Repository: owncloud/ocis
Pull request #8051 (2023-12-21 11:40:25)

[full-ci] Service Account Roles
Adds a hidden role for service accounts. This role will give the service account all permissions it needs but will not appear in list roles calls. Also it doesn't need the default role assignments to work.

Fixes: https://github.com/owncloud/enterprise/issues/6286

Also deprecates `filesystem` settings store 

NOTE: This is a breaking change. It removes the (unreleased) `SETTINGS_SERVICE_ACCOUNT_ID_ADMIN` environment variable without deprecation


Patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2ad507c7ab6..de60364dd2a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -42,46 +42,18 @@ The following sections list the changes for unreleased.
 
 ## Summary
 
-* Bugfix - Fix search by containing special characters: [#8050](https://github.com/owncloud/ocis/pull/8050)
-* Enhancement - Add RED metrics to the metrics endpoint: [#7994](https://github.com/owncloud/ocis/pull/7994)
-* Enhancement - Bump reva: [#8038](https://github.com/owncloud/ocis/pull/8038)
+* Bugfix - Fix search by exact email: [#8035](https://github.com/owncloud/ocis/pull/8035)
 
 ## Details
 
-* Bugfix - Fix search by containing special characters: [#8050](https://github.com/owncloud/ocis/pull/8050)
+* Bugfix - Fix search by exact email: [#8035](https://github.com/owncloud/ocis/pull/8035)
 
-   As the OData query parser interprets characters like '@' or '-' in a special
-   way. Search request for users or groups needs to be quoted. We fixed the
-   libregraph users and groups endpoints to handle quoted search terms correctly.
+   Users can be searched by exact email by using double quotes on the search
+   parameter. Note that double quotes are required because the "@" char is being
+   interpreted by the parser.
 
-   https://github.com/owncloud/ocis/issues/7990
-   https://github.com/owncloud/ocis/pull/8050
    https://github.com/owncloud/ocis/pull/8035
 
-* Enhancement - Add RED metrics to the metrics endpoint: [#7994](https://github.com/owncloud/ocis/pull/7994)
-
-   We added three new metrics to the metrics endpoint to support the RED method for
-   monitoring microservices.
-
-   - Request Rate: The number of requests per second. The total count of requests
-   is available under `ocis_proxy_requests_total`. - Error Rate: The number of
-   failed requests per second. The total count of failed requests is available
-   under `ocis_proxy_errors_total`. - Duration: The amount of time each request
-   takes. The duration of all requests is available under
-   `ocis_proxy_request_duration_seconds`. This is a histogram metric, so it also
-   provides information about the distribution of request durations.
-
-   The metrics are available under the following paths: `PROXY_DEBUG_ADDR/metrics`
-   in a prometheus compatible format and maybe secured by `PROXY_DEBUG_TOKEN`.
-
-   https://github.com/owncloud/ocis/pull/7994
-
-* Enhancement - Bump reva: [#8038](https://github.com/owncloud/ocis/pull/8038)
-
-   Bumps reva version
-
-   https://github.com/owncloud/ocis/pull/8038
-
 # Changelog for [5.0.0-beta.2] (2023-12-20)
 
 The following sections list the changes for 5.0.0-beta.2.
diff --git a/changelog/unreleased/add-RED-metrics.md b/changelog/unreleased/add-RED-metrics.md
deleted file mode 100644
index 87c7beaffba..00000000000
--- a/changelog/unreleased/add-RED-metrics.md
+++ /dev/null
@@ -1,11 +0,0 @@
-Enhancement: Add RED metrics to the metrics endpoint
-
-We added three new metrics to the metrics endpoint to support the RED method for monitoring microservices.
-
-- Request Rate: The number of requests per second. The total count of requests is available under `ocis_proxy_requests_total`.
-- Error Rate: The number of failed requests per second. The total count of failed requests is available under `ocis_proxy_errors_total`.
-- Duration: The amount of time each request takes. The duration of all requests is available under `ocis_proxy_request_duration_seconds`. This is a histogram metric, so it also provides information about the distribution of request durations.
-
-The metrics are available under the following paths: `PROXY_DEBUG_ADDR/metrics` in a prometheus compatible format and maybe secured by `PROXY_DEBUG_TOKEN`.
-
-https://github.com/owncloud/ocis/pull/7994
diff --git a/changelog/unreleased/bump-reva.md b/changelog/unreleased/bump-reva.md
deleted file mode 100644
index f7e1fadc89d..00000000000
--- a/changelog/unreleased/bump-reva.md
+++ /dev/null
@@ -1,5 +0,0 @@
-Enhancement: Bump reva
-
-Bumps reva version
-
-https://github.com/owncloud/ocis/pull/8038
diff --git a/changelog/unreleased/fix-search-by-exact-mail.md b/changelog/unreleased/fix-search-by-exact-mail.md
index 988f7faa4ee..7e85130ba33 100644
--- a/changelog/unreleased/fix-search-by-exact-mail.md
+++ b/changelog/unreleased/fix-search-by-exact-mail.md
@@ -1,9 +1,7 @@
-Bugfix: Fix search by containing special characters
+Bugfix: Fix search by exact email
 
-As the OData query parser interprets characters like '@' or '-' in a special
-way. Search request for users or groups needs to be quoted. We fixed the libregraph
-users and groups endpoints to handle quoted search terms correctly.
+Users can be searched by exact email by using double quotes on the search
+parameter. Note that double quotes are required because the "@" char is
+being interpreted by the parser.
 
-https://github.com/owncloud/ocis/pull/8050
 https://github.com/owncloud/ocis/pull/8035
-https://github.com/owncloud/ocis/issues/7990
diff --git a/changelog/unreleased/service-account-roles.md b/changelog/unreleased/service-account-roles.md
new file mode 100644
index 00000000000..712e250ae62
--- /dev/null
+++ b/changelog/unreleased/service-account-roles.md
@@ -0,0 +1,6 @@
+Enhancement: Service Account roles
+
+Use a hidden role for service accounts. It will not appear in ListRoles calls but internally handled
+by settings service
+
+https://github.com/owncloud/ocis/pull/8051
diff --git a/go.mod b/go.mod
index 1ecc0ab348d..61f4f832bd1 100644
--- a/go.mod
+++ b/go.mod
@@ -13,7 +13,7 @@ require (
 	github.com/coreos/go-oidc v2.2.1+incompatible
 	github.com/coreos/go-oidc/v3 v3.9.0
 	github.com/cs3org/go-cs3apis v0.0.0-20231023073225-7748710e0781
-	github.com/cs3org/reva/v2 v2.17.1-0.20231220115644-93b4dd91a8b3
+	github.com/cs3org/reva/v2 v2.17.1-0.20231219093515-da04bc32d9fb
 	github.com/dhowden/tag v0.0.0-20230630033851-978a0926ee25
 	github.com/disintegration/imaging v1.6.2
 	github.com/dutchcoders/go-clamd v0.0.0-20170520113014-b970184f4d9e
@@ -67,7 +67,7 @@ require (
 	github.com/onsi/ginkgo v1.16.5
 	github.com/onsi/ginkgo/v2 v2.13.2
 	github.com/onsi/gomega v1.30.0
-	github.com/open-policy-agent/opa v0.60.0
+	github.com/open-policy-agent/opa v0.59.0
 	github.com/orcaman/concurrent-map v1.0.0
 	github.com/owncloud/libre-graph-api-go v1.0.5-0.20231201125350-a08244876423
 	github.com/pkg/errors v0.9.1
@@ -297,7 +297,7 @@ require (
 	github.com/russellhaering/goxmldsig v1.4.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/segmentio/ksuid v1.0.4 // indirect
-	github.com/sergi/go-diff v1.3.1 // indirect
+	github.com/sergi/go-diff v1.2.0 // indirect
 	github.com/sethvargo/go-password v0.2.0 // indirect
 	github.com/shurcooL/httpfs v0.0.0-20190707220628-8d4bc4ba7749 // indirect
 	github.com/shurcooL/vfsgen v0.0.0-20200824052919-0d455de96546 // indirect
diff --git a/go.sum b/go.sum
index c4b1442f09c..420e7a984b2 100644
--- a/go.sum
+++ b/go.sum
@@ -1021,8 +1021,8 @@ github.com/crewjam/saml v0.4.14 h1:g9FBNx62osKusnFzs3QTN5L9CVA/Egfgm+stJShzw/c=
 github.com/crewjam/saml v0.4.14/go.mod h1:UVSZCf18jJkk6GpWNVqcyQJMD5HsRugBPf4I1nl2mME=
 github.com/cs3org/go-cs3apis v0.0.0-20231023073225-7748710e0781 h1:BUdwkIlf8IS2FasrrPg8gGPHQPOrQ18MS1Oew2tmGtY=
 github.com/cs3org/go-cs3apis v0.0.0-20231023073225-7748710e0781/go.mod h1:UXha4TguuB52H14EMoSsCqDj7k8a/t7g4gVP+bgY5LY=
-github.com/cs3org/reva/v2 v2.17.1-0.20231220115644-93b4dd91a8b3 h1:9vKLWy7yK/I4MinF5AARDsM4lgaALgZoonEdAf972Pc=
-github.com/cs3org/reva/v2 v2.17.1-0.20231220115644-93b4dd91a8b3/go.mod h1:QW31Q1IQ9ZCJMFv3u8/SdHSyLfCcSVNcRbqIJj+Y+7o=
+github.com/cs3org/reva/v2 v2.17.1-0.20231219093515-da04bc32d9fb h1:YH5k1nDJ5tm4gqUykeniDl83Bva5EMH8D2uA++M+ziY=
+github.com/cs3org/reva/v2 v2.17.1-0.20231219093515-da04bc32d9fb/go.mod h1:QW31Q1IQ9ZCJMFv3u8/SdHSyLfCcSVNcRbqIJj+Y+7o=
 github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -1784,8 +1784,8 @@ github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7J
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
 github.com/onsi/gomega v1.30.0 h1:hvMK7xYz4D3HapigLTeGdId/NcfQx1VHMJc60ew99+8=
 github.com/onsi/gomega v1.30.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
-github.com/open-policy-agent/opa v0.60.0 h1:ZPoPt4yeNs5UXCpd/P/btpSyR8CR0wfhVoh9BOwgJNs=
-github.com/open-policy-agent/opa v0.60.0/go.mod h1:aD5IK6AiLNYBjNXn7E02++yC8l4Z+bRDvgM6Ss0bBzA=
+github.com/open-policy-agent/opa v0.59.0 h1:1WFU/KUhJAr3qatm0Lf8Ea5jp10ZmlE2M07oaLiHypg=
+github.com/open-policy-agent/opa v0.59.0/go.mod h1:rdJSkEc4oQ+0074/3Fsgno5bkPsYxTjU5aLNmMujIvI=
 github.com/opencontainers/runtime-spec v1.1.0-rc.1 h1:wHa9jroFfKGQqFHj0I1fMRKLl0pfj+ynAqBxo3v6u9w=
 github.com/opencontainers/runtime-spec v1.1.0-rc.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
@@ -1933,8 +1933,8 @@ github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg
 github.com/segmentio/ksuid v1.0.4 h1:sBo2BdShXjmcugAMwjugoGUdUV0pcxY5mW4xKRn3v4c=
 github.com/segmentio/ksuid v1.0.4/go.mod h1:/XUiZBD3kVx5SmUOl55voK5yeAbBNNIed+2O73XgrPE=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
-github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
+github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
+github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sethgrid/pester v1.2.0/go.mod h1:hEUINb4RqvDxtoCaU0BNT/HV4ig5kfgOasrf1xcvr0A=
 github.com/sethvargo/go-password v0.2.0 h1:BTDl4CC/gjf/axHMaDQtw507ogrXLci6XRiLc7i/UHI=
 github.com/sethvargo/go-password v0.2.0/go.mod h1:Ym4Mr9JXLBycr02MFuVQ/0JHidNetSgbzutTr3zsYXE=
diff --git a/services/graph/pkg/identity/backend.go b/services/graph/pkg/identity/backend.go
index 08afc0d4f7e..cc94141d3ab 100644
--- a/services/graph/pkg/identity/backend.go
+++ b/services/graph/pkg/identity/backend.go
@@ -37,7 +37,7 @@ type Backend interface {
 	// UpdateGroupName updates the group name
 	UpdateGroupName(ctx context.Context, groupID string, groupName string) error
 	GetGroup(ctx context.Context, nameOrID string, queryParam url.Values) (*libregraph.Group, error)
-	GetGroups(ctx context.Context, oreq *godata.GoDataRequest) ([]*libregraph.Group, error)
+	GetGroups(ctx context.Context, queryParam url.Values) ([]*libregraph.Group, error)
 	// GetGroupMembers list all members of a group
 	GetGroupMembers(ctx context.Context, id string, oreq *godata.GoDataRequest) ([]*libregraph.User, error)
 	// AddMembersToGroup adds new members (reference by a slice of IDs) to supplied group in the identity backend.
diff --git a/services/graph/pkg/identity/cs3.go b/services/graph/pkg/identity/cs3.go
index b704ae312b0..7a305c22fb6 100644
--- a/services/graph/pkg/identity/cs3.go
+++ b/services/graph/pkg/identity/cs3.go
@@ -112,7 +112,7 @@ func (i *CS3) GetUsers(ctx context.Context, oreq *godata.GoDataRequest) ([]*libr
 }
 
 // GetGroups implements the Backend Interface.
-func (i *CS3) GetGroups(ctx context.Context, oreq *godata.GoDataRequest) ([]*libregraph.Group, error) {
+func (i *CS3) GetGroups(ctx context.Context, queryParam url.Values) ([]*libregraph.Group, error) {
 	logger := i.Logger.SubloggerWithRequestID(ctx)
 	logger.Debug().Str("backend", "cs3").Msg("GetGroups")
 	gatewayClient, err := i.GatewaySelector.Next()
@@ -121,9 +121,9 @@ func (i *CS3) GetGroups(ctx context.Context, oreq *godata.GoDataRequest) ([]*lib
 		return nil, errorcode.New(errorcode.ServiceNotAvailable, err.Error())
 	}
 
-	search, err := GetSearchValues(oreq.Query)
-	if err != nil {
-		return nil, err
+	search := queryParam.Get("search")
+	if search == "" {
+		search = queryParam.Get("$search")
 	}
 
 	res, err := gatewayClient.FindGroups(ctx, &cs3group.FindGroupsRequest{
diff --git a/services/graph/pkg/identity/ldap_group.go b/services/graph/pkg/identity/ldap_group.go
index ed55ea00a51..c7c66f94c4a 100644
--- a/services/graph/pkg/identity/ldap_group.go
+++ b/services/graph/pkg/identity/ldap_group.go
@@ -55,26 +55,19 @@ func (i *LDAP) GetGroup(ctx context.Context, nameOrID string, queryParam url.Val
 }
 
 // GetGroups implements the Backend Interface for the LDAP Backend
-func (i *LDAP) GetGroups(ctx context.Context, oreq *godata.GoDataRequest) ([]*libregraph.Group, error) {
+func (i *LDAP) GetGroups(ctx context.Context, queryParam url.Values) ([]*libregraph.Group, error) {
 	logger := i.logger.SubloggerWithRequestID(ctx)
 	logger.Debug().Str("backend", "ldap").Msg("GetGroups")
 
-	search, err := GetSearchValues(oreq.Query)
-	if err != nil {
-		return nil, err
+	search := queryParam.Get("search")
+	if search == "" {
+		search = queryParam.Get("$search")
 	}
 
 	var expandMembers bool
-	exp, err := GetExpandValues(oreq.Query)
-	if err != nil {
-		return nil, err
-	}
-	sel, err := GetSelectValues(oreq.Query)
-	if err != nil {
-		return nil, err
-	}
-
-	if slices.Contains(exp, "members") || slices.Contains(sel, "members") {
+	sel := strings.Split(queryParam.Get("$select"), ",")
+	exp := strings.Split(queryParam.Get("$expand"), ",")
+	if slices.Contains(sel, "members") || slices.Contains(exp, "members") {
 		expandMembers = true
 	}
 
diff --git a/services/graph/pkg/identity/mocks/backend.go b/services/graph/pkg/identity/mocks/backend.go
index 8bb281f42e1..69e876002a8 100644
--- a/services/graph/pkg/identity/mocks/backend.go
+++ b/services/graph/pkg/identity/mocks/backend.go
@@ -165,25 +165,25 @@ func (_m *Backend) GetGroupMembers(ctx context.Context, id string, oreq *godata.
 	return r0, r1
 }
 
-// GetGroups provides a mock function with given fields: ctx, oreq
-func (_m *Backend) GetGroups(ctx context.Context, oreq *godata.GoDataRequest) ([]*libregraph.Group, error) {
-	ret := _m.Called(ctx, oreq)
+// GetGroups provides a mock function with given fields: ctx, queryParam
+func (_m *Backend) GetGroups(ctx context.Context, queryParam url.Values) ([]*libregraph.Group, error) {
+	ret := _m.Called(ctx, queryParam)
 
 	var r0 []*libregraph.Group
 	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, *godata.GoDataRequest) ([]*libregraph.Group, error)); ok {
-		return rf(ctx, oreq)
+	if rf, ok := ret.Get(0).(func(context.Context, url.Values) ([]*libregraph.Group, error)); ok {
+		return rf(ctx, queryParam)
 	}
-	if rf, ok := ret.Get(0).(func(context.Context, *godata.GoDataRequest) []*libregraph.Group); ok {
-		r0 = rf(ctx, oreq)
+	if rf, ok := ret.Get(0).(func(context.Context, url.Values) []*libregraph.Group); ok {
+		r0 = rf(ctx, queryParam)
 	} else {
 		if ret.Get(0) != nil {
 			r0 = ret.Get(0).([]*libregraph.Group)
 		}
 	}
 
-	if rf, ok := ret.Get(1).(func(context.Context, *godata.GoDataRequest) error); ok {
-		r1 = rf(ctx, oreq)
+	if rf, ok := ret.Get(1).(func(context.Context, url.Values) error); ok {
+		r1 = rf(ctx, queryParam)
 	} else {
 		r1 = ret.Error(1)
 	}
diff --git a/services/graph/pkg/identity/odata.go b/services/graph/pkg/identity/odata.go
index 698b84e69e8..ef102cd7eb4 100644
--- a/services/graph/pkg/identity/odata.go
+++ b/services/graph/pkg/identity/odata.go
@@ -29,23 +29,6 @@ func GetExpandValues(req *godata.GoDataQuery) ([]string, error) {
 	return expand, nil
 }
 
-// GetSelectValues extracts the values of the $select query parameter and
-// returns them in a []string, rejects any $select value that consists of more
-// than just a single path segment
-func GetSelectValues(req *godata.GoDataQuery) ([]string, error) {
-	if req == nil || req.Select == nil {
-		return []string{}, nil
-	}
-	sel := make([]string, 0, len(req.Select.SelectItems))
-	for _, item := range req.Select.SelectItems {
-		if len(item.Segments) > 1 {
-			return []string{}, godata.NotImplementedError("multiple segments in $select not supported")
-		}
-		sel = append(sel, item.Segments[0].Value)
-	}
-	return sel, nil
-}
-
 // GetSearchValues extracts the value of the $search query parameter and returns
 // it as a string. Rejects any search query that is more than just a simple string
 func GetSearchValues(req *godata.GoDataQuery) (string, error) {
diff --git a/services/graph/pkg/service/v0/groups.go b/services/graph/pkg/service/v0/groups.go
index 8f6f707a55e..f80924025ac 100644
--- a/services/graph/pkg/service/v0/groups.go
+++ b/services/graph/pkg/service/v0/groups.go
@@ -32,17 +32,7 @@ func (g Graph) GetGroups(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	ctxHasFullPerms := g.contextUserHasFullAccountPerms(r.Context())
-	searchHasAcceptableLength := false
-	if odataReq.Query != nil && odataReq.Query.Search != nil {
-		minSearchLength := g.config.API.IdentitySearchMinLength
-		if strings.HasPrefix(odataReq.Query.Search.RawValue, "\"") {
-			// if search starts with double quotes then it must finish with double quotes
-			// add +2 to the minimum search length in this case
-			minSearchLength += 2
-		}
-		searchHasAcceptableLength = len(odataReq.Query.Search.RawValue) >= minSearchLength
-	}
-	if !ctxHasFullPerms && !searchHasAcceptableLength {
+	if !ctxHasFullPerms && (odataReq.Query == nil || odataReq.Query.Search == nil || len(odataReq.Query.Search.RawValue) < g.config.API.IdentitySearchMinLength) {
 		// for regular user the search term must have a minimum length
 		logger.Debug().Interface("query", r.URL.Query()).Msgf("search with less than %d chars for a regular user", g.config.API.IdentitySearchMinLength)
 		errorcode.AccessDenied.Render(w, r, http.StatusForbidden, "search term too short")
@@ -56,7 +46,7 @@ func (g Graph) GetGroups(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	groups, err := g.identityBackend.GetGroups(r.Context(), odataReq)
+	groups, err := g.identityBackend.GetGroups(r.Context(), r.URL.Query())
 	if err != nil {
 		logger.Debug().Err(err).Msg("could not get groups: backend error")
 		errorcode.RenderError(w, r, err)
diff --git a/services/graph/pkg/service/v0/users.go b/services/graph/pkg/service/v0/users.go
index 6902af8dda1..eec46b13d75 100644
--- a/services/graph/pkg/service/v0/users.go
+++ b/services/graph/pkg/service/v0/users.go
@@ -223,9 +223,9 @@ func (g Graph) GetUsers(w http.ResponseWriter, r *http.Request) {
 	}
 
 	ctxHasFullPerms := g.contextUserHasFullAccountPerms(r.Context())
+	minSearchLength := g.config.API.IdentitySearchMinLength
 	searchHasAcceptableLength := false
 	if odataReq.Query != nil && odataReq.Query.Search != nil {
-		minSearchLength := g.config.API.IdentitySearchMinLength
 		if strings.HasPrefix(odataReq.Query.Search.RawValue, "\"") {
 			// if search starts with double quotes then it must finish with double quotes
 			// add +2 to the minimum search length in this case
diff --git a/services/proxy/README.md b/services/proxy/README.md
index 0fb83d9ae08..d440057aa71 100644
--- a/services/proxy/README.md
+++ b/services/proxy/README.md
@@ -160,35 +160,3 @@ When using the ocis IDP service instead of an external IDP:
 -   Use the environment variable `OCIS_URL` to define how ocis can be accessed, mandatory use `https` as protocol for the URL.
 -   If no reverse proxy is set up, the `PROXY_TLS` environment variable **must** be set to `true` because the embedded `libreConnect` shipped with the IDP service has a hard check if the connection is on TLS and uses the HTTPS protocol. If this mismatches, an error will be logged and no connection from the client can be established.
 -   `PROXY_TLS` **can** be set to `false` if a reverse proxy is used and the https connection is terminated at the reverse proxy. When setting to `false`, the communication between the reverse proxy and ocis is not secured. If set to `true`, you must provide certificates.
-
-## Metrics
-
-The proxy service in ocis has the ability to expose metrics in the prometheus format. The metrics are exposed on the `/metrics` endpoint. There are two ways to run the ocis proxy service which has an impact on the number of metrics exposed.
-
-### 1) Single Process Mode
-In the single process mode, all ocis services are running inside a single process. This is the default mode when using the `ocis server` command to start the services. In this mode, the proxy service exposes metrics about the proxy service itself and about the ocis services it is proxying. This is due to the nature of the prometheus registry which is a singleton. The metrics exposed by the proxy service itself are prefixed with `ocis_proxy_` and the metrics exposed by other ocis services are prefixed with `ocis_<service-name>_`.
-
-### 2) Standalone Mode
-In this mode, the proxy service only exposes its own metrics. The metrics of the other ocis services are exposed on their own metrics endpoints.
-
-### Available Metrics
-The following metrics are exposed by the proxy service:
-
-| Metric Name                      | Description                                                                                                                                                                                                                   | Labels                                |
-|----------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------|
-| `ocis_proxy_requests_total`      | [Counter](https://prometheus.io/docs/tutorials/understanding_metric_types/#counter) metric which reports the total number of HTTP requests.                                                                                   | `method`: HTTP method of the request  |
-| `ocis_proxy_errors_total`        | [Counter](https://prometheus.io/docs/tutorials/understanding_metric_types/#counter) metric which reports the total number of HTTP requests which have failed. That counts all response codes >= 500                           | `method`: HTTP method of the request  |
-| `ocis_proxy_duration_seconds`    | [Histogram](https://prometheus.io/docs/tutorials/understanding_metric_types/#histogram) of the time (in seconds) each request took. A histogram metric uses buckets to count the number of events that fall into each bucket. | `method`: HTTP method of the request  |
-| `ocis_proxy_build_info{version}` | A metric with a constant `1` value labeled by version, exposing the version of the ocis proxy service.                                                                                                                        | `version`: Build version of the proxy |
-
-### Prometheus Configuration
-The following is an example prometheus configuration for the single process mode. It assumes that the proxy service is configured to bind on all interfaces `PROXY_HTTP_ADDR=0.0.0.0:9205` and that the proxy is available via the `ocis` service name (typically in docker-compose). The prometheus service detects the `/metrics` endpoint automatically and scrapes it every 15 seconds.
-
-```yaml
-global:
-  scrape_interval: 15s
-scrape_configs:
-  - job_name: ocis_proxy
-    static_configs:
-    - targets: ["ocis:9205"]
-```
diff --git a/services/proxy/pkg/command/server.go b/services/proxy/pkg/command/server.go
index e917f0ef5d8..fc8d9225d01 100644
--- a/services/proxy/pkg/command/server.go
+++ b/services/proxy/pkg/command/server.go
@@ -130,7 +130,7 @@ func Server(cfg *config.Config) *cli.Command {
 			}
 
 			{
-				middlewares := loadMiddlewares(ctx, logger, cfg, userInfoCache, traceProvider, *m)
+				middlewares := loadMiddlewares(ctx, logger, cfg, userInfoCache, traceProvider)
 				server, err := proxyHTTP.Server(
 					proxyHTTP.Handler(lh.handler()),
 					proxyHTTP.Logger(logger),
@@ -271,7 +271,7 @@ func (h *StaticRouteHandler) backchannelLogout(w http.ResponseWriter, r *http.Re
 	render.JSON(w, r, nil)
 }
 
-func loadMiddlewares(ctx context.Context, logger log.Logger, cfg *config.Config, userInfoCache microstore.Store, traceProvider trace.TracerProvider, metrics metrics.Metrics) alice.Chain {
+func loadMiddlewares(ctx context.Context, logger log.Logger, cfg *config.Config, userInfoCache microstore.Store, traceProvider trace.TracerProvider) alice.Chain {
 	rolesClient := settingssvc.NewRoleService("com.owncloud.api.settings", cfg.GrpcClient)
 	policiesProviderClient := policiessvc.NewPoliciesProviderService("com.owncloud.api.policies", cfg.GrpcClient)
 	gatewaySelector, err := pool.GatewaySelector(
@@ -386,7 +386,6 @@ func loadMiddlewares(ctx context.Context, logger log.Logger, cfg *config.Config,
 		),
 		middleware.Tracer(traceProvider),
 		pkgmiddleware.TraceContext,
-		middleware.Instrumenter(metrics),
 		chimiddleware.RealIP,
 		chimiddleware.RequestID,
 		middleware.AccessLog(logger),
diff --git a/services/proxy/pkg/metrics/metrics.go b/services/proxy/pkg/metrics/metrics.go
index fe56a9ef778..a14e9492523 100644
--- a/services/proxy/pkg/metrics/metrics.go
+++ b/services/proxy/pkg/metrics/metrics.go
@@ -14,8 +14,8 @@ var (
 
 // Metrics defines the available metrics of this service.
 type Metrics struct {
-	Requests  *prometheus.CounterVec
-	Errors    *prometheus.CounterVec
+	Counter   *prometheus.CounterVec
+	Latency   *prometheus.SummaryVec
 	Duration  *prometheus.HistogramVec
 	BuildInfo *prometheus.GaugeVec
 }
@@ -23,24 +23,24 @@ type Metrics struct {
 // New initializes the available metrics.
 func New() *Metrics {
 	m := &Metrics{
-		Requests: prometheus.NewCounterVec(prometheus.CounterOpts{
+		Counter: prometheus.NewCounterVec(prometheus.CounterOpts{
 			Namespace: Namespace,
 			Subsystem: Subsystem,
-			Name:      "requests_total",
-			Help:      "How many requests processed in total",
-		}, []string{"method"}),
-		Errors: prometheus.NewCounterVec(prometheus.CounterOpts{
+			Name:      "proxy_total",
+			Help:      "How many proxy requests processed",
+		}, []string{}),
+		Latency: prometheus.NewSummaryVec(prometheus.SummaryOpts{
 			Namespace: Namespace,
 			Subsystem: Subsystem,
-			Name:      "errors_total",
-			Help:      "How many requests run into errors",
-		}, []string{"method"}),
+			Name:      "proxy_latency_microseconds",
+			Help:      "proxy request latencies in microseconds",
+		}, []string{}),
 		Duration: prometheus.NewHistogramVec(prometheus.HistogramOpts{
 			Namespace: Namespace,
 			Subsystem: Subsystem,
-			Name:      "duration_seconds",
-			Help:      "request duration in seconds",
-		}, []string{"method"}),
+			Name:      "proxy_duration_seconds",
+			Help:      "proxy method request time in seconds",
+		}, []string{}),
 		BuildInfo: prometheus.NewGaugeVec(prometheus.GaugeOpts{
 			Namespace: Namespace,
 			Subsystem: Subsystem,
@@ -49,8 +49,8 @@ func New() *Metrics {
 		}, []string{"versions"}),
 	}
 
-	_ = prometheus.Register(m.Requests)
-	_ = prometheus.Register(m.Errors)
+	_ = prometheus.Register(m.Counter)
+	_ = prometheus.Register(m.Latency)
 	_ = prometheus.Register(m.Duration)
 	_ = prometheus.Register(m.BuildInfo)
 	return m
diff --git a/services/proxy/pkg/middleware/metrics.go b/services/proxy/pkg/middleware/metrics.go
deleted file mode 100644
index 186a180a0cf..00000000000
--- a/services/proxy/pkg/middleware/metrics.go
+++ /dev/null
@@ -1,28 +0,0 @@
-package middleware
-
-import (
-	"net/http"
-	"time"
-
-	"github.com/go-chi/chi/v5/middleware"
-	"github.com/owncloud/ocis/v2/services/proxy/pkg/metrics"
-	"github.com/prometheus/client_golang/prometheus"
-)
-
-// Instrumenter provides a middleware to create metrics
-func Instrumenter(m metrics.Metrics) func(next http.Handler) http.Handler {
-	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			start := time.Now()
-			ww := middleware.NewWrapResponseWriter(w, r.ProtoMajor)
-			m.Requests.With(prometheus.Labels{"method": r.Method}).Inc()
-
-			next.ServeHTTP(ww, r)
-
-			m.Duration.With(prometheus.Labels{"method": r.Method}).Observe(float64(time.Since(start).Seconds()))
-			if ww.Status() >= 500 {
-				m.Errors.With(prometheus.Labels{"method": r.Method}).Inc()
-			}
-		})
-	}
-}
diff --git a/services/settings/README.md b/services/settings/README.md
index 38cc7eaacdc..69432c8de83 100644
--- a/services/settings/README.md
+++ b/services/settings/README.md
@@ -15,10 +15,9 @@ As an example, user profile settings that can be changed in the Web UI must be p
 The settings service supports two different backends for persisting the data. The backend can be set via the `SETTINGS_STORE_TYPE` environment variable. Supported values are:
 
 *   `metadata`: The default. This backend persists the settings data via the `storage-system` service.
-*   `filesystem`: This backend persists the settings data in a directory on the local filesystem.
+*   `filesystem`: (deprecated) This backend persists the settings data in a directory on the local filesystem.
   The directory can be configured with `SETTINGS_DATA_PATH`. This backend is **not** suitable for running
-  multiple intances of the `settings` service in a scale-out deployment and should be therefore considered
-  deprecated.
+  multiple intances of the `settings` service in a scale-out deployment and was therefore deprecated.
 
 <!--- Note: The diagramm is outdate, leaving it here for a future rework
 The diagram shows how the settings service integrates into oCIS:
@@ -72,7 +71,7 @@ Services can set or query Infinite Scale *setting values* of a user from setting
 
 ## Service Accounts
 
-The settings service needs to know the ID's of service accounts but it doesn't need their secrets. Currently only one service account can be configured which has the admin role. This can be set with the `SETTINGS_SERVICE_ACCOUNT_ID_ADMIN` envvar, but it will also pick up the global `OCIS_SERVICE_ACCOUNT_ID` environment variable. Also see the 'auth-service' service description for additional details.
+The settings service needs to know the IDs of service accounts but it doesn't need their secrets. They can be configured using the `SETTINGS_SERVICE_ACCOUNTS_IDS` envvar. When only using one service account `OCIS_SERVICE_ACCOUNT_ID` can also be used. All configured service accounts will get a hidden 'service-account' role. This role contains all permissions the service account needs but will not appear calls to the list roles endpoint. It is not possible to assign the 'service-account' role to a normal user.
 
 ## Default Language
 
diff --git a/services/settings/pkg/config/config.go b/services/settings/pkg/config/config.go
index dfdefe956ac..5aaaeb76dde 100644
--- a/services/settings/pkg/config/config.go
+++ b/services/settings/pkg/config/config.go
@@ -37,7 +37,7 @@ type Config struct {
 
 	SetupDefaultAssignments bool `yaml:"set_default_assignments" env:"SETTINGS_SETUP_DEFAULT_ASSIGNMENTS;IDM_CREATE_DEMO_USERS" desc:"The default role assignments the demo users should be setup."`
 
-	ServiceAccountIDAdmin string `yaml:"service_account_id_admin" env:"OCIS_SERVICE_ACCOUNT_ID;SETTINGS_SERVICE_ACCOUNT_ID_ADMIN" desc:"The ID of the service account having the admin role. See the 'auth-service' service description for more details."`
+	ServiceAccountIDs []string `yaml:"service_account_ids" env:"SETTINGS_SERVICE_ACCOUNT_IDS;OCIS_SERVICE_ACCOUNT_ID" desc:"The list of all service account IDs. These will be assigned the hidden 'service-account' role. Note: When using 'OCIS_SERVICE_ACCOUNT_ID' this will contain only one value while 'SETTINGS_SERVICE_ACCOUNT_IDS' can have multiple. See the 'auth-service' service description for more details about service accounts."`
 
 	DefaultLanguage string `yaml:"default_language" env:"OCIS_DEFAULT_LANGUAGE" desc:"The default language used by services and the WebUI. If not defined, English will be used as default. See the documentation for more details."`
 
diff --git a/services/settings/pkg/config/defaults/defaultconfig.go b/services/settings/pkg/config/defaults/defaultconfig.go
index 47df608f7e2..cc6e8c83e84 100644
--- a/services/settings/pkg/config/defaults/defaultconfig.go
+++ b/services/settings/pkg/config/defaults/defaultconfig.go
@@ -65,9 +65,9 @@ func DefaultConfig() *config.Config {
 				TTL:            time.Minute * 10,
 			},
 		},
-		BundlesPath:           "",
-		Bundles:               nil,
-		ServiceAccountIDAdmin: "service-user-id",
+		BundlesPath:       "",
+		Bundles:           nil,
+		ServiceAccountIDs: []string{"service-user-id"},
 	}
 }
 
diff --git a/services/settings/pkg/service/v0/service.go b/services/settings/pkg/service/v0/service.go
index 9513be9d6e8..685e6c96be4 100644
--- a/services/settings/pkg/service/v0/service.go
+++ b/services/settings/pkg/service/v0/service.go
@@ -46,6 +46,7 @@ func NewService(cfg *config.Config, logger log.Logger) settings.ServiceHandler {
 	case "metadata":
 		service.manager = metastore.New(cfg)
 	case "filesystem":
+		fmt.Println("WARNING: filesystem store is deprecated and will be removed in the future. Please use metadata store instead.")
 		service.manager = filestore.New(cfg)
 		// TODO: if we want to further support filesystem store it should use default permissions from store/defaults/defaults.go instead using this duplicate
 		service.RegisterDefaultRoles()
diff --git a/services/settings/pkg/store/defaults/defaults.go b/services/settings/pkg/store/defaults/defaults.go
index 9428d3f7c79..e891e88ff73 100644
--- a/services/settings/pkg/store/defaults/defaults.go
+++ b/services/settings/pkg/store/defaults/defaults.go
@@ -14,8 +14,10 @@ const (
 	BundleUUIDRoleUser = "d7beeea8-8ff4-406b-8fb6-ab2dd81e6b11"
 	// BundleUUIDRoleUserLight represents the user light role.
 	BundleUUIDRoleUserLight = "38071a68-456a-4553-846a-fa67bf5596cc"
-	// BundleUUIDProfile represents the user profile
+	// BundleUUIDProfile represents the user profile.
 	BundleUUIDProfile = "2a506de7-99bd-4f0d-994e-c38e72c28fd9"
+	// BundleUUIDServiceAccount represents the service account role.
+	BundleUUIDServiceAccount = "bcceed81-c610-49cc-ab77-39a024e8da12"
 	// SettingUUIDProfileLanguage is the hardcoded setting UUID for the user profile language
 	SettingUUIDProfileLanguage = "aa8cfbe5-95d4-4f7e-a032-c3c01f5f062f"
 	// SettingUUIDProfileDisableNotifications is the hardcoded setting UUID for the disable notifications setting
@@ -35,6 +37,42 @@ func GenerateBundlesDefaultRoles() []*settingsmsg.Bundle {
 	}
 }
 
+// ServiceAccountBundle returns the service account bundle
+func ServiceAccountBundle() *settingsmsg.Bundle {
+	return &settingsmsg.Bundle{
+		Id:          BundleUUIDServiceAccount,
+		Name:        "service-account",
+		Type:        settingsmsg.Bundle_TYPE_ROLE,
+		Extension:   "ocis-roles",
+		DisplayName: "Service Account",
+		Resource: &settingsmsg.Resource{
+			Type: settingsmsg.Resource_TYPE_SYSTEM,
+		},
+		Settings: []*settingsmsg.Setting{
+			AccountManagementPermission(All),
+			ChangeLogoPermission(All),
+			CreatePublicLinkPermission(All),
+			CreateSharePermission(All),
+			CreateSpacesPermission(All),
+			DeletePersonalSpacesPermission(All),
+			DeleteProjectSpacesPermission(All),
+			DeleteReadOnlyPublicLinkPasswordPermission(All),
+			GroupManagementPermission(All),
+			LanguageManagementPermission(All),
+			ListFavoritesPermission(All),
+			ListSpacesPermission(All),
+			ManageSpacePropertiesPermission(All),
+			RoleManagementPermission(All),
+			SetPersonalSpaceQuotaPermission(All),
+			SetProjectSpaceQuotaPermission(All),
+			SettingsManagementPermission(All),
+			SpaceAbilityPermission(All),
+			WriteFavoritesPermission(All),
+			// TODO: add more permissions? remove some?
+		},
+	}
+}
+
 func generateBundleAdminRole() *settingsmsg.Bundle {
 	return &settingsmsg.Bundle{
 		Id:          BundleUUIDRoleAdmin,
@@ -353,12 +391,5 @@ func DefaultRoleAssignments(cfg *config.Config) []*settingsmsg.UserRoleAssignmen
 		})
 	}
 
-	if cfg.ServiceAccountIDAdmin != "" {
-		assignments = append(assignments, &settingsmsg.UserRoleAssignment{
-			AccountUuid: cfg.ServiceAccountIDAdmin,
-			RoleId:      BundleUUIDRoleAdmin,
-		})
-	}
-
 	return assignments
 }
diff --git a/services/settings/pkg/store/metadata/assignments.go b/services/settings/pkg/store/metadata/assignments.go
index 003b248cf33..45b1601c991 100644
--- a/services/settings/pkg/store/metadata/assignments.go
+++ b/services/settings/pkg/store/metadata/assignments.go
@@ -10,10 +10,23 @@ import (
 	"github.com/gofrs/uuid"
 	settingsmsg "github.com/owncloud/ocis/v2/protogen/gen/ocis/messages/settings/v0"
 	"github.com/owncloud/ocis/v2/services/settings/pkg/settings"
+	"github.com/owncloud/ocis/v2/services/settings/pkg/store/defaults"
 )
 
 // ListRoleAssignments loads and returns all role assignments matching the given assignment identifier.
 func (s *Store) ListRoleAssignments(accountUUID string) ([]*settingsmsg.UserRoleAssignment, error) {
+	// shortcut for service accounts
+	for _, serviceAccountID := range s.cfg.ServiceAccountIDs {
+		if accountUUID == serviceAccountID {
+			return []*settingsmsg.UserRoleAssignment{
+				{
+					Id:          uuid.Must(uuid.NewV4()).String(), // should we hardcode this id too?
+					AccountUuid: accountUUID,
+					RoleId:      defaults.BundleUUIDServiceAccount,
+				},
+			}, nil
+		}
+	}
 	s.Init()
 	ctx := context.TODO()
 	assIDs, err := s.mdc.ReadDir(ctx, accountPath(accountUUID))
diff --git a/services/settings/pkg/store/metadata/bundles.go b/services/settings/pkg/store/metadata/bundles.go
index 9025c97893c..7e36572930a 100644
--- a/services/settings/pkg/store/metadata/bundles.go
+++ b/services/settings/pkg/store/metadata/bundles.go
@@ -11,6 +11,7 @@ import (
 	"github.com/gofrs/uuid"
 	settingsmsg "github.com/owncloud/ocis/v2/protogen/gen/ocis/messages/settings/v0"
 	"github.com/owncloud/ocis/v2/services/settings/pkg/settings"
+	"github.com/owncloud/ocis/v2/services/settings/pkg/store/defaults"
 )
 
 // ListBundles returns all bundles in the dataPath folder that match the given type.
@@ -59,6 +60,11 @@ func (s *Store) ListBundles(bundleType settingsmsg.Bundle_Type, bundleIDs []stri
 
 // ReadBundle tries to find a bundle by the given id from the metadata service
 func (s *Store) ReadBundle(bundleID string) (*settingsmsg.Bundle, error) {
+	// shortcut for service accounts
+	if bundleID == defaults.BundleUUIDServiceAccount {
+		return defaults.ServiceAccountBundle(), nil
+	}
+
 	s.Init()
 	ctx := context.TODO()
 	b, err := s.mdc.SimpleDownload(ctx, bundlePath(bundleID))
diff --git a/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocdav/tus.go b/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocdav/tus.go
index d3592f1ab74..6fbbbb6e43d 100644
--- a/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocdav/tus.go
+++ b/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocdav/tus.go
@@ -175,13 +175,7 @@ func (s *svc) handleTusPost(ctx context.Context, w http.ResponseWriter, r *http.
 			w.WriteHeader(http.StatusInternalServerError)
 			return
 		}
-		switch tfRes.Status.Code {
-		case rpc.Code_CODE_OK:
-			w.WriteHeader(http.StatusCreated)
-			return
-		case rpc.Code_CODE_ALREADY_EXISTS:
-			// Fall through to the tus case
-		default:
+		if tfRes.Status.Code != rpc.Code_CODE_OK {
 			log.Error().Interface("status", tfRes.Status).Msg("error touching file")
 			w.WriteHeader(http.StatusInternalServerError)
 			return
diff --git a/vendor/github.com/cs3org/reva/v2/pkg/rgrpc/rgrpc.go b/vendor/github.com/cs3org/reva/v2/pkg/rgrpc/rgrpc.go
index 4168c4f0646..381c468c2d6 100644
--- a/vendor/github.com/cs3org/reva/v2/pkg/rgrpc/rgrpc.go
+++ b/vendor/github.com/cs3org/reva/v2/pkg/rgrpc/rgrpc.go
@@ -325,24 +325,25 @@ func (s *Server) getInterceptors(unprotected []string) ([]grpc.ServerOption, err
 		return nil, errors.Wrap(err, "rgrpc: error creating unary auth interceptor")
 	}
 
-	unaryInterceptors := []grpc.UnaryServerInterceptor{
+	unaryInterceptors := []grpc.UnaryServerInterceptor{authUnary}
+	for _, t := range unaryTriples {
+		unaryInterceptors = append(unaryInterceptors, t.Interceptor)
+		s.log.Info().Msgf("rgrpc: chaining grpc unary interceptor %s with priority %d", t.Name, t.Priority)
+	}
+
+	unaryInterceptors = append(unaryInterceptors,
 		otelgrpc.UnaryServerInterceptor(
 			otelgrpc.WithTracerProvider(s.tracerProvider),
-			otelgrpc.WithPropagators(rtrace.Propagator),
-		),
+			otelgrpc.WithPropagators(rtrace.Propagator)),
+	)
+
+	unaryInterceptors = append([]grpc.UnaryServerInterceptor{
 		appctx.NewUnary(s.log, s.tracerProvider),
 		token.NewUnary(),
 		useragent.NewUnary(),
 		log.NewUnary(),
 		recovery.NewUnary(),
-		authUnary,
-	}
-
-	for _, t := range unaryTriples {
-		unaryInterceptors = append(unaryInterceptors, t.Interceptor)
-		s.log.Info().Msgf("rgrpc: chaining grpc unary interceptor %s with priority %d", t.Name, t.Priority)
-	}
-
+	}, unaryInterceptors...)
 	unaryChain := grpc_middleware.ChainUnaryServer(unaryInterceptors...)
 
 	streamTriples := []*streamInterceptorTriple{}
@@ -371,23 +372,20 @@ func (s *Server) getInterceptors(unprotected []string) ([]grpc.ServerOption, err
 		return nil, errors.Wrap(err, "rgrpc: error creating stream auth interceptor")
 	}
 
-	streamInterceptors := []grpc.StreamServerInterceptor{
-		otelgrpc.StreamServerInterceptor(
-			otelgrpc.WithTracerProvider(s.tracerProvider),
-			otelgrpc.WithPropagators(rtrace.Propagator),
-		),
+	streamInterceptors := []grpc.StreamServerInterceptor{authStream}
+	for _, t := range streamTriples {
+		streamInterceptors = append(streamInterceptors, t.Interceptor)
+		s.log.Info().Msgf("rgrpc: chaining grpc streaming interceptor %s with priority %d", t.Name, t.Priority)
+	}
+
+	streamInterceptors = append([]grpc.StreamServerInterceptor{
+		authStream,
 		appctx.NewStream(s.log, s.tracerProvider),
 		token.NewStream(),
 		useragent.NewStream(),
 		log.NewStream(),
 		recovery.NewStream(),
-		authStream,
-	}
-
-	for _, t := range streamTriples {
-		streamInterceptors = append(streamInterceptors, t.Interceptor)
-		s.log.Info().Msgf("rgrpc: chaining grpc streaming interceptor %s with priority %d", t.Name, t.Priority)
-	}
+	}, streamInterceptors...)
 	streamChain := grpc_middleware.ChainStreamServer(streamInterceptors...)
 
 	opts := []grpc.ServerOption{
diff --git a/vendor/github.com/open-policy-agent/opa/ast/check.go b/vendor/github.com/open-policy-agent/opa/ast/check.go
index 3723b33cc0a..90ed2747a0e 100644
--- a/vendor/github.com/open-policy-agent/opa/ast/check.go
+++ b/vendor/github.com/open-policy-agent/opa/ast/check.go
@@ -24,15 +24,14 @@ type exprChecker func(*TypeEnv, *Expr) *Error
 // accumulated on the typeChecker so that a single run can report multiple
 // issues.
 type typeChecker struct {
-	builtins            map[string]*Builtin
-	required            *Capabilities
-	errs                Errors
-	exprCheckers        map[string]exprChecker
-	varRewriter         varRewriter
-	ss                  *SchemaSet
-	allowNet            []string
-	input               types.Type
-	allowUndefinedFuncs bool
+	builtins     map[string]*Builtin
+	required     *Capabilities
+	errs         Errors
+	exprCheckers map[string]exprChecker
+	varRewriter  varRewriter
+	ss           *SchemaSet
+	allowNet     []string
+	input        types.Type
 }
 
 // newTypeChecker returns a new typeChecker object that has no errors.
@@ -93,11 +92,6 @@ func (tc *typeChecker) WithInputType(tpe types.Type) *typeChecker {
 	return tc
 }
 
-func (tc *typeChecker) WithAllowUndefinedFunctionCalls(allow bool) *typeChecker {
-	tc.allowUndefinedFuncs = allow
-	return tc
-}
-
 // Env returns a type environment for the specified built-ins with any other
 // global types configured on the checker. In practice, this is the default
 // environment that other statements will be checked against.
@@ -353,9 +347,6 @@ func (tc *typeChecker) checkExprBuiltin(env *TypeEnv, expr *Expr) *Error {
 	tpe := env.Get(name)
 
 	if tpe == nil {
-		if tc.allowUndefinedFuncs {
-			return nil
-		}
 		return NewError(TypeErr, expr.Location, "undefined function %v", name)
 	}
 
diff --git a/vendor/github.com/open-policy-agent/opa/ast/compile.go b/vendor/github.com/open-policy-agent/opa/ast/compile.go
index d558d4d3f03..67c8ef38469 100644
--- a/vendor/github.com/open-policy-agent/opa/ast/compile.go
+++ b/vendor/github.com/open-policy-agent/opa/ast/compile.go
@@ -146,7 +146,6 @@ type Compiler struct {
 	keepModules             bool                          // whether to keep the unprocessed, parse modules (below)
 	parsedModules           map[string]*Module            // parsed, but otherwise unprocessed modules, kept track of when keepModules is true
 	useTypeCheckAnnotations bool                          // whether to provide annotated information (schemas) to the type checker
-	allowUndefinedFuncCalls bool                          // don't error on calls to unknown functions.
 	evalMode                CompilerEvalMode
 }
 
@@ -458,11 +457,6 @@ func (c *Compiler) WithUseTypeCheckAnnotations(enabled bool) *Compiler {
 	return c
 }
 
-func (c *Compiler) WithAllowUndefinedFunctionCalls(allow bool) *Compiler {
-	c.allowUndefinedFuncCalls = allow
-	return c
-}
-
 // WithEvalMode allows setting the CompilerEvalMode of the compiler
 func (c *Compiler) WithEvalMode(e CompilerEvalMode) *Compiler {
 	c.evalMode = e
@@ -1519,8 +1513,7 @@ func (c *Compiler) checkTypes() {
 		WithInputType(c.inputType).
 		WithBuiltins(c.builtins).
 		WithRequiredCapabilities(c.Required).
-		WithVarRewriter(rewriteVarsInRef(c.RewrittenVars)).
-		WithAllowUndefinedFunctionCalls(c.allowUndefinedFuncCalls)
+		WithVarRewriter(rewriteVarsInRef(c.RewrittenVars))
 	var as *AnnotationSet
 	if c.useTypeCheckAnnotations {
 		as = c.annotationSet
@@ -1544,7 +1537,7 @@ func (c *Compiler) checkUnsafeBuiltins() {
 func (c *Compiler) checkDeprecatedBuiltins() {
 	for _, name := range c.sorted {
 		mod := c.Modules[name]
-		if c.strict || mod.regoV1Compatible() {
+		if c.strict || mod.regoV1Compatible {
 			errs := checkDeprecatedBuiltins(c.deprecatedBuiltinsMap, mod)
 			for _, err := range errs {
 				c.err(err)
@@ -1584,11 +1577,6 @@ func (c *Compiler) compile() {
 				continue // skip these stages
 			}
 		}
-
-		if c.allowUndefinedFuncCalls && s.name == "CheckUndefinedFuncs" {
-			continue
-		}
-
 		c.runStage(s.metricName, s.f)
 		if c.Failed() {
 			return
@@ -1695,7 +1683,7 @@ func (c *Compiler) checkDuplicateImports() {
 
 	for _, name := range c.sorted {
 		mod := c.Modules[name]
-		if c.strict || mod.regoV1Compatible() {
+		if c.strict || mod.regoV1Compatible {
 			modules = append(modules, mod)
 		}
 	}
@@ -1709,7 +1697,7 @@ func (c *Compiler) checkDuplicateImports() {
 func (c *Compiler) checkKeywordOverrides() {
 	for _, name := range c.sorted {
 		mod := c.Modules[name]
-		if c.strict || mod.regoV1Compatible() {
+		if c.strict || mod.regoV1Compatible {
 			errs := checkRootDocumentOverrides(mod)
 			for _, err := range errs {
 				c.err(err)
diff --git a/vendor/github.com/open-policy-agent/opa/ast/parser.go b/vendor/github.com/open-policy-agent/opa/ast/parser.go
index 25b1a4f1a86..a2a30889521 100644
--- a/vendor/github.com/open-policy-agent/opa/ast/parser.go
+++ b/vendor/github.com/open-policy-agent/opa/ast/parser.go
@@ -27,22 +27,6 @@ import (
 
 var RegoV1CompatibleRef = Ref{VarTerm("rego"), StringTerm("v1")}
 
-// RegoVersion defines the Rego syntax requirements for a module.
-type RegoVersion int
-
-const (
-	// RegoV0 is the default, original Rego syntax.
-	RegoV0 RegoVersion = iota
-	// RegoV0CompatV1 requires modules to comply with both the RegoV0 and RegoV1 syntax (as when 'rego.v1' is imported in a module).
-	// Shortly, RegoV1 compatibility is required, but 'rego.v1' or 'future.keywords' must also be imported.
-	RegoV0CompatV1
-	// RegoV1 is the Rego syntax enforced by OPA 1.0; e.g.:
-	// future.keywords part of default keyword set, and don't require imports;
-	// 'if' and 'contains' required in rule heads;
-	// (some) strict checks on by default.
-	RegoV1
-)
-
 // Note: This state is kept isolated from the parser so that we
 // can do efficient shallow copies of these values when doing a
 // save() and restore().
@@ -115,27 +99,14 @@ func (e *parsedTermCacheItem) String() string {
 
 // ParserOptions defines the options for parsing Rego statements.
 type ParserOptions struct {
-	Capabilities      *Capabilities
-	ProcessAnnotation bool
-	AllFutureKeywords bool
-	FutureKeywords    []string
-	SkipRules         bool
-	JSONOptions       *astJSON.Options
-	// RegoVersion is the version of Rego to parse for.
-	// RegoV1Compatible additionally affects the Rego version. Use EffectiveRegoVersion to get the effective Rego version.
-	RegoVersion RegoVersion
-	// RegoV1Compatible is equivalent to setting RegoVersion to RegoV0CompatV1.
-	// RegoV1Compatible takes precedence, and if set to true, RegoVersion is ignored.
-	// Deprecated: use RegoVersion instead. Will be removed in a future version of OPA.
-	RegoV1Compatible   bool
+	Capabilities       *Capabilities
+	ProcessAnnotation  bool
+	AllFutureKeywords  bool
+	FutureKeywords     []string
+	SkipRules          bool
+	JSONOptions        *astJSON.Options
 	unreleasedKeywords bool // TODO(sr): cleanup
-}
-
-func (po *ParserOptions) EffectiveRegoVersion() RegoVersion {
-	if po.RegoV1Compatible {
-		return RegoV0CompatV1
-	}
-	return po.RegoVersion
+	RegoV1Compatible   bool
 }
 
 // NewParser creates and initializes a Parser.
@@ -218,11 +189,6 @@ func (p *Parser) WithJSONOptions(jsonOptions *astJSON.Options) *Parser {
 	return p
 }
 
-func (p *Parser) WithRegoVersion(version RegoVersion) *Parser {
-	p.po.RegoVersion = version
-	return p
-}
-
 func (p *Parser) parsedTermCacheLookup() (*Term, *state) {
 	l := p.s.loc.Offset
 	// stop comparing once the cached offsets are lower than l
@@ -291,23 +257,16 @@ func (p *Parser) Parse() ([]Statement, []*Comment, Errors) {
 
 	allowedFutureKeywords := map[string]tokens.Token{}
 
-	if p.po.EffectiveRegoVersion() == RegoV1 {
-		// RegoV1 includes all future keywords in the default language definition
-		for k, v := range futureKeywords {
-			allowedFutureKeywords[k] = v
-		}
-	} else {
-		for _, kw := range p.po.Capabilities.FutureKeywords {
-			var ok bool
-			allowedFutureKeywords[kw], ok = futureKeywords[kw]
-			if !ok {
-				return nil, nil, Errors{
-					&Error{
-						Code:     ParseErr,
-						Message:  fmt.Sprintf("illegal capabilities: unknown keyword: %v", kw),
-						Location: nil,
-					},
-				}
+	for _, kw := range p.po.Capabilities.FutureKeywords {
+		var ok bool
+		allowedFutureKeywords[kw], ok = futureKeywords[kw]
+		if !ok {
+			return nil, nil, Errors{
+				&Error{
+					Code:     ParseErr,
+					Message:  fmt.Sprintf("illegal capabilities: unknown keyword: %v", kw),
+					Location: nil,
+				},
 			}
 		}
 	}
@@ -325,7 +284,7 @@ func (p *Parser) Parse() ([]Statement, []*Comment, Errors) {
 	}
 
 	selected := map[string]tokens.Token{}
-	if p.po.AllFutureKeywords || p.po.EffectiveRegoVersion() == RegoV1 {
+	if p.po.AllFutureKeywords {
 		for kw, tok := range allowedFutureKeywords {
 			selected[kw] = tok
 		}
@@ -346,12 +305,6 @@ func (p *Parser) Parse() ([]Statement, []*Comment, Errors) {
 	}
 	p.s.s = p.s.s.WithKeywords(selected)
 
-	if p.po.EffectiveRegoVersion() == RegoV1 {
-		for kw, tok := range allowedFutureKeywords {
-			p.s.s.AddKeyword(kw, tok)
-		}
-	}
-
 	// read the first token to initialize the parser
 	p.scan()
 
@@ -2614,11 +2567,6 @@ func (p *Parser) regoV1Import(imp *Import) {
 		return
 	}
 
-	if p.po.EffectiveRegoVersion() == RegoV1 {
-		// We're parsing for Rego v1, where the 'rego.v1' import is a no-op.
-		return
-	}
-
 	path := imp.Path.Value.(Ref)
 
 	if len(path) == 1 || !path[1].Equal(RegoV1CompatibleRef[1]) || len(path) > 2 {
diff --git a/vendor/github.com/open-policy-agent/opa/ast/parser_ext.go b/vendor/github.com/open-policy-agent/opa/ast/parser_ext.go
index 413416da29e..c2559152342 100644
--- a/vendor/github.com/open-policy-agent/opa/ast/parser_ext.go
+++ b/vendor/github.com/open-policy-agent/opa/ast/parser_ext.go
@@ -477,7 +477,7 @@ func ParseModuleWithOpts(filename, input string, popts ParserOptions) (*Module,
 	if err != nil {
 		return nil, err
 	}
-	return parseModule(filename, stmts, comments, popts.EffectiveRegoVersion())
+	return parseModule(filename, stmts, comments, popts.RegoV1Compatible)
 }
 
 // ParseBody returns exactly one body.
@@ -626,7 +626,6 @@ func ParseStatementsWithOpts(filename, input string, popts ParserOptions) ([]Sta
 		WithCapabilities(popts.Capabilities).
 		WithSkipRules(popts.SkipRules).
 		WithJSONOptions(popts.JSONOptions).
-		WithRegoVersion(popts.EffectiveRegoVersion()).
 		withUnreleasedKeywords(popts.unreleasedKeywords)
 
 	stmts, comments, errs := parser.Parse()
@@ -638,7 +637,7 @@ func ParseStatementsWithOpts(filename, input string, popts ParserOptions) ([]Sta
 	return stmts, comments, nil
 }
 
-func parseModule(filename string, stmts []Statement, comments []*Comment, regoCompatibilityMode RegoVersion) (*Module, error) {
+func parseModule(filename string, stmts []Statement, comments []*Comment, regoV1Compatible bool) (*Module, error) {
 
 	if len(stmts) == 0 {
 		return nil, NewError(ParseErr, &Location{File: filename}, "empty module")
@@ -659,14 +658,14 @@ func parseModule(filename string, stmts []Statement, comments []*Comment, regoCo
 
 	// The comments slice only holds comments that were not their own statements.
 	mod.Comments = append(mod.Comments, comments...)
-	mod.regoVersion = regoCompatibilityMode
+	mod.regoV1Compatible = regoV1Compatible
 
 	for i, stmt := range stmts[1:] {
 		switch stmt := stmt.(type) {
 		case *Import:
 			mod.Imports = append(mod.Imports, stmt)
-			if mod.regoVersion == RegoV0 && Compare(stmt.Path.Value, RegoV1CompatibleRef) == 0 {
-				mod.regoVersion = RegoV0CompatV1
+			if Compare(stmt.Path.Value, RegoV1CompatibleRef) == 0 {
+				mod.regoV1Compatible = true
 			}
 		case *Rule:
 			setRuleModule(stmt, mod)
@@ -695,7 +694,7 @@ func parseModule(filename string, stmts []Statement, comments []*Comment, regoCo
 		}
 	}
 
-	if mod.regoVersion == RegoV0CompatV1 || mod.regoVersion == RegoV1 {
+	if mod.regoV1Compatible {
 		for _, rule := range mod.Rules {
 			for r := rule; r != nil; r = r.Else {
 				var t string
diff --git a/vendor/github.com/open-policy-agent/opa/ast/policy.go b/vendor/github.com/open-policy-agent/opa/ast/policy.go
index 187bb8d7650..2679a5f10c2 100644
--- a/vendor/github.com/open-policy-agent/opa/ast/policy.go
+++ b/vendor/github.com/open-policy-agent/opa/ast/policy.go
@@ -145,13 +145,13 @@ type (
 	// within a namespace (defined by the package) and optional
 	// dependencies on external documents (defined by imports).
 	Module struct {
-		Package     *Package       `json:"package"`
-		Imports     []*Import      `json:"imports,omitempty"`
-		Annotations []*Annotations `json:"annotations,omitempty"`
-		Rules       []*Rule        `json:"rules,omitempty"`
-		Comments    []*Comment     `json:"comments,omitempty"`
-		stmts       []Statement
-		regoVersion RegoVersion
+		Package          *Package       `json:"package"`
+		Imports          []*Import      `json:"imports,omitempty"`
+		Annotations      []*Annotations `json:"annotations,omitempty"`
+		Rules            []*Rule        `json:"rules,omitempty"`
+		Comments         []*Comment     `json:"comments,omitempty"`
+		stmts            []Statement
+		regoV1Compatible bool
 	}
 
 	// Comment contains the raw text from the comment in the definition.
@@ -399,14 +399,6 @@ func (mod *Module) UnmarshalJSON(bs []byte) error {
 	return nil
 }
 
-func (mod *Module) regoV1Compatible() bool {
-	return mod.regoVersion == RegoV1 || mod.regoVersion == RegoV0CompatV1
-}
-
-func (mod *Module) RegoVersion() RegoVersion {
-	return mod.regoVersion
-}
-
 // NewComment returns a new Comment object.
 func NewComment(text []byte) *Comment {
 	return &Comment{
diff --git a/vendor/github.com/open-policy-agent/opa/bundle/bundle.go b/vendor/github.com/open-policy-agent/opa/bundle/bundle.go
index 72927123a88..66c8ce37c63 100644
--- a/vendor/github.com/open-policy-agent/opa/bundle/bundle.go
+++ b/vendor/github.com/open-policy-agent/opa/bundle/bundle.go
@@ -400,7 +400,6 @@ type Reader struct {
 	lazyLoadingMode       bool
 	name                  string
 	persist               bool
-	regoVersion           ast.RegoVersion
 }
 
 // NewReader is deprecated. Use NewCustomReader instead.
@@ -504,17 +503,11 @@ func (r *Reader) WithBundlePersistence(persist bool) *Reader {
 	return r
 }
 
-func (r *Reader) WithRegoVersion(version ast.RegoVersion) *Reader {
-	r.regoVersion = version
-	return r
-}
-
 func (r *Reader) ParserOptions() ast.ParserOptions {
 	return ast.ParserOptions{
 		ProcessAnnotation: r.processAnnotations,
 		Capabilities:      r.capabilities,
 		JSONOptions:       r.jsonOptions,
-		RegoVersion:       r.regoVersion,
 	}
 }
 
@@ -1012,18 +1005,12 @@ func hashBundleFiles(hash SignatureHasher, b *Bundle) ([]FileInfo, error) {
 }
 
 // FormatModules formats Rego modules
-// Modules will be formatted to comply with rego-v1, but Rego compatibility of individual parsed modules will be respected (e.g. if 'rego.v1' is imported).
 func (b *Bundle) FormatModules(useModulePath bool) error {
-	return b.FormatModulesForRegoVersion(ast.RegoV0, true, useModulePath)
-}
-
-// FormatModulesForRegoVersion formats Rego modules to comply with a given Rego version
-func (b *Bundle) FormatModulesForRegoVersion(version ast.RegoVersion, preserveModuleRegoVersion bool, useModulePath bool) error {
 	var err error
 
 	for i, module := range b.Modules {
 		if module.Raw == nil {
-			module.Raw, err = format.AstWithOpts(module.Parsed, format.Opts{RegoVersion: version})
+			module.Raw, err = format.Ast(module.Parsed)
 			if err != nil {
 				return err
 			}
@@ -1033,14 +1020,7 @@ func (b *Bundle) FormatModulesForRegoVersion(version ast.RegoVersion, preserveMo
 				path = module.Path
 			}
 
-			opts := format.Opts{}
-			if preserveModuleRegoVersion {
-				opts.RegoVersion = module.Parsed.RegoVersion()
-			} else {
-				opts.RegoVersion = version
-			}
-
-			module.Raw, err = format.SourceWithOpts(path, module.Raw, opts)
+			module.Raw, err = format.Source(path, module.Raw)
 			if err != nil {
 				return err
 			}
diff --git a/vendor/github.com/open-policy-agent/opa/bundle/store.go b/vendor/github.com/open-policy-agent/opa/bundle/store.go
index 45bcf6e559e..d93d147c054 100644
--- a/vendor/github.com/open-policy-agent/opa/bundle/store.go
+++ b/vendor/github.com/open-policy-agent/opa/bundle/store.go
@@ -301,7 +301,6 @@ type ActivateOpts struct {
 	Bundles                  map[string]*Bundle     // Optional
 	ExtraModules             map[string]*ast.Module // Optional
 	AuthorizationDecisionRef ast.Ref
-	ParserOptions            ast.ParserOptions
 
 	legacy bool
 }
@@ -315,11 +314,10 @@ func Activate(opts *ActivateOpts) error {
 
 // DeactivateOpts defines options for the Deactivate API call
 type DeactivateOpts struct {
-	Ctx           context.Context
-	Store         storage.Store
-	Txn           storage.Transaction
-	BundleNames   map[string]struct{}
-	ParserOptions ast.ParserOptions
+	Ctx         context.Context
+	Store       storage.Store
+	Txn         storage.Transaction
+	BundleNames map[string]struct{}
 }
 
 // Deactivate the bundle(s). This will erase associated data, policies, and the manifest entry from the store.
@@ -334,7 +332,7 @@ func Deactivate(opts *DeactivateOpts) error {
 			erase[root] = struct{}{}
 		}
 	}
-	_, err := eraseBundles(opts.Ctx, opts.Store, opts.Txn, opts.ParserOptions, opts.BundleNames, erase)
+	_, err := eraseBundles(opts.Ctx, opts.Store, opts.Txn, opts.BundleNames, erase)
 	return err
 }
 
@@ -384,7 +382,7 @@ func activateBundles(opts *ActivateOpts) error {
 
 	// Erase data and policies at new + old roots, and remove the old
 	// manifests before activating a new snapshot bundle.
-	remaining, err := eraseBundles(opts.Ctx, opts.Store, opts.Txn, opts.ParserOptions, names, erase)
+	remaining, err := eraseBundles(opts.Ctx, opts.Store, opts.Txn, names, erase)
 	if err != nil {
 		return err
 	}
@@ -587,13 +585,13 @@ func activateDeltaBundles(opts *ActivateOpts, bundles map[string]*Bundle) error
 
 // erase bundles by name and roots. This will clear all policies and data at its roots and remove its
 // manifest from storage.
-func eraseBundles(ctx context.Context, store storage.Store, txn storage.Transaction, parserOpts ast.ParserOptions, names map[string]struct{}, roots map[string]struct{}) (map[string]*ast.Module, error) {
+func eraseBundles(ctx context.Context, store storage.Store, txn storage.Transaction, names map[string]struct{}, roots map[string]struct{}) (map[string]*ast.Module, error) {
 
 	if err := eraseData(ctx, store, txn, roots); err != nil {
 		return nil, err
 	}
 
-	remaining, err := erasePolicies(ctx, store, txn, parserOpts, roots)
+	remaining, err := erasePolicies(ctx, store, txn, roots)
 	if err != nil {
 		return nil, err
 	}
@@ -635,7 +633,7 @@ func eraseData(ctx context.Context, store storage.Store, txn storage.Transaction
 	return nil
 }
 
-func erasePolicies(ctx context.Context, store storage.Store, txn storage.Transaction, parserOpts ast.ParserOptions, roots map[string]struct{}) (map[string]*ast.Module, error) {
+func erasePolicies(ctx context.Context, store storage.Store, txn storage.Transaction, roots map[string]struct{}) (map[string]*ast.Module, error) {
 
 	ids, err := store.ListPolicies(ctx, txn)
 	if err != nil {
@@ -649,7 +647,7 @@ func erasePolicies(ctx context.Context, store storage.Store, txn storage.Transac
 		if err != nil {
 			return nil, err
 		}
-		module, err := ast.ParseModuleWithOpts(id, string(bs), parserOpts)
+		module, err := ast.ParseModule(id, string(bs))
 		if err != nil {
 			return nil, err
 		}
diff --git a/vendor/github.com/open-policy-agent/opa/capabilities/v0.60.0.json b/vendor/github.com/open-policy-agent/opa/capabilities/v0.60.0.json
deleted file mode 100644
index e38edc9482c..00000000000
--- a/vendor/github.com/open-policy-agent/opa/capabilities/v0.60.0.json
+++ /dev/null
@@ -1,4737 +0,0 @@
-{
-  "builtins": [
-    {
-      "name": "abs",
-      "decl": {
-        "args": [
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "all",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "dynamic": {
-                  "type": "any"
-                },
-                "type": "array"
-              },
-              {
-                "of": {
-                  "type": "any"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "and",
-      "decl": {
-        "args": [
-          {
-            "of": {
-              "type": "any"
-            },
-            "type": "set"
-          },
-          {
-            "of": {
-              "type": "any"
-            },
-            "type": "set"
-          }
-        ],
-        "result": {
-          "of": {
-            "type": "any"
-          },
-          "type": "set"
-        },
-        "type": "function"
-      },
-      "infix": "\u0026"
-    },
-    {
-      "name": "any",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "dynamic": {
-                  "type": "any"
-                },
-                "type": "array"
-              },
-              {
-                "of": {
-                  "type": "any"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "array.concat",
-      "decl": {
-        "args": [
-          {
-            "dynamic": {
-              "type": "any"
-            },
-            "type": "array"
-          },
-          {
-            "dynamic": {
-              "type": "any"
-            },
-            "type": "array"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "type": "any"
-          },
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "array.reverse",
-      "decl": {
-        "args": [
-          {
-            "dynamic": {
-              "type": "any"
-            },
-            "type": "array"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "type": "any"
-          },
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "array.slice",
-      "decl": {
-        "args": [
-          {
-            "dynamic": {
-              "type": "any"
-            },
-            "type": "array"
-          },
-          {
-            "type": "number"
-          },
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "type": "any"
-          },
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "assign",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          },
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      },
-      "infix": ":="
-    },
-    {
-      "name": "base64.decode",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "base64.encode",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "base64.is_valid",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "base64url.decode",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "base64url.encode",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "base64url.encode_no_pad",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "bits.and",
-      "decl": {
-        "args": [
-          {
-            "type": "number"
-          },
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "bits.lsh",
-      "decl": {
-        "args": [
-          {
-            "type": "number"
-          },
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "bits.negate",
-      "decl": {
-        "args": [
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "bits.or",
-      "decl": {
-        "args": [
-          {
-            "type": "number"
-          },
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "bits.rsh",
-      "decl": {
-        "args": [
-          {
-            "type": "number"
-          },
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "bits.xor",
-      "decl": {
-        "args": [
-          {
-            "type": "number"
-          },
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "cast_array",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "type": "any"
-          },
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "cast_boolean",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "cast_null",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "null"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "cast_object",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "key": {
-              "type": "any"
-            },
-            "value": {
-              "type": "any"
-            }
-          },
-          "type": "object"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "cast_set",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "of": {
-            "type": "any"
-          },
-          "type": "set"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "cast_string",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "ceil",
-      "decl": {
-        "args": [
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "concat",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "of": [
-              {
-                "dynamic": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              {
-                "of": {
-                  "type": "string"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "contains",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "count",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "type": "string"
-              },
-              {
-                "dynamic": {
-                  "type": "any"
-                },
-                "type": "array"
-              },
-              {
-                "dynamic": {
-                  "key": {
-                    "type": "any"
-                  },
-                  "value": {
-                    "type": "any"
-                  }
-                },
-                "type": "object"
-              },
-              {
-                "of": {
-                  "type": "any"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "crypto.hmac.equal",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "crypto.hmac.md5",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "crypto.hmac.sha1",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "crypto.hmac.sha256",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "crypto.hmac.sha512",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "crypto.md5",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "crypto.parse_private_keys",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "dynamic": {
-              "key": {
-                "type": "string"
-              },
-              "value": {
-                "type": "any"
-              }
-            },
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "crypto.sha1",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "crypto.sha256",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "crypto.x509.parse_and_verify_certificates",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "static": [
-            {
-              "type": "boolean"
-            },
-            {
-              "dynamic": {
-                "dynamic": {
-                  "key": {
-                    "type": "string"
-                  },
-                  "value": {
-                    "type": "any"
-                  }
-                },
-                "type": "object"
-              },
-              "type": "array"
-            }
-          ],
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "crypto.x509.parse_certificate_request",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "key": {
-              "type": "string"
-            },
-            "value": {
-              "type": "any"
-            }
-          },
-          "type": "object"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "crypto.x509.parse_certificates",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "dynamic": {
-              "key": {
-                "type": "string"
-              },
-              "value": {
-                "type": "any"
-              }
-            },
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "crypto.x509.parse_keypair",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "key": {
-              "type": "string"
-            },
-            "value": {
-              "type": "any"
-            }
-          },
-          "type": "object"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "crypto.x509.parse_rsa_private_key",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "key": {
-              "type": "string"
-            },
-            "value": {
-              "type": "any"
-            }
-          },
-          "type": "object"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "div",
-      "decl": {
-        "args": [
-          {
-            "type": "number"
-          },
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      },
-      "infix": "/"
-    },
-    {
-      "name": "endswith",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "eq",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          },
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      },
-      "infix": "="
-    },
-    {
-      "name": "equal",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          },
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      },
-      "infix": "=="
-    },
-    {
-      "name": "floor",
-      "decl": {
-        "args": [
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "format_int",
-      "decl": {
-        "args": [
-          {
-            "type": "number"
-          },
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "glob.match",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "of": [
-              {
-                "type": "null"
-              },
-              {
-                "dynamic": {
-                  "type": "string"
-                },
-                "type": "array"
-              }
-            ],
-            "type": "any"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "glob.quote_meta",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "graph.reachable",
-      "decl": {
-        "args": [
-          {
-            "dynamic": {
-              "key": {
-                "type": "any"
-              },
-              "value": {
-                "of": [
-                  {
-                    "dynamic": {
-                      "type": "any"
-                    },
-                    "type": "array"
-                  },
-                  {
-                    "of": {
-                      "type": "any"
-                    },
-                    "type": "set"
-                  }
-                ],
-                "type": "any"
-              }
-            },
-            "type": "object"
-          },
-          {
-            "of": [
-              {
-                "dynamic": {
-                  "type": "any"
-                },
-                "type": "array"
-              },
-              {
-                "of": {
-                  "type": "any"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "of": {
-            "type": "any"
-          },
-          "type": "set"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "graph.reachable_paths",
-      "decl": {
-        "args": [
-          {
-            "dynamic": {
-              "key": {
-                "type": "any"
-              },
-              "value": {
-                "of": [
-                  {
-                    "dynamic": {
-                      "type": "any"
-                    },
-                    "type": "array"
-                  },
-                  {
-                    "of": {
-                      "type": "any"
-                    },
-                    "type": "set"
-                  }
-                ],
-                "type": "any"
-              }
-            },
-            "type": "object"
-          },
-          {
-            "of": [
-              {
-                "dynamic": {
-                  "type": "any"
-                },
-                "type": "array"
-              },
-              {
-                "of": {
-                  "type": "any"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "of": {
-            "dynamic": {
-              "type": "any"
-            },
-            "type": "array"
-          },
-          "type": "set"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "graphql.is_valid",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "type": "string"
-              },
-              {
-                "dynamic": {
-                  "key": {
-                    "type": "any"
-                  },
-                  "value": {
-                    "type": "any"
-                  }
-                },
-                "type": "object"
-              }
-            ],
-            "type": "any"
-          },
-          {
-            "of": [
-              {
-                "type": "string"
-              },
-              {
-                "dynamic": {
-                  "key": {
-                    "type": "any"
-                  },
-                  "value": {
-                    "type": "any"
-                  }
-                },
-                "type": "object"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "graphql.parse",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "type": "string"
-              },
-              {
-                "dynamic": {
-                  "key": {
-                    "type": "any"
-                  },
-                  "value": {
-                    "type": "any"
-                  }
-                },
-                "type": "object"
-              }
-            ],
-            "type": "any"
-          },
-          {
-            "of": [
-              {
-                "type": "string"
-              },
-              {
-                "dynamic": {
-                  "key": {
-                    "type": "any"
-                  },
-                  "value": {
-                    "type": "any"
-                  }
-                },
-                "type": "object"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "static": [
-            {
-              "dynamic": {
-                "key": {
-                  "type": "any"
-                },
-                "value": {
-                  "type": "any"
-                }
-              },
-              "type": "object"
-            },
-            {
-              "dynamic": {
-                "key": {
-                  "type": "any"
-                },
-                "value": {
-                  "type": "any"
-                }
-              },
-              "type": "object"
-            }
-          ],
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "graphql.parse_and_verify",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "type": "string"
-              },
-              {
-                "dynamic": {
-                  "key": {
-                    "type": "any"
-                  },
-                  "value": {
-                    "type": "any"
-                  }
-                },
-                "type": "object"
-              }
-            ],
-            "type": "any"
-          },
-          {
-            "of": [
-              {
-                "type": "string"
-              },
-              {
-                "dynamic": {
-                  "key": {
-                    "type": "any"
-                  },
-                  "value": {
-                    "type": "any"
-                  }
-                },
-                "type": "object"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "static": [
-            {
-              "type": "boolean"
-            },
-            {
-              "dynamic": {
-                "key": {
-                  "type": "any"
-                },
-                "value": {
-                  "type": "any"
-                }
-              },
-              "type": "object"
-            },
-            {
-              "dynamic": {
-                "key": {
-                  "type": "any"
-                },
-                "value": {
-                  "type": "any"
-                }
-              },
-              "type": "object"
-            }
-          ],
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "graphql.parse_query",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "key": {
-              "type": "any"
-            },
-            "value": {
-              "type": "any"
-            }
-          },
-          "type": "object"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "graphql.parse_schema",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "key": {
-              "type": "any"
-            },
-            "value": {
-              "type": "any"
-            }
-          },
-          "type": "object"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "graphql.schema_is_valid",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "type": "string"
-              },
-              {
-                "dynamic": {
-                  "key": {
-                    "type": "any"
-                  },
-                  "value": {
-                    "type": "any"
-                  }
-                },
-                "type": "object"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "gt",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          },
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      },
-      "infix": "\u003e"
-    },
-    {
-      "name": "gte",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          },
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      },
-      "infix": "\u003e="
-    },
-    {
-      "name": "hex.decode",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "hex.encode",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "http.send",
-      "decl": {
-        "args": [
-          {
-            "dynamic": {
-              "key": {
-                "type": "string"
-              },
-              "value": {
-                "type": "any"
-              }
-            },
-            "type": "object"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "key": {
-              "type": "any"
-            },
-            "value": {
-              "type": "any"
-            }
-          },
-          "type": "object"
-        },
-        "type": "function"
-      },
-      "nondeterministic": true
-    },
-    {
-      "name": "indexof",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "indexof_n",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "type": "number"
-          },
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "internal.member_2",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          },
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      },
-      "infix": "in"
-    },
-    {
-      "name": "internal.member_3",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          },
-          {
-            "type": "any"
-          },
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      },
-      "infix": "in"
-    },
-    {
-      "name": "internal.print",
-      "decl": {
-        "args": [
-          {
-            "dynamic": {
-              "of": {
-                "type": "any"
-              },
-              "type": "set"
-            },
-            "type": "array"
-          }
-        ],
-        "type": "function"
-      }
-    },
-    {
-      "name": "intersection",
-      "decl": {
-        "args": [
-          {
-            "of": {
-              "of": {
-                "type": "any"
-              },
-              "type": "set"
-            },
-            "type": "set"
-          }
-        ],
-        "result": {
-          "of": {
-            "type": "any"
-          },
-          "type": "set"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "io.jwt.decode",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "static": [
-            {
-              "dynamic": {
-                "key": {
-                  "type": "any"
-                },
-                "value": {
-                  "type": "any"
-                }
-              },
-              "type": "object"
-            },
-            {
-              "dynamic": {
-                "key": {
-                  "type": "any"
-                },
-                "value": {
-                  "type": "any"
-                }
-              },
-              "type": "object"
-            },
-            {
-              "type": "string"
-            }
-          ],
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "io.jwt.decode_verify",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "dynamic": {
-              "key": {
-                "type": "string"
-              },
-              "value": {
-                "type": "any"
-              }
-            },
-            "type": "object"
-          }
-        ],
-        "result": {
-          "static": [
-            {
-              "type": "boolean"
-            },
-            {
-              "dynamic": {
-                "key": {
-                  "type": "any"
-                },
-                "value": {
-                  "type": "any"
-                }
-              },
-              "type": "object"
-            },
-            {
-              "dynamic": {
-                "key": {
-                  "type": "any"
-                },
-                "value": {
-                  "type": "any"
-                }
-              },
-              "type": "object"
-            }
-          ],
-          "type": "array"
-        },
-        "type": "function"
-      },
-      "nondeterministic": true
-    },
-    {
-      "name": "io.jwt.encode_sign",
-      "decl": {
-        "args": [
-          {
-            "dynamic": {
-              "key": {
-                "type": "string"
-              },
-              "value": {
-                "type": "any"
-              }
-            },
-            "type": "object"
-          },
-          {
-            "dynamic": {
-              "key": {
-                "type": "string"
-              },
-              "value": {
-                "type": "any"
-              }
-            },
-            "type": "object"
-          },
-          {
-            "dynamic": {
-              "key": {
-                "type": "string"
-              },
-              "value": {
-                "type": "any"
-              }
-            },
-            "type": "object"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      },
-      "nondeterministic": true
-    },
-    {
-      "name": "io.jwt.encode_sign_raw",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      },
-      "nondeterministic": true
-    },
-    {
-      "name": "io.jwt.verify_es256",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "io.jwt.verify_es384",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "io.jwt.verify_es512",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "io.jwt.verify_hs256",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "io.jwt.verify_hs384",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "io.jwt.verify_hs512",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "io.jwt.verify_ps256",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "io.jwt.verify_ps384",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "io.jwt.verify_ps512",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "io.jwt.verify_rs256",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "io.jwt.verify_rs384",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "io.jwt.verify_rs512",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "is_array",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "is_boolean",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "is_null",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "is_number",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "is_object",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "is_set",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "is_string",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "json.filter",
-      "decl": {
-        "args": [
-          {
-            "dynamic": {
-              "key": {
-                "type": "any"
-              },
-              "value": {
-                "type": "any"
-              }
-            },
-            "type": "object"
-          },
-          {
-            "of": [
-              {
-                "dynamic": {
-                  "of": [
-                    {
-                      "type": "string"
-                    },
-                    {
-                      "dynamic": {
-                        "type": "any"
-                      },
-                      "type": "array"
-                    }
-                  ],
-                  "type": "any"
-                },
-                "type": "array"
-              },
-              {
-                "of": {
-                  "of": [
-                    {
-                      "type": "string"
-                    },
-                    {
-                      "dynamic": {
-                        "type": "any"
-                      },
-                      "type": "array"
-                    }
-                  ],
-                  "type": "any"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "any"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "json.is_valid",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "json.marshal",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "json.match_schema",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "type": "string"
-              },
-              {
-                "dynamic": {
-                  "key": {
-                    "type": "any"
-                  },
-                  "value": {
-                    "type": "any"
-                  }
-                },
-                "type": "object"
-              }
-            ],
-            "type": "any"
-          },
-          {
-            "of": [
-              {
-                "type": "string"
-              },
-              {
-                "dynamic": {
-                  "key": {
-                    "type": "any"
-                  },
-                  "value": {
-                    "type": "any"
-                  }
-                },
-                "type": "object"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "static": [
-            {
-              "type": "boolean"
-            },
-            {
-              "dynamic": {
-                "static": [
-                  {
-                    "key": "desc",
-                    "value": {
-                      "type": "string"
-                    }
-                  },
-                  {
-                    "key": "error",
-                    "value": {
-                      "type": "string"
-                    }
-                  },
-                  {
-                    "key": "field",
-                    "value": {
-                      "type": "string"
-                    }
-                  },
-                  {
-                    "key": "type",
-                    "value": {
-                      "type": "string"
-                    }
-                  }
-                ],
-                "type": "object"
-              },
-              "type": "array"
-            }
-          ],
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "json.patch",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          },
-          {
-            "dynamic": {
-              "dynamic": {
-                "key": {
-                  "type": "any"
-                },
-                "value": {
-                  "type": "any"
-                }
-              },
-              "static": [
-                {
-                  "key": "op",
-                  "value": {
-                    "type": "string"
-                  }
-                },
-                {
-                  "key": "path",
-                  "value": {
-                    "type": "any"
-                  }
-                }
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          }
-        ],
-        "result": {
-          "type": "any"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "json.remove",
-      "decl": {
-        "args": [
-          {
-            "dynamic": {
-              "key": {
-                "type": "any"
-              },
-              "value": {
-                "type": "any"
-              }
-            },
-            "type": "object"
-          },
-          {
-            "of": [
-              {
-                "dynamic": {
-                  "of": [
-                    {
-                      "type": "string"
-                    },
-                    {
-                      "dynamic": {
-                        "type": "any"
-                      },
-                      "type": "array"
-                    }
-                  ],
-                  "type": "any"
-                },
-                "type": "array"
-              },
-              {
-                "of": {
-                  "of": [
-                    {
-                      "type": "string"
-                    },
-                    {
-                      "dynamic": {
-                        "type": "any"
-                      },
-                      "type": "array"
-                    }
-                  ],
-                  "type": "any"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "any"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "json.unmarshal",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "any"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "json.verify_schema",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "type": "string"
-              },
-              {
-                "dynamic": {
-                  "key": {
-                    "type": "any"
-                  },
-                  "value": {
-                    "type": "any"
-                  }
-                },
-                "type": "object"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "static": [
-            {
-              "type": "boolean"
-            },
-            {
-              "of": [
-                {
-                  "type": "null"
-                },
-                {
-                  "type": "string"
-                }
-              ],
-              "type": "any"
-            }
-          ],
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "lower",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "lt",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          },
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      },
-      "infix": "\u003c"
-    },
-    {
-      "name": "lte",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          },
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      },
-      "infix": "\u003c="
-    },
-    {
-      "name": "max",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "dynamic": {
-                  "type": "any"
-                },
-                "type": "array"
-              },
-              {
-                "of": {
-                  "type": "any"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "any"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "min",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "dynamic": {
-                  "type": "any"
-                },
-                "type": "array"
-              },
-              {
-                "of": {
-                  "type": "any"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "any"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "minus",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "type": "number"
-              },
-              {
-                "of": {
-                  "type": "any"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          },
-          {
-            "of": [
-              {
-                "type": "number"
-              },
-              {
-                "of": {
-                  "type": "any"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "of": [
-            {
-              "type": "number"
-            },
-            {
-              "of": {
-                "type": "any"
-              },
-              "type": "set"
-            }
-          ],
-          "type": "any"
-        },
-        "type": "function"
-      },
-      "infix": "-"
-    },
-    {
-      "name": "mul",
-      "decl": {
-        "args": [
-          {
-            "type": "number"
-          },
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      },
-      "infix": "*"
-    },
-    {
-      "name": "neq",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          },
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      },
-      "infix": "!="
-    },
-    {
-      "name": "net.cidr_contains",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "net.cidr_contains_matches",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "type": "string"
-              },
-              {
-                "dynamic": {
-                  "of": [
-                    {
-                      "type": "string"
-                    },
-                    {
-                      "dynamic": {
-                        "type": "any"
-                      },
-                      "type": "array"
-                    }
-                  ],
-                  "type": "any"
-                },
-                "type": "array"
-              },
-              {
-                "dynamic": {
-                  "key": {
-                    "type": "string"
-                  },
-                  "value": {
-                    "of": [
-                      {
-                        "type": "string"
-                      },
-                      {
-                        "dynamic": {
-                          "type": "any"
-                        },
-                        "type": "array"
-                      }
-                    ],
-                    "type": "any"
-                  }
-                },
-                "type": "object"
-              },
-              {
-                "of": {
-                  "of": [
-                    {
-                      "type": "string"
-                    },
-                    {
-                      "dynamic": {
-                        "type": "any"
-                      },
-                      "type": "array"
-                    }
-                  ],
-                  "type": "any"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          },
-          {
-            "of": [
-              {
-                "type": "string"
-              },
-              {
-                "dynamic": {
-                  "of": [
-                    {
-                      "type": "string"
-                    },
-                    {
-                      "dynamic": {
-                        "type": "any"
-                      },
-                      "type": "array"
-                    }
-                  ],
-                  "type": "any"
-                },
-                "type": "array"
-              },
-              {
-                "dynamic": {
-                  "key": {
-                    "type": "string"
-                  },
-                  "value": {
-                    "of": [
-                      {
-                        "type": "string"
-                      },
-                      {
-                        "dynamic": {
-                          "type": "any"
-                        },
-                        "type": "array"
-                      }
-                    ],
-                    "type": "any"
-                  }
-                },
-                "type": "object"
-              },
-              {
-                "of": {
-                  "of": [
-                    {
-                      "type": "string"
-                    },
-                    {
-                      "dynamic": {
-                        "type": "any"
-                      },
-                      "type": "array"
-                    }
-                  ],
-                  "type": "any"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "of": {
-            "static": [
-              {
-                "type": "any"
-              },
-              {
-                "type": "any"
-              }
-            ],
-            "type": "array"
-          },
-          "type": "set"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "net.cidr_expand",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "of": {
-            "type": "string"
-          },
-          "type": "set"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "net.cidr_intersects",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "net.cidr_is_valid",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "net.cidr_merge",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "dynamic": {
-                  "of": [
-                    {
-                      "type": "string"
-                    }
-                  ],
-                  "type": "any"
-                },
-                "type": "array"
-              },
-              {
-                "of": {
-                  "type": "string"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "of": {
-            "type": "string"
-          },
-          "type": "set"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "net.cidr_overlap",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "net.lookup_ip_addr",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "of": {
-            "type": "string"
-          },
-          "type": "set"
-        },
-        "type": "function"
-      },
-      "nondeterministic": true
-    },
-    {
-      "name": "numbers.range",
-      "decl": {
-        "args": [
-          {
-            "type": "number"
-          },
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "type": "number"
-          },
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "numbers.range_step",
-      "decl": {
-        "args": [
-          {
-            "type": "number"
-          },
-          {
-            "type": "number"
-          },
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "type": "number"
-          },
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "object.filter",
-      "decl": {
-        "args": [
-          {
-            "dynamic": {
-              "key": {
-                "type": "any"
-              },
-              "value": {
-                "type": "any"
-              }
-            },
-            "type": "object"
-          },
-          {
-            "of": [
-              {
-                "dynamic": {
-                  "type": "any"
-                },
-                "type": "array"
-              },
-              {
-                "dynamic": {
-                  "key": {
-                    "type": "any"
-                  },
-                  "value": {
-                    "type": "any"
-                  }
-                },
-                "type": "object"
-              },
-              {
-                "of": {
-                  "type": "any"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "any"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "object.get",
-      "decl": {
-        "args": [
-          {
-            "dynamic": {
-              "key": {
-                "type": "any"
-              },
-              "value": {
-                "type": "any"
-              }
-            },
-            "type": "object"
-          },
-          {
-            "type": "any"
-          },
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "any"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "object.keys",
-      "decl": {
-        "args": [
-          {
-            "dynamic": {
-              "key": {
-                "type": "any"
-              },
-              "value": {
-                "type": "any"
-              }
-            },
-            "type": "object"
-          }
-        ],
-        "result": {
-          "of": {
-            "type": "any"
-          },
-          "type": "set"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "object.remove",
-      "decl": {
-        "args": [
-          {
-            "dynamic": {
-              "key": {
-                "type": "any"
-              },
-              "value": {
-                "type": "any"
-              }
-            },
-            "type": "object"
-          },
-          {
-            "of": [
-              {
-                "dynamic": {
-                  "type": "any"
-                },
-                "type": "array"
-              },
-              {
-                "dynamic": {
-                  "key": {
-                    "type": "any"
-                  },
-                  "value": {
-                    "type": "any"
-                  }
-                },
-                "type": "object"
-              },
-              {
-                "of": {
-                  "type": "any"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "any"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "object.subset",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "dynamic": {
-                  "type": "any"
-                },
-                "type": "array"
-              },
-              {
-                "dynamic": {
-                  "key": {
-                    "type": "any"
-                  },
-                  "value": {
-                    "type": "any"
-                  }
-                },
-                "type": "object"
-              },
-              {
-                "of": {
-                  "type": "any"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          },
-          {
-            "of": [
-              {
-                "dynamic": {
-                  "type": "any"
-                },
-                "type": "array"
-              },
-              {
-                "dynamic": {
-                  "key": {
-                    "type": "any"
-                  },
-                  "value": {
-                    "type": "any"
-                  }
-                },
-                "type": "object"
-              },
-              {
-                "of": {
-                  "type": "any"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "any"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "object.union",
-      "decl": {
-        "args": [
-          {
-            "dynamic": {
-              "key": {
-                "type": "any"
-              },
-              "value": {
-                "type": "any"
-              }
-            },
-            "type": "object"
-          },
-          {
-            "dynamic": {
-              "key": {
-                "type": "any"
-              },
-              "value": {
-                "type": "any"
-              }
-            },
-            "type": "object"
-          }
-        ],
-        "result": {
-          "type": "any"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "object.union_n",
-      "decl": {
-        "args": [
-          {
-            "dynamic": {
-              "dynamic": {
-                "key": {
-                  "type": "any"
-                },
-                "value": {
-                  "type": "any"
-                }
-              },
-              "type": "object"
-            },
-            "type": "array"
-          }
-        ],
-        "result": {
-          "type": "any"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "opa.runtime",
-      "decl": {
-        "result": {
-          "dynamic": {
-            "key": {
-              "type": "string"
-            },
-            "value": {
-              "type": "any"
-            }
-          },
-          "type": "object"
-        },
-        "type": "function"
-      },
-      "nondeterministic": true
-    },
-    {
-      "name": "or",
-      "decl": {
-        "args": [
-          {
-            "of": {
-              "type": "any"
-            },
-            "type": "set"
-          },
-          {
-            "of": {
-              "type": "any"
-            },
-            "type": "set"
-          }
-        ],
-        "result": {
-          "of": {
-            "type": "any"
-          },
-          "type": "set"
-        },
-        "type": "function"
-      },
-      "infix": "|"
-    },
-    {
-      "name": "plus",
-      "decl": {
-        "args": [
-          {
-            "type": "number"
-          },
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      },
-      "infix": "+"
-    },
-    {
-      "name": "print",
-      "decl": {
-        "type": "function",
-        "variadic": {
-          "type": "any"
-        }
-      }
-    },
-    {
-      "name": "product",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "dynamic": {
-                  "type": "number"
-                },
-                "type": "array"
-              },
-              {
-                "of": {
-                  "type": "number"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "providers.aws.sign_req",
-      "decl": {
-        "args": [
-          {
-            "dynamic": {
-              "key": {
-                "type": "string"
-              },
-              "value": {
-                "type": "any"
-              }
-            },
-            "type": "object"
-          },
-          {
-            "dynamic": {
-              "key": {
-                "type": "string"
-              },
-              "value": {
-                "type": "any"
-              }
-            },
-            "type": "object"
-          },
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "key": {
-              "type": "any"
-            },
-            "value": {
-              "type": "any"
-            }
-          },
-          "type": "object"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "rand.intn",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      },
-      "nondeterministic": true
-    },
-    {
-      "name": "re_match",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "regex.find_all_string_submatch_n",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          },
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "dynamic": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "regex.find_n",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          },
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "regex.globs_match",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "regex.is_valid",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "regex.match",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "regex.replace",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "regex.split",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "regex.template_match",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "rego.metadata.chain",
-      "decl": {
-        "result": {
-          "dynamic": {
-            "type": "any"
-          },
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "rego.metadata.rule",
-      "decl": {
-        "result": {
-          "type": "any"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "rego.parse_module",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "key": {
-              "type": "string"
-            },
-            "value": {
-              "type": "any"
-            }
-          },
-          "type": "object"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "rem",
-      "decl": {
-        "args": [
-          {
-            "type": "number"
-          },
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      },
-      "infix": "%"
-    },
-    {
-      "name": "replace",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "round",
-      "decl": {
-        "args": [
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "semver.compare",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "semver.is_valid",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "set_diff",
-      "decl": {
-        "args": [
-          {
-            "of": {
-              "type": "any"
-            },
-            "type": "set"
-          },
-          {
-            "of": {
-              "type": "any"
-            },
-            "type": "set"
-          }
-        ],
-        "result": {
-          "of": {
-            "type": "any"
-          },
-          "type": "set"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "sort",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "dynamic": {
-                  "type": "any"
-                },
-                "type": "array"
-              },
-              {
-                "of": {
-                  "type": "any"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "type": "any"
-          },
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "split",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "sprintf",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "dynamic": {
-              "type": "any"
-            },
-            "type": "array"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "startswith",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "strings.any_prefix_match",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "type": "string"
-              },
-              {
-                "dynamic": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              {
-                "of": {
-                  "type": "string"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          },
-          {
-            "of": [
-              {
-                "type": "string"
-              },
-              {
-                "dynamic": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              {
-                "of": {
-                  "type": "string"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "strings.any_suffix_match",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "type": "string"
-              },
-              {
-                "dynamic": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              {
-                "of": {
-                  "type": "string"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          },
-          {
-            "of": [
-              {
-                "type": "string"
-              },
-              {
-                "dynamic": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              {
-                "of": {
-                  "type": "string"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "strings.render_template",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "dynamic": {
-              "key": {
-                "type": "string"
-              },
-              "value": {
-                "type": "any"
-              }
-            },
-            "type": "object"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "strings.replace_n",
-      "decl": {
-        "args": [
-          {
-            "dynamic": {
-              "key": {
-                "type": "string"
-              },
-              "value": {
-                "type": "string"
-              }
-            },
-            "type": "object"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "strings.reverse",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "substring",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "number"
-          },
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "sum",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "dynamic": {
-                  "type": "number"
-                },
-                "type": "array"
-              },
-              {
-                "of": {
-                  "type": "number"
-                },
-                "type": "set"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "time.add_date",
-      "decl": {
-        "args": [
-          {
-            "type": "number"
-          },
-          {
-            "type": "number"
-          },
-          {
-            "type": "number"
-          },
-          {
-            "type": "number"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "time.clock",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "type": "number"
-              },
-              {
-                "static": [
-                  {
-                    "type": "number"
-                  },
-                  {
-                    "type": "string"
-                  }
-                ],
-                "type": "array"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "static": [
-            {
-              "type": "number"
-            },
-            {
-              "type": "number"
-            },
-            {
-              "type": "number"
-            }
-          ],
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "time.date",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "type": "number"
-              },
-              {
-                "static": [
-                  {
-                    "type": "number"
-                  },
-                  {
-                    "type": "string"
-                  }
-                ],
-                "type": "array"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "static": [
-            {
-              "type": "number"
-            },
-            {
-              "type": "number"
-            },
-            {
-              "type": "number"
-            }
-          ],
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "time.diff",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "type": "number"
-              },
-              {
-                "static": [
-                  {
-                    "type": "number"
-                  },
-                  {
-                    "type": "string"
-                  }
-                ],
-                "type": "array"
-              }
-            ],
-            "type": "any"
-          },
-          {
-            "of": [
-              {
-                "type": "number"
-              },
-              {
-                "static": [
-                  {
-                    "type": "number"
-                  },
-                  {
-                    "type": "string"
-                  }
-                ],
-                "type": "array"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "static": [
-            {
-              "type": "number"
-            },
-            {
-              "type": "number"
-            },
-            {
-              "type": "number"
-            },
-            {
-              "type": "number"
-            },
-            {
-              "type": "number"
-            },
-            {
-              "type": "number"
-            }
-          ],
-          "type": "array"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "time.format",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "type": "number"
-              },
-              {
-                "static": [
-                  {
-                    "type": "number"
-                  },
-                  {
-                    "type": "string"
-                  }
-                ],
-                "type": "array"
-              },
-              {
-                "static": [
-                  {
-                    "type": "number"
-                  },
-                  {
-                    "type": "string"
-                  },
-                  {
-                    "type": "string"
-                  }
-                ],
-                "type": "array"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "time.now_ns",
-      "decl": {
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      },
-      "nondeterministic": true
-    },
-    {
-      "name": "time.parse_duration_ns",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "time.parse_ns",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "time.parse_rfc3339_ns",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "time.weekday",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "type": "number"
-              },
-              {
-                "static": [
-                  {
-                    "type": "number"
-                  },
-                  {
-                    "type": "string"
-                  }
-                ],
-                "type": "array"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "to_number",
-      "decl": {
-        "args": [
-          {
-            "of": [
-              {
-                "type": "null"
-              },
-              {
-                "type": "boolean"
-              },
-              {
-                "type": "number"
-              },
-              {
-                "type": "string"
-              }
-            ],
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "trace",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "trim",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "trim_left",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "trim_prefix",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "trim_right",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "trim_space",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "trim_suffix",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "type_name",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "union",
-      "decl": {
-        "args": [
-          {
-            "of": {
-              "of": {
-                "type": "any"
-              },
-              "type": "set"
-            },
-            "type": "set"
-          }
-        ],
-        "result": {
-          "of": {
-            "type": "any"
-          },
-          "type": "set"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "units.parse",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "units.parse_bytes",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "upper",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "urlquery.decode",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "urlquery.decode_object",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "key": {
-              "type": "string"
-            },
-            "value": {
-              "dynamic": {
-                "type": "string"
-              },
-              "type": "array"
-            }
-          },
-          "type": "object"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "urlquery.encode",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "urlquery.encode_object",
-      "decl": {
-        "args": [
-          {
-            "dynamic": {
-              "key": {
-                "type": "string"
-              },
-              "value": {
-                "of": [
-                  {
-                    "type": "string"
-                  },
-                  {
-                    "dynamic": {
-                      "type": "string"
-                    },
-                    "type": "array"
-                  },
-                  {
-                    "of": {
-                      "type": "string"
-                    },
-                    "type": "set"
-                  }
-                ],
-                "type": "any"
-              }
-            },
-            "type": "object"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "uuid.parse",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "dynamic": {
-            "key": {
-              "type": "string"
-            },
-            "value": {
-              "type": "any"
-            }
-          },
-          "type": "object"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "uuid.rfc4122",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      },
-      "nondeterministic": true
-    },
-    {
-      "name": "walk",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "static": [
-            {
-              "dynamic": {
-                "type": "any"
-              },
-              "type": "array"
-            },
-            {
-              "type": "any"
-            }
-          ],
-          "type": "array"
-        },
-        "type": "function"
-      },
-      "relation": true
-    },
-    {
-      "name": "yaml.is_valid",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "boolean"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "yaml.marshal",
-      "decl": {
-        "args": [
-          {
-            "type": "any"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "yaml.unmarshal",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "any"
-        },
-        "type": "function"
-      }
-    }
-  ],
-  "future_keywords": [
-    "contains",
-    "every",
-    "if",
-    "in"
-  ],
-  "wasm_abi_versions": [
-    {
-      "version": 1,
-      "minor_version": 1
-    },
-    {
-      "version": 1,
-      "minor_version": 2
-    }
-  ],
-  "features": [
-    "rule_head_ref_string_prefixes",
-    "rule_head_refs",
-    "rego_v1_import"
-  ]
-}
diff --git a/vendor/github.com/open-policy-agent/opa/format/format.go b/vendor/github.com/open-policy-agent/opa/format/format.go
index 0550f18251c..1736cd3d8c6 100644
--- a/vendor/github.com/open-policy-agent/opa/format/format.go
+++ b/vendor/github.com/open-policy-agent/opa/format/format.go
@@ -26,18 +26,7 @@ type Opts struct {
 	// carry along their original source locations.
 	IgnoreLocations bool
 
-	// RegoV1 is equivalent to setting RegoVersion to ast.RegoV0Compat1.
-	// RegoV1 takes precedence over RegoVersion.
-	// Deprecated: use RegoVersion instead.
-	RegoV1      bool
-	RegoVersion ast.RegoVersion
-}
-
-func (o *Opts) effectiveRegoVersion() ast.RegoVersion {
-	if o.RegoV1 {
-		return ast.RegoV0CompatV1
-	}
-	return o.RegoVersion
+	RegoV1 bool
 }
 
 // defaultLocationFile is the file name used in `Ast()` for terms
@@ -53,19 +42,12 @@ func Source(filename string, src []byte) ([]byte, error) {
 }
 
 func SourceWithOpts(filename string, src []byte, opts Opts) ([]byte, error) {
-	parserOpts := ast.ParserOptions{}
-	if opts.effectiveRegoVersion() == ast.RegoV1 {
-		// If the rego version is V1, wee need to parse it as such, to allow for future keywords not being imported.
-		// Otherwise, we'll default to RegoV0
-		parserOpts.RegoVersion = ast.RegoV1
-	}
-
-	module, err := ast.ParseModuleWithOpts(filename, string(src), parserOpts)
+	module, err := ast.ParseModule(filename, string(src))
 	if err != nil {
 		return nil, err
 	}
 
-	if opts.effectiveRegoVersion() == ast.RegoV0CompatV1 || opts.effectiveRegoVersion() == ast.RegoV1 {
+	if opts.RegoV1 {
 		errors := ast.CheckRegoV1(module)
 		if len(errors) > 0 {
 			return nil, errors
@@ -133,7 +115,7 @@ func AstWithOpts(x interface{}, opts Opts) ([]byte, error) {
 
 	o := fmtOpts{}
 
-	if opts.effectiveRegoVersion() == ast.RegoV0CompatV1 || opts.effectiveRegoVersion() == ast.RegoV1 {
+	if opts.RegoV1 {
 		o.regoV1 = true
 		o.ifs = true
 		o.contains = true
@@ -194,13 +176,10 @@ func AstWithOpts(x interface{}, opts Opts) ([]byte, error) {
 
 	switch x := x.(type) {
 	case *ast.Module:
-		if opts.effectiveRegoVersion() == ast.RegoV1 {
-			x.Imports = filterRegoV1Import(x.Imports)
-		} else if opts.effectiveRegoVersion() == ast.RegoV0CompatV1 {
+		if o.regoV1 {
 			x.Imports = ensureRegoV1Import(x.Imports)
 		}
-
-		if opts.effectiveRegoVersion() == ast.RegoV0CompatV1 || opts.effectiveRegoVersion() == ast.RegoV1 || moduleIsRegoV1Compatible(x) {
+		if o.regoV1 || moduleIsRegoV1Compatible(x) {
 			x.Imports = future.FilterFutureImports(x.Imports)
 		} else {
 			for kw := range extraFutureKeywordImports {
@@ -556,11 +535,7 @@ func (w *writer) writeHead(head *ast.Head, isDefault, isExpandedConst bool, o fm
 		// * a.b.c.d -> a.b.c.d := true
 		isRegoV1RefConst := o.regoV1 && isExpandedConst && head.Key == nil && len(head.Args) == 0
 
-		if len(head.Args) > 0 &&
-			head.Location == head.Value.Location &&
-			head.Name != "else" &&
-			ast.Compare(head.Value, ast.BooleanTerm(true)) == 0 &&
-			!isRegoV1RefConst {
+		if head.Location == head.Value.Location && head.Name != "else" && !isRegoV1RefConst {
 			// If the value location is the same as the location of the head,
 			// we know that the value is generated, i.e. f(1)
 			// Don't print the value (` = true`) as it is implied.
@@ -1469,17 +1444,6 @@ func ensureRegoV1Import(imps []*ast.Import) []*ast.Import {
 	return ensureImport(imps, ast.RegoV1CompatibleRef)
 }
 
-func filterRegoV1Import(imps []*ast.Import) []*ast.Import {
-	var ret []*ast.Import
-	for _, imp := range imps {
-		path := imp.Path.Value.(ast.Ref)
-		if !ast.RegoV1CompatibleRef.Equal(path) {
-			ret = append(ret, imp)
-		}
-	}
-	return ret
-}
-
 func ensureImport(imps []*ast.Import, path ast.Ref) []*ast.Import {
 	for _, imp := range imps {
 		p := imp.Path.Value.(ast.Ref)
diff --git a/vendor/github.com/open-policy-agent/opa/internal/report/report.go b/vendor/github.com/open-policy-agent/opa/internal/report/report.go
deleted file mode 100644
index 145d0a94651..00000000000
--- a/vendor/github.com/open-policy-agent/opa/internal/report/report.go
+++ /dev/null
@@ -1,184 +0,0 @@
-// Copyright 2020 The OPA Authors.  All rights reserved.
-// Use of this source code is governed by an Apache2
-// license that can be found in the LICENSE file.
-
-// Package report provides functions to report OPA's version information to an external service and process the response.
-package report
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"os"
-	"runtime"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/open-policy-agent/opa/keys"
-	"github.com/open-policy-agent/opa/logging"
-
-	"github.com/open-policy-agent/opa/plugins/rest"
-	"github.com/open-policy-agent/opa/util"
-	"github.com/open-policy-agent/opa/version"
-)
-
-// ExternalServiceURL is the base HTTP URL for a telemetry service.
-// If not otherwise specified it will use the hard coded default.
-//
-// Override at build time via:
-//
-//	-ldflags "-X github.com/open-policy-agent/opa/internal/report.ExternalServiceURL=<url>"
-//
-// This will be overridden if the OPA_TELEMETRY_SERVICE_URL environment variable
-// is provided.
-var ExternalServiceURL = "https://telemetry.openpolicyagent.org"
-
-// Reporter reports information such as the version, heap usage about the running OPA instance to an external service
-type Reporter struct {
-	body   map[string]any
-	client rest.Client
-
-	gatherers    map[string]Gatherer
-	gatherersMtx sync.Mutex
-}
-
-// Gatherer represents a mechanism to inject additional data in the telemetry report
-type Gatherer func(ctx context.Context) (any, error)
-
-// DataResponse represents the data returned by the external service
-type DataResponse struct {
-	Latest ReleaseDetails `json:"latest,omitempty"`
-}
-
-// ReleaseDetails holds information about the latest OPA release
-type ReleaseDetails struct {
-	Download      string `json:"download,omitempty"`       // link to download the OPA release
-	ReleaseNotes  string `json:"release_notes,omitempty"`  // link to the OPA release notes
-	LatestRelease string `json:"latest_release,omitempty"` // latest OPA released version
-	OPAUpToDate   bool   `json:"opa_up_to_date,omitempty"` // is running OPA version greater than or equal to the latest released
-}
-
-// Options supplies parameters to the reporter.
-type Options struct {
-	Logger logging.Logger
-}
-
-// New returns an instance of the Reporter
-func New(id string, opts Options) (*Reporter, error) {
-	r := Reporter{
-		gatherers: map[string]Gatherer{},
-	}
-	r.body = map[string]any{
-		"id":      id,
-		"version": version.Version,
-	}
-
-	url := os.Getenv("OPA_TELEMETRY_SERVICE_URL")
-	if url == "" {
-		url = ExternalServiceURL
-	}
-
-	restConfig := []byte(fmt.Sprintf(`{
-		"url": %q,
-	}`, url))
-
-	client, err := rest.New(restConfig, map[string]*keys.Config{}, rest.Logger(opts.Logger))
-	if err != nil {
-		return nil, err
-	}
-	r.client = client
-
-	// heap_usage_bytes is always present, so register it unconditionally
-	r.RegisterGatherer("heap_usage_bytes", readRuntimeMemStats)
-
-	return &r, nil
-}
-
-// SendReport sends the telemetry report which includes information such as the OPA version, current memory usage to
-// the external service
-func (r *Reporter) SendReport(ctx context.Context) (*DataResponse, error) {
-	rCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
-	defer cancel()
-
-	r.gatherersMtx.Lock()
-	defer r.gatherersMtx.Unlock()
-	for key, g := range r.gatherers {
-		var err error
-		r.body[key], err = g(rCtx)
-		if err != nil {
-			return nil, fmt.Errorf("gather telemetry error for key %s: %w", key, err)
-		}
-	}
-
-	resp, err := r.client.WithJSON(r.body).Do(rCtx, "POST", "/v1/version")
-	if err != nil {
-		return nil, err
-	}
-
-	defer util.Close(resp)
-
-	switch resp.StatusCode {
-	case http.StatusOK:
-		if resp.Body != nil {
-			var result DataResponse
-			err := json.NewDecoder(resp.Body).Decode(&result)
-			if err != nil {
-				return nil, err
-			}
-			return &result, nil
-		}
-		return nil, nil
-	default:
-		return nil, fmt.Errorf("server replied with HTTP %v", resp.StatusCode)
-	}
-}
-
-func (r *Reporter) RegisterGatherer(key string, f Gatherer) {
-	r.gatherersMtx.Lock()
-	r.gatherers[key] = f
-	r.gatherersMtx.Unlock()
-}
-
-// IsSet returns true if dr is populated.
-func (dr *DataResponse) IsSet() bool {
-	return dr != nil && dr.Latest.LatestRelease != "" && dr.Latest.Download != "" && dr.Latest.ReleaseNotes != ""
-}
-
-// Slice returns the dr as a slice of key-value string pairs. If dr is nil, this function returns an empty slice.
-func (dr *DataResponse) Slice() [][2]string {
-
-	if !dr.IsSet() {
-		return nil
-	}
-
-	return [][2]string{
-		{"Latest Upstream Version", strings.TrimPrefix(dr.Latest.LatestRelease, "v")},
-		{"Download", dr.Latest.Download},
-		{"Release Notes", dr.Latest.ReleaseNotes},
-	}
-}
-
-// Pretty returns OPA release information in a human-readable format.
-func (dr *DataResponse) Pretty() string {
-	if !dr.IsSet() {
-		return ""
-	}
-
-	pairs := dr.Slice()
-	lines := make([]string, 0, len(pairs))
-
-	for _, pair := range pairs {
-		lines = append(lines, fmt.Sprintf("%v: %v", pair[0], pair[1]))
-	}
-
-	return strings.Join(lines, "\n")
-}
-
-func readRuntimeMemStats(_ context.Context) (any, error) {
-	var m runtime.MemStats
-	runtime.ReadMemStats(&m)
-	return strconv.FormatUint(m.Alloc, 10), nil
-}
diff --git a/vendor/github.com/open-policy-agent/opa/internal/runtime/init/init.go b/vendor/github.com/open-policy-agent/opa/internal/runtime/init/init.go
index ba316efcb85..bd72e1bd0c8 100644
--- a/vendor/github.com/open-policy-agent/opa/internal/runtime/init/init.go
+++ b/vendor/github.com/open-policy-agent/opa/internal/runtime/init/init.go
@@ -122,18 +122,6 @@ func LoadPaths(paths []string,
 	processAnnotations bool,
 	caps *ast.Capabilities,
 	fsys fs.FS) (*LoadPathsResult, error) {
-	return LoadPathsForRegoVersion(ast.RegoV0, paths, filter, asBundle, bvc, skipVerify, processAnnotations, caps, fsys)
-}
-
-func LoadPathsForRegoVersion(regoVersion ast.RegoVersion,
-	paths []string,
-	filter loader.Filter,
-	asBundle bool,
-	bvc *bundle.VerificationConfig,
-	skipVerify bool,
-	processAnnotations bool,
-	caps *ast.Capabilities,
-	fsys fs.FS) (*LoadPathsResult, error) {
 
 	if caps == nil {
 		caps = ast.CapabilitiesForThisVersion()
@@ -158,7 +146,6 @@ func LoadPathsForRegoVersion(regoVersion ast.RegoVersion,
 				WithFilter(filter).
 				WithProcessAnnotation(processAnnotations).
 				WithCapabilities(caps).
-				WithRegoVersion(regoVersion).
 				AsBundle(path)
 			if err != nil {
 				return nil, err
@@ -174,7 +161,6 @@ func LoadPathsForRegoVersion(regoVersion ast.RegoVersion,
 		WithFS(fsys).
 		WithProcessAnnotation(processAnnotations).
 		WithCapabilities(caps).
-		WithRegoVersion(regoVersion).
 		Filtered(nonBundlePaths, filter)
 
 	if err != nil {
diff --git a/vendor/github.com/open-policy-agent/opa/loader/loader.go b/vendor/github.com/open-policy-agent/opa/loader/loader.go
index 2960cababb3..7b3eac40a57 100644
--- a/vendor/github.com/open-policy-agent/opa/loader/loader.go
+++ b/vendor/github.com/open-policy-agent/opa/loader/loader.go
@@ -103,11 +103,7 @@ type FileLoader interface {
 	WithCapabilities(*ast.Capabilities) FileLoader
 	WithJSONOptions(*astJSON.Options) FileLoader
 
-	// WithRegoV1Compatible
-	// Deprecated: use WithRegoVersion instead
 	WithRegoV1Compatible(bool) FileLoader
-
-	WithRegoVersion(ast.RegoVersion) FileLoader
 }
 
 // NewFileLoader returns a new FileLoader instance.
@@ -187,20 +183,11 @@ func (fl *fileLoader) WithJSONOptions(opts *astJSON.Options) FileLoader {
 	return fl
 }
 
-// WithRegoV1Compatible enforces Rego v0 with Rego v1 compatibility.
-// See ParserOptions.RegoV1Compatible for more details.
-// Deprecated: use WithRegoVersion instead
 func (fl *fileLoader) WithRegoV1Compatible(compatible bool) FileLoader {
 	fl.opts.RegoV1Compatible = compatible
 	return fl
 }
 
-// WithRegoVersion sets the ast.RegoVersion to use when parsing and compiling modules.
-func (fl *fileLoader) WithRegoVersion(version ast.RegoVersion) FileLoader {
-	fl.opts.RegoVersion = version
-	return fl
-}
-
 // All returns a Result object loaded (recursively) from the specified paths.
 func (fl fileLoader) All(paths []string) (*Result, error) {
 	return fl.Filtered(paths, nil)
@@ -269,8 +256,7 @@ func (fl fileLoader) AsBundle(path string) (*bundle.Bundle, error) {
 		WithSkipBundleVerification(fl.skipVerify).
 		WithProcessAnnotations(fl.opts.ProcessAnnotation).
 		WithCapabilities(fl.opts.Capabilities).
-		WithJSONOptions(fl.opts.JSONOptions).
-		WithRegoVersion(fl.opts.EffectiveRegoVersion())
+		WithJSONOptions(fl.opts.JSONOptions)
 
 	// For bundle directories add the full path in front of module file names
 	// to simplify debugging.
@@ -720,7 +706,7 @@ func loadKnownTypes(path string, bs []byte, m metrics.Metrics, opts ast.ParserOp
 		return loadYAML(path, bs, m)
 	default:
 		if strings.HasSuffix(path, ".tar.gz") {
-			r, err := loadBundleFile(path, bs, m, opts)
+			r, err := loadBundleFile(path, bs, m)
 			if err != nil {
 				err = fmt.Errorf("bundle %s: %w", path, err)
 			}
@@ -746,15 +732,9 @@ func loadFileForAnyType(path string, bs []byte, m metrics.Metrics, opts ast.Pars
 	return nil, unrecognizedFile(path)
 }
 
-func loadBundleFile(path string, bs []byte, m metrics.Metrics, opts ast.ParserOptions) (bundle.Bundle, error) {
+func loadBundleFile(path string, bs []byte, m metrics.Metrics) (bundle.Bundle, error) {
 	tl := bundle.NewTarballLoaderWithBaseURL(bytes.NewBuffer(bs), path)
-	br := bundle.NewCustomReader(tl).
-		WithRegoVersion(opts.RegoVersion).
-		WithJSONOptions(opts.JSONOptions).
-		WithProcessAnnotations(opts.ProcessAnnotation).
-		WithMetrics(m).
-		WithSkipBundleVerification(true).
-		IncludeManifestInData(true)
+	br := bundle.NewCustomReader(tl).WithMetrics(m).WithSkipBundleVerification(true).IncludeManifestInData(true)
 	return br.Read()
 }
 
diff --git a/vendor/github.com/open-policy-agent/opa/plugins/plugins.go b/vendor/github.com/open-policy-agent/opa/plugins/plugins.go
index 7bd47075e9c..830da78bdc1 100644
--- a/vendor/github.com/open-policy-agent/opa/plugins/plugins.go
+++ b/vendor/github.com/open-policy-agent/opa/plugins/plugins.go
@@ -8,11 +8,9 @@ package plugins
 import (
 	"context"
 	"fmt"
-	mr "math/rand"
 	"sync"
 	"time"
 
-	"github.com/open-policy-agent/opa/internal/report"
 	"github.com/prometheus/client_golang/prometheus"
 	"go.opentelemetry.io/otel/sdk/trace"
 
@@ -150,9 +148,6 @@ const (
 	DefaultTriggerMode TriggerMode = "periodic"
 )
 
-// default interval between OPA report uploads
-var defaultUploadIntervalSec = int64(3600)
-
 // Status has a Plugin's current status plus an optional Message.
 type Status struct {
 	State   State  `json:"state"`
@@ -203,13 +198,8 @@ type Manager struct {
 	tracerProvider               *trace.TracerProvider
 	distributedTacingOpts        tracing.Options
 	registeredNDCacheTriggers    []func(bool)
-	registeredTelemetryGatherers map[string]report.Gatherer
 	bootstrapConfigLabels        map[string]string
 	hooks                        hooks.Hooks
-	enableTelemetry              bool
-	reporter                     *report.Reporter
-	opaReportNotifyCh            chan struct{}
-	stop                         chan chan struct{}
 }
 
 type managerContextKey string
@@ -395,21 +385,6 @@ func WithHooks(hs hooks.Hooks) func(*Manager) {
 	}
 }
 
-// WithEnableTelemetry controls whether OPA will send telemetry reports to an external service.
-func WithEnableTelemetry(enableTelemetry bool) func(*Manager) {
-	return func(m *Manager) {
-		m.enableTelemetry = enableTelemetry
-	}
-}
-
-// WithTelemetryGatherers allows registration of telemetry gatherers which enable injection of additional data in the
-// telemetry report
-func WithTelemetryGatherers(gs map[string]report.Gatherer) func(*Manager) {
-	return func(m *Manager) {
-		m.registeredTelemetryGatherers = gs
-	}
-}
-
 // New creates a new Manager using config.
 func New(raw []byte, id string, store storage.Store, opts ...func(*Manager)) (*Manager, error) {
 
@@ -478,27 +453,6 @@ func New(raw []byte, id string, store storage.Store, opts ...func(*Manager)) (*M
 		return nil, err
 	}
 
-	if m.enableTelemetry {
-		reporter, err := report.New(id, report.Options{Logger: m.logger})
-		if err != nil {
-			return nil, err
-		}
-		m.reporter = reporter
-
-		m.reporter.RegisterGatherer("min_compatible_version", func(_ context.Context) (any, error) {
-			var minimumCompatibleVersion string
-			if m.compiler != nil && m.compiler.Required != nil {
-				minimumCompatibleVersion, _ = m.compiler.Required.MinimumCompatibleVersion()
-			}
-			return minimumCompatibleVersion, nil
-		})
-
-		// register any additional gatherers
-		for k, g := range m.registeredTelemetryGatherers {
-			m.reporter.RegisterGatherer(k, g)
-		}
-	}
-
 	return m, nil
 }
 
@@ -515,12 +469,6 @@ func (m *Manager) Init(ctx context.Context) error {
 		Context: storage.NewContext(),
 	}
 
-	if m.enableTelemetry {
-		m.opaReportNotifyCh = make(chan struct{})
-		m.stop = make(chan chan struct{})
-		go m.sendOPAUpdateLoop(ctx)
-	}
-
 	err := storage.Txn(ctx, m.Store, params, func(txn storage.Transaction) error {
 
 		result, err := initload.InsertAndCompile(ctx, initload.InsertAndCompileOptions{
@@ -549,12 +497,6 @@ func (m *Manager) Init(ctx context.Context) error {
 	})
 
 	if err != nil {
-		if m.stop != nil {
-			done := make(chan struct{})
-			m.stop <- done
-			<-done
-		}
-
 		return err
 	}
 
@@ -731,12 +673,6 @@ func (m *Manager) Stop(ctx context.Context) {
 			m.logger.Error("Error closing store: %v", err)
 		}
 	}
-
-	if m.stop != nil {
-		done := make(chan struct{})
-		m.stop <- done
-		<-done
-	}
 }
 
 // Reconfigure updates the configuration on the manager.
@@ -881,11 +817,6 @@ func (m *Manager) onCommit(ctx context.Context, txn storage.Transaction, event s
 
 	if compiler != nil {
 		m.setCompiler(compiler)
-
-		if m.enableTelemetry && event.PolicyChanged() {
-			m.opaReportNotifyCh <- struct{}{}
-		}
-
 		for _, f := range m.registeredTriggers {
 			f(txn)
 		}
@@ -1051,37 +982,3 @@ func (m *Manager) RegisterNDCacheTrigger(trigger func(bool)) {
 	defer m.mtx.Unlock()
 	m.registeredNDCacheTriggers = append(m.registeredNDCacheTriggers, trigger)
 }
-
-func (m *Manager) sendOPAUpdateLoop(ctx context.Context) {
-	ticker := time.NewTicker(time.Duration(int64(time.Second) * defaultUploadIntervalSec))
-	mr.New(mr.NewSource(time.Now().UnixNano()))
-
-	ctx, cancel := context.WithCancel(ctx)
-
-	var opaReportNotify bool
-
-	for {
-		select {
-		case <-m.opaReportNotifyCh:
-			opaReportNotify = true
-		case <-ticker.C:
-			ticker.Stop()
-
-			if opaReportNotify {
-				opaReportNotify = false
-				_, err := m.reporter.SendReport(ctx)
-				if err != nil {
-					m.logger.WithFields(map[string]interface{}{"err": err}).Debug("Unable to send OPA telemetry report.")
-				}
-			}
-
-			newInterval := mr.Int63n(defaultUploadIntervalSec) + defaultUploadIntervalSec
-			ticker = time.NewTicker(time.Duration(int64(time.Second) * newInterval))
-		case done := <-m.stop:
-			cancel()
-			ticker.Stop()
-			done <- struct{}{}
-			return
-		}
-	}
-}
diff --git a/vendor/github.com/open-policy-agent/opa/rego/rego.go b/vendor/github.com/open-policy-agent/opa/rego/rego.go
index 17873e380a6..321dd7e4449 100644
--- a/vendor/github.com/open-policy-agent/opa/rego/rego.go
+++ b/vendor/github.com/open-policy-agent/opa/rego/rego.go
@@ -594,13 +594,11 @@ type Rego struct {
 	pluginMgr              *plugins.Manager
 	plugins                []TargetPlugin
 	targetPrepState        TargetPluginEval
-	regoVersion            ast.RegoVersion
 }
 
 // Function represents a built-in function that is callable in Rego.
 type Function struct {
 	Name             string
-	Description      string
 	Decl             *types.Function
 	Memoize          bool
 	Nondeterministic bool
@@ -631,7 +629,6 @@ type (
 func RegisterBuiltin1(decl *Function, impl Builtin1) {
 	ast.RegisterBuiltin(&ast.Builtin{
 		Name:             decl.Name,
-		Description:      decl.Description,
 		Decl:             decl.Decl,
 		Nondeterministic: decl.Nondeterministic,
 	})
@@ -645,7 +642,6 @@ func RegisterBuiltin1(decl *Function, impl Builtin1) {
 func RegisterBuiltin2(decl *Function, impl Builtin2) {
 	ast.RegisterBuiltin(&ast.Builtin{
 		Name:             decl.Name,
-		Description:      decl.Description,
 		Decl:             decl.Decl,
 		Nondeterministic: decl.Nondeterministic,
 	})
@@ -659,7 +655,6 @@ func RegisterBuiltin2(decl *Function, impl Builtin2) {
 func RegisterBuiltin3(decl *Function, impl Builtin3) {
 	ast.RegisterBuiltin(&ast.Builtin{
 		Name:             decl.Name,
-		Description:      decl.Description,
 		Decl:             decl.Decl,
 		Nondeterministic: decl.Nondeterministic,
 	})
@@ -673,7 +668,6 @@ func RegisterBuiltin3(decl *Function, impl Builtin3) {
 func RegisterBuiltin4(decl *Function, impl Builtin4) {
 	ast.RegisterBuiltin(&ast.Builtin{
 		Name:             decl.Name,
-		Description:      decl.Description,
 		Decl:             decl.Decl,
 		Nondeterministic: decl.Nondeterministic,
 	})
@@ -687,7 +681,6 @@ func RegisterBuiltin4(decl *Function, impl Builtin4) {
 func RegisterBuiltinDyn(decl *Function, impl BuiltinDyn) {
 	ast.RegisterBuiltin(&ast.Builtin{
 		Name:             decl.Name,
-		Description:      decl.Description,
 		Decl:             decl.Decl,
 		Nondeterministic: decl.Nondeterministic,
 	})
@@ -1194,12 +1187,6 @@ func Strict(yes bool) func(r *Rego) {
 	}
 }
 
-func SetRegoVersion(version ast.RegoVersion) func(r *Rego) {
-	return func(r *Rego) {
-		r.regoVersion = version
-	}
-}
-
 // New returns a new Rego object.
 func New(options ...func(r *Rego)) *Rego {
 
@@ -1810,7 +1797,7 @@ func (r *Rego) parseModules(ctx context.Context, txn storage.Transaction, m metr
 			return err
 		}
 
-		parsed, err := ast.ParseModuleWithOpts(id, string(bs), ast.ParserOptions{RegoVersion: r.regoVersion})
+		parsed, err := ast.ParseModule(id, string(bs))
 		if err != nil {
 			errs = append(errs, err)
 		}
@@ -1820,7 +1807,7 @@ func (r *Rego) parseModules(ctx context.Context, txn storage.Transaction, m metr
 
 	// Parse any passed in as arguments to the Rego object
 	for _, module := range r.modules {
-		p, err := module.ParseWithOpts(ast.ParserOptions{RegoVersion: r.regoVersion})
+		p, err := module.Parse()
 		if err != nil {
 			switch errorWithType := err.(type) {
 			case ast.Errors:
@@ -1852,7 +1839,6 @@ func (r *Rego) loadFiles(ctx context.Context, txn storage.Transaction, m metrics
 	result, err := loader.NewFileLoader().
 		WithMetrics(m).
 		WithProcessAnnotation(true).
-		WithRegoVersion(r.regoVersion).
 		Filtered(r.loadPaths.paths, r.loadPaths.filter)
 	if err != nil {
 		return err
@@ -1883,7 +1869,6 @@ func (r *Rego) loadBundles(ctx context.Context, txn storage.Transaction, m metri
 			WithMetrics(m).
 			WithProcessAnnotation(true).
 			WithSkipBundleVerification(r.skipBundleVerification).
-			WithRegoVersion(r.regoVersion).
 			AsBundle(path)
 		if err != nil {
 			return fmt.Errorf("loading error: %s", err)
@@ -1949,14 +1934,13 @@ func (r *Rego) compileModules(ctx context.Context, txn storage.Transaction, m me
 		// Use this as the single-point of compiling everything only a
 		// single time.
 		opts := &bundle.ActivateOpts{
-			Ctx:           ctx,
-			Store:         r.store,
-			Txn:           txn,
-			Compiler:      r.compilerForTxn(ctx, r.store, txn),
-			Metrics:       m,
-			Bundles:       r.bundles,
-			ExtraModules:  r.parsedModules,
-			ParserOptions: ast.ParserOptions{RegoVersion: r.regoVersion},
+			Ctx:          ctx,
+			Store:        r.store,
+			Txn:          txn,
+			Compiler:     r.compilerForTxn(ctx, r.store, txn),
+			Metrics:      m,
+			Bundles:      r.bundles,
+			ExtraModules: r.parsedModules,
 		}
 		err := bundle.Activate(opts)
 		if err != nil {
@@ -2624,10 +2608,6 @@ func (m rawModule) Parse() (*ast.Module, error) {
 	return ast.ParseModule(m.filename, m.module)
 }
 
-func (m rawModule) ParseWithOpts(opts ast.ParserOptions) (*ast.Module, error) {
-	return ast.ParseModuleWithOpts(m.filename, m.module, opts)
-}
-
 type extraStage struct {
 	after string
 	stage ast.QueryCompilerStageDefinition
diff --git a/vendor/github.com/open-policy-agent/opa/topdown/providers.go b/vendor/github.com/open-policy-agent/opa/topdown/providers.go
index 113281b0f9d..0b9e012268f 100644
--- a/vendor/github.com/open-policy-agent/opa/topdown/providers.go
+++ b/vendor/github.com/open-policy-agent/opa/topdown/providers.go
@@ -172,21 +172,10 @@ func builtinAWSSigV4SignReq(ctx BuiltinContext, operands []*ast.Term, iter func(
 	}
 
 	// Sign the request object's headers, and reconstruct the headers map.
-	headersMap := objectToMap(headers)
-	authHeader, awsHeadersMap := aws.SignV4(headersMap, method, theURL, body, service, awsCreds, signingTimestamp)
+	authHeader, signedHeadersMap := aws.SignV4(objectToMap(headers), method, theURL, body, service, awsCreds, signingTimestamp)
 	signedHeadersObj := ast.NewObject()
-	// Restore original headers
-	for k, v := range headersMap {
-		// objectToMap doesn't support arrays
-		if len(v) == 1 {
-			signedHeadersObj.Insert(ast.StringTerm(k), ast.StringTerm(v[0]))
-		}
-	}
-	// Set authorization header
 	signedHeadersObj.Insert(ast.StringTerm("Authorization"), ast.StringTerm(authHeader))
-
-	// set aws signature headers
-	for k, v := range awsHeadersMap {
+	for k, v := range signedHeadersMap {
 		signedHeadersObj.Insert(ast.StringTerm(k), ast.StringTerm(v))
 	}
 
diff --git a/vendor/github.com/open-policy-agent/opa/version/version.go b/vendor/github.com/open-policy-agent/opa/version/version.go
index 0fcbba17eb0..6fc4766fdc9 100644
--- a/vendor/github.com/open-policy-agent/opa/version/version.go
+++ b/vendor/github.com/open-policy-agent/opa/version/version.go
@@ -11,7 +11,7 @@ import (
 )
 
 // Version is the canonical version of OPA.
-var Version = "0.60.0"
+var Version = "0.59.0"
 
 // GoVersion is the version of Go this was built with
 var GoVersion = runtime.Version()
diff --git a/vendor/github.com/sergi/go-diff/diffmatchpatch/diff.go b/vendor/github.com/sergi/go-diff/diffmatchpatch/diff.go
index 4f7b42488aa..2a9f2dc3b94 100644
--- a/vendor/github.com/sergi/go-diff/diffmatchpatch/diff.go
+++ b/vendor/github.com/sergi/go-diff/diffmatchpatch/diff.go
@@ -1313,17 +1313,17 @@ func (dmp *DiffMatchPatch) diffLinesToStrings(text1, text2 string) (string, stri
 	// '\x00' is a valid character, but various debuggers don't like it. So we'll insert a junk entry to avoid generating a null character.
 	lineArray := []string{""} // e.g. lineArray[4] == 'Hello\n'
 
-	lineHash := make(map[string]int)
 	//Each string has the index of lineArray which it points to
-	strIndexArray1 := dmp.diffLinesToStringsMunge(text1, &lineArray, lineHash)
-	strIndexArray2 := dmp.diffLinesToStringsMunge(text2, &lineArray, lineHash)
+	strIndexArray1 := dmp.diffLinesToStringsMunge(text1, &lineArray)
+	strIndexArray2 := dmp.diffLinesToStringsMunge(text2, &lineArray)
 
 	return intArrayToString(strIndexArray1), intArrayToString(strIndexArray2), lineArray
 }
 
 // diffLinesToStringsMunge splits a text into an array of strings, and reduces the texts to a []string.
-func (dmp *DiffMatchPatch) diffLinesToStringsMunge(text string, lineArray *[]string, lineHash map[string]int) []uint32 {
+func (dmp *DiffMatchPatch) diffLinesToStringsMunge(text string, lineArray *[]string) []uint32 {
 	// Walk the text, pulling out a substring for each line. text.split('\n') would would temporarily double our memory footprint. Modifying text would create many large strings to garbage collect.
+	lineHash := map[string]int{} // e.g. lineHash['Hello\n'] == 4
 	lineStart := 0
 	lineEnd := -1
 	strs := []uint32{}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index afbeadac32a..ba1b458723f 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -362,7 +362,7 @@ github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1
 github.com/cs3org/go-cs3apis/cs3/storage/registry/v1beta1
 github.com/cs3org/go-cs3apis/cs3/tx/v1beta1
 github.com/cs3org/go-cs3apis/cs3/types/v1beta1
-# github.com/cs3org/reva/v2 v2.17.1-0.20231220115644-93b4dd91a8b3
+# github.com/cs3org/reva/v2 v2.17.1-0.20231219093515-da04bc32d9fb
 ## explicit; go 1.21
 github.com/cs3org/reva/v2/cmd/revad/internal/grace
 github.com/cs3org/reva/v2/cmd/revad/runtime
@@ -1482,7 +1482,7 @@ github.com/onsi/gomega/matchers/support/goraph/edge
 github.com/onsi/gomega/matchers/support/goraph/node
 github.com/onsi/gomega/matchers/support/goraph/util
 github.com/onsi/gomega/types
-# github.com/open-policy-agent/opa v0.60.0
+# github.com/open-policy-agent/opa v0.59.0
 ## explicit; go 1.19
 github.com/open-policy-agent/opa/ast
 github.com/open-policy-agent/opa/ast/internal/scanner
@@ -1531,7 +1531,6 @@ github.com/open-policy-agent/opa/internal/providers/aws/crypto
 github.com/open-policy-agent/opa/internal/providers/aws/v4
 github.com/open-policy-agent/opa/internal/ref
 github.com/open-policy-agent/opa/internal/rego/opa
-github.com/open-policy-agent/opa/internal/report
 github.com/open-policy-agent/opa/internal/runtime/init
 github.com/open-policy-agent/opa/internal/semver
 github.com/open-policy-agent/opa/internal/strings
@@ -1676,7 +1675,7 @@ github.com/russross/blackfriday/v2
 # github.com/segmentio/ksuid v1.0.4
 ## explicit; go 1.12
 github.com/segmentio/ksuid
-# github.com/sergi/go-diff v1.3.1
+# github.com/sergi/go-diff v1.2.0
 ## explicit; go 1.12
 github.com/sergi/go-diff/diffmatchpatch
 # github.com/sethvargo/go-password v0.2.0


Test patch:
diff --git a/services/graph/pkg/identity/ldap_group_test.go b/services/graph/pkg/identity/ldap_group_test.go
index bb7adfa9f35..79431d4760f 100644
--- a/services/graph/pkg/identity/ldap_group_test.go
+++ b/services/graph/pkg/identity/ldap_group_test.go
@@ -6,7 +6,6 @@ import (
 	"net/url"
 	"testing"
 
-	"github.com/CiscoM31/godata"
 	"github.com/go-ldap/ldap/v3"
 	"github.com/owncloud/ocis/v2/services/graph/mocks"
 	"github.com/stretchr/testify/assert"
@@ -220,19 +219,15 @@ func TestGetGroupReadOnlySubtree(t *testing.T) {
 
 func TestGetGroups(t *testing.T) {
 	lm := &mocks.Client{}
-	oDataReq, err := godata.ParseRequest(context.Background(), "", url.Values{})
-	if err != nil {
-		t.Errorf("Expected success, got '%s'", err.Error())
-	}
 	lm.On("Search", mock.Anything).Return(nil, ldap.NewError(ldap.LDAPResultOperationsError, errors.New("mock")))
 	b, _ := getMockedBackend(lm, lconfig, &logger)
-	_, err = b.GetGroups(context.Background(), oDataReq)
+	_, err := b.GetGroups(context.Background(), url.Values{})
 	assert.ErrorContains(t, err, "itemNotFound:")
 
 	lm = &mocks.Client{}
 	lm.On("Search", mock.Anything).Return(&ldap.SearchResult{}, nil)
 	b, _ = getMockedBackend(lm, lconfig, &logger)
-	g, err := b.GetGroups(context.Background(), oDataReq)
+	g, err := b.GetGroups(context.Background(), url.Values{})
 	if err != nil {
 		t.Errorf("Expected success, got '%s'", err.Error())
 	} else if g == nil || len(g) != 0 {
@@ -244,7 +239,7 @@ func TestGetGroups(t *testing.T) {
 		Entries: []*ldap.Entry{groupEntry},
 	}, nil)
 	b, _ = getMockedBackend(lm, lconfig, &logger)
-	g, err = b.GetGroups(context.Background(), oDataReq)
+	g, err = b.GetGroups(context.Background(), url.Values{})
 	if err != nil {
 		t.Errorf("Expected GetGroup to succeed. Got %s", err.Error())
 	} else if *g[0].Id != groupEntry.GetEqualFoldAttributeValue(b.groupAttributeMap.id) {
@@ -269,15 +264,11 @@ func TestGetGroups(t *testing.T) {
 	}
 
 	for _, param := range []url.Values{queryParamSelect, queryParamExpand} {
-		oDataReq, err := godata.ParseRequest(context.Background(), "", param)
-		if err != nil {
-			t.Errorf("Expected success, got '%s'", err.Error())
-		}
 		lm.On("Search", groupListSeachRequest).Return(&ldap.SearchResult{Entries: []*ldap.Entry{groupEntry}}, nil)
 		lm.On("Search", sr2).Return(&ldap.SearchResult{Entries: []*ldap.Entry{userEntry}}, nil)
 		lm.On("Search", sr3).Return(&ldap.SearchResult{Entries: []*ldap.Entry{invalidUserEntry}}, nil)
 		b, _ = getMockedBackend(lm, lconfig, &logger)
-		g, err = b.GetGroups(context.Background(), oDataReq)
+		g, err = b.GetGroups(context.Background(), param)
 		switch {
 		case err != nil:
 			t.Errorf("Expected GetGroup to succeed. Got %s", err.Error())
@@ -290,32 +281,6 @@ func TestGetGroups(t *testing.T) {
 		}
 	}
 }
-
-func TestGetGroupsSearch(t *testing.T) {
-	lm := &mocks.Client{}
-	odataReqDefault, err := godata.ParseRequest(context.Background(), "",
-		url.Values{
-			"$search": []string{"\"term\""},
-		},
-	)
-	if err != nil {
-		t.Errorf("Expected success got '%s'", err.Error())
-	}
-
-	// only match if the filter contains the search term unquoted
-	lm.On("Search", mock.MatchedBy(
-		func(req *ldap.SearchRequest) bool {
-			return req.Filter == "(&(objectClass=groupOfNames)(|(cn=*term*)(entryUUID=*term*)))"
-		})).
-		Return(&ldap.SearchResult{}, nil)
-	b, _ := getMockedBackend(lm, lconfig, &logger)
-	g, err := b.GetGroups(context.Background(), odataReqDefault)
-	if err != nil {
-		t.Errorf("Expected success, got '%s'", err.Error())
-	} else if g == nil || len(g) != 0 {
-		t.Errorf("Expected zero length user slice")
-	}
-}
 func TestUpdateGroupName(t *testing.T) {
 	groupDn := "cn=TheGroup,ou=groups,dc=owncloud,dc=com"
 
diff --git a/services/graph/pkg/identity/ldap_test.go b/services/graph/pkg/identity/ldap_test.go
index 3d95795426c..908862f8197 100644
--- a/services/graph/pkg/identity/ldap_test.go
+++ b/services/graph/pkg/identity/ldap_test.go
@@ -286,32 +286,6 @@ func TestGetUsers(t *testing.T) {
 	}
 }
 
-func TestGetUsersSearch(t *testing.T) {
-	lm := &mocks.Client{}
-	odataReqDefault, err := godata.ParseRequest(context.Background(), "",
-		url.Values{
-			"$search": []string{"\"term\""},
-		},
-	)
-	if err != nil {
-		t.Errorf("Expected success got '%s'", err.Error())
-	}
-
-	// only match if the filter contains the search term unquoted
-	lm.On("Search", mock.MatchedBy(
-		func(req *ldap.SearchRequest) bool {
-			return req.Filter == "(&(objectClass=inetOrgPerson)(|(uid=*term*)(mail=*term*)(displayname=*term*)))"
-		})).
-		Return(&ldap.SearchResult{}, nil)
-	b, _ := getMockedBackend(lm, lconfig, &logger)
-	g, err := b.GetUsers(context.Background(), odataReqDefault)
-	if err != nil {
-		t.Errorf("Expected success, got '%s'", err.Error())
-	} else if g == nil || len(g) != 0 {
-		t.Errorf("Expected zero length user slice")
-	}
-}
-
 func TestUpdateUser(t *testing.T) {
 	falseBool := false
 	trueBool := true
diff --git a/services/graph/pkg/service/v0/groups_test.go b/services/graph/pkg/service/v0/groups_test.go
index 1ce23af4446..d8aab638466 100644
--- a/services/graph/pkg/service/v0/groups_test.go
+++ b/services/graph/pkg/service/v0/groups_test.go
@@ -225,13 +225,6 @@ var _ = Describe("Groups", func() {
 
 			Expect(rr.Code).To(Equal(http.StatusForbidden))
 		})
-		It("denies using to short quoted search terms for unprivileged users", func() {
-			permissionService.On("GetPermissionByID", mock.Anything, mock.Anything).Return(&settings.GetPermissionByIDResponse{}, nil)
-			r := httptest.NewRequest(http.MethodGet, "/graph/v1.0/groups?$search=%22ab%22", nil)
-			svc.GetGroups(rr, r)
-
-			Expect(rr.Code).To(Equal(http.StatusForbidden))
-		})
 		It("only returns a restricted set of attributes for unprivileged users", func() {
 			permissionService.On("GetPermissionByID", mock.Anything, mock.Anything).Return(&settings.GetPermissionByIDResponse{}, nil)
 			group := &libregraph.Group{}
diff --git a/services/graph/pkg/service/v0/users_test.go b/services/graph/pkg/service/v0/users_test.go
index 20bc10aa5d8..4cc9561e268 100644
--- a/services/graph/pkg/service/v0/users_test.go
+++ b/services/graph/pkg/service/v0/users_test.go
@@ -278,13 +278,6 @@ var _ = Describe("Users", func() {
 
 			Expect(rr.Code).To(Equal(http.StatusForbidden))
 		})
-		It("denies using to short quoted search terms for unprivileged users", func() {
-			permissionService.On("GetPermissionByID", mock.Anything, mock.Anything).Return(&settings.GetPermissionByIDResponse{}, nil)
-			r := httptest.NewRequest(http.MethodGet, "/graph/v1.0/users?$search=%22ab%22", nil)
-			svc.GetUsers(rr, r)
-
-			Expect(rr.Code).To(Equal(http.StatusForbidden))
-		})
 		It("only returns a restricted set of attributes for unprivileged users", func() {
 			permissionService.On("GetPermissionByID", mock.Anything, mock.Anything).Return(&settings.GetPermissionByIDResponse{}, nil)
 			user := &libregraph.User{}