update vendor

Signed-off-by: Ronni Skansing <rskansing@gmail.com>

backend/vendor/github.com/wneessen/go-mail/REUSE.toml

@@ -0,0 +1,14 @@
+# SPDX-FileCopyrightText: Copyright (c) The go-mail Authors
+#
+# SPDX-License-Identifier: MIT
+
+version = 1
+SPDX-PackageName = "go-mail"
+SPDX-PackageSupplier = "The go-mail Authors"
+SPDX-PackageDownloadLocation = "https://github.com/wneessen/go-mail"
+
+[[annotations]]
+path = ["testdata/**"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "The go-mail Authors"
+SPDX-License-Identifier = "MIT"

backend/vendor/github.com/wneessen/go-mail/eml.go

@@ -0,0 +1,601 @@
+// SPDX-FileCopyrightText: The go-mail Authors
+//
+// SPDX-License-Identifier: MIT
+
+package mail
+
+import (
+	"bytes"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"io"
+	"mime"
+	"mime/multipart"
+	"mime/quotedprintable"
+	netmail "net/mail"
+	"os"
+	"strings"
+)
+
+// EMLToMsgFromString parses a given EML string and returns a pre-filled Msg pointer.
+//
+// This function takes an EML formatted string, converts it into a bytes buffer, and then
+// calls EMLToMsgFromReader to parse the buffer and create a Msg object. This provides a
+// convenient way to convert EML strings directly into Msg objects.
+//
+// Parameters:
+//   - emlString: A string containing the EML formatted message.
+//
+// Returns:
+//   - A pointer to the Msg object populated with the parsed data, and an error if parsing
+//     fails.
+func EMLToMsgFromString(emlString string) (*Msg, error) {
+	eb := bytes.NewBufferString(emlString)
+	return EMLToMsgFromReader(eb)
+}
+
+// EMLToMsgFromReader parses a reader that holds EML content and returns a pre-filled Msg pointer.
+//
+// This function reads EML content from the provided io.Reader and populates a Msg object
+// with the parsed data. It initializes the Msg and extracts headers and body parts from
+// the EML content. Any errors encountered during parsing are returned.
+//
+// Parameters:
+//   - reader: An io.Reader containing the EML formatted message.
+//
+// Returns:
+//   - A pointer to the Msg object populated with the parsed data, and an error if parsing
+//     fails.
+func EMLToMsgFromReader(reader io.Reader) (*Msg, error) {
+	msg := NewMsg()
+	parsedMsg, bodybuf, err := readEMLFromReader(reader)
+	if err != nil || parsedMsg == nil {
+		return msg, fmt.Errorf("failed to parse EML from reader: %w", err)
+	}
+
+	if err = parseEML(parsedMsg, bodybuf, msg); err != nil {
+		return msg, fmt.Errorf("failed to parse EML contents: %w", err)
+	}
+
+	return msg, nil
+}
+
+// EMLToMsgFromFile opens and parses a .eml file at a provided file path and returns a
+// pre-filled Msg pointer.
+//
+// This function attempts to read and parse an EML file located at the specified file path.
+// It initializes a Msg object and populates it with the parsed headers and body. Any errors
+// encountered during the file operations or parsing are returned.
+//
+// Parameters:
+//   - filePath: The path to the .eml file to be parsed.
+//
+// Returns:
+//   - A pointer to the Msg object populated with the parsed data, and an error if parsing
+//     fails.
+func EMLToMsgFromFile(filePath string) (*Msg, error) {
+	msg := NewMsg()
+	parsedMsg, bodybuf, err := readEML(filePath)
+	if err != nil || parsedMsg == nil {
+		return msg, fmt.Errorf("failed to parse EML file: %w", err)
+	}
+
+	if err = parseEML(parsedMsg, bodybuf, msg); err != nil {
+		return msg, fmt.Errorf("failed to parse EML contents: %w", err)
+	}
+
+	return msg, nil
+}
+
+// parseEML parses the EML's headers and body and inserts the parsed values into the Msg.
+//
+// This function extracts relevant header fields and body content from the parsed EML message
+// and stores them in the provided Msg object. It handles various header types and body
+// parts, ensuring that the Msg is correctly populated with all necessary information.
+//
+// Parameters:
+//   - parsedMsg: A pointer to the netmail.Message containing the parsed EML data.
+//   - bodybuf: A bytes.Buffer containing the body content of the EML message.
+//   - msg: A pointer to the Msg object to be populated with the parsed data.
+//
+// Returns:
+//   - An error if any issues occur during the parsing process; otherwise, returns nil.
+func parseEML(parsedMsg *netmail.Message, bodybuf *bytes.Buffer, msg *Msg) error {
+	if err := parseEMLHeaders(&parsedMsg.Header, msg); err != nil {
+		return fmt.Errorf("failed to parse EML headers: %w", err)
+	}
+	if err := parseEMLBodyParts(parsedMsg, bodybuf, msg); err != nil {
+		return fmt.Errorf("failed to parse EML body parts: %w", err)
+	}
+	return nil
+}
+
+// readEML opens an EML file and uses net/mail to parse the header and body.
+//
+// This function opens the specified EML file for reading and utilizes the net/mail package
+// to parse the message's headers and body. It returns the parsed message and a buffer
+// containing the body content, along with any errors encountered during the process.
+//
+// Parameters:
+//   - filePath: The path to the EML file to be opened and parsed.
+//
+// Returns:
+//   - A pointer to the parsed netmail.Message, a bytes.Buffer containing the body, and an
+//     error if any issues occur during file operations or parsing.
+func readEML(filePath string) (*netmail.Message, *bytes.Buffer, error) {
+	fileHandle, err := os.Open(filePath)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to open EML file: %w", err)
+	}
+	defer func() {
+		_ = fileHandle.Close()
+	}()
+	return readEMLFromReader(fileHandle)
+}
+
+// readEMLFromReader uses net/mail to parse the header and body from a given io.Reader.
+//
+// This function reads the EML content from the provided io.Reader and uses the net/mail
+// package to parse the message's headers and body. It returns the parsed netmail.Message
+// along with a bytes.Buffer containing the body content. Any errors encountered during
+// the parsing process are returned.
+//
+// Parameters:
+//   - reader: An io.Reader containing the EML formatted message.
+//
+// Returns:
+//   - A pointer to the parsed netmail.Message, a bytes.Buffer containing the body, and an
+//     error if any issues occur during parsing.
+func readEMLFromReader(reader io.Reader) (*netmail.Message, *bytes.Buffer, error) {
+	parsedMsg, err := netmail.ReadMessage(reader)
+	if err != nil {
+		return parsedMsg, nil, fmt.Errorf("failed to parse EML: %w", err)
+	}
+
+	buf := bytes.Buffer{}
+	if _, err = buf.ReadFrom(parsedMsg.Body); err != nil {
+		return nil, nil, err
+	}
+
+	return parsedMsg, &buf, nil
+}
+
+// parseEMLHeaders parses the EML's headers and populates the Msg with relevant information.
+//
+// This function checks the EML headers for common headers and sets the corresponding fields
+// in the Msg object. It extracts address headers, content types, and other relevant data
+// for further processing.
+//
+// Parameters:
+//   - mailHeader: A pointer to the netmail.Header containing the EML headers.
+//   - msg: A pointer to the Msg object to be populated with parsed header information.
+//
+// Returns:
+//   - An error if parsing the headers fails; otherwise, returns nil.
+func parseEMLHeaders(mailHeader *netmail.Header, msg *Msg) error {
+	commonHeaders := []Header{
+		HeaderContentType, HeaderImportance, HeaderInReplyTo, HeaderListUnsubscribe,
+		HeaderListUnsubscribePost, HeaderMessageID, HeaderMIMEVersion, HeaderOrganization,
+		HeaderPrecedence, HeaderPriority, HeaderReferences, HeaderSubject, HeaderUserAgent,
+		HeaderXMailer, HeaderXMSMailPriority, HeaderXPriority,
+	}
+
+	// Extract content type, charset and encoding first
+	parseEMLEncoding(mailHeader, msg)
+	parseEMLContentTypeCharset(mailHeader, msg)
+
+	// Extract address headers
+	if value := mailHeader.Get(HeaderFrom.String()); value != "" {
+		if err := msg.From(value); err != nil {
+			return fmt.Errorf(`failed to parse %q header: %w`, HeaderFrom, err)
+		}
+	}
+	addrHeaders := map[AddrHeader]func(...string) error{
+		HeaderTo:  msg.To,
+		HeaderCc:  msg.Cc,
+		HeaderBcc: msg.Bcc,
+	}
+	for addrHeader, addrFunc := range addrHeaders {
+		if v := mailHeader.Get(addrHeader.String()); v != "" {
+			var addrStrings []string
+			parsedAddrs, err := netmail.ParseAddressList(v)
+			if err != nil {
+				return fmt.Errorf(`failed to parse address list: %w`, err)
+			}
+			for _, addr := range parsedAddrs {
+				addrStrings = append(addrStrings, addr.String())
+			}
+			// We can skip the error checking here since netmail.ParseAddressList already performed the
+			// same address checking that the msg methods do.
+			_ = addrFunc(addrStrings...)
+		}
+	}
+
+	// Extract date from message
+	date, err := mailHeader.Date()
+	if err != nil {
+		switch {
+		case errors.Is(err, netmail.ErrHeaderNotPresent):
+			msg.SetDate()
+		default:
+			return fmt.Errorf("failed to parse EML date: %w", err)
+		}
+	}
+	if err == nil {
+		msg.SetDateWithValue(date)
+	}
+
+	// Extract common headers
+	for _, header := range commonHeaders {
+		if value := mailHeader.Get(header.String()); value != "" {
+			if strings.EqualFold(header.String(), HeaderContentType.String()) &&
+				strings.HasPrefix(value, TypeMultipartMixed.String()) {
+				continue
+			}
+			msg.SetGenHeader(header, value)
+		}
+	}
+
+	return nil
+}
+
+// parseEMLBodyParts parses the body of an EML based on the different content types and encodings.
+//
+// This function examines the content type of the parsed EML message and processes the body
+// parts accordingly. It handles both plain text and multipart types, ensuring that the
+// Msg object is populated with the appropriate body content.
+//
+// Parameters:
+//   - parsedMsg: A pointer to the netmail.Message containing the parsed EML data.
+//   - bodybuf: A bytes.Buffer containing the body content of the EML message.
+//   - msg: A pointer to the Msg object to be populated with the parsed body content.
+//
+// Returns:
+//   - An error if any issues occur during the body parsing process; otherwise, returns nil.
+func parseEMLBodyParts(parsedMsg *netmail.Message, bodybuf *bytes.Buffer, msg *Msg) error {
+	// Extract the transfer encoding of the body
+	mediatype, params, err := mime.ParseMediaType(parsedMsg.Header.Get(HeaderContentType.String()))
+	if err != nil {
+		switch {
+		// If no Content-Type header is found, we assume that this is a plain text, 7bit, US-ASCII mail
+		case strings.EqualFold(err.Error(), "mime: no media type"):
+			mediatype = TypeTextPlain.String()
+			params = make(map[string]string)
+			params["charset"] = CharsetASCII.String()
+		default:
+			return fmt.Errorf("failed to extract content type: %w", err)
+		}
+	}
+	if value, ok := params["charset"]; ok {
+		msg.SetCharset(Charset(value))
+	}
+	if value, ok := params["boundary"]; ok {
+		msg.SetBoundary(value)
+	}
+
+	switch {
+	case strings.EqualFold(mediatype, TypeTextPlain.String()),
+		strings.EqualFold(mediatype, TypeTextHTML.String()):
+		if err = parseEMLBodyPlain(mediatype, parsedMsg, bodybuf, msg); err != nil {
+			return fmt.Errorf("failed to parse plain body: %w", err)
+		}
+	case strings.EqualFold(mediatype, TypeMultipartAlternative.String()),
+		strings.EqualFold(mediatype, TypeMultipartMixed.String()),
+		strings.EqualFold(mediatype, TypeMultipartRelated.String()):
+		if err = parseEMLMultipart(params, bodybuf, msg); err != nil {
+			return fmt.Errorf("failed to parse multipart body: %w", err)
+		}
+	default:
+		return fmt.Errorf("failed to parse body, unknown content type: %s", mediatype)
+	}
+	return nil
+}
+
+// parseEMLBodyPlain parses the mail body of plain type messages.
+//
+// This function handles the parsing of plain text messages based on their encoding. It
+// identifies the content transfer encoding and decodes the body content accordingly,
+// storing the result in the provided Msg object.
+//
+// Parameters:
+//   - mediatype: The media type of the message (e.g., text/plain).
+//   - parsedMsg: A pointer to the netmail.Message containing the parsed EML data.
+//   - bodybuf: A bytes.Buffer containing the body content of the EML message.
+//   - msg: A pointer to the Msg object to be populated with the parsed body content.
+//
+// Returns:
+//   - An error if any issues occur during the parsing of the plain body; otherwise, returns nil.
+func parseEMLBodyPlain(mediatype string, parsedMsg *netmail.Message, bodybuf *bytes.Buffer, msg *Msg) error {
+	contentTransferEnc := parsedMsg.Header.Get(HeaderContentTransferEnc.String())
+	// If no Content-Transfer-Encoding is set, we can imply 7bit US-ASCII encoding
+	// https://datatracker.ietf.org/doc/html/rfc2045#section-6.1
+	if contentTransferEnc == "" || strings.EqualFold(contentTransferEnc, EncodingUSASCII.String()) {
+		msg.SetEncoding(EncodingUSASCII)
+		msg.SetBodyString(ContentType(mediatype), bodybuf.String())
+		return nil
+	}
+	if strings.EqualFold(contentTransferEnc, NoEncoding.String()) {
+		msg.SetEncoding(NoEncoding)
+		msg.SetBodyString(ContentType(mediatype), bodybuf.String())
+		return nil
+	}
+	if strings.EqualFold(contentTransferEnc, EncodingQP.String()) {
+		msg.SetEncoding(EncodingQP)
+		qpReader := quotedprintable.NewReader(bodybuf)
+		qpBuffer := bytes.Buffer{}
+		if _, err := qpBuffer.ReadFrom(qpReader); err != nil {
+			return fmt.Errorf("failed to read quoted-printable body: %w", err)
+		}
+		msg.SetBodyString(ContentType(mediatype), qpBuffer.String())
+		return nil
+	}
+	if strings.EqualFold(contentTransferEnc, EncodingB64.String()) {
+		msg.SetEncoding(EncodingB64)
+		b64Decoder := base64.NewDecoder(base64.StdEncoding, bodybuf)
+		b64Buffer := bytes.Buffer{}
+		if _, err := b64Buffer.ReadFrom(b64Decoder); err != nil {
+			return fmt.Errorf("failed to read base64 body: %w", err)
+		}
+		msg.SetBodyString(ContentType(mediatype), b64Buffer.String())
+		return nil
+	}
+	return fmt.Errorf("unsupported Content-Transfer-Encoding")
+}
+
+// parseEMLMultipart parses a multipart body part of an EML message.
+//
+// This function handles the parsing of multipart messages, extracting the individual parts
+// and determining their content types. It processes each part according to its content type
+// and ensures that all relevant data is stored in the Msg object.
+//
+// Parameters:
+//   - params: A map containing the parameters from the multipart content type.
+//   - bodybuf: A bytes.Buffer containing the body content of the EML message.
+//   - msg: A pointer to the Msg object to be populated with the parsed body parts.
+//
+// Returns:
+//   - An error if any issues occur during the parsing of the multipart body; otherwise,
+//     returns nil.
+func parseEMLMultipart(params map[string]string, bodybuf *bytes.Buffer, msg *Msg) error {
+	boundary, ok := params["boundary"]
+	if !ok {
+		return fmt.Errorf("no boundary tag found in multipart body")
+	}
+	multipartReader := multipart.NewReader(bodybuf, boundary)
+ReadNextPart:
+	multiPart, err := multipartReader.NextPart()
+	defer func() {
+		if multiPart != nil {
+			_ = multiPart.Close()
+		}
+	}()
+	if err != nil && !errors.Is(err, io.EOF) {
+		return fmt.Errorf("failed to get next part of multipart message: %w", err)
+	}
+	for err == nil {
+		// Multipart/related and Multipart/alternative parts need to be parsed separately
+		if contentTypeSlice, ok := multiPart.Header[HeaderContentType.String()]; ok && len(contentTypeSlice) == 1 {
+			contentType, _ := parseMultiPartHeader(contentTypeSlice[0])
+			if strings.EqualFold(contentType, TypeMultipartRelated.String()) ||
+				strings.EqualFold(contentType, TypeMultipartAlternative.String()) {
+				relatedPart := &netmail.Message{
+					Header: netmail.Header(multiPart.Header),
+					Body:   multiPart,
+				}
+				relatedBuf := &bytes.Buffer{}
+				if _, err = relatedBuf.ReadFrom(multiPart); err != nil {
+					return fmt.Errorf("failed to read related multipart message to buffer: %w", err)
+				}
+				if err := parseEMLBodyParts(relatedPart, relatedBuf, msg); err != nil {
+					return fmt.Errorf("failed to parse related multipart body: %w", err)
+				}
+			}
+		}
+
+		// Content-Disposition header means we have an attachment or embed
+		if contentDisposition, ok := multiPart.Header[HeaderContentDisposition.String()]; ok {
+			if err = parseEMLAttachmentEmbed(contentDisposition, multiPart, msg); err != nil {
+				return fmt.Errorf("failed to parse attachment/embed: %w", err)
+			}
+			goto ReadNextPart
+		}
+
+		multiPartData, mperr := io.ReadAll(multiPart)
+		if mperr != nil {
+			_ = multiPart.Close()
+			return fmt.Errorf("failed to read multipart: %w", err)
+		}
+
+		multiPartContentType, ok := multiPart.Header[HeaderContentType.String()]
+		if !ok {
+			return fmt.Errorf("failed to get content-type from part")
+		}
+		contentType, optional := parseMultiPartHeader(multiPartContentType[0])
+		if strings.EqualFold(contentType, TypeMultipartRelated.String()) {
+			goto ReadNextPart
+		}
+		part := msg.newPart(ContentType(contentType))
+		if charset, ok := optional["charset"]; ok {
+			part.SetCharset(Charset(charset))
+		}
+
+		mutliPartTransferEnc, ok := multiPart.Header[HeaderContentTransferEnc.String()]
+		if !ok {
+			// If CTE is empty we can assume that it's a quoted-printable CTE since the
+			// GO stdlib multipart packages deletes that header
+			// See: https://cs.opensource.google/go/go/+/refs/tags/go1.22.0:src/mime/multipart/multipart.go;l=161
+			mutliPartTransferEnc = []string{EncodingQP.String()}
+		}
+
+		switch {
+		case strings.EqualFold(mutliPartTransferEnc[0], EncodingUSASCII.String()):
+			part.SetEncoding(EncodingUSASCII)
+			part.SetContent(string(multiPartData))
+		case strings.EqualFold(mutliPartTransferEnc[0], NoEncoding.String()):
+			part.SetEncoding(NoEncoding)
+			part.SetContent(string(multiPartData))
+		case strings.EqualFold(mutliPartTransferEnc[0], EncodingB64.String()):
+			part.SetEncoding(EncodingB64)
+			if err = handleEMLMultiPartBase64Encoding(multiPartData, part); err != nil {
+				return fmt.Errorf("failed to handle multipart base64 transfer-encoding: %w", err)
+			}
+		case strings.EqualFold(mutliPartTransferEnc[0], EncodingQP.String()):
+			part.SetEncoding(EncodingQP)
+			part.SetContent(string(multiPartData))
+		default:
+			return fmt.Errorf("unsupported Content-Transfer-Encoding: %s", mutliPartTransferEnc[0])
+		}
+
+		msg.parts = append(msg.parts, part)
+		multiPart, err = multipartReader.NextPart()
+	}
+	if !errors.Is(err, io.EOF) {
+		return fmt.Errorf("failed to read multipart: %w", err)
+	}
+	return nil
+}
+
+// parseEMLEncoding parses and determines the encoding of the message.
+//
+// This function extracts the content transfer encoding from the EML headers and sets the
+// corresponding encoding in the Msg object. It ensures that the correct encoding is used
+// for further processing of the message content.
+//
+// Parameters:
+//   - mailHeader: A pointer to the netmail.Header containing the EML headers.
+//   - msg: A pointer to the Msg object to be updated with the encoding information.
+func parseEMLEncoding(mailHeader *netmail.Header, msg *Msg) {
+	if value := mailHeader.Get(HeaderContentTransferEnc.String()); value != "" {
+		switch {
+		case strings.EqualFold(value, EncodingQP.String()):
+			msg.SetEncoding(EncodingQP)
+		case strings.EqualFold(value, EncodingB64.String()):
+			msg.SetEncoding(EncodingB64)
+		default:
+			msg.SetEncoding(NoEncoding)
+		}
+	}
+}
+
+// parseEMLContentTypeCharset parses and determines the charset and content type of the message.
+//
+// This function extracts the content type and charset from the EML headers, setting them
+// appropriately in the Msg object. It ensures that the Msg object is configured with the
+// correct content type for further processing.
+//
+// Parameters:
+//   - mailHeader: A pointer to the netmail.Header containing the EML headers.
+//   - msg: A pointer to the Msg object to be updated with content type and charset information.
+func parseEMLContentTypeCharset(mailHeader *netmail.Header, msg *Msg) {
+	if value := mailHeader.Get(HeaderContentType.String()); value != "" {
+		contentType, optional := parseMultiPartHeader(value)
+		if charset, ok := optional["charset"]; ok {
+			msg.SetCharset(Charset(charset))
+		}
+		msg.setEncoder()
+		if contentType != "" && !strings.EqualFold(contentType, TypeMultipartMixed.String()) {
+			msg.SetGenHeader(HeaderContentType, contentType)
+		}
+	}
+}
+
+// handleEMLMultiPartBase64Encoding sets the content body of a base64 encoded Part.
+//
+// This function decodes the base64 encoded content of a multipart part and stores the
+// resulting content in the provided Part object. It handles any errors that occur during
+// the decoding process.
+//
+// Parameters:
+//   - multiPartData: A byte slice containing the base64 encoded data.
+//   - part: A pointer to the Part object where the decoded content will be stored.
+//
+// Returns:
+//   - An error if the base64 decoding fails; otherwise, returns nil.
+func handleEMLMultiPartBase64Encoding(multiPartData []byte, part *Part) error {
+	part.SetEncoding(EncodingB64)
+	content, err := base64.StdEncoding.DecodeString(string(multiPartData))
+	if err != nil {
+		return fmt.Errorf("failed to decode base64 part: %w", err)
+	}
+	part.SetContent(string(content))
+	return nil
+}
+
+// parseMultiPartHeader parses a multipart header and returns the value and optional parts as a map.
+//
+// This function splits a multipart header into its main value and any optional parameters,
+// returning them separately. It helps in processing multipart messages by extracting
+// relevant information from headers.
+//
+// Parameters:
+//   - multiPartHeader: A string representing the multipart header to be parsed.
+//
+// Returns:
+//   - The main header value as a string and a map of optional parameters.
+func parseMultiPartHeader(multiPartHeader string) (header string, optional map[string]string) {
+	optional = make(map[string]string)
+	headerSplit := strings.Split(multiPartHeader, ";")
+	header = headerSplit[0]
+	if len(headerSplit) == 1 {
+		return header, optional
+	}
+	for _, opt := range headerSplit[1:] {
+		optString := strings.TrimLeft(opt, " ")
+		optSplit := strings.SplitN(optString, "=", 2)
+		if len(optSplit) == 2 {
+			optional[optSplit[0]] = optSplit[1]
+		}
+	}
+	return header, optional
+}
+
+// parseEMLAttachmentEmbed parses a multipart that is an attachment or embed.
+//
+// This function handles the parsing of multipart sections that are marked as attachments or
+// embedded content. It processes the content disposition and sets the appropriate fields in
+// the Msg object based on the parsed data.
+//
+// Parameters:
+//   - contentDisposition: A slice of strings containing the content disposition header.
+//   - multiPart: A pointer to the multipart.Part to be parsed.
+//   - msg: A pointer to the Msg object to be populated with the attachment or embed data.
+//
+// Returns:
+//   - An error if any issues occur during the parsing of attachments or embeds; otherwise,
+//     returns nil.
+func parseEMLAttachmentEmbed(contentDisposition []string, multiPart *multipart.Part, msg *Msg) error {
+	cdType, optional := parseMultiPartHeader(contentDisposition[0])
+	filename := "generic.attachment"
+	if name, ok := optional["filename"]; ok {
+		filename = name[1 : len(name)-1]
+	}
+
+	var dataReader io.Reader
+	dataReader = multiPart
+	contentTransferEnc, _ := parseMultiPartHeader(multiPart.Header.Get(HeaderContentTransferEnc.String()))
+	b64Decoder := base64.NewDecoder(base64.StdEncoding, multiPart)
+	if strings.EqualFold(contentTransferEnc, EncodingB64.String()) {
+		dataReader = b64Decoder
+	}
+
+	switch strings.ToLower(cdType) {
+	case "attachment":
+		if err := msg.AttachReader(filename, dataReader); err != nil {
+			return fmt.Errorf("failed to attach multipart body: %w", err)
+		}
+	case "inline":
+		if contentID, _ := parseMultiPartHeader(multiPart.Header.Get(HeaderContentID.String())); contentID != "" {
+			if err := msg.EmbedReader(filename, dataReader, WithFileContentID(contentID)); err != nil {
+				return fmt.Errorf("failed to embed multipart body: %w", err)
+			}
+			return nil
+		}
+		if err := msg.EmbedReader(filename, dataReader); err != nil {
+			return fmt.Errorf("failed to embed multipart body: %w", err)
+		}
+	default:
+		return errors.New("unsupported content disposition type")
+	}
+	return nil
+}

backend/vendor/github.com/wneessen/go-mail/go.sum.license

@@ -0,0 +1,3 @@
+// SPDX-FileCopyrightText: Copyright (c) The go-mail Authors
+//
+// SPDX-License-Identifier: MIT

backend/vendor/github.com/wneessen/go-mail/internal/pkcs7/pkcs7.go

@@ -0,0 +1,412 @@
+// SPDX-FileCopyrightText: Copyright (c) 2015 Andrew Smith
+// SPDX-FileCopyrightText: Copyright (c) 2017-2024 The mozilla services project (https://github.com/mozilla-services)
+// SPDX-FileCopyrightText: Copyright (c) The go-mail Authors
+//
+// Partially forked from https://github.com/mozilla-services/pkcs7, which in turn is also a fork
+// of https://github.com/fullsailor/pkcs7.
+// Use of the forked source code is, same as go-mail, governed by a MIT license.
+//
+// go-mail specific modifications by the go-mail Authors.
+// Licensed under the MIT License.
+// See [PROJECT ROOT]/LICENSES directory for more information.
+//
+// SPDX-License-Identifier: MIT
+
+package pkcs7
+
+import (
+	"bytes"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/rand"
+	"crypto/rsa"
+	_ "crypto/sha256" // for crypto.SHA256
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/asn1"
+	"errors"
+	"fmt"
+	"math/big"
+	"sort"
+	"time"
+)
+
+var (
+	OIDData                   = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 7, 1}
+	OIDSignedData             = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 7, 2}
+	OIDAttributeContentType   = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 3}
+	OIDAttributeMessageDigest = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 4}
+	OIDAttributeSigningTime   = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 5}
+
+	OIDDigestAlgorithmSHA256      = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 2, 1}
+	OIDDigestAlgorithmECDSASHA256 = asn1.ObjectIdentifier{1, 2, 840, 10045, 4, 3, 2}
+
+	OIDEncryptionAlgorithmRSASHA256 = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 11}
+)
+
+// PKCS7 Represents a PKCS7 structure
+type PKCS7 struct {
+	Content      []byte
+	Certificates []*x509.Certificate
+	CRLs         []x509.RevocationList
+	Signers      []signerInfo
+}
+
+type contentInfo struct {
+	ContentType asn1.ObjectIdentifier
+	Content     asn1.RawValue `asn1:"explicit,optional,tag:0"`
+}
+
+type signedData struct {
+	Version                    int                        `asn1:"default:1"`
+	DigestAlgorithmIdentifiers []pkix.AlgorithmIdentifier `asn1:"set"`
+	ContentInfo                contentInfo
+	Certificates               rawCertificates       `asn1:"optional,tag:0"`
+	CRLs                       []x509.RevocationList `asn1:"optional,tag:1"`
+	SignerInfos                []signerInfo          `asn1:"set"`
+}
+
+type rawCertificates struct {
+	Raw asn1.RawContent
+}
+
+func (raw rawCertificates) Parse() ([]*x509.Certificate, error) {
+	if len(raw.Raw) == 0 {
+		return nil, nil
+	}
+
+	var val asn1.RawValue
+	if _, err := asn1.Unmarshal(raw.Raw, &val); err != nil {
+		return nil, err
+	}
+
+	return x509.ParseCertificates(val.Bytes)
+}
+
+type attribute struct {
+	Type  asn1.ObjectIdentifier
+	Value asn1.RawValue `asn1:"set"`
+}
+
+type issuerAndSerial struct {
+	IssuerName   asn1.RawValue
+	SerialNumber *big.Int
+}
+
+// MessageDigestMismatchError is returned when the signer data digest does not
+// match the computed digest for the contained content
+type MessageDigestMismatchError struct {
+	ExpectedDigest []byte
+	ActualDigest   []byte
+}
+
+func (err *MessageDigestMismatchError) Error() string {
+	return fmt.Sprintf("pkcs7: Message digest mismatch\n\tExpected: %X\n\tActual  : %X", err.ExpectedDigest, err.ActualDigest)
+}
+
+type signerInfo struct {
+	Version                   int `asn1:"default:1"`
+	IssuerAndSerialNumber     issuerAndSerial
+	DigestAlgorithm           pkix.AlgorithmIdentifier
+	AuthenticatedAttributes   []attribute `asn1:"optional,tag:0"`
+	DigestEncryptionAlgorithm pkix.AlgorithmIdentifier
+	EncryptedDigest           []byte
+	UnauthenticatedAttributes []attribute `asn1:"optional,tag:1"`
+}
+
+// Attribute represents a key value pair attribute. Value must be marshalable byte
+// `encoding/asn1`
+type Attribute struct {
+	Type  asn1.ObjectIdentifier
+	Value interface{}
+}
+
+// SignerInfoConfig are optional values to include when adding a signer
+type SignerInfoConfig struct {
+	ExtraSignedAttributes   []Attribute
+	ExtraUnsignedAttributes []Attribute
+}
+
+type attributes struct {
+	types  []asn1.ObjectIdentifier
+	values []interface{}
+}
+
+// Add adds the attribute, maintaining insertion order
+func (as *attributes) Add(attrType asn1.ObjectIdentifier, value interface{}) {
+	as.types = append(as.types, attrType)
+	as.values = append(as.values, value)
+}
+
+type sortableAttribute struct {
+	SortKey   []byte
+	Attribute attribute
+}
+
+type attributeSet []sortableAttribute
+
+func (as attributeSet) Len() int {
+	return len(as)
+}
+
+func (as attributeSet) Less(i, j int) bool {
+	return bytes.Compare(as[i].SortKey, as[j].SortKey) < 0
+}
+
+func (as attributeSet) Swap(i, j int) {
+	as[i], as[j] = as[j], as[i]
+}
+
+func (as attributeSet) attributes() []attribute {
+	attrs := make([]attribute, len(as))
+	for i, attr := range as {
+		attrs[i] = attr.Attribute
+	}
+	return attrs
+}
+
+func (as *attributes) forMarshaling() ([]attribute, error) {
+	sortables := make(attributeSet, len(as.types))
+	for i := range sortables {
+		attrType := as.types[i]
+		attrValue := as.values[i]
+		asn1Value, err := asn1.Marshal(attrValue)
+		if err != nil {
+			return nil, err
+		}
+		attr := attribute{
+			Type:  attrType,
+			Value: asn1.RawValue{Tag: 17, IsCompound: true, Bytes: asn1Value}, // 17 == SET tag
+		}
+		encoded, err := asn1.Marshal(attr)
+		if err != nil {
+			return nil, err
+		}
+		sortables[i] = sortableAttribute{
+			SortKey:   encoded,
+			Attribute: attr,
+		}
+	}
+	sort.Sort(sortables)
+	return sortables.attributes(), nil
+}
+
+// SignedData is an opaque data structure for creating signed data payloads
+type SignedData struct {
+	sd            signedData
+	certs         []*x509.Certificate
+	data          []byte
+	messageDigest []byte
+	digestOid     asn1.ObjectIdentifier
+}
+
+// NewSignedData initializes a SignedData with content
+func NewSignedData(data []byte) (*SignedData, error) {
+	content, err := asn1.Marshal(data)
+	if err != nil {
+		return nil, err
+	}
+	ci := contentInfo{
+		ContentType: OIDData,
+		Content:     asn1.RawValue{Class: 2, Tag: 0, Bytes: content, IsCompound: true},
+	}
+	sd := signedData{
+		ContentInfo: ci,
+		Version:     1,
+	}
+	return &SignedData{sd: sd, data: data, digestOid: OIDDigestAlgorithmSHA256}, nil
+}
+
+// AddSigner is a wrapper around AddSignerChain() that adds a signer without any parent.
+func (sd *SignedData) AddSigner(cert *x509.Certificate, pkey crypto.PrivateKey, config SignerInfoConfig) error {
+	var parents []*x509.Certificate
+	return sd.addSignerChain(cert, pkey, parents, config)
+}
+
+// addSignerChain signs attributes about the content and adds certificates
+// and signers infos to the Signed Data. The certificate and private key
+// of the end-entity signer are used to issue the signature, and any
+// parent of that end-entity that need to be added to the list of
+// certifications can be specified in the parents slice.
+//
+// The signature algorithm used to hash the data is the one of the end-entity
+// certificate.
+func (sd *SignedData) addSignerChain(ee *x509.Certificate, pkey crypto.PrivateKey, parents []*x509.Certificate, config SignerInfoConfig) error {
+	// Following RFC 2315, 9.2 SignerInfo type, the distinguished name of
+	// the issuer of the end-entity signer is stored in the issuerAndSerialNumber
+	// section of the SignedData.SignerInfo, alongside the serial number of
+	// the end-entity.
+	var ias issuerAndSerial
+	ias.SerialNumber = ee.SerialNumber
+	if len(parents) == 0 {
+		// no parent, the issuer is the end-entity cert itself
+		ias.IssuerName = asn1.RawValue{FullBytes: ee.RawIssuer}
+	} else {
+		err := verifyPartialChain(ee, parents)
+		if err != nil {
+			return err
+		}
+		// the first parent is the issuer
+		ias.IssuerName = asn1.RawValue{FullBytes: parents[0].RawSubject}
+	}
+	sd.sd.DigestAlgorithmIdentifiers = append(sd.sd.DigestAlgorithmIdentifiers,
+		pkix.AlgorithmIdentifier{Algorithm: sd.digestOid},
+	)
+	h := crypto.SHA256.New()
+	h.Write(sd.data)
+	sd.messageDigest = h.Sum(nil)
+	encryptionOid, err := getOIDForEncryptionAlgorithm(pkey, sd.digestOid)
+	if err != nil {
+		return err
+	}
+	attrs := &attributes{}
+	attrs.Add(OIDAttributeContentType, sd.sd.ContentInfo.ContentType)
+	attrs.Add(OIDAttributeMessageDigest, sd.messageDigest)
+	attrs.Add(OIDAttributeSigningTime, time.Now().UTC())
+	for _, attr := range config.ExtraSignedAttributes {
+		attrs.Add(attr.Type, attr.Value)
+	}
+	finalAttrs, err := attrs.forMarshaling()
+	if err != nil {
+		return err
+	}
+	unsignedAttrs := &attributes{}
+	for _, attr := range config.ExtraUnsignedAttributes {
+		unsignedAttrs.Add(attr.Type, attr.Value)
+	}
+	finalUnsignedAttrs, err := unsignedAttrs.forMarshaling()
+	if err != nil {
+		return err
+	}
+	// create signature of signed attributes
+	signature, err := signAttributes(finalAttrs, pkey, crypto.SHA256)
+	if err != nil {
+		return err
+	}
+	signer := signerInfo{
+		AuthenticatedAttributes:   finalAttrs,
+		UnauthenticatedAttributes: finalUnsignedAttrs,
+		DigestAlgorithm:           pkix.AlgorithmIdentifier{Algorithm: sd.digestOid},
+		DigestEncryptionAlgorithm: pkix.AlgorithmIdentifier{Algorithm: encryptionOid},
+		IssuerAndSerialNumber:     ias,
+		EncryptedDigest:           signature,
+		Version:                   1,
+	}
+	sd.certs = append(sd.certs, ee)
+	if len(parents) > 0 {
+		sd.certs = append(sd.certs, parents...)
+	}
+	sd.sd.SignerInfos = append(sd.sd.SignerInfos, signer)
+	return nil
+}
+
+// AddCertificate adds the certificate to the payload. Useful for parent certificates
+func (sd *SignedData) AddCertificate(cert *x509.Certificate) {
+	sd.certs = append(sd.certs, cert)
+}
+
+// Detach removes content from the signed data struct to make it a detached signature.
+// This must be called right before Finish()
+func (sd *SignedData) Detach() {
+	sd.sd.ContentInfo = contentInfo{ContentType: OIDData}
+}
+
+// Finish marshals the content and its signers
+func (sd *SignedData) Finish() ([]byte, error) {
+	sd.sd.Certificates = marshalCertificates(sd.certs)
+	inner, err := asn1.Marshal(sd.sd)
+	if err != nil {
+		return nil, err
+	}
+	outer := contentInfo{
+		ContentType: OIDSignedData,
+		Content:     asn1.RawValue{Class: 2, Tag: 0, Bytes: inner, IsCompound: true},
+	}
+	return asn1.Marshal(outer)
+}
+
+// verifyPartialChain checks that a given cert is issued by the first parent in the list,
+// then continue down the path. It doesn't require the last parent to be a root CA,
+// or to be trusted in any truststore. It simply verifies that the chain provided, albeit
+// partial, makes sense.
+func verifyPartialChain(cert *x509.Certificate, parents []*x509.Certificate) error {
+	if len(parents) == 0 {
+		return fmt.Errorf("pkcs7: zero parents provided to verify the signature of certificate %q", cert.Subject.CommonName)
+	}
+	err := cert.CheckSignatureFrom(parents[0])
+	if err != nil {
+		return fmt.Errorf("pkcs7: certificate signature from parent is invalid: %w", err)
+	}
+	if len(parents) == 1 {
+		// there is no more parent to check, return
+		return nil
+	}
+	return verifyPartialChain(parents[0], parents[1:])
+}
+
+// getOIDForEncryptionAlgorithm takes the private key type of the signer and
+// the OID of a digest algorithm to return the appropriate signerInfo.DigestEncryptionAlgorithm
+func getOIDForEncryptionAlgorithm(pkey crypto.PrivateKey, _ asn1.ObjectIdentifier) (asn1.ObjectIdentifier, error) {
+	switch pkey.(type) {
+	case *rsa.PrivateKey:
+		return OIDEncryptionAlgorithmRSASHA256, nil
+	case *ecdsa.PrivateKey:
+		return OIDDigestAlgorithmECDSASHA256, nil
+	}
+	return nil, fmt.Errorf("pkcs7: cannot convert encryption algorithm to oid, unknown private key type %T", pkey)
+}
+
+// signs the DER encoded form of the attributes with the private key
+func signAttributes(attrs []attribute, pkey crypto.PrivateKey, hash crypto.Hash) ([]byte, error) {
+	attrBytes, err := marshalAttributes(attrs)
+	if err != nil {
+		return nil, err
+	}
+	h := hash.New()
+	h.Write(attrBytes)
+	hashed := h.Sum(nil)
+
+	key, ok := pkey.(crypto.Signer)
+	if !ok {
+		return nil, errors.New("pkcs7: private key does not implement crypto.Signer")
+	}
+	return key.Sign(rand.Reader, hashed, hash)
+}
+
+// concat and wraps the certificates in the RawValue structure
+func marshalCertificates(certs []*x509.Certificate) rawCertificates {
+	var buf bytes.Buffer
+	for _, cert := range certs {
+		buf.Write(cert.Raw)
+	}
+	rawCerts, _ := marshalCertificateBytes(buf.Bytes())
+	return rawCerts
+}
+
+// Even though, the tag & length are stripped out during marshalling the
+// RawContent, we have to encode it into the RawContent. If It's missing,
+// then `asn1.Marshal()` will strip out the certificate wrapper instead.
+func marshalCertificateBytes(certs []byte) (rawCertificates, error) {
+	val := asn1.RawValue{Bytes: certs, Class: 2, Tag: 0, IsCompound: true}
+	b, err := asn1.Marshal(val)
+	if err != nil {
+		return rawCertificates{}, err
+	}
+	return rawCertificates{Raw: b}, nil
+}
+
+func marshalAttributes(attrs []attribute) ([]byte, error) {
+	encodedAttributes, err := asn1.Marshal(struct {
+		A []attribute `asn1:"set"`
+	}{A: attrs})
+	if err != nil {
+		return nil, err
+	}
+
+	// Remove the leading sequence octets
+	var raw asn1.RawValue
+	if _, err := asn1.Unmarshal(encodedAttributes, &raw); err != nil {
+		return nil, err
+	}
+	return raw.Bytes, nil
+}

backend/vendor/github.com/wneessen/go-mail/quicksend.go

@@ -0,0 +1,111 @@
+// SPDX-FileCopyrightText: The go-mail Authors
+//
+// SPDX-License-Identifier: MIT
+
+package mail
+
+import (
+	"bytes"
+	"crypto/tls"
+	"fmt"
+	"net"
+	"strconv"
+)
+
+type AuthData struct {
+	Auth     bool
+	Username string
+	Password string
+}
+
+var testHookTLSConfig func() *tls.Config // nil, except for tests
+
+// QuickSend is an all-in-one method for quickly sending simple text mails in go-mail.
+//
+// This method will create a new client that connects to the server at addr, switches to TLS if possible,
+// authenticates with the optional AuthData provided in auth and create a new simple Msg with the provided
+// subject string and message bytes as body. The message will be sent using from as sender address and will
+// be delivered to every address in rcpts. QuickSend will always send as text/plain ContentType.
+//
+// For the SMTP authentication, if auth is not nil and AuthData.Auth is set to true, it will try to
+// autodiscover the best SMTP authentication mechanism supported by the server. If auth is set to true
+// but autodiscover is not able to find a suitable authentication mechanism or if the authentication
+// fails, the mail delivery will fail completely.
+//
+// The content parameter should be an RFC 822-style email body. The lines of content should be CRLF terminated.
+//
+// Parameters:
+//   - addr: The hostname and port of the mail server, it must include a port, as in "mail.example.com:smtp".
+//   - auth: A AuthData pointer. If nil or if AuthData.Auth is set to false, not SMTP authentication will be performed.
+//   - from: The from address of the sender as string.
+//   - rcpts: A slice of strings of receipient addresses.
+//   - subject: The subject line as string.
+//   - content: A byte slice of the mail content
+//
+// Returns:
+//   - A pointer to the generated Msg.
+//   - An error if any step in the process of mail generation or delivery failed.
+func QuickSend(addr string, auth *AuthData, from string, rcpts []string, subject string, content []byte) (*Msg, error) {
+	host, port, err := net.SplitHostPort(addr)
+	if err != nil {
+		return nil, fmt.Errorf("failed to split host and port from address: %w", err)
+	}
+	portnum, err := strconv.Atoi(port)
+	if err != nil {
+		return nil, fmt.Errorf("failed to convert port to int: %w", err)
+	}
+	client, err := NewClient(host, WithPort(portnum), WithTLSPolicy(TLSOpportunistic))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create new client: %w", err)
+	}
+
+	if auth != nil && auth.Auth {
+		client.SetSMTPAuth(SMTPAuthAutoDiscover)
+		client.SetUsername(auth.Username)
+		client.SetPassword(auth.Password)
+	}
+
+	tlsConfig := client.tlsconfig
+	if testHookTLSConfig != nil {
+		tlsConfig = testHookTLSConfig()
+	}
+	if err = client.SetTLSConfig(tlsConfig); err != nil {
+		return nil, fmt.Errorf("failed to set TLS config: %w", err)
+	}
+
+	message := NewMsg()
+	if err = message.From(from); err != nil {
+		return nil, fmt.Errorf("failed to set MAIL FROM address: %w", err)
+	}
+	if err = message.To(rcpts...); err != nil {
+		return nil, fmt.Errorf("failed to set RCPT TO address: %w", err)
+	}
+	message.Subject(subject)
+	buffer := bytes.NewBuffer(content)
+	writeFunc := writeFuncFromBuffer(buffer)
+	message.SetBodyWriter(TypeTextPlain, writeFunc)
+
+	if err = client.DialAndSend(message); err != nil {
+		return nil, fmt.Errorf("failed to dial and send message: %w", err)
+	}
+	return message, nil
+}
+
+// NewAuthData creates a new AuthData instance with the provided username and password.
+//
+// This function initializes an AuthData struct with authentication enabled and sets the
+// username and password fields.
+//
+// Parameters:
+//   - user: The username for authentication.
+//   - pass: The password for authentication.
+//
+// Returns:
+//   - A pointer to the initialized AuthData instance.
+func NewAuthData(user, pass string) *AuthData {
+	return &AuthData{
+		Auth:     true,
+		Username: user,
+		Password: pass,
+	}
+}

backend/vendor/github.com/wneessen/go-mail/smime.go

@@ -0,0 +1,138 @@
+// SPDX-FileCopyrightText: The go-mail Authors
+//
+// SPDX-License-Identifier: MIT
+
+package mail
+
+import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+
+	"github.com/wneessen/go-mail/internal/pkcs7"
+)
+
+var (
+	// ErrPrivateKeyMissing should be used if private key is invalid
+	ErrPrivateKeyMissing = errors.New("private key is missing")
+
+	// ErrCertificateMissing should be used if the certificate is invalid
+	ErrCertificateMissing = errors.New("certificate is missing")
+)
+
+// SMIME represents the configuration and state for S/MIME signing.
+//
+// This struct encapsulates the private key, certificate, optional intermediate certificate, and
+// a flag indicating whether a signing process is currently in progress.
+//
+// Fields:
+//   - privateKey: The private key used for signing (implements crypto.PrivateKey).
+//   - certificate: The x509 certificate associated with the private key.
+//   - intermediateCert: An optional x509 intermediate certificate for chain validation.
+//   - inProgress: A boolean flag indicating if a signing operation is currently active.
+type SMIME struct {
+	privateKey       crypto.PrivateKey
+	certificate      *x509.Certificate
+	intermediateCert *x509.Certificate
+	inProgress       bool
+}
+
+// newSMIME constructs a new instance of SMIME with the provided parameters.
+//
+// This function initializes an SMIME object with a private key, certificate, and an optional
+// intermediate certificate.
+//
+// Parameters:
+//   - privateKey: The private key used for signing (must implement crypto.PrivateKey).
+//   - certificate: The x509 certificate associated with the private key.
+//   - intermediateCert: An optional x509 intermediate certificate for chain validation.
+//
+// Returns:
+//   - An SMIME instance configured with the provided parameters.
+//   - An error if the private key or certificate is missing.
+func newSMIME(privateKey crypto.PrivateKey, certificate *x509.Certificate,
+	intermediateCertificate *x509.Certificate,
+) (*SMIME, error) {
+	if privateKey == nil {
+		return nil, ErrPrivateKeyMissing
+	}
+	if certificate == nil {
+		return nil, ErrCertificateMissing
+	}
+
+	return &SMIME{
+		privateKey:       privateKey,
+		certificate:      certificate,
+		intermediateCert: intermediateCertificate,
+	}, nil
+}
+
+// signMessage signs the provided message with S/MIME and returns the signature in DER format.
+//
+// This function creates S/MIME signed data using the configured private key and certificate.
+// It optionally includes an intermediate certificate for chain validation and detaches the signature.
+//
+// Parameters:
+//   - message: The byte slice representing the message to be signed.
+//
+// Returns:
+//   - A string containing the S/MIME signature in DER format.
+//   - An error if initializing signed data, adding the signer, or finishing the signature fails.
+func (s *SMIME) signMessage(message []byte) (string, error) {
+	signedData, err := pkcs7.NewSignedData(message)
+	if err != nil || signedData == nil {
+		return "", fmt.Errorf("failed to initialize signed data: %w", err)
+	}
+
+	if err = signedData.AddSigner(s.certificate, s.privateKey, pkcs7.SignerInfoConfig{}); err != nil {
+		return "", fmt.Errorf("could not add signer message: %w", err)
+	}
+
+	if s.intermediateCert != nil {
+		signedData.AddCertificate(s.intermediateCert)
+	}
+
+	signedData.Detach()
+	signatureDER, err := signedData.Finish()
+	if err != nil {
+		return "", fmt.Errorf("failed to finish signature: %w", err)
+	}
+
+	return string(signatureDER), nil
+}
+
+// getLeafCertificate retrieves the leaf certificate from a tls.Certificate.
+//
+// This function returns the parsed leaf certificate from the provided TLS certificate. If the Leaf field
+// is nil, it parses and returns the first certificate in the chain.
+//
+// PLEASE NOTE: In Go versions prior to 1.23, the Certificate.Leaf field was left nil, and the parsed
+// certificate was discarded. This behavior can be re-enabled by setting "x509keypairleaf=0" in the
+// GODEBUG environment variable.
+//
+// Parameters:
+//   - keyPairTlS: The *tls.Certificate containing the certificate chain.
+//
+// Returns:
+//   - The parsed leaf x509 certificate.
+//   - An error if the certificate could not be parsed.
+func getLeafCertificate(keyPairTLS *tls.Certificate) (*x509.Certificate, error) {
+	if keyPairTLS == nil {
+		return nil, errors.New("provided certificate is nil")
+	}
+	if keyPairTLS.Leaf != nil {
+		return keyPairTLS.Leaf, nil
+	}
+
+	if len(keyPairTLS.Certificate) == 0 {
+		return nil, errors.New("certificate chain is empty")
+	}
+	cert, err := x509.ParseCertificate(keyPairTLS.Certificate[0])
+	if err != nil {
+		return nil, err
+	}
+
+	return cert, nil
+}

backend/vendor/github.com/wneessen/go-mail/smtp/auth_scram.go

@@ -0,0 +1,317 @@
+// SPDX-FileCopyrightText: Copyright (c) The go-mail Authors
+//
+// SPDX-License-Identifier: MIT
+
+package smtp
+
+import (
+	"bytes"
+	"crypto/hmac"
+	"crypto/pbkdf2"
+	"crypto/rand"
+	"crypto/sha1"
+	"crypto/sha256"
+	"crypto/tls"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"hash"
+	"io"
+	"strconv"
+	"strings"
+
+	"golang.org/x/text/secure/precis"
+)
+
+// scramAuth represents a SCRAM (Salted Challenge Response Authentication Mechanism) client and
+// satisfies the smtp.Auth interface.
+type scramAuth struct {
+	username, password, algorithm               string
+	firstBareMsg, nonce, saltedPwd, authMessage []byte
+	iterations                                  int
+	h                                           func() hash.Hash
+	isPlus                                      bool
+	tlsConnState                                *tls.ConnectionState
+	bindData                                    []byte
+}
+
+// ScramSHA1Auth creates and returns a new SCRAM-SHA-1 authentication mechanism with the given
+// username and password.
+func ScramSHA1Auth(username, password string) Auth {
+	return &scramAuth{
+		username:  username,
+		password:  password,
+		algorithm: "SCRAM-SHA-1",
+		h:         sha1.New,
+	}
+}
+
+// ScramSHA256Auth creates and returns a new SCRAM-SHA-256 authentication mechanism with the given
+// username and password.
+func ScramSHA256Auth(username, password string) Auth {
+	return &scramAuth{
+		username:  username,
+		password:  password,
+		algorithm: "SCRAM-SHA-256",
+		h:         sha256.New,
+	}
+}
+
+// ScramSHA1PlusAuth returns an Auth instance configured for SCRAM-SHA-1-PLUS authentication with
+// the provided username, password, and TLS connection state.
+func ScramSHA1PlusAuth(username, password string, tlsConnState *tls.ConnectionState) Auth {
+	return &scramAuth{
+		username:     username,
+		password:     password,
+		algorithm:    "SCRAM-SHA-1-PLUS",
+		h:            sha1.New,
+		isPlus:       true,
+		tlsConnState: tlsConnState,
+	}
+}
+
+// ScramSHA256PlusAuth returns an Auth instance configured for SCRAM-SHA-256-PLUS authentication with
+// the provided username, password, and TLS connection state.
+func ScramSHA256PlusAuth(username, password string, tlsConnState *tls.ConnectionState) Auth {
+	return &scramAuth{
+		username:     username,
+		password:     password,
+		algorithm:    "SCRAM-SHA-256-PLUS",
+		h:            sha256.New,
+		isPlus:       true,
+		tlsConnState: tlsConnState,
+	}
+}
+
+// Start initializes the SCRAM authentication process and returns the selected algorithm, nil data, and no error.
+func (a *scramAuth) Start(_ *ServerInfo) (string, []byte, error) {
+	return a.algorithm, nil, nil
+}
+
+// Next processes the server's challenge and returns the client's response for SCRAM authentication.
+func (a *scramAuth) Next(fromServer []byte, more bool) ([]byte, error) {
+	if more {
+		if len(fromServer) == 0 {
+			a.reset()
+			return a.initialClientMessage()
+		}
+		switch {
+		case bytes.HasPrefix(fromServer, []byte("r=")):
+			resp, err := a.handleServerFirstResponse(fromServer)
+			if err != nil {
+				a.reset()
+				return nil, err
+			}
+			return resp, nil
+		case bytes.HasPrefix(fromServer, []byte("v=")):
+			resp, err := a.handleServerValidationMessage(fromServer)
+			if err != nil {
+				a.reset()
+				return nil, err
+			}
+			return resp, nil
+		default:
+			a.reset()
+			return nil, fmt.Errorf("%w: %s", ErrUnexpectedServerResponse, string(fromServer))
+		}
+	}
+	return nil, nil
+}
+
+// reset clears all authentication-related properties in the scramAuth instance, effectively resetting its state.
+func (a *scramAuth) reset() {
+	a.nonce = nil
+	a.firstBareMsg = nil
+	a.saltedPwd = nil
+	a.authMessage = nil
+	a.iterations = 0
+}
+
+// initialClientMessage generates the initial message for SCRAM authentication, including a nonce and
+// optional channel binding.
+func (a *scramAuth) initialClientMessage() ([]byte, error) {
+	username, err := a.normalizeUsername()
+	if err != nil {
+		return nil, fmt.Errorf("username normalization failed: %w", err)
+	}
+
+	nonceBuffer := make([]byte, 24)
+	if _, err := io.ReadFull(rand.Reader, nonceBuffer); err != nil {
+		return nil, fmt.Errorf("unable to generate client secret: %w", err)
+	}
+	a.nonce = make([]byte, base64.StdEncoding.EncodedLen(len(nonceBuffer)))
+	base64.StdEncoding.Encode(a.nonce, nonceBuffer)
+
+	a.firstBareMsg = []byte("n=" + username + ",r=" + string(a.nonce))
+	returnBytes := []byte("n,," + string(a.firstBareMsg))
+
+	// SCRAM-SHA-X-PLUS auth requires channel binding
+	if a.isPlus {
+		if a.tlsConnState == nil {
+			return nil, errors.New("tls connection state is required for SCRAM-SHA-X-PLUS")
+		}
+		bindType := "tls-unique"
+		connState := a.tlsConnState
+		bindData := connState.TLSUnique
+
+		// crypto/tls: no tls-unique channel binding value for this tls connection, possibly due to missing
+		// extended master key support and/or resumed connection
+		// RFC9266:122 tls-unique not defined for tls 1.3 and later
+		if bindData == nil || connState.Version >= tls.VersionTLS13 {
+			bindType = "tls-exporter"
+			bindData, err = connState.ExportKeyingMaterial("EXPORTER-Channel-Binding", []byte{}, 32)
+			if err != nil {
+				return nil, fmt.Errorf("unable to export keying material: %w", err)
+			}
+		}
+		bindData = []byte("p=" + bindType + ",," + string(bindData))
+		a.bindData = make([]byte, base64.StdEncoding.EncodedLen(len(bindData)))
+		base64.StdEncoding.Encode(a.bindData, bindData)
+		returnBytes = []byte("p=" + bindType + ",," + string(a.firstBareMsg))
+	}
+
+	return returnBytes, nil
+}
+
+// handleServerFirstResponse processes the first response from the server in SCRAM authentication.
+func (a *scramAuth) handleServerFirstResponse(fromServer []byte) ([]byte, error) {
+	parts := bytes.Split(fromServer, []byte(","))
+	if len(parts) < 3 {
+		return nil, errors.New("not enough fields in the first server response")
+	}
+	if !bytes.HasPrefix(parts[0], []byte("r=")) {
+		return nil, errors.New("first part of the server response does not start with r=")
+	}
+	if !bytes.HasPrefix(parts[1], []byte("s=")) {
+		return nil, errors.New("second part of the server response does not start with s=")
+	}
+	if !bytes.HasPrefix(parts[2], []byte("i=")) {
+		return nil, errors.New("third part of the server response does not start with i=")
+	}
+
+	combinedNonce := parts[0][2:]
+	if len(a.nonce) == 0 || !bytes.HasPrefix(combinedNonce, a.nonce) {
+		return nil, errors.New("server nonce does not start with our nonce")
+	}
+	a.nonce = combinedNonce
+
+	encodedSalt := parts[1][2:]
+	salt := make([]byte, base64.StdEncoding.DecodedLen(len(encodedSalt)))
+	n, err := base64.StdEncoding.Decode(salt, encodedSalt)
+	if err != nil {
+		return nil, fmt.Errorf("invalid encoded salt: %w", err)
+	}
+	salt = salt[:n]
+
+	iterations, err := strconv.Atoi(string(parts[2][2:]))
+	if err != nil {
+		return nil, fmt.Errorf("invalid iterations: %w", err)
+	}
+	a.iterations = iterations
+
+	password, err := a.normalizeString(a.password)
+	if err != nil {
+		return nil, fmt.Errorf("unable to normalize password: %w", err)
+	}
+
+	a.saltedPwd, err = pbkdf2.Key(a.h, password, salt, a.iterations, a.h().Size())
+	if err != nil {
+		return nil, fmt.Errorf("unable to derive key: %w", err)
+	}
+
+	msgWithoutProof := []byte("c=biws,r=" + string(a.nonce))
+
+	// A PLUS authentication requires the channel binding data
+	if a.isPlus {
+		msgWithoutProof = []byte("c=" + string(a.bindData) + ",r=" + string(a.nonce))
+	}
+
+	a.authMessage = []byte(string(a.firstBareMsg) + "," + string(fromServer) + "," + string(msgWithoutProof))
+	clientProof := a.computeClientProof()
+
+	return []byte(string(msgWithoutProof) + ",p=" + string(clientProof)), nil
+}
+
+// handleServerValidationMessage verifies the server's signature during the SCRAM authentication process.
+func (a *scramAuth) handleServerValidationMessage(fromServer []byte) ([]byte, error) {
+	serverSignature := fromServer[2:]
+	computedServerSignature := a.computeServerSignature()
+
+	if !hmac.Equal(serverSignature, computedServerSignature) {
+		return nil, errors.New("invalid server signature")
+	}
+	return []byte(""), nil
+}
+
+// computeHMAC generates a Hash-based Message Authentication Code (HMAC) using the specified key and message.
+func (a *scramAuth) computeHMAC(key, msg []byte) []byte {
+	mac := hmac.New(a.h, key)
+	mac.Write(msg)
+	return mac.Sum(nil)
+}
+
+// computeHash generates a hash of the given key using the configured hashing algorithm.
+func (a *scramAuth) computeHash(key []byte) []byte {
+	hasher := a.h()
+	hasher.Write(key)
+	return hasher.Sum(nil)
+}
+
+// computeClientProof generates the client proof as part of the SCRAM authentication process.
+func (a *scramAuth) computeClientProof() []byte {
+	clientKey := a.computeHMAC(a.saltedPwd, []byte("Client Key"))
+	storedKey := a.computeHash(clientKey)
+	clientSignature := a.computeHMAC(storedKey[:], a.authMessage)
+	clientProof := make([]byte, len(clientSignature))
+	for i := 0; i < len(clientSignature); i++ {
+		clientProof[i] = clientKey[i] ^ clientSignature[i]
+	}
+	buf := make([]byte, base64.StdEncoding.EncodedLen(len(clientProof)))
+	base64.StdEncoding.Encode(buf, clientProof)
+	return buf
+}
+
+// computeServerSignature returns the computed base64-encoded server signature in the SCRAM
+// authentication process.
+func (a *scramAuth) computeServerSignature() []byte {
+	serverKey := a.computeHMAC(a.saltedPwd, []byte("Server Key"))
+	serverSignature := a.computeHMAC(serverKey, a.authMessage)
+	buf := make([]byte, base64.StdEncoding.EncodedLen(len(serverSignature)))
+	base64.StdEncoding.Encode(buf, serverSignature)
+	return buf
+}
+
+// normalizeUsername replaces special characters in the username for SCRAM authentication
+// and prepares it using the SASLprep profile as per RFC 8265, returning the normalized
+// username or an error.
+func (a *scramAuth) normalizeUsername() (string, error) {
+	// RFC 5802 section 5.1: the characters ',' or '=' in usernames are
+	// sent as '=2C' and '=3D' respectively.
+	replacer := strings.NewReplacer("=", "=3D", ",", "=2C")
+	username := replacer.Replace(a.username)
+	// RFC 5802 section 5.1: before sending the username to the server,
+	// the client SHOULD prepare the username using the "SASLprep"
+	// profile [RFC4013] of the "stringprep" algorithm [RFC3454]
+	// treating it as a query string (i.e., unassigned Unicode code
+	// points are allowed). If the preparation of the username fails or
+	// results in an empty string, the client SHOULD abort the
+	// authentication exchange.
+	//
+	// Since RFC 8265 obsoletes RFC 4013 we use it instead.
+	username, err := a.normalizeString(username)
+	if err != nil {
+		return "", fmt.Errorf("unable to normalize username: %w", err)
+	}
+	return username, nil
+}
+
+// normalizeString normalizes the input string according to the OpaqueString profile of the
+// precis framework. It returns the normalized string or an error if normalization fails or
+// results in an empty string.
+func (a *scramAuth) normalizeString(s string) (string, error) {
+	s, err := precis.OpaqueString.String(s)
+	if err != nil {
+		return "", fmt.Errorf("failed to normalize string: %w", err)
+	}
+	return s, nil
+}

backend/vendor/github.com/wneessen/go-mail/smtp/errorregistry.go

@@ -0,0 +1,128 @@
+// SPDX-FileCopyrightText: Copyright (c) The go-mail Authors
+//
+// SPDX-License-Identifier: MIT
+
+package smtp
+
+import (
+	"net/textproto"
+	"strings"
+	"sync"
+)
+
+// ResponseErrorHandler provides custom handling for SMTP response errors.
+//
+// This interface defines a method for handling SMTP responses that do not comply with expected
+// formats or behaviors. It is useful for implementing retry logic, logging, or protocol-specific
+// error handling logic. It injects itself into the smtp.Client and is called whenever a server
+// response does fail.
+//
+// Parameters:
+//   - host: The hostname of the SMTP server that this ResponseErrorHandler should handle
+//   - command: The SMTP command that triggered the error.
+//   - conn: The textproto.Conn to the SMTP server.
+//   - err: The error received from the SMTP server.
+//
+// Returns:
+//   - An error indicating the outcome of the error handling logic.
+type ResponseErrorHandler interface {
+	HandleError(host, command string, conn *textproto.Conn, err error) error
+}
+
+// DefaultErrorHandler implements ResponseErrorHandler by returning the original error.
+//
+// This handler provides a default implementation of the ResponseErrorHandler interface,
+// where no custom error processing is performed. It simply returns the original error
+// received from the SMTP server.
+//
+// Returns:
+//   - The original error passed to the handler.
+type DefaultErrorHandler struct{}
+
+// HandleError satisfies the ResponseErrorHandler interface for the DefaultErrorHandler type
+func (d *DefaultErrorHandler) HandleError(_, _ string, _ *textproto.Conn, err error) error {
+	return err
+}
+
+// HandlerKey uniquely identifies a host-command pair for handler mapping.
+//
+// This struct is used to associate a specific SMTP host and command combination with
+// a ResponseErrorHandler. It enables mapping and retrieval of handlers based on
+// the source of the error.
+type HandlerKey struct {
+	Host    string
+	Command string
+}
+
+// ErrorHandlerRegistry manages custom error handlers for SMTP host-command pairs.
+//
+// This struct stores mappings between HandlerKey values and corresponding
+// ResponseErrorHandler implementations. It supports concurrent access and provides
+// a fallback default handler when no specific match is found.
+type ErrorHandlerRegistry struct {
+	mu             sync.RWMutex
+	handlers       map[HandlerKey]ResponseErrorHandler
+	defaultHandler ResponseErrorHandler
+}
+
+// NewErrorHandlerRegistry creates a new ErrorHandlerRegistry instance.
+//
+// This function initializes an ErrorHandlerRegistry with an empty handler map and
+// assigns a DefaultErrorHandler as the fallback handler.
+//
+// Returns:
+//   - A pointer to the newly constructed ErrorHandlerRegistry.
+func NewErrorHandlerRegistry() *ErrorHandlerRegistry {
+	return &ErrorHandlerRegistry{
+		handlers:       make(map[HandlerKey]ResponseErrorHandler),
+		defaultHandler: &DefaultErrorHandler{}, // Set the default handler
+	}
+}
+
+// RegisterHandler associates a custom handler with a specific host and command.
+//
+// This method registers a ResponseErrorHandler for the given SMTP host and command
+// combination. It ensures thread-safe access to the internal handler map.
+//
+// Parameters:
+//   - host: The SMTP server hostname.
+//   - command: The SMTP command to associate with the handler.
+//   - handler: The ResponseErrorHandler to register.
+func (r *ErrorHandlerRegistry) RegisterHandler(host, command string, handler ResponseErrorHandler) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.handlers[HandlerKey{Host: strings.ToLower(host), Command: strings.ToLower(command)}] = handler
+}
+
+// GetHandler retrieves the handler for a given host and command.
+//
+// This method returns the ResponseErrorHandler registered for the specified SMTP host
+// and command. If no handler is found, it returns the default handler.
+//
+// Parameters:
+//   - host: The SMTP server hostname.
+//   - command: The SMTP command to look up.
+//
+// Returns:
+//   - The corresponding ResponseErrorHandler, or the default handler if none is registered.
+func (r *ErrorHandlerRegistry) GetHandler(host, command string) ResponseErrorHandler {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	if handler, ok := r.handlers[HandlerKey{Host: strings.ToLower(host), Command: strings.ToLower(command)}]; ok {
+		return handler
+	}
+	return r.defaultHandler
+}
+
+// SetDefaultHandler overrides the default ResponseErrorHandler.
+//
+// This method sets a new default handler to be used when no specific handler is
+// registered for a host and command combination. It ensures thread-safe access.
+//
+// Parameters:
+//   - handler: The new default ResponseErrorHandler to assign.
+func (r *ErrorHandlerRegistry) SetDefaultHandler(handler ResponseErrorHandler) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.defaultHandler = handler
+}

backend/vendor/golang.org/x/crypto/blake2b/go125.go

@@ -0,0 +1,11 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build go1.25
+
+package blake2b
+
+import "hash"
+
+var _ hash.XOF = (*xof)(nil)

backend/vendor/golang.org/x/text/runes/cond.go

@@ -0,0 +1,187 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package runes
+
+import (
+	"unicode/utf8"
+
+	"golang.org/x/text/transform"
+)
+
+// Note: below we pass invalid UTF-8 to the tIn and tNotIn transformers as is.
+// This is done for various reasons:
+// - To retain the semantics of the Nop transformer: if input is passed to a Nop
+//   one would expect it to be unchanged.
+// - It would be very expensive to pass a converted RuneError to a transformer:
+//   a transformer might need more source bytes after RuneError, meaning that
+//   the only way to pass it safely is to create a new buffer and manage the
+//   intermingling of RuneErrors and normal input.
+// - Many transformers leave ill-formed UTF-8 as is, so this is not
+//   inconsistent. Generally ill-formed UTF-8 is only replaced if it is a
+//   logical consequence of the operation (as for Map) or if it otherwise would
+//   pose security concerns (as for Remove).
+// - An alternative would be to return an error on ill-formed UTF-8, but this
+//   would be inconsistent with other operations.
+
+// If returns a transformer that applies tIn to consecutive runes for which
+// s.Contains(r) and tNotIn to consecutive runes for which !s.Contains(r). Reset
+// is called on tIn and tNotIn at the start of each run. A Nop transformer will
+// substitute a nil value passed to tIn or tNotIn. Invalid UTF-8 is translated
+// to RuneError to determine which transformer to apply, but is passed as is to
+// the respective transformer.
+func If(s Set, tIn, tNotIn transform.Transformer) Transformer {
+	if tIn == nil && tNotIn == nil {
+		return Transformer{transform.Nop}
+	}
+	if tIn == nil {
+		tIn = transform.Nop
+	}
+	if tNotIn == nil {
+		tNotIn = transform.Nop
+	}
+	sIn, ok := tIn.(transform.SpanningTransformer)
+	if !ok {
+		sIn = dummySpan{tIn}
+	}
+	sNotIn, ok := tNotIn.(transform.SpanningTransformer)
+	if !ok {
+		sNotIn = dummySpan{tNotIn}
+	}
+
+	a := &cond{
+		tIn:    sIn,
+		tNotIn: sNotIn,
+		f:      s.Contains,
+	}
+	a.Reset()
+	return Transformer{a}
+}
+
+type dummySpan struct{ transform.Transformer }
+
+func (d dummySpan) Span(src []byte, atEOF bool) (n int, err error) {
+	return 0, transform.ErrEndOfSpan
+}
+
+type cond struct {
+	tIn, tNotIn transform.SpanningTransformer
+	f           func(rune) bool
+	check       func(rune) bool               // current check to perform
+	t           transform.SpanningTransformer // current transformer to use
+}
+
+// Reset implements transform.Transformer.
+func (t *cond) Reset() {
+	t.check = t.is
+	t.t = t.tIn
+	t.t.Reset() // notIn will be reset on first usage.
+}
+
+func (t *cond) is(r rune) bool {
+	if t.f(r) {
+		return true
+	}
+	t.check = t.isNot
+	t.t = t.tNotIn
+	t.tNotIn.Reset()
+	return false
+}
+
+func (t *cond) isNot(r rune) bool {
+	if !t.f(r) {
+		return true
+	}
+	t.check = t.is
+	t.t = t.tIn
+	t.tIn.Reset()
+	return false
+}
+
+// This implementation of Span doesn't help all too much, but it needs to be
+// there to satisfy this package's Transformer interface.
+// TODO: there are certainly room for improvements, though. For example, if
+// t.t == transform.Nop (which will a common occurrence) it will save a bundle
+// to special-case that loop.
+func (t *cond) Span(src []byte, atEOF bool) (n int, err error) {
+	p := 0
+	for n < len(src) && err == nil {
+		// Don't process too much at a time as the Spanner that will be
+		// called on this block may terminate early.
+		const maxChunk = 4096
+		max := len(src)
+		if v := n + maxChunk; v < max {
+			max = v
+		}
+		atEnd := false
+		size := 0
+		current := t.t
+		for ; p < max; p += size {
+			r := rune(src[p])
+			if r < utf8.RuneSelf {
+				size = 1
+			} else if r, size = utf8.DecodeRune(src[p:]); size == 1 {
+				if !atEOF && !utf8.FullRune(src[p:]) {
+					err = transform.ErrShortSrc
+					break
+				}
+			}
+			if !t.check(r) {
+				// The next rune will be the start of a new run.
+				atEnd = true
+				break
+			}
+		}
+		n2, err2 := current.Span(src[n:p], atEnd || (atEOF && p == len(src)))
+		n += n2
+		if err2 != nil {
+			return n, err2
+		}
+		// At this point either err != nil or t.check will pass for the rune at p.
+		p = n + size
+	}
+	return n, err
+}
+
+func (t *cond) Transform(dst, src []byte, atEOF bool) (nDst, nSrc int, err error) {
+	p := 0
+	for nSrc < len(src) && err == nil {
+		// Don't process too much at a time, as the work might be wasted if the
+		// destination buffer isn't large enough to hold the result or a
+		// transform returns an error early.
+		const maxChunk = 4096
+		max := len(src)
+		if n := nSrc + maxChunk; n < len(src) {
+			max = n
+		}
+		atEnd := false
+		size := 0
+		current := t.t
+		for ; p < max; p += size {
+			r := rune(src[p])
+			if r < utf8.RuneSelf {
+				size = 1
+			} else if r, size = utf8.DecodeRune(src[p:]); size == 1 {
+				if !atEOF && !utf8.FullRune(src[p:]) {
+					err = transform.ErrShortSrc
+					break
+				}
+			}
+			if !t.check(r) {
+				// The next rune will be the start of a new run.
+				atEnd = true
+				break
+			}
+		}
+		nDst2, nSrc2, err2 := current.Transform(dst[nDst:], src[nSrc:p], atEnd || (atEOF && p == len(src)))
+		nDst += nDst2
+		nSrc += nSrc2
+		if err2 != nil {
+			return nDst, nSrc, err2
+		}
+		// At this point either err != nil or t.check will pass for the rune at p.
+		p = nSrc + size
+	}
+	return nDst, nSrc, err
+}

backend/vendor/golang.org/x/text/runes/runes.go

@@ -0,0 +1,355 @@
+// Copyright 2014 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package runes provide transforms for UTF-8 encoded text.
+package runes // import "golang.org/x/text/runes"
+
+import (
+	"unicode"
+	"unicode/utf8"
+
+	"golang.org/x/text/transform"
+)
+
+// A Set is a collection of runes.
+type Set interface {
+	// Contains returns true if r is contained in the set.
+	Contains(r rune) bool
+}
+
+type setFunc func(rune) bool
+
+func (s setFunc) Contains(r rune) bool {
+	return s(r)
+}
+
+// Note: using funcs here instead of wrapping types result in cleaner
+// documentation and a smaller API.
+
+// In creates a Set with a Contains method that returns true for all runes in
+// the given RangeTable.
+func In(rt *unicode.RangeTable) Set {
+	return setFunc(func(r rune) bool { return unicode.Is(rt, r) })
+}
+
+// NotIn creates a Set with a Contains method that returns true for all runes not
+// in the given RangeTable.
+func NotIn(rt *unicode.RangeTable) Set {
+	return setFunc(func(r rune) bool { return !unicode.Is(rt, r) })
+}
+
+// Predicate creates a Set with a Contains method that returns f(r).
+func Predicate(f func(rune) bool) Set {
+	return setFunc(f)
+}
+
+// Transformer implements the transform.Transformer interface.
+type Transformer struct {
+	t transform.SpanningTransformer
+}
+
+func (t Transformer) Transform(dst, src []byte, atEOF bool) (nDst, nSrc int, err error) {
+	return t.t.Transform(dst, src, atEOF)
+}
+
+func (t Transformer) Span(b []byte, atEOF bool) (n int, err error) {
+	return t.t.Span(b, atEOF)
+}
+
+func (t Transformer) Reset() { t.t.Reset() }
+
+// Bytes returns a new byte slice with the result of converting b using t.  It
+// calls Reset on t. It returns nil if any error was found. This can only happen
+// if an error-producing Transformer is passed to If.
+func (t Transformer) Bytes(b []byte) []byte {
+	b, _, err := transform.Bytes(t, b)
+	if err != nil {
+		return nil
+	}
+	return b
+}
+
+// String returns a string with the result of converting s using t. It calls
+// Reset on t. It returns the empty string if any error was found. This can only
+// happen if an error-producing Transformer is passed to If.
+func (t Transformer) String(s string) string {
+	s, _, err := transform.String(t, s)
+	if err != nil {
+		return ""
+	}
+	return s
+}
+
+// TODO:
+// - Copy: copying strings and bytes in whole-rune units.
+// - Validation (maybe)
+// - Well-formed-ness (maybe)
+
+const runeErrorString = string(utf8.RuneError)
+
+// Remove returns a Transformer that removes runes r for which s.Contains(r).
+// Illegal input bytes are replaced by RuneError before being passed to f.
+func Remove(s Set) Transformer {
+	if f, ok := s.(setFunc); ok {
+		// This little trick cuts the running time of BenchmarkRemove for sets
+		// created by Predicate roughly in half.
+		// TODO: special-case RangeTables as well.
+		return Transformer{remove(f)}
+	}
+	return Transformer{remove(s.Contains)}
+}
+
+// TODO: remove transform.RemoveFunc.
+
+type remove func(r rune) bool
+
+func (remove) Reset() {}
+
+// Span implements transform.Spanner.
+func (t remove) Span(src []byte, atEOF bool) (n int, err error) {
+	for r, size := rune(0), 0; n < len(src); {
+		if r = rune(src[n]); r < utf8.RuneSelf {
+			size = 1
+		} else if r, size = utf8.DecodeRune(src[n:]); size == 1 {
+			// Invalid rune.
+			if !atEOF && !utf8.FullRune(src[n:]) {
+				err = transform.ErrShortSrc
+			} else {
+				err = transform.ErrEndOfSpan
+			}
+			break
+		}
+		if t(r) {
+			err = transform.ErrEndOfSpan
+			break
+		}
+		n += size
+	}
+	return
+}
+
+// Transform implements transform.Transformer.
+func (t remove) Transform(dst, src []byte, atEOF bool) (nDst, nSrc int, err error) {
+	for r, size := rune(0), 0; nSrc < len(src); {
+		if r = rune(src[nSrc]); r < utf8.RuneSelf {
+			size = 1
+		} else if r, size = utf8.DecodeRune(src[nSrc:]); size == 1 {
+			// Invalid rune.
+			if !atEOF && !utf8.FullRune(src[nSrc:]) {
+				err = transform.ErrShortSrc
+				break
+			}
+			// We replace illegal bytes with RuneError. Not doing so might
+			// otherwise turn a sequence of invalid UTF-8 into valid UTF-8.
+			// The resulting byte sequence may subsequently contain runes
+			// for which t(r) is true that were passed unnoticed.
+			if !t(utf8.RuneError) {
+				if nDst+3 > len(dst) {
+					err = transform.ErrShortDst
+					break
+				}
+				dst[nDst+0] = runeErrorString[0]
+				dst[nDst+1] = runeErrorString[1]
+				dst[nDst+2] = runeErrorString[2]
+				nDst += 3
+			}
+			nSrc++
+			continue
+		}
+		if t(r) {
+			nSrc += size
+			continue
+		}
+		if nDst+size > len(dst) {
+			err = transform.ErrShortDst
+			break
+		}
+		for i := 0; i < size; i++ {
+			dst[nDst] = src[nSrc]
+			nDst++
+			nSrc++
+		}
+	}
+	return
+}
+
+// Map returns a Transformer that maps the runes in the input using the given
+// mapping. Illegal bytes in the input are converted to utf8.RuneError before
+// being passed to the mapping func.
+func Map(mapping func(rune) rune) Transformer {
+	return Transformer{mapper(mapping)}
+}
+
+type mapper func(rune) rune
+
+func (mapper) Reset() {}
+
+// Span implements transform.Spanner.
+func (t mapper) Span(src []byte, atEOF bool) (n int, err error) {
+	for r, size := rune(0), 0; n < len(src); n += size {
+		if r = rune(src[n]); r < utf8.RuneSelf {
+			size = 1
+		} else if r, size = utf8.DecodeRune(src[n:]); size == 1 {
+			// Invalid rune.
+			if !atEOF && !utf8.FullRune(src[n:]) {
+				err = transform.ErrShortSrc
+			} else {
+				err = transform.ErrEndOfSpan
+			}
+			break
+		}
+		if t(r) != r {
+			err = transform.ErrEndOfSpan
+			break
+		}
+	}
+	return n, err
+}
+
+// Transform implements transform.Transformer.
+func (t mapper) Transform(dst, src []byte, atEOF bool) (nDst, nSrc int, err error) {
+	var replacement rune
+	var b [utf8.UTFMax]byte
+
+	for r, size := rune(0), 0; nSrc < len(src); {
+		if r = rune(src[nSrc]); r < utf8.RuneSelf {
+			if replacement = t(r); replacement < utf8.RuneSelf {
+				if nDst == len(dst) {
+					err = transform.ErrShortDst
+					break
+				}
+				dst[nDst] = byte(replacement)
+				nDst++
+				nSrc++
+				continue
+			}
+			size = 1
+		} else if r, size = utf8.DecodeRune(src[nSrc:]); size == 1 {
+			// Invalid rune.
+			if !atEOF && !utf8.FullRune(src[nSrc:]) {
+				err = transform.ErrShortSrc
+				break
+			}
+
+			if replacement = t(utf8.RuneError); replacement == utf8.RuneError {
+				if nDst+3 > len(dst) {
+					err = transform.ErrShortDst
+					break
+				}
+				dst[nDst+0] = runeErrorString[0]
+				dst[nDst+1] = runeErrorString[1]
+				dst[nDst+2] = runeErrorString[2]
+				nDst += 3
+				nSrc++
+				continue
+			}
+		} else if replacement = t(r); replacement == r {
+			if nDst+size > len(dst) {
+				err = transform.ErrShortDst
+				break
+			}
+			for i := 0; i < size; i++ {
+				dst[nDst] = src[nSrc]
+				nDst++
+				nSrc++
+			}
+			continue
+		}
+
+		n := utf8.EncodeRune(b[:], replacement)
+
+		if nDst+n > len(dst) {
+			err = transform.ErrShortDst
+			break
+		}
+		for i := 0; i < n; i++ {
+			dst[nDst] = b[i]
+			nDst++
+		}
+		nSrc += size
+	}
+	return
+}
+
+// ReplaceIllFormed returns a transformer that replaces all input bytes that are
+// not part of a well-formed UTF-8 code sequence with utf8.RuneError.
+func ReplaceIllFormed() Transformer {
+	return Transformer{&replaceIllFormed{}}
+}
+
+type replaceIllFormed struct{ transform.NopResetter }
+
+func (t replaceIllFormed) Span(src []byte, atEOF bool) (n int, err error) {
+	for n < len(src) {
+		// ASCII fast path.
+		if src[n] < utf8.RuneSelf {
+			n++
+			continue
+		}
+
+		r, size := utf8.DecodeRune(src[n:])
+
+		// Look for a valid non-ASCII rune.
+		if r != utf8.RuneError || size != 1 {
+			n += size
+			continue
+		}
+
+		// Look for short source data.
+		if !atEOF && !utf8.FullRune(src[n:]) {
+			err = transform.ErrShortSrc
+			break
+		}
+
+		// We have an invalid rune.
+		err = transform.ErrEndOfSpan
+		break
+	}
+	return n, err
+}
+
+func (t replaceIllFormed) Transform(dst, src []byte, atEOF bool) (nDst, nSrc int, err error) {
+	for nSrc < len(src) {
+		// ASCII fast path.
+		if r := src[nSrc]; r < utf8.RuneSelf {
+			if nDst == len(dst) {
+				err = transform.ErrShortDst
+				break
+			}
+			dst[nDst] = r
+			nDst++
+			nSrc++
+			continue
+		}
+
+		// Look for a valid non-ASCII rune.
+		if _, size := utf8.DecodeRune(src[nSrc:]); size != 1 {
+			if size != copy(dst[nDst:], src[nSrc:nSrc+size]) {
+				err = transform.ErrShortDst
+				break
+			}
+			nDst += size
+			nSrc += size
+			continue
+		}
+
+		// Look for short source data.
+		if !atEOF && !utf8.FullRune(src[nSrc:]) {
+			err = transform.ErrShortSrc
+			break
+		}
+
+		// We have an invalid rune.
+		if nDst+3 > len(dst) {
+			err = transform.ErrShortDst
+			break
+		}
+		dst[nDst+0] = runeErrorString[0]
+		dst[nDst+1] = runeErrorString[1]
+		dst[nDst+2] = runeErrorString[2]
+		nDst += 3
+		nSrc++
+	}
+	return nDst, nSrc, err
+}

backend/vendor/golang.org/x/text/secure/precis/class.go

@@ -0,0 +1,36 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package precis
+
+import (
+	"unicode/utf8"
+)
+
+// TODO: Add contextual character rules from Appendix A of RFC5892.
+
+// A class is a set of characters that match certain derived properties. The
+// PRECIS framework defines two classes: The Freeform class and the Identifier
+// class. The freeform class should be used for profiles where expressiveness is
+// prioritized over safety such as nicknames or passwords. The identifier class
+// should be used for profiles where safety is the first priority such as
+// addressable network labels and usernames.
+type class struct {
+	validFrom property
+}
+
+// Contains satisfies the runes.Set interface and returns whether the given rune
+// is a member of the class.
+func (c class) Contains(r rune) bool {
+	b := make([]byte, 4)
+	n := utf8.EncodeRune(b, r)
+
+	trieval, _ := dpTrie.lookup(b[:n])
+	return c.validFrom <= property(trieval)
+}
+
+var (
+	identifier = &class{validFrom: pValid}
+	freeform   = &class{validFrom: idDisOrFreePVal}
+)

backend/vendor/golang.org/x/text/secure/precis/context.go

@@ -0,0 +1,139 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package precis
+
+import "errors"
+
+// This file contains tables and code related to context rules.
+
+type catBitmap uint16
+
+const (
+	// These bits, once set depending on the current value, are never unset.
+	bJapanese catBitmap = 1 << iota
+	bArabicIndicDigit
+	bExtendedArabicIndicDigit
+
+	// These bits are set on each iteration depending on the current value.
+	bJoinStart
+	bJoinMid
+	bJoinEnd
+	bVirama
+	bLatinSmallL
+	bGreek
+	bHebrew
+
+	// These bits indicated which of the permanent bits need to be set at the
+	// end of the checks.
+	bMustHaveJapn
+
+	permanent = bJapanese | bArabicIndicDigit | bExtendedArabicIndicDigit | bMustHaveJapn
+)
+
+const finalShift = 10
+
+var errContext = errors.New("precis: contextual rule violated")
+
+func init() {
+	// Programmatically set these required bits as, manually setting them seems
+	// too error prone.
+	for i, ct := range categoryTransitions {
+		categoryTransitions[i].keep |= permanent
+		categoryTransitions[i].accept |= ct.term
+	}
+}
+
+var categoryTransitions = []struct {
+	keep catBitmap // mask selecting which bits to keep from the previous state
+	set  catBitmap // mask for which bits to set for this transition
+
+	// These bitmaps are used for rules that require lookahead.
+	// term&accept == term must be true, which is enforced programmatically.
+	term   catBitmap // bits accepted as termination condition
+	accept catBitmap // bits that pass, but not sufficient as termination
+
+	// The rule function cannot take a *context as an argument, as it would
+	// cause the context to escape, adding significant overhead.
+	rule func(beforeBits catBitmap) (doLookahead bool, err error)
+}{
+	joiningL:          {set: bJoinStart},
+	joiningD:          {set: bJoinStart | bJoinEnd},
+	joiningT:          {keep: bJoinStart, set: bJoinMid},
+	joiningR:          {set: bJoinEnd},
+	viramaModifier:    {set: bVirama},
+	viramaJoinT:       {set: bVirama | bJoinMid},
+	latinSmallL:       {set: bLatinSmallL},
+	greek:             {set: bGreek},
+	greekJoinT:        {set: bGreek | bJoinMid},
+	hebrew:            {set: bHebrew},
+	hebrewJoinT:       {set: bHebrew | bJoinMid},
+	japanese:          {set: bJapanese},
+	katakanaMiddleDot: {set: bMustHaveJapn},
+
+	zeroWidthNonJoiner: {
+		term:   bJoinEnd,
+		accept: bJoinMid,
+		rule: func(before catBitmap) (doLookAhead bool, err error) {
+			if before&bVirama != 0 {
+				return false, nil
+			}
+			if before&bJoinStart == 0 {
+				return false, errContext
+			}
+			return true, nil
+		},
+	},
+	zeroWidthJoiner: {
+		rule: func(before catBitmap) (doLookAhead bool, err error) {
+			if before&bVirama == 0 {
+				err = errContext
+			}
+			return false, err
+		},
+	},
+	middleDot: {
+		term: bLatinSmallL,
+		rule: func(before catBitmap) (doLookAhead bool, err error) {
+			if before&bLatinSmallL == 0 {
+				return false, errContext
+			}
+			return true, nil
+		},
+	},
+	greekLowerNumeralSign: {
+		set:  bGreek,
+		term: bGreek,
+		rule: func(before catBitmap) (doLookAhead bool, err error) {
+			return true, nil
+		},
+	},
+	hebrewPreceding: {
+		set: bHebrew,
+		rule: func(before catBitmap) (doLookAhead bool, err error) {
+			if before&bHebrew == 0 {
+				err = errContext
+			}
+			return false, err
+		},
+	},
+	arabicIndicDigit: {
+		set: bArabicIndicDigit,
+		rule: func(before catBitmap) (doLookAhead bool, err error) {
+			if before&bExtendedArabicIndicDigit != 0 {
+				err = errContext
+			}
+			return false, err
+		},
+	},
+	extendedArabicIndicDigit: {
+		set: bExtendedArabicIndicDigit,
+		rule: func(before catBitmap) (doLookAhead bool, err error) {
+			if before&bArabicIndicDigit != 0 {
+				err = errContext
+			}
+			return false, err
+		},
+	},
+}

backend/vendor/golang.org/x/text/secure/precis/doc.go

@@ -0,0 +1,14 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package precis contains types and functions for the preparation,
+// enforcement, and comparison of internationalized strings ("PRECIS") as
+// defined in RFC 8264. It also contains several pre-defined profiles for
+// passwords, nicknames, and usernames as defined in RFC 8265 and RFC 8266.
+//
+// BE ADVISED: This package is under construction and the API may change in
+// backwards incompatible ways and without notice.
+package precis // import "golang.org/x/text/secure/precis"
+
+//go:generate go run gen.go gen_trieval.go

backend/vendor/golang.org/x/text/secure/precis/nickname.go

@@ -0,0 +1,72 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package precis
+
+import (
+	"unicode"
+	"unicode/utf8"
+
+	"golang.org/x/text/transform"
+)
+
+type nickAdditionalMapping struct {
+	// TODO: This transformer needs to be stateless somehow…
+	notStart  bool
+	prevSpace bool
+}
+
+func (t *nickAdditionalMapping) Reset() {
+	t.prevSpace = false
+	t.notStart = false
+}
+
+func (t *nickAdditionalMapping) Transform(dst, src []byte, atEOF bool) (nDst, nSrc int, err error) {
+	// RFC 8266 §2.1.  Rules
+	//
+	// 2.  Additional Mapping Rule: The additional mapping rule consists of
+	//     the following sub-rules.
+	//
+	//     a.  Map any instances of non-ASCII space to SPACE (U+0020); a
+	//         non-ASCII space is any Unicode code point having a general
+	//         category of "Zs", naturally with the exception of SPACE
+	//         (U+0020).  (The inclusion of only ASCII space prevents
+	//         confusion with various non-ASCII space code points, many of
+	//         which are difficult to reproduce across different input
+	//         methods.)
+	//
+	//     b.  Remove any instances of the ASCII space character at the
+	//         beginning or end of a nickname (e.g., "stpeter " is mapped to
+	//         "stpeter").
+	//
+	//     c.  Map interior sequences of more than one ASCII space character
+	//         to a single ASCII space character (e.g., "St  Peter" is
+	//         mapped to "St Peter").
+	for nSrc < len(src) {
+		r, size := utf8.DecodeRune(src[nSrc:])
+		if size == 0 { // Incomplete UTF-8 encoding
+			if !atEOF {
+				return nDst, nSrc, transform.ErrShortSrc
+			}
+			size = 1
+		}
+		if unicode.Is(unicode.Zs, r) {
+			t.prevSpace = true
+		} else {
+			if t.prevSpace && t.notStart {
+				dst[nDst] = ' '
+				nDst += 1
+			}
+			if size != copy(dst[nDst:], src[nSrc:nSrc+size]) {
+				nDst += size
+				return nDst, nSrc, transform.ErrShortDst
+			}
+			nDst += size
+			t.prevSpace = false
+			t.notStart = true
+		}
+		nSrc += size
+	}
+	return nDst, nSrc, nil
+}

backend/vendor/golang.org/x/text/secure/precis/options.go

@@ -0,0 +1,157 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package precis
+
+import (
+	"golang.org/x/text/cases"
+	"golang.org/x/text/language"
+	"golang.org/x/text/runes"
+	"golang.org/x/text/transform"
+	"golang.org/x/text/unicode/norm"
+)
+
+// An Option is used to define the behavior and rules of a Profile.
+type Option func(*options)
+
+type options struct {
+	// Preparation options
+	foldWidth bool
+
+	// Enforcement options
+	asciiLower    bool
+	cases         transform.SpanningTransformer
+	disallow      runes.Set
+	norm          transform.SpanningTransformer
+	additional    []func() transform.SpanningTransformer
+	width         transform.SpanningTransformer
+	disallowEmpty bool
+	bidiRule      bool
+	repeat        bool
+
+	// Comparison options
+	ignorecase bool
+}
+
+func getOpts(o ...Option) (res options) {
+	for _, f := range o {
+		f(&res)
+	}
+	// Using a SpanningTransformer, instead of norm.Form prevents an allocation
+	// down the road.
+	if res.norm == nil {
+		res.norm = norm.NFC
+	}
+	return
+}
+
+var (
+	// The IgnoreCase option causes the profile to perform a case insensitive
+	// comparison during the PRECIS comparison step.
+	IgnoreCase Option = ignoreCase
+
+	// The FoldWidth option causes the profile to map non-canonical wide and
+	// narrow variants to their decomposition mapping. This is useful for
+	// profiles that are based on the identifier class which would otherwise
+	// disallow such characters.
+	FoldWidth Option = foldWidth
+
+	// The DisallowEmpty option causes the enforcement step to return an error if
+	// the resulting string would be empty.
+	DisallowEmpty Option = disallowEmpty
+
+	// The BidiRule option causes the Bidi Rule defined in RFC 5893 to be
+	// applied.
+	BidiRule Option = bidiRule
+)
+
+var (
+	ignoreCase = func(o *options) {
+		o.ignorecase = true
+	}
+	foldWidth = func(o *options) {
+		o.foldWidth = true
+	}
+	disallowEmpty = func(o *options) {
+		o.disallowEmpty = true
+	}
+	bidiRule = func(o *options) {
+		o.bidiRule = true
+	}
+	repeat = func(o *options) {
+		o.repeat = true
+	}
+)
+
+// TODO: move this logic to package transform
+
+type spanWrap struct{ transform.Transformer }
+
+func (s spanWrap) Span(src []byte, atEOF bool) (n int, err error) {
+	return 0, transform.ErrEndOfSpan
+}
+
+// TODO: allow different types? For instance:
+//     func() transform.Transformer
+//     func() transform.SpanningTransformer
+//     func([]byte) bool  // validation only
+//
+// Also, would be great if we could detect if a transformer is reentrant.
+
+// The AdditionalMapping option defines the additional mapping rule for the
+// Profile by applying Transformer's in sequence.
+func AdditionalMapping(t ...func() transform.Transformer) Option {
+	return func(o *options) {
+		for _, f := range t {
+			sf := func() transform.SpanningTransformer {
+				return f().(transform.SpanningTransformer)
+			}
+			if _, ok := f().(transform.SpanningTransformer); !ok {
+				sf = func() transform.SpanningTransformer {
+					return spanWrap{f()}
+				}
+			}
+			o.additional = append(o.additional, sf)
+		}
+	}
+}
+
+// The Norm option defines a Profile's normalization rule. Defaults to NFC.
+func Norm(f norm.Form) Option {
+	return func(o *options) {
+		o.norm = f
+	}
+}
+
+// The FoldCase option defines a Profile's case mapping rule. Options can be
+// provided to determine the type of case folding used.
+func FoldCase(opts ...cases.Option) Option {
+	return func(o *options) {
+		o.asciiLower = true
+		o.cases = cases.Fold(opts...)
+	}
+}
+
+// The LowerCase option defines a Profile's case mapping rule. Options can be
+// provided to determine the type of case folding used.
+func LowerCase(opts ...cases.Option) Option {
+	return func(o *options) {
+		o.asciiLower = true
+		if len(opts) == 0 {
+			o.cases = cases.Lower(language.Und, cases.HandleFinalSigma(false))
+			return
+		}
+
+		opts = append([]cases.Option{cases.HandleFinalSigma(false)}, opts...)
+		o.cases = cases.Lower(language.Und, opts...)
+	}
+}
+
+// The Disallow option further restricts a Profile's allowed characters beyond
+// what is disallowed by the underlying string class.
+func Disallow(set runes.Set) Option {
+	return func(o *options) {
+		o.disallow = set
+	}
+}

backend/vendor/golang.org/x/text/secure/precis/profile.go

@@ -0,0 +1,412 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package precis
+
+import (
+	"bytes"
+	"errors"
+	"unicode/utf8"
+
+	"golang.org/x/text/cases"
+	"golang.org/x/text/language"
+	"golang.org/x/text/runes"
+	"golang.org/x/text/secure/bidirule"
+	"golang.org/x/text/transform"
+	"golang.org/x/text/width"
+)
+
+var (
+	errDisallowedRune = errors.New("precis: disallowed rune encountered")
+)
+
+var dpTrie = newDerivedPropertiesTrie(0)
+
+// A Profile represents a set of rules for normalizing and validating strings in
+// the PRECIS framework.
+type Profile struct {
+	options
+	class *class
+}
+
+// NewIdentifier creates a new PRECIS profile based on the Identifier string
+// class. Profiles created from this class are suitable for use where safety is
+// prioritized over expressiveness like network identifiers, user accounts, chat
+// rooms, and file names.
+func NewIdentifier(opts ...Option) *Profile {
+	return &Profile{
+		options: getOpts(opts...),
+		class:   identifier,
+	}
+}
+
+// NewFreeform creates a new PRECIS profile based on the Freeform string class.
+// Profiles created from this class are suitable for use where expressiveness is
+// prioritized over safety like passwords, and display-elements such as
+// nicknames in a chat room.
+func NewFreeform(opts ...Option) *Profile {
+	return &Profile{
+		options: getOpts(opts...),
+		class:   freeform,
+	}
+}
+
+// NewRestrictedProfile creates a new PRECIS profile based on an existing
+// profile.
+// If the parent profile already had the Disallow option set, the new rule
+// overrides the parents rule.
+func NewRestrictedProfile(parent *Profile, disallow runes.Set) *Profile {
+	p := *parent
+	Disallow(disallow)(&p.options)
+	return &p
+}
+
+// NewTransformer creates a new transform.Transformer that performs the PRECIS
+// preparation and enforcement steps on the given UTF-8 encoded bytes.
+func (p *Profile) NewTransformer() *Transformer {
+	var ts []transform.Transformer
+
+	// These transforms are applied in the order defined in
+	// https://tools.ietf.org/html/rfc7564#section-7
+
+	// RFC 8266 §2.1:
+	//
+	//     Implementation experience has shown that applying the rules for the
+	//     Nickname profile is not an idempotent procedure for all code points.
+	//     Therefore, an implementation SHOULD apply the rules repeatedly until
+	//     the output string is stable; if the output string does not stabilize
+	//     after reapplying the rules three (3) additional times after the first
+	//     application, the implementation SHOULD terminate application of the
+	//     rules and reject the input string as invalid.
+	//
+	// There is no known string that will change indefinitely, so repeat 4 times
+	// and rely on the Span method to keep things relatively performant.
+	r := 1
+	if p.options.repeat {
+		r = 4
+	}
+	for ; r > 0; r-- {
+		if p.options.foldWidth {
+			ts = append(ts, width.Fold)
+		}
+
+		for _, f := range p.options.additional {
+			ts = append(ts, f())
+		}
+
+		if p.options.cases != nil {
+			ts = append(ts, p.options.cases)
+		}
+
+		ts = append(ts, p.options.norm)
+
+		if p.options.bidiRule {
+			ts = append(ts, bidirule.New())
+		}
+
+		ts = append(ts, &checker{p: p, allowed: p.Allowed()})
+	}
+
+	// TODO: Add the disallow empty rule with a dummy transformer?
+
+	return &Transformer{transform.Chain(ts...)}
+}
+
+var errEmptyString = errors.New("precis: transformation resulted in empty string")
+
+type buffers struct {
+	src  []byte
+	buf  [2][]byte
+	next int
+}
+
+func (b *buffers) apply(t transform.SpanningTransformer) (err error) {
+	n, err := t.Span(b.src, true)
+	if err != transform.ErrEndOfSpan {
+		return err
+	}
+	x := b.next & 1
+	if b.buf[x] == nil {
+		b.buf[x] = make([]byte, 0, 8+len(b.src)+len(b.src)>>2)
+	}
+	span := append(b.buf[x][:0], b.src[:n]...)
+	b.src, _, err = transform.Append(t, span, b.src[n:])
+	b.buf[x] = b.src
+	b.next++
+	return err
+}
+
+// Pre-allocate transformers when possible. In some cases this avoids allocation.
+var (
+	foldWidthT transform.SpanningTransformer = width.Fold
+	lowerCaseT transform.SpanningTransformer = cases.Lower(language.Und, cases.HandleFinalSigma(false))
+)
+
+// TODO: make this a method on profile.
+
+func (b *buffers) enforce(p *Profile, src []byte, comparing bool) (str []byte, err error) {
+	b.src = src
+
+	ascii := true
+	for _, c := range src {
+		if c >= utf8.RuneSelf {
+			ascii = false
+			break
+		}
+	}
+	// ASCII fast path.
+	if ascii {
+		for _, f := range p.options.additional {
+			if err = b.apply(f()); err != nil {
+				return nil, err
+			}
+		}
+		switch {
+		case p.options.asciiLower || (comparing && p.options.ignorecase):
+			for i, c := range b.src {
+				if 'A' <= c && c <= 'Z' {
+					b.src[i] = c ^ 1<<5
+				}
+			}
+		case p.options.cases != nil:
+			b.apply(p.options.cases)
+		}
+		c := checker{p: p}
+		if _, err := c.span(b.src, true); err != nil {
+			return nil, err
+		}
+		if p.disallow != nil {
+			for _, c := range b.src {
+				if p.disallow.Contains(rune(c)) {
+					return nil, errDisallowedRune
+				}
+			}
+		}
+		if p.options.disallowEmpty && len(b.src) == 0 {
+			return nil, errEmptyString
+		}
+		return b.src, nil
+	}
+
+	// These transforms are applied in the order defined in
+	// https://tools.ietf.org/html/rfc8264#section-7
+
+	r := 1
+	if p.options.repeat {
+		r = 4
+	}
+	for ; r > 0; r-- {
+		// TODO: allow different width transforms options.
+		if p.options.foldWidth || (p.options.ignorecase && comparing) {
+			b.apply(foldWidthT)
+		}
+		for _, f := range p.options.additional {
+			if err = b.apply(f()); err != nil {
+				return nil, err
+			}
+		}
+		if p.options.cases != nil {
+			b.apply(p.options.cases)
+		}
+		if comparing && p.options.ignorecase {
+			b.apply(lowerCaseT)
+		}
+		b.apply(p.norm)
+		if p.options.bidiRule && !bidirule.Valid(b.src) {
+			return nil, bidirule.ErrInvalid
+		}
+		c := checker{p: p}
+		if _, err := c.span(b.src, true); err != nil {
+			return nil, err
+		}
+		if p.disallow != nil {
+			for i := 0; i < len(b.src); {
+				r, size := utf8.DecodeRune(b.src[i:])
+				if p.disallow.Contains(r) {
+					return nil, errDisallowedRune
+				}
+				i += size
+			}
+		}
+		if p.options.disallowEmpty && len(b.src) == 0 {
+			return nil, errEmptyString
+		}
+	}
+	return b.src, nil
+}
+
+// Append appends the result of applying p to src writing the result to dst.
+// It returns an error if the input string is invalid.
+func (p *Profile) Append(dst, src []byte) ([]byte, error) {
+	var buf buffers
+	b, err := buf.enforce(p, src, false)
+	if err != nil {
+		return nil, err
+	}
+	return append(dst, b...), nil
+}
+
+func processBytes(p *Profile, b []byte, key bool) ([]byte, error) {
+	var buf buffers
+	b, err := buf.enforce(p, b, key)
+	if err != nil {
+		return nil, err
+	}
+	if buf.next == 0 {
+		c := make([]byte, len(b))
+		copy(c, b)
+		return c, nil
+	}
+	return b, nil
+}
+
+// Bytes returns a new byte slice with the result of applying the profile to b.
+func (p *Profile) Bytes(b []byte) ([]byte, error) {
+	return processBytes(p, b, false)
+}
+
+// AppendCompareKey appends the result of applying p to src (including any
+// optional rules to make strings comparable or useful in a map key such as
+// applying lowercasing) writing the result to dst. It returns an error if the
+// input string is invalid.
+func (p *Profile) AppendCompareKey(dst, src []byte) ([]byte, error) {
+	var buf buffers
+	b, err := buf.enforce(p, src, true)
+	if err != nil {
+		return nil, err
+	}
+	return append(dst, b...), nil
+}
+
+func processString(p *Profile, s string, key bool) (string, error) {
+	var buf buffers
+	b, err := buf.enforce(p, []byte(s), key)
+	if err != nil {
+		return "", err
+	}
+	return string(b), nil
+}
+
+// String returns a string with the result of applying the profile to s.
+func (p *Profile) String(s string) (string, error) {
+	return processString(p, s, false)
+}
+
+// CompareKey returns a string that can be used for comparison, hashing, or
+// collation.
+func (p *Profile) CompareKey(s string) (string, error) {
+	return processString(p, s, true)
+}
+
+// Compare enforces both strings, and then compares them for bit-string identity
+// (byte-for-byte equality). If either string cannot be enforced, the comparison
+// is false.
+func (p *Profile) Compare(a, b string) bool {
+	var buf buffers
+
+	akey, err := buf.enforce(p, []byte(a), true)
+	if err != nil {
+		return false
+	}
+
+	buf = buffers{}
+	bkey, err := buf.enforce(p, []byte(b), true)
+	if err != nil {
+		return false
+	}
+
+	return bytes.Equal(akey, bkey)
+}
+
+// Allowed returns a runes.Set containing every rune that is a member of the
+// underlying profile's string class and not disallowed by any profile specific
+// rules.
+func (p *Profile) Allowed() runes.Set {
+	if p.options.disallow != nil {
+		return runes.Predicate(func(r rune) bool {
+			return p.class.Contains(r) && !p.options.disallow.Contains(r)
+		})
+	}
+	return p.class
+}
+
+type checker struct {
+	p       *Profile
+	allowed runes.Set
+
+	beforeBits catBitmap
+	termBits   catBitmap
+	acceptBits catBitmap
+}
+
+func (c *checker) Reset() {
+	c.beforeBits = 0
+	c.termBits = 0
+	c.acceptBits = 0
+}
+
+func (c *checker) span(src []byte, atEOF bool) (n int, err error) {
+	for n < len(src) {
+		e, sz := dpTrie.lookup(src[n:])
+		d := categoryTransitions[category(e&catMask)]
+		if sz == 0 {
+			if !atEOF {
+				return n, transform.ErrShortSrc
+			}
+			return n, errDisallowedRune
+		}
+		doLookAhead := false
+		if property(e) < c.p.class.validFrom {
+			if d.rule == nil {
+				return n, errDisallowedRune
+			}
+			doLookAhead, err = d.rule(c.beforeBits)
+			if err != nil {
+				return n, err
+			}
+		}
+		c.beforeBits &= d.keep
+		c.beforeBits |= d.set
+		if c.termBits != 0 {
+			// We are currently in an unterminated lookahead.
+			if c.beforeBits&c.termBits != 0 {
+				c.termBits = 0
+				c.acceptBits = 0
+			} else if c.beforeBits&c.acceptBits == 0 {
+				// Invalid continuation of the unterminated lookahead sequence.
+				return n, errContext
+			}
+		}
+		if doLookAhead {
+			if c.termBits != 0 {
+				// A previous lookahead run has not been terminated yet.
+				return n, errContext
+			}
+			c.termBits = d.term
+			c.acceptBits = d.accept
+		}
+		n += sz
+	}
+	if m := c.beforeBits >> finalShift; c.beforeBits&m != m || c.termBits != 0 {
+		err = errContext
+	}
+	return n, err
+}
+
+// TODO: we may get rid of this transform if transform.Chain understands
+// something like a Spanner interface.
+func (c checker) Transform(dst, src []byte, atEOF bool) (nDst, nSrc int, err error) {
+	short := false
+	if len(dst) < len(src) {
+		src = src[:len(dst)]
+		atEOF = false
+		short = true
+	}
+	nSrc, err = c.span(src, atEOF)
+	nDst = copy(dst, src[:nSrc])
+	if short && (err == transform.ErrShortSrc || err == nil) {
+		err = transform.ErrShortDst
+	}
+	return nDst, nSrc, err
+}

backend/vendor/golang.org/x/text/secure/precis/profiles.go

@@ -0,0 +1,78 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package precis
+
+import (
+	"unicode"
+
+	"golang.org/x/text/runes"
+	"golang.org/x/text/transform"
+	"golang.org/x/text/unicode/norm"
+)
+
+var (
+	// Implements the Nickname profile specified in RFC 8266.
+	Nickname *Profile = nickname
+
+	// Implements the UsernameCaseMapped profile specified in RFC 8265.
+	UsernameCaseMapped *Profile = usernameCaseMap
+
+	// Implements the UsernameCasePreserved profile specified in RFC 8265.
+	UsernameCasePreserved *Profile = usernameNoCaseMap
+
+	// Implements the OpaqueString profile defined in RFC 8265 for passwords and
+	// other secure labels.
+	OpaqueString *Profile = opaquestring
+)
+
+var (
+	nickname = &Profile{
+		options: getOpts(
+			AdditionalMapping(func() transform.Transformer {
+				return &nickAdditionalMapping{}
+			}),
+			IgnoreCase,
+			Norm(norm.NFKC),
+			DisallowEmpty,
+			repeat,
+		),
+		class: freeform,
+	}
+	usernameCaseMap = &Profile{
+		options: getOpts(
+			FoldWidth,
+			LowerCase(),
+			Norm(norm.NFC),
+			BidiRule,
+		),
+		class: identifier,
+	}
+	usernameNoCaseMap = &Profile{
+		options: getOpts(
+			FoldWidth,
+			Norm(norm.NFC),
+			BidiRule,
+		),
+		class: identifier,
+	}
+	opaquestring = &Profile{
+		options: getOpts(
+			AdditionalMapping(func() transform.Transformer {
+				return mapSpaces
+			}),
+			Norm(norm.NFC),
+			DisallowEmpty,
+		),
+		class: freeform,
+	}
+)
+
+// mapSpaces is a shared value of a runes.Map transformer.
+var mapSpaces transform.Transformer = runes.Map(func(r rune) rune {
+	if unicode.Is(unicode.Zs, r) {
+		return ' '
+	}
+	return r
+})

backend/vendor/golang.org/x/text/secure/precis/transformer.go

@@ -0,0 +1,32 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package precis
+
+import "golang.org/x/text/transform"
+
+// Transformer implements the transform.Transformer interface.
+type Transformer struct {
+	t transform.Transformer
+}
+
+// Reset implements the transform.Transformer interface.
+func (t Transformer) Reset() { t.t.Reset() }
+
+// Transform implements the transform.Transformer interface.
+func (t Transformer) Transform(dst, src []byte, atEOF bool) (nDst, nSrc int, err error) {
+	return t.t.Transform(dst, src, atEOF)
+}
+
+// Bytes returns a new byte slice with the result of applying t to b.
+func (t Transformer) Bytes(b []byte) []byte {
+	b, _, _ = transform.Bytes(t, b)
+	return b
+}
+
+// String returns a string with the result of applying t to s.
+func (t Transformer) String(s string) string {
+	s, _, _ = transform.String(t, s)
+	return s
+}

backend/vendor/golang.org/x/text/secure/precis/trieval.go

@@ -0,0 +1,64 @@
+// Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
+
+package precis
+
+// entry is the entry of a trie table
+// 7..6   property (unassigned, disallowed, maybe, valid)
+// 5..0   category
+type entry uint8
+
+const (
+	propShift = 6
+	propMask  = 0xc0
+	catMask   = 0x3f
+)
+
+func (e entry) property() property { return property(e & propMask) }
+func (e entry) category() category { return category(e & catMask) }
+
+type property uint8
+
+// The order of these constants matter. A Profile may consider runes to be
+// allowed either from pValid or idDisOrFreePVal.
+const (
+	unassigned property = iota << propShift
+	disallowed
+	idDisOrFreePVal // disallowed for Identifier, pValid for FreeForm
+	pValid
+)
+
+// compute permutations of all properties and specialCategories.
+type category uint8
+
+const (
+	other category = iota
+
+	// Special rune types
+	joiningL
+	joiningD
+	joiningT
+	joiningR
+	viramaModifier
+	viramaJoinT // Virama + JoiningT
+	latinSmallL // U+006c
+	greek
+	greekJoinT // Greek + JoiningT
+	hebrew
+	hebrewJoinT // Hebrew + JoiningT
+	japanese    // hirigana, katakana, han
+
+	// Special rune types associated with contextual rules defined in
+	// https://tools.ietf.org/html/rfc5892#appendix-A.
+	// ContextO
+	zeroWidthNonJoiner // rule 1
+	zeroWidthJoiner    // rule 2
+	// ContextJ
+	middleDot                // rule 3
+	greekLowerNumeralSign    // rule 4
+	hebrewPreceding          // rule 5 and 6
+	katakanaMiddleDot        // rule 7
+	arabicIndicDigit         // rule 8
+	extendedArabicIndicDigit // rule 9
+
+	numCategories
+)

backend/vendor/golang.org/x/text/width/kind_string.go

@@ -0,0 +1,28 @@
+// Code generated by "stringer -type=Kind"; DO NOT EDIT.
+
+package width
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[Neutral-0]
+	_ = x[EastAsianAmbiguous-1]
+	_ = x[EastAsianWide-2]
+	_ = x[EastAsianNarrow-3]
+	_ = x[EastAsianFullwidth-4]
+	_ = x[EastAsianHalfwidth-5]
+}
+
+const _Kind_name = "NeutralEastAsianAmbiguousEastAsianWideEastAsianNarrowEastAsianFullwidthEastAsianHalfwidth"
+
+var _Kind_index = [...]uint8{0, 7, 25, 38, 53, 71, 89}
+
+func (i Kind) String() string {
+	if i < 0 || i >= Kind(len(_Kind_index)-1) {
+		return "Kind(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+	return _Kind_name[_Kind_index[i]:_Kind_index[i+1]]
+}

backend/vendor/golang.org/x/text/width/transform.go

@@ -0,0 +1,239 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package width
+
+import (
+	"unicode/utf8"
+
+	"golang.org/x/text/transform"
+)
+
+type foldTransform struct {
+	transform.NopResetter
+}
+
+func (foldTransform) Span(src []byte, atEOF bool) (n int, err error) {
+	for n < len(src) {
+		if src[n] < utf8.RuneSelf {
+			// ASCII fast path.
+			for n++; n < len(src) && src[n] < utf8.RuneSelf; n++ {
+			}
+			continue
+		}
+		v, size := trie.lookup(src[n:])
+		if size == 0 { // incomplete UTF-8 encoding
+			if !atEOF {
+				err = transform.ErrShortSrc
+			} else {
+				n = len(src)
+			}
+			break
+		}
+		if elem(v)&tagNeedsFold != 0 {
+			err = transform.ErrEndOfSpan
+			break
+		}
+		n += size
+	}
+	return n, err
+}
+
+func (foldTransform) Transform(dst, src []byte, atEOF bool) (nDst, nSrc int, err error) {
+	for nSrc < len(src) {
+		if src[nSrc] < utf8.RuneSelf {
+			// ASCII fast path.
+			start, end := nSrc, len(src)
+			if d := len(dst) - nDst; d < end-start {
+				end = nSrc + d
+			}
+			for nSrc++; nSrc < end && src[nSrc] < utf8.RuneSelf; nSrc++ {
+			}
+			n := copy(dst[nDst:], src[start:nSrc])
+			if nDst += n; nDst == len(dst) {
+				nSrc = start + n
+				if nSrc == len(src) {
+					return nDst, nSrc, nil
+				}
+				if src[nSrc] < utf8.RuneSelf {
+					return nDst, nSrc, transform.ErrShortDst
+				}
+			}
+			continue
+		}
+		v, size := trie.lookup(src[nSrc:])
+		if size == 0 { // incomplete UTF-8 encoding
+			if !atEOF {
+				return nDst, nSrc, transform.ErrShortSrc
+			}
+			size = 1 // gobble 1 byte
+		}
+		if elem(v)&tagNeedsFold == 0 {
+			if size != copy(dst[nDst:], src[nSrc:nSrc+size]) {
+				return nDst, nSrc, transform.ErrShortDst
+			}
+			nDst += size
+		} else {
+			data := inverseData[byte(v)]
+			if len(dst)-nDst < int(data[0]) {
+				return nDst, nSrc, transform.ErrShortDst
+			}
+			i := 1
+			for end := int(data[0]); i < end; i++ {
+				dst[nDst] = data[i]
+				nDst++
+			}
+			dst[nDst] = data[i] ^ src[nSrc+size-1]
+			nDst++
+		}
+		nSrc += size
+	}
+	return nDst, nSrc, nil
+}
+
+type narrowTransform struct {
+	transform.NopResetter
+}
+
+func (narrowTransform) Span(src []byte, atEOF bool) (n int, err error) {
+	for n < len(src) {
+		if src[n] < utf8.RuneSelf {
+			// ASCII fast path.
+			for n++; n < len(src) && src[n] < utf8.RuneSelf; n++ {
+			}
+			continue
+		}
+		v, size := trie.lookup(src[n:])
+		if size == 0 { // incomplete UTF-8 encoding
+			if !atEOF {
+				err = transform.ErrShortSrc
+			} else {
+				n = len(src)
+			}
+			break
+		}
+		if k := elem(v).kind(); byte(v) == 0 || k != EastAsianFullwidth && k != EastAsianWide && k != EastAsianAmbiguous {
+		} else {
+			err = transform.ErrEndOfSpan
+			break
+		}
+		n += size
+	}
+	return n, err
+}
+
+func (narrowTransform) Transform(dst, src []byte, atEOF bool) (nDst, nSrc int, err error) {
+	for nSrc < len(src) {
+		if src[nSrc] < utf8.RuneSelf {
+			// ASCII fast path.
+			start, end := nSrc, len(src)
+			if d := len(dst) - nDst; d < end-start {
+				end = nSrc + d
+			}
+			for nSrc++; nSrc < end && src[nSrc] < utf8.RuneSelf; nSrc++ {
+			}
+			n := copy(dst[nDst:], src[start:nSrc])
+			if nDst += n; nDst == len(dst) {
+				nSrc = start + n
+				if nSrc == len(src) {
+					return nDst, nSrc, nil
+				}
+				if src[nSrc] < utf8.RuneSelf {
+					return nDst, nSrc, transform.ErrShortDst
+				}
+			}
+			continue
+		}
+		v, size := trie.lookup(src[nSrc:])
+		if size == 0 { // incomplete UTF-8 encoding
+			if !atEOF {
+				return nDst, nSrc, transform.ErrShortSrc
+			}
+			size = 1 // gobble 1 byte
+		}
+		if k := elem(v).kind(); byte(v) == 0 || k != EastAsianFullwidth && k != EastAsianWide && k != EastAsianAmbiguous {
+			if size != copy(dst[nDst:], src[nSrc:nSrc+size]) {
+				return nDst, nSrc, transform.ErrShortDst
+			}
+			nDst += size
+		} else {
+			data := inverseData[byte(v)]
+			if len(dst)-nDst < int(data[0]) {
+				return nDst, nSrc, transform.ErrShortDst
+			}
+			i := 1
+			for end := int(data[0]); i < end; i++ {
+				dst[nDst] = data[i]
+				nDst++
+			}
+			dst[nDst] = data[i] ^ src[nSrc+size-1]
+			nDst++
+		}
+		nSrc += size
+	}
+	return nDst, nSrc, nil
+}
+
+type wideTransform struct {
+	transform.NopResetter
+}
+
+func (wideTransform) Span(src []byte, atEOF bool) (n int, err error) {
+	for n < len(src) {
+		// TODO: Consider ASCII fast path. Special-casing ASCII handling can
+		// reduce the ns/op of BenchmarkWideASCII by about 30%. This is probably
+		// not enough to warrant the extra code and complexity.
+		v, size := trie.lookup(src[n:])
+		if size == 0 { // incomplete UTF-8 encoding
+			if !atEOF {
+				err = transform.ErrShortSrc
+			} else {
+				n = len(src)
+			}
+			break
+		}
+		if k := elem(v).kind(); byte(v) == 0 || k != EastAsianHalfwidth && k != EastAsianNarrow {
+		} else {
+			err = transform.ErrEndOfSpan
+			break
+		}
+		n += size
+	}
+	return n, err
+}
+
+func (wideTransform) Transform(dst, src []byte, atEOF bool) (nDst, nSrc int, err error) {
+	for nSrc < len(src) {
+		// TODO: Consider ASCII fast path. Special-casing ASCII handling can
+		// reduce the ns/op of BenchmarkWideASCII by about 30%. This is probably
+		// not enough to warrant the extra code and complexity.
+		v, size := trie.lookup(src[nSrc:])
+		if size == 0 { // incomplete UTF-8 encoding
+			if !atEOF {
+				return nDst, nSrc, transform.ErrShortSrc
+			}
+			size = 1 // gobble 1 byte
+		}
+		if k := elem(v).kind(); byte(v) == 0 || k != EastAsianHalfwidth && k != EastAsianNarrow {
+			if size != copy(dst[nDst:], src[nSrc:nSrc+size]) {
+				return nDst, nSrc, transform.ErrShortDst
+			}
+			nDst += size
+		} else {
+			data := inverseData[byte(v)]
+			if len(dst)-nDst < int(data[0]) {
+				return nDst, nSrc, transform.ErrShortDst
+			}
+			i := 1
+			for end := int(data[0]); i < end; i++ {
+				dst[nDst] = data[i]
+				nDst++
+			}
+			dst[nDst] = data[i] ^ src[nSrc+size-1]
+			nDst++
+		}
+		nSrc += size
+	}
+	return nDst, nSrc, nil
+}

backend/vendor/golang.org/x/text/width/trieval.go

@@ -0,0 +1,30 @@
+// Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
+
+package width
+
+// elem is an entry of the width trie. The high byte is used to encode the type
+// of the rune. The low byte is used to store the index to a mapping entry in
+// the inverseData array.
+type elem uint16
+
+const (
+	tagNeutral elem = iota << typeShift
+	tagAmbiguous
+	tagWide
+	tagNarrow
+	tagFullwidth
+	tagHalfwidth
+)
+
+const (
+	numTypeBits = 3
+	typeShift   = 16 - numTypeBits
+
+	// tagNeedsFold is true for all fullwidth and halfwidth runes except for
+	// the Won sign U+20A9.
+	tagNeedsFold = 0x1000
+
+	// The Korean Won sign is halfwidth, but SHOULD NOT be mapped to a wide
+	// variant.
+	wonSign rune = 0x20A9
+)

backend/vendor/golang.org/x/text/width/width.go

@@ -0,0 +1,206 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:generate stringer -type=Kind
+//go:generate go run gen.go gen_common.go gen_trieval.go
+
+// Package width provides functionality for handling different widths in text.
+//
+// Wide characters behave like ideographs; they tend to allow line breaks after
+// each character and remain upright in vertical text layout. Narrow characters
+// are kept together in words or runs that are rotated sideways in vertical text
+// layout.
+//
+// For more information, see https://unicode.org/reports/tr11/.
+package width // import "golang.org/x/text/width"
+
+import (
+	"unicode/utf8"
+
+	"golang.org/x/text/transform"
+)
+
+// TODO
+// 1) Reduce table size by compressing blocks.
+// 2) API proposition for computing display length
+//    (approximation, fixed pitch only).
+// 3) Implement display length.
+
+// Kind indicates the type of width property as defined in https://unicode.org/reports/tr11/.
+type Kind int
+
+const (
+	// Neutral characters do not occur in legacy East Asian character sets.
+	Neutral Kind = iota
+
+	// EastAsianAmbiguous characters that can be sometimes wide and sometimes
+	// narrow and require additional information not contained in the character
+	// code to further resolve their width.
+	EastAsianAmbiguous
+
+	// EastAsianWide characters are wide in its usual form. They occur only in
+	// the context of East Asian typography. These runes may have explicit
+	// halfwidth counterparts.
+	EastAsianWide
+
+	// EastAsianNarrow characters are narrow in its usual form. They often have
+	// fullwidth counterparts.
+	EastAsianNarrow
+
+	// Note: there exist Narrow runes that do not have fullwidth or wide
+	// counterparts, despite what the definition says (e.g. U+27E6).
+
+	// EastAsianFullwidth characters have a compatibility decompositions of type
+	// wide that map to a narrow counterpart.
+	EastAsianFullwidth
+
+	// EastAsianHalfwidth characters have a compatibility decomposition of type
+	// narrow that map to a wide or ambiguous counterpart, plus U+20A9 ₩ WON
+	// SIGN.
+	EastAsianHalfwidth
+
+	// Note: there exist runes that have a halfwidth counterparts but that are
+	// classified as Ambiguous, rather than wide (e.g. U+2190).
+)
+
+// TODO: the generated tries need to return size 1 for invalid runes for the
+// width to be computed correctly (each byte should render width 1)
+
+var trie = newWidthTrie(0)
+
+// Lookup reports the Properties of the first rune in b and the number of bytes
+// of its UTF-8 encoding.
+func Lookup(b []byte) (p Properties, size int) {
+	v, sz := trie.lookup(b)
+	return Properties{elem(v), b[sz-1]}, sz
+}
+
+// LookupString reports the Properties of the first rune in s and the number of
+// bytes of its UTF-8 encoding.
+func LookupString(s string) (p Properties, size int) {
+	v, sz := trie.lookupString(s)
+	return Properties{elem(v), s[sz-1]}, sz
+}
+
+// LookupRune reports the Properties of rune r.
+func LookupRune(r rune) Properties {
+	var buf [4]byte
+	n := utf8.EncodeRune(buf[:], r)
+	v, _ := trie.lookup(buf[:n])
+	last := byte(r)
+	if r >= utf8.RuneSelf {
+		last = 0x80 + byte(r&0x3f)
+	}
+	return Properties{elem(v), last}
+}
+
+// Properties provides access to width properties of a rune.
+type Properties struct {
+	elem elem
+	last byte
+}
+
+func (e elem) kind() Kind {
+	return Kind(e >> typeShift)
+}
+
+// Kind returns the Kind of a rune as defined in Unicode TR #11.
+// See https://unicode.org/reports/tr11/ for more details.
+func (p Properties) Kind() Kind {
+	return p.elem.kind()
+}
+
+// Folded returns the folded variant of a rune or 0 if the rune is canonical.
+func (p Properties) Folded() rune {
+	if p.elem&tagNeedsFold != 0 {
+		buf := inverseData[byte(p.elem)]
+		buf[buf[0]] ^= p.last
+		r, _ := utf8.DecodeRune(buf[1 : 1+buf[0]])
+		return r
+	}
+	return 0
+}
+
+// Narrow returns the narrow variant of a rune or 0 if the rune is already
+// narrow or doesn't have a narrow variant.
+func (p Properties) Narrow() rune {
+	if k := p.elem.kind(); byte(p.elem) != 0 && (k == EastAsianFullwidth || k == EastAsianWide || k == EastAsianAmbiguous) {
+		buf := inverseData[byte(p.elem)]
+		buf[buf[0]] ^= p.last
+		r, _ := utf8.DecodeRune(buf[1 : 1+buf[0]])
+		return r
+	}
+	return 0
+}
+
+// Wide returns the wide variant of a rune or 0 if the rune is already
+// wide or doesn't have a wide variant.
+func (p Properties) Wide() rune {
+	if k := p.elem.kind(); byte(p.elem) != 0 && (k == EastAsianHalfwidth || k == EastAsianNarrow) {
+		buf := inverseData[byte(p.elem)]
+		buf[buf[0]] ^= p.last
+		r, _ := utf8.DecodeRune(buf[1 : 1+buf[0]])
+		return r
+	}
+	return 0
+}
+
+// TODO for Properties:
+// - Add Fullwidth/Halfwidth or Inverted methods for computing variants
+// mapping.
+// - Add width information (including information on non-spacing runes).
+
+// Transformer implements the transform.Transformer interface.
+type Transformer struct {
+	t transform.SpanningTransformer
+}
+
+// Reset implements the transform.Transformer interface.
+func (t Transformer) Reset() { t.t.Reset() }
+
+// Transform implements the transform.Transformer interface.
+func (t Transformer) Transform(dst, src []byte, atEOF bool) (nDst, nSrc int, err error) {
+	return t.t.Transform(dst, src, atEOF)
+}
+
+// Span implements the transform.SpanningTransformer interface.
+func (t Transformer) Span(src []byte, atEOF bool) (n int, err error) {
+	return t.t.Span(src, atEOF)
+}
+
+// Bytes returns a new byte slice with the result of applying t to b.
+func (t Transformer) Bytes(b []byte) []byte {
+	b, _, _ = transform.Bytes(t, b)
+	return b
+}
+
+// String returns a string with the result of applying t to s.
+func (t Transformer) String(s string) string {
+	s, _, _ = transform.String(t, s)
+	return s
+}
+
+var (
+	// Fold is a transform that maps all runes to their canonical width.
+	//
+	// Note that the NFKC and NFKD transforms in golang.org/x/text/unicode/norm
+	// provide a more generic folding mechanism.
+	Fold Transformer = Transformer{foldTransform{}}
+
+	// Widen is a transform that maps runes to their wide variant, if
+	// available.
+	Widen Transformer = Transformer{wideTransform{}}
+
+	// Narrow is a transform that maps runes to their narrow variant, if
+	// available.
+	Narrow Transformer = Transformer{narrowTransform{}}
+)
+
+// TODO: Consider the following options:
+// - Treat Ambiguous runes that have a halfwidth counterpart as wide, or some
+//   generalized variant of this.
+// - Consider a wide Won character to be the default width (or some generalized
+//   variant of this).
+// - Filter the set of characters that gets converted (the preferred approach is
+//   to allow applying filters to transforms).

backend/vendor/golang.org/x/tools/internal/gocommand/invoke_notunix.go

@@ -0,0 +1,13 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !unix
+
+package gocommand
+
+import "os"
+
+// sigStuckProcess is the signal to send to kill a hanging subprocess.
+// On Unix we send SIGQUIT, but on non-Unix we only have os.Kill.
+var sigStuckProcess = os.Kill

backend/vendor/golang.org/x/tools/internal/gocommand/invoke_unix.go

@@ -0,0 +1,13 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build unix
+
+package gocommand
+
+import "syscall"
+
+// Sigstuckprocess is the signal to send to kill a hanging subprocess.
+// Send SIGQUIT to get a stack trace.
+var sigStuckProcess = syscall.SIGQUIT

backend/vendor/golang.org/x/tools/internal/stdlib/deps.go

@@ -0,0 +1,359 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Code generated by generate.go. DO NOT EDIT.
+
+package stdlib
+
+type pkginfo struct {
+	name string
+	deps string // list of indices of dependencies, as varint-encoded deltas
+}
+
+var deps = [...]pkginfo{
+	{"archive/tar", "\x03j\x03E5\x01\v\x01#\x01\x01\x02\x05\n\x02\x01\x02\x02\v"},
+	{"archive/zip", "\x02\x04`\a\x16\x0205\x01+\x05\x01\x11\x03\x02\r\x04"},
+	{"bufio", "\x03j}F\x13"},
+	{"bytes", "m+R\x03\fH\x02\x02"},
+	{"cmp", ""},
+	{"compress/bzip2", "\x02\x02\xe6\x01C"},
+	{"compress/flate", "\x02k\x03z\r\x025\x01\x03"},
+	{"compress/gzip", "\x02\x04`\a\x03\x15eU"},
+	{"compress/lzw", "\x02k\x03z"},
+	{"compress/zlib", "\x02\x04`\a\x03\x13\x01f"},
+	{"container/heap", "\xae\x02"},
+	{"container/list", ""},
+	{"container/ring", ""},
+	{"context", "m\\i\x01\f"},
+	{"crypto", "\x83\x01gE"},
+	{"crypto/aes", "\x10\n\a\x8e\x02"},
+	{"crypto/cipher", "\x03\x1e\x01\x01\x1d\x11\x1c,Q"},
+	{"crypto/des", "\x10\x13\x1d-,\x96\x01\x03"},
+	{"crypto/dsa", "@\x04)}\x0e"},
+	{"crypto/ecdh", "\x03\v\f\x0e\x04\x14\x04\r\x1c}"},
+	{"crypto/ecdsa", "\x0e\x05\x03\x04\x01\x0e\x16\x01\x04\f\x01\x1c}\x0e\x04L\x01"},
+	{"crypto/ed25519", "\x0e\x1c\x16\n\a\x1c}E"},
+	{"crypto/elliptic", "0=}\x0e:"},
+	{"crypto/fips140", " \x05\x90\x01"},
+	{"crypto/hkdf", "-\x12\x01-\x16"},
+	{"crypto/hmac", "\x1a\x14\x11\x01\x112"},
+	{"crypto/internal/boring", "\x0e\x02\rf"},
+	{"crypto/internal/boring/bbig", "\x1a\xde\x01M"},
+	{"crypto/internal/boring/bcache", "\xb3\x02\x12"},
+	{"crypto/internal/boring/sig", ""},
+	{"crypto/internal/cryptotest", "\x03\r\n)\x0e\x19\x06\x13\x12#\a\t\x11\x11\x11\x1b\x01\f\r\x05\n"},
+	{"crypto/internal/entropy", "E"},
+	{"crypto/internal/fips140", ">/}9\r\x15"},
+	{"crypto/internal/fips140/aes", "\x03\x1d\x03\x02\x13\x04\x01\x01\x05*\x8c\x016"},
+	{"crypto/internal/fips140/aes/gcm", " \x01\x02\x02\x02\x11\x04\x01\x06*\x8a\x01"},
+	{"crypto/internal/fips140/alias", "\xc5\x02"},
+	{"crypto/internal/fips140/bigmod", "%\x17\x01\x06*\x8c\x01"},
+	{"crypto/internal/fips140/check", " \x0e\x06\b\x02\xac\x01["},
+	{"crypto/internal/fips140/check/checktest", "%\xfe\x01\""},
+	{"crypto/internal/fips140/drbg", "\x03\x1c\x01\x01\x04\x13\x04\b\x01(}\x0f9"},
+	{"crypto/internal/fips140/ecdh", "\x03\x1d\x05\x02\t\f1}\x0f9"},
+	{"crypto/internal/fips140/ecdsa", "\x03\x1d\x04\x01\x02\a\x02\x067}H"},
+	{"crypto/internal/fips140/ed25519", "\x03\x1d\x05\x02\x04\v7\xc2\x01\x03"},
+	{"crypto/internal/fips140/edwards25519", "%\a\f\x041\x8c\x019"},
+	{"crypto/internal/fips140/edwards25519/field", "%\x13\x041\x8c\x01"},
+	{"crypto/internal/fips140/hkdf", "\x03\x1d\x05\t\x069"},
+	{"crypto/internal/fips140/hmac", "\x03\x1d\x14\x01\x017"},
+	{"crypto/internal/fips140/mlkem", "\x03\x1d\x05\x02\x0e\x03\x041"},
+	{"crypto/internal/fips140/nistec", "%\f\a\x041\x8c\x01*\x0f\x13"},
+	{"crypto/internal/fips140/nistec/fiat", "%\x135\x8c\x01"},
+	{"crypto/internal/fips140/pbkdf2", "\x03\x1d\x05\t\x069"},
+	{"crypto/internal/fips140/rsa", "\x03\x1d\x04\x01\x02\r\x01\x01\x025}H"},
+	{"crypto/internal/fips140/sha256", "\x03\x1d\x1c\x01\x06*\x8c\x01"},
+	{"crypto/internal/fips140/sha3", "\x03\x1d\x18\x04\x010\x8c\x01L"},
+	{"crypto/internal/fips140/sha512", "\x03\x1d\x1c\x01\x06*\x8c\x01"},
+	{"crypto/internal/fips140/ssh", " \x05"},
+	{"crypto/internal/fips140/subtle", "#"},
+	{"crypto/internal/fips140/tls12", "\x03\x1d\x05\t\x06\x027"},
+	{"crypto/internal/fips140/tls13", "\x03\x1d\x05\b\a\b1"},
+	{"crypto/internal/fips140deps", ""},
+	{"crypto/internal/fips140deps/byteorder", "\x99\x01"},
+	{"crypto/internal/fips140deps/cpu", "\xad\x01\a"},
+	{"crypto/internal/fips140deps/godebug", "\xb5\x01"},
+	{"crypto/internal/fips140hash", "5\x1a4\xc2\x01"},
+	{"crypto/internal/fips140only", "'\r\x01\x01M25"},
+	{"crypto/internal/fips140test", ""},
+	{"crypto/internal/hpke", "\x0e\x01\x01\x03\x1a\x1d#,`N"},
+	{"crypto/internal/impl", "\xb0\x02"},
+	{"crypto/internal/randutil", "\xea\x01\x12"},
+	{"crypto/internal/sysrand", "mi!\x1f\r\x0f\x01\x01\v\x06"},
+	{"crypto/internal/sysrand/internal/seccomp", "m"},
+	{"crypto/md5", "\x0e2-\x16\x16`"},
+	{"crypto/mlkem", "/"},
+	{"crypto/pbkdf2", "2\r\x01-\x16"},
+	{"crypto/rand", "\x1a\x06\a\x19\x04\x01(}\x0eM"},
+	{"crypto/rc4", "#\x1d-\xc2\x01"},
+	{"crypto/rsa", "\x0e\f\x01\t\x0f\f\x01\x04\x06\a\x1c\x03\x1325\r\x01"},
+	{"crypto/sha1", "\x0e\f&-\x16\x16\x14L"},
+	{"crypto/sha256", "\x0e\f\x1aO"},
+	{"crypto/sha3", "\x0e'N\xc2\x01"},
+	{"crypto/sha512", "\x0e\f\x1cM"},
+	{"crypto/subtle", "8\x96\x01U"},
+	{"crypto/tls", "\x03\b\x02\x01\x01\x01\x01\x02\x01\x01\x01\x03\x01\a\x01\v\x02\n\x01\b\x05\x03\x01\x01\x01\x01\x02\x01\x02\x01\x17\x02\x03\x13\x16\x14\b5\x16\x16\r\n\x01\x01\x01\x02\x01\f\x06\x02\x01"},
+	{"crypto/tls/internal/fips140tls", " \x93\x02"},
+	{"crypto/x509", "\x03\v\x01\x01\x01\x01\x01\x01\x01\x011\x03\x02\x01\x01\x02\x05\x0e\x06\x02\x02\x03E\x032\x01\x02\t\x01\x01\x01\a\x10\x05\x01\x06\x02\x05\f\x01\x02\r\x02\x01\x01\x02\x03\x01"},
+	{"crypto/x509/pkix", "c\x06\a\x88\x01G"},
+	{"database/sql", "\x03\nJ\x16\x03z\f\x06\"\x05\n\x02\x03\x01\f\x02\x02\x02"},
+	{"database/sql/driver", "\r`\x03\xae\x01\x11\x10"},
+	{"debug/buildinfo", "\x03W\x02\x01\x01\b\a\x03`\x18\x02\x01+\x0f "},
+	{"debug/dwarf", "\x03c\a\x03z1\x13\x01\x01"},
+	{"debug/elf", "\x03\x06P\r\a\x03`\x19\x01,\x19\x01\x15"},
+	{"debug/gosym", "\x03c\n\xbe\x01\x01\x01\x02"},
+	{"debug/macho", "\x03\x06P\r\n`\x1a,\x19\x01"},
+	{"debug/pe", "\x03\x06P\r\a\x03`\x1a,\x19\x01\x15"},
+	{"debug/plan9obj", "f\a\x03`\x1a,"},
+	{"embed", "m+:\x18\x01T"},
+	{"embed/internal/embedtest", ""},
+	{"encoding", ""},
+	{"encoding/ascii85", "\xea\x01E"},
+	{"encoding/asn1", "\x03j\x03\x87\x01\x01&\x0f\x02\x01\x0f\x03\x01"},
+	{"encoding/base32", "\xea\x01C\x02"},
+	{"encoding/base64", "\x99\x01QC\x02"},
+	{"encoding/binary", "m}\r'\x0f\x05"},
+	{"encoding/csv", "\x02\x01j\x03zF\x11\x02"},
+	{"encoding/gob", "\x02_\x05\a\x03`\x1a\f\x01\x02\x1d\b\x14\x01\x0e\x02"},
+	{"encoding/hex", "m\x03zC\x03"},
+	{"encoding/json", "\x03\x01]\x04\b\x03z\r'\x0f\x02\x01\x02\x0f\x01\x01\x02"},
+	{"encoding/pem", "\x03b\b}C\x03"},
+	{"encoding/xml", "\x02\x01^\f\x03z4\x05\f\x01\x02\x0f\x02"},
+	{"errors", "\xc9\x01|"},
+	{"expvar", "jK9\t\n\x15\r\n\x02\x03\x01\x10"},
+	{"flag", "a\f\x03z,\b\x05\n\x02\x01\x0f"},
+	{"fmt", "mE8\r\x1f\b\x0f\x02\x03\x11"},
+	{"go/ast", "\x03\x01l\x0f\x01j\x03)\b\x0f\x02\x01"},
+	{"go/ast/internal/tests", ""},
+	{"go/build", "\x02\x01j\x03\x01\x03\x02\a\x02\x01\x17\x1e\x04\x02\t\x14\x12\x01+\x01\x04\x01\a\n\x02\x01\x11\x02\x02"},
+	{"go/build/constraint", "m\xc2\x01\x01\x11\x02"},
+	{"go/constant", "p\x10w\x01\x016\x01\x02\x11"},
+	{"go/doc", "\x04l\x01\x06\t=-1\x12\x02\x01\x11\x02"},
+	{"go/doc/comment", "\x03m\xbd\x01\x01\x01\x01\x11\x02"},
+	{"go/format", "\x03m\x01\f\x01\x02jF"},
+	{"go/importer", "s\a\x01\x01\x04\x01i9"},
+	{"go/internal/gccgoimporter", "\x02\x01W\x13\x03\x05\v\x01g\x02,\x01\x05\x13\x01\v\b"},
+	{"go/internal/gcimporter", "\x02n\x10\x01/\x05\x0e',\x17\x03\x02"},
+	{"go/internal/srcimporter", "p\x01\x02\n\x03\x01i,\x01\x05\x14\x02\x13"},
+	{"go/parser", "\x03j\x03\x01\x03\v\x01j\x01+\x06\x14"},
+	{"go/printer", "p\x01\x03\x03\tj\r\x1f\x17\x02\x01\x02\n\x05\x02"},
+	{"go/scanner", "\x03m\x10j2\x12\x01\x12\x02"},
+	{"go/token", "\x04l\xbd\x01\x02\x03\x01\x0e\x02"},
+	{"go/types", "\x03\x01\x06c\x03\x01\x04\b\x03\x02\x15\x1e\x06+\x04\x03\n%\a\n\x01\x01\x01\x02\x01\x0e\x02\x02"},
+	{"go/version", "\xba\x01v"},
+	{"hash", "\xea\x01"},
+	{"hash/adler32", "m\x16\x16"},
+	{"hash/crc32", "m\x16\x16\x14\x85\x01\x01\x12"},
+	{"hash/crc64", "m\x16\x16\x99\x01"},
+	{"hash/fnv", "m\x16\x16`"},
+	{"hash/maphash", "\x94\x01\x05\x1b\x03@N"},
+	{"html", "\xb0\x02\x02\x11"},
+	{"html/template", "\x03g\x06\x19,5\x01\v \x05\x01\x02\x03\x0e\x01\x02\v\x01\x03\x02"},
+	{"image", "\x02k\x1f^\x0f6\x03\x01"},
+	{"image/color", ""},
+	{"image/color/palette", "\x8c\x01"},
+	{"image/draw", "\x8b\x01\x01\x04"},
+	{"image/gif", "\x02\x01\x05e\x03\x1b\x01\x01\x01\vQ"},
+	{"image/internal/imageutil", "\x8b\x01"},
+	{"image/jpeg", "\x02k\x1e\x01\x04Z"},
+	{"image/png", "\x02\a]\n\x13\x02\x06\x01^E"},
+	{"index/suffixarray", "\x03c\a}\r*\f\x01"},
+	{"internal/abi", "\xb4\x01\x91\x01"},
+	{"internal/asan", "\xc5\x02"},
+	{"internal/bisect", "\xa3\x02\x0f\x01"},
+	{"internal/buildcfg", "pG_\x06\x02\x05\f\x01"},
+	{"internal/bytealg", "\xad\x01\x98\x01"},
+	{"internal/byteorder", ""},
+	{"internal/cfg", ""},
+	{"internal/chacha8rand", "\x99\x01\x1b\x91\x01"},
+	{"internal/copyright", ""},
+	{"internal/coverage", ""},
+	{"internal/coverage/calloc", ""},
+	{"internal/coverage/cfile", "j\x06\x17\x16\x01\x02\x01\x01\x01\x01\x01\x01\x01#\x01\x1f,\x06\a\f\x01\x03\f\x06"},
+	{"internal/coverage/cformat", "\x04l-\x04I\f7\x01\x02\f"},
+	{"internal/coverage/cmerge", "p-Z"},
+	{"internal/coverage/decodecounter", "f\n-\v\x02@,\x19\x16"},
+	{"internal/coverage/decodemeta", "\x02d\n\x17\x16\v\x02@,"},
+	{"internal/coverage/encodecounter", "\x02d\n-\f\x01\x02>\f \x17"},
+	{"internal/coverage/encodemeta", "\x02\x01c\n\x13\x04\x16\r\x02>,/"},
+	{"internal/coverage/pods", "\x04l-y\x06\x05\f\x02\x01"},
+	{"internal/coverage/rtcov", "\xc5\x02"},
+	{"internal/coverage/slicereader", "f\nz["},
+	{"internal/coverage/slicewriter", "pz"},
+	{"internal/coverage/stringtab", "p8\x04>"},
+	{"internal/coverage/test", ""},
+	{"internal/coverage/uleb128", ""},
+	{"internal/cpu", "\xc5\x02"},
+	{"internal/dag", "\x04l\xbd\x01\x03"},
+	{"internal/diff", "\x03m\xbe\x01\x02"},
+	{"internal/exportdata", "\x02\x01j\x03\x03]\x1a,\x01\x05\x13\x01\x02"},
+	{"internal/filepathlite", "m+:\x19B"},
+	{"internal/fmtsort", "\x04\x9a\x02\x0f"},
+	{"internal/fuzz", "\x03\nA\x18\x04\x03\x03\x01\f\x0355\r\x02\x1d\x01\x05\x02\x05\f\x01\x02\x01\x01\v\x04\x02"},
+	{"internal/goarch", ""},
+	{"internal/godebug", "\x96\x01 |\x01\x12"},
+	{"internal/godebugs", ""},
+	{"internal/goexperiment", ""},
+	{"internal/goos", ""},
+	{"internal/goroot", "\x96\x02\x01\x05\x14\x02"},
+	{"internal/gover", "\x04"},
+	{"internal/goversion", ""},
+	{"internal/itoa", ""},
+	{"internal/lazyregexp", "\x96\x02\v\x0f\x02"},
+	{"internal/lazytemplate", "\xea\x01,\x1a\x02\v"},
+	{"internal/msan", "\xc5\x02"},
+	{"internal/nettrace", ""},
+	{"internal/obscuretestdata", "e\x85\x01,"},
+	{"internal/oserror", "m"},
+	{"internal/pkgbits", "\x03K\x18\a\x03\x05\vj\x0e\x1e\r\f\x01"},
+	{"internal/platform", ""},
+	{"internal/poll", "mO\x1a\x149\x0f\x01\x01\v\x06"},
+	{"internal/profile", "\x03\x04f\x03z7\r\x01\x01\x0f"},
+	{"internal/profilerecord", ""},
+	{"internal/race", "\x94\x01\xb1\x01"},
+	{"internal/reflectlite", "\x94\x01 3<\""},
+	{"internal/runtime/atomic", "\xc5\x02"},
+	{"internal/runtime/exithook", "\xca\x01{"},
+	{"internal/runtime/maps", "\x94\x01\x01\x1f\v\t\x05\x01w"},
+	{"internal/runtime/math", "\xb4\x01"},
+	{"internal/runtime/sys", "\xb4\x01\x04"},
+	{"internal/runtime/syscall", "\xc5\x02"},
+	{"internal/saferio", "\xea\x01["},
+	{"internal/singleflight", "\xb2\x02"},
+	{"internal/stringslite", "\x98\x01\xad\x01"},
+	{"internal/sync", "\x94\x01 \x14k\x12"},
+	{"internal/synctest", "\xc5\x02"},
+	{"internal/syscall/execenv", "\xb4\x02"},
+	{"internal/syscall/unix", "\xa3\x02\x10\x01\x11"},
+	{"internal/sysinfo", "\x02\x01\xaa\x01=,\x1a\x02"},
+	{"internal/syslist", ""},
+	{"internal/testenv", "\x03\n`\x02\x01*\x1a\x10'+\x01\x05\a\f\x01\x02\x02\x01\n"},
+	{"internal/testlog", "\xb2\x02\x01\x12"},
+	{"internal/testpty", "m\x03\xa6\x01"},
+	{"internal/trace", "\x02\x01\x01\x06\\\a\x03n\x03\x03\x06\x03\n6\x01\x02\x0f\x06"},
+	{"internal/trace/internal/testgen", "\x03c\nl\x03\x02\x03\x011\v\x0f"},
+	{"internal/trace/internal/tracev1", "\x03\x01b\a\x03t\x06\r6\x01"},
+	{"internal/trace/raw", "\x02d\nq\x03\x06E\x01\x11"},
+	{"internal/trace/testtrace", "\x02\x01j\x03l\x03\x06\x057\f\x02\x01"},
+	{"internal/trace/tracev2", ""},
+	{"internal/trace/traceviewer", "\x02]\v\x06\x1a<\x16\a\a\x04\t\n\x15\x01\x05\a\f\x01\x02\r"},
+	{"internal/trace/traceviewer/format", ""},
+	{"internal/trace/version", "pq\t"},
+	{"internal/txtar", "\x03m\xa6\x01\x1a"},
+	{"internal/types/errors", "\xaf\x02"},
+	{"internal/unsafeheader", "\xc5\x02"},
+	{"internal/xcoff", "Y\r\a\x03`\x1a,\x19\x01"},
+	{"internal/zstd", "f\a\x03z\x0f"},
+	{"io", "m\xc5\x01"},
+	{"io/fs", "m+*(1\x12\x12\x04"},
+	{"io/ioutil", "\xea\x01\x01+\x17\x03"},
+	{"iter", "\xc8\x01[\""},
+	{"log", "pz\x05'\r\x0f\x01\f"},
+	{"log/internal", ""},
+	{"log/slog", "\x03\nT\t\x03\x03z\x04\x01\x02\x02\x04'\x05\n\x02\x01\x02\x01\f\x02\x02\x02"},
+	{"log/slog/internal", ""},
+	{"log/slog/internal/benchmarks", "\r`\x03z\x06\x03<\x10"},
+	{"log/slog/internal/buffer", "\xb2\x02"},
+	{"log/slog/internal/slogtest", "\xf0\x01"},
+	{"log/syslog", "m\x03~\x12\x16\x1a\x02\r"},
+	{"maps", "\xed\x01X"},
+	{"math", "\xad\x01LL"},
+	{"math/big", "\x03j\x03)\x14=\r\x02\x024\x01\x02\x13"},
+	{"math/bits", "\xc5\x02"},
+	{"math/cmplx", "\xf7\x01\x02"},
+	{"math/rand", "\xb5\x01B;\x01\x12"},
+	{"math/rand/v2", "m,\x02\\\x02L"},
+	{"mime", "\x02\x01b\b\x03z\f \x17\x03\x02\x0f\x02"},
+	{"mime/multipart", "\x02\x01G#\x03E5\f\x01\x06\x02\x15\x02\x06\x11\x02\x01\x15"},
+	{"mime/quotedprintable", "\x02\x01mz"},
+	{"net", "\x04\t`+\x1d\a\x04\x05\f\x01\x04\x14\x01%\x06\r\n\x05\x01\x01\v\x06\a"},
+	{"net/http", "\x02\x01\x04\x04\x02=\b\x13\x01\a\x03E5\x01\x03\b\x01\x02\x02\x02\x01\x02\x06\x02\x01\x01\n\x01\x01\x05\x01\x02\x05\n\x01\x01\x01\x02\x01\x01\v\x02\x02\x02\b\x01\x01\x01"},
+	{"net/http/cgi", "\x02P\x1b\x03z\x04\b\n\x01\x13\x01\x01\x01\x04\x01\x05\x02\n\x02\x01\x0f\x0e"},
+	{"net/http/cookiejar", "\x04i\x03\x90\x01\x01\b\f\x18\x03\x02\r\x04"},
+	{"net/http/fcgi", "\x02\x01\nY\a\x03z\x16\x01\x01\x14\x1a\x02\r"},
+	{"net/http/httptest", "\x02\x01\nE\x02\x1b\x01z\x04\x12\x01\n\t\x02\x19\x01\x02\r\x0e"},
+	{"net/http/httptrace", "\rEn@\x14\n!"},
+	{"net/http/httputil", "\x02\x01\n`\x03z\x04\x0f\x03\x01\x05\x02\x01\v\x01\x1b\x02\r\x0e"},
+	{"net/http/internal", "\x02\x01j\x03z"},
+	{"net/http/internal/ascii", "\xb0\x02\x11"},
+	{"net/http/internal/httpcommon", "\r`\x03\x96\x01\x0e\x01\x19\x01\x01\x02\x1b\x02"},
+	{"net/http/internal/testcert", "\xb0\x02"},
+	{"net/http/pprof", "\x02\x01\nc\x19,\x11$\x04\x13\x14\x01\r\x06\x03\x01\x02\x01\x0f"},
+	{"net/internal/cgotest", ""},
+	{"net/internal/socktest", "p\xc2\x01\x02"},
+	{"net/mail", "\x02k\x03z\x04\x0f\x03\x14\x1c\x02\r\x04"},
+	{"net/netip", "\x04i+\x01#;\x026\x15"},
+	{"net/rpc", "\x02f\x05\x03\x10\n`\x04\x12\x01\x1d\x0f\x03\x02"},
+	{"net/rpc/jsonrpc", "j\x03\x03z\x16\x11!"},
+	{"net/smtp", "\x19.\v\x13\b\x03z\x16\x14\x1c"},
+	{"net/textproto", "\x02\x01j\x03z\r\t/\x01\x02\x13"},
+	{"net/url", "m\x03\x86\x01%\x12\x02\x01\x15"},
+	{"os", "m+\x01\x18\x03\b\t\r\x03\x01\x04\x10\x018\n\x05\x01\x01\v\x06"},
+	{"os/exec", "\x03\n`H \x01\x14\x01+\x06\a\f\x01\x04\v"},
+	{"os/exec/internal/fdtest", "\xb4\x02"},
+	{"os/signal", "\r\x89\x02\x17\x05\x02"},
+	{"os/user", "\x02\x01j\x03z,\r\f\x01\x02"},
+	{"path", "m+\xab\x01"},
+	{"path/filepath", "m+\x19:+\r\n\x03\x04\x0f"},
+	{"plugin", "m"},
+	{"reflect", "m'\x04\x1c\b\f\x04\x02\x19\x10,\f\x03\x0f\x02\x02"},
+	{"reflect/internal/example1", ""},
+	{"reflect/internal/example2", ""},
+	{"regexp", "\x03\xe7\x018\v\x02\x01\x02\x0f\x02"},
+	{"regexp/syntax", "\xad\x02\x01\x01\x01\x11\x02"},
+	{"runtime", "\x94\x01\x04\x01\x02\f\x06\a\x02\x01\x01\x0f\x03\x01\x01\x01\x01\x01\x03\x0fd"},
+	{"runtime/coverage", "\x9f\x01K"},
+	{"runtime/debug", "pUQ\r\n\x02\x01\x0f\x06"},
+	{"runtime/internal/startlinetest", ""},
+	{"runtime/internal/wasitest", ""},
+	{"runtime/metrics", "\xb6\x01A,\""},
+	{"runtime/pprof", "\x02\x01\x01\x03\x06Y\a\x03$3#\r\x1f\r\n\x01\x01\x01\x02\x02\b\x03\x06"},
+	{"runtime/race", "\xab\x02"},
+	{"runtime/race/internal/amd64v1", ""},
+	{"runtime/trace", "\rcz9\x0f\x01\x12"},
+	{"slices", "\x04\xe9\x01\fL"},
+	{"sort", "\xc9\x0104"},
+	{"strconv", "m+:%\x02J"},
+	{"strings", "m'\x04:\x18\x03\f9\x0f\x02\x02"},
+	{"structs", ""},
+	{"sync", "\xc8\x01\vP\x10\x12"},
+	{"sync/atomic", "\xc5\x02"},
+	{"syscall", "m(\x03\x01\x1b\b\x03\x03\x06\aT\n\x05\x01\x12"},
+	{"testing", "\x03\n`\x02\x01X\x0f\x13\r\x04\x1b\x06\x02\x05\x02\a\x01\x02\x01\x02\x01\f\x02\x02\x02"},
+	{"testing/fstest", "m\x03z\x01\v%\x12\x03\b\a"},
+	{"testing/internal/testdeps", "\x02\v\xa6\x01'\x10,\x03\x05\x03\b\a\x02\r"},
+	{"testing/iotest", "\x03j\x03z\x04"},
+	{"testing/quick", "o\x01\x87\x01\x04#\x12\x0f"},
+	{"testing/slogtest", "\r`\x03\x80\x01.\x05\x12\n"},
+	{"text/scanner", "\x03mz,+\x02"},
+	{"text/tabwriter", "pzY"},
+	{"text/template", "m\x03B8\x01\v\x1f\x01\x05\x01\x02\x05\r\x02\f\x03\x02"},
+	{"text/template/parse", "\x03m\xb3\x01\f\x01\x11\x02"},
+	{"time", "m+\x1d\x1d'*\x0f\x02\x11"},
+	{"time/tzdata", "m\xc7\x01\x11"},
+	{"unicode", ""},
+	{"unicode/utf16", ""},
+	{"unicode/utf8", ""},
+	{"unique", "\x94\x01>\x01P\x0f\x13\x12"},
+	{"unsafe", ""},
+	{"vendor/golang.org/x/crypto/chacha20", "\x10V\a\x8c\x01*'"},
+	{"vendor/golang.org/x/crypto/chacha20poly1305", "\x10V\a\xd9\x01\x04\x01\a"},
+	{"vendor/golang.org/x/crypto/cryptobyte", "c\n\x03\x88\x01&!\n"},
+	{"vendor/golang.org/x/crypto/cryptobyte/asn1", ""},
+	{"vendor/golang.org/x/crypto/internal/alias", "\xc5\x02"},
+	{"vendor/golang.org/x/crypto/internal/poly1305", "Q\x15\x93\x01"},
+	{"vendor/golang.org/x/net/dns/dnsmessage", "m"},
+	{"vendor/golang.org/x/net/http/httpguts", "\x80\x02\x14\x1c\x13\r"},
+	{"vendor/golang.org/x/net/http/httpproxy", "m\x03\x90\x01\x15\x01\x1a\x13\r"},
+	{"vendor/golang.org/x/net/http2/hpack", "\x03j\x03zH"},
+	{"vendor/golang.org/x/net/idna", "p\x87\x019\x13\x10\x02\x01"},
+	{"vendor/golang.org/x/net/nettest", "\x03c\a\x03z\x11\x05\x16\x01\f\f\x01\x02\x02\x01\n"},
+	{"vendor/golang.org/x/sys/cpu", "\x96\x02\r\f\x01\x15"},
+	{"vendor/golang.org/x/text/secure/bidirule", "m\xd6\x01\x11\x01"},
+	{"vendor/golang.org/x/text/transform", "\x03j}Y"},
+	{"vendor/golang.org/x/text/unicode/bidi", "\x03\be~@\x15"},
+	{"vendor/golang.org/x/text/unicode/norm", "f\nzH\x11\x11"},
+	{"weak", "\x94\x01\x8f\x01\""},
+}

backend/vendor/golang.org/x/tools/internal/stdlib/import.go

@@ -0,0 +1,89 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package stdlib
+
+// This file provides the API for the import graph of the standard library.
+//
+// Be aware that the compiler-generated code for every package
+// implicitly depends on package "runtime" and a handful of others
+// (see runtimePkgs in GOROOT/src/cmd/internal/objabi/pkgspecial.go).
+
+import (
+	"encoding/binary"
+	"iter"
+	"slices"
+	"strings"
+)
+
+// Imports returns the sequence of packages directly imported by the
+// named standard packages, in name order.
+// The imports of an unknown package are the empty set.
+//
+// The graph is built into the application and may differ from the
+// graph in the Go source tree being analyzed by the application.
+func Imports(pkgs ...string) iter.Seq[string] {
+	return func(yield func(string) bool) {
+		for _, pkg := range pkgs {
+			if i, ok := find(pkg); ok {
+				var depIndex uint64
+				for data := []byte(deps[i].deps); len(data) > 0; {
+					delta, n := binary.Uvarint(data)
+					depIndex += delta
+					if !yield(deps[depIndex].name) {
+						return
+					}
+					data = data[n:]
+				}
+			}
+		}
+	}
+}
+
+// Dependencies returns the set of all dependencies of the named
+// standard packages, including the initial package,
+// in a deterministic topological order.
+// The dependencies of an unknown package are the empty set.
+//
+// The graph is built into the application and may differ from the
+// graph in the Go source tree being analyzed by the application.
+func Dependencies(pkgs ...string) iter.Seq[string] {
+	return func(yield func(string) bool) {
+		for _, pkg := range pkgs {
+			if i, ok := find(pkg); ok {
+				var seen [1 + len(deps)/8]byte // bit set of seen packages
+				var visit func(i int) bool
+				visit = func(i int) bool {
+					bit := byte(1) << (i % 8)
+					if seen[i/8]&bit == 0 {
+						seen[i/8] |= bit
+						var depIndex uint64
+						for data := []byte(deps[i].deps); len(data) > 0; {
+							delta, n := binary.Uvarint(data)
+							depIndex += delta
+							if !visit(int(depIndex)) {
+								return false
+							}
+							data = data[n:]
+						}
+						if !yield(deps[i].name) {
+							return false
+						}
+					}
+					return true
+				}
+				if !visit(i) {
+					return
+				}
+			}
+		}
+	}
+}
+
+// find returns the index of pkg in the deps table.
+func find(pkg string) (int, bool) {
+	return slices.BinarySearchFunc(deps[:], pkg, func(p pkginfo, n string) int {
+		return strings.Compare(p.name, n)
+	})
+}

backend/vendor/golang.org/x/tools/internal/typesinternal/classify_call.go

@@ -0,0 +1,137 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package typesinternal
+
+import (
+	"fmt"
+	"go/ast"
+	"go/types"
+	_ "unsafe"
+)
+
+// CallKind describes the function position of an [*ast.CallExpr].
+type CallKind int
+
+const (
+	CallStatic     CallKind = iota // static call to known function
+	CallInterface                  // dynamic call through an interface method
+	CallDynamic                    // dynamic call of a func value
+	CallBuiltin                    // call to a builtin function
+	CallConversion                 // a conversion (not a call)
+)
+
+var callKindNames = []string{
+	"CallStatic",
+	"CallInterface",
+	"CallDynamic",
+	"CallBuiltin",
+	"CallConversion",
+}
+
+func (k CallKind) String() string {
+	if i := int(k); i >= 0 && i < len(callKindNames) {
+		return callKindNames[i]
+	}
+	return fmt.Sprintf("typeutil.CallKind(%d)", k)
+}
+
+// ClassifyCall classifies the function position of a call expression ([*ast.CallExpr]).
+// It distinguishes among true function calls, calls to builtins, and type conversions,
+// and further classifies function calls as static calls (where the function is known),
+// dynamic interface calls, and other dynamic calls.
+//
+// For the declarations:
+//
+//	func f() {}
+//	func g[T any]() {}
+//	var v func()
+//	var s []func()
+//	type I interface { M() }
+//	var i I
+//
+// ClassifyCall returns the following:
+//
+//	f()           CallStatic
+//	g[int]()      CallStatic
+//	i.M()         CallInterface
+//	min(1, 2)     CallBuiltin
+//	v()           CallDynamic
+//	s[0]()        CallDynamic
+//	int(x)        CallConversion
+//	[]byte("")    CallConversion
+func ClassifyCall(info *types.Info, call *ast.CallExpr) CallKind {
+	if info.Types == nil {
+		panic("ClassifyCall: info.Types is nil")
+	}
+	tv := info.Types[call.Fun]
+	if tv.IsType() {
+		return CallConversion
+	}
+	if tv.IsBuiltin() {
+		return CallBuiltin
+	}
+	obj := info.Uses[UsedIdent(info, call.Fun)]
+	// Classify the call by the type of the object, if any.
+	switch obj := obj.(type) {
+	case *types.Func:
+		if interfaceMethod(obj) {
+			return CallInterface
+		}
+		return CallStatic
+	default:
+		return CallDynamic
+	}
+}
+
+// UsedIdent returns the identifier such that info.Uses[UsedIdent(info, e)]
+// is the [types.Object] used by e, if any.
+//
+// If e is one of various forms of reference:
+//
+//	f, c, v, T           lexical reference
+//	pkg.X                qualified identifier
+//	f[T] or pkg.F[K,V]   instantiations of the above kinds
+//	expr.f               field or method value selector
+//	T.f                  method expression selector
+//
+// UsedIdent returns the identifier whose is associated value in [types.Info.Uses]
+// is the object to which it refers.
+//
+// For the declarations:
+//
+//	func F[T any] {...}
+//	type I interface { M() }
+//	var (
+//	  x int
+//	  s struct { f  int }
+//	  a []int
+//	  i I
+//	)
+//
+// UsedIdent returns the following:
+//
+//	Expr          UsedIdent
+//	x             x
+//	s.f           f
+//	F[int]        F
+//	i.M           M
+//	I.M           M
+//	min           min
+//	int           int
+//	1             nil
+//	a[0]          nil
+//	[]byte        nil
+//
+// Note: if e is an instantiated function or method, UsedIdent returns
+// the corresponding generic function or method on the generic type.
+func UsedIdent(info *types.Info, e ast.Expr) *ast.Ident {
+	return usedIdent(info, e)
+}
+
+//go:linkname usedIdent golang.org/x/tools/go/types/typeutil.usedIdent
+func usedIdent(info *types.Info, e ast.Expr) *ast.Ident
+
+//go:linkname interfaceMethod golang.org/x/tools/go/types/typeutil.interfaceMethod
+func interfaceMethod(f *types.Func) bool

backend/vendor/golang.org/x/tools/internal/typesinternal/varkind.go

@@ -0,0 +1,40 @@
+// Copyright 2024 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package typesinternal
+
+// TODO(adonovan): when CL 645115 lands, define the go1.25 version of
+// this API that actually does something.
+
+import "go/types"
+
+type VarKind uint8
+
+const (
+	_          VarKind = iota // (not meaningful)
+	PackageVar                // a package-level variable
+	LocalVar                  // a local variable
+	RecvVar                   // a method receiver variable
+	ParamVar                  // a function parameter variable
+	ResultVar                 // a function result variable
+	FieldVar                  // a struct field
+)
+
+func (kind VarKind) String() string {
+	return [...]string{
+		0:          "VarKind(0)",
+		PackageVar: "PackageVar",
+		LocalVar:   "LocalVar",
+		RecvVar:    "RecvVar",
+		ParamVar:   "ParamVar",
+		ResultVar:  "ResultVar",
+		FieldVar:   "FieldVar",
+	}[kind]
+}
+
+// GetVarKind returns an invalid VarKind.
+func GetVarKind(v *types.Var) VarKind { return 0 }
+
+// SetVarKind has no effect.
+func SetVarKind(v *types.Var, kind VarKind) {}