZ0Ex28Xk=
-github.com/gobuffalo/gitgen v0.0.0-20190315122116-cc086187d211/go.mod h1:vEHJk/E9DmhejeLeNt7UVvlSGv3ziL+djtTr3yyzcOw=
-github.com/gobuffalo/gogen v0.0.0-20190315121717-8f38393713f5/go.mod h1:V9QVDIxsgKNZs6L2IYiGR8datgMhB577vzTDqypH360=
-github.com/gobuffalo/gogen v0.1.0/go.mod h1:8NTelM5qd8RZ15VjQTFkAW6qOMx5wBbW4dSCS3BY8gg=
-github.com/gobuffalo/gogen v0.1.1/go.mod h1:y8iBtmHmGc4qa3urIyo1shvOD8JftTtfcKi+71xfDNE=
-github.com/gobuffalo/here v0.6.0/go.mod h1:wAG085dHOYqUpf+Ap+WOdrPTp5IYcDAs/x7PLa8Y5fM=
-github.com/gobuffalo/logger v0.0.0-20190315122211-86e12af44bc2/go.mod h1:QdxcLw541hSGtBnhUc4gaNIXRjiDppFGaDqzbrBd3v8=
-github.com/gobuffalo/mapi v1.0.1/go.mod h1:4VAGh89y6rVOvm5A8fKFxYG+wIW6LO1FMTG9hnKStFc=
-github.com/gobuffalo/mapi v1.0.2/go.mod h1:4VAGh89y6rVOvm5A8fKFxYG+wIW6LO1FMTG9hnKStFc=
-github.com/gobuffalo/packd v0.0.0-20190315124812-a385830c7fc0/go.mod h1:M2Juc+hhDXf/PnmBANFCqx4DM3wRbgDvnVWeG2RIxq4=
-github.com/gobuffalo/packd v0.1.0/go.mod h1:M2Juc+hhDXf/PnmBANFCqx4DM3wRbgDvnVWeG2RIxq4=
-github.com/gobuffalo/packr/v2 v2.0.9/go.mod h1:emmyGweYTm6Kdper+iywB6YK5YzuKchGtJQZ0Odn4pQ=
-github.com/gobuffalo/packr/v2 v2.2.0/go.mod h1:CaAwI0GPIAv+5wKLtv8Afwl+Cm78K/I/VCm/3ptBN+0=
-github.com/gobuffalo/syncx v0.0.0-20190224160051-33c29581e754/go.mod h1:HhnNqWY95UYwwW3uSASeV7vtgYkT2t16hJgV3AEPUpw=
-github.com/gobwas/httphead v0.0.0-20180130184737-2c6c146eadee/go.mod h1:L0fX3K22YWvt/FAX9NnzrNzcI4wNYi9Yku4O0LKYflo=
-github.com/gobwas/httphead v0.1.0 h1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=
 github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
-github.com/gobwas/pool v0.2.0/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
-github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
-github.com/gobwas/ws v1.0.2/go.mod h1:szmBTxLgaFppYjEmNtny/v3w89xOydFnnZMcgRRu/EM=
-github.com/gobwas/ws v1.2.1 h1:F2aeBZrm2NDsc7vbovKrWSogd4wvfAxg0FQ89/iqOTk=
 github.com/gobwas/ws v1.2.1/go.mod h1:hRKAFb8wOxFROYNsT1bqfWnhX+b5MFeJM9r2ZSwg/KY=
 github.com/goccy/go-json v0.9.11/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
-github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/goccy/go-yaml v1.9.8/go.mod h1:JubOolP3gh0HpiBc4BLRD4YmjEjHAmIIB2aaXKkTfoE=
 github.com/goccy/go-yaml v1.11.0/go.mod h1:H+mJrWtjPTJAHvRbV09MCK9xYwODM+wRTVFFTWckfng=
-github.com/gocql/gocql v0.0.0-20210515062232-b7ef815b4556/go.mod h1:DL0ekTmBSTdlNF25Orwt/JMzqIq3EJ4MVa/J/uK64OY=
-github.com/godbus/dbus v0.0.0-20151105175453-c7fdd8b5cd55/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
-github.com/godbus/dbus v0.0.0-20180201030542-885f9cc04c9c/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
-github.com/godbus/dbus v0.0.0-20190422162347-ade71ed3457e/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
 github.com/godbus/dbus/v5 v5.0.3/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/godbus/dbus/v5 v5.0.6/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
@@ -2210,11 +1913,7 @@
 github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gofrs/flock v0.8.1 h1:+gYjHKf32LDeiEEFhQaotPbLuUXjY5ZqxKgXy7n59aw=
 github.com/gofrs/flock v0.8.1/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
-github.com/gofrs/uuid v3.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
-github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gogo/googleapis v1.1.0/go.mod h1:gf4bu3Q80BeJ6H1S1vYPm8/ELATdvryBaNFGgqEef3s=
-github.com/gogo/googleapis v1.2.0/go.mod h1:Njal3psf3qN6dwBtQfUmBZh2ybovJ0tlu3o/AC7HYjU=
-github.com/gogo/googleapis v1.4.0/go.mod h1:5YRNX2z1oM5gXdAkurHa942MDgEJyk02w4OecKY87+c=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.2.0/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
@@ -2222,14 +1921,9 @@
 github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
-github.com/golang-jwt/jwt/v4 v4.1.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
 github.com/golang-jwt/jwt/v4 v4.4.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
 github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
-github.com/golang-migrate/migrate/v4 v4.15.2 h1:vU+M05vs6jWHKDdmE1Ecwj0BznygFc4QsdRe2E/L7kc=
-github.com/golang-migrate/migrate/v4 v4.15.2/go.mod h1:f2toGLkYqD3JH+Todi4aZ2ZdbeUNx4sIwiOK96rE9Lw=
-github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=
@@ -2253,7 +1947,6 @@
 github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
 github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
 github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
-github.com/golang/protobuf v1.0.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -2275,9 +1968,7 @@
 github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/golang/snappy v0.0.0-20170215233205-553a64147049/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.0-20180518054509-2e65f85255db/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d h1:viFft9sS/dxoYY0aiOTsLKO2aZQAPT4nlQCsimGcSGE=
@@ -2298,7 +1989,6 @@
 github.com/google/certificate-transparency-go v1.1.2-0.20210512142713-bed466244fa6/go.mod h1:aF2dp7Dh81mY8Y/zpzyXps4fQW5zQbDu2CxfpJB6NkI=
 github.com/google/certificate-transparency-go v1.1.2 h1:4hE0GEId6NAW28dFpC+LrRGwQX5dtmXQGDbg8+/MZOM=
 github.com/google/certificate-transparency-go v1.1.2/go.mod h1:3OL+HKDqHPUfdKrHVQxO6T8nDLO0HF7LRTlkIWXaWvQ=
-github.com/google/flatbuffers v2.0.0+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
 github.com/google/flatbuffers v2.0.8+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
 github.com/google/flatbuffers v23.5.26+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
 github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
@@ -2323,16 +2013,13 @@
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-containerregistry v0.5.1/go.mod h1:Ct15B4yir3PLOP5jsy0GNeYVaIZs/MK/Jz5any1wFW0=
 github.com/google/go-dap v0.12.0 h1:rVcjv3SyMIrpaOoTAdFDyHs99CwVOItIJGKLQFQhNeM=
 github.com/google/go-dap v0.12.0/go.mod h1:tNjCASCm5cqePi/RVXXWEVqtnNLV1KTWtYOqu6rZNzc=
 github.com/google/go-github/v28 v28.1.1/go.mod h1:bsqJWQX05omyWVmc00nEUql9mhQyv38lDZ8kPZcQVoM=
-github.com/google/go-github/v39 v39.2.0/go.mod h1:C1s8C5aCC9L+JXIYpJM5GYytdX52vC1bLvHEF1IhBrE=
 github.com/google/go-licenses v0.0.0-20210329231322-ce1d9163b77d/go.mod h1:+TYOmkVoJOpwnS0wfdsJCV9CoD5nJYsHoFk/0CrTK4M=
 github.com/google/go-pkcs11 v0.2.0/go.mod h1:6eQoGcuNJpa7jnd5pMGdkSaQpNDYvPlXWMcjXXThLlY=
 github.com/google/go-pkcs11 v0.2.1-0.20230907215043-c6f79328ddf9/go.mod h1:6eQoGcuNJpa7jnd5pMGdkSaQpNDYvPlXWMcjXXThLlY=
 github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
-github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
 github.com/google/go-replayers/grpcreplay v0.1.0/go.mod h1:8Ig2Idjpr6gifRd6pNVggX6TC1Zw6Jx74AKp7QNH2QE=
 github.com/google/go-replayers/httpreplay v0.1.0/go.mod h1:YKZViNhiGgqdBlUbI2MwGpq4pXxNmhJLPHQ7cv2b5no=
 github.com/google/go-tpm v0.1.2-0.20190725015402-ae6dd98980d4/go.mod h1:H9HbmUG2YgV/PHITkO7p6wxEEj/v5nlsVWIwumwH2NI=
@@ -2459,12 +2146,8 @@
 github.com/goreleaser/goreleaser v0.134.0/go.mod h1:ZT6Y2rSYa6NxQzIsdfWWNWAlYGXGbreo66NmE+3X3WQ=
 github.com/goreleaser/nfpm v1.2.1/go.mod h1:TtWrABZozuLOttX2uDlYyECfQX7x5XYkVxhjYcR6G9w=
 github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
-github.com/gorilla/handlers v0.0.0-20150720190736-60c7bfde3e33/go.mod h1:Qkdc/uu4tH4g6mTK6auzZ766c4CA0Ng8+o/OAirnOIQ=
-github.com/gorilla/handlers v1.4.2/go.mod h1:Qkdc/uu4tH4g6mTK6auzZ766c4CA0Ng8+o/OAirnOIQ=
 github.com/gorilla/mux v1.6.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
-github.com/gorilla/mux v1.7.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.7.3/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
-github.com/gorilla/mux v1.7.4/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
 github.com/gorilla/websocket v0.0.0-20170926233335-4201258b820c/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
 github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
 github.com/gorilla/websocket v1.4.1/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
@@ -2499,12 +2182,10 @@
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0/go.mod h1:P+Lt/0by1T8bfcF3z737NnSbmxQAppXMRziHUxPOC8k=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 h1:asbCHRVmodnJTuQ3qamDwqVOIjwqUPTYmYuemVOx+Ys=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0/go.mod h1:ggCgvZ2r7uOoQjOyu2Y1NhHmEPPzzuhWgcza5M1Ji1I=
-github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
 github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
 github.com/hashicorp/consul/api v1.3.0/go.mod h1:MmDNSzIMUjNpY/mQ398R4bk2FnqQLoPndWW5VkKPlCE=
 github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
 github.com/hashicorp/consul/sdk v0.3.0/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
-github.com/hashicorp/errwrap v0.0.0-20141028054710-7554cd9344ce/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -2514,7 +2195,6 @@
 github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
-github.com/hashicorp/go-multierror v0.0.0-20161216184304-ed905158d874/go.mod h1:JMRHfdO9jKNzS/+BTlxCjKNQHg/jZAft8U7LloJvN7I=
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
@@ -2543,7 +2223,6 @@
 github.com/huandu/xstrings v1.2.0/go.mod h1:DvyZB1rfVYsBIigL8HwpZgxHwXozlTgGqn63UyNX5k4=
 github.com/hudl/fargo v1.3.0/go.mod h1:y3CKSmjA+wD2gak7sUSXTAoopbhU08POFhmITJgmKTg=
 github.com/iancoleman/strcase v0.2.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho=
-github.com/iancoleman/strcase v0.3.0 h1:nTXanmYxhfFAMjZL34Ov6gkzEsSJZ5DbhxWjvSASxEI=
 github.com/iancoleman/strcase v0.3.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
@@ -2556,85 +2235,21 @@
 github.com/imdario/mergo v0.3.4/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/imdario/mergo v0.3.8/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/imdario/mergo v0.3.9/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
-github.com/imdario/mergo v0.3.10/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/improbable-eng/grpc-web v0.15.0 h1:BN+7z6uNXZ1tQGcNAuaU1YjsLTApzkjt2tzCixLaUPQ=
-github.com/improbable-eng/grpc-web v0.15.0/go.mod h1:1sy9HKV4Jt9aEs9JSnkWlRJPuPtwNr0l57L4f878wP8=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d/go.mod h1:qj24IKcXYK6Iy9ceXlo3Tc+vtHo9lIhSX5JddghvEPo=
 github.com/insomniacslk/dhcp v0.0.0-20240829085014-a3a4c1f04475 h1:hxST5pwMBEOWmxpkX20w9oZG+hXdhKmAIPQ3NGGAxas=
 github.com/insomniacslk/dhcp v0.0.0-20240829085014-a3a4c1f04475/go.mod h1:KclMyHxX06VrVr0DJmeFSUb1ankt7xTfoOA35pCkoic=
-github.com/intel/goresctrl v0.2.0/go.mod h1:+CZdzouYFn5EsxgqAQTEzMfwKwuc0fVdMrT9FCCAVRQ=
 github.com/intel/goresctrl v0.8.0 h1:N3shVbS3kA1Hk2AmcbHv8805Hjbv+zqsCIZCGktxx50=
 github.com/intel/goresctrl v0.8.0/go.mod h1:T3ZZnuHSNouwELB5wvOoUJaB7l/4Rm23rJy/wuWJlr0=
 github.com/ishidawataru/sctp v0.0.0-20230406120618-7ff4192f6ff2/go.mod h1:co9pwDoBCm1kGxawmb4sPq0cSIOOWNPT4KnHotMP1Zg=
-github.com/j-keck/arping v0.0.0-20160618110441-2cf9dc699c56/go.mod h1:ymszkNOg6tORTn+6F6j+Jc8TOr5osrynvN6ivFWZ2GA=
-github.com/j-keck/arping v1.0.2/go.mod h1:aJbELhR92bSk7tp79AWM/ftfc90EfEi2bQJrbBFOsPw=
-github.com/jackc/chunkreader v1.0.0/go.mod h1:RT6O25fNZIuasFJRyZ4R/Y2BbhasbmZXF9QQ7T3kePo=
-github.com/jackc/chunkreader/v2 v2.0.0/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
-github.com/jackc/chunkreader/v2 v2.0.1/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
-github.com/jackc/pgconn v0.0.0-20190420214824-7e0022ef6ba3/go.mod h1:jkELnwuX+w9qN5YIfX0fl88Ehu4XC3keFuOJJk9pcnA=
-github.com/jackc/pgconn v0.0.0-20190824142844-760dd75542eb/go.mod h1:lLjNuW/+OfW9/pnVKPazfWOgNfH2aPem8YQ7ilXGvJE=
-github.com/jackc/pgconn v0.0.0-20190831204454-2fabfa3c18b7/go.mod h1:ZJKsE/KZfsUgOEh9hBm+xYTstcNHg7UPMVJqRfQxq4s=
-github.com/jackc/pgconn v1.4.0/go.mod h1:Y2O3ZDF0q4mMacyWV3AstPJpeHXWGEetiFttmq5lahk=
-github.com/jackc/pgconn v1.5.0/go.mod h1:QeD3lBfpTFe8WUnPZWN5KY/mB8FGMIYRdd8P8Jr0fAI=
-github.com/jackc/pgconn v1.5.1-0.20200601181101-fa742c524853/go.mod h1:QeD3lBfpTFe8WUnPZWN5KY/mB8FGMIYRdd8P8Jr0fAI=
-github.com/jackc/pgconn v1.8.0/go.mod h1:1C2Pb36bGIP9QHGBYCjnyhqu7Rv3sGshaQUvmfGIB/o=
-github.com/jackc/pgconn v1.9.0/go.mod h1:YctiPyvzfU11JFxoXokUOOKQXQmDMoJL9vJzHH8/2JY=
-github.com/jackc/pgconn v1.9.1-0.20210724152538-d89c8390a530/go.mod h1:4z2w8XhRbP1hYxkpTuBjTS3ne3J48K83+u0zoyvg2pI=
-github.com/jackc/pgconn v1.12.0/go.mod h1:ZkhRC59Llhrq3oSfrikvwQ5NaxYExr6twkdkMLaKono=
-github.com/jackc/pgconn v1.12.1/go.mod h1:ZkhRC59Llhrq3oSfrikvwQ5NaxYExr6twkdkMLaKono=
-github.com/jackc/pgerrcode v0.0.0-20201024163028-a0d42d470451/go.mod h1:a/s9Lp5W7n/DD0VrVoyJ00FbP2ytTPDVOivvn2bMlds=
-github.com/jackc/pgio v1.0.0/go.mod h1:oP+2QK2wFfUWgr+gxjoBH9KGBb31Eio69xUb0w5bYf8=
-github.com/jackc/pgmock v0.0.0-20190831213851-13a1b77aafa2/go.mod h1:fGZlG77KXmcq05nJLRkk0+p82V8B8Dw8KN2/V9c/OAE=
-github.com/jackc/pgmock v0.0.0-20201204152224-4fe30f7445fd/go.mod h1:hrBW0Enj2AZTNpt/7Y5rr2xe/9Mn757Wtb2xeBzPv2c=
-github.com/jackc/pgmock v0.0.0-20210724152146-4ad1a8207f65/go.mod h1:5R2h2EEX+qri8jOWMbJCtaPWkrrNc7OHwsp2TCqp7ak=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
-github.com/jackc/pgproto3 v1.1.0/go.mod h1:eR5FA3leWg7p9aeAqi37XOTgTIbkABlvcPB3E5rlc78=
-github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190420180111-c116219b62db/go.mod h1:bhq50y+xrl9n5mRYyCBFKkpRVTLYJVWeCc+mEAI3yXA=
-github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190609003834-432c2951c711/go.mod h1:uH0AWtUmuShn0bcesswc4aBTWGvw0cAxIJp+6OB//Wg=
-github.com/jackc/pgproto3/v2 v2.0.0-rc3/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
-github.com/jackc/pgproto3/v2 v2.0.0-rc3.0.20190831210041-4c03ce451f29/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
-github.com/jackc/pgproto3/v2 v2.0.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
-github.com/jackc/pgproto3/v2 v2.0.6/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
-github.com/jackc/pgproto3/v2 v2.0.7/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
-github.com/jackc/pgproto3/v2 v2.1.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
-github.com/jackc/pgproto3/v2 v2.3.0/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
-github.com/jackc/pgservicefile v0.0.0-20200307190119-3430c5407db8/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
-github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
 github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk=
 github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgtype v0.0.0-20190421001408-4ed0de4755e0/go.mod h1:hdSHsc1V01CGwFsrv11mJRHWJ6aifDLfdV3aVjFF0zg=
-github.com/jackc/pgtype v0.0.0-20190824184912-ab885b375b90/go.mod h1:KcahbBH1nCMSo2DXpzsoWOAfFkdEtEJpPbVLq8eE+mc=
-github.com/jackc/pgtype v0.0.0-20190828014616-a8802b16cc59/go.mod h1:MWlu30kVJrUS8lot6TQqcg7mtthZ9T0EoIBFiJcmcyw=
-github.com/jackc/pgtype v1.2.0/go.mod h1:5m2OfMh1wTK7x+Fk952IDmI4nw3nPrvtQdM0ZT4WpC0=
-github.com/jackc/pgtype v1.3.1-0.20200510190516-8cd94a14c75a/go.mod h1:vaogEUkALtxZMCH411K+tKzNpwzCKU+AnPzBKZ+I+Po=
-github.com/jackc/pgtype v1.3.1-0.20200606141011-f6355165a91c/go.mod h1:cvk9Bgu/VzJ9/lxTO5R5sf80p0DiucVtN7ZxvaC4GmQ=
-github.com/jackc/pgtype v1.6.2/go.mod h1:JCULISAZBFGrHaOXIIFiyfzW5VY0GRitRr8NeJsrdig=
-github.com/jackc/pgtype v1.8.1-0.20210724151600-32e20a603178/go.mod h1:C516IlIV9NKqfsMCXTdChteoXmwgUceqaLfjg2e3NlM=
-github.com/jackc/pgtype v1.11.0/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
-github.com/jackc/pgx/v4 v4.0.0-20190420224344-cc3461e65d96/go.mod h1:mdxmSJJuR08CZQyj1PVQBHy9XOp5p8/SHH6a0psbY9Y=
-github.com/jackc/pgx/v4 v4.0.0-20190421002000-1b8f0016e912/go.mod h1:no/Y67Jkk/9WuGR0JG/JseM9irFbnEPbuWV2EELPNuM=
-github.com/jackc/pgx/v4 v4.0.0-pre1.0.20190824185557-6972a5742186/go.mod h1:X+GQnOEnf1dqHGpw7JmHqHc1NxDoalibchSk9/RWuDc=
-github.com/jackc/pgx/v4 v4.5.0/go.mod h1:EpAKPLdnTorwmPUUsqrPxy5fphV18j9q3wrfRXgo+kA=
-github.com/jackc/pgx/v4 v4.6.1-0.20200510190926-94ba730bb1e9/go.mod h1:t3/cdRQl6fOLDxqtlyhe9UWgfIi9R8+8v8GKV5TRA/o=
-github.com/jackc/pgx/v4 v4.6.1-0.20200606145419-4e5062306904/go.mod h1:ZDaNWkt9sW1JMiNn0kdYBaLelIhw7Pg4qd+Vk6tw7Hg=
-github.com/jackc/pgx/v4 v4.10.1/go.mod h1:QlrWebbs3kqEZPHCTGyxecvzG6tvIsYu+A5b1raylkA=
-github.com/jackc/pgx/v4 v4.12.1-0.20210724153913-640aa07df17c/go.mod h1:1QD0+tgSXP7iUjYm9C1NxKhny7lq6ee99u/z+IHFcgs=
-github.com/jackc/pgx/v4 v4.16.0/go.mod h1:N0A9sFdWzkw/Jy1lwoiB64F2+ugFZi987zRxcPez/wI=
-github.com/jackc/pgx/v4 v4.16.1/go.mod h1:SIhx0D5hoADaiXZVyv+3gSm3LCIIINTVO0PficsvWGQ=
 github.com/jackc/pgx/v5 v5.4.3 h1:cxFyXhxlvAifxnkKKdlxv8XqUf59tDlYjnV5YYfsJJY=
 github.com/jackc/pgx/v5 v5.4.3/go.mod h1:Ig06C2Vu0t5qXC60W8sqIthScaEnFvojjj9dSljmHRA=
-github.com/jackc/puddle v0.0.0-20190413234325-e4ced69a3a2b/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
-github.com/jackc/puddle v0.0.0-20190608224051-11cab39313c9/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
-github.com/jackc/puddle v1.1.0/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
-github.com/jackc/puddle v1.1.1/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
-github.com/jackc/puddle v1.1.3/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
-github.com/jackc/puddle v1.2.1/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle/v2 v2.2.1 h1:RhxXJtFG022u4ibrCSMSiu5aOq1i77R3OHKNJj77OAk=
 github.com/jackc/puddle/v2 v2.2.1/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jarcoal/httpmock v1.0.5/go.mod h1:ATjnClrvW/3tijVmpL/va5Z3aAyGvqU3gCT8nX0Txik=
@@ -2646,17 +2261,10 @@
 github.com/jhump/protoreflect v1.9.0/go.mod h1:7GcYQDdMU/O/BBrl/cX6PNHpXh6cenjd8pneu5yW7Tg=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
 github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
-github.com/jinzhu/now v1.1.1/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
-github.com/jinzhu/now v1.1.4/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
 github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
-github.com/jmespath/go-jmespath v0.0.0-20160803190731-bd40a432e4c7/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
 github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
-github.com/jmoiron/sqlx v1.2.0/go.mod h1:1FEQNm3xlJgrMD+FBdI9+xvCksHtbpVBBw5dYhBSsks=
-github.com/jmoiron/sqlx v1.3.1/go.mod h1:2BljVx/86SuTyjE+aPYlHCTNvZrnJXghYGpNiXLBMCQ=
-github.com/jmoiron/sqlx v1.3.5/go.mod h1:nRVWtLre0KfCLJvgxzCsLVMogSvQ1zNJtpYr2Ccp0mQ=
-github.com/joefitzgerald/rainbow-reporter v0.1.0/go.mod h1:481CNgqmVHQZzdIbN52CupLJyoVwB10FQ/IQlF1pdL8=
 github.com/joho/godotenv v1.3.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqxOKXbg=
 github.com/joho/godotenv v1.4.0 h1:3l4+N6zfMWnkbPEXKng2o2/MR5mSwTrBih4ZEkkz1lg=
 github.com/joho/godotenv v1.4.0/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
@@ -2696,12 +2304,7 @@
 github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
 github.com/jung-kurt/gofpdf v1.0.0/go.mod h1:7Id9E/uU8ce6rXgefFLlgrJj/GYY22cpxn+r32jIOes=
 github.com/jung-kurt/gofpdf v1.0.3-0.20190309125859-24315acbbda5/go.mod h1:7Id9E/uU8ce6rXgefFLlgrJj/GYY22cpxn+r32jIOes=
-github.com/k0kubun/colorstring v0.0.0-20150214042306-9440f1994b88/go.mod h1:3w7q1U84EfirKl04SVQ/s7nPm1ZPhiXd34z40TNz36k=
 github.com/k0kubun/go-ansi v0.0.0-20180517002512-3bf9e2903213/go.mod h1:vNUNkEQ1e29fT/6vq2aBdFsgNPmy8qMdSay1npru+Sw=
-github.com/k0kubun/pp v2.3.0+incompatible/go.mod h1:GWse8YhT0p8pT4ir3ZgBbfZild3tgzSScAn6HmfYukg=
-github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0/go.mod h1:1NbS8ALrpOvjt0rHPNLyCIeMtbizbir8U//inJ+zuB8=
-github.com/karrick/godirwalk v1.8.0/go.mod h1:H5KPZjojv4lE+QYImBI8xVtrBRgYrIVsaRPx4tDPEn4=
-github.com/karrick/godirwalk v1.10.3/go.mod h1:RoGL9dQei4vP9ilrpETWE8CLOZ1kiN0LhBygSwrAsHA=
 github.com/karrick/godirwalk v1.17.0 h1:b4kY7nqDdioR/6qnbHQyDvmA17u5G1cZ6J+CZXwSWoI=
 github.com/karrick/godirwalk v1.17.0/go.mod h1:j4mkqPuvaLI8mp1DroR3P6ad7cyYd4c1qeJ3RV7ULlk=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
@@ -2712,22 +2315,13 @@
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/asmfmt v1.3.2/go.mod h1:AG8TuvYojzulgDAMCnYn50l/5QV3Bs/tp6j0HLHbNSE=
-github.com/klauspost/compress v1.9.5/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.10.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.11.1/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
-github.com/klauspost/compress v1.11.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
-github.com/klauspost/compress v1.11.7/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
-github.com/klauspost/compress v1.11.13/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
-github.com/klauspost/compress v1.13.1/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
-github.com/klauspost/compress v1.13.4/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
-github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
 github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHUDtV4Yw2GlzU=
 github.com/klauspost/compress v1.16.7/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
 github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
 github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.2.3/go.mod h1:RVVoqg1df56z8g3pUjL/3lE5UfnlrJX8tyFgg4nqhuY=
-github.com/klauspost/cpuid/v2 v2.2.5 h1:0E5MSMDEoAulmXNFquVs//DdoomxaoTY1kUhbc/qbZg=
 github.com/klauspost/cpuid/v2 v2.2.5/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
 github.com/koneu/natend v0.0.0-20150829182554-ec0926ea948d/go.mod h1:QHb4k4cr1fQikUahfcRVPcEXiUgFsdIstGqlurL0XL4=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
@@ -2748,40 +2342,26 @@
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/ktrysmt/go-bitbucket v0.6.4/go.mod h1:9u0v3hsd2rqCHRIpbir1oP7F58uo5dq19sBYvuMoyQ4=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/ledongthuc/pdf v0.0.0-20220302134840-0c2507a12d80/go.mod h1:imJHygn/1yfhB7XSJJKlFZKl/J+dCPAknuiaGOshXAs=
 github.com/leodido/go-urn v1.1.0/go.mod h1:+cyI34gQWZcE1eQU7NVgKkkzdXDQHr1dBMtdAPozLkw=
 github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=
-github.com/leodido/go-urn v1.2.4 h1:XlAE/cm/ms7TE/VMVoduSpNBoyc2dOxHs5MZSwAN63Q=
-github.com/leodido/go-urn v1.2.4/go.mod h1:7ZrI8mTSeBSHl/UaRyKQW1qZeMgak41ANeCNaVckg+4=
 github.com/letsencrypt/pkcs11key/v4 v4.0.0/go.mod h1:EFUvBDay26dErnNb70Nd0/VW3tJiIbETBPTl9ATXQag=
-github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.1.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.1.1/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.3.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.8.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/lib/pq v1.10.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/lib/pq v1.10.2/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/lib/pq v1.10.6/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
-github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/libopenstorage/openstorage v1.0.0 h1:GLPam7/0mpdP8ZZtKjbfcXJBTIA/T1O6CBErVEFEyIM=
 github.com/libopenstorage/openstorage v1.0.0/go.mod h1:Sp1sIObHjat1BeXhfMqLZ14wnOzEhNx2YQedreMcUyc=
 github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0=
 github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE=
 github.com/lightstep/lightstep-tracer-common/golang/gogo v0.0.0-20190605223551-bc2310a04743/go.mod h1:qklhhLq1aX+mtWk9cPHPzaBjWImj5ULL6C7HFJtXQMM=
 github.com/lightstep/lightstep-tracer-go v0.18.1/go.mod h1:jlF1pusYV4pidLvZ+XD0UBX0ZE6WURAspgAczcDHrL4=
-github.com/linuxkit/virtsock v0.0.0-20201010232012-f8cee7dfc7a3/go.mod h1:3r6x7q95whyfWQpmGZTu3gk3v2YkMi05HEzl7Tf7YEo=
 github.com/lithammer/dedent v1.1.0 h1:VNzHMVCBNG1j0fh3OrsFRkVUwStdDArbgBWoPAffktY=
 github.com/lithammer/dedent v1.1.0/go.mod h1:jrXYCQtgg0nJiN+StA2KgR7w6CiQNv9Fd/Z9BP0jIOc=
 github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
 github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/lufia/iostat v1.2.1 h1:tnCdZBIglgxD47RyD55kfWQcJMGzO+1QBziSQfesf2k=
 github.com/lufia/iostat v1.2.1/go.mod h1:rEPNA0xXgjHQjuI5Cy05sLlS2oRcSlWHRLrvh/AQ+Pg=
-github.com/lyft/protoc-gen-star v0.5.3/go.mod h1:V0xaHgaf5oCCqmcxYcWiDfTiKsZsRc87/1qhoTACD8w=
 github.com/lyft/protoc-gen-star v0.6.0/go.mod h1:TGAoBVkt8w7MPG72TrKIu85MIdXwDuzJYeZuUPFPNwA=
 github.com/lyft/protoc-gen-star v0.6.1/go.mod h1:TGAoBVkt8w7MPG72TrKIu85MIdXwDuzJYeZuUPFPNwA=
 github.com/lyft/protoc-gen-star/v2 v2.0.1/go.mod h1:RcCdONR2ScXaYnQC5tUzxzlpA3WVYF7/opLeUgcQs/o=
@@ -2791,10 +2371,6 @@
 github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
-github.com/markbates/oncer v0.0.0-20181203154359-bf2de49a0be2/go.mod h1:Ld9puTsIW75CHf65OeIOkyKbteujpZVXDpWK6YGZbxE=
-github.com/markbates/pkger v0.15.1/go.mod h1:0JoVlrol20BSywW79rN3kdFFsE5xYM+rSCQDXbLhiuI=
-github.com/markbates/safe v1.0.1/go.mod h1:nAqgmRi7cY2nqMc92/bSEeQA+R4OheNU2T1kNSCBdG0=
-github.com/marstr/guid v1.1.0/go.mod h1:74gB1z2wpxxInTG6yaqA7KrtM0NZ+RbrcqDvYHefzho=
 github.com/mattfenwick/collections v0.3.2 h1:sdEBe7/cL+dK7CZ0SXod07qzCpoGJu2xtOywAF155Us=
 github.com/mattfenwick/collections v0.3.2/go.mod h1:S2z3MxcMsoBiP8Zw4ewmFvQcfq7QfesA7V192udZ0W8=
 github.com/mattfenwick/cyclonus v0.5.6 h1:8bZ+v2Kcn4H7Z+OhX1l3BQrAHqUdmBwdBBiDIk3Wj7s=
@@ -2803,17 +2379,14 @@
 github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
 github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-ieproxy v0.0.0-20190610004146-91bb50d98149/go.mod h1:31jz6HNzdxOmlERGGEc4v/dMssOfmp2p5bT/okiKFFc=
-github.com/mattn/go-ieproxy v0.0.1/go.mod h1:pYabZ6IHcRpFh7vIaLfK7rdcWgFEb3SFJ6/gNWuh88E=
 github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.7/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.9/go.mod h1:YNRxwqDuOph6SZLI9vUUz6OYw3QyUt7WiY2yME+cCiQ=
 github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
@@ -2833,14 +2406,9 @@
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U=
 github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
-github.com/mattn/go-shellwords v1.0.3/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
-github.com/mattn/go-shellwords v1.0.6/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
 github.com/mattn/go-shellwords v1.0.10/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
 github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
 github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
-github.com/mattn/go-sqlite3 v1.9.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
-github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
-github.com/mattn/go-sqlite3 v1.14.10/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
 github.com/mattn/go-sqlite3 v1.14.14/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
 github.com/mattn/go-sqlite3 v1.14.15/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
 github.com/mattn/go-sqlite3 v1.14.16/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
@@ -2853,7 +2421,6 @@
 github.com/matttproud/golang_protobuf_extensions v1.0.2/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
 github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
 github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0/go.mod h1:QUyp042oQthUoa9bqDv0ER0wrtXnBruoNd7aNjkbP+k=
-github.com/maxbrunsfeld/counterfeiter/v6 v6.2.2/go.mod h1:eD9eIE7cdwcMi9rYluz88Jz2VyhSmden33/aXg4oVIY=
 github.com/mdlayher/arp v0.0.0-20220512170110-6706a2966875 h1:ql8x//rJsHMjS+qqEag8n3i4azw1QneKh5PieH9UEbY=
 github.com/mdlayher/arp v0.0.0-20220512170110-6706a2966875/go.mod h1:kfOoFJuHWp76v1RgZCb9/gVUc7XdY877S2uVYbNliGc=
 github.com/mdlayher/ethernet v0.0.0-20220221185849-529eae5b6118 h1:2oDp6OOhLxQ9JBoUuysVz9UZ9uI6oLUbvAZu0x8o+vE=
@@ -2917,9 +2484,7 @@
 github.com/mitchellh/gox v0.4.0/go.mod h1:Sd9lOJ0+aimLBi73mGofS1ycjY8lL3uZM3JPS42BGNg=
 github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0QubkSMEySY=
 github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/mitchellh/mapstructure v0.0.0-20180220230111-00c29f56e238/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/mitchellh/osext v0.0.0-20151018003038-5e2d6d41470f/go.mod h1:OkQIRizQZAeMln+1tSwduZz7+Af5oFlKirV/MSYes2A=
 github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/mitchellh/reflectwalk v1.0.1/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/mndrix/tap-go v0.0.0-20171203230836-629fa407e90b/go.mod h1:pzzDgJWZ34fGzaAZGFW22KVZDfyrYW+QABMrWnJBnSs=
@@ -2930,26 +2495,20 @@
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU=
 github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
-github.com/moby/sys/mountinfo v0.4.0/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
-github.com/moby/sys/mountinfo v0.4.1/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
 github.com/moby/sys/mountinfo v0.5.0/go.mod h1:3bMD3Rg+zkqx8MRYPi7Pyb0Ie97QEBmdxbhnCLlSvSU=
 github.com/moby/sys/mountinfo v0.7.1/go.mod h1:IJb6JQeOklcdMU9F5xQ8ZALD+CUr5VlGpwtX+VE0rpI=
 github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
 github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
 github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
 github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
-github.com/moby/sys/signal v0.6.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn88Kg8Tg=
 github.com/moby/sys/signal v0.7.1 h1:PrQxdvxcGijdo6UXXo/lU/TvHUWyPhj7UOpSo8tuvk0=
 github.com/moby/sys/signal v0.7.1/go.mod h1:Se1VGehYokAkrSQwL4tDzHvETwUZlnY7S5XtQ50mQp8=
-github.com/moby/sys/symlink v0.1.0/go.mod h1:GGDODQmbFOjFsXvfLVn3+ZRxkch54RkSiGqsZeMYowQ=
-github.com/moby/sys/symlink v0.2.0/go.mod h1:7uZVF2dqJjG/NsClqul95CqKOBRQyYSNnJ6BMgR/gFs=
 github.com/moby/sys/symlink v0.3.0 h1:GZX89mEZ9u53f97npBy4Rc3vJKj7JBDj/PN2I22GrNU=
 github.com/moby/sys/symlink v0.3.0/go.mod h1:3eNdhduHmYPcgsJtZXW1W4XUJdZGBIkttZ8xKqPUJq0=
 github.com/moby/sys/user v0.3.0 h1:9ni5DlcW5an3SvRSx4MouotOygvzaXbaSrc/wGDFWPo=
 github.com/moby/sys/user v0.3.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
 github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
 github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
-github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6/go.mod h1:E2VnQOmVuvZB6UYnnDB0qG5Nq/1tD9acaOpo6xmt0Kw=
 github.com/moby/term v0.0.0-20221205130635-1aeaba878587/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
 github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
 github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
@@ -2960,15 +2519,10 @@
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/modocache/gover v0.0.0-20171022184752-b58185e213c5/go.mod h1:caMODM3PzxT8aQXRPkAt8xlV/e7d7w8GM5g0fa5F0D8=
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9M+97sNutRR1RKhG96O6jWumTTnw=
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
-github.com/monogon-dev/packngo v0.0.0-20240122175436-ecbd9eb00ddb h1:sxSnvzB4iDBNhUBqXME/ETqjF4vX0mURE85T/I/Mr0o=
-github.com/monogon-dev/packngo v0.0.0-20240122175436-ecbd9eb00ddb/go.mod h1:Io6VJqzkiqmIEQbpOjeIw9v8q9PfcTEq8TEY/tMQsfw=
-github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe/go.mod h1:wL8QJuTMNUDYhXwkmfOly8iTdp5TEcJFWZD2D7SIkUc=
-github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
 github.com/mrunalp/fileutils v0.5.1 h1:F+S7ZlNKnrwHfSwdlgNSkKo67ReVf8o9fel6C3dkm/Q=
@@ -2978,15 +2532,12 @@
 github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/mutecomm/go-sqlcipher/v4 v4.4.0/go.mod h1:PyN04SaWalavxRGH9E8ZftG6Ju7rsPrGmQRjrEaVpiY=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f h1:KUppIJq7/+SVif2QVs3tOP0zanoHgBEVAwHxUSIzRqU=
 github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mwitkow/go-proto-validators v0.3.2/go.mod h1:ej0Qp0qMgHN/KtDyUt+Q1/tA7a5VarXUOUxD+oeD30w=
-github.com/mwitkow/grpc-proxy v0.0.0-20181017164139-0f1106ef9c76/go.mod h1:x5OoJHDHqxHS801UIuhqGl6QdSAEJvtausosHSdazIo=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
-github.com/nakagami/firebirdsql v0.0.0-20190310045651-3c02a58cfed8/go.mod h1:86wM1zFnC6/uDBfZGNwB65O+pR2OFi5q/YQaEUid1qA=
 github.com/nats-io/jwt v0.3.0/go.mod h1:fRYCDE99xlTsqUzISS1Bi75UBJ6ljOJQOAAu5VglpSg=
 github.com/nats-io/jwt v0.3.2/go.mod h1:/euKqTS1ZD+zzjYrY7pseZrTtWQSjujC7xjPc8wL6eU=
 github.com/nats-io/nats-server/v2 v2.1.2/go.mod h1:Afk+wRZqkMQs/p45uXdrVLuab3gwv3Z8C4HTBu8GD/k=
@@ -2994,9 +2545,6 @@
 github.com/nats-io/nkeys v0.1.0/go.mod h1:xpnFELMwJABBLVhffcfd1MZx6VsNRFpEugbxziKVo7w=
 github.com/nats-io/nkeys v0.1.3/go.mod h1:xpnFELMwJABBLVhffcfd1MZx6VsNRFpEugbxziKVo7w=
 github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
-github.com/ncw/swift v1.0.47/go.mod h1:23YIA4yWVnGwv2dQlN4bB7egfYX6YLn0Yo/S6zZO/ZM=
-github.com/neo4j/neo4j-go-driver v1.8.1-0.20200803113522-b626aa943eba/go.mod h1:ncO5VaFWh0Nrt+4KT4mOZboaczBZcLuHrG+/sUeP8gI=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/nishanths/predeclared v0.0.0-20190419143655-18a43bb90ffc/go.mod h1:62PewwiQTlm/7Rj+cxVYqZvDIUc+JjZq6GHAC1fsObQ=
 github.com/nishanths/predeclared v0.0.0-20200524104333-86fad755b4d3/go.mod h1:nt3d53pc1VYcphSCIaYAJtnPYnr3Zyn8fMq2wvPGPso=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
@@ -3010,15 +2558,10 @@
 github.com/olekukonko/tablewriter v0.0.4/go.mod h1:zq6QwlOf5SlnkVbMSr5EoBv3636FWnp+qbPhuoO21uA=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
-github.com/onsi/ginkgo v0.0.0-20151202141238-7f8ab55aaf3b/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.8.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.10.3/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.12.0/go.mod h1:oUhWkIvk5aDxtKvDDuw8gItl8pKl42LzjC9KZE0HfGg=
 github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
-github.com/onsi/ginkgo v1.13.0/go.mod h1:+REjRxOmWfHCjfv9TTWB1jD1Frx4XydAD3zm1lskyM0=
 github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
 github.com/onsi/ginkgo/v2 v2.1.3/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
 github.com/onsi/ginkgo/v2 v2.1.4/go.mod h1:um6tUpWM/cxCK3/FK8BXqEiUMUwRgSM4JXG47RKZmLU=
@@ -3042,15 +2585,11 @@
 github.com/onsi/ginkgo/v2 v2.21.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
 github.com/onsi/ginkgo/v2 v2.22.0 h1:Yed107/8DjTr0lKCNt7Dn8yQ6ybuDRQoMGrNFKzMfHg=
 github.com/onsi/ginkgo/v2 v2.22.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
-github.com/onsi/gomega v0.0.0-20151007035656-2152b45fa28a/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
 github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
-github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
-github.com/onsi/gomega v1.9.0/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
 github.com/onsi/gomega v1.10.3/go.mod h1:V9xEwhxec5O8UDM77eCW8vLymOMltsqPVYWrpDsH8xc=
-github.com/onsi/gomega v1.15.0/go.mod h1:cIuvLEne0aoVhAgh/O6ac0Op8WWw9H6eYCriF+tEHG0=
 github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
 github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro=
 github.com/onsi/gomega v1.20.1/go.mod h1:DtrZpjmvpn2mPm4YWQa0/ALMDj9v4YxLgojwPeREyVo=
@@ -3075,44 +2614,21 @@
 github.com/onsi/gomega v1.36.0 h1:Pb12RlruUtj4XUuPUqeEWc6j5DkVVVA49Uf6YLfC95Y=
 github.com/onsi/gomega v1.36.0/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
 github.com/op/go-logging v0.0.0-20160315200505-970db520ece7/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk=
-github.com/opencontainers/go-digest v0.0.0-20170106003457-a6d0ee40d420/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
-github.com/opencontainers/go-digest v0.0.0-20180430190053-c9281466c8b2/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
-github.com/opencontainers/go-digest v1.0.0-rc1/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
-github.com/opencontainers/go-digest v1.0.0-rc1.0.20180430190053-c9281466c8b2/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.0.0/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
-github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
-github.com/opencontainers/image-spec v1.0.2-0.20211117181255-693428a734f5/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
 github.com/opencontainers/image-spec v1.0.2/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
 github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
 github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
-github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
-github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
-github.com/opencontainers/runc v1.0.0-rc8.0.20190926000215-3e425f80a8c9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
-github.com/opencontainers/runc v1.0.0-rc9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
-github.com/opencontainers/runc v1.0.0-rc93/go.mod h1:3NOsor4w32B2tC0Zbl8Knk4Wg84SM2ImC1fxBuqJ/H0=
-github.com/opencontainers/runc v1.0.2/go.mod h1:aTaHFFwQXuA71CiyxOdFFIorAoemI04suvGRQFzWTD0=
-github.com/opencontainers/runc v1.1.0/go.mod h1:Tj1hFw6eFWp/o33uxGf5yF2BX5yz2Z6iptFpuvbbKqc=
 github.com/opencontainers/runc v1.1.13/go.mod h1:R016aXacfp/gwQBYw2FDGa9m+n6atbLWrYY8hNMT/sA=
 github.com/opencontainers/runc v1.2.1/go.mod h1:/PXzF0h531HTMsYQnmxXkBD7YaGShm/2zcRB79dksUc=
 github.com/opencontainers/runc v1.2.2 h1:jTg3Vw2A5f0N9PoxFTEwUhvpANGaNPT3689Yfd/zaX0=
 github.com/opencontainers/runc v1.2.2/go.mod h1:/PXzF0h531HTMsYQnmxXkBD7YaGShm/2zcRB79dksUc=
-github.com/opencontainers/runtime-spec v0.1.2-0.20190507144316-5b71a03e2700/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-spec v1.0.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-spec v1.0.2-0.20190207185410-29686dbc5559/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-spec v1.0.2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-spec v1.0.3-0.20200929063507-e6143ca7d51d/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/runtime-spec v1.0.3-0.20220825212826-86290f6a00fb/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/runtime-spec v1.2.0 h1:z97+pHb3uELt/yiAWD691HNHQIF07bE7dzrbT927iTk=
 github.com/opencontainers/runtime-spec v1.2.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-tools v0.0.0-20181011054405-1d69bd0f9c39/go.mod h1:r3f7wjNzSs2extwzU3Y+6pKfobzPh+kKFJ3ofN+3nfs=
 github.com/opencontainers/runtime-tools v0.9.1-0.20221107090550-2e043c6bd626 h1:DmNGcqH3WDbV5k8OJ+esPWbqUOX5rMLR2PMvziDMJi0=
 github.com/opencontainers/runtime-tools v0.9.1-0.20221107090550-2e043c6bd626/go.mod h1:BRHJJd0E+cx42OybVYSgUvZmU0B8P9gZuRXlZUP7TKI=
-github.com/opencontainers/selinux v1.6.0/go.mod h1:VVGKuOLlE7v4PJyT6h7mNWvq1rzqiriPsEqVhc+svHE=
-github.com/opencontainers/selinux v1.8.0/go.mod h1:RScLhm78qiWa2gbVCcGkC7tCGdgk3ogry1nUQF8Evvo=
-github.com/opencontainers/selinux v1.8.2/go.mod h1:MUIHuUEvKB1wtJjQdOyYRgOnLD2xAPP8dBsCoU0KuF8=
 github.com/opencontainers/selinux v1.9.1/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI=
 github.com/opencontainers/selinux v1.10.0/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI=
 github.com/opencontainers/selinux v1.11.0/go.mod h1:E5dMC3VPuVvVHDYmi78qvhJp8+M586T4DlDRYpFkyec=
@@ -3137,9 +2653,6 @@
 github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
 github.com/pelletier/go-buffruneio v0.2.0/go.mod h1:JkE26KsDizTr40EUHkXVtNPvgGtbSNq5BcowyYOWdKo=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
-github.com/pelletier/go-toml v1.7.0/go.mod h1:vwGMzjaWMwyfHwgIBhI2YUM4fB6nL6lVAvS1LBMMhTE=
-github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrapLU/GW4pbc=
-github.com/pelletier/go-toml v1.9.3/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
 github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
 github.com/performancecopilot/speed v3.0.0+incompatible/go.mod h1:/CLtqpZ5gBg1M9iaPbIdPPGyKcA8hKdoy6hAWba7Yac=
@@ -3155,7 +2668,6 @@
 github.com/pierrec/lz4 v2.3.0+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
 github.com/pierrec/lz4 v2.6.1+incompatible h1:9UY3+iC23yxF0UfGaYrGplQ+79Rg+h/q9FV9ix19jjM=
 github.com/pierrec/lz4 v2.6.1+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
-github.com/pierrec/lz4/v4 v4.1.8/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pierrec/lz4/v4 v4.1.18/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
@@ -3170,11 +2682,8 @@
 github.com/pingcap/log v1.1.0/go.mod h1:DWQW5jICDR7UJh4HtxXSM20Churx4CQL0fwL/SoOSA4=
 github.com/pingcap/tidb/parser v0.0.0-20231010133155-38cb4f3312be h1:4HUBkIZs+4j+tbXGm5/B0yjB66OTz218HDKA6VrhO7U=
 github.com/pingcap/tidb/parser v0.0.0-20231010133155-38cb4f3312be/go.mod h1:cwq4bKUlftpWuznB+rqNwbN0xy6/i5SL/nYvEKeJn4s=
-github.com/pkg/browser v0.0.0-20210706143420-7d21f8c997e2/go.mod h1:HKlIX3XHQyzLZPlr7++PzdhaXEj94dEiJgZDTsxEqUI=
-github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8/go.mod h1:HKlIX3XHQyzLZPlr7++PzdhaXEj94dEiJgZDTsxEqUI=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/errors v0.8.1-0.20171018195549-f15c970de5b7/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -3196,7 +2705,6 @@
 github.com/pquerna/cachecontrol v0.1.0/go.mod h1:NrUG3Z7Rdu85UNR3vm7SOsl1nFIeSiQnrHV5K9mBcUI=
 github.com/prometheus-community/go-runit v0.1.0 h1:uTWEj/Fn2RoLdfg/etSqwzgYNOYPrARx1BHUN052tGA=
 github.com/prometheus-community/go-runit v0.1.0/go.mod h1:AvJ9Jo3gAFu2lbM4+qfjdpq30FfiLDJZKbQ015u08IQ=
-github.com/prometheus/client_golang v0.0.0-20180209125602-c332b6f63c06/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.3-0.20190127221311-3c4408c8b829/go.mod h1:p2iRAGwDERtqlqzRXnrOVns+ignqQo//hLXqYxZYVNs=
 github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
@@ -3216,7 +2724,6 @@
 github.com/prometheus/client_golang v1.19.1/go.mod h1:mP78NwGzrVks5S2H6ab8+ZZGJLZUq1hoULYBAYBw1Ho=
 github.com/prometheus/client_golang v1.21.0 h1:DIsaGmiaBkSangBgMtWdNfxbMNdku5IK6iNhrEqWvdA=
 github.com/prometheus/client_golang v1.21.0/go.mod h1:U9NM32ykUErtVBxdvD3zfi+EuFkkaBvMb09mIfe0Zgg=
-github.com/prometheus/client_model v0.0.0-20171117100541-99fa1f4be8e5/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190115171406-56726106282f/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
@@ -3229,7 +2736,6 @@
 github.com/prometheus/client_model v0.5.0/go.mod h1:dTiFglRmd66nLR9Pv9f0mZi7B7fk5Pm3gvsjB5tr+kI=
 github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
 github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
-github.com/prometheus/common v0.0.0-20180110214958-89604d197083/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.2.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
@@ -3238,10 +2744,8 @@
 github.com/prometheus/common v0.7.0/go.mod h1:DjGbpBbp5NYNiECxcL/VnbXCCaQpKd3tt26CguLLsqA=
 github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8bs7vj7HSQ4=
 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
-github.com/prometheus/common v0.15.0/go.mod h1:U+gB1OBLb1lF3O42bTCL+FK18tX9Oar16Clt/msog/s=
 github.com/prometheus/common v0.18.0/go.mod h1:U+gB1OBLb1lF3O42bTCL+FK18tX9Oar16Clt/msog/s=
 github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
-github.com/prometheus/common v0.30.0/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
 github.com/prometheus/common v0.32.1/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
 github.com/prometheus/common v0.37.0/go.mod h1:phzohg0JFMnBEFGxTDbfu3QyL5GI8gTQJFhYO5B3mfA=
 github.com/prometheus/common v0.42.0/go.mod h1:xBwqVerjNdUDjgODMpudtOMwlOwf2SaTr1yjz4b7Zbc=
@@ -3255,18 +2759,14 @@
 github.com/prometheus/exporter-toolkit v0.14.0/go.mod h1:Gu5LnVvt7Nr/oqTBUC23WILZepW0nffNo10XdhQcwWA=
 github.com/prometheus/node_exporter v1.9.0 h1:qjXtu1H4Cj8JnVGCiAoW5Bpu8woL6O5b69bhPw3TNjc=
 github.com/prometheus/node_exporter v1.9.0/go.mod h1:wJdVxMYyn1H59zeEJfCQv5CTnxBc2PKOpA3zc+nFU2s=
-github.com/prometheus/procfs v0.0.0-20180125133057-cb4147076ac7/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190117184657-bf6a532e95b1/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
-github.com/prometheus/procfs v0.0.0-20190522114515-bc1a522cf7b1/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
-github.com/prometheus/procfs v0.0.5/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
 github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
 github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.2.0/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
-github.com/prometheus/procfs v0.3.0/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
 github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
 github.com/prometheus/procfs v0.8.0/go.mod h1:z7EfXMXOkbkqb9IINtpCn86r/to3BnA0uaxHdg830/4=
@@ -3282,7 +2782,6 @@
 github.com/pseudomuto/protoc-gen-doc v1.5.0/go.mod h1:exDTOVwqpp30eV/EDPFLZy3Pwr2sn6hBC1WIYH/UbIg=
 github.com/pseudomuto/protokit v0.2.0/go.mod h1:2PdH30hxVHsup8KpBTOXTBeMVhJZVio3Q8ViKSAXT0Q=
 github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
-github.com/remyoudompheng/bigfft v0.0.0-20190728182440-6a916e37a237/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
@@ -3301,8 +2800,6 @@
 github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
 github.com/rogpeppe/fastuuid v1.1.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
-github.com/rogpeppe/go-internal v1.1.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.2.2/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
@@ -3312,11 +2809,7 @@
 github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
 github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/rs/cors v1.7.0/go.mod h1:gFx+x8UowdsKA9AchylcLynDq+nNFfI8FkUZdN/jGCU=
-github.com/rs/cors v1.8.0 h1:P2KMzcFwrPoSjkF1WLRPsp3UMLyql8L4v9hQpVeK5so=
 github.com/rs/cors v1.8.0/go.mod h1:EBwu+T5AvHOcXwvZIkQFjUN6s8Czyqw12GL/Y0tUyRM=
-github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
-github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
-github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
 github.com/russross/blackfriday v1.6.0/go.mod h1:ti0ldHuxg49ri4ksnFxlkCfN+hvslNlmVHqNRXXJNAY=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
@@ -3325,13 +2818,10 @@
 github.com/ruudk/golang-pdf417 v0.0.0-20181029194003-1af4ab5afa58/go.mod h1:6lfFZQK844Gfx8o5WFuvpxWRwnSoipWe/p622j1v06w=
 github.com/ruudk/golang-pdf417 v0.0.0-20201230142125-a7e3863a1245/go.mod h1:pQAZKsJ8yyVxGRWYNEm9oFB8ieLgKFnamEyDmSA0BRk=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/safchain/ethtool v0.0.0-20190326074333-42ed695e3de8/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
-github.com/safchain/ethtool v0.0.0-20210803160452-9aa261dae9b1/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
 github.com/safchain/ethtool v0.5.10 h1:Im294gZtuf4pSGJRAOGKaASNi3wMeFaGaWuSaomedpc=
 github.com/safchain/ethtool v0.5.10/go.mod h1:w9jh2Lx7YBR4UwzLkzCmWl85UY0W2uZdd7/DckVE5+c=
 github.com/samuel/go-zookeeper v0.0.0-20190923202752-2cc03de413da/go.mod h1:gi+0XIa01GRL2eRQVjQkKGqKF3SF9vZR/HnPullcV2E=
 github.com/sassoftware/go-rpmutils v0.0.0-20190420191620-a8f1baeba37b/go.mod h1:am+Fp8Bt506lA3Rk3QCmSqmYmLMnPDhdDUcosQCAx+I=
-github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
 github.com/sbezverk/nfproxy v0.0.0-20210112155058-0d98b4a69f0c h1:nlKDckTP5mXfdpUST7l4cU6fGzMlkv/CVg+EVOsClS8=
 github.com/sbezverk/nfproxy v0.0.0-20210112155058-0d98b4a69f0c/go.mod h1:GjbltZ/ijINkRu8WructOUgK6C9AxHw80EEIiy9l/QM=
 github.com/sbezverk/nftableslib v0.0.0-20191009195911-d7d699cf636c/go.mod h1:AljQ9u3mGnCGUGz5yYo66Nu997KTqu46+OFl/fWGRFU=
@@ -3342,11 +2832,7 @@
 github.com/sbezverk/nftableslib/e2e/setenv v0.0.0-20191010164456-029e0d78cdb1/go.mod h1:Q7cQRSoGvFdscKripABhD9LwzMPI7nyH/W19KStrNEE=
 github.com/schollz/progressbar/v3 v3.14.6 h1:GyjwcWBAf+GFDMLziwerKvpuS7ZF+mNTAXIB2aspiZs=
 github.com/schollz/progressbar/v3 v3.14.6/go.mod h1:Nrzpuw3Nl0srLY0VlTvC4V6RL50pcEymjy6qyJAaLa0=
-github.com/sclevine/agouti v3.0.0+incompatible/go.mod h1:b4WX9W9L1sfQKXeJf1mUTLZKJ48R1S7H23Ji7oFO5Bw=
-github.com/sclevine/spec v1.2.0/go.mod h1:W4J29eT/Kzv7/b9IWLB055Z+qvVC9vt0Arko24q7p+U=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
-github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
-github.com/seccomp/libseccomp-golang v0.9.2-0.20210429002308-3879420cc921/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
 github.com/seccomp/libseccomp-golang v0.9.2-0.20220502022130-f33da4d89646/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
 github.com/seccomp/libseccomp-golang v0.10.0 h1:aA4bp+/Zzi0BnWZ2F1wgNBs5gTpm+na2rWM6M9YjLpY=
 github.com/seccomp/libseccomp-golang v0.10.0/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
@@ -3354,17 +2840,10 @@
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
-github.com/shopspring/decimal v0.0.0-20200227202807-02e2044944cc/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
-github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
-github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/siebenmann/go-kstat v0.0.0-20210513183136-173c9b0a9973 h1:GfSdC6wKfTGcgCS7BtzF5694Amne1pGCSTY252WhlEY=
 github.com/siebenmann/go-kstat v0.0.0-20210513183136-173c9b0a9973/go.mod h1:G81aIFAMS9ECrwBYR9YxhlPjWgrItd+Kje78O6+uqm8=
-github.com/sirupsen/logrus v1.0.4-0.20170822132746-89742aefa4b2/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
-github.com/sirupsen/logrus v1.0.6/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
-github.com/sirupsen/logrus v1.4.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
@@ -3376,10 +2855,8 @@
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/assertions v1.0.0/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM=
 github.com/smartystreets/go-aws-auth v0.0.0-20180515143844-0c1422d1fdb9/go.mod h1:SnhjPscd9TpLiy1LpzGSKh3bXCfxxXuqd9xmQJy3slM=
-github.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/smartystreets/gunit v1.0.0/go.mod h1:qwPWnhz6pn0NnRBP++URONOVyNkPyr4SauJk4cUOwJs=
-github.com/snowflakedb/gosnowflake v1.6.3/go.mod h1:6hLajn6yxuJ4xUHZegMekpq9rnQbGJ7TMwXjgTmA6lg=
 github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
 github.com/soheilhy/cmux v0.1.5-0.20210205191134-5ec6847320e5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0=
 github.com/soheilhy/cmux v0.1.5 h1:jjzc5WVemNEDTLwv9tlmemhC73tI08BNOIGwBOo10Js=
@@ -3393,7 +2870,6 @@
 github.com/spf13/afero v1.9.2/go.mod h1:iUV7ddyEEZPO5gA3zD4fJt6iStLlL+Lg4m2cihcDf8Y=
 github.com/spf13/afero v1.10.0/go.mod h1:UBogFpq8E9Hx+xc5CNTTEpTnuHVmXDwZcZcE1eb/UhQ=
 github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cobra v0.0.2-0.20171109065643-2da4a54c5cee/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
 github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
 github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
 github.com/spf13/cobra v1.0.0/go.mod h1:/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE=
@@ -3405,7 +2881,6 @@
 github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
 github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
-github.com/spf13/pflag v1.0.1-0.20171106142849-4c012f6dcd95/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.1/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
@@ -3417,7 +2892,6 @@
 github.com/sqlc-dev/sqlc v1.23.0 h1:h3hnieAGeaqcdKK2zqmy2fHi7S3EkQRR/Gc3qhKuEMg=
 github.com/sqlc-dev/sqlc v1.23.0/go.mod h1:p2och/yapLwIj32x0E4ZFeMgCVn7laIobYCq/CNmTMI=
 github.com/src-d/gcfg v1.4.0/go.mod h1:p/UMsR43ujA89BJY9duynAwIpvqEujIH/jFlfL7jWoI=
-github.com/stefanberger/go-pkcs11uri v0.0.0-20201008174630-78d3cae3a980/go.mod h1:AO3tvPzVZ/ayst6UlUKUv6rcPQInYe3IknH3jYhAKu8=
 github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 h1:pnnLyeX7o/5aX8qUQ69P/mLojDqwda8hFOCBTmP/6hw=
 github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6/go.mod h1:39R/xuhNgVhi+K0/zst4TLrJrVmbm6LVgl4A0+ZFS5M=
 github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
@@ -3426,7 +2900,6 @@
 github.com/streadway/amqp v0.0.0-20190404075320-75d898a42a94/go.mod h1:AZpEONHx3DKn8O/DFsRAY58/XVQiIPMTMB1SddzLXVw=
 github.com/streadway/amqp v0.0.0-20190827072141-edfb9018d271/go.mod h1:AZpEONHx3DKn8O/DFsRAY58/XVQiIPMTMB1SddzLXVw=
 github.com/streadway/handy v0.0.0-20190108123426-d5acb3125c2a/go.mod h1:qNTQ5P5JnDBl6z3cMAg/SywNDC5ABu5ApDIw6lUbRmI=
-github.com/stretchr/objx v0.0.0-20180129172003-8a3f7159479f/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
@@ -3435,7 +2908,6 @@
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v0.0.0-20170130113145-4d4bfba8f1d1/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v0.0.0-20180303142811-b89eecf5ca5d/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
@@ -3454,14 +2926,10 @@
 github.com/stripe/safesql v0.2.0/go.mod h1:q7b2n0JmzM1mVGfcYpanfVb2j23cXZeWFxcILPn3JV4=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/substrait-io/substrait-go v0.4.2/go.mod h1:qhpnLmrcvAnlZsUyPXZRqldiHapPTXC3t7xFgDi3aQg=
-github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
-github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 h1:kdXcSzyDtseVEc4yCz2qF8ZrQvIDBJLl4S1c3GCXmoI=
 github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
-github.com/tchap/go-patricia v2.2.6+incompatible/go.mod h1:bmLyhP68RS6kStMGxByiQ23RP/odRBOTVjwp2cDyi6I=
 github.com/tchap/go-patricia/v2 v2.3.1 h1:6rQp39lgIYZ+MHmdEq4xzuk1t7OdC35z/xm0BGhTkes=
 github.com/tchap/go-patricia/v2 v2.3.1/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
-github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/tj/assert v0.0.0-20171129193455-018094318fb0/go.mod h1:mZ9/Rh9oLWpLLDRpvE+3b7gP/C2YyLFYxNmcLnPTMe0=
 github.com/tj/go-elastic v0.0.0-20171221160941-36157cbbebc2/go.mod h1:WjeM0Oo1eNAjXGDx2yma7uG2XoyRZTq1uv3M/o7imD0=
 github.com/tj/go-kinesis v0.0.0-20171128231115-08b17f58cb1b/go.mod h1:/yhzCV0xPfx6jb1bBgRFjl5lytqVqZXEaeqWP8lTEao=
@@ -3474,64 +2942,44 @@
 github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75/go.mod h1:KO6IkyS8Y3j8OdNO85qEYBsRPuteD+YciPomcXdrMnk=
 github.com/tomasen/realip v0.0.0-20180522021738-f0c99a92ddce/go.mod h1:o8v6yHRoik09Xen7gje4m9ERNah1d1PPsVq1VEx9vE4=
 github.com/tsenart/deadcode v0.0.0-20160724212837-210d2dc333e9/go.mod h1:q+QjxYvZ+fpjMXqs+XEriussHjSYqeXVnAdSV1tkMYk=
-github.com/tv42/httpunix v0.0.0-20191220191345-2ba4b9c3382c/go.mod h1:hzIxponao9Kjc7aWznkXaL4U4TWaDSs8zcsY4Ka08nM=
-github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
-github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701 h1:pyC9PaHYZFgEKFdlp3G8RaCKgVpHZnecvArXvPXcFkM=
 github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701/go.mod h1:P3a5rG4X7tI17Nn3aOIAYr5HbIMukwXG0urG0WuL8OA=
 github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
-github.com/ugorji/go v1.1.7 h1:/68gy2h+1mWMrwZFeD1kQialdSzAb432dtpeJ42ovdo=
 github.com/ugorji/go v1.1.7/go.mod h1:kZn38zHttfInRq0xu/PH0az30d+z6vm202qpg1oXVMw=
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
 github.com/ugorji/go/codec v1.1.7/go.mod h1:Ax+UKWsSmolVDwsd+7N3ZtXu+yMGCf907BLYF3GoBXY=
-github.com/ugorji/go/codec v1.2.11 h1:BMaWp1Bb6fHwEtbplGBGJ498wD+LKlNSl25MjdZY4dU=
-github.com/ugorji/go/codec v1.2.11/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
 github.com/ulikunitz/xz v0.5.6/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8=
 github.com/ulikunitz/xz v0.5.7/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/ulikunitz/xz v0.5.12 h1:37Nm15o69RwBkXM0J6A5OlE67RZTfzUxTj8fB3dfcsc=
 github.com/ulikunitz/xz v0.5.12/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/urfave/cli v0.0.0-20171014202726-7bc6a0acffa5/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
 github.com/urfave/cli v1.19.1/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
 github.com/urfave/cli v1.20.0/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
 github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
-github.com/urfave/cli v1.22.2/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/urfave/cli v1.22.4/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/urfave/cli v1.22.14/go.mod h1:X0eDS6pD6Exaclxm99NJ3FiCDRED7vIHpx2mDOHLvkA=
 github.com/urfave/cli v1.22.15 h1:nuqt+pdC/KqswQKhETJjo7pvn/k4xMUxgW6liI7XpnM=
 github.com/urfave/cli v1.22.15/go.mod h1:wSan1hmo5zeyLGBjRJbzRTNk8gwoYa2B9n4q9dmRIc0=
 github.com/urfave/cli/v2 v2.27.5 h1:WoHEJLdsXr6dDWoJgMq/CboDmyY/8HMMH1fTECbih+w=
 github.com/urfave/cli/v2 v2.27.5/go.mod h1:3Sevf16NykTbInEnD0yKkjDAeZDS0A6bzhBH5hrMvTQ=
-github.com/vishvananda/netlink v0.0.0-20181108222139-023a6dafdcdf/go.mod h1:+SR5DhBJrl6ZM7CoCKvpw5BKroDKQ+PJqOg65H/2ktk=
 github.com/vishvananda/netlink v1.0.0/go.mod h1:+SR5DhBJrl6ZM7CoCKvpw5BKroDKQ+PJqOg65H/2ktk=
 github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
-github.com/vishvananda/netlink v1.1.1-0.20201029203352-d40f9887b852/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
-github.com/vishvananda/netlink v1.1.1-0.20210330154013-f5de75959ad5/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
 github.com/vishvananda/netlink v1.3.1-0.20240905180732-b1ce50cfa9be h1:xdCMvyhnKzaepIUgVpUmTJo/+H1AQ7HuFYn1hv7/Neo=
 github.com/vishvananda/netlink v1.3.1-0.20240905180732-b1ce50cfa9be/go.mod h1:i6NetklAujEcC6fK0JPjT8qSwWyO0HLn4UKG+hGqeJs=
 github.com/vishvananda/netns v0.0.0-20180720170159-13995c7128cc/go.mod h1:ZjcWmFBXmLKZu9Nxj3WKYEafiSqer2rnvPr0en9UNpI=
 github.com/vishvananda/netns v0.0.0-20190625233234-7109fa855b0f/go.mod h1:ZjcWmFBXmLKZu9Nxj3WKYEafiSqer2rnvPr0en9UNpI=
 github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
-github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
-github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
 github.com/vishvananda/netns v0.0.2/go.mod h1:yitZXdAVI+yPFSb4QUe+VW3vOVl4PZPNcBgbPxAtJxw=
 github.com/vishvananda/netns v0.0.4 h1:Oeaw1EM2JMxD51g9uhtC0D7erkIjgmj8+JZc26m1YX8=
 github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
-github.com/willf/bitset v1.1.11-0.20200630133818-d5bec3311243/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
-github.com/willf/bitset v1.1.11/go.mod h1:83CECat5yLh5zVOf4P1ErAgKA5UDvKtgyUABdr3+MjI=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
-github.com/xanzy/go-gitlab v0.15.0/go.mod h1:8zdQa/ri1dfn8eS3Ir1SyfvOKlw7WBJ8DVThkpGiXrs=
 github.com/xanzy/go-gitlab v0.31.0/go.mod h1:sPLojNBn68fMUWSxIJtdVVIP8uSBYqesTfDUseX11Ug=
 github.com/xanzy/ssh-agent v0.2.1/go.mod h1:mLlQY/MoOhWBj+gOGMQkOeiEvkx+8pJSI+0Bx9h2kr4=
-github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
-github.com/xdg-go/scram v1.0.2/go.mod h1:1WAq6h33pAW+iRreB34OORO2Nf7qel3VV3fjBj+hCSs=
-github.com/xdg-go/stringprep v1.0.2/go.mod h1:8F9zXuvzgwmyT5DUm4GUfZGDdT3W+LCvS6+da4O5kxM=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
 github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
 github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
-github.com/xeipuuv/gojsonschema v0.0.0-20180618132009-1d523034197f/go.mod h1:5yf86TLmAcydyeJq5YvxkGPE2fm/u4myDekKRoLuqhs=
 github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
 github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
 github.com/xhit/go-str2duration v1.2.0/go.mod h1:3cPSlfZlUHVlneIVfePFWcJZsuwf+P1v2SRTV4cUmp4=
@@ -3549,7 +2997,6 @@
 github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
 github.com/yalue/native_endian v1.0.2 h1:e4SxBbaCoOOO4E3axd7FSriUhzc1bIzqZGG5jl6Evbg=
 github.com/yalue/native_endian v1.0.2/go.mod h1:cr+I2WnCwDkkPV0DvgBpGQkJV12CDWR5bAoMtT+56iE=
-github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d/go.mod h1:rHwXgn7JulP+udvsHwJoVG1YGAP6VLg4y9I5dyZdqmA=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -3557,13 +3004,8 @@
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43/go.mod h1:aX5oPXxHm3bOH+xeAttToC8pqch2ScQN/JoXYupl6xs=
-github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50/go.mod h1:NUSPSUX/bi6SeDMUh6brw0nXpxHnc96TguQh0+r/ssA=
-github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f/go.mod h1:GlGEuHIJweS1mbCqG+7vt2nvWLzLLnRHbXz5JKd/Qbg=
 github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
 github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
-github.com/zenazn/goji v0.9.0/go.mod h1:7S9M489iMyHBNxwZnk9/EHS098H4/F6TATF2mIxtB1Q=
-gitlab.com/nyarla/go-crypt v0.0.0-20160106005555-d9a5dc2b789b/go.mod h1:T3BPAOm2cqquPa0MKWeNkmOM5RQsRhkrwMWonFMN7fE=
 go.einride.tech/aip v0.66.0/go.mod h1:qAhMsfT7plxBX+Oy7Huol6YUvZ0ZzdUz26yZsQwfl1M=
 go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.etcd.io/bbolt v1.3.3/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
@@ -3611,8 +3053,6 @@
 go.etcd.io/etcd/v3 v3.5.0-alpha.0/go.mod h1:JZ79d3LV6NUfPjUxXrpiFAYcjhT+06qqw+i28snx8To=
 go.etcd.io/etcd/v3 v3.5.0/go.mod h1:FldM0/VzcxYWLvWx1sdA7ghKw7C3L2DvUTzGrcEtsC4=
 go.etcd.io/gofail v0.1.0/go.mod h1:VZBCXYGZhHAinaBiiqYvuDynvahNsAyLFwB3kEHKz1M=
-go.mongodb.org/mongo-driver v1.7.0/go.mod h1:Q4oFMbo1+MSNqICAdYMlC/zSTrwCogR4R8NzkI+yfU8=
-go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk=
 go.mozilla.org/pkcs7 v0.9.0 h1:yM4/HS9dYv7ri2biPtxt8ikvB37a980dg69/pKmS+eI=
 go.mozilla.org/pkcs7 v0.9.0/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk=
 go.opencensus.io v0.15.0/go.mod h1:UffZAU+4sDEINUGP/B7UfBBkq4fqLu9zXAX7ke6CHW0=
@@ -3635,7 +3075,6 @@
 go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful v0.42.0 h1:Z6SbqeRZAl2OczfkFOqLx1BeYBDYehNjEnqluD7581Y=
 go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful v0.42.0/go.mod h1:XiglO+8SPMqM3Mqh5/rtxR1VHc63o8tb38QrU6tm4mU=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.20.0/go.mod h1:oVGt1LRbBOBq1A5BQLlUg9UaU/54aiHw8cgjV3aWZ/E=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.28.0/go.mod h1:vEhqr0m4eTc+DWxfsXoXue2GBgV2uUwVznkGIHW/e5w=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.0/go.mod h1:Ct6zzQEuGK3WpJs2n4dn+wfJYzd/+hNnxMRTWjGn30M=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.1/go.mod h1:4UoMYEZOC0yN/sPGH76KPkkU7zgiEWYWL9vwmbnTJPE=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0/go.mod h1:r9vWsPS/3AQItv3OSlEJ/E4mbrhUbbw18meOjArPtKQ=
@@ -3655,7 +3094,6 @@
 go.opentelemetry.io/contrib/propagators/b3 v1.17.0 h1:ImOVvHnku8jijXqkwCSyYKRDt2YrnGXD4BbhcpfbfJo=
 go.opentelemetry.io/contrib/propagators/b3 v1.17.0/go.mod h1:IkfUfMpKWmynvvE0264trz0sf32NRTZL4nuAN9AbWRc=
 go.opentelemetry.io/otel v0.20.0/go.mod h1:Y3ugLH2oa81t5QO+Lty+zXf8zC9L26ax4Nzoxm/dooo=
-go.opentelemetry.io/otel v1.3.0/go.mod h1:PWIKzi6JCp7sM0k9yZ43VX+T345uNbAkDKwHVjb2PTs=
 go.opentelemetry.io/otel v1.16.0/go.mod h1:vl0h9NUa1D5s1nv3A5vZOYWn8av4K8Ml6JDeHrT/bx4=
 go.opentelemetry.io/otel v1.19.0/go.mod h1:i0QyjOq3UPoTzff0PJB2N66fb4S0+rSbSB15/oyH9fY=
 go.opentelemetry.io/otel v1.20.0/go.mod h1:oUIGj3D77RwJdM6PPZImDpSZGDvkD9fhesHny69JFrs=
@@ -3668,19 +3106,15 @@
 go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY=
 go.opentelemetry.io/otel v1.34.0/go.mod h1:OWFPOQ+h4G8xpyjgqo4SxJYdDQ/qmRH+wivy7zzx9oI=
 go.opentelemetry.io/otel/exporters/otlp v0.20.0/go.mod h1:YIieizyaN77rtLJra0buKiNBOm9XQfkPEKBeuhoMwAM=
-go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.3.0/go.mod h1:VpP4/RMn8bv8gNo9uK7/IMY4mtWLELsS+JIP0inH0h4=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.3.0/go.mod h1:hO1KLR7jcKaDDKDkvI9dP/FIhpmna5lkqPUQdEjFAM8=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.20.0/go.mod h1:GijYcYmNpX1KazD5JmWGsi4P7dDTTTnfv1UbGn84MnU=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.27.0/go.mod h1:OQFyQVrDlbe+R7xrEyDr/2Wr67Ol0hRUgsfA+V5A95s=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0/go.mod h1:s75jGIWA9OfCMzF0xr+ZgfrB5FEbbV7UuYo32ahUiFI=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.31.0 h1:K0XaT3DwHAcV4nKLzcQvwAgSyisUghWoY20I7huthMk=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.31.0/go.mod h1:B5Ki776z/MBnVha1Nzwp5arlzBbE3+1jk+pGmaP5HME=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.3.0/go.mod h1:keUU7UfnwWTWpJ+FWnyqmogPa82nuU5VUANFq49hlMY=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.20.0/go.mod h1:vNUq47TGFioo+ffTSnKNdob241vePmtNZnAODKapKd0=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0/go.mod h1:MOiCmryaYtc+V0Ei+Tx9o5S1ZjA7kzLucuVuyzBZloQ=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.31.0 h1:FFeLy03iVTXP6ffeN2iXrxfGsZGCjVx0/4KlizjyBwU=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.31.0/go.mod h1:TMu73/k1CP8nBUpDLc71Wj/Kf7ZS9FK5b53VapRsP9o=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.3.0/go.mod h1:QNX1aly8ehqqX1LEa6YniTU7VY9I6R3X/oPxhGdTceE=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.27.0/go.mod h1:HVkSiDhTM9BoUJU8qE6j2eSWLLXvi1USXjyd2BXT8PY=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.31.0 h1:lUsI2TYsQw2r1IASwoROaCnjdj2cvC2+Jbxvk6nHnWU=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.31.0/go.mod h1:2HpZxxQurfGxJlJDblybejHB6RX6pmExPNe517hREw4=
@@ -3698,7 +3132,6 @@
 go.opentelemetry.io/otel/metric v1.34.0/go.mod h1:CEDrp0fy2D0MvkXE+dPV7cMi8tWZwX3dmaIhwPOaqHE=
 go.opentelemetry.io/otel/oteltest v0.20.0/go.mod h1:L7bgKf9ZB7qCwT9Up7i9/pn0PWIa9FqQ2IQ8LoxiGnw=
 go.opentelemetry.io/otel/sdk v0.20.0/go.mod h1:g/IcepuwNsoiX5Byy2nNV0ySUF1em498m7hBWC279Yc=
-go.opentelemetry.io/otel/sdk v1.3.0/go.mod h1:rIo4suHNhQwBIPg9axF8V9CA72Wz2mKF1teNrup8yzs=
 go.opentelemetry.io/otel/sdk v1.16.0/go.mod h1:tMsIuKXuuIWPBAOrH+eHtvhTL+SntFtXF9QD68aP6p4=
 go.opentelemetry.io/otel/sdk v1.19.0/go.mod h1:NedEbbS4w3C6zElbLdPJKOpJQOrGUJ+GfzpjUvI0v1A=
 go.opentelemetry.io/otel/sdk v1.20.0/go.mod h1:rmkSx1cZCm/tn16iWDn1GQbLtsW/LvsdEEFzCSRM6V0=
@@ -3713,7 +3146,6 @@
 go.opentelemetry.io/otel/sdk/metric v1.32.0 h1:rZvFnvmvawYb0alrYkjraqJq0Z4ZUJAiyYCU9snn1CU=
 go.opentelemetry.io/otel/sdk/metric v1.32.0/go.mod h1:PWeZlq0zt9YkYAp3gjKZ0eicRYvOh1Gd+X99x6GHpCQ=
 go.opentelemetry.io/otel/trace v0.20.0/go.mod h1:6GjCW8zgDjwGHGa6GkyeB8+/5vjT16gUEi0Nf1iBdgw=
-go.opentelemetry.io/otel/trace v1.3.0/go.mod h1:c/VDhno8888bvQYmbYLqe41/Ldmr/KKunbvWM4/fEjk=
 go.opentelemetry.io/otel/trace v1.16.0/go.mod h1:Yt9vYq1SdNz3xdjZZK7wcXv1qv2pwLkqr2QVwea0ef0=
 go.opentelemetry.io/otel/trace v1.19.0/go.mod h1:mfaSyvGyEJEI0nyV2I4qhNQnbBOUUmYZpYojqMnX2vo=
 go.opentelemetry.io/otel/trace v1.20.0/go.mod h1:HJSK7F/hA5RlzpZ0zKDCHCDHm556LCDtKaAo6JmBFUU=
@@ -3726,7 +3158,6 @@
 go.opentelemetry.io/otel/trace v1.34.0 h1:+ouXS2V8Rd4hp4580a8q23bg0azF2nI8cqLYnC8mh/k=
 go.opentelemetry.io/otel/trace v1.34.0/go.mod h1:Svm7lSjQD7kG7KJ/MUHPVXSDGz2OX4h0M2jHBhmSfRE=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v0.11.0/go.mod h1:QpEjXPrNQzrFDZgoTo49dgHR9RYRSrg3NAKnUGl9YpQ=
 go.opentelemetry.io/proto/otlp v0.15.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
 go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
 go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
@@ -3745,7 +3176,6 @@
 go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
 go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
-go.uber.org/goleak v1.1.12/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
 go.uber.org/goleak v1.2.0/go.mod h1:XJYK+MuIchqpmGmUSAzotztawfKvYLUIgg7guXrwVUo=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
@@ -3759,7 +3189,6 @@
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9Ejo0C68/HhF8uaILCdgjnY+goOA=
-go.uber.org/zap v1.9.1/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 go.uber.org/zap v1.13.0/go.mod h1:zwrFLgMcdUuIBviXEYEH1YKNaOBnKXsx2IPda5bBwHM=
 go.uber.org/zap v1.16.0/go.mod h1:MA8QOfq0BHJwdXa996Y4dYkAqRKB8/1K1QMMZVaNZjQ=
@@ -3773,46 +3202,30 @@
 gocloud.dev v0.19.0/go.mod h1:SmKwiR8YwIMMJvQBKLsC3fHNyMwXLw3PMDO+VVteJMI=
 golang.org/x/arch v0.11.0 h1:KXV8WWKCXm6tRpLirl2szsO5j/oOODwZf4hATmGVNs4=
 golang.org/x/arch v0.11.0/go.mod h1:FEVrYAQjsQXMVJ1nsMoVVXPZg6p2JE2mx8psSWTDQys=
-golang.org/x/crypto v0.0.0-20171113213409-9f005a07e0d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20180501155221-613d6eafa307/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20181009213950-7c1a557ab941/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190219172222-a4c6cb3142f2/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190411191339-88737f569e3a/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
-golang.org/x/crypto v0.0.0-20190422162423-af44ce270edf/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
 golang.org/x/crypto v0.0.0-20190426145343-a29dc8fdc734/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190829043050-9756ffdc2472/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191002192127-34f69633bfdc/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191117063200-497ca9f6d64f/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200323165209-0ec3e9974c59/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200420201142-3c4aac89819a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20201203163018-be400aefbc4c/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
 golang.org/x/crypto v0.0.0-20210314154223-e6e6c4f2bb5b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220208050332-20e1d8d225ab/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220314234659-1baeb1ce4c0b/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220517005047-85d78b3ac167/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
@@ -3918,11 +3331,9 @@
 golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/mod v0.23.0 h1:Zb7khfcRGKk+kqfxFaP5tZqCnDZMjC5VtUBs87Hr6QM=
 golang.org/x/mod v0.23.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
-golang.org/x/net v0.0.0-20180218175443-cbe0f9307d01/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181011144130-49bb7cea24b1/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181108082009-03003ca0c849/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -3931,7 +3342,6 @@
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190125091013-d26f9f9a57f3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190225153610-fe579d43d832/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -3948,10 +3358,8 @@
 golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191002035440-2ec189313ef0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191007182048-72f939374954/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191028085509-fe3aa8a45271/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191112182307-2180aed22343/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191119073136-fc4aabc6c914/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -3982,20 +3390,14 @@
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
 golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210505024714-0287a6fb4125/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210614182718-04defd469f4e/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210825183410-e898025ed96a/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210928044308-7d9f5e0b762b/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211029224645-99673261e6eb/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211111083644-e5c967477495/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211123203042-d83791d6bcd9/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211216030914-fe4d6282115f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220111093109-d55c255bac03/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220325170049-de3da57026de/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
@@ -4038,7 +3440,6 @@
 golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
 golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
 golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
-golang.org/x/oauth2 v0.0.0-20180227000427-d7d64896b5ff/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -4115,7 +3516,6 @@
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
 golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
-golang.org/x/sys v0.0.0-20180224232135-f6cff0780e54/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -4130,57 +3530,41 @@
 golang.org/x/sys v0.0.0-20190221075227-b4e8571b14e0/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190405154228-4b34438f7a67/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190411185658-b44545bcd369/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190419153524-e8e3143a4f4a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190509141414-a5b02f93d862/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190514135907-3a4b5fb9f71f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190522044717-8097e1b27ff5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190523142557-0e01d883c5c5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190531175056-4c3a928424d2/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190602015325-4c4f7f33c9ed/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190616124812-15dcb6c0061f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190620070143-6f217b454f45/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190626221950-04f50cda93cb/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190801041406-cbf593c0f2f3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190804053845-51ab0e2deafa/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190812073006-9eafafc0a87e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191022100944-742c48ecaeb7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191029155521-f43be2a4598c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191112214154-59a1497f0cea/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191115151921-52ab43148777/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191119060738-e882bf8e40c2/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191210023423-ac6580df4449/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191220142924-d4481acd189f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200120151820-655fe14d7479/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200124204421-9fbb57f87de9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -4189,28 +3573,17 @@
 golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200519105757-fe76b779f299/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200622214017-ed371f2e16b4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200728102440-3e129f6d46b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200817155316-9781c653f443/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200828194041-157a740278f4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200916030750-2334cc1a136f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200922070232-aee5d888a860/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200923182605-d9f96fdee20d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201009025420-dfb3f7c4e634/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201112073958-5cba982894dd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201117170446-d9b008d0a637/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201126233918-771906719818/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201202213521-69691e467435/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201207223542-d4d67f95c62d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -4225,29 +3598,23 @@
 golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210316092937-0b90fd5c4c48/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210324051608-47abb6519492/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210412220455-f1c623a9e750/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210426230700-d19ff857e887/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210503080704-8803ae5d1324/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210514084401-e8d321eab015/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210603125802-9665404d3644/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210616045830-e2b7044e8c71/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210629170331-7dc0b73dc9fb/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210816183151-1e6c022a8912/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210818153620-00dd8d7831e7/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210903071746-97244b99971b/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210906170528-6f6e22806c34/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -4257,20 +3624,16 @@
 golang.org/x/sys v0.0.0-20211031064116-611d5d643895/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211103235746-7861aae1554b/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211110154304-99a53858aa08/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211117180635-dee7805ff2e1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211205182925-97ca703d548d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211210111614-af8b64212486/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220111092808-5a964db01320/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220207234003-57398862261d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220317061510-51cd9980dadf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220328115105-d36c6a25d886/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220406163625-3f8b81556e12/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -4278,7 +3641,6 @@
 golang.org/x/sys v0.0.0-20220422013727-9388b58f7150/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220502124256-b6088ccd6cba/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220513210249-45d2b4557a2a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -4323,9 +3685,7 @@
 golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457/go.mod h1:pRgIJT+bRLFKnoM1ldnzKoxTIn14Yxz928LQRYYgIN0=
 golang.org/x/telemetry v0.0.0-20241106142447-58a1122356f5 h1:TCDqnvbBsFapViksHcHySl/sW4+rTGNIAoJJesHRuMM=
 golang.org/x/telemetry v0.0.0-20241106142447-58a1122356f5/go.mod h1:8nZWdGp9pq73ZI//QJyckMQab3yq7hoWi7SI0UIusVI=
-golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
@@ -4389,7 +3749,6 @@
 golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20220224211638-0e9765cccd65/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20220922220347-f3bd1da661af/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.1.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -4409,23 +3768,16 @@
 golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190329151228-23e29df326fe/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190416151739-9c9e1878f421/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190420181800-aa740d480789/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190422233926-fe54fb35175b/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190425163242-31fd60d6bfdc/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190531172133-b3315ee88b7d/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190624222133-a101b041ded4/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190706070813-72ffa07ba3db/go.mod h1:jcCCGcm9btYwXyDqrUWc6MKQKKGJCWEQ3AfLSRIbEuI=
 golang.org/x/tools v0.0.0-20190729092621-ff9f1409240a/go.mod h1:jcCCGcm9btYwXyDqrUWc6MKQKKGJCWEQ3AfLSRIbEuI=
 golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190823170909-c4a336ef6a2f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190903025054-afe7f8212f0d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190927191325-030b2cf1153e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -4472,7 +3824,6 @@
 golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
-golang.org/x/tools v0.0.0-20200916195026-c9a70fc28ce3/go.mod h1:z6u4i615ZeAfBE4XtMziQW1fSVJXACjjbWkB/mvPzlU=
 golang.org/x/tools v0.0.0-20201014170642-d1624618ad65/go.mod h1:z6u4i615ZeAfBE4XtMziQW1fSVJXACjjbWkB/mvPzlU=
 golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20201124115921-2c860bdd6e78/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
@@ -4514,8 +3865,6 @@
 golang.org/x/tools v0.26.0/go.mod h1:TPVVj70c7JJ3WCazhD8OdXcZg/og+b9+tH/KxylGwH0=
 golang.org/x/tools v0.30.0 h1:BgcpHewrV5AUp2G9MebG4XPFI1E2W41zU1SaqVA9vJY=
 golang.org/x/tools v0.30.0/go.mod h1:c347cR/OJfw5TI+GfX7RUPNMdDRRbjvYTS0jPyvsVtY=
-golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -4540,7 +3889,6 @@
 gonum.org/v1/plot v0.0.0-20190515093506-e2840ee46a6b/go.mod h1:Wt8AAjI+ypCyYX3nZBvf6cAIx93T+c/OS2HFAYskSZc=
 gonum.org/v1/plot v0.9.0/go.mod h1:3Pcqqmp6RHvJI72kgb8fThyUnav364FOsdDo2aGW5lY=
 gonum.org/v1/plot v0.10.1/go.mod h1:VZW5OlhkL1mysU9vaqNHnsy86inf6Ot+jB3r+BczCEo=
-google.golang.org/api v0.0.0-20160322025152-9bf6e6e569ff/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
 google.golang.org/api v0.3.1/go.mod h1:6wY9I6uQWHQ8EM57III9mq/AjF+i8G65rmVagqKMtkk=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/api v0.5.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
@@ -4578,7 +3926,6 @@
 google.golang.org/api v0.56.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
 google.golang.org/api v0.57.0/go.mod h1:dVPlbZyBo2/OjBpmvNdpn2GRm6rPy75jyU7bmhdrMgI=
 google.golang.org/api v0.61.0/go.mod h1:xQRti5UdCmoCEqFxcz93fTl338AVqDgyaDRuOZ3hg9I=
-google.golang.org/api v0.62.0/go.mod h1:dKmwPCydfsad4qCH08MSdgWjfHOyfpd4VtDGgRFdavw=
 google.golang.org/api v0.63.0/go.mod h1:gs4ij2ffTRXwuzzgJl/56BdwJaA194ijkfn++9tDuPo=
 google.golang.org/api v0.67.0/go.mod h1:ShHKP8E60yPsKNw/w8w+VYaj9H6buA5UqDp8dhbQZ6g=
 google.golang.org/api v0.70.0/go.mod h1:Bs4ZM2HGifEvXwd50TtW70ovgJffJYw2oRCOFU/SkfA=
@@ -4624,7 +3971,6 @@
 google.golang.org/api v0.169.0/go.mod h1:gpNOiMA2tZ4mf5R9Iwf4rK/Dcz0fbdIgWYWVoxmsyLg=
 google.golang.org/api v0.222.0 h1:Aiewy7BKLCuq6cUCeOUrsAlzjXPqBkEeQ/iwGHVQa/4=
 google.golang.org/api v0.222.0/go.mod h1:efZia3nXpWELrwMlN5vyQrD4GmJN1Vw0x68Et3r+a9c=
-google.golang.org/appengine v1.0.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.2.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.3.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -4636,7 +3982,6 @@
 google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
-google.golang.org/cloud v0.0.0-20151119220103-975617b05ea8/go.mod h1:0H1ncTHf11KCFhTc/+EFRbzSCOZx+VUbRMk55Yv5MYk=
 google.golang.org/genproto v0.0.0-20170818010345-ee236bd376b0/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20181107211654-5fc9ac540362/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
@@ -4645,7 +3990,6 @@
 google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190508193815-b515fa19cec8/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190522204451-c2c4e71fbf69/go.mod h1:z3L6/3dTEVtUr6QSP8miRzeRqwQOioJ9I66odjN4I7s=
 google.golang.org/genproto v0.0.0-20190530194941-fb225487d101/go.mod h1:z3L6/3dTEVtUr6QSP8miRzeRqwQOioJ9I66odjN4I7s=
 google.golang.org/genproto v0.0.0-20190620144150-6af8c5fc6601/go.mod h1:z3L6/3dTEVtUr6QSP8miRzeRqwQOioJ9I66odjN4I7s=
 google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
@@ -4657,7 +4001,6 @@
 google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
 google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
 google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200117163144-32f20d992d24/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
 google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
 google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
 google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
@@ -4672,7 +4015,6 @@
 google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20200527145253-8367513e4ece/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
 google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
 google.golang.org/genproto v0.0.0-20200626011028-ee7919e894b5/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200707001353-8e8330bf89df/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
@@ -4702,7 +4044,6 @@
 google.golang.org/genproto v0.0.0-20210604141403-392c879c8b08/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
 google.golang.org/genproto v0.0.0-20210608205507-b6d2f5bf0d7d/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
 google.golang.org/genproto v0.0.0-20210624195500-8bfb893ecb84/go.mod h1:SzzZ/N+nwJDaO1kznhnlzqS8ocJICar6hYhVyhi++24=
-google.golang.org/genproto v0.0.0-20210630183607-d20f26d13c79/go.mod h1:yiaVoXHpRzHGyxV3o4DktVWY4mSUErTKaeEOq6C3t3U=
 google.golang.org/genproto v0.0.0-20210713002101-d411969a0d9a/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k=
 google.golang.org/genproto v0.0.0-20210716133855-ce7ef5c701ea/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k=
 google.golang.org/genproto v0.0.0-20210728212813-7823e685a01f/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
@@ -4715,19 +4056,15 @@
 google.golang.org/genproto v0.0.0-20210909211513-a8c4777a87af/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
 google.golang.org/genproto v0.0.0-20210924002016-3dee208752a0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211129164237-f09f9a12af12/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211203200212-54befc351ae9/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211206160659-862468c7d6e0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211221195035-429b39de9b1c/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220111164026-67b88f271998/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20220126215142-9970aeb2e350/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20220207164111-0872dc986b00/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
 google.golang.org/genproto v0.0.0-20220222213610-43724f9ea8cf/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
 google.golang.org/genproto v0.0.0-20220304144024-325a89244dc8/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
 google.golang.org/genproto v0.0.0-20220310185008-1973136f34c6/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220314164441-57ef72a4c106/go.mod h1:hAL49I2IFola2sVEjAn7MEwsja0xp51I0tlGAf9hz4E=
 google.golang.org/genproto v0.0.0-20220324131243-acbaeb5b85eb/go.mod h1:hAL49I2IFola2sVEjAn7MEwsja0xp51I0tlGAf9hz4E=
 google.golang.org/genproto v0.0.0-20220329172620-7be39ac1afc7/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
 google.golang.org/genproto v0.0.0-20220407144326-9054f6ed7bac/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
@@ -4912,7 +4249,6 @@
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240826202546-f6391c0de4c7/go.mod h1:UqMtugtsSgubUsoxbuAoiCXvqvErP7Gf0so0mK9tHxU=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250224174004-546df14abb99 h1:ZSlhAUqC4r8TPzqLXQ0m3upBNZeF+Y8jQ3c4CR3Ujms=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250224174004-546df14abb99/go.mod h1:LuRYeWDFV6WOn90g357N17oMCaxpgCnbi/44qJvDn2I=
-google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.8.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -4949,7 +4285,6 @@
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.43.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
 google.golang.org/grpc v1.44.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
 google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
 google.golang.org/grpc v1.46.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
@@ -5013,13 +4348,10 @@
 google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
 google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
-gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20141024133853-64131543e789/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
@@ -5031,10 +4363,8 @@
 gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/gcfg.v1 v1.2.3/go.mod h1:yesOnuUOFQAhST5vPY4nbZsb/huCgGGXlipJsBn0b3o=
-gopkg.in/gemnasium/logrus-airbrake-hook.v2 v2.1.2/go.mod h1:Xk6kEKp8OKb+X14hQBKWaSkCsqBpgog8nAV2xsGOxlo=
 gopkg.in/go-playground/assert.v1 v1.2.1/go.mod h1:9RXL0bg/zibRAgZUYszZSwO/z8Y/a8bDuhia5mkpMnE=
 gopkg.in/go-playground/validator.v9 v9.29.1/go.mod h1:+c9/zcJMFNgbLvly1L1V+PpxWdVbfP1avr/N00E2vyQ=
-gopkg.in/inconshreveable/log15.v2 v2.0.0-20180818164646-67afb5ed74ec/go.mod h1:aPpfJ7XW+gOuirDoZ8gHhLh3kZ1B08FtV2bbmy7Jv3s=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/ini.v1 v1.51.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
@@ -5042,8 +4372,6 @@
 gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
 gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
-gopkg.in/square/go-jose.v2 v2.3.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
-gopkg.in/square/go-jose.v2 v2.5.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
 gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI=
 gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
 gopkg.in/src-d/go-billy.v4 v4.3.2/go.mod h1:nDjArDMp+XMs1aFAESLRjfGSgfvoYN0hDfzEk0GjC98=
@@ -5059,7 +4387,6 @@
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.6/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
@@ -5068,16 +4395,7 @@
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gorm.io/driver/postgres v1.0.8/go.mod h1:4eOzrI1MUfm6ObJU/UcmbXyiHSs8jSwH95G5P5dxcAg=
-gorm.io/driver/postgres v1.3.5/go.mod h1:EGCWefLFQSVFrHGy4J8EtiHCWX5Q8t0yz2Jt9aKkGzU=
-gorm.io/gorm v1.20.12/go.mod h1:0HFTzE/SqkGTzK6TlDPPQbAYCluiVvhzoA1+aVyzenw=
-gorm.io/gorm v1.21.4/go.mod h1:0HFTzE/SqkGTzK6TlDPPQbAYCluiVvhzoA1+aVyzenw=
-gorm.io/gorm v1.23.4/go.mod h1:l2lP/RyAtc1ynaTjFksBde/O8v9oOGIApu2/xRitmZk=
-gorm.io/gorm v1.23.5/go.mod h1:l2lP/RyAtc1ynaTjFksBde/O8v9oOGIApu2/xRitmZk=
-gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
 gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=
-gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
-gotest.tools/v3 v3.1.0/go.mod h1:fHy7eyTmJFO5bQbUsEGQ1v4m2J3Jz9eWL54TP2/ZuYQ=
 gotest.tools/v3 v3.5.1/go.mod h1:isy3WKz7GK6uNw/sbHzfKBLvlvXwUyV06n6brMxxopU=
 gvisor.dev/gvisor v0.0.0-20241119070250-e4f9220466df h1:1eoWdOuG2Af87RHIR4iNiD3fUhATY+dpcYeHqXJHkKI=
 gvisor.dev/gvisor v0.0.0-20241119070250-e4f9220466df/go.mod h1:5DMfjtclAbTIjbXqO1qCe2K5GKKxWz2JHvCChuTcJEM=
@@ -5129,7 +4447,6 @@
 k8s.io/endpointslice v0.32.0/go.mod h1:ArQ8P2n//14SG8k9vAxkiR3adB8C3BY3oSACOpTJRiY=
 k8s.io/externaljwt v0.32.0 h1:XblxKdGy937DArBgW/G2QCI55P2e69UxR/aLffOa+wY=
 k8s.io/externaljwt v0.32.0/go.mod h1:P9TZ/u+o3CG//KNc/2HJmKgnuvawWS75IosS9dlGlxI=
-k8s.io/gengo v0.0.0-20201113003025-83324d819ded/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
 k8s.io/gengo v0.0.0-20230829151522-9cce18d56c01/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
 k8s.io/gengo/v2 v2.0.0-20240826214909-a7b603a56eb7/go.mod h1:EJykeLsmFC60UQbYJezXkEsG2FLrt0GPNkU5iK5GWxU=
 k8s.io/gengo/v2 v2.0.0-20240911193312-2b36238f13e9/go.mod h1:EJykeLsmFC60UQbYJezXkEsG2FLrt0GPNkU5iK5GWxU=
@@ -5137,8 +4454,6 @@
 k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
 k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
 k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
-k8s.io/klog/v2 v2.4.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
-k8s.io/klog/v2 v2.30.0/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/klog/v2 v2.100.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
@@ -5171,7 +4486,6 @@
 k8s.io/system-validators v1.9.1/go.mod h1:d4UVrxKu52s0BHU984Peb9VpIq4V9sd8xjTBV/waY/I=
 k8s.io/utils v0.0.0-20201110183641-67b214c5f920/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 k8s.io/utils v0.0.0-20210802155522-efc7438f0176/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-k8s.io/utils v0.0.0-20210930125809-cb0fa318a74b/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 k8s.io/utils v0.0.0-20230406110748-d93618cff8a2/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
@@ -5180,8 +4494,6 @@
 lukechampine.com/uint128 v1.1.1/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
 lukechampine.com/uint128 v1.2.0/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
 lukechampine.com/uint128 v1.3.0/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
-modernc.org/b v1.0.0/go.mod h1:uZWcZfRj1BpYzfN9JTerzlNUnnPsV9O2ZA8JsRcubNg=
-modernc.org/cc/v3 v3.32.4/go.mod h1:0R6jl1aZlIl2avnYfbfHBS1QB6/f+16mihBObaBC878=
 modernc.org/cc/v3 v3.36.0/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
 modernc.org/cc/v3 v3.36.2/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
 modernc.org/cc/v3 v3.36.3/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
@@ -5192,7 +4504,6 @@
 modernc.org/ccgo/v3 v3.0.0-20220430103911-bc99d88307be/go.mod h1:bwdAnOoaIt8Ax9YdWGjxWsdkPcZyRPHqrOvJxaKAKGw=
 modernc.org/ccgo/v3 v3.0.0-20220904174949-82d86e1b6d56/go.mod h1:YSXjPL62P2AMSxBphRHPn7IkzhVHqkvOnRKAKh+W6ZI=
 modernc.org/ccgo/v3 v3.0.0-20220910160915-348f15de615a/go.mod h1:8p47QxPkdugex9J4n9P2tLZ9bK01yngIVp00g4nomW0=
-modernc.org/ccgo/v3 v3.9.2/go.mod h1:gnJpy6NIVqkETT+L5zPsQFj7L2kkhfPMzOghRNv/CFo=
 modernc.org/ccgo/v3 v3.16.4/go.mod h1:tGtX0gE9Jn7hdZFeU88slbTh1UtCYKusWOoCJuvkWsQ=
 modernc.org/ccgo/v3 v3.16.6/go.mod h1:tGtX0gE9Jn7hdZFeU88slbTh1UtCYKusWOoCJuvkWsQ=
 modernc.org/ccgo/v3 v3.16.8/go.mod h1:zNjwkizS+fIFDrDjIAgBSCLkWbJuHF+ar3QRn+Z9aws=
@@ -5200,15 +4511,8 @@
 modernc.org/ccgo/v3 v3.16.13-0.20221017192402-261537637ce8/go.mod h1:fUB3Vn0nVPReA+7IG7yZDfjv1TMWjhQP8gCxrFAtL5g=
 modernc.org/ccgo/v3 v3.16.13/go.mod h1:2Quk+5YgpImhPjv2Qsob1DnZ/4som1lJTodubIcoUkY=
 modernc.org/ccorpus v1.11.6/go.mod h1:2gEUTrWqdpH2pXsmTM1ZkjeSrUWDpjMu2T6m29L/ErQ=
-modernc.org/db v1.0.0/go.mod h1:kYD/cO29L/29RM0hXYl4i3+Q5VojL31kTUVpVJDw0s8=
-modernc.org/file v1.0.0/go.mod h1:uqEokAEn1u6e+J45e54dsEA/pw4o7zLrA2GwyntZzjw=
-modernc.org/fileutil v1.0.0/go.mod h1:JHsWpkrk/CnVV1H/eGlFf85BEpfkrp56ro8nojIq9Q8=
-modernc.org/golex v1.0.0/go.mod h1:b/QX9oBD/LhixY6NDh+IdGv17hgB+51fET1i2kPSmvk=
 modernc.org/httpfs v1.0.6/go.mod h1:7dosgurJGp0sPaRanU53W4xZYKh14wfzX420oZADeHM=
-modernc.org/internal v1.0.0/go.mod h1:VUD/+JAkhCpvkUitlEOnhpVxCgsBI90oTzSCRcqQVSM=
 modernc.org/libc v0.0.0-20220428101251-2d5f3daf273b/go.mod h1:p7Mg4+koNjc8jkqwcoFBJx7tXkpj00G77X7A72jXPXA=
-modernc.org/libc v1.7.13-0.20210308123627-12f642a52bb8/go.mod h1:U1eq8YWr/Kc1RWCMFUWEdkTg8OTcfLw2kY8EDwl039w=
-modernc.org/libc v1.9.5/go.mod h1:U1eq8YWr/Kc1RWCMFUWEdkTg8OTcfLw2kY8EDwl039w=
 modernc.org/libc v1.16.0/go.mod h1:N4LD6DBE9cf+Dzf9buBlzVJndKr/iJHG97vGLHYnb5A=
 modernc.org/libc v1.16.1/go.mod h1:JjJE0eu4yeK7tab2n4S1w8tlWd9MxXLRzheaRnAKymU=
 modernc.org/libc v1.16.17/go.mod h1:hYIV5VZczAmGZAnG15Vdngn5HSF5cSkbvfz2B7GRuVU=
@@ -5223,13 +4527,9 @@
 modernc.org/libc v1.21.4/go.mod h1:przBsL5RDOZajTVslkugzLBj1evTue36jEomFQOoYuI=
 modernc.org/libc v1.22.2/go.mod h1:uvQavJ1pZ0hIoC/jfqNoMLURIMhKzINIWypNM17puug=
 modernc.org/libc v1.22.4/go.mod h1:jj+Z7dTNX8fBScMVNRAYZ/jF91K8fdT2hYMThc3YjBY=
-modernc.org/lldb v1.0.0/go.mod h1:jcRvJGWfCGodDZz8BPwiKMJxGJngQ/5DrRapkQnLob8=
-modernc.org/mathutil v1.0.0/go.mod h1:wU0vUrJsVWBZ4P6e7xtFJEhFSNsfRLJ8H458uRjg03k=
-modernc.org/mathutil v1.1.1/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
 modernc.org/mathutil v1.2.2/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
 modernc.org/mathutil v1.4.1/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
 modernc.org/mathutil v1.5.0/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
-modernc.org/memory v1.0.4/go.mod h1:nV2OApxradM3/OVbs2/0OsP6nPfakXpi50C7dcoHXlc=
 modernc.org/memory v1.1.1/go.mod h1:/0wo5ibyrQiaoUoH7f9D8dnglAmILJ5/cxZlRECf+Nw=
 modernc.org/memory v1.2.0/go.mod h1:/0wo5ibyrQiaoUoH7f9D8dnglAmILJ5/cxZlRECf+Nw=
 modernc.org/memory v1.2.1/go.mod h1:PkUhL0Mugw21sHPeskwZW4D6VscE/GQJOnIpCnW6pSU=
@@ -5238,31 +4538,21 @@
 modernc.org/memory v1.5.0/go.mod h1:PkUhL0Mugw21sHPeskwZW4D6VscE/GQJOnIpCnW6pSU=
 modernc.org/opt v0.1.1/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
 modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
-modernc.org/ql v1.0.0/go.mod h1:xGVyrLIatPcO2C1JvI/Co8c0sr6y91HKFNy4pt9JXEY=
-modernc.org/sortutil v1.1.0/go.mod h1:ZyL98OQHJgH9IEfN71VsamvJgrtRX9Dj2gX+vH86L1k=
-modernc.org/sqlite v1.10.6/go.mod h1:Z9FEjUtZP4qFEg6/SiADg9XCER7aYy9a/j7Pg9P7CPs=
 modernc.org/sqlite v1.18.1/go.mod h1:6ho+Gow7oX5V+OiOQ6Tr4xeqbx13UZ6t+Fw9IRUG4d4=
 modernc.org/sqlite v1.18.2/go.mod h1:kvrTLEWgxUcHa2GfHBQtanR1H9ht3hTJNtKpzH9k1u0=
 modernc.org/sqlite v1.21.2/go.mod h1:cxbLkB5WS32DnQqeH4h4o1B0eMr8W/y8/RGuxQ3JsC0=
-modernc.org/strutil v1.1.0/go.mod h1:lstksw84oURvj9y3tn8lGvRxyRC1S2+g5uuIzNfIOBs=
 modernc.org/strutil v1.1.1/go.mod h1:DE+MQQ/hjKBZS2zNInV5hhcipt5rLPWkmpbGeW5mmdw=
 modernc.org/strutil v1.1.3/go.mod h1:MEHNA7PdEnEwLvspRMtWTNnp2nnyvMfkimT1NKNAGbw=
-modernc.org/tcl v1.5.2/go.mod h1:pmJYOLgpiys3oI4AeAafkcUfE+TKKilminxNyU/+Zlo=
 modernc.org/tcl v1.13.1/go.mod h1:XOLfOwzhkljL4itZkK6T72ckMgvj0BDsnKNdZVUOecw=
 modernc.org/tcl v1.13.2/go.mod h1:7CLiGIPo1M8Rv1Mitpv5akc2+8fxUd2y2UzC/MfMzy0=
 modernc.org/tcl v1.15.1/go.mod h1:aEjeGJX2gz1oWKOLDVZ2tnEWLUrIn8H+GFu+akoDhqs=
 modernc.org/token v1.0.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
 modernc.org/token v1.0.1/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
 modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
-modernc.org/z v1.0.1-0.20210308123920-1f282aa71362/go.mod h1:8/SRk5C/HgiQWCgXdfpb+1RvhORdkz5sw72d3jjtyqA=
-modernc.org/z v1.0.1/go.mod h1:8/SRk5C/HgiQWCgXdfpb+1RvhORdkz5sw72d3jjtyqA=
 modernc.org/z v1.5.1/go.mod h1:eWFB510QWW5Th9YGZT81s+LwvaAs3Q2yr4sP0rmLkv8=
 modernc.org/z v1.7.0/go.mod h1:hVdgNMh8ggTuRG1rGU8x+xGRFfiQUIAw0ZqlPy8+HyQ=
-modernc.org/zappy v1.0.0/go.mod h1:hHe+oGahLVII/aTTyWK/b53VDHMAGCBYYeZ9sn83HC4=
 mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed/go.mod h1:Xkxe497xwlCKkIaQYRfC7CSLworTXY9RMqwhhCm+8Nc=
 mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b/go.mod h1:2odslEg/xrtNQqCYg2/jCoyKnw3vv5biOc3JnIcYfL4=
-nhooyr.io/websocket v1.8.6 h1:s+C3xAMLwGmlI31Nyn/eAehUlZPwfYZu2JXM621Q5/k=
-nhooyr.io/websocket v1.8.6/go.mod h1:B70DZP8IakI65RVQ51MsWP/8jndNma26DVA/nFSCgW0=
 pack.ag/amqp v0.11.2/go.mod h1:4/cbmt4EJXSKlG6LCfWHoqmN0uFdy5i/+YFz+fTfhV4=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=