Repository: kubevela/kubevela

Issue:
Incorrect `vela def render` exit code on render error
**Describe the bug**
When running `vela def render` command with a faulty `.cue` file input, it fails to render, prints the error to stderr, but exit code remains 0.

Not sure if intentional, `vela def vet` does print the same error, but with exit code 1

**To Reproduce**
```sh
$ echo "1234" > /tmp/test.cue

$ vela def render /tmp/test.cue
failed to render test.cue, reason: failed to parse CUE: no metadata found, invalid

$ echo "$?"
0
```

**Expected behavior**
Non-zero exit code

**KubeVela Version**
1.9.13 and 1.10.0-alpha.1

**Cluster information**
N/A

**Additional context**
https://github.com/kubevela/kubevela/blob/0f780dec75fadf4c081df44051234011b4d136c2/references/cli/def.go#L840


Discussion:
@anoop2811: Thanks for raising this. Would you want to contribute to give an exit code of -1 in this regard?@ChrisV404: I can take a look at this if the author doesn't mind?@anoop2811: Great, thanks @ChrisV404 @7h3-3mp7y-m4n: Hi there, if this issue is stale, I’d be happy to take it on!

Solution patch:
diff --git a/.github/workflows/back-port.yml b/.github/workflows/back-port.yml
index 4b44bb00..f0a0b58a 100644
--- a/.github/workflows/back-port.yml
+++ b/.github/workflows/back-port.yml
@@ -17,12 +17,12 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
         with:
           fetch-depth: 0
 
       - name: Open Backport PR
-        uses: zeebe-io/backport-action@08bafb375e6e9a9a2b53a744b987e5d81a133191
+        uses: zeebe-io/backport-action@0193454f0c5947491d348f33a275c119f30eb736
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           github_workspace: ${{ github.workspace }}
diff --git a/.github/workflows/chart.yml b/.github/workflows/chart.yml
index 47ffd575..bd85614d 100644
--- a/.github/workflows/chart.yml
+++ b/.github/workflows/chart.yml
@@ -17,7 +17,7 @@ jobs:
       HELM_CHART_NAME: vela-core
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - name: Get git revision
         id: vars
         shell: bash
@@ -28,7 +28,7 @@ jobs:
         with:
           version: v3.4.0
       - name: Setup node
-        uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: '14'
       - name: Generate helm doc
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index a2cbf81f..475c3176 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -26,12 +26,12 @@ jobs:
         uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
+        uses: github/codeql-action/init@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
         with:
           languages: ${{ matrix.language }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
+        uses: github/codeql-action/autobuild@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
+        uses: github/codeql-action/analyze@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
diff --git a/.github/workflows/definition-lint.yml b/.github/workflows/definition-lint.yml
index f8e46a34..1714f5c3 100644
--- a/.github/workflows/definition-lint.yml
+++ b/.github/workflows/definition-lint.yml
@@ -23,19 +23,19 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Setup Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5
         with:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Checkout
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
         with:
           submodules: true
 
       - name: Setup KinD
         run: |
-          go install sigs.k8s.io/kind@v0.19.0
-          kind create cluster
+          go install sigs.k8s.io/kind@v0.29.0
+          kind create cluster --image=kindest/node:v1.31.9
 
       - name: Definition Doc generate check
         run: |
diff --git a/.github/workflows/e2e-multicluster-test.yml b/.github/workflows/e2e-multicluster-test.yml
index 611536d6..b2be990c 100644
--- a/.github/workflows/e2e-multicluster-test.yml
+++ b/.github/workflows/e2e-multicluster-test.yml
@@ -44,14 +44,14 @@ jobs:
     if: needs.detect-noop.outputs.noop != 'true'
     strategy:
       matrix:
-        k8s-version: ["v1.29"]
+        k8s-version: ["v1.31"]
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.k8s-version }}
       cancel-in-progress: true
 
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
 
       - name: Install tools
         run: |
@@ -61,7 +61,7 @@ jobs:
           sudo snap install helm --classic
 
       - name: Setup Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5
         with:
           go-version: ${{ env.GO_VERSION }}
 
@@ -71,12 +71,12 @@ jobs:
 
       - name: Setup KinD
         run: |
-          go install sigs.k8s.io/kind@v0.24.0
+          go install sigs.k8s.io/kind@v0.29.0
           kind delete cluster --name worker || true
-          kind create cluster --name worker --image=kindest/node:v1.29.8
+          kind create cluster --name worker --image=kindest/node:v1.31.9
           kind export kubeconfig --internal --name worker --kubeconfig /tmp/worker.kubeconfig
           kind delete cluster || true
-          kind create cluster --image=kindest/node:v1.29.8
+          kind create cluster --image=kindest/node:v1.31.9
 
       - name: Load image
         run: |
@@ -99,7 +99,7 @@ jobs:
           make end-e2e-core-shards
 
       - name: Upload coverage report
-        uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d
+        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: /tmp/e2e-profile.out,/tmp/e2e_multicluster_test.out
diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index 6d62fed3..de063b15 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -44,14 +44,14 @@ jobs:
     if: needs.detect-noop.outputs.noop != 'true'
     strategy:
       matrix:
-        k8s-version: ["v1.29"]
+        k8s-version: ["v1.31"]
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.k8s-version }}
       cancel-in-progress: true
 
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
 
       - name: Install tools
         run: |
@@ -61,7 +61,7 @@ jobs:
           sudo snap install helm --classic
 
       - name: Setup Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5
         with:
           go-version: ${{ env.GO_VERSION }}
 
@@ -71,9 +71,9 @@ jobs:
 
       - name: Setup KinD
         run: |
-          go install sigs.k8s.io/kind@v0.24.0
+          go install sigs.k8s.io/kind@v0.29.0
           kind delete cluster || true
-          kind create cluster --image=kindest/node:v1.29.8
+          kind create cluster --image=kindest/node:v1.31.9
 
       - name: Get Ginkgo
         run: |
@@ -106,7 +106,7 @@ jobs:
         run: make end-e2e
 
       - name: Upload coverage report
-        uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d
+        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: /tmp/e2e-profile.out
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 8495f6ea..1de8a4aa 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -43,12 +43,12 @@ jobs:
 
     steps:
       - name: Setup Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5
         with:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Checkout
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
         with:
           submodules: true
 
@@ -68,12 +68,12 @@ jobs:
 
     steps:
       - name: Setup Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5
         with:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Checkout
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
         with:
           submodules: true
 
@@ -93,17 +93,17 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
         with:
           submodules: true
 
       - name: Setup Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5
         with:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Setup node
-        uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: "14"
 
@@ -116,9 +116,9 @@ jobs:
 
       - name: Setup KinD
         run: |
-          go install sigs.k8s.io/kind@v0.19.0
+          go install sigs.k8s.io/kind@v0.29.0
           kind delete cluster --name kind || true
-          kind create cluster --name kind --image=kindest/node:v1.26.4 --kubeconfig ~/.kube/config
+          kind create cluster --name kind --image=kindest/node:v1.31.9 --kubeconfig ~/.kube/config
 
       - name: Run cross-build
         run: make cross-build
@@ -138,12 +138,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
         with:
           submodules: true
 
       - name: Setup Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5
         with:
           go-version: ${{ env.GO_VERSION }}
 
@@ -169,15 +169,15 @@ jobs:
     if: needs.detect-noop.outputs.noop != 'true'
     steps:
       - name: Checkout
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
         with:
           submodules: true
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
       - name: Build Test for vela core
-        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
         with:
           context: .
           file: Dockerfile
@@ -189,15 +189,15 @@ jobs:
     if: needs.detect-noop.outputs.noop != 'true'
     steps:
       - name: Checkout
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
         with:
           submodules: true
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
-      - name: Build Test for CLI
-        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
+      - name: Build Test for CLI 
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
         with:
           context: .
           file: Dockerfile.cli
\ No newline at end of file
diff --git a/.github/workflows/issue-commands.yml b/.github/workflows/issue-commands.yml
index e6324965..27dcf5be 100644
--- a/.github/workflows/issue-commands.yml
+++ b/.github/workflows/issue-commands.yml
@@ -80,7 +80,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Open Backport PR
-        uses: zeebe-io/backport-action@08bafb375e6e9a9a2b53a744b987e5d81a133191
+        uses: zeebe-io/backport-action@0193454f0c5947491d348f33a275c119f30eb736
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           github_workspace: ${{ github.workspace }}
diff --git a/.github/workflows/registry.yml b/.github/workflows/registry.yml
index da4f70ad..87065cc3 100644
--- a/.github/workflows/registry.yml
+++ b/.github/workflows/registry.yml
@@ -35,7 +35,7 @@ jobs:
         uses: imjasonh/setup-crane@00c9e93efa4e1138c9a7a5c594acd6c75a2fbf0c # v0.1
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # main
+        uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # main
         with:
           cosign-release: 'v2.5.0'
 
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index c8e707ae..8ce3bad0 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -55,6 +55,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
+        uses: github/codeql-action/upload-sarif@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/sdk-test.yml b/.github/workflows/sdk-test.yml
index 64ef7986..02cbd632 100644
--- a/.github/workflows/sdk-test.yml
+++ b/.github/workflows/sdk-test.yml
@@ -26,10 +26,10 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
 
       - name: Setup Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5
         with:
           go-version: ${{ env.GO_VERSION }}
 
@@ -40,8 +40,8 @@ jobs:
 
       - name: Setup KinD
         run: |
-          go install sigs.k8s.io/kind@v0.19.0
-          kind create cluster
+          go install sigs.k8s.io/kind@v0.29.0
+          kind create cluster --image=kindest/node:v1.31.9
 
       - name: Build CLI
         run: make vela-cli
diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml
index 0f3ee8bd..12d566b4 100644
--- a/.github/workflows/trivy-scan.yml
+++ b/.github/workflows/trivy-scan.yml
@@ -27,7 +27,7 @@ jobs:
           output: 'trivy-results.sarif'
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
+        uses: github/codeql-action/upload-sarif@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'
\ No newline at end of file
diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml
index 837e1503..ed78a19b 100644
--- a/.github/workflows/unit-test.yml
+++ b/.github/workflows/unit-test.yml
@@ -42,12 +42,12 @@ jobs:
 
     steps:
       - name: Set up Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5
         with:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
         with:
           submodules: true
 
@@ -66,16 +66,16 @@ jobs:
 
       - name: Setup KinD
         run: |
-          go install sigs.k8s.io/kind@v0.19.0
-          kind create cluster
+          go install sigs.k8s.io/kind@v0.29.0
+          kind create cluster --image=kindest/node:v1.31.9
 
       - name: Run Make test
         run: make test
 
       - name: Upload coverage report
-        uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d
+        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 #v5.4.3
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
-          file: ./coverage.txt
+          files: ./coverage.txt
           flags: core-unittests
           name: codecov-umbrella
diff --git a/Makefile b/Makefile
index 93545f9a..463c41a8 100644
--- a/Makefile
+++ b/Makefile
@@ -61,7 +61,7 @@ staticcheck: staticchecktool
 ## lint: Run the golangci-lint
 lint: golangci
 	@$(INFO) lint
-	@$(GOLANGCILINT) run --fix --verbose --exclude-dirs 'scaffold'
+	@GOLANGCILINT=$(GOLANGCILINT) ./hack/utils/golangci-lint-wrapper.sh
 
 ## reviewable: Run the reviewable
 reviewable: manifests fmt vet lint staticcheck helm-doc-gen sdk_fmt
diff --git a/README.md b/README.md
index d209bbfd..40b89ca8 100644
--- a/README.md
+++ b/README.md
@@ -115,4 +115,4 @@ Security is a first priority thing for us at KubeVela. If you come across a rela
 
 ## Code of Conduct
 
-KubeVela adopts [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md).
+KubeVela adopts [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md).
\ No newline at end of file
diff --git a/apis/core.oam.dev/common/types.go b/apis/core.oam.dev/common/types.go
index 7ee5b5e2..43444f3c 100644
--- a/apis/core.oam.dev/common/types.go
+++ b/apis/core.oam.dev/common/types.go
@@ -135,6 +135,9 @@ type Status struct {
 	// HealthPolicy defines the health check policy for the abstraction
 	// +optional
 	HealthPolicy string `json:"healthPolicy,omitempty"`
+	// Details stores a string representation of a CUE status map to be evaluated at runtime for display
+	// +optional
+	Details string `json:"details,omitempty"`
 }
 
 // ApplicationPhase is a label for the condition of an application at the current time
@@ -172,6 +175,7 @@ type ApplicationComponentStatus struct {
 	// WorkloadDefinition is the definition of a WorkloadDefinition, such as deployments/apps.v1
 	WorkloadDefinition WorkloadGVK              `json:"workloadDefinition,omitempty"`
 	Healthy            bool                     `json:"healthy"`
+	Details            map[string]string        `json:"details,omitempty"`
 	Message            string                   `json:"message,omitempty"`
 	Traits             []ApplicationTraitStatus `json:"traits,omitempty"`
 	Scopes             []corev1.ObjectReference `json:"scopes,omitempty"`
@@ -185,9 +189,10 @@ func (in ApplicationComponentStatus) Equal(r ApplicationComponentStatus) bool {
 
 // ApplicationTraitStatus records the trait health status
 type ApplicationTraitStatus struct {
-	Type    string `json:"type"`
-	Healthy bool   `json:"healthy"`
-	Message string `json:"message,omitempty"`
+	Type    string            `json:"type"`
+	Healthy bool              `json:"healthy"`
+	Details map[string]string `json:"details,omitempty"`
+	Message string            `json:"message,omitempty"`
 }
 
 // Revision has name and revision number
diff --git a/apis/core.oam.dev/common/zz_generated.deepcopy.go b/apis/core.oam.dev/common/zz_generated.deepcopy.go
index d211a0fb..cd70665a 100644
--- a/apis/core.oam.dev/common/zz_generated.deepcopy.go
+++ b/apis/core.oam.dev/common/zz_generated.deepcopy.go
@@ -130,10 +130,19 @@ func (in *ApplicationComponent) DeepCopy() *ApplicationComponent {
 func (in *ApplicationComponentStatus) DeepCopyInto(out *ApplicationComponentStatus) {
 	*out = *in
 	out.WorkloadDefinition = in.WorkloadDefinition
+	if in.Details != nil {
+		in, out := &in.Details, &out.Details
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
 	if in.Traits != nil {
 		in, out := &in.Traits, &out.Traits
 		*out = make([]ApplicationTraitStatus, len(*in))
-		copy(*out, *in)
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
 	}
 	if in.Scopes != nil {
 		in, out := &in.Scopes, &out.Scopes
@@ -175,6 +184,13 @@ func (in *ApplicationTrait) DeepCopy() *ApplicationTrait {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ApplicationTraitStatus) DeepCopyInto(out *ApplicationTraitStatus) {
 	*out = *in
+	if in.Details != nil {
+		in, out := &in.Details, &out.Details
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationTraitStatus.
diff --git a/apis/core.oam.dev/v1alpha1/register.go b/apis/core.oam.dev/v1alpha1/register.go
index 3f8ff218..90e9b3b0 100644
--- a/apis/core.oam.dev/v1alpha1/register.go
+++ b/apis/core.oam.dev/v1alpha1/register.go
@@ -60,3 +60,8 @@ func init() {
 	SchemeBuilder.Register(&workflowv1alpha1.Workflow{}, &workflowv1alpha1.WorkflowList{})
 	_ = SchemeBuilder.AddToScheme(k8sscheme.Scheme)
 }
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
diff --git a/apis/core.oam.dev/v1beta1/register.go b/apis/core.oam.dev/v1beta1/register.go
index 10b7c80c..4942e693 100644
--- a/apis/core.oam.dev/v1beta1/register.go
+++ b/apis/core.oam.dev/v1beta1/register.go
@@ -49,6 +49,7 @@ var (
 	ComponentDefinitionGroupKind        = schema.GroupKind{Group: Group, Kind: ComponentDefinitionKind}.String()
 	ComponentDefinitionKindAPIVersion   = ComponentDefinitionKind + "." + SchemeGroupVersion.String()
 	ComponentDefinitionGroupVersionKind = SchemeGroupVersion.WithKind(ComponentDefinitionKind)
+	ComponentDefinitionGVR              = SchemeGroupVersion.WithResource("componentdefinitions")
 )
 
 // WorkloadDefinition type metadata.
@@ -65,6 +66,7 @@ var (
 	TraitDefinitionGroupKind        = schema.GroupKind{Group: Group, Kind: TraitDefinitionKind}.String()
 	TraitDefinitionKindAPIVersion   = TraitDefinitionKind + "." + SchemeGroupVersion.String()
 	TraitDefinitionGroupVersionKind = SchemeGroupVersion.WithKind(TraitDefinitionKind)
+	TraitDefinitionGVR              = SchemeGroupVersion.WithResource("traitdefinitions")
 )
 
 // PolicyDefinition type metadata.
@@ -73,6 +75,7 @@ var (
 	PolicyDefinitionGroupKind        = schema.GroupKind{Group: Group, Kind: PolicyDefinitionKind}.String()
 	PolicyDefinitionKindAPIVersion   = PolicyDefinitionKind + "." + SchemeGroupVersion.String()
 	PolicyDefinitionGroupVersionKind = SchemeGroupVersion.WithKind(PolicyDefinitionKind)
+	PolicyDefinitionGVR              = SchemeGroupVersion.WithResource("policydefinitions")
 )
 
 // WorkflowStepDefinition type metadata.
@@ -81,6 +84,7 @@ var (
 	WorkflowStepDefinitionGroupKind        = schema.GroupKind{Group: Group, Kind: WorkflowStepDefinitionKind}.String()
 	WorkflowStepDefinitionKindAPIVersion   = WorkflowStepDefinitionKind + "." + SchemeGroupVersion.String()
 	WorkflowStepDefinitionGroupVersionKind = SchemeGroupVersion.WithKind(WorkflowStepDefinitionKind)
+	WorkflowStepDefinitionGVR              = SchemeGroupVersion.WithResource("workflowstepdefinitions")
 )
 
 // DefinitionRevision type metadata.
@@ -115,6 +119,20 @@ var (
 	ResourceTrackerKindVersionKind = SchemeGroupVersion.WithKind(ResourceTrackerKind)
 )
 
+// DefinitionTypeInfo contains the mapping information for a definition type
+type DefinitionTypeInfo struct {
+	GVR  schema.GroupVersionResource
+	Kind string
+}
+
+// DefinitionTypeMap maps definition types to their corresponding GVR and Kind
+var DefinitionTypeMap = map[reflect.Type]DefinitionTypeInfo{
+	reflect.TypeOf(ComponentDefinition{}):    {GVR: ComponentDefinitionGVR, Kind: ComponentDefinitionKind},
+	reflect.TypeOf(TraitDefinition{}):        {GVR: TraitDefinitionGVR, Kind: TraitDefinitionKind},
+	reflect.TypeOf(PolicyDefinition{}):       {GVR: PolicyDefinitionGVR, Kind: PolicyDefinitionKind},
+	reflect.TypeOf(WorkflowStepDefinition{}): {GVR: WorkflowStepDefinitionGVR, Kind: WorkflowStepDefinitionKind},
+}
+
 func init() {
 	SchemeBuilder.Register(&ComponentDefinition{}, &ComponentDefinitionList{})
 	SchemeBuilder.Register(&WorkloadDefinition{}, &WorkloadDefinitionList{})
diff --git a/apis/core.oam.dev/v1beta1/zz_generated.deepcopy.go b/apis/core.oam.dev/v1beta1/zz_generated.deepcopy.go
index c42796a5..0e3eb29e 100644
--- a/apis/core.oam.dev/v1beta1/zz_generated.deepcopy.go
+++ b/apis/core.oam.dev/v1beta1/zz_generated.deepcopy.go
@@ -552,6 +552,22 @@ func (in *DefinitionRevisionSpec) DeepCopy() *DefinitionRevisionSpec {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DefinitionTypeInfo) DeepCopyInto(out *DefinitionTypeInfo) {
+	*out = *in
+	out.GVR = in.GVR
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DefinitionTypeInfo.
+func (in *DefinitionTypeInfo) DeepCopy() *DefinitionTypeInfo {
+	if in == nil {
+		return nil
+	}
+	out := new(DefinitionTypeInfo)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ManagedResource) DeepCopyInto(out *ManagedResource) {
 	*out = *in
diff --git a/app.yaml b/app.yaml
new file mode 100644
index 00000000..e69de29b
diff --git a/charts/vela-core/README.md b/charts/vela-core/README.md
index e16f423c..5f695985 100644
--- a/charts/vela-core/README.md
+++ b/charts/vela-core/README.md
@@ -99,6 +99,7 @@ helm install --create-namespace -n vela-system kubevela kubevela/vela-core --wai
 | `featureGates.sharedDefinitionStorageForApplicationRevision` | use definition cache to reduce duplicated definition storage for application revision, must be used with InformerCacheFilterUnnecessaryFields                                                                                    | `true`  |
 | `featureGates.disableWorkflowContextConfigMapCache`          | disable the workflow context's configmap informer cache                                                                                                                                                                          | `true`  |
 | `featureGates.enableCueValidation`                           | enable the strict cue validation for cue required parameter fields                                                                                                                                                               | `false` |
+| `featureGates.enableApplicationStatusMetrics`                | enable application status metrics and structured logging                                                                                                                                                                         | `false` |
 
 ### MultiCluster parameters
 
@@ -150,7 +151,8 @@ helm install --create-namespace -n vela-system kubevela kubevela/vela-core --wai
 | `logFileMaxSize`                               | Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0, the maximum file size is unlimited.                                         | `1024`               |
 | `kubeClient.qps`                               | The qps for reconcile clients                                                                                                                                      | `400`                |
 | `kubeClient.burst`                             | The burst for reconcile clients                                                                                                                                    | `600`                |
-| `authentication.enabled`                       | Enable authentication for application                                                                                                                              | `false`              |
+| `authentication.enabled`                       | Enable authentication framework for applications                                                                                                                   | `false`              |
+| `authentication.definitions.enabled`           | Enable definition permission validation (requires authentication.enabled)                                                                                          | `false`              |
 | `authentication.withUser`                      | Application authentication will impersonate as the request User                                                                                                    | `true`               |
 | `authentication.defaultUser`                   | Application authentication will impersonate as the User if no user provided in Application                                                                         | `kubevela:vela-core` |
 | `authentication.groupPattern`                  | Application authentication will impersonate as the request Group that matches the pattern                                                                          | `kubevela:*`         |
diff --git a/charts/vela-core/crds/core.oam.dev_applicationrevisions.yaml b/charts/vela-core/crds/core.oam.dev_applicationrevisions.yaml
index 8b3bb62e..cc1541a9 100644
--- a/charts/vela-core/crds/core.oam.dev_applicationrevisions.yaml
+++ b/charts/vela-core/crds/core.oam.dev_applicationrevisions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.5
   name: applicationrevisions.core.oam.dev
 spec:
   group: core.oam.dev
@@ -395,7 +395,6 @@ spec:
                                 the event) or if no container name is specified "spec.containers[2]" (container with
                                 index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                 referencing a part of an object.
-                                TODO: this design is not final and this field is subject to change in the future.
                               type: string
                             kind:
                               description: |-
@@ -429,24 +428,8 @@ spec:
                         description: Components record the related Components created
                           by Application Controller
                         items:
-                          description: |-
-                            ObjectReference contains enough information to let you inspect or modify the referred object.
-                            ---
-                            New uses of this type are discouraged because of difficulty describing its usage when embedded in APIs.
-                             1. Ignored fields.  It includes many fields which are not generally honored.  For instance, ResourceVersion and FieldPath are both very rarely valid in actual usage.
-                             2. Invalid usage help.  It is impossible to add specific help for individual usage.  In most embedded usages, there are particular
-                                restrictions like, "must refer only to types A and B" or "UID not honored" or "name must be restricted".
-                                Those cannot be well described when embedded.
-                             3. Inconsistent validation.  Because the usages are different, the validation rules are different by usage, which makes it hard for users to predict what will happen.
-                             4. The fields are both imprecise and overly precise.  Kind is not a precise mapping to a URL. This can produce ambiguity
-                                during interpretation and require a REST mapping.  In most cases, the dependency is on the group,resource tuple
-                                and the version of the actual struct is irrelevant.
-                             5. We cannot easily change it.  Because this type is embedded in many locations, updates to this type
-                                will affect numerous schemas.  Don't make new APIs embed an underspecified API type they do not control.
-
-
-                            Instead of using this type, create a locally provided and used type that is well-focused on your reference.
-                            For example, ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533 .
+                          description: ObjectReference contains enough information
+                            to let you inspect or modify the referred object.
                           properties:
                             apiVersion:
                               description: API version of the referent.
@@ -460,7 +443,6 @@ spec:
                                 the event) or if no container name is specified "spec.containers[2]" (container with
                                 index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                 referencing a part of an object.
-                                TODO: this design is not final and this field is subject to change in the future.
                               type: string
                             kind:
                               description: |-
@@ -577,6 +559,10 @@ spec:
                           properties:
                             cluster:
                               type: string
+                            details:
+                              additionalProperties:
+                                type: string
+                              type: object
                             env:
                               type: string
                             healthy:
@@ -589,24 +575,8 @@ spec:
                               type: string
                             scopes:
                               items:
-                                description: |-
-                                  ObjectReference contains enough information to let you inspect or modify the referred object.
-                                  ---
-                                  New uses of this type are discouraged because of difficulty describing its usage when embedded in APIs.
-                                   1. Ignored fields.  It includes many fields which are not generally honored.  For instance, ResourceVersion and FieldPath are both very rarely valid in actual usage.
-                                   2. Invalid usage help.  It is impossible to add specific help for individual usage.  In most embedded usages, there are particular
-                                      restrictions like, "must refer only to types A and B" or "UID not honored" or "name must be restricted".
-                                      Those cannot be well described when embedded.
-                                   3. Inconsistent validation.  Because the usages are different, the validation rules are different by usage, which makes it hard for users to predict what will happen.
-                                   4. The fields are both imprecise and overly precise.  Kind is not a precise mapping to a URL. This can produce ambiguity
-                                      during interpretation and require a REST mapping.  In most cases, the dependency is on the group,resource tuple
-                                      and the version of the actual struct is irrelevant.
-                                   5. We cannot easily change it.  Because this type is embedded in many locations, updates to this type
-                                      will affect numerous schemas.  Don't make new APIs embed an underspecified API type they do not control.
-
-
-                                  Instead of using this type, create a locally provided and used type that is well-focused on your reference.
-                                  For example, ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533 .
+                                description: ObjectReference contains enough information
+                                  to let you inspect or modify the referred object.
                                 properties:
                                   apiVersion:
                                     description: API version of the referent.
@@ -620,7 +590,6 @@ spec:
                                       the event) or if no container name is specified "spec.containers[2]" (container with
                                       index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                       referencing a part of an object.
-                                      TODO: this design is not final and this field is subject to change in the future.
                                     type: string
                                   kind:
                                     description: |-
@@ -655,6 +624,10 @@ spec:
                                 description: ApplicationTraitStatus records the trait
                                   health status
                                 properties:
+                                  details:
+                                    additionalProperties:
+                                      type: string
+                                    type: object
                                   healthy:
                                     type: boolean
                                   message:
@@ -693,24 +666,8 @@ spec:
                           appRevision:
                             type: string
                           contextBackend:
-                            description: |-
-                              ObjectReference contains enough information to let you inspect or modify the referred object.
-                              ---
-                              New uses of this type are discouraged because of difficulty describing its usage when embedded in APIs.
-                               1. Ignored fields.  It includes many fields which are not generally honored.  For instance, ResourceVersion and FieldPath are both very rarely valid in actual usage.
-                               2. Invalid usage help.  It is impossible to add specific help for individual usage.  In most embedded usages, there are particular
-                                  restrictions like, "must refer only to types A and B" or "UID not honored" or "name must be restricted".
-                                  Those cannot be well described when embedded.
-                               3. Inconsistent validation.  Because the usages are different, the validation rules are different by usage, which makes it hard for users to predict what will happen.
-                               4. The fields are both imprecise and overly precise.  Kind is not a precise mapping to a URL. This can produce ambiguity
-                                  during interpretation and require a REST mapping.  In most cases, the dependency is on the group,resource tuple
-                                  and the version of the actual struct is irrelevant.
-                               5. We cannot easily change it.  Because this type is embedded in many locations, updates to this type
-                                  will affect numerous schemas.  Don't make new APIs embed an underspecified API type they do not control.
-
-
-                              Instead of using this type, create a locally provided and used type that is well-focused on your reference.
-                              For example, ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533 .
+                            description: ObjectReference contains enough information
+                              to let you inspect or modify the referred object.
                             properties:
                               apiVersion:
                                 description: API version of the referent.
@@ -724,7 +681,6 @@ spec:
                                   the event) or if no container name is specified "spec.containers[2]" (container with
                                   index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                   referencing a part of an object.
-                                  TODO: this design is not final and this field is subject to change in the future.
                                 type: string
                               kind:
                                 description: |-
@@ -1048,6 +1004,11 @@ spec:
                               description: CustomStatus defines the custom status
                                 message that could display to user
                               type: string
+                            details:
+                              description: Details stores a string representation
+                                of a CUE status map to be evaluated at runtime for
+                                display
+                              type: string
                             healthPolicy:
                               description: HealthPolicy defines the health check policy
                                 for the abstraction
@@ -1650,6 +1611,11 @@ spec:
                               description: CustomStatus defines the custom status
                                 message that could display to user
                               type: string
+                            details:
+                              description: Details stores a string representation
+                                of a CUE status map to be evaluated at runtime for
+                                display
+                              type: string
                             healthPolicy:
                               description: HealthPolicy defines the health check policy
                                 for the abstraction
@@ -2335,6 +2301,11 @@ spec:
                               description: CustomStatus defines the custom status
                                 message that could display to user
                               type: string
+                            details:
+                              description: Details stores a string representation
+                                of a CUE status map to be evaluated at runtime for
+                                display
+                              type: string
                             healthPolicy:
                               description: HealthPolicy defines the health check policy
                                 for the abstraction
@@ -2403,24 +2374,8 @@ spec:
                   appRevision:
                     type: string
                   contextBackend:
-                    description: |-
-                      ObjectReference contains enough information to let you inspect or modify the referred object.
-                      ---
-                      New uses of this type are discouraged because of difficulty describing its usage when embedded in APIs.
-                       1. Ignored fields.  It includes many fields which are not generally honored.  For instance, ResourceVersion and FieldPath are both very rarely valid in actual usage.
-                       2. Invalid usage help.  It is impossible to add specific help for individual usage.  In most embedded usages, there are particular
-                          restrictions like, "must refer only to types A and B" or "UID not honored" or "name must be restricted".
-                          Those cannot be well described when embedded.
-                       3. Inconsistent validation.  Because the usages are different, the validation rules are different by usage, which makes it hard for users to predict what will happen.
-                       4. The fields are both imprecise and overly precise.  Kind is not a precise mapping to a URL. This can produce ambiguity
-                          during interpretation and require a REST mapping.  In most cases, the dependency is on the group,resource tuple
-                          and the version of the actual struct is irrelevant.
-                       5. We cannot easily change it.  Because this type is embedded in many locations, updates to this type
-                          will affect numerous schemas.  Don't make new APIs embed an underspecified API type they do not control.
-
-
-                      Instead of using this type, create a locally provided and used type that is well-focused on your reference.
-                      For example, ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533 .
+                    description: ObjectReference contains enough information to let
+                      you inspect or modify the referred object.
                     properties:
                       apiVersion:
                         description: API version of the referent.
@@ -2434,7 +2389,6 @@ spec:
                           the event) or if no container name is specified "spec.containers[2]" (container with
                           index 2 in this pod). This syntax is chosen only to have some well-defined way of
                           referencing a part of an object.
-                          TODO: this design is not final and this field is subject to change in the future.
                         type: string
                       kind:
                         description: |-
diff --git a/charts/vela-core/crds/core.oam.dev_applications.yaml b/charts/vela-core/crds/core.oam.dev_applications.yaml
index 978d3a67..ad7d95c3 100644
--- a/charts/vela-core/crds/core.oam.dev_applications.yaml
+++ b/charts/vela-core/crds/core.oam.dev_applications.yaml
@@ -3,7 +3,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     cert-manager.io/inject-ca-from: vela-system/kubevela-vela-core-root-cert
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.5
   name: applications.core.oam.dev
 spec:
   group: core.oam.dev
@@ -345,7 +345,6 @@ spec:
                         the event) or if no container name is specified "spec.containers[2]" (container with
                         index 2 in this pod). This syntax is chosen only to have some well-defined way of
                         referencing a part of an object.
-                        TODO: this design is not final and this field is subject to change in the future.
                       type: string
                     kind:
                       description: |-
@@ -379,24 +378,8 @@ spec:
                 description: Components record the related Components created by Application
                   Controller
                 items:
-                  description: |-
-                    ObjectReference contains enough information to let you inspect or modify the referred object.
-                    ---
-                    New uses of this type are discouraged because of difficulty describing its usage when embedded in APIs.
-                     1. Ignored fields.  It includes many fields which are not generally honored.  For instance, ResourceVersion and FieldPath are both very rarely valid in actual usage.
-                     2. Invalid usage help.  It is impossible to add specific help for individual usage.  In most embedded usages, there are particular
-                        restrictions like, "must refer only to types A and B" or "UID not honored" or "name must be restricted".
-                        Those cannot be well described when embedded.
-                     3. Inconsistent validation.  Because the usages are different, the validation rules are different by usage, which makes it hard for users to predict what will happen.
-                     4. The fields are both imprecise and overly precise.  Kind is not a precise mapping to a URL. This can produce ambiguity
-                        during interpretation and require a REST mapping.  In most cases, the dependency is on the group,resource tuple
-                        and the version of the actual struct is irrelevant.
-                     5. We cannot easily change it.  Because this type is embedded in many locations, updates to this type
-                        will affect numerous schemas.  Don't make new APIs embed an underspecified API type they do not control.
-
-
-                    Instead of using this type, create a locally provided and used type that is well-focused on your reference.
-                    For example, ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533 .
+                  description: ObjectReference contains enough information to let
+                    you inspect or modify the referred object.
                   properties:
                     apiVersion:
                       description: API version of the referent.
@@ -410,7 +393,6 @@ spec:
                         the event) or if no container name is specified "spec.containers[2]" (container with
                         index 2 in this pod). This syntax is chosen only to have some well-defined way of
                         referencing a part of an object.
-                        TODO: this design is not final and this field is subject to change in the future.
                       type: string
                     kind:
                       description: |-
@@ -525,6 +507,10 @@ spec:
                   properties:
                     cluster:
                       type: string
+                    details:
+                      additionalProperties:
+                        type: string
+                      type: object
                     env:
                       type: string
                     healthy:
@@ -537,24 +523,8 @@ spec:
                       type: string
                     scopes:
                       items:
-                        description: |-
-                          ObjectReference contains enough information to let you inspect or modify the referred object.
-                          ---
-                          New uses of this type are discouraged because of difficulty describing its usage when embedded in APIs.
-                           1. Ignored fields.  It includes many fields which are not generally honored.  For instance, ResourceVersion and FieldPath are both very rarely valid in actual usage.
-                           2. Invalid usage help.  It is impossible to add specific help for individual usage.  In most embedded usages, there are particular
-                              restrictions like, "must refer only to types A and B" or "UID not honored" or "name must be restricted".
-                              Those cannot be well described when embedded.
-                           3. Inconsistent validation.  Because the usages are different, the validation rules are different by usage, which makes it hard for users to predict what will happen.
-                           4. The fields are both imprecise and overly precise.  Kind is not a precise mapping to a URL. This can produce ambiguity
-                              during interpretation and require a REST mapping.  In most cases, the dependency is on the group,resource tuple
-                              and the version of the actual struct is irrelevant.
-                           5. We cannot easily change it.  Because this type is embedded in many locations, updates to this type
-                              will affect numerous schemas.  Don't make new APIs embed an underspecified API type they do not control.
-
-
-                          Instead of using this type, create a locally provided and used type that is well-focused on your reference.
-                          For example, ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533 .
+                        description: ObjectReference contains enough information to
+                          let you inspect or modify the referred object.
                         properties:
                           apiVersion:
                             description: API version of the referent.
@@ -568,7 +538,6 @@ spec:
                               the event) or if no container name is specified "spec.containers[2]" (container with
                               index 2 in this pod). This syntax is chosen only to have some well-defined way of
                               referencing a part of an object.
-                              TODO: this design is not final and this field is subject to change in the future.
                             type: string
                           kind:
                             description: |-
@@ -603,6 +572,10 @@ spec:
                         description: ApplicationTraitStatus records the trait health
                           status
                         properties:
+                          details:
+                            additionalProperties:
+                              type: string
+                            type: object
                           healthy:
                             type: boolean
                           message:
@@ -641,24 +614,8 @@ spec:
                   appRevision:
                     type: string
                   contextBackend:
-                    description: |-
-                      ObjectReference contains enough information to let you inspect or modify the referred object.
-                      ---
-                      New uses of this type are discouraged because of difficulty describing its usage when embedded in APIs.
-                       1. Ignored fields.  It includes many fields which are not generally honored.  For instance, ResourceVersion and FieldPath are both very rarely valid in actual usage.
-                       2. Invalid usage help.  It is impossible to add specific help for individual usage.  In most embedded usages, there are particular
-                          restrictions like, "must refer only to types A and B" or "UID not honored" or "name must be restricted".
-                          Those cannot be well described when embedded.
-                       3. Inconsistent validation.  Because the usages are different, the validation rules are different by usage, which makes it hard for users to predict what will happen.
-                       4. The fields are both imprecise and overly precise.  Kind is not a precise mapping to a URL. This can produce ambiguity
-                          during interpretation and require a REST mapping.  In most cases, the dependency is on the group,resource tuple
-                          and the version of the actual struct is irrelevant.
-                       5. We cannot easily change it.  Because this type is embedded in many locations, updates to this type
-                          will affect numerous schemas.  Don't make new APIs embed an underspecified API type they do not control.
-
-
-                      Instead of using this type, create a locally provided and used type that is well-focused on your reference.
-                      For example, ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533 .
+                    description: ObjectReference contains enough information to let
+                      you inspect or modify the referred object.
                     properties:
                       apiVersion:
                         description: API version of the referent.
@@ -672,7 +629,6 @@ spec:
                           the event) or if no container name is specified "spec.containers[2]" (container with
                           index 2 in this pod). This syntax is chosen only to have some well-defined way of
                           referencing a part of an object.
-                          TODO: this design is not final and this field is subject to change in the future.
                         type: string
                       kind:
                         description: |-
diff --git a/charts/vela-core/crds/core.oam.dev_componentdefinitions.yaml b/charts/vela-core/crds/core.oam.dev_componentdefinitions.yaml
index 0a9e9489..b60313d3 100644
--- a/charts/vela-core/crds/core.oam.dev_componentdefinitions.yaml
+++ b/charts/vela-core/crds/core.oam.dev_componentdefinitions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.5
   name: componentdefinitions.core.oam.dev
 spec:
   group: core.oam.dev
@@ -190,6 +190,10 @@ spec:
                     description: CustomStatus defines the custom status message that
                       could display to user
                     type: string
+                  details:
+                    description: Details stores a string representation of a CUE status
+                      map to be evaluated at runtime for display
+                    type: string
                   healthPolicy:
                     description: HealthPolicy defines the health check policy for
                       the abstraction
diff --git a/charts/vela-core/crds/core.oam.dev_definitionrevisions.yaml b/charts/vela-core/crds/core.oam.dev_definitionrevisions.yaml
index d3769a43..9dce47fe 100644
--- a/charts/vela-core/crds/core.oam.dev_definitionrevisions.yaml
+++ b/charts/vela-core/crds/core.oam.dev_definitionrevisions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.5
   name: definitionrevisions.core.oam.dev
 spec:
   group: core.oam.dev
@@ -236,6 +236,10 @@ spec:
                             description: CustomStatus defines the custom status message
                               that could display to user
                             type: string
+                          details:
+                            description: Details stores a string representation of
+                              a CUE status map to be evaluated at runtime for display
+                            type: string
                           healthPolicy:
                             description: HealthPolicy defines the health check policy
                               for the abstraction
@@ -773,6 +777,10 @@ spec:
                             description: CustomStatus defines the custom status message
                               that could display to user
                             type: string
+                          details:
+                            description: Details stores a string representation of
+                              a CUE status map to be evaluated at runtime for display
+                            type: string
                           healthPolicy:
                             description: HealthPolicy defines the health check policy
                               for the abstraction
diff --git a/charts/vela-core/crds/core.oam.dev_policies.yaml b/charts/vela-core/crds/core.oam.dev_policies.yaml
index fd197e1c..6ad08df3 100644
--- a/charts/vela-core/crds/core.oam.dev_policies.yaml
+++ b/charts/vela-core/crds/core.oam.dev_policies.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.5
   name: policies.core.oam.dev
 spec:
   group: core.oam.dev
diff --git a/charts/vela-core/crds/core.oam.dev_policydefinitions.yaml b/charts/vela-core/crds/core.oam.dev_policydefinitions.yaml
index ae3a3047..69f70f9f 100644
--- a/charts/vela-core/crds/core.oam.dev_policydefinitions.yaml
+++ b/charts/vela-core/crds/core.oam.dev_policydefinitions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.5
   name: policydefinitions.core.oam.dev
 spec:
   group: core.oam.dev
diff --git a/charts/vela-core/crds/core.oam.dev_resourcetrackers.yaml b/charts/vela-core/crds/core.oam.dev_resourcetrackers.yaml
index 99badfef..203f65e3 100644
--- a/charts/vela-core/crds/core.oam.dev_resourcetrackers.yaml
+++ b/charts/vela-core/crds/core.oam.dev_resourcetrackers.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.5
   name: resourcetrackers.core.oam.dev
 spec:
   group: core.oam.dev
@@ -96,7 +96,6 @@ spec:
                         the event) or if no container name is specified "spec.containers[2]" (container with
                         index 2 in this pod). This syntax is chosen only to have some well-defined way of
                         referencing a part of an object.
-                        TODO: this design is not final and this field is subject to change in the future.
                       type: string
                     kind:
                       description: |-
diff --git a/charts/vela-core/crds/core.oam.dev_traitdefinitions.yaml b/charts/vela-core/crds/core.oam.dev_traitdefinitions.yaml
index b753dc19..c16a2bbb 100644
--- a/charts/vela-core/crds/core.oam.dev_traitdefinitions.yaml
+++ b/charts/vela-core/crds/core.oam.dev_traitdefinitions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.5
   name: traitdefinitions.core.oam.dev
 spec:
   group: core.oam.dev
@@ -220,6 +220,10 @@ spec:
                     description: CustomStatus defines the custom status message that
                       could display to user
                     type: string
+                  details:
+                    description: Details stores a string representation of a CUE status
+                      map to be evaluated at runtime for display
+                    type: string
                   healthPolicy:
                     description: HealthPolicy defines the health check policy for
                       the abstraction
diff --git a/charts/vela-core/crds/core.oam.dev_workflowstepdefinitions.yaml b/charts/vela-core/crds/core.oam.dev_workflowstepdefinitions.yaml
index af718182..ce9b0767 100644
--- a/charts/vela-core/crds/core.oam.dev_workflowstepdefinitions.yaml
+++ b/charts/vela-core/crds/core.oam.dev_workflowstepdefinitions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.5
   name: workflowstepdefinitions.core.oam.dev
 spec:
   group: core.oam.dev
diff --git a/charts/vela-core/templates/NOTES.txt b/charts/vela-core/templates/NOTES.txt
index 65622ad1..14cb2559 100644
--- a/charts/vela-core/templates/NOTES.txt
+++ b/charts/vela-core/templates/NOTES.txt
@@ -29,3 +29,12 @@ Welcome to use the KubeVela! Enjoy your shipping application journey!
 
 
 You can refer to https://kubevela.io for more details.
+
+{{- if and .Values.authentication.enabled (not .Values.authentication.definitions.enabled) }}
+
+WARNING: Authentication is enabled but definition permission validation is disabled.
+   Applications can reference definitions without RBAC checks.
+   To enable definition permission validation:
+     --set authentication.definitions.enabled=true
+   Ensure users have appropriate RBAC permissions before enabling.
+{{- end }}
diff --git a/charts/vela-core/templates/defwithtemplate/request.yaml b/charts/vela-core/templates/defwithtemplate/request.yaml
index 7f8387aa..8461dfc0 100644
--- a/charts/vela-core/templates/defwithtemplate/request.yaml
+++ b/charts/vela-core/templates/defwithtemplate/request.yaml
@@ -4,7 +4,7 @@ apiVersion: core.oam.dev/v1beta1
 kind: WorkflowStepDefinition
 metadata:
   annotations:
-    custom.definition.oam.dev/category: External Intergration
+    custom.definition.oam.dev/category: External Integration
     definition.oam.dev/alias: ""
     definition.oam.dev/description: Send request to the url
   name: request
@@ -14,8 +14,8 @@ spec:
     cue:
       template: |
         import (
+        	"vela/op"
         	"vela/http"
-        	"vela/builtin"
         	"encoding/json"
         )
 
@@ -33,14 +33,22 @@ spec:
         		}
         	}
         }
-        fail: {
-        	if http.$returns.response.statusCode > 400 {
-        		requestFail: builtin.#Fail & {
-        			$params: message: "request of \(parameter.url) is fail: \(http.response.statusCode)"
+
+        wait: op.#ConditionalWait & {
+        	continue: req.$returns != _|_
+        	message?: "Waiting for response from \(parameter.url)"
+        }
+
+        fail: op.#Steps & {
+        	if req.$returns.statusCode > 400 {
+        		requestFail: op.#Fail & {
+        			message: "request of \(parameter.url) is fail: \(req.$returns.statusCode)"
         		}
         	}
         }
-        response: json.Unmarshal(http.$returns.response.body)
+
+        response: json.Unmarshal(req.$returns.body)
+
         parameter: {
         	url:    string
         	method: *"GET" | "POST" | "PUT" | "DELETE"
diff --git a/charts/vela-core/templates/defwithtemplate/storage.yaml b/charts/vela-core/templates/defwithtemplate/storage.yaml
index fa3691e3..c6783d54 100644
--- a/charts/vela-core/templates/defwithtemplate/storage.yaml
+++ b/charts/vela-core/templates/defwithtemplate/storage.yaml
@@ -57,7 +57,10 @@ spec:
         	if parameter.hostPath != _|_ for v in parameter.hostPath {
         		{
         			name: "hostpath-" + v.name
-        			path: v.path
+        			hostPath: {
+        				path: v.path
+        				type: v.type
+        			}
         		}
         	},
         ]
diff --git a/charts/vela-core/templates/kubevela-controller.yaml b/charts/vela-core/templates/kubevela-controller.yaml
index f53dfc8f..80bf8028 100644
--- a/charts/vela-core/templates/kubevela-controller.yaml
+++ b/charts/vela-core/templates/kubevela-controller.yaml
@@ -299,8 +299,8 @@ spec:
             - "--enable-external-package-for-default-compiler={{ .Values.workflow.enableExternalPackageForDefaultCompiler }}"
             - "--enable-external-package-watch-for-default-compiler={{ .Values.workflow.enableExternalPackageWatchForDefaultCompiler }}"
             - "--feature-gates=EnableSuspendOnFailure={{- .Values.workflow.enableSuspendOnFailure | toString -}}"
-            - "--feature-gates=AuthenticateApplication={{- .Values.authentication.enabled | toString -}}"
             - "--feature-gates=GzipResourceTracker={{- .Values.featureGates.gzipResourceTracker | toString -}}"
+            - "--feature-gates=AuthenticateApplication={{- .Values.authentication.enabled | toString -}}"
             - "--feature-gates=ZstdResourceTracker={{- .Values.featureGates.zstdResourceTracker | toString -}}"
             - "--feature-gates=ApplyOnce={{- .Values.featureGates.applyOnce | toString -}}"
             - "--feature-gates=MultiStageComponentApply= {{- .Values.featureGates.multiStageComponentApply | toString -}}"
@@ -312,7 +312,9 @@ spec:
             - "--feature-gates=SharedDefinitionStorageForApplicationRevision={{- .Values.featureGates.sharedDefinitionStorageForApplicationRevision | toString -}}"
             - "--feature-gates=DisableWorkflowContextConfigMapCache={{- .Values.featureGates.disableWorkflowContextConfigMapCache | toString -}}"
             - "--feature-gates=EnableCueValidation={{- .Values.featureGates.enableCueValidation | toString -}}"
+            - "--feature-gates=EnableApplicationStatusMetrics={{- .Values.featureGates.enableApplicationStatusMetrics | toString -}}"
             {{ if .Values.authentication.enabled }}
+            - "--feature-gates=ValidateDefinitionPermissions={{ .Values.authentication.definitions.enabled | toString -}}"
             {{ if .Values.authentication.withUser }}
             - "--authentication-with-user"
             {{ end }}
diff --git a/charts/vela-core/values.yaml b/charts/vela-core/values.yaml
index f9008464..2fa9592e 100644
--- a/charts/vela-core/values.yaml
+++ b/charts/vela-core/values.yaml
@@ -124,6 +124,7 @@ optimize:
 ##@param featureGates.sharedDefinitionStorageForApplicationRevision use definition cache to reduce duplicated definition storage for application revision, must be used with InformerCacheFilterUnnecessaryFields
 ##@param featureGates.disableWorkflowContextConfigMapCache disable the workflow context's configmap informer cache
 ##@param featureGates.enableCueValidation enable the strict cue validation for cue required parameter fields
+##@param featureGates.enableApplicationStatusMetrics enable application status metrics and structured logging
 ##@param
 featureGates:
   gzipResourceTracker: false
@@ -140,6 +141,7 @@ featureGates:
   sharedDefinitionStorageForApplicationRevision: true
   disableWorkflowContextConfigMapCache: true
   enableCueValidation: false
+  enableApplicationStatusMetrics: false
 
 ## @section MultiCluster parameters
 
@@ -287,12 +289,15 @@ kubeClient:
   qps: 400
   burst: 600
 
-## @param authentication.enabled Enable authentication for application
+## @param authentication.enabled Enable authentication framework for applications
+## @param authentication.definitions.enabled Enable definition permission validation (requires authentication.enabled)  
 ## @param authentication.withUser Application authentication will impersonate as the request User
 ## @param authentication.defaultUser Application authentication will impersonate as the User if no user provided in Application
 ## @param authentication.groupPattern Application authentication will impersonate as the request Group that matches the pattern
 authentication:
   enabled: false
+  definitions:
+    enabled: false
   withUser: true
   defaultUser: kubevela:vela-core
   groupPattern: kubevela:*
diff --git a/e2e/addon/mock/testrepo/helm-repo/index.yaml b/e2e/addon/mock/testrepo/helm-repo/index.yaml
index 78946b3a..fc089d7d 100644
--- a/e2e/addon/mock/testrepo/helm-repo/index.yaml
+++ b/e2e/addon/mock/testrepo/helm-repo/index.yaml
@@ -22,7 +22,7 @@ entries:
       version: 2.0.0
       annotations:
         system.vela: ">=1.5.0"
-        system.kubernetes: ">=1.30.0"
+        system.kubernetes: ">=1.32.0"
   vela-workflow:
     - annotations:
         system.vela: '>=v1.6.0-beta.1'
diff --git a/go.mod b/go.mod
index 23798f5a..e9d472c5 100644
--- a/go.mod
+++ b/go.mod
@@ -17,9 +17,9 @@ require (
 	github.com/crossplane/crossplane-runtime v1.16.0
 	github.com/cue-exp/kubevelafix v0.0.0-20220922150317-aead819d979d
 	github.com/dave/jennifer v1.6.1
-	github.com/davecgh/go-spew v1.1.1
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
 	github.com/ettle/strcase v0.2.0
-	github.com/fatih/color v1.16.0
+	github.com/fatih/color v1.18.0
 	github.com/fluxcd/helm-controller/api v0.32.2
 	github.com/fluxcd/source-controller/api v0.30.0
 	github.com/form3tech-oss/jwt-go v3.2.5+incompatible
@@ -38,29 +38,29 @@ require (
 	github.com/hinshun/vt10x v0.0.0-20180616224451-1954e6464174
 	github.com/imdario/mergo v0.3.16
 	github.com/jeremywohl/flatten/v2 v2.0.0-20211013061545-07e4a09fb8e4
-	github.com/kubevela/pkg v1.9.3-0.20241203070234-2cf98778c0a9
-	github.com/kubevela/workflow v0.6.2
+	github.com/kubevela/pkg v1.9.3-0.20250625225831-a2894a62a307
+	github.com/kubevela/workflow v0.6.3-0.20250717221743-56b80cee4121
 	github.com/kyokomi/emoji v2.2.4+incompatible
 	github.com/magiconair/properties v1.8.7
 	github.com/mattn/go-runewidth v0.0.15
 	github.com/mitchellh/hashstructure/v2 v2.0.2
 	github.com/nacos-group/nacos-sdk-go/v2 v2.2.2
-	github.com/oam-dev/cluster-gateway v1.9.1-0.20241120140625-33c8891b781c
-	github.com/oam-dev/cluster-register v1.0.4-0.20230424040021-147f7c1fefe5
+	github.com/oam-dev/cluster-gateway v1.9.2-0.20250629203450-2b04dd452b7a
+	github.com/oam-dev/cluster-register v1.0.4-0.20250624042630-618dfa13eb5b
 	github.com/oam-dev/terraform-config-inspect v0.0.0-20210418082552-fc72d929aa28
-	github.com/oam-dev/terraform-controller v0.8.0
+	github.com/oam-dev/terraform-controller v0.8.1-0.20250707044258-c0557127de25
 	github.com/olekukonko/tablewriter v0.0.5
-	github.com/onsi/ginkgo/v2 v2.19.0
-	github.com/onsi/gomega v1.34.1
+	github.com/onsi/ginkgo/v2 v2.23.3
+	github.com/onsi/gomega v1.36.2
 	github.com/openkruise/kruise-api v1.4.0
 	github.com/openkruise/rollouts v0.3.0
 	github.com/pelletier/go-toml v1.9.5
 	github.com/pkg/errors v0.9.1
-	github.com/prometheus/client_golang v1.18.0
-	github.com/prometheus/client_model v0.5.0
+	github.com/prometheus/client_golang v1.20.5
+	github.com/prometheus/client_model v0.6.1
 	github.com/rivo/tview v0.0.0-20221128165837-db36428c92d9
 	github.com/sirupsen/logrus v1.9.3
-	github.com/spf13/cobra v1.8.0
+	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.10.0
 	github.com/tidwall/gjson v1.14.4
@@ -69,31 +69,31 @@ require (
 	gitlab.com/gitlab-org/api/client-go v0.127.0
 	go.uber.org/multierr v1.11.0
 	golang.org/x/crypto v0.37.0
-	golang.org/x/mod v0.21.0
+	golang.org/x/mod v0.24.0
 	golang.org/x/oauth2 v0.29.0
 	golang.org/x/sync v0.13.0
 	golang.org/x/term v0.31.0
 	golang.org/x/text v0.24.0
-	golang.org/x/tools v0.26.0
+	golang.org/x/tools v0.31.0
 	gomodules.xyz/jsonpatch/v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
 	helm.sh/helm/v3 v3.14.4
-	k8s.io/api v0.29.2
-	k8s.io/apiextensions-apiserver v0.29.2
-	k8s.io/apimachinery v0.29.2
-	k8s.io/apiserver v0.29.2
-	k8s.io/cli-runtime v0.29.2
-	k8s.io/client-go v0.29.2
-	k8s.io/component-base v0.29.2
+	k8s.io/api v0.31.10
+	k8s.io/apiextensions-apiserver v0.31.10
+	k8s.io/apimachinery v0.31.10
+	k8s.io/apiserver v0.31.10
+	k8s.io/cli-runtime v0.31.10
+	k8s.io/client-go v0.31.10
+	k8s.io/component-base v0.31.10
 	k8s.io/helm v2.17.0+incompatible
-	k8s.io/klog/v2 v2.120.1
-	k8s.io/kube-aggregator v0.27.2
-	k8s.io/kubectl v0.29.2
-	k8s.io/metrics v0.29.2
-	k8s.io/utils v0.0.0-20240310230437-4693a0247e57
+	k8s.io/klog/v2 v2.130.1
+	k8s.io/kube-aggregator v0.31.10
+	k8s.io/kubectl v0.31.10
+	k8s.io/metrics v0.31.10
+	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397
 	open-cluster-management.io/api v0.11.0
-	sigs.k8s.io/controller-runtime v0.17.6
-	sigs.k8s.io/controller-tools v0.14.0
+	sigs.k8s.io/controller-runtime v0.19.7
+	sigs.k8s.io/controller-tools v0.16.5
 	sigs.k8s.io/gateway-api v0.7.1
 	sigs.k8s.io/kind v0.20.0
 	sigs.k8s.io/yaml v1.4.0
@@ -117,15 +117,15 @@ require (
 	github.com/agext/levenshtein v1.2.3 // indirect
 	github.com/alessio/shellescape v1.4.1 // indirect
 	github.com/aliyun/alibaba-cloud-sdk-go v1.61.1704 // indirect
-	github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df // indirect
+	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
 	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
 	github.com/buger/jsonparser v1.1.1 // indirect
-	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
-	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chai2010/gettext-go v1.0.2 // indirect
 	github.com/cloudflare/circl v1.6.1 // indirect
 	github.com/cockroachdb/apd/v3 v3.2.1 // indirect
@@ -135,7 +135,7 @@ require (
 	github.com/containerd/stargz-snapshotter/estargz v0.15.1 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.4 // indirect
 	github.com/creack/pty v1.1.18 // indirect
 	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
@@ -148,8 +148,8 @@ require (
 	github.com/emicklei/go-restful/v3 v3.12.0 // indirect
 	github.com/emicklei/proto v1.10.0 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
-	github.com/evanphx/json-patch v5.9.0+incompatible // indirect
-	github.com/evanphx/json-patch/v5 v5.8.0 // indirect
+	github.com/evanphx/json-patch v5.7.0+incompatible // indirect
+	github.com/evanphx/json-patch/v5 v5.9.0 // indirect
 	github.com/exponent-io/jsonpath v0.0.0-20151013193312-d6023ce2651d // indirect
 	github.com/fatih/camelcase v1.0.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
@@ -157,7 +157,7 @@ require (
 	github.com/fluxcd/pkg/apis/kustomize v1.0.0 // indirect
 	github.com/fluxcd/pkg/apis/meta v1.0.0 // indirect
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
-	github.com/fvbommel/sortorder v1.1.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
 	github.com/gdamore/encoding v1.0.0 // indirect
 	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/go-errors/errors v1.5.1 // indirect
@@ -171,17 +171,17 @@ require (
 	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/go-stack/stack v1.8.1 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
-	github.com/gobuffalo/flect v1.0.2 // indirect
+	github.com/gobuffalo/flect v1.0.3 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/btree v1.1.2 // indirect
-	github.com/google/cel-go v0.17.7 // indirect
-	github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49 // indirect
+	github.com/google/cel-go v0.20.1 // indirect
+	github.com/google/gnostic-models v0.6.9 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6 // indirect
+	github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
 	github.com/google/safetext v0.0.0-20220905092116-b49f7bc46da2 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.6.0 // indirect
@@ -189,7 +189,7 @@ require (
 	github.com/gorilla/websocket v1.5.0 // indirect
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
@@ -205,8 +205,9 @@ require (
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/compress v1.17.7 // indirect
+	github.com/klauspost/compress v1.17.10 // indirect
 	github.com/kr/pty v1.1.8 // indirect
+	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
 	github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
 	github.com/lib/pq v1.10.9 // indirect
@@ -215,14 +216,13 @@ require (
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
 	github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/locker v1.0.1 // indirect
-	github.com/moby/spdystream v0.2.0 // indirect
+	github.com/moby/spdystream v0.4.0 // indirect
 	github.com/moby/term v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
@@ -238,9 +238,9 @@ require (
 	github.com/perimeterx/marshmallow v1.1.5 // indirect
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/pjbgf/sha1cd v0.3.2 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/common v0.45.0 // indirect
-	github.com/prometheus/procfs v0.12.0 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/prometheus/common v0.55.0 // indirect
+	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/protocolbuffers/txtpbfmt v0.0.0-20230328191034-3462fbc510c0 // indirect
 	github.com/rivo/uniseg v0.4.3 // indirect
 	github.com/robfig/cron/v3 v3.0.1 // indirect
@@ -255,23 +255,24 @@ require (
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.0 // indirect
 	github.com/vbatts/tar-split v0.11.5 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/zclconf/go-cty v1.13.0 // indirect
-	go.etcd.io/etcd/api/v3 v3.5.10 // indirect
-	go.etcd.io/etcd/client/pkg/v3 v3.5.10 // indirect
-	go.etcd.io/etcd/client/v3 v3.5.10 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0 // indirect
-	go.opentelemetry.io/otel v1.21.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0 // indirect
-	go.opentelemetry.io/otel/metric v1.21.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.21.0 // indirect
-	go.opentelemetry.io/otel/trace v1.21.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.0.0 // indirect
+	go.etcd.io/etcd/api/v3 v3.5.16 // indirect
+	go.etcd.io/etcd/client/pkg/v3 v3.5.16 // indirect
+	go.etcd.io/etcd/client/v3 v3.5.16 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.53.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 // indirect
+	go.opentelemetry.io/otel v1.28.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.28.0 // indirect
+	go.opentelemetry.io/otel/metric v1.28.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.28.0 // indirect
+	go.opentelemetry.io/otel/trace v1.28.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
 	go.starlark.net v0.0.0-20240329153429-e6e8e7ce1b7a // indirect
 	go.uber.org/automaxprocs v1.5.3 // indirect
 	go.uber.org/zap v1.26.0 // indirect
@@ -280,12 +281,12 @@ require (
 	golang.org/x/sys v0.32.0 // indirect
 	golang.org/x/time v0.10.0 // indirect
 	google.golang.org/genproto v0.0.0-20240227224415-6ceb2ff114de // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240227224415-6ceb2ff114de // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda // indirect
-	google.golang.org/grpc v1.63.0 // indirect
-	google.golang.org/protobuf v1.35.2 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240814211410-ddb44dafa142 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240814211410-ddb44dafa142 // indirect
+	google.golang.org/grpc v1.67.1 // indirect
+	google.golang.org/protobuf v1.36.5 // indirect
 	gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
-	gopkg.in/evanphx/json-patch.v5 v5.9.0 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
@@ -293,25 +294,25 @@ require (
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	k8s.io/klog v1.0.0 // indirect
-	k8s.io/kms v0.29.3 // indirect
-	k8s.io/kube-openapi v0.0.0-20240403164606-bc84c2ddaf99 // indirect
+	k8s.io/kms v0.31.10 // indirect
+	k8s.io/kube-openapi v0.0.0-20250610211856-8b98d1ed966a // indirect
 	oras.land/oras-go v1.2.5 // indirect
-	sigs.k8s.io/apiserver-network-proxy v0.0.30 // indirect
-	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.28.0 // indirect
-	sigs.k8s.io/apiserver-runtime v1.1.2-0.20221118041430-0a6394f6dda3 // indirect
+	sigs.k8s.io/apiserver-network-proxy v0.31.4 // indirect
+	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.3 // indirect
+	sigs.k8s.io/apiserver-runtime v1.1.2-0.20250117204231-9282f514a674 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
-	sigs.k8s.io/kustomize/api v0.16.0 // indirect
-	sigs.k8s.io/kustomize/kyaml v0.16.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
+	sigs.k8s.io/kustomize/api v0.17.2 // indirect
+	sigs.k8s.io/kustomize/kyaml v0.17.1 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
 )
 
 replace (
 	cloud.google.com/go => cloud.google.com/go v0.100.2
 	github.com/docker/cli => github.com/docker/cli v24.0.9+incompatible
-	github.com/docker/docker => github.com/docker/docker v25.0.6+incompatible
+	github.com/docker/docker => github.com/docker/docker v28.3.3+incompatible
 	github.com/docker/docker-credential-helpers => github.com/docker/docker-credential-helpers v0.7.0
 	github.com/wercker/stern => github.com/oam-dev/stern v1.13.2
-	k8s.io/kube-openapi => k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client => sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.36
-	sigs.k8s.io/apiserver-runtime => github.com/kmodules/apiserver-runtime v1.1.2-0.20240303184316-6365e03bf9ac
+	sigs.k8s.io/apiserver-runtime => github.com/kmodules/apiserver-runtime v1.1.2-0.20250422194347-c5ac4abaf2ae
 )
diff --git a/go.sum b/go.sum
index ef672ce8..2eda6f38 100644
--- a/go.sum
+++ b/go.sum
@@ -1,24 +1,17 @@
-cloud.google.com/go v0.100.2 h1:t9Iw5QH5v4XtlEQaCtUY7x6sCABps8sW0acw7e2WQ6Y=
 cloud.google.com/go v0.100.2/go.mod h1:4Xra9TjzAeYHrl5+oeLlzbM2k3mjVhZh4UqTZ//w99A=
 cloud.google.com/go/compute v0.1.0/go.mod h1:GAesmwr110a34z04OlxYkATPBEfVhkymfTBXtfbBFow=
-cloud.google.com/go/compute v1.24.0 h1:phWcR2eWzRJaL/kOiJwfFsPs4BaKq1j6vnpZrc1YlVg=
-cloud.google.com/go/compute/metadata v0.3.0 h1:Tz+eQXMEqDIKRsmY3cHTL6FVaynIjX2QxYC4trgAKZc=
-cloud.google.com/go/compute/metadata v0.3.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
-cloud.google.com/go/firestore v1.1.0/go.mod h1:ulACoGHTpvq5r8rxGJ4ddJZBZqakUQqClKRT5SZwBmk=
-cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
 cuelabs.dev/go/oci/ociregistry v0.0.0-20240404174027-a39bec0462d2 h1:BnG6pr9TTr6CYlrJznYUDj6V7xldD1W+1iXPum0wT/w=
 cuelabs.dev/go/oci/ociregistry v0.0.0-20240404174027-a39bec0462d2/go.mod h1:pK23AUVXuNzzTpfMCA06sxZGeVQ/75FdVtW249de9Uo=
 cuelang.org/go v0.9.2 h1:pfNiry2PdRBr02G/aKm5k2vhzmqbAOoaB4WurmEbWvs=
 cuelang.org/go v0.9.2/go.mod h1:qpAYsLOf7gTM1YdEg6cxh553uZ4q9ZDWlPbtZr9q1Wk=
 dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
 dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
-dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
 github.com/AlecAivazis/survey/v2 v2.1.1 h1:LEMbHE0pLj75faaVEKClEX1TM4AJmmnOh9eimREzLWI=
 github.com/AlecAivazis/survey/v2 v2.1.1/go.mod h1:9FJRdMdDm8rnT+zHVbvQT2RTSTLq0Ttd6q3Vl2fahjk=
-github.com/Azure/go-ansiterm v0.0.0-20210608223527-2377c96fe795/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
-github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
@@ -32,7 +25,6 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/BurntSushi/toml v1.0.0/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8=
 github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
-github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7OputlJIzU=
 github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU=
 github.com/FogDong/uitable v0.0.5 h1:1bJo/uvhGUC6i8JPHZCr8XKMHiDExE7mQkOCmDl0ryQ=
@@ -87,20 +79,14 @@ github.com/aliyun/alibaba-cloud-sdk-go v1.61.1704/go.mod h1:RcDobYh8k5VP6TNybz9m
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
-github.com/antlr/antlr4/runtime/Go/antlr v0.0.0-20210826220005-b48c857c3a0e/go.mod h1:F7bn7fEU90QkQ3tnmaTx3LTKLEDqnwWODIYppRQ5hnY=
-github.com/antlr/antlr4/runtime/Go/antlr v0.0.0-20220418222510-f25a4f6275ed/go.mod h1:F7bn7fEU90QkQ3tnmaTx3LTKLEDqnwWODIYppRQ5hnY=
-github.com/antlr/antlr4/runtime/Go/antlr v1.4.10/go.mod h1:F7bn7fEU90QkQ3tnmaTx3LTKLEDqnwWODIYppRQ5hnY=
-github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df h1:7RFfzj4SSt6nnvCPbCqijJi1nWCd+TqAT3bYCStRC18=
-github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df/go.mod h1:pSwJ0fSY5KhvocuWSx4fz3BA8OrA1bQn+K1Eli3BRwM=
+github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
+github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g=
 github.com/apparentlymart/go-dump v0.0.0-20180507223929-23540a00eaa3/go.mod h1:oL81AME2rN47vu18xqj1S1jPIPuN7afo62yKTNn3XMM=
 github.com/apparentlymart/go-textseg v1.0.0/go.mod h1:z96Txxhf3xSFMPmb5X/1W05FF/Nj9VFpLOpjS5yuumk=
 github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6iT90AvPUL1NNfNw=
 github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
 github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
 github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
-github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
-github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b h1:uUXgbcPDK3KpW29o4iy7GtuappbWT0l5NaMo9H9pJDw=
@@ -108,16 +94,11 @@ github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b/go.mod h1:DAHtR1m6l
 github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/benbjohnson/clock v1.0.3/go.mod h1:bGMdMPoPVvcYyt1gHDf4J2KE153Yf9BuiUKYMaxlTDM=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84=
-github.com/bketelsen/crypt v0.0.4/go.mod h1:aI6NrJ0pMGgvZKL1iVgXLnfIFJtfV+bKCoqOes/6LfM=
-github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
 github.com/bluele/gcache v0.0.2 h1:WcbfdXICg7G/DGBh1PFfcirkWOQV+v077yF1pSy3DGw=
@@ -134,25 +115,18 @@ github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b h1:otBG+dV+YK+Soembj
 github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
 github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0 h1:nvj0OLI3YqYXer/kZD8Ri1aaunCxIEsOst1BVJswV0o=
 github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
-github.com/cenkalti/backoff/v4 v4.1.1/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
-github.com/cenkalti/backoff/v4 v4.1.3/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
-github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
-github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/certifi/gocertifi v0.0.0-20191021191039-0944d244cd40/go.mod h1:sGbDF6GwGcLpkNXPUTkMRoywsNa/ol15pxFe6ERfguA=
-github.com/certifi/gocertifi v0.0.0-20200922220541-2c3bb06c6054/go.mod h1:sGbDF6GwGcLpkNXPUTkMRoywsNa/ol15pxFe6ERfguA=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
-github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chai2010/gettext-go v1.0.2 h1:1Lwwip6Q2QGsAdl/ZKPCwTe9fe0CjlUbqj5bFNSjIRk=
 github.com/chai2010/gettext-go v1.0.2/go.mod h1:y+wnP2cHYaVj19NZhYKAwEMH2CI1gNHeQQ+5AjwawxA=
 github.com/chartmuseum/helm-push v0.10.4 h1:vJTEwhQQ/c+puHSZv+n/3qoHQEAkjjX2b7ODvFVL14s=
 github.com/chartmuseum/helm-push v0.10.4/go.mod h1:T+g3wEExKHZADxEU3ZwCRZm5Wa5crecdqJWBfETGTKw=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
 github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
@@ -160,17 +134,11 @@ github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGX
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
 github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa h1:jQCWAUqqlij9Pgj2i/PB79y4KOPYVyFYdROxgaCwdTQ=
-github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa/go.mod h1:x/1Gn8zydmfq8dk6e9PdstVsDgu9RuyIIJqAaF//0IM=
 github.com/cockroachdb/apd/v3 v3.2.1 h1:U+8j7t0axsIgvQUqthuNm82HIrYXodOV2iWLWtEaIwg=
 github.com/cockroachdb/apd/v3 v3.2.1/go.mod h1:klXJcjp+FffLTHlhIG69tezTDvdP065naDsHzKhYSqc=
-github.com/cockroachdb/datadriven v0.0.0-20200714090401-bf6692d28da5/go.mod h1:h6jFvWxBdQXxjopDMZyH2UVceIRfR84bdzbkoKrsWNo=
-github.com/cockroachdb/errors v1.2.4/go.mod h1:rQD95gz6FARkaKkQXUksEje/d9a6wBJoCr5oaCLELYA=
-github.com/cockroachdb/logtags v0.0.0-20190617123548-eb05cc24525f/go.mod h1:i/u985jwjWRlyHXQbwatDASoW0RMlZ/3i9yJHE2xLkI=
 github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
 github.com/containerd/cgroups/v3 v3.0.2 h1:f5WFqIVSgo5IZmtTT3qVBo6TzI1ON6sycSBKkymb9L0=
 github.com/containerd/cgroups/v3 v3.0.2/go.mod h1:JUgITrzdFqp42uI2ryGA+ge0ap/nxzYgkGmIcetmErE=
@@ -186,25 +154,15 @@ github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpS
 github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
 github.com/containerd/stargz-snapshotter/estargz v0.15.1 h1:eXJjw9RbkLFgioVaTG+G/ZW/0kEe2oEKCdS/ZxIyoCU=
 github.com/containerd/stargz-snapshotter/estargz v0.15.1/go.mod h1:gr2RNwukQ/S9Nv33Lt6UC7xEx58C+LHRdoqbEKjz1Kk=
-github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
-github.com/coreos/etcd v3.3.13+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
-github.com/coreos/go-oidc v2.1.0+incompatible/go.mod h1:CgnwVTmzoESiwO9qyAFEMiHoZ1nMCKZlZ9V6mm3/LKc=
-github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
-github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
-github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
-github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/cpuguy83/go-md2man/v2 v2.0.3 h1:qMCsGGgs+MAzDFyp9LpAe1Lqy/fY/qCovCm0qnXZOBM=
-github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.4 h1:wfIWP927BUkWJb2NmU/kNDYIBTh/ziUX91+lVfRxZq4=
+github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
 github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/crossplane/crossplane-runtime v1.16.0 h1:lz+l0wEB3qowdTmN7t0PZkfuNSvfOoEhQrEYFbYqMow=
@@ -216,10 +174,9 @@ github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGL
 github.com/dave/jennifer v1.6.1 h1:T4T/67t6RAA5AIV6+NP8Uk/BIsXgDoqEowgycdQQLuk=
 github.com/dave/jennifer v1.6.1/go.mod h1:nXbxhEmQfOZhWml3D1cDK5M1FLnMSozpbFN/m3RmGZc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
-github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/distribution/v3 v3.0.0-20221208165359-362910506bc2 h1:aBfCb7iqHmDEIp6fBvC/hQUddQfg+3qdYjwzaiP9Hnc=
 github.com/distribution/distribution/v3 v3.0.0-20221208165359-362910506bc2/go.mod h1:WHNsWjnIn2V1LYOrME7e8KxSeKunYHsxEm4am0BUtcI=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
@@ -228,8 +185,8 @@ github.com/docker/cli v24.0.9+incompatible h1:OxbimnP/z+qVjDLpq9wbeFU3Nc30XhSe+L
 github.com/docker/cli v24.0.9+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v25.0.6+incompatible h1:5cPwbwriIcsua2REJe8HqQV+6WlWc1byg2QSXzBxBGg=
-github.com/docker/docker v25.0.6+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI=
+github.com/docker/docker v28.3.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.7.0 h1:xtCHsjxogADNZcdv1pKUHXryefjlVRqWqIhk/uXJp0A=
 github.com/docker/docker-credential-helpers v0.7.0/go.mod h1:rETQfLdHNT3foU5kuNkFR1R1V12OJRRO5lzt2D1b5X0=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
@@ -241,15 +198,12 @@ github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHz
 github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 h1:UhxFibDNY/bfvqU5CAUmr9zpesgbU6SWc8/B4mflAE4=
 github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
-github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
 github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o=
 github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
-github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
-github.com/emicklei/go-restful/v3 v3.8.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/emicklei/go-restful/v3 v3.9.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
 github.com/emicklei/go-restful/v3 v3.12.0 h1:y2DdzBAURM29NFF94q6RaY4vjIH1rtwDapwQtU84iWk=
 github.com/emicklei/go-restful/v3 v3.12.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/emicklei/proto v1.10.0 h1:pDGyFRVV5RvV+nkBK9iy3q67FBy9Xa7vwrOTE+g5aGw=
@@ -262,31 +216,23 @@ github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1m
 github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
-github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1/go.mod h1:KJwIaB5Mv44NWtYuAOFCVOjcI94vtpEz2JU/D2v6IjE=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/envoyproxy/protoc-gen-validate v1.0.4 h1:gVPz/FMfvh57HdSJQyvBtF00j8JU4zdyUgIUNhlgg0A=
-github.com/envoyproxy/protoc-gen-validate v1.0.4/go.mod h1:qys6tmnRsYrQqIhm2bvKZH4Blx/1gTIZ2UKVY1M+Yew=
 github.com/ettle/strcase v0.2.0 h1:fGNiVF21fHXpX1niBgk0aROov1LagYsOwV/xqKDKR/Q=
 github.com/ettle/strcase v0.2.0/go.mod h1:DajmHElDSaX76ITe3/VHVyMin4LWSJN5Z909Wp+ED1A=
-github.com/evanphx/json-patch v0.5.2/go.mod h1:ZWS5hhDbVDyob71nXKNL0+PWn6ToqBHMikGIFbs31qQ=
 github.com/evanphx/json-patch v4.11.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/evanphx/json-patch v5.9.0+incompatible h1:fBXyNpNMuTTDdquAq/uisOr2lShz4oaXpDTX2bLe7ls=
-github.com/evanphx/json-patch v5.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/evanphx/json-patch v5.7.0+incompatible h1:vgGkfT/9f8zE6tvSCe74nfpAVDQ2tG6yudJd8LBksgI=
+github.com/evanphx/json-patch v5.7.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/evanphx/json-patch/v5 v5.6.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2VvlbKOFpnXhI9Bw4=
-github.com/evanphx/json-patch/v5 v5.8.0 h1:lRj6N9Nci7MvzrXuX6HFzU8XjmhPiXPlsKEy1u0KQro=
-github.com/evanphx/json-patch/v5 v5.8.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
+github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0/FOJfg=
+github.com/evanphx/json-patch/v5 v5.9.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
 github.com/exponent-io/jsonpath v0.0.0-20151013193312-d6023ce2651d h1:105gxyaGwCFad8crR9dcMQWvV9Hvulu6hwUh4tWPJnM=
 github.com/exponent-io/jsonpath v0.0.0-20151013193312-d6023ce2651d/go.mod h1:ZZMPRZwes7CROmyNKgQzC3XPs6L/G2EJLHddWejkmf4=
 github.com/fatih/camelcase v1.0.0 h1:hxNvNX/xYBp0ovncs8WyWZrOrpBNub/JfaMvbURyft8=
 github.com/fatih/camelcase v1.0.0/go.mod h1:yN2Sb0lFhZJUdVvtELVWefmrXpuZESvPmqwoZc+/fpc=
 github.com/fatih/color v0.0.0-20180516100307-2d684516a886/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
-github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
-github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fluxcd/helm-controller/api v0.32.2 h1:ETkZmMEHY/qu6a9AjP6en35WrpN7NnVmhOe7IvOB7jE=
@@ -309,19 +255,16 @@ github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3
 github.com/frankban/quicktest v1.14.3/go.mod h1:mgiwOwqx65TmIk1wJ6Q7wvnVMocbUorkibMOrVTHZps=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
-github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
-github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
-github.com/fvbommel/sortorder v1.1.0 h1:fUmoe+HLsBTctBDoaBwpQo5N+nrCp8g/BjKb/6ZQmYw=
-github.com/fvbommel/sortorder v1.1.0/go.mod h1:uk88iVf1ovNn1iLfgUVU2F9o5eO30ui720w+kxuqRs0=
+github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
+github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
 github.com/gdamore/encoding v1.0.0 h1:+7OoQ1Bc6eTm5niUzBa0Ctsh6JbMW6Ra+YNuAtDBdko=
 github.com/gdamore/encoding v1.0.0/go.mod h1:alR0ol34c49FCSBLjhosxzcPHQbf2trDkoo5dl+VrEg=
 github.com/gdamore/tcell/v2 v2.6.0 h1:OKbluoP9VYmJwZwq/iLb4BxwKcwGthaa1YNBJIyCySg=
 github.com/gdamore/tcell/v2 v2.6.0/go.mod h1:be9omFATkdr0D9qewWW3d+MEvl5dha+Etb5y65J2H8Y=
 github.com/getkin/kin-openapi v0.131.0 h1:NO2UeHnFKRYhZ8wg6Nyh5Cq7dHk4suQQr72a4pMrDxE=
 github.com/getkin/kin-openapi v0.131.0/go.mod h1:3OlG51PCYNsPByuiMB0t4fjnNlIDnaEDsjiKUV8nL58=
-github.com/getsentry/raven-go v0.2.0/go.mod h1:KungGk8q33+aIAZUIVWZDr2OfAEBsO49PX4NzFV5kcQ=
 github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
@@ -336,44 +279,30 @@ github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMj
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
 github.com/go-git/go-git/v5 v5.16.0 h1:k3kuOEpkc0DeY7xlL6NaaNg39xdgQbtH5mwCafHO9AQ=
 github.com/go-git/go-git/v5 v5.16.0/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8=
-github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gorp/gorp/v3 v3.1.0 h1:ItKF/Vbuj31dmV4jxA1qblpSwkl9g1typ24xoe70IGs=
 github.com/go-gorp/gorp/v3 v3.1.0/go.mod h1:dLEjIyyRNiXvNZ8PSmzpt1GsWAUK8kjVhEpjH8TixEw=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
-github.com/go-kit/log v0.2.0/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
-github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
-github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
 github.com/go-logr/logr v0.4.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
-github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-logr/zapr v1.2.0/go.mod h1:Qa4Bsj2Vb+FAVeAKsLD8RLQ+YRJB8YDmOAKxaBQf7Ro=
-github.com/go-logr/zapr v1.2.3/go.mod h1:eIauM6P8qSvTw5o2ez6UEAfGjQKrxQTl5EoK+Qa2oG4=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
 github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
 github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
 github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
 github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
-github.com/go-openapi/jsonreference v0.19.5/go.mod h1:RdybgQwPxbL4UEjuAruzK1x3nE69AqPYEJeo/TWfEeg=
-github.com/go-openapi/jsonreference v0.20.0/go.mod h1:Ag74Ico3lPc+zR+qjn4XBUmXymS4zJbYVCZmcgkasdo=
-github.com/go-openapi/jsonreference v0.20.1/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
+github.com/go-openapi/jsonreference v0.19.3/go.mod h1:rjx6GuL8TTa9VaixXglHmQmIL98+wF9xc8zWvFonSJ8=
 github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
 github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
 github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
-github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
-github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
 github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
 github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
 github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
@@ -381,19 +310,18 @@ github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZs
 github.com/go-resty/resty/v2 v2.8.0 h1:J29d0JFWwSWrDCysnOK/YjsPMLQTx0TvgJEHVGvf2L8=
 github.com/go-resty/resty/v2 v2.8.0/go.mod h1:UCui0cMHekLrSntoMyofdSTaPpinlRHFtPpizuyDW2w=
 github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
-github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI=
-github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
+github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
+github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-stack/stack v1.8.1 h1:ntEHSVwIt7PNXNpgPmVfMrNhLtgjlmnZha2kOpuRiDw=
 github.com/go-stack/stack v1.8.1/go.mod h1:dcoOX6HbPZSZptuspn9bctJ+N/CnF5gGygcUP3XYfe4=
-github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM=
 github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/gobuffalo/flect v1.0.2 h1:eqjPGSo2WmjgY2XlpGwo2NXgL3RucAKo4k4qQMNA5sA=
-github.com/gobuffalo/flect v1.0.2/go.mod h1:A5msMlrHtLqh9umBSnvabjsMrCcCpAyzglnDvkbYKHs=
+github.com/gobuffalo/flect v1.0.3 h1:xeWBM2nui+qnVvNM4S3foBhCAL2XgPU+a7FdpelbTq4=
+github.com/gobuffalo/flect v1.0.3/go.mod h1:A5msMlrHtLqh9umBSnvabjsMrCcCpAyzglnDvkbYKHs=
 github.com/gobuffalo/logger v1.0.6 h1:nnZNpxYo0zx+Aj9RfMPBm+x9zAU2OayFh/xrAWi34HU=
 github.com/gobuffalo/logger v1.0.6/go.mod h1:J31TBEHR1QLV2683OXTAItYIg8pv2JMHnF/quuAbMjs=
 github.com/gobuffalo/packd v1.0.1 h1:U2wXfRr4E9DH8IdsDLlRFwTZTK7hLfq9qT/QHXGVe/0=
@@ -404,18 +332,12 @@ github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
-github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
-github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/goji/httpauth v0.0.0-20160601135302-2da839ab0f4d/go.mod h1:nnjvkQ9ptGaCkuDUx6wNykzzlUixGxvkme+H/lnzb+A=
-github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
-github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v4 v4.5.1 h1:JdqV9zKUdtaa9gdPlywC3aeoEsR681PlKC+4F5gQgeo=
+github.com/golang-jwt/jwt/v4 v4.5.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=
-github.com/golang/glog v1.2.0 h1:uCdmnmatrKCgMBlM4rMuJZWOkPDqdbZPnrMXDY4gI68=
-github.com/golang/glog v1.2.0/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
-github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
@@ -428,7 +350,6 @@ github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5y
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
 github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
@@ -438,27 +359,19 @@ github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QD
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/gomodule/redigo v1.8.2 h1:H5XSIre1MB5NbPYFp+i1NBbb5qN1W8Y8YAQoAYbkm8k=
 github.com/gomodule/redigo v1.8.2/go.mod h1:P9dn9mFrCBvWhGE1wpxx6fgq7BAeLBk+UUUzlpkBYO0=
-github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.1/go.mod h1:xXMiIv4Fb/0kKde4SpL7qlzvu5cMJDRkFDxJfI9uaxA=
 github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
 github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
-github.com/google/cel-go v0.9.0/go.mod h1:U7ayypeSkw23szu4GaQTPJGx66c20mx8JklMSxrmI1w=
-github.com/google/cel-go v0.12.6/go.mod h1:Jk7ljRzLBhkmiAwBoUxB1sZSCVBAzkqPF25olK/iRDw=
-github.com/google/cel-go v0.17.7 h1:6ebJFzu1xO2n7TLtN+UBqShGBhlD85bhvglh5DpcfqQ=
-github.com/google/cel-go v0.17.7/go.mod h1:HXZKzB0LXqer5lHHgfWAnlYwJaQBDKMjxjulNQzhwhY=
-github.com/google/cel-spec v0.6.0/go.mod h1:Nwjgxy5CbjlPrtCWjeDjUyKMl8w41YBYGjsyDdqk0xA=
-github.com/google/gnostic v0.5.7-v3refs/go.mod h1:73MKFl6jIHelAJNaBGFzt3SPtZULs9dYrGFt8OiIsHQ=
-github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
-github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49 h1:0VpGH+cDhbDtdcweoyCVsF3fhN8kejK6rFe/2FFX2nU=
-github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49/go.mod h1:BkkQ4L1KS1xMt2aWSPStnn55ChGC0DPOn2FQYj+f25M=
+github.com/google/cel-go v0.20.1 h1:nDx9r8S3L4pE61eDdt8igGj8rf5kjYR3ILxWIpWNi84=
+github.com/google/cel-go v0.20.1/go.mod h1:kWcIzTsPX0zmQ+H3TirHstLLf9ep5QTsZBN9u4dOYLg=
+github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw=
+github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
@@ -469,7 +382,6 @@ github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
@@ -485,23 +397,21 @@ github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/martian/v3 v3.2.1/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
-github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6 h1:k7nVchz72niMH6YLQNvHSdIE7iqsQxK1P41mySCvssg=
-github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6/go.mod h1:kf6iHlnVGwgKolg33glAes7Yg/8iWP8ukqeldJSO7jw=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/safetext v0.0.0-20220905092116-b49f7bc46da2 h1:SJ+NtwL6QaZ21U+IrK7d0gGgpjGGvd2kz+FzTHVzdqI=
 github.com/google/safetext v0.0.0-20220905092116-b49f7bc46da2/go.mod h1:Tv1PlzqC9t8wNnpPdctvtSUOPUUg4SHeE6vR1Ir2hmg=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
 github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM=
+github.com/googleapis/gnostic v0.5.1/go.mod h1:6U4PtQXGIEt/Z3h5MAT7FNofLnw9vXk2cUuW7uA/OeU=
 github.com/googleapis/gnostic v0.5.5/go.mod h1:7+EbHbldMins07ALC74bsA81Ovc97DwqyJO1AENw9kA=
-github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/gorilla/handlers v1.5.1 h1:9lRY6j8DEeeBT10CvO9hGW0gmky0BprnvDI5vfhUHH4=
 github.com/gorilla/handlers v1.5.1/go.mod h1:t8XrUpc4KVXb7HGyJ4/cEnwQiaxrX/hz1Zv/4g96P1Q=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
@@ -514,44 +424,27 @@ github.com/gosuri/uitable v0.0.4/go.mod h1:tKR86bXuXPZazfOTG1FIzvjIdXzd0mo4Vtn16
 github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
-github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
 github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 h1:+9834+KizmvFV7pXQGSXQTsaWhq2GjuNUt0aUU0YBYw=
 github.com/grpc-ecosystem/go-grpc-middleware v1.3.0/go.mod h1:z0ButlSOZa5vEBq9m2m2hlwIgKw+rp3sdCBRoJY+30Y=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 h1:Ovs26xHkKqVztRpIrF/92BcuyuQ/YW4NSIpoGtfXNho=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
-github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4ZsPv9hVvWI6+ch50m39Pf2Ks=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 h1:YBftPWNWd4WwGqtY2yeZL2ef8rHAxPBD8KFhJpmcqms=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9Kz84aCaG7AsGZnLjhHbUqwPg=
-github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
-github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 h1:bkypFPDjIYGfCYD5mRBvpqxfYX1YCS1PXdKYWi8FsN0=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0/go.mod h1:P+Lt/0by1T8bfcF3z737NnSbmxQAppXMRziHUxPOC8k=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
 github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
-github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
-github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
 github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
-github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU=
-github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=
-github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
-github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
 github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
-github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
-github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
 github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/hashicorp/hcl v0.0.0-20170504190234-a4b07c25de5f/go.mod h1:oZtUIOe8dh44I2q6ScRibXws4Ajl+d+nod3AaR9vL5w=
@@ -560,25 +453,17 @@ github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T
 github.com/hashicorp/hcl/v2 v2.0.0/go.mod h1:oVVDG71tEinNGYCxinCYadcmKU9bglqW9pV3txagJ90=
 github.com/hashicorp/hcl/v2 v2.18.0 h1:wYnG7Lt31t2zYkcquwgKo6MWXzRUDIeIVU5naZwHLl8=
 github.com/hashicorp/hcl/v2 v2.18.0/go.mod h1:ThLC89FV4p9MPW804KVbe/cEXoQ8NZEh+JtMeeGErHE=
-github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
-github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
-github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
-github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
 github.com/hinshun/vt10x v0.0.0-20180616224451-1954e6464174 h1:WlZsjVhE8Af9IcZDGgJGQpNflI3+MJSBhsgT5PCtzBQ=
 github.com/hinshun/vt10x v0.0.0-20180616224451-1954e6464174/go.mod h1:DqJ97dSdRW1W22yXSB90986pcOyQ7r45iio1KN2ez1A=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/huandu/xstrings v1.4.0 h1:D17IlohoQq4UcpqD7fDk80P7l+lwAmlFaBHgOipl2FU=
 github.com/huandu/xstrings v1.4.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
-github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
-github.com/imdario/mergo v0.3.6/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
 github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
 github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
@@ -595,7 +480,6 @@ github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGw
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/jmoiron/sqlx v1.3.5 h1:vFFPA71p1o5gAeqtEAwLU4dnX2napprKtHr7PYIcN3g=
 github.com/jmoiron/sqlx v1.3.5/go.mod h1:nRVWtLre0KfCLJvgxzCsLVMogSvQ1zNJtpYr2Ccp0mQ=
-github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
 github.com/jonboulle/clockwork v0.2.2 h1:UOGuzwb1PwsrDAObMuhUnj0p5ULPj8V/xJ7Kx9qUBdQ=
 github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
@@ -609,7 +493,6 @@ github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/
 github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
 github.com/karrick/godirwalk v1.16.1 h1:DynhcF+bztK8gooS0+NDJFrdNZjJ3gzVzC545UNA9iw=
@@ -618,21 +501,17 @@ github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNU
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
 github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
 github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
-github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
-github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.17.7 h1:ehO88t2UGzQK66LMdE8tibEd1ErmzZjNEqWkjLAKQQg=
-github.com/klauspost/compress v1.17.7/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
-github.com/kmodules/apiserver-runtime v1.1.2-0.20240303184316-6365e03bf9ac h1:mvMh55oSOPI2uyCuBfW5Vhr5/NqZqBJMDWvPRbhd/LY=
-github.com/kmodules/apiserver-runtime v1.1.2-0.20240303184316-6365e03bf9ac/go.mod h1:HdEqkDMCJJHr3S9E/r6ytI30AvKB4LUta4dIANUBvx8=
+github.com/klauspost/compress v1.17.10 h1:oXAz+Vh0PMUvJczoi+flxpnBEPxoER1IaAnU/NMPtT0=
+github.com/klauspost/compress v1.17.10/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
+github.com/kmodules/apiserver-runtime v1.1.2-0.20250422194347-c5ac4abaf2ae h1:dsX0Dcs0Od11vap5Yub3aukBHuZEoZ1nqFH5nVRYrN4=
+github.com/kmodules/apiserver-runtime v1.1.2-0.20250422194347-c5ac4abaf2ae/go.mod h1:zOVeivsnCWenmbgr6kiefIExoqlbuv2xyg9SXXfbs5U=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
@@ -642,10 +521,10 @@ github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/kubevela/pkg v1.9.3-0.20241203070234-2cf98778c0a9 h1:VgW3WgcQ5jZcWUvKULfnV7w8vfp86yGp6Es4NFJpiCg=
-github.com/kubevela/pkg v1.9.3-0.20241203070234-2cf98778c0a9/go.mod h1:mb14wKSzUVKsSupXEjnci2vCd8DTkN4mBYdz9wvS7Vk=
-github.com/kubevela/workflow v0.6.2 h1:zmsjQStemSSAJVACsf9c39WTIJqdn1YQlb5jltOfSwU=
-github.com/kubevela/workflow v0.6.2/go.mod h1:nJIoAw1SHthfLhJqFFKX2dwwoDy6vF2DZrBdlAJNSXU=
+github.com/kubevela/pkg v1.9.3-0.20250625225831-a2894a62a307 h1:6vebFO0h5vU/0gSol3l/9KlgZeuZzYhl3/DlDr0jI6E=
+github.com/kubevela/pkg v1.9.3-0.20250625225831-a2894a62a307/go.mod h1:P1yK32LmSs+NRjGu3Wu45VeCeKgIXiRg4qItN1MbgA8=
+github.com/kubevela/workflow v0.6.3-0.20250717221743-56b80cee4121 h1:clU2P7FyrhLm1l/xviiLO1Cen00ZI01oOfPxAOoMi0w=
+github.com/kubevela/workflow v0.6.3-0.20250717221743-56b80cee4121/go.mod h1:79KSLzfgBnJboWgxy5P/1GCc2ZUOLEYlF+vS4xQ3FNo=
 github.com/kylelemons/godebug v0.0.0-20170820004349-d65d576e9348/go.mod h1:B69LEHPfb2qLo0BaaOLcbitczOKLWTsrBG9LczfCD4k=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
@@ -660,15 +539,14 @@ github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
 github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0=
 github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE=
+github.com/lithammer/dedent v1.1.0 h1:VNzHMVCBNG1j0fh3OrsFRkVUwStdDArbgBWoPAffktY=
+github.com/lithammer/dedent v1.1.0/go.mod h1:jrXYCQtgg0nJiN+StA2KgR7w6CiQNv9Fd/Z9BP0jIOc=
 github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
 github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
-github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
-github.com/magiconair/properties v1.8.5/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
 github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
 github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
-github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/markbates/errx v1.1.0 h1:QDFeR+UP95dO12JgW+tgi2UVfo0V8YBHiUIOaeBPiEI=
@@ -677,12 +555,10 @@ github.com/markbates/oncer v1.0.0 h1:E83IaVAHygyndzPimgUYJjbshhDTALZyXxvk9FOlQRY
 github.com/markbates/oncer v1.0.0/go.mod h1:Z59JA581E9GP6w96jai+TGqafHPW+cPfRxz2aSZ0mcI=
 github.com/markbates/safe v1.0.1 h1:yjZkbvRM6IzKj9tlu/zMJLS0n/V351OZWRnF3QfaUxI=
 github.com/markbates/safe v1.0.1/go.mod h1:nAqgmRi7cY2nqMc92/bSEeQA+R4OheNU2T1kNSCBdG0=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-colorable v0.1.7/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
@@ -694,52 +570,38 @@ github.com/mattn/go-runewidth v0.0.14/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh
 github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U=
 github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
-github.com/mattn/go-sqlite3 v1.14.19 h1:fhGleo2h1p8tVChob4I9HpmVFIAkKGpiukdrgQbWfGI=
-github.com/mattn/go-sqlite3 v1.14.19/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
+github.com/mattn/go-sqlite3 v1.14.23 h1:gbShiuAP1W5j9UOksQ06aiiqPMxYecovVGwmTxWtuw0=
+github.com/mattn/go-sqlite3 v1.14.23/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
-github.com/matttproud/golang_protobuf_extensions v1.0.2/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
-github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 h1:jWpvCLoY8Z/e3VKvlsiIGKtc+UG6U5vzxaoagmhXfyg=
-github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0/go.mod h1:QUyp042oQthUoa9bqDv0ER0wrtXnBruoNd7aNjkbP+k=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b h1:j7+1HpAFS1zy5+Q4qx1fWh90gTKwiN4QCGoY9TWyyO4=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
-github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
 github.com/miekg/dns v1.1.25 h1:dFwPR6SfLtrSwgDcIq2bcU/gVutB4sNApq2HBdqcakg=
 github.com/miekg/dns v1.1.25/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
-github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
 github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/go-homedir v0.0.0-20161203194507-b8bc1bf76747/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
 github.com/mitchellh/go-wordwrap v0.0.0-20150314170334-ad45545899c7/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
 github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
 github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
 github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
-github.com/mitchellh/gox v0.4.0/go.mod h1:Sd9lOJ0+aimLBi73mGofS1ycjY8lL3uZM3JPS42BGNg=
 github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4=
 github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE=
-github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0QubkSMEySY=
-github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
-github.com/moby/spdystream v0.2.0 h1:cjW1zVyyoiM0T7b6UoySUFqzXMoqRckQtXwGPiBhOM8=
 github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
+github.com/moby/spdystream v0.4.0 h1:Vy79D6mHeJJjiPdFEL2yku1kl0chZpJfZcPpb16BRl8=
+github.com/moby/spdystream v0.4.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
 github.com/moby/sys/mountinfo v0.6.2 h1:BzJjoreD5BMFNmD9Rus6gdd1pLuecOFPt8wC+Vygl78=
 github.com/moby/sys/mountinfo v0.6.2/go.mod h1:IJb6JQeOklcdMU9F5xQ8ZALD+CUr5VlGpwtX+VE0rpI=
 github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
 github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
-github.com/moby/term v0.0.0-20210610120745-9d4ed1856297/go.mod h1:vgPCkQMyxTZ7IDy8SXRufE172gr8+K/JE/7hHFxHW3A=
-github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6/go.mod h1:E2VnQOmVuvZB6UYnnDB0qG5Nq/1tD9acaOpo6xmt0Kw=
-github.com/moby/term v0.0.0-20220808134915-39b0c02b01ae/go.mod h1:E2VnQOmVuvZB6UYnnDB0qG5Nq/1tD9acaOpo6xmt0Kw=
 github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
 github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -767,50 +629,35 @@ github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLA
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
-github.com/oam-dev/cluster-gateway v1.9.1-0.20241120140625-33c8891b781c h1:0j1V4CHd6ug4Gr6v30oJJqoYVNBcYcTrGsiD7fMzqc8=
-github.com/oam-dev/cluster-gateway v1.9.1-0.20241120140625-33c8891b781c/go.mod h1:hbwv6J0oV1ZP2NL7ITGG7Ga/AyyW/X0y9EaLy82Rhsc=
-github.com/oam-dev/cluster-register v1.0.4-0.20230424040021-147f7c1fefe5 h1:LJbb+5T9SyykRbni1jwcj9DvqhP60m5OexrF0vzzRcg=
-github.com/oam-dev/cluster-register v1.0.4-0.20230424040021-147f7c1fefe5/go.mod h1:Xc5oAAnLOjH7xYSQL0AGHPobFiShL7EYhV/4j9rrwXg=
+github.com/oam-dev/cluster-gateway v1.9.2-0.20250629203450-2b04dd452b7a h1:DRcSDrLv1en8j5ESR+LR0feGLuyT9M15HJgiMn3sFZs=
+github.com/oam-dev/cluster-gateway v1.9.2-0.20250629203450-2b04dd452b7a/go.mod h1:ZIYRoiy4He22db8XiWTAh7QecIt5QWiQNacCZg1zbbY=
+github.com/oam-dev/cluster-register v1.0.4-0.20250624042630-618dfa13eb5b h1:9oAzdnBC9rEcwLDpkReoWpZPwqbIC0rqIejFCFkE3Gk=
+github.com/oam-dev/cluster-register v1.0.4-0.20250624042630-618dfa13eb5b/go.mod h1:grVoZB9AM44ssnJH8e+5mUQhp71ku32gKWULkWNGq7g=
 github.com/oam-dev/stern v1.13.2 h1:jlGgtJbKmIVhzkH44ft5plkgs8XEfvxbFrQdX60CQR4=
 github.com/oam-dev/stern v1.13.2/go.mod h1:0pLjZt0amXE/ErF16Rdrgd98H2owN8Hmn3/7CX5+AeA=
 github.com/oam-dev/terraform-config-inspect v0.0.0-20210418082552-fc72d929aa28 h1:tD8HiFKnt0jnwdTWjeqUnfnUYLD/+Nsmj8ZGIxqDWiU=
 github.com/oam-dev/terraform-config-inspect v0.0.0-20210418082552-fc72d929aa28/go.mod h1:Mu8i0/DdplvnjwRbAYPsc8+LRR27n/mp8VWdkN10GzE=
-github.com/oam-dev/terraform-controller v0.8.0 h1:/881bAELCsceSj+Zh3Nsu8Ym5N7D5Ho0HsWzO+TDc1w=
-github.com/oam-dev/terraform-controller v0.8.0/go.mod h1:ydc9iHjgLzwuWB+MlE2vRA8gOZsif0T4E2FL34K8CZ4=
+github.com/oam-dev/terraform-controller v0.8.1-0.20250707044258-c0557127de25 h1:J5byd7UtaHZWDMcFA1VoMos+kbEpe3LcitWVmpcJmdI=
+github.com/oam-dev/terraform-controller v0.8.1-0.20250707044258-c0557127de25/go.mod h1:+QfZ/EBzdrGZcxGIt/I9OTDwq4kH/+aCD6Mh0yrrGr8=
 github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 h1:G7ERwszslrBzRxj//JalHPu/3yz+De2J+4aLtSRlHiY=
 github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037/go.mod h1:2bpvgLBZEtENV5scfDFEtB/5+1M4hkQhDQrccEJ/qGw=
 github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 h1:bQx3WeLcUWy+RletIKwUIt4x3t8n2SxavmoclizMb8c=
 github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o=
-github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
+github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
 github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
-github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
 github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
-github.com/onsi/ginkgo/v2 v2.1.3/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
-github.com/onsi/ginkgo/v2 v2.1.4/go.mod h1:um6tUpWM/cxCK3/FK8BXqEiUMUwRgSM4JXG47RKZmLU=
-github.com/onsi/ginkgo/v2 v2.1.6/go.mod h1:MEH45j8TBi6u9BMogfbp0stKC5cdGjumZj5Y7AG4VIk=
-github.com/onsi/ginkgo/v2 v2.3.0/go.mod h1:Eew0uilEqZmIEZr8JrvYlvOM7Rr6xzTmMV8AyFNU9d0=
-github.com/onsi/ginkgo/v2 v2.4.0/go.mod h1:iHkDK1fKGcBoEHT5W7YBq4RFWaQulw+caOMkAt4OrFo=
-github.com/onsi/ginkgo/v2 v2.5.0/go.mod h1:Luc4sArBICYCS8THh8v3i3i5CuSZO+RaQRaJoeNwomw=
-github.com/onsi/ginkgo/v2 v2.6.0/go.mod h1:63DOGlLAH8+REH8jUGdL3YpCpu7JODesutUjdENfUAc=
-github.com/onsi/ginkgo/v2 v2.19.0 h1:9Cnnf7UHo57Hy3k6/m5k3dRfGTMXGvxhHFvkDTCTpvA=
-github.com/onsi/ginkgo/v2 v2.19.0/go.mod h1:rlwLi9PilAFJ8jCg9UE1QP6VBpd6/xj3SRC0d6TU0To=
+github.com/onsi/ginkgo/v2 v2.23.3 h1:edHxnszytJ4lD9D5Jjc4tiDkPBZ3siDeJJkUZJJVkp0=
+github.com/onsi/ginkgo/v2 v2.23.3/go.mod h1:zXTP6xIp3U8aVuXN8ENK9IXRaTjFnpVB9mGmaSRvxnM=
+github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
-github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
-github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro=
-github.com/onsi/gomega v1.20.1/go.mod h1:DtrZpjmvpn2mPm4YWQa0/ALMDj9v4YxLgojwPeREyVo=
-github.com/onsi/gomega v1.21.1/go.mod h1:iYAIXgPSaDHak0LCMA+AWBpIKBr8WZicMxnE8luStNc=
-github.com/onsi/gomega v1.22.1/go.mod h1:x6n7VNe4hw0vkyYUM4mjIXx3JbLiPaBPNgB7PRQ1tuM=
-github.com/onsi/gomega v1.23.0/go.mod h1:Z/NWtiqwBrwUt4/2loMmHL63EDLnYHmVbuBpDr2vQAg=
-github.com/onsi/gomega v1.24.0/go.mod h1:Z/NWtiqwBrwUt4/2loMmHL63EDLnYHmVbuBpDr2vQAg=
-github.com/onsi/gomega v1.24.1/go.mod h1:3AOiACssS3/MajrniINInwbfOOtfZvplPzuRSmvt1jM=
-github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
-github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
+github.com/onsi/gomega v1.36.2 h1:koNYke6TVk6ZmnyHrCXba/T/MoLBXFjeC1PtvYgw0A8=
+github.com/onsi/gomega v1.36.2/go.mod h1:DdwyADRjrc825LhMEkD76cHR5+pUnjhUN8GlHlRPHzY=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
@@ -819,13 +666,8 @@ github.com/openkruise/kruise-api v1.4.0 h1:MDDXQIYvaCh0ioIJSRniF4kCKby9JI3/ec6pZ
 github.com/openkruise/kruise-api v1.4.0/go.mod h1:HyRlDV0MfW5Zm+3g36bx7u4CcWHcKBxL8g/c/2bjcd4=
 github.com/openkruise/rollouts v0.3.0 h1:T02r9BxHJ02MRkbc7C4F12qMGgrziZVjgmukwz6k60s=
 github.com/openkruise/rollouts v0.3.0/go.mod h1:rZvWA05fLEqfVQYLwqtSNzAbCZSzYiftKuga5yBWYM8=
-github.com/openshift/build-machinery-go v0.0.0-20211213093930-7e33a7eb4ce3/go.mod h1:b1BuldmJlbA/xYtdZvKi+7j5YGB44qJUJDZ9zwiNCfE=
 github.com/openshift/library-go v0.0.0-20230327085348-8477ec72b725 h1:GC0oekPo2BDqK+2Mv6W/VuvkaUUMFcmqp0AZDN2vWrA=
 github.com/openshift/library-go v0.0.0-20230327085348-8477ec72b725/go.mod h1:OspkL5FZZapzNcka6UkNMFD7ifLT/dWUNvtwErpRK9k=
-github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
-github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
-github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
-github.com/pelletier/go-toml v1.9.3/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/pelletier/go-toml v1.9.4/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
@@ -841,57 +683,42 @@ github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/poy/onpar v1.1.2 h1:QaNrNiZx0+Nar5dLgTVp5mXkyoVFIbepjyEoGSnhbAY=
 github.com/poy/onpar v1.1.2/go.mod h1:6X8FLNoxyr9kkmnlqpK6LSoiOtrO6MICtWwEuWkLjzg=
-github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021/go.mod h1:prYjPmNq4d1NPVmpShWobRqXY3q7Vp+80DqgxxUrUIA=
-github.com/pquerna/cachecontrol v0.1.0/go.mod h1:NrUG3Z7Rdu85UNR3vm7SOsl1nFIeSiQnrHV5K9mBcUI=
 github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
 github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
-github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
 github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
-github.com/prometheus/client_golang v1.11.1/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
-github.com/prometheus/client_golang v1.12.1/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
 github.com/prometheus/client_golang v1.12.2/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
-github.com/prometheus/client_golang v1.14.0/go.mod h1:8vpkKitgIVNcqrRBWh1C4TIUQgYNtG/XQE4E/Zae36Y=
-github.com/prometheus/client_golang v1.18.0 h1:HzFfmkOzH5Q8L8G+kSJKUx5dtG87sewO+FoDDqP5Tbk=
-github.com/prometheus/client_golang v1.18.0/go.mod h1:T+GXkCk5wSJyOqMIzVgvvjFDlkOQntgjkJWKrN5txjA=
+github.com/prometheus/client_golang v1.20.5 h1:cxppBPuYhUnsO6yo/aoRol4L7q7UFfdm+bR9r+8l63Y=
+github.com/prometheus/client_golang v1.20.5/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.3.0/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w=
-github.com/prometheus/client_model v0.5.0 h1:VQw1hfvPvk3Uv6Qf29VrPF32JB6rtbgI6cYPYQjL0Qw=
-github.com/prometheus/client_model v0.5.0/go.mod h1:dTiFglRmd66nLR9Pv9f0mZi7B7fk5Pm3gvsjB5tr+kI=
-github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
-github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
+github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
 github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
-github.com/prometheus/common v0.28.0/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
 github.com/prometheus/common v0.32.1/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
-github.com/prometheus/common v0.37.0/go.mod h1:phzohg0JFMnBEFGxTDbfu3QyL5GI8gTQJFhYO5B3mfA=
-github.com/prometheus/common v0.45.0 h1:2BGz0eBc2hdMDLnO/8n0jeB3oPrt2D08CekT0lneoxM=
-github.com/prometheus/common v0.45.0/go.mod h1:YJmSTw9BoKxJplESWWxlbyttQR4uaEcGyv9MZjVOJsY=
+github.com/prometheus/common v0.55.0 h1:KEi6DK7lXW/m7Ig5i47x0vRzuBsHuvJdi5ee6Y3G1dc=
+github.com/prometheus/common v0.55.0/go.mod h1:2SECS4xJG1kd8XF9IcM1gMX6510RAEL65zxzNImwdc8=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
-github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
 github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
 github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/prometheus/procfs v0.8.0/go.mod h1:z7EfXMXOkbkqb9IINtpCn86r/to3BnA0uaxHdg830/4=
-github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
-github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
-github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
+github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
+github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
 github.com/protocolbuffers/txtpbfmt v0.0.0-20230328191034-3462fbc510c0 h1:sadMIsgmHpEOGbUs6VtHBXRR1OHevnj7hLx9ZcdNGW4=
 github.com/protocolbuffers/txtpbfmt v0.0.0-20230328191034-3462fbc510c0/go.mod h1:jgxiZysxFPM+iWKwQwPR+y+Jvo54ARd4EisXxKYpB5c=
 github.com/rivo/tview v0.0.0-20221128165837-db36428c92d9 h1:ccTgRxA37ypj3q8zB8G4k3xGPfBbIaMwrf3Yw6k50NY=
@@ -901,61 +728,43 @@ github.com/rivo/uniseg v0.4.3 h1:utMvzDsuh3suAEnhH0RdHmoPbU648o6CvXxTx4SBMOw=
 github.com/rivo/uniseg v0.4.3/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
 github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
-github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/rubenv/sql-migrate v1.5.2 h1:bMDqOnrJVV/6JQgQ/MxOpU+AdO8uzYYA/TxFUBzFtS0=
 github.com/rubenv/sql-migrate v1.5.2/go.mod h1:H38GW8Vqf8F0Su5XignRyaRcbXbJunSWxs+kmzlg0Is=
-github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
 github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8=
 github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
-github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
 github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
-github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
-github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
-github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
 github.com/soheilhy/cmux v0.1.5 h1:jjzc5WVemNEDTLwv9tlmemhC73tI08BNOIGwBOo10Js=
 github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
-github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
 github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
-github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
-github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
 github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU=
 github.com/spf13/cobra v0.0.0-20180629152535-a114f312e075/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
-github.com/spf13/cobra v1.1.3/go.mod h1:pGADOWyqRD/YMrPZigI/zbliZ2wVD/23d+is3pSWzOo=
-github.com/spf13/cobra v1.2.1/go.mod h1:ExllRjgxM/piMAM+3tAZvg8fsklGAf3tPfi+i8t68Nk=
 github.com/spf13/cobra v1.4.0/go.mod h1:Wo4iy3BUC+X2Fybo0PDqwJIv3dNRiZLHQymsfxlB84g=
-github.com/spf13/cobra v1.6.0/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUqzrY=
-github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
-github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
-github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
-github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
+github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
+github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
+github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.2/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.7.0/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5qpdg=
-github.com/spf13/viper v1.8.1/go.mod h1:o0Pch8wJ9BVSWGQMbra6iw0oQ5oktSIBaujf1rJH9Ns=
 github.com/stoewer/go-strcase v1.2.0 h1:Z2iHWqGXH00XYgqDmNgQbIBxf3wrNq0F3feEy0ainaU=
 github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -976,15 +785,12 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/tidwall/gjson v1.14.4 h1:uo0p8EbA09J7RQaflQ1aBRffTR7xedD2bcIVSYxLnkM=
 github.com/tidwall/gjson v1.14.4/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
 github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
 github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
 github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
-github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
-github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75 h1:6fotK7otjonDflCTK0BCfls4SPy3NcCVb5dqqmbRknE=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75/go.mod h1:KO6IkyS8Y3j8OdNO85qEYBsRPuteD+YciPomcXdrMnk=
 github.com/ugorji/go/codec v1.2.7 h1:YPXUKf7fYbp/y8xloBqZOw2qaVggbfwMlI8WM3wZUJ0=
@@ -992,6 +798,8 @@ github.com/ugorji/go/codec v1.2.7/go.mod h1:WGN1fab3R1fzQlVQTkfxVtIBhWDRqOviHU95
 github.com/vbatts/tar-split v0.11.5 h1:3bHCTIheBm1qFTcgh9oPu+nNBtX+XJIupG/vacinCts=
 github.com/vbatts/tar-split v0.11.5/go.mod h1:yZbwRsSeGjusneWgA781EKej9HF8vme8okylkAeNKLk=
 github.com/vmihailenco/msgpack v3.3.3+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
 github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
@@ -1008,8 +816,6 @@ github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/yuin/goldmark v1.4.0/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43 h1:+lm10QQTNSBd8DVTNGHx7o/IKu9HYDvLMffDhbyLccI=
 github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43/go.mod h1:aX5oPXxHm3bOH+xeAttToC8pqch2ScQN/JoXYupl6xs=
@@ -1022,310 +828,185 @@ github.com/zclconf/go-cty v1.13.0 h1:It5dfKTTZHe9aeppbNOda3mN7Ag7sg6QkBNm6TkyFa0
 github.com/zclconf/go-cty v1.13.0/go.mod h1:YKQzy/7pZ7iq2jNFzy5go57xdxdWoLLpaEp4u238AE0=
 gitlab.com/gitlab-org/api/client-go v0.127.0 h1:8xnxcNKGF2gDazEoMs+hOZfOspSSw8D0vAoWhQk9U+U=
 gitlab.com/gitlab-org/api/client-go v0.127.0/go.mod h1:bYC6fPORKSmtuPRyD9Z2rtbAjE7UeNatu2VWHRf4/LE=
-go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
-go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4=
-go.etcd.io/bbolt v1.3.10 h1:+BqfJTcCzTItrop8mq/lbzL8wSGtj94UO/3U31shqG0=
-go.etcd.io/bbolt v1.3.10/go.mod h1:bK3UQLPJZly7IlNmV7uVHJDxfe5aK9Ll93e/74Y9oEQ=
-go.etcd.io/etcd/api/v3 v3.5.0/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
-go.etcd.io/etcd/api/v3 v3.5.5/go.mod h1:KFtNaxGDw4Yx/BA4iPPwevUTAuqcsPxzyX8PHydchN8=
-go.etcd.io/etcd/api/v3 v3.5.10 h1:szRajuUUbLyppkhs9K6BRtjY37l66XQQmw7oZRANE4k=
-go.etcd.io/etcd/api/v3 v3.5.10/go.mod h1:TidfmT4Uycad3NM/o25fG3J07odo4GBB9hoxaodFCtI=
-go.etcd.io/etcd/client/pkg/v3 v3.5.0/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
-go.etcd.io/etcd/client/pkg/v3 v3.5.5/go.mod h1:ggrwbk069qxpKPq8/FKkQ3Xq9y39kbFR4LnKszpRXeQ=
-go.etcd.io/etcd/client/pkg/v3 v3.5.10 h1:kfYIdQftBnbAq8pUWFXfpuuxFSKzlmM5cSn76JByiT0=
-go.etcd.io/etcd/client/pkg/v3 v3.5.10/go.mod h1:DYivfIviIuQ8+/lCq4vcxuseg2P2XbHygkKwFo9fc8U=
-go.etcd.io/etcd/client/v2 v2.305.0/go.mod h1:h9puh54ZTgAKtEbut2oe9P4L/oqKCVB6xsXlzd7alYQ=
-go.etcd.io/etcd/client/v2 v2.305.5/go.mod h1:zQjKllfqfBVyVStbt4FaosoX2iYd8fV/GRy/PbowgP4=
-go.etcd.io/etcd/client/v2 v2.305.10 h1:MrmRktzv/XF8CvtQt+P6wLUlURaNpSDJHFZhe//2QE4=
-go.etcd.io/etcd/client/v2 v2.305.10/go.mod h1:m3CKZi69HzilhVqtPDcjhSGp+kA1OmbNn0qamH80xjA=
-go.etcd.io/etcd/client/v3 v3.5.0/go.mod h1:AIKXXVX/DQXtfTEqBryiLTUXwON+GuvO6Z7lLS/oTh0=
-go.etcd.io/etcd/client/v3 v3.5.5/go.mod h1:aApjR4WGlSumpnJ2kloS75h6aHUmAyaPLjHMxpc7E7c=
-go.etcd.io/etcd/client/v3 v3.5.10 h1:W9TXNZ+oB3MCd/8UjxHTWK5J9Nquw9fQBLJd5ne5/Ao=
-go.etcd.io/etcd/client/v3 v3.5.10/go.mod h1:RVeBnDz2PUEZqTpgqwAtUd8nAPf5kjyFyND7P1VkOKc=
-go.etcd.io/etcd/pkg/v3 v3.5.0/go.mod h1:UzJGatBQ1lXChBkQF0AuAtkRQMYnHubxAEYIrC3MSsE=
-go.etcd.io/etcd/pkg/v3 v3.5.5/go.mod h1:6ksYFxttiUGzC2uxyqiyOEvhAiD0tuIqSZkX3TyPdaE=
-go.etcd.io/etcd/pkg/v3 v3.5.10 h1:WPR8K0e9kWl1gAhB5A7gEa5ZBTNkT9NdNWrR8Qpo1CM=
-go.etcd.io/etcd/pkg/v3 v3.5.10/go.mod h1:TKTuCKKcF1zxmfKWDkfz5qqYaE3JncKKZPFf8c1nFUs=
-go.etcd.io/etcd/raft/v3 v3.5.0/go.mod h1:UFOHSIvO/nKwd4lhkwabrTD3cqW5yVyYYf/KlD00Szc=
-go.etcd.io/etcd/raft/v3 v3.5.5/go.mod h1:76TA48q03g1y1VpTue92jZLr9lIHKUNcYdZOOGyx8rI=
-go.etcd.io/etcd/raft/v3 v3.5.10 h1:cgNAYe7xrsrn/5kXMSaH8kM/Ky8mAdMqGOxyYwpP0LA=
-go.etcd.io/etcd/raft/v3 v3.5.10/go.mod h1:odD6kr8XQXTy9oQnyMPBOr0TVe+gT0neQhElQ6jbGRc=
-go.etcd.io/etcd/server/v3 v3.5.0/go.mod h1:3Ah5ruV+M+7RZr0+Y/5mNLwC+eQlni+mQmOVdCRJoS4=
-go.etcd.io/etcd/server/v3 v3.5.5/go.mod h1:rZ95vDw/jrvsbj9XpTqPrTAB9/kzchVdhRirySPkUBc=
-go.etcd.io/etcd/server/v3 v3.5.10 h1:4NOGyOwD5sUZ22PiWYKmfxqoeh72z6EhYjNosKGLmZg=
-go.etcd.io/etcd/server/v3 v3.5.10/go.mod h1:gBplPHfs6YI0L+RpGkTQO7buDbHv5HJGG/Bst0/zIPo=
-go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
+go.etcd.io/bbolt v1.3.11 h1:yGEzV1wPz2yVCLsD8ZAiGHhHVlczyC9d1rP43/VCRJ0=
+go.etcd.io/bbolt v1.3.11/go.mod h1:dksAq7YMXoljX0xu6VF5DMZGbhYYoLUalEiSySYAS4I=
+go.etcd.io/etcd/api/v3 v3.5.16 h1:WvmyJVbjWqK4R1E+B12RRHz3bRGy9XVfh++MgbN+6n0=
+go.etcd.io/etcd/api/v3 v3.5.16/go.mod h1:1P4SlIP/VwkDmGo3OlOD7faPeP8KDIFhqvciH5EfN28=
+go.etcd.io/etcd/client/pkg/v3 v3.5.16 h1:ZgY48uH6UvB+/7R9Yf4x574uCO3jIx0TRDyetSfId3Q=
+go.etcd.io/etcd/client/pkg/v3 v3.5.16/go.mod h1:V8acl8pcEK0Y2g19YlOV9m9ssUe6MgiDSobSoaBAM0E=
+go.etcd.io/etcd/client/v2 v2.305.16 h1:kQrn9o5czVNaukf2A2At43cE9ZtWauOtf9vRZuiKXow=
+go.etcd.io/etcd/client/v2 v2.305.16/go.mod h1:h9YxWCzcdvZENbfzBTFCnoNumr2ax3F19sKMqHFmXHE=
+go.etcd.io/etcd/client/v3 v3.5.16 h1:sSmVYOAHeC9doqi0gv7v86oY/BTld0SEFGaxsU9eRhE=
+go.etcd.io/etcd/client/v3 v3.5.16/go.mod h1:X+rExSGkyqxvu276cr2OwPLBaeqFu1cIl4vmRjAD/50=
+go.etcd.io/etcd/pkg/v3 v3.5.16 h1:cnavs5WSPWeK4TYwPYfmcr3Joz9BH+TZ6qoUtz6/+mc=
+go.etcd.io/etcd/pkg/v3 v3.5.16/go.mod h1:+lutCZHG5MBBFI/U4eYT5yL7sJfnexsoM20Y0t2uNuY=
+go.etcd.io/etcd/raft/v3 v3.5.16 h1:zBXA3ZUpYs1AwiLGPafYAKKl/CORn/uaxYDwlNwndAk=
+go.etcd.io/etcd/raft/v3 v3.5.16/go.mod h1:P4UP14AxofMJ/54boWilabqqWoW9eLodl6I5GdGzazI=
+go.etcd.io/etcd/server/v3 v3.5.16 h1:d0/SAdJ3vVsZvF8IFVb1k8zqMZ+heGcNfft71ul9GWE=
+go.etcd.io/etcd/server/v3 v3.5.16/go.mod h1:ynhyZZpdDp1Gq49jkUg5mfkDWZwXnn3eIqCqtJnrD/s=
 go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/contrib v0.20.0/go.mod h1:G/EtFaa6qaN7+LxqfIAT3GiZa7Wv5DTBUzl5H4LY0Kc=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.20.0/go.mod h1:oVGt1LRbBOBq1A5BQLlUg9UaU/54aiHw8cgjV3aWZ/E=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.25.0/go.mod h1:E5NNboN0UqSAki0Atn9kVwaN7I+l25gGxDqBueo/74E=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.35.0/go.mod h1:h8TWwRAhQpOd0aM5nYsRD8+flnkj+526GEIVlarH7eY=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.1 h1:SpGay3w+nEwMpfVnbqOLH5gY52/foP8RE8UzTZ1pdSE=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.1/go.mod h1:4UoMYEZOC0yN/sPGH76KPkkU7zgiEWYWL9vwmbnTJPE=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.20.0/go.mod h1:2AboqHi0CiIZU0qwhtUfCYD1GeUzvvIXWNkhDt7ZMG4=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.35.0/go.mod h1:9NiG9I2aHTKkcxqCILhjtyNA1QEiCjdBACv4IvrFQ+c=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0 h1:x8Z78aZx8cOF0+Kkazoc7lwUNMGy0LrzEMxTm4BbTxg=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0/go.mod h1:62CPTSry9QZtOaSsE3tOzhx6LzDhHnXJ6xHeMNNiM6Q=
-go.opentelemetry.io/otel v0.20.0/go.mod h1:Y3ugLH2oa81t5QO+Lty+zXf8zC9L26ax4Nzoxm/dooo=
-go.opentelemetry.io/otel v1.0.1/go.mod h1:OPEOD4jIT2SlZPMmwT6FqZz2C0ZNdQqiWcoK6M0SNFU=
-go.opentelemetry.io/otel v1.8.0/go.mod h1:2pkj+iMj0o03Y+cW6/m8Y4WkRdYN3AvCXCnzRMp9yvM=
-go.opentelemetry.io/otel v1.10.0/go.mod h1:NbvWjCthWHKBEUMpf0/v8ZRZlni86PpGFEMA9pnQSnQ=
-go.opentelemetry.io/otel v1.21.0 h1:hzLeKBZEL7Okw2mGzZ0cc4k/A7Fta0uoPgaJCr8fsFc=
-go.opentelemetry.io/otel v1.21.0/go.mod h1:QZzNPQPm1zLX4gZK4cMi+71eaorMSGT3A4znnUvNNEo=
-go.opentelemetry.io/otel/exporters/otlp v0.20.0/go.mod h1:YIieizyaN77rtLJra0buKiNBOm9XQfkPEKBeuhoMwAM=
-go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.10.0/go.mod h1:78XhIg8Ht9vR4tbLNUhXsiOnE2HOuSeKAiAcoVQEpOY=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.0.1/go.mod h1:Kv8liBeVNFkkkbilbgWRpV+wWuu+H5xdOT6HAgd30iw=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.10.0/go.mod h1:Krqnjl22jUJ0HgMzw5eveuCvFDXY4nSYb4F8t5gdrag=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0 h1:Mne5On7VWdx7omSrSSZvM4Kw7cS7NQkOOmLcgscI51U=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0/go.mod h1:IPtUMKL4O3tH5y+iXVyAXqpAwMuzC1IrxVS81rummfE=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.0.1/go.mod h1:xOvWoTOrQjxjW61xtOmD/WKGRYb/P4NzRo3bs65U6Rk=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.10.0/go.mod h1:OfUCyyIiDvNXHWpcWgbF+MWvqPZiNa3YDEnivcnYsV0=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0 h1:3d+S281UTjM+AbF31XSOYn1qXn3BgIdWl8HNEpx08Jk=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0/go.mod h1:0+KuTDyKL4gjKCF75pHOX4wuzYDUZYfAQdSu43o+Z2I=
-go.opentelemetry.io/otel/metric v0.20.0/go.mod h1:598I5tYlH1vzBjn+BTuhzTCSb/9debfNp6R3s7Pr1eU=
-go.opentelemetry.io/otel/metric v0.31.0/go.mod h1:ohmwj9KTSIeBnDBm/ZwH2PSZxZzoOaG2xZeekTRzL5A=
-go.opentelemetry.io/otel/metric v1.21.0 h1:tlYWfeo+Bocx5kLEloTjbcDwBuELRrIFxwdQ36PlJu4=
-go.opentelemetry.io/otel/metric v1.21.0/go.mod h1:o1p3CA8nNHW8j5yuQLdc1eeqEaPfzug24uvsyIEJRWM=
-go.opentelemetry.io/otel/oteltest v0.20.0/go.mod h1:L7bgKf9ZB7qCwT9Up7i9/pn0PWIa9FqQ2IQ8LoxiGnw=
-go.opentelemetry.io/otel/sdk v0.20.0/go.mod h1:g/IcepuwNsoiX5Byy2nNV0ySUF1em498m7hBWC279Yc=
-go.opentelemetry.io/otel/sdk v1.0.1/go.mod h1:HrdXne+BiwsOHYYkBE5ysIcv2bvdZstxzmCQhxTcZkI=
-go.opentelemetry.io/otel/sdk v1.10.0/go.mod h1:vO06iKzD5baltJz1zarxMCNHFpUlUiOy4s65ECtn6kE=
-go.opentelemetry.io/otel/sdk v1.21.0 h1:FTt8qirL1EysG6sTQRZ5TokkU8d0ugCj8htOgThZXQ8=
-go.opentelemetry.io/otel/sdk v1.21.0/go.mod h1:Nna6Yv7PWTdgJHVRD9hIYywQBRx7pbox6nwBnZIxl/E=
-go.opentelemetry.io/otel/sdk/export/metric v0.20.0/go.mod h1:h7RBNMsDJ5pmI1zExLi+bJK+Dr8NQCh0qGhm1KDnNlE=
-go.opentelemetry.io/otel/sdk/metric v0.20.0/go.mod h1:knxiS8Xd4E/N+ZqKmUPf3gTTZ4/0TjTXukfxjzSTpHE=
-go.opentelemetry.io/otel/trace v0.20.0/go.mod h1:6GjCW8zgDjwGHGa6GkyeB8+/5vjT16gUEi0Nf1iBdgw=
-go.opentelemetry.io/otel/trace v1.0.1/go.mod h1:5g4i4fKLaX2BQpSBsxw8YYcgKpMMSW3x7ZTuYBr3sUk=
-go.opentelemetry.io/otel/trace v1.8.0/go.mod h1:0Bt3PXY8w+3pheS3hQUt+wow8b1ojPaTBoTCh2zIFI4=
-go.opentelemetry.io/otel/trace v1.10.0/go.mod h1:Sij3YYczqAdz+EhmGhE6TpTxUO5/F/AzrK+kxfGqySM=
-go.opentelemetry.io/otel/trace v1.21.0 h1:WD9i5gzvoUPuXIXH24ZNBudiarZDKuekPqi/E8fpfLc=
-go.opentelemetry.io/otel/trace v1.21.0/go.mod h1:LGbsEB0f9LGjN+OZaQQ26sohbOmiMR+BaslueVtS/qQ=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.53.0 h1:9G6E0TXzGFVfTnawRzrPl83iHOAV7L8NJiR8RSGYV1g=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.53.0/go.mod h1:azvtTADFQJA8mX80jIH/akaE7h+dbm/sVuaHqN13w74=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 h1:4K4tsIXefpVJtvA/8srF4V4y0akAoPHkIslgAkjixJA=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0/go.mod h1:jjdQuTGVsXV4vSs+CJ2qYDeDPf9yIJV23qlIzBm73Vg=
+go.opentelemetry.io/otel v1.28.0 h1:/SqNcYk+idO0CxKEUOtKQClMK/MimZihKYMruSMViUo=
+go.opentelemetry.io/otel v1.28.0/go.mod h1:q68ijF8Fc8CnMHKyzqL6akLO46ePnjkgfIMIjUIX9z4=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 h1:3Q/xZUyC1BBkualc9ROb4G8qkH90LXEIICcs5zv1OYY=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0/go.mod h1:s75jGIWA9OfCMzF0xr+ZgfrB5FEbbV7UuYo32ahUiFI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.28.0 h1:R3X6ZXmNPRR8ul6i3WgFURCHzaXjHdm0karRG/+dj3s=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.28.0/go.mod h1:QWFXnDavXWwMx2EEcZsf3yxgEKAqsxQ+Syjp+seyInw=
+go.opentelemetry.io/otel/metric v1.28.0 h1:f0HGvSl1KRAU1DLgLGFjrwVyismPlnuU6JD6bOeuA5Q=
+go.opentelemetry.io/otel/metric v1.28.0/go.mod h1:Fb1eVBFZmLVTMb6PPohq3TO9IIhUisDsbJoL/+uQW4s=
+go.opentelemetry.io/otel/sdk v1.28.0 h1:b9d7hIry8yZsgtbmM0DKyPWMMUMlK9NEKuIG4aBqWyE=
+go.opentelemetry.io/otel/sdk v1.28.0/go.mod h1:oYj7ClPUA7Iw3m+r7GeEjz0qckQRJK2B8zjcZEfu7Pg=
+go.opentelemetry.io/otel/trace v1.28.0 h1:GhQ9cUuQGmNDd5BTCP2dAvv75RdMxEfTmYejp+lkx9g=
+go.opentelemetry.io/otel/trace v1.28.0/go.mod h1:jPyXzNPg6da9+38HEwElrQiHlVMTnVfM3/yv2OlIHaI=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v0.9.0/go.mod h1:1vKfU9rv61e9EVGthD1zNvUbiwPcimSsOPU9brfSHJg=
-go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
-go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
-go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
+go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
+go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
 go.starlark.net v0.0.0-20240329153429-e6e8e7ce1b7a h1:Oe+v9w90BBIxQZ4U39+axR8KxrBbxqnRudPPcBIlP3o=
 go.starlark.net v0.0.0-20240329153429-e6e8e7ce1b7a/go.mod h1:YKMCv9b1WrfWmeqdV5MAuEHWsu5iC+fe6kYl2sQjdI8=
-go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/automaxprocs v1.5.3 h1:kWazyxZUrS3Gs4qUpbwo5kEIMGe/DAvi5Z4tl2NW4j8=
 go.uber.org/automaxprocs v1.5.3/go.mod h1:eRbA25aqJrxAbsLO0xy5jVwPt7FQnRgjW+efnwa1WM0=
-go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
-go.uber.org/goleak v1.1.11-0.20210813005559-691160354723/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
 go.uber.org/goleak v1.1.11/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
-go.uber.org/goleak v1.1.12/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
-go.uber.org/goleak v1.2.0/go.mod h1:XJYK+MuIchqpmGmUSAzotztawfKvYLUIgg7guXrwVUo=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
 go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
-go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
-go.uber.org/zap v1.19.0/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
-go.uber.org/zap v1.19.1/go.mod h1:j3DNczoxDZroyBnOT1L/Q79cfUMGZxlv/9dzN7SM1rI=
 go.uber.org/zap v1.21.0/go.mod h1:wjWOCqI0f2ZZrJF/UufIOkiC8ii6tm1iqIsLo76RfJw=
-go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg=
 go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
 go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190426145343-a29dc8fdc734/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190530122614-20be4c3c3ed5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
-golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20220214200702-86341886e292/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220411220226-7b82a4e95df4/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
 golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
-golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
-golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
-golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.6.0/go.mod h1:4mET923SAdbXp2ki8ey+zGs1SLqsuM2Y0uvdZR/fUNI=
-golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.21.0 h1:vvrHzRwRfVKSiLrG+d4FMl/Qi4ukBCE6kZlTUkDYRT0=
-golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
+golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180811021610-c39426892332/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181201002055-351d144fa1fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201202161906-c7110b5ffcbb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
 golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210520170846-37e1c6afe023/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210825183410-e898025ed96a/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
-golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
-golang.org/x/net v0.3.1-0.20221206200815-1e63c2f08a10/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
 golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20210402161424-2e8d93401602/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
-golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
 golang.org/x/oauth2 v0.29.0 h1:WdYw2tdTK1S8olAzWHdgeqfy+Mtm9XNhv/xJsY65d98=
 golang.org/x/oauth2 v0.29.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
 golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
-golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190502175342-a43fa875dd82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190530182044-ad28b68e88f1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190801041406-cbf593c0f2f3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200519105757-fe76b779f299/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200831180312-196b9ba8737a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200923182605-d9f96fdee20d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210831042530-f4d43177bf5e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211029165221-6e7872819dc8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211210111614-af8b64212486/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220422013727-9388b58f7150/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1335,11 +1016,8 @@ golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
-golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
@@ -1352,126 +1030,75 @@ golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
 golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
-golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20220210224613-90d013bbcef8/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.10.0 h1:3usCWA8tQn0L8+hFJQNgzpWbd89begxN66o1Ojdn5L4=
 golang.org/x/time v0.10.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
-golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190624222133-a101b041ded4/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191112195655-aa38f8e97acc/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200505023115-26f46d2f7ef8/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.6-0.20210820212750-d4cc65f0b2ff/go.mod h1:YD9qOF0M9xpSpdWTBbzEl5e/RnCefISl8E5Noe10jFM=
-golang.org/x/tools v0.1.10-0.20220218145154-897bd77cd717/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
-golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.2.0/go.mod h1:y4OqIKeOV/fWJetJ8bXPU1sEVniLMIyDAZWeHdV+NTA=
-golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.26.0 h1:v/60pFQmzmT9ExmjDv2gGIfi3OqfKoEP6I5+umXlbnQ=
-golang.org/x/tools v0.26.0/go.mod h1:TPVVj70c7JJ3WCazhD8OdXcZg/og+b9+tH/KxylGwH0=
+golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
+golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
-gomodules.xyz/jsonpatch/v2 v2.2.0/go.mod h1:WXp+iVDkoLQqPudfQ9GBlwB2eZ5DKOnjQZCYdOS8GPY=
 gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
 gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
-google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.44.0/go.mod h1:EBOGZqzyhtvMDoxwS97ctnh0zUmYY6CxqXsc1AvkYD8=
 google.golang.org/api v0.54.0/go.mod h1:7C4bFFOvVDGXjfDTAsgGwDgAxRDeQ4X8NvUedIt6z3k=
 google.golang.org/api v0.56.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
 google.golang.org/api v0.63.0/go.mod h1:gs4ij2ffTRXwuzzgJl/56BdwJaA194ijkfn++9tDuPo=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
-google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
 google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201102152239-715cce707fb0/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210402141018-6c239bbf2bb1/go.mod h1:9lPAdzaEmUacj36I+k7YKbEc5CXzPIeORRgDAUOu28A=
-google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
 google.golang.org/genproto v0.0.0-20210805201207-89edb61ffb67/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
 google.golang.org/genproto v0.0.0-20210821163610-241b8fcbd6c8/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
 google.golang.org/genproto v0.0.0-20210828152312-66f60bf46e71/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210831024726-fe130286e0e2/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
 google.golang.org/genproto v0.0.0-20210909211513-a8c4777a87af/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211221195035-429b39de9b1c/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220107163113-42d7afdf6368/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220502173005-c8bf987b8c21/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
 google.golang.org/genproto v0.0.0-20240227224415-6ceb2ff114de h1:F6qOa9AZTYJXOUEr4jDysRDLrm4PHePlge4v4TGAlxY=
 google.golang.org/genproto v0.0.0-20240227224415-6ceb2ff114de/go.mod h1:VUhTRKeHn9wwcdrk73nvdC9gF178Tzhmt/qyaFcPLSo=
-google.golang.org/genproto/googleapis/api v0.0.0-20240227224415-6ceb2ff114de h1:jFNzHPIeuzhdRwVhbZdiym9q0ory/xY3sA+v2wPg8I0=
-google.golang.org/genproto/googleapis/api v0.0.0-20240227224415-6ceb2ff114de/go.mod h1:5iCWqnniDlqZHrd3neWVTOwvh/v6s3232omMecelax8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda h1:LI5DOvAxUPMv/50agcLLoo+AdWc1irS9Rzz4vPuD1V4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda/go.mod h1:WtryC6hu0hhx87FDGxWCDptyssuo68sk10vYjF+T9fY=
+google.golang.org/genproto/googleapis/api v0.0.0-20240814211410-ddb44dafa142 h1:wKguEg1hsxI2/L3hUYrpo1RVi48K+uTyzKqprwLXsb8=
+google.golang.org/genproto/googleapis/api v0.0.0-20240814211410-ddb44dafa142/go.mod h1:d6be+8HhtEtucleCbxpPW9PA9XwISACu8nvpPqF0BVo=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240814211410-ddb44dafa142 h1:e7S5W7MGGLaSu8j3YjdezkZ+m1/Nm0uRVRMEMGk26Xs=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240814211410-ddb44dafa142/go.mod h1:UqMtugtsSgubUsoxbuAoiCXvqvErP7Gf0so0mK9tHxU=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
-google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
 google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
 google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.36.1/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
 google.golang.org/grpc v1.37.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
-google.golang.org/grpc v1.37.1/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
-google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
 google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.41.0/go.mod h1:U3l9uK9J0sini8mHphKoXyaqDA/8VyGnDee1zzIUK6k=
-google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.46.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/grpc v1.46.2/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
 google.golang.org/grpc v1.48.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/grpc v1.49.0/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
-google.golang.org/grpc v1.63.0 h1:WjKe+dnvABXyPJMD7KDNLxtoGk5tgk+YFWN6cBWjZE8=
-google.golang.org/grpc v1.63.0/go.mod h1:WAX/8DgncnokcFUldAxq7GeB5DXHDbMF+lLvDomNkRA=
+google.golang.org/grpc v1.67.1 h1:zWnc1Vrcno+lHZCOofnIMvycFcc0QRGIzm9dhnDX68E=
+google.golang.org/grpc v1.67.1/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
@@ -1486,10 +1113,8 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.35.2 h1:8Ar7bF+apOIoThw1EdZl0p1oWvMqTHmpA2fRTyZO8io=
-google.golang.org/protobuf v1.35.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
+google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc h1:2gGKlE2+asNV9m7xrywl36YYNnBG5ZQ0r/BOOxqPpmk=
 gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc/go.mod h1:m7x9LTH6d71AHyAX77c9yqWCCa3UKHcVEj9y7hAtKDk=
@@ -1500,28 +1125,23 @@ gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/evanphx/json-patch.v5 v5.9.0 h1:hx1VU2SGj4F8r9b8GUwJLdc8DNO8sy79ZGui0G05GLo=
-gopkg.in/evanphx/json-patch.v5 v5.9.0/go.mod h1:/kvTRh1TVm5wuM6OkHxqXtE/1nUZZpihg29RtuIyfvk=
+gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
+gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df h1:n7WqCuqOuCbNr617RXOY0AWRXxgwEyPp2z+p0+hgMuE=
 gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df/go.mod h1:LRQQ+SO6ZHR7tOkpBDuZnXENFzX8qRjMDMyPD6BRkCw=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
-gopkg.in/ini.v1 v1.51.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
-gopkg.in/ini.v1 v1.62.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/ini.v1 v1.66.2/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
-gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
-gopkg.in/square/go-jose.v2 v2.2.2/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
 gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
-gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -1537,129 +1157,81 @@ gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
-gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=
-gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
 gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
 gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
 helm.sh/helm/v3 v3.14.4 h1:6FSpEfqyDalHq3kUr4gOMThhgY55kXUEjdQoyODYnrM=
 helm.sh/helm/v3 v3.14.4/go.mod h1:Tje7LL4gprZpuBNTbG34d1Xn5NmRT3OWfBRwpOSer9I=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 k8s.io/api v0.22.1/go.mod h1:bh13rkTp3F1XEaLGykbyRD2QaTTzPm0e/BMd8ptFONY=
-k8s.io/api v0.23.0/go.mod h1:8wmDdLBHBNxtOIytwLstXt5E9PddnZb0GaMcqsvDBpg=
-k8s.io/api v0.24.0/go.mod h1:5Jl90IUrJHUJYEMANRURMiVvJ0g7Ax7r3R1bqO8zx8I=
-k8s.io/api v0.26.1/go.mod h1:xd/GBNgR0f707+ATNyPmQ1oyKSgndzXij81FzWGsejg=
-k8s.io/api v0.26.3/go.mod h1:PXsqwPMXBSBcL1lJ9CYDKy7kIReUydukS5JiRlxC3qE=
-k8s.io/api v0.29.2 h1:hBC7B9+MU+ptchxEqTNW2DkUosJpp1P+Wn6YncZ474A=
-k8s.io/api v0.29.2/go.mod h1:sdIaaKuU7P44aoyyLlikSLayT6Vb7bvJNCX105xZXY0=
-k8s.io/apiextensions-apiserver v0.23.0/go.mod h1:xIFAEEDlAZgpVBl/1VSjGDmLoXAWRG40+GsWhKhAxY4=
-k8s.io/apiextensions-apiserver v0.26.1/go.mod h1:AptjOSXDGuE0JICx/Em15PaoO7buLwTs0dGleIHixSM=
-k8s.io/apiextensions-apiserver v0.26.3/go.mod h1:jdA5MdjNWGP+njw1EKMZc64xAT5fIhN6VJrElV3sfpQ=
-k8s.io/apiextensions-apiserver v0.29.2 h1:UK3xB5lOWSnhaCk0RFZ0LUacPZz9RY4wi/yt2Iu+btg=
-k8s.io/apiextensions-apiserver v0.29.2/go.mod h1:aLfYjpA5p3OwtqNXQFkhJ56TB+spV8Gc4wfMhUA3/b8=
+k8s.io/api v0.31.10 h1:hR39mlD3fxAMVotfj1aAEUOZhNMf+pL/XpL2zKvfLMk=
+k8s.io/api v0.31.10/go.mod h1:UwhlGlhYzRQuDudTdvUZ6bZZAKp0Zs82m+qEw/BZxCU=
+k8s.io/apiextensions-apiserver v0.31.10 h1:Scl+8yOqpbO/6eilafV7F1cpjVmobFWu8EJ3Y2TIKt4=
+k8s.io/apiextensions-apiserver v0.31.10/go.mod h1:0VbuO1j4eft+aMYjVy0piM+A+aITSvamJwOYRYJyHMw=
 k8s.io/apimachinery v0.22.1/go.mod h1:O3oNtNadZdeOMxHFVxOreoznohCpy0z6mocxbZr7oJ0=
-k8s.io/apimachinery v0.23.0/go.mod h1:fFCTTBKvKcwTPFzjlcxp91uPFZr+JA0FubU4fLzzFYc=
-k8s.io/apimachinery v0.24.0/go.mod h1:82Bi4sCzVBdpYjyI4jY6aHX+YCUchUIrZrXKedjd2UM=
-k8s.io/apimachinery v0.26.1/go.mod h1:tnPmbONNJ7ByJNz9+n9kMjNP8ON+1qoAIIC70lztu74=
-k8s.io/apimachinery v0.26.3/go.mod h1:ats7nN1LExKHvJ9TmwootT00Yz05MuYqPXEXaVeOy5I=
-k8s.io/apimachinery v0.29.2 h1:EWGpfJ856oj11C52NRCHuU7rFDwxev48z+6DSlGNsV8=
-k8s.io/apimachinery v0.29.2/go.mod h1:6HVkd1FwxIagpYrHSwJlQqZI3G9LfYWRPAkUvLnXTKU=
-k8s.io/apiserver v0.23.0/go.mod h1:Cec35u/9zAepDPPFyT+UMrgqOCjgJ5qtfVJDxjZYmt4=
-k8s.io/apiserver v0.26.1/go.mod h1:wr75z634Cv+sifswE9HlAo5FQ7UoUauIICRlOE+5dCg=
-k8s.io/apiserver v0.26.3/go.mod h1:CJe/VoQNcXdhm67EvaVjYXxR3QyfwpceKPuPaeLibTA=
-k8s.io/apiserver v0.29.2 h1:+Z9S0dSNr+CjnVXQePG8TcBWHr3Q7BmAr7NraHvsMiQ=
-k8s.io/apiserver v0.29.2/go.mod h1:B0LieKVoyU7ykQvPFm7XSdIHaCHSzCzQWPFa5bqbeMQ=
-k8s.io/cli-runtime v0.29.2 h1:smfsOcT4QujeghsNjECKN3lwyX9AwcFU0nvJ7sFN3ro=
-k8s.io/cli-runtime v0.29.2/go.mod h1:KLisYYfoqeNfO+MkTWvpqIyb1wpJmmFJhioA0xd4MW8=
+k8s.io/apimachinery v0.31.10 h1:fKQxHMu8IFRsC5wsiA7ySL9Z/dw9LOmVs3cifAx1cXk=
+k8s.io/apimachinery v0.31.10/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
+k8s.io/apiserver v0.31.10 h1:oMK+nnYVh2+D7nujjeEbtBl/kbG9CyqrX06wjkFytdE=
+k8s.io/apiserver v0.31.10/go.mod h1:nzEhw+jN3NdDq8b+/uUqL5s4AFRmSkRv5ZJJs8eVuAc=
+k8s.io/cli-runtime v0.31.10 h1:6B205qo3SxQZd/rrYVUaQ6WVKCxkWj9cJRqoUPZ/27A=
+k8s.io/cli-runtime v0.31.10/go.mod h1:kbyGtOOQGSMgjBSBuSkyvAzDDwgl3Bh2vl9iuaPqNxk=
 k8s.io/client-go v0.22.1/go.mod h1:BquC5A4UOo4qVDUtoc04/+Nxp1MeHcVc1HJm1KmG8kk=
-k8s.io/client-go v0.23.0/go.mod h1:hrDnpnK1mSr65lHHcUuIZIXDgEbzc7/683c6hyG4jTA=
-k8s.io/client-go v0.24.0/go.mod h1:VFPQET+cAFpYxh6Bq6f4xyMY80G6jKKktU6G0m00VDw=
-k8s.io/client-go v0.26.1/go.mod h1:IWNSglg+rQ3OcvDkhY6+QLeasV4OYHDjdqeWkDQZwGE=
-k8s.io/client-go v0.26.3/go.mod h1:ZPNu9lm8/dbRIPAgteN30RSXea6vrCpFvq+MateTUuQ=
-k8s.io/client-go v0.29.2 h1:FEg85el1TeZp+/vYJM7hkDlSTFZ+c5nnK44DJ4FyoRg=
-k8s.io/client-go v0.29.2/go.mod h1:knlvFZE58VpqbQpJNbCbctTVXcd35mMyAAwBdpt4jrA=
-k8s.io/code-generator v0.23.0/go.mod h1:vQvOhDXhuzqiVfM/YHp+dmg10WDZCchJVObc9MvowsE=
-k8s.io/code-generator v0.24.0/go.mod h1:dpVhs00hTuTdTY6jvVxvTFCk6gSMrtfRydbhZwHI15w=
-k8s.io/code-generator v0.26.1/go.mod h1:OMoJ5Dqx1wgaQzKgc+ZWaZPfGjdRq/Y3WubFrZmeI3I=
-k8s.io/code-generator v0.26.3/go.mod h1:ryaiIKwfxEJEaywEzx3dhWOydpVctKYbqLajJf0O8dI=
-k8s.io/component-base v0.23.0/go.mod h1:DHH5uiFvLC1edCpvcTDV++NKULdYYU6pR9Tt3HIKMKI=
-k8s.io/component-base v0.24.0/go.mod h1:Dgazgon0i7KYUsS8krG8muGiMVtUZxG037l1MKyXgrA=
-k8s.io/component-base v0.26.1/go.mod h1:VHrLR0b58oC035w6YQiBSbtsf0ThuSwXP+p5dD/kAWU=
-k8s.io/component-base v0.26.3/go.mod h1:5kj1kZYwSC6ZstHJN7oHBqcJC6yyn41eR+Sqa/mQc8E=
-k8s.io/component-base v0.29.2 h1:lpiLyuvPA9yV1aQwGLENYyK7n/8t6l3nn3zAtFTJYe8=
-k8s.io/component-base v0.29.2/go.mod h1:BfB3SLrefbZXiBfbM+2H1dlat21Uewg/5qtKOl8degM=
-k8s.io/gengo v0.0.0-20210813121822-485abfe95c7c/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
-k8s.io/gengo v0.0.0-20211129171323-c02415ce4185/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
-k8s.io/gengo v0.0.0-20220902162205-c0856e24416d/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
-k8s.io/gengo v0.0.0-20230829151522-9cce18d56c01/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
+k8s.io/client-go v0.31.10 h1:2WvGOFKKggxmx6kB6DP1NjdvLPyI6z+CtDWcQsyHpTI=
+k8s.io/client-go v0.31.10/go.mod h1:zRlFekIgyvhAEb8osZ6ar1//EqqGgW9C/j5jGVFNMXI=
+k8s.io/component-base v0.31.10 h1:8daIQBYMhcnuXMD1otGkjpx4d4b0UIcg18xieLTAGA0=
+k8s.io/component-base v0.31.10/go.mod h1:qoSFFg2SO854XgeCJwFL/LPY/oJU1vqJHhNCEgI6xhA=
+k8s.io/gengo v0.0.0-20200413195148-3a45101e95ac/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
 k8s.io/helm v2.17.0+incompatible h1:Bpn6o1wKLYqKM3+Osh8e+1/K2g/GsQJ4F4yNF2+deao=
 k8s.io/helm v2.17.0+incompatible/go.mod h1:LZzlS4LQBHfciFOurYBFkCMTaZ0D1l+p0teMg7TSULI=
 k8s.io/klog v1.0.0 h1:Pt+yjF5aB1xDSVbau4VsWe+dQNzA0qv1LlXdC2dF6Q8=
 k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
 k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
-k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
 k8s.io/klog/v2 v2.9.0/go.mod h1:hy9LJ/NvuK+iVyP4Ehqva4HxZG/oXyIS3n3Jmire4Ec=
-k8s.io/klog/v2 v2.30.0/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
-k8s.io/klog/v2 v2.60.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
-k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
-k8s.io/klog/v2 v2.90.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
-k8s.io/klog/v2 v2.120.1 h1:QXU6cPEOIslTGvZaXvFWiP9VKyeet3sawzTOvdXb4Vw=
-k8s.io/klog/v2 v2.120.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kms v0.26.1/go.mod h1:ReC1IEGuxgfN+PDCIpR6w8+XMmDE7uJhxcCwMZFdIYc=
-k8s.io/kms v0.26.3/go.mod h1:69qGnf1NsFOQP07fBYqNLZklqEHSJF024JqYCaeVxHg=
-k8s.io/kms v0.29.3 h1:ReljsAUhYlm2spdT4yXmY+9a8x8dc/OT4mXvwQPPteQ=
-k8s.io/kms v0.29.3/go.mod h1:TBGbJKpRUMk59neTMDMddjIDL+D4HuFUbpuiuzmOPg0=
-k8s.io/kube-aggregator v0.27.2 h1:jfHoPip+qN/fn3OcrYs8/xMuVYvkJHKo0H0DYciqdns=
-k8s.io/kube-aggregator v0.27.2/go.mod h1:mwrTt4ESjQ7A6847biwohgZWn8P/KzSFHegEScbSGY4=
-k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 h1:aVUu9fTY98ivBPKR9Y5w/AuzbMm96cd3YHRTU83I780=
-k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00/go.mod h1:AsvuZPBlUDVuCdzJ87iajxtXuR9oktsTctW/R9wwouA=
-k8s.io/kubectl v0.29.2 h1:uaDYaBhumvkwz0S2XHt36fK0v5IdNgL7HyUniwb2IUo=
-k8s.io/kubectl v0.29.2/go.mod h1:BhizuYBGcKaHWyq+G7txGw2fXg576QbPrrnQdQDZgqI=
-k8s.io/metrics v0.29.2 h1:oLSTHEr40V7c7C8wDRRhiAefjGRHROK5zeV8NT0tpzc=
-k8s.io/metrics v0.29.2/go.mod h1:cWzACDpKElWhm0CElwfK+7I39wDNbmDDCX7hywjvgR4=
+k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
+k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kms v0.31.10 h1:jD/+hMQ8WT4ht419sXNs1u4dqeJidG34rFcnb2nP6CM=
+k8s.io/kms v0.31.10/go.mod h1:OZKwl1fan3n3N5FFxnW5C4V3ygrah/3YXeJWS3O6+94=
+k8s.io/kube-aggregator v0.31.10 h1:NeqnNYGEpJx8NTN56q48vR1XFyLG/8Rif/5iazNSTwE=
+k8s.io/kube-aggregator v0.31.10/go.mod h1:e5mGlroAKn7b0tjM7+WCN1xhIR35saroPUw10MnF9Zw=
+k8s.io/kube-openapi v0.0.0-20210421082810-95288971da7e/go.mod h1:vHXdDvt9+2spS2Rx9ql3I8tycm3H9FDfdUoIuKCefvw=
+k8s.io/kube-openapi v0.0.0-20250610211856-8b98d1ed966a h1:ZV3Zr+/7s7aVbjNGICQt+ppKWsF1tehxggNfbM7XnG8=
+k8s.io/kube-openapi v0.0.0-20250610211856-8b98d1ed966a/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
+k8s.io/kubectl v0.31.10 h1:U1Y4+aucs7jgUrD4SbMy4ynVVGoCMy6Uav/elBmeNGk=
+k8s.io/kubectl v0.31.10/go.mod h1:RD8VRN9NlCUncTWTSnCywLdKPGl8URyV9SAkUI3eTlM=
+k8s.io/metrics v0.31.10 h1:NNyPGSgVWMvj9Xd73KrkDESMm0eNITEfiTgJuw7uqhk=
+k8s.io/metrics v0.31.10/go.mod h1:+OpG8LsU+MzLGc0jwnD3SMPij4qbabJDRo6Ys8acVDE=
 k8s.io/utils v0.0.0-20210707171843-4b05e18ac7d9/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-k8s.io/utils v0.0.0-20210802155522-efc7438f0176/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-k8s.io/utils v0.0.0-20210930125809-cb0fa318a74b/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-k8s.io/utils v0.0.0-20221107191617-1a15be271d1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-k8s.io/utils v0.0.0-20221128185143-99ec85e7a448/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-k8s.io/utils v0.0.0-20240310230437-4693a0247e57 h1:gbqbevonBh57eILzModw6mrkbwM0gQBEuevE/AaBsHY=
-k8s.io/utils v0.0.0-20240310230437-4693a0247e57/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-open-cluster-management.io/api v0.10.1/go.mod h1:6BB/Y6r3hXlPjpJgDwIs6Ubxyx/kXXOg6D9Cntg1I9E=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 open-cluster-management.io/api v0.11.0 h1:zBxa33Co3wseLBF4HEJobhl0P6ygj+Drhe7Wrfo0/h8=
 open-cluster-management.io/api v0.11.0/go.mod h1:WgKUCJ7+Bf40DsOmH1Gdkpyj3joco+QLzrlM6Ak39zE=
 oras.land/oras-go v1.2.5 h1:XpYuAwAb0DfQsunIyMfeET92emK8km3W4yEzZvUbsTo=
 oras.land/oras-go v1.2.5/go.mod h1:PuAwRShRZCsZb7g8Ar3jKKQR/2A/qN+pkYxIOd/FAoo=
-sigs.k8s.io/apiserver-network-proxy v0.0.30 h1:Zr5Zqd2GymcYUwijHUDEaQ1I3Dx0giTIWaD80N6j2mE=
-sigs.k8s.io/apiserver-network-proxy v0.0.30/go.mod h1:0wSWl5ohhp7kYl5XOP0w1IZSWTHhe9TojjDGityZxnc=
+sigs.k8s.io/apiserver-network-proxy v0.31.4 h1:YRb3mCGK5fO6c0UtzhhDgmjoIy18k/PoxFdNR2oVm9o=
+sigs.k8s.io/apiserver-network-proxy v0.31.4/go.mod h1:Ugnqsjch2aZ/yAl/PGQbAhjcw6R72lsWDmX/LjyXfSc=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.36 h1:PUuX1qIFv309AT8hF/CdPKDmsG/hn/L8zRX7VvISM3A=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.36/go.mod h1:WxjusMwXlKzfAs4p9km6XJRndVt2FROgMVCE4cdohFo=
-sigs.k8s.io/controller-runtime v0.11.1/go.mod h1:KKwLiTooNGu+JmLZGn9Sl3Gjmfj66eMbCQznLP5zcqA=
-sigs.k8s.io/controller-runtime v0.14.6/go.mod h1:WqIdsAY6JBsjfc/CqO0CORmNtoCtE4S6qbPc9s68h+0=
-sigs.k8s.io/controller-runtime v0.17.6 h1:12IXsozEsIXWAMRpgRlYS1jjAHQXHtWEOMdULh3DbEw=
-sigs.k8s.io/controller-runtime v0.17.6/go.mod h1:N0jpP5Lo7lMTF9aL56Z/B2oWBJjey6StQM0jRbKQXtY=
-sigs.k8s.io/controller-tools v0.14.0 h1:rnNoCC5wSXlrNoBKKzL70LNJKIQKEzT6lloG6/LF73A=
-sigs.k8s.io/controller-tools v0.14.0/go.mod h1:TV7uOtNNnnR72SpzhStvPkoS/U5ir0nMudrkrC4M9Sc=
+sigs.k8s.io/controller-runtime v0.19.7 h1:DLABZfMr20A+AwCZOHhcbcu+TqBXnJZaVBri9K3EO48=
+sigs.k8s.io/controller-runtime v0.19.7/go.mod h1:iRmWllt8IlaLjvTTDLhRBXIEtkCK6hwVBJJsYS9Ajf4=
+sigs.k8s.io/controller-tools v0.16.5 h1:5k9FNRqziBPwqr17AMEPPV/En39ZBplLAdOwwQHruP4=
+sigs.k8s.io/controller-tools v0.16.5/go.mod h1:8vztuRVzs8IuuJqKqbXCSlXcw+lkAv/M2sTpg55qjMY=
 sigs.k8s.io/gateway-api v0.7.1 h1:Tts2jeepVkPA5rVG/iO+S43s9n7Vp7jCDhZDQYtPigQ=
 sigs.k8s.io/gateway-api v0.7.1/go.mod h1:Xv0+ZMxX0lu1nSSDIIPEfbVztgNZ+3cfiYrJsa2Ooso=
-sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6/go.mod h1:p4QtZmO4uMYipTQNzagwnNoseA6OxSUutVw05NhYDRs=
-sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2/go.mod h1:B+TnT182UBxE84DiCz4CVE26eOSDAeYCpfDnC2kdKMY=
-sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
 sigs.k8s.io/kind v0.20.0 h1:f0sc3v9mQbGnjBUaqSFST1dwIuiikKVGgoTwpoP33a8=
 sigs.k8s.io/kind v0.20.0/go.mod h1:aBlbxg08cauDgZ612shr017/rZwqd7AS563FvpWKPVs=
-sigs.k8s.io/kustomize/api v0.16.0 h1:/zAR4FOQDCkgSDmVzV2uiFbuy9bhu3jEzthrHCuvm1g=
-sigs.k8s.io/kustomize/api v0.16.0/go.mod h1:MnFZ7IP2YqVyVwMWoRxPtgl/5hpA+eCCrQR/866cm5c=
-sigs.k8s.io/kustomize/kyaml v0.16.0 h1:6J33uKSoATlKZH16unr2XOhDI+otoe2sR3M8PDzW3K0=
-sigs.k8s.io/kustomize/kyaml v0.16.0/go.mod h1:xOK/7i+vmE14N2FdFyugIshB8eF6ALpy7jI87Q2nRh4=
+sigs.k8s.io/kustomize/api v0.17.2 h1:E7/Fjk7V5fboiuijoZHgs4aHuexi5Y2loXlVOAVAG5g=
+sigs.k8s.io/kustomize/api v0.17.2/go.mod h1:UWTz9Ct+MvoeQsHcJ5e+vziRRkwimm3HytpZgIYqye0=
+sigs.k8s.io/kustomize/kyaml v0.17.1 h1:TnxYQxFXzbmNG6gOINgGWQt09GghzgTP6mIurOgrLCQ=
+sigs.k8s.io/kustomize/kyaml v0.17.1/go.mod h1:9V0mCjIEYjlXuCdYsSXvyoy2BTsLESH7TlGV81S282U=
+sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
 sigs.k8s.io/structured-merge-diff/v4 v4.1.2/go.mod h1:j/nl6xW8vLS49O8YvXW1ocPhZawJtm+Yrr7PPRQ0Vg4=
-sigs.k8s.io/structured-merge-diff/v4 v4.2.0/go.mod h1:j/nl6xW8vLS49O8YvXW1ocPhZawJtm+Yrr7PPRQ0Vg4=
-sigs.k8s.io/structured-merge-diff/v4 v4.2.1/go.mod h1:j/nl6xW8vLS49O8YvXW1ocPhZawJtm+Yrr7PPRQ0Vg4=
-sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
-sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
-sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
+sigs.k8s.io/structured-merge-diff/v4 v4.6.0 h1:IUA9nvMmnKWcj5jl84xn+T5MnlZKThmUW1TdblaLVAc=
+sigs.k8s.io/structured-merge-diff/v4 v4.6.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
 sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
 sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
diff --git a/hack/apis/clientgen.sh b/hack/apis/clientgen.sh
index 3a3b551d..1aa748d5 100755
--- a/hack/apis/clientgen.sh
+++ b/hack/apis/clientgen.sh
@@ -44,22 +44,43 @@ EOF
 }
 
 clientGen() {
-  # TODO: better migrate this to kube_codegen.sh (https://github.com/kubernetes/sample-controller/blob/master/hack/update-codegen.sh)
-  chmod +x ./vendor/k8s.io/code-generator/generate-groups.sh
+  # Using kube_codegen.sh as generate-groups.sh has been removed
+  chmod +x ./vendor/k8s.io/code-generator/kube_codegen.sh 
   chmod +x ./vendor/k8s.io/code-generator/generate-internal-groups.sh
-  bash ./vendor/k8s.io/code-generator/generate-groups.sh "${CODEGEN_GENERATORS}" \
-    ${OUTPUT_PACKAGE} \
-    ${APIS_PACKAGE} \
-    "${CODEGEN_GROUP_VERSIONS}" \
-    --output-base "${OUTPUT_DIR}" \
-    --go-header-file "${BOILERPLATE_FILE}"
+  
+  # kube_codegen.sh uses different syntax - call it via the kube_codegen module
+  source ./vendor/k8s.io/code-generator/kube_codegen.sh
+  
+  # Generate code using the new API
+  kube::codegen::gen_client \
+    --with-watch \
+    --output-dir "${OUTPUT_DIR}" \
+    --output-pkg "${OUTPUT_PACKAGE}" \
+    --boilerplate "${BOILERPLATE_FILE}" \
+    "./apis"
 
   rm -rf ./pkg/generated/
   mkdir -p ./pkg/generated/
-  mv "${WORK_TEMP_DIR}/github.com/oam-dev/kubevela/pkg/generated/client" ./pkg/generated/
+  
+  # Move the generated client code
+  if [ -d "${WORK_TEMP_DIR}/clientset" ] || [ -d "${WORK_TEMP_DIR}/informers" ] || [ -d "${WORK_TEMP_DIR}/listers" ]; then
+    mkdir -p ./pkg/generated/client
+    if [ -d "${WORK_TEMP_DIR}/clientset" ]; then
+      mv "${WORK_TEMP_DIR}/clientset" ./pkg/generated/client/
+    fi
+    if [ -d "${WORK_TEMP_DIR}/informers" ]; then
+      mv "${WORK_TEMP_DIR}/informers" ./pkg/generated/client/
+    fi
+    if [ -d "${WORK_TEMP_DIR}/listers" ]; then
+      mv "${WORK_TEMP_DIR}/listers" ./pkg/generated/client/
+    fi
+  else
+    echo "Warning: Generated client directories not found"
+    find "${WORK_TEMP_DIR}" -type d 2>/dev/null || true
+  fi
 }
 
-EXPECTED_CONTROLLER_GEN_VERSION=v0.14.0
+EXPECTED_CONTROLLER_GEN_VERSION=v0.16.5
 CONTROLLER_GEN="$(go env GOPATH)"/bin/controller-gen
 
 deepcopyGen() {
diff --git a/hack/utils/golangci-lint-wrapper.sh b/hack/utils/golangci-lint-wrapper.sh
new file mode 100755
index 00000000..d0025562
--- /dev/null
+++ b/hack/utils/golangci-lint-wrapper.sh
@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Wrapper script to run golangci-lint and ignore typecheck errors
+# This script filters out false positive typecheck errors from golangci-lint v1.60.1
+
+set -euo pipefail
+
+# Create temporary files for output
+tmpfile=$(mktemp)
+filtered=$(mktemp)
+
+# Ensure cleanup on exit
+cleanup() {
+    rm -f "$tmpfile" "$filtered"
+}
+trap cleanup EXIT INT TERM
+
+if ${GOLANGCILINT:-golangci-lint} run --config .golangci.yml --fix --verbose --exclude-dirs 'scaffold' > "$tmpfile" 2>&1; then
+    exit_code=0
+else
+    exit_code=$?
+fi
+
+# Keep the original verbose output (level= lines)
+grep -E "^level=|^[[:space:]]*$" "$tmpfile" > "$filtered" || true
+
+# Check for non-typecheck errors and add them to output
+if grep -E "\.go:[0-9]+:[0-9]+:.*\(" "$tmpfile" 2>/dev/null | grep -v "(typecheck)" > /dev/null; then
+    {
+        echo ""
+        echo "Linting errors found:"
+        grep -E "\.go:[0-9]+:[0-9]+:.*\(" "$tmpfile" | grep -v "(typecheck)" || true
+    } >> "$filtered"
+fi
+
+cat "$filtered"
+if [[ $exit_code -eq 0 ]]; then
+    exit 0
+fi
+
+# Count non-typecheck errors in .go files
+non_typecheck_errors=$(grep -E "\.go:[0-9]+:[0-9]+:.*\(" "$tmpfile" 2>/dev/null | grep -v "(typecheck)" | grep -c . || echo "0")
+
+# Ensure the count is a valid number (remove spaces and newlines)
+non_typecheck_errors=$(echo "$non_typecheck_errors" | tr -d '[:space:]')
+
+# Check if golangci-lint itself had a critical failure (not a linting error)
+# This catches cases like config errors, missing files, etc.
+if [[ $exit_code -ne 0 ]] && [[ $non_typecheck_errors -eq 0 ]]; then
+    # Check if there are only typecheck errors
+    total_errors=$(grep -E "\.go:[0-9]+:[0-9]+:.*\(" "$tmpfile" 2>/dev/null | grep -c . || echo "0")
+    typecheck_errors=$(grep -E "\.go:[0-9]+:[0-9]+:.*\(typecheck\)" "$tmpfile" 2>/dev/null | grep -c . || echo "0")
+    
+    # Clean up the counts
+    total_errors=$(echo "$total_errors" | tr -d '[:space:]')
+    typecheck_errors=$(echo "$typecheck_errors" | tr -d '[:space:]')
+    
+    if [[ $total_errors -eq $typecheck_errors ]]; then
+        # Only typecheck errors, ignore them
+        exit 0
+    else
+        # There was a critical failure, show the full output and exit with error
+        echo ""
+        echo "Critical golangci-lint failure detected:"
+        cat "$tmpfile"
+        exit "$exit_code"
+    fi
+fi
+
+if [[ $non_typecheck_errors -gt 0 ]]; then
+    exit "$exit_code"
+else
+    # Only typecheck errors, ignore them
+    exit 0
+fi
\ No newline at end of file
diff --git a/makefiles/dependency.mk b/makefiles/dependency.mk
index f7c2d15c..8e9e3bc7 100644
--- a/makefiles/dependency.mk
+++ b/makefiles/dependency.mk
@@ -4,7 +4,7 @@ $(LOCALBIN):
 GOLANGCILINT_VERSION ?= 1.60.1
 GLOBAL_GOLANGCILINT := $(shell which golangci-lint)
 GOBIN_GOLANGCILINT:= $(shell which $(GOBIN)/golangci-lint)
-ENVTEST_K8S_VERSION = 1.29.0
+ENVTEST_K8S_VERSION = 1.31.0
 ENVTEST ?= $(LOCALBIN)/setup-envtest
 
 .PHONY: golangci
@@ -31,7 +31,7 @@ ifeq (, $(shell which staticcheck))
 	@{ \
 	set -e ;\
 	echo 'installing honnef.co/go/tools/cmd/staticcheck ' ;\
-	go install honnef.co/go/tools/cmd/staticcheck@v0.5.1 ;\
+	go install honnef.co/go/tools/cmd/staticcheck@v0.6.1 ;\
 	}
 STATICCHECK=$(GOBIN)/staticcheck
 else
diff --git a/pkg/appfile/appfile.go b/pkg/appfile/appfile.go
index 1dec8334..211ad07b 100644
--- a/pkg/appfile/appfile.go
+++ b/pkg/appfile/appfile.go
@@ -23,6 +23,8 @@ import (
 	"reflect"
 	"strings"
 
+	"github.com/oam-dev/kubevela/pkg/cue/definition/health"
+
 	"cuelang.org/go/cue"
 	"github.com/crossplane/crossplane-runtime/pkg/fieldpath"
 	"github.com/kubevela/pkg/util/slices"
@@ -110,21 +112,12 @@ func (comp *Component) GetTemplateContext(ctx process.Context, client client.Cli
 }
 
 // EvalStatus eval workload status
-func (comp *Component) EvalStatus(templateContext map[string]interface{}) (string, error) {
+func (comp *Component) EvalStatus(templateContext map[string]interface{}) (*health.StatusResult, error) {
 	// if the standard workload is managed by trait always return empty message
 	if comp.SkipApplyWorkload {
-		return "", nil
-	}
-	return comp.engine.Status(templateContext, comp.FullTemplate.CustomStatus, comp.Params)
-}
-
-// EvalHealth eval workload health check
-func (comp *Component) EvalHealth(templateContext map[string]interface{}) (bool, error) {
-	// if the health of template is not set or standard workload is managed by trait always return true
-	if comp.SkipApplyWorkload {
-		return true, nil
+		return nil, nil
 	}
-	return comp.engine.HealthCheck(templateContext, comp.FullTemplate.Health, comp.Params)
+	return comp.engine.Status(templateContext, comp.FullTemplate.AsStatusRequest(comp.Params))
 }
 
 // Trait is ComponentTrait
@@ -135,7 +128,6 @@ type Trait struct {
 	Params             map[string]interface{}
 
 	Template           string
-	HealthCheckPolicy  string
 	CustomStatusFormat string
 
 	// RequiredSecrets stores secret names which the trait needs from cloud resource component and its context
@@ -159,14 +151,9 @@ func (trait *Trait) GetTemplateContext(ctx process.Context, client client.Client
 	return templateContext, err
 }
 
-// EvalStatus eval trait status
-func (trait *Trait) EvalStatus(templateContext map[string]interface{}) (string, error) {
-	return trait.engine.Status(templateContext, trait.CustomStatusFormat, trait.Params)
-}
-
-// EvalHealth eval trait health check
-func (trait *Trait) EvalHealth(templateContext map[string]interface{}) (bool, error) {
-	return trait.engine.HealthCheck(templateContext, trait.HealthCheckPolicy, trait.Params)
+// EvalStatus eval trait status (including health)
+func (trait *Trait) EvalStatus(templateContext map[string]interface{}) (*health.StatusResult, error) {
+	return trait.engine.Status(templateContext, trait.FullTemplate.AsStatusRequest(trait.Params))
 }
 
 // Appfile describes application
diff --git a/pkg/appfile/parser.go b/pkg/appfile/parser.go
index 4cf94024..0e0a0421 100644
--- a/pkg/appfile/parser.go
+++ b/pkg/appfile/parser.go
@@ -704,7 +704,6 @@ func (p *Parser) convertTemplate2Trait(name string, properties map[string]interf
 		CapabilityCategory: templ.CapabilityCategory,
 		Params:             properties,
 		Template:           templ.TemplateStr,
-		HealthCheckPolicy:  templ.Health,
 		CustomStatusFormat: templ.CustomStatus,
 		FullTemplate:       templ,
 		engine:             definition.NewTraitAbstractEngine(traitName),
diff --git a/pkg/appfile/template.go b/pkg/appfile/template.go
index cf3fb7f2..d326fd48 100644
--- a/pkg/appfile/template.go
+++ b/pkg/appfile/template.go
@@ -31,6 +31,8 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
+	"github.com/oam-dev/kubevela/pkg/cue/definition/health"
+
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/v1beta1"
 	"github.com/oam-dev/kubevela/apis/types"
@@ -51,6 +53,7 @@ type Template struct {
 	TemplateStr        string
 	Health             string
 	CustomStatus       string
+	Details            string
 	CapabilityCategory types.CapabilityCategory
 	Reference          common.WorkloadTypeDescriptor
 	Terraform          *common.Terraform
@@ -350,6 +353,7 @@ func loadSchematicToTemplate(tmpl *Template, status *common.Status, schematic *c
 	if status != nil {
 		tmpl.CustomStatus = status.CustomStatus
 		tmpl.Health = status.HealthPolicy
+		tmpl.Details = status.Details
 	}
 
 	if schematic != nil {
@@ -398,3 +402,12 @@ func ConvertTemplateJSON2Object(capabilityName string, in *runtime.RawExtension,
 	}
 	return t, nil
 }
+
+func (t *Template) AsStatusRequest(parameter map[string]interface{}) *health.StatusRequest {
+	return &health.StatusRequest{
+		Health:    t.Health,
+		Custom:    t.CustomStatus,
+		Details:   t.Details,
+		Parameter: parameter,
+	}
+}
diff --git a/pkg/controller/core.oam.dev/v1beta1/application/application_controller.go b/pkg/controller/core.oam.dev/v1beta1/application/application_controller.go
index dfe8b0ea..938905e2 100644
--- a/pkg/controller/core.oam.dev/v1beta1/application/application_controller.go
+++ b/pkg/controller/core.oam.dev/v1beta1/application/application_controller.go
@@ -254,11 +254,9 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
 	}
 
 	var phase = common.ApplicationRunning
-	if !hasHealthCheckPolicy(appFile.ParsedPolicies) {
-		app.Status.Services = handler.services
-		if !isHealthy(handler.services) {
-			phase = common.ApplicationUnhealthy
-		}
+	isHealthy := evalStatus(logCtx, handler, appFile, appParser)
+	if !isHealthy {
+		phase = common.ApplicationUnhealthy
 	}
 
 	r.stateKeep(logCtx, handler, app)
@@ -477,6 +475,9 @@ func (r *Reconciler) writeStatusByMethod(ctx context.Context, method method, app
 		executor.StepStatusCache.Store(fmt.Sprintf("%s-%s", app.Name, app.Namespace), -1)
 		return err
 	}
+	if feature.DefaultMutableFeatureGate.Enabled(features.EnableApplicationStatusMetrics) {
+		r.updateMetricsAndLog(ctx, app)
+	}
 	return nil
 }
 
@@ -593,6 +594,9 @@ func (r *Reconciler) SetupWithManager(mgr ctrl.Manager) error {
 
 // Setup adds a controller that reconciles App.
 func Setup(mgr ctrl.Manager, args core.Args) error {
+	// Register application status metrics after feature gates are initialized
+	metrics.RegisterApplicationStatusMetrics()
+
 	reconciler := Reconciler{
 		Client:   mgr.GetClient(),
 		Scheme:   mgr.GetScheme(),
@@ -690,3 +694,25 @@ func setVelaVersion(app *v1beta1.Application) {
 		metav1.SetMetaDataAnnotation(&app.ObjectMeta, oam.AnnotationKubeVelaVersion, version.VelaVersion)
 	}
 }
+
+func evalStatus(ctx monitorContext.Context, handler *AppHandler, appFile *appfile.Appfile, appParser *appfile.Parser) bool {
+	healthCheck := handler.checkComponentHealth(appParser, appFile)
+	if !hasHealthCheckPolicy(appFile.ParsedPolicies) {
+		for idx, svc := range handler.services {
+			for _, component := range handler.app.Spec.Components {
+				_, status, _, _, err := healthCheck(ctx, component, nil, svc.Cluster, svc.Namespace)
+				if err != nil {
+					ctx.Error(err, "Failed to collect health status")
+				} else if status != nil {
+					handler.services[idx].Healthy = status.Healthy
+					handler.services[idx].Message = status.Message
+					handler.services[idx].Details = status.Details
+					handler.services[idx].Traits = status.Traits
+				}
+			}
+		}
+		handler.app.Status.Services = handler.services
+		return isHealthy(handler.services)
+	}
+	return true
+}
diff --git a/pkg/controller/core.oam.dev/v1beta1/application/application_metrics.go b/pkg/controller/core.oam.dev/v1beta1/application/application_metrics.go
new file mode 100644
index 00000000..780fd6b9
--- /dev/null
+++ b/pkg/controller/core.oam.dev/v1beta1/application/application_metrics.go
@@ -0,0 +1,206 @@
+/*
+Copyright 2021 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package application
+
+import (
+	"context"
+
+	workflowv1alpha1 "github.com/kubevela/workflow/api/v1alpha1"
+	"k8s.io/klog/v2"
+
+	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
+	"github.com/oam-dev/kubevela/apis/core.oam.dev/v1beta1"
+	"github.com/oam-dev/kubevela/pkg/monitor/metrics"
+)
+
+// HealthStatus represents the health status of an application
+type HealthStatus struct {
+	Healthy        bool
+	HealthyCount   int
+	UnhealthyCount int
+}
+
+// updateMetricsAndLog updates Prometheus metrics and logs application status with service details
+func (r *Reconciler) updateMetricsAndLog(_ context.Context, app *v1beta1.Application) {
+	healthStatus := calculateHealthStatus(app.Status.Services)
+
+	updateHealthMetric(app, healthStatus.Healthy)
+	updatePhaseMetrics(app)
+
+	workflowStatus := buildWorkflowStatus(app.Status.Workflow)
+	serviceDetails := buildServiceDetails(app.Status.Services)
+	logApplicationStatus(app, healthStatus, workflowStatus, serviceDetails)
+}
+
+// calculateHealthStatus calculates the health status from services
+func calculateHealthStatus(services []common.ApplicationComponentStatus) HealthStatus {
+	status := HealthStatus{
+		Healthy: true,
+	}
+
+	for _, svc := range services {
+		if svc.Healthy {
+			status.HealthyCount++
+		} else {
+			status.UnhealthyCount++
+			status.Healthy = false
+		}
+	}
+
+	return status
+}
+
+// updateHealthMetric updates the application health status metric
+func updateHealthMetric(app *v1beta1.Application, healthy bool) {
+	healthValue := float64(1)
+	if !healthy {
+		healthValue = float64(0)
+	}
+
+	metrics.ApplicationHealthStatus.WithLabelValues(
+		app.Name,
+		app.Namespace,
+	).Set(healthValue)
+}
+
+// updatePhaseMetrics updates the application and workflow phase metrics
+func updatePhaseMetrics(app *v1beta1.Application) {
+	metrics.ApplicationPhase.WithLabelValues(
+		app.Name,
+		app.Namespace,
+	).Set(appPhaseToNumeric(app.Status.Phase))
+
+	if app.Status.Workflow != nil && app.Status.Workflow.Phase != "" {
+		metrics.WorkflowPhase.WithLabelValues(
+			app.Name,
+			app.Namespace,
+		).Set(workflowPhaseToNumeric(app.Status.Workflow.Phase))
+	}
+}
+
+// buildWorkflowStatus builds workflow status information for logging
+func buildWorkflowStatus(workflow *common.WorkflowStatus) map[string]interface{} {
+	if workflow == nil {
+		return make(map[string]interface{})
+	}
+
+	return map[string]interface{}{
+		"app_revision": workflow.AppRevision,
+		"finished":     workflow.Finished,
+		"phase":        workflow.Phase,
+		"message":      workflow.Message,
+	}
+}
+
+// buildServiceDetails builds service details for logging
+func buildServiceDetails(services []common.ApplicationComponentStatus) []map[string]interface{} {
+	serviceDetails := make([]map[string]interface{}, 0, len(services))
+
+	for _, svc := range services {
+		svcDetails := map[string]interface{}{
+			"name":      svc.Name,
+			"namespace": svc.Namespace,
+			"cluster":   svc.Cluster,
+			"healthy":   svc.Healthy,
+			"message":   svc.Message,
+		}
+		if len(svc.Details) > 0 {
+			svcDetails["details"] = svc.Details
+		}
+		serviceDetails = append(serviceDetails, svcDetails)
+	}
+
+	return serviceDetails
+}
+
+// logApplicationStatus logs the application status with structured data
+func logApplicationStatus(app *v1beta1.Application, healthStatus HealthStatus, workflowStatus map[string]interface{}, serviceDetails []map[string]interface{}) {
+	statusDetails := map[string]interface{}{
+		"app_uid":   app.UID,
+		"app_name":  app.Name,
+		"version":   app.ResourceVersion,
+		"namespace": app.Namespace,
+		"labels":    app.Labels,
+		"status": map[string]interface{}{
+			"phase":                    string(app.Status.Phase),
+			"healthy":                  healthStatus.Healthy,
+			"healthy_services_count":   healthStatus.HealthyCount,
+			"unhealthy_services_count": healthStatus.UnhealthyCount,
+			"services":                 serviceDetails,
+			"workflow":                 workflowStatus,
+		},
+	}
+
+	klog.InfoS("application update",
+		"app_uid", app.UID,
+		"app_name", app.Name,
+		"namespace", app.Namespace,
+		"phase", string(app.Status.Phase),
+		"healthy", healthStatus.Healthy,
+		"data", statusDetails,
+	)
+}
+
+// appPhaseToNumeric converts application phase to numeric value for metrics
+func appPhaseToNumeric(phase common.ApplicationPhase) float64 {
+	switch phase {
+	case common.ApplicationStarting:
+		return 0
+	case common.ApplicationRunning:
+		return 1
+	case common.ApplicationRendering:
+		return 2
+	case common.ApplicationPolicyGenerating:
+		return 3
+	case common.ApplicationRunningWorkflow:
+		return 4
+	case common.ApplicationWorkflowSuspending:
+		return 5
+	case common.ApplicationWorkflowTerminated:
+		return 6
+	case common.ApplicationWorkflowFailed:
+		return 7
+	case common.ApplicationUnhealthy:
+		return 8
+	case common.ApplicationDeleting:
+		return 9
+	default:
+		return -1
+	}
+}
+
+// workflowPhaseToNumeric converts workflow phase to numeric value for metrics
+func workflowPhaseToNumeric(phase workflowv1alpha1.WorkflowRunPhase) float64 {
+	switch phase {
+	case workflowv1alpha1.WorkflowStateInitializing:
+		return 0
+	case workflowv1alpha1.WorkflowStateSucceeded:
+		return 1
+	case workflowv1alpha1.WorkflowStateExecuting:
+		return 2
+	case workflowv1alpha1.WorkflowStateSuspending:
+		return 3
+	case workflowv1alpha1.WorkflowStateTerminated:
+		return 4
+	case workflowv1alpha1.WorkflowStateFailed:
+		return 5
+	case workflowv1alpha1.WorkflowStateSkipped:
+		return 6
+	default:
+		return -1
+	}
+}
diff --git a/pkg/controller/core.oam.dev/v1beta1/application/apply.go b/pkg/controller/core.oam.dev/v1beta1/application/apply.go
index 39f11993..a6f11c89 100644
--- a/pkg/controller/core.oam.dev/v1beta1/application/apply.go
+++ b/pkg/controller/core.oam.dev/v1beta1/application/apply.go
@@ -245,14 +245,16 @@ func (h *AppHandler) collectTraitHealthStatus(comp *appfile.Component, tr *appfi
 	if err != nil {
 		return common.ApplicationTraitStatus{}, nil, errors.WithMessagef(err, "app=%s, comp=%s, trait=%s, get template context error", appName, comp.Name, tr.Name)
 	}
-	if ok, err := tr.EvalHealth(templateContext); !ok || err != nil {
-		traitStatus.Healthy = false
-	}
-	traitStatus.Message, err = tr.EvalStatus(templateContext)
 	if err != nil {
 		return common.ApplicationTraitStatus{}, nil, errors.WithMessagef(err, "app=%s, comp=%s, trait=%s, evaluate status message error", appName, comp.Name, tr.Name)
 	}
-	return traitStatus, extractOutputs(templateContext), nil
+	statusResult, err := tr.EvalStatus(templateContext)
+	if err == nil && statusResult != nil {
+		traitStatus.Healthy = statusResult.Healthy
+		traitStatus.Message = statusResult.Message
+		traitStatus.Details = statusResult.Details
+	}
+	return traitStatus, extractOutputs(templateContext), err
 }
 
 // collectWorkloadHealthStatus collect workload health status
@@ -260,9 +262,8 @@ func (h *AppHandler) collectWorkloadHealthStatus(ctx context.Context, comp *appf
 	var output *unstructured.Unstructured
 	var outputs []*unstructured.Unstructured
 	var (
-		appRev   = h.currentAppRev
-		appName  = appRev.Spec.Application.Name
-		isHealth = true
+		appRev  = h.currentAppRev
+		appName = appRev.Spec.Application.Name
 	)
 	if comp.CapabilityCategory == types.TerraformCategory {
 		var configuration terraforv1beta2.Configuration
@@ -272,13 +273,13 @@ func (h *AppHandler) collectWorkloadHealthStatus(ctx context.Context, comp *appf
 				if err := h.Client.Get(ctx, client.ObjectKey{Name: comp.Name, Namespace: accessor.Namespace()}, &legacyConfiguration); err != nil {
 					return false, nil, nil, errors.WithMessagef(err, "app=%s, comp=%s, check health error", appName, comp.Name)
 				}
-				isHealth = setStatus(status, legacyConfiguration.Status.ObservedGeneration, legacyConfiguration.Generation,
+				setStatus(status, legacyConfiguration.Status.ObservedGeneration, legacyConfiguration.Generation,
 					legacyConfiguration.GetLabels(), appRev.Name, legacyConfiguration.Status.Apply.State, legacyConfiguration.Status.Apply.Message)
 			} else {
 				return false, nil, nil, errors.WithMessagef(err, "app=%s, comp=%s, check health error", appName, comp.Name)
 			}
 		} else {
-			isHealth = setStatus(status, configuration.Status.ObservedGeneration, configuration.Generation, configuration.GetLabels(),
+			setStatus(status, configuration.Status.ObservedGeneration, configuration.Generation, configuration.GetLabels(),
 				appRev.Name, configuration.Status.Apply.State, configuration.Status.Apply.Message)
 		}
 	} else {
@@ -286,17 +287,24 @@ func (h *AppHandler) collectWorkloadHealthStatus(ctx context.Context, comp *appf
 		if err != nil {
 			return false, nil, nil, errors.WithMessagef(err, "app=%s, comp=%s, get template context error", appName, comp.Name)
 		}
-		if ok, err := comp.EvalHealth(templateContext); !ok || err != nil {
-			isHealth = false
-		}
-		status.Healthy = isHealth
-		status.Message, err = comp.EvalStatus(templateContext)
+		statusResult, err := comp.EvalStatus(templateContext)
 		if err != nil {
 			return false, nil, nil, errors.WithMessagef(err, "app=%s, comp=%s, evaluate workload status message error", appName, comp.Name)
 		}
+		if statusResult != nil {
+			status.Healthy = statusResult.Healthy
+			if statusResult.Message != "" {
+				status.Message = statusResult.Message
+			}
+			if statusResult.Details != nil {
+				status.Details = statusResult.Details
+			}
+		} else {
+			status.Healthy = false
+		}
 		output, outputs = extractOutputAndOutputs(templateContext)
 	}
-	return isHealth, output, outputs, nil
+	return status.Healthy, output, outputs, nil
 }
 
 // nolint
@@ -310,6 +318,7 @@ func (h *AppHandler) collectHealthStatus(ctx context.Context, comp *appfile.Comp
 			Name:               comp.Name,
 			WorkloadDefinition: comp.FullTemplate.Reference.Definition,
 			Healthy:            true,
+			Details:            make(map[string]string),
 			Namespace:          accessor.Namespace(),
 			Cluster:            multicluster.ClusterNameInContext(ctx),
 		}
@@ -361,7 +370,7 @@ collectNext:
 }
 
 func setStatus(status *common.ApplicationComponentStatus, observedGeneration, generation int64, labels map[string]string,
-	appRevName string, state terraformtypes.ConfigurationState, message string) bool {
+	appRevName string, state terraformtypes.ConfigurationState, message string) {
 	isLatest := func() bool {
 		if observedGeneration != 0 && observedGeneration != generation {
 			return false
@@ -377,10 +386,9 @@ func setStatus(status *common.ApplicationComponentStatus, observedGeneration, ge
 	status.Message = message
 	if !isLatest() || state != terraformtypes.Available {
 		status.Healthy = false
-		return false
+		return
 	}
 	status.Healthy = true
-	return true
 }
 
 // ApplyPolicies will render policies into manifests from appfile and dispatch them
diff --git a/pkg/controller/core.oam.dev/v1beta1/application/assemble/assemble.go b/pkg/controller/core.oam.dev/v1beta1/application/assemble/assemble.go
index 1fbb9c03..11153930 100644
--- a/pkg/controller/core.oam.dev/v1beta1/application/assemble/assemble.go
+++ b/pkg/controller/core.oam.dev/v1beta1/application/assemble/assemble.go
@@ -34,15 +34,19 @@ func checkAutoDetectComponent(wl *unstructured.Unstructured) bool {
 }
 
 // PrepareBeforeApply will prepare for some necessary info before apply
-func PrepareBeforeApply(comp *types.ComponentManifest, appRev *v1beta1.ApplicationRevision) (*unstructured.Unstructured, []*unstructured.Unstructured, error) {
+func PrepareBeforeApply(comp *types.ComponentManifest, appRev *v1beta1.ApplicationRevision, disableAllComponentRevision bool) (*unstructured.Unstructured, []*unstructured.Unstructured, error) {
 	if checkAutoDetectComponent(comp.ComponentOutput) {
 		return nil, nil, nil
 	}
 	compRevisionName := comp.RevisionName
 	compName := comp.Name
 	additionalLabel := map[string]string{
-		oam.LabelAppComponentRevision: compRevisionName,
-		oam.LabelAppRevisionHash:      appRev.Labels[oam.LabelAppRevisionHash],
+		oam.LabelAppRevisionHash: appRev.Labels[oam.LabelAppRevisionHash],
+	}
+	// If DisableAllComponentRevision is true, the component revision label is omitted intentionally.
+	// However, if DisableAllComponentRevision is false, the component revision tag will be added even if compRevisionName is empty.
+	if !disableAllComponentRevision {
+		additionalLabel[oam.LabelAppComponentRevision] = compRevisionName
 	}
 	wl := assembleWorkload(compName, comp.ComponentOutput, additionalLabel)
 
diff --git a/pkg/controller/core.oam.dev/v1beta1/application/generator.go b/pkg/controller/core.oam.dev/v1beta1/application/generator.go
index 978e7ba0..ce742ac1 100644
--- a/pkg/controller/core.oam.dev/v1beta1/application/generator.go
+++ b/pkg/controller/core.oam.dev/v1beta1/application/generator.go
@@ -314,20 +314,20 @@ func (h *AppHandler) renderComponentFunc(appParser *appfile.Parser, af *appfile.
 }
 
 func (h *AppHandler) checkComponentHealth(appParser *appfile.Parser, af *appfile.Appfile) oamprovidertypes.ComponentHealthCheck {
-	return func(baseCtx context.Context, comp common.ApplicationComponent, patcher *cue.Value, clusterName string, overrideNamespace string) (bool, *unstructured.Unstructured, []*unstructured.Unstructured, error) {
+	return func(baseCtx context.Context, comp common.ApplicationComponent, patcher *cue.Value, clusterName string, overrideNamespace string) (bool, *common.ApplicationComponentStatus, *unstructured.Unstructured, []*unstructured.Unstructured, error) {
 		ctx := multicluster.ContextWithClusterName(baseCtx, clusterName)
 		ctx = contextWithComponentNamespace(ctx, overrideNamespace)
 		ctx = contextWithReplicaKey(ctx, comp.ReplicaKey)
 
 		wl, manifest, err := h.prepareWorkloadAndManifests(ctx, appParser, comp, patcher, af)
 		if err != nil {
-			return false, nil, nil, err
+			return false, nil, nil, nil, err
 		}
 		wl.Ctx.SetCtx(auth.ContextWithUserInfo(ctx, h.app))
 
 		readyWorkload, readyTraits, err := renderComponentsAndTraits(manifest, h.currentAppRev, clusterName, overrideNamespace)
 		if err != nil {
-			return false, nil, nil, err
+			return false, nil, nil, nil, err
 		}
 		checkSkipApplyWorkload(wl)
 
@@ -336,15 +336,15 @@ func (h *AppHandler) checkComponentHealth(appParser *appfile.Parser, af *appfile
 			dispatchResources = append([]*unstructured.Unstructured{readyWorkload}, readyTraits...)
 		}
 		if !h.resourceKeeper.ContainsResources(dispatchResources) {
-			return false, nil, nil, err
+			return false, nil, nil, nil, err
 		}
 
-		_, output, outputs, isHealth, err := h.collectHealthStatus(auth.ContextWithUserInfo(ctx, h.app), wl, overrideNamespace, false)
+		status, output, outputs, isHealth, err := h.collectHealthStatus(auth.ContextWithUserInfo(ctx, h.app), wl, overrideNamespace, false)
 		if err != nil {
-			return false, nil, nil, err
+			return false, nil, nil, nil, err
 		}
 
-		return isHealth, output, outputs, err
+		return isHealth, status, output, outputs, err
 	}
 }
 
@@ -455,7 +455,7 @@ func (h *AppHandler) prepareWorkloadAndManifests(ctx context.Context,
 }
 
 func renderComponentsAndTraits(manifest *types.ComponentManifest, appRev *v1beta1.ApplicationRevision, clusterName string, overrideNamespace string) (*unstructured.Unstructured, []*unstructured.Unstructured, error) {
-	readyWorkload, readyTraits, err := assemble.PrepareBeforeApply(manifest, appRev)
+	readyWorkload, readyTraits, err := assemble.PrepareBeforeApply(manifest, appRev, DisableAllComponentRevision)
 	if err != nil {
 		return nil, nil, errors.WithMessage(err, "assemble resources before apply fail")
 	}
diff --git a/pkg/controller/core.oam.dev/v1beta1/core/policies/policydefinition/policydefinition_controller.go b/pkg/controller/core.oam.dev/v1beta1/core/policies/policydefinition/policydefinition_controller.go
index 6d60b7b5..5b852383 100644
--- a/pkg/controller/core.oam.dev/v1beta1/core/policies/policydefinition/policydefinition_controller.go
+++ b/pkg/controller/core.oam.dev/v1beta1/core/policies/policydefinition/policydefinition_controller.go
@@ -103,8 +103,8 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
 		policyDefinition.Status.Conditions = []condition.Condition{condition.ReconcileSuccess()}
 
 		if err := r.UpdateStatus(ctx, &policyDefinition); err != nil {
-			klog.InfoS("Could not update policyDefinition Status", "err", err)
-			r.record.Event(&policyDefinition, event.Warning("cannot update PolicyDefinition Status", err))
+			klog.InfoS("Could not update policyDefinition Details", "err", err)
+			r.record.Event(&policyDefinition, event.Warning("cannot update PolicyDefinition Details", err))
 			return ctrl.Result{}, util.PatchCondition(ctx, r, &policyDefinition,
 				condition.ReconcileError(fmt.Errorf(util.ErrUpdatePolicyDefinition, policyDefinition.Name, err)))
 		}
diff --git a/pkg/controller/core.oam.dev/v1beta1/core/revison.go b/pkg/controller/core.oam.dev/v1beta1/core/revison.go
index 905f1627..5230d3fd 100644
--- a/pkg/controller/core.oam.dev/v1beta1/core/revison.go
+++ b/pkg/controller/core.oam.dev/v1beta1/core/revison.go
@@ -435,7 +435,7 @@ func ReconcileDefinitionRevision(ctx context.Context,
 			Revision:     defRev.Spec.Revision,
 			RevisionHash: defRev.Spec.RevisionHash,
 		}); err != nil {
-			klog.ErrorS(err, "Could not update Definition Status")
+			klog.ErrorS(err, "Could not update Definition Details")
 			record.Event(definition, event.Warning("cannot update the definition status", err))
 			return nil, &ctrl.Result{}, util.PatchCondition(ctx, cli, definition,
 				condition.ReconcileError(fmt.Errorf(util.ErrUpdateComponentDefinition, definition.GetName(), err)))
diff --git a/pkg/cue/definition/health/health.go b/pkg/cue/definition/health/health.go
new file mode 100644
index 00000000..ebcbfd50
--- /dev/null
+++ b/pkg/cue/definition/health/health.go
@@ -0,0 +1,248 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package health
+
+import (
+	"encoding/json"
+	"slices"
+	"strings"
+
+	"cuelang.org/go/cue"
+	"cuelang.org/go/cue/cuecontext"
+	"cuelang.org/go/cue/format"
+	"github.com/kubevela/workflow/pkg/cue/model/value"
+	"github.com/pkg/errors"
+	"k8s.io/klog/v2"
+)
+
+const (
+	CustomMessage  = "message"
+	IsHealthPolicy = "isHealth"
+)
+
+type StatusRequest struct {
+	Health    string
+	Custom    string
+	Details   string
+	Parameter map[string]interface{}
+}
+
+type StatusResult struct {
+	Healthy bool              `json:"healthy"`
+	Message string            `json:"message,omitempty"`
+	Details map[string]string `json:"details,omitempty"`
+}
+
+func CheckHealth(templateContext map[string]interface{}, healthPolicyTemplate string, parameter interface{}) (bool, error) {
+	if healthPolicyTemplate == "" {
+		return true, nil
+	}
+	runtimeContextBuff, err := formatRuntimeContext(templateContext, parameter)
+	if err != nil {
+		return false, err
+	}
+	var buff = healthPolicyTemplate + "\n" + runtimeContextBuff
+
+	val := cuecontext.New().CompileString(buff)
+	healthy, err := val.LookupPath(value.FieldPath(IsHealthPolicy)).Bool()
+	if err != nil {
+		return false, errors.WithMessage(err, "evaluate health status")
+	}
+	return healthy, nil
+}
+
+func GetStatus(templateContext map[string]interface{}, request *StatusRequest) (*StatusResult, error) {
+	if templateContext["status"] == nil {
+		templateContext["status"] = make(map[string]interface{})
+	}
+
+	templateContext, statusMap, mapErr := getStatusMap(templateContext, request.Details, request.Parameter)
+	if mapErr != nil {
+		klog.Warningf("failed to get status map: %v", mapErr)
+	}
+
+	healthy, healthErr := CheckHealth(templateContext, request.Health, request.Parameter)
+	if healthErr != nil {
+		klog.Warningf("failed to check health: %v", healthErr)
+	}
+
+	if statusMap, ok := templateContext["status"].(map[string]interface{}); ok {
+		statusMap["healthy"] = healthy
+	} else {
+		klog.Warningf("templateContext['status'] is not a map[string]interface{}, cannot set healthy field")
+	}
+
+	message, msgErr := getStatusMessage(templateContext, request.Custom, request.Parameter)
+	if msgErr != nil {
+		klog.Warningf("failed to get status message: %v", msgErr)
+	}
+
+	return &StatusResult{
+		Healthy: healthy,
+		Message: message,
+		Details: statusMap,
+	}, nil
+}
+
+func getStatusMessage(templateContext map[string]interface{}, customStatusTemplate string, parameter interface{}) (string, error) {
+	if customStatusTemplate == "" {
+		return "", nil
+	}
+	runtimeContextBuff, err := formatRuntimeContext(templateContext, parameter)
+	if err != nil {
+		return "", err
+	}
+	var buff = customStatusTemplate + "\n" + runtimeContextBuff
+
+	val := cuecontext.New().CompileString(buff)
+	if val.Err() != nil {
+		return "", errors.WithMessage(val.Err(), "compile status template")
+	}
+	message, err := val.LookupPath(value.FieldPath(CustomMessage)).String()
+	if err != nil {
+		return "", errors.WithMessage(err, "evaluate customStatus.message")
+	}
+	return message, nil
+}
+
+func getStatusMap(templateContext map[string]interface{}, statusFields string, parameter interface{}) (map[string]interface{}, map[string]string, error) {
+	status := make(map[string]string)
+
+	if templateContext["status"] == nil {
+		templateContext["status"] = make(map[string]interface{})
+	}
+
+	if statusFields == "" {
+		return templateContext, status, nil
+	}
+
+	runtimeContextBuff, err := formatRuntimeContext(templateContext, parameter)
+	if err != nil {
+		return templateContext, status, errors.WithMessage(err, "format runtime context")
+	}
+	cueCtx := cuecontext.New()
+
+	var contextLabels []string
+	contextVal := cueCtx.CompileString(runtimeContextBuff)
+	iter, err := contextVal.Fields(cue.All())
+	if err != nil {
+		return templateContext, nil, errors.WithMessage(err, "get context fields")
+	}
+	for iter.Next() {
+		contextLabels = append(contextLabels, iter.Label())
+	}
+
+	cueBuffer := runtimeContextBuff + "\n" + statusFields
+	val := cueCtx.CompileString(cueBuffer)
+	if val.Err() != nil {
+		return templateContext, nil, errors.WithMessage(val.Err(), "compile status fields template")
+	}
+	iter, err = val.Fields()
+	if err != nil {
+		return templateContext, nil, errors.WithMessage(err, "get status fields")
+	}
+
+	detailsMap := make(map[string]interface{})
+
+outer:
+	for iter.Next() {
+		label := iter.Label()
+
+		if len(label) >= 32 {
+			klog.Warningf("status.details field label %s is too long, skipping", label)
+			continue // Skip labels that are too long
+		}
+
+		if slices.Contains(contextLabels, label) {
+			continue // Skip fields that are already in the context
+		}
+
+		v := iter.Value()
+
+		// Check if field should be excluded via attributes
+		shouldExclude := false
+		for _, a := range v.Attributes(cue.FieldAttr) {
+			if a.Name() == "local" || a.Name() == "private" {
+				shouldExclude = true
+				break
+			}
+		}
+
+		// For $ fields, include in context but not in status map
+		if strings.HasPrefix(label, "$") {
+			if err = v.Value().Validate(cue.Concrete(true)); err == nil {
+				var nonStringValue interface{}
+				if err := v.Value().Decode(&nonStringValue); err == nil {
+					detailsMap[label] = nonStringValue
+				}
+			}
+			continue // Skip adding to status map
+		}
+
+		// Skip excluded fields entirely
+		if shouldExclude {
+			continue outer
+		}
+
+		if err = v.Value().Validate(cue.Concrete(true)); err == nil {
+			var nonStringValue interface{}
+			if err := v.Value().Decode(&nonStringValue); err == nil {
+				detailsMap[label] = nonStringValue
+			}
+
+			if v.Value().IncompleteKind() == cue.StringKind {
+				status[label], _ = v.Value().String()
+				continue
+			}
+			node := v.Value().Syntax(cue.Final())
+			b, err := format.Node(node)
+			if err != nil {
+				return templateContext, nil, errors.WithMessagef(err, "format status field %s", label)
+			}
+			status[label] = string(b)
+		} else {
+			status[label] = cue.BottomKind.String() // Use a default value for invalid fields
+		}
+	}
+
+	if statusContext, ok := templateContext["status"].(map[string]interface{}); ok {
+		statusContext["details"] = detailsMap
+	} else {
+		klog.Warningf("templateContext['status'] is not a map[string]interface{}, cannot store details")
+	}
+
+	return templateContext, status, nil
+}
+
+func formatRuntimeContext(templateContext map[string]interface{}, parameter interface{}) (string, error) {
+	var paramBuff = "parameter: {}\n"
+
+	bt, err := json.Marshal(templateContext)
+	if err != nil {
+		return "", errors.WithMessage(err, "json marshal template context")
+	}
+	ctxBuff := "context: " + string(bt) + "\n"
+
+	bt, err = json.Marshal(parameter)
+	if err != nil {
+		return "", errors.WithMessage(err, "json marshal template parameters")
+	}
+	if string(bt) != "null" {
+		paramBuff = "parameter: " + string(bt) + "\n"
+	}
+	return ctxBuff + paramBuff, nil
+}
diff --git a/pkg/cue/definition/template.go b/pkg/cue/definition/template.go
index 1a9e6a85..b16e92a5 100644
--- a/pkg/cue/definition/template.go
+++ b/pkg/cue/definition/template.go
@@ -22,10 +22,11 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/oam-dev/kubevela/pkg/cue/definition/health"
+
 	"github.com/kubevela/pkg/cue/cuex"
 
 	"cuelang.org/go/cue"
-	"cuelang.org/go/cue/cuecontext"
 	"github.com/kubevela/pkg/multicluster"
 
 	"github.com/pkg/errors"
@@ -52,10 +53,6 @@ const (
 	PatchFieldName = "patch"
 	// PatchOutputsFieldName is the name of the struct contains the patch of outputs CR data
 	PatchOutputsFieldName = "patchOutputs"
-	// CustomMessage defines the custom message in definition template
-	CustomMessage = "message"
-	// HealthCheckPolicy defines the health check policy in definition template
-	HealthCheckPolicy = "isHealth"
 	// ErrsFieldName check if errors contained in the cue
 	ErrsFieldName = "errs"
 )
@@ -69,8 +66,7 @@ const (
 // AbstractEngine defines Definition's Render interface
 type AbstractEngine interface {
 	Complete(ctx process.Context, abstractTemplate string, params interface{}) error
-	HealthCheck(templateContext map[string]interface{}, healthPolicyTemplate string, parameter interface{}) (bool, error)
-	Status(templateContext map[string]interface{}, customStatusTemplate string, parameter interface{}) (string, error)
+	Status(templateContext map[string]interface{}, request *health.StatusRequest) (*health.StatusResult, error)
 	GetTemplateContext(ctx process.Context, cli client.Client, accessor util.NamespaceAccessor) (map[string]interface{}, error)
 }
 
@@ -208,72 +204,9 @@ func (wd *workloadDef) getTemplateContext(ctx process.Context, cli client.Reader
 	return root, nil
 }
 
-func formatRuntimeContext(templateContext map[string]interface{}, parameter interface{}) (string, error) {
-	var paramBuff = "parameter: {}\n"
-
-	bt, err := json.Marshal(templateContext)
-	if err != nil {
-		return "", errors.WithMessage(err, "json marshal template context")
-	}
-	ctxBuff := "context: " + string(bt) + "\n"
-
-	bt, err = json.Marshal(parameter)
-	if err != nil {
-		return "", errors.WithMessage(err, "json marshal template parameters")
-	}
-	if string(bt) != "null" {
-		paramBuff = "parameter: " + string(bt) + "\n"
-	}
-	return ctxBuff + paramBuff, nil
-}
-
-// HealthCheck address health check for workload
-func (wd *workloadDef) HealthCheck(templateContext map[string]interface{}, healthPolicyTemplate string, parameter interface{}) (bool, error) {
-	return checkHealth(templateContext, healthPolicyTemplate, parameter)
-}
-
-func checkHealth(templateContext map[string]interface{}, healthPolicyTemplate string, parameter interface{}) (bool, error) {
-	if healthPolicyTemplate == "" {
-		return true, nil
-	}
-	runtimeContextBuff, err := formatRuntimeContext(templateContext, parameter)
-	if err != nil {
-		return false, err
-	}
-	var buff = healthPolicyTemplate + "\n" + runtimeContextBuff
-
-	val := cuecontext.New().CompileString(buff)
-	healthy, err := val.LookupPath(value.FieldPath(HealthCheckPolicy)).Bool()
-	if err != nil {
-		return false, errors.WithMessage(err, "evaluate health status")
-	}
-	return healthy, nil
-}
-
 // Status get workload status by customStatusTemplate
-func (wd *workloadDef) Status(templateContext map[string]interface{}, customStatusTemplate string, parameter interface{}) (string, error) {
-	return getStatusMessage(templateContext, customStatusTemplate, parameter)
-}
-
-func getStatusMessage(templateContext map[string]interface{}, customStatusTemplate string, parameter interface{}) (string, error) {
-	if customStatusTemplate == "" {
-		return "", nil
-	}
-	runtimeContextBuff, err := formatRuntimeContext(templateContext, parameter)
-	if err != nil {
-		return "", err
-	}
-	var buff = customStatusTemplate + "\n" + runtimeContextBuff
-
-	val := cuecontext.New().CompileString(buff)
-	if val.Err() != nil {
-		return "", errors.WithMessage(val.Err(), "compile status template")
-	}
-	message, err := val.LookupPath(value.FieldPath(CustomMessage)).String()
-	if err != nil {
-		return "", errors.WithMessage(err, "evaluate customStatus.message")
-	}
-	return message, nil
+func (wd *workloadDef) Status(templateContext map[string]interface{}, request *health.StatusRequest) (*health.StatusResult, error) {
+	return health.GetStatus(templateContext, request)
 }
 
 func (wd *workloadDef) GetTemplateContext(ctx process.Context, cli client.Client, accessor util.NamespaceAccessor) (map[string]interface{}, error) {
@@ -467,13 +400,8 @@ func (td *traitDef) getTemplateContext(ctx process.Context, cli client.Reader, a
 }
 
 // Status get trait status by customStatusTemplate
-func (td *traitDef) Status(templateContext map[string]interface{}, customStatusTemplate string, parameter interface{}) (string, error) {
-	return getStatusMessage(templateContext, customStatusTemplate, parameter)
-}
-
-// HealthCheck address health check for trait
-func (td *traitDef) HealthCheck(templateContext map[string]interface{}, healthPolicyTemplate string, parameter interface{}) (bool, error) {
-	return checkHealth(templateContext, healthPolicyTemplate, parameter)
+func (td *traitDef) Status(templateContext map[string]interface{}, request *health.StatusRequest) (*health.StatusResult, error) {
+	return health.GetStatus(templateContext, request)
 }
 
 func (td *traitDef) GetTemplateContext(ctx process.Context, cli client.Client, accessor util.NamespaceAccessor) (map[string]interface{}, error) {
diff --git a/pkg/definition/ast/transformer.go b/pkg/definition/ast/transformer.go
new file mode 100644
index 00000000..987b022e
--- /dev/null
+++ b/pkg/definition/ast/transformer.go
@@ -0,0 +1,206 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package ast
+
+import (
+	"fmt"
+	"strings"
+
+	"cuelang.org/go/cue/ast"
+	"cuelang.org/go/cue/parser"
+	"cuelang.org/go/cue/token"
+)
+
+const (
+	// status is the path to the status field in the metadata
+	status       = "attributes.status.details"
+	healthPolicy = "attributes.status.healthPolicy"
+	customStatus = "attributes.status.customStatus"
+	// localFieldPrefix is the prefix for local fields not output to the status
+	localFieldPrefix = "$"
+)
+
+// EncodeMetadata encodes native CUE in the metadata fields to a CUE string literal
+func EncodeMetadata(field *ast.Field) error {
+	if err := marshalField[*ast.StructLit](field, healthPolicy, validateHealthPolicyField); err != nil {
+		return err
+	}
+	if err := marshalField[*ast.StructLit](field, customStatus, validateCustomStatusField); err != nil {
+		return err
+	}
+	if err := marshalField[*ast.StructLit](field, status, validateStatusField); err != nil {
+		return err
+	}
+	return nil
+}
+
+// DecodeMetadata decodes a CUE string literal in the metadata fields to native CUE expressions
+func DecodeMetadata(field *ast.Field) error {
+	if err := unmarshalField[*ast.StructLit](field, healthPolicy, validateHealthPolicyField); err != nil {
+		return err
+	}
+	if err := unmarshalField[*ast.StructLit](field, customStatus, validateCustomStatusField); err != nil {
+		return err
+	}
+	if err := unmarshalField[*ast.StructLit](field, status, validateStatusField); err != nil {
+		return err
+	}
+	return nil
+}
+
+func marshalField[T ast.Node](field *ast.Field, key string, validator func(T) error) error {
+	if statusField, ok := GetFieldByPath(field, key); ok {
+		switch expr := statusField.Value.(type) {
+		case *ast.BasicLit:
+			if expr.Kind != token.STRING {
+				return fmt.Errorf("expected %s field to be string, got %v", key, expr.Kind)
+			}
+			if err := ValidateCueStringLiteral[T](expr, validator); err != nil {
+				return fmt.Errorf("%s field failed validation: %w", key, err)
+			}
+			return nil
+
+		case *ast.StructLit:
+			structLit := expr
+			v, ok := ast.Node(structLit).(T)
+			if !ok {
+				return fmt.Errorf("%s field: cannot convert *ast.StructLit to expected type", key)
+			}
+			err := validator(v)
+			if err != nil {
+				return err
+			}
+			strLit, err := StringifyStructLitAsCueString(structLit)
+			if err != nil {
+				return err
+			}
+			UpdateNodeByPath(field, key, strLit)
+			return nil
+
+		default:
+			return fmt.Errorf("unexpected type for %s field: %T", key, expr)
+		}
+	}
+	return nil
+}
+
+func unmarshalField[T ast.Node](field *ast.Field, key string, validator func(T) error) error {
+	if statusField, ok := GetFieldByPath(field, key); ok {
+		basicLit, ok := statusField.Value.(*ast.BasicLit)
+		if !ok || basicLit.Kind != token.STRING {
+			return fmt.Errorf("%s field is not a string literal", key)
+		}
+
+		err := ValidateCueStringLiteral[T](basicLit, validator)
+		if err != nil {
+			return fmt.Errorf("%s field failed validation: %w", key, err)
+		}
+
+		unquoted := strings.TrimSpace(TrimCueRawString(basicLit.Value))
+		expr, err := parser.ParseExpr("-", WrapCueStruct(unquoted))
+		if err != nil {
+			return fmt.Errorf("unexpected error re-parsing validated %s string: %w", key, err)
+		}
+
+		structLit, ok := expr.(*ast.StructLit)
+		if !ok {
+			return fmt.Errorf("expected struct after validation in field %s", key)
+		}
+
+		statusField.Value = structLit
+	}
+	return nil
+}
+
+func validateStatusField(sl *ast.StructLit) error {
+	for _, elt := range sl.Elts {
+		f, ok := elt.(*ast.Field)
+		if !ok {
+			return fmt.Errorf("status.details contains non-field element")
+		}
+
+		label := GetFieldLabel(f.Label)
+
+		if strings.HasPrefix(label, localFieldPrefix) {
+			continue
+		}
+
+		switch f.Value.(type) {
+		case *ast.BasicLit,
+			*ast.Ident,
+			*ast.SelectorExpr,
+			*ast.CallExpr,
+			*ast.BinaryExpr:
+			continue
+		default:
+			return fmt.Errorf("status.details field %q contains unsupported expression type %T", label, f.Value)
+		}
+	}
+	return nil
+}
+
+func validateCustomStatusField(sl *ast.StructLit) error {
+	validator := func(expr ast.Expr) error {
+		switch v := expr.(type) {
+		case *ast.BasicLit:
+			if v.Kind != token.STRING {
+				return fmt.Errorf("customStatus field 'message' must be a string, got %v", v.Kind)
+			}
+		case *ast.Interpolation, *ast.CallExpr, *ast.SelectorExpr, *ast.Ident, *ast.BinaryExpr, *ast.ParenExpr,
+			*ast.ListLit, *ast.IndexExpr, *ast.SliceExpr, *ast.Comprehension:
+		default:
+			return fmt.Errorf("customStatus field 'message' must be a string expression, got %T", v)
+		}
+		return nil
+	}
+
+	found, err := FindAndValidateField(sl, "message", validator)
+	if err != nil {
+		return err
+	}
+	if !found {
+		return fmt.Errorf("customStatus must contain a 'message' field")
+	}
+
+	return nil
+}
+
+func validateHealthPolicyField(sl *ast.StructLit) error {
+	validator := func(expr ast.Expr) error {
+		switch v := expr.(type) {
+		case *ast.Ident:
+		case *ast.BasicLit:
+			if v.Kind != token.TRUE && v.Kind != token.FALSE {
+				return fmt.Errorf("healthPolicy field 'isHealth' must be a boolean literal (true/false), got %v", v.Kind)
+			}
+		case *ast.BinaryExpr, *ast.UnaryExpr, *ast.CallExpr, *ast.SelectorExpr, *ast.ParenExpr:
+		default:
+			return fmt.Errorf("healthPolicy field 'isHealth' must be a boolean expression, got %T", v)
+		}
+		return nil
+	}
+
+	found, err := FindAndValidateField(sl, "isHealth", validator)
+	if err != nil {
+		return err
+	}
+	if !found {
+		return fmt.Errorf("healthPolicy must contain an 'isHealth' field")
+	}
+
+	return nil
+}
diff --git a/pkg/definition/ast/utils.go b/pkg/definition/ast/utils.go
new file mode 100644
index 00000000..ba683cc2
--- /dev/null
+++ b/pkg/definition/ast/utils.go
@@ -0,0 +1,297 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package ast
+
+import (
+	"fmt"
+	"strings"
+
+	"cuelang.org/go/cue/ast"
+	"cuelang.org/go/cue/format"
+	"cuelang.org/go/cue/parser"
+	"cuelang.org/go/cue/token"
+	"cuelang.org/go/pkg/strconv"
+)
+
+// GetFieldByPath retrieves a field by its path in the AST
+func GetFieldByPath(node ast.Node, path string) (*ast.Field, bool) {
+	_, field, ok := GetNodeByPath(node, path)
+	return field, ok
+}
+
+// GetNodeByPath retrieves a node by its path in the AST
+func GetNodeByPath(node ast.Node, path string) (ast.Node, *ast.Field, bool) {
+	if path == "" || node == nil {
+		return nil, nil, false
+	}
+
+	pathParts := strings.Split(path, ".")
+
+	switch n := node.(type) {
+	case *ast.File:
+		startField, val, ok := lookupTopLevelField(n, pathParts[0])
+		if !ok {
+			return nil, nil, false
+		}
+		if len(pathParts) == 1 {
+			return val, startField, true
+		}
+		return traversePath(val, pathParts[1:], startField)
+
+	case *ast.Field:
+		label := GetFieldLabel(n.Label)
+		if label == pathParts[0] {
+			if len(pathParts) == 1 {
+				return n, n, true
+			}
+			return traversePath(n.Value, pathParts[1:], n)
+		}
+		return traversePath(n.Value, pathParts, nil)
+
+	case *ast.StructLit:
+		return traversePath(n, pathParts, nil)
+
+	default:
+		return nil, nil, false
+	}
+}
+
+// UpdateNodeByPath updates a node in the AST by its path
+func UpdateNodeByPath(root ast.Node, path string, newExpr ast.Expr) bool {
+	_, field, ok := GetNodeByPath(root, path)
+	if !ok || field == nil {
+		return false
+	}
+	field.Value = newExpr
+	return true
+}
+
+// GetFieldLabel retrieves the label of a field in the AST
+func GetFieldLabel(label ast.Label) string {
+	if label == nil {
+		return ""
+	}
+	switch l := label.(type) {
+	case *ast.Ident:
+		return l.Name
+	case *ast.BasicLit:
+		return strings.Trim(l.Value, `"`)
+	default:
+		return ""
+	}
+}
+
+// StringifyStructLitAsCueString converts a StructLit to a CUE string literal representation
+func StringifyStructLitAsCueString(structLit *ast.StructLit) (*ast.BasicLit, error) {
+	if len(structLit.Elts) == 0 {
+		return &ast.BasicLit{
+			Kind:  token.STRING,
+			Value: `"{}"`,
+		}, nil
+	}
+
+	formatted, err := format.Node(structLit)
+	if err != nil {
+		return nil, fmt.Errorf("failed to format struct: %w", err)
+	}
+
+	content := string(formatted)
+
+	content = strings.TrimSpace(content)
+	if strings.HasPrefix(content, "{") && strings.HasSuffix(content, "}") {
+		content = strings.TrimPrefix(content, "{")
+		content = strings.TrimSuffix(content, "}")
+		content = strings.Trim(content, "\n")
+	}
+
+	if content == "" {
+		return &ast.BasicLit{
+			Kind:  token.STRING,
+			Value: `"{}"`,
+		}, nil
+	}
+	lines := strings.Split(content, "\n")
+
+	var sb strings.Builder
+	sb.WriteString(`#"""`)
+	sb.WriteString("\n")
+	sb.WriteString(strings.Join(lines, "\n"))
+	sb.WriteString("\n")
+	sb.WriteString(`"""#`)
+
+	result := strings.ReplaceAll(sb.String(), "\t", "  ")
+
+	return &ast.BasicLit{
+		Kind:  token.STRING,
+		Value: result,
+	}, nil
+}
+
+// ValidateCueStringLiteral validates a CUE string literal by parsing it and applying a custom validator function
+func ValidateCueStringLiteral[T ast.Node](lit *ast.BasicLit, validator func(T) error) error {
+	if lit.Kind != token.STRING {
+		return fmt.Errorf("not a string literal")
+	}
+
+	raw := TrimCueRawString(lit.Value)
+	if raw == "" {
+		return nil
+	}
+
+	wrapped := WrapCueStruct(raw)
+
+	expr, err := parser.ParseExpr("-", wrapped)
+	if err != nil {
+		return fmt.Errorf("invalid cue content in string literal: %w", err)
+	}
+
+	node, ok := expr.(T)
+	if !ok {
+		return fmt.Errorf("parsed expression is not of expected type %T", *new(T))
+	}
+
+	return validator(node)
+}
+
+// TrimCueRawString trims a CUE raw string literal and handles escape sequences
+func TrimCueRawString(s string) string {
+	s = strings.TrimSpace(s)
+	switch {
+	case strings.HasPrefix(s, `#"""`) && strings.HasSuffix(s, `"""#`):
+		s = strings.TrimSuffix(strings.TrimPrefix(s, `#"""`), `"""#`)
+	case strings.HasPrefix(s, `"""`) && strings.HasSuffix(s, `"""`):
+		s = strings.TrimSuffix(strings.TrimPrefix(s, `"""`), `"""`)
+	default:
+		fallback, err := strconv.Unquote(s)
+		if err == nil {
+			s = fallback
+		}
+	}
+
+	// Handle escape sequences for backward compatibility with existing definitions
+	// For quoted strings (after strconv.Unquote): replace actual tab characters
+	s = strings.ReplaceAll(s, "\t", "  ")
+	// For raw strings (not unquoted): replace literal \t
+	s = strings.ReplaceAll(s, "\\t", "  ")
+	s = strings.ReplaceAll(s, "\\\\", "\\")
+
+	return s
+}
+
+// WrapCueStruct wraps a string in a CUE struct format
+func WrapCueStruct(s string) string {
+	return fmt.Sprintf("{\n%s\n}", s)
+}
+
+// FindAndValidateField searches for a field at the top level or within top-level if statements
+func FindAndValidateField(sl *ast.StructLit, fieldName string, validator fieldValidator) (found bool, err error) {
+	// First check top-level fields
+	for _, elt := range sl.Elts {
+		if field, ok := elt.(*ast.Field); ok {
+			label := GetFieldLabel(field.Label)
+			if label == fieldName {
+				found = true
+				if validator != nil {
+					err = validator(field.Value)
+				}
+				return found, err
+			}
+		}
+	}
+
+	// If not found at top level, check within top-level if statements
+	for _, elt := range sl.Elts {
+		if comp, ok := elt.(*ast.Comprehension); ok {
+			// Check if this comprehension has if clauses (conditional fields)
+			hasIfClause := false
+			for _, clause := range comp.Clauses {
+				if _, ok := clause.(*ast.IfClause); ok {
+					hasIfClause = true
+					break
+				}
+			}
+
+			// If it has an if clause and the value is a struct, search within it
+			if hasIfClause {
+				if structLit, ok := comp.Value.(*ast.StructLit); ok {
+					if innerFound, innerErr := FindAndValidateField(structLit, fieldName, validator); innerFound {
+						return true, innerErr
+					}
+				}
+			}
+		}
+	}
+
+	return found, err
+}
+
+func lookupTopLevelField(node ast.Node, key string) (*ast.Field, ast.Expr, bool) {
+	switch n := node.(type) {
+	case *ast.Field:
+		if GetFieldLabel(n.Label) == key {
+			return n, n.Value, true
+		}
+	case *ast.StructLit:
+		for _, decl := range n.Elts {
+			if f, ok := decl.(*ast.Field); ok && GetFieldLabel(f.Label) == key {
+				return f, f.Value, true
+			}
+		}
+	case *ast.File:
+		for _, decl := range n.Decls {
+			if f, ok := decl.(*ast.Field); ok && GetFieldLabel(f.Label) == key {
+				return f, f.Value, true
+			}
+		}
+	}
+	return nil, nil, false
+}
+
+// fieldValidator is a function that validates a field's value
+type fieldValidator func(ast.Expr) error
+
+func traversePath(val ast.Expr, pathParts []string, lastField *ast.Field) (ast.Node, *ast.Field, bool) {
+	currentField := lastField
+	currentVal := val
+
+	for _, part := range pathParts {
+		structLit, ok := currentVal.(*ast.StructLit)
+		if !ok {
+			return nil, nil, false
+		}
+
+		found := false
+		for _, decl := range structLit.Elts {
+			f, ok := decl.(*ast.Field)
+			if !ok {
+				continue
+			}
+			if GetFieldLabel(f.Label) == part {
+				currentVal = f.Value
+				currentField = f
+				found = true
+				break
+			}
+		}
+
+		if !found {
+			return nil, nil, false
+		}
+	}
+
+	return currentVal, currentField, true
+}
diff --git a/pkg/definition/definition.go b/pkg/definition/definition.go
index de0a9400..2afe1dd1 100644
--- a/pkg/definition/definition.go
+++ b/pkg/definition/definition.go
@@ -24,6 +24,8 @@ import (
 	"fmt"
 	"strings"
 
+	ast2 "github.com/oam-dev/kubevela/pkg/definition/ast"
+
 	"cuelang.org/go/cue"
 	"cuelang.org/go/cue/ast"
 	"cuelang.org/go/cue/cuecontext"
@@ -41,7 +43,6 @@ import (
 	"sigs.k8s.io/yaml"
 
 	"github.com/kubevela/pkg/cue/cuex"
-	"github.com/kubevela/workflow/pkg/cue/model/sets"
 
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/v1beta1"
@@ -200,7 +201,22 @@ func (def *Definition) ToCUEString() (string, error) {
 	if err != nil {
 		return "", err
 	}
-	metadataString, err := sets.ToString(*val)
+
+	var metadataString string
+	syntax := val.Syntax()
+	if sl, ok := syntax.(*ast.StructLit); ok {
+		field, err := findAndDecodeFieldByLabel(sl, def.GetName())
+		if err != nil {
+			return "", err
+		}
+		if field != nil {
+			metadataString, err = formatFieldToString(field)
+			if err != nil {
+				return "", errors.Wrapf(err, "failed to format metadata field %s", def.GetName())
+			}
+		}
+	}
+
 	if err != nil {
 		return "", err
 	}
@@ -378,6 +394,15 @@ func (def *Definition) FromYAML(data []byte) error {
 	return yaml.Unmarshal(data, def)
 }
 
+// ValidDefinitionTypes return the list of valid definition types
+func ValidDefinitionTypes() []string {
+	var types []string
+	for k := range DefinitionTypeToKind {
+		types = append(types, k)
+	}
+	return types
+}
+
 // FromCUEString converts cue string into Definition
 func (def *Definition) FromCUEString(cueString string, _ *rest.Config) error {
 	// cuectx := cuecontext.New()
@@ -408,6 +433,10 @@ func (def *Definition) FromCUEString(cueString string, _ *rest.Config) error {
 					return errors.Errorf("unexpected decl found in template: %v", decl)
 				}
 			} else {
+				err := ast2.EncodeMetadata(field)
+				if err != nil {
+					return errors.Wrapf(err, "failed to parse metadata %s", label)
+				}
 				metadataDecls = append(metadataDecls, field)
 			}
 		}
@@ -444,15 +473,6 @@ func (def *Definition) FromCUEString(cueString string, _ *rest.Config) error {
 	return def.FromCUE(&inst, templateString)
 }
 
-// ValidDefinitionTypes return the list of valid definition types
-func ValidDefinitionTypes() []string {
-	var types []string
-	for k := range DefinitionTypeToKind {
-		types = append(types, k)
-	}
-	return types
-}
-
 // SearchDefinition search the Definition in k8s by traversing all possible results across types or namespaces
 func SearchDefinition(c client.Client, definitionType, namespace string, additionalFilters ...filters.Filter) ([]unstructured.Unstructured, error) {
 	ctx := context.Background()
@@ -639,3 +659,28 @@ func formatCUEString(cueString string) (string, error) {
 	}
 	return string(b), nil
 }
+
+func findAndDecodeFieldByLabel(slit *ast.StructLit, targetLabel string) (*ast.Field, error) {
+	for _, decl := range slit.Elts {
+		field, ok := decl.(*ast.Field)
+		if !ok {
+			continue
+		}
+		label := ast2.GetFieldLabel(field.Label)
+		if label == targetLabel {
+			if err := ast2.DecodeMetadata(field); err != nil {
+				return nil, err
+			}
+			return field, nil
+		}
+	}
+	return nil, nil
+}
+
+func formatFieldToString(field *ast.Field) (string, error) {
+	b, err := format.Node(field)
+	if err != nil {
+		return "", errors.Wrap(err, "failed to format field")
+	}
+	return string(b), nil
+}
diff --git a/pkg/features/controller_features.go b/pkg/features/controller_features.go
index 8aa600ae..841cca98 100644
--- a/pkg/features/controller_features.go
+++ b/pkg/features/controller_features.go
@@ -54,6 +54,8 @@ const (
 
 	// AuthenticateApplication enable the authentication for application
 	AuthenticateApplication featuregate.Feature = "AuthenticateApplication"
+	// ValidateDefinitionPermissions enables RBAC validation for definition access in applications
+	ValidateDefinitionPermissions featuregate.Feature = "ValidateDefinitionPermissions"
 	// GzipResourceTracker enables the gzip compression for ResourceTracker. It can be useful if you have large
 	// application that needs to dispatch lots of resources or large resources (like CRD or huge ConfigMap),
 	// which at the cost of slower processing speed due to the extra overhead for compression and decompression.
@@ -114,6 +116,9 @@ const (
 
 	// EnableCueValidation enable strict cue validation fields for the required parameter field verification
 	EnableCueValidation = "EnableCueValidation"
+
+	// EnableApplicationStatusMetrics enable the collection and export of application status metrics and structured logging
+	EnableApplicationStatusMetrics = "EnableApplicationStatusMetrics"
 )
 
 var defaultFeatureGates = map[featuregate.Feature]featuregate.FeatureSpec{
@@ -125,6 +130,7 @@ var defaultFeatureGates = map[featuregate.Feature]featuregate.FeatureSpec{
 	DisableReferObjectsFromURL:                    {Default: false, PreRelease: featuregate.Alpha},
 	ApplyResourceByReplace:                        {Default: false, PreRelease: featuregate.Alpha},
 	AuthenticateApplication:                       {Default: false, PreRelease: featuregate.Alpha},
+	ValidateDefinitionPermissions:                 {Default: false, PreRelease: featuregate.Alpha},
 	GzipResourceTracker:                           {Default: false, PreRelease: featuregate.Alpha},
 	ZstdResourceTracker:                           {Default: false, PreRelease: featuregate.Alpha},
 	ApplyOnce:                                     {Default: false, PreRelease: featuregate.Alpha},
@@ -139,6 +145,7 @@ var defaultFeatureGates = map[featuregate.Feature]featuregate.FeatureSpec{
 	SharedDefinitionStorageForApplicationRevision: {Default: true, PreRelease: featuregate.Alpha},
 	DisableWorkflowContextConfigMapCache:          {Default: true, PreRelease: featuregate.Alpha},
 	EnableCueValidation:                           {Default: false, PreRelease: featuregate.Beta},
+	EnableApplicationStatusMetrics:                {Default: false, PreRelease: featuregate.Alpha},
 }
 
 func init() {
diff --git a/pkg/monitor/metrics/application.go b/pkg/monitor/metrics/application.go
index a80a4318..6831e864 100644
--- a/pkg/monitor/metrics/application.go
+++ b/pkg/monitor/metrics/application.go
@@ -66,6 +66,27 @@ var (
 		Name: "workflow_step_phase_number",
 		Help: "workflow step phase number",
 	}, []string{"step_type", "phase"})
+
+	// ApplicationHealthStatus reports the overall health status of each application
+	ApplicationHealthStatus = prometheus.NewGaugeVec(prometheus.GaugeOpts{
+		Name: "kubevela_application_health_status",
+		Help: "Application health status (1 = healthy, 0 = unhealthy)",
+	}, []string{"app_name", "namespace"})
+
+	// ApplicationPhase reports the numeric phase of each application
+	ApplicationPhase = prometheus.NewGaugeVec(prometheus.GaugeOpts{
+		Name: "kubevela_application_phase",
+		Help: "Application phase as numeric value (0=starting, 1=running, 2=rendering, 3=policy_generating, 4=running_workflow, " +
+			"5=workflow_suspending, 6=workflow_terminated, 7=workflow_failed, 8=unhealthy, 9=deleting, " +
+			"-1=unknown)",
+	}, []string{"app_name", "namespace"})
+
+	// WorkflowPhase reports the numeric phase of each workflow
+	WorkflowPhase = prometheus.NewGaugeVec(prometheus.GaugeOpts{
+		Name: "kubevela_application_workflow_phase",
+		Help: "Workflow phase as numeric value (0=initializing, 1=succeeded, 2=executing, 3=suspending, 4=terminated, " +
+			"5=failed, 6=skipped, -1=unknown)",
+	}, []string{"app_name", "namespace"})
 )
 
 var (
diff --git a/pkg/monitor/metrics/workflow.go b/pkg/monitor/metrics/workflow.go
index a2d41136..314296e8 100644
--- a/pkg/monitor/metrics/workflow.go
+++ b/pkg/monitor/metrics/workflow.go
@@ -15,10 +15,13 @@ package metrics
 
 import (
 	"github.com/prometheus/client_golang/prometheus"
+	"k8s.io/apiserver/pkg/util/feature"
 	"k8s.io/klog/v2"
 	"sigs.k8s.io/controller-runtime/pkg/metrics"
 
 	velametrics "github.com/kubevela/pkg/monitor/metrics"
+
+	"github.com/oam-dev/kubevela/pkg/features"
 )
 
 var (
@@ -53,6 +56,10 @@ var collectorGroup = []prometheus.Collector{
 	ClusterCPUUsageGauge,
 }
 
+var (
+	applicationStatusMetricsRegistered = false
+)
+
 func init() {
 	for _, collector := range collectorGroup {
 		if err := metrics.Registry.Register(collector); err != nil {
@@ -60,3 +67,27 @@ func init() {
 		}
 	}
 }
+
+// RegisterApplicationStatusMetrics registers the application status metrics
+// This should be called after the feature gate system is initialized
+func RegisterApplicationStatusMetrics() {
+	if applicationStatusMetricsRegistered {
+		return
+	}
+
+	if feature.DefaultMutableFeatureGate.Enabled(features.EnableApplicationStatusMetrics) {
+		statusMetrics := []prometheus.Collector{
+			ApplicationHealthStatus,
+			ApplicationPhase,
+			WorkflowPhase,
+		}
+
+		for _, metric := range statusMetrics {
+			if err := metrics.Registry.Register(metric); err != nil {
+				klog.Errorf("Failed to register application status metric: %v", err)
+			}
+		}
+
+		applicationStatusMetricsRegistered = true
+	}
+}
diff --git a/pkg/webhook/core.oam.dev/v1beta1/application/mutating_handler.go b/pkg/webhook/core.oam.dev/v1beta1/application/mutating_handler.go
index 69748b21..d04849c0 100644
--- a/pkg/webhook/core.oam.dev/v1beta1/application/mutating_handler.go
+++ b/pkg/webhook/core.oam.dev/v1beta1/application/mutating_handler.go
@@ -42,7 +42,7 @@ import (
 // MutatingHandler adding user info to application annotations
 type MutatingHandler struct {
 	skipUsers []string
-	Decoder   *admission.Decoder
+	Decoder   admission.Decoder
 }
 
 var _ admission.Handler = &MutatingHandler{}
diff --git a/pkg/webhook/core.oam.dev/v1beta1/application/validating_handler.go b/pkg/webhook/core.oam.dev/v1beta1/application/validating_handler.go
index 72fb0c58..cdc27857 100644
--- a/pkg/webhook/core.oam.dev/v1beta1/application/validating_handler.go
+++ b/pkg/webhook/core.oam.dev/v1beta1/application/validating_handler.go
@@ -40,7 +40,7 @@ var _ admission.Handler = &ValidatingHandler{}
 type ValidatingHandler struct {
 	Client client.Client
 	// Decoder decodes objects
-	Decoder *admission.Decoder
+	Decoder admission.Decoder
 }
 
 func simplifyError(err error) error {
@@ -73,7 +73,7 @@ func (h *ValidatingHandler) Handle(ctx context.Context, req admission.Request) a
 	ctx = util.SetNamespaceInCtx(ctx, app.Namespace)
 	switch req.Operation {
 	case admissionv1.Create:
-		if allErrs := h.ValidateCreate(ctx, app); len(allErrs) > 0 {
+		if allErrs := h.ValidateCreate(ctx, app, req); len(allErrs) > 0 {
 			// http.StatusUnprocessableEntity will NOT report any error descriptions
 			// to the client, use generic http.StatusBadRequest instead.
 			return admission.Errored(http.StatusBadRequest, mergeErrors(allErrs))
@@ -84,7 +84,7 @@ func (h *ValidatingHandler) Handle(ctx context.Context, req admission.Request) a
 			return admission.Errored(http.StatusBadRequest, simplifyError(err))
 		}
 		if app.ObjectMeta.DeletionTimestamp.IsZero() {
-			if allErrs := h.ValidateUpdate(ctx, app, oldApp); len(allErrs) > 0 {
+			if allErrs := h.ValidateUpdate(ctx, app, oldApp, req); len(allErrs) > 0 {
 				return admission.Errored(http.StatusBadRequest, mergeErrors(allErrs))
 			}
 		}
diff --git a/pkg/webhook/core.oam.dev/v1beta1/application/validation.go b/pkg/webhook/core.oam.dev/v1beta1/application/validation.go
index eca6c4fd..6d2842c0 100644
--- a/pkg/webhook/core.oam.dev/v1beta1/application/validation.go
+++ b/pkg/webhook/core.oam.dev/v1beta1/application/validation.go
@@ -19,16 +19,21 @@ package application
 import (
 	"context"
 	"fmt"
+	"reflect"
 	"time"
 
 	"github.com/kubevela/pkg/controller/sharding"
 	"github.com/kubevela/pkg/util/singleton"
+	authv1 "k8s.io/api/authorization/v1"
 	"k8s.io/apimachinery/pkg/util/validation/field"
 	utilfeature "k8s.io/apiserver/pkg/util/feature"
+	"k8s.io/klog/v2"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/v1beta1"
 	"github.com/oam-dev/kubevela/pkg/appfile"
+	"github.com/oam-dev/kubevela/pkg/auth"
 	"github.com/oam-dev/kubevela/pkg/features"
 	"github.com/oam-dev/kubevela/pkg/oam"
 )
@@ -108,6 +113,278 @@ func (h *ValidatingHandler) ValidateComponents(ctx context.Context, app *v1beta1
 	return componentErrs
 }
 
+// checkDefinitionPermission checks if user has permission to access a definition in either system namespace or app namespace
+func (h *ValidatingHandler) checkDefinitionPermission(ctx context.Context, req admission.Request, resource, definitionType, appNamespace string) (bool, error) {
+	// Check permission in system namespace (vela-system) first since most definitions are there
+	// This optimizes for the common case and reduces API calls
+	systemNsSar := &authv1.SubjectAccessReview{
+		Spec: authv1.SubjectAccessReviewSpec{
+			User:   req.UserInfo.Username,
+			Groups: req.UserInfo.Groups,
+			ResourceAttributes: &authv1.ResourceAttributes{
+				Verb:      "get",
+				Group:     "core.oam.dev",
+				Version:   "v1beta1",
+				Resource:  resource,
+				Namespace: oam.SystemDefinitionNamespace,
+				Name:      definitionType,
+			},
+		},
+	}
+
+	if err := h.Client.Create(ctx, systemNsSar); err != nil {
+		return false, fmt.Errorf("failed to check %s permission in system namespace: %w", resource, err)
+	}
+
+	if systemNsSar.Status.Allowed {
+		// User has permission in system namespace - no need to check app namespace
+		return true, nil
+	}
+
+	// If not in system namespace and app namespace is different, check app namespace
+	if appNamespace != oam.SystemDefinitionNamespace {
+		appNsSar := &authv1.SubjectAccessReview{
+			Spec: authv1.SubjectAccessReviewSpec{
+				User:   req.UserInfo.Username,
+				Groups: req.UserInfo.Groups,
+				ResourceAttributes: &authv1.ResourceAttributes{
+					Verb:      "get",
+					Group:     "core.oam.dev",
+					Version:   "v1beta1",
+					Resource:  resource,
+					Namespace: appNamespace,
+					Name:      definitionType,
+				},
+			},
+		}
+
+		if err := h.Client.Create(ctx, appNsSar); err != nil {
+			return false, fmt.Errorf("failed to check %s permission in namespace %s: %w", resource, appNamespace, err)
+		}
+
+		if appNsSar.Status.Allowed {
+			// User has permission in app namespace
+			return true, nil
+		}
+	}
+
+	// User doesn't have permission in either namespace
+	return false, nil
+}
+
+// workflowStepLocation represents the location of a workflow step
+type workflowStepLocation struct {
+	StepIndex    int
+	SubStepIndex int // -1 if not a sub-step
+	IsSubStep    bool
+}
+
+// definitionUsage tracks where each definition type is used in the application
+type definitionUsage struct {
+	componentTypes    map[string][]int
+	traitTypes        map[string][][2]int
+	policyTypes       map[string][]int
+	workflowStepTypes map[string][]workflowStepLocation
+}
+
+// collectDefinitionUsage collects all unique definition types and their locations in the application
+func collectDefinitionUsage(app *v1beta1.Application) *definitionUsage {
+	usage := &definitionUsage{
+		componentTypes:    make(map[string][]int),
+		traitTypes:        make(map[string][][2]int),
+		policyTypes:       make(map[string][]int),
+		workflowStepTypes: make(map[string][]workflowStepLocation),
+	}
+
+	// Collect component and trait types
+	for i, comp := range app.Spec.Components {
+		usage.componentTypes[comp.Type] = append(usage.componentTypes[comp.Type], i)
+
+		for j, trait := range comp.Traits {
+			usage.traitTypes[trait.Type] = append(usage.traitTypes[trait.Type], [2]int{i, j})
+		}
+	}
+
+	// Collect policy types
+	for i, policy := range app.Spec.Policies {
+		usage.policyTypes[policy.Type] = append(usage.policyTypes[policy.Type], i)
+	}
+
+	// Collect workflow step types (including sub-steps)
+	if app.Spec.Workflow != nil {
+		for i, step := range app.Spec.Workflow.Steps {
+			location := workflowStepLocation{
+				StepIndex:    i,
+				SubStepIndex: -1,
+				IsSubStep:    false,
+			}
+			usage.workflowStepTypes[step.Type] = append(usage.workflowStepTypes[step.Type], location)
+
+			// Also check sub-steps
+			for j, subStep := range step.SubSteps {
+				subLocation := workflowStepLocation{
+					StepIndex:    i,
+					SubStepIndex: j,
+					IsSubStep:    true,
+				}
+				usage.workflowStepTypes[subStep.Type] = append(usage.workflowStepTypes[subStep.Type], subLocation)
+			}
+		}
+	}
+
+	return usage
+}
+
+// processDefinitionPermissionCheck handles the common logic for processing permission check results
+func (h *ValidatingHandler) processDefinitionPermissionCheck(
+	allowed bool,
+	err error,
+	req admission.Request,
+	definitionKind string,
+	definitionType string,
+	appNamespace string,
+	fieldPaths []*field.Path,
+) field.ErrorList {
+	var errs field.ErrorList
+
+	if err != nil {
+		klog.Errorf("Failed to check %s permission for user %s: %v", definitionKind, req.UserInfo.Username, err)
+		for _, fieldPath := range fieldPaths {
+			errs = append(errs, field.Forbidden(fieldPath,
+				fmt.Sprintf("unable to verify permissions for %s %q: %v", definitionKind, definitionType, err)))
+		}
+		return errs
+	}
+
+	if !allowed {
+		klog.Infof("User %q does not have permission to access %s %q in namespace %q or %q",
+			req.UserInfo.Username, definitionKind, definitionType, appNamespace, oam.SystemDefinitionNamespace)
+		for _, fieldPath := range fieldPaths {
+			errs = append(errs, field.Forbidden(fieldPath,
+				fmt.Sprintf("user %q cannot get %s %q in namespace %q or %q",
+					req.UserInfo.Username, definitionKind, definitionType, appNamespace, oam.SystemDefinitionNamespace)))
+		}
+	}
+
+	return errs
+}
+
+// fieldPathBuilder is a function that builds field paths for a given definition usage
+type fieldPathBuilder func(interface{}) []*field.Path
+
+// validateDefinitions is a generic function to validate any definition type
+func (h *ValidatingHandler) validateDefinitions(
+	ctx context.Context,
+	req admission.Request,
+	appNamespace string,
+	definitionType reflect.Type,
+	usageMap interface{},
+	buildFieldPaths fieldPathBuilder,
+) field.ErrorList {
+	var errs field.ErrorList
+
+	// Get the definition info for the given type
+	defInfo, ok := v1beta1.DefinitionTypeMap[definitionType]
+	if !ok {
+		klog.Errorf("Unknown definition type: %v", definitionType)
+		return errs
+	}
+
+	switch typedMap := usageMap.(type) {
+	case map[string][]int:
+		for defType, indices := range typedMap {
+			allowed, err := h.checkDefinitionPermission(ctx, req, defInfo.GVR.Resource, defType, appNamespace)
+			fieldPaths := buildFieldPaths(indices)
+			errs = append(errs, h.processDefinitionPermissionCheck(
+				allowed, err, req, defInfo.Kind, defType, appNamespace, fieldPaths)...)
+		}
+	case map[string][][2]int:
+		for defType, locations := range typedMap {
+			allowed, err := h.checkDefinitionPermission(ctx, req, defInfo.GVR.Resource, defType, appNamespace)
+			fieldPaths := buildFieldPaths(locations)
+			errs = append(errs, h.processDefinitionPermissionCheck(
+				allowed, err, req, defInfo.Kind, defType, appNamespace, fieldPaths)...)
+		}
+	case map[string][]workflowStepLocation:
+		for defType, locations := range typedMap {
+			allowed, err := h.checkDefinitionPermission(ctx, req, defInfo.GVR.Resource, defType, appNamespace)
+			fieldPaths := buildFieldPaths(locations)
+			errs = append(errs, h.processDefinitionPermissionCheck(
+				allowed, err, req, defInfo.Kind, defType, appNamespace, fieldPaths)...)
+		}
+	}
+
+	return errs
+}
+
+// ValidateDefinitionPermissions validates that the user has permissions to access all definition types
+func (h *ValidatingHandler) ValidateDefinitionPermissions(ctx context.Context, app *v1beta1.Application, req admission.Request) field.ErrorList {
+	// Requires both authentication and definition validation enabled
+	if !auth.AuthenticationWithUser || !utilfeature.DefaultMutableFeatureGate.Enabled(features.ValidateDefinitionPermissions) {
+		return nil
+	}
+
+	var errs field.ErrorList
+	usage := collectDefinitionUsage(app)
+
+	// Validate ComponentDefinitions
+	errs = append(errs, h.validateDefinitions(ctx, req, app.Namespace,
+		reflect.TypeOf(v1beta1.ComponentDefinition{}), usage.componentTypes,
+		func(indices interface{}) []*field.Path {
+			var paths []*field.Path
+			for _, idx := range indices.([]int) {
+				paths = append(paths, field.NewPath("spec", "components").Index(idx).Child("type"))
+			}
+			return paths
+		})...)
+
+	// Validate TraitDefinitions
+	errs = append(errs, h.validateDefinitions(ctx, req, app.Namespace,
+		reflect.TypeOf(v1beta1.TraitDefinition{}), usage.traitTypes,
+		func(locations interface{}) []*field.Path {
+			var paths []*field.Path
+			for _, loc := range locations.([][2]int) {
+				paths = append(paths,
+					field.NewPath("spec", "components").Index(loc[0]).Child("traits").Index(loc[1]).Child("type"))
+			}
+			return paths
+		})...)
+
+	// Validate PolicyDefinitions
+	errs = append(errs, h.validateDefinitions(ctx, req, app.Namespace,
+		reflect.TypeOf(v1beta1.PolicyDefinition{}), usage.policyTypes,
+		func(indices interface{}) []*field.Path {
+			var paths []*field.Path
+			for _, idx := range indices.([]int) {
+				paths = append(paths, field.NewPath("spec", "policies").Index(idx).Child("type"))
+			}
+			return paths
+		})...)
+
+	// Validate WorkflowStepDefinitions
+	errs = append(errs, h.validateDefinitions(ctx, req, app.Namespace,
+		reflect.TypeOf(v1beta1.WorkflowStepDefinition{}), usage.workflowStepTypes,
+		func(locations interface{}) []*field.Path {
+			var paths []*field.Path
+			for _, loc := range locations.([]workflowStepLocation) {
+				paths = append(paths, getWorkflowStepFieldPath(loc))
+			}
+			return paths
+		})...)
+
+	return errs
+}
+
+// getWorkflowStepFieldPath constructs the field path for a workflow step or sub-step
+func getWorkflowStepFieldPath(loc workflowStepLocation) *field.Path {
+	if !loc.IsSubStep {
+		// Regular step
+		return field.NewPath("spec", "workflow", "steps").Index(loc.StepIndex).Child("type")
+	}
+	// Sub-step
+	return field.NewPath("spec", "workflow", "steps").Index(loc.StepIndex).Child("subSteps").Index(loc.SubStepIndex).Child("type")
+}
+
 // ValidateAnnotations validates whether the application has both autoupdate and publish version annotations
 func (h *ValidatingHandler) ValidateAnnotations(_ context.Context, app *v1beta1.Application) field.ErrorList {
 	var annotationsErrs field.ErrorList
@@ -122,19 +399,20 @@ func (h *ValidatingHandler) ValidateAnnotations(_ context.Context, app *v1beta1.
 }
 
 // ValidateCreate validates the Application on creation
-func (h *ValidatingHandler) ValidateCreate(ctx context.Context, app *v1beta1.Application) field.ErrorList {
+func (h *ValidatingHandler) ValidateCreate(ctx context.Context, app *v1beta1.Application, req admission.Request) field.ErrorList {
 	var errs field.ErrorList
 
 	errs = append(errs, h.ValidateAnnotations(ctx, app)...)
+	errs = append(errs, h.ValidateDefinitionPermissions(ctx, app, req)...)
 	errs = append(errs, h.ValidateWorkflow(ctx, app)...)
 	errs = append(errs, h.ValidateComponents(ctx, app)...)
 	return errs
 }
 
 // ValidateUpdate validates the Application on update
-func (h *ValidatingHandler) ValidateUpdate(ctx context.Context, newApp, _ *v1beta1.Application) field.ErrorList {
+func (h *ValidatingHandler) ValidateUpdate(ctx context.Context, newApp, _ *v1beta1.Application, req admission.Request) field.ErrorList {
 	// check if the newApp is valid
-	errs := h.ValidateCreate(ctx, newApp)
+	errs := h.ValidateCreate(ctx, newApp, req)
 	// TODO: add more validating
 	return errs
 }
diff --git a/pkg/webhook/core.oam.dev/v1beta1/componentdefinition/mutating_handler.go b/pkg/webhook/core.oam.dev/v1beta1/componentdefinition/mutating_handler.go
index 33427ed0..4811d230 100644
--- a/pkg/webhook/core.oam.dev/v1beta1/componentdefinition/mutating_handler.go
+++ b/pkg/webhook/core.oam.dev/v1beta1/componentdefinition/mutating_handler.go
@@ -40,7 +40,7 @@ import (
 type MutatingHandler struct {
 	Client client.Client
 	// Decoder decodes objects
-	Decoder *admission.Decoder
+	Decoder admission.Decoder
 	// AutoGenWorkloadDef indicates whether create workloadDef which componentDef refers to
 	AutoGenWorkloadDef bool
 }
diff --git a/pkg/webhook/core.oam.dev/v1beta1/componentdefinition/validating_handler.go b/pkg/webhook/core.oam.dev/v1beta1/componentdefinition/validating_handler.go
index d18e3090..8622e21a 100644
--- a/pkg/webhook/core.oam.dev/v1beta1/componentdefinition/validating_handler.go
+++ b/pkg/webhook/core.oam.dev/v1beta1/componentdefinition/validating_handler.go
@@ -35,12 +35,12 @@ import (
 	webhookutils "github.com/oam-dev/kubevela/pkg/webhook/utils"
 )
 
-var componentDefGVR = v1beta1.SchemeGroupVersion.WithResource("componentdefinitions")
+var componentDefGVR = v1beta1.ComponentDefinitionGVR
 
 // ValidatingHandler handles validation of component definition
 type ValidatingHandler struct {
 	// Decoder decodes object
-	Decoder *admission.Decoder
+	Decoder admission.Decoder
 	Client  client.Client
 }
 
@@ -65,7 +65,7 @@ func (h *ValidatingHandler) Handle(ctx context.Context, req admission.Request) a
 
 		// validate cueTemplate
 		if obj.Spec.Schematic != nil && obj.Spec.Schematic.CUE != nil {
-			err = webhookutils.ValidateCueTemplate(obj.Spec.Schematic.CUE.Template)
+			err = webhookutils.ValidateCuexTemplate(ctx, obj.Spec.Schematic.CUE.Template)
 			if err != nil {
 				return admission.Denied(err.Error())
 			}
diff --git a/pkg/webhook/core.oam.dev/v1beta1/policydefinition/validating_handler.go b/pkg/webhook/core.oam.dev/v1beta1/policydefinition/validating_handler.go
index 1d78552c..464c7e85 100644
--- a/pkg/webhook/core.oam.dev/v1beta1/policydefinition/validating_handler.go
+++ b/pkg/webhook/core.oam.dev/v1beta1/policydefinition/validating_handler.go
@@ -32,12 +32,12 @@ import (
 	webhookutils "github.com/oam-dev/kubevela/pkg/webhook/utils"
 )
 
-var policyDefGVR = v1beta1.SchemeGroupVersion.WithResource("policydefinitions")
+var policyDefGVR = v1beta1.PolicyDefinitionGVR
 
 // ValidatingHandler handles validation of policy definition
 type ValidatingHandler struct {
 	// Decoder decodes object
-	Decoder *admission.Decoder
+	Decoder admission.Decoder
 	Client  client.Client
 }
 
diff --git a/pkg/webhook/core.oam.dev/v1beta1/traitdefinition/validating_handler.go b/pkg/webhook/core.oam.dev/v1beta1/traitdefinition/validating_handler.go
index f0c64e4f..a850ae30 100644
--- a/pkg/webhook/core.oam.dev/v1beta1/traitdefinition/validating_handler.go
+++ b/pkg/webhook/core.oam.dev/v1beta1/traitdefinition/validating_handler.go
@@ -42,14 +42,14 @@ const (
 	failInfoDefRefOmitted = "if definition reference is omitted, patch or output with GVK is required"
 )
 
-var traitDefGVR = v1beta1.SchemeGroupVersion.WithResource("traitdefinitions")
+var traitDefGVR = v1beta1.TraitDefinitionGVR
 
 // ValidatingHandler handles validation of trait definition
 type ValidatingHandler struct {
 	Client client.Client
 
 	// Decoder decodes object
-	Decoder *admission.Decoder
+	Decoder admission.Decoder
 	// Validators validate objects
 	Validators []TraitDefValidator
 }
@@ -91,7 +91,7 @@ func (h *ValidatingHandler) Handle(ctx context.Context, req admission.Request) a
 
 		// validate cueTemplate
 		if obj.Spec.Schematic != nil && obj.Spec.Schematic.CUE != nil {
-			err = webhookutils.ValidateCueTemplate(obj.Spec.Schematic.CUE.Template)
+			err = webhookutils.ValidateCuexTemplate(ctx, obj.Spec.Schematic.CUE.Template)
 			if err != nil {
 				return admission.Denied(err.Error())
 			}
diff --git a/pkg/webhook/core.oam.dev/v1beta1/workflowstepdefinition/validating_handler.go b/pkg/webhook/core.oam.dev/v1beta1/workflowstepdefinition/validating_handler.go
index dd806558..f430d368 100644
--- a/pkg/webhook/core.oam.dev/v1beta1/workflowstepdefinition/validating_handler.go
+++ b/pkg/webhook/core.oam.dev/v1beta1/workflowstepdefinition/validating_handler.go
@@ -32,12 +32,12 @@ import (
 	webhookutils "github.com/oam-dev/kubevela/pkg/webhook/utils"
 )
 
-var workflowStepDefGVR = v1beta1.SchemeGroupVersion.WithResource("workflowstepdefinitions")
+var workflowStepDefGVR = v1beta1.WorkflowStepDefinitionGVR
 
 // ValidatingHandler handles validation of workflow step definition
 type ValidatingHandler struct {
 	// Decoder decodes object
-	Decoder *admission.Decoder
+	Decoder admission.Decoder
 	Client  client.Client
 }
 
@@ -48,7 +48,7 @@ func (h *ValidatingHandler) InjectClient(c client.Client) error {
 }
 
 // InjectDecoder injects the decoder into the ValidatingHandler
-func (h *ValidatingHandler) InjectDecoder(d *admission.Decoder) error {
+func (h *ValidatingHandler) InjectDecoder(d admission.Decoder) error {
 	h.Decoder = d
 	return nil
 }
diff --git a/pkg/webhook/utils/utils.go b/pkg/webhook/utils/utils.go
index 361b5194..eeb3e70a 100644
--- a/pkg/webhook/utils/utils.go
+++ b/pkg/webhook/utils/utils.go
@@ -23,6 +23,8 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/kubevela/pkg/cue/cuex"
+
 	"cuelang.org/go/cue/cuecontext"
 	cueErrors "cuelang.org/go/cue/errors"
 	"github.com/pkg/errors"
@@ -73,6 +75,19 @@ func ValidateCueTemplate(cueTemplate string) error {
 	return checkError(err)
 }
 
+// ValidateCuexTemplate validate cueTemplate with CueX for types utilising it
+func ValidateCuexTemplate(ctx context.Context, cueTemplate string) error {
+	val, err := cuex.DefaultCompiler.Get().CompileStringWithOptions(ctx, cueTemplate)
+	if err != nil {
+		return err
+	}
+	if e := checkError(val.Err()); e != nil {
+		return e
+	}
+	err = val.Validate()
+	return checkError(err)
+}
+
 func checkError(err error) error {
 	re := regexp.MustCompile(ContextRegex)
 	if err != nil {
diff --git a/pkg/workflow/providers/legacy/multicluster/deploy.go b/pkg/workflow/providers/legacy/multicluster/deploy.go
index 7eb86318..0fbf9c1f 100644
--- a/pkg/workflow/providers/legacy/multicluster/deploy.go
+++ b/pkg/workflow/providers/legacy/multicluster/deploy.go
@@ -340,7 +340,7 @@ HealthCheck:
 			break HealthCheck
 		}
 		checkResults := slices.ParMap[*applyTask, *applyTaskResult](checkTasks, func(task *applyTask) *applyTaskResult {
-			healthy, output, outputs, err := healthCheck(ctx, task.component, nil, task.placement.Cluster, task.placement.Namespace)
+			healthy, _, output, outputs, err := healthCheck(ctx, task.component, nil, task.placement.Cluster, task.placement.Namespace)
 			task.healthy = ptr.To(healthy)
 			if healthy {
 				err = task.generateOutput(output, outputs, cache, makeValue)
diff --git a/pkg/workflow/providers/multicluster/deploy.go b/pkg/workflow/providers/multicluster/deploy.go
index 7eb86318..0fbf9c1f 100644
--- a/pkg/workflow/providers/multicluster/deploy.go
+++ b/pkg/workflow/providers/multicluster/deploy.go
@@ -340,7 +340,7 @@ HealthCheck:
 			break HealthCheck
 		}
 		checkResults := slices.ParMap[*applyTask, *applyTaskResult](checkTasks, func(task *applyTask) *applyTaskResult {
-			healthy, output, outputs, err := healthCheck(ctx, task.component, nil, task.placement.Cluster, task.placement.Namespace)
+			healthy, _, output, outputs, err := healthCheck(ctx, task.component, nil, task.placement.Cluster, task.placement.Namespace)
 			task.healthy = ptr.To(healthy)
 			if healthy {
 				err = task.generateOutput(output, outputs, cache, makeValue)
diff --git a/pkg/workflow/providers/types/types.go b/pkg/workflow/providers/types/types.go
index 08d0bbcf..914bb17f 100644
--- a/pkg/workflow/providers/types/types.go
+++ b/pkg/workflow/providers/types/types.go
@@ -42,7 +42,7 @@ type ComponentApply func(ctx context.Context, comp common.ApplicationComponent,
 type ComponentRender func(ctx context.Context, comp common.ApplicationComponent, patcher *cue.Value, clusterName string, overrideNamespace string) (*unstructured.Unstructured, []*unstructured.Unstructured, error)
 
 // ComponentHealthCheck health check oam component.
-type ComponentHealthCheck func(ctx context.Context, comp common.ApplicationComponent, patcher *cue.Value, clusterName string, overrideNamespace string) (bool, *unstructured.Unstructured, []*unstructured.Unstructured, error)
+type ComponentHealthCheck func(ctx context.Context, comp common.ApplicationComponent, patcher *cue.Value, clusterName string, overrideNamespace string) (bool, *common.ApplicationComponentStatus, *unstructured.Unstructured, []*unstructured.Unstructured, error)
 
 // WorkloadRender render application component into workload
 type WorkloadRender func(ctx context.Context, comp common.ApplicationComponent) (*appfile.Component, error)
diff --git a/pkg/workflow/step/generator.go b/pkg/workflow/step/generator.go
index 243ba003..818b4198 100644
--- a/pkg/workflow/step/generator.go
+++ b/pkg/workflow/step/generator.go
@@ -96,6 +96,7 @@ func (g *ApplyComponentWorkflowStepGenerator) Generate(app *v1beta1.Application,
 				Properties: util.Object2RawExtension(map[string]string{
 					"component": comp.Name,
 				}),
+				DependsOn: comp.DependsOn,
 			},
 		})
 	}
diff --git a/references/appfile/api/service.go b/references/appfile/api/service.go
index 05ad0e27..e4028fa9 100644
--- a/references/appfile/api/service.go
+++ b/references/appfile/api/service.go
@@ -94,7 +94,11 @@ func (s Service) RenderServiceToApplicationComponent(tm template.Manager, servic
 			traits = append(traits, trait)
 			continue
 		}
-		workloadKeys[k] = v
+		if k != "dependsOn" {
+			workloadKeys[k] = v
+		} else {
+			comp.DependsOn = toStringSlice(v)
+		}
 	}
 
 	// Handle workloadKeys to settings
@@ -115,6 +119,26 @@ func (s Service) RenderServiceToApplicationComponent(tm template.Manager, servic
 	return comp, nil
 }
 
+// toStringSlice converts an interface{} or string to a []string
+func toStringSlice(v interface{}) []string {
+	switch val := v.(type) {
+	case string:
+		return []string{val}
+	case []string:
+		return val
+	case []interface{}:
+		var result []string
+		for _, item := range val {
+			if s, ok := item.(string); ok {
+				result = append(result, s)
+			}
+		}
+		return result
+	default:
+		return nil
+	}
+}
+
 // GetServices will get all services defined in AppFile
 func (af *AppFile) GetServices() map[string]Service {
 	return af.Services
diff --git a/references/cli/def.go b/references/cli/def.go
index 56b8b0a7..11ff51e6 100644
--- a/references/cli/def.go
+++ b/references/cli/def.go
@@ -837,13 +837,20 @@ func NewDefinitionRenderCommand(c common.Args) *cobra.Command {
 					return errors.Wrapf(err, "failed to read directory %s", args[0])
 				}
 			}
+			var renderErrs []error
 			for i, inputFilename := range inputFilenames {
-				if err = render(inputFilename, outputFilenames[i]); err != nil {
-					if _, err = fmt.Fprintf(cmd.ErrOrStderr(), "failed to render %s, reason: %v", inputFilename, err); err != nil {
-						return errors.Wrapf(err, "failed to write err")
+				renderErr := render(inputFilename, outputFilenames[i])
+				if renderErr != nil {
+					wrappedRenderErr := errors.Wrapf(renderErr, "failed to render %s", inputFilename)
+					if _, writeErr := fmt.Fprintln(cmd.ErrOrStderr(), wrappedRenderErr); writeErr != nil {
+						renderErrs = append(renderErrs, errors.Wrapf(writeErr, "failed to write to stderr for %s", inputFilename))
 					}
+					renderErrs = append(renderErrs, wrappedRenderErr)
 				}
 			}
+			if len(renderErrs) > 0 {
+				return fmt.Errorf("rendering failed for %d file(s)", len(renderErrs))
+			}
 			return nil
 		},
 	}
diff --git a/references/cli/portforward.go b/references/cli/portforward.go
index 467dc919..8c188be1 100644
--- a/references/cli/portforward.go
+++ b/references/cli/portforward.go
@@ -309,7 +309,7 @@ func (o *VelaPortForwardOptions) Run() error {
 		}
 	}()
 
-	return o.kcPortForwardOptions.RunPortForward()
+	return o.kcPortForwardOptions.RunPortForwardContext(o.Ctx)
 }
 
 func splitPort(port string) (local, remote string) {
diff --git a/references/cli/print.go b/references/cli/print.go
index e718c8a1..bf0f3ed1 100644
--- a/references/cli/print.go
+++ b/references/cli/print.go
@@ -30,7 +30,9 @@ var (
 	red    = color.New(color.FgRed)
 	green  = color.New(color.FgGreen)
 	yellow = color.New(color.FgYellow)
-	white  = color.New(color.Bold, color.FgWhite)
+	blue   = color.New(color.FgBlue)
+	// white is not currently used, but kept for future needs - commenting out to pass checks
+	// white := color.New(color.Bold, color.FgWhite)
 )
 
 // emoji used in vela cmd for printing
diff --git a/references/cli/status.go b/references/cli/status.go
index b8ed6f47..0a6d2648 100644
--- a/references/cli/status.go
+++ b/references/cli/status.go
@@ -21,7 +21,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"strings"
 	"time"
 
 	"cuelang.org/go/cue"
@@ -190,13 +189,18 @@ func printAppStatus(_ context.Context, c client.Client, ioStreams cmdutil.IOStre
 	if err != nil {
 		return err
 	}
+	healthStatusEmoji := emojiSucceed
+	if !getAppHealth(app) {
+		healthStatusEmoji = emojiFail
+	}
 
 	cmd.Printf("About:\n\n")
 	table := newUITable()
 	table.AddRow("  Name:", appName)
 	table.AddRow("  Namespace:", namespace)
 	table.AddRow("  Created at:", app.CreationTimestamp.String())
-	table.AddRow("  Status:", getAppPhaseColor(app.Status.Phase).Sprint(app.Status.Phase))
+	table.AddRow("  Healthy:", healthStatusEmoji)
+	table.AddRow("  Details:", getAppPhaseColor(app.Status.Phase).Sprint(app.Status.Phase))
 	cmd.Printf("%s\n\n", table.String())
 	if err := printWorkflowStatus(c, ioStreams, appName, namespace, detail); err != nil {
 		return err
@@ -356,20 +360,27 @@ func loopCheckStatus(c client.Client, ioStreams cmdutil.IOStreams, appName strin
 		if comp.Cluster == "" {
 			comp.Cluster = "local"
 		}
-		nsStat := ""
+		ioStreams.Infof("%s", fmt.Sprintf("  - Name: %s  %s\n", compName, envStat))
+		ioStreams.Infof("%s", fmt.Sprintf("    Cluster: %s\n", comp.Cluster))
 		if comp.Namespace != "" {
-			nsStat = "Namespace: " + comp.Namespace
+			ioStreams.Infof("%s", fmt.Sprintf("    Namespace: %s\n", comp.Namespace))
 		}
-		ioStreams.Infof("%s", fmt.Sprintf("  - Name: %s  %s\n", compName, envStat))
-		ioStreams.Infof("%s", fmt.Sprintf("    Cluster: %s  %s\n", comp.Cluster, nsStat))
 		ioStreams.Infof("    Type: %s\n", getComponentType(remoteApp, compName))
-		healthColor := getHealthStatusColor(comp.Healthy)
-		healthInfo := strings.ReplaceAll(comp.Message, "\n", "\n\t") // format healthInfo output
-		healthstats := "Healthy"
+
+		var healthEmoji = emojiSucceed
 		if !comp.Healthy {
-			healthstats = "Unhealthy"
+			healthEmoji = emojiFail
+		}
+		ioStreams.Infof("    Health: %s\n", healthEmoji)
+		if comp.Message != "" {
+			ioStreams.Infof("      Message: %s\n", comp.Message)
+		}
+		if len(comp.Details) > 0 {
+			ioStreams.Infof("      Status Details: \n")
+			for k, v := range comp.Details {
+				ioStreams.Infof("        %s: %s\n", k, v)
+			}
 		}
-		ioStreams.Infof("    %s %s\n", healthColor.Sprint(healthstats), healthColor.Sprint(healthInfo))
 
 		// load it again after health check
 		remoteApp, err = loadRemoteApplication(c, namespace, appName)
@@ -383,16 +394,21 @@ func loopCheckStatus(c client.Client, ioStreams cmdutil.IOStreams, appName strin
 			ioStreams.Infof("    No trait applied\n")
 		}
 		for _, tr := range comp.Traits {
-			traitBase := ""
-			if tr.Healthy {
-				traitBase = fmt.Sprintf("      %s%s", emojiSucceed, white.Sprint(tr.Type))
-			} else {
-				traitBase = fmt.Sprintf("      %s%s", emojiFail, white.Sprint(tr.Type))
+			ioStreams.Infof("      %s: %s\n", "Type", tr.Type)
+			var trHealthEmoji = emojiSucceed
+			if !tr.Healthy {
+				trHealthEmoji = emojiFail
 			}
+			ioStreams.Infof("      %s: %s\n", "Health", trHealthEmoji)
 			if tr.Message != "" {
-				traitBase += ": " + tr.Message
+				ioStreams.Infof("        %s: %s\n", "Message", tr.Message)
+			}
+			if len(tr.Details) > 0 {
+				ioStreams.Infof("        %s:\n", "Status Details")
+				for k, v := range tr.Details {
+					ioStreams.Infof("          %s: %s\n", k, v)
+				}
 			}
-			ioStreams.Infof("%s", traitBase)
 		}
 		ioStreams.Info("")
 	}
@@ -442,13 +458,6 @@ func TrackDeployStatus(c common.Args, appName string, namespace string) (commont
 	return appObj.Status.Phase, nil
 }
 
-func getHealthStatusColor(s bool) *color.Color {
-	if s {
-		return green
-	}
-	return yellow
-}
-
 func getWfStepColor(phase workflowv1alpha1.WorkflowStepPhase) *color.Color {
 	switch phase {
 	case workflowv1alpha1.WorkflowStepPhaseSucceeded:
@@ -461,10 +470,30 @@ func getWfStepColor(phase workflowv1alpha1.WorkflowStepPhase) *color.Color {
 }
 
 func getAppPhaseColor(appPhase commontypes.ApplicationPhase) *color.Color {
-	if appPhase == commontypes.ApplicationRunning {
+	switch appPhase {
+	case commontypes.ApplicationUnhealthy:
+		return red
+	case commontypes.ApplicationWorkflowSuspending:
+		return blue
+	case commontypes.ApplicationRunning:
 		return green
+	default:
+		return yellow
+	}
+}
+
+func getAppHealth(app *v1beta1.Application) bool {
+	for _, s := range app.Status.Services {
+		if !s.Healthy {
+			return false
+		}
+		for _, t := range s.Traits {
+			if !t.Healthy {
+				return false
+			}
+		}
 	}
-	return yellow
+	return true
 }
 
 func printApplicationTree(c common.Args, cmd *cobra.Command, appName string, appNs string) error {
diff --git a/vela-templates/definitions/internal/trait/storage.cue b/vela-templates/definitions/internal/trait/storage.cue
index a2c4cd17..88be2b35 100644
--- a/vela-templates/definitions/internal/trait/storage.cue
+++ b/vela-templates/definitions/internal/trait/storage.cue
@@ -51,7 +51,10 @@ template: {
 		if parameter.hostPath != _|_ for v in parameter.hostPath {
 			{
 				name: "hostpath-" + v.name
-				path: v.path
+				hostPath: {
+					path: v.path
+					type: v.type
+				}
 			}
 		},
 	]
diff --git a/vela-templates/definitions/internal/workflowstep/request.cue b/vela-templates/definitions/internal/workflowstep/request.cue
index b1456293..6d0aaa7b 100644
--- a/vela-templates/definitions/internal/workflowstep/request.cue
+++ b/vela-templates/definitions/internal/workflowstep/request.cue
@@ -1,6 +1,6 @@
 import (
+	"vela/op"
 	"vela/http"
-	"vela/builtin"
 	"encoding/json"
 )
 
@@ -9,7 +9,7 @@ request: {
 	attributes: {}
 	description: "Send request to the url"
 	annotations: {
-		"category": "External Intergration"
+		"category": "External Integration"
 	}
 	labels: {}
 	type: "workflow-step"
@@ -30,14 +30,22 @@ template: {
 			}
 		}
 	}
-	fail: {
-		if http.$returns.response.statusCode > 400 {
-			requestFail: builtin.#Fail & {
-				$params: message: "request of \(parameter.url) is fail: \(http.response.statusCode)"
+
+	wait: op.#ConditionalWait & {
+		continue: req.$returns != _|_
+		message?: "Waiting for response from \(parameter.url)"
+	}
+
+	fail: op.#Steps & {
+		if req.$returns.statusCode > 400 {
+			requestFail: op.#Fail & {
+				message: "request of \(parameter.url) is fail: \(req.$returns.statusCode)"
 			}
 		}
 	}
-	response: json.Unmarshal(http.$returns.response.body)
+
+	response: json.Unmarshal(req.$returns.body)
+
 	parameter: {
 		url:    string
 		method: *"GET" | "POST" | "PUT" | "DELETE"



Test patch:
diff --git a/apis/core.oam.dev/v1beta1/register_test.go b/apis/core.oam.dev/v1beta1/register_test.go
new file mode 100644
index 00000000..bdf1a38b
--- /dev/null
+++ b/apis/core.oam.dev/v1beta1/register_test.go
@@ -0,0 +1,117 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestDefinitionTypeMap(t *testing.T) {
+	tests := []struct {
+		name         string
+		defType      reflect.Type
+		expectedGVR  schema.GroupVersionResource
+		expectedKind string
+	}{
+		{
+			name:         "ComponentDefinition",
+			defType:      reflect.TypeOf(ComponentDefinition{}),
+			expectedGVR:  ComponentDefinitionGVR,
+			expectedKind: ComponentDefinitionKind,
+		},
+		{
+			name:         "TraitDefinition",
+			defType:      reflect.TypeOf(TraitDefinition{}),
+			expectedGVR:  TraitDefinitionGVR,
+			expectedKind: TraitDefinitionKind,
+		},
+		{
+			name:         "PolicyDefinition",
+			defType:      reflect.TypeOf(PolicyDefinition{}),
+			expectedGVR:  PolicyDefinitionGVR,
+			expectedKind: PolicyDefinitionKind,
+		},
+		{
+			name:         "WorkflowStepDefinition",
+			defType:      reflect.TypeOf(WorkflowStepDefinition{}),
+			expectedGVR:  WorkflowStepDefinitionGVR,
+			expectedKind: WorkflowStepDefinitionKind,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			info, ok := DefinitionTypeMap[tt.defType]
+			assert.Truef(t, ok, "Type %v should exist in DefinitionTypeMap", tt.defType)
+			assert.Equal(t, tt.expectedGVR, info.GVR)
+			assert.Equal(t, tt.expectedKind, info.Kind)
+
+			// Verify GVR follows Kubernetes conventions
+			assert.Equal(t, Group, info.GVR.Group)
+			assert.Equal(t, Version, info.GVR.Version)
+			// Resource should be lowercase plural of Kind
+			assert.Equal(t, strings.ToLower(info.Kind)+"s", info.GVR.Resource)
+		})
+	}
+}
+
+func TestDefinitionTypeMapCompleteness(t *testing.T) {
+	// Ensure all expected definition types are in the map
+	expectedTypes := []reflect.Type{
+		reflect.TypeOf(ComponentDefinition{}),
+		reflect.TypeOf(TraitDefinition{}),
+		reflect.TypeOf(PolicyDefinition{}),
+		reflect.TypeOf(WorkflowStepDefinition{}),
+	}
+
+	assert.Equal(t, len(expectedTypes), len(DefinitionTypeMap), "DefinitionTypeMap should contain exactly %d entries", len(expectedTypes))
+
+	for _, expectedType := range expectedTypes {
+		_, ok := DefinitionTypeMap[expectedType]
+		assert.Truef(t, ok, "DefinitionTypeMap should contain %v", expectedType)
+	}
+}
+
+func TestDefinitionKindValues(t *testing.T) {
+	// Verify that the Kind values match the actual type names
+	tests := []struct {
+		defType      interface{}
+		expectedKind string
+	}{
+		{ComponentDefinition{}, "ComponentDefinition"},
+		{TraitDefinition{}, "TraitDefinition"},
+		{PolicyDefinition{}, "PolicyDefinition"},
+		{WorkflowStepDefinition{}, "WorkflowStepDefinition"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.expectedKind, func(t *testing.T) {
+			actualKind := reflect.TypeOf(tt.defType).Name()
+			assert.Equal(t, tt.expectedKind, actualKind)
+
+			// Also verify it matches what's in the map
+			info, ok := DefinitionTypeMap[reflect.TypeOf(tt.defType)]
+			assert.True(t, ok)
+			assert.Equal(t, tt.expectedKind, info.Kind)
+		})
+	}
+}
diff --git a/cmd/core/app/hooks/pre_start_hook_test.go b/cmd/core/app/hooks/pre_start_hook_test.go
index 34de1f8f..f1938153 100644
--- a/cmd/core/app/hooks/pre_start_hook_test.go
+++ b/cmd/core/app/hooks/pre_start_hook_test.go
@@ -42,7 +42,7 @@ func TestPreStartHook(t *testing.T) {
 
 var _ = Describe("Test pre-start hooks", func() {
 	It("Test SystemCRDValidationHook", func() {
-		defer featuregatetesting.SetFeatureGateDuringTest(&testing.T{}, utilfeature.DefaultFeatureGate, features.ZstdApplicationRevision, true)()
+		featuregatetesting.SetFeatureGateDuringTest(GinkgoT(), utilfeature.DefaultFeatureGate, features.ZstdApplicationRevision, true)
 		ctx := context.Background()
 		Expect(k8s.EnsureNamespace(ctx, singleton.KubeClient.Get(), types.DefaultKubeVelaNS)).Should(Succeed())
 		err := hooks.NewSystemCRDValidationHook().Run(ctx)
diff --git a/e2e/application/application_test.go b/e2e/application/application_test.go
index 46adcc8c..4b0b781e 100644
--- a/e2e/application/application_test.go
+++ b/e2e/application/application_test.go
@@ -44,20 +44,23 @@ var (
 	applicationName             = "app-basic"
 	traitAlias                  = "scaler"
 	appNameForInit              = "initmyapp"
-	jsonAppFile                 = `{"name":"nginx-vela","services":{"nginx":{"type":"webservice","image":"nginx:1.9.4","ports":[{port: 80, expose: true}]}}}`
-	testDeleteJsonAppFile       = `{"name":"test-vela-delete","services":{"nginx-test":{"type":"webservice","image":"nginx:1.9.4","ports":[{port: 80, expose: true}]}}}`
-	appbasicJsonAppFile         = `{"name":"app-basic","services":{"app-basic":{"type":"webservice","image":"nginx:1.9.4","ports":[{port: 80, expose: true}]}}}`
-	appbasicAddTraitJsonAppFile = `{"name":"app-basic","services":{"app-basic":{"type":"webservice","image":"nginx:1.9.4","ports":[{port: 80, expose: true}],"scaler":{"replicas":2}}}}`
+	jsonAppFile                 = `{"name":"nginx-vela","services":{"nginx":{"type":"webservice","image":"nginx:1.29.0","ports":[{port: 80, expose: true}]}}}`
+	testDeleteJsonAppFile       = `{"name":"test-vela-delete","services":{"nginx-test":{"type":"webservice","image":"nginx:1.29.0","ports":[{port: 80, expose: true}]}}}`
+	appbasicJsonAppFile         = `{"name":"app-basic","services":{"app-basic":{"type":"webservice","image":"nginx:1.29.0","ports":[{port: 80, expose: true}]}}}`
+	appbasicAddTraitJsonAppFile = `{"name":"app-basic","services":{"app-basic":{"type":"webservice","image":"nginx:1.29.0","ports":[{port: 80, expose: true}],"scaler":{"replicas":2}}}}`
 	velaQL                      = "test-component-pod-view{appNs=default,appName=nginx-vela,name=nginx}"
 
-	waitAppfileToSuccess = `{"name":"app-wait-success","services":{"app-basic1":{"type":"webservice","image":"nginx:1.9.4","ports":[{port: 80, expose: true}]}}}`
+	waitAppfileToSuccess = `{"name":"app-wait-success","services":{"app-basic1":{"type":"webservice","image":"nginx:1.29.0","ports":[{port: 80, expose: true}]}}}`
 	waitAppfileToFail    = `{"name":"app-wait-fail","services":{"app-basic2":{"type":"webservice","image":"nginx:fail","ports":[{port: 80, expose: true}]}}}`
+
+	componentDependsOnFailApp     = `{"name":"comp-depends-fail","services":{"failing-db":{"type":"webservice","image": ""},"dependent-service":{"type":"webservice","dependsOn":["failing-db"],"image":"nginx:latest","ports":[{"port":8080,"expose":false}]}}}`
+	componentDependsOnMultipleApp = `{"name":"comp-depends-multiple","services":{"database":{"type":"webservice","image":"nginx:latest","ports":[{"port":3306,"expose":false}]},"cache":{"type":"webservice","image":"nginx:latest","ports":[{"port":6379,"expose":false}]},"backend":{"type":"webservice","dependsOn":["database","cache"],"image":"nginx:latest","ports":[{"port":8080,"expose":false}]}}}`
 )
 
 var _ = ginkgo.Describe("Test Vela Application", ginkgo.Ordered, func() {
+	e2e.DeleteEnvFunc("env delete", envName)
 	e2e.JsonAppFileContext("json appfile apply", jsonAppFile)
 	e2e.EnvSetContext("env set default", "default")
-	e2e.DeleteEnvFunc("env delete", envName)
 	e2e.EnvInitContext("env init env-application", envName)
 	e2e.EnvSetContext("env set", envName)
 	e2e.JsonAppFileContext("deploy app-basic", appbasicJsonAppFile)
@@ -313,3 +316,61 @@ var VelaQLPodListContext = func(context string, velaQL string) bool {
 		}
 	})
 }
+
+var _ = ginkgo.Describe("Test Component Level DependsOn CLI", ginkgo.Ordered, func() {
+
+	e2e.JsonAppFileContext("component dependsOn failure blocking", componentDependsOnFailApp)
+	ComponentDependsOnFailureContext("component dependsOn failure blocking verification", "comp-depends-fail")
+	e2e.WorkloadDeleteContext("delete failure app", "comp-depends-fail")
+
+	e2e.JsonAppFileContext("component dependsOn multiple dependencies", componentDependsOnMultipleApp)
+	ComponentDependsOnMultipleContext("component dependsOn multiple dependencies verification", "comp-depends-multiple")
+	e2e.WorkloadDeleteContext("delete multiple deps app", "comp-depends-multiple")
+})
+
+var ComponentDependsOnFailureContext = func(context string, appName string) bool {
+	return ginkgo.It(context+": should block dependent components when dependency fails", func() {
+		ginkgo.By("verify application doesn't reach running state due to component failure")
+		ginkgo.By("wait sufficient time for dependency check")
+		time.Sleep(45 * time.Second)
+
+		cli := fmt.Sprintf("vela status %s", appName)
+		output, err := e2e.Exec(cli)
+		gomega.Expect(err).NotTo(gomega.HaveOccurred())
+
+		ginkgo.By("check that dependent service is blocked")
+		gomega.Expect(strings.ToLower(output)).Should(gomega.ContainSubstring("failed"))
+		// The app should show some indication that components are waiting on dependencies
+		gomega.Expect(strings.ToLower(output)).Should(gomega.SatisfyAny(
+			gomega.ContainSubstring("pending"),
+			gomega.ContainSubstring("progressing"),
+			gomega.ContainSubstring("waiting"),
+			gomega.ContainSubstring("suspend"),
+		))
+	})
+}
+
+var ComponentDependsOnMultipleContext = func(context string, appName string) bool {
+	return ginkgo.It(context+": should handle multiple dependencies correctly", func() {
+		ginkgo.By("verify application eventually reaches running state")
+		gomega.Eventually(func() string {
+			cli := fmt.Sprintf("vela status %s", appName)
+			output, err := e2e.Exec(cli)
+			gomega.Expect(err).NotTo(gomega.HaveOccurred())
+			return output
+		}, 300*time.Second, 5*time.Second).Should(gomega.ContainSubstring("running"))
+
+		ginkgo.By("wait sufficient time for dependency check")
+		time.Sleep(time.Minute)
+
+		ginkgo.By("verify all components are healthy")
+		cli := fmt.Sprintf("vela status %s --tree", appName)
+		output, err := e2e.Exec(cli)
+		gomega.Expect(err).NotTo(gomega.HaveOccurred())
+		gomega.Expect(output).Should(gomega.And(
+			gomega.ContainSubstring("database"),
+			gomega.ContainSubstring("cache"),
+			gomega.ContainSubstring("backend"),
+		))
+	})
+}
diff --git a/pkg/auth/identity_test.go b/pkg/auth/identity_test.go
new file mode 100644
index 00000000..d93b66cf
--- /dev/null
+++ b/pkg/auth/identity_test.go
@@ -0,0 +1,254 @@
+/*
+Copyright 2022 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	rbacv1 "k8s.io/api/rbac/v1"
+)
+
+func TestIdentity(t *testing.T) {
+	t.Run("String", func(t *testing.T) {
+		testCases := map[string]struct {
+			identity Identity
+			expected string
+		}{
+			"user only": {
+				identity: Identity{User: "test-user"},
+				expected: "User=test-user",
+			},
+			"user and groups": {
+				identity: Identity{User: "test-user", Groups: []string{"group1", "group2"}},
+				expected: "User=test-user Groups=group1,group2",
+			},
+			"service account only": {
+				identity: Identity{ServiceAccount: "sa-name", ServiceAccountNamespace: "sa-ns"},
+				expected: "SA=system:serviceaccount:sa-ns:sa-name",
+			},
+			"all fields": {
+				identity: Identity{User: "test-user", Groups: []string{"group1"}, ServiceAccount: "sa-name", ServiceAccountNamespace: "sa-ns"},
+				expected: "User=test-user Groups=group1 SA=system:serviceaccount:sa-ns:sa-name",
+			},
+			"empty": {
+				identity: Identity{},
+				expected: "",
+			},
+		}
+		for name, tc := range testCases {
+			t.Run(name, func(t *testing.T) {
+				r := require.New(t)
+				r.Equal(tc.expected, tc.identity.String())
+			})
+		}
+	})
+
+	t.Run("Match", func(t *testing.T) {
+		identity := &Identity{
+			User:                    "test-user",
+			Groups:                  []string{"group1", "group2"},
+			ServiceAccount:          "sa-name",
+			ServiceAccountNamespace: "sa-ns",
+		}
+		testCases := map[string]struct {
+			subject  rbacv1.Subject
+			expected bool
+		}{
+			"match user": {
+				subject:  rbacv1.Subject{Kind: rbacv1.UserKind, Name: "test-user"},
+				expected: true,
+			},
+			"not match user": {
+				subject:  rbacv1.Subject{Kind: rbacv1.UserKind, Name: "another-user"},
+				expected: false,
+			},
+			"match group": {
+				subject:  rbacv1.Subject{Kind: rbacv1.GroupKind, Name: "group1"},
+				expected: true,
+			},
+			"not match group": {
+				subject:  rbacv1.Subject{Kind: rbacv1.GroupKind, Name: "group3"},
+				expected: false,
+			},
+			"match service account": {
+				subject:  rbacv1.Subject{Kind: rbacv1.ServiceAccountKind, Name: "sa-name", Namespace: "sa-ns"},
+				expected: true,
+			},
+			"not match service account name": {
+				subject:  rbacv1.Subject{Kind: rbacv1.ServiceAccountKind, Name: "another-sa", Namespace: "sa-ns"},
+				expected: false,
+			},
+			"not match service account namespace": {
+				subject:  rbacv1.Subject{Kind: rbacv1.ServiceAccountKind, Name: "sa-name", Namespace: "another-ns"},
+				expected: false,
+			},
+			"unknown kind": {
+				subject:  rbacv1.Subject{Kind: "Unknown", Name: "test-user"},
+				expected: false,
+			},
+		}
+		for name, tc := range testCases {
+			t.Run(name, func(t *testing.T) {
+				r := require.New(t)
+				r.Equal(tc.expected, identity.Match(tc.subject))
+			})
+		}
+	})
+
+	t.Run("MatchAny", func(t *testing.T) {
+		identity := &Identity{
+			User:   "test-user",
+			Groups: []string{"group1"},
+		}
+		testCases := map[string]struct {
+			subjects []rbacv1.Subject
+			expected bool
+		}{
+			"match one": {
+				subjects: []rbacv1.Subject{
+					{Kind: rbacv1.GroupKind, Name: "group-other"},
+					{Kind: rbacv1.UserKind, Name: "test-user"},
+				},
+				expected: true,
+			},
+			"match none": {
+				subjects: []rbacv1.Subject{
+					{Kind: rbacv1.GroupKind, Name: "group-other"},
+					{Kind: rbacv1.UserKind, Name: "user-other"},
+				},
+				expected: false,
+			},
+			"empty subjects": {
+				subjects: []rbacv1.Subject{},
+				expected: false,
+			},
+		}
+		for name, tc := range testCases {
+			t.Run(name, func(t *testing.T) {
+				r := require.New(t)
+				r.Equal(tc.expected, identity.MatchAny(tc.subjects))
+			})
+		}
+	})
+
+	t.Run("Regularize", func(t *testing.T) {
+		testCases := map[string]struct {
+			identity *Identity
+			expected *Identity
+		}{
+			"trim spaces": {
+				identity: &Identity{User: "  user  ", ServiceAccount: " sa  "},
+				expected: &Identity{User: "user", ServiceAccount: "sa", ServiceAccountNamespace: "default"},
+			},
+			"remove duplicate groups": {
+				identity: &Identity{User: "user", Groups: []string{" g1 ", "g2", " g1", ""}},
+				expected: &Identity{User: "user", Groups: []string{"g1", "g2", ""}},
+			},
+			"default sa namespace": {
+				identity: &Identity{ServiceAccount: "sa"},
+				expected: &Identity{ServiceAccount: "sa", ServiceAccountNamespace: "default"},
+			},
+			"no change": {
+				identity: &Identity{User: "user", Groups: []string{"g1"}},
+				expected: &Identity{User: "user", Groups: []string{"g1"}},
+			},
+		}
+		for name, tc := range testCases {
+			t.Run(name, func(t *testing.T) {
+				r := require.New(t)
+				tc.identity.Regularize()
+				r.Equal(tc.expected, tc.identity)
+			})
+		}
+	})
+
+	t.Run("Validate", func(t *testing.T) {
+		testCases := map[string]struct {
+			identity  Identity
+			expectErr bool
+		}{
+			"valid user": {
+				identity:  Identity{User: "user"},
+				expectErr: false,
+			},
+			"valid service account": {
+				identity:  Identity{ServiceAccount: "sa", ServiceAccountNamespace: "ns"},
+				expectErr: false,
+			},
+			"invalid empty": {
+				identity:  Identity{},
+				expectErr: true,
+			},
+			"invalid user and sa": {
+				identity:  Identity{User: "user", ServiceAccount: "sa"},
+				expectErr: true,
+			},
+			"invalid group and sa": {
+				identity:  Identity{Groups: []string{"g1"}, ServiceAccount: "sa"},
+				expectErr: true,
+			},
+			"invalid sa namespace without sa": {
+				identity:  Identity{User: "user", ServiceAccountNamespace: "ns"},
+				expectErr: true,
+			},
+		}
+		for name, tc := range testCases {
+			t.Run(name, func(t *testing.T) {
+				r := require.New(t)
+				err := tc.identity.Validate()
+				if tc.expectErr {
+					r.Error(err)
+				} else {
+					r.NoError(err)
+				}
+			})
+		}
+	})
+
+	t.Run("Subjects", func(t *testing.T) {
+		testCases := map[string]struct {
+			identity Identity
+			expected []rbacv1.Subject
+		}{
+			"user and groups": {
+				identity: Identity{User: "user", Groups: []string{"g1", "g2"}},
+				expected: []rbacv1.Subject{
+					{Kind: rbacv1.UserKind, APIGroup: rbacv1.GroupName, Name: "user"},
+					{Kind: rbacv1.GroupKind, APIGroup: rbacv1.GroupName, Name: "g1"},
+					{Kind: rbacv1.GroupKind, APIGroup: rbacv1.GroupName, Name: "g2"},
+				},
+			},
+			"service account": {
+				identity: Identity{ServiceAccount: "sa", ServiceAccountNamespace: "ns"},
+				expected: []rbacv1.Subject{
+					{Kind: rbacv1.ServiceAccountKind, Name: "sa", Namespace: "ns"},
+				},
+			},
+			"empty": {
+				identity: Identity{},
+				expected: nil,
+			},
+		}
+		for name, tc := range testCases {
+			t.Run(name, func(t *testing.T) {
+				r := require.New(t)
+				r.ElementsMatch(tc.expected, tc.identity.Subjects())
+			})
+		}
+	})
+}
diff --git a/pkg/auth/kubeconfig_test.go b/pkg/auth/kubeconfig_test.go
new file mode 100644
index 00000000..7d2ea85e
--- /dev/null
+++ b/pkg/auth/kubeconfig_test.go
@@ -0,0 +1,334 @@
+/*
+Copyright 2022 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	authenticationv1 "k8s.io/api/authentication/v1"
+	certificatesv1 "k8s.io/api/certificates/v1"
+	certificatesv1beta1 "k8s.io/api/certificates/v1beta1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apiserver/pkg/authentication/user"
+	"k8s.io/client-go/kubernetes/fake"
+	ktesting "k8s.io/client-go/testing"
+	"k8s.io/client-go/tools/clientcmd"
+	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
+)
+
+func TestNewKubeConfigGenerateOptions(t *testing.T) {
+	testCases := map[string]struct {
+		opts     []KubeConfigGenerateOption
+		validate func(*testing.T, *KubeConfigGenerateOptions)
+	}{
+		"default options": {
+			opts: []KubeConfigGenerateOption{},
+			validate: func(t *testing.T, opts *KubeConfigGenerateOptions) {
+				r := require.New(t)
+				r.NotNil(opts.X509)
+				r.Nil(opts.ServiceAccount)
+				r.Equal(user.Anonymous, opts.X509.User)
+				r.Contains(opts.X509.Groups, KubeVelaClientGroup)
+			},
+		},
+		"with user and group options": {
+			opts: []KubeConfigGenerateOption{
+				KubeConfigWithUserGenerateOption("test-user"),
+				KubeConfigWithGroupGenerateOption("test-group"),
+			},
+			validate: func(t *testing.T, opts *KubeConfigGenerateOptions) {
+				r := require.New(t)
+				r.Equal("test-user", opts.X509.User)
+				r.Contains(opts.X509.Groups, "test-group")
+			},
+		},
+		"with service account option": {
+			opts: []KubeConfigGenerateOption{KubeConfigWithServiceAccountGenerateOption(types.NamespacedName{Name: "sa", Namespace: "ns"})},
+			validate: func(t *testing.T, opts *KubeConfigGenerateOptions) {
+				r := require.New(t)
+				r.Nil(opts.X509)
+				r.NotNil(opts.ServiceAccount)
+				r.Equal("sa", opts.ServiceAccount.ServiceAccountName)
+				r.Equal("ns", opts.ServiceAccount.ServiceAccountNamespace)
+			},
+		},
+	}
+
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			opts := newKubeConfigGenerateOptions(tc.opts...)
+			tc.validate(t, opts)
+		})
+	}
+}
+
+func TestGenKubeConfig(t *testing.T) {
+	baseCfg := &clientcmdapi.Config{
+		Clusters: map[string]*clientcmdapi.Cluster{
+			"test-cluster": {Server: "https://localhost:6443"},
+		},
+		Contexts: map[string]*clientcmdapi.Context{
+			"test-context": {Cluster: "test-cluster", AuthInfo: "test-user"},
+		},
+		CurrentContext: "test-context",
+	}
+	authInfo := &clientcmdapi.AuthInfo{
+		ClientKeyData:         []byte("test-key"),
+		ClientCertificateData: []byte("test-cert"),
+	}
+
+	testCases := map[string]struct {
+		baseCfg   *clientcmdapi.Config
+		authInfo  *clientcmdapi.AuthInfo
+		caData    []byte
+		expectErr bool
+	}{
+		"valid config": {
+			baseCfg:  baseCfg,
+			authInfo: authInfo,
+			caData:   []byte("ca-data"),
+		},
+		"no clusters in config": {
+			baseCfg:   &clientcmdapi.Config{},
+			authInfo:  authInfo,
+			expectErr: true,
+		},
+	}
+
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			r := require.New(t)
+			cfg, err := genKubeConfig(tc.baseCfg, tc.authInfo, tc.caData)
+			if tc.expectErr {
+				r.Error(err)
+				r.Contains(err.Error(), "no clusters")
+				return
+			}
+			r.NoError(err)
+			r.NotNil(cfg)
+			r.Len(cfg.Clusters, 1)
+			r.Equal(tc.caData, cfg.Clusters["test-cluster"].CertificateAuthorityData)
+		})
+	}
+}
+
+func TestMakeCertAndKey(t *testing.T) {
+	r := require.New(t)
+	buf := &bytes.Buffer{}
+	csr, key, err := makeCertAndKey(buf, &KubeConfigGenerateX509Options{User: "bob", Groups: []string{"g"}, PrivateKeyBits: 2048})
+	r.NoError(err)
+	r.NotEmpty(csr)
+	r.NotEmpty(key)
+	r.Contains(buf.String(), "Private key generated.")
+}
+
+func TestMakeCSRName(t *testing.T) {
+	r := require.New(t)
+	name := makeCSRName("test-user")
+	r.Equal("kubevela-csr-test-user", name)
+}
+
+func TestGenerateX509KubeConfig(t *testing.T) {
+	r := require.New(t)
+	ctx := context.Background()
+	minimalCfg := func() *clientcmdapi.Config {
+		return &clientcmdapi.Config{
+			Clusters:       map[string]*clientcmdapi.Cluster{"c": {Server: "https://example"}},
+			Contexts:       map[string]*clientcmdapi.Context{"ctx": {Cluster: "c", AuthInfo: "ai"}},
+			CurrentContext: "ctx",
+		}
+	}
+
+	t.Run("v1", func(t *testing.T) {
+		cli := fake.NewSimpleClientset()
+		var stored *certificatesv1.CertificateSigningRequest
+		cli.Fake.PrependReactor("create", "certificatesigningrequests", func(action ktesting.Action) (bool, runtime.Object, error) {
+			create := action.(ktesting.CreateAction)
+			obj := create.GetObject().(*certificatesv1.CertificateSigningRequest)
+			stored = obj.DeepCopy()
+			return true, stored, nil
+		})
+		cli.Fake.PrependReactor("update", "certificatesigningrequests/approval", func(action ktesting.Action) (bool, runtime.Object, error) {
+			return true, stored, nil
+		})
+		getCount := 0
+		cli.Fake.PrependReactor("get", "certificatesigningrequests", func(action ktesting.Action) (bool, runtime.Object, error) {
+			getCount++
+			obj := stored.DeepCopy()
+			if getCount >= 2 {
+				obj.Status.Certificate = []byte("CERT")
+			}
+			return true, obj, nil
+		})
+		cli.Fake.PrependReactor("delete", "certificatesigningrequests", func(action ktesting.Action) (bool, runtime.Object, error) {
+			return true, nil, nil
+		})
+
+		buf := &bytes.Buffer{}
+		cfg := minimalCfg()
+		res, err := generateX509KubeConfigV1(ctx, cli, cfg, buf, &KubeConfigGenerateX509Options{User: "alice", Groups: []string{"g"}, ExpireTime: time.Hour, PrivateKeyBits: 2048})
+		r.NoError(err)
+		ai := res.AuthInfos[cfg.Contexts[cfg.CurrentContext].AuthInfo]
+		r.NotEmpty(ai.ClientCertificateData)
+		r.NotEmpty(ai.ClientKeyData)
+	})
+
+	t.Run("v1beta1", func(t *testing.T) {
+		cli := fake.NewSimpleClientset()
+		var stored *certificatesv1beta1.CertificateSigningRequest
+		cli.Fake.PrependReactor("create", "certificatesigningrequests", func(action ktesting.Action) (bool, runtime.Object, error) {
+			create := action.(ktesting.CreateAction)
+			obj := create.GetObject().(*certificatesv1beta1.CertificateSigningRequest)
+			stored = obj.DeepCopy()
+			return true, stored, nil
+		})
+		cli.Fake.PrependReactor("update", "certificatesigningrequests", func(action ktesting.Action) (bool, runtime.Object, error) {
+			update := action.(ktesting.UpdateAction)
+			obj := update.GetObject().(*certificatesv1beta1.CertificateSigningRequest)
+			stored = obj.DeepCopy()
+			return true, stored, nil
+		})
+		getCount := 0
+		cli.Fake.PrependReactor("get", "certificatesigningrequests", func(action ktesting.Action) (bool, runtime.Object, error) {
+			getCount++
+			obj := stored.DeepCopy()
+			if getCount >= 2 {
+				obj.Status.Certificate = []byte("CERT-BETA")
+			}
+			return true, obj, nil
+		})
+		cli.Fake.PrependReactor("delete", "certificatesigningrequests", func(action ktesting.Action) (bool, runtime.Object, error) {
+			return true, nil, nil
+		})
+
+		buf := &bytes.Buffer{}
+		cfg := minimalCfg()
+		res, err := generateX509KubeConfigV1Beta(ctx, cli, cfg, buf, &KubeConfigGenerateX509Options{User: "alice-beta", Groups: []string{"g"}, ExpireTime: time.Hour, PrivateKeyBits: 2048})
+		r.NoError(err)
+		ai := res.AuthInfos[cfg.Contexts[cfg.CurrentContext].AuthInfo]
+		r.Equal([]byte("CERT-BETA"), ai.ClientCertificateData)
+		r.NotEmpty(ai.ClientKeyData)
+	})
+}
+
+func TestGenerateServiceAccountKubeConfig(t *testing.T) {
+	r := require.New(t)
+	ctx := context.Background()
+	minimalCfg := func() *clientcmdapi.Config {
+		return &clientcmdapi.Config{
+			Clusters:       map[string]*clientcmdapi.Cluster{"c": {Server: "https://example"}},
+			Contexts:       map[string]*clientcmdapi.Context{"ctx": {Cluster: "c", AuthInfo: "ai"}},
+			CurrentContext: "ctx",
+		}
+	}
+
+	t.Run("with secret", func(t *testing.T) {
+		sa := &corev1.ServiceAccount{ObjectMeta: metav1.ObjectMeta{Name: "sa", Namespace: "ns"}, Secrets: []corev1.ObjectReference{{Name: "s"}}}
+		sec := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "s", Namespace: "ns"}, Data: map[string][]byte{"token": []byte("tok"), "ca.crt": []byte("CA")}}
+		cli := fake.NewSimpleClientset(sa, sec)
+
+		buf := &bytes.Buffer{}
+		cfg := minimalCfg()
+		got, err := generateServiceAccountKubeConfig(ctx, cli, cfg, buf, &KubeConfigGenerateServiceAccountOptions{ServiceAccountName: "sa", ServiceAccountNamespace: "ns", ExpireTime: time.Hour})
+		r.NoError(err)
+		ai := got.AuthInfos[cfg.Contexts[cfg.CurrentContext].AuthInfo]
+		r.Equal("tok", ai.Token)
+		cl := got.Clusters[cfg.Contexts[cfg.CurrentContext].Cluster]
+		r.Equal("CA", string(cl.CertificateAuthorityData))
+	})
+
+	t.Run("with token request", func(t *testing.T) {
+		sa := &corev1.ServiceAccount{ObjectMeta: metav1.ObjectMeta{Name: "sa", Namespace: "ns"}}
+		cm := &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: "kube-root-ca.crt", Namespace: "ns"}, Data: map[string]string{"ca.crt": "CA"}}
+		cli := fake.NewSimpleClientset(sa, cm)
+
+		cli.Fake.PrependReactor("create", "serviceaccounts/token", func(action ktesting.Action) (bool, runtime.Object, error) {
+			obj := &authenticationv1.TokenRequest{
+				Status: authenticationv1.TokenRequestStatus{Token: "rtok"},
+			}
+			return true, obj, nil
+		})
+
+		buf := &bytes.Buffer{}
+		cfg := minimalCfg()
+		got, err := generateServiceAccountKubeConfig(ctx, cli, cfg, buf, &KubeConfigGenerateServiceAccountOptions{ServiceAccountName: "sa", ServiceAccountNamespace: "ns", ExpireTime: time.Hour})
+		r.NoError(err)
+		ai := got.AuthInfos[cfg.Contexts[cfg.CurrentContext].AuthInfo]
+		r.Equal("rtok", ai.Token)
+		cl := got.Clusters[cfg.Contexts[cfg.CurrentContext].Cluster]
+		r.Equal("CA", string(cl.CertificateAuthorityData))
+	})
+}
+
+func TestReadIdentityFromKubeConfig(t *testing.T) {
+	r := require.New(t)
+	dir := t.TempDir()
+
+	t.Run("from certificate", func(t *testing.T) {
+		priv, err := rsa.GenerateKey(rand.Reader, 2048)
+		r.NoError(err)
+		tmpl := &x509.Certificate{SerialNumber: new(big.Int).SetInt64(1), Subject: pkix.Name{CommonName: "alice", Organization: []string{"g1", "g2"}}, NotBefore: time.Now().Add(-time.Hour), NotAfter: time.Now().Add(time.Hour)}
+		certDER, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &priv.PublicKey, priv)
+		r.NoError(err)
+		certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER})
+
+		kcfg := &clientcmdapi.Config{
+			Clusters:       map[string]*clientcmdapi.Cluster{"c": {Server: "https://example"}},
+			Contexts:       map[string]*clientcmdapi.Context{"ctx": {Cluster: "c", AuthInfo: "ai"}},
+			CurrentContext: "ctx",
+			AuthInfos:      map[string]*clientcmdapi.AuthInfo{"ai": {ClientCertificateData: certPEM}},
+		}
+		path := filepath.Join(dir, "kubeconfig-cert")
+		err = clientcmd.WriteToFile(*kcfg, path)
+		r.NoError(err)
+
+		id, err := ReadIdentityFromKubeConfig(path)
+		r.NoError(err)
+		r.Equal("alice", id.User)
+		r.Equal([]string{"g1", "g2"}, id.Groups)
+	})
+
+	t.Run("no auth returns error", func(t *testing.T) {
+		kcfg := &clientcmdapi.Config{
+			Clusters:       map[string]*clientcmdapi.Cluster{"c": {Server: "https://example"}},
+			Contexts:       map[string]*clientcmdapi.Context{"ctx": {Cluster: "c", AuthInfo: "ai"}},
+			CurrentContext: "ctx",
+			AuthInfos:      map[string]*clientcmdapi.AuthInfo{"ai": {}},
+		}
+		path := filepath.Join(dir, "kubeconfig-empty")
+		err := clientcmd.WriteToFile(*kcfg, path)
+		r.NoError(err)
+
+		_, err = ReadIdentityFromKubeConfig(path)
+		r.Error(err)
+		r.Contains(err.Error(), "cannot find client certificate or serviceaccount token in kubeconfig")
+	})
+}
diff --git a/pkg/auth/privileges_test.go b/pkg/auth/privileges_test.go
new file mode 100644
index 00000000..b397595d
--- /dev/null
+++ b/pkg/auth/privileges_test.go
@@ -0,0 +1,377 @@
+/*
+Copyright 2022 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES, OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"bytes"
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	rbacv1 "k8s.io/api/rbac/v1"
+	"k8s.io/apiextensions-apiserver/pkg/apis/apiextensions"
+	kerrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+)
+
+func TestAuthObjRefHelpers(t *testing.T) {
+	testCases := []struct {
+		name             string
+		ref              authObjRef
+		expectedFullName string
+		expectedScope    apiextensions.ResourceScope
+	}{
+		{
+			name:             "namespaced object",
+			ref:              authObjRef{Name: "test-obj", Namespace: "test-ns"},
+			expectedFullName: "test-ns/test-obj",
+			expectedScope:    apiextensions.NamespaceScoped,
+		},
+		{
+			name:             "cluster-scoped object",
+			ref:              authObjRef{Name: "test-obj"},
+			expectedFullName: "test-obj",
+			expectedScope:    apiextensions.ClusterScoped,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := require.New(t)
+			t.Run("FullName", func(t *testing.T) {
+				r.Equal(tc.expectedFullName, tc.ref.FullName())
+			})
+			t.Run("Scope", func(t *testing.T) {
+				r.Equal(tc.expectedScope, tc.ref.Scope())
+			})
+		})
+	}
+}
+
+func TestSubjectsHelpers(t *testing.T) {
+	s1 := rbacv1.Subject{Kind: rbacv1.UserKind, Name: "user1"}
+	s2 := rbacv1.Subject{Kind: rbacv1.GroupKind, Name: "group1"}
+	s3 := rbacv1.Subject{Kind: rbacv1.UserKind, Name: "user2"}
+
+	t.Run("mergeSubjects", func(t *testing.T) {
+		testCases := []struct {
+			name     string
+			src      []rbacv1.Subject
+			merge    []rbacv1.Subject
+			expected []rbacv1.Subject
+		}{
+			{"no duplicates", []rbacv1.Subject{s1}, []rbacv1.Subject{s2}, []rbacv1.Subject{s1, s2}},
+			{"with duplicates", []rbacv1.Subject{s1, s2}, []rbacv1.Subject{s2, s3}, []rbacv1.Subject{s1, s2, s3}},
+			{"merge into empty", nil, []rbacv1.Subject{s1}, []rbacv1.Subject{s1}},
+		}
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				r := require.New(t)
+				merged := mergeSubjects(tc.src, tc.merge)
+				r.ElementsMatch(tc.expected, merged)
+			})
+		}
+	})
+
+	t.Run("removeSubjects", func(t *testing.T) {
+		testCases := []struct {
+			name     string
+			src      []rbacv1.Subject
+			toRemove []rbacv1.Subject
+			expected []rbacv1.Subject
+		}{
+			{"remove existing", []rbacv1.Subject{s1, s2, s3}, []rbacv1.Subject{s2}, []rbacv1.Subject{s1, s3}},
+			{"remove non-existent", []rbacv1.Subject{s1}, []rbacv1.Subject{s2}, []rbacv1.Subject{s1}},
+		}
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				r := require.New(t)
+				remaining := removeSubjects(tc.src, tc.toRemove)
+				r.ElementsMatch(tc.expected, remaining)
+			})
+		}
+	})
+}
+
+func TestPrivilegeDescription(t *testing.T) {
+	r := require.New(t)
+
+	t.Run("ScopedPrivilege", func(t *testing.T) {
+		p := &ScopedPrivilege{Cluster: "c1", Namespace: "ns1", ReadOnly: true}
+		r.Equal("c1", p.GetCluster())
+		roles := p.GetRoles()
+		r.Len(roles, 1)
+		r.Equal(KubeVelaReaderRoleName, roles[0].GetName())
+
+		binding := p.GetRoleBinding(nil).(*rbacv1.RoleBinding)
+		r.Equal("ns1", binding.Namespace)
+		r.Equal(KubeVelaReaderRoleName, binding.RoleRef.Name)
+	})
+
+	t.Run("ApplicationPrivilege", func(t *testing.T) {
+		p := &ApplicationPrivilege{Cluster: "c1", ReadOnly: false}
+		r.Equal("c1", p.GetCluster())
+		roles := p.GetRoles()
+		r.Len(roles, 1)
+		r.Equal(KubeVelaWriterAppRoleName, roles[0].GetName())
+
+		binding := p.GetRoleBinding(nil).(*rbacv1.ClusterRoleBinding)
+		r.Equal(KubeVelaWriterAppRoleName, binding.RoleRef.Name)
+	})
+}
+
+func TestListPrivileges(t *testing.T) {
+	r := require.New(t)
+
+	userRole := &rbacv1.Role{
+		ObjectMeta: metav1.ObjectMeta{Name: "user-role", Namespace: "default"},
+		Rules:      []rbacv1.PolicyRule{{Verbs: []string{"get"}, Resources: []string{"pods"}}},
+	}
+	groupClusterRole := &rbacv1.ClusterRole{
+		ObjectMeta: metav1.ObjectMeta{Name: "group-crole"},
+		Rules:      []rbacv1.PolicyRule{{Verbs: []string{"list"}, Resources: []string{"deployments"}}},
+	}
+	userRoleBinding := &rbacv1.RoleBinding{
+		ObjectMeta: metav1.ObjectMeta{Name: "user-rb", Namespace: "default"},
+		Subjects:   []rbacv1.Subject{{Kind: rbacv1.UserKind, Name: "test-user"}},
+		RoleRef:    rbacv1.RoleRef{Kind: "Role", Name: "user-role"},
+	}
+	groupClusterRoleBinding := &rbacv1.ClusterRoleBinding{
+		ObjectMeta: metav1.ObjectMeta{Name: "group-crb"},
+		Subjects:   []rbacv1.Subject{{Kind: rbacv1.GroupKind, Name: "test-group"}},
+		RoleRef:    rbacv1.RoleRef{Kind: "ClusterRole", Name: "group-crole"},
+	}
+
+	scheme := runtime.NewScheme()
+	r.NoError(rbacv1.AddToScheme(scheme))
+	cli := fake.NewClientBuilder().WithScheme(scheme).WithObjects(userRole, groupClusterRole, userRoleBinding, groupClusterRoleBinding).Build()
+
+	identity := &Identity{User: "test-user", Groups: []string{"test-group"}}
+	privileges, err := ListPrivileges(context.Background(), cli, []string{"local"}, identity)
+
+	r.NoError(err)
+	r.NotNil(privileges)
+	r.Len(privileges, 1)
+	localPrivileges, ok := privileges["local"]
+	r.True(ok)
+	r.Len(localPrivileges, 2)
+
+	foundUserRole := false
+	foundGroupRole := false
+	for _, p := range localPrivileges {
+		if p.RoleRef.Name == "user-role" {
+			foundUserRole = true
+			r.Equal("Role", p.RoleRef.Kind)
+			r.Equal("default", p.RoleRef.Namespace)
+			r.Len(p.Rules, 1)
+			r.Equal("pods", p.Rules[0].Resources[0])
+			r.Len(p.RoleBindingRefs, 1)
+			r.Equal("user-rb", p.RoleBindingRefs[0].Name)
+		}
+		if p.RoleRef.Name == "group-crole" {
+			foundGroupRole = true
+			r.Equal("ClusterRole", p.RoleRef.Kind)
+			r.Len(p.Rules, 1)
+			r.Equal("deployments", p.Rules[0].Resources[0])
+			r.Len(p.RoleBindingRefs, 1)
+			r.Equal("group-crb", p.RoleBindingRefs[0].Name)
+		}
+	}
+	r.True(foundUserRole, "Expected to find privilege for user-role")
+	r.True(foundGroupRole, "Expected to find privilege for group-crole")
+}
+
+func TestPrivilegePrettyPrint(t *testing.T) {
+	r := require.New(t)
+
+	t.Run("printPolicyRule", func(t *testing.T) {
+		testCases := []struct {
+			name     string
+			rule     rbacv1.PolicyRule
+			expected string
+			lim      uint
+		}{
+			{
+				name: "simple rule",
+				rule: rbacv1.PolicyRule{
+					Verbs:     []string{"get", "list"},
+					APIGroups: []string{""},
+					Resources: []string{"pods"},
+				},
+				expected: "Resources:       pods\nVerb:            get, list",
+				lim:      80,
+			},
+			{
+				name: "rule with all fields",
+				rule: rbacv1.PolicyRule{
+					Verbs:           []string{"get"},
+					APIGroups:       []string{"apps"},
+					Resources:       []string{"deployments"},
+					ResourceNames:   []string{"my-deploy"},
+					NonResourceURLs: []string{"/version"},
+				},
+				expected: strings.Join([]string{
+					"APIGroups:       apps",
+					"Resources:       deployments",
+					"ResourceNames:   my-deploy",
+					"NonResourceURLs: /version",
+					"Verb:            get",
+				}, "\n"),
+				lim: 80,
+			},
+		}
+
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				output := printPolicyRule(tc.rule, tc.lim)
+				r.Equal(tc.expected, output)
+			})
+		}
+	})
+
+	t.Run("PrettyPrintPrivileges", func(t *testing.T) {
+		identity := &Identity{User: "test-user"}
+		clusters := []string{"cluster-1", "cluster-2"}
+		privilegesMap := map[string][]PrivilegeInfo{
+			"cluster-1": {
+				{
+					RoleRef:         RoleRef{Kind: "ClusterRole", Name: "view"},
+					RoleBindingRefs: []RoleBindingRef{{Kind: "ClusterRoleBinding", Name: "view-binding"}},
+					Rules:           []rbacv1.PolicyRule{{Verbs: []string{"get", "list"}, APIGroups: []string{"*"}, Resources: []string{"*"}}},
+				},
+				{
+					RoleRef:         RoleRef{Kind: "Role", Name: "editor", Namespace: "default"},
+					RoleBindingRefs: []RoleBindingRef{{Kind: "RoleBinding", Name: "editor-binding", Namespace: "default"}},
+					Rules:           []rbacv1.PolicyRule{{Verbs: []string{"*"}, APIGroups: []string{"apps"}, Resources: []string{"deployments"}}},
+				},
+			},
+			"cluster-2": {},
+		}
+
+		output := PrettyPrintPrivileges(identity, privilegesMap, clusters, 80)
+		// Exact string matching for tree output is brittle, so we check for key components.
+		r.Contains(output, "User=test-user")
+		r.Contains(output, "cluster-1")
+		r.Contains(output, "ClusterRole")
+		r.Contains(output, "view")
+		r.Contains(output, "Role")
+		r.Contains(output, "default/editor")
+		r.Contains(output, "cluster-2")
+		r.Contains(output, "no privilege found")
+		r.Contains(output, "PolicyRules")
+		r.Contains(output, "Scope")
+	})
+}
+
+func TestGrantAndRevokePrivileges(t *testing.T) {
+	r := require.New(t)
+	ctx := context.Background()
+	scheme := runtime.NewScheme()
+	r.NoError(rbacv1.AddToScheme(scheme))
+
+	privileges := []PrivilegeDescription{
+		&ScopedPrivilege{
+			Cluster:  "local",
+			ReadOnly: false, // Creates KubeVelaWriterRoleName
+		},
+	}
+	identityUser1 := &Identity{User: "user1"}
+	identityUser2 := &Identity{User: "user2"}
+
+	t.Run("GrantPrivileges", func(t *testing.T) {
+		cli := fake.NewClientBuilder().WithScheme(scheme).Build()
+		writer := &bytes.Buffer{}
+
+		// 1. Grant to user1
+		err := GrantPrivileges(ctx, cli, privileges, identityUser1, writer)
+		r.NoError(err)
+
+		// Verify Role and Binding created
+		role := &rbacv1.ClusterRole{}
+		err = cli.Get(ctx, types.NamespacedName{Name: KubeVelaWriterRoleName}, role)
+		r.NoError(err)
+
+		binding := &rbacv1.ClusterRoleBinding{}
+		err = cli.Get(ctx, types.NamespacedName{Name: KubeVelaWriterRoleName + ":binding"}, binding)
+		r.NoError(err)
+		r.Len(binding.Subjects, 1)
+		r.Equal("user1", binding.Subjects[0].Name)
+
+		// 2. Grant to user2 (should merge)
+		err = GrantPrivileges(ctx, cli, privileges, identityUser2, writer)
+		r.NoError(err)
+
+		err = cli.Get(ctx, types.NamespacedName{Name: KubeVelaWriterRoleName + ":binding"}, binding)
+		r.NoError(err)
+		r.Len(binding.Subjects, 2)
+		r.ElementsMatch([]rbacv1.Subject{
+			{Kind: rbacv1.UserKind, Name: "user1", APIGroup: rbacv1.GroupName},
+			{Kind: rbacv1.UserKind, Name: "user2", APIGroup: rbacv1.GroupName},
+		}, binding.Subjects)
+
+		// 3. Grant to user1 again with replace
+		err = GrantPrivileges(ctx, cli, privileges, identityUser1, writer, WithReplace)
+		r.NoError(err)
+
+		err = cli.Get(ctx, types.NamespacedName{Name: KubeVelaWriterRoleName + ":binding"}, binding)
+		r.NoError(err)
+		// Due to a bug in GrantPrivileges, WithReplace does not replace subjects.
+		// It re-applies the existing subjects.
+		r.Len(binding.Subjects, 2)
+		r.ElementsMatch([]rbacv1.Subject{
+			{Kind: rbacv1.UserKind, Name: "user1", APIGroup: rbacv1.GroupName},
+			{Kind: rbacv1.UserKind, Name: "user2", APIGroup: rbacv1.GroupName},
+		}, binding.Subjects)
+	})
+
+	t.Run("RevokePrivileges", func(t *testing.T) {
+		// Pre-populate client with a binding with two users
+		initialBinding := &rbacv1.ClusterRoleBinding{
+			ObjectMeta: metav1.ObjectMeta{Name: KubeVelaWriterRoleName + ":binding"},
+			RoleRef:    rbacv1.RoleRef{Kind: "ClusterRole", Name: KubeVelaWriterRoleName},
+			Subjects: []rbacv1.Subject{
+				{Kind: rbacv1.UserKind, Name: "user1", APIGroup: rbacv1.GroupName},
+				{Kind: rbacv1.UserKind, Name: "user2", APIGroup: rbacv1.GroupName},
+			},
+		}
+		cli := fake.NewClientBuilder().WithScheme(scheme).WithObjects(initialBinding).Build()
+		writer := &bytes.Buffer{}
+
+		// 1. Revoke from user1
+		err := RevokePrivileges(ctx, cli, privileges, identityUser1, writer)
+		r.NoError(err)
+
+		// Verify user1 is removed, but binding still exists
+		binding := &rbacv1.ClusterRoleBinding{}
+		err = cli.Get(ctx, types.NamespacedName{Name: KubeVelaWriterRoleName + ":binding"}, binding)
+		r.NoError(err)
+		r.Len(binding.Subjects, 1)
+		r.Equal("user2", binding.Subjects[0].Name)
+
+		// 2. Revoke from user2 (last user)
+		err = RevokePrivileges(ctx, cli, privileges, identityUser2, writer)
+		r.NoError(err)
+
+		// Verify binding is now deleted
+		err = cli.Get(ctx, types.NamespacedName{Name: KubeVelaWriterRoleName + ":binding"}, binding)
+		r.True(kerrors.IsNotFound(err))
+	})
+}
diff --git a/pkg/auth/round_trippers_test.go b/pkg/auth/round_trippers_test.go
index 999c0b6a..05acf3df 100644
--- a/pkg/auth/round_trippers_test.go
+++ b/pkg/auth/round_trippers_test.go
@@ -47,7 +47,7 @@ func (rt *testRoundTripper) RoundTrip(req *http.Request) (*http.Response, error)
 }
 
 func TestImpersonatingRoundTripper(t *testing.T) {
-	defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.AuthenticateApplication, true)()
+	featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.AuthenticateApplication, true)
 	AuthenticationWithUser = true
 	defer func() {
 		AuthenticationWithUser = false
diff --git a/pkg/auth/userinfo_test.go b/pkg/auth/userinfo_test.go
index 45d2ed92..f47fd7c2 100644
--- a/pkg/auth/userinfo_test.go
+++ b/pkg/auth/userinfo_test.go
@@ -32,7 +32,7 @@ import (
 )
 
 func TestContextWithUserInfo(t *testing.T) {
-	defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.AuthenticateApplication, true)()
+	featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.AuthenticateApplication, true)
 	AuthenticationWithUser = true
 	defer func() {
 		AuthenticationWithUser = false
diff --git a/pkg/component/ref_objects_suite_test.go b/pkg/component/ref_objects_suite_test.go
index da26e14b..21d1a6a7 100644
--- a/pkg/component/ref_objects_suite_test.go
+++ b/pkg/component/ref_objects_suite_test.go
@@ -80,8 +80,8 @@ var _ = AfterSuite(func() {
 
 var _ = Describe("Test ref-objects functions", func() {
 	It("Test SelectRefObjectsForDispatch", func() {
-		defer featuregatetesting.SetFeatureGateDuringTest(&testing.T{}, utilfeature.DefaultFeatureGate, features.LegacyObjectTypeIdentifier, true)()
-		defer featuregatetesting.SetFeatureGateDuringTest(&testing.T{}, utilfeature.DefaultFeatureGate, features.DeprecatedObjectLabelSelector, true)()
+		featuregatetesting.SetFeatureGateDuringTest(GinkgoT(), utilfeature.DefaultFeatureGate, features.LegacyObjectTypeIdentifier, true)
+		featuregatetesting.SetFeatureGateDuringTest(GinkgoT(), utilfeature.DefaultFeatureGate, features.DeprecatedObjectLabelSelector, true)
 		By("Create objects")
 		Expect(k8sClient.Create(context.Background(), &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "test"}})).Should(Succeed())
 		for _, obj := range []client.Object{&corev1.ConfigMap{
diff --git a/pkg/config/factory_test.go b/pkg/config/factory_test.go
index 4e7ed109..24a2bbaf 100644
--- a/pkg/config/factory_test.go
+++ b/pkg/config/factory_test.go
@@ -25,7 +25,10 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	"github.com/stretchr/testify/require"
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
+	"github.com/oam-dev/kubevela/apis/types"
 	nacosmock "github.com/oam-dev/kubevela/test/mock/nacos"
 )
 
@@ -170,4 +173,92 @@ var _ = Describe("test config factory", func() {
 		err := fac.DeleteTemplate(context.TODO(), "default", "nacos")
 		Expect(err).Should(BeNil())
 	})
+
+	It("should fail to parse template with invalid CUE syntax", func() {
+		_, err := fac.ParseTemplate(context.Background(), "invalid-cue", []byte("metadata: { name: }"))
+		Expect(err).To(HaveOccurred())
+	})
+
+	It("should fail to parse template missing template block", func() {
+		_, err := fac.ParseTemplate(context.Background(), "missing-template", []byte(`metadata: { name: "t" }`))
+		Expect(err).To(HaveOccurred())
+		Expect(err.Error()).To(ContainSubstring("template"))
+	})
+
+	It("should fail to parse config when template not found", func() {
+		_, err := fac.ParseConfig(context.TODO(), NamespacedName{Name: "non-existent-template", Namespace: "default"}, Metadata{})
+		Expect(err).To(Equal(ErrTemplateNotFound))
+	})
+
+	It("should parse a template-less config", func() {
+		config, err := fac.ParseConfig(context.TODO(), NamespacedName{}, Metadata{
+			NamespacedName: NamespacedName{Name: "template-less-config", Namespace: "default"},
+			Properties:     map[string]interface{}{"key": "value"},
+		})
+		Expect(err).ShouldNot(HaveOccurred())
+		Expect(config.Name).To(Equal("template-less-config"))
+		Expect(config.Secret.Labels[types.LabelConfigType]).To(Equal(""))
+	})
+
+	It("should fail to update config when changing the template", func() {
+		nacos, err := fac.ParseConfig(context.TODO(), NamespacedName{Name: "nacos-server", Namespace: "default"}, Metadata{NamespacedName: NamespacedName{Name: "config-to-change", Namespace: "default"}, Properties: map[string]interface{}{
+			"servers": []map[string]interface{}{{
+				"ipAddr": "127.0.0.1",
+				"port":   8849,
+			}},
+		}})
+		Expect(err).ShouldNot(HaveOccurred())
+		Expect(fac.CreateOrUpdateConfig(context.Background(), nacos, "default")).ShouldNot(HaveOccurred())
+
+		nacos.Template.Name = "another-template"
+		err = fac.CreateOrUpdateConfig(context.Background(), nacos, "default")
+		Expect(err).To(Equal(ErrChangeTemplate))
+	})
+
+	It("should return error when getting a sensitive config", func() {
+		sensitiveTpl, err := fac.ParseTemplate(context.Background(), "", []byte(`
+metadata: { name: "sensitive-tpl", sensitive: true }
+template: { parameter: { key: string } }
+`))
+		Expect(err).ShouldNot(HaveOccurred())
+		Expect(fac.CreateOrUpdateConfigTemplate(context.TODO(), "default", sensitiveTpl)).ShouldNot(HaveOccurred())
+
+		sensitiveConfig, err := fac.ParseConfig(context.TODO(), NamespacedName{Name: "sensitive-tpl", Namespace: "default"}, Metadata{
+			NamespacedName: NamespacedName{Name: "sensitive-config", Namespace: "default"},
+			Properties:     map[string]interface{}{"key": "secret-value"},
+		})
+		Expect(err).ShouldNot(HaveOccurred())
+		Expect(fac.CreateOrUpdateConfig(context.Background(), sensitiveConfig, "default")).ShouldNot(HaveOccurred())
+
+		_, err = fac.GetConfig(context.TODO(), "default", "sensitive-config", false)
+		Expect(err).To(Equal(ErrSensitiveConfig))
+	})
+
+	It("should fail to delete a secret that is not a KubeVela config", func() {
+		secret := &v1.Secret{
+			ObjectMeta: metav1.ObjectMeta{Name: "not-a-config", Namespace: "default"},
+			Data:       map[string][]byte{"key": []byte("value")},
+		}
+		Expect(k8sClient.Create(context.TODO(), secret)).ShouldNot(HaveOccurred())
+
+		err := fac.DeleteConfig(context.TODO(), "default", "not-a-config")
+		Expect(err).To(HaveOccurred())
+		Expect(err.Error()).To(ContainSubstring("is not a config"))
+	})
+
+	It("should fail to convert configmap to template if labels are missing", func() {
+		cm := v1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{Name: "no-labels"},
+		}
+		_, err := convertConfigMap2Template(cm)
+		Expect(err).To(HaveOccurred())
+	})
+
+	It("should fail to convert secret to config if labels are missing", func() {
+		secret := &v1.Secret{
+			ObjectMeta: metav1.ObjectMeta{Name: "no-labels"},
+		}
+		_, err := convertSecret2Config(secret)
+		Expect(err).To(HaveOccurred())
+	})
 })
diff --git a/pkg/config/writer/writer_test.go b/pkg/config/writer/writer_test.go
new file mode 100644
index 00000000..06b114bb
--- /dev/null
+++ b/pkg/config/writer/writer_test.go
@@ -0,0 +1,192 @@
+/*
+Copyright 2022 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package writer
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"cuelang.org/go/cue/cuecontext"
+	"github.com/stretchr/testify/require"
+
+	configcontext "github.com/oam-dev/kubevela/pkg/config/context"
+	"github.com/oam-dev/kubevela/pkg/cue/script"
+)
+
+func TestConvertMap2PropertiesKV(t *testing.T) {
+	r := require.New(t)
+	t.Run("valid conversion", func(t *testing.T) {
+		re := map[string]string{}
+		err := convertMap2PropertiesKV("", map[string]interface{}{
+			"s":  "s",
+			"n":  1,
+			"nn": 1.5,
+			"b":  true,
+			"m": map[string]interface{}{
+				"s": "s",
+				"b": false,
+			},
+			"aa": []string{"a", "a"},
+			"ai": []int64{1, 2},
+			"ar": []map[string]interface{}{{
+				"s2": "s2",
+			}},
+		}, re)
+		r.Equal(err, nil)
+		r.Equal(re, map[string]string{
+			"s":       "s",
+			"n":       "1",
+			"nn":      "1.5",
+			"b":       "true",
+			"m.s":     "s",
+			"m.b":     "false",
+			"aa":      "a,a",
+			"ai":      "1,2",
+			"ar.0.s2": "s2",
+		})
+	})
+
+	t.Run("unsupported type", func(t *testing.T) {
+		re := map[string]string{}
+		err := convertMap2PropertiesKV("", map[string]interface{}{"unsupported": make(chan int)}, re)
+		r.Error(err)
+		r.Contains(err.Error(), "can not be supported")
+	})
+}
+
+func TestEncodingOutput(t *testing.T) {
+	r := require.New(t)
+	t.Run("all formats", func(t *testing.T) {
+		testValue := `
+			context: {
+				key1: "hello"
+				key2: 2
+				key3: true
+				key4: 4.4
+				key5: ["hello"]
+				key6: [{"hello": 1}]
+				key7: [1, 2]
+				key8: [1.2, 1]
+				key9: {key10: [{"wang": true}]}
+			}
+		`
+		v := cuecontext.New().CompileString(testValue)
+		r.Equal(v.Err(), nil)
+
+		_, err := encodingOutput(v, "yaml")
+		r.Equal(err, nil)
+
+		_, err = encodingOutput(v, "properties")
+		r.Equal(err, nil)
+
+		_, err = encodingOutput(v, "toml")
+		r.Equal(err, nil)
+
+		json, err := encodingOutput(v, "json")
+		r.Equal(err, nil)
+		r.Equal(string(json), `{"context":{"key1":"hello","key2":2,"key3":true,"key4":4.4,"key5":["hello"],"key6":[{"hello":1}],"key7":[1,2],"key8":[1.2,1],"key9":{"key10":[{"wang":true}]}}}`)
+	})
+
+	t.Run("specific formats", func(t *testing.T) {
+		testValue := `
+            {
+                key1: "hello"
+                key2: 123
+                key3: {
+                    subkey: "sub"
+                }
+            }
+        `
+		v := cuecontext.New().CompileString(testValue)
+		r.NoError(v.Err())
+
+		tomlBytes, err := encodingOutput(v, "toml")
+		r.NoError(err)
+		expectedToml := "key1 = \"hello\"\nkey2 = 123.0\n\n[key3]\n  subkey = \"sub\"\n"
+		r.Equal(expectedToml, string(tomlBytes))
+
+		propsBytes, err := encodingOutput(v, "properties")
+		r.NoError(err)
+		r.Contains(string(propsBytes), "key1 = hello")
+		r.Contains(string(propsBytes), "key2 = 123")
+		r.Contains(string(propsBytes), "key3.subkey = sub")
+	})
+
+	t.Run("invalid cue value", func(t *testing.T) {
+		v := cuecontext.New().CompileString(`{key: > 1}`)
+		_, err := encodingOutput(v, "json")
+		r.Error(err)
+	})
+}
+
+func TestParseExpandedWriterConfig(t *testing.T) {
+	r := require.New(t)
+	t.Run("missing nacos block", func(t *testing.T) {
+		v := cuecontext.New().CompileString(
+			`
+        template: {}
+        `)
+		r.NoError(v.Err())
+		ewc := ParseExpandedWriterConfig(v)
+		r.Nil(ewc.Nacos)
+	})
+
+	t.Run("malformed nacos block", func(t *testing.T) {
+		v := cuecontext.New().CompileString(`
+        nacos: {
+            endpoint: 123 // should be a struct
+        }
+        `)
+		r.NoError(v.Err())
+		ewc := ParseExpandedWriterConfig(v)
+		r.True(ewc.Nacos == nil || ewc.Nacos.Endpoint.Name == "")
+	})
+}
+
+func TestRenderForExpandedWriter(t *testing.T) {
+	r := require.New(t)
+	t.Run("no nacos config", func(t *testing.T) {
+		ewc := ExpandedWriterConfig{}
+		data, err := RenderForExpandedWriter(ewc, script.CUE(""), configcontext.ConfigRenderContext{}, nil)
+		r.NoError(err)
+		r.Nil(data.Nacos)
+	})
+
+	t.Run("render nacos error", func(t *testing.T) {
+		ewc := ExpandedWriterConfig{
+			Nacos: &NacosConfig{},
+		}
+		s := script.CUE("parameter: {}")
+		_, err := RenderForExpandedWriter(ewc, s, configcontext.ConfigRenderContext{}, nil)
+		r.Error(err)
+	})
+}
+
+func TestWrite(t *testing.T) {
+	r := require.New(t)
+	t.Run("error reading config", func(t *testing.T) {
+		ewd := &ExpandedWriterData{
+			Nacos: &NacosData{},
+		}
+		errs := Write(context.Background(), ewd, func(ctx context.Context, namespace, name string) (map[string]interface{}, error) {
+			return nil, errors.New("read-config-error")
+		})
+		r.Len(errs, 1)
+		r.Equal("fail to read the config of the nacos server:read-config-error", errs[0].Error())
+	})
+}
diff --git a/pkg/config/writer/writter_test.go b/pkg/config/writer/writter_test.go
deleted file mode 100644
index 5b28728e..00000000
--- a/pkg/config/writer/writter_test.go
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
-Copyright 2022 The KubeVela Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-	http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package writer
-
-import (
-	"testing"
-
-	"cuelang.org/go/cue/cuecontext"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertMap2KV(t *testing.T) {
-	r := require.New(t)
-	re := map[string]string{}
-	err := convertMap2PropertiesKV("", map[string]interface{}{
-		"s":  "s",
-		"n":  1,
-		"nn": 1.5,
-		"b":  true,
-		"m": map[string]interface{}{
-			"s": "s",
-			"b": false,
-		},
-		"aa": []string{"a", "a"},
-		"ai": []int64{1, 2},
-		"ar": []map[string]interface{}{{
-			"s2": "s2",
-		}},
-	}, re)
-	r.Equal(err, nil)
-	r.Equal(re, map[string]string{
-		"s":       "s",
-		"n":       "1",
-		"nn":      "1.5",
-		"b":       "true",
-		"m.s":     "s",
-		"m.b":     "false",
-		"aa":      "a,a",
-		"ai":      "1,2",
-		"ar.0.s2": "s2",
-	})
-}
-
-func TestEncodingOutput(t *testing.T) {
-	r := require.New(t)
-	testValue := `
-		context: {
-			key1: "hello"
-			key2: 2
-			key3: true
-			key4: 4.4
-			key5: ["hello"]
-			key6: [{"hello": 1}]
-			key7: [1, 2]
-			key8: [1.2, 1]
-			key9: {key10: [{"wang": true}]}
-		}
-	`
-	v := cuecontext.New().CompileString(testValue)
-	r.Equal(v.Err(), nil)
-
-	_, err := encodingOutput(v, "yaml")
-	r.Equal(err, nil)
-
-	_, err = encodingOutput(v, "properties")
-	r.Equal(err, nil)
-
-	_, err = encodingOutput(v, "toml")
-	r.Equal(err, nil)
-
-	json, err := encodingOutput(v, "json")
-	r.Equal(err, nil)
-	r.Equal(string(json), `{"context":{"key1":"hello","key2":2,"key3":true,"key4":4.4,"key5":["hello"],"key6":[{"hello":1}],"key7":[1,2],"key8":[1.2,1],"key9":{"key10":[{"wang":true}]}}}`)
-}
diff --git a/pkg/controller/core.oam.dev/v1beta1/application/application_controller_test.go b/pkg/controller/core.oam.dev/v1beta1/application/application_controller_test.go
index cb2299f6..fc09f335 100644
--- a/pkg/controller/core.oam.dev/v1beta1/application/application_controller_test.go
+++ b/pkg/controller/core.oam.dev/v1beta1/application/application_controller_test.go
@@ -22,10 +22,13 @@ import (
 	"fmt"
 	"path/filepath"
 	sysruntime "runtime"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
 
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+
 	"github.com/oam-dev/kubevela/pkg/features"
 
 	"github.com/google/go-cmp/cmp"
@@ -756,7 +759,7 @@ var _ = Describe("Test Application Controller", func() {
 	})
 
 	It("application with dag workflow failed after retries", func() {
-		defer featuregatetesting.SetFeatureGateDuringTest(&testing.T{}, utilfeature.DefaultFeatureGate, wffeatures.EnableSuspendOnFailure, true)()
+		featuregatetesting.SetFeatureGateDuringTest(GinkgoT(), utilfeature.DefaultFeatureGate, wffeatures.EnableSuspendOnFailure, true)
 		ns := corev1.Namespace{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "dag-failed-after-retries",
@@ -858,7 +861,7 @@ var _ = Describe("Test Application Controller", func() {
 	})
 
 	It("application with step by step workflow failed after retries", func() {
-		defer featuregatetesting.SetFeatureGateDuringTest(&testing.T{}, utilfeature.DefaultFeatureGate, wffeatures.EnableSuspendOnFailure, true)()
+		featuregatetesting.SetFeatureGateDuringTest(GinkgoT(), utilfeature.DefaultFeatureGate, wffeatures.EnableSuspendOnFailure, true)
 		ns := corev1.Namespace{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "step-by-step-failed-after-retries",
@@ -3888,7 +3891,7 @@ var _ = Describe("Test Application Controller", func() {
 	})
 
 	It("test application with healthy and PreDispatch trait", func() {
-		defer featuregatetesting.SetFeatureGateDuringTest(&testing.T{}, utilfeature.DefaultFeatureGate, features.MultiStageComponentApply, true)()
+		featuregatetesting.SetFeatureGateDuringTest(GinkgoT(), utilfeature.DefaultFeatureGate, features.MultiStageComponentApply, true)
 		By("create the new namespace")
 		ns := &corev1.Namespace{
 			ObjectMeta: metav1.ObjectMeta{
@@ -3938,7 +3941,7 @@ var _ = Describe("Test Application Controller", func() {
 	})
 
 	It("test application with unhealthy and PreDispatch trait", func() {
-		defer featuregatetesting.SetFeatureGateDuringTest(&testing.T{}, utilfeature.DefaultFeatureGate, features.MultiStageComponentApply, true)()
+		featuregatetesting.SetFeatureGateDuringTest(GinkgoT(), utilfeature.DefaultFeatureGate, features.MultiStageComponentApply, true)
 		By("create the new namespace")
 		ns := &corev1.Namespace{
 			ObjectMeta: metav1.ObjectMeta{
@@ -3986,6 +3989,105 @@ var _ = Describe("Test Application Controller", func() {
 		Expect(k8sClient.Delete(ctx, appWithPreDispatch)).Should(BeNil())
 		Expect(k8sClient.Delete(ctx, ns)).Should(BeNil())
 	})
+
+	It("should reevaluate health after workflow finishes and detect component deterioration", func() {
+		reconcileAppAndExpectPhase := func(app *v1beta1.Application, phase common.ApplicationPhase) {
+			Eventually(func() common.ApplicationPhase {
+				_, err := reconciler.Reconcile(ctx, reconcile.Request{
+					NamespacedName: client.ObjectKeyFromObject(app),
+				})
+				Expect(err).ToNot(HaveOccurred())
+
+				updated := &v1beta1.Application{}
+				Expect(k8sClient.Get(ctx, client.ObjectKeyFromObject(app), updated)).To(Succeed())
+
+				return updated.Status.Phase
+			}, time.Second*5, time.Millisecond*500).Should(Equal(phase))
+		}
+
+		patchDeploymentHealthLabel := func(ns corev1.Namespace, val bool) {
+			dep := &v1.Deployment{}
+			Expect(k8sClient.Get(ctx, types.NamespacedName{
+				Name:      "deployment",
+				Namespace: ns.Name,
+			}, dep)).To(Succeed())
+
+			patch := client.MergeFrom(dep.DeepCopy())
+			if dep.Labels == nil {
+				dep.Labels = map[string]string{}
+			}
+			dep.Labels["healthy"] = strconv.FormatBool(val)
+			Expect(k8sClient.Patch(ctx, dep, patch)).To(Succeed())
+			Expect(dep.Labels["healthy"]).To(Equal(strconv.FormatBool(val)))
+		}
+
+		ctx := context.Background()
+		ns := corev1.Namespace{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "health-reeval",
+			},
+		}
+		Expect(k8sClient.Create(ctx, &ns)).Should(Succeed())
+
+		app := &v1beta1.Application{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "reeval-app",
+				Namespace: ns.Name,
+			},
+			Spec: v1beta1.ApplicationSpec{
+				Components: []common.ApplicationComponent{
+					{
+						Name:       "deployment",
+						Type:       "deployment",
+						Properties: &runtime.RawExtension{Raw: []byte(`{"image":"nginx"}`)},
+					},
+				},
+				Policies: []v1beta1.AppPolicy{
+					{
+						Name:       "apply-once",
+						Type:       "apply-once",
+						Properties: &runtime.RawExtension{Raw: []byte(`{"enable":true}`)},
+					},
+				},
+			},
+		}
+
+		By("Applying the test component definition with modifiable health status")
+		defJson, err := yaml.YAMLToJSON([]byte(deploymentComponentDefinitionWithModifiableHealthStatusYaml))
+		Expect(err).ShouldNot(HaveOccurred())
+		u := &unstructured.Unstructured{}
+		err = json.Unmarshal(defJson, u)
+		Expect(err).ShouldNot(HaveOccurred())
+		err = k8sClient.Create(ctx, u.DeepCopy())
+		Expect(err).ShouldNot(HaveOccurred())
+
+		By("Creating the application with the modifiable deployment component")
+		Expect(k8sClient.Create(ctx, app)).Should(Succeed())
+
+		By("Running an initial reconciliation to create the application in a healthy state")
+		reconcileAppAndExpectPhase(app, common.ApplicationRunning)
+
+		By("Manually modifying the deployment to simulate health deterioration")
+		patchDeploymentHealthLabel(ns, false)
+
+		By("Re-reconciling to detect the change and reevaluate health")
+		reconcileAppAndExpectPhase(app, common.ApplicationUnhealthy)
+
+		By("Checking that both the component and application are marked unhealthy")
+		updated := &v1beta1.Application{}
+		Expect(k8sClient.Get(ctx, client.ObjectKeyFromObject(app), updated)).To(Succeed())
+		Expect(updated.Status.Services[0].Healthy).To(BeFalse())
+		Expect(updated.Status.Phase).To(Equal(common.ApplicationUnhealthy))
+
+		By("Reconciling without change to ensure health remains unhealthy")
+		reconcileAppAndExpectPhase(app, common.ApplicationUnhealthy)
+
+		By("Manually modifying the deployment to simulate health restoration")
+		patchDeploymentHealthLabel(ns, true)
+
+		By("Re-reconciling to detect the change and ensure healthy state is restored")
+		reconcileAppAndExpectPhase(app, common.ApplicationRunning)
+	})
 })
 
 const (
@@ -4576,6 +4678,59 @@ spec:
         	$params: value: workloads
         }
         parameter: parallelism: int
+`
+	deploymentComponentDefinitionWithModifiableHealthStatusYaml = `
+apiVersion: core.oam.dev/v1beta1
+kind: ComponentDefinition
+metadata:
+  annotations:
+    definition.oam.dev/description: Simple deployment
+  name: deployment
+  namespace: vela-system
+spec:
+  workload:
+    definition:
+      apiVersion: apps/v1
+      kind: Deployment
+  status:
+    healthPolicy: |
+      isHealth: context.output.metadata.labels.healthy == "true"
+  schematic:
+    cue:
+      template: |
+        parameter: {
+          image: string
+        }
+        output: {
+          apiVersion: "apps/v1"
+          kind: "Deployment"
+          metadata: {
+            name: "deployment"
+            namespace: context.namespace
+            labels: {
+              app: context.name
+              healthy: "true"
+            }
+          }
+          spec: {
+            replicas: 1
+            selector: matchLabels: {
+              app: context.name
+            }
+            template: {
+              metadata: labels: {
+                app: context.name
+              }
+              spec: containers: [{
+                name:  context.name
+                image: parameter.image
+                ports: [{
+                  containerPort: 80
+                }]
+              }]
+            }
+          }
+        }
 `
 )
 
diff --git a/pkg/controller/core.oam.dev/v1beta1/application/application_metrics_test.go b/pkg/controller/core.oam.dev/v1beta1/application/application_metrics_test.go
new file mode 100644
index 00000000..e9f6026e
--- /dev/null
+++ b/pkg/controller/core.oam.dev/v1beta1/application/application_metrics_test.go
@@ -0,0 +1,545 @@
+/*
+Copyright 2021 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package application
+
+import (
+	"context"
+	"testing"
+
+	workflowv1alpha1 "github.com/kubevela/workflow/api/v1alpha1"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/testutil"
+	"github.com/stretchr/testify/assert"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
+	"github.com/oam-dev/kubevela/apis/core.oam.dev/v1beta1"
+	"github.com/oam-dev/kubevela/pkg/monitor/metrics"
+)
+
+func TestCalculateHealthStatus(t *testing.T) {
+	tests := []struct {
+		name     string
+		services []common.ApplicationComponentStatus
+		expected HealthStatus
+	}{
+		{
+			name: "all services healthy",
+			services: []common.ApplicationComponentStatus{
+				{Healthy: true},
+				{Healthy: true},
+				{Healthy: true},
+			},
+			expected: HealthStatus{
+				Healthy:        true,
+				HealthyCount:   3,
+				UnhealthyCount: 0,
+			},
+		},
+		{
+			name: "some unhealthy",
+			services: []common.ApplicationComponentStatus{
+				{Healthy: true},
+				{Healthy: false},
+				{Healthy: true},
+			},
+			expected: HealthStatus{
+				Healthy:        false,
+				HealthyCount:   2,
+				UnhealthyCount: 1,
+			},
+		},
+		{
+			name: "all services unhealthy",
+			services: []common.ApplicationComponentStatus{
+				{Healthy: false},
+				{Healthy: false},
+			},
+			expected: HealthStatus{
+				Healthy:        false,
+				HealthyCount:   0,
+				UnhealthyCount: 2,
+			},
+		},
+		{
+			name:     "no services",
+			services: []common.ApplicationComponentStatus{},
+			expected: HealthStatus{
+				Healthy:        true,
+				HealthyCount:   0,
+				UnhealthyCount: 0,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := calculateHealthStatus(tt.services)
+			assert.Equal(t, tt.expected, got)
+		})
+	}
+}
+
+func TestAppPhaseToNumeric(t *testing.T) {
+	tests := []struct {
+		name  string
+		phase common.ApplicationPhase
+		want  float64
+	}{
+		{"starting", common.ApplicationStarting, 0},
+		{"running", common.ApplicationRunning, 1},
+		{"rendering", common.ApplicationRendering, 2},
+		{"policy generating", common.ApplicationPolicyGenerating, 3},
+		{"running workflow", common.ApplicationRunningWorkflow, 4},
+		{"workflow suspending", common.ApplicationWorkflowSuspending, 5},
+		{"workflow terminated", common.ApplicationWorkflowTerminated, 6},
+		{"workflow failed", common.ApplicationWorkflowFailed, 7},
+		{"unhealthy", common.ApplicationUnhealthy, 8},
+		{"deleting", common.ApplicationDeleting, 9},
+		{"unknown", common.ApplicationPhase("unknown"), -1},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := appPhaseToNumeric(tt.phase)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestWorkflowPhaseToNumeric(t *testing.T) {
+	tests := []struct {
+		name  string
+		phase workflowv1alpha1.WorkflowRunPhase
+		want  float64
+	}{
+		{"initializing", workflowv1alpha1.WorkflowStateInitializing, 0},
+		{"succeeded", workflowv1alpha1.WorkflowStateSucceeded, 1},
+		{"executing", workflowv1alpha1.WorkflowStateExecuting, 2},
+		{"suspending", workflowv1alpha1.WorkflowStateSuspending, 3},
+		{"terminated", workflowv1alpha1.WorkflowStateTerminated, 4},
+		{"failed", workflowv1alpha1.WorkflowStateFailed, 5},
+		{"skipped", workflowv1alpha1.WorkflowStateSkipped, 6},
+		{"unknown", workflowv1alpha1.WorkflowRunPhase("unknown"), -1},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := workflowPhaseToNumeric(tt.phase)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestBuildWorkflowStatus(t *testing.T) {
+	tests := []struct {
+		name     string
+		workflow *common.WorkflowStatus
+		want     map[string]interface{}
+	}{
+		{
+			name:     "nil workflow",
+			workflow: nil,
+			want:     map[string]interface{}{},
+		},
+		{
+			name: "workflow with data",
+			workflow: &common.WorkflowStatus{
+				AppRevision: "rev-1",
+				Finished:    true,
+				Phase:       workflowv1alpha1.WorkflowStateSucceeded,
+				Message:     "Workflow completed",
+			},
+			want: map[string]interface{}{
+				"app_revision": "rev-1",
+				"finished":     true,
+				"phase":        workflowv1alpha1.WorkflowStateSucceeded,
+				"message":      "Workflow completed",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := buildWorkflowStatus(tt.workflow)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestBuildServiceDetails(t *testing.T) {
+	tests := []struct {
+		name     string
+		services []common.ApplicationComponentStatus
+		want     []map[string]interface{}
+	}{
+		{
+			name:     "empty services",
+			services: []common.ApplicationComponentStatus{},
+			want:     []map[string]interface{}{},
+		},
+		{
+			name: "services with details",
+			services: []common.ApplicationComponentStatus{
+				{
+					Name:      "web",
+					Namespace: "default",
+					Cluster:   "local",
+					Healthy:   true,
+					Message:   "Running",
+					Details:   map[string]string{"replicas": "3"},
+				},
+				{
+					Name:      "db",
+					Namespace: "default",
+					Cluster:   "local",
+					Healthy:   false,
+					Message:   "Connection failed",
+				},
+			},
+			want: []map[string]interface{}{
+				{
+					"name":      "web",
+					"namespace": "default",
+					"cluster":   "local",
+					"healthy":   true,
+					"message":   "Running",
+					"details":   map[string]string{"replicas": "3"},
+				},
+				{
+					"name":      "db",
+					"namespace": "default",
+					"cluster":   "local",
+					"healthy":   false,
+					"message":   "Connection failed",
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := buildServiceDetails(tt.services)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestUpdateHealthMetric(t *testing.T) {
+	// Reset the metric before testing
+	metrics.ApplicationHealthStatus.Reset()
+
+	tests := []struct {
+		name          string
+		app           *v1beta1.Application
+		healthy       bool
+		expectedValue float64
+	}{
+		{
+			name: "healthy application",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app",
+					Namespace: "default",
+				},
+			},
+			healthy:       true,
+			expectedValue: 1,
+		},
+		{
+			name: "unhealthy application",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app",
+					Namespace: "default",
+				},
+			},
+			healthy:       false,
+			expectedValue: 0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			updateHealthMetric(tt.app, tt.healthy)
+
+			value := testutil.ToFloat64(metrics.ApplicationHealthStatus.WithLabelValues(
+				tt.app.Name,
+				tt.app.Namespace,
+			))
+			assert.Equal(t, tt.expectedValue, value)
+		})
+	}
+}
+
+func TestUpdatePhaseMetrics(t *testing.T) {
+	// Reset metrics before testing
+	metrics.ApplicationPhase.Reset()
+	metrics.WorkflowPhase.Reset()
+
+	tests := []struct {
+		name                  string
+		app                   *v1beta1.Application
+		expectedAppPhase      float64
+		expectedWorkflowPhase float64
+		hasWorkflowMetric     bool
+	}{
+		{
+			name: "app with workflow",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app",
+					Namespace: "default",
+				},
+				Status: common.AppStatus{
+					Phase: common.ApplicationRunning,
+					Workflow: &common.WorkflowStatus{
+						Phase: workflowv1alpha1.WorkflowStateSucceeded,
+					},
+				},
+			},
+			expectedAppPhase:      1, // ApplicationRunning
+			expectedWorkflowPhase: 1, // WorkflowStateSucceeded
+			hasWorkflowMetric:     true,
+		},
+		{
+			name: "app without workflow",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app-2",
+					Namespace: "default",
+				},
+				Status: common.AppStatus{
+					Phase: common.ApplicationStarting,
+				},
+			},
+			expectedAppPhase:  0, // ApplicationStarting
+			hasWorkflowMetric: false,
+		},
+		{
+			name: "app with empty workflow phase",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app-3",
+					Namespace: "default",
+				},
+				Status: common.AppStatus{
+					Phase: common.ApplicationUnhealthy,
+					Workflow: &common.WorkflowStatus{
+						Phase: "", // Empty phase
+					},
+				},
+			},
+			expectedAppPhase:  8, // ApplicationUnhealthy
+			hasWorkflowMetric: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			updatePhaseMetrics(tt.app)
+
+			appPhaseValue := testutil.ToFloat64(metrics.ApplicationPhase.WithLabelValues(
+				tt.app.Name,
+				tt.app.Namespace,
+			))
+			assert.Equal(t, tt.expectedAppPhase, appPhaseValue)
+
+			if tt.hasWorkflowMetric {
+				workflowPhaseValue := testutil.ToFloat64(metrics.WorkflowPhase.WithLabelValues(
+					tt.app.Name,
+					tt.app.Namespace,
+				))
+				assert.Equal(t, tt.expectedWorkflowPhase, workflowPhaseValue)
+			}
+		})
+	}
+}
+
+func TestLogApplicationStatus(t *testing.T) {
+	tests := []struct {
+		name           string
+		app            *v1beta1.Application
+		healthStatus   HealthStatus
+		workflowStatus map[string]interface{}
+		serviceDetails []map[string]interface{}
+	}{
+		{
+			name: "complete status",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app",
+					Namespace: "default",
+					UID:       "12345",
+					Labels:    map[string]string{"env": "prod"},
+				},
+				Status: common.AppStatus{
+					Phase: common.ApplicationRunning,
+				},
+			},
+			healthStatus: HealthStatus{
+				Healthy:        true,
+				HealthyCount:   2,
+				UnhealthyCount: 0,
+			},
+			workflowStatus: map[string]interface{}{
+				"phase":    workflowv1alpha1.WorkflowStateSucceeded,
+				"finished": true,
+			},
+			serviceDetails: []map[string]interface{}{
+				{
+					"name":    "web",
+					"healthy": true,
+				},
+			},
+		},
+		{
+			name: "minimal status",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app-minimal",
+					Namespace: "default",
+				},
+				Status: common.AppStatus{
+					Phase: common.ApplicationStarting,
+				},
+			},
+			healthStatus:   HealthStatus{Healthy: true},
+			workflowStatus: map[string]interface{}{},
+			serviceDetails: []map[string]interface{}{},
+		},
+		{
+			name: "nil values",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app-nil",
+					Namespace: "default",
+				},
+			},
+			healthStatus:   HealthStatus{},
+			workflowStatus: nil,
+			serviceDetails: nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.NotPanics(t, func() {
+				logApplicationStatus(tt.app, tt.healthStatus, tt.workflowStatus, tt.serviceDetails)
+			})
+		})
+	}
+}
+
+func TestUpdateMetricsAndLogFunction(t *testing.T) {
+	// Reset metrics before testing
+	metrics.ApplicationHealthStatus.Reset()
+	metrics.ApplicationPhase.Reset()
+	metrics.WorkflowPhase.Reset()
+
+	tests := []struct {
+		name string
+		app  *v1beta1.Application
+	}{
+		{
+			name: "complete application",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app",
+					Namespace: "default",
+					UID:       "12345",
+				},
+				Status: common.AppStatus{
+					Phase: common.ApplicationRunning,
+					Services: []common.ApplicationComponentStatus{
+						{
+							Name:      "web",
+							Namespace: "default",
+							Healthy:   true,
+							Message:   "Running",
+						},
+						{
+							Name:      "db",
+							Namespace: "default",
+							Healthy:   false,
+							Message:   "Starting",
+						},
+					},
+					Workflow: &common.WorkflowStatus{
+						Phase:       workflowv1alpha1.WorkflowStateExecuting,
+						Finished:    false,
+						AppRevision: "v1",
+					},
+				},
+			},
+		},
+		{
+			name: "application with no services",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app-empty",
+					Namespace: "test",
+				},
+				Status: common.AppStatus{
+					Phase:    common.ApplicationStarting,
+					Services: []common.ApplicationComponentStatus{},
+				},
+			},
+		},
+		{
+			name: "application with nil workflow",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app-no-workflow",
+					Namespace: "default",
+				},
+				Status: common.AppStatus{
+					Phase: common.ApplicationUnhealthy,
+					Services: []common.ApplicationComponentStatus{
+						{
+							Name:    "failing-service",
+							Healthy: false,
+						},
+					},
+					Workflow: nil,
+				},
+			},
+		},
+	}
+
+	r := &Reconciler{}
+	ctx := context.Background()
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.NotPanics(t, func() {
+				r.updateMetricsAndLog(ctx, tt.app)
+			})
+
+			labels := prometheus.Labels{
+				"app_name":  tt.app.Name,
+				"namespace": tt.app.Namespace,
+			}
+
+			_, err := metrics.ApplicationHealthStatus.GetMetricWith(labels)
+			assert.NoError(t, err)
+
+			_, err = metrics.ApplicationPhase.GetMetricWith(labels)
+			assert.NoError(t, err)
+		})
+	}
+}
diff --git a/pkg/controller/core.oam.dev/v1beta1/application/assemble/assemble_suite_test.go b/pkg/controller/core.oam.dev/v1beta1/application/assemble/assemble_suite_test.go
index eb1db9e3..d830ef26 100644
--- a/pkg/controller/core.oam.dev/v1beta1/application/assemble/assemble_suite_test.go
+++ b/pkg/controller/core.oam.dev/v1beta1/application/assemble/assemble_suite_test.go
@@ -15,3 +15,175 @@ limitations under the License.
 */
 
 package assemble
+
+import (
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+
+	"github.com/oam-dev/kubevela/apis/core.oam.dev/v1beta1"
+	"github.com/oam-dev/kubevela/apis/types"
+	"github.com/oam-dev/kubevela/pkg/oam"
+)
+
+var _ = Describe("Test PrepareBeforeApply", func() {
+	Context("Test disableAllComponentRevision parameter", func() {
+		var (
+			comp     *types.ComponentManifest
+			appRev   *v1beta1.ApplicationRevision
+			revHash  string
+			compName string
+			revName  string
+		)
+
+		BeforeEach(func() {
+			revHash = "test-hash"
+			compName = "test-component"
+			revName = "test-revision"
+
+			// initialize ComponentManifest
+			comp = &types.ComponentManifest{
+				Name:         compName,
+				RevisionName: revName,
+				ComponentOutput: &unstructured.Unstructured{
+					Object: map[string]interface{}{
+						"apiVersion": "apps/v1",
+						"kind":       "Deployment",
+						"metadata": map[string]interface{}{
+							"name": compName,
+						},
+						"spec": map[string]interface{}{
+							"selector": map[string]interface{}{
+								"matchLabels": map[string]interface{}{
+									"app": compName,
+								},
+							},
+							"template": map[string]interface{}{
+								"metadata": map[string]interface{}{
+									"labels": map[string]interface{}{
+										"app": compName,
+									},
+								},
+								"spec": map[string]interface{}{
+									"containers": []interface{}{
+										map[string]interface{}{
+											"name":  "nginx",
+											"image": "nginx:latest",
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+				ComponentOutputsAndTraits: []*unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"apiVersion": "core.oam.dev/v1alpha2",
+							"kind":       "TraitDefinition",
+							"metadata": map[string]interface{}{
+								"name": "test-trait",
+							},
+							"spec": map[string]interface{}{
+								"appliesToWorkloads": []interface{}{"deployments.apps"},
+							},
+						},
+					},
+				},
+			}
+
+			// initialize ApplicationRevision
+			appRev = &v1beta1.ApplicationRevision{
+				Spec: v1beta1.ApplicationRevisionSpec{
+					ApplicationRevisionCompressibleFields: v1beta1.ApplicationRevisionCompressibleFields{
+						ComponentDefinitions: map[string]*v1beta1.ComponentDefinition{},
+						TraitDefinitions: map[string]*v1beta1.TraitDefinition{
+							"test-trait": {
+								Spec: v1beta1.TraitDefinitionSpec{
+									ManageWorkload: false,
+								},
+							},
+						},
+					},
+				},
+			}
+			appRev.SetLabels(map[string]string{
+				oam.LabelAppRevisionHash: revHash,
+			})
+		})
+
+		It("should add component revision label when disableAllComponentRevision is false", func() {
+			wl, traits, err := PrepareBeforeApply(comp, appRev, false)
+			Expect(err).To(BeNil())
+			Expect(wl).NotTo(BeNil())
+			Expect(traits).To(HaveLen(1))
+
+			// Verify workload labels
+			labels := wl.GetLabels()
+			Expect(labels).To(HaveKeyWithValue(oam.LabelAppRevisionHash, revHash))
+			Expect(labels).To(HaveKeyWithValue(oam.LabelAppComponentRevision, revName))
+
+			// Verify trait labels
+			traitLabels := traits[0].GetLabels()
+			Expect(traitLabels).To(HaveKeyWithValue(oam.LabelAppRevisionHash, revHash))
+			Expect(traitLabels).To(HaveKeyWithValue(oam.LabelAppComponentRevision, revName))
+		})
+
+		It("should not add component revision label when disableAllComponentRevision is true", func() {
+			wl, traits, err := PrepareBeforeApply(comp, appRev, true)
+			Expect(err).To(BeNil())
+			Expect(wl).NotTo(BeNil())
+			Expect(traits).To(HaveLen(1))
+
+			// Verify workload labels
+			labels := wl.GetLabels()
+			Expect(labels).To(HaveKeyWithValue(oam.LabelAppRevisionHash, revHash))
+			Expect(labels).NotTo(HaveKey(oam.LabelAppComponentRevision))
+
+			// Verify trait labels
+			traitLabels := traits[0].GetLabels()
+			Expect(traitLabels).To(HaveKeyWithValue(oam.LabelAppRevisionHash, revHash))
+			Expect(traitLabels).NotTo(HaveKey(oam.LabelAppComponentRevision))
+		})
+
+		It("should return nil when component output is nil", func() {
+			comp.ComponentOutput = nil
+			wl, traits, err := PrepareBeforeApply(comp, appRev, false)
+			Expect(err).To(BeNil())
+			Expect(wl).To(BeNil())
+			Expect(traits).To(BeNil())
+		})
+
+		It("should return nil when component output has empty apiVersion and kind", func() {
+			comp.ComponentOutput = &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"metadata": map[string]interface{}{
+						"name": compName,
+					},
+				},
+			}
+			wl, traits, err := PrepareBeforeApply(comp, appRev, false)
+			Expect(err).To(BeNil())
+			Expect(wl).To(BeNil())
+			Expect(traits).To(BeNil())
+		})
+
+		It("should handle empty component revision name", func() {
+			comp.RevisionName = ""
+			wl, traits, err := PrepareBeforeApply(comp, appRev, false)
+			Expect(err).To(BeNil())
+			Expect(wl).NotTo(BeNil())
+			Expect(traits).To(HaveLen(1))
+
+			// Verify workload labels
+			labels := wl.GetLabels()
+			Expect(labels).To(HaveKeyWithValue(oam.LabelAppRevisionHash, revHash))
+			Expect(labels).To(HaveKeyWithValue(oam.LabelAppComponentRevision, ""))
+
+			// Verify trait labels
+			traitLabels := traits[0].GetLabels()
+			Expect(traitLabels).To(HaveKeyWithValue(oam.LabelAppRevisionHash, revHash))
+			Expect(traitLabels).To(HaveKeyWithValue(oam.LabelAppComponentRevision, ""))
+		})
+	})
+})
diff --git a/pkg/cue/definition/health/health_test.go b/pkg/cue/definition/health/health_test.go
new file mode 100644
index 00000000..7420baaa
--- /dev/null
+++ b/pkg/cue/definition/health/health_test.go
@@ -0,0 +1,783 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package health
+
+import (
+	"strings"
+	"testing"
+
+	"cuelang.org/go/cue/token"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCheckHealth(t *testing.T) {
+	cases := map[string]struct {
+		tpContext  map[string]interface{}
+		healthTemp string
+		parameter  interface{}
+		exp        bool
+	}{
+		"normal-equal": {
+			tpContext: map[string]interface{}{
+				"output": map[string]interface{}{
+					"status": map[string]interface{}{
+						"readyReplicas": 4,
+						"replicas":      4,
+					},
+				},
+			},
+			healthTemp: "isHealth:  context.output.status.readyReplicas == context.output.status.replicas",
+			parameter:  nil,
+			exp:        true,
+		},
+		"normal-false": {
+			tpContext: map[string]interface{}{
+				"output": map[string]interface{}{
+					"status": map[string]interface{}{
+						"readyReplicas": 4,
+						"replicas":      5,
+					},
+				},
+			},
+			healthTemp: "isHealth: context.output.status.readyReplicas == context.output.status.replicas",
+			parameter:  nil,
+			exp:        false,
+		},
+		"array-case-equal": {
+			tpContext: map[string]interface{}{
+				"output": map[string]interface{}{
+					"status": map[string]interface{}{
+						"conditions": []interface{}{
+							map[string]interface{}{"status": "True"},
+						},
+					},
+				},
+			},
+			healthTemp: `isHealth: context.output.status.conditions[0].status == "True"`,
+			parameter:  nil,
+			exp:        true,
+		},
+		"parameter-false": {
+			tpContext: map[string]interface{}{
+				"output": map[string]interface{}{
+					"status": map[string]interface{}{
+						"replicas": 4,
+					},
+				},
+				"outputs": map[string]interface{}{
+					"my": map[string]interface{}{
+						"status": map[string]interface{}{
+							"readyReplicas": 4,
+						},
+					},
+				},
+			},
+			healthTemp: "isHealth: context.outputs[parameter.res].status.readyReplicas == context.output.status.replicas",
+			parameter: map[string]string{
+				"res": "my",
+			},
+			exp: true,
+		},
+	}
+	for message, ca := range cases {
+		healthy, err := CheckHealth(ca.tpContext, ca.healthTemp, ca.parameter)
+		assert.NoError(t, err, message)
+		assert.Equal(t, ca.exp, healthy, message)
+	}
+}
+
+func TestGetStatusMessage(t *testing.T) {
+	cases := map[string]struct {
+		tpContext  map[string]interface{}
+		parameter  interface{}
+		statusTemp string
+		expMessage string
+	}{
+		"field-with-array-and-outputs": {
+			tpContext: map[string]interface{}{
+				"outputs": map[string]interface{}{
+					"service": map[string]interface{}{
+						"spec": map[string]interface{}{
+							"type":      "NodePort",
+							"clusterIP": "10.0.0.1",
+							"ports": []interface{}{
+								map[string]interface{}{
+									"port": 80,
+								},
+							},
+						},
+					},
+					"ingress": map[string]interface{}{
+						"rules": []interface{}{
+							map[string]interface{}{
+								"host": "example.com",
+							},
+						},
+					},
+				},
+			},
+			statusTemp: `message: "type: " + context.outputs.service.spec.type + " clusterIP:" + context.outputs.service.spec.clusterIP + " ports:" + "\(context.outputs.service.spec.ports[0].port)" + " domain:" + context.outputs.ingress.rules[0].host`,
+			expMessage: "type: NodePort clusterIP:10.0.0.1 ports:80 domain:example.com",
+		},
+		"complex status": {
+			tpContext: map[string]interface{}{
+				"outputs": map[string]interface{}{
+					"ingress": map[string]interface{}{
+						"spec": map[string]interface{}{
+							"rules": []interface{}{
+								map[string]interface{}{
+									"host": "example.com",
+								},
+							},
+						},
+						"status": map[string]interface{}{
+							"loadBalancer": map[string]interface{}{
+								"ingress": []interface{}{
+									map[string]interface{}{
+										"ip": "10.0.0.1",
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			statusTemp: `if len(context.outputs.ingress.status.loadBalancer.ingress) > 0 {
+	message: "Visiting URL: " + context.outputs.ingress.spec.rules[0].host + ", IP: " + context.outputs.ingress.status.loadBalancer.ingress[0].ip
+}
+if len(context.outputs.ingress.status.loadBalancer.ingress) == 0 {
+	message: "No loadBalancer found, visiting by using 'vela port-forward " + context.appName + " --route'\n"
+}`,
+			expMessage: "Visiting URL: example.com, IP: 10.0.0.1",
+		},
+		"status use parameter field": {
+			tpContext: map[string]interface{}{
+				"outputs": map[string]interface{}{
+					"test-name": map[string]interface{}{
+						"spec": map[string]interface{}{
+							"type":      "NodePort",
+							"clusterIP": "10.0.0.1",
+							"ports": []interface{}{
+								map[string]interface{}{
+									"port": 80,
+								},
+							},
+						},
+					},
+				},
+			},
+			parameter: map[string]interface{}{
+				"configInfo": map[string]string{
+					"name": "test-name",
+				},
+			},
+			statusTemp: `message: parameter.configInfo.name + ".type: " + context.outputs["\(parameter.configInfo.name)"].spec.type`,
+			expMessage: "test-name.type: NodePort",
+		},
+		"import package in template": {
+			tpContext: map[string]interface{}{
+				"outputs": map[string]interface{}{
+					"service": map[string]interface{}{
+						"spec": map[string]interface{}{
+							"type":      "NodePort",
+							"clusterIP": "10.0.0.1",
+							"ports": []interface{}{
+								map[string]interface{}{
+									"port": 80,
+								},
+							},
+						},
+					},
+					"ingress": map[string]interface{}{
+						"rules": []interface{}{
+							map[string]interface{}{
+								"host": "example.com",
+							},
+						},
+					},
+				},
+			},
+			statusTemp: `import "strconv"
+      message: "ports: " + strconv.FormatInt(context.outputs.service.spec.ports[0].port,10)`,
+			expMessage: "ports: 80",
+		},
+	}
+	for message, ca := range cases {
+		gotMessage, err := getStatusMessage(ca.tpContext, ca.statusTemp, ca.parameter)
+		assert.NoError(t, err, message)
+		assert.Equal(t, ca.expMessage, gotMessage, message)
+	}
+}
+
+func TestGetStatus(t *testing.T) {
+	cases := map[string]struct {
+		tpContext map[string]interface{}
+		parameter interface{}
+		statusCue string
+		expStatus map[string]string
+		expErr    bool
+	}{
+		"test-simple-output-status": {
+			tpContext: map[string]interface{}{
+				"output": map[string]interface{}{
+					"replicas":      3,
+					"readyReplicas": 3,
+				},
+			},
+			parameter: make(map[string]interface{}),
+			statusCue: strings.TrimSpace(`
+				deploymentReady: context.output.readyReplicas == context.output.replicas
+				deploymentHealthy: context.output.readyReplicas > 2
+			`),
+			expStatus: map[string]string{
+				"deploymentReady":   "true",
+				"deploymentHealthy": "true",
+			},
+		},
+		"test-simple-outputs-status": {
+			tpContext: map[string]interface{}{
+				"outputs": map[string]interface{}{
+					"deployment": map[string]interface{}{
+						"replicas":      3,
+						"readyReplicas": 3,
+					},
+				},
+			},
+			parameter: make(map[string]interface{}),
+			statusCue: strings.TrimSpace(`
+				deploymentReady: context.outputs.deployment.readyReplicas == context.outputs.deployment.replicas
+				deploymentHealthy: context.outputs.deployment.readyReplicas > 2
+			`),
+			expStatus: map[string]string{
+				"deploymentReady":   "true",
+				"deploymentHealthy": "true",
+			},
+		},
+		"test-field-is-already-a-string": {
+			tpContext: map[string]interface{}{
+				"output": map[string]interface{}{
+					"stringVal": "abc",
+				},
+			},
+			parameter: make(map[string]interface{}),
+			statusCue: strings.TrimSpace(`
+				stringVal: context.output.stringVal
+			`),
+			expStatus: map[string]string{
+				"stringVal": "abc",
+			},
+		},
+		"test-field-not-exists": {
+			tpContext: map[string]interface{}{
+				"outputs": map[string]interface{}{
+					"deployment": map[string]interface{}{},
+				},
+			},
+			parameter: make(map[string]interface{}),
+			statusCue: strings.TrimSpace(`
+				notExists: context.output.notExists
+			`),
+			expStatus: map[string]string{
+				"notExists": token.BOTTOM.String(),
+			},
+		},
+		"test-field-not-exists-has-no-impact-on-others": {
+			tpContext: map[string]interface{}{
+				"output": map[string]interface{}{
+					"deployment": map[string]interface{}{
+						"exists": "abc",
+					},
+				},
+			},
+			parameter: make(map[string]interface{}),
+			statusCue: strings.TrimSpace(`
+				exists: context.output.deployment.exists
+				notExists: context.output.notExists
+			`),
+			expStatus: map[string]string{
+				"notExists": token.BOTTOM.String(),
+				"exists":    "abc",
+			},
+		},
+		"test-parameter-in-status": {
+			tpContext: map[string]interface{}{
+				"output": map[string]interface{}{
+					"anOutput": 2,
+				},
+			},
+			parameter: map[string]interface{}{
+				"aParam": 2,
+			},
+			statusCue: strings.TrimSpace(`
+				sum: context.output.anOutput + parameter.aParam
+			`),
+			expStatus: map[string]string{
+				"sum": "4",
+			},
+		},
+		"test-key-input-too-large-skipped": {
+			tpContext: map[string]interface{}{
+				"output": map[string]interface{}{
+					"anOutput": 2,
+				},
+			},
+			parameter: make(map[string]interface{}),
+			statusCue: strings.TrimSpace(`
+				thisIsAKeyThatIsWayTooLongToBeUsedAsAKeyInTheStatusMapAndShouldBeSkipped: context.output.anOutput
+			`),
+			expStatus: map[string]string{},
+		},
+		"test-not-exists-with-fallback": {
+			tpContext: map[string]interface{}{
+				"output": map[string]interface{}{},
+			},
+			parameter: make(map[string]interface{}),
+			statusCue: strings.TrimSpace(`
+				healthy: *context.output.isHealthy | false
+			`),
+			expStatus: map[string]string{
+				"healthy": "false",
+			},
+		},
+		"test-invalid-context-fails-gracefully": {
+			tpContext: map[string]interface{}{
+				"createFailure": make(chan int), // This simulates json parsing failures
+			},
+			parameter: make(map[string]interface{}),
+			statusCue: strings.TrimSpace(`
+				healthy: *context.output.isHealthy | false
+			`),
+			expStatus: map[string]string{},
+			expErr:    true,
+		},
+		"test-annotations-ignored-but-referencable": {
+			tpContext: map[string]interface{}{
+				"output": map[string]interface{}{
+					"replicas":      3,
+					"readyReplicas": 3,
+				},
+			},
+			parameter: make(map[string]interface{}),
+			statusCue: strings.TrimSpace(`
+		        a: 1 @local()
+				b: 2 @private()
+				c: a + b
+			`),
+			expStatus: map[string]string{
+				"c": "3",
+			},
+		},
+		"test-$-fields-ignored-but-referencable": {
+			tpContext: map[string]interface{}{
+				"output": map[string]interface{}{
+					"replicas":      3,
+					"readyReplicas": 3,
+				},
+			},
+			parameter: make(map[string]interface{}),
+			statusCue: strings.TrimSpace(`
+		        $a: 1
+				$b: 2
+				c: $a + $b
+			`),
+			expStatus: map[string]string{
+				"c": "3",
+			},
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			_, status, err := getStatusMap(tc.tpContext, tc.statusCue, tc.parameter)
+			if !tc.expErr {
+				assert.NoError(t, err)
+			}
+			assert.Equal(t, tc.expStatus, status, "status fields should match")
+		})
+	}
+}
+
+func TestContextPassing(t *testing.T) {
+	cases := map[string]struct {
+		initialCtx  map[string]interface{}
+		request     StatusRequest
+		expMessage  string
+		expDetails  map[string]string
+		validateCtx func(t *testing.T, ctx map[string]interface{})
+	}{
+		"basic-context-passing": {
+			initialCtx: map[string]interface{}{},
+			request: StatusRequest{
+				Parameter: map[string]interface{}{},
+				Details: strings.TrimSpace(`
+					stringValue: "example"
+					intValue: 1 + 2
+				`),
+				Custom: strings.TrimSpace(`
+					message: "\(context.status.details.stringValue) \(context.status.details.intValue)"
+				`),
+			},
+			expMessage: "example 3",
+			expDetails: map[string]string{
+				"stringValue": "example",
+				"intValue":    "3",
+			},
+		},
+		"complex-types-in-context": {
+			initialCtx: map[string]interface{}{
+				"outputs": map[string]interface{}{
+					"service": map[string]interface{}{
+						"port": 8080,
+					},
+				},
+			},
+			request: StatusRequest{
+				Parameter: map[string]interface{}{
+					"replicas": 3,
+				},
+				Details: strings.TrimSpace(`
+					replicas: parameter.replicas
+					port: context.outputs.service.port
+					isReady: parameter.replicas > 0 && context.outputs.service.port > 0
+					config: {
+						enabled: true
+						timeout: 30
+					} @private()
+					configEnabled: config.enabled
+					configTimeout: config.timeout
+				`),
+				Custom: strings.TrimSpace(`
+					message: "Service on port \(context.status.details.port) with \(context.status.details.replicas) replicas is ready: \(context.status.details.isReady)"
+				`),
+			},
+			expMessage: "Service on port 8080 with 3 replicas is ready: true",
+			expDetails: map[string]string{
+				"replicas":      "3",
+				"port":          "8080",
+				"isReady":       "true",
+				"configEnabled": "true",
+				"configTimeout": "30",
+			},
+			validateCtx: func(t *testing.T, ctx map[string]interface{}) {
+				statusCtx := ctx["status"].(map[string]interface{})
+				details := statusCtx["details"].(map[string]interface{})
+
+				assert.Equal(t, 3, details["replicas"])
+				assert.Equal(t, 8080, details["port"])
+				assert.Equal(t, true, details["isReady"])
+				assert.Equal(t, true, details["configEnabled"])
+				assert.Equal(t, 30, details["configTimeout"])
+
+				assert.Nil(t, details["config"])
+			},
+		},
+		"array-handling-in-context": {
+			initialCtx: map[string]interface{}{},
+			request: StatusRequest{
+				Parameter: map[string]interface{}{},
+				Details: strings.TrimSpace(`
+					$ports: [80, 443, 8080]
+					$protocols: ["http", "https", "http"]
+					$mappings: [
+						{port: 80, protocol: "http"},
+						{port: 443, protocol: "https"}
+					]
+					portCount: len($ports)
+					firstPort: $ports[0]
+					mainProtocol: $protocols[0]
+					portsString: "80,443,8080"
+				`),
+				Custom: strings.TrimSpace(`
+					message: "Serving on \(len(context.status.details.$ports)) ports"
+				`),
+			},
+			expMessage: "Serving on 3 ports",
+			expDetails: map[string]string{
+				"portCount":    "3",
+				"firstPort":    "80",
+				"mainProtocol": "http",
+				"portsString":  "80,443,8080",
+			},
+			validateCtx: func(t *testing.T, ctx map[string]interface{}) {
+				statusCtx := ctx["status"].(map[string]interface{})
+				details := statusCtx["details"].(map[string]interface{})
+
+				ports := details["$ports"].([]interface{})
+				assert.Len(t, ports, 3)
+				assert.Equal(t, 80, ports[0])
+				assert.Equal(t, 443, ports[1])
+				assert.Equal(t, 8080, ports[2])
+
+				protocols := details["$protocols"].([]interface{})
+				assert.Len(t, protocols, 3)
+				assert.Equal(t, "http", protocols[0])
+				assert.Equal(t, "https", protocols[1])
+
+				mappings := details["$mappings"].([]interface{})
+				assert.Len(t, mappings, 2)
+
+				assert.Equal(t, 3, details["portCount"])
+				assert.Equal(t, 80, details["firstPort"])
+				assert.Equal(t, "http", details["mainProtocol"])
+				assert.Equal(t, "80,443,8080", details["portsString"])
+			},
+		},
+		"nested-references": {
+			initialCtx: map[string]interface{}{
+				"appName": "my-app",
+			},
+			request: StatusRequest{
+				Parameter: map[string]interface{}{
+					"env": "production",
+				},
+				Details: strings.TrimSpace(`
+					environment: parameter.env
+					$appInfo: {
+						name: context.appName
+						env: parameter.env
+						fullName: "\(context.appName)-\(parameter.env)"
+					}
+					appName: $appInfo.name
+					appEnv: $appInfo.env
+					appFullName: $appInfo.fullName
+				`),
+				Custom: strings.TrimSpace(`
+					message: "Deployed \(context.status.details.$appInfo.fullName) to \(context.status.details.environment)"
+				`),
+			},
+			expMessage: "Deployed my-app-production to production",
+			expDetails: map[string]string{
+				"environment": "production",
+				"appName":     "my-app",
+				"appEnv":      "production",
+				"appFullName": "my-app-production",
+			},
+			validateCtx: func(t *testing.T, ctx map[string]interface{}) {
+				statusCtx := ctx["status"].(map[string]interface{})
+				details := statusCtx["details"].(map[string]interface{})
+
+				appInfo := details["$appInfo"].(map[string]interface{})
+				assert.Equal(t, "my-app", appInfo["name"])
+				assert.Equal(t, "production", appInfo["env"])
+				assert.Equal(t, "my-app-production", appInfo["fullName"])
+
+				assert.Equal(t, "production", details["environment"])
+				assert.Equal(t, "my-app", details["appName"])
+				assert.Equal(t, "production", details["appEnv"])
+				assert.Equal(t, "my-app-production", details["appFullName"])
+			},
+		},
+		"existing-status-preserved": {
+			initialCtx: map[string]interface{}{
+				"status": map[string]interface{}{
+					"existingField": "should-be-preserved",
+				},
+			},
+			request: StatusRequest{
+				Parameter: map[string]interface{}{},
+				Details: strings.TrimSpace(`
+					newField: "added-value"
+				`),
+				Custom: strings.TrimSpace(`
+					message: "Status has existing: \(context.status.existingField)"
+				`),
+			},
+			expMessage: "Status has existing: should-be-preserved",
+			expDetails: map[string]string{
+				"newField": "added-value",
+			},
+			validateCtx: func(t *testing.T, ctx map[string]interface{}) {
+				statusCtx := ctx["status"].(map[string]interface{})
+				assert.Equal(t, "should-be-preserved", statusCtx["existingField"])
+				assert.NotNil(t, statusCtx["details"])
+			},
+		},
+		"dollar-fields-in-context-only": {
+			initialCtx: map[string]interface{}{},
+			request: StatusRequest{
+				Parameter: map[string]interface{}{
+					"baseValue": 10,
+				},
+				Details: strings.TrimSpace(`
+					$multiplier: 2
+					$offset: 5
+					result: parameter.baseValue * $multiplier + $offset
+					displayText: "Result is \(result)"
+				`),
+				Custom: strings.TrimSpace(`
+					message: "Computed using multiplier \(context.status.details.$multiplier) and offset \(context.status.details.$offset)"
+				`),
+			},
+			expMessage: "Computed using multiplier 2 and offset 5",
+			expDetails: map[string]string{
+				"result":      "25",
+				"displayText": "Result is 25",
+			},
+			validateCtx: func(t *testing.T, ctx map[string]interface{}) {
+				statusCtx := ctx["status"].(map[string]interface{})
+				details := statusCtx["details"].(map[string]interface{})
+
+				assert.Equal(t, 2, details["$multiplier"])
+				assert.Equal(t, 5, details["$offset"])
+				assert.Equal(t, 25, details["result"])
+				assert.Equal(t, "Result is 25", details["displayText"])
+			},
+		},
+		"health-check-references-status-details": {
+			initialCtx: map[string]interface{}{
+				"output": map[string]interface{}{
+					"status": map[string]interface{}{
+						"replicas":      5,
+						"readyReplicas": 3,
+					},
+				},
+			},
+			request: StatusRequest{
+				Parameter: map[string]interface{}{},
+				Details: strings.TrimSpace(`
+					replicas: context.output.status.replicas
+					readyReplicas: context.output.status.readyReplicas
+					percentReady: "\(readyReplicas * 100 / replicas)%"
+				`),
+				Health: strings.TrimSpace(`
+					isHealth: context.status.details.replicas == context.status.details.readyReplicas
+				`),
+				Custom: strings.TrimSpace(`
+					message: "Deployment status: \(context.status.details.percentReady) ready"
+				`),
+			},
+			expMessage: "Deployment status: 60% ready",
+			expDetails: map[string]string{
+				"replicas":      "5",
+				"readyReplicas": "3",
+				"percentReady":  "60%",
+			},
+			validateCtx: func(t *testing.T, ctx map[string]interface{}) {
+				statusCtx := ctx["status"].(map[string]interface{})
+				assert.Equal(t, false, statusCtx["healthy"])
+				details := statusCtx["details"].(map[string]interface{})
+				assert.Equal(t, 5, details["replicas"])
+				assert.Equal(t, 3, details["readyReplicas"])
+			},
+		},
+		"message-references-health-and-details": {
+			initialCtx: map[string]interface{}{
+				"output": map[string]interface{}{
+					"status": map[string]interface{}{
+						"phase":         "Running",
+						"replicas":      3,
+						"readyReplicas": 3,
+					},
+				},
+			},
+			request: StatusRequest{
+				Parameter: map[string]interface{}{},
+				Details: strings.TrimSpace(`
+					phase: context.output.status.phase
+					replicas: context.output.status.replicas
+					readyReplicas: context.output.status.readyReplicas
+				`),
+				Health: strings.TrimSpace(`
+					isHealth: context.status.details.phase == "Running" && context.status.details.readyReplicas == context.status.details.replicas
+				`),
+				Custom: strings.TrimSpace(`
+					if context.status.healthy {
+						message: "Deployment is healthy: \(context.status.details.readyReplicas)/\(context.status.details.replicas) replicas ready"
+					}
+					if !context.status.healthy {
+						message: "Deployment unhealthy: \(context.status.details.readyReplicas)/\(context.status.details.replicas) replicas ready"
+					}
+				`),
+			},
+			expMessage: "Deployment is healthy: 3/3 replicas ready",
+			expDetails: map[string]string{
+				"phase":         "Running",
+				"replicas":      "3",
+				"readyReplicas": "3",
+			},
+			validateCtx: func(t *testing.T, ctx map[string]interface{}) {
+				statusCtx := ctx["status"].(map[string]interface{})
+				assert.Equal(t, true, statusCtx["healthy"])
+			},
+		},
+		"complex-health-with-computed-details": {
+			initialCtx: map[string]interface{}{
+				"output": map[string]interface{}{
+					"status": map[string]interface{}{
+						"capacity":  100,
+						"used":      85,
+						"threshold": 80,
+					},
+				},
+			},
+			request: StatusRequest{
+				Parameter: map[string]interface{}{},
+				Details: strings.TrimSpace(`
+					capacity: context.output.status.capacity
+					used: context.output.status.used
+					threshold: context.output.status.threshold
+					$utilization: used * 100.0 / capacity
+					utilizationPercent: "\($utilization)%"
+					$overThreshold: $utilization > threshold
+				`),
+				Health: strings.TrimSpace(`
+					isHealth: !context.status.details.$overThreshold
+				`),
+				Custom: strings.TrimSpace(`
+					if context.status.healthy {
+						message: "Resource usage OK at \(context.status.details.utilizationPercent)"
+					}
+					if !context.status.healthy {
+						message: "Resource usage HIGH at \(context.status.details.utilizationPercent) (threshold: \(context.status.details.threshold)%)"
+					}
+				`),
+			},
+			expMessage: "Resource usage HIGH at 85.0% (threshold: 80%)",
+			expDetails: map[string]string{
+				"capacity":           "100",
+				"used":               "85",
+				"threshold":          "80",
+				"utilizationPercent": "85.0%",
+			},
+			validateCtx: func(t *testing.T, ctx map[string]interface{}) {
+				statusCtx := ctx["status"].(map[string]interface{})
+				assert.Equal(t, false, statusCtx["healthy"])
+				details := statusCtx["details"].(map[string]interface{})
+				assert.Equal(t, float64(85), details["$utilization"])
+				assert.Equal(t, true, details["$overThreshold"])
+			},
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			ctx := make(map[string]interface{})
+			for k, v := range tc.initialCtx {
+				ctx[k] = v
+			}
+
+			result, err := GetStatus(ctx, &tc.request)
+			assert.NoError(t, err)
+			assert.Equal(t, tc.expMessage, result.Message)
+			assert.Equal(t, tc.expDetails, result.Details)
+
+			if tc.validateCtx != nil {
+				tc.validateCtx(t, ctx)
+			}
+		})
+	}
+}
diff --git a/pkg/cue/definition/template_test.go b/pkg/cue/definition/template_test.go
index 9d13a949..15a9f5bf 100644
--- a/pkg/cue/definition/template_test.go
+++ b/pkg/cue/definition/template_test.go
@@ -21,13 +21,18 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
 	wfprocess "github.com/kubevela/workflow/pkg/cue/process"
 
 	"github.com/oam-dev/kubevela/apis/types"
 	"github.com/oam-dev/kubevela/pkg/cue/process"
+	"github.com/oam-dev/kubevela/pkg/oam/util"
 )
 
 func TestWorkloadTemplateComplete(t *testing.T) {
@@ -1282,205 +1287,6 @@ outputs: abc :{
 	}
 }
 
-func TestCheckHealth(t *testing.T) {
-	cases := map[string]struct {
-		tpContext  map[string]interface{}
-		healthTemp string
-		parameter  interface{}
-		exp        bool
-	}{
-		"normal-equal": {
-			tpContext: map[string]interface{}{
-				"output": map[string]interface{}{
-					"status": map[string]interface{}{
-						"readyReplicas": 4,
-						"replicas":      4,
-					},
-				},
-			},
-			healthTemp: "isHealth:  context.output.status.readyReplicas == context.output.status.replicas",
-			parameter:  nil,
-			exp:        true,
-		},
-		"normal-false": {
-			tpContext: map[string]interface{}{
-				"output": map[string]interface{}{
-					"status": map[string]interface{}{
-						"readyReplicas": 4,
-						"replicas":      5,
-					},
-				},
-			},
-			healthTemp: "isHealth: context.output.status.readyReplicas == context.output.status.replicas",
-			parameter:  nil,
-			exp:        false,
-		},
-		"array-case-equal": {
-			tpContext: map[string]interface{}{
-				"output": map[string]interface{}{
-					"status": map[string]interface{}{
-						"conditions": []interface{}{
-							map[string]interface{}{"status": "True"},
-						},
-					},
-				},
-			},
-			healthTemp: `isHealth: context.output.status.conditions[0].status == "True"`,
-			parameter:  nil,
-			exp:        true,
-		},
-		"parameter-false": {
-			tpContext: map[string]interface{}{
-				"output": map[string]interface{}{
-					"status": map[string]interface{}{
-						"replicas": 4,
-					},
-				},
-				"outputs": map[string]interface{}{
-					"my": map[string]interface{}{
-						"status": map[string]interface{}{
-							"readyReplicas": 4,
-						},
-					},
-				},
-			},
-			healthTemp: "isHealth: context.outputs[parameter.res].status.readyReplicas == context.output.status.replicas",
-			parameter: map[string]string{
-				"res": "my",
-			},
-			exp: true,
-		},
-	}
-	for message, ca := range cases {
-		healthy, err := checkHealth(ca.tpContext, ca.healthTemp, ca.parameter)
-		assert.NoError(t, err, message)
-		assert.Equal(t, ca.exp, healthy, message)
-	}
-}
-
-func TestGetStatus(t *testing.T) {
-	cases := map[string]struct {
-		tpContext  map[string]interface{}
-		parameter  interface{}
-		statusTemp string
-		expMessage string
-	}{
-		"field-with-array-and-outputs": {
-			tpContext: map[string]interface{}{
-				"outputs": map[string]interface{}{
-					"service": map[string]interface{}{
-						"spec": map[string]interface{}{
-							"type":      "NodePort",
-							"clusterIP": "10.0.0.1",
-							"ports": []interface{}{
-								map[string]interface{}{
-									"port": 80,
-								},
-							},
-						},
-					},
-					"ingress": map[string]interface{}{
-						"rules": []interface{}{
-							map[string]interface{}{
-								"host": "example.com",
-							},
-						},
-					},
-				},
-			},
-			statusTemp: `message: "type: " + context.outputs.service.spec.type + " clusterIP:" + context.outputs.service.spec.clusterIP + " ports:" + "\(context.outputs.service.spec.ports[0].port)" + " domain:" + context.outputs.ingress.rules[0].host`,
-			expMessage: "type: NodePort clusterIP:10.0.0.1 ports:80 domain:example.com",
-		},
-		"complex status": {
-			tpContext: map[string]interface{}{
-				"outputs": map[string]interface{}{
-					"ingress": map[string]interface{}{
-						"spec": map[string]interface{}{
-							"rules": []interface{}{
-								map[string]interface{}{
-									"host": "example.com",
-								},
-							},
-						},
-						"status": map[string]interface{}{
-							"loadBalancer": map[string]interface{}{
-								"ingress": []interface{}{
-									map[string]interface{}{
-										"ip": "10.0.0.1",
-									},
-								},
-							},
-						},
-					},
-				},
-			},
-			statusTemp: `if len(context.outputs.ingress.status.loadBalancer.ingress) > 0 {
-	message: "Visiting URL: " + context.outputs.ingress.spec.rules[0].host + ", IP: " + context.outputs.ingress.status.loadBalancer.ingress[0].ip
-}
-if len(context.outputs.ingress.status.loadBalancer.ingress) == 0 {
-	message: "No loadBalancer found, visiting by using 'vela port-forward " + context.appName + " --route'\n"
-}`,
-			expMessage: "Visiting URL: example.com, IP: 10.0.0.1",
-		},
-		"status use parameter field": {
-			tpContext: map[string]interface{}{
-				"outputs": map[string]interface{}{
-					"test-name": map[string]interface{}{
-						"spec": map[string]interface{}{
-							"type":      "NodePort",
-							"clusterIP": "10.0.0.1",
-							"ports": []interface{}{
-								map[string]interface{}{
-									"port": 80,
-								},
-							},
-						},
-					},
-				},
-			},
-			parameter: map[string]interface{}{
-				"configInfo": map[string]string{
-					"name": "test-name",
-				},
-			},
-			statusTemp: `message: parameter.configInfo.name + ".type: " + context.outputs["\(parameter.configInfo.name)"].spec.type`,
-			expMessage: "test-name.type: NodePort",
-		},
-		"import package in template": {
-			tpContext: map[string]interface{}{
-				"outputs": map[string]interface{}{
-					"service": map[string]interface{}{
-						"spec": map[string]interface{}{
-							"type":      "NodePort",
-							"clusterIP": "10.0.0.1",
-							"ports": []interface{}{
-								map[string]interface{}{
-									"port": 80,
-								},
-							},
-						},
-					},
-					"ingress": map[string]interface{}{
-						"rules": []interface{}{
-							map[string]interface{}{
-								"host": "example.com",
-							},
-						},
-					},
-				},
-			},
-			statusTemp: `import "strconv"
-      message: "ports: " + strconv.FormatInt(context.outputs.service.spec.ports[0].port,10)`,
-			expMessage: "ports: 80",
-		},
-	}
-	for message, ca := range cases {
-		gotMessage, err := getStatusMessage(ca.tpContext, ca.statusTemp, ca.parameter)
-		assert.NoError(t, err, message)
-		assert.Equal(t, ca.expMessage, gotMessage, message)
-	}
-}
-
 func TestTraitPatchSingleOutput(t *testing.T) {
 	baseTemplate := `
 	output: {
@@ -1565,3 +1371,324 @@ parameter: {
 		assert.Contains(t, err.Error(), v.err)
 	}
 }
+
+func TestWorkloadGetTemplateContext(t *testing.T) {
+	scheme := runtime.NewScheme()
+	require.NoError(t, appsv1.AddToScheme(scheme))
+	require.NoError(t, corev1.AddToScheme(scheme))
+
+	workload := &unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"apiVersion": "apps/v1",
+			"kind":       "Deployment",
+			"metadata": map[string]interface{}{
+				"name":      "test-workload",
+				"namespace": "default",
+			},
+		},
+	}
+	auxSvc := &unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "Service",
+			"metadata": map[string]interface{}{
+				"name":      "test-aux-svc",
+				"namespace": "default",
+			},
+		},
+	}
+
+	baseCtx := process.NewContext(process.ContextData{
+		AppName:         "myapp",
+		CompName:        "test",
+		Namespace:       "default",
+		AppRevisionName: "myapp-v1",
+	})
+
+	workloadTemplate := `
+output: {
+	apiVersion: "apps/v1"
+    kind: "Deployment"
+	metadata: {
+		name: "test-workload"
+		namespace: "default"
+	}
+}
+outputs: service: {
+	apiVersion: "v1"
+    kind: "Service"
+	metadata: {
+		name: "test-aux-svc"
+		namespace: "default"
+	}
+}
+`
+	wt := NewWorkloadAbstractEngine("testWorkload")
+	err := wt.Complete(baseCtx, workloadTemplate, nil)
+	require.NoError(t, err)
+
+	testCases := map[string]struct {
+		reason    string
+		cli       client.Client
+		ctx       wfprocess.Context
+		wantErr   bool
+		checkFunc func(t *testing.T, templateContext map[string]interface{})
+	}{
+		"successfully get template context": {
+			reason: "Should successfully get the template context with both output and outputs.",
+			cli:    fake.NewClientBuilder().WithScheme(scheme).WithObjects(workload, auxSvc).Build(),
+			ctx:    baseCtx,
+			checkFunc: func(t *testing.T, templateContext map[string]interface{}) {
+				require.NotNil(t, templateContext)
+				output, ok := templateContext[OutputFieldName]
+				require.True(t, ok)
+				outputMap, ok := output.(map[string]interface{})
+				require.True(t, ok)
+				require.Equal(t, "test-workload", outputMap["metadata"].(map[string]interface{})["name"])
+
+				outputs, ok := templateContext[OutputsFieldName]
+				require.True(t, ok)
+				outputsMap, ok := outputs.(map[string]interface{})
+				require.True(t, ok)
+				svc, ok := outputsMap["service"]
+				require.True(t, ok)
+				svcMap, ok := svc.(map[string]interface{})
+				require.True(t, ok)
+				require.Equal(t, "test-aux-svc", svcMap["metadata"].(map[string]interface{})["name"])
+			},
+		},
+		"resource not found": {
+			reason:  "Should return an error when a resource is not found in the cluster.",
+			cli:     fake.NewClientBuilder().WithScheme(scheme).Build(),
+			ctx:     baseCtx,
+			wantErr: true,
+		},
+	}
+
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			wd := &workloadDef{def: def{name: "test"}}
+			accessor := util.NewApplicationResourceNamespaceAccessor("default", "")
+			templateContext, err := wd.GetTemplateContext(tc.ctx, tc.cli, accessor)
+
+			if tc.wantErr {
+				require.Error(t, err, tc.reason)
+			} else {
+				require.NoError(t, err, tc.reason)
+				if tc.checkFunc != nil {
+					tc.checkFunc(t, templateContext)
+				}
+			}
+		})
+	}
+}
+
+func TestTraitGetTemplateContext(t *testing.T) {
+	scheme := runtime.NewScheme()
+	require.NoError(t, corev1.AddToScheme(scheme))
+
+	traitOutput := &unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "ConfigMap",
+			"metadata": map[string]interface{}{
+				"name":      "test-trait-output",
+				"namespace": "default",
+			},
+		},
+	}
+
+	traitName := "my-trait"
+	baseCtx := process.NewContext(process.ContextData{
+		AppName:         "myapp",
+		CompName:        "test",
+		Namespace:       "default",
+		AppRevisionName: "myapp-v1",
+	})
+
+	traitTemplate := `
+outputs: myconfig: {
+	apiVersion: "v1"
+    kind: "ConfigMap"
+	metadata: {
+		name: "test-trait-output"
+		namespace: "default"
+	}
+}
+`
+	td := NewTraitAbstractEngine(traitName)
+	err := td.Complete(baseCtx, traitTemplate, nil)
+	require.NoError(t, err)
+
+	emptyCtx := process.NewContext(process.ContextData{
+		AppName:         "myapp",
+		CompName:        "test",
+		Namespace:       "default",
+		AppRevisionName: "myapp-v1",
+	})
+
+	testCases := map[string]struct {
+		reason    string
+		cli       client.Client
+		ctx       wfprocess.Context
+		traitName string
+		wantErr   bool
+		checkFunc func(t *testing.T, templateContext map[string]interface{})
+	}{
+		"successfully get template context for trait": {
+			reason:    "Should successfully get the template context for a trait with outputs.",
+			cli:       fake.NewClientBuilder().WithScheme(scheme).WithObjects(traitOutput).Build(),
+			ctx:       baseCtx,
+			traitName: traitName,
+			checkFunc: func(t *testing.T, templateContext map[string]interface{}) {
+				require.NotNil(t, templateContext)
+				outputs, ok := templateContext[OutputsFieldName]
+				require.True(t, ok)
+				outputsMap, ok := outputs.(map[string]interface{})
+				require.True(t, ok)
+				cm, ok := outputsMap["myconfig"]
+				require.True(t, ok)
+				cmMap, ok := cm.(map[string]interface{})
+				require.True(t, ok)
+				require.Equal(t, "test-trait-output", cmMap["metadata"].(map[string]interface{})["name"])
+			},
+		},
+		"trait resource not found": {
+			reason:    "Should return an error when a trait's output resource is not found.",
+			cli:       fake.NewClientBuilder().WithScheme(scheme).Build(),
+			ctx:       baseCtx,
+			traitName: traitName,
+			wantErr:   true,
+		},
+		"trait with no outputs": {
+			reason:    "Should successfully get a context for a trait that produces no outputs.",
+			cli:       fake.NewClientBuilder().WithScheme(scheme).Build(),
+			ctx:       emptyCtx,
+			traitName: traitName,
+			checkFunc: func(t *testing.T, templateContext map[string]interface{}) {
+				require.NotNil(t, templateContext)
+				_, ok := templateContext[OutputsFieldName]
+				require.False(t, ok)
+			},
+		},
+	}
+
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			traitDef := &traitDef{def: def{name: tc.traitName}}
+			accessor := util.NewApplicationResourceNamespaceAccessor("default", "")
+			templateContext, err := traitDef.GetTemplateContext(tc.ctx, tc.cli, accessor)
+
+			if tc.wantErr {
+				require.Error(t, err, tc.reason)
+			} else {
+				require.NoError(t, err, tc.reason)
+				if tc.checkFunc != nil {
+					tc.checkFunc(t, templateContext)
+				}
+			}
+		})
+	}
+}
+
+func TestGetCommonLabels(t *testing.T) {
+	type want struct {
+		labels map[string]string
+	}
+	cases := map[string]struct {
+		reason string
+		input  map[string]string
+		want   want
+	}{
+		"TestConvert": {
+			reason: "Test that context labels are correctly converted to OAM labels",
+			input: map[string]string{
+				process.ContextAppName:     "my-app",
+				process.ContextName:        "my-comp",
+				process.ContextAppRevision: "v1",
+				process.ContextReplicaKey:  "rep-key",
+				"other-label":              "other-value",
+			},
+			want: want{
+				labels: map[string]string{
+					"app.oam.dev/name":        "my-app",
+					"app.oam.dev/component":   "my-comp",
+					"app.oam.dev/appRevision": "v1",
+					"app.oam.dev/replicaKey":  "rep-key",
+				},
+			},
+		},
+		"TestEmpty": {
+			reason: "Test that an empty input map results in an empty output map",
+			input:  map[string]string{},
+			want: want{
+				labels: map[string]string{},
+			},
+		},
+		"TestNoConvert": {
+			reason: "Test that labels with no OAM equivalent are ignored",
+			input: map[string]string{
+				"other-label": "other-value",
+			},
+			want: want{
+				labels: map[string]string{},
+			},
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			r := require.New(t)
+			got := GetCommonLabels(tc.input)
+			r.Equal(tc.want.labels, got, tc.reason)
+		})
+	}
+}
+
+func TestGetBaseContextLabels(t *testing.T) {
+	type want struct {
+		labels map[string]string
+	}
+	cases := map[string]struct {
+		reason string
+		ctx    wfprocess.Context
+		want   want
+	}{
+		"TestWithAppNameAndRevision": {
+			reason: "Test that app name and revision are added to the base context labels",
+			ctx: process.NewContext(process.ContextData{
+				AppName:         "my-app",
+				AppRevisionName: "v1",
+				CompName:        "my-comp",
+			}),
+			want: want{
+				labels: map[string]string{
+					process.ContextAppName:     "my-app",
+					process.ContextAppRevision: "v1",
+					process.ContextName:        "my-comp",
+				},
+			},
+		},
+		"TestWithoutAppNameAndRevision": {
+			reason: "Test that the base context labels are returned when app name and revision are missing",
+			ctx: process.NewContext(process.ContextData{
+				CompName: "my-comp",
+			}),
+			want: want{
+				labels: map[string]string{
+					process.ContextAppName:     "",
+					process.ContextAppRevision: "",
+					process.ContextName:        "my-comp",
+				},
+			},
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			r := require.New(t)
+			got := GetBaseContextLabels(tc.ctx)
+			r.Equal(tc.want.labels, got, tc.reason)
+		})
+	}
+}
diff --git a/pkg/cue/script/template_test.go b/pkg/cue/script/template_test.go
index 4cae1238..69c81a87 100644
--- a/pkg/cue/script/template_test.go
+++ b/pkg/cue/script/template_test.go
@@ -286,3 +286,155 @@ func TestParsePropertiesToSchemaWithCueX(t *testing.T) {
 	assert.Equal(t, err, nil)
 	assert.Equal(t, len(schema.Properties), 2)
 }
+
+func TestParseToValue(t *testing.T) {
+	cases := map[string]struct {
+		script    CUE
+		expectErr bool
+	}{
+		"valid cue script": {
+			script:    CUE(templateScript),
+			expectErr: false,
+		},
+		"invalid cue script": {
+			script: CUE(`
+metadata: {
+	name: "invalid"
+	alias: "Invalid"
+`),
+			expectErr: true,
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			v, err := tc.script.ParseToValue()
+			if tc.expectErr {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+				assert.True(t, v.Exists())
+			}
+		})
+	}
+}
+
+func TestParseToValueWithCueX(t *testing.T) {
+	cases := map[string]struct {
+		script    CUE
+		expectErr bool
+	}{
+		"valid cue script": {
+			script:    CUE(templateScript),
+			expectErr: false,
+		},
+		"invalid cue script": {
+			script: CUE(`
+metadata: {
+	name: "invalid"
+	alias: "Invalid"
+`),
+			expectErr: true,
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			v, err := tc.script.ParseToValueWithCueX(context.Background())
+			if tc.expectErr {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+				assert.True(t, v.Exists())
+			}
+		})
+	}
+}
+
+func TestParseToTemplateValue(t *testing.T) {
+	cases := map[string]struct {
+		script      CUE
+		expectErr   bool
+		errContains string
+	}{
+		"valid cue script": {
+			script:    CUE(templateScript),
+			expectErr: false,
+		},
+		"missing template field": {
+			script: CUE(`
+metadata: {
+	name: "missing-template"
+}
+`),
+			expectErr:   true,
+			errContains: "the template cue is invalid",
+		},
+		"missing parameter field": {
+			script: CUE(`
+template: {
+	output: {}
+}
+`),
+			expectErr:   true,
+			errContains: "the template cue must include the template.parameter field",
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			v, err := tc.script.ParseToTemplateValue()
+			if tc.expectErr {
+				assert.Error(t, err)
+				assert.Contains(t, err.Error(), tc.errContains)
+			} else {
+				assert.NoError(t, err)
+				assert.True(t, v.Exists())
+			}
+		})
+	}
+}
+
+func TestParseToTemplateValueWithCueX(t *testing.T) {
+	cases := map[string]struct {
+		script      CUE
+		expectErr   bool
+		errContains string
+	}{
+		"valid cue script": {
+			script:    CUE(templateScript),
+			expectErr: false,
+		},
+		"missing template field": {
+			script: CUE(`
+metadata: {
+	name: "missing-template"
+}
+`),
+			expectErr:   true,
+			errContains: "the template cue must include the template field",
+		},
+		"missing parameter field": {
+			script: CUE(`
+template: {
+	output: {}
+}
+`),
+			expectErr:   true,
+			errContains: "the template cue must include the template.parameter field",
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			v, err := tc.script.ParseToTemplateValueWithCueX(context.Background())
+			if tc.expectErr {
+				assert.Error(t, err)
+				assert.Contains(t, err.Error(), tc.errContains)
+			} else {
+				assert.NoError(t, err)
+				assert.True(t, v.Exists())
+			}
+		})
+	}
+}
diff --git a/pkg/cue/task/process_test.go b/pkg/cue/task/process_test.go
index 42660a91..3171f4b9 100644
--- a/pkg/cue/task/process_test.go
+++ b/pkg/cue/task/process_test.go
@@ -66,18 +66,56 @@ func TestProcess(t *testing.T) {
 	s := NewMock()
 	defer s.Close()
 
-	taskTemplate := cuecontext.New().CompileString(TaskTemplate)
-	taskTemplate = taskTemplate.FillPath(value.FieldPath(process.ParameterFieldName), map[string]interface{}{
-		"serviceURL": "http://127.0.0.1:8090/api/v1/token?val=test-token",
-	})
-
-	inst, err := Process(taskTemplate)
-	if err != nil {
-		t.Fatal(err)
+	testCases := map[string]struct {
+		template   string
+		parameter  map[string]interface{}
+		wantOutput string
+		wantErr    string
+	}{
+		"success": {
+			template: TaskTemplate,
+			parameter: map[string]interface{}{
+				"serviceURL": "http://127.0.0.1:8090/api/v1/token?val=test-token",
+			},
+			wantOutput: "{\"data\":\"test-token\"}",
+		},
+		"no http in processing": {
+			template: `
+parameter: {
+  serviceURL: string
+}
+processing: {}
+`,
+			parameter: map[string]interface{}{
+				"serviceURL": "http://127.0.0.1:8090/api/v1/token?val=test-token",
+			},
+			wantErr: "there is no http in processing",
+		},
+		"http task fails": {
+			template:  TaskTemplate,
+			parameter: map[string]interface{}{"serviceURL": "http://127.0.0.1:3000"},
+			wantErr:   "fail to exec http task",
+		},
+	}
+
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			taskTemplate := cuecontext.New().CompileString(tc.template)
+			taskTemplate = taskTemplate.FillPath(value.FieldPath(process.ParameterFieldName), tc.parameter)
+
+			inst, err := Process(taskTemplate)
+
+			if tc.wantErr != "" {
+				assert.ErrorContains(t, err, tc.wantErr)
+			} else {
+				assert.NoError(t, err)
+				output := inst.LookupPath(value.FieldPath("output"))
+				data, err := cueJson.Marshal(output)
+				assert.NoError(t, err)
+				assert.Equal(t, tc.wantOutput, string(data))
+			}
+		})
 	}
-	output := inst.LookupPath(value.FieldPath("output"))
-	data, _ := cueJson.Marshal(output)
-	assert.Equal(t, "{\"data\":\"test-token\"}", data)
 }
 
 func NewMock() *httptest.Server {
diff --git a/pkg/definition/ast/transformer_test.go b/pkg/definition/ast/transformer_test.go
new file mode 100644
index 00000000..3c99b457
--- /dev/null
+++ b/pkg/definition/ast/transformer_test.go
@@ -0,0 +1,1119 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package ast
+
+import (
+	"testing"
+
+	"cuelang.org/go/cue/ast"
+	"cuelang.org/go/cue/format"
+	"cuelang.org/go/cue/parser"
+	"github.com/stretchr/testify/require"
+)
+
+func TestMarshalAndUnmarshalMetadata(t *testing.T) {
+	tests := []struct {
+		name               string
+		input              string
+		expectMarshalErr   string
+		expectUnmarshalErr string
+		expectContains     string
+	}{
+		{
+			name: "valid scalar values",
+			input: `
+				attributes: {
+					status: {
+						details: {
+							strVal: "ok"
+							intVal: 42
+							boolVal: true
+							nullVal: null
+							typeVal: string
+						}
+					}
+				}
+			`,
+			expectContains: "strVal",
+		},
+		{
+			name: "references to context output",
+			input: `
+				attributes: {
+					status: {
+						details: {
+							val: context.output.status.running
+						}
+					}
+				}
+			`,
+			expectContains: "val",
+		},
+		{
+			name: "valid selector and call expressions",
+			input: `
+				attributes: {
+					status: {
+						details: {
+							selector: context.output.status.running
+						}
+					}
+				}
+			`,
+			expectContains: "selector",
+		},
+		{
+			name: "struct value is invalid",
+			input: `
+				attributes: {
+					status: {
+						details: {
+							data: { key: "value" }
+						}
+					}
+				}
+			`,
+			expectMarshalErr: `unsupported expression type`,
+		},
+		{
+			name: "list value is invalid",
+			input: `
+				attributes: {
+					status: {
+						details: {
+							items: [1, 2, 3]
+						}
+					}
+				}
+			`,
+			expectMarshalErr: `unsupported expression type`,
+		},
+		{
+			name: "$key with struct is permitted",
+			input: `
+				attributes: {
+					status: {
+						details: {
+							$raw: { key: "value" }
+						}
+					}
+				}
+			`,
+			expectContains: "$raw",
+		},
+		{
+			name: "$key with list is permitted",
+			input: `
+				attributes: {
+					status: {
+						details: {
+							$items: [1, 2, 3]
+						}
+					}
+				}
+			`,
+			expectContains: "$items",
+		},
+		{
+			name: "valid stringified struct round trip",
+			input: `
+				attributes: {
+					status: {
+						details: #"""
+							ok: true
+							value: 99
+						"""#
+					}
+				}
+			`,
+			expectContains: "value",
+		},
+		{
+			name: "malformed stringified status fails validation",
+			input: `
+	        	attributes: {
+	        		status: {
+	        			details: #"""
+	        				invalid cue: abc
+	        			"""#
+	        		}
+	        	}
+	        `,
+			expectMarshalErr: "invalid cue content in string literal",
+		},
+		{
+			name: "nested local struct is permitted",
+			input: `
+	        	attributes: {
+	        		status: {
+	        			details: {
+                            $local: {
+								nested: {
+                                    deepNesting: {
+                                       key: "value" 
+                                    }
+                                }
+                            }
+                            $anotherLocal: $local.nested.deepNesting.key
+                            val: $anotherLocal
+                        }
+	        		}
+	        	}
+	        `,
+			expectContains: "$local",
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt // Re-bind range variable to avoid capture
+		t.Run(tt.name, func(t *testing.T) {
+			file, err := parser.ParseFile("-", tt.input)
+			require.NoError(t, err)
+
+			var rootField *ast.Field
+			for _, decl := range file.Decls {
+				if f, ok := decl.(*ast.Field); ok {
+					rootField = f
+					break
+				}
+			}
+			require.NotNil(t, rootField)
+
+			err = EncodeMetadata(rootField)
+			if tt.expectMarshalErr != "" {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tt.expectMarshalErr)
+				return
+			} else {
+				require.NoError(t, err)
+			}
+
+			err = DecodeMetadata(rootField)
+			if tt.expectUnmarshalErr != "" {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tt.expectUnmarshalErr)
+				return
+			} else {
+				require.NoError(t, err)
+			}
+
+			if tt.expectContains != "" {
+				statusField, ok := GetFieldByPath(rootField, "attributes.status.details")
+				require.True(t, ok)
+
+				switch v := statusField.Value.(type) {
+				case *ast.BasicLit:
+					require.Contains(t, v.Value, tt.expectContains)
+				case *ast.StructLit:
+					out, err := format.Node(v)
+					require.NoError(t, err)
+					require.Contains(t, string(out), tt.expectContains)
+				default:
+					t.Fatalf("unexpected status value type: %T", v)
+				}
+			}
+		})
+	}
+}
+
+func TestMarshalAndUnmarshalHealthPolicy(t *testing.T) {
+	tests := []struct {
+		name               string
+		input              string
+		expectMarshalErr   string
+		expectUnmarshalErr string
+		expectContains     string
+	}{
+		{
+			name: "valid healthPolicy with boolean literal",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: {
+							isHealth: true
+						}
+					}
+				}
+			`,
+			expectContains: "isHealth",
+		},
+		{
+			name: "valid healthPolicy with binary expression",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: {
+							isHealth: context.output.status.phase == "Running"
+						}
+					}
+				}
+			`,
+			expectContains: "isHealth",
+		},
+		{
+			name: "valid healthPolicy with complex expression",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: {
+							isHealth: context.output.status.ready && context.output.status.replicas > 0
+						}
+					}
+				}
+			`,
+			expectContains: "isHealth",
+		},
+		{
+			name: "valid healthPolicy with selector expression",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: {
+							isHealth: context.output.status.conditions[0].status
+						}
+					}
+				}
+			`,
+			expectContains: "isHealth",
+		},
+		{
+			name: "valid healthPolicy with call expression",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: {
+							isHealth: len(context.output.status.conditions) > 0
+						}
+					}
+				}
+			`,
+			expectContains: "isHealth",
+		},
+		{
+			name: "healthPolicy missing isHealth field",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: {
+							someOtherField: true
+						}
+					}
+				}
+			`,
+			expectMarshalErr: "healthPolicy must contain an 'isHealth' field",
+		},
+		{
+			name: "healthPolicy with invalid isHealth type (struct)",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: {
+							isHealth: { nested: true }
+						}
+					}
+				}
+			`,
+			expectMarshalErr: "healthPolicy field 'isHealth' must be a boolean expression",
+		},
+		{
+			name: "healthPolicy with invalid isHealth type (list)",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: {
+							isHealth: [true, false]
+						}
+					}
+				}
+			`,
+			expectMarshalErr: "healthPolicy field 'isHealth' must be a boolean expression",
+		},
+		{
+			name: "valid stringified healthPolicy round trip",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: #"""
+							isHealth: context.output.status.phase == "Running"
+						"""#
+					}
+				}
+			`,
+			expectContains: "isHealth",
+		},
+		{
+			name: "malformed stringified healthPolicy fails validation",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: #"""
+							invalid cue: abc
+						"""#
+					}
+				}
+			`,
+			expectMarshalErr: "invalid cue content in string literal",
+		},
+		{
+			name: "healthPolicy as plain string is valid",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: "isHealth: true"
+					}
+				}
+			`,
+			expectContains: "isHealth",
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			file, err := parser.ParseFile("-", tt.input)
+			require.NoError(t, err)
+
+			var rootField *ast.Field
+			for _, decl := range file.Decls {
+				if f, ok := decl.(*ast.Field); ok {
+					rootField = f
+					break
+				}
+			}
+			require.NotNil(t, rootField)
+
+			err = EncodeMetadata(rootField)
+			if tt.expectMarshalErr != "" {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tt.expectMarshalErr)
+				return
+			} else {
+				require.NoError(t, err)
+			}
+
+			err = DecodeMetadata(rootField)
+			if tt.expectUnmarshalErr != "" {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tt.expectUnmarshalErr)
+				return
+			} else {
+				require.NoError(t, err)
+			}
+
+			if tt.expectContains != "" {
+				healthPolicyField, ok := GetFieldByPath(rootField, "attributes.status.healthPolicy")
+				require.True(t, ok)
+
+				switch v := healthPolicyField.Value.(type) {
+				case *ast.BasicLit:
+					require.Contains(t, v.Value, tt.expectContains)
+				case *ast.StructLit:
+					out, err := format.Node(v)
+					require.NoError(t, err)
+					require.Contains(t, string(out), tt.expectContains)
+				default:
+					t.Fatalf("unexpected healthPolicy value type: %T", v)
+				}
+			}
+		})
+	}
+}
+
+func TestMarshalAndUnmarshalCustomStatus(t *testing.T) {
+	tests := []struct {
+		name               string
+		input              string
+		expectMarshalErr   string
+		expectUnmarshalErr string
+		expectContains     string
+	}{
+		{
+			name: "valid customStatus with string message",
+			input: `
+				attributes: {
+					status: {
+						customStatus: {
+							message: "Service is healthy"
+						}
+					}
+				}
+			`,
+			expectContains: "message",
+		},
+		{
+			name: "valid customStatus with interpolation",
+			input: `
+				attributes: {
+					status: {
+						customStatus: {
+							message: "\(context.output.metadata.name) is running"
+						}
+					}
+				}
+			`,
+			expectContains: "message",
+		},
+		{
+			name: "valid customStatus with selector expression",
+			input: `
+				attributes: {
+					status: {
+						customStatus: {
+							message: context.output.status.message
+						}
+					}
+				}
+			`,
+			expectContains: "message",
+		},
+		{
+			name: "valid customStatus with binary expression",
+			input: `
+				attributes: {
+					status: {
+						customStatus: {
+							message: "Replicas: " + context.output.status.replicas
+						}
+					}
+				}
+			`,
+			expectContains: "message",
+		},
+		{
+			name: "valid customStatus with call expression",
+			input: `
+				attributes: {
+					status: {
+						customStatus: {
+							message: strconv.FormatInt(context.output.status.replicas, 10)
+						}
+					}
+				}
+			`,
+			expectContains: "message",
+		},
+		{
+			name: "valid customStatus with list expression",
+			input: `
+				attributes: {
+					status: {
+						customStatus: {
+							message: [for c in context.output.status.conditions if c.type == "Ready" { c.message }][0]
+						}
+					}
+				}
+			`,
+			expectContains: "message",
+		},
+		{
+			name: "customStatus missing message field",
+			input: `
+				attributes: {
+					status: {
+						customStatus: {
+							someOtherField: "value"
+						}
+					}
+				}
+			`,
+			expectMarshalErr: "customStatus must contain a 'message' field",
+		},
+		{
+			name: "customStatus with invalid message type (struct)",
+			input: `
+				attributes: {
+					status: {
+						customStatus: {
+							message: { nested: "value" }
+						}
+					}
+				}
+			`,
+			expectMarshalErr: "customStatus field 'message' must be a string expression",
+		},
+		{
+			name: "customStatus with integer literal message",
+			input: `
+				attributes: {
+					status: {
+						customStatus: {
+							message: 42
+						}
+					}
+				}
+			`,
+			expectMarshalErr: "customStatus field 'message' must be a string",
+		},
+		{
+			name: "valid stringified customStatus round trip",
+			input: `
+				attributes: {
+					status: {
+						customStatus: #"""
+							message: "Pod \(context.output.metadata.name) is running"
+						"""#
+					}
+				}
+			`,
+			expectContains: "message",
+		},
+		{
+			name: "malformed stringified customStatus fails validation",
+			input: `
+				attributes: {
+					status: {
+						customStatus: #"""
+							invalid cue: abc
+						"""#
+					}
+				}
+			`,
+			expectMarshalErr: "invalid cue content in string literal",
+		},
+		{
+			name: "customStatus with additional fields alongside message",
+			input: `
+				attributes: {
+					status: {
+						customStatus: {
+							message: "Service is healthy"
+							severity: "info"
+							timestamp: context.output.metadata.creationTimestamp
+						}
+					}
+				}
+			`,
+			expectContains: "message",
+		},
+		{
+			name: "customStatus as plain string is valid",
+			input: `
+				attributes: {
+					status: {
+						customStatus: "message: \"Hello\""
+					}
+				}
+			`,
+			expectContains: "message",
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			file, err := parser.ParseFile("-", tt.input)
+			require.NoError(t, err)
+
+			var rootField *ast.Field
+			for _, decl := range file.Decls {
+				if f, ok := decl.(*ast.Field); ok {
+					rootField = f
+					break
+				}
+			}
+			require.NotNil(t, rootField)
+
+			err = EncodeMetadata(rootField)
+			if tt.expectMarshalErr != "" {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tt.expectMarshalErr)
+				return
+			} else {
+				require.NoError(t, err)
+			}
+
+			err = DecodeMetadata(rootField)
+			if tt.expectUnmarshalErr != "" {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tt.expectUnmarshalErr)
+				return
+			} else {
+				require.NoError(t, err)
+			}
+
+			if tt.expectContains != "" {
+				customStatusField, ok := GetFieldByPath(rootField, "attributes.status.customStatus")
+				require.True(t, ok)
+
+				switch v := customStatusField.Value.(type) {
+				case *ast.BasicLit:
+					require.Contains(t, v.Value, tt.expectContains)
+				case *ast.StructLit:
+					out, err := format.Node(v)
+					require.NoError(t, err)
+					require.Contains(t, string(out), tt.expectContains)
+				default:
+					t.Fatalf("unexpected customStatus value type: %T", v)
+				}
+			}
+		})
+	}
+}
+
+func TestHealthPolicyEdgeCases(t *testing.T) {
+	tests := []struct {
+		name               string
+		input              string
+		expectMarshalErr   string
+		expectUnmarshalErr string
+	}{
+		{
+			name: "healthPolicy with unary expression",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: {
+							isHealth: !context.output.status.failed
+						}
+					}
+				}
+			`,
+		},
+		{
+			name: "healthPolicy with parenthesized expression",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: {
+							isHealth: (context.output.status.phase == "Running" || context.output.status.phase == "Succeeded")
+						}
+					}
+				}
+			`,
+		},
+		{
+			name: "healthPolicy with nested binary expressions",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: {
+							isHealth: context.output.status.ready && (context.output.status.replicas > 0 || context.output.status.phase == "Ready")
+						}
+					}
+				}
+			`,
+		},
+		{
+			name: "healthPolicy with string literal should fail",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: {
+							isHealth: "true"
+						}
+					}
+				}
+			`,
+			expectMarshalErr: "healthPolicy field 'isHealth' must be a boolean literal (true/false)",
+		},
+		{
+			name: "healthPolicy with comprehension should fail",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: {
+							isHealth: [for c in context.output.status.conditions if c.type == "Ready" { c.status }][0]
+						}
+					}
+				}
+			`,
+			expectMarshalErr: "healthPolicy field 'isHealth' must be a boolean expression",
+		},
+		{
+			name: "healthPolicy with empty struct should fail",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: {}
+					}
+				}
+			`,
+			expectMarshalErr: "healthPolicy must contain an 'isHealth' field",
+		},
+		{
+			name: "healthPolicy with additional fields is allowed",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: {
+							isHealth: true
+							reason: "always healthy"
+						}
+					}
+				}
+			`,
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			file, err := parser.ParseFile("-", tt.input)
+			require.NoError(t, err)
+
+			var rootField *ast.Field
+			for _, decl := range file.Decls {
+				if f, ok := decl.(*ast.Field); ok {
+					rootField = f
+					break
+				}
+			}
+			require.NotNil(t, rootField)
+
+			err = EncodeMetadata(rootField)
+			if tt.expectMarshalErr != "" {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tt.expectMarshalErr)
+				return
+			} else {
+				require.NoError(t, err)
+			}
+
+			err = DecodeMetadata(rootField)
+			if tt.expectUnmarshalErr != "" {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tt.expectUnmarshalErr)
+				return
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestCustomStatusEdgeCases(t *testing.T) {
+	tests := []struct {
+		name               string
+		input              string
+		expectMarshalErr   string
+		expectUnmarshalErr string
+	}{
+		{
+			name: "customStatus with comprehension expression",
+			input: `
+				attributes: {
+					status: {
+						customStatus: {
+							message: [for i, v in context.output.status.conditions { "\(i): \(v.message)" }][0]
+						}
+					}
+				}
+			`,
+		},
+		{
+			name: "customStatus with index expression",
+			input: `
+				attributes: {
+					status: {
+						customStatus: {
+							message: context.output.status.conditions[0].message
+						}
+					}
+				}
+			`,
+		},
+		{
+			name: "customStatus with slice expression",
+			input: `
+				attributes: {
+					status: {
+						customStatus: {
+							message: context.output.status.message[0:10]
+						}
+					}
+				}
+			`,
+		},
+		{
+			name: "customStatus with parenthesized expression",
+			input: `
+				attributes: {
+					status: {
+						customStatus: {
+							message: ("Status: " + context.output.status.phase)
+						}
+					}
+				}
+			`,
+		},
+		{
+			name: "customStatus with nested interpolation",
+			input: `
+				attributes: {
+					status: {
+						customStatus: {
+							message: "Pod \(context.output.metadata.name) has \(context.output.status.replicas) replicas"
+						}
+					}
+				}
+			`,
+		},
+		{
+			name: "customStatus with boolean literal should fail",
+			input: `
+				attributes: {
+					status: {
+						customStatus: {
+							message: true
+						}
+					}
+				}
+			`,
+			expectMarshalErr: "customStatus field 'message' must be a string",
+		},
+		{
+			name: "customStatus with empty struct should fail",
+			input: `
+				attributes: {
+					status: {
+						customStatus: {}
+					}
+				}
+			`,
+			expectMarshalErr: "customStatus must contain a 'message' field",
+		},
+		{
+			name: "customStatus with only non-message fields should fail",
+			input: `
+				attributes: {
+					status: {
+						customStatus: {
+							severity: "error"
+							code: 500
+						}
+					}
+				}
+			`,
+			expectMarshalErr: "customStatus must contain a 'message' field",
+		},
+		{
+			name: "customStatus with field expression should fail",
+			input: `
+				attributes: {
+					status: {
+						customStatus: {
+							message: { template: "Hello" }
+						}
+					}
+				}
+			`,
+			expectMarshalErr: "customStatus field 'message' must be a string expression",
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			file, err := parser.ParseFile("-", tt.input)
+			require.NoError(t, err)
+
+			var rootField *ast.Field
+			for _, decl := range file.Decls {
+				if f, ok := decl.(*ast.Field); ok {
+					rootField = f
+					break
+				}
+			}
+			require.NotNil(t, rootField)
+
+			err = EncodeMetadata(rootField)
+			if tt.expectMarshalErr != "" {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tt.expectMarshalErr)
+				return
+			} else {
+				require.NoError(t, err)
+			}
+
+			err = DecodeMetadata(rootField)
+			if tt.expectUnmarshalErr != "" {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tt.expectUnmarshalErr)
+				return
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestBackwardCompatibility(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+	}{
+		{
+			name: "existing worker component healthPolicy format",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: #"""
+							isHealth: context.output.status.readyReplicas > 0 && context.output.status.readyReplicas == context.output.status.replicas
+						"""#
+					}
+				}
+			`,
+		},
+		{
+			name: "existing worker component customStatus format",
+			input: `
+				attributes: {
+					status: {
+						customStatus: #"""
+							appName:     context.appName
+							internal:    "\($appName) is running"
+							exposeType:  *"" | string
+							if context.outputs.service != _|_ {
+								exposeType: context.outputs.service.spec.type
+							}
+							if exposeType == "ClusterIP" {
+								message: "\(appName) has ClusterIP service"
+							}
+							if exposeType == "NodePort" {
+								message: "\(appName) has NodePort service"
+							}
+							if exposeType == "LoadBalancer" {
+								message: "\(appName) has LoadBalancer service"
+							}
+							if exposeType == "" {
+								message: internal
+							}
+						"""#
+					}
+				}
+			`,
+		},
+		{
+			name: "complex multi-field definition with both healthPolicy and customStatus",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: #"""
+							isHealth: context.output.status.phase == "Running" || (context.output.status.phase == "Succeeded" && context.output.spec.restartPolicy == "Never")
+						"""#
+						customStatus: #"""
+							ready: [ for c in context.output.status.conditions if c.type == "Ready" { c.status }][0] == "True"
+							message: "Pod \(context.output.metadata.name): phase=\(context.output.status.phase), ready=\(ready)"
+						"""#
+					}
+				}
+			`,
+		},
+		{
+			name: "simple string format for healthPolicy",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: "isHealth: true"
+					}
+				}
+			`,
+		},
+		{
+			name: "simple string format for customStatus",
+			input: `
+				attributes: {
+					status: {
+						customStatus: "message: \"Service is healthy\""
+					}
+				}
+			`,
+		},
+		{
+			name: "healthPolicy with list comprehensions and complex conditions",
+			input: `
+				attributes: {
+					status: {
+						healthPolicy: #"""
+							conditions: [ for c in context.output.status.conditions if c.type == "Ready" || c.type == "ContainersReady" { c.status }]
+							isHealth: len($conditions) > 0 && ![ for c in conditions if c != "True" { c }] != []
+						"""#
+					}
+				}
+			`,
+		},
+		{
+			name: "customStatus with nested conditionals and string interpolation",
+			input: `
+				attributes: {
+					status: {
+						customStatus: #"""
+							phase: context.output.status.phase
+							replicas: context.output.status.replicas
+							readyReplicas: *0 | int
+							if context.output.status.readyReplicas != _|_ {
+								readyReplicas: context.output.status.readyReplicas
+							}
+							if phase == "Running" {
+								if readyReplicas == replicas {
+									message: "All \(replicas) replicas are ready"
+								}
+								if readyReplicas < replicas {
+									message: "Only \(readyReplicas) of \(replicas) replicas are ready"
+								}
+							}
+							if phase != "Running" {
+								message: "Deployment is in phase: \(phase)"
+							}
+						"""#
+					}
+				}
+			`,
+		},
+		{
+			name: "preserving local fields that start with $",
+			input: `
+				attributes: {
+					status: {
+						customStatus: #"""
+							internal: "internal state"
+							compute: context.output.status.replicas * 2
+							debugInfo: {
+								phase: context.output.status.phase
+								replicas: context.output.status.replicas
+							}
+							message: "Status: \(internal), computed: \(compute)"
+						"""#
+					}
+				}
+			`,
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			file, err := parser.ParseFile("-", tt.input)
+			require.NoError(t, err)
+
+			var rootField *ast.Field
+			for _, decl := range file.Decls {
+				if f, ok := decl.(*ast.Field); ok {
+					rootField = f
+					break
+				}
+			}
+			require.NotNil(t, rootField)
+
+			err = EncodeMetadata(rootField)
+			require.NoError(t, err)
+
+			err = DecodeMetadata(rootField)
+			require.NoError(t, err)
+		})
+	}
+}
diff --git a/pkg/definition/ast/utils_test.go b/pkg/definition/ast/utils_test.go
new file mode 100644
index 00000000..3dd1658a
--- /dev/null
+++ b/pkg/definition/ast/utils_test.go
@@ -0,0 +1,846 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package ast
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+	"testing"
+
+	"cuelang.org/go/cue/ast"
+	"cuelang.org/go/cue/parser"
+	"cuelang.org/go/cue/token"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetFieldByPath(t *testing.T) {
+	tests := []struct {
+		name  string
+		path  string
+		found bool
+		label string
+	}{
+		{
+			name:  "Field does exist",
+			path:  "component.attributes.status.health",
+			found: true,
+			label: "health",
+		},
+		{
+			name:  "Field does not exist",
+			path:  "component.attributes.status.missingField",
+			found: false,
+			label: "",
+		},
+		{
+			name:  "Top level field can be found",
+			path:  "component",
+			found: true,
+			label: "component",
+		},
+		{
+			name:  "Empty path returns false",
+			path:  "",
+			found: false,
+		},
+	}
+
+	src := `
+	component: {
+	  attributes: {
+	    status: {
+	      health: "ok"
+	    }
+	  }
+	}`
+
+	file, err := parser.ParseFile("-", src)
+	require.NoError(t, err)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			field, ok := GetFieldByPath(file, tt.path)
+			require.Equal(t, tt.found, ok)
+
+			if ok {
+				require.Equal(t, tt.label, GetFieldLabel(field.Label))
+			}
+		})
+	}
+}
+
+func TestGetNodeByPath(t *testing.T) {
+	tests := []struct {
+		name       string
+		path       string
+		found      bool
+		fieldLabel string
+		nodeType   string
+	}{
+		{
+			name:       "Node and field exist",
+			path:       "component.attributes.status.health",
+			found:      true,
+			fieldLabel: "health",
+			nodeType:   "*ast.BasicLit",
+		},
+		{
+			name:  "Field does not exist",
+			path:  "component.attributes.status.missingField",
+			found: false,
+		},
+		{
+			name:       "Top level field can be found",
+			path:       "component",
+			found:      true,
+			fieldLabel: "component",
+			nodeType:   "*ast.StructLit",
+		},
+		{
+			name:  "Empty path",
+			path:  "",
+			found: false,
+		},
+		{
+			name:       "Valid path that ends on struct",
+			path:       "component.attributes.status",
+			found:      true,
+			fieldLabel: "status",
+			nodeType:   "*ast.StructLit",
+		},
+	}
+
+	src := `
+	component: {
+	  attributes: {
+	    status: {
+	      health: "ok"
+	    }
+	  }
+	}`
+
+	file, err := parser.ParseFile("-", src)
+	require.NoError(t, err)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			node, field, ok := GetNodeByPath(file, tt.path)
+			require.Equal(t, tt.found, ok)
+
+			if ok {
+				require.NotNil(t, field)
+				require.Equal(t, tt.fieldLabel, GetFieldLabel(field.Label))
+				if tt.nodeType != "" {
+					require.Equal(t, tt.nodeType, fmt.Sprintf("%T", node))
+				}
+			}
+		})
+	}
+}
+
+func TestUpdateNodeByPath(t *testing.T) {
+	tests := []struct {
+		name      string
+		path      string
+		newValue  string
+		shouldSet bool
+		expected  string
+	}{
+		{
+			name:      "Update nested field",
+			path:      "component.attributes.status.health",
+			newValue:  `"updated"`,
+			shouldSet: true,
+			expected:  `"updated"`,
+		},
+		{
+			name:      "Update of missing field",
+			path:      "component.attributes.status.missingField",
+			newValue:  `"missing!"`,
+			shouldSet: false,
+		},
+		{
+			name:      "Update top level field",
+			path:      "component",
+			newValue:  `"top"`,
+			shouldSet: true,
+			expected:  `"top"`,
+		},
+		{
+			name:      "Empty path",
+			path:      "",
+			newValue:  `"shouldFail"`,
+			shouldSet: false,
+		},
+	}
+
+	src := `
+	component: {
+	  attributes: {
+	    status: {
+	      health: "ok"
+	    }
+	  }
+	}`
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			file, err := parser.ParseFile("-", src)
+			require.NoError(t, err)
+
+			newExpr := &ast.BasicLit{Kind: token.STRING, Value: tt.newValue}
+			ok := UpdateNodeByPath(file, tt.path, newExpr)
+			require.Equal(t, tt.shouldSet, ok)
+
+			if ok {
+				field, found := GetFieldByPath(file, tt.path)
+				require.True(t, found)
+
+				basicLit, isLit := field.Value.(*ast.BasicLit)
+				require.True(t, isLit)
+				require.Equal(t, tt.expected, basicLit.Value)
+			}
+		})
+	}
+}
+
+func TestStringifyStructLitAsCueString(t *testing.T) {
+	tests := []struct {
+		name       string
+		input      string
+		contains   []string
+		shouldFail bool
+	}{
+		{
+			name: "Simple string and number fields",
+			input: `
+			{
+			  name: "example"
+			  count: 42
+			}`,
+			contains: []string{
+				`name:   "example"`,
+				`count:   42`,
+			},
+		},
+		{
+			name: "Boolean and nested struct",
+			input: `
+			{
+			  enabled: true
+			  metadata: {
+			    version: "v1"
+			  }
+			}`,
+			contains: []string{
+				`enabled:   true`,
+				`metadata: {`,
+				`version:   "v1"`,
+			},
+		},
+		{
+			name: "Empty struct",
+			input: `
+			{
+			}`,
+			contains: []string{
+				`{}`,
+			},
+		},
+		{
+			name: "Struct with list",
+			input: `
+			{
+			  items: [1, 2, 3]
+			}`,
+			contains: []string{
+				`items:   [1, 2, 3]`,
+			},
+		},
+		{
+			name: "Invalid CUE input",
+			input: `
+			{
+			  name: "missing comma"
+			  123bad
+			}`,
+			shouldFail: true,
+		},
+		{
+			name: "Conditional fields with if statements",
+			input: `
+			{
+				if context.status.healthy {
+					message: "Healthy! (\(context.status.details.replicaReadyRatio * 100)% pods running)"
+				}
+
+				if !context.status.healthy {
+					message: "Unhealthy! (\(context.status.details.replicaReadyRatio * 100)% pods running)"
+				}
+			}`,
+			contains: []string{
+				`if context.status.healthy {`,
+				`message: "Healthy! (\(context.status.details.replicaReadyRatio*100)% pods running)"`,
+				`if !context.status.healthy {`,
+				`message: "Unhealthy! (\(context.status.details.replicaReadyRatio*100)% pods running)"`,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			expr, err := parser.ParseExpr("-", tt.input)
+			if tt.shouldFail {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+
+			structLit, ok := expr.(*ast.StructLit)
+			require.True(t, ok, "expected struct literal")
+
+			strLit, err := StringifyStructLitAsCueString(structLit)
+			require.NoError(t, err)
+
+			for _, substr := range tt.contains {
+				require.Contains(t, normalizeString(strLit.Value), normalizeString(substr))
+			}
+		})
+	}
+}
+
+func TestGetFieldLabel(t *testing.T) {
+	tests := []struct {
+		name     string
+		label    ast.Label
+		expected string
+	}{
+		{
+			name:     "Ident label",
+			label:    &ast.Ident{Name: "foo"},
+			expected: "foo",
+		},
+		{
+			name:     "BasicLit string label",
+			label:    &ast.BasicLit{Value: `"bar"`},
+			expected: "bar",
+		},
+		{
+			name:     "BasicLit empty string",
+			label:    &ast.BasicLit{Value: `""`},
+			expected: "",
+		},
+		{
+			name:     "BasicLit with quotes and spaces",
+			label:    &ast.BasicLit{Value: `"  spaced  "`},
+			expected: "  spaced  ",
+		},
+		{
+			name:     "Nil label",
+			label:    nil,
+			expected: "",
+		},
+		{
+			name:     "Unsupported label type",
+			label:    &ast.ListLit{}, // not a valid label
+			expected: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := GetFieldLabel(tt.label)
+			require.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestTrimCueRawString(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{
+			name:     "Triple quoted raw string with hash",
+			input:    `#"""foo bar"""#`,
+			expected: `foo bar`,
+		},
+		{
+			name:     "Triple quoted raw string without hash",
+			input:    `"""foo bar"""`,
+			expected: `foo bar`,
+		},
+		{
+			name:     "Double quoted standard string",
+			input:    `"foo bar"`,
+			expected: `foo bar`,
+		},
+		{
+			name:     "Unquoted fallback string",
+			input:    `foo bar`,
+			expected: `foo bar`,
+		},
+		{
+			name:     "Triple quoted with leading/trailing spaces",
+			input:    `   #"""foo bar"""#   `,
+			expected: `foo bar`,
+		},
+		{
+			name:     "Escaped quoted string",
+			input:    `"line 1\nline 2"`,
+			expected: "line 1\nline 2",
+		},
+		{
+			name:     "Invalid quoted string (fallback)",
+			input:    `"unterminated`,
+			expected: `"unterminated`,
+		},
+		{
+			name:     "raw string with tab character",
+			input:    `#"""hello\tworld"""#`,
+			expected: `hello  world`,
+		},
+		{
+			name:     "quoted string with escaped tab",
+			input:    `"hello\tworld"`,
+			expected: `hello  world`,
+		},
+		{
+			name: "raw string with multiple tabs",
+			input: `#"""line1\t\tvalue
+line2\t\tvalue"""#`,
+			expected: `line1    value
+line2    value`,
+		},
+		{
+			name:     "triple quoted string with tabs",
+			input:    `"""hello\tworld"""`,
+			expected: `hello  world`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			out := TrimCueRawString(tt.input)
+			require.Equal(t, tt.expected, out)
+		})
+	}
+}
+
+func TestValidateCueStringLiteral(t *testing.T) {
+	tests := []struct {
+		name       string
+		lit        *ast.BasicLit
+		validator  func(*ast.StructLit) error
+		expectErr  bool
+		errContain string
+	}{
+		{
+			name: "valid struct literal",
+			lit: &ast.BasicLit{
+				Kind: token.STRING,
+				Value: `#"""
+name: "test"
+age: 30
+"""#`,
+			},
+			validator: validStructValidator,
+			expectErr: false,
+		},
+		{
+			name: "empty struct literal fails validator",
+			lit: &ast.BasicLit{
+				Kind: token.STRING,
+				Value: `#"""
+"""#`,
+			},
+			validator:  validStructValidator,
+			expectErr:  true,
+			errContain: "struct is empty",
+		},
+		{
+			name: "empty string passes",
+			lit: &ast.BasicLit{
+				Kind:  token.STRING,
+				Value: `""`,
+			},
+			validator: validStructValidator,
+			expectErr: false,
+		},
+		{
+			name: "invalid cue content fails parse",
+			lit: &ast.BasicLit{
+				Kind: token.STRING,
+				Value: `#"""
+invalid: @@@
+"""#`,
+			},
+			validator:  validStructValidator,
+			expectErr:  true,
+			errContain: "invalid cue content in string literal",
+		},
+		{
+			name: "non-string literal fails",
+			lit: &ast.BasicLit{
+				Kind:  token.INT,
+				Value: `123`,
+			},
+			validator:  validStructValidator,
+			expectErr:  true,
+			errContain: "not a string literal",
+		},
+		{
+			name: "parsed type mismatch returns error",
+			lit: &ast.BasicLit{
+				Kind:  token.STRING,
+				Value: `#""" """#`, // empty struct literal
+			},
+			validator: func(s *ast.StructLit) error {
+				return fmt.Errorf("forced error")
+			},
+			expectErr:  true,
+			errContain: "forced error",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := ValidateCueStringLiteral[*ast.StructLit](tt.lit, tt.validator)
+			if tt.expectErr {
+				require.Error(t, err)
+				if tt.errContain != "" {
+					require.Contains(t, err.Error(), tt.errContain)
+				}
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func normalizeString(s string) string {
+	s = strings.ReplaceAll(s, "\t", " ")
+	re := regexp.MustCompile(`\s+`)
+	return re.ReplaceAllString(s, " ")
+}
+
+func validStructValidator(slit *ast.StructLit) error {
+	if len(slit.Elts) == 0 {
+		return fmt.Errorf("struct is empty")
+	}
+	return nil
+}
+
+func TestWrapCueStruct(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{
+			name:     "simple multiline string",
+			input:    "field1: \"value1\"\nfield2: 42",
+			expected: "{\nfield1: \"value1\"\nfield2: 42\n}",
+		},
+		{
+			name:     "empty string",
+			input:    "",
+			expected: "{\n\n}",
+		},
+		{
+			name:     "single line",
+			input:    "foo: bar",
+			expected: "{\nfoo: bar\n}",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := WrapCueStruct(tt.input)
+			require.Equal(t, tt.expected, got)
+		})
+	}
+}
+
+func TestFindAndValidateField(t *testing.T) {
+	tests := []struct {
+		name               string
+		input              string
+		fieldName          string
+		expectedFound      bool
+		expectedErrMessage string
+		validator          fieldValidator
+	}{
+		{
+			name: "find field at top level without validator",
+			input: `{
+				field1: "value1"
+				field2: "value2"
+			}`,
+			fieldName:     "field1",
+			expectedFound: true,
+		},
+		{
+			name: "field not found at any level",
+			input: `{
+				field1: "value1"
+				field2: "value2"
+			}`,
+			fieldName:     "field3",
+			expectedFound: false,
+		},
+		{
+			name: "find field at top level with validator that passes",
+			input: `{
+				message: "hello world"
+				other: "value"
+			}`,
+			fieldName:     "message",
+			expectedFound: true,
+			validator: func(expr ast.Expr) error {
+				if basicLit, ok := expr.(*ast.BasicLit); ok {
+					if basicLit.Value != `"hello world"` {
+						return fmt.Errorf("expected hello world, got %s", basicLit.Value)
+					}
+				}
+				return nil
+			},
+		},
+		{
+			name: "find field at top level with validator that fails",
+			input: `{
+				message: "hello world"
+				other: "value"
+			}`,
+			fieldName:          "message",
+			expectedFound:      true,
+			expectedErrMessage: "expected goodbye, got",
+			validator: func(expr ast.Expr) error {
+				if basicLit, ok := expr.(*ast.BasicLit); ok {
+					if basicLit.Value != `"goodbye"` {
+						return fmt.Errorf("expected goodbye, got %s", basicLit.Value)
+					}
+				}
+				return nil
+			},
+		},
+		{
+			name: "find field in simple if statement",
+			input: `{
+				otherField: "value"
+				if condition {
+					message: "found in if"
+				}
+			}`,
+			fieldName:     "message",
+			expectedFound: true,
+		},
+		{
+			name: "find field in nested if statements",
+			input: `{
+				otherField: "value"
+				if condition1 {
+					if condition2 {
+						message: "deeply nested"
+					}
+				}
+			}`,
+			fieldName:     "message",
+			expectedFound: true,
+		},
+		{
+			name: "find field in if-else chain",
+			input: `{
+				status: "running"
+				if status == "running" {
+					message: "service is running"
+				}
+				if status == "stopped" {
+					message: "service is stopped"
+				}
+			}`,
+			fieldName:     "message",
+			expectedFound: true,
+		},
+		{
+			name: "find field in complex nested conditionals",
+			input: `{
+				phase: context.output.status.phase
+				replicas: context.output.status.replicas
+				readyReplicas: *0 | int
+				if context.output.status.readyReplicas != _|_ {
+					readyReplicas: context.output.status.readyReplicas
+				}
+				if phase == "Running" {
+					if readyReplicas == replicas {
+						message: "All replicas are ready"
+					}
+					if readyReplicas < replicas {
+						message: "Some replicas are not ready"
+					}
+				}
+				if phase != "Running" {
+					message: "Deployment is not running"
+				}
+			}`,
+			fieldName:     "message",
+			expectedFound: true,
+		},
+		{
+			name: "find field in if with validator",
+			input: `{
+				condition: true
+				if condition {
+					isHealth: true
+				}
+			}`,
+			fieldName:     "isHealth",
+			expectedFound: true,
+			validator: func(expr ast.Expr) error {
+				if basicLit, ok := expr.(*ast.BasicLit); ok {
+					if basicLit.Value != "true" {
+						return fmt.Errorf("expected true, got %s", basicLit.Value)
+					}
+				}
+				return nil
+			},
+		},
+		{
+			name: "find field in nested if with failing validator",
+			input: `{
+				condition: true
+				if condition {
+					if nestedCondition {
+						isHealth: false
+					}
+				}
+			}`,
+			fieldName:          "isHealth",
+			expectedFound:      true,
+			expectedErrMessage: "expected true, got",
+			validator: func(expr ast.Expr) error {
+				if basicLit, ok := expr.(*ast.BasicLit); ok {
+					if basicLit.Value != "true" {
+						return fmt.Errorf("expected true, got %s", basicLit.Value)
+					}
+				}
+				return nil
+			},
+		},
+		{
+			name: "field not found in comprehension without if clause",
+			input: `{
+				items: [for x in list { value: x }]
+			}`,
+			fieldName:     "message",
+			expectedFound: false,
+		},
+		{
+			name: "find field with complex expressions in if",
+			input: `{
+				replicas: context.output.status.replicas
+				readyReplicas: context.output.status.readyReplicas
+				if (replicas | *0) != (readyReplicas | *0) {
+					message: "not ready"
+				}
+			}`,
+			fieldName:     "message",
+			expectedFound: true,
+		},
+		{
+			name: "find field with quoted label in if statement",
+			input: `{
+				condition: true
+				if condition {
+					"field-with-dash": "value"
+				}
+			}`,
+			fieldName:     "field-with-dash",
+			expectedFound: true,
+		},
+		{
+			name: "find field in multiple nested levels",
+			input: `{
+				level1: "value"
+				if condition1 {
+					level2: "value"
+					if condition2 {
+						level3: "value"
+						if condition3 {
+							message: "deeply nested field"
+						}
+					}
+				}
+			}`,
+			fieldName:     "message",
+			expectedFound: true,
+		},
+		{
+			name: "empty struct with if statements",
+			input: `{
+				if condition {
+				}
+			}`,
+			fieldName:     "message",
+			expectedFound: false,
+		},
+		{
+			name: "field exists in both top level and if statement (finds top level first)",
+			input: `{
+				message: "top level"
+				if condition {
+					message: "in if"
+				}
+			}`,
+			fieldName:     "message",
+			expectedFound: true,
+			validator: func(expr ast.Expr) error {
+				if basicLit, ok := expr.(*ast.BasicLit); ok {
+					if basicLit.Value == `"top level"` {
+						return nil
+					}
+					return fmt.Errorf("expected top level message, got %s", basicLit.Value)
+				}
+				return fmt.Errorf("expected string literal")
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			expr, err := parser.ParseExpr("-", tt.input)
+			require.NoError(t, err)
+
+			structLit, ok := expr.(*ast.StructLit)
+			require.True(t, ok, "input should parse as struct literal")
+
+			found, err := FindAndValidateField(structLit, tt.fieldName, tt.validator)
+
+			require.Equal(t, tt.expectedFound, found, "found result should match expected")
+
+			if tt.expectedErrMessage != "" {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tt.expectedErrMessage)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
diff --git a/pkg/definition/definition_test.go b/pkg/definition/definition_test.go
index c04f9b0c..e7da3fd8 100644
--- a/pkg/definition/definition_test.go
+++ b/pkg/definition/definition_test.go
@@ -19,11 +19,17 @@ package definition
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 
+	ast2 "cuelang.org/go/cue/ast"
+	"cuelang.org/go/cue/parser"
+
+	"github.com/oam-dev/kubevela/pkg/definition/ast"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -262,3 +268,95 @@ func TestValidateSpec(t *testing.T) {
 		})
 	}
 }
+
+func TestCueNativeStatusFromCueString(t *testing.T) {
+	cueStr := strings.TrimSpace(`
+	  "a-component": {
+	    attributes: {
+	      workload: {
+	        definition: {
+	          apiVersion: "apps/v1"
+	          kind:       "Deployment"
+	        }
+	      }
+	      status: {
+	        customStatus: {
+	          message: "\(context.output.status.readyReplicas) / \(context.output.status.replicas) replicas are ready"
+	        }
+
+	        healthPolicy: {
+	          isHealth: context.output.status.readyReplicas == context.output.status.replicas
+	        }
+
+	        details: {
+	          $temp: context.output.status.replicas
+	          deploymentReady: *(context.output.status.replicas == context.output.status.readyReplicas) | false
+	        }
+	      }
+	    }
+	    type: "component"
+	  }
+
+	  template: output: {}
+	`)
+
+	def := &Definition{}
+	err := def.FromCUEString(cueStr, nil)
+	require.NoError(t, err, "failed to parse cue string")
+
+	str, err := def.ToCUEString()
+	require.NoError(t, err, "failed to convert definition to CUE")
+
+	f, err := parser.ParseFile("-", str, parser.ParseComments)
+	require.NoError(t, err, "failed to parse resulting CUE string")
+
+	statusField, ok := ast.GetFieldByPath(f, fmt.Sprintf("%s.attributes.status.details", def.GetName()))
+	require.True(t, ok, "status field not found in CUE definition")
+	require.IsType(t, &ast2.StructLit{}, statusField.Value, "expected status field to be of type StructLit")
+}
+
+func TestStringStatusFromCueString(t *testing.T) {
+	cueStr := strings.TrimSpace(`
+	  "a-component": {
+	    attributes: {
+	      workload: {
+	        definition: {
+	          apiVersion: "apps/v1"
+	          kind:       "Deployment"
+	        }
+	      }
+	      status: {
+	        customStatus: #"""
+	          message: "\(context.output.status.readyReplicas) / \(context.output.status.replicas) replicas are ready"
+	        """#
+
+	        healthPolicy: #"""
+	          isHealth: context.output.status.readyReplicas == context.output.status.replicas
+	        """#
+
+	        details: #"""
+	          $someValue: context.output.status.replicas
+	          deploymentReady: *(context.output.status.replicas == context.output.status.readyReplicas) | false
+	          replicas: *context.output.status.replicas | 0
+	        """#
+	      }
+	    }
+	    type: "component"
+	  }
+
+	  template: output: {}
+	`)
+	def := &Definition{}
+	err := def.FromCUEString(cueStr, nil)
+	require.NoError(t, err, "failed to parse cue string")
+
+	str, err := def.ToCUEString()
+	require.NoError(t, err, "failed to convert definition to CUE")
+
+	f, err := parser.ParseFile("-", str, parser.ParseComments)
+	require.NoError(t, err, "failed to parse resulting CUE string")
+
+	statusField, ok := ast.GetFieldByPath(f, fmt.Sprintf("%s.attributes.status.details", def.GetName()))
+	require.True(t, ok, "status field not found in CUE definition")
+	require.IsType(t, &ast2.StructLit{}, statusField.Value, "expected status field to be of type StructLit")
+}
diff --git a/pkg/oam/auxliary_test.go b/pkg/oam/auxliary_test.go
index 3f7cf879..7188013f 100644
--- a/pkg/oam/auxliary_test.go
+++ b/pkg/oam/auxliary_test.go
@@ -18,16 +18,102 @@ package oam
 
 import (
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/require"
-	v1 "k8s.io/api/apps/v1"
+	appsv1 "k8s.io/api/apps/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
-func TestGetSetCluster(t *testing.T) {
-	r := require.New(t)
-	deploy := &v1.Deployment{}
-	r.Equal("", GetCluster(deploy))
-	clusterName := "cluster"
-	SetClusterIfEmpty(deploy, clusterName)
-	r.Equal(clusterName, GetCluster(deploy))
+func TestOAMAuxiliary(t *testing.T) {
+	t.Run("ClusterLabel", func(t *testing.T) {
+		r := require.New(t)
+		deploy := &appsv1.Deployment{}
+		clusterName1 := "cluster-1"
+		clusterName2 := "cluster-2"
+
+		r.Equal("", GetCluster(deploy), "GetCluster should return empty string for new object")
+
+		SetClusterIfEmpty(deploy, clusterName1)
+		r.Equal(clusterName1, GetCluster(deploy), "SetClusterIfEmpty should set label on empty object")
+
+		SetClusterIfEmpty(deploy, clusterName2)
+		r.Equal(clusterName1, GetCluster(deploy), "SetClusterIfEmpty should not overwrite existing label")
+
+		SetCluster(deploy, clusterName2)
+		r.Equal(clusterName2, GetCluster(deploy), "SetCluster should overwrite existing label")
+	})
+
+	t.Run("VersionAnnotations", func(t *testing.T) {
+		r := require.New(t)
+		deploy := &appsv1.Deployment{}
+		publishVersion := "v1.0.0"
+		deployVersion := "app-v1"
+
+		r.Equal("", GetPublishVersion(deploy), "GetPublishVersion should return empty string for new object")
+		SetPublishVersion(deploy, publishVersion)
+		r.Equal(publishVersion, GetPublishVersion(deploy))
+
+		r.Equal("", GetDeployVersion(deploy), "GetDeployVersion should return empty string for new object")
+		annotations := deploy.GetAnnotations()
+		if annotations == nil {
+			annotations = make(map[string]string)
+		}
+		annotations[AnnotationDeployVersion] = deployVersion
+		deploy.SetAnnotations(annotations)
+		r.Equal(deployVersion, GetDeployVersion(deploy))
+	})
+
+	t.Run("LastAppliedTimeAnnotation", func(t *testing.T) {
+		r := require.New(t)
+		fixedTime := time.Now().Truncate(time.Second)
+		creationTime := fixedTime.Add(-time.Hour)
+
+		testCases := []struct {
+			name         string
+			annotations  map[string]string
+			expectedTime time.Time
+		}{
+			{
+				name:         "no annotation",
+				annotations:  nil,
+				expectedTime: creationTime,
+			},
+			{
+				name:         "valid annotation",
+				annotations:  map[string]string{AnnotationLastAppliedTime: fixedTime.Format(time.RFC3339)},
+				expectedTime: fixedTime,
+			},
+			{
+				name:         "invalid annotation",
+				annotations:  map[string]string{AnnotationLastAppliedTime: "invalid-time"},
+				expectedTime: creationTime,
+			},
+		}
+
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				deploy := &appsv1.Deployment{}
+				deploy.SetCreationTimestamp(metav1.NewTime(creationTime))
+				deploy.SetAnnotations(tc.annotations)
+				r.True(tc.expectedTime.Equal(GetLastAppliedTime(deploy)))
+			})
+		}
+	})
+
+	t.Run("ControllerRequirementAnnotation", func(t *testing.T) {
+		r := require.New(t)
+		deploy := &appsv1.Deployment{}
+		requirement := "controller-x"
+
+		r.Equal("", GetControllerRequirement(deploy), "GetControllerRequirement should be empty for new object")
+
+		SetControllerRequirement(deploy, requirement)
+		r.Equal(requirement, GetControllerRequirement(deploy))
+		r.Contains(deploy.GetAnnotations(), AnnotationControllerRequirement)
+
+		SetControllerRequirement(deploy, "")
+		r.Equal("", GetControllerRequirement(deploy), "GetControllerRequirement should be empty after setting to empty string")
+		r.NotContains(deploy.GetAnnotations(), AnnotationControllerRequirement, "Annotation should be removed when set to empty")
+	})
 }
diff --git a/pkg/policy/topology_test.go b/pkg/policy/topology_test.go
index c6e2e89a..822ef79a 100644
--- a/pkg/policy/topology_test.go
+++ b/pkg/policy/topology_test.go
@@ -40,7 +40,7 @@ import (
 )
 
 func TestGetClusterLabelSelectorInTopology(t *testing.T) {
-	defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.DeprecatedPolicySpec, true)()
+	featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.DeprecatedPolicySpec, true)
 	multicluster.ClusterGatewaySecretNamespace = types.DefaultKubeVelaNS
 	cli := fake.NewClientBuilder().WithScheme(common.Scheme).WithObjects(&corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
diff --git a/pkg/resourcekeeper/gc_suite_test.go b/pkg/resourcekeeper/gc_suite_test.go
index 7e2c6d80..b9706c19 100644
--- a/pkg/resourcekeeper/gc_suite_test.go
+++ b/pkg/resourcekeeper/gc_suite_test.go
@@ -67,7 +67,7 @@ var _ = Describe("Test ResourceKeeper garbage collection", func() {
 	})
 
 	It("Test gcHandler garbage collect legacy RT", func() {
-		defer featuregatetesting.SetFeatureGateDuringTest(&testing.T{}, utilfeature.DefaultFeatureGate, features.LegacyResourceTrackerGC, true)()
+		featuregatetesting.SetFeatureGateDuringTest(&testing.T{}, utilfeature.DefaultFeatureGate, features.LegacyResourceTrackerGC, true)
 		version.VelaVersion = velaVersionNumberToUpgradeResourceTracker
 		ctx := context.Background()
 		cli := multicluster.NewFakeClient(testClient)
diff --git a/pkg/utils/apply/apply_resource_test.go b/pkg/utils/apply/apply_resource_test.go
index 941c7f64..76aff691 100644
--- a/pkg/utils/apply/apply_resource_test.go
+++ b/pkg/utils/apply/apply_resource_test.go
@@ -229,7 +229,7 @@ func basicTestDeployment() *appsv1.Deployment {
 					Containers: []corev1.Container{ // array field
 						{
 							Name:  "nginx",
-							Image: "nginx:1.9.4", // normal field without default value
+							Image: "nginx:1.29.0", // normal field without default value
 						},
 					},
 				},
diff --git a/pkg/webhook/core.oam.dev/v1beta1/application/mutating_handler_test.go b/pkg/webhook/core.oam.dev/v1beta1/application/mutating_handler_test.go
index af8c7dc0..b724d610 100644
--- a/pkg/webhook/core.oam.dev/v1beta1/application/mutating_handler_test.go
+++ b/pkg/webhook/core.oam.dev/v1beta1/application/mutating_handler_test.go
@@ -1,4 +1,5 @@
 /*
+ /*
 Copyright 2022 The KubeVela Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/pkg/webhook/core.oam.dev/v1beta1/application/suite_test.go b/pkg/webhook/core.oam.dev/v1beta1/application/suite_test.go
index 5cc11167..e5880b78 100644
--- a/pkg/webhook/core.oam.dev/v1beta1/application/suite_test.go
+++ b/pkg/webhook/core.oam.dev/v1beta1/application/suite_test.go
@@ -49,7 +49,7 @@ var cfg *rest.Config
 var k8sClient client.Client
 var testEnv *envtest.Environment
 var testScheme = runtime.NewScheme()
-var decoder *admission.Decoder
+var decoder admission.Decoder
 var ctx = context.Background()
 var handler *ValidatingHandler
 
diff --git a/pkg/webhook/core.oam.dev/v1beta1/application/validating_handler_test.go b/pkg/webhook/core.oam.dev/v1beta1/application/validating_handler_test.go
index d859561c..4ee0a86f 100644
--- a/pkg/webhook/core.oam.dev/v1beta1/application/validating_handler_test.go
+++ b/pkg/webhook/core.oam.dev/v1beta1/application/validating_handler_test.go
@@ -248,6 +248,109 @@ var _ = Describe("Test Application Validator", func() {
 				Object: runtime.RawExtension{
 					Raw: []byte(`
 {"apiVersion":"core.oam.dev/v1beta1","kind":"Application","metadata":{"name":"workflow-timeout","namespace":"default","annotations":{"app.oam.dev/autoUpdate":"true"}},"spec":{"components":[{"name":"comp","type":"worker","properties":{"image":"crccheck/hello-world"}}],"workflow":{"steps":[{"name":"group","type":"suspend","timeout":"1s"}]}}}
+`),
+				},
+			},
+		}
+		resp := handler.Handle(ctx, req)
+		Expect(resp.Allowed).Should(BeTrue())
+	})
+
+	It("Test Application Update with validation errors - duplicate workflow steps", func() {
+		req := admission.Request{
+			AdmissionRequest: admissionv1.AdmissionRequest{
+				Operation: admissionv1.Update,
+				Resource:  metav1.GroupVersionResource{Group: "core.oam.dev", Version: "v1alpha2", Resource: "applications"},
+				Object: runtime.RawExtension{
+					Raw: []byte(`
+{"apiVersion":"core.oam.dev/v1beta1","kind":"Application","metadata":{"name":"application-sample","namespace":"default"},"spec":{"components":[{"name":"comp","type":"worker","properties":{"image":"busybox"}}],"workflow":{"steps":[{"name":"suspend","type":"suspend"},{"name":"suspend","type":"suspend"}]}}}
+`),
+				},
+				OldObject: runtime.RawExtension{
+					Raw: []byte(`
+{"apiVersion":"core.oam.dev/v1beta1","kind":"Application","metadata":{"name":"application-sample","namespace":"default"},"spec":{"components":[{"name":"comp","type":"worker","properties":{"image":"busybox"}}]}}
+`),
+				},
+			},
+		}
+		resp := handler.Handle(ctx, req)
+		Expect(resp.Allowed).Should(BeFalse())
+	})
+
+	It("Test Application Update with invalid workflow timeout", func() {
+		req := admission.Request{
+			AdmissionRequest: admissionv1.AdmissionRequest{
+				Operation: admissionv1.Update,
+				Resource:  metav1.GroupVersionResource{Group: "core.oam.dev", Version: "v1alpha2", Resource: "applications"},
+				Object: runtime.RawExtension{
+					Raw: []byte(`
+{"apiVersion":"core.oam.dev/v1beta1","kind":"Application","metadata":{"name":"workflow-update-test","namespace":"default"},"spec":{"components":[{"name":"comp","type":"worker","properties":{"image":"busybox"}}],"workflow":{"steps":[{"name":"group","type":"suspend","timeout":"invalid-timeout"}]}}}
+`),
+				},
+				OldObject: runtime.RawExtension{
+					Raw: []byte(`
+{"apiVersion":"core.oam.dev/v1beta1","kind":"Application","metadata":{"name":"workflow-update-test","namespace":"default"},"spec":{"components":[{"name":"comp","type":"worker","properties":{"image":"busybox"}}]}}
+`),
+				},
+			},
+		}
+		resp := handler.Handle(ctx, req)
+		Expect(resp.Allowed).Should(BeFalse())
+	})
+
+	It("Test Application Update with deletion timestamp should skip validation", func() {
+		now := metav1.Now()
+		req := admission.Request{
+			AdmissionRequest: admissionv1.AdmissionRequest{
+				Operation: admissionv1.Update,
+				Resource:  metav1.GroupVersionResource{Group: "core.oam.dev", Version: "v1alpha2", Resource: "applications"},
+				Object: runtime.RawExtension{
+					Raw: []byte(`
+{"apiVersion":"core.oam.dev/v1beta1","kind":"Application","metadata":{"name":"application-sample","namespace":"default","deletionTimestamp":"` + now.Format("2006-01-02T15:04:05Z") + `"},"spec":{"components":[{"name":"comp","type":"worker","properties":{"image":"busybox"}}],"workflow":{"steps":[{"name":"suspend","type":"suspend"},{"name":"suspend","type":"suspend"}]}}}
+`),
+				},
+				OldObject: runtime.RawExtension{
+					Raw: []byte(`
+{"apiVersion":"core.oam.dev/v1beta1","kind":"Application","metadata":{"name":"application-sample","namespace":"default"},"spec":{"components":[{"name":"comp","type":"worker","properties":{"image":"busybox"}}]}}
+`),
+				},
+			},
+		}
+		resp := handler.Handle(ctx, req)
+		// Even with duplicate workflow steps (which would normally fail), it should pass because of deletion timestamp
+		Expect(resp.Allowed).Should(BeTrue())
+	})
+
+	It("Test Application Update decode old object error", func() {
+		req := admission.Request{
+			AdmissionRequest: admissionv1.AdmissionRequest{
+				Operation: admissionv1.Update,
+				Resource:  metav1.GroupVersionResource{Group: "core.oam.dev", Version: "v1alpha2", Resource: "applications"},
+				Object: runtime.RawExtension{
+					Raw: []byte(`
+{"apiVersion":"core.oam.dev/v1beta1","kind":"Application","metadata":{"name":"application-sample","namespace":"default"},"spec":{"components":[{"name":"comp","type":"worker","properties":{"image":"busybox"}}]}}
+`),
+				},
+				OldObject: runtime.RawExtension{Raw: []byte("invalid json")},
+			},
+		}
+		resp := handler.Handle(ctx, req)
+		Expect(resp.Allowed).Should(BeFalse())
+	})
+
+	It("Test Application Update successful case", func() {
+		req := admission.Request{
+			AdmissionRequest: admissionv1.AdmissionRequest{
+				Operation: admissionv1.Update,
+				Resource:  metav1.GroupVersionResource{Group: "core.oam.dev", Version: "v1alpha2", Resource: "applications"},
+				Object: runtime.RawExtension{
+					Raw: []byte(`
+{"apiVersion":"core.oam.dev/v1beta1","kind":"Application","metadata":{"name":"application-sample","namespace":"default"},"spec":{"components":[{"name":"comp","type":"worker","properties":{"image":"nginx"}}]}}
+`),
+				},
+				OldObject: runtime.RawExtension{
+					Raw: []byte(`
+{"apiVersion":"core.oam.dev/v1beta1","kind":"Application","metadata":{"name":"application-sample","namespace":"default"},"spec":{"components":[{"name":"comp","type":"worker","properties":{"image":"busybox"}}]}}
 `),
 				},
 			},
diff --git a/pkg/webhook/core.oam.dev/v1beta1/application/validation_permissions_test.go b/pkg/webhook/core.oam.dev/v1beta1/application/validation_permissions_test.go
new file mode 100644
index 00000000..88aa8ade
--- /dev/null
+++ b/pkg/webhook/core.oam.dev/v1beta1/application/validation_permissions_test.go
@@ -0,0 +1,881 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package application
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	admissionv1 "k8s.io/api/admission/v1"
+	authenticationv1 "k8s.io/api/authentication/v1"
+	authv1 "k8s.io/api/authorization/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	utilfeature "k8s.io/apiserver/pkg/util/feature"
+	featuregatetesting "k8s.io/component-base/featuregate/testing"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+
+	workflowv1alpha1 "github.com/kubevela/workflow/api/v1alpha1"
+
+	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
+	"github.com/oam-dev/kubevela/apis/core.oam.dev/v1beta1"
+	"github.com/oam-dev/kubevela/pkg/auth"
+	"github.com/oam-dev/kubevela/pkg/features"
+	"github.com/oam-dev/kubevela/pkg/oam"
+)
+
+func TestValidateDefinitionPermissions(t *testing.T) {
+	// Enable the authentication features for testing
+	featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultMutableFeatureGate, features.ValidateDefinitionPermissions, true)
+	oldAuthWithUser := auth.AuthenticationWithUser
+	auth.AuthenticationWithUser = true
+	defer func() { auth.AuthenticationWithUser = oldAuthWithUser }()
+
+	testCases := []struct {
+		name                string
+		app                 *v1beta1.Application
+		userInfo            authenticationv1.UserInfo
+		allowedDefinitions  map[string]bool // resource/namespace/name -> allowed
+		expectedErrorCount  int
+		expectedErrorFields []string
+		expectedErrorMsgs   []string
+	}{
+		{
+			name: "user has all permissions",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app",
+					Namespace: "test-ns",
+				},
+				Spec: v1beta1.ApplicationSpec{
+					Components: []common.ApplicationComponent{
+						{
+							Name: "comp1",
+							Type: "webservice",
+							Traits: []common.ApplicationTrait{
+								{Type: "scaler"},
+							},
+						},
+					},
+					Policies: []v1beta1.AppPolicy{
+						{Name: "policy1", Type: "topology"},
+					},
+					Workflow: &v1beta1.Workflow{
+						Steps: []workflowv1alpha1.WorkflowStep{
+							{
+								WorkflowStepBase: workflowv1alpha1.WorkflowStepBase{
+									Name: "step1",
+									Type: "deploy",
+								},
+							},
+						},
+					},
+				},
+			},
+			userInfo: authenticationv1.UserInfo{
+				Username: "test-user",
+				Groups:   []string{"test-group"},
+			},
+			allowedDefinitions: map[string]bool{
+				"componentdefinitions/vela-system/webservice": true,
+				"traitdefinitions/vela-system/scaler":         true,
+				"policydefinitions/vela-system/topology":      true,
+				"workflowstepdefinitions/vela-system/deploy":  true,
+			},
+			expectedErrorCount: 0,
+		},
+		{
+			name: "user lacks ComponentDefinition permission",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app",
+					Namespace: "test-ns",
+				},
+				Spec: v1beta1.ApplicationSpec{
+					Components: []common.ApplicationComponent{
+						{
+							Name: "comp1",
+							Type: "webservice",
+						},
+						{
+							Name: "comp2",
+							Type: "webservice", // Same type, should get two errors
+						},
+					},
+				},
+			},
+			userInfo: authenticationv1.UserInfo{
+				Username: "restricted-user",
+				Groups:   []string{"restricted-group"},
+			},
+			allowedDefinitions: map[string]bool{
+				"componentdefinitions/vela-system/webservice": false,
+				"componentdefinitions/test-ns/webservice":     false,
+			},
+			expectedErrorCount:  2, // One for each component
+			expectedErrorFields: []string{"spec.components[0].type", "spec.components[1].type"},
+			expectedErrorMsgs:   []string{"cannot get ComponentDefinition \"webservice\""},
+		},
+		{
+			name: "user lacks TraitDefinition permission",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app",
+					Namespace: "test-ns",
+				},
+				Spec: v1beta1.ApplicationSpec{
+					Components: []common.ApplicationComponent{
+						{
+							Name: "comp1",
+							Type: "webservice",
+							Traits: []common.ApplicationTrait{
+								{Type: "scaler"},
+								{Type: "gateway"},
+							},
+						},
+					},
+				},
+			},
+			userInfo: authenticationv1.UserInfo{
+				Username: "restricted-user",
+				Groups:   []string{"restricted-group"},
+			},
+			allowedDefinitions: map[string]bool{
+				"componentdefinitions/vela-system/webservice": true,
+				"traitdefinitions/vela-system/scaler":         false,
+				"traitdefinitions/test-ns/scaler":             false,
+				"traitdefinitions/vela-system/gateway":        false,
+				"traitdefinitions/test-ns/gateway":            false,
+			},
+			expectedErrorCount:  2,
+			expectedErrorFields: []string{"spec.components[0].traits[1].type", "spec.components[0].traits[0].type"},
+			expectedErrorMsgs:   []string{"cannot get TraitDefinition \"gateway\"", "cannot get TraitDefinition \"scaler\""},
+		},
+		{
+			name: "user lacks PolicyDefinition permission",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app",
+					Namespace: "test-ns",
+				},
+				Spec: v1beta1.ApplicationSpec{
+					Policies: []v1beta1.AppPolicy{
+						{
+							Name: "topology",
+							Type: "topology",
+							Properties: &runtime.RawExtension{
+								Raw: []byte(`{"clusters":["local","remote"]}`),
+							},
+						},
+						{
+							Name: "override",
+							Type: "override",
+							Properties: &runtime.RawExtension{
+								Raw: []byte(`{"components":[{"name":"comp1"}]}`),
+							},
+						},
+					},
+				},
+			},
+			userInfo: authenticationv1.UserInfo{
+				Username: "policy-user",
+				Groups:   []string{"policy-group"},
+			},
+			allowedDefinitions: map[string]bool{
+				"policydefinitions/vela-system/topology": true,
+				"policydefinitions/test-ns/topology":     true,
+				"policydefinitions/vela-system/override": false,
+				"policydefinitions/test-ns/override":     false,
+			},
+			expectedErrorCount:  1,
+			expectedErrorFields: []string{"spec.policies[1].type"},
+			expectedErrorMsgs:   []string{"cannot get PolicyDefinition \"override\""},
+		},
+		{
+			name: "empty application",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "empty-app",
+					Namespace: "test-ns",
+				},
+				Spec: v1beta1.ApplicationSpec{},
+			},
+			userInfo: authenticationv1.UserInfo{
+				Username: "empty-user",
+				Groups:   []string{"empty-group"},
+			},
+			allowedDefinitions: map[string]bool{},
+			expectedErrorCount: 0,
+		},
+		{
+			name: "nil workflow",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "nil-workflow-app",
+					Namespace: "test-ns",
+				},
+				Spec: v1beta1.ApplicationSpec{
+					Components: []common.ApplicationComponent{
+						{
+							Name: "comp1",
+							Type: "webservice",
+						},
+					},
+					Workflow: nil,
+				},
+			},
+			userInfo: authenticationv1.UserInfo{
+				Username: "test-user",
+				Groups:   []string{"test-group"},
+			},
+			allowedDefinitions: map[string]bool{
+				"componentdefinitions/vela-system/webservice": true,
+				"componentdefinitions/test-ns/webservice":     true,
+			},
+			expectedErrorCount: 0,
+		},
+		{
+			name: "mixed permissions",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "mixed-app",
+					Namespace: "test-ns",
+				},
+				Spec: v1beta1.ApplicationSpec{
+					Components: []common.ApplicationComponent{
+						{
+							Name: "allowed-comp",
+							Type: "webservice",
+							Traits: []common.ApplicationTrait{
+								{Type: "scaler"},
+								{Type: "ingress"},
+							},
+						},
+						{
+							Name: "denied-comp",
+							Type: "worker",
+						},
+					},
+					Policies: []v1beta1.AppPolicy{
+						{
+							Name: "topology",
+							Type: "topology",
+						},
+						{
+							Name: "garbage-collect",
+							Type: "garbage-collect",
+						},
+					},
+					Workflow: &v1beta1.Workflow{
+						Steps: []workflowv1alpha1.WorkflowStep{
+							{
+								WorkflowStepBase: workflowv1alpha1.WorkflowStepBase{
+									Name: "deploy",
+									Type: "deploy",
+								},
+							},
+							{
+								WorkflowStepBase: workflowv1alpha1.WorkflowStepBase{
+									Name: "notify",
+									Type: "notification",
+								},
+							},
+						},
+					},
+				},
+			},
+			userInfo: authenticationv1.UserInfo{
+				Username: "mixed-user",
+				Groups:   []string{"mixed-group"},
+			},
+			allowedDefinitions: map[string]bool{
+				"componentdefinitions/vela-system/webservice":      true,
+				"componentdefinitions/test-ns/webservice":          true,
+				"componentdefinitions/vela-system/worker":          false,
+				"componentdefinitions/test-ns/worker":              false,
+				"traitdefinitions/vela-system/scaler":              false,
+				"traitdefinitions/test-ns/scaler":                  false,
+				"traitdefinitions/vela-system/ingress":             true,
+				"traitdefinitions/test-ns/ingress":                 true,
+				"policydefinitions/vela-system/topology":           true,
+				"policydefinitions/test-ns/topology":               true,
+				"policydefinitions/vela-system/garbage-collect":    false,
+				"policydefinitions/test-ns/garbage-collect":        false,
+				"workflowstepdefinitions/vela-system/deploy":       true,
+				"workflowstepdefinitions/test-ns/deploy":           true,
+				"workflowstepdefinitions/vela-system/notification": false,
+				"workflowstepdefinitions/test-ns/notification":     false,
+			},
+			expectedErrorCount: 4,
+			expectedErrorFields: []string{
+				"spec.components[0].traits[0].type",
+				"spec.components[1].type",
+				"spec.policies[1].type",
+				"spec.workflow.steps[1].type",
+			},
+			expectedErrorMsgs: []string{
+				"cannot get TraitDefinition \"scaler\"",
+				"cannot get ComponentDefinition \"worker\"",
+				"cannot get PolicyDefinition \"garbage-collect\"",
+				"cannot get WorkflowStepDefinition \"notification\"",
+			},
+		},
+		{
+			name: "SAR API failure returns error",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app",
+					Namespace: "test-ns",
+				},
+				Spec: v1beta1.ApplicationSpec{
+					Components: []common.ApplicationComponent{
+						{
+							Name: "comp1",
+							Type: "error-trigger",
+						},
+					},
+				},
+			},
+			userInfo: authenticationv1.UserInfo{
+				Username: "test-user",
+				Groups:   []string{"test-group"},
+			},
+			allowedDefinitions: map[string]bool{
+				"componentdefinitions/vela-system/error-trigger": false,
+				"componentdefinitions/test-ns/error-trigger":     false,
+			},
+			expectedErrorCount:  1,
+			expectedErrorFields: []string{"spec.components[0].type"},
+			expectedErrorMsgs:   []string{"unable to verify permissions"},
+		},
+		{
+			name: "SAR API intermittent failure - fails closed for safety",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app",
+					Namespace: "test-ns",
+				},
+				Spec: v1beta1.ApplicationSpec{
+					Components: []common.ApplicationComponent{
+						{
+							Name: "comp1",
+							Type: "system-error-only",
+						},
+					},
+				},
+			},
+			userInfo: authenticationv1.UserInfo{
+				Username: "test-user",
+				Groups:   []string{"test-group"},
+			},
+			allowedDefinitions: map[string]bool{
+				"componentdefinitions/test-ns/system-error-only": true,
+			},
+			expectedErrorCount:  1,
+			expectedErrorFields: []string{"spec.components[0].type"},
+			expectedErrorMsgs:   []string{"unable to verify permissions"},
+		},
+		{
+			name: "user has permission in app namespace but not system namespace",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app",
+					Namespace: "test-ns",
+				},
+				Spec: v1beta1.ApplicationSpec{
+					Components: []common.ApplicationComponent{
+						{
+							Name: "comp1",
+							Type: "custom-comp",
+						},
+					},
+				},
+			},
+			userInfo: authenticationv1.UserInfo{
+				Username: "namespace-user",
+				Groups:   []string{"namespace-group"},
+			},
+			allowedDefinitions: map[string]bool{
+				"componentdefinitions/vela-system/custom-comp": false,
+				"componentdefinitions/test-ns/custom-comp":     true, // Allowed in app namespace
+			},
+			expectedErrorCount: 0, // Should pass as user has permission in app namespace
+		},
+		{
+			name: "user has permission in system namespace but not app namespace",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app",
+					Namespace: "test-ns",
+				},
+				Spec: v1beta1.ApplicationSpec{
+					Components: []common.ApplicationComponent{
+						{
+							Name: "comp1",
+							Type: "webservice",
+						},
+					},
+				},
+			},
+			userInfo: authenticationv1.UserInfo{
+				Username: "system-user",
+				Groups:   []string{"system-group"},
+			},
+			allowedDefinitions: map[string]bool{
+				"componentdefinitions/vela-system/webservice": true, // Allowed in system namespace
+				"componentdefinitions/test-ns/webservice":     false,
+			},
+			expectedErrorCount: 0, // Should pass as user has permission in system namespace
+		},
+		{
+			name: "workflow with substeps",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app",
+					Namespace: "test-ns",
+				},
+				Spec: v1beta1.ApplicationSpec{
+					Workflow: &v1beta1.Workflow{
+						Steps: []workflowv1alpha1.WorkflowStep{
+							{
+								WorkflowStepBase: workflowv1alpha1.WorkflowStepBase{
+									Name: "step1",
+									Type: "deploy",
+								},
+								SubSteps: []workflowv1alpha1.WorkflowStepBase{
+									{
+										Name: "substep1",
+										Type: "suspend",
+									},
+									{
+										Name: "substep2",
+										Type: "notification",
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			userInfo: authenticationv1.UserInfo{
+				Username: "workflow-user",
+				Groups:   []string{"workflow-group"},
+			},
+			allowedDefinitions: map[string]bool{
+				"workflowstepdefinitions/vela-system/deploy":       true,
+				"workflowstepdefinitions/vela-system/suspend":      false,
+				"workflowstepdefinitions/test-ns/suspend":          false,
+				"workflowstepdefinitions/vela-system/notification": false,
+				"workflowstepdefinitions/test-ns/notification":     false,
+			},
+			expectedErrorCount:  2,
+			expectedErrorFields: []string{"spec.workflow.steps[0].subSteps[0].type", "spec.workflow.steps[0].subSteps[1].type"},
+			expectedErrorMsgs:   []string{"cannot get WorkflowStepDefinition \"suspend\"", "cannot get WorkflowStepDefinition \"notification\""},
+		},
+		{
+			name: "duplicate definitions only checked once",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app",
+					Namespace: "test-ns",
+				},
+				Spec: v1beta1.ApplicationSpec{
+					Components: []common.ApplicationComponent{
+						{
+							Name: "comp1",
+							Type: "webservice",
+							Traits: []common.ApplicationTrait{
+								{Type: "scaler"},
+							},
+						},
+						{
+							Name: "comp2",
+							Type: "webservice", // Duplicate
+							Traits: []common.ApplicationTrait{
+								{Type: "scaler"}, // Duplicate
+							},
+						},
+					},
+				},
+			},
+			userInfo: authenticationv1.UserInfo{
+				Username: "test-user",
+				Groups:   []string{"test-group"},
+			},
+			allowedDefinitions: map[string]bool{
+				"componentdefinitions/vela-system/webservice": false,
+				"componentdefinitions/test-ns/webservice":     false,
+				"traitdefinitions/vela-system/scaler":         false,
+				"traitdefinitions/test-ns/scaler":             false,
+			},
+			expectedErrorCount: 4, // 2 components + 2 traits
+			expectedErrorFields: []string{
+				"spec.components[0].type",
+				"spec.components[1].type",
+				"spec.components[0].traits[0].type",
+				"spec.components[1].traits[0].type",
+			},
+		},
+		{
+			name: "application in vela-system namespace",
+			app: &v1beta1.Application{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-app",
+					Namespace: oam.SystemDefinitionNamespace, // vela-system
+				},
+				Spec: v1beta1.ApplicationSpec{
+					Components: []common.ApplicationComponent{
+						{
+							Name: "comp1",
+							Type: "webservice",
+						},
+					},
+				},
+			},
+			userInfo: authenticationv1.UserInfo{
+				Username: "system-user",
+				Groups:   []string{"system-group"},
+			},
+			allowedDefinitions: map[string]bool{
+				"componentdefinitions/vela-system/webservice": false,
+			},
+			expectedErrorCount:  1,
+			expectedErrorFields: []string{"spec.components[0].type"},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Create a fake client with mock SubjectAccessReview behavior
+			scheme := runtime.NewScheme()
+			_ = v1beta1.AddToScheme(scheme)
+			_ = authv1.AddToScheme(scheme)
+
+			fakeClient := &mockSARClient{
+				Client:             fake.NewClientBuilder().WithScheme(scheme).Build(),
+				allowedDefinitions: tc.allowedDefinitions,
+			}
+
+			handler := &ValidatingHandler{
+				Client: fakeClient,
+			}
+
+			req := admission.Request{
+				AdmissionRequest: admissionv1.AdmissionRequest{
+					UserInfo: tc.userInfo,
+				},
+			}
+
+			// Run the validation
+			errs := handler.ValidateDefinitionPermissions(context.Background(), tc.app, req)
+
+			// Check error count
+			assert.Equal(t, tc.expectedErrorCount, len(errs),
+				"Expected %d errors, got %d: %v", tc.expectedErrorCount, len(errs), errs)
+
+			// Check error fields and messages (order independent)
+			if len(tc.expectedErrorFields) > 0 {
+				actualFields := make([]string, len(errs))
+				for i, err := range errs {
+					actualFields[i] = err.Field
+				}
+				for _, expectedField := range tc.expectedErrorFields {
+					assert.Contains(t, actualFields, expectedField,
+						"Expected field %s not found in errors: %v", expectedField, actualFields)
+				}
+			}
+			if len(tc.expectedErrorMsgs) > 0 {
+				actualMessages := make([]string, len(errs))
+				for i, err := range errs {
+					actualMessages[i] = err.Detail
+				}
+				for _, expectedMsg := range tc.expectedErrorMsgs {
+					found := false
+					for _, actualMsg := range actualMessages {
+						if strings.Contains(actualMsg, expectedMsg) {
+							found = true
+							break
+						}
+					}
+					assert.True(t, found,
+						"Expected message containing %s not found in errors: %v", expectedMsg, actualMessages)
+				}
+			}
+		})
+	}
+}
+
+func TestValidateDefinitionPermissions_FeatureDisabled(t *testing.T) {
+	// Disable the definition validation feature
+	featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultMutableFeatureGate, features.ValidateDefinitionPermissions, false)
+	oldAuthWithUser := auth.AuthenticationWithUser
+	auth.AuthenticationWithUser = true
+	defer func() { auth.AuthenticationWithUser = oldAuthWithUser }()
+
+	app := &v1beta1.Application{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-app",
+			Namespace: "test-ns",
+		},
+		Spec: v1beta1.ApplicationSpec{
+			Components: []common.ApplicationComponent{
+				{
+					Name: "comp1",
+					Type: "webservice",
+				},
+			},
+		},
+	}
+
+	handler := &ValidatingHandler{
+		Client: fake.NewClientBuilder().Build(),
+	}
+
+	req := admission.Request{
+		AdmissionRequest: admissionv1.AdmissionRequest{
+			UserInfo: authenticationv1.UserInfo{
+				Username: "test-user",
+			},
+		},
+	}
+
+	// Should return no errors when feature is disabled
+	errs := handler.ValidateDefinitionPermissions(context.Background(), app, req)
+	assert.Empty(t, errs, "Expected no errors when feature is disabled")
+}
+
+func TestValidateDefinitionPermissions_AuthenticationDisabled(t *testing.T) {
+	// Enable the definition validation feature but disable authentication
+	featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultMutableFeatureGate, features.ValidateDefinitionPermissions, true)
+	oldAuthWithUser := auth.AuthenticationWithUser
+	auth.AuthenticationWithUser = false
+	defer func() { auth.AuthenticationWithUser = oldAuthWithUser }()
+
+	app := &v1beta1.Application{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-app",
+			Namespace: "test-ns",
+		},
+		Spec: v1beta1.ApplicationSpec{
+			Components: []common.ApplicationComponent{
+				{
+					Name: "comp1",
+					Type: "webservice",
+				},
+			},
+		},
+	}
+
+	handler := &ValidatingHandler{
+		Client: fake.NewClientBuilder().Build(),
+	}
+
+	req := admission.Request{
+		AdmissionRequest: admissionv1.AdmissionRequest{
+			UserInfo: authenticationv1.UserInfo{
+				Username: "test-user",
+			},
+		},
+	}
+
+	// Should return no errors when AuthenticationWithUser is disabled
+	errs := handler.ValidateDefinitionPermissions(context.Background(), app, req)
+	assert.Empty(t, errs, "Expected no errors when AuthenticationWithUser is disabled")
+}
+
+func TestCollectDefinitionUsage(t *testing.T) {
+	app := &v1beta1.Application{
+		Spec: v1beta1.ApplicationSpec{
+			Components: []common.ApplicationComponent{
+				{
+					Name: "comp1",
+					Type: "webservice",
+					Traits: []common.ApplicationTrait{
+						{Type: "scaler"},
+						{Type: "gateway"},
+					},
+				},
+				{
+					Name: "comp2",
+					Type: "webservice", // Duplicate
+					Traits: []common.ApplicationTrait{
+						{Type: "scaler"}, // Duplicate
+					},
+				},
+			},
+			Policies: []v1beta1.AppPolicy{
+				{Name: "policy1", Type: "topology"},
+				{Name: "policy2", Type: "override"},
+				{Name: "policy3", Type: "topology"}, // Duplicate
+			},
+			Workflow: &v1beta1.Workflow{
+				Steps: []workflowv1alpha1.WorkflowStep{
+					{
+						WorkflowStepBase: workflowv1alpha1.WorkflowStepBase{
+							Name: "step1",
+							Type: "deploy",
+						},
+						SubSteps: []workflowv1alpha1.WorkflowStepBase{
+							{
+								Name: "substep1",
+								Type: "suspend",
+							},
+							{
+								Name: "substep2",
+								Type: "deploy", // Duplicate
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	usage := collectDefinitionUsage(app)
+
+	// Check component types
+	assert.Equal(t, 2, len(usage.componentTypes["webservice"]))
+	assert.Contains(t, usage.componentTypes["webservice"], 0)
+	assert.Contains(t, usage.componentTypes["webservice"], 1)
+
+	// Check trait types
+	assert.Equal(t, 2, len(usage.traitTypes["scaler"]))
+	assert.Equal(t, 1, len(usage.traitTypes["gateway"]))
+
+	// Check policy types
+	assert.Equal(t, 2, len(usage.policyTypes["topology"]))
+	assert.Equal(t, 1, len(usage.policyTypes["override"]))
+
+	// Check workflow step types
+	assert.Equal(t, 2, len(usage.workflowStepTypes["deploy"]))
+	assert.Equal(t, 1, len(usage.workflowStepTypes["suspend"]))
+
+	// Check that substeps are properly marked
+	for _, loc := range usage.workflowStepTypes["suspend"] {
+		assert.True(t, loc.IsSubStep, "Suspend should be marked as a substep")
+		assert.Equal(t, 0, loc.StepIndex, "Suspend should be in step 0")
+		assert.Equal(t, 0, loc.SubStepIndex, "Suspend should be substep 0")
+	}
+
+	// Check regular steps and substeps for "deploy"
+	deployLocations := usage.workflowStepTypes["deploy"]
+	assert.Equal(t, 2, len(deployLocations))
+	regularStepFound := false
+	subStepFound := false
+	for _, loc := range deployLocations {
+		if !loc.IsSubStep {
+			regularStepFound = true
+			assert.Equal(t, 0, loc.StepIndex)
+			assert.Equal(t, -1, loc.SubStepIndex)
+		} else {
+			subStepFound = true
+			assert.Equal(t, 0, loc.StepIndex)
+			assert.Equal(t, 1, loc.SubStepIndex)
+		}
+	}
+	assert.True(t, regularStepFound, "Should have regular deploy step")
+	assert.True(t, subStepFound, "Should have deploy substep")
+}
+
+func TestGetWorkflowStepFieldPath(t *testing.T) {
+	testCases := []struct {
+		name         string
+		location     workflowStepLocation
+		expectedPath string
+	}{
+		{
+			name: "regular step",
+			location: workflowStepLocation{
+				StepIndex:    0,
+				SubStepIndex: -1,
+				IsSubStep:    false,
+			},
+			expectedPath: "spec.workflow.steps[0].type",
+		},
+		{
+			name: "regular step index 5",
+			location: workflowStepLocation{
+				StepIndex:    5,
+				SubStepIndex: -1,
+				IsSubStep:    false,
+			},
+			expectedPath: "spec.workflow.steps[5].type",
+		},
+		{
+			name: "substep 0 of step 0",
+			location: workflowStepLocation{
+				StepIndex:    0,
+				SubStepIndex: 0,
+				IsSubStep:    true,
+			},
+			expectedPath: "spec.workflow.steps[0].subSteps[0].type",
+		},
+		{
+			name: "substep 2 of step 1",
+			location: workflowStepLocation{
+				StepIndex:    1,
+				SubStepIndex: 2,
+				IsSubStep:    true,
+			},
+			expectedPath: "spec.workflow.steps[1].subSteps[2].type",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			path := getWorkflowStepFieldPath(tc.location)
+			assert.Equal(t, tc.expectedPath, path.String())
+		})
+	}
+}
+
+// mockSARClient is a mock client that simulates SubjectAccessReview responses
+type mockSARClient struct {
+	client.Client
+	allowedDefinitions map[string]bool
+}
+
+func (m *mockSARClient) Create(ctx context.Context, obj client.Object, opts ...client.CreateOption) error {
+	if sar, ok := obj.(*authv1.SubjectAccessReview); ok {
+		// Mock failures
+		if sar.Spec.ResourceAttributes.Name == "error-trigger" {
+			return fmt.Errorf("simulated SAR API failure: connection timeout")
+		}
+		if sar.Spec.ResourceAttributes.Name == "system-error-only" &&
+			sar.Spec.ResourceAttributes.Namespace == "vela-system" {
+			return fmt.Errorf("simulated SAR API failure: system namespace unreachable")
+		}
+
+		key := fmt.Sprintf("%s/%s/%s",
+			sar.Spec.ResourceAttributes.Resource,
+			sar.Spec.ResourceAttributes.Namespace,
+			sar.Spec.ResourceAttributes.Name)
+
+		if allowed, exists := m.allowedDefinitions[key]; exists {
+			sar.Status.Allowed = allowed
+		} else {
+			sar.Status.Allowed = false
+		}
+		return nil
+	}
+	return m.Client.Create(ctx, obj, opts...)
+}
diff --git a/pkg/webhook/core.oam.dev/v1beta1/componentdefinition/validating_handler_test.go b/pkg/webhook/core.oam.dev/v1beta1/componentdefinition/validating_handler_test.go
index ad26ffcb..3e1c9578 100644
--- a/pkg/webhook/core.oam.dev/v1beta1/componentdefinition/validating_handler_test.go
+++ b/pkg/webhook/core.oam.dev/v1beta1/componentdefinition/validating_handler_test.go
@@ -44,7 +44,7 @@ import (
 var handler ValidatingHandler
 var req admission.Request
 var reqResource metav1.GroupVersionResource
-var decoder *admission.Decoder
+var decoder admission.Decoder
 var cd v1beta1.ComponentDefinition
 var cdRaw []byte
 var testScheme = runtime.NewScheme()
diff --git a/pkg/webhook/core.oam.dev/v1beta1/policydefinition/validating_handler_test.go b/pkg/webhook/core.oam.dev/v1beta1/policydefinition/validating_handler_test.go
index 7f6823bd..33fe672f 100644
--- a/pkg/webhook/core.oam.dev/v1beta1/policydefinition/validating_handler_test.go
+++ b/pkg/webhook/core.oam.dev/v1beta1/policydefinition/validating_handler_test.go
@@ -41,7 +41,7 @@ import (
 var handler ValidatingHandler
 var req admission.Request
 var reqResource metav1.GroupVersionResource
-var decoder *admission.Decoder
+var decoder admission.Decoder
 var pd v1beta1.PolicyDefinition
 var pdRaw []byte
 var scheme = runtime.NewScheme()
diff --git a/pkg/webhook/core.oam.dev/v1beta1/traitdefinition/validating_handler_test.go b/pkg/webhook/core.oam.dev/v1beta1/traitdefinition/validating_handler_test.go
index df8f9bc5..9fdf5899 100644
--- a/pkg/webhook/core.oam.dev/v1beta1/traitdefinition/validating_handler_test.go
+++ b/pkg/webhook/core.oam.dev/v1beta1/traitdefinition/validating_handler_test.go
@@ -43,7 +43,7 @@ import (
 var handler ValidatingHandler
 var req admission.Request
 var reqResource metav1.GroupVersionResource
-var decoder *admission.Decoder
+var decoder admission.Decoder
 var td v1beta1.TraitDefinition
 var tdRaw []byte
 var scheme = runtime.NewScheme()
diff --git a/pkg/webhook/core.oam.dev/v1beta1/workflowstepdefinition/validating_handler_test.go b/pkg/webhook/core.oam.dev/v1beta1/workflowstepdefinition/validating_handler_test.go
index 5b087bfe..82d701af 100644
--- a/pkg/webhook/core.oam.dev/v1beta1/workflowstepdefinition/validating_handler_test.go
+++ b/pkg/webhook/core.oam.dev/v1beta1/workflowstepdefinition/validating_handler_test.go
@@ -41,7 +41,7 @@ import (
 
 var handler ValidatingHandler
 var reqResource metav1.GroupVersionResource
-var decoder *admission.Decoder
+var decoder admission.Decoder
 var td v1beta1.WorkflowStepDefinition
 var validCueTemplate string
 var inValidCueTemplate string
diff --git a/pkg/webhook/utils/utils_test.go b/pkg/webhook/utils/utils_test.go
index b0b168d4..037dc7bb 100644
--- a/pkg/webhook/utils/utils_test.go
+++ b/pkg/webhook/utils/utils_test.go
@@ -17,9 +17,17 @@ limitations under the License.
 package utils
 
 import (
+	"context"
 	"fmt"
+	"strings"
 	"testing"
 
+	"github.com/kubevela/pkg/cue/cuex"
+	"github.com/kubevela/pkg/util/singleton"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	dynamicfake "k8s.io/client-go/dynamic/fake"
+
 	"cuelang.org/go/cue/errors"
 	"github.com/crossplane/crossplane-runtime/pkg/test"
 	"github.com/google/go-cmp/cmp"
@@ -70,6 +78,100 @@ func TestValidateCueTemplate(t *testing.T) {
 	}
 }
 
+func TestValidateCuexTemplate(t *testing.T) {
+	cases := map[string]struct {
+		cueTemplate string
+		want        error
+	}{
+		"normalCueTemp": {
+			cueTemplate: "name: 'name'",
+			want:        nil,
+		},
+		"contextNouFoundCueTemp": {
+			cueTemplate: `
+				output: {
+					metadata: {
+						name: context.name
+						label: context.label
+						annotation: "default"
+					}
+				}`,
+			want: nil,
+		},
+		"withCuexPackageImports": {
+			cueTemplate: `
+				import "test/ext"
+				
+				test: ext.#Add & {
+					a: 1
+					b: 2
+				}
+	
+				output: {
+					metadata: {
+						name: context.name + "\(test.result)"
+						label: context.label
+						annotation: "default"
+					}
+				}
+			`,
+			want: nil,
+		},
+		"inValidCueTemp": {
+			cueTemplate: `
+				output: {
+					metadata: {
+						name: context.name
+						label: context.label
+						annotation: "default"
+					},
+					hello: world 
+				}`,
+			want: errors.New("output.hello: reference \"world\" not found"),
+		},
+	}
+
+	packageObj := &unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"apiVersion": "cue.oam.dev/v1alpha1",
+			"kind":       "Package",
+			"metadata": map[string]interface{}{
+				"name":      "test-package",
+				"namespace": "vela-system",
+			},
+			"spec": map[string]interface{}{
+				"path": "test/ext",
+				"templates": map[string]interface{}{
+					"test/ext": strings.TrimSpace(`
+                        package ext
+                        #Add: {
+						  a: number
+						  b: number
+                          result: a + b
+						}
+                    `),
+				},
+			},
+		},
+	}
+
+	dcl := dynamicfake.NewSimpleDynamicClient(runtime.NewScheme(), packageObj)
+	singleton.DynamicClient.Set(dcl)
+	cuex.DefaultCompiler.Reload()
+
+	defer singleton.ReloadClients()
+	defer cuex.DefaultCompiler.Reload()
+
+	for caseName, cs := range cases {
+		t.Run(caseName, func(t *testing.T) {
+			err := ValidateCuexTemplate(context.Background(), cs.cueTemplate)
+			if diff := cmp.Diff(cs.want, err, test.EquateErrors()); diff != "" {
+				t.Errorf("\n%s\nValidateCueTemplate: -want , +got \n%s\n", cs.want, diff)
+			}
+		})
+	}
+}
+
 func TestValidateSemanticVersion(t *testing.T) {
 	cases := map[string]struct {
 		version string
diff --git a/pkg/workflow/providers/legacy/multicluster/deploy_test.go b/pkg/workflow/providers/legacy/multicluster/deploy_test.go
index 4289a0d9..95aaf7d3 100644
--- a/pkg/workflow/providers/legacy/multicluster/deploy_test.go
+++ b/pkg/workflow/providers/legacy/multicluster/deploy_test.go
@@ -119,9 +119,9 @@ func TestApplyComponentsDepends(t *testing.T) {
 		applyMap.Store(fmt.Sprintf("%s/%s", clusterName, comp.Name), true)
 		return nil, nil, true, nil
 	}
-	healthCheck := func(_ context.Context, comp apicommon.ApplicationComponent, patcher *cue.Value, clusterName string, overrideNamespace string) (bool, *unstructured.Unstructured, []*unstructured.Unstructured, error) {
+	healthCheck := func(_ context.Context, comp apicommon.ApplicationComponent, patcher *cue.Value, clusterName string, overrideNamespace string) (bool, *apicommon.ApplicationComponentStatus, *unstructured.Unstructured, []*unstructured.Unstructured, error) {
 		_, found := applyMap.Load(fmt.Sprintf("%s/%s", clusterName, comp.Name))
-		return found, nil, nil, nil
+		return found, nil, nil, nil, nil
 	}
 	parallelism := 10
 
@@ -163,9 +163,9 @@ func TestApplyComponentsIO(t *testing.T) {
 		applyMap.Store(fmt.Sprintf("%s/%s", clusterName, comp.Name), true)
 		return nil, nil, true, nil
 	}
-	healthCheck := func(_ context.Context, comp apicommon.ApplicationComponent, patcher *cue.Value, clusterName string, overrideNamespace string) (bool, *unstructured.Unstructured, []*unstructured.Unstructured, error) {
+	healthCheck := func(_ context.Context, comp apicommon.ApplicationComponent, patcher *cue.Value, clusterName string, overrideNamespace string) (bool, *apicommon.ApplicationComponentStatus, *unstructured.Unstructured, []*unstructured.Unstructured, error) {
 		_, found := applyMap.Load(fmt.Sprintf("%s/%s", clusterName, comp.Name))
-		return found, &unstructured.Unstructured{Object: map[string]interface{}{
+		return found, nil, &unstructured.Unstructured{Object: map[string]interface{}{
 				"spec": map[string]interface{}{
 					"path": fmt.Sprintf("%s/%s", clusterName, comp.Name),
 				},
@@ -320,11 +320,11 @@ func TestApplyComponentsIO(t *testing.T) {
 			applyMap.Store(storeKey(clusterName, comp), result)
 			return nil, nil, true, nil
 		}
-		healthCheck := func(_ context.Context, comp apicommon.ApplicationComponent, patcher *cue.Value, clusterName string, overrideNamespace string) (bool, *unstructured.Unstructured, []*unstructured.Unstructured, error) {
+		healthCheck := func(_ context.Context, comp apicommon.ApplicationComponent, patcher *cue.Value, clusterName string, overrideNamespace string) (bool, *apicommon.ApplicationComponentStatus, *unstructured.Unstructured, []*unstructured.Unstructured, error) {
 			key := storeKey(clusterName, comp)
 			r, found := applyMap.Load(key)
 			result, _ := r.(applyResult)
-			return found, result.output, result.outputs, nil
+			return found, nil, result.output, result.outputs, nil
 		}
 
 		inputSlot := "input_slot"
diff --git a/pkg/workflow/providers/multicluster/deploy_test.go b/pkg/workflow/providers/multicluster/deploy_test.go
index 4289a0d9..95aaf7d3 100644
--- a/pkg/workflow/providers/multicluster/deploy_test.go
+++ b/pkg/workflow/providers/multicluster/deploy_test.go
@@ -119,9 +119,9 @@ func TestApplyComponentsDepends(t *testing.T) {
 		applyMap.Store(fmt.Sprintf("%s/%s", clusterName, comp.Name), true)
 		return nil, nil, true, nil
 	}
-	healthCheck := func(_ context.Context, comp apicommon.ApplicationComponent, patcher *cue.Value, clusterName string, overrideNamespace string) (bool, *unstructured.Unstructured, []*unstructured.Unstructured, error) {
+	healthCheck := func(_ context.Context, comp apicommon.ApplicationComponent, patcher *cue.Value, clusterName string, overrideNamespace string) (bool, *apicommon.ApplicationComponentStatus, *unstructured.Unstructured, []*unstructured.Unstructured, error) {
 		_, found := applyMap.Load(fmt.Sprintf("%s/%s", clusterName, comp.Name))
-		return found, nil, nil, nil
+		return found, nil, nil, nil, nil
 	}
 	parallelism := 10
 
@@ -163,9 +163,9 @@ func TestApplyComponentsIO(t *testing.T) {
 		applyMap.Store(fmt.Sprintf("%s/%s", clusterName, comp.Name), true)
 		return nil, nil, true, nil
 	}
-	healthCheck := func(_ context.Context, comp apicommon.ApplicationComponent, patcher *cue.Value, clusterName string, overrideNamespace string) (bool, *unstructured.Unstructured, []*unstructured.Unstructured, error) {
+	healthCheck := func(_ context.Context, comp apicommon.ApplicationComponent, patcher *cue.Value, clusterName string, overrideNamespace string) (bool, *apicommon.ApplicationComponentStatus, *unstructured.Unstructured, []*unstructured.Unstructured, error) {
 		_, found := applyMap.Load(fmt.Sprintf("%s/%s", clusterName, comp.Name))
-		return found, &unstructured.Unstructured{Object: map[string]interface{}{
+		return found, nil, &unstructured.Unstructured{Object: map[string]interface{}{
 				"spec": map[string]interface{}{
 					"path": fmt.Sprintf("%s/%s", clusterName, comp.Name),
 				},
@@ -320,11 +320,11 @@ func TestApplyComponentsIO(t *testing.T) {
 			applyMap.Store(storeKey(clusterName, comp), result)
 			return nil, nil, true, nil
 		}
-		healthCheck := func(_ context.Context, comp apicommon.ApplicationComponent, patcher *cue.Value, clusterName string, overrideNamespace string) (bool, *unstructured.Unstructured, []*unstructured.Unstructured, error) {
+		healthCheck := func(_ context.Context, comp apicommon.ApplicationComponent, patcher *cue.Value, clusterName string, overrideNamespace string) (bool, *apicommon.ApplicationComponentStatus, *unstructured.Unstructured, []*unstructured.Unstructured, error) {
 			key := storeKey(clusterName, comp)
 			r, found := applyMap.Load(key)
 			result, _ := r.(applyResult)
-			return found, result.output, result.outputs, nil
+			return found, nil, result.output, result.outputs, nil
 		}
 
 		inputSlot := "input_slot"
diff --git a/pkg/workflow/step/generator_test.go b/pkg/workflow/step/generator_test.go
index ffb4098c..814bbc6e 100644
--- a/pkg/workflow/step/generator_test.go
+++ b/pkg/workflow/step/generator_test.go
@@ -292,6 +292,288 @@ func TestWorkflowStepGenerator(t *testing.T) {
 	}
 }
 
+func TestApplyComponentWorkflowStepGeneratorWithDependsOn(t *testing.T) {
+	r := require.New(t)
+
+	testCases := map[string]struct {
+		input    []workflowv1alpha1.WorkflowStep
+		app      *v1beta1.Application
+		output   []workflowv1alpha1.WorkflowStep
+		hasError bool
+	}{
+		"component-with-single-dependency": {
+			input: []workflowv1alpha1.WorkflowStep{},
+			app: &v1beta1.Application{
+				Spec: v1beta1.ApplicationSpec{
+					Components: []common.ApplicationComponent{{
+						Name: "database",
+						Type: "webservice",
+					}, {
+						Name:      "backend",
+						Type:      "webservice",
+						DependsOn: []string{"database"},
+					}},
+				},
+			},
+			output: []workflowv1alpha1.WorkflowStep{{
+				WorkflowStepBase: workflowv1alpha1.WorkflowStepBase{
+					Name:       "database",
+					Type:       "apply-component",
+					Properties: &runtime.RawExtension{Raw: []byte(`{"component":"database"}`)},
+				},
+			}, {
+				WorkflowStepBase: workflowv1alpha1.WorkflowStepBase{
+					Name:       "backend",
+					Type:       "apply-component",
+					Properties: &runtime.RawExtension{Raw: []byte(`{"component":"backend"}`)},
+					DependsOn:  []string{"database"},
+				},
+			}},
+		},
+		"component-with-multiple-dependencies": {
+			input: []workflowv1alpha1.WorkflowStep{},
+			app: &v1beta1.Application{
+				Spec: v1beta1.ApplicationSpec{
+					Components: []common.ApplicationComponent{{
+						Name: "database",
+						Type: "webservice",
+					}, {
+						Name: "cache",
+						Type: "webservice",
+					}, {
+						Name:      "backend",
+						Type:      "webservice",
+						DependsOn: []string{"database", "cache"},
+					}},
+				},
+			},
+			output: []workflowv1alpha1.WorkflowStep{{
+				WorkflowStepBase: workflowv1alpha1.WorkflowStepBase{
+					Name:       "database",
+					Type:       "apply-component",
+					Properties: &runtime.RawExtension{Raw: []byte(`{"component":"database"}`)},
+				},
+			}, {
+				WorkflowStepBase: workflowv1alpha1.WorkflowStepBase{
+					Name:       "cache",
+					Type:       "apply-component",
+					Properties: &runtime.RawExtension{Raw: []byte(`{"component":"cache"}`)},
+				},
+			}, {
+				WorkflowStepBase: workflowv1alpha1.WorkflowStepBase{
+					Name:       "backend",
+					Type:       "apply-component",
+					Properties: &runtime.RawExtension{Raw: []byte(`{"component":"backend"}`)},
+					DependsOn:  []string{"database", "cache"},
+				},
+			}},
+		},
+		"component-with-chained-dependencies": {
+			input: []workflowv1alpha1.WorkflowStep{},
+			app: &v1beta1.Application{
+				Spec: v1beta1.ApplicationSpec{
+					Components: []common.ApplicationComponent{{
+						Name: "database",
+						Type: "webservice",
+					}, {
+						Name:      "backend",
+						Type:      "webservice",
+						DependsOn: []string{"database"},
+					}, {
+						Name:      "frontend",
+						Type:      "webservice",
+						DependsOn: []string{"backend"},
+					}},
+				},
+			},
+			output: []workflowv1alpha1.WorkflowStep{{
+				WorkflowStepBase: workflowv1alpha1.WorkflowStepBase{
+					Name:       "database",
+					Type:       "apply-component",
+					Properties: &runtime.RawExtension{Raw: []byte(`{"component":"database"}`)},
+				},
+			}, {
+				WorkflowStepBase: workflowv1alpha1.WorkflowStepBase{
+					Name:       "backend",
+					Type:       "apply-component",
+					Properties: &runtime.RawExtension{Raw: []byte(`{"component":"backend"}`)},
+					DependsOn:  []string{"database"},
+				},
+			}, {
+				WorkflowStepBase: workflowv1alpha1.WorkflowStepBase{
+					Name:       "frontend",
+					Type:       "apply-component",
+					Properties: &runtime.RawExtension{Raw: []byte(`{"component":"frontend"}`)},
+					DependsOn:  []string{"backend"},
+				},
+			}},
+		},
+		"component-without-dependency": {
+			input: []workflowv1alpha1.WorkflowStep{},
+			app: &v1beta1.Application{
+				Spec: v1beta1.ApplicationSpec{
+					Components: []common.ApplicationComponent{{
+						Name: "standalone",
+						Type: "webservice",
+					}},
+				},
+			},
+			output: []workflowv1alpha1.WorkflowStep{{
+				WorkflowStepBase: workflowv1alpha1.WorkflowStepBase{
+					Name:       "standalone",
+					Type:       "apply-component",
+					Properties: &runtime.RawExtension{Raw: []byte(`{"component":"standalone"}`)},
+				},
+			}},
+		},
+		"mixed-components-some-with-dependencies": {
+			input: []workflowv1alpha1.WorkflowStep{},
+			app: &v1beta1.Application{
+				Spec: v1beta1.ApplicationSpec{
+					Components: []common.ApplicationComponent{{
+						Name: "independent1",
+						Type: "webservice",
+					}, {
+						Name: "database",
+						Type: "webservice",
+					}, {
+						Name:      "dependent1",
+						Type:      "webservice",
+						DependsOn: []string{"database"},
+					}, {
+						Name: "independent2",
+						Type: "webservice",
+					}},
+				},
+			},
+			output: []workflowv1alpha1.WorkflowStep{{
+				WorkflowStepBase: workflowv1alpha1.WorkflowStepBase{
+					Name:       "independent1",
+					Type:       "apply-component",
+					Properties: &runtime.RawExtension{Raw: []byte(`{"component":"independent1"}`)},
+				},
+			}, {
+				WorkflowStepBase: workflowv1alpha1.WorkflowStepBase{
+					Name:       "database",
+					Type:       "apply-component",
+					Properties: &runtime.RawExtension{Raw: []byte(`{"component":"database"}`)},
+				},
+			}, {
+				WorkflowStepBase: workflowv1alpha1.WorkflowStepBase{
+					Name:       "dependent1",
+					Type:       "apply-component",
+					Properties: &runtime.RawExtension{Raw: []byte(`{"component":"dependent1"}`)},
+					DependsOn:  []string{"database"},
+				},
+			}, {
+				WorkflowStepBase: workflowv1alpha1.WorkflowStepBase{
+					Name:       "independent2",
+					Type:       "apply-component",
+					Properties: &runtime.RawExtension{Raw: []byte(`{"component":"independent2"}`)},
+				},
+			}},
+		},
+	}
+
+	generator := &ApplyComponentWorkflowStepGenerator{}
+
+	for name, testCase := range testCases {
+		t.Run(name, func(t *testing.T) {
+			output, err := generator.Generate(testCase.app, testCase.input)
+			if testCase.hasError {
+				r.Error(err)
+			} else {
+				r.NoError(err)
+				r.Equal(testCase.output, output)
+			}
+		})
+	}
+}
+
+func TestComponentDependsOnFieldPreservation(t *testing.T) {
+	r := require.New(t)
+
+	// This test specifically verifies that the DependsOn field from components
+	// is correctly carried forward to workflow steps, enabling execution gating
+	app := &v1beta1.Application{
+		Spec: v1beta1.ApplicationSpec{
+			Components: []common.ApplicationComponent{{
+				Name: "database",
+				Type: "webservice",
+			}, {
+				Name:      "api-server",
+				Type:      "webservice",
+				DependsOn: []string{"database"},
+			}, {
+				Name:      "worker",
+				Type:      "webservice",
+				DependsOn: []string{"database", "api-server"},
+			}},
+		},
+	}
+
+	generator := &ApplyComponentWorkflowStepGenerator{}
+	output, err := generator.Generate(app, []workflowv1alpha1.WorkflowStep{})
+
+	r.NoError(err)
+	r.Len(output, 3)
+
+	// Verify the database component has no dependencies
+	r.Equal("database", output[0].Name)
+	r.Nil(output[0].DependsOn)
+
+	// Verify api-server has database dependency
+	r.Equal("api-server", output[1].Name)
+	r.Equal([]string{"database"}, output[1].DependsOn)
+
+	// Verify worker has both dependencies
+	r.Equal("worker", output[2].Name)
+	r.Equal([]string{"database", "api-server"}, output[2].DependsOn)
+}
+
+func TestChainGeneratorWithComponentDependsOn(t *testing.T) {
+	r := require.New(t)
+
+	// Test that the chain generator preserves component dependencies
+	cli := fake.NewClientBuilder().WithScheme(common2.Scheme).Build()
+
+	app := &v1beta1.Application{
+		Spec: v1beta1.ApplicationSpec{
+			Components: []common.ApplicationComponent{{
+				Name: "database",
+				Type: "webservice",
+			}, {
+				Name:      "backend",
+				Type:      "webservice",
+				DependsOn: []string{"database"},
+			}},
+		},
+	}
+
+	generator := NewChainWorkflowStepGenerator(
+		&RefWorkflowStepGenerator{Context: context.Background(), Client: cli},
+		&DeployWorkflowStepGenerator{},
+		&Deploy2EnvWorkflowStepGenerator{},
+		&ApplyComponentWorkflowStepGenerator{},
+	)
+
+	output, err := generator.Generate(app, []workflowv1alpha1.WorkflowStep{})
+	r.NoError(err)
+	r.Len(output, 2)
+
+	// Find the backend step and verify it has the dependency
+	var backendStep *workflowv1alpha1.WorkflowStep
+	for i, step := range output {
+		if step.Name == "backend" {
+			backendStep = &output[i]
+			break
+		}
+	}
+
+	r.NotNil(backendStep, "Backend step should exist")
+	r.Equal([]string{"database"}, backendStep.DependsOn, "Backend step should depend on database")
+}
+
 func TestIsBuiltinWorkflowStepType(t *testing.T) {
 	assert.True(t, IsBuiltinWorkflowStepType("suspend"))
 	assert.True(t, IsBuiltinWorkflowStepType("apply-component"))
diff --git a/references/cli/def_test.go b/references/cli/def_test.go
index 31d9ab4a..098d6fcf 100644
--- a/references/cli/def_test.go
+++ b/references/cli/def_test.go
@@ -543,7 +543,7 @@ func TestNewDefinitionRenderCommand(t *testing.T) {
 	defer removeFile(traitFilename, t)
 	cmd.SetArgs([]string{traitFilename})
 	if err := cmd.Execute(); err != nil {
-		t.Fatalf("unexpeced error when executing redner command: %v", err)
+		t.Fatalf("unexpected error when executing render command on single file: %v", err)
 	}
 	// directory read/write test
 	_ = os.Setenv(HelmChartFormatEnvName, "system")
@@ -558,16 +558,22 @@ func TestNewDefinitionRenderCommand(t *testing.T) {
 	initCommand(cmd)
 	cmd.SetArgs([]string{dirname, "-o", outputDir, "--message", "Author: KubeVela"})
 	if err := cmd.Execute(); err != nil {
-		t.Fatalf("unexpeced error when executing render command: %v", err)
+		t.Fatalf("unexpected error when executing render command on valid directory: %v", err)
 	}
 	// directory read/print test
-	_ = os.WriteFile(filepath.Join(dirname, "temp.json"), []byte("hello"), 0600)
-	_ = os.WriteFile(filepath.Join(dirname, "temp.cue"), []byte("hello"), 0600)
+	require.NoError(t, os.WriteFile(filepath.Join(dirname, "temp.json"), []byte("hello"), 0600)) // ignored
+	badCueFile := filepath.Join(dirname, "temp.cue")
+	require.NoError(t, os.WriteFile(badCueFile, []byte("hello"), 0600))
+
 	cmd = NewDefinitionRenderCommand(c)
 	initCommand(cmd)
 	cmd.SetArgs([]string{dirname})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("unexpeced error when executing render command: %v", err)
+	err = cmd.Execute()
+	if err == nil {
+		t.Fatalf("expected error when executing render command with invalid CUE file, got nil")
+	}
+	if !strings.Contains(err.Error(), "rendering failed for") {
+		t.Fatalf("unexpected error message: %v", err)
 	}
 }
 
diff --git a/test/e2e-multicluster-test/multicluster_standalone_test.go b/test/e2e-multicluster-test/multicluster_standalone_test.go
index 0e17e72e..882a827a 100644
--- a/test/e2e-multicluster-test/multicluster_standalone_test.go
+++ b/test/e2e-multicluster-test/multicluster_standalone_test.go
@@ -22,6 +22,7 @@ import (
 	"os"
 	"time"
 
+	workflowv1alpha1 "github.com/kubevela/workflow/api/v1alpha1"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	v1 "k8s.io/api/apps/v1"
@@ -35,8 +36,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/yaml"
 
-	workflowv1alpha1 "github.com/kubevela/workflow/api/v1alpha1"
-
 	oamcomm "github.com/oam-dev/kubevela/apis/core.oam.dev/common"
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/v1alpha1"
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/v1beta1"
@@ -215,7 +214,7 @@ var _ = Describe("Test multicluster standalone scenario", func() {
 		Eventually(func(g Gomega) {
 			g.Expect(k8sClient.Get(hubCtx, appKey, app)).Should(Succeed())
 			g.Expect(app.Status.Phase).Should(Equal(oamcomm.ApplicationRunning))
-		}, 30*time.Second).Should(Succeed())
+		}, 2*time.Minute).Should(Succeed())
 
 		By("Update Application to first failed version")
 		Eventually(func(g Gomega) {
@@ -223,12 +222,12 @@ var _ = Describe("Test multicluster standalone scenario", func() {
 			app.Annotations[oam.AnnotationPublishVersion] = "alpha2"
 			app.Spec.Components[0].Properties = &runtime.RawExtension{Raw: []byte(`{"image":"busybox:bad"}`)}
 			g.Expect(k8sClient.Update(hubCtx, app)).Should(Succeed())
-		}, 30*time.Second).Should(Succeed())
+		}, 2*time.Minute).Should(Succeed())
 
 		Eventually(func(g Gomega) {
 			g.Expect(k8sClient.Get(hubCtx, appKey, app)).Should(Succeed())
 			g.Expect(app.Status.Phase).Should(Equal(oamcomm.ApplicationRunningWorkflow))
-		}, 30*time.Second).Should(Succeed())
+		}, 2*time.Minute).Should(Succeed())
 
 		By("Update Application to second failed version")
 		Eventually(func(g Gomega) {
@@ -236,12 +235,12 @@ var _ = Describe("Test multicluster standalone scenario", func() {
 			app.Annotations[oam.AnnotationPublishVersion] = "alpha3"
 			app.Spec.Components[0].Name = "busybox-bad"
 			g.Expect(k8sClient.Update(hubCtx, app)).Should(Succeed())
-		}, 30*time.Second).Should(Succeed())
+		}, 2*time.Minute).Should(Succeed())
 		Eventually(func(g Gomega) {
 			deploy := &v1.Deployment{}
 			g.Expect(k8sClient.Get(workerCtx, types.NamespacedName{Namespace: namespace, Name: "busybox"}, deploy)).Should(Succeed())
 			g.Expect(k8sClient.Delete(workerCtx, deploy)).Should(Succeed())
-		}, 30*time.Second).Should(Succeed())
+		}, 2*time.Minute).Should(Succeed())
 
 		By("Change external policy")
 		Eventually(func(g Gomega) {
@@ -250,7 +249,7 @@ var _ = Describe("Test multicluster standalone scenario", func() {
 			g.Expect(k8sClient.Get(hubCtx, types.NamespacedName{Namespace: namespace, Name: "topology-worker"}, policy)).Should(Succeed())
 			policy.Properties = &runtime.RawExtension{Raw: []byte(`{"clusters":["changed"]}`)}
 			g.Expect(k8sClient.Update(hubCtx, policy)).Should(Succeed())
-		}, 30*time.Second).Should(Succeed())
+		}, 2*time.Minute).Should(Succeed())
 
 		By("Change referred objects")
 		Eventually(func(g Gomega) {
@@ -258,7 +257,7 @@ var _ = Describe("Test multicluster standalone scenario", func() {
 			g.Expect(k8sClient.Get(hubCtx, types.NamespacedName{Namespace: namespace, Name: "busybox-ref"}, deploy)).Should(Succeed())
 			deploy.Spec.Replicas = ptr.To(int32(1))
 			g.Expect(k8sClient.Update(hubCtx, deploy)).Should(Succeed())
-		}, 30*time.Second).Should(Succeed())
+		}, 2*time.Minute).Should(Succeed())
 
 		By("Live-diff application")
 		outputs, err := execCommand("live-diff", "-r", "busybox-v3,busybox-v1", "-n", namespace)
@@ -282,24 +281,38 @@ var _ = Describe("Test multicluster standalone scenario", func() {
 		Eventually(func(g Gomega) {
 			_, err = execCommand("workflow", "suspend", "busybox", "-n", namespace)
 			g.Expect(err).Should(Succeed())
-		}).WithTimeout(10 * time.Second).Should(Succeed())
+		}).WithTimeout(30 * time.Second).Should(Succeed())
 		Eventually(func(g Gomega) {
 			_, err = execCommand("workflow", "rollback", "busybox", "-n", namespace)
 			g.Expect(err).Should(Succeed())
-		}).WithTimeout(10 * time.Second).Should(Succeed())
+		}).WithTimeout(30 * time.Second).Should(Succeed())
 
+		By("Wait for application to be running after rollback")
 		Eventually(func(g Gomega) {
 			g.Expect(k8sClient.Get(hubCtx, appKey, app)).Should(Succeed())
 			g.Expect(app.Status.Phase).Should(Equal(oamcomm.ApplicationRunning))
+		}).WithTimeout(5 * time.Minute).WithPolling(5 * time.Second).Should(Succeed())
+
+		By("Verify deployment image rollback")
+		Eventually(func(g Gomega) {
 			deploy := &v1.Deployment{}
 			g.Expect(k8sClient.Get(workerCtx, types.NamespacedName{Namespace: namespace, Name: "busybox"}, deploy)).Should(Succeed())
 			g.Expect(deploy.Spec.Template.Spec.Containers[0].Image).Should(Equal("busybox"))
+		}).WithTimeout(5 * time.Minute).WithPolling(5 * time.Second).Should(Succeed())
+
+		By("Verify referred object state rollback")
+		Eventually(func(g Gomega) {
+			deploy := &v1.Deployment{}
 			g.Expect(k8sClient.Get(workerCtx, types.NamespacedName{Namespace: namespace, Name: "busybox-ref"}, deploy)).Should(Succeed())
 			g.Expect(deploy.Spec.Replicas).Should(Equal(ptr.To(int32(0))))
+		}).WithTimeout(5 * time.Minute).WithPolling(5 * time.Second).Should(Succeed())
+
+		By("Verify application revisions")
+		Eventually(func(g Gomega) {
 			revs, err := application.GetSortedAppRevisions(hubCtx, k8sClient, app.Name, namespace)
 			g.Expect(err).Should(Succeed())
-			g.Expect(len(revs)).Should(Equal(1))
-		}).WithTimeout(5 * time.Minute).WithPolling(2 * time.Second).Should(Succeed())
+			g.Expect(len(revs)).Should(BeNumerically(">=", 1))
+		}).WithTimeout(5 * time.Minute).WithPolling(5 * time.Second).Should(Succeed())
 	})
 
 	It("Test large application parallel apply and delete", func() {
diff --git a/test/e2e-test/application_test.go b/test/e2e-test/application_test.go
index d4749495..1d7ee476 100644
--- a/test/e2e-test/application_test.go
+++ b/test/e2e-test/application_test.go
@@ -23,6 +23,10 @@ import (
 	"strconv"
 	"time"
 
+	"cuelang.org/go/cue"
+	"cuelang.org/go/cue/cuecontext"
+	workflowv1alpha1 "github.com/kubevela/workflow/api/v1alpha1"
+
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	v1 "k8s.io/api/apps/v1"
@@ -459,6 +463,285 @@ var _ = Describe("Application Normal tests", func() {
 
 		By("Checking the services not replicated & application status")
 		verifyWorkloadRunningExpected(ctx, namespaceName, "hello-no-rep", 1, "crccheck/hello-world")
+	})
+
+	It("test app with custom status fields", func() {
+		By("Applying the deployment-with-status component definition")
+		var compDef v1beta1.ComponentDefinition
+		Expect(common.ReadYamlToObject("testdata/definition/deployment-with-status.yaml", &compDef)).Should(BeNil())
+		Eventually(func() error {
+			return k8sClient.Create(ctx, compDef.DeepCopy())
+		}, 10*time.Second, 500*time.Millisecond).Should(SatisfyAny(util.AlreadyExistMatcher{}, BeNil()))
+		DeferCleanup(func() {
+			_ = k8sClient.Delete(ctx, &compDef)
+		})
+
+		By("Applying the trait-with-status trait definition")
+		var traitDef v1beta1.TraitDefinition
+		Expect(common.ReadYamlToObject("testdata/definition/trait-with-status.yaml", &traitDef)).Should(BeNil())
+		Eventually(func() error {
+			return k8sClient.Create(ctx, traitDef.DeepCopy())
+		}, 10*time.Second, 500*time.Millisecond).Should(SatisfyAny(util.AlreadyExistMatcher{}, BeNil()))
+		DeferCleanup(func() {
+			_ = k8sClient.Delete(ctx, &traitDef)
+		})
+
+		By("Creating an application that uses the deployment-with-status definition")
+		applyApp(ctx, namespaceName, "app_with_status.yaml", app)
+
+		By("Reading the deployment component definition cue template")
+		compCueSpec := cuecontext.New().CompileString(compDef.Spec.Schematic.CUE.Template)
+		compReplicas, err := compCueSpec.LookupPath(cue.ParsePath("output.spec.replicas")).Int64()
+		Expect(err).Should(BeNil())
+		compImage, err := compCueSpec.LookupPath(cue.ParsePath("output.spec.template.spec.containers[0].image")).String()
+		Expect(err).Should(BeNil())
+
+		By("Reading the deployment trait definition cue template")
+		traitCueSpec := cuecontext.New().CompileString(traitDef.Spec.Schematic.CUE.Template)
+		traitReplicas, err := traitCueSpec.LookupPath(cue.ParsePath("outputs.deployment.spec.replicas")).Int64()
+		Expect(err).Should(BeNil())
+		traitImage, err := traitCueSpec.LookupPath(cue.ParsePath("outputs.deployment.spec.template.spec.containers[0].image")).String()
+		Expect(err).Should(BeNil())
+
+		By("Checking the initial application status")
+		Expect(app.Status.Services).ShouldNot(BeEmpty())
+		Expect(app.Status.Services[0].Healthy).Should(BeFalse())
+		Expect(app.Status.Services[0].Message).Should(Equal(fmt.Sprintf("Unhealthy - 0 / %d replicas are ready", compReplicas)))
+		Expect(app.Status.Services[0].Details["readyReplicas"]).Should(Equal("0"))
+		Expect(app.Status.Services[0].Details["deploymentReady"]).Should(Equal("false"))
+
+		verifyWorkloadRunningExpected(ctx, namespaceName, compDef.Name, int32(compReplicas), compImage)
+		verifyWorkloadRunningExpected(ctx, namespaceName, traitDef.Name, int32(traitReplicas), traitImage)
+
+		By("Triggering application reconciliation to ensure status is updated (to avoid flakiness)")
+		Eventually(func() error {
+			if err := k8sClient.Get(ctx, client.ObjectKey{Namespace: app.Namespace, Name: app.Name}, app); err != nil {
+				return err
+			}
+			if app.Annotations == nil {
+				app.Annotations = make(map[string]string)
+			}
+			app.Annotations["force.reconcile"] = fmt.Sprintf("%d", time.Now().Unix())
+			return k8sClient.Update(ctx, app)
+		}, 10*time.Second, 500*time.Millisecond).Should(Succeed())
+
+		By("Waiting for the app to turn healthy")
+		Eventually(func() bool {
+			err := k8sClient.Get(ctx, client.ObjectKey{
+				Namespace: app.Namespace,
+				Name:      app.Name,
+			}, app)
+			if err != nil {
+				return false
+			}
+			if len(app.Status.Services) == 0 {
+				return false
+			}
+			return app.Status.Services[0].Healthy && app.Status.Services[0].Traits[0].Healthy
+		}, 30*time.Second, 1*time.Second).Should(BeTrue(), "Expected application component & trait to become healthy")
+
+		By("Checking the component status matches expectations")
+		Expect(app.Status.Services[0].Healthy).Should(BeTrue())
+		Expect(app.Status.Services[0].Message).Should(Equal(fmt.Sprintf("Healthy - %v / %v replicas are ready", compReplicas, compReplicas)))
+		Expect(app.Status.Services[0].Details["readyReplicas"]).Should(Equal(fmt.Sprintf("%v", compReplicas)))
+		Expect(app.Status.Services[0].Details["deploymentReady"]).Should(Equal("true"))
+
+		By("Checking the trait status matches expectations")
+		Expect(app.Status.Services[0].Traits[0].Healthy).Should(BeTrue())
+		Expect(app.Status.Services[0].Traits[0].Message).Should(Equal(fmt.Sprintf("Healthy - %v / %v replicas are ready", traitReplicas, traitReplicas)))
+		Expect(app.Status.Services[0].Traits[0].Details["allReplicasReady"]).Should(Equal("true"))
+	})
+})
+
+var _ = Describe("Test Component Level DependsOn", func() {
+	ctx := context.TODO()
+	namespaceName := "component-depends-on-test"
+
+	BeforeEach(func() {
+		By("Creating namespace for component dependsOn tests")
+		createNamespace(ctx, namespaceName)
+	})
+
+	AfterEach(func() {
+		By("Cleaning up resources after each test")
+		// Clean up applications
+		appList := &v1beta1.ApplicationList{}
+		Expect(k8sClient.List(ctx, appList, client.InNamespace(namespaceName))).Should(BeNil())
+		for _, app := range appList.Items {
+			Expect(k8sClient.Delete(ctx, &app)).Should(BeNil())
+		}
+		// Wait for applications to be deleted
+		Eventually(func() bool {
+			appList := &v1beta1.ApplicationList{}
+			_ = k8sClient.List(ctx, appList, client.InNamespace(namespaceName))
+			return len(appList.Items) == 0
+		}, 120*time.Second, 2*time.Second).Should(BeTrue())
+	})
+
+	It("Component dependsOn should enforce execution gating - success scenario", func() {
+		By("Apply an application with chained component dependencies")
+		var app v1beta1.Application
+		applyApp(ctx, namespaceName, "app_component_depends_on_success.yaml", &app)
+
+		By("Verify application reaches running state")
+		verifyApplicationPhase(ctx, namespaceName, "app-component-depends-on-success", oamcomm.ApplicationRunning)
+
+		By("Verify all components are healthy")
+		Eventually(func() bool {
+			var testApp v1beta1.Application
+			err := k8sClient.Get(ctx, client.ObjectKey{Namespace: namespaceName, Name: "app-component-depends-on-success"}, &testApp)
+			if err != nil {
+				return false
+			}
+
+			if len(testApp.Status.Services) != 3 {
+				return false
+			}
+
+			// Check if all components are healthy
+			for _, service := range testApp.Status.Services {
+				if !service.Healthy {
+					return false
+				}
+			}
+			return true
+		}, 180*time.Second, 5*time.Second).Should(BeTrue())
+
+		By("Verify workflow execution order through step status")
+		var testApp v1beta1.Application
+		Expect(k8sClient.Get(ctx, client.ObjectKey{Namespace: namespaceName, Name: "app-component-depends-on-success"}, &testApp)).Should(BeNil())
+
+		// Verify workflow steps were executed in correct order
+		if testApp.Status.Workflow != nil {
+			stepStatus := testApp.Status.Workflow.Steps
+			databaseStepFound := false
+			backendStepFound := false
+			frontendStepFound := false
+
+			for _, step := range stepStatus {
+				switch step.Name {
+				case "database":
+					Expect(step.Phase).Should(Equal(workflowv1alpha1.WorkflowStepPhaseSucceeded))
+					databaseStepFound = true
+				case "backend":
+					// Backend should only succeed after database
+					Expect(step.Phase).Should(Equal(workflowv1alpha1.WorkflowStepPhaseSucceeded))
+					Expect(databaseStepFound).Should(BeTrue()) // Database should be processed first
+					backendStepFound = true
+				case "frontend":
+					// Frontend should only succeed after backend
+					Expect(step.Phase).Should(Equal(workflowv1alpha1.WorkflowStepPhaseSucceeded))
+					Expect(backendStepFound).Should(BeTrue()) // Backend should be processed before frontend
+					frontendStepFound = true
+				}
+			}
+			Expect(databaseStepFound && backendStepFound && frontendStepFound).Should(BeTrue())
+		}
+	})
+
+	It("Component dependsOn should block dependent components when dependency fails", func() {
+		By("Apply an application where the first component will fail")
+		var app v1beta1.Application
+		applyApp(ctx, namespaceName, "app_component_depends_on_fail.yaml", &app)
+
+		By("Wait for the application to process")
+		time.Sleep(30 * time.Second)
+
+		By("Verify the failing component is unhealthy and dependent component is not provisioned")
+		Eventually(func() bool {
+			var testApp v1beta1.Application
+			err := k8sClient.Get(ctx, client.ObjectKey{Namespace: namespaceName, Name: "app-component-depends-on-fail"}, &testApp)
+			if err != nil {
+				return false
+			}
+
+			// Check workflow status to ensure dependent step is suspended/waiting
+			if testApp.Status.Workflow != nil {
+				stepStatus := testApp.Status.Workflow.Steps
+				failingStepFound := false
+				dependentStepBlocked := true
+
+				for _, step := range stepStatus {
+					switch step.Name {
+					case "failing-database":
+						// The failing component should be in failed state or retrying
+						if step.Phase == workflowv1alpha1.WorkflowStepPhaseFailed {
+							failingStepFound = true
+						}
+					case "dependent-backend":
+						// The dependent component should be suspended/pending due to dependency failure
+						if step.Phase == workflowv1alpha1.WorkflowStepPhaseSucceeded {
+							dependentStepBlocked = false
+						}
+					}
+				}
+				return failingStepFound && dependentStepBlocked
+			}
+			return false
+		}, 120*time.Second, 5*time.Second).Should(BeTrue())
+
+		By("Verify application is not in running state due to component failure")
+		var testApp v1beta1.Application
+		Expect(k8sClient.Get(ctx, client.ObjectKey{Namespace: namespaceName, Name: "app-component-depends-on-fail"}, &testApp)).Should(BeNil())
+		Expect(testApp.Status.Phase).ShouldNot(Equal(oamcomm.ApplicationRunning))
+	})
+
+	It("Component dependsOn should work with multiple dependencies", func() {
+		By("Apply an application with component having multiple dependencies")
+		var app v1beta1.Application
+		applyApp(ctx, namespaceName, "app_component_depends_on_multiple.yaml", &app)
+
+		By("Verify application reaches running state")
+		verifyApplicationPhase(ctx, namespaceName, "app-component-depends-on-multiple", oamcomm.ApplicationRunning)
+
+		By("Verify all components are healthy")
+		Eventually(func() bool {
+			var testApp v1beta1.Application
+			err := k8sClient.Get(ctx, client.ObjectKey{Namespace: namespaceName, Name: "app-component-depends-on-multiple"}, &testApp)
+			if err != nil {
+				return false
+			}
+
+			if len(testApp.Status.Services) != 3 {
+				return false
+			}
 
+			// Check if all components are healthy
+			for _, service := range testApp.Status.Services {
+				if !service.Healthy {
+					return false
+				}
+			}
+			return true
+		}, 180*time.Second, 5*time.Second).Should(BeTrue())
+
+		By("Verify workflow execution dependencies")
+		var testApp v1beta1.Application
+		Expect(k8sClient.Get(ctx, client.ObjectKey{Namespace: namespaceName, Name: "app-component-depends-on-multiple"}, &testApp)).Should(BeNil())
+
+		// Verify workflow steps were executed with proper dependencies
+		if testApp.Status.Workflow != nil {
+			stepStatus := testApp.Status.Workflow.Steps
+			databaseStepSucceeded := false
+			cacheStepSucceeded := false
+			backendStepSucceeded := false
+
+			for _, step := range stepStatus {
+				switch step.Name {
+				case "database":
+					Expect(step.Phase).Should(Equal(workflowv1alpha1.WorkflowStepPhaseSucceeded))
+					databaseStepSucceeded = true
+				case "cache":
+					Expect(step.Phase).Should(Equal(workflowv1alpha1.WorkflowStepPhaseSucceeded))
+					cacheStepSucceeded = true
+				case "backend":
+					// Backend should only succeed after both database and cache
+					Expect(step.Phase).Should(Equal(workflowv1alpha1.WorkflowStepPhaseSucceeded))
+					Expect(databaseStepSucceeded && cacheStepSucceeded).Should(BeTrue())
+					backendStepSucceeded = true
+				}
+			}
+			Expect(databaseStepSucceeded && cacheStepSucceeded && backendStepSucceeded).Should(BeTrue())
+		}
 	})
 })
diff --git a/test/e2e-test/definition_revision_test.go b/test/e2e-test/definition_revision_test.go
index 27e87d79..63db5e17 100644
--- a/test/e2e-test/definition_revision_test.go
+++ b/test/e2e-test/definition_revision_test.go
@@ -362,10 +362,9 @@ var _ = Describe("Test application of the specified definition version", func()
 			return k8sClient.Get(ctx, client.ObjectKey{Name: jobName, Namespace: namespace}, workerJob)
 		}, 30*time.Second, 3*time.Second).Should(Succeed())
 
-		By("Verify trait is applied to the workload")
+		By("Verify if trait is applied to the workload")
 		webserviceV1Labels := webServiceV1Deploy.GetLabels()
 		Expect(webserviceV1Labels["hello"]).Should(Equal("kubevela"))
-
 		By("Check Application is rendered by the specified version of the Definition")
 		Expect(webServiceV1Deploy.Labels["componentdefinition.oam.dev/version"]).Should(Equal("v1"))
 		Expect(webServiceV1Deploy.Labels["traitdefinition.oam.dev/version"]).Should(Equal("v1"))
diff --git a/test/e2e-test/definition_test.go b/test/e2e-test/definition_test.go
index 692a7e8c..c0e58401 100644
--- a/test/e2e-test/definition_test.go
+++ b/test/e2e-test/definition_test.go
@@ -29,11 +29,14 @@ import (
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	pkgruntime "k8s.io/apimachinery/pkg/runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/v1beta1"
 	"github.com/oam-dev/kubevela/apis/types"
+	pkgdef "github.com/oam-dev/kubevela/pkg/definition"
 	"github.com/oam-dev/kubevela/pkg/oam"
 	"github.com/oam-dev/kubevela/pkg/oam/util"
 	utilcommon "github.com/oam-dev/kubevela/pkg/utils/common"
@@ -260,4 +263,90 @@ var _ = Describe("ComponentDefinition Normal tests", func() {
 		By("Verify application is running")
 		verifyApplicationPhase(context.TODO(), newApp.Namespace, newApp.Name, common.ApplicationRunning)
 	})
+
+	Context("Definition Retrieval and CUE Parsing Validation", func() {
+		It("should successfully parse all definitions loaded from helm chart templates", func() {
+			By("Loading all definition YAML files from charts/vela-core/templates/defwithtemplate")
+			_, file, _, _ := runtime.Caller(0)
+			definitionDir := filepath.Join(file, "../../../charts/vela-core/templates/defwithtemplate")
+
+			files, err := filepath.Glob(filepath.Join(definitionDir, "*.yaml"))
+			Expect(err).To(BeNil())
+			Expect(len(files)).To(BeNumerically(">", 0))
+
+			By(fmt.Sprintf("Found %d definition YAML files to test", len(files)))
+
+			// Install all definitions
+			installedDefinitions := []string{}
+			for _, definitionFile := range files {
+				definitionName := strings.TrimSuffix(filepath.Base(definitionFile), ".yaml")
+				By(fmt.Sprintf("Installing definition from %s", definitionName))
+
+				err := testdef.InstallDefinitionFromYAML(ctx, k8sClient, definitionFile, func(s string) string {
+					// Replace helm template placeholders like the existing notification test
+					s = strings.ReplaceAll(s, `{{ include "systemDefinitionNamespace" . }}`, namespace)
+					s = strings.ReplaceAll(s, `{{- include "systemDefinitionNamespace" . }}`, namespace)
+					return s
+				})
+				if err != nil {
+					// Some definitions might fail to install due to dependencies, that's ok
+					fmt.Printf("Warning: Failed to install definition from %s: %v\n", definitionFile, err)
+				} else {
+					installedDefinitions = append(installedDefinitions, definitionName)
+				}
+			}
+
+			By(fmt.Sprintf("Successfully installed %d definitions, now testing CUE parsing", len(installedDefinitions)))
+
+			// Test CUE parsing on all installed ComponentDefinitions
+			By("Testing CUE parsing for ComponentDefinitions")
+			var componentDefs v1beta1.ComponentDefinitionList
+			Expect(k8sClient.List(ctx, &componentDefs, &client.ListOptions{Namespace: namespace})).Should(Succeed())
+
+			componentErrorCount := 0
+			for i := range componentDefs.Items {
+				unstructuredObj, err := pkgruntime.DefaultUnstructuredConverter.ToUnstructured(&componentDefs.Items[i])
+				if err != nil {
+					componentErrorCount++
+					fmt.Printf("ERROR: ComponentDefinition %s failed to convert to unstructured: %v\n", componentDefs.Items[i].Name, err)
+					continue
+				}
+
+				def := &pkgdef.Definition{Unstructured: unstructured.Unstructured{Object: unstructuredObj}}
+				_, err = def.ToCUEString()
+				if err != nil {
+					componentErrorCount++
+					fmt.Printf("ERROR: ComponentDefinition %s failed CUE parsing: %v\n", componentDefs.Items[i].Name, err)
+				}
+			}
+
+			// Test CUE parsing on all installed TraitDefinitions
+			By("Testing CUE parsing for TraitDefinitions")
+			var traitDefs v1beta1.TraitDefinitionList
+			Expect(k8sClient.List(ctx, &traitDefs, &client.ListOptions{Namespace: namespace})).Should(Succeed())
+
+			traitErrorCount := 0
+			for i := range traitDefs.Items {
+				unstructuredObj, err := pkgruntime.DefaultUnstructuredConverter.ToUnstructured(&traitDefs.Items[i])
+				if err != nil {
+					traitErrorCount++
+					fmt.Printf("ERROR: TraitDefinition %s failed to convert to unstructured: %v\n", traitDefs.Items[i].Name, err)
+					continue
+				}
+
+				def := &pkgdef.Definition{Unstructured: unstructured.Unstructured{Object: unstructuredObj}}
+				_, err = def.ToCUEString()
+				if err != nil {
+					traitErrorCount++
+					fmt.Printf("ERROR: TraitDefinition %s failed CUE parsing: %v\n", traitDefs.Items[i].Name, err)
+				}
+			}
+
+			By(fmt.Sprintf("CUE parsing results: %d ComponentDefinitions tested, %d TraitDefinitions tested",
+				len(componentDefs.Items), len(traitDefs.Items)))
+
+			totalErrors := componentErrorCount + traitErrorCount
+			Expect(totalErrors).To(Equal(0), fmt.Sprintf("%d definitions failed CUE parsing with updated logic", totalErrors))
+		})
+	})
 })
diff --git a/test/e2e-test/testdata/app/app_component_depends_on_fail.yaml b/test/e2e-test/testdata/app/app_component_depends_on_fail.yaml
new file mode 100644
index 00000000..65bf39d8
--- /dev/null
+++ b/test/e2e-test/testdata/app/app_component_depends_on_fail.yaml
@@ -0,0 +1,22 @@
+apiVersion: core.oam.dev/v1beta1
+kind: Application
+metadata:
+  name: app-component-depends-on-fail
+spec:
+  components:
+    - name: failing-database
+      type: webservice
+      properties:
+        image: ""  # This will fail to pull
+        ports:
+          - port: 3306
+            expose: false
+    - name: dependent-backend
+      type: webservice
+      dependsOn:
+        - failing-database
+      properties:
+        image: "nginx:1.20"
+        ports:
+          - port: 8080
+            expose: false
diff --git a/test/e2e-test/testdata/app/app_component_depends_on_multiple.yaml b/test/e2e-test/testdata/app/app_component_depends_on_multiple.yaml
new file mode 100644
index 00000000..a9d2618f
--- /dev/null
+++ b/test/e2e-test/testdata/app/app_component_depends_on_multiple.yaml
@@ -0,0 +1,30 @@
+apiVersion: core.oam.dev/v1beta1
+kind: Application
+metadata:
+  name: app-component-depends-on-multiple
+spec:
+  components:
+    - name: database
+      type: webservice
+      properties:
+        image: "nginx:1.20"
+        ports:
+          - port: 3306
+            expose: false
+    - name: cache
+      type: webservice
+      properties:
+        image: "nginx:1.20"
+        ports:
+          - port: 6379
+            expose: false
+    - name: backend
+      type: webservice
+      dependsOn:
+        - database
+        - cache
+      properties:
+        image: "nginx:1.20"
+        ports:
+          - port: 8080
+            expose: false
diff --git a/test/e2e-test/testdata/app/app_component_depends_on_success.yaml b/test/e2e-test/testdata/app/app_component_depends_on_success.yaml
new file mode 100644
index 00000000..07aa809a
--- /dev/null
+++ b/test/e2e-test/testdata/app/app_component_depends_on_success.yaml
@@ -0,0 +1,31 @@
+apiVersion: core.oam.dev/v1beta1
+kind: Application
+metadata:
+  name: app-component-depends-on-success
+spec:
+  components:
+    - name: database
+      type: webservice
+      properties:
+        image: "nginx:1.20"
+        ports:
+          - port: 3306
+            expose: false
+    - name: backend
+      type: webservice
+      dependsOn:
+        - database
+      properties:
+        image: "nginx:1.20"
+        ports:
+          - port: 8080
+            expose: false
+    - name: frontend
+      type: webservice
+      dependsOn:
+        - backend
+      properties:
+        image: "nginx:1.20"
+        ports:
+          - port: 80
+            expose: true
diff --git a/test/e2e-test/testdata/app/app_with_status.yaml b/test/e2e-test/testdata/app/app_with_status.yaml
new file mode 100644
index 00000000..117b1f6a
--- /dev/null
+++ b/test/e2e-test/testdata/app/app_with_status.yaml
@@ -0,0 +1,10 @@
+apiVersion: core.oam.dev/v1beta1
+kind: Application
+metadata:
+  name: app-with-status
+spec:
+  components:
+    - name: deployment-with-status
+      type: deployment-with-status
+      traits:
+        - type: trait-with-status
\ No newline at end of file
diff --git a/test/e2e-test/testdata/definition/deployment-with-status.yaml b/test/e2e-test/testdata/definition/deployment-with-status.yaml
new file mode 100644
index 00000000..f4cac6a5
--- /dev/null
+++ b/test/e2e-test/testdata/definition/deployment-with-status.yaml
@@ -0,0 +1,59 @@
+apiVersion: core.oam.dev/v1beta1
+kind: ComponentDefinition
+metadata:
+  annotations:
+    definition.oam.dev/alias: Deployment
+    definition.oam.dev/description: Deployment
+  name: deployment-with-status
+  namespace: vela-system
+spec:
+  schematic:
+    cue:
+      template: |
+        output: {
+          apiVersion: "apps/v1"
+          kind:       "Deployment"
+
+          metadata: {
+            name: "deployment-with-status"
+          }
+
+          spec: {
+            replicas: 2
+        
+            selector: matchLabels: {
+              app: "deployment-with-status"
+            }
+
+            template: {
+              metadata: labels: {
+                app: "deployment-with-status"
+              }
+
+              spec: {
+                containers: [{
+                  name:  "deployment-with-status"
+                  image: "nginx"
+                }]
+              }
+            }
+          }
+        }
+  status:
+    details: |
+      deploymentReady: *(context.output.status.replicas == context.output.status.readyReplicas) | false
+      $expectedReplicas: context.output.spec.replicas
+      readyReplicas: *context.output.status.readyReplicas | 0
+    healthPolicy: |
+      isHealth: context.status.details.readyReplicas == context.status.details.$expectedReplicas
+    customStatus: |
+      if context.status.healthy {
+        message: "Healthy - \(context.status.details.readyReplicas) / \(context.status.details.$expectedReplicas) replicas are ready"
+      }
+      if !context.status.healthy {
+        message: "Unhealthy - \(context.status.details.readyReplicas) / \(context.status.details.$expectedReplicas) replicas are ready"
+      }
+  workload:
+    definition:
+      apiVersion: apps/v1
+      kind: Deployment
\ No newline at end of file
diff --git a/test/e2e-test/testdata/definition/trait-with-status.yaml b/test/e2e-test/testdata/definition/trait-with-status.yaml
new file mode 100644
index 00000000..fa8d071f
--- /dev/null
+++ b/test/e2e-test/testdata/definition/trait-with-status.yaml
@@ -0,0 +1,62 @@
+apiVersion: core.oam.dev/v1beta1
+kind: TraitDefinition
+metadata:
+  annotations:
+    definition.oam.dev/alias: Deployment
+    definition.oam.dev/description: Deployment
+  name: trait-with-status
+  namespace: vela-system
+spec:
+  appliesToWorkloads:
+    - deployment-with-status
+  podDisruptive: false
+  schematic:
+    cue:
+      template: |
+        outputs: {
+          deployment: {
+            apiVersion: "apps/v1"
+            kind:       "Deployment"
+
+            metadata: {
+              name: "trait-with-status"
+            }
+
+            spec: {
+              replicas: 1
+        
+              selector: matchLabels: {
+                app: "trait-with-status"
+              }
+
+              template: {
+                metadata: labels: {
+                  app: "trait-with-status"
+                }
+
+                spec: {
+                  containers: [{
+                    name:  "trait-with-status"
+                    image: "nginx"
+                  }]
+                }
+              }
+            }
+          }
+        }
+  status:
+    details: |
+      deploymentReady: *(context.outputs.deployment.status.replicas == context.outputs.deployment.status.readyReplicas) | false
+      $expectedReplicas: context.outputs.deployment.spec.replicas
+      readyReplicas: *context.outputs.deployment.status.readyReplicas | 0
+      allReplicasReady: readyReplicas == $expectedReplicas
+    healthPolicy: |
+      isHealth: context.status.details.readyReplicas == context.status.details.$expectedReplicas
+    customStatus: |
+      if context.status.healthy {
+        message: "Healthy - \(context.status.details.readyReplicas) / \(context.status.details.$expectedReplicas) replicas are ready"
+      }
+      if !context.status.healthy {
+        message: "Unhealthy - \(context.status.details.readyReplicas) / \(context.status.details.$expectedReplicas) replicas are ready"
+      }
+  workloadRefPath: ""
\ No newline at end of file