feat: deploy to Frostmoln production

The AWS deploy-prod job has failed since CI left AWS (no k8s.unbound.se
context on the runners). Deploys now go to the Frostmoln production
cluster (namespace schemas), the way the sites do.

Frostmoln enforces restricted Pod Security: the pod runs as the image's
non-root user with a matching securityContext. The prod-only manifests
move to the prod-frostmoln target; the ALB ingress becomes a Traefik one
with a Let's Encrypt certificate.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu

.gitea/workflows/ci.yaml

@@ -19,8 +19,8 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version: 'stable'
       - name: Generate and format check
@@ -35,8 +35,8 @@ jobs:
   vulnerabilities:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version: 'stable'
       - name: Check vulnerabilities
@@ -47,13 +47,13 @@ jobs:
   check-release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: '24'
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version: 'stable'
       - name: Check goreleaser config
@@ -61,11 +61,15 @@ jobs:
         with:
           version: '~> v2'
           args: check
-      - name: Test release build
+      - name: Install goreleaser
         uses: goreleaser/goreleaser-action@v7
         with:
           version: '~> v2'
-          args: release --snapshot --clean
+          install-only: true
+      # Without the runner's GOCACHEPROG (gobuildcache): goreleaser's parallel
+      # go builds contend for its per-entry locks and time out.
+      - name: Test release build
+        run: env -u GOCACHEPROG goreleaser release --snapshot --clean
 
   build:
     needs: [check, vulnerabilities, check-release]
@@ -74,21 +78,35 @@ jobs:
       BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_CONTENT }}
       GITEA_REPOSITORY: ${{ gitea.repository }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: buildtool/setup-buildtools-action@v1
       - name: Build and push
         run: unset GITEA_TOKEN && build && push
 
-  deploy-prod:
+  deploy-prod-frostmoln:
     needs: build
     if: gitea.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     env:
-      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_CONTENT }}
+      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_FROSTMOLN_PRODUCTION }}
       GITEA_REPOSITORY: ${{ gitea.repository }}
+      FM_TENANT: 9ae61342-0f76-476f-8176-e46f6b0b0c32
     environment: prod
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: buildtool/setup-buildtools-action@v1
-      - name: Deploy to production
+      - name: Install fm
-        run: deploy prod
+        run: |
+          sudo install -d -m 0755 /etc/apt/keyrings
+          sudo curl -fsSL -o /etc/apt/keyrings/frostmoln.gpg https://get.frostmoln.cloud/deb/frostmoln.gpg
+          sudo curl -fsSL -o /etc/apt/sources.list.d/frostmoln.sources https://get.frostmoln.cloud/deb/frostmoln.sources
+          sudo apt-get update && sudo apt-get install -y fm
+      - name: Deploy to Frostmoln production
+        env:
+          FROSTMOLN_API_KEY: ${{ secrets.FROSTMOLN_PRODUCTION_DEPLOY_KEY }}
+        # The cluster API is private: the kubeconfig's exec plugin opens an fm
+        # tunnel on demand. fm reads the key from its config file, not the env.
+        run: |
+          fm auth api-key set "$FROSTMOLN_API_KEY" > /dev/null
+          fm kubernetes cluster kubeconfig ${{ vars.FROSTMOLN_PRODUCTION_CLUSTER_ID }} --exec --file "$RUNNER_TEMP/kubeconfig"
+          KUBECONFIG_CONTENT="$(cat "$RUNNER_TEMP/kubeconfig")" deploy prod-frostmoln -n schemas

.gitea/workflows/goreleaser.yaml

@@ -5,29 +5,27 @@ on:
     tags:
       - 'v*'
 
-env:
-  RELEASE_TOKEN_FILE: /runner-secrets/release-token
-
 jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: '24'
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version: 'stable'
       - name: Install goreleaser
         uses: goreleaser/goreleaser-action@v7
         with:
-          version: 'v2.13.3'
+          version: 'v2.18.3'
           install-only: true
       - name: Release
         run: |
           GITEA_TOKEN=$(cat "${RELEASE_TOKEN_FILE}")
           export GITEA_TOKEN
-          goreleaser release --clean
+          # Without GOCACHEPROG: parallel builds contend for gobuildcache's locks.
+          env -u GOCACHEPROG goreleaser release --clean

.gitea/workflows/pre-commit.yaml

@@ -13,13 +13,13 @@ jobs:
     env:
       SKIP: no-commit-to-branch
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version: 'stable'
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
-          python-version: '3.14'
+          python-version: '3.15'
       - name: Install goimports
         run: go install golang.org/x/tools/cmd/goimports@latest
       - uses: pre-commit/action@v3.0.1

.goreleaser.yml

@@ -2,7 +2,7 @@ project_name: unbound-schemas
 version: 2
 
 gitea_urls:
-  api: http://gitea-http.gitea.svc.cluster.local:3000/api/v1
+  api: https://git.unbound.se/api/v1
   download: https://gitea.unbound.se
 
 env:

.pre-commit-config.yaml

@@ -11,7 +11,7 @@ repos:
     - --allow-multiple-documents
   - id: check-added-large-files
 - repo: https://github.com/alessandrojcm/commitlint-pre-commit-hook
-  rev: v9.24.0
+  rev: v9.27.0
   hooks:
   - id: commitlint
     stages: [ commit-msg ]
@@ -30,11 +30,11 @@ repos:
   - id: go-test
   - id: gofumpt
 - repo: https://github.com/golangci/golangci-lint
-  rev: v2.10.1
+  rev: v2.14.0
   hooks:
   - id: golangci-lint-full
 - repo: https://github.com/gitleaks/gitleaks
-  rev: v8.30.0
+  rev: v8.30.1
   hooks:
   - id: gitleaks
 exclude: '^ctl/generated.go|graph/generated/.*$|^graph/model/models_gen.go|^tools/.*$$'

.version

@@ -1,3 +1,3 @@
 {
-  "version": "v0.9.5"
+  "version": "v0.9.8"
 }

CHANGELOG.md

@@ -2,6 +2,239 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.9.8] - 2026-10-13
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.2.0 (#835)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.3.0 (#836)
+- *(deps)* Update module github.com/auth0/go-jwt-middleware/v3 to v3.2.0 (#837)
+- *(k8s)* Point OTEL endpoint to k8s-monitoring-alloy service (#839)
+- Raise Node heap cap to 512MB and bump pod memory limit (#838)
+- *(k8s)* Raise schemas CPU request from 20m to 100m (#840)
+- *(k8s)* Add scaleUp/scaleDown stabilization to schemas HPA (#844)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.3.1 (#845)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.4.0 (#846)
+- *(deps)* Update module golang.org/x/crypto to v0.52.0 (#848)
+- *(deps)* Update eventsourced (#849)
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/pg to v1.20.0 (#850)
+- Bump eventsourced/pg to v2.0.2 and harden startup error logging (#851)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.4.1 (#852)
+- *(deps)* Update module go.opentelemetry.io/contrib/bridges/otelslog to v0.19.0 (#854)
+- *(deps)* Update opentelemetry-go monorepo (#853)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.4.2 (#856)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.4.3 (#857)
+- *(deps)* Update module golang.org/x/sync to v0.21.0 (#858)
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.34 (#860)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.4.4 (#862)
+- *(deps)* Update module golang.org/x/crypto to v0.53.0 (#863)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.4.5 (#865)
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.91 (#864)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.4.6 (#866)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.5.0 (#869)
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.35 (#871)
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.92 (#873)
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.93 (#876)
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.36 (#877)
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.27.2 (#878)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.5.1 (#879)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.6.0 (#880)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.7.0 (#881)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.8.0 (#882)
+- *(deps)* Update module golang.org/x/sync to v0.22.0 (#883)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.9.0 (#884)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.9.1 (#885)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.9.2 (#886)
+- *(deps)* Update module golang.org/x/crypto to v0.54.0 (#888)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.10.0 (#890)
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.94 (#889)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.11.0 (#892)
+- *(deps)* Update module github.com/alecthomas/kong to v1.16.0 (#894)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.12.0 (#895)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.12.1 (#896)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.13.0 (#899)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.13.1 (#900)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.13.2 (#901)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.14.0 (#903)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.14.1 (#904)
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.27.3 (#905)
+- *(deps)* Update module github.com/auth0/go-jwt-middleware/v3 to v3.3.0 (#907)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.14.2 (#908)
+- *(deps)* Update opentelemetry-go monorepo (#909)
+- *(deps)* Update module go.opentelemetry.io/contrib/bridges/otelslog to v0.20.0 (#911)
+- *(deps)* Update module github.com/alecthomas/kong to v1.16.1 (#914)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.15.0 (#915)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.15.1 (#917)
+- *(deps)* Update module golang.org/x/crypto to v0.55.0 (#918)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.16.0 (#919)
+- *(deps)* Update module github.com/stretchr/testify to v1.12.0 (#920)
+- *(deps)* Update module github.com/stretchr/testify to v1.12.1 (#923)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.17.0 (#925)
+- *(deps)* Update opentelemetry-go monorepo (#929)
+- *(deps)* Update module go.opentelemetry.io/contrib/bridges/otelslog to v0.20.1 (#930)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.18.0 (#932)
+- *(deps)* Update module golang.org/x/crypto to v0.56.0 [security] (#934)
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.37 (#935)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.19.0 (#936)
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.28.0 (#938)
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.95 (#937)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.20.0 (#939)
+- *(deps)* Update module golang.org/x/sync to v0.23.0 (#940)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.20.2 (#943)
+- *(deps)* Update module golang.org/x/crypto to v0.57.0 (#945)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.20.3 (#947)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.21.0 (#957)
+- *(deps)* Update module codeberg.org/messaging/go-messaging-amqp to v0.0.6 (#959)
+- *(deps)* Update module codeberg.org/eventsourced/pg/v2 to v2.2.0 (#961)
+- *(deps)* Update module codeberg.org/eventsourced/pg/v2 to v2.2.1 (#963)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.21.1 (#964)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.22.0 (#970)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.22.1 (#972)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.23.0 (#974)
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.58 (#976)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.24.0 (#977)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.25.0 (#982)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.26.0 (#984)
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.59 (#988)
+- *(deps)* Update module codeberg.org/eventsourced/pg/v2 to v2.3.0 (#991)
+- *(deps)* Update opentelemetry-go monorepo (#990)
+- *(monitoring)* Use otel.SetLoggerProvider (#998)
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.60 (#995)
+- *(deps)* Update module go.opentelemetry.io/contrib/bridges/otelslog to v0.21.0 (#993)
+- Release to the Gitea API on its public URL (#997)
+- *(deps)* Update module golang.org/x/crypto to v0.58.0 (#1010)
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.61 (#1007)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.27.0 (#1008)
+
+### 🚜 Refactor
+
+- Migrate eventsourced to codeberg and go-messaging-amqp (#949)
+
+### ⚡ Performance
+
+- *(graph)* Cache merged SDL and SchemaUpdate per ref (#841)
+- *(graph)* Warm schema cache on startup to kill cold-start spikes (#843)
+
+### ⚙️ Miscellaneous Tasks
+
+- *(deps)* Update golang:1.26.3 docker digest to 54d3246 (#842)
+- *(deps)* Update node.js to v24.16.0 (#847)
+- *(deps)* Update golang docker tag to v1.26.4 (#855)
+- *(deps)* Update node.js to fb71d01 (#859)
+- *(deps)* Update golang:1.26.4 docker digest to 62df9f3 (#861)
+- *(deps)* Update node.js to 21f403a (#867)
+- *(deps)* Update actions/checkout action to v7 (#868)
+- *(deps)* Update node.js to v24.17.0 (#870)
+- *(deps)* Update golang:1.26.4 docker digest to f83d235 (#872)
+- *(deps)* Update pre-commit hook alessandrojcm/commitlint-pre-commit-hook to v9.26.0 (#874)
+- *(deps)* Update node.js to v24.18.0 (#875)
+- *(deps)* Update golang docker tag to v1.26.5 (#887)
+- *(deps)* Update golang:1.26.5 docker digest to adde241 (#891)
+- *(deps)* Update actions/setup-go action to v7 (#897)
+- *(deps)* Update actions/setup-node action to v7 (#893)
+- *(deps)* Update actions/setup-python action to v7 (#902)
+- *(deps)* Update node.js to v24.18.1 (#906)
+- *(deps)* Update node.js to v24.19.0 (#910)
+- *(deps)* Update golang:1.26.5 docker digest to 046e320 (#912)
+- *(deps)* Update golang:1.26.5 docker digest to e8ab809 (#913)
+- *(deps)* Update golang docker tag to v1.26.6 (#916)
+- *(deps)* Update golang docker tag to v1.26.7 (#921)
+- *(deps)* Update golang docker tag to v1.27.0 (#922)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.13.1 (#924)
+- *(deps)* Update golang:1.27.0 docker digest to 47526c1 (#926)
+- *(deps)* Update node.js to v24.20.0 (#927)
+- *(deps)* Update node.js to e67514e (#928)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.13.2 (#931)
+- *(deps)* Update golang docker tag to v1.27.1 (#933)
+- *(deps)* Update node.js to v24.21.0 (#941)
+- *(deps)* Update node.js to 4b2d7ee (#951)
+- *(deps)* Update node.js to ebfe2f9 (#953)
+- *(deps)* Update golang:1.27.1 docker digest to 2c9f73f (#955)
+- *(deps)* Update dependency goreleaser/goreleaser to v2.18.2 (#965)
+- *(deps)* Update pre-commit hook alessandrojcm/commitlint-pre-commit-hook to v9.27.0 (#968)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.14.0 (#980)
+- *(k8s)* Take the image reference from build-tools (#986)
+- *(deps)* Update golang:1.27.1 docker digest to 45639bc (#996)
+- *(deps)* Update golang docker tag to v1.27.2 (#1004)
+- *(deps)* Update dependency goreleaser/goreleaser to v2.18.3 (#1009)
+- *(deps)* Update dependency python to 3.15 (#1015)
+
+## [0.9.7] - 2026-05-14
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/pg to v1.18.6 (#790)
+- *(deps)* Update module github.com/alecthomas/kong to v1.15.0 (#791)
+- *(deps)* Update opentelemetry-go monorepo (#793)
+- *(deps)* Update module go.opentelemetry.io/contrib/bridges/otelslog to v0.18.0 (#797)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.268 (#798)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.269 (#802)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.270 (#804)
+- *(deps)* Update module github.com/auth0/go-jwt-middleware/v3 to v3.1.0 (#805)
+- *(deps)* Update module golang.org/x/crypto to v0.50.0 (#807)
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/pg to v1.18.7 (#810)
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.27.1 (#814)
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.33 (#816)
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.90 (#818)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0 (#820)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.1.0 (#823)
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/pg to v1.18.8 (#831)
+- *(deps)* Update module golang.org/x/crypto to v0.51.0 (#832)
+
+### 🎨 Styling
+
+- Apply gofumpt formatting (#828)
+
+### ⚙️ Miscellaneous Tasks
+
+- *(deps)* Update golang:1.26.1 docker digest to 5ba1126 (#795)
+- *(deps)* Update golang docker tag to v1.26.2 (#800)
+- *(deps)* Update node.js to 8510330 (#809)
+- *(deps)* Update node.js to v24.15.0 (#811)
+- *(deps)* Update golang:1.26.2 docker digest to e1203b8 (#812)
+- *(deps)* Update pre-commit hook alessandrojcm/commitlint-pre-commit-hook to v9.25.0 (#822)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.12.0 (#826)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.12.1 (#827)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.12.2 (#830)
+- *(deps)* Update golang docker tag to v1.26.3 (#833)
+
+## [0.9.6] - 2026-03-29
+
+### 🐛 Bug Fixes
+
+- *(graph)* Stabilize debouncer tests with synctest fake clock
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.257 (#743)
+- *(deps)* Update golang.org/x/net to v0.51.0
+- *(deps)* Update module go.opentelemetry.io/contrib/bridges/otelslog to v0.16.0 (#745)
+- *(deps)* Update opentelemetry-go monorepo (#744)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.260 (#750)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.261 (#751)
+- *(deps)* Update opentelemetry-go monorepo (#755)
+- *(deps)* Update module go.opentelemetry.io/contrib/bridges/otelslog to v0.17.0 (#756)
+- *(deps)* Update module golang.org/x/sync to v0.20.0 (#760)
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.88 (#762)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.262 (#765)
+- *(deps)* Update module golang.org/x/crypto to v0.49.0 (#767)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.263 (#771)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.264 (#773)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.265 (#776)
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/pg to v1.18.5 (#778)
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.89 (#782)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.266 (#784)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.267 (#786)
+- Cap Node.js heap to prevent OOM during wgc composition (#788)
+
+### ⚙️ Miscellaneous Tasks
+
+- *(deps)* Update golang docker tag to v1.26.1 (#752)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.11.1
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.11.2 (#758)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.11.3 (#763)
+- *(deps)* Update pre-commit hook gitleaks/gitleaks to v8.30.1 (#769)
+- *(deps)* Update golang:1.26.1 docker digest to 984bf90 (#774)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.11.4 (#780)
+- *(deps)* Update node.js to v24.14.1 (#783)
+
 ## [0.9.5] - 2026-02-25
 
 ### 🐛 Bug Fixes

CLAUDE.md

@@ -9,7 +9,7 @@ This is a GraphQL schema registry service that manages federated GraphQL schemas
 ## Architecture
 
 ### Event Sourcing
-The system uses event sourcing via `gitlab.com/unboundsoftware/eventsourced`. Key domain aggregates are:
+The system uses event sourcing via `codeberg.org/eventsourced`. Key domain aggregates are:
 - **Organization** (domain/aggregates.go): Manages organizations, users, and API keys
 - **SubGraph** (domain/aggregates.go): Tracks subgraph schemas with versioning
 

Dockerfile

@@ -1,4 +1,4 @@
-FROM amd64/golang:1.26.0@sha256:9835fb4f8aa06038ca460e300ee3cb8079d0802a1979724cdb455f5784448704 as modules
+FROM amd64/golang:1.27.2@sha256:9e036bef9c3cd035cae4aeff523b3997c3c8aa993b13d112a71ea90143e87e48 as modules
 WORKDIR /build
 ADD go.* /build
 RUN go mod download
@@ -24,12 +24,17 @@ RUN GOOS=linux GOARCH=amd64 go build \
 FROM scratch as export
 COPY --from=build /build/coverage.txt /
 
-FROM node:24.14.0-alpine@sha256:7fddd9ddeae8196abf4a3ef2de34e11f7b1a722119f91f28ddf1e99dcafdf114
+FROM node:24.21.0-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1
 ENV TZ Europe/Stockholm
 
 # Install wgc CLI globally for Cosmo Router composition
 RUN npm install -g wgc@latest
 
+# Cap Node.js heap for runtime wgc invocations. 512MB leaves room for
+# composing supergraphs with many subgraphs; lower caps (e.g. 64MB) OOM
+# wgc as the subgraph count grows.
+ENV NODE_OPTIONS="--max-old-space-size=512"
+
 # Copy timezone data and certificates
 COPY --from=build /usr/share/zoneinfo /usr/share/zoneinfo
 COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
@@ -37,4 +42,8 @@ COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 # Copy the service binary
 COPY --from=build /release/service /
 
+# The image's own non-root user: Frostmoln enforces restricted Pod Security.
+# The service only writes under /tmp (cosmo composition).
+USER node
+
 CMD ["/service"]

cache/cache.go

@@ -6,10 +6,10 @@ import (
 	"sync"
 	"time"
 
-	"github.com/sparetimecoders/goamqp"
+	"codeberg.org/eventsourced/eventsourced"
-	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
 
 	"gitea.unbound.se/unboundsoftware/schemas/domain"
+	"gitea.unbound.se/unboundsoftware/schemas/graph/model"
 	"gitea.unbound.se/unboundsoftware/schemas/hash"
 )
 
@@ -21,9 +21,19 @@ type Cache struct {
 	services      map[string]map[string]map[string]struct{}
 	subGraphs     map[string]string
 	lastUpdate    map[string]string
+	mergedSDLs    map[string]*mergedSDLEntry
+	schemaUpdates map[string]*model.SchemaUpdate
 	logger        *slog.Logger
 }
 
+// mergedSDLEntry holds a precomputed merged SDL together with the lastUpdate
+// id it was computed against, so stale entries can be detected on read.
+type mergedSDLEntry struct {
+	ID        string
+	SDL       string
+	SubGraphs []*model.SubGraph
+}
+
 func (c *Cache) OrganizationByAPIKey(apiKey string) *domain.Organization {
 	c.mu.RLock()
 	defer c.mu.RUnlock()
@@ -91,6 +101,30 @@ func (c *Cache) Services(orgId, ref, lastUpdate string) ([]string, string) {
 	return services, c.lastUpdate[key]
 }
 
+// OrgRef identifies a single (organizationId, ref) pair that the cache
+// tracks subgraphs for.
+type OrgRef struct {
+	OrgId string
+	Ref   string
+}
+
+// AllOrgRefs returns every (orgId, ref) pair that currently has at least
+// one subgraph in the cache. Used by startup warmup to pre-compute the
+// merged SDL and SchemaUpdate for every known ref before the pod starts
+// serving traffic.
+func (c *Cache) AllOrgRefs() []OrgRef {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	var out []OrgRef
+	for orgId, refs := range c.services {
+		for ref := range refs {
+			out = append(out, OrgRef{OrgId: orgId, Ref: ref})
+		}
+	}
+	return out
+}
+
 func (c *Cache) SubGraphId(orgId, ref, service string) string {
 	c.mu.RLock()
 	defer c.mu.RUnlock()
@@ -98,7 +132,7 @@ func (c *Cache) SubGraphId(orgId, ref, service string) string {
 	return c.subGraphs[subGraphKey(orgId, ref, service)]
 }
 
-func (c *Cache) Update(msg any, _ goamqp.Headers) (any, error) {
+func (c *Cache) Update(msg any) error {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 
@@ -184,8 +218,11 @@ func (c *Cache) Update(msg any, _ goamqp.Headers) (any, error) {
 					for service := range refs[ref] {
 						delete(c.subGraphs, subGraphKey(orgId, ref, service))
 					}
-					// Remove lastUpdate for this org/ref
+					// Remove cached results for this org/ref
-					delete(c.lastUpdate, refKey(orgId, ref))
+					rk := refKey(orgId, ref)
+					delete(c.lastUpdate, rk)
+					delete(c.mergedSDLs, rk)
+					delete(c.schemaUpdates, rk)
 				}
 				delete(c.services, orgId)
 			}
@@ -212,7 +249,7 @@ func (c *Cache) Update(msg any, _ goamqp.Headers) (any, error) {
 	default:
 		c.logger.With("msg", msg).Warn("unexpected message received")
 	}
-	return nil, nil
+	return nil
 }
 
 func (c *Cache) updateSubGraph(orgId string, ref string, subGraphId string, service string, updated time.Time) {
@@ -253,10 +290,68 @@ func New(logger *slog.Logger) *Cache {
 		services:      make(map[string]map[string]map[string]struct{}),
 		subGraphs:     make(map[string]string),
 		lastUpdate:    make(map[string]string),
+		mergedSDLs:    make(map[string]*mergedSDLEntry),
+		schemaUpdates: make(map[string]*model.SchemaUpdate),
 		logger:        logger,
 	}
 }
 
+// GetMergedSDL returns the cached merged SDL for (orgId, ref) if it was
+// computed against the current lastUpdate. Returns nil when missing or stale.
+func (c *Cache) GetMergedSDL(orgId, ref string) *mergedSDLEntry {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	key := refKey(orgId, ref)
+	entry := c.mergedSDLs[key]
+	if entry == nil || entry.ID != c.lastUpdate[key] {
+		return nil
+	}
+	return entry
+}
+
+// MergedSDLEntry exposes the cached merged SDL fields to callers.
+func (e *mergedSDLEntry) Unpack() (id, sdl string, subGraphs []*model.SubGraph) {
+	return e.ID, e.SDL, e.SubGraphs
+}
+
+// SetMergedSDL stores a precomputed merged SDL for (orgId, ref). The entry
+// is only retained while c.lastUpdate[key] matches id; subsequent updates
+// invalidate it implicitly via the version mismatch in GetMergedSDL.
+func (c *Cache) SetMergedSDL(orgId, ref, id, sdl string, subGraphs []*model.SubGraph) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	c.mergedSDLs[refKey(orgId, ref)] = &mergedSDLEntry{
+		ID:        id,
+		SDL:       sdl,
+		SubGraphs: subGraphs,
+	}
+}
+
+// GetSchemaUpdate returns the cached SchemaUpdate (subgraphs + cosmo router
+// config) for (orgId, ref) when its id matches the current lastUpdate.
+// Returns nil when missing or stale.
+func (c *Cache) GetSchemaUpdate(orgId, ref string) *model.SchemaUpdate {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	key := refKey(orgId, ref)
+	upd := c.schemaUpdates[key]
+	if upd == nil || upd.ID != c.lastUpdate[key] {
+		return nil
+	}
+	return upd
+}
+
+// SetSchemaUpdate stores a precomputed SchemaUpdate for (orgId, ref).
+func (c *Cache) SetSchemaUpdate(orgId, ref string, update *model.SchemaUpdate) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	c.schemaUpdates[refKey(orgId, ref)] = update
+}
+
 func refKey(orgId string, ref string) string {
 	return fmt.Sprintf("%s<->%s", orgId, ref)
 }

cache/cache_test.go

@@ -7,10 +7,10 @@ import (
 	"testing"
 	"time"
 
+	"codeberg.org/eventsourced/eventsourced"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
 
 	"gitea.unbound.se/unboundsoftware/schemas/domain"
 	"gitea.unbound.se/unboundsoftware/schemas/hash"
@@ -208,7 +208,7 @@ func TestCache_Update_OrganizationAdded(t *testing.T) {
 	}
 	event.ID = *eventsourced.IdFromString(orgID)
 
-	_, err := c.Update(event, nil)
+	err := c.Update(event)
 	require.NoError(t, err)
 
 	// Verify organization was added
@@ -247,7 +247,7 @@ func TestCache_Update_APIKeyAdded(t *testing.T) {
 	}
 	event.ID = *eventsourced.IdFromString(uuid.New().String())
 
-	_, err := c.Update(event, nil)
+	err := c.Update(event)
 	require.NoError(t, err)
 
 	// Verify API key was added to cache
@@ -281,7 +281,7 @@ func TestCache_Update_SubGraphUpdated(t *testing.T) {
 	event.ID = *eventsourced.IdFromString(subGraphID)
 	event.SetWhen(time.Now())
 
-	_, err := c.Update(event, nil)
+	err := c.Update(event)
 	require.NoError(t, err)
 
 	// Verify subgraph was added to services
@@ -366,7 +366,7 @@ func TestCache_ConcurrentWrites(t *testing.T) {
 				Initiator: "user-" + string(rune(index)),
 			}
 			event.ID = *eventsourced.IdFromString(orgID)
-			_, err := c.Update(event, nil)
+			err := c.Update(event)
 			assert.NoError(t, err)
 		}(i)
 	}
@@ -423,7 +423,7 @@ func TestCache_ConcurrentReadsAndWrites(t *testing.T) {
 				Initiator: "user-new-" + string(rune(index)),
 			}
 			event.ID = *eventsourced.IdFromString(newOrgID)
-			_, err := c.Update(event, nil)
+			err := c.Update(event)
 			assert.NoError(t, err)
 		}(i)
 	}
@@ -471,7 +471,7 @@ func TestCache_Update_APIKeyRemoved(t *testing.T) {
 	}
 	event.ID = *eventsourced.IdFromString(orgID)
 
-	_, err := c.Update(event, nil)
+	err := c.Update(event)
 	require.NoError(t, err)
 
 	// Verify API key was removed from cache
@@ -523,7 +523,7 @@ func TestCache_Update_APIKeyRemoved_MultipleKeys(t *testing.T) {
 	}
 	event.ID = *eventsourced.IdFromString(orgID)
 
-	_, err := c.Update(event, nil)
+	err := c.Update(event)
 	require.NoError(t, err)
 
 	// Verify only key2 was removed
@@ -579,7 +579,7 @@ func TestCache_Update_OrganizationRemoved(t *testing.T) {
 	}
 	event.ID = *eventsourced.IdFromString(orgID)
 
-	_, err := c.Update(event, nil)
+	err := c.Update(event)
 	require.NoError(t, err)
 
 	// Verify organization was removed
@@ -633,7 +633,7 @@ func TestCache_Update_OrganizationRemoved_MultipleUsers(t *testing.T) {
 	}
 	event.ID = *eventsourced.IdFromString(orgID)
 
-	_, err := c.Update(event, nil)
+	err := c.Update(event)
 	require.NoError(t, err)
 
 	// Verify user1 still has otherOrgID but not removed orgID

cmd/service/amqp_test.go

@@ -0,0 +1,85 @@
+package main
+
+import (
+	"context"
+	"log/slog"
+	"testing"
+
+	"codeberg.org/eventsourced/eventsourced"
+	goamqp "codeberg.org/messaging/go-messaging-amqp"
+	spec "codeberg.org/messaging/messaging"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"gitea.unbound.se/unboundsoftware/schemas/cache"
+	"gitea.unbound.se/unboundsoftware/schemas/domain"
+)
+
+// ownKeys is a literal list on purpose: deriving it from the code would keep a renamed key green.
+var ownKeys = []string{
+	"SubGraph.Updated",
+	"Organization.Added",
+	"Organization.UserAdded",
+	"Organization.APIKeyAdded",
+	"Organization.APIKeyRemoved",
+	"Organization.Removed",
+}
+
+func Test_amqpSetups(t *testing.T) {
+	setups := amqpSetups(slog.Default(), make(chan error, 1), goamqp.NewPublisher(), cache.New(slog.Default()))
+	topology, err := goamqp.CollectTopology(serviceName, setups...)
+	require.NoError(t, err)
+
+	var consumed, publishesTo []string
+	for _, e := range topology.Endpoints {
+		switch e.Direction {
+		case spec.DirectionConsume:
+			assert.True(t, e.Ephemeral, "cache consumers must be transient, %s is durable", e.QueueName)
+			consumed = append(consumed, e.RoutingKey)
+		case spec.DirectionPublish:
+			publishesTo = append(publishesTo, e.ExchangeName)
+		}
+	}
+	assert.ElementsMatch(t, ownKeys, consumed)
+	assert.Equal(t, []string{"events.topic.exchange"}, publishesTo)
+}
+
+type recordingPublisher struct {
+	keys []string
+	ctxs []context.Context
+}
+
+func (r *recordingPublisher) Publish(ctx context.Context, routingKey string, _ any, _ ...goamqp.Header) error {
+	r.keys = append(r.keys, routingKey)
+	r.ctxs = append(r.ctxs, ctx)
+	return nil
+}
+
+func Test_newEventPublisher(t *testing.T) {
+	rec := &recordingPublisher{}
+	p, err := newEventPublisher(rec)
+	require.NoError(t, err)
+
+	for _, e := range []eventsourced.Event{
+		&domain.SubGraphUpdated{},
+		&domain.OrganizationAdded{},
+		&domain.UserAddedToOrganization{},
+		&domain.APIKeyAdded{},
+		&domain.APIKeyRemoved{},
+		&domain.OrganizationRemoved{},
+	} {
+		require.NoError(t, p.Publish(context.Background(), e))
+	}
+	assert.Equal(t, ownKeys, rec.keys, "published keys must match what the cache consumers bind")
+}
+
+func Test_uncancelledPublisher(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	rec := &recordingPublisher{}
+	p, err := newEventPublisher(uncancelledPublisher{rec})
+	require.NoError(t, err)
+
+	require.NoError(t, p.Publish(ctx, &domain.OrganizationAdded{}))
+	assert.NoError(t, rec.ctxs[0].Err(), "publish must not see the request's cancellation")
+}

cmd/service/service.go

@@ -13,6 +13,11 @@ import (
 	"syscall"
 	"time"
 
+	"codeberg.org/eventsourced/amqp"
+	"codeberg.org/eventsourced/eventsourced"
+	"codeberg.org/eventsourced/pg/v2"
+	goamqp "codeberg.org/messaging/go-messaging-amqp"
+	spec "codeberg.org/messaging/messaging"
 	"github.com/99designs/gqlgen/graphql/handler"
 	"github.com/99designs/gqlgen/graphql/handler/extension"
 	"github.com/99designs/gqlgen/graphql/handler/lru"
@@ -20,11 +25,7 @@ import (
 	"github.com/99designs/gqlgen/graphql/playground"
 	"github.com/alecthomas/kong"
 	"github.com/rs/cors"
-	"github.com/sparetimecoders/goamqp"
 	"github.com/vektah/gqlparser/v2/ast"
-	"gitlab.com/unboundsoftware/eventsourced/amqp"
-	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
-	"gitlab.com/unboundsoftware/eventsourced/pg"
 
 	"gitea.unbound.se/unboundsoftware/schemas/cache"
 	"gitea.unbound.se/unboundsoftware/schemas/domain"
@@ -57,7 +58,8 @@ func main() {
 	var cli CLI
 	_ = kong.Parse(&cli)
 	logger := logging.SetupLogger(cli.LogLevel, cli.LogFormat, serviceName, buildVersion)
-	closeEvents := make(chan error)
+	// buffered: go-messaging-amqp reports a lost connection without blocking
+	closeEvents := make(chan error, 1)
 
 	if err := start(
 		closeEvents,
@@ -66,6 +68,13 @@ func main() {
 		cli,
 	); err != nil {
 		logger.With("error", err).Error("process error")
+		// start() defers the OTel SDK shutdown, so by the time we get here the
+		// log exporter may already be torn down and the line above never
+		// reaches Alloy. Write to stderr too so startup failures are always
+		// visible in `kubectl logs`, and exit non-zero so the container is
+		// reported as failed (CrashLoopBackOff) instead of "Completed".
+		fmt.Fprintf(os.Stderr, "fatal: process error: %v\n", err)
+		os.Exit(1)
 	}
 }
 
@@ -107,7 +116,7 @@ func start(closeEvents chan error, logger *slog.Logger, connectToAmqpFunc func(u
 	}
 
 	publisher := goamqp.NewPublisher()
-	eventPublisher, err := amqp.New(publisher)
+	eventPublisher, err := newEventPublisher(uncancelledPublisher{publisher})
 	if err != nil {
 		return fmt.Errorf("failed to create event publisher: %v", err)
 	}
@@ -123,25 +132,7 @@ func start(closeEvents chan error, logger *slog.Logger, connectToAmqpFunc func(u
 	if err := loadSubGraphs(rootCtx, eventStore, serviceCache); err != nil {
 		return fmt.Errorf("caching subgraphs: %w", err)
 	}
-	setups := []goamqp.Setup{
+	if err := conn.Start(rootCtx, amqpSetups(logger, closeEvents, publisher, serviceCache)...); err != nil {
-		goamqp.UseLogger(func(s string) { logger.Error(s) }),
-		goamqp.CloseListener(closeEvents),
-		goamqp.WithPrefetchLimit(20),
-		goamqp.EventStreamPublisher(publisher),
-		goamqp.TransientEventStreamConsumer("SubGraph.Updated", serviceCache.Update, domain.SubGraphUpdated{}),
-		goamqp.TransientEventStreamConsumer("Organization.Added", serviceCache.Update, domain.OrganizationAdded{}),
-		goamqp.TransientEventStreamConsumer("Organization.UserAdded", serviceCache.Update, domain.UserAddedToOrganization{}),
-		goamqp.TransientEventStreamConsumer("Organization.APIKeyAdded", serviceCache.Update, domain.APIKeyAdded{}),
-		goamqp.TransientEventStreamConsumer("Organization.APIKeyRemoved", serviceCache.Update, domain.APIKeyRemoved{}),
-		goamqp.TransientEventStreamConsumer("Organization.Removed", serviceCache.Update, domain.OrganizationRemoved{}),
-		goamqp.WithTypeMapping("SubGraph.Updated", domain.SubGraphUpdated{}),
-		goamqp.WithTypeMapping("Organization.Added", domain.OrganizationAdded{}),
-		goamqp.WithTypeMapping("Organization.UserAdded", domain.UserAddedToOrganization{}),
-		goamqp.WithTypeMapping("Organization.APIKeyAdded", domain.APIKeyAdded{}),
-		goamqp.WithTypeMapping("Organization.APIKeyRemoved", domain.APIKeyRemoved{}),
-		goamqp.WithTypeMapping("Organization.Removed", domain.OrganizationRemoved{}),
-	}
-	if err := conn.Start(rootCtx, setups...); err != nil {
 		return fmt.Errorf("failed to setup AMQP: %v", err)
 	}
 
@@ -174,10 +165,13 @@ func start(closeEvents chan error, logger *slog.Logger, connectToAmqpFunc func(u
 	wg.Add(1)
 	go func() {
 		defer wg.Done()
-		err := <-closeEvents
+		select {
-		if err != nil {
+		case err := <-closeEvents:
-			logger.With("error", err).Error("received close from AMQP")
+			if err != nil {
-			rootCancel()
+				logger.With("error", err).Error("received close from AMQP")
+				rootCancel()
+			}
+		case <-rootCtx.Done():
 		}
 	}()
 
@@ -193,7 +187,6 @@ func start(closeEvents chan error, logger *slog.Logger, connectToAmqpFunc func(u
 			logger.With("error", err).Error("close http server")
 		}
 		close(sigint)
-		close(closeEvents)
 	}()
 	wg.Add(1)
 	go func() {
@@ -210,6 +203,8 @@ func start(closeEvents chan error, logger *slog.Logger, connectToAmqpFunc func(u
 			Debouncer:      graph.NewDebouncer(500 * time.Millisecond),
 		}
 
+		resolver.WarmCache(rootCtx)
+
 		config := generated.Config{
 			Resolvers:  resolver,
 			Complexity: generated.ComplexityRoot{},
@@ -291,7 +286,7 @@ func loadOrganizations(ctx context.Context, eventStore eventsourced.EventStore,
 		if _, err := eventsourced.NewHandler(ctx, organization, eventStore); err != nil {
 			return err
 		}
-		_, err := serviceCache.Update(organization, nil)
+		err := serviceCache.Update(organization)
 		if err != nil {
 			return err
 		}
@@ -309,7 +304,7 @@ func loadSubGraphs(ctx context.Context, eventStore eventsourced.EventStore, serv
 		if _, err := eventsourced.NewHandler(ctx, subGraph, eventStore); err != nil {
 			return err
 		}
-		_, err := serviceCache.Update(subGraph, nil)
+		err := serviceCache.Update(subGraph)
 		if err != nil {
 			return err
 		}
@@ -317,6 +312,49 @@ func loadSubGraphs(ctx context.Context, eventStore eventsourced.EventStore, serv
 	return nil
 }
 
+func newEventPublisher(p amqp.BackingPublisher) (*amqp.Amqp, error) {
+	return amqp.New(
+		p,
+		amqp.WithTypeMapping("SubGraph.Updated", domain.SubGraphUpdated{}),
+		amqp.WithTypeMapping("Organization.Added", domain.OrganizationAdded{}),
+		amqp.WithTypeMapping("Organization.UserAdded", domain.UserAddedToOrganization{}),
+		amqp.WithTypeMapping("Organization.APIKeyAdded", domain.APIKeyAdded{}),
+		amqp.WithTypeMapping("Organization.APIKeyRemoved", domain.APIKeyRemoved{}),
+		amqp.WithTypeMapping("Organization.Removed", domain.OrganizationRemoved{}),
+	)
+}
+
+func amqpSetups(logger *slog.Logger, closeEvents chan error, publisher *goamqp.Publisher, serviceCache *cache.Cache) []goamqp.Setup {
+	return []goamqp.Setup{
+		goamqp.WithLogger(logger),
+		goamqp.CloseListener(closeEvents),
+		goamqp.EventStreamPublisher(publisher),
+		goamqp.TransientEventStreamConsumer("SubGraph.Updated", cacheUpdater[domain.SubGraphUpdated](serviceCache)),
+		goamqp.TransientEventStreamConsumer("Organization.Added", cacheUpdater[domain.OrganizationAdded](serviceCache)),
+		goamqp.TransientEventStreamConsumer("Organization.UserAdded", cacheUpdater[domain.UserAddedToOrganization](serviceCache)),
+		goamqp.TransientEventStreamConsumer("Organization.APIKeyAdded", cacheUpdater[domain.APIKeyAdded](serviceCache)),
+		goamqp.TransientEventStreamConsumer("Organization.APIKeyRemoved", cacheUpdater[domain.APIKeyRemoved](serviceCache)),
+		goamqp.TransientEventStreamConsumer("Organization.Removed", cacheUpdater[domain.OrganizationRemoved](serviceCache)),
+	}
+}
+
+// uncancelledPublisher detaches publishes from the request context: eventsourced publishes
+// right after storing an event, and a stored event must be published even if the client left.
+type uncancelledPublisher struct {
+	amqp.BackingPublisher
+}
+
+func (p uncancelledPublisher) Publish(ctx context.Context, routingKey string, msg any, headers ...goamqp.Header) error {
+	return p.BackingPublisher.Publish(context.WithoutCancel(ctx), routingKey, msg, headers...)
+}
+
+// cacheUpdater passes the payload as a pointer, which is what Cache.Update switches on
+func cacheUpdater[T any](c *cache.Cache) spec.EventHandler[T] {
+	return func(_ context.Context, e spec.ConsumableEvent[T]) error {
+		return c.Update(&e.Payload)
+	}
+}
+
 func ConnectAMQP(url string) (Connection, error) {
 	return goamqp.NewFromURL(serviceName, url)
 }

cmd/service/service_test.go

@@ -4,11 +4,11 @@ import (
 	"context"
 	"testing"
 
+	"codeberg.org/eventsourced/eventsourced"
 	"github.com/99designs/gqlgen/graphql/handler/transport"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
 
 	"gitea.unbound.se/unboundsoftware/schemas/domain"
 	"gitea.unbound.se/unboundsoftware/schemas/hash"

domain/aggregates.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 	"time"
 
-	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
+	"codeberg.org/eventsourced/eventsourced"
 )
 
 type Organization struct {

domain/commands.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"strings"
 
-	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
+	"codeberg.org/eventsourced/eventsourced"
 
 	"gitea.unbound.se/unboundsoftware/schemas/hash"
 )

domain/commands_test.go

@@ -5,9 +5,9 @@ import (
 	"strings"
 	"testing"
 
+	"codeberg.org/eventsourced/eventsourced"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
 
 	"gitea.unbound.se/unboundsoftware/schemas/hash"
 )

domain/events.go

@@ -1,6 +1,6 @@
 package domain
 
-import "gitlab.com/unboundsoftware/eventsourced/eventsourced"
+import "codeberg.org/eventsourced/eventsourced"
 
 type OrganizationAdded struct {
 	eventsourced.BaseEvent

domain/events_test.go

@@ -4,9 +4,9 @@ import (
 	"testing"
 	"time"
 
+	"codeberg.org/eventsourced/eventsourced"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
 )
 
 func TestOrganizationAdded_UpdateOrganization(t *testing.T) {

go.mod

@@ -1,91 +1,98 @@
 module gitea.unbound.se/unboundsoftware/schemas
 
-go 1.25.0
+go 1.26.0
 
 require (
-	github.com/99designs/gqlgen v0.17.87
+	codeberg.org/eventsourced/amqp v1.10.1
+	codeberg.org/eventsourced/eventsourced v1.24.0
+	codeberg.org/eventsourced/pg/v2 v2.3.0
+	codeberg.org/messaging/go-messaging-amqp v0.0.6
+	codeberg.org/messaging/messaging v0.0.5
+	github.com/99designs/gqlgen v0.17.95
 	github.com/DATA-DOG/go-sqlmock v1.5.2
 	github.com/Khan/genqlient v0.8.1
-	github.com/alecthomas/kong v1.14.0
+	github.com/alecthomas/kong v1.16.1
 	github.com/apex/log v1.9.0
-	github.com/auth0/go-jwt-middleware/v3 v3.0.0
+	github.com/auth0/go-jwt-middleware/v3 v3.3.0
 	github.com/google/uuid v1.6.0
 	github.com/jmoiron/sqlx v1.4.0
-	github.com/pressly/goose/v3 v3.27.0
+	github.com/pressly/goose/v3 v3.29.0
 	github.com/rs/cors v1.11.1
-	github.com/sparetimecoders/goamqp v0.3.3
+	github.com/stretchr/testify v1.12.1
-	github.com/stretchr/testify v1.11.1
+	github.com/vektah/gqlparser/v2 v2.5.62
-	github.com/vektah/gqlparser/v2 v2.5.32
+	github.com/wundergraph/graphql-go-tools/v2 v2.28.0
-	github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.256
+	go.opentelemetry.io/contrib/bridges/otelslog v0.21.0
-	gitlab.com/unboundsoftware/eventsourced/amqp v1.9.1
+	go.opentelemetry.io/otel v1.47.0
-	gitlab.com/unboundsoftware/eventsourced/eventsourced v1.19.4
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.47.0
-	gitlab.com/unboundsoftware/eventsourced/pg v1.18.4
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0
-	go.opentelemetry.io/contrib/bridges/otelslog v0.15.0
+	go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.23.0
-	go.opentelemetry.io/otel v1.40.0
+	go.opentelemetry.io/otel/sdk v1.47.0
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.40.0
+	go.opentelemetry.io/otel/sdk/log v1.47.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.40.0
+	go.opentelemetry.io/otel/sdk/metric v1.47.0
-	go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.16.0
+	go.opentelemetry.io/otel/trace v1.47.0
-	go.opentelemetry.io/otel/log v0.16.0
+	golang.org/x/crypto v0.58.0
-	go.opentelemetry.io/otel/sdk v1.40.0
+	golang.org/x/sync v0.24.0
-	go.opentelemetry.io/otel/sdk/log v0.16.0
-	go.opentelemetry.io/otel/sdk/metric v1.40.0
-	go.opentelemetry.io/otel/trace v1.40.0
-	golang.org/x/crypto v0.48.0
-	golang.org/x/sync v0.19.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
 	github.com/agnivade/levenshtein v1.2.1 // indirect
-	github.com/buger/jsonparser v1.1.1 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/buger/jsonparser v1.1.2 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/coder/websocket v1.8.15 // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/goccy/go-yaml v1.19.2 // indirect
-	github.com/gorilla/websocket v1.5.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/lestrrat-go/blackmagic v1.0.4 // indirect
 	github.com/lestrrat-go/dsig v1.0.0 // indirect
 	github.com/lestrrat-go/dsig-secp256k1 v1.0.0 // indirect
 	github.com/lestrrat-go/httpcc v1.0.1 // indirect
 	github.com/lestrrat-go/httprc/v3 v3.0.3 // indirect
-	github.com/lestrrat-go/jwx/v3 v3.0.12 // indirect
+	github.com/lestrrat-go/jwx/v3 v3.0.13 // indirect
 	github.com/lestrrat-go/option/v2 v2.0.0 // indirect
-	github.com/lib/pq v1.11.2 // indirect
+	github.com/lib/pq v1.12.3 // indirect
 	github.com/mfridman/interpolate v0.0.2 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/client_golang v1.23.2 // indirect
-	github.com/rabbitmq/amqp091-go v1.10.0 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.66.1 // indirect
+	github.com/prometheus/procfs v0.22.0 // indirect
+	github.com/rabbitmq/amqp091-go v1.15.0 // indirect
 	github.com/segmentio/asm v1.2.1 // indirect
-	github.com/sethvargo/go-retry v0.3.0 // indirect
+	github.com/sethvargo/go-retry v0.5.0 // indirect
-	github.com/sosodev/duration v1.3.1 // indirect
+	github.com/sosodev/duration v1.4.0 // indirect
-	github.com/stretchr/objx v0.5.2 // indirect
+	github.com/stretchr/objx v0.5.3 // indirect
-	github.com/tidwall/gjson v1.17.0 // indirect
+	github.com/tidwall/gjson v1.18.0 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tidwall/sjson v1.2.5 // indirect
-	github.com/urfave/cli/v3 v3.6.2 // indirect
+	github.com/urfave/cli/v3 v3.11.0 // indirect
 	github.com/valyala/fastjson v1.6.7 // indirect
 	github.com/wundergraph/astjson v1.1.0 // indirect
-	github.com/wundergraph/go-arena v1.1.0 // indirect
+	github.com/wundergraph/go-arena v1.3.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0 // indirect
-	go.opentelemetry.io/otel/metric v1.40.0 // indirect
+	go.opentelemetry.io/otel/log v1.47.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.9.0 // indirect
+	go.opentelemetry.io/otel/metric v1.47.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/mod v0.33.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
-	golang.org/x/net v0.50.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/sys v0.41.0 // indirect
+	golang.org/x/mod v0.41.0 // indirect
-	golang.org/x/text v0.34.0 // indirect
+	golang.org/x/net v0.61.0 // indirect
-	golang.org/x/tools v0.42.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect
+	golang.org/x/text v0.43.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260217215200-42d3e9bedb6d // indirect
+	golang.org/x/tools v0.51.0 // indirect
-	google.golang.org/grpc v1.79.1 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20261005182115-fad411399dd8 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20261005182115-fad411399dd8 // indirect
+	google.golang.org/grpc v1.84.0 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
 )

go.sum

@@ -1,26 +1,32 @@
+codeberg.org/eventsourced/amqp v1.10.1 h1:nGSG+lKbq8ibr7p8WBqSfH12uROQb+UXKg6BFnhquY4=
+codeberg.org/eventsourced/amqp v1.10.1/go.mod h1:qQLe1a9T56hrPc/lxtoXWTqU3fnsgulQ1j4luQLNpcg=
+codeberg.org/eventsourced/eventsourced v1.24.0 h1:yNB+74JNB/NHo7D8ZR/yQcTVDYrWnjFf0xUKLgViqRc=
+codeberg.org/eventsourced/eventsourced v1.24.0/go.mod h1:uy0HxejDdNFpI+Yp7VOEvjfEUFJQX1VkCZ4e4JyDp7Q=
+codeberg.org/eventsourced/pg/v2 v2.3.0 h1:g6kZ9DASeFrC8C+bDcXzbYD8409KHzWmyLOI5sCdNWI=
+codeberg.org/eventsourced/pg/v2 v2.3.0/go.mod h1:qPxl3382m7lbhbrEaxwSZ9PrAPoODj2+TqnV3tIKWzU=
+codeberg.org/messaging/go-messaging-amqp v0.0.6 h1:TAPcIspjjg44MNXwbcscW+ol1kIX49lnX2N3dsh0e0s=
+codeberg.org/messaging/go-messaging-amqp v0.0.6/go.mod h1:R4Hg1w964P7OP7vQ9AsXdd4KjgN/YlQ/9+XzXKpEVp4=
+codeberg.org/messaging/messaging v0.0.5 h1:/ueH90F4RNPUeeJIwdG9oVhDW7+XjCzwOYq8xc0kfQk=
+codeberg.org/messaging/messaging v0.0.5/go.mod h1:xyWLUcfaVzcN6GWk9uaQsxPVUC2Vm2S89mYZGdiWTWg=
+codeberg.org/messaging/messaging/tck v0.0.3 h1:a4Nr7ytFqEJloTOyVeAtMNgO9Fig1ZUirjW4FVlK0lc=
+codeberg.org/messaging/messaging/tck v0.0.3/go.mod h1:RiOsKXGAhNQK2STBVYGjhN0CFtmcrsEne1qUe15n8Q4=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
 filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
-github.com/99designs/gqlgen v0.17.87 h1:pSnCIMhBQezAE8bc1GNmfdLXFmnWtWl1GRDFEE/nHP8=
+github.com/99designs/gqlgen v0.17.95 h1:882h7F5iJImgtyUVttc4MOK2NbzbMYc2oyNeHqkjpP4=
-github.com/99designs/gqlgen v0.17.87/go.mod h1:fK05f1RqSNfQpd4CfW5qk/810Tqi4/56Wf6Nem0khAg=
+github.com/99designs/gqlgen v0.17.95/go.mod h1:kHYPrpwOXDU1OQyxIg3Z7nVXSnlUoHVWBY7CMJCAM4M=
 github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7OputlJIzU=
 github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU=
 github.com/Khan/genqlient v0.8.1 h1:wtOCc8N9rNynRLXN3k3CnfzheCUNKBcvXmVv5zt6WCs=
 github.com/Khan/genqlient v0.8.1/go.mod h1:R2G6DzjBvCbhjsEajfRjbWdVglSH/73kSivC9TLWVjU=
-github.com/PuerkitoBio/goquery v1.11.0 h1:jZ7pwMQXIITcUXNH83LLk+txlaEy6NVOfTuP43xxfqw=
-github.com/PuerkitoBio/goquery v1.11.0/go.mod h1:wQHgxUOU3JGuj3oD/QFfxUdlzW6xPHfqyHre6VMY4DQ=
 github.com/agnivade/levenshtein v1.2.1 h1:EHBY3UOn1gwdy/VbFwgo4cxecRznFk7fKWN1KOX7eoM=
 github.com/agnivade/levenshtein v1.2.1/go.mod h1:QVVI16kDrtSuwcpd0p1+xMC6Z/VfhtCyDIjcwga4/DU=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
-github.com/alecthomas/kong v1.14.0 h1:gFgEUZWu2ZmZ+UhyZ1bDhuutbKN1nTtJTwh19Wsn21s=
+github.com/alecthomas/kong v1.16.1 h1:ixhCt93XkJ98kGposQ54+bl0IK6XwqB40AsMynU7Z8E=
-github.com/alecthomas/kong v1.14.0/go.mod h1:wrlbXem1CWqUV5Vbmss5ISYhsVPkBb1Yo7YKJghju2I=
+github.com/alecthomas/kong v1.16.1/go.mod h1:wrlbXem1CWqUV5Vbmss5ISYhsVPkBb1Yo7YKJghju2I=
 github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
 github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
-github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883 h1:bvNMNQO63//z+xNgfBlViaCIJKLlCJ6/fmUseuG0wVQ=
-github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
-github.com/andybalholm/cascadia v1.3.3 h1:AG2YHrzJIm4BZ19iwJ/DAua6Btl3IwJX+VI4kktS1LM=
-github.com/andybalholm/cascadia v1.3.3/go.mod h1:xNd9bqTn98Ln4DwST8/nG+H0yuB8Hmgu1YHNnWw0GeA=
 github.com/apex/log v1.9.0 h1:FHtw/xuaM8AgmvDDTI9fiwoAL25Sq2cxojnZICUU8l0=
 github.com/apex/log v1.9.0/go.mod h1:m82fZlWIuiWzWP04XCTXmnX0xRkYYbCdYn8jbJeLBEA=
 github.com/apex/logs v1.0.0/go.mod h1:XzxuLZ5myVHDy9SAmYpamKKRNApGj54PfYLcFrXqDwo=
@@ -28,36 +34,41 @@ github.com/aphistic/golf v0.0.0-20180712155816-02c07f170c5a/go.mod h1:3NqKYiepwy
 github.com/aphistic/sweet v0.2.0/go.mod h1:fWDlIh/isSE9n6EPsRmC0det+whmX6dJid3stzu0Xys=
 github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig+0+Ap1h4unLjW6YQJpKZVmUzxsD4E/Q=
 github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
-github.com/auth0/go-jwt-middleware/v3 v3.0.0 h1:+rvUPCT+VbAuK4tpS13fWfZrMyqTwLopt3VoY0Y7kvA=
+github.com/auth0/go-jwt-middleware/v3 v3.3.0 h1:nRALRLGsUdWgxX0knqwp60YxiYypeZYfhr+yFCvHoGY=
-github.com/auth0/go-jwt-middleware/v3 v3.0.0/go.mod h1:iU42jqjRyeKbf9YYSnRnolr836gk6Ty/jnUNuVq2b0o=
+github.com/auth0/go-jwt-middleware/v3 v3.3.0/go.mod h1:WXL/zFf3nuQJWQOVj3hGUQ289ixKVSrFGwZn6LxaQsw=
 github.com/aws/aws-sdk-go v1.20.6/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/aybabtme/rgbterm v0.0.0-20170906152045-cc83f3b3ce59/go.mod h1:q/89r3U2H7sSsE2t6Kca0lfwTK8JdoNGS/yzM/4iH5I=
-github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
-github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/buger/jsonparser v1.1.2 h1:frqHqw7otoVbk5M8LlE/L7HTnIq2v9RX6EJ48i9AxJk=
+github.com/buger/jsonparser v1.1.2/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
 github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/coder/websocket v1.8.15 h1:6B2JPeOGlpff2Uz6vOEH1Vzpi0iUz20A+lPVhPHtNUA=
+github.com/coder/websocket v1.8.15/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 h1:NMZiJj8QnKe1LgsbDayM4UoHwbvwDRwnI3hwNaAHRnc=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40=
 github.com/dgryski/trifles v0.0.0-20230903005119-f50d829f2e54 h1:SG7nF6SRlWhcT7cNTs5R6Hk4V2lcmLz2NsG2VnInyNo=
 github.com/dgryski/trifles v0.0.0-20230903005119-f50d829f2e54/go.mod h1:if7Fbed8SFyPtHLHbg49SI7NAdJiC5WIA09pe59rfAA=
-github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.1.0 h1:dbKTrvD0klcbBV/h4AWJdMuZogJACoMlvWIWZ5b2xWg=
-github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/dustin/go-humanize v1.1.0/go.mod h1:hc1CvRkJMsgxqjmjMQF3QNRAZBwY8AXBAzKYoSX9sFI=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
-github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
+github.com/go-sql-driver/mysql v1.10.1 h1:arlSnNLq6a5yxGxV7qg9lF4j0C+KwD6NbQyKr9QL6ME=
-github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
+github.com/go-sql-driver/mysql v1.10.1/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
@@ -73,10 +84,8 @@ github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gorilla/websocket v1.5.1 h1:gmztn0JnHVt9JZquRuzLw3g4wouNVzKL15iLr/zn/QY=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw=
-github.com/gorilla/websocket v1.5.1/go.mod h1:x3kM2JMyaluk02fnUJpQuwD2dCS5NDG2ZHL0uE0tcaY=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 h1:X+2YciYSxvMQK0UZ7sg45ZVabVZBeBuvMkmuI2V3Fak=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7/go.mod h1:lW34nIZuQ8UDPdkon5fmfp2l3+ZkQ2me/+oecHYLOII=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
@@ -89,14 +98,15 @@ github.com/jmoiron/sqlx v1.4.0 h1:1PLqN7S1UYp5t4SrVVnt4nUVNemrDAtxlulVe+Qgm3o=
 github.com/jmoiron/sqlx v1.4.0/go.mod h1:ZrZ7UsYB/weZdl2Bxg6jCRO9c3YHl8r3ahlKmRT4JLY=
 github.com/jpillora/backoff v0.0.0-20180909062703-3050d21c67d7/go.mod h1:2iMrUgbbvHEiQClaW2NsSzMyGHqN+rDFqY705q49KG0=
 github.com/kisielk/sqlstruct v0.0.0-20201105191214-5f3e10d3ab46/go.mod h1:yyMNCyc/Ib3bDTKd379tNMpB/7/H5TjM2Y9QJ5THLbE=
+github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLMPdiQ=
+github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/lestrrat-go/blackmagic v1.0.4 h1:IwQibdnf8l2KoO+qC3uT4OaTWsW7tuRQXy9TRN9QanA=
 github.com/lestrrat-go/blackmagic v1.0.4/go.mod h1:6AWFyKNNj0zEXQYfTMPfZrAXUWUfTIZ5ECEUEJaijtw=
 github.com/lestrrat-go/dsig v1.0.0 h1:OE09s2r9Z81kxzJYRn07TFM9XA4akrUdoMwr0L8xj38=
@@ -107,37 +117,54 @@ github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZ
 github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E=
 github.com/lestrrat-go/httprc/v3 v3.0.3 h1:WjLHWkDkgWXeIUrKi/7lS/sGq2DjkSAwdTbH5RHXAKs=
 github.com/lestrrat-go/httprc/v3 v3.0.3/go.mod h1:mSMtkZW92Z98M5YoNNztbRGxbXHql7tSitCvaxvo9l0=
-github.com/lestrrat-go/jwx/v3 v3.0.12 h1:p25r68Y4KrbBdYjIsQweYxq794CtGCzcrc5dGzJIRjg=
+github.com/lestrrat-go/jwx/v3 v3.0.13 h1:AdHKiPIYeCSnOJtvdpipPg/0SuFh9rdkN+HF3O0VdSk=
-github.com/lestrrat-go/jwx/v3 v3.0.12/go.mod h1:HiUSaNmMLXgZ08OmGBaPVvoZQgJVOQphSrGr5zMamS8=
+github.com/lestrrat-go/jwx/v3 v3.0.13/go.mod h1:2m0PV1A9tM4b/jVLMx8rh6rBl7F6WGb3EG2hufN9OQU=
 github.com/lestrrat-go/option/v2 v2.0.0 h1:XxrcaJESE1fokHy3FpaQ/cXW8ZsIdWcdFzzLOcID3Ss=
 github.com/lestrrat-go/option/v2 v2.0.0/go.mod h1:oSySsmzMoR0iRzCDCaUfsCzxQHUEuhOViQObyy7S6Vg=
 github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/lib/pq v1.11.2 h1:x6gxUeu39V0BHZiugWe8LXZYZ+Utk7hSJGThs8sdzfs=
+github.com/lib/pq v1.12.3 h1:tTWxr2YLKwIvK90ZXEw8GP7UFHtcbTtty8zsI+YjrfQ=
-github.com/lib/pq v1.11.2/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
+github.com/lib/pq v1.12.3/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
 github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
 github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/mfridman/interpolate v0.0.2 h1:pnuTK7MQIxxFz1Gr+rjSIx9u7qVjf5VOoM/u6BbAxPY=
 github.com/mfridman/interpolate v0.0.2/go.mod h1:p+7uk6oE07mpE/Ik1b8EckO0O4ZXiGAfshKBWLUM9Xg=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
-github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
-github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/nats-io/nats.go v1.52.0 h1:n3avV4VBsCgsdwh71TppsTwtv+QdPs7ntSKM8qJLGsc=
+github.com/nats-io/nats.go v1.52.0/go.mod h1:26HypzazeOkyO3/mqd1zZd53STJN0EjCYF9Uy2ZOBno=
+github.com/nats-io/nkeys v0.4.15 h1:JACV5jRVO9V856KOapQ7x+EY8Jo3qw1vJt/9Jpwzkk4=
+github.com/nats-io/nkeys v0.4.15/go.mod h1:CpMchTXC9fxA5zrMo4KpySxNjiDVvr8ANOSZdiNfUrs=
+github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
+github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
+github.com/ncruces/go-strftime v1.1.0 h1:vtPmPWMkb539RGV9WpWT9EwJGvrOCKvMNI4obWL47Hk=
+github.com/ncruces/go-strftime v1.1.0/go.mod h1:yVaq7iwCN09vHRrKBrrflXT0M9tTMG2KmZ9Fj7xeG/g=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pressly/goose/v3 v3.27.0 h1:/D30gVTuQhu0WsNZYbJi4DMOsx1lNq+6SkLe+Wp59BM=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pressly/goose/v3 v3.27.0/go.mod h1:3ZBeCXqzkgIRvrEMDkYh1guvtoJTU5oMMuDdkutoM78=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rabbitmq/amqp091-go v1.10.0 h1:STpn5XsHlHGcecLmMFCtg7mqq0RnD+zFr4uzukfVhBw=
+github.com/pressly/goose/v3 v3.29.0 h1:dtEnBCT7CqkHIUCdgrXsrmeisaN8gFkRU4Y5OEwif4o=
-github.com/rabbitmq/amqp091-go v1.10.0/go.mod h1:Hy4jKW5kQART1u+JkDTF9YYOQUHXqMuhrgxOEeS7G4o=
+github.com/pressly/goose/v3 v3.29.0/go.mod h1:plA4aP4+u+Q3FMTgbFbhF8TuAWpAdfWpoFGkJsIFWh0=
+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.66.1 h1:h5E0h5/Y8niHc5DlaLlWLArTQI7tMrsfQjHV+d9ZoGs=
+github.com/prometheus/common v0.66.1/go.mod h1:gcaUsgf3KfRSwHY4dIMXLPV0K/Wg1oZ8+SbZk/HH/dA=
+github.com/prometheus/procfs v0.22.0 h1:6q9+/JL9IKAPbCmBrv9n5O5Ty3NKnciV5X7YGw0oics=
+github.com/prometheus/procfs v0.22.0/go.mod h1:CvmFr/GVhIjIvWJZW3tgkODBQMRIf0EyWMQLHCHab58=
+github.com/rabbitmq/amqp091-go v1.15.0 h1:LEQL4/yp48/Wigt6A6XOu18RQRo8ZHtB5I/KZJn+gkw=
+github.com/rabbitmq/amqp091-go v1.15.0/go.mod h1:Hy4jKW5kQART1u+JkDTF9YYOQUHXqMuhrgxOEeS7G4o=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/fastuuid v1.1.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
@@ -154,26 +181,24 @@ github.com/segmentio/asm v1.2.1/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
 github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
 github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
-github.com/sethvargo/go-retry v0.3.0 h1:EEt31A35QhrcRZtrYFDTBg91cqZVnFL2navjDrah2SE=
+github.com/sethvargo/go-retry v0.5.0 h1:JYfFKmVJ8ER06GReN1efzc5cm52BrVsFVzmcHiKJwfY=
-github.com/sethvargo/go-retry v0.3.0/go.mod h1:mNX17F0C/HguQMyMyJxcnU471gOZGxCLyYaFyAZraas=
+github.com/sethvargo/go-retry v0.5.0/go.mod h1:tvsjdKG6xfiCx4LSiUZ06kcv38xvdVQwv8R6/VnnVWg=
 github.com/smartystreets/assertions v1.0.0/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM=
 github.com/smartystreets/go-aws-auth v0.0.0-20180515143844-0c1422d1fdb9/go.mod h1:SnhjPscd9TpLiy1LpzGSKh3bXCfxxXuqd9xmQJy3slM=
 github.com/smartystreets/gunit v1.0.0/go.mod h1:qwPWnhz6pn0NnRBP++URONOVyNkPyr4SauJk4cUOwJs=
-github.com/sosodev/duration v1.3.1 h1:qtHBDMQ6lvMQsL15g4aopM4HEfOaYuhWBw3NPTtlqq4=
+github.com/sosodev/duration v1.4.0 h1:35ed0KiVFriGHHzZZJaZLgmTEEICIyt8Sx0RQfj9IjE=
-github.com/sosodev/duration v1.3.1/go.mod h1:RQIBBX0+fMLc/D9+Jb/fwvVmo0eZvDDEERAikUR6SDg=
+github.com/sosodev/duration v1.4.0/go.mod h1:RQIBBX0+fMLc/D9+Jb/fwvVmo0eZvDDEERAikUR6SDg=
-github.com/sparetimecoders/goamqp v0.3.3 h1:z/nfTPmrjeU/rIVuNOgsVLCimp3WFoNFvS3ZzXRJ6HE=
-github.com/sparetimecoders/goamqp v0.3.3/go.mod h1:W9NRCpWLE+Vruv2dcRSbszNil2O826d2Nv6kAkETW5o=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
-github.com/tidwall/gjson v1.17.0 h1:/Jocvlh98kcTfpN2+JzGQWQcqrPQwDrVEMApx/M5ZwM=
+github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
-github.com/tidwall/gjson v1.17.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
 github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
 github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
@@ -188,97 +213,95 @@ github.com/tj/go-buffer v1.1.0/go.mod h1:iyiJpfFcR2B9sXu7KvjbT9fpM4mOelRSDTbntVj
 github.com/tj/go-elastic v0.0.0-20171221160941-36157cbbebc2/go.mod h1:WjeM0Oo1eNAjXGDx2yma7uG2XoyRZTq1uv3M/o7imD0=
 github.com/tj/go-kinesis v0.0.0-20171128231115-08b17f58cb1b/go.mod h1:/yhzCV0xPfx6jb1bBgRFjl5lytqVqZXEaeqWP8lTEao=
 github.com/tj/go-spin v1.1.0/go.mod h1:Mg1mzmePZm4dva8Qz60H2lHwmJ2loum4VIrLgVnKwh4=
-github.com/urfave/cli/v3 v3.6.2 h1:lQuqiPrZ1cIz8hz+HcrG0TNZFxU70dPZ3Yl+pSrH9A8=
+github.com/urfave/cli/v3 v3.11.0 h1:P/euJp99kb9p0tlVY+iYTLYYTAQlfl0hR2gUO1Img1Q=
-github.com/urfave/cli/v3 v3.6.2/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
+github.com/urfave/cli/v3 v3.11.0/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
 github.com/valyala/fastjson v1.6.7 h1:ZE4tRy0CIkh+qDc5McjatheGX2czdn8slQjomexVpBM=
 github.com/valyala/fastjson v1.6.7/go.mod h1:CLCAqky6SMuOcxStkYQvblddUtoRxhYMGLrsQns1aXY=
-github.com/vektah/gqlparser/v2 v2.5.32 h1:k9QPJd4sEDTL+qB4ncPLflqTJ3MmjB9SrVzJrawpFSc=
+github.com/vektah/gqlparser/v2 v2.5.62 h1:GJP/emj1wIWKs0U3SHcAgzknWgylTqQ1qH2gNL+wSWc=
-github.com/vektah/gqlparser/v2 v2.5.32/go.mod h1:c1I28gSOVNzlfc4WuDlqU7voQnsqI6OG2amkBAFmgts=
+github.com/vektah/gqlparser/v2 v2.5.62/go.mod h1:JNK+plRwKdXLsF/qPFPe5tE0z4s1WeroD9S5LR8um/Q=
 github.com/wundergraph/astjson v1.1.0 h1:xORDosrZ87zQFJwNGe/HIHXqzpdHOFmqWgykCLVL040=
 github.com/wundergraph/astjson v1.1.0/go.mod h1:h12D/dxxnedtLzsKyBLK7/Oe4TAoGpRVC9nDpDrZSWw=
-github.com/wundergraph/go-arena v1.1.0 h1:9+wSRkJAkA2vbYHp6s8tEGhPViRGQNGXqPHT0QzhdIc=
+github.com/wundergraph/go-arena v1.3.0 h1:n0ng5a1vbd8YGq1u3rMr0vPU5f6AZ1BXIiUhL1UIok8=
-github.com/wundergraph/go-arena v1.1.0/go.mod h1:ROOysEHWJjLQ8FSfNxZCziagb7Qw2nXY3/vgKRh7eWw=
+github.com/wundergraph/go-arena v1.3.0/go.mod h1:ROOysEHWJjLQ8FSfNxZCziagb7Qw2nXY3/vgKRh7eWw=
-github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.256 h1:IlLfd3qL4THUkxSXsVRwcDNCAPNXqDrflMI0Hbvlb/Q=
+github.com/wundergraph/graphql-go-tools/v2 v2.28.0 h1:Qh9CG3rAo2yrz4cs8PwJ3wDIDxWPeLFTVjMJcLkfmnQ=
-github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.256/go.mod h1:gfmmrPd2khZONmwYE8RIfnGjwIG+RqL52jYiBzcUST8=
+github.com/wundergraph/graphql-go-tools/v2 v2.28.0/go.mod h1:2+FpG5/GRCFYw+fU8jmid4bF+362KtCio5Fo7fzNvhU=
-gitlab.com/unboundsoftware/eventsourced/amqp v1.9.1 h1:X6269JoAzHIKCVmtgMHZH3m7xOpACSp37ca3eODe9iU=
-gitlab.com/unboundsoftware/eventsourced/amqp v1.9.1/go.mod h1:EAs0d6Eh0aDiQkUJlSWErHqgHFQdxx0e8I7aG/2FarY=
-gitlab.com/unboundsoftware/eventsourced/eventsourced v1.19.4 h1:+yZkhi9/sTyBEN5vJTfvycyXgGrm07QKGSh3jiWiQdM=
-gitlab.com/unboundsoftware/eventsourced/eventsourced v1.19.4/go.mod h1:LrA7I7etRmhIC1PjO8c26BHm+gWsy2rC3eSMe5+XUWE=
-gitlab.com/unboundsoftware/eventsourced/pg v1.18.4 h1:ei0xdaACXw6/54w5hPscGUlJUzHJm6MQoeUP7hPqbJA=
-gitlab.com/unboundsoftware/eventsourced/pg v1.18.4/go.mod h1:IryGlvRa02/IAASbGqoMHTC2Q4WHXr2QY7fLUVN3mL0=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/bridges/otelslog v0.15.0 h1:yOYhGNPZseueTTvWp5iBD3/CthrmvayUXYEX862dDi4=
+go.opentelemetry.io/contrib/bridges/otelslog v0.21.0 h1:/CdgE52i1OEPHhsGUqrggYNRaZy4v4YgVenGd52dRBI=
-go.opentelemetry.io/contrib/bridges/otelslog v0.15.0/go.mod h1:CvaNVqIfcybc+7xqZNubbE+26K6P7AKZF/l0lE2kdCk=
+go.opentelemetry.io/contrib/bridges/otelslog v0.21.0/go.mod h1:9pBdbVbuehIDzxN4accnzzxEUPT8Nq7grbZMo+J1VN4=
-go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms=
+go.opentelemetry.io/otel v1.47.0 h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM=
-go.opentelemetry.io/otel v1.40.0/go.mod h1:IMb+uXZUKkMXdPddhwAHm6UfOwJyh4ct1ybIlV14J0g=
+go.opentelemetry.io/otel v1.47.0/go.mod h1:8wS9O2qfXrYrzp6hIF/HOYJJf/wIhFPhR2xLuP+iXQU=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.40.0 h1:9y5sHvAxWzft1WQ4BwqcvA+IFVUJ1Ya75mSAUnFEVwE=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.47.0 h1:7kszRN4Ze5GeAkUnBjBSUIunVBMA+mZIG04auueqguM=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.40.0/go.mod h1:eQqT90eR3X5Dbs1g9YSM30RavwLF725Ris5/XSXWvqE=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.47.0/go.mod h1:CLzakYy8jOdkBfcveCWYkeKJxujcF4xPhh2Z7IfE98U=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 h1:QKdN8ly8zEMrByybbQgv8cWBcdAarwmIPZ6FThrWXJs=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0 h1:julhjPeUH/q/7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0/go.mod h1:bTdK1nhqF76qiPoCCdyFIV+N/sRHYXYCTQc+3VCi3MI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0/go.mod h1:Ao2mz688LH/tFf0yMAenidq6k2YNSx6SIY2q6jDACck=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.40.0 h1:wVZXIWjQSeSmMoxF74LzAnpVQOAFDo3pPji9Y4SOFKc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0 h1:aXZXsZ012wOgVkqaiQv+Z/d8V0xKjmg70F6m4CE94lc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.40.0/go.mod h1:khvBS2IggMFNwZK/6lEeHg/W57h/IX6J4URh57fuI40=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0/go.mod h1:ziu1gUIJhAaxM3EV1e3Ralk5AAyL1UOYz3lJJ4VSI38=
-go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.16.0 h1:ivlbaajBWJqhcCPniDqDJmRwj4lc6sRT+dCAVKNmxlQ=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.23.0 h1:PW/E9Tw6ZykC88pey0MZY8hKOUeEw+hX6PU+oXA4A9o=
-go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.16.0/go.mod h1:u/G56dEKDDwXNCVLsbSrllB2o8pbtFLUC4HpR66r2dc=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.23.0/go.mod h1:hUw4VNfiOnQ/yzGgy6ZdWVnudXw7iRfImhd6FjXOnvI=
-go.opentelemetry.io/otel/log v0.16.0 h1:DeuBPqCi6pQwtCK0pO4fvMB5eBq6sNxEnuTs88pjsN4=
+go.opentelemetry.io/otel/log v1.47.0 h1:cOTS1CcLbSQeZKanGJ+0JpF/+t4PELi3O3bbl2lqCcI=
-go.opentelemetry.io/otel/log v0.16.0/go.mod h1:rWsmqNVTLIA8UnwYVOItjyEZDbKIkMxdQunsIhpUMes=
+go.opentelemetry.io/otel/log v1.47.0/go.mod h1:9byitSQ5pLC6PpqwGXjqdMKya6ZTswHRZh2vvXT33nw=
-go.opentelemetry.io/otel/metric v1.40.0 h1:rcZe317KPftE2rstWIBitCdVp89A2HqjkxR3c11+p9g=
+go.opentelemetry.io/otel/metric v1.47.0 h1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY=
-go.opentelemetry.io/otel/metric v1.40.0/go.mod h1:ib/crwQH7N3r5kfiBZQbwrTge743UDc7DTFVZrrXnqc=
+go.opentelemetry.io/otel/metric v1.47.0/go.mod h1:ADGSXxRrXM6bjbvLo535EstVFlPpPYZm4LBKixjDHwU=
-go.opentelemetry.io/otel/sdk v1.40.0 h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8=
+go.opentelemetry.io/otel/metric/x v0.69.0 h1:DjRLr15H83v+hCW7JA9NoJvOkYTtmq5YoDRbe9deYpM=
-go.opentelemetry.io/otel/sdk v1.40.0/go.mod h1:Ph7EFdYvxq72Y8Li9q8KebuYUr2KoeyHx0DRMKrYBUE=
+go.opentelemetry.io/otel/metric/x v0.69.0/go.mod h1:uVvsMPMFFyj/HUQfrUnH3JjnOQ1dwFDorgFLRBasM0k=
-go.opentelemetry.io/otel/sdk/log v0.16.0 h1:e/b4bdlQwC5fnGtG3dlXUrNOnP7c8YLVSpSfEBIkTnI=
+go.opentelemetry.io/otel/sdk v1.47.0 h1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I=
-go.opentelemetry.io/otel/sdk/log v0.16.0/go.mod h1:JKfP3T6ycy7QEuv3Hj8oKDy7KItrEkus8XJE6EoSzw4=
+go.opentelemetry.io/otel/sdk v1.47.0/go.mod h1:VUc24kiOeoGsxG8G9ULx3fWKvB7jMhnGE8Oi607lgR0=
-go.opentelemetry.io/otel/sdk/log/logtest v0.16.0 h1:/XVkpZ41rVRTP4DfMgYv1nEtNmf65XPPyAdqV90TMy4=
+go.opentelemetry.io/otel/sdk/log v1.47.0 h1:W4N/ZfgpkRRnmARnqYoQ6BrWA0mrj8IzVDNLlpmUJZY=
-go.opentelemetry.io/otel/sdk/log/logtest v0.16.0/go.mod h1:iOOPgQr5MY9oac/F5W86mXdeyWZGleIx3uXO98X2R6Y=
+go.opentelemetry.io/otel/sdk/log v1.47.0/go.mod h1:Wu74Z2EmOKXi2FleSNAb0Hyau2G+r5kubSEMJw5aAMs=
-go.opentelemetry.io/otel/sdk/metric v1.40.0 h1:mtmdVqgQkeRxHgRv4qhyJduP3fYJRMX4AtAlbuWdCYw=
+go.opentelemetry.io/otel/sdk/log/logtest v0.23.0 h1:j3pm42QCrKYYLLkI6OrV1QHFkUfDA6/4EP+Y1PzggLg=
-go.opentelemetry.io/otel/sdk/metric v1.40.0/go.mod h1:4Z2bGMf0KSK3uRjlczMOeMhKU2rhUqdWNoKcYrtcBPg=
+go.opentelemetry.io/otel/sdk/log/logtest v0.23.0/go.mod h1:zt0gEnuTZgDvqvczHwYswz93eqMaIr6upTTsdV/HUlU=
-go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw=
+go.opentelemetry.io/otel/sdk/metric v1.47.0 h1:lfISg2j93VT6yqdk9OfUaZmw/GfcZqCCV3jdXtsPnKw=
-go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA=
+go.opentelemetry.io/otel/sdk/metric v1.47.0/go.mod h1:ypLp+mW1Nt2x+Szt3b5/i1syodyts49lMOwxpDI3VGw=
-go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A=
+go.opentelemetry.io/otel/trace v1.47.0 h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrFNWSrM=
-go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4=
+go.opentelemetry.io/otel/trace v1.47.0/go.mod h1:jNaSLa2PZEYFG6fRjJABAu+bw4FS08uDmPg28lTghu0=
+go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk=
+go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190426145343-a29dc8fdc734/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
-golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
-golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa h1:Zt3DZoOFFYkKhDT3v7Lm9FDMEV06GpzjG2jrqW+QTE0=
+golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
-golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa/go.mod h1:K79w1Vqn7PoiZn+TkNpx3BUWUQksGO3JcVX6qIjytmA=
+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
-golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
-golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60=
+golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
-golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM=
+golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
-golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
-golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
+golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI=
-golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
+golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA=
-gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
-gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 h1:merA0rdPeUV3YIIfHHcH4qBkiQAc1nfCKSI7lB4cV2M=
+google.golang.org/genproto/googleapis/api v0.0.0-20261005182115-fad411399dd8 h1:cFbkNigDInw+wVTXc+CyhUsoHGJCw0BR6mlNoRVfre0=
-google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409/go.mod h1:fl8J1IvUjCilwZzQowmw2b7HQB2eAuYBabMXzWurF+I=
+google.golang.org/genproto/googleapis/api v0.0.0-20261005182115-fad411399dd8/go.mod h1:QK6p7IgD7IZEZJBhhSUCib5X2vMOzlrGCGUw2XyVDh0=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260217215200-42d3e9bedb6d h1:t/LOSXPJ9R0B6fnZNyALBRfZBH0Uy0gT+uR+SJ6syqQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20261005182115-fad411399dd8 h1:0SXBqli5dnuCKMjI/X3FM226zEaEa0GUcSCJtN1vL2o=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260217215200-42d3e9bedb6d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20261005182115-fad411399dd8/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc=
-google.golang.org/grpc v1.79.1 h1:zGhSi45ODB9/p3VAawt9a+O/MULLl9dpizzNNpq7flY=
+google.golang.org/grpc v1.84.0 h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=
-google.golang.org/grpc v1.79.1/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
+google.golang.org/grpc v1.84.0/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
@@ -291,11 +314,11 @@ gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C
 gopkg.in/yaml.v3 v3.0.0-20200605160147-a5ece683394c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-modernc.org/libc v1.68.0 h1:PJ5ikFOV5pwpW+VqCK1hKJuEWsonkIJhhIXyuF/91pQ=
+modernc.org/libc v1.78.0 h1:Lpm+e9K6ruVYEGwWfuBO1xXtYEaXDouFOG1SuWjFDP4=
-modernc.org/libc v1.68.0/go.mod h1:NnKCYeoYgsEqnY3PgvNgAeaJnso968ygU8Z0DxjoEc0=
+modernc.org/libc v1.78.0/go.mod h1:wvxR55nOF2/66NkJoNV7/coXBTCvT3HR22rcqW6lOuA=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
-modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.12.1 h1:nFMiWrpStgZczNl6XI9GnIk/rWhYIyHGUaR04pGbp9g=
-modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/memory v1.12.1/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
-modernc.org/sqlite v1.46.1 h1:eFJ2ShBLIEnUWlLy12raN0Z1plqmFX9Qe3rjQTKt6sU=
+modernc.org/sqlite v1.60.1 h1:/blz53O951KWFOso4QQvEs/Fq6cDBKLtMVrYNSeJVKw=
-modernc.org/sqlite v1.46.1/go.mod h1:CzbrU2lSB1DKUusvwGz7rqEKIq+NUd8GWuBBZDs9/nA=
+modernc.org/sqlite v1.60.1/go.mod h1:1dIoEagfDE72QytD5scH1lxARtaUgKgHC/NuApA27r0=

graph/cosmo.go

@@ -109,7 +109,8 @@ func GenerateCosmoRouterConfigWithExecutor(subGraphs []*model.SubGraph, executor
 	// Execute wgc router compose
 	// wgc is installed globally in the Docker image
 	outputFile := filepath.Join(tmpDir, "config.json")
-	output, err := executor.Execute("wgc", "router", "compose",
+	output, err := executor.Execute(
+		"wgc", "router", "compose",
 		"--input", inputFile,
 		"--out", outputFile,
 		"--suppress-warnings",

graph/debounce_test.go

@@ -3,6 +3,7 @@ package graph
 import (
 	"sync/atomic"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"github.com/stretchr/testify/assert"
@@ -10,48 +11,59 @@ import (
 )
 
 func TestDebouncer_Coalesces(t *testing.T) {
-	d := NewDebouncer(50 * time.Millisecond)
+	synctest.Test(t, func(t *testing.T) {
-	var calls atomic.Int32
+		d := NewDebouncer(50 * time.Millisecond)
+		var calls atomic.Int32
 
-	// Fire 10 rapid calls for the same key — only the last should execute.
+		// Fire 10 rapid calls for the same key — only the last should execute.
-	for range 10 {
+		for range 10 {
-		d.Debounce("key1", func() {
+			d.Debounce("key1", func() {
-			calls.Add(1)
+				calls.Add(1)
-		})
+			})
-	}
+		}
 
-	// Wait for the debounce delay plus some margin.
+		// Advance fake clock past the debounce delay and let goroutines settle.
-	time.Sleep(150 * time.Millisecond)
+		time.Sleep(50 * time.Millisecond)
+		synctest.Wait()
 
-	assert.Equal(t, int32(1), calls.Load(), "rapid calls should coalesce into a single execution")
+		assert.Equal(t, int32(1), calls.Load(), "rapid calls should coalesce into a single execution")
+	})
 }
 
 func TestDebouncer_DifferentKeys(t *testing.T) {
-	d := NewDebouncer(50 * time.Millisecond)
+	synctest.Test(t, func(t *testing.T) {
-	var calls atomic.Int32
+		d := NewDebouncer(50 * time.Millisecond)
+		var calls atomic.Int32
 
-	d.Debounce("key-a", func() { calls.Add(1) })
+		d.Debounce("key-a", func() { calls.Add(1) })
-	d.Debounce("key-b", func() { calls.Add(1) })
+		d.Debounce("key-b", func() { calls.Add(1) })
-	d.Debounce("key-c", func() { calls.Add(1) })
+		d.Debounce("key-c", func() { calls.Add(1) })
 
-	time.Sleep(150 * time.Millisecond)
+		time.Sleep(50 * time.Millisecond)
+		synctest.Wait()
 
-	assert.Equal(t, int32(3), calls.Load(), "different keys should fire independently")
+		assert.Equal(t, int32(3), calls.Load(), "different keys should fire independently")
+	})
 }
 
 func TestDebouncer_TimerReset(t *testing.T) {
-	d := NewDebouncer(100 * time.Millisecond)
+	synctest.Test(t, func(t *testing.T) {
-	var value atomic.Int32
+		d := NewDebouncer(100 * time.Millisecond)
+		var value atomic.Int32
 
-	// First call sets value to 1.
+		// First call sets value to 1.
-	d.Debounce("key", func() { value.Store(1) })
+		d.Debounce("key", func() { value.Store(1) })
 
-	// Wait 60ms (less than the 100ms delay), then replace with value 2.
+		// Advance 60ms (less than the 100ms delay) — first timer hasn't fired.
-	time.Sleep(60 * time.Millisecond)
+		time.Sleep(60 * time.Millisecond)
-	d.Debounce("key", func() { value.Store(2) })
 
-	// At 60ms the first timer hasn't fired yet. Wait for the second timer.
+		// Replace with value 2 — resets the timer to fire at 60+100 = 160ms.
-	time.Sleep(150 * time.Millisecond)
+		d.Debounce("key", func() { value.Store(2) })
 
-	require.Equal(t, int32(2), value.Load(), "later call should replace the earlier one")
+		// Advance another 100ms (total 160ms) to fire the reset timer.
+		time.Sleep(100 * time.Millisecond)
+		synctest.Wait()
+
+		require.Equal(t, int32(2), value.Load(), "later call should replace the earlier one")
+	})
 }

graph/resolver.go

@@ -5,10 +5,12 @@ import (
 	"fmt"
 	"log/slog"
 
-	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
+	"codeberg.org/eventsourced/eventsourced"
 
 	"gitea.unbound.se/unboundsoftware/schemas/cache"
+	"gitea.unbound.se/unboundsoftware/schemas/graph/model"
 	"gitea.unbound.se/unboundsoftware/schemas/middleware"
+	"gitea.unbound.se/unboundsoftware/schemas/sdlmerge"
 )
 
 //go:generate go run github.com/99designs/gqlgen
@@ -60,3 +62,60 @@ func (r *Resolver) handler(ctx context.Context, aggregate eventsourced.Aggregate
 func apiKeyId(orgId, name string) string {
 	return fmt.Sprintf("%s-%s", orgId, name)
 }
+
+// WarmCache precomputes the merged SDL and SchemaUpdate (cosmo router
+// config) for every (orgId, ref) tracked in the cache. Intended to run
+// once at startup, after the event-sourced caches have been populated
+// but before the pod accepts traffic, so the first request per ref does
+// not pay the cold-start cost of running sdlmerge + wgc compose.
+//
+// Errors per ref are logged and skipped rather than aborting the whole
+// warmup: a single bad ref must not block the pod from serving the
+// remaining refs.
+func (r *Resolver) WarmCache(ctx context.Context) {
+	refs := r.Cache.AllOrgRefs()
+	r.Logger.Info("Warming schema cache on startup", "refCount", len(refs))
+
+	for _, or := range refs {
+		services, lastUpdate := r.Cache.Services(or.OrgId, or.Ref, "")
+		if len(services) == 0 {
+			continue
+		}
+
+		subGraphs := make([]*model.SubGraph, len(services))
+		serviceSDLs := make([]string, len(services))
+		for i, id := range services {
+			sg, err := r.fetchSubGraph(ctx, id)
+			if err != nil {
+				r.Logger.Error("warmup: fetch subgraph", "error", err, "orgId", or.OrgId, "ref", or.Ref, "id", id)
+				subGraphs = nil
+				break
+			}
+			subGraphs[i] = r.toGqlSubGraph(sg)
+			serviceSDLs[i] = sg.Sdl
+		}
+		if subGraphs == nil {
+			continue
+		}
+
+		if sdl, err := sdlmerge.MergeSDLs(serviceSDLs...); err != nil {
+			r.Logger.Error("warmup: merge SDLs", "error", err, "orgId", or.OrgId, "ref", or.Ref)
+		} else {
+			r.Cache.SetMergedSDL(or.OrgId, or.Ref, lastUpdate, sdl, subGraphs)
+		}
+
+		cosmoConfig, err := r.CosmoGenerator.Generate(ctx, subGraphs)
+		if err != nil {
+			r.Logger.Error("warmup: generate cosmo config", "error", err, "orgId", or.OrgId, "ref", or.Ref)
+			continue
+		}
+		r.Cache.SetSchemaUpdate(or.OrgId, or.Ref, &model.SchemaUpdate{
+			Ref:               or.Ref,
+			ID:                lastUpdate,
+			SubGraphs:         subGraphs,
+			CosmoRouterConfig: &cosmoConfig,
+		})
+	}
+
+	r.Logger.Info("Schema cache warmup complete", "refCount", len(refs))
+}

graph/schema.helpers.go

@@ -3,7 +3,7 @@ package graph
 import (
 	"context"
 
-	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
+	"codeberg.org/eventsourced/eventsourced"
 
 	"gitea.unbound.se/unboundsoftware/schemas/domain"
 	"gitea.unbound.se/unboundsoftware/schemas/graph/model"

graph/schema.resolvers.go

@@ -10,7 +10,7 @@ import (
 	"fmt"
 	"strings"
 
-	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
+	"codeberg.org/eventsourced/eventsourced"
 
 	"gitea.unbound.se/unboundsoftware/schemas/domain"
 	"gitea.unbound.se/unboundsoftware/schemas/graph/generated"
@@ -178,7 +178,8 @@ func (r *mutationResolver) UpdateSubGraph(ctx context.Context, input model.Input
 	// same org+ref only trigger one config generation.
 	r.Debouncer.Debounce(orgId+":"+input.Ref, func() {
 		services, lastUpdate := r.Cache.Services(orgId, input.Ref, "")
-		r.Logger.Info("Publishing schema update after subgraph change",
+		r.Logger.Info(
+			"Publishing schema update after subgraph change",
 			"ref", input.Ref,
 			"orgId", orgId,
 			"lastUpdate", lastUpdate,
@@ -209,8 +210,10 @@ func (r *mutationResolver) UpdateSubGraph(ctx context.Context, input model.Input
 			SubGraphs:         subGraphs,
 			CosmoRouterConfig: &cosmoConfig,
 		}
+		r.Cache.SetSchemaUpdate(orgId, input.Ref, update)
 
-		r.Logger.Info("Publishing schema update to subscribers",
+		r.Logger.Info(
+			"Publishing schema update to subscribers",
 			"ref", update.Ref,
 			"id", update.ID,
 			"subGraphsCount", len(update.SubGraphs),
@@ -246,7 +249,8 @@ func (r *queryResolver) Supergraph(ctx context.Context, ref string, isAfter *str
 	orgId := middleware.OrganizationFromContext(ctx)
 	userId := middleware.UserFromContext(ctx)
 
-	r.Logger.Info("Supergraph query",
+	r.Logger.Info(
+		"Supergraph query",
 		"ref", ref,
 		"orgId", orgId,
 		"userId", userId,
@@ -277,13 +281,25 @@ func (r *queryResolver) Supergraph(ctx context.Context, ref string, isAfter *str
 	if isAfter != nil {
 		after = *isAfter
 	}
-	services, lastUpdate := r.Cache.Services(orgId, ref, after)
+	_, lastUpdate := r.Cache.Services(orgId, ref, after)
 	if after == lastUpdate {
 		return &model.Unchanged{
 			ID:              lastUpdate,
 			MinDelaySeconds: 10,
 		}, nil
 	}
+
+	if cached := r.Cache.GetMergedSDL(orgId, ref); cached != nil {
+		id, sdl, subGraphs := cached.Unpack()
+		return &model.SubGraphs{
+			ID:              id,
+			SubGraphs:       subGraphs,
+			Sdl:             sdl,
+			MinDelaySeconds: 10,
+		}, nil
+	}
+
+	services, _ := r.Cache.Services(orgId, ref, "")
 	subGraphs := make([]*model.SubGraph, len(services))
 	serviceSDLs := make([]string, len(services))
 	for i, id := range services {
@@ -299,6 +315,7 @@ func (r *queryResolver) Supergraph(ctx context.Context, ref string, isAfter *str
 	if err != nil {
 		return nil, err
 	}
+	r.Cache.SetMergedSDL(orgId, ref, lastUpdate, sdl, subGraphs)
 	return &model.SubGraphs{
 		ID:              lastUpdate,
 		SubGraphs:       subGraphs,
@@ -312,7 +329,8 @@ func (r *queryResolver) LatestSchema(ctx context.Context, ref string) (*model.Sc
 	orgId := middleware.OrganizationFromContext(ctx)
 	userId := middleware.UserFromContext(ctx)
 
-	r.Logger.Info("LatestSchema query",
+	r.Logger.Info(
+		"LatestSchema query",
 		"ref", ref,
 		"orgId", orgId,
 		"userId", userId,
@@ -340,9 +358,20 @@ func (r *queryResolver) LatestSchema(ctx context.Context, ref string) (*model.Sc
 		return nil, fmt.Errorf("no authentication provided")
 	}
 
+	if cached := r.Cache.GetSchemaUpdate(orgId, ref); cached != nil {
+		r.Logger.Info(
+			"Latest schema served from cache",
+			"ref", ref,
+			"orgId", orgId,
+			"id", cached.ID,
+		)
+		return cached, nil
+	}
+
 	// Get current services and schema
 	services, lastUpdate := r.Cache.Services(orgId, ref, "")
-	r.Logger.Info("Fetching latest schema",
+	r.Logger.Info(
+		"Fetching latest schema",
 		"ref", ref,
 		"orgId", orgId,
 		"lastUpdate", lastUpdate,
@@ -380,8 +409,10 @@ func (r *queryResolver) LatestSchema(ctx context.Context, ref string) (*model.Sc
 		SubGraphs:         subGraphs,
 		CosmoRouterConfig: &cosmoConfig,
 	}
+	r.Cache.SetSchemaUpdate(orgId, ref, update)
 
-	r.Logger.Info("Latest schema fetched",
+	r.Logger.Info(
+		"Latest schema fetched",
 		"ref", update.Ref,
 		"id", update.ID,
 		"subGraphsCount", len(update.SubGraphs),
@@ -395,7 +426,8 @@ func (r *queryResolver) LatestSchema(ctx context.Context, ref string) (*model.Sc
 func (r *subscriptionResolver) SchemaUpdates(ctx context.Context, ref string) (<-chan *model.SchemaUpdate, error) {
 	orgId := middleware.OrganizationFromContext(ctx)
 
-	r.Logger.Info("SchemaUpdates subscription started",
+	r.Logger.Info(
+		"SchemaUpdates subscription started",
 		"ref", ref,
 		"orgId", orgId,
 	)
@@ -412,7 +444,8 @@ func (r *subscriptionResolver) SchemaUpdates(ctx context.Context, ref string) (<
 	// Send initial state immediately
 	go func() {
 		services, lastUpdate := r.Cache.Services(orgId, ref, "")
-		r.Logger.Info("Preparing initial schema update",
+		r.Logger.Info(
+			"Preparing initial schema update",
 			"ref", ref,
 			"orgId", orgId,
 			"lastUpdate", lastUpdate,
@@ -444,7 +477,8 @@ func (r *subscriptionResolver) SchemaUpdates(ctx context.Context, ref string) (<
 			CosmoRouterConfig: &cosmoConfig,
 		}
 
-		r.Logger.Info("Sending initial schema update",
+		r.Logger.Info(
+			"Sending initial schema update",
 			"ref", update.Ref,
 			"id", update.ID,
 			"subGraphsCount", len(update.SubGraphs),

k8s/autoscale.yaml

@@ -18,3 +18,23 @@ spec:
       target:
         type: Utilization
         averageUtilization: 60
+  behavior:
+    scaleUp:
+      # Wait 2min of sustained high CPU before scaling up. Schemas is
+      # event-driven and the per-request work is bursty even with the
+      # cache + warmup, so single spikes shouldn't pull replicas up.
+      stabilizationWindowSeconds: 120
+      policies:
+      - type: Pods
+        value: 1
+        periodSeconds: 60
+    scaleDown:
+      # Default 300s window kept pods pinned at maxReplicas long after
+      # the triggering spike had subsided. 120s is long enough to avoid
+      # flapping but lets the deployment return to minReplicas quickly
+      # once the workload calms.
+      stabilizationWindowSeconds: 120
+      policies:
+      - type: Pods
+        value: 1
+        periodSeconds: 60

k8s/deploy.yaml

@@ -26,6 +26,11 @@ spec:
       labels:
         app.kubernetes.io/name: schemas
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
       affinity:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
@@ -40,10 +45,16 @@ spec:
               topologyKey: kubernetes.io/hostname
       containers:
       - name: schemas
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ["ALL"]
         resources:
           requests:
-            cpu: "20m"
+            cpu: "100m"
-            memory: "20Mi"
+            memory: "128Mi"
+          limits:
+            memory: "768Mi"
         livenessProbe:
           httpGet:
             path: /health/live
@@ -61,13 +72,13 @@ spec:
           timeoutSeconds: 5
           failureThreshold: 3
         imagePullPolicy: IfNotPresent
-        image: oci.unbound.se/unboundsoftware/schemas:${COMMIT}
+        image: ${IMAGE}
         ports:
         - name: api
           containerPort: 8080
         env:
         - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: http://k8s-monitoring-alloy-receiver.monitoring.svc.cluster.local:4318
+          value: http://k8s-monitoring-alloy.monitoring.svc.cluster.local:4318
         envFrom:
         - configMapRef:
             name: schemas

k8s/ingress-prod-frostmoln.yaml

@@ -0,0 +1,20 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: schemas
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: "schemas.unbound.se"
+    http:
+      paths:
+      - path: /query
+        pathType: Prefix
+        backend:
+          service:
+            name: schemas
+            port:
+              name: api

k8s/ingress-prod.yaml

@@ -1,24 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: schemas-ingress
-  annotations:
-    alb.ingress.kubernetes.io/group.name: "default"
-    alb.ingress.kubernetes.io/scheme: internet-facing
-    alb.ingress.kubernetes.io/target-type: instance
-    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'
-    alb.ingress.kubernetes.io/ssl-redirect: "443"
-    alb.ingress.kubernetes.io/healthcheck-path: '/health'
-spec:
-  ingressClassName: "alb"
-  rules:
-  - host: "schemas.unbound.se"
-    http:
-      paths:
-      - path: /query
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: schemas
-            port:
-              name: api

k8s/secrets-prod-frostmoln.yaml

@@ -0,0 +1,17 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: schemas
+spec:
+  refreshInterval: 1h
+  # The namespace's store (infra frostmoln/production/schemas.tf); the
+  # Frostmoln Secret holds POSTGRES_URL, AMQP_URL and API_KEY
+  # (infra frostmoln/production/scripts/seed-schemas.sh).
+  secretStoreRef:
+    name: frostmoln
+    kind: SecretStore
+  target:
+    name: schemas
+  dataFrom:
+  - extract:
+      key: schemas

k8s/secrets.yaml

@@ -1,24 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: schemas
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    name: external-secrets
-    kind: ClusterSecretStore
-  target:
-    creationPolicy: Owner
-    template:
-      mergePolicy: Merge
-      engineVersion: 'v2'
-      data:
-        POSTGRES_URL: "postgres://{{ .DB_USERNAME }}:{{ .DB_PASSWORD }}@{{ .DB_HOST }}:{{ .DB_PORT }}/schemas?sslmode=disable"
-        API_KEY: "{{ .API_KEY }}"
-  dataFrom:
-  - extract:
-      key: services/schemas
-  - extract:
-      key: rds/postgres/prod-psql
-  - extract:
-      key: mq/rabbit/prod

middleware/auth_test.go

@@ -6,13 +6,13 @@ import (
 	"net/http/httptest"
 	"testing"
 
+	"codeberg.org/eventsourced/eventsourced"
 	"github.com/auth0/go-jwt-middleware/v3/core"
 	"github.com/auth0/go-jwt-middleware/v3/validator"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
-	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
 
 	"gitea.unbound.se/unboundsoftware/schemas/domain"
 )

monitoring/otel.go

@@ -12,7 +12,6 @@ import (
 	"go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp"
 	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp"
 	"go.opentelemetry.io/otel/exporters/stdout/stdoutlog"
-	"go.opentelemetry.io/otel/log/global"
 	"go.opentelemetry.io/otel/propagation"
 	"go.opentelemetry.io/otel/sdk/log"
 	"go.opentelemetry.io/otel/sdk/metric"
@@ -75,7 +74,7 @@ func SetupOTelSDK(ctx context.Context, enabled bool, serviceName, buildVersion,
 	processor := log.NewSimpleProcessor(logExporter)
 	logProvider := log.NewLoggerProvider(log.WithProcessor(processor))
 
-	global.SetLoggerProvider(logProvider)
+	otel.SetLoggerProvider(logProvider)
 	shutdownFuncs = append(shutdownFuncs, logProvider.Shutdown)
 
 	exp, err := otlpmetrichttp.New(ctx)

rand/string.go

@@ -9,7 +9,8 @@ const charset = "abcdefghijklmnopqrstuvwxyz" +
 	"ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
 
 var seededRand *rand.Rand = rand.New(
-	rand.NewSource(time.Now().UnixNano()))
+	rand.NewSource(time.Now().UnixNano()),
+)
 
 func StringWithCharset(length int, charset string) string {
 	b := make([]byte, length)

renovate.json

@@ -16,7 +16,8 @@
     {
       "groupName": "Eventsourced",
       "matchPackageNames": [
-        "gitlab.com/unboundsoftware/eventsourced/**"
+        "codeberg.org/eventsourced/**",
+        "codeberg.org/messaging/**"
       ]
     }
   ]

sdlmerge/sdlmerge.go

@@ -50,12 +50,12 @@ func MergeSDLs(SDLs ...string) (string, error) {
 
 	doc, report := astparser.ParseGraphqlDocumentString(strings.Join(rawDocs, "\n"))
 	if report.HasErrors() {
-		return "", fmt.Errorf("parse graphql document string: %w", report)
+		return "", fmt.Errorf("parse graphql document string: %w", &report)
 	}
 
 	astnormalization.NormalizeSubgraphSDL(&doc, &report)
 	if report.HasErrors() {
-		return "", fmt.Errorf("merge ast: %w", report)
+		return "", fmt.Errorf("merge ast: %w", &report)
 	}
 
 	if err := MergeAST(&doc); err != nil {
@@ -81,11 +81,11 @@ func validateSubgraphs(subgraphs []string) error {
 			return err
 		}
 		if report.HasErrors() {
-			return fmt.Errorf(parseDocumentError, report)
+			return fmt.Errorf(parseDocumentError, &report)
 		}
 		validator.Validate(&doc, &report)
 		if report.HasErrors() {
-			return fmt.Errorf("validate schema: %w", report)
+			return fmt.Errorf("validate schema: %w", &report)
 		}
 	}
 	return nil
@@ -96,11 +96,11 @@ func normalizeSubgraphs(subgraphs []string) error {
 	for i, subgraph := range subgraphs {
 		doc, report := astparser.ParseGraphqlDocumentString(subgraph)
 		if report.HasErrors() {
-			return fmt.Errorf(parseDocumentError, report)
+			return fmt.Errorf(parseDocumentError, &report)
 		}
 		subgraphNormalizer.NormalizeDefinition(&doc, &report)
 		if report.HasErrors() {
-			return fmt.Errorf("normalize schema: %w", report)
+			return fmt.Errorf("normalize schema: %w", &report)
 		}
 		out, err := astprinter.PrintString(&doc)
 		if err != nil {
@@ -160,7 +160,7 @@ func (m *normalizer) normalize(operation *ast.Document) error {
 	for _, walker := range m.walkers {
 		walker.Walk(operation, nil, &report)
 		if report.HasErrors() {
-			return fmt.Errorf("walk: %w", report)
+			return fmt.Errorf("walk: %w", &report)
 		}
 	}