feat: Add ID option to plugin_worker command

- Add -id CLI flag to allow custom worker IDs - Auto-generates ID if not specified (worker-{hostname}-{timestamp}) - ID defaults to empty string and is optional - Log the custom ID when specified - Update usage examples to show -id option - Worker can now be identified by custom name in admin UI
fix: Sort plugins by ID in admin UI
2026-10-09 16:15:51 +00:00 · 2026-02-17 11:14:48 -08:00 · 2026-02-17 11:12:11 -08:00 · 2026-02-17 11:08:35 -08:00 · 2026-02-17 09:03:00 -08:00 · 2026-02-17 08:33:36 -08:00
499 changed files with 30758 additions and 48114 deletions
@@ -11,4 +11,4 @@ jobs:
      - name: 'Checkout Repository'
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@05fe4576374b728f0c523d6a13d64c25081e0803
+        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261
@@ -135,7 +135,7 @@ jobs:

    - name: Archive logs
      if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v6
      with:
        name: output-logs
        path: docker/output.log
@@ -52,7 +52,7 @@ jobs:

    - name: Archive logs
      if: failure()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v6
      with:
        name: ec-integration-test-logs
        path: |
@@ -42,7 +42,7 @@ jobs:
        
    - name: Upload test logs on failure
      if: failure()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v6
      with:
        name: ec-test-logs
        path: test/erasure_coding/admin_dockertest/tmp/logs/
@@ -183,7 +183,7 @@ jobs:
        
    - name: Upload Test Artifacts
      if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v6
      with:
        name: fuse-integration-test-results
        path: |
@@ -119,7 +119,7 @@ jobs:
          echo "✅ All template rendering tests passed!"

      - name: Create kind cluster
-        uses: helm/kind-action@v1.14.0
+        uses: helm/kind-action@v1.13.0

      - name: Run chart-testing (install)
        run: ct install --target-branch ${{ github.event.repository.default_branch }} --all --chart-dirs k8s/charts
@@ -49,7 +49,7 @@ jobs:
      
      - name: Upload Test Reports
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: test-reports-java-${{ matrix.java }}
          path: |
@@ -70,7 +70,7 @@ jobs:
        
    - name: Archive logs on failure
      if: failure()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v6
      with:
        name: metadata-subscribe-test-logs
        path: |
@@ -1,39 +0,0 @@
-name: "Plugin Worker Integration Tests"
-
-on:
-  push:
-    branches: [ master ]
-  pull_request:
-    branches: [ master ]
-
-permissions:
-  contents: read
-
-jobs:
-  plugin-worker:
-    name: "Plugin Worker: ${{ matrix.worker }}"
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - worker: erasure_coding
-            path: test/plugin_workers/erasure_coding
-          - worker: vacuum
-            path: test/plugin_workers/vacuum
-          - worker: volume_balance
-            path: test/plugin_workers/volume_balance
-
-    steps:
-      - name: Set up Go 1.x
-        uses: actions/setup-go@v6
-        with:
-          go-version: ^1.26
-        id: go
-
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v6
-
-      - name: Run plugin worker tests
-        run: go test -v ./${{ matrix.path }}
@@ -62,7 +62,7 @@ jobs:

    - name: Archive logs
      if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v6
      with:
        name: postgres-logs
        path: test/postgres/postgres-output.log
@@ -39,14 +39,6 @@ jobs:
          echo "=== Running S3 Integration Tests ==="
          go test -v -timeout=60s -run TestS3Integration ./...

-      - name: Run S3 DeleteBucketNotEmpty Tests
-        timeout-minutes: 15
-        working-directory: test/s3/normal
-        run: |
-          set -x
-          echo "=== Running S3 DeleteBucketNotEmpty Tests ==="
-          go test -v -timeout=60s -run TestS3DeleteBucketNotEmpty ./...
-
      - name: Run IAM Integration Tests
        timeout-minutes: 15
        working-directory: test/s3/normal
@@ -57,7 +49,7 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: integration-test-logs
          path: test/s3/normal/*.log
@@ -77,7 +77,7 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-filer-group-test-logs
          path: test/s3/filer_group/weed-test*.log
@@ -76,7 +76,7 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-versioning-test-logs-${{ matrix.test-type }}
          path: test/s3/versioning/weed-test*.log
@@ -124,7 +124,7 @@ jobs:

      - name: Upload server logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-versioning-compatibility-logs
          path: test/s3/versioning/weed-test*.log
@@ -172,7 +172,7 @@ jobs:

      - name: Upload server logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-cors-compatibility-logs
          path: test/s3/cors/weed-test*.log
@@ -239,7 +239,7 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-retention-test-logs-${{ matrix.test-type }}
          path: test/s3/retention/weed-test*.log
@@ -306,7 +306,7 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-cors-test-logs-${{ matrix.test-type }}
          path: test/s3/cors/weed-test*.log
@@ -355,7 +355,7 @@ jobs:

      - name: Upload server logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-retention-worm-logs
          path: test/s3/retention/weed-test*.log
@@ -422,7 +422,7 @@ jobs:

      - name: Upload stress test logs
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-versioning-stress-logs
          path: test/s3/versioning/weed-test*.log
@@ -478,7 +478,7 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-tagging-test-logs
          path: test/s3/tagging/weed-test*.log
@@ -531,7 +531,7 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-remote-cache-test-logs
          path: |
@@ -65,7 +65,7 @@ jobs:

      - name: Upload test results on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: iam-unit-test-results
          path: |
@@ -162,7 +162,7 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-iam-integration-logs-${{ matrix.test-type }}
          path: test/s3/iam/weed-*.log
@@ -222,7 +222,7 @@ jobs:

      - name: Upload distributed test logs
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-iam-distributed-logs
          path: test/s3/iam/weed-*.log
@@ -274,7 +274,7 @@ jobs:

      - name: Upload performance test results
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-iam-performance-results
          path: |
@@ -152,7 +152,7 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-keycloak-test-logs
          path: |
@@ -121,7 +121,7 @@ jobs:
      
      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: test-logs-python-${{ matrix.python-version }}
          path: |
@@ -70,7 +70,7 @@ jobs:

      - name: Upload test results on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: policy-unit-test-results
          path: |
@@ -178,7 +178,7 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-policy-variables-test-logs
          path: /tmp/weed_policy_test_server.log
@@ -299,7 +299,7 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-policy-enforcement-logs-${{ matrix.test-case }}
          path: /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log
@@ -386,7 +386,7 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: trusted-proxy-test-logs
          path: /tmp/weed_proxy_test.log
@@ -1,122 +0,0 @@
-name: "S3 Proxy Signature Tests"
-
-on:
-  push:
-    branches: [ master ]
-  pull_request:
-    branches: [ master ]
-
-concurrency:
-  group: ${{ github.head_ref || github.ref }}/s3-proxy-signature-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  proxy-signature-tests:
-    name: S3 Proxy Signature Verification Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v6
-
-      - name: Set up Go 1.x
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build SeaweedFS binary for Linux
-        run: |
-          set -x
-          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -buildvcs=false -v -o test/s3/proxy_signature/weed ./weed
-
-      - name: Run S3 Proxy Signature Tests
-        timeout-minutes: 10
-        working-directory: test/s3/proxy_signature
-        run: |
-          set -x
-          echo "Starting Docker Compose services..."
-          docker compose up -d --build
-          
-          # Check if containers are running
-          echo "Checking container status..."
-          docker compose ps
-          
-          # Wait for services to be ready
-          echo "Waiting for nginx proxy to be ready..."
-          PROXY_READY=0
-          for i in $(seq 1 30); do
-            if curl -s http://localhost:9000/ > /dev/null 2>&1; then
-              echo "Proxy is ready"
-              PROXY_READY=1
-              break
-            fi
-            echo "Waiting for proxy... ($i/30)"
-            sleep 1
-          done
-          if [ $PROXY_READY -eq 0 ]; then
-            echo "ERROR: Proxy failed to become ready after 30 seconds"
-            echo "Docker compose logs:"
-            docker compose logs --no-color || true
-            exit 1
-          fi
-          
-          # Wait for SeaweedFS to be ready
-          echo "Waiting for SeaweedFS S3 gateway to be ready via proxy..."
-          S3_READY=0
-          for i in $(seq 1 30); do
-            # Check logs first for startup message (weed mini says "S3 service is ready")
-            if docker compose logs seaweedfs 2>&1 | grep -qE "S3 (gateway|service).*(started|ready)"; then
-              echo "SeaweedFS S3 gateway is ready"
-              S3_READY=1
-              break
-            fi
-            # Fallback: check headers via proxy (which is already ready)
-            if curl -s -I http://localhost:9000/ | grep -qi "SeaweedFS"; then
-              echo "SeaweedFS S3 gateway is responding via proxy"
-              S3_READY=1
-              break
-            fi
-            echo "Waiting for S3 gateway... ($i/30)"
-            sleep 1
-          done
-          if [ $S3_READY -eq 0 ]; then
-            echo "ERROR: SeaweedFS S3 gateway failed to become ready after 30 seconds"
-            echo "Latest seaweedfs logs:"
-            docker compose logs --no-color --tail 20 seaweedfs || true
-            exit 1
-          fi
-          
-          # Run the test script inside AWS CLI container
-          echo "Running test script..."
-          docker run --rm --network host \
-            --entrypoint bash \
-            amazon/aws-cli:latest \
-            -c "$(cat test.sh)"
-          
-          TEST_RESULT=$?
-          
-          # Cleanup
-          docker compose down
-          
-          exit $TEST_RESULT
-
-      - name: Cleanup on failure
-        if: failure()
-        working-directory: test/s3/proxy_signature
-        run: |
-          echo "Cleaning up Docker containers..."
-          ls -al weed || true
-          ldd weed || true
-          echo "Docker compose logs:"
-          docker compose logs --no-color || true
-          echo "Container status before cleanup:"
-          docker ps -a
-          echo "Stopping services..."
-          docker compose down || true
@@ -73,7 +73,7 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-spark-test-logs
          path: test/s3/spark/test-output.log
@@ -95,7 +95,7 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-sse-test-logs-${{ matrix.test-type }}
          path: test/s3/sse/weed-test*.log
@@ -143,7 +143,7 @@ jobs:

      - name: Upload server logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-sse-compatibility-logs
          path: test/s3/sse/weed-test*.log
@@ -192,7 +192,7 @@ jobs:

      - name: Upload server logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-sse-metadata-persistence-logs
          path: test/s3/sse/weed-test*.log
@@ -241,7 +241,7 @@ jobs:

      - name: Upload server logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-sse-copy-operations-logs
          path: test/s3/sse/weed-test*.log
@@ -290,7 +290,7 @@ jobs:

      - name: Upload server logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-sse-multipart-logs
          path: test/s3/sse/weed-test*.log
@@ -340,7 +340,7 @@ jobs:

      - name: Upload performance test logs
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-sse-performance-logs
          path: test/s3/sse/weed-test*.log
@@ -389,7 +389,7 @@ jobs:

      - name: Upload server logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-volume-encryption-logs
          path: /tmp/seaweedfs-sse-*.log
@@ -66,7 +66,7 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: s3-tables-test-logs
          path: test/s3tables/table-buckets/test-output.log
@@ -122,7 +122,7 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: iceberg-catalog-test-logs
          path: test/s3tables/catalog/test-output.log
@@ -188,73 +188,12 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: trino-iceberg-catalog-test-logs
          path: test/s3tables/catalog_trino/test-output.log
          retention-days: 3

-  polaris-integration-tests:
-    name: Polaris Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Run go mod tidy
-        run: go mod tidy
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false ./weed
-
-      - name: Pre-pull Polaris image
-        run: docker pull apache/polaris:latest
-
-      - name: Run Polaris Integration Tests
-        timeout-minutes: 25
-        run: |
-          set -x
-          set -o pipefail
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting Polaris Tests ==="
-
-          go test -v -timeout 20m ./test/s3tables/polaris 2>&1 | tee test/s3tables/polaris/test-output.log || {
-            echo "Polaris integration tests failed"
-            exit 1
-          }
-
-      - name: Show test output on failure
-        if: failure()
-        working-directory: test/s3tables/polaris
-        run: |
-          echo "=== Test Output ==="
-          if [ -f test-output.log ]; then
-            tail -200 test-output.log
-          fi
-
-          echo "=== Process information ==="
-          ps aux | grep -E "(weed|test|docker)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: polaris-test-logs
-          path: test/s3tables/polaris/test-output.log
-          retention-days: 3
-
  spark-iceberg-catalog-tests:
    name: Spark Iceberg Catalog Integration Tests
    runs-on: ubuntu-22.04
@@ -315,7 +254,7 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: spark-iceberg-catalog-test-logs
          path: test/s3tables/catalog_spark/test-output.log
@@ -383,7 +322,7 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: risingwave-catalog-test-logs
          path: test/s3tables/catalog_risingwave/test-output.log
@@ -449,7 +388,7 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: sts-integration-test-logs
          path: test/s3tables/sts_integration/test-output.log
@@ -518,7 +457,7 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: lakekeeper-integration-test-logs
          path: test/s3tables/lakekeeper/test-output.log
@@ -125,7 +125,7 @@ jobs:

    - name: Upload test results
      if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v6
      with:
        name: spark-test-results
        path: test/java/spark/target/surefire-reports/
@@ -103,7 +103,7 @@ jobs:

      - name: Upload server logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: seaweedfs-logs
          # Note: actions don't use defaults.run.working-directory, so path is relative to workspace root
@@ -106,7 +106,7 @@ jobs:

      - name: Upload test logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: tus-test-logs
          path: |
@@ -90,7 +90,7 @@ jobs:

      - name: Archive logs on failure
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: volume-server-integration-test-logs
          path: /tmp/volume-server-it-logs/
@@ -1,4 +1,4 @@
-.PHONY: test admin-generate admin-build admin-clean admin-dev admin-run admin-test admin-fmt admin-help weed-commands
+.PHONY: test admin-generate admin-build admin-clean admin-dev admin-run admin-test admin-fmt admin-help

 BINARY = weed
 ADMIN_DIR = weed/admin
@@ -11,9 +11,6 @@ all: install
 install: admin-generate
 	cd weed; go install

-weed-commands:
-	cd weed && $(MAKE) weed-db weed-sql
-
 warp_install:
 	go install github.com/minio/warp@v0.7.6

@@ -43,7 +40,7 @@ test: admin-generate
 # Admin component targets
 admin-generate:
 	@echo "Generating admin component templates..."
-	@cd $(ADMIN_DIR) && templ generate ./view
+	@templ generate

 admin-build: admin-generate
 	@echo "Building admin component..."
@@ -1,7 +0,0 @@
-package main
-
-import "os"
-
-func main() {
-	os.Exit(Run(os.Args[1:]))
-}
@@ -1,7 +0,0 @@
-package main
-
-import "os"
-
-func main() {
-	os.Exit(Run(os.Args[1:]))
-}
@@ -7,7 +7,6 @@

 [master.maintenance]
 # periodically run these scripts are the same as running them from 'weed shell'
-# Scripts are skipped while an admin server is connected.
 scripts = """
  lock
  ec.encode -fullPercent=95 -quietFor=1h
@@ -20,17 +20,13 @@ if [ "$(id -u)" = "0" ]; then
  
  DATA_UID=$(stat -c '%u' /data 2>/dev/null)
  DATA_GID=$(stat -c '%g' /data 2>/dev/null)
-
-  # Only run chown -R if ownership doesn't already match (avoids expensive
-  # recursive chown on subsequent starts, and is a no-op on OpenShift when
-  # fsGroup has already set correct ownership on the PVC).
-  if [ "$DATA_UID" != "$SEAWEED_UID" ] || [ "$DATA_GID" != "$SEAWEED_GID" ]; then
+  
+  # Only run chown -R if ownership doesn't match (much faster for subsequent starts)
    echo "Fixing /data ownership for seaweed user (uid=$SEAWEED_UID, gid=$SEAWEED_GID)"
    if ! chown -R seaweed:seaweed /data; then
      echo "Warning: Failed to change ownership of /data. This may cause permission errors." >&2
      echo "If /data is read-only or has mount issues, the application may fail to start." >&2
    fi
-  fi
  
  # Use su-exec to drop privileges and run as seaweed user
  exec su-exec seaweed "$0" "$@"
@@ -58,7 +54,7 @@ isArgPassed() {
 case "$1" in

  'master')
-  	ARGS="-mdir=/data -volumeSizeLimitMB=1024"
+  	ARGS="-mdir=/data -volumePreallocate -volumeSizeLimitMB=1024"
  	shift
  	exec /usr/bin/weed -logtostderr=true master $ARGS $@
 	;;
@@ -73,9 +69,9 @@ case "$1" in
 	;;

  'server')
-  	ARGS="-dir=/data -volume.max=0 -master.volumeSizeLimitMB=1024"
+  	ARGS="-dir=/data -volume.max=0 -master.volumePreallocate -master.volumeSizeLimitMB=1024"
  	if isArgPassed "-volume.max" "$@"; then
-  	  ARGS="-dir=/data -master.volumeSizeLimitMB=1024"
+  	  ARGS="-dir=/data -master.volumePreallocate -master.volumeSizeLimitMB=1024"
  	fi
 	shift
  	exec /usr/bin/weed -logtostderr=true server $ARGS $@
@@ -33,7 +33,7 @@ isArgPassed() {
 case "$1" in

  'master')
-  	ARGS="-mdir=/data -volumeSizeLimitMB=1024"
+  	ARGS="-mdir=/data -volumePreallocate -volumeSizeLimitMB=1024"
  	shift
  	exec /usr/bin/weed -logtostderr=true master $ARGS "$@"
 	;;
@@ -48,9 +48,9 @@ case "$1" in
 	;;

  'server')
-  	ARGS="-dir=/data -volume.max=0 -master.volumeSizeLimitMB=1024"
+  	ARGS="-dir=/data -volume.max=0 -master.volumePreallocate -master.volumeSizeLimitMB=1024"
  	if isArgPassed "-volume.max" "$@"; then
-  	  ARGS="-dir=/data -master.volumeSizeLimitMB=1024"
+  	  ARGS="-dir=/data -master.volumePreallocate -master.volumeSizeLimitMB=1024"
  	fi
 	shift
  	exec /usr/bin/weed -logtostderr=true server $ARGS "$@"
@@ -42,12 +42,3 @@ services:
      - master
      - volume
      - filer
-  admin:
-    image: chrislusf/seaweedfs:dev # use a remote dev image
-    ports:
-      - 23646:23646
-    command: 'admin -master=master:9333'
-    depends_on:
-      - master
-      - volume
-      - filer
@@ -26,7 +26,7 @@ require (
 	github.com/facebookgo/stats v0.0.0-20151006221625-1b76add642e4
 	github.com/facebookgo/subset v0.0.0-20200203212716-c811ad88dec4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/go-redsync/redsync/v4 v4.16.0
+	github.com/go-redsync/redsync/v4 v4.15.0
 	github.com/go-sql-driver/mysql v1.9.3
 	github.com/go-zookeeper/zk v1.0.3 // indirect
 	github.com/golang/protobuf v1.5.4
@@ -89,27 +89,27 @@ require (
 	go.etcd.io/etcd/client/v3 v3.6.7
 	go.mongodb.org/mongo-driver v1.17.6
 	go.opencensus.io v0.24.0 // indirect
-	gocloud.dev v0.45.0
-	gocloud.dev/pubsub/natspubsub v0.45.0
+	gocloud.dev v0.44.0
+	gocloud.dev/pubsub/natspubsub v0.44.0
 	gocloud.dev/pubsub/rabbitpubsub v0.44.0
 	golang.org/x/crypto v0.48.0
 	golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546
-	golang.org/x/image v0.36.0
+	golang.org/x/image v0.35.0
 	golang.org/x/net v0.49.0
-	golang.org/x/oauth2 v0.35.0
+	golang.org/x/oauth2 v0.34.0
 	golang.org/x/sys v0.41.0
 	golang.org/x/text v0.34.0 // indirect
 	golang.org/x/tools v0.41.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	google.golang.org/api v0.258.0
-	google.golang.org/genproto v0.0.0-20251124214823-79d6a2a48846 // indirect
+	google.golang.org/genproto v0.0.0-20250922171735-9219d122eba9 // indirect
 	google.golang.org/grpc v1.78.0
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	modernc.org/b v1.0.0 // indirect
 	modernc.org/mathutil v1.7.1
 	modernc.org/memory v1.11.0 // indirect
-	modernc.org/sqlite v1.46.1
+	modernc.org/sqlite v1.44.3
 	modernc.org/strutil v1.2.1
 )

@@ -131,6 +131,8 @@ require (
 	github.com/cognusion/imaging v1.0.2
 	github.com/fluent/fluent-logger-golang v1.10.1
 	github.com/getsentry/sentry-go v0.42.0
+	github.com/gin-contrib/sessions v1.0.4
+	github.com/gin-gonic/gin v1.11.0
 	github.com/go-ldap/ldap/v3 v3.4.12
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/flatbuffers/go v0.0.0-20230108230133-3b8644d32c50
@@ -138,19 +140,20 @@ require (
 	github.com/hashicorp/raft-boltdb/v2 v2.3.1
 	github.com/hashicorp/vault/api v1.22.0
 	github.com/jhump/protoreflect v1.18.0
-	github.com/linkedin/goavro/v2 v2.15.0
+	github.com/lib/pq v1.11.1
+	github.com/linkedin/goavro/v2 v2.14.1
 	github.com/mattn/go-sqlite3 v1.14.34
 	github.com/minio/crc64nvme v1.1.1
 	github.com/orcaman/concurrent-map/v2 v2.0.1
-	github.com/parquet-go/parquet-go v0.28.0
+	github.com/parquet-go/parquet-go v0.26.4
 	github.com/pkg/sftp v1.13.10
 	github.com/rabbitmq/amqp091-go v1.10.0
-	github.com/rclone/rclone v1.73.1
+	github.com/rclone/rclone v1.72.1
 	github.com/rdleal/intervalst v1.5.0
 	github.com/redis/go-redis/v9 v9.18.0
 	github.com/schollz/progressbar/v3 v3.19.0
 	github.com/seaweedfs/go-fuse/v2 v2.9.1
-	github.com/shirou/gopsutil/v4 v4.26.2
+	github.com/shirou/gopsutil/v4 v4.26.1
 	github.com/tarantool/go-tarantool/v2 v2.4.1
 	github.com/testcontainers/testcontainers-go v0.39.0
 	github.com/tikv/client-go/v2 v2.0.7
@@ -171,13 +174,12 @@ require (
 	atomicgo.dev/keyboard v0.2.9 // indirect
 	atomicgo.dev/schedule v0.1.0 // indirect
 	cloud.google.com/go/longrunning v0.7.0 // indirect
-	cloud.google.com/go/pubsub/v2 v2.3.0 // indirect
+	cloud.google.com/go/pubsub/v2 v2.2.1 // indirect
 	dario.cat/mergo v1.0.2 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.1 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
 	github.com/Azure/go-autorest/autorest/to v0.4.1 // indirect
-	github.com/FilenCloudDienste/filen-sdk-go v0.0.37 // indirect
 	github.com/a1ex3/zstd-seekable-format-go/pkg v0.10.0 // indirect
 	github.com/anchore/go-lzo v0.1.0 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
@@ -210,8 +212,6 @@ require (
 	github.com/docker/docker v28.5.0+incompatible // indirect
 	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/dromara/dongle v1.0.1 // indirect
-	github.com/gin-gonic/gin v1.11.0 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
 	github.com/go-git/go-billy/v5 v5.6.2 // indirect
 	github.com/goccy/go-yaml v1.18.0 // indirect
@@ -226,7 +226,6 @@ require (
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
 	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
 	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
-	github.com/internxt/rclone-adapter v0.0.0-20260213125353-6f59c89fcb7c // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
@@ -236,7 +235,6 @@ require (
 	github.com/klauspost/asmfmt v1.3.2 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
-	github.com/lib/pq v1.11.1 // indirect
 	github.com/lithammer/fuzzysearch v1.1.8 // indirect
 	github.com/lithammer/shortuuid/v3 v3.0.7 // indirect
 	github.com/magiconair/properties v1.8.10 // indirect
@@ -259,9 +257,8 @@ require (
 	github.com/pierrre/geohash v1.0.0 // indirect
 	github.com/pquerna/otp v1.5.0 // indirect
 	github.com/pterm/pterm v0.12.81 // indirect
+	github.com/quic-go/qpack v0.6.0 // indirect
 	github.com/quic-go/quic-go v0.57.0 // indirect
-	github.com/rclone/Proton-API-Bridge v1.0.1-0.20260127174007-77f974840d11 // indirect
-	github.com/rclone/go-proton-api v1.0.1-0.20260127173028-eb465cac3b18 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sasha-s/go-deadlock v0.3.1 // indirect
@@ -270,20 +267,18 @@ require (
 	github.com/substrait-io/substrait v0.69.0 // indirect
 	github.com/substrait-io/substrait-go/v4 v4.4.0 // indirect
 	github.com/substrait-io/substrait-protobuf/go v0.71.0 // indirect
-	github.com/twpayne/go-geom v1.6.1 // indirect
-	github.com/twpayne/go-kml/v3 v3.2.1 // indirect
-	github.com/tyler-smith/go-bip39 v1.1.0 // indirect
+	github.com/twpayne/go-geom v1.4.1 // indirect
+	github.com/twpayne/go-kml v1.5.2 // indirect
 	github.com/ulikunitz/xz v0.5.15 // indirect
 	github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/zeebo/xxh3 v1.0.2 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect
 	go.opentelemetry.io/otel/exporters/zipkin v1.36.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.9.0 // indirect
-	go.uber.org/mock v0.5.2 // indirect
+	go.opentelemetry.io/proto/otlp v1.7.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/mod v0.32.0 // indirect
@@ -292,13 +287,13 @@ require (
 )

 require (
-	cel.dev/expr v0.25.1 // indirect
+	cel.dev/expr v0.24.0 // indirect
 	cloud.google.com/go/auth v0.17.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	cloud.google.com/go/iam v1.5.3 // indirect
-	cloud.google.com/go/monitoring v1.24.3 // indirect
-	filippo.io/edwards25519 v1.1.1 // indirect
+	cloud.google.com/go/monitoring v1.24.2 // indirect
+	filippo.io/edwards25519 v1.1.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
@@ -327,7 +322,7 @@ require (
 	github.com/arangodb/go-velocypack v0.0.0-20200318135517-5af53c29c67e // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.12 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.4 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
@@ -336,23 +331,26 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.7 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.16 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sns v1.39.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sqs v1.42.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sns v1.34.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sqs v1.38.8 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.41.6
+	github.com/aws/aws-sdk-go-v2/service/sts v1.41.6 // indirect
 	github.com/aws/smithy-go v1.24.0
 	github.com/boltdb/bolt v1.3.1 // indirect
 	github.com/bradenaw/juniper v0.15.3 // indirect
 	github.com/bradfitz/iter v0.0.0-20191230175014-e8f45d346db8 // indirect
 	github.com/buengese/sgzip v0.1.1 // indirect
+	github.com/bytedance/sonic v1.14.0 // indirect
+	github.com/bytedance/sonic/loader v0.3.0 // indirect
 	github.com/calebcase/tmpfile v1.0.3 // indirect
 	github.com/chilts/sid v0.0.0-20190607042430-660e94789ec9 // indirect
-	github.com/cloudflare/circl v1.6.3 // indirect
+	github.com/cloudflare/circl v1.6.1 // indirect
 	github.com/cloudinary/cloudinary-go/v2 v2.13.0 // indirect
 	github.com/cloudsoda/go-smb2 v0.0.0-20250228001242-d4c70e6251cc // indirect
 	github.com/cloudsoda/sddl v0.0.0-20250224235906-926454e91efc // indirect
-	github.com/cncf/xds/go v0.0.0-20251110193048-8bfbf64dc13e // indirect
+	github.com/cloudwego/base64x v0.1.6 // indirect
+	github.com/cncf/xds/go v0.0.0-20251022180443-0feb69152e9f // indirect
 	github.com/colinmarc/hdfs/v2 v2.4.0 // indirect
 	github.com/creasty/defaults v1.8.0 // indirect
 	github.com/cronokirby/saferith v0.33.0 // indirect
@@ -360,18 +358,19 @@ require (
 	github.com/d4l3k/messagediff v1.2.1 // indirect
 	github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 // indirect
 	github.com/dropbox/dropbox-sdk-go-unofficial/v6 v6.0.5 // indirect
-	github.com/ebitengine/purego v0.10.0 // indirect
+	github.com/ebitengine/purego v0.9.1 // indirect
 	github.com/elastic/gosigar v0.14.3 // indirect
 	github.com/emersion/go-message v0.18.2 // indirect
 	github.com/emersion/go-vcard v0.0.0-20241024213814-c9703dde27ff // indirect
-	github.com/envoyproxy/go-control-plane/envoy v1.36.0 // indirect
+	github.com/envoyproxy/go-control-plane/envoy v1.35.0 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/flynn/noise v1.1.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.11 // indirect
 	github.com/geoffgarside/ber v1.2.0 // indirect
-	github.com/go-chi/chi/v5 v5.2.5 // indirect
+	github.com/gin-contrib/sse v1.1.0 // indirect
+	github.com/go-chi/chi/v5 v5.2.3 // indirect
 	github.com/go-darwin/apfs v0.0.0-20211011131704-f84b94dbf348 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
@@ -390,9 +389,10 @@ require (
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.7 // indirect
+	github.com/gorilla/context v1.1.2 // indirect
 	github.com/gorilla/schema v1.4.1 // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
-	github.com/gorilla/sessions v1.4.0
+	github.com/gorilla/sessions v1.4.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
@@ -402,6 +402,8 @@ require (
 	github.com/hashicorp/go-msgpack/v2 v2.1.2 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/hashicorp/golang-lru v0.6.0 // indirect
+	github.com/henrybear327/Proton-API-Bridge v1.0.0 // indirect
+	github.com/henrybear327/go-proton-api v1.0.0 // indirect
 	github.com/jcmturner/aescts/v2 v2.0.0 // indirect
 	github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect
 	github.com/jcmturner/goidentity/v6 v6.0.1 // indirect
@@ -428,8 +430,8 @@ require (
 	github.com/mitchellh/mapstructure v1.5.1-0.20220423185008-bf980b35cac4
 	github.com/montanaflynn/stats v0.7.1 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/nats-io/nats.go v1.48.0 // indirect
-	github.com/nats-io/nkeys v0.4.12 // indirect
+	github.com/nats-io/nats.go v1.43.0 // indirect
+	github.com/nats-io/nkeys v0.4.11 // indirect
 	github.com/nats-io/nuid v1.0.1 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/ncw/swift/v2 v2.0.5 // indirect
@@ -443,7 +445,7 @@ require (
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pengsrc/go-shared v0.2.1-0.20190131101655-1999055a4a14 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
-	github.com/pierrec/lz4/v4 v4.1.25
+	github.com/pierrec/lz4/v4 v4.1.22
 	github.com/pingcap/errors v0.11.5-0.20211224045212-9687c2b0f87c // indirect
 	github.com/pingcap/failpoint v0.0.0-20220801062533-2eaa32854a6c // indirect
 	github.com/pingcap/kvproto v0.0.0-20230403051650-e166ae588106 // indirect
@@ -459,7 +461,7 @@ require (
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
 	github.com/samber/lo v1.52.0 // indirect
-	github.com/seaweedfs/cockroachdb-parser v0.0.0-20260225204133-2f342c5ea564
+	github.com/seaweedfs/cockroachdb-parser v0.0.0-20251021184156-909763b17138
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
 	github.com/sony/gobreaker v1.0.0 // indirect
 	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
@@ -474,7 +476,9 @@ require (
 	github.com/tinylib/msgp v1.5.0 // indirect
 	github.com/tklauser/go-sysconf v0.3.16 // indirect
 	github.com/tklauser/numcpus v0.11.0 // indirect
+	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/twmb/murmur3 v1.1.8 // indirect
+	github.com/ugorji/go/codec v1.3.0 // indirect
 	github.com/unknwon/goconfig v1.0.0 // indirect
 	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
@@ -493,13 +497,14 @@ require (
 	go.opentelemetry.io/contrib/detectors/gcp v1.38.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
-	go.opentelemetry.io/otel v1.40.0 // indirect
-	go.opentelemetry.io/otel/metric v1.40.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.40.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.40.0 // indirect
-	go.opentelemetry.io/otel/trace v1.40.0 // indirect
+	go.opentelemetry.io/otel v1.38.0 // indirect
+	go.opentelemetry.io/otel/metric v1.38.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.38.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.38.0 // indirect
+	go.opentelemetry.io/otel/trace v1.38.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.1 // indirect
+	golang.org/x/arch v0.20.0 // indirect
 	golang.org/x/term v0.40.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20251124214823-79d6a2a48846 // indirect
@@ -1,6 +1,6 @@
 apiVersion: v1
 description: SeaweedFS
 name: seaweedfs
-appVersion: "4.15"
+appVersion: "4.13"
 # Dev note: Trigger a helm chart release by `git tag -a helm-<version>`
-version: 4.15.0
+version: 4.0.413
@@ -212,9 +212,8 @@ To enable workers, add the following to your values.yaml:
 worker:
  enabled: true
  replicas: 2  # Scale based on workload
-  jobType: "vacuum,volume_balance,erasure_coding"  # Job types this worker can handle
-  maxDetect: 1  # Maximum concurrent detection requests
-  maxExecute: 4  # Maximum concurrent execution jobs per worker
+  capabilities: "vacuum,balance,erasure_coding"  # Tasks this worker can handle
+  maxConcurrent: 3  # Maximum concurrent tasks per worker
  
  # Working directory for task execution
  # Default: "/tmp/seaweedfs-worker"
@@ -249,14 +248,14 @@ worker:
      memory: "2Gi"
 ```

-### Worker Job Types
+### Worker Capabilities

-Workers can be configured with different job types:
+Workers can be configured with different capabilities:
 - **vacuum**: Reclaim deleted file space
- **volume_balance**: Balance volumes across volume servers
+- **balance**: Balance volumes across volume servers
 - **erasure_coding**: Handle erasure coding operations

-You can configure workers with all job types or create specialized worker pools with specific job types.
+You can configure workers with all capabilities or create specialized worker pools with specific capabilities.

 ### Worker Deployment Strategy

@@ -265,11 +264,11 @@ For production deployments, consider:
 1. **Multiple Workers**: Deploy 2+ worker replicas for high availability
 2. **Resource Allocation**: Workers need sufficient CPU/memory for maintenance tasks
 3. **Storage**: Workers need temporary storage for vacuum and balance operations (size depends on volume size)
-4. **Specialized Workers**: Create separate worker deployments for different job types if needed
+4. **Specialized Workers**: Create separate worker deployments for different capabilities if needed

 Example specialized worker configuration:

-For specialized worker pools, deploy separate Helm releases with different job types:
+For specialized worker pools, deploy separate Helm releases with different capabilities:

 **values-worker-vacuum.yaml** (for vacuum operations):
 ```yaml
@@ -288,8 +287,8 @@ admin:
 worker:
  enabled: true
  replicas: 2
-  jobType: "vacuum"
-  maxExecute: 2
+  capabilities: "vacuum"
+  maxConcurrent: 2
  # REQUIRED: Point to the admin service of your main SeaweedFS release
  # Replace <namespace> with the namespace where your main seaweedfs is deployed
  # Example: If deploying in namespace "production":
@@ -314,8 +313,8 @@ admin:
 worker:
  enabled: true
  replicas: 1
-  jobType: "volume_balance"
-  maxExecute: 1
+  capabilities: "balance"
+  maxConcurrent: 1
  # REQUIRED: Point to the admin service of your main SeaweedFS release
  # Replace <namespace> with the namespace where your main seaweedfs is deployed
  # Example: If deploying in namespace "production":
@@ -324,7 +323,6 @@ worker:
 ```

 Deploy the specialized workers as separate releases:
-### Specialized Worker Deployment
 ```bash
 # Deploy vacuum workers
 helm install seaweedfs-worker-vacuum seaweedfs/seaweedfs -f values-worker-vacuum.yaml
@@ -333,22 +331,6 @@ helm install seaweedfs-worker-vacuum seaweedfs/seaweedfs -f values-worker-vacuum
 helm install seaweedfs-worker-balance seaweedfs/seaweedfs -f values-worker-balance.yaml
 ```

-## OpenShift Support
-
-SeaweedFS can be deployed on OpenShift or any cluster enforcing the Kubernetes "restricted" Pod Security Standard. By default, OpenShift blocks containers that run as root or use `hostPath` volumes.
-
-To deploy on OpenShift, use the provided `openshift-values.yaml` which overrides the default configuration to:
-1. Use `PersistentVolumeClaims` instead of `hostPath`.
-2. Enable `runAsNonRoot` and omit hardcoded UIDs to allow OpenShift to assign valid UIDs automatically.
-3. Apply appropriate `seccompProfile` and drop capabilities.
-
-Usage:
-```bash
-helm install seaweedfs seaweedfs/seaweedfs \
-  -n seaweedfs --create-namespace \
-  -f openshift-values.yaml
-```
-
 ## Enterprise

 For enterprise users, please visit [seaweedfs.com](https://seaweedfs.com) for the SeaweedFS Enterprise Edition, 
@@ -1,123 +0,0 @@
-# openshift-values.yaml
-#
-# Example overrides for deploying SeaweedFS on OpenShift (or any cluster
-# enforcing the Kubernetes "restricted" Pod Security Standard).
-#
-# OpenShift's default "restricted" SCC blocks containers that:
-#   - Run as UID 0 (root)
-#   - Request privilege escalation
-#   - Use hostPath volumes
-#   - Omit a seccompProfile
-#
-# These overrides satisfy all four requirements by:
-#   1. Replacing hostPath volumes with PersistentVolumeClaims (or emptyDir for logs)
-#   2. Enabling runAsNonRoot: true. By omitting runAsUser, OpenShift will
-#      automatically assign a valid UID from the namespace's allocated range.
-#   3. Dropping all Linux capabilities and setting allowPrivilegeEscalation: false
-#   4. Enabling RuntimeDefault seccompProfile
-#
-# Usage:
-#   helm install seaweedfs seaweedfs/seaweedfs \
-#     -n seaweedfs --create-namespace \
-#     -f openshift-values.yaml
-#
-# Adjust storageClass and sizes to match your cluster's available StorageClasses.
-# On OpenShift you can discover them with: oc get storageclass
-
-master:
-  data:
-    type: "persistentVolumeClaim"
-    size: "10Gi"
-    storageClass: ""        # leave empty to use the cluster default StorageClass
-
-  logs:
-    type: "emptyDir"        # avoids hostPath; use persistentVolumeClaim if you need log persistence
-
-  podSecurityContext:
-    enabled: true
-    # On OpenShift, we omit runAsUser/runAsGroup/fsGroup to let the admission
-    # controller assign them automatically based on the namespace's SCC.
-    runAsNonRoot: true
-
-  containerSecurityContext:
-    enabled: true
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop: ["ALL"]
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-volume:
-  dataDirs:
-    - name: data1
-      type: "persistentVolumeClaim"
-      size: "100Gi"
-      storageClass: ""      # leave empty to use the cluster default StorageClass
-      maxVolumes: 0
-
-  logs:
-    type: "emptyDir"
-
-  podSecurityContext:
-    enabled: true
-    # On OpenShift, we omit runAsUser/runAsGroup/fsGroup to let the admission
-    # controller assign them automatically based on the namespace's SCC.
-    runAsNonRoot: true
-
-  containerSecurityContext:
-    enabled: true
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop: ["ALL"]
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-filer:
-  data:
-    type: "persistentVolumeClaim"
-    size: "25Gi"
-    storageClass: ""        # leave empty to use the cluster default StorageClass
-
-  logs:
-    type: "emptyDir"
-
-  podSecurityContext:
-    enabled: true
-    # On OpenShift, we omit runAsUser/runAsGroup/fsGroup to let the admission
-    # controller assign them automatically based on the namespace's SCC.
-    runAsNonRoot: true
-
-  containerSecurityContext:
-    enabled: true
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop: ["ALL"]
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
-
-# S3 gateway (if enabled)
-s3:
-  enabled: true
-  replicas: 1
-  port: 8333
-  enableAuth: true
-  podSecurityContext:
-    enabled: true
-    # On OpenShift, we omit runAsUser/runAsGroup/fsGroup to let the admission
-    # controller assign them automatically based on the namespace's SCC.
-    runAsNonRoot: true
-
-  logs:
-    type: "emptyDir"
-
-  containerSecurityContext:
-    enabled: true
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop: ["ALL"]
-    runAsNonRoot: true
-    seccompProfile:
-      type: RuntimeDefault
@@ -118,10 +118,8 @@ spec:
                  fieldPath: metadata.namespace
            - name: SEAWEEDFS_FULLNAME
              value: "{{ include "seaweedfs.fullname" . }}"
-            {{- $mergedExtraEnvironmentVars := dict }}
-            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global "component" .Values.admin "target" $mergedExtraEnvironmentVars) }}
-            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
-            {{- $value := index $mergedExtraEnvironmentVars $key }}
+            {{- if .Values.admin.extraEnvironmentVars }}
+            {{- range $key, $value := .Values.admin.extraEnvironmentVars }}
            - name: {{ $key }}
            {{- if kindIs "string" $value }}
              value: {{ tpl $value $ | quote }}
@@ -130,6 +128,18 @@ spec:
                {{ toYaml $value | nindent 16 | trim }}
            {{- end -}}
            {{- end }}
+            {{- end }}
+            {{- if .Values.global.extraEnvironmentVars }}
+            {{- range $key, $value := .Values.global.extraEnvironmentVars }}
+            - name: {{ $key }}
+            {{- if kindIs "string" $value }}
+              value: {{ tpl $value $ | quote }}
+            {{- else }}
+              valueFrom:
+                {{ toYaml $value | nindent 16 | trim }}
+            {{- end -}}
+            {{- end }}
+            {{- end }}
          command:
            - "/bin/sh"
            - "-ec"
@@ -6,10 +6,6 @@ metadata:
  name: {{ .Values.cosi.bucketClassName }}
 driverName: {{ .Values.cosi.driverName }}
 deletionPolicy: Delete
-{{- with .Values.cosi.bucketClassParameters }}
-parameters:
-  {{- toYaml . | nindent 2 }}
-{{- end }}
 ---
 kind: BucketAccessClass
 apiVersion: objectstorage.k8s.io/v1alpha1
@@ -96,10 +96,8 @@ spec:
            - name: WEED_GRPC_CA
              value: /usr/local/share/ca-certificates/client/ca.crt
            {{- end }}
-            {{- $mergedExtraEnvironmentVars := dict }}
-            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global "component" .Values.cosi "target" $mergedExtraEnvironmentVars) }}
-            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
-            {{- $value := index $mergedExtraEnvironmentVars $key }}
+            {{- if .Values.cosi.extraEnvironmentVars }}
+            {{- range $key, $value := .Values.cosi.extraEnvironmentVars }}
            - name: {{ $key }}
            {{- if kindIs "string" $value }}
              value: {{ tpl $value $ | quote }}
@@ -108,6 +106,18 @@ spec:
                {{ toYaml $value | nindent 16 | trim }}
            {{- end -}}
            {{- end }}
+            {{- end }}
+            {{- if .Values.global.extraEnvironmentVars }}
+            {{- range $key, $value := .Values.global.extraEnvironmentVars }}
+            - name: {{ $key }}
+            {{- if kindIs "string" $value }}
+              value: {{ tpl $value $ | quote }}
+            {{- else }}
+              valueFrom:
+                {{ toYaml $value | nindent 16 | trim }}
+            {{- end -}}
+            {{- end }}
+            {{- end }}
          volumeMounts:
            - mountPath: /var/lib/cosi
              name: socket
@@ -114,10 +114,8 @@ spec:
                  optional: true
            - name: SEAWEEDFS_FULLNAME
              value: "{{ include "seaweedfs.fullname" . }}"
-            {{- $mergedExtraEnvironmentVars := dict }}
-            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global "component" .Values.filer "target" $mergedExtraEnvironmentVars) }}
-            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
-            {{- $value := index $mergedExtraEnvironmentVars $key }}
+            {{- if .Values.filer.extraEnvironmentVars }}
+            {{- range $key, $value := .Values.filer.extraEnvironmentVars }}
            - name: {{ $key }}
            {{- if kindIs "string" $value }}
              value: {{ tpl $value $ | quote }}
@@ -126,6 +124,18 @@ spec:
                {{ toYaml $value | nindent 16 | trim }}
            {{- end -}}
            {{- end }}
+            {{- end }}
+            {{- if .Values.global.extraEnvironmentVars }}
+            {{- range $key, $value := .Values.global.extraEnvironmentVars }}
+            - name: {{ $key }}
+            {{- if kindIs "string" $value }}
+              value: {{ tpl $value $ | quote }}
+            {{- else }}
+              valueFrom:
+                {{ toYaml $value | nindent 16 | trim }}
+            {{- end -}}
+            {{- end }}
+            {{- end }}
            {{- if .Values.filer.secretExtraEnvironmentVars }}
            {{- range $key, $value := .Values.filer.secretExtraEnvironmentVars }}
            - name: {{ $key }}
@@ -69,7 +69,9 @@ spec:
      priorityClassName: {{ .Values.master.priorityClassName | quote }}
      {{- end }}
      enableServiceLinks: false
+      {{- if .Values.global.createClusterRole }}
      serviceAccountName: {{ .Values.master.serviceAccountName | default (include "seaweedfs.serviceAccountName" .) | quote }} # for deleting statefulset pods after migration
+      {{- end }}
      {{- if .Values.master.initContainers }}
      initContainers:
        {{ tpl .Values.master.initContainers . | nindent 8 | trim }}
@@ -96,10 +98,8 @@ spec:
                  fieldPath: metadata.namespace
            - name: SEAWEEDFS_FULLNAME
              value: "{{ include "seaweedfs.fullname" . }}"
-            {{- $mergedExtraEnvironmentVars := dict }}
-            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global "component" .Values.master "target" $mergedExtraEnvironmentVars) }}
-            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
-            {{- $value := index $mergedExtraEnvironmentVars $key }}
+            {{- if .Values.master.extraEnvironmentVars }}
+            {{- range $key, $value := .Values.master.extraEnvironmentVars }}
            - name: {{ $key }}
            {{- if kindIs "string" $value }}
              value: {{ tpl $value $ | quote }}
@@ -108,6 +108,18 @@ spec:
                {{ toYaml $value | nindent 16 | trim }}
            {{- end -}}
            {{- end }}
+            {{- end }}
+            {{- if .Values.global.extraEnvironmentVars }}
+            {{- range $key, $value := .Values.global.extraEnvironmentVars }}
+            - name: {{ $key }}
+            {{- if kindIs "string" $value }}
+              value: {{ tpl $value $ | quote }}
+            {{- else }}
+              valueFrom:
+                {{ toYaml $value | nindent 16 | trim }}
+            {{- end -}}
+            {{- end }}
+            {{- end }}
          command:
            - "/bin/sh"
            - "-ec"
@@ -90,10 +90,8 @@ spec:
                  fieldPath: metadata.namespace
            - name: SEAWEEDFS_FULLNAME
              value: "{{ include "seaweedfs.fullname" . }}"
-            {{- $mergedExtraEnvironmentVars := dict }}
-            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global "component" .Values.s3 "target" $mergedExtraEnvironmentVars) }}
-            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
-            {{- $value := index $mergedExtraEnvironmentVars $key }}
+            {{- if .Values.s3.extraEnvironmentVars }}
+            {{- range $key, $value := .Values.s3.extraEnvironmentVars }}
            - name: {{ $key }}
            {{- if kindIs "string" $value }}
              value: {{ tpl $value $ | quote }}
@@ -102,6 +100,18 @@ spec:
                {{ toYaml $value | nindent 16 | trim }}
            {{- end -}}
            {{- end }}
+            {{- end }}
+            {{- if .Values.global.extraEnvironmentVars }}
+            {{- range $key, $value := .Values.global.extraEnvironmentVars }}
+            - name: {{ $key }}
+            {{- if kindIs "string" $value }}
+              value: {{ tpl $value $ | quote }}
+            {{- else }}
+              valueFrom:
+                {{ toYaml $value | nindent 16 | trim }}
+            {{- end -}}
+            {{- end }}
+            {{- end }}
          command:
            - "/bin/sh"
            - "-ec"
@@ -10,21 +10,10 @@
 {{- if and .Values.s3.reuseLegacySecret $existingSecret }}
 {{- $reuse = true }}
 {{- end }}
-{{- $creds := .Values.s3.credentials | default dict -}}
-{{- $adminCreds := $creds.admin | default dict -}}
-{{- $access_key_admin := $adminCreds.accessKey -}}
-{{- $secret_key_admin := $adminCreds.secretKey -}}
-{{- if not (and $access_key_admin $secret_key_admin) -}}
-  {{- $access_key_admin = include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
-  {{- $secret_key_admin = include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
-{{- end -}}
-{{- $readCreds := $creds.read | default dict -}}
-{{- $access_key_read := $readCreds.accessKey -}}
-{{- $secret_key_read := $readCreds.secretKey -}}
-{{- if not (and $access_key_read $secret_key_read) -}}
-  {{- $access_key_read = include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
-  {{- $secret_key_read = include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
-{{- end -}}
+{{- $access_key_admin := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
+{{- $secret_key_admin := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
+{{- $access_key_read := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
+{{- $secret_key_read := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
 apiVersion: v1
 kind: Secret
 type: Opaque
@@ -54,4 +43,4 @@ stringData:
  s3_auditLogConfig.json: |
    {{ toJson .Values.s3.auditLogConfig | nindent 4 }}
  {{- end }}
-{{- end }}
+{{- end }}
@@ -90,10 +90,8 @@ spec:
                  fieldPath: metadata.namespace
            - name: SEAWEEDFS_FULLNAME
              value: "{{ include "seaweedfs.fullname" . }}"
-            {{- $mergedExtraEnvironmentVars := dict }}
-            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global "component" .Values.sftp "target" $mergedExtraEnvironmentVars) }}
-            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
-            {{- $value := index $mergedExtraEnvironmentVars $key }}
+            {{- if .Values.sftp.extraEnvironmentVars }}
+            {{- range $key, $value := .Values.sftp.extraEnvironmentVars }}
            - name: {{ $key }}
            {{- if kindIs "string" $value }}
              value: {{ tpl $value $ | quote }}
@@ -102,6 +100,18 @@ spec:
                {{ toYaml $value | nindent 16 | trim }}
            {{- end -}}
            {{- end }}
+            {{- end }}
+            {{- if .Values.global.extraEnvironmentVars }}
+            {{- range $key, $value := .Values.global.extraEnvironmentVars }}
+            - name: {{ $key }}
+            {{- if kindIs "string" $value }}
+              value: {{ tpl $value $ | quote }}
+            {{- else }}
+              valueFrom:
+                {{ toYaml $value | nindent 16 | trim }}
+            {{- end -}}
+            {{- end }}
+            {{- end }}
          command:
            - "/bin/sh"
            - "-ec"
@@ -6,7 +6,6 @@ metadata:
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: sftp
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
@@ -59,18 +59,6 @@ Inject extra environment vars in the format key:value, if populated
 {{- end -}}
 {{- end -}}

-{{- define "seaweedfs.mergeExtraEnvironmentVars" -}}
-{{- $global := ((.global | default dict).extraEnvironmentVars | default dict) -}}
-{{- $component := ((.component | default dict).extraEnvironmentVars | default dict) -}}
-{{- $target := .target -}}
-{{- range $key, $value := $global }}
-{{- $_ := set $target $key $value }}
-{{- end }}
-{{- range $key, $value := $component }}
-{{- $_ := set $target $key $value }}
-{{- end }}
-{{- end -}}
-
 {{/* Return the proper filer image */}}
 {{- define "filer.image" -}}
 {{- if .Values.filer.imageOverride -}}
@@ -147,9 +135,7 @@ Inject extra environment vars in the format key:value, if populated
 {{- $repositoryName := default .Values.image.repository .Values.global.repository | toString -}}
 {{- $name := .Values.global.imageName | toString -}}
 {{- $tag := default .Chart.AppVersion .Values.image.tag  | toString -}}
-{{- if .Values.image.repository -}}
-{{-   $name = $repositoryName -}}
-{{- else if $repositoryName -}}
+{{- if $repositoryName -}}
 {{-   $name = printf "%s/%s" (trimSuffix "/" $repositoryName) (base $name) -}}
 {{- end -}}
 {{- if $registryName -}}
@@ -3,15 +3,6 @@
 {{- $s3Enabled := false }}
 {{- $enableAuth := false }}
 {{- $existingConfigSecret := "" }}
-{{- $bucketsFolder := "/buckets" }}
-{{- $bucketEnvVars := merge (dict) (.Values.global.extraEnvironmentVars | default dict) }}
-{{- if .Values.allInOne.enabled }}
-  {{- $bucketEnvVars = merge (.Values.allInOne.extraEnvironmentVars | default dict) $bucketEnvVars }}
-{{- else }}
-  {{- $bucketEnvVars = merge (.Values.filer.extraEnvironmentVars | default dict) $bucketEnvVars }}
-{{- end }}
-{{- $bucketsFolder = default $bucketsFolder (get $bucketEnvVars "WEED_FILER_BUCKETS_FOLDER") }}
-{{- $bucketsFolder = trimSuffix "/" $bucketsFolder }}

 {{- /* Check allInOne mode first */}}
 {{- if .Values.allInOne.enabled }}
@@ -51,7 +42,7 @@ metadata:
  annotations:
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-weight": "-5"
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+    "helm.sh/hook-delete-policy": hook-succeeded
 spec:
  template:
    metadata:
@@ -92,7 +83,6 @@ spec:
          - "/bin/sh"
          - "-ec"
          - |
-            set -o pipefail
            wait_for_service() {
              local url=$1
              local max_attempts=60  # 5 minutes total (5s * 60)
@@ -118,51 +108,15 @@ spec:
            wait_for_service "http://$WEED_CLUSTER_SW_MASTER{{ .Values.master.readinessProbe.httpGet.path }}"
            wait_for_service "http://$WEED_CLUSTER_SW_FILER{{ .Values.filer.readinessProbe.httpGet.path }}"
            {{- end }}
-            {{- range $createBuckets }}
-            {{- $bucketName := .name }}
-            {{- $bucketLock := or .lock .objectLock .withLock }}
-            bucket_list=$(/bin/echo 's3.bucket.list' | /usr/bin/weed shell) || { echo "Error listing s3 buckets"; exit 1; }
-            if echo "$bucket_list" | awk '{print $1}' | grep -Fxq "{{ $bucketName }}"; then
-              echo "Bucket '{{ $bucketName }}' already exists, skipping creation."
+          {{- range $createBuckets }}
+            if /bin/echo "s3.bucket.list" | /usr/bin/weed shell | awk '{print $1}' | grep -Fxq "{{ .name }}"; then
+              echo "Bucket '{{ .name }}' already exists, skipping creation."
            else
-              echo "Creating bucket '{{ $bucketName }}'..."
-              /bin/echo 's3.bucket.create --name {{ $bucketName }}{{- if $bucketLock }} --withLock{{- end }}' | /usr/bin/weed shell
+              echo "Creating bucket '{{ .name }}'..."
+              /bin/echo "s3.bucket.create --name {{ .name }}" | /usr/bin/weed shell
            fi
          {{- end }}
          {{- range $createBuckets }}
-          {{- $bucketLock := or .lock .objectLock .withLock }}
-          {{- if $bucketLock }}
-            /bin/echo 's3.bucket.lock -name {{ .name }} -enable' | /usr/bin/weed shell
-          {{- end }}
-          {{- end }}
-          {{- range $createBuckets }}
-          {{- $bucketVersioning := "" }}
-          {{- if kindIs "bool" .versioning }}
-            {{- if .versioning }}
-              {{- $bucketVersioning = "Enabled" }}
-            {{- end }}
-          {{- else if kindIs "string" .versioning }}
-            {{- $versioningLower := lower .versioning }}
-            {{- if eq $versioningLower "enabled" "enable" "true" }}
-              {{- $bucketVersioning = "Enabled" }}
-            {{- else if eq $versioningLower "suspended" "disable" "false" }}
-              {{- $bucketVersioning = "Suspended" }}
-            {{- else if or (eq .versioning "Enabled") (eq .versioning "Suspended") }}
-              {{- $bucketVersioning = .versioning }}
-            {{- else }}
-              {{- fail (printf "Invalid versioning value for bucket %s: %s. Must be 'Enabled' or 'Suspended'" .name .versioning) }}
-            {{- end }}
-          {{- end }}
-          {{- if $bucketVersioning }}
-            /bin/echo 's3.bucket.versioning -name {{ .name }} -status {{ $bucketVersioning }}' | /usr/bin/weed shell
-          {{- end }}
-          {{- end }}
-          {{- range $createBuckets }}
-          {{- if .ttl }}
-            /bin/echo 'fs.configure -locationPrefix={{ $bucketsFolder }}/{{ .name }}/ -ttl={{ .ttl }} -apply' | /usr/bin/weed shell
-          {{- end }}
-          {{- end }}
-          {{- range $createBuckets }}
          {{- if .anonymousRead }}
            /bin/echo \
            "s3.configure --user anonymous \
@@ -3,10 +3,6 @@ kind: ServiceAccount
 metadata:
  name: {{ include "seaweedfs.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
-  {{- with .Values.global.serviceAccountAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -12,7 +12,6 @@ metadata:
  namespace: {{ $.Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" $ }}
-    app.kubernetes.io/instance: {{ $.Release.Name }}
    app.kubernetes.io/component: {{ $volumeName }}
    helm.sh/chart: {{ $.Chart.Name }}-{{ $.Chart.Version | replace "+" "_" }}
    app.kubernetes.io/managed-by: {{ $.Release.Service }}
@@ -69,7 +69,9 @@ spec:
      priorityClassName: {{ $volume.priorityClassName | quote }}
      {{- end }}
      enableServiceLinks: false
+      {{- if $.Values.global.createClusterRole }}
      serviceAccountName: {{ $volume.serviceAccountName | default (include "seaweedfs.serviceAccountName" $) | quote }} # for deleting statefulset pods after migration
+      {{- end }}
      {{- $initContainers_exists := include "volume.initContainers_exists" $ -}}
      {{- if $initContainers_exists }}
      initContainers:
@@ -116,10 +118,8 @@ spec:
                  fieldPath: status.hostIP
            - name: SEAWEEDFS_FULLNAME
              value: "{{ include "seaweedfs.fullname" $ }}"
-            {{- $mergedExtraEnvironmentVars := dict }}
-            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" $.Values.global "component" $volume "target" $mergedExtraEnvironmentVars) }}
-            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
-            {{- $value := index $mergedExtraEnvironmentVars $key }}
+            {{- if $volume.extraEnvironmentVars }}
+            {{- range $key, $value := $volume.extraEnvironmentVars }}
            - name: {{ $key }}
            {{- if kindIs "string" $value }}
              value: {{ tpl $value $ | quote }}
@@ -128,6 +128,18 @@ spec:
                {{ toYaml $value | nindent 16 | trim }}
            {{- end -}}
            {{- end }}
+            {{- end }}
+            {{- if $.Values.global.extraEnvironmentVars }}
+            {{- range $key, $value := $.Values.global.extraEnvironmentVars }}
+            - name: {{ $key }}
+            {{- if kindIs "string" $value }}
+              value: {{ tpl $value $ | quote }}
+            {{- else }}
+              valueFrom:
+                {{ toYaml $value | nindent 16 | trim }}
+            {{- end -}}
+            {{- end }}
+            {{- end }}
          command:
            - "/bin/sh"
            - "-ec"
@@ -93,10 +93,8 @@ spec:
                  fieldPath: metadata.namespace
            - name: SEAWEEDFS_FULLNAME
              value: "{{ include "seaweedfs.fullname" . }}"
-            {{- $mergedExtraEnvironmentVars := dict }}
-            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global "component" .Values.worker "target" $mergedExtraEnvironmentVars) }}
-            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
-            {{- $value := index $mergedExtraEnvironmentVars $key }}
+            {{- if .Values.worker.extraEnvironmentVars }}
+            {{- range $key, $value := .Values.worker.extraEnvironmentVars }}
            - name: {{ $key }}
            {{- if kindIs "string" $value }}
              value: {{ tpl $value $ | quote }}
@@ -105,6 +103,18 @@ spec:
                {{ toYaml $value | nindent 16 | trim }}
            {{- end -}}
            {{- end }}
+            {{- end }}
+            {{- if .Values.global.extraEnvironmentVars }}
+            {{- range $key, $value := .Values.global.extraEnvironmentVars }}
+            - name: {{ $key }}
+            {{- if kindIs "string" $value }}
+              value: {{ tpl $value $ | quote }}
+            {{- else }}
+              valueFrom:
+                {{ toYaml $value | nindent 16 | trim }}
+            {{- end -}}
+            {{- end }}
+            {{- end }}
          command:
            - "/bin/sh"
            - "-ec"
@@ -126,15 +136,11 @@ spec:
              {{- else }}
              -admin={{ template "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}:{{ .Values.admin.port }}{{ if .Values.admin.grpcPort }}.{{ .Values.admin.grpcPort }}{{ end }} \
              {{- end }}
-              -jobType={{ .Values.worker.jobType }} \
-              -maxDetect={{ .Values.worker.maxDetect }} \
-              -maxExecute={{ .Values.worker.maxExecute }} \
-              -workingDir={{ .Values.worker.workingDir }}{{- if or .Values.worker.metricsPort .Values.worker.metricsIp .Values.worker.extraArgs }} \{{ end }}
+              -capabilities={{ .Values.worker.capabilities }} \
+              -maxConcurrent={{ .Values.worker.maxConcurrent }} \
+              -workingDir={{ .Values.worker.workingDir }}{{- if or .Values.worker.metricsPort .Values.worker.extraArgs }} \{{ end }}
              {{- if .Values.worker.metricsPort }}
-              -metricsPort={{ .Values.worker.metricsPort }}{{- if or .Values.worker.metricsIp .Values.worker.extraArgs }} \{{ end }}
-              {{- end }}
-              {{- if .Values.worker.metricsIp }}
-              -metricsIp={{ .Values.worker.metricsIp }}{{- if .Values.worker.extraArgs }} \{{ end }}
+              -metricsPort={{ .Values.worker.metricsPort }}{{- if .Values.worker.extraArgs }} \{{ end }}
              {{- end }}
              {{- range $index, $arg := .Values.worker.extraArgs }}
              {{ $arg }}{{- if lt $index (sub (len $.Values.worker.extraArgs) 1) }} \{{ end }}
@@ -20,7 +20,6 @@ global:
      filerRead: false
  # we will use this serviceAccountName for all ClusterRoles/ClusterRoleBindings
  serviceAccountName: "seaweedfs"
-  serviceAccountAnnotations: {}
  automountServiceAccountToken: true
  certificates:
    duration: 87600h
@@ -891,22 +890,12 @@ filer:
    # set to the name of an existing kubernetes Secret with the s3 json config file
    # should have a secret key called seaweedfs_s3_config with an inline json configure
    existingConfigSecret: null
-    # To provide explicit credentials for the S3 gateway, set them under
-    # the top-level s3.credentials key (not filer.s3.credentials).
-    # The s3-secret.yaml template only reads from .Values.s3.credentials.
-    # See: s3.credentials.admin.accessKey, s3.credentials.read.accessKey
    auditLogConfig: {}
    # You may specify buckets to be created during the install or upgrade process.
    # Buckets may be exposed publicly by setting `anonymousRead` to `true`
-    # ttl format: [1-255][m|h|d|w|M|y] (e.g., 7d)
-    # objectLock enables S3 Object Lock (irreversible, forces versioning)
-    # versioning: Enabled or Suspended (or true to enable)
    # createBuckets:
    #   - name: bucket-a
    #     anonymousRead: true
-    #     ttl: 7d
-    #     objectLock: true
-    #     versioning: Enabled
    #   - name: bucket-b
    #     anonymousRead: false

@@ -929,28 +918,12 @@ s3:
  # set to the name of an existing kubernetes Secret with the s3 json config file
  # should have a secret key called seaweedfs_s3_config with an inline json config
  existingConfigSecret: null
-  # Optionally provide explicit credentials for the S3 gateway.
-  # When set, these are used in the generated s3 secret instead of
-  # auto-generating random credentials.
-  # credentials:
-  #   admin:
-  #     accessKey: ""
-  #     secretKey: ""
-  #   read:
-  #     accessKey: ""
-  #     secretKey: ""
  auditLogConfig: {}
  # You may specify buckets to be created during the install or upgrade process.
  # Buckets may be exposed publicly by setting `anonymousRead` to `true`
-  # ttl format: [1-255][m|h|d|w|M|y] (e.g., 7d)
-  # objectLock enables S3 Object Lock (irreversible, forces versioning)
-  # versioning: Enabled or Suspended (or true to enable)
  # createBuckets:
  #   - name: bucket-a
  #     anonymousRead: true
-  #     ttl: 7d
-  #     objectLock: true
-  #     versioning: Enabled
  #   - name: bucket-b
  #     anonymousRead: false

@@ -1297,20 +1270,17 @@ worker:
  replicas: 1
  loggingOverrideLevel: null
  metricsPort: 9327
-  metricsIp: ""  # If empty, defaults to 0.0.0.0

  # Admin server to connect to
  adminServer: ""

-  # Worker job types - comma-separated list
-  # Available: vacuum, volume_balance, erasure_coding
-  jobType: "vacuum,volume_balance,erasure_coding"
+  # Worker capabilities - comma-separated list
+  # Available: vacuum, balance, erasure_coding
+  # Default: "vacuum,balance,erasure_coding" (all capabilities)
+  capabilities: "vacuum,balance,erasure_coding"

-  # Maximum number of concurrent detection requests
-  maxDetect: 1
-
-  # Maximum number of concurrent execution jobs
-  maxExecute: 4
+  # Maximum number of concurrent tasks
+  maxConcurrent: 3

  # Working directory for task execution
  workingDir: "/tmp/seaweedfs-worker"
@@ -1448,22 +1418,12 @@ allInOne:
    # Set to the name of an existing kubernetes Secret with the s3 json config file
    # should have a secret key called seaweedfs_s3_config with an inline json config
    existingConfigSecret: null
-    # To provide explicit credentials for the S3 gateway, set them under
-    # the top-level s3.credentials key (not allInOne.s3.credentials).
-    # The s3-secret.yaml template only reads from .Values.s3.credentials.
-    # See: s3.credentials.admin.accessKey, s3.credentials.read.accessKey
    auditLogConfig: null  # S3 audit log configuration (null inherits from s3.auditLogConfig)
    # You may specify buckets to be created during the install process.
    # Buckets may be exposed publicly by setting `anonymousRead` to `true`
-    # ttl format: [1-255][m|h|d|w|M|y] (e.g., 7d)
-    # objectLock enables S3 Object Lock (irreversible, forces versioning)
-    # versioning: Enabled or Suspended (or true to enable)
    # createBuckets:
    #   - name: bucket-a
    #     anonymousRead: true
-    #     ttl: 7d
-    #     objectLock: true
-    #     versioning: Enabled
    #   - name: bucket-b
    #     anonymousRead: false

@@ -1629,8 +1589,6 @@ cosi:
  image: "ghcr.io/seaweedfs/seaweedfs-cosi-driver:v0.1.2"
  driverName: "seaweedfs.objectstorage.k8s.io"
  bucketClassName: "seaweedfs"
-  # Optional parameters to pass to the default BucketClass (e.g., diskType for tiered storage)
-  bucketClassParameters: {}
  endpoint: ""
  region: ""

@@ -148,7 +148,7 @@ func waitForServer(url string, timeout time.Duration) bool {
 func testProtobufMarshaling() error {
 	// Test protobuf marshaling/unmarshaling
 	testData := &proto.TelemetryData{
-		TopologyId:        "test-cluster-12345",
+		ClusterId:         "test-cluster-12345",
 		Version:           "test-3.45",
 		Os:                "linux/amd64",
 		VolumeServerCount: 2,
@@ -2,11 +2,13 @@ package admin_dockertest

 import (
 	"bytes"
-	crand "crypto/rand"
 	"encoding/json"
 	"fmt"
 	"io"
+	"io/ioutil"
+	"math/rand"
 	"net/http"
+	"net/url"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -153,155 +155,135 @@ func waitForUrl(t *testing.T, url string, retries int) {
 	t.Fatalf("Timeout waiting for %s", url)
 }

-func fetchJSON(url string, out interface{}) error {
-	resp, err := http.Get(url)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
-		return fmt.Errorf("status %d: %s", resp.StatusCode, string(body))
-	}
-	return json.NewDecoder(resp.Body).Decode(out)
-}
-
-func mapField(obj map[string]interface{}, key string) (interface{}, bool) {
-	if obj == nil {
-		return nil, false
-	}
-	if value, ok := obj[key]; ok {
-		return value, true
-	}
-	return nil, false
-}
-
-func mapFieldAny(obj map[string]interface{}, keys ...string) (interface{}, bool) {
-	for _, key := range keys {
-		if value, ok := mapField(obj, key); ok {
-			return value, true
-		}
-	}
-	return nil, false
-}
-
 func TestEcEndToEnd(t *testing.T) {
 	defer cleanup()
 	ensureEnvironment(t)

 	client := &http.Client{}

-	// 1. Configure plugin job types for fast EC detection/execution.
-	t.Log("Configuring plugin job types via API...")
+	// 1. Configure Global Maintenance (Scan Interval = 1s) via API
+	t.Log("Configuring Global Maintenance via API...")

-	schedulerConfig := map[string]interface{}{
-		"idle_sleep_seconds": 1,
-	}
-	jsonBody, err := json.Marshal(schedulerConfig)
-	if err != nil {
-		t.Fatalf("Failed to marshal scheduler config: %v", err)
-	}
-	req, err := http.NewRequest("PUT", AdminUrl+"/api/plugin/scheduler-config", bytes.NewBuffer(jsonBody))
-	if err != nil {
-		t.Fatalf("Failed to create scheduler config request: %v", err)
-	}
-	req.Header.Set("Content-Type", "application/json")
+	// 1.1 Fetch current config
+	req, _ := http.NewRequest("GET", AdminUrl+"/api/maintenance/config", nil)
 	resp, err := client.Do(req)
 	if err != nil {
-		t.Fatalf("Failed to update scheduler config: %v", err)
+		t.Fatalf("Failed to get global config: %v", err)
 	}
 	if resp.StatusCode != http.StatusOK {
 		body, _ := io.ReadAll(resp.Body)
-		t.Fatalf("Failed to update scheduler config (status %d): %s", resp.StatusCode, string(body))
+		t.Fatalf("Failed to get global config (status %d): %s", resp.StatusCode, string(body))
+	}
+
+	var globalConfig map[string]interface{}
+	if err := json.NewDecoder(resp.Body).Decode(&globalConfig); err != nil {
+		t.Fatalf("Failed to decode global config: %v", err)
 	}
 	resp.Body.Close()

-	// Disable volume balance to reduce interference for this EC-focused test.
-	balanceConfig := map[string]interface{}{
-		"job_type": "volume_balance",
-		"admin_runtime": map[string]interface{}{
-			"enabled": false,
-		},
+	// 1.2 Modify config
+	globalConfig["enabled"] = true
+	globalConfig["scan_interval_seconds"] = 1
+
+	// Ensure policy structure exists
+	if globalConfig["policy"] == nil {
+		globalConfig["policy"] = map[string]interface{}{}
 	}
-	jsonBody, err = json.Marshal(balanceConfig)
-	if err != nil {
-		t.Fatalf("Failed to marshal volume_balance config: %v", err)
+	policy, _ := globalConfig["policy"].(map[string]interface{})
+
+	// Ensure task_policies structure exists
+	if policy["task_policies"] == nil {
+		policy["task_policies"] = map[string]interface{}{}
 	}
-	req, err = http.NewRequest("PUT", AdminUrl+"/api/plugin/job-types/volume_balance/config", bytes.NewBuffer(jsonBody))
-	if err != nil {
-		t.Fatalf("Failed to create volume_balance config request: %v", err)
+	taskPolicies, _ := policy["task_policies"].(map[string]interface{})
+
+	// Disable balance tasks to avoid interference with EC test
+	if taskPolicies["balance"] == nil {
+		taskPolicies["balance"] = map[string]interface{}{}
 	}
+	balancePolicy, _ := taskPolicies["balance"].(map[string]interface{})
+	balancePolicy["enabled"] = false
+
+	// Set global max concurrent
+	policy["global_max_concurrent"] = 4
+	globalConfig["policy"] = policy
+
+	// Explicitly set required fields
+	requiredFields := map[string]float64{
+		"worker_timeout_seconds":   300,
+		"task_timeout_seconds":     7200,
+		"retry_delay_seconds":      900,
+		"cleanup_interval_seconds": 86400,
+		"task_retention_seconds":   604800,
+		"max_retries":              3,
+	}
+	for field, val := range requiredFields {
+		if _, ok := globalConfig[field]; !ok || globalConfig[field] == 0 {
+			globalConfig[field] = val
+		}
+	}
+
+	// 1.3 Update config
+	jsonBody, _ := json.Marshal(globalConfig)
+	req, _ = http.NewRequest("PUT", AdminUrl+"/api/maintenance/config", bytes.NewBuffer(jsonBody))
 	req.Header.Set("Content-Type", "application/json")
 	resp, err = client.Do(req)
 	if err != nil {
-		t.Fatalf("Failed to update volume_balance config: %v", err)
+		t.Fatalf("Failed to update global config: %v", err)
 	}
 	if resp.StatusCode != http.StatusOK {
 		body, _ := io.ReadAll(resp.Body)
-		t.Fatalf("Failed to update volume_balance config (status %d): %s", resp.StatusCode, string(body))
+		t.Fatalf("Failed to update global config (status %d): %s", resp.StatusCode, string(body))
 	}
 	resp.Body.Close()

-	ecConfig := map[string]interface{}{
-		"job_type": "erasure_coding",
-		"admin_runtime": map[string]interface{}{
-			"enabled":                          true,
-			"detection_interval_seconds":       1,
-			"global_execution_concurrency":     4,
-			"per_worker_execution_concurrency": 4,
-			"max_jobs_per_detection":           100,
-		},
-		"worker_config_values": map[string]interface{}{
-			"quiet_for_seconds": map[string]interface{}{
-				"int64_value": "1",
-			},
-			"min_interval_seconds": map[string]interface{}{
-				"int64_value": "1",
-			},
-			"min_size_mb": map[string]interface{}{
-				"int64_value": "1",
-			},
-			"fullness_ratio": map[string]interface{}{
-				"double_value": 0.0001,
-			},
-		},
-	}
-	jsonBody, err = json.Marshal(ecConfig)
-	if err != nil {
-		t.Fatalf("Failed to marshal erasure_coding config: %v", err)
-	}
-	req, err = http.NewRequest("PUT", AdminUrl+"/api/plugin/job-types/erasure_coding/config", bytes.NewBuffer(jsonBody))
-	if err != nil {
-		t.Fatalf("Failed to create erasure_coding config request: %v", err)
-	}
-	req.Header.Set("Content-Type", "application/json")
+	// 2. Configure EC Task (Short intervals) via Form API
+	t.Log("Configuring EC Task via Form API...")
+	formData := url.Values{}
+	formData.Set("enabled", "true")
+	formData.Set("scan_interval_seconds", "1")
+	formData.Set("repeat_interval_seconds", "1")
+	formData.Set("check_interval_seconds", "1")
+	formData.Set("max_concurrent", "4")
+	formData.Set("quiet_for_seconds_value", "1")
+	formData.Set("quiet_for_seconds_unit", "seconds")
+	formData.Set("min_size_mb", "1")
+	formData.Set("fullness_ratio", "0.0001")
+
+	req, _ = http.NewRequest("POST", AdminUrl+"/maintenance/config/erasure_coding", strings.NewReader(formData.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 	resp, err = client.Do(req)
 	if err != nil {
-		t.Fatalf("Failed to update erasure_coding config: %v", err)
+		t.Fatalf("Failed to update EC config: %v", err)
 	}
-	if resp.StatusCode != http.StatusOK {
+	if resp.StatusCode != 200 && resp.StatusCode != 303 {
 		body, _ := io.ReadAll(resp.Body)
-		t.Fatalf("Failed to update erasure_coding config (status %d): %s", resp.StatusCode, string(body))
+		t.Fatalf("Failed to update EC config (status %d): %s", resp.StatusCode, string(body))
 	}
 	resp.Body.Close()
+	t.Log("EC Task Configuration updated")

-	// 2. Upload a file
+	// 3. Restart Admin to pick up Global Config (Scan Interval)
+	if len(runningCmds) > 0 {
+		adminCmd := runningCmds[len(runningCmds)-1]
+		t.Log("Restarting Admin Server to apply configuration...")
+		stopWeed(t, adminCmd)
+		time.Sleep(10 * time.Second)
+		startWeed(t, "admin_restarted", "admin", "-master=localhost:9333", "-port=23646", "-port.grpc=33646", "-dataDir=./tmp/admin")
+		waitForUrl(t, AdminUrl+"/health", 60)
+	}
+
+	// 4. Upload a file
 	fileSize := 5 * 1024 * 1024
 	data := make([]byte, fileSize)
-	crand.Read(data)
+	rand.Read(data)
 	fileName := fmt.Sprintf("ec_test_file_%d", time.Now().Unix())
 	t.Logf("Uploading %d bytes file %s to Filer...", fileSize, fileName)
 	uploadUrl := FilerUrl + "/" + fileName

 	var uploadErr error
 	for i := 0; i < 10; i++ {
-		req, err := http.NewRequest("PUT", uploadUrl, bytes.NewBuffer(data))
-		if err != nil {
-			uploadErr = err
-			t.Logf("Upload attempt %d failed to create request: %v", i+1, err)
-			time.Sleep(2 * time.Second)
-			continue
-		}
+		req, _ := http.NewRequest("PUT", uploadUrl, bytes.NewBuffer(data))
 		resp, err := client.Do(req)
 		if err == nil {
 			if resp.StatusCode == 201 {
@@ -324,18 +306,17 @@ func TestEcEndToEnd(t *testing.T) {
 	}
 	t.Log("Upload successful")

-	// 3. Verify EC Encoding
+	// 5. Verify EC Encoding
 	t.Log("Waiting for EC encoding (checking Master topology)...")
 	startTime := time.Now()
 	ecVerified := false
 	var lastBody []byte
-	debugTick := 0

 	for time.Since(startTime) < 300*time.Second {
-		// 3.1 Check Master Topology
+		// 5.1 Check Master Topology
 		resp, err := http.Get(MasterUrl + "/dir/status")
 		if err == nil {
-			lastBody, _ = io.ReadAll(resp.Body)
+			lastBody, _ = ioutil.ReadAll(resp.Body)
 			resp.Body.Close()

 			// Check total EC shards
@@ -355,104 +336,25 @@ func TestEcEndToEnd(t *testing.T) {
 			}
 		}

-		// 3.2 Debug: Check workers, jobs, and scheduler status
-		debugTick++
-
-		var workers []map[string]interface{}
+		// 5.2 Debug: Check workers and tasks
+		wResp, wErr := http.Get(AdminUrl + "/api/maintenance/workers")
 		workerCount := 0
-		ecDetectorCount := 0
-		ecExecutorCount := 0
-		if err := fetchJSON(AdminUrl+"/api/plugin/workers", &workers); err == nil {
+		if wErr == nil {
+			var workers []interface{}
+			json.NewDecoder(wResp.Body).Decode(&workers)
+			wResp.Body.Close()
 			workerCount = len(workers)
-			for _, worker := range workers {
-				capsValue, ok := mapFieldAny(worker, "capabilities", "Capabilities")
-				if !ok {
-					continue
-				}
-				caps, ok := capsValue.(map[string]interface{})
-				if !ok {
-					continue
-				}
-				if capValue, ok := caps["erasure_coding"].(map[string]interface{}); ok {
-					if capValue["can_detect"] == true {
-						ecDetectorCount++
-					}
-					if capValue["can_execute"] == true {
-						ecExecutorCount++
-					}
-				}
-			}
 		}

-		var tasks []map[string]interface{}
+		tResp, tErr := http.Get(AdminUrl + "/api/maintenance/tasks")
 		taskCount := 0
-		ecTaskCount := 0
-		ecTaskStates := map[string]int{}
-		if err := fetchJSON(AdminUrl+"/api/plugin/jobs?limit=1000", &tasks); err == nil {
+		if tErr == nil {
+			var tasks []interface{}
+			json.NewDecoder(tResp.Body).Decode(&tasks)
+			tResp.Body.Close()
 			taskCount = len(tasks)
-			for _, task := range tasks {
-				jobType, _ := task["job_type"].(string)
-				state, _ := task["state"].(string)
-				if jobType == "erasure_coding" {
-					ecTaskCount++
-					ecTaskStates[state]++
-				}
-			}
-		}
-
-		t.Logf("Waiting for EC... (Workers: %d det=%d exec=%d, Tasks: %d ec=%d, EC States: %+v)",
-			workerCount, ecDetectorCount, ecExecutorCount, taskCount, ecTaskCount, ecTaskStates)
-
-		if debugTick%3 == 0 {
-			var pluginStatus map[string]interface{}
-			if err := fetchJSON(AdminUrl+"/api/plugin/status", &pluginStatus); err == nil {
-				t.Logf("Plugin status: enabled=%v worker_count=%v worker_grpc_port=%v configured=%v",
-					pluginStatus["enabled"], pluginStatus["worker_count"], pluginStatus["worker_grpc_port"], pluginStatus["configured"])
-			}
-
-			var schedulerStatus map[string]interface{}
-			if err := fetchJSON(AdminUrl+"/api/plugin/scheduler-status", &schedulerStatus); err == nil {
-				if schedValue, ok := schedulerStatus["scheduler"].(map[string]interface{}); ok {
-					t.Logf("Scheduler status: current_job_type=%v phase=%v last_iteration_had_jobs=%v idle_sleep_seconds=%v last_iteration_done_at=%v next_detection_at=%v",
-						schedValue["current_job_type"], schedValue["current_phase"],
-						schedValue["last_iteration_had_jobs"], schedValue["idle_sleep_seconds"], schedValue["last_iteration_done_at"], schedValue["next_detection_at"])
-				} else {
-					t.Logf("Scheduler status: %v", schedulerStatus)
-				}
-			}
-
-			var schedulerStates []map[string]interface{}
-			if err := fetchJSON(AdminUrl+"/api/plugin/scheduler-states", &schedulerStates); err == nil {
-				for _, state := range schedulerStates {
-					if state["job_type"] == "erasure_coding" {
-						t.Logf("EC scheduler state: enabled=%v detection_in_flight=%v detector_available=%v executor_workers=%v next_detection_at=%v last_run_status=%v last_run_started_at=%v last_run_completed_at=%v",
-							state["enabled"], state["detection_in_flight"], state["detector_available"],
-							state["executor_worker_count"], state["next_detection_at"], state["last_run_status"],
-							state["last_run_started_at"], state["last_run_completed_at"])
-						break
-					}
-				}
-			}
-
-			var jobTypes []map[string]interface{}
-			if err := fetchJSON(AdminUrl+"/api/plugin/job-types", &jobTypes); err == nil {
-				var names []string
-				for _, jobType := range jobTypes {
-					if name, ok := jobType["job_type"].(string); ok && name != "" {
-						names = append(names, name)
-					}
-				}
-				t.Logf("Plugin job types: %v", names)
-			}
-
-			var activities []map[string]interface{}
-			if err := fetchJSON(AdminUrl+"/api/plugin/activities?job_type=erasure_coding&limit=5", &activities); err == nil {
-				for i := len(activities) - 1; i >= 0; i-- {
-					act := activities[i]
-					t.Logf("EC activity: stage=%v message=%v occurred_at=%v", act["stage"], act["message"], act["occurred_at"])
-				}
-			}
 		}
+		t.Logf("Waiting for EC... (Workers: %d, Active Tasks: %d)", workerCount, taskCount)

 		time.Sleep(10 * time.Second)
 	}
@@ -1,4 +1,5 @@
 //go:build foundationdb
+// +build foundationdb

 package foundationdb

@@ -1,4 +1,5 @@
 //go:build foundationdb
+// +build foundationdb

 package foundationdb

@@ -21,7 +21,7 @@
        <scala.binary.version>2.12</scala.binary.version>
        <junit.version>4.13.2</junit.version>
        <seaweedfs.hadoop3.client.version>4.00</seaweedfs.hadoop3.client.version>
-        <jackson.version>2.18.6</jackson.version> <!-- Upgraded from 2.15.3 -->
+        <jackson.version>2.18.2</jackson.version> <!-- Upgraded from 2.15.3 -->
        <netty.version>4.1.129.Final</netty.version> <!-- Upgraded to 4.1.125.Final for security fixes (CVE in netty-codec < 4.1.125.Final, netty-codec-http2 <= 4.1.123.Final) -->
        <parquet.version>1.15.2</parquet.version> <!-- Upgraded to 1.15.2 for security fix -->
        <parquet.format.version>2.12.0</parquet.format.version>
@@ -16,9 +16,8 @@ RUN go mod download
 # Copy source code
 COPY . .

-# Build the weed binaries with Kafka gateway support
+# Build the weed binary with Kafka gateway support
 RUN CGO_ENABLED=1 GOOS=linux go build -a -installsuffix cgo -ldflags '-extldflags "-static"' -o weed ./weed
-RUN CGO_ENABLED=1 GOOS=linux go build -a -installsuffix cgo -ldflags '-extldflags "-static"' -o weed-sql ./cmd/weed-sql

 # Final stage
 FROM alpine:latest
@@ -33,9 +32,8 @@ RUN addgroup -g 1000 seaweedfs && \
 # Set working directory
 WORKDIR /usr/bin

-# Copy binaries from builder
+# Copy binary from builder
 COPY --from=builder /app/weed .
-COPY --from=builder /app/weed-sql .

 # Create data directory
 RUN mkdir -p /data && chown seaweedfs:seaweedfs /data
@@ -8,7 +8,7 @@ require (
 	github.com/seaweedfs/seaweedfs v0.0.0-00010101000000-000000000000
 	github.com/segmentio/kafka-go v0.4.49
 	github.com/stretchr/testify v1.11.1
-	google.golang.org/grpc v1.78.0
+	google.golang.org/grpc v1.77.0
 )

 replace github.com/seaweedfs/seaweedfs => ../../
@@ -17,15 +17,14 @@ require (
 	cloud.google.com/go/auth v0.17.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.4 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/storage/azfile v1.5.3 // indirect
-	github.com/Azure/go-ntlmssp v0.1.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.3 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/storage/azfile v1.5.2 // indirect
+	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect
-	github.com/FilenCloudDienste/filen-sdk-go v0.0.37 // indirect
-	github.com/Files-com/files-sdk-go/v3 v3.2.264 // indirect
+	github.com/Files-com/files-sdk-go/v3 v3.2.218 // indirect
 	github.com/IBM/go-sdk-core/v5 v5.21.0 // indirect
 	github.com/Max-Sum/base32768 v0.0.0-20230304063302-18e6ce5945fd // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
@@ -36,58 +35,51 @@ require (
 	github.com/ProtonMail/go-srp v0.0.7 // indirect
 	github.com/ProtonMail/gopenpgp/v2 v2.9.0 // indirect
 	github.com/PuerkitoBio/goquery v1.10.3 // indirect
-	github.com/a1ex3/zstd-seekable-format-go/pkg v0.10.0 // indirect
 	github.com/abbot/go-http-auth v0.4.0 // indirect
-	github.com/anchore/go-lzo v0.1.0 // indirect
 	github.com/andybalholm/brotli v1.2.0 // indirect
 	github.com/andybalholm/cascadia v1.3.3 // indirect
 	github.com/appscode/go-querystring v0.0.0-20170504095604-0126cfb3f1dc // indirect
+	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/aws/aws-sdk-go v1.55.8 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.41.1 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.41.0 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.32.7 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.7 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.4 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.32.6 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.6 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.16 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.16 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.15 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.16 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.0.5 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.41.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.93.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.0.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.30.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.12 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.41.5 // indirect
 	github.com/aws/smithy-go v1.24.0 // indirect
-	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/boombuler/barcode v1.1.0 // indirect
 	github.com/bradenaw/juniper v0.15.3 // indirect
 	github.com/bradfitz/iter v0.0.0-20191230175014-e8f45d346db8 // indirect
 	github.com/buengese/sgzip v0.1.1 // indirect
-	github.com/buger/jsonparser v1.1.1 // indirect
+	github.com/bufbuild/protocompile v0.14.1 // indirect
 	github.com/calebcase/tmpfile v1.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chilts/sid v0.0.0-20190607042430-660e94789ec9 // indirect
-	github.com/clipperhouse/stringish v0.1.1 // indirect
-	github.com/clipperhouse/uax29/v2 v2.3.0 // indirect
-	github.com/cloudflare/circl v1.6.3 // indirect
-	github.com/cloudinary/cloudinary-go/v2 v2.13.0 // indirect
+	github.com/cloudflare/circl v1.6.1 // indirect
+	github.com/cloudinary/cloudinary-go/v2 v2.12.0 // indirect
 	github.com/cloudsoda/go-smb2 v0.0.0-20250228001242-d4c70e6251cc // indirect
 	github.com/cloudsoda/sddl v0.0.0-20250224235906-926454e91efc // indirect
 	github.com/cognusion/imaging v1.0.2 // indirect
 	github.com/colinmarc/hdfs/v2 v2.4.0 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
-	github.com/coreos/go-systemd/v22 v22.6.0 // indirect
+	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
 	github.com/creasty/defaults v1.8.0 // indirect
 	github.com/cronokirby/saferith v0.33.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/diskfs/go-diskfs v1.7.0 // indirect
-	github.com/dromara/dongle v1.0.1 // indirect
 	github.com/dropbox/dropbox-sdk-go-unofficial/v6 v6.0.5 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/eapache/go-resiliency v1.7.0 // indirect
@@ -99,26 +91,25 @@ require (
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/flynn/noise v1.1.0 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.11 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.9 // indirect
 	github.com/geoffgarside/ber v1.2.0 // indirect
-	github.com/go-chi/chi/v5 v5.2.5 // indirect
+	github.com/go-chi/chi/v5 v5.2.2 // indirect
 	github.com/go-darwin/apfs v0.0.0-20211011131704-f84b94dbf348 // indirect
-	github.com/go-git/go-billy/v5 v5.6.2 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
-	github.com/go-openapi/errors v0.22.4 // indirect
-	github.com/go-openapi/strfmt v0.25.0 // indirect
+	github.com/go-openapi/errors v0.22.2 // indirect
+	github.com/go-openapi/strfmt v0.23.0 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
-	github.com/go-playground/validator/v10 v10.28.0 // indirect
+	github.com/go-playground/validator/v10 v10.27.0 // indirect
 	github.com/go-resty/resty/v2 v2.16.5 // indirect
 	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
-	github.com/gofrs/flock v0.13.0 // indirect
+	github.com/gofrs/flock v0.12.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
-	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
+	github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/golang/snappy v1.0.0 // indirect
 	github.com/google/btree v1.1.3 // indirect
@@ -133,83 +124,78 @@ require (
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
-	github.com/internxt/rclone-adapter v0.0.0-20260213125353-6f59c89fcb7c // indirect
+	github.com/henrybear327/Proton-API-Bridge v1.0.0 // indirect
+	github.com/henrybear327/go-proton-api v1.0.0 // indirect
 	github.com/jcmturner/aescts/v2 v2.0.0 // indirect
 	github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect
 	github.com/jcmturner/gofork v1.7.6 // indirect
 	github.com/jcmturner/goidentity/v6 v6.0.1 // indirect
 	github.com/jcmturner/gokrb5/v8 v8.4.4 // indirect
 	github.com/jcmturner/rpc/v2 v2.0.3 // indirect
-	github.com/jhump/protoreflect v1.18.0 // indirect
-	github.com/jhump/protoreflect/v2 v2.0.0-beta.1 // indirect
+	github.com/jhump/protoreflect v1.17.0 // indirect
 	github.com/jlaffaye/ftp v0.2.1-0.20240918233326-1b970516f5d3 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/jtolds/gls v4.20.0+incompatible // indirect
 	github.com/jtolio/noiseconn v0.0.0-20231127013910-f6d9ecbf1de7 // indirect
 	github.com/jzelinskie/whirlpool v0.0.0-20201016144138-0675e54bb004 // indirect
 	github.com/karlseguin/ccache/v2 v2.0.8 // indirect
-	github.com/klauspost/compress v1.18.4 // indirect
+	github.com/klauspost/compress v1.18.2 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
-	github.com/klauspost/reedsolomon v1.13.0 // indirect
+	github.com/klauspost/reedsolomon v1.12.6 // indirect
 	github.com/koofr/go-httpclient v0.0.0-20240520111329-e20f8f203988 // indirect
 	github.com/koofr/go-koofrclient v0.0.0-20221207135200-cbd7fc9ad6a6 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
-	github.com/lanrat/extsort v1.4.2 // indirect
+	github.com/lanrat/extsort v1.4.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/lpar/date v1.0.0 // indirect
-	github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 // indirect
-	github.com/mailru/easyjson v0.9.1 // indirect
+	github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mattn/go-runewidth v0.0.19 // indirect
+	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/mapstructure v1.5.1-0.20220423185008-bf980b35cac4 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/ncw/swift/v2 v2.0.5 // indirect
+	github.com/ncw/swift/v2 v2.0.4 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
-	github.com/oracle/oci-go-sdk/v65 v65.104.0 // indirect
+	github.com/oracle/oci-go-sdk/v65 v65.98.0 // indirect
 	github.com/orcaman/concurrent-map/v2 v2.0.1 // indirect
 	github.com/panjf2000/ants/v2 v2.11.3 // indirect
-	github.com/parquet-go/bitpack v1.0.0 // indirect
-	github.com/parquet-go/jsonlite v1.0.0 // indirect
-	github.com/parquet-go/parquet-go v0.26.4 // indirect
+	github.com/parquet-go/parquet-go v0.26.3 // indirect
 	github.com/patrickmn/go-cache v2.1.0+incompatible // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pengsrc/go-shared v0.2.1-0.20190131101655-1999055a4a14 // indirect
 	github.com/peterh/liner v1.2.2 // indirect
-	github.com/petermattis/goid v0.0.0-20260113132338-7c7de50cc741 // indirect
-	github.com/pierrec/lz4/v4 v4.1.25 // indirect
+	github.com/pierrec/lz4/v4 v4.1.22 // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.10 // indirect
 	github.com/pkg/xattr v0.4.12 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
-	github.com/pquerna/otp v1.5.0 // indirect
 	github.com/prometheus/client_golang v1.23.2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.67.2 // indirect
+	github.com/prometheus/common v0.66.1 // indirect
 	github.com/prometheus/procfs v0.19.2 // indirect
 	github.com/putdotio/go-putio/putio v0.0.0-20200123120452-16d982cac2b8 // indirect
-	github.com/quic-go/qpack v0.6.0 // indirect
-	github.com/rclone/Proton-API-Bridge v1.0.1-0.20260127174007-77f974840d11 // indirect
-	github.com/rclone/go-proton-api v1.0.1-0.20260127173028-eb465cac3b18 // indirect
-	github.com/rclone/rclone v1.73.1 // indirect
+	github.com/rclone/rclone v1.71.2 // indirect
 	github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 // indirect
 	github.com/rdleal/intervalst v1.5.0 // indirect
-	github.com/relvacode/iso8601 v1.7.0 // indirect
+	github.com/relvacode/iso8601 v1.6.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rfjakob/eme v1.1.2 // indirect
+	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
-	github.com/samber/lo v1.52.0 // indirect
+	github.com/samber/lo v1.51.0 // indirect
 	github.com/seaweedfs/goexif v1.0.3 // indirect
-	github.com/shirou/gopsutil/v4 v4.26.1 // indirect
-	github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af // indirect
+	github.com/shirou/gopsutil/v4 v4.25.11 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
 	github.com/smarty/assertions v1.16.0 // indirect
 	github.com/sony/gobreaker v1.0.0 // indirect
 	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
-	github.com/spacemonkeygo/monkit/v3 v3.0.25-0.20251022131615-eb24eb109368 // indirect
+	github.com/spacemonkeygo/monkit/v3 v3.0.24 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
@@ -217,18 +203,15 @@ require (
 	github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/syndtr/goleveldb v1.0.1-0.20190318030020-c3a204f8e965 // indirect
-	github.com/t3rm1n4l/go-mega v0.0.0-20251031123324-a804aaa87491 // indirect
+	github.com/t3rm1n4l/go-mega v0.0.0-20250926104142-ccb8d3498e6c // indirect
 	github.com/tklauser/go-sysconf v0.3.16 // indirect
 	github.com/tklauser/numcpus v0.11.0 // indirect
-	github.com/tyler-smith/go-bip39 v1.1.0 // indirect
 	github.com/tylertreat/BoomFilters v0.0.0-20210315201527-1a82519a3e43 // indirect
-	github.com/ulikunitz/xz v0.5.15 // indirect
 	github.com/unknwon/goconfig v1.0.0 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/viant/ptrie v1.0.1 // indirect
-	github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
-	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
@@ -237,24 +220,24 @@ require (
 	github.com/zeebo/blake3 v0.2.4 // indirect
 	github.com/zeebo/errs v1.4.0 // indirect
 	github.com/zeebo/xxh3 v1.0.2 // indirect
-	go.etcd.io/bbolt v1.4.3 // indirect
+	go.etcd.io/bbolt v1.4.2 // indirect
 	go.mongodb.org/mongo-driver v1.17.6 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 // indirect
 	go.opentelemetry.io/otel v1.38.0 // indirect
 	go.opentelemetry.io/otel/metric v1.38.0 // indirect
 	go.opentelemetry.io/otel/trace v1.38.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.48.0 // indirect
-	golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 // indirect
-	golang.org/x/image v0.36.0 // indirect
-	golang.org/x/net v0.49.0 // indirect
+	golang.org/x/crypto v0.46.0 // indirect
+	golang.org/x/exp v0.0.0-20250811191247-51f88131bc50 // indirect
+	golang.org/x/image v0.34.0 // indirect
+	golang.org/x/net v0.48.0 // indirect
 	golang.org/x/oauth2 v0.34.0 // indirect
 	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/sys v0.41.0 // indirect
-	golang.org/x/term v0.40.0 // indirect
-	golang.org/x/text v0.34.0 // indirect
+	golang.org/x/sys v0.39.0 // indirect
+	golang.org/x/term v0.38.0 // indirect
+	golang.org/x/text v0.32.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
 	google.golang.org/api v0.258.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251213004720-97cd9d5aeac2 // indirect
@@ -267,7 +250,7 @@ require (
 	modernc.org/mathutil v1.7.1 // indirect
 	moul.io/http2curl/v2 v2.3.0 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
-	storj.io/common v0.0.0-20251107171817-6221ae45072c // indirect
+	storj.io/common v0.0.0-20250808122759-804533d519c1 // indirect
 	storj.io/drpc v0.0.35-0.20250513201419-f7819ea69b55 // indirect
 	storj.io/eventkit v0.0.0-20250410172343-61f26d3de156 // indirect
 	storj.io/infectious v0.0.2 // indirect
@@ -13,7 +13,8 @@ cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKV
 cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
 cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
 cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
-cloud.google.com/go/auth v0.17.0 h1:74yCm7hCj2rUyyAocqnFzsAYXgJhrG26XCFimrc/Kz4=
+cloud.google.com/go/auth v0.16.5 h1:mFWNQ2FEVWAliEQWpAdH80omXFokmrnbDhUS9cBywsI=
+cloud.google.com/go/auth v0.16.5/go.mod h1:utzRfHMP+Vv0mpOkTRQoWD2q3BatTOoWbA7gCc2dUhQ=
 cloud.google.com/go/auth v0.17.0/go.mod h1:6wv/t5/6rOPAX4fJiRjKkJCvswLwdet7G8+UGXt7nCQ=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
@@ -37,8 +38,8 @@ cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohl
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 h1:fou+2+WFTib47nS+nz/ozhEBnvU96bKHy6LjRsY4E28=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0/go.mod h1:t76Ruy8AHvUAC8GfMWJMa0ElSbuIcO03NLpynfbgsPA=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY=
@@ -47,22 +48,20 @@ github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDo
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2/go.mod h1:XtLgD3ZD34DAaVIIAyG3objl5DynM3CQ/vMcbBNJZGI=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.1 h1:/Zt+cDPnpC3OVDm/JKLOs7M2DKmLRIIp3XIx9pHHiig=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.1/go.mod h1:Ng3urmn6dYe8gnbCMoHHVl5APYz2txho3koEkV2o2HA=
-github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.4 h1:jWQK1GI+LeGGUKBADtcH2rRqPxYB1Ljwms5gFA2LqrM=
-github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.4/go.mod h1:8mwH4klAm9DUgR2EEHyEEAQlRDvLPyg5fQry3y+cDew=
-github.com/Azure/azure-sdk-for-go/sdk/storage/azfile v1.5.3 h1:sxgSqOB9CDToiaVFpxuvb5wGgGqWa3lCShcm5o0n3bE=
-github.com/Azure/azure-sdk-for-go/sdk/storage/azfile v1.5.3/go.mod h1:XdED8i399lEVblYHTZM8eXaP07gv4Z58IL6ueMlVlrg=
-github.com/Azure/go-ntlmssp v0.1.0 h1:DjFo6YtWzNqNvQdrwEyr/e4nhU3vRiwenz5QX7sFz+A=
-github.com/Azure/go-ntlmssp v0.1.0/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.3 h1:ZJJNFaQ86GVKQ9ehwqyAFE6pIfyicpuJ8IkVaPBc6/4=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.3/go.mod h1:URuDvhmATVKqHBH9/0nOiNKk0+YcwfQ3WkK5PqHKxc8=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azfile v1.5.2 h1:l3SabZmNuXCMCbQUIeR4W6/N4j8SeH/lwX+a6leZhHo=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azfile v1.5.2/go.mod h1:k+mEZ4f1pVqZTRqtSDW2AhZ/3wT5qLpsUA75C/k7dtE=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 h1:XRzhVemXdgvJqCH0sFfrBUTnUJSBrBf7++ypk+twtRs=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/FilenCloudDienste/filen-sdk-go v0.0.37 h1:W8S9TrAyZ4//3PXsU6+Bi+fe/6uIL986GyS7PVzIDL4=
-github.com/FilenCloudDienste/filen-sdk-go v0.0.37/go.mod h1:0cBhKXQg49XbKZZfk5TCDa3sVLP+xMxZTWL+7KY0XR0=
-github.com/Files-com/files-sdk-go/v3 v3.2.264 h1:lMHTplAYI9FtmCo/QOcpRxmPA5REVAct1r2riQmDQKw=
-github.com/Files-com/files-sdk-go/v3 v3.2.264/go.mod h1:wGqkOzRu/ClJibvDgcfuJNAqI2nLhe8g91tPlDKRCdE=
+github.com/Files-com/files-sdk-go/v3 v3.2.218 h1:tIvcbHXNY/bq+Sno6vajOJOxhe5XbU59Fa1ohOybK+s=
+github.com/Files-com/files-sdk-go/v3 v3.2.218/go.mod h1:E0BaGQbcMUcql+AfubCR/iasWKBxX5UZPivnQGC2z0M=
 github.com/IBM/go-sdk-core/v5 v5.21.0 h1:DUnYhvC4SoC8T84rx5omnhY3+xcQg/Whyoa3mDPIMkk=
 github.com/IBM/go-sdk-core/v5 v5.21.0/go.mod h1:Q3BYO6iDA2zweQPDGbNTtqft5tDcEpm6RTuqMlPcvbw=
 github.com/IBM/sarama v1.46.0 h1:+YTM1fNd6WKMchlnLKRUB5Z0qD4M8YbvwIIPLvJD53s=
@@ -90,69 +89,63 @@ github.com/ProtonMail/gopenpgp/v2 v2.9.0 h1:ruLzBmwe4dR1hdnrsEJ/S7psSBmV15gFttFU
 github.com/ProtonMail/gopenpgp/v2 v2.9.0/go.mod h1:IldDyh9Hv1ZCCYatTuuEt1XZJ0OPjxLpTarDfglih7s=
 github.com/PuerkitoBio/goquery v1.10.3 h1:pFYcNSqHxBD06Fpj/KsbStFRsgRATgnf3LeXiUkhzPo=
 github.com/PuerkitoBio/goquery v1.10.3/go.mod h1:tMUX0zDMHXYlAQk6p35XxQMqMweEKB7iK7iLNd4RH4Y=
-github.com/a1ex3/zstd-seekable-format-go/pkg v0.10.0 h1:iLDOF0rdGTrol/q8OfPIIs5kLD8XvA2q75o6Uq/tgak=
-github.com/a1ex3/zstd-seekable-format-go/pkg v0.10.0/go.mod h1:DrEWcQJjz7t5iF2duaiyhg4jyoF0kxOD6LtECNGkZ/Q=
 github.com/aalpar/deheap v0.0.0-20210914013432-0cc84d79dec3 h1:hhdWprfSpFbN7lz3W1gM40vOgvSh1WCSMxYD6gGB4Hs=
 github.com/aalpar/deheap v0.0.0-20210914013432-0cc84d79dec3/go.mod h1:XaUnRxSCYgL3kkgX0QHIV0D+znljPIDImxlv2kbGv0Y=
 github.com/abbot/go-http-auth v0.4.0 h1:QjmvZ5gSC7jm3Zg54DqWE/T5m1t2AfDu6QlXJT0EVT0=
 github.com/abbot/go-http-auth v0.4.0/go.mod h1:Cz6ARTIzApMJDzh5bRMSUou6UMSp0IEXg9km/ci7TJM=
-github.com/anchore/go-lzo v0.1.0 h1:NgAacnzqPeGH49Ky19QKLBZEuFRqtTG9cdaucc3Vncs=
-github.com/anchore/go-lzo v0.1.0/go.mod h1:3kLx0bve2oN1iDwgM1U5zGku1Tfbdb0No5qp1eL1fIk=
 github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
 github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/andybalholm/cascadia v1.3.3 h1:AG2YHrzJIm4BZ19iwJ/DAua6Btl3IwJX+VI4kktS1LM=
 github.com/andybalholm/cascadia v1.3.3/go.mod h1:xNd9bqTn98Ln4DwST8/nG+H0yuB8Hmgu1YHNnWw0GeA=
 github.com/appscode/go-querystring v0.0.0-20170504095604-0126cfb3f1dc h1:LoL75er+LKDHDUfU5tRvFwxH0LjPpZN8OoG8Ll+liGU=
 github.com/appscode/go-querystring v0.0.0-20170504095604-0126cfb3f1dc/go.mod h1:w648aMHEgFYS6xb0KVMMtZ2uMeemhiKCuD2vj6gY52A=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/aws/aws-sdk-go v1.55.8 h1:JRmEUbU52aJQZ2AjX4q4Wu7t4uZjOu71uyNmaWlUkJQ=
 github.com/aws/aws-sdk-go v1.55.8/go.mod h1:ZkViS9AqA6otK+JBBNH2++sx1sgxrPKcSzPPvQkUtXk=
-github.com/aws/aws-sdk-go-v2 v1.41.1 h1:ABlyEARCDLN034NhxlRUSZr4l71mh+T5KAeGh6cerhU=
-github.com/aws/aws-sdk-go-v2 v1.41.1/go.mod h1:MayyLB8y+buD9hZqkCW3kX1AKq07Y5pXxtgB+rRFhz0=
+github.com/aws/aws-sdk-go-v2 v1.41.0 h1:tNvqh1s+v0vFYdA1xq0aOJH+Y5cRyZ5upu6roPgPKd4=
+github.com/aws/aws-sdk-go-v2 v1.41.0/go.mod h1:MayyLB8y+buD9hZqkCW3kX1AKq07Y5pXxtgB+rRFhz0=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 h1:489krEF9xIGkOaaX3CE/Be2uWjiXrkCH6gUX+bZA/BU=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4/go.mod h1:IOAPF6oT9KCsceNTvvYMNHy0+kMF8akOjeDvPENWxp4=
-github.com/aws/aws-sdk-go-v2/config v1.32.7 h1:vxUyWGUwmkQ2g19n7JY/9YL8MfAIl7bTesIUykECXmY=
-github.com/aws/aws-sdk-go-v2/config v1.32.7/go.mod h1:2/Qm5vKUU/r7Y+zUk/Ptt2MDAEKAfUtKc1+3U1Mo3oY=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.7 h1:tHK47VqqtJxOymRrNtUXN5SP/zUTvZKeLx4tH6PGQc8=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.7/go.mod h1:qOZk8sPDrxhf+4Wf4oT2urYJrYt3RejHSzgAquYeppw=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17 h1:I0GyV8wiYrP8XpA70g1HBcQO1JlQxCMTW9npl5UbDHY=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17/go.mod h1:tyw7BOl5bBe/oqvoIeECFJjMdzXoa/dfVz3QQ5lgHGA=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.4 h1:2fjfz3/G9BRvIKuNZ655GwzpklC2kEH0cowZQGO7uBg=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.4/go.mod h1:Ymws824lvMypLFPwyyUXM52SXuGgxpu0+DISLfKvB+c=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 h1:xOLELNKGp2vsiteLsvLPwxC+mYmO6OZ8PYgiuPJzF8U=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17/go.mod h1:5M5CI3D12dNOtH3/mk6minaRwI2/37ifCURZISxA/IQ=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 h1:WWLqlh79iO48yLkj1v3ISRNiv+3KdQoZ6JWyfcsyQik=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17/go.mod h1:EhG22vHRrvF8oXSTYStZhJc1aUgKtnJe+aOiFEV90cM=
+github.com/aws/aws-sdk-go-v2/config v1.32.6 h1:hFLBGUKjmLAekvi1evLi5hVvFQtSo3GYwi+Bx4lpJf8=
+github.com/aws/aws-sdk-go-v2/config v1.32.6/go.mod h1:lcUL/gcd8WyjCrMnxez5OXkO3/rwcNmvfno62tnXNcI=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.6 h1:F9vWao2TwjV2MyiyVS+duza0NIRtAslgLUM0vTA1ZaE=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.6/go.mod h1:SgHzKjEVsdQr6Opor0ihgWtkWdfRAIwxYzSJ8O85VHY=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.16 h1:80+uETIWS1BqjnN9uJ0dBUaETh+P1XwFy5vwHwK5r9k=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.16/go.mod h1:wOOsYuxYuB/7FlnVtzeBYRcjSRtQpAW0hCP7tIULMwo=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.18.4 h1:0SzCLoPRSK3qSydsaFQWugP+lOBCTPwfcBOm6222+UA=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.18.4/go.mod h1:JAet9FsBHjfdI+TnMBX4ModNNaQHAd3dc/Bk+cNsxeM=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.3/go.mod h1:br7KA6edAAqDGUYJ+zVVPAyMrPhnN+zdt17yTUT6FPw=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16 h1:rgGwPzb82iBYSvHMHXc8h9mRoOUBZIGFgKb9qniaZZc=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16/go.mod h1:L/UxsGeKpGoIj6DxfhOWHWQ/kGKcd4I1VncE4++IyKA=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16 h1:1jtGzuV7c82xnqOVfx2F0xmJcOw5374L7N6juGW6x6U=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16/go.mod h1:M2E5OQf+XLe+SZGmmpaI2yy+J326aFf6/+54PoxSANc=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 h1:WKuaxf++XKWlHWu9ECbMlha8WOEGm0OUEZqm4K/Gcfk=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4/go.mod h1:ZWy7j6v1vWGmPReu0iSGvRiise4YI5SkR3OHKTZ6Wuc=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.16 h1:CjMzUs78RDDv4ROu3JnJn/Ig1r6ZD7/T2DXLLRpejic=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.16/go.mod h1:uVW4OLBqbJXSHJYA9svT9BluSvvwbzLQ2Crf6UPzR3c=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.15 h1:NLYTEyZmVZo0Qh183sC8nC+ydJXOOeIL/qI/sS3PdLY=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.15/go.mod h1:Z803iB3B0bc8oJV8zH2PERLRfQUJ2n2BXISpsA4+O1M=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 h1:0ryTNEdJbzUCEWkVXEXoqlXV72J5keC1GvILMOuD00E=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4/go.mod h1:HQ4qwNZh32C3CBeO6iJLQlgtMzqeG17ziAA/3KDJFow=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.7 h1:DIBqIrJ7hv+e4CmIk2z3pyKT+3B6qVMgRsawHiR3qso=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.7/go.mod h1:vLm00xmBke75UmpNvOcZQ/Q30ZFjbczeLFqGx5urmGo=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17 h1:RuNSMoozM8oXlgLG/n6WLaFGoea7/CddrCfIiSA+xdY=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17/go.mod h1:F2xxQ9TZz5gDWsclCtPQscGpP0VUOc8RqgFM3vDENmU=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.16 h1:NSbvS17MlI2lurYgXnCOLvCFX38sBW4eiVER7+kkgsU=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.16/go.mod h1:SwT8Tmqd4sA6G1qaGdzWCJN99bUmPGHfRwwq3G5Qb+A=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0 h1:MIWra+MSq53CFaXXAywB2qg9YvVZifkk6vEGl/1Qor0=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0/go.mod h1:79S2BdqCJpScXZA2y+cpZuocWsjGjJINyXnOsf5DTz8=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.5 h1:VrhDvQib/i0lxvr3zqlUwLwJP4fpmpyD9wYG1vfSu+Y=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.5/go.mod h1:k029+U8SY30/3/ras4G/Fnv/b88N4mAfliNn08Dem4M=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 h1:v6EiMvhEYBoHABfbGB4alOYmCIrcgyPPiBE1wZAEbqk=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.9/go.mod h1:yifAsgBxgJWn3ggx70A3urX2AN49Y5sJTD1UQFlfqBw=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 h1:gd84Omyu9JLriJVCbGApcLzVR3XtmC4ZDPcAI6Ftvds=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13/go.mod h1:sTGThjphYE4Ohw8vJiRStAcu3rbjtXRsdNB0TvZ5wwo=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.6 h1:5fFjR/ToSOzB2OQ/XqWpZBmNvmP/pJ1jOWYlFDJTjRQ=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.6/go.mod h1:qgFDZQSD/Kys7nJnVqYlWKnh0SSdMjAi0uSwON4wgYQ=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.6 h1:P1MU/SuhadGvg2jtviDXPEejU3jBNhoeeAlRadHzvHI=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.6/go.mod h1:5KYaMG6wmVKMFBSfWoyG/zH8pWwzQFnKgpoSRlXHKdQ=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16 h1:oHjJHeUy0ImIV0bsrX0X91GkV5nJAyv1l1CC9lnO0TI=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16/go.mod h1:iRSNGgOYmiYwSCXxXaKb9HfOEj40+oTKn8pTxMlYkRM=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.15 h1:wsSQ4SVz5YE1crz0Ap7VBZrV4nNqZt4CIBBT8mnwoNc=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.15/go.mod h1:I7sditnFGtYMIqPRU1QoHZAUrXkGp4SczmlLwrNPlD0=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.93.0 h1:IrbE3B8O9pm3lsg96AXIN5MXX4pECEuExh/A0Du3AuI=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.93.0/go.mod h1:/sJLzHtiiZvs6C1RbxS/anSAFwZD6oC6M/kotQzOiLw=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.4 h1:HpI7aMmJ+mm1wkSHIA2t5EaFFv5EFYXePW30p1EIrbQ=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.4/go.mod h1:C5RdGMYGlfM0gYq/tifqgn4EbyX99V15P2V3R+VHbQU=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.8 h1:aM/Q24rIlS3bRAhTyFurowU8A0SMyGDtEOY/l/s/1Uw=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.8/go.mod h1:+fWt2UHSb4kS7Pu8y+BMBvJF0EWx+4H0hzNwtDNRTrg=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.12 h1:AHDr0DaHIAo8c9t1emrzAlVDFp+iMMKnPdYy6XO4MCE=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.12/go.mod h1:GQ73XawFFiWxyWXMHWfhiomvP3tXtdNar/fi8z18sx0=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.5 h1:SciGFVNZ4mHdm7gpD1dgZYnCuVdX1s+lFTg4+4DOy70=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.5/go.mod h1:iW40X4QBmUxdP+fZNOpfmkdMZqsovezbAeO+Ubiv2pk=
 github.com/aws/smithy-go v1.24.0 h1:LpilSUItNPFr1eY85RYgTIg5eIEPtvFbskaFcmmIUnk=
 github.com/aws/smithy-go v1.24.0/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
-github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
-github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
-github.com/boombuler/barcode v1.1.0 h1:ChaYjBR63fr4LFyGn8E8nt7dBSt3MiU3zMOZqFvVkHo=
-github.com/boombuler/barcode v1.1.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/bradenaw/juniper v0.15.3 h1:RHIAMEDTpvmzV1wg1jMAHGOoI2oJUSPx3lxRldXnFGo=
 github.com/bradenaw/juniper v0.15.3/go.mod h1:UX4FX57kVSaDp4TPqvSjkAAewmRFAfXf27BOs5z9dq8=
 github.com/bradfitz/iter v0.0.0-20191230175014-e8f45d346db8 h1:GKTyiRCL6zVf5wWaqKnf+7Qs6GbEPfd4iMOitWzXJx8=
@@ -161,13 +154,11 @@ github.com/buengese/sgzip v0.1.1 h1:ry+T8l1mlmiWEsDrH/YHZnCVWD2S3im1KLsyO+8ZmTU=
 github.com/buengese/sgzip v0.1.1/go.mod h1:i5ZiXGF3fhV7gL1xaRRL1nDnmpNj0X061FQzOS8VMas=
 github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/FBatYVw=
 github.com/bufbuild/protocompile v0.14.1/go.mod h1:ppVdAIhbr2H8asPk6k4pY7t9zB1OU5DoEw9xY/FUi1c=
-github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=
-github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
 github.com/bwesterb/go-ristretto v1.2.0/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
-github.com/bytedance/sonic v1.13.2 h1:8/H1FempDZqC4VqjptGo14QQlJx8VdZJegxs6wwfqpQ=
-github.com/bytedance/sonic v1.13.2/go.mod h1:o68xyaF9u2gvVBuGHPlUVCy+ZfmNNO5ETf1+KgkJhz4=
-github.com/bytedance/sonic/loader v0.2.4 h1:ZWCw4stuXUsn1/+zQDqeE7JKP+QO47tz7QCNan80NzY=
-github.com/bytedance/sonic/loader v0.2.4/go.mod h1:N8A3vUdtUebEY2/VQC0MyhYeKUFosQU6FxH2JmUe6VI=
+github.com/bytedance/sonic v1.14.0 h1:/OfKt8HFw0kh2rj8N0F6C/qPGRESq0BbaNZgcNXXzQQ=
+github.com/bytedance/sonic v1.14.0/go.mod h1:WoEbx8WTcFJfzCe0hbmyTGrfjt8PzNEBdxlNUO24NhA=
+github.com/bytedance/sonic/loader v0.3.0 h1:dskwH8edlzNMctoruo8FPTJDF3vLtDT0sXZwvZJyqeA=
+github.com/bytedance/sonic/loader v0.3.0/go.mod h1:N8A3vUdtUebEY2/VQC0MyhYeKUFosQU6FxH2JmUe6VI=
 github.com/calebcase/tmpfile v1.0.3 h1:BZrOWZ79gJqQ3XbAQlihYZf/YCV0H4KPIdM5K5oMpJo=
 github.com/calebcase/tmpfile v1.0.3/go.mod h1:UAUc01aHeC+pudPagY/lWvt2qS9ZO5Zzof6/tIUzqeI=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
@@ -179,21 +170,17 @@ github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWR
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/clipperhouse/stringish v0.1.1 h1:+NSqMOr3GR6k1FdRhhnXrLfztGzuG+VuFDfatpWHKCs=
-github.com/clipperhouse/stringish v0.1.1/go.mod h1:v/WhFtE1q0ovMta2+m+UbpZ+2/HEXNWYXQgCt4hdOzA=
-github.com/clipperhouse/uax29/v2 v2.3.0 h1:SNdx9DVUqMoBuBoW3iLOj4FQv3dN5mDtuqwuhIGpJy4=
-github.com/clipperhouse/uax29/v2 v2.3.0/go.mod h1:Wn1g7MK6OoeDT0vL+Q0SQLDz/KpfsVRgg6W7ihQeh4g=
 github.com/cloudflare/circl v1.1.0/go.mod h1:prBCrKB9DV4poKZY1l9zBXg2QJY7mvgRvtMxxK7fi4I=
-github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
-github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
-github.com/cloudinary/cloudinary-go/v2 v2.13.0 h1:ugiQwb7DwpWQnete2AZkTh94MonZKmxD7hDGy1qTzDs=
-github.com/cloudinary/cloudinary-go/v2 v2.13.0/go.mod h1:ireC4gqVetsjVhYlwjUJwKTbZuWjEIynbR9zQTlqsvo=
+github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
+github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
+github.com/cloudinary/cloudinary-go/v2 v2.12.0 h1:uveBJeNpJztKDwFW/B+Wuklq584hQmQXlo+hGTSOGZ8=
+github.com/cloudinary/cloudinary-go/v2 v2.12.0/go.mod h1:ireC4gqVetsjVhYlwjUJwKTbZuWjEIynbR9zQTlqsvo=
 github.com/cloudsoda/go-smb2 v0.0.0-20250228001242-d4c70e6251cc h1:t8YjNUCt1DimB4HCIXBztwWMhgxr5yG5/YaRl9Afdfg=
 github.com/cloudsoda/go-smb2 v0.0.0-20250228001242-d4c70e6251cc/go.mod h1:CgWpFCFWzzEA5hVkhAc6DZZzGd3czx+BblvOzjmg6KA=
 github.com/cloudsoda/sddl v0.0.0-20250224235906-926454e91efc h1:0xCWmFKBmarCqqqLeM7jFBSw/Or81UEElFqO8MY+GDs=
 github.com/cloudsoda/sddl v0.0.0-20250224235906-926454e91efc/go.mod h1:uvR42Hb/t52HQd7x5/ZLzZEK8oihrFpgnodIJ1vte2E=
-github.com/cloudwego/base64x v0.1.5 h1:XPciSp1xaq2VCSt6lF0phncD4koWyULpl5bUxbfCyP4=
-github.com/cloudwego/base64x v0.1.5/go.mod h1:0zlkT4Wn5C6NdauXdJRhSKRlJvmclQ1hhJgA0rcu/8w=
+github.com/cloudwego/base64x v0.1.6 h1:t11wG9AECkCDk5fMSoxmufanudBtJ+/HemLstXDLI2M=
+github.com/cloudwego/base64x v0.1.6/go.mod h1:OFcloc187FXDaYHvrNIjxSe8ncn0OOM8gEHfghB2IPU=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cognusion/imaging v1.0.2 h1:BQwBV8V8eF3+dwffp8Udl9xF1JKh5Z0z5JkJwAi98Mc=
 github.com/cognusion/imaging v1.0.2/go.mod h1:mj7FvH7cT2dlFogQOSUQRtotBxJ4gFQ2ySMSmBm5dSk=
@@ -201,8 +188,8 @@ github.com/colinmarc/hdfs/v2 v2.4.0 h1:v6R8oBx/Wu9fHpdPoJJjpGSUxo8NhHIwrwsfhFvU9
 github.com/colinmarc/hdfs/v2 v2.4.0/go.mod h1:0NAO+/3knbMx6+5pCv+Hcbaz4xn/Zzbn9+WIib2rKVI=
 github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
-github.com/coreos/go-systemd/v22 v22.6.0 h1:aGVa/v8B7hpb0TKl0MWoAavPDmHvobFe5R5zn0bCJWo=
-github.com/coreos/go-systemd/v22 v22.6.0/go.mod h1:iG+pp635Fo7ZmV/j14KUcmEyWF+0X7Lua8rrTWzYgWU=
+github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
+github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/creasty/defaults v1.8.0 h1:z27FJxCAa0JKt3utc0sCImAEb+spPucmKoOdLHvHYKk=
 github.com/creasty/defaults v1.8.0/go.mod h1:iGzKe6pbEHnpMPtfDXZEr0NVxWnPTjb1bbDy08fPzYM=
 github.com/cronokirby/saferith v0.33.0 h1:TgoQlfsD4LIwx71+ChfRcIpjkw+RPOapDEVxa+LhwLo=
@@ -213,14 +200,8 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/diskfs/go-diskfs v1.7.0 h1:vonWmt5CMowXwUc79jWyGrf2DIMeoOjkLlMnQYGVOs8=
-github.com/diskfs/go-diskfs v1.7.0/go.mod h1:LhQyXqOugWFRahYUSw47NyZJPezFzB9UELwhpszLP/k=
-github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
-github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
 github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
 github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
-github.com/dromara/dongle v1.0.1 h1:si/7UP/EXxnFVZok1cNos70GiMGxInAYMilHQFP5dJs=
-github.com/dromara/dongle v1.0.1/go.mod h1:ebFhTaDgxaDIKppycENTWlBsxz8mWCPWOLnsEgDpMv4=
 github.com/dropbox/dropbox-sdk-go-unofficial/v6 v6.0.5 h1:FT+t0UEDykcor4y3dMVKXIiWJETBpRgERYTGlmMd7HU=
 github.com/dropbox/dropbox-sdk-go-unofficial/v6 v6.0.5/go.mod h1:rSS3kM9XMzSQ6pw91Qgd6yB5jdt70N4OdtrAf74As5M=
 github.com/dsnet/try v0.0.3 h1:ptR59SsrcFUYbT/FhAbKTV6iLkeD6O18qfIWRml2fqI=
@@ -235,13 +216,10 @@ github.com/eapache/queue v1.1.0 h1:YOEu7KNc61ntiQlcEeUIoDTJ2o8mQznoNvUhiigpIqc=
 github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I=
 github.com/ebitengine/purego v0.9.1 h1:a/k2f2HQU3Pi399RPW1MOaZyhKJL9w/xFpKAg4q1s0A=
 github.com/ebitengine/purego v0.9.1/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
-github.com/elliotwutingfeng/asciiset v0.0.0-20230602022725-51bbb787efab h1:h1UgjJdAAhj+uPL68n7XASS6bU+07ZX1WJvVS2eyoeY=
-github.com/elliotwutingfeng/asciiset v0.0.0-20230602022725-51bbb787efab/go.mod h1:GLo/8fDswSAniFG+BFIaiSPcK610jyzgEhWYPQwuQdw=
 github.com/emersion/go-message v0.18.2 h1:rl55SQdjd9oJcIoQNhubD2Acs1E6IzlZISRTK7x/Lpg=
 github.com/emersion/go-message v0.18.2/go.mod h1:XpJyL70LwRvq2a8rVbHXikPgKj8+aI0kGdHlg16ibYA=
 github.com/emersion/go-vcard v0.0.0-20241024213814-c9703dde27ff h1:4N8wnS3f1hNHSmFD5zgFkWCyA4L1kCDkImPAtK7D6tg=
 github.com/emersion/go-vcard v0.0.0-20241024213814-c9703dde27ff/go.mod h1:HMJKR5wlh/ziNp+sHEDV2ltblO4JD2+IdDOWtGcQBTM=
-github.com/emmansun/gmsm v0.15.5/go.mod h1:2m4jygryohSWkaSduFErgCwQKab5BNjURoFrn2DNwyU=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
@@ -259,22 +237,20 @@ github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7z
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/gabriel-vasile/mimetype v1.4.11 h1:AQvxbp830wPhHTqc1u7nzoLT+ZFxGY7emj5DR5DYFik=
-github.com/gabriel-vasile/mimetype v1.4.11/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
+github.com/gabriel-vasile/mimetype v1.4.9 h1:5k+WDwEsD9eTLL8Tz3L0VnmVh9QxGjRmjBvAG7U/oYY=
+github.com/gabriel-vasile/mimetype v1.4.9/go.mod h1:WnSQhFKJuBlRyLiKohA/2DtIlPFAbguNaG7QCHcyGok=
 github.com/geoffgarside/ber v1.2.0 h1:/loowoRcs/MWLYmGX9QtIAbA+V/FrnVLsMMPhwiRm64=
 github.com/geoffgarside/ber v1.2.0/go.mod h1:jVPKeCbj6MvQZhwLYsGwaGI52oUorHoHKNecGT85ZCc=
-github.com/gin-contrib/sse v1.0.0 h1:y3bT1mUWUxDpW4JLQg/HnTqV4rozuW4tC9eFKTxYI9E=
-github.com/gin-contrib/sse v1.0.0/go.mod h1:zNuFdwarAygJBht0NTKiSi3jRf6RbqeILZ9Sp6Slhe0=
+github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w=
+github.com/gin-contrib/sse v1.1.0/go.mod h1:hxRZ5gVpWMT7Z0B0gSNYqqsSCNIJMjzvm6fqCz9vjwM=
 github.com/gin-gonic/gin v1.11.0 h1:OW/6PLjyusp2PPXtyxKHU0RbX6I/l28FTdDlae5ueWk=
 github.com/gin-gonic/gin v1.11.0/go.mod h1:+iq/FyxlGzII0KHiBGjuNn4UNENUlKbGlNmc+W50Dls=
-github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug=
-github.com/go-chi/chi/v5 v5.2.5/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0=
+github.com/go-chi/chi/v5 v5.2.2 h1:CMwsvRVTbXVytCk1Wd72Zy1LAsAh9GxMmSNWLHCG618=
+github.com/go-chi/chi/v5 v5.2.2/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
 github.com/go-darwin/apfs v0.0.0-20211011131704-f84b94dbf348 h1:JnrjqG5iR07/8k7NqrLNilRsl3s1EPRQEGvbPyOce68=
 github.com/go-darwin/apfs v0.0.0-20211011131704-f84b94dbf348/go.mod h1:Czxo/d1g948LtrALAZdL04TL/HnkopquAjxYUuI02bo=
 github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
 github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
-github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM=
-github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -288,20 +264,18 @@ github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
 github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
-github.com/go-openapi/errors v0.22.4 h1:oi2K9mHTOb5DPW2Zjdzs/NIvwi2N3fARKaTJLdNabaM=
-github.com/go-openapi/errors v0.22.4/go.mod h1:z9S8ASTUqx7+CP1Q8dD8ewGH/1JWFFLX/2PmAYNQLgk=
-github.com/go-openapi/strfmt v0.25.0 h1:7R0RX7mbKLa9EYCTHRcCuIPcaqlyQiWNPTXwClK0saQ=
-github.com/go-openapi/strfmt v0.25.0/go.mod h1:nNXct7OzbwrMY9+5tLX4I21pzcmE6ccMGXl3jFdPfn8=
-github.com/go-openapi/testify/v2 v2.0.2 h1:X999g3jeLcoY8qctY/c/Z8iBHTbwLz7R2WXd6Ub6wls=
-github.com/go-openapi/testify/v2 v2.0.2/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
+github.com/go-openapi/errors v0.22.2 h1:rdxhzcBUazEcGccKqbY1Y7NS8FDcMyIRr0934jrYnZg=
+github.com/go-openapi/errors v0.22.2/go.mod h1:+n/5UdIqdVnLIJ6Q9Se8HNGUXYaY6CN8ImWzfi/Gzp0=
+github.com/go-openapi/strfmt v0.23.0 h1:nlUS6BCqcnAk0pyhi9Y+kdDVZdZMHfEKQiS4HaMgO/c=
+github.com/go-openapi/strfmt v0.23.0/go.mod h1:NrtIpfKtWIygRkKVsxh7XQMDQW5HKQl6S5ik2elW+K4=
 github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
 github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
 github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
 github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
 github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
-github.com/go-playground/validator/v10 v10.28.0 h1:Q7ibns33JjyW48gHkuFT91qX48KG0ktULL6FgHdG688=
-github.com/go-playground/validator/v10 v10.28.0/go.mod h1:GoI6I1SjPBh9p7ykNE/yj3fFYbyDOpwMn5KXd+m2hUU=
+github.com/go-playground/validator/v10 v10.27.0 h1:w8+XrWVMhGkxOaaowyKH35gFydVHOvC0/uWoy2Fzwn4=
+github.com/go-playground/validator/v10 v10.27.0/go.mod h1:I5QpIEbmr8On7W0TktmJAumgzX4CA1XNl4ZmDuVHKKo=
 github.com/go-resty/resty/v2 v2.16.5 h1:hBKqmWrr7uRc3euHVqmh1HTHcKn99Smr7o5spptdhTM=
 github.com/go-resty/resty/v2 v2.16.5/go.mod h1:hkJtXbA2iKHzJheXYvQ8snQES5ZLGKMwQ07xAwp/fiA=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
@@ -312,14 +286,16 @@ github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
 github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
 github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
-github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
-github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/gofrs/flock v0.8.1/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
+github.com/gofrs/flock v0.12.1 h1:MTLVXXHf8ekldpJk3AKicLij9MdwOWkZ+a/jHHZby9E=
+github.com/gofrs/flock v0.12.1/go.mod h1:9zxTsyu5xtJ9DK+1tFZyibEV7y3uwDxPPfbxeeHCoD0=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
 github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
-github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
-github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
+github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -379,14 +355,15 @@ github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.7 h1:zrn2Ee/nWmHulBx5sAVrGgAa0f2/R35S4DJwfFaUPFQ=
+github.com/googleapis/enterprise-certificate-proxy v0.3.6 h1:GW/XbdyBFQ8Qe+YAmFU9uHLo7OnF5tL52HFAgMmyrf4=
+github.com/googleapis/enterprise-certificate-proxy v0.3.6/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
 github.com/googleapis/enterprise-certificate-proxy v0.3.7/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo=
 github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
-github.com/gopherjs/gopherjs v1.17.2 h1:fQnZVsXk8uxXIStYb0N4bGk7jeyTalG/wsZjQ25dO0g=
-github.com/gopherjs/gopherjs v1.17.2/go.mod h1:pRRIvn/QzFLrKfvEz3qUuEhtE/zLCWfreZ6J5gM2i+k=
+github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e h1:JKmoR8x90Iww1ks85zJ1lfDGgIiMDuIptTOhJq+zKyg=
+github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/gorilla/schema v1.4.1 h1:jUg5hUjCSDZpNGLuXQOgIWGdlgrIdYvgQ0wZtdK1M3E=
@@ -413,14 +390,14 @@ github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/C
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/henrybear327/Proton-API-Bridge v1.0.0 h1:gjKAaWfKu++77WsZTHg6FUyPC5W0LTKWQciUm8PMZb0=
+github.com/henrybear327/Proton-API-Bridge v1.0.0/go.mod h1:gunH16hf6U74W2b9CGDaWRadiLICsoJ6KRkSt53zLts=
+github.com/henrybear327/go-proton-api v1.0.0 h1:zYi/IbjLwFAW7ltCeqXneUGJey0TN//Xo851a/BgLXw=
+github.com/henrybear327/go-proton-api v1.0.0/go.mod h1:w63MZuzufKcIZ93pwRgiOtxMXYafI8H74D77AxytOBc=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
-github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/internxt/rclone-adapter v0.0.0-20260213125353-6f59c89fcb7c h1:r+KtxPyrhsYeNbsfeqTfEM8xRdwgV6LuNhLZxpXecb4=
-github.com/internxt/rclone-adapter v0.0.0-20260213125353-6f59c89fcb7c/go.mod h1:vdPya4AIcDjvng4ViaAzqjegJf0VHYpYHQguFx5xBp0=
 github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
 github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
 github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
@@ -433,10 +410,8 @@ github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh6
 github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
 github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
 github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
-github.com/jhump/protoreflect v1.18.0 h1:TOz0MSR/0JOZ5kECB/0ufGnC2jdsgZ123Rd/k4Z5/2w=
-github.com/jhump/protoreflect v1.18.0/go.mod h1:ezWcltJIVF4zYdIFM+D/sHV4Oh5LNU08ORzCGfwvTz8=
-github.com/jhump/protoreflect/v2 v2.0.0-beta.1 h1:Dw1rslK/VotaUGYsv53XVWITr+5RCPXfvvlGrM/+B6w=
-github.com/jhump/protoreflect/v2 v2.0.0-beta.1/go.mod h1:D9LBEowZyv8/iSu97FU2zmXG3JxVTmNw21mu63niFzU=
+github.com/jhump/protoreflect v1.17.0 h1:qOEr613fac2lOuTgWN4tPAtLL7fUSbuJL5X5XumQh94=
+github.com/jhump/protoreflect v1.17.0/go.mod h1:h9+vUUL38jiBzck8ck+6G/aeMX8Z4QUY/NiJPwPNi+8=
 github.com/jlaffaye/ftp v0.2.1-0.20240918233326-1b970516f5d3 h1:ZxO6Qr2GOXPdcW80Mcn3nemvilMPvpWqxrNfK2ZnNNs=
 github.com/jlaffaye/ftp v0.2.1-0.20240918233326-1b970516f5d3/go.mod h1:dvLUr/8Fs9a2OBrEnCC5duphbkz/k/mSy5OkXg3PAgI=
 github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
@@ -461,12 +436,12 @@ github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRt
 github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c=
-github.com/klauspost/compress v1.18.4/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
+github.com/klauspost/compress v1.18.2 h1:iiPHWW0YrcFgpBYhsA6D1+fqHssJscY/Tm/y2Uqnapk=
+github.com/klauspost/compress v1.18.2/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
-github.com/klauspost/reedsolomon v1.13.0 h1:E0Cmgf2kMuhZTj6eefnvpKC4/Q4jhCi9YIjcZjK4arc=
-github.com/klauspost/reedsolomon v1.13.0/go.mod h1:ggJT9lc71Vu+cSOPBlxGvBN6TfAS77qB4fp8vJ05NSA=
+github.com/klauspost/reedsolomon v1.12.6 h1:8pqE9aECQG/ZFitiUD1xK/E83zwosBAZtE3UbuZM8TQ=
+github.com/klauspost/reedsolomon v1.12.6/go.mod h1:ggJT9lc71Vu+cSOPBlxGvBN6TfAS77qB4fp8vJ05NSA=
 github.com/koofr/go-httpclient v0.0.0-20240520111329-e20f8f203988 h1:CjEMN21Xkr9+zwPmZPaJJw+apzVbjGL5uK/6g9Q2jGU=
 github.com/koofr/go-httpclient v0.0.0-20240520111329-e20f8f203988/go.mod h1:/agobYum3uo/8V6yPVnq+R82pyVGCeuWW5arT4Txn8A=
 github.com/koofr/go-koofrclient v0.0.0-20221207135200-cbd7fc9ad6a6 h1:FHVoZMOVRA+6/y4yRlbiR3WvsrOcKBd/f64H7YiWR2U=
@@ -483,37 +458,35 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/lanrat/extsort v1.4.2 h1:akbLIdo4PhNZtvjpaWnbXtGMmLtnGzXplkzfgl+XTTY=
-github.com/lanrat/extsort v1.4.2/go.mod h1:hceP6kxKPKebjN1RVrDBXMXXECbaI41Y94tt6MDazc4=
+github.com/lanrat/extsort v1.4.0 h1:jysS/Tjnp7mBwJ6NG8SY+XYFi8HF3LujGbqY9jOWjco=
+github.com/lanrat/extsort v1.4.0/go.mod h1:hceP6kxKPKebjN1RVrDBXMXXECbaI41Y94tt6MDazc4=
 github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
 github.com/linkedin/goavro/v2 v2.14.1 h1:/8VjDpd38PRsy02JS0jflAu7JZPfJcGTwqWgMkFS2iI=
 github.com/linkedin/goavro/v2 v2.14.1/go.mod h1:KXx+erlq+RPlGSPmLF7xGo6SAbh8sCQ53x064+ioxhk=
 github.com/lpar/date v1.0.0 h1:bq/zVqFTUmsxvd/CylidY4Udqpr9BOFrParoP6p0x/I=
 github.com/lpar/date v1.0.0/go.mod h1:KjYe0dDyMQTgpqcUz4LEIeM5VZwhggjVx/V2dtc8NSo=
-github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 h1:PwQumkgq4/acIiZhtifTV5OUqqiP82UAl0h87xj/l9k=
-github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
-github.com/mailru/easyjson v0.9.1 h1:LbtsOm5WAswyWbvTEOqhypdPeZzHavpZx96/n553mR8=
-github.com/mailru/easyjson v0.9.1/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
+github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35 h1:PpXWgLPs+Fqr325bN2FD2ISlRRztXibcX6e8f5FR5Dc=
+github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.3/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
-github.com/mattn/go-runewidth v0.0.19 h1:v++JhqYnZuu5jSKrk9RbgF5v4CGUjqRfBm05byFGLdw=
-github.com/mattn/go-runewidth v0.0.19/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
+github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
+github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
-github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
+github.com/mitchellh/mapstructure v1.5.1-0.20220423185008-bf980b35cac4 h1:BpfhmLKZf+SjVanKKhCgf3bg+511DmU9eDQTen7LLbY=
+github.com/mitchellh/mapstructure v1.5.1-0.20220423185008-bf980b35cac4/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/ncw/swift/v2 v2.0.5 h1:9o5Gsd7bInAFEqsGPcaUdsboMbqf8lnNtxqWKFT9iz8=
-github.com/ncw/swift/v2 v2.0.5/go.mod h1:cbAO76/ZwcFrFlHdXPjaqWZ9R7Hdar7HpjRXBfbjigk=
+github.com/ncw/swift/v2 v2.0.4 h1:hHWVFxn5/YaTWAASmn4qyq2p6OyP/Hm3vMLzkjEqR7w=
+github.com/ncw/swift/v2 v2.0.4/go.mod h1:cbAO76/ZwcFrFlHdXPjaqWZ9R7Hdar7HpjRXBfbjigk=
 github.com/nxadm/tail v1.4.11 h1:8feyoE3OzPrcshW5/MJ4sGESc5cqmGkGCWlco4l0bqY=
 github.com/nxadm/tail v1.4.11/go.mod h1:OTaG3NK980DZzxbRq6lEuzgU+mug70nY11sMd4JXXHc=
 github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
@@ -527,18 +500,15 @@ github.com/onsi/ginkgo/v2 v2.23.3/go.mod h1:zXTP6xIp3U8aVuXN8ENK9IXRaTjFnpVB9mGm
 github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.37.0 h1:CdEG8g0S133B4OswTDC/5XPSzE1OeP29QOioj2PID2Y=
 github.com/onsi/gomega v1.37.0/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
-github.com/oracle/oci-go-sdk/v65 v65.104.0 h1:l9awEvzWvxmYhy/97A0hZ87pa7BncYXmcO/S8+rvgK0=
-github.com/oracle/oci-go-sdk/v65 v65.104.0/go.mod h1:oB8jFGVc/7/zJ+DbleE8MzGHjhs2ioCz5stRTdZdIcY=
+github.com/oracle/oci-go-sdk/v65 v65.98.0 h1:ZKsy97KezSiYSN1Fml4hcwjpO+wq01rjBkPqIiUejVc=
+github.com/oracle/oci-go-sdk/v65 v65.98.0/go.mod h1:RGiXfpDDmRRlLtqlStTzeBjjdUNXyqm3KXKyLCm3A/Q=
 github.com/orcaman/concurrent-map/v2 v2.0.1 h1:jOJ5Pg2w1oeB6PeDurIYf6k9PQ+aTITr/6lP/L/zp6c=
 github.com/orcaman/concurrent-map/v2 v2.0.1/go.mod h1:9Eq3TG2oBe5FirmYWQfYO5iH1q0Jv47PLaNK++uCdOM=
 github.com/panjf2000/ants/v2 v2.11.3 h1:AfI0ngBoXJmYOpDh9m516vjqoUu2sLrIVgppI9TZVpg=
 github.com/panjf2000/ants/v2 v2.11.3/go.mod h1:8u92CYMUc6gyvTIw8Ru7Mt7+/ESnJahz5EVtqfrilek=
-github.com/parquet-go/bitpack v1.0.0 h1:AUqzlKzPPXf2bCdjfj4sTeacrUwsT7NlcYDMUQxPcQA=
-github.com/parquet-go/bitpack v1.0.0/go.mod h1:XnVk9TH+O40eOOmvpAVZ7K2ocQFrQwysLMnc6M/8lgs=
-github.com/parquet-go/jsonlite v1.0.0 h1:87QNdi56wOfsE5bdgas0vRzHPxfJgzrXGml1zZdd7VU=
-github.com/parquet-go/jsonlite v1.0.0/go.mod h1:nDjpkpL4EOtqs6NQugUsi0Rleq9sW/OtC1NnZEnxzF0=
-github.com/parquet-go/parquet-go v0.26.4 h1:zJ3l8ef5WJZE2m63pKwyEJ2BhyDlgS0PfOEhuCQQU2A=
-github.com/parquet-go/parquet-go v0.26.4/go.mod h1:h9GcSt41Knf5qXI1tp1TfR8bDBUtvdUMzSKe26aZcHk=
+github.com/parquet-go/parquet-go v0.25.1 h1:l7jJwNM0xrk0cnIIptWMtnSnuxRkwq53S+Po3KG8Xgo=
+github.com/parquet-go/parquet-go v0.25.1/go.mod h1:AXBuotO1XiBtcqJb/FKFyjBG4aqa3aQAAWF3ZPzCanY=
+github.com/parquet-go/parquet-go v0.26.3/go.mod h1:h9GcSt41Knf5qXI1tp1TfR8bDBUtvdUMzSKe26aZcHk=
 github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
 github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
 github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
@@ -547,10 +517,8 @@ github.com/pengsrc/go-shared v0.2.1-0.20190131101655-1999055a4a14 h1:XeOYlK9W1uC
 github.com/pengsrc/go-shared v0.2.1-0.20190131101655-1999055a4a14/go.mod h1:jVblp62SafmidSkvWrXyxAme3gaTfEtWwRPGz5cpvHg=
 github.com/peterh/liner v1.2.2 h1:aJ4AOodmL+JxOZZEL2u9iJf8omNRpqHc/EbrK+3mAXw=
 github.com/peterh/liner v1.2.2/go.mod h1:xFwJyiKIXJZUKItq5dGHZSTBRAuG/CpeNpWLyiNRNwI=
-github.com/petermattis/goid v0.0.0-20260113132338-7c7de50cc741 h1:KPpdlQLZcHfTMQRi6bFQ7ogNO0ltFT4PmtwTLW4W+14=
-github.com/petermattis/goid v0.0.0-20260113132338-7c7de50cc741/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
-github.com/pierrec/lz4/v4 v4.1.25 h1:kocOqRffaIbU5djlIBr7Wh+cx82C0vtFb0fOurZHqD0=
-github.com/pierrec/lz4/v4 v4.1.25/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=
+github.com/pierrec/lz4/v4 v4.1.22 h1:cKFw6uJDK+/gfw5BcDL0JL5aBsAFdsIT18eRtLj7VIU=
+github.com/pierrec/lz4/v4 v4.1.22/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
 github.com/pkg/diff v0.0.0-20200914180035-5b29258ca4f7/go.mod h1:zO8QMzTeZd5cpnIkz/Gn6iK0jDfGicM1nynOkkPIl28=
@@ -565,15 +533,13 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
-github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
-github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
 github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
 github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.67.2 h1:PcBAckGFTIHt2+L3I33uNRTlKTplNzFctXcWhPyAEN8=
-github.com/prometheus/common v0.67.2/go.mod h1:63W3KZb1JOKgcjlIr64WW/LvFGAqKPj0atm+knVGEko=
+github.com/prometheus/common v0.66.1 h1:h5E0h5/Y8niHc5DlaLlWLArTQI7tMrsfQjHV+d9ZoGs=
+github.com/prometheus/common v0.66.1/go.mod h1:gcaUsgf3KfRSwHY4dIMXLPV0K/Wg1oZ8+SbZk/HH/dA=
 github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws=
 github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
 github.com/putdotio/go-putio/putio v0.0.0-20200123120452-16d982cac2b8 h1:Y258uzXU/potCYnQd1r6wlAnoMB68BiCkCcCnKx1SH8=
@@ -582,22 +548,21 @@ github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
 github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
 github.com/quic-go/quic-go v0.57.0 h1:AsSSrrMs4qI/hLrKlTH/TGQeTMY0ib1pAOX7vA3AdqE=
 github.com/quic-go/quic-go v0.57.0/go.mod h1:ly4QBAjHA2VhdnxhojRsCUOeJwKYg+taDlos92xb1+s=
-github.com/rclone/Proton-API-Bridge v1.0.1-0.20260127174007-77f974840d11 h1:4MI2alxM/Ye2gIRBlYf28JGWTipZ4Zz7yAziPKrttjs=
-github.com/rclone/Proton-API-Bridge v1.0.1-0.20260127174007-77f974840d11/go.mod h1:3HLX7dwZgvB7nt+Yl/xdzVPcargQ1yBmJEUg3n+jMKM=
-github.com/rclone/go-proton-api v1.0.1-0.20260127173028-eb465cac3b18 h1:Lc+d3ISfQaMJKWZOE7z4ZSY4RVmdzbn1B0IM8xN18qM=
-github.com/rclone/go-proton-api v1.0.1-0.20260127173028-eb465cac3b18/go.mod h1:LB2kCEaZMzNn3ocdz+qYfxXmuLxxN0ka62KJd2x53Bc=
-github.com/rclone/rclone v1.73.1 h1:FCGZUd7sXO8+nIpbuXGPkd+f23o/ZACefrHtRGDAiDM=
-github.com/rclone/rclone v1.73.1/go.mod h1:T9HeSXv/SI9qJFkYLqsjY/5ljIFWJTVmTrG7H/4JrPY=
+github.com/rclone/rclone v1.71.2 h1:3Jk5xNPFrZhVABRuN/OPvApuZQddpE2tkhYMuEn1Ud4=
+github.com/rclone/rclone v1.71.2/go.mod h1:dCK9FzPDlpkbQJ9M7MmWsmv3X5nibfWe+ogJXu6gSgM=
 github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 h1:bsUq1dX0N8AOIL7EB/X911+m4EHsnWEHeJ0c+3TTBrg=
 github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
 github.com/rdleal/intervalst v1.5.0 h1:SEB9bCFz5IqD1yhfH1Wv8IBnY/JQxDplwkxHjT6hamU=
 github.com/rdleal/intervalst v1.5.0/go.mod h1:xO89Z6BC+LQDH+IPQQw/OESt5UADgFD41tYMUINGpxQ=
-github.com/relvacode/iso8601 v1.7.0 h1:BXy+V60stMP6cpswc+a93Mq3e65PfXCgDFfhvNNGrdo=
-github.com/relvacode/iso8601 v1.7.0/go.mod h1:FlNp+jz+TXpyRqgmM7tnzHHzBnz776kmAH2h3sZCn0I=
+github.com/relvacode/iso8601 v1.6.0 h1:eFXUhMJN3Gz8Rcq82f9DTMW0svjtAVuIEULglM7QHTU=
+github.com/relvacode/iso8601 v1.6.0/go.mod h1:FlNp+jz+TXpyRqgmM7tnzHHzBnz776kmAH2h3sZCn0I=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rfjakob/eme v1.1.2 h1:SxziR8msSOElPayZNFfQw4Tjx/Sbaeeh3eRvrHVMUs4=
 github.com/rfjakob/eme v1.1.2/go.mod h1:cVvpasglm/G3ngEfcfT/Wt0GwhkuO32pf/poW6Nyk1k=
+github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
+github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
@@ -605,18 +570,18 @@ github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 h1:OkMGxebDj
 github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06/go.mod h1:+ePHsJ1keEjQtpvf9HHw0f4ZeJ0TLRsxhunSI2hYJSs=
 github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=
 github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
-github.com/samber/lo v1.52.0 h1:Rvi+3BFHES3A8meP33VPAxiBZX/Aws5RxrschYGjomw=
-github.com/samber/lo v1.52.0/go.mod h1:4+MXEGsJzbKGaUEQFKBq2xtfuznW9oz/WrgyzMzRoM0=
+github.com/samber/lo v1.51.0 h1:kysRYLbHy/MB7kQZf5DSN50JHmMsNEdeY24VzJFu7wI=
+github.com/samber/lo v1.51.0/go.mod h1:4+MXEGsJzbKGaUEQFKBq2xtfuznW9oz/WrgyzMzRoM0=
 github.com/seaweedfs/goexif v1.0.3 h1:ve/OjI7dxPW8X9YQsv3JuVMaxEyF9Rvfd04ouL+Bz30=
 github.com/seaweedfs/goexif v1.0.3/go.mod h1:Oni780Z236sXpIQzk1XoJlTwqrJ02smEin9zQeff7Fk=
 github.com/segmentio/kafka-go v0.4.49 h1:GJiNX1d/g+kG6ljyJEoi9++PUMdXGAxb7JGPiDCuNmk=
 github.com/segmentio/kafka-go v0.4.49/go.mod h1:Y1gn60kzLEEaW28YshXyk2+VCUKbJ3Qr6DrnT3i4+9E=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
-github.com/shirou/gopsutil/v4 v4.26.1 h1:TOkEyriIXk2HX9d4isZJtbjXbEjf5qyKPAzbzY0JWSo=
-github.com/shirou/gopsutil/v4 v4.26.1/go.mod h1:medLI9/UNAb0dOI9Q3/7yWSqKkj00u+1tgY8nvv41pc=
+github.com/shirou/gopsutil/v4 v4.25.11 h1:X53gB7muL9Gnwwo2evPSE+SfOrltMoR6V3xJAXZILTY=
+github.com/shirou/gopsutil/v4 v4.25.11/go.mod h1:EivAfP5x2EhLp2ovdpKSozecVXn1TmuG7SMzs/Wh4PU=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af h1:Sp5TG9f7K39yfB+If0vjp97vuT74F72r8hfRpP8jLU0=
-github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 h1:JIAuq3EEf9cgbU6AtGPK4CTG3Zf6CKMNqf0MHTggAUA=
 github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966/go.mod h1:sUM3LWHvSMaG192sy56D9F7CNvL7jUJVXoqM1QKLnog=
 github.com/smarty/assertions v1.16.0 h1:EvHNkdRA4QHMrn75NZSoUQ/mAUXAYWfatfB01yTCzfY=
@@ -625,18 +590,17 @@ github.com/smartystreets/goconvey v1.8.1 h1:qGjIddxOk4grTu9JPOU31tVfq3cNdBlNa5sS
 github.com/smartystreets/goconvey v1.8.1/go.mod h1:+/u4qLyY6x1jReYOp7GOM2FSt8aP9CzCZL03bI28W60=
 github.com/snabb/httpreaderat v1.0.1 h1:whlb+vuZmyjqVop8x1EKOg05l2NE4z9lsMMXjmSUCnY=
 github.com/snabb/httpreaderat v1.0.1/go.mod h1:lpbGrKDWF37yvRbtRvQsbesS6Ty5c83t8ztannPoMsA=
+github.com/sony/gobreaker v0.5.0/go.mod h1:ZKptC7FHNvhBz7dN2LGjPVBz2sZJmc0/PkyDJOjmxWY=
 github.com/sony/gobreaker v1.0.0 h1:feX5fGGXSl3dYd4aHZItw+FpHLvvoaqkawKjVNiFMNQ=
 github.com/sony/gobreaker v1.0.0/go.mod h1:ZKptC7FHNvhBz7dN2LGjPVBz2sZJmc0/PkyDJOjmxWY=
 github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 h1:+jumHNA0Wrelhe64i8F6HNlS8pkoyMv5sreGx2Ry5Rw=
 github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8/go.mod h1:3n1Cwaq1E1/1lhQhtRK2ts/ZwZEhjcQeJQ1RuC6Q/8U=
-github.com/spacemonkeygo/monkit/v3 v3.0.25-0.20251022131615-eb24eb109368 h1:GyYC5Ntqk/yy9lEIGE7chdIvt4zP44taycwd9YDSGdc=
-github.com/spacemonkeygo/monkit/v3 v3.0.25-0.20251022131615-eb24eb109368/go.mod h1:XkZYGzknZwkD0AKUnZaSXhRiVTLCkq7CWVa3IsE72gA=
+github.com/spacemonkeygo/monkit/v3 v3.0.24 h1:cKixJ+evHnfJhWNyIZjBy5hoW8LTWmrJXPo18tzLNrk=
+github.com/spacemonkeygo/monkit/v3 v3.0.24/go.mod h1:XkZYGzknZwkD0AKUnZaSXhRiVTLCkq7CWVa3IsE72gA=
 github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
 github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
 github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
-github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s=
-github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
@@ -658,14 +622,15 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.5/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
 github.com/syndtr/goleveldb v1.0.1-0.20190318030020-c3a204f8e965 h1:1oFLiOyVl+W7bnBzGhf7BbIv9loSFQcieWWYIjLqcAw=
 github.com/syndtr/goleveldb v1.0.1-0.20190318030020-c3a204f8e965/go.mod h1:9OrXJhf154huy1nPWmuSrkgjPUtUNhA+Zmy+6AESzuA=
-github.com/t3rm1n4l/go-mega v0.0.0-20251031123324-a804aaa87491 h1:rrGZv6xYk37hx0tW2sYfgbO0PqStbHqz6Bq6oc9Hurg=
-github.com/t3rm1n4l/go-mega v0.0.0-20251031123324-a804aaa87491/go.mod h1:ykucQyiE9Q2qx1wLlEtZkkNn1IURib/2O+Mvd25i1Fo=
+github.com/t3rm1n4l/go-mega v0.0.0-20250926104142-ccb8d3498e6c h1:BLopNCyqewbE8+BtlIp/Juzu8AJGxz0gHdGADnsblVc=
+github.com/t3rm1n4l/go-mega v0.0.0-20250926104142-ccb8d3498e6c/go.mod h1:ykucQyiE9Q2qx1wLlEtZkkNn1IURib/2O+Mvd25i1Fo=
 github.com/tailscale/depaware v0.0.0-20210622194025-720c4b409502/go.mod h1:p9lPsd+cx33L3H9nNoecRRxPssFKUwwI50I3pZ0yT+8=
 github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA=
 github.com/tklauser/go-sysconf v0.3.16/go.mod h1:/qNL9xxDhc7tx3HSRsLWNnuzbVfh3e7gh/BmM179nYI=
@@ -673,14 +638,10 @@ github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9R
 github.com/tklauser/numcpus v0.11.0/go.mod h1:z+LwcLq54uWZTX0u/bGobaV34u6V7KNlTZejzM6/3MQ=
 github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
-github.com/tyler-smith/go-bip39 v1.1.0 h1:5eUemwrMargf3BSLRRCalXT93Ns6pQJIjYQN2nyfOP8=
-github.com/tyler-smith/go-bip39 v1.1.0/go.mod h1:gUYDtqQw1JS3ZJ8UWVcGTGqqr6YIN3CWg+kkNaLt55U=
 github.com/tylertreat/BoomFilters v0.0.0-20210315201527-1a82519a3e43 h1:QEePdg0ty2r0t1+qwfZmQ4OOl/MB2UXIeJSpIZv56lg=
 github.com/tylertreat/BoomFilters v0.0.0-20210315201527-1a82519a3e43/go.mod h1:OYRfF6eb5wY9VRFkXJH8FFBi3plw2v+giaIu7P054pM=
-github.com/ugorji/go/codec v1.2.12 h1:9LC83zGrHhuUA9l16C9AHXAqEV/2wBQ4nkvumAE65EE=
-github.com/ugorji/go/codec v1.2.12/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
-github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
-github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
+github.com/ugorji/go/codec v1.3.0 h1:Qd2W2sQawAfG8XSvzwhBeoGq71zXOC/Q1E9y/wUcsUA=
+github.com/ugorji/go/codec v1.3.0/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
 github.com/unknwon/goconfig v1.0.0 h1:rS7O+CmUdli1T+oDm7fYj1MwqNWtEJfNj+FqcUHML8U=
 github.com/unknwon/goconfig v1.0.0/go.mod h1:qu2ZQ/wcC/if2u32263HTVC39PeOQRSmidQk3DuDFQ8=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
@@ -691,8 +652,6 @@ github.com/viant/ptrie v1.0.1 h1:3fFC8XqCSchf11sCSS5sbb8eGDNEP2g2Hj96lNdHlZY=
 github.com/viant/ptrie v1.0.1/go.mod h1:Y+mwwNCIUgFrCZcrG4/QChfi4ubvnNBsyrENBIgigu0=
 github.com/viant/toolbox v0.34.5 h1:szWNPiGHjo8Dd4v2a59saEhG31DRL2Xf3aJ0ZtTSuqc=
 github.com/viant/toolbox v0.34.5/go.mod h1:OxMCG57V0PXuIP2HNQrtJf2CjqdmbrOx5EkMILuUhzM=
-github.com/wk8/go-ordered-map/v2 v2.1.8 h1:5h/BUHu93oj4gIdvHHHGsScSTMijfx5PeYkE/fJgbpc=
-github.com/wk8/go-ordered-map/v2 v2.1.8/go.mod h1:5nJHM5DyteebpVlHnWMV0rPz6Zp7+xBAnxjb1X5vnTw=
 github.com/wsxiaoys/terminal v0.0.0-20160513160801-0940f3fc43a0 h1:3UeQBvD0TFrlVjOeLOBz+CPAI8dnbqNSVwUwRrkp7vQ=
 github.com/wsxiaoys/terminal v0.0.0-20160513160801-0940f3fc43a0/go.mod h1:IXCdmsXIht47RaVFLEdVnh1t+pgYtTAhQGj73kz+2DM=
 github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
@@ -703,9 +662,8 @@ github.com/xdg-go/scram v1.1.2 h1:FHX5I5B4i4hKRVRBCFRxq1iQRej7WO3hhBuJf+UUySY=
 github.com/xdg-go/scram v1.1.2/go.mod h1:RT/sEzTbU5y00aCK8UOx6R7YryM0iF1N2MOmC3kKLN4=
 github.com/xdg-go/stringprep v1.0.4 h1:XLI/Ng3O1Atzq0oBs3TWm+5ZVgkq2aqdlvP9JtoZ6c8=
 github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f h1:J9EGpcZtP0E/raorCMxlFGSTBrsSlaDGf3jU/qvAE2c=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
-github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
-github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
 github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
@@ -733,8 +691,8 @@ github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
 github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=
 github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
-go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
-go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
+go.etcd.io/bbolt v1.4.2 h1:IrUHp260R8c+zYx/Tm8QZr04CX+qWS5PGfPdevhdm1I=
+go.etcd.io/bbolt v1.4.2/go.mod h1:Is8rSHO/b4f3XigBC0lL0+4FwAQv3HXEEIgFMuKHceM=
 go.mongodb.org/mongo-driver v1.17.6 h1:87JUG1wZfWsr6rIz3ZmpH90rL5tea7O3IHuSwHUpsss=
 go.mongodb.org/mongo-driver v1.17.6/go.mod h1:Hy04i7O2kC4RS06ZrhPRqj/u4DTYkFDAAccj+rVKqgQ=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
@@ -744,8 +702,8 @@ go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 h1:RbKq8BG0FI8OiXhBfcRtqqHcZcka+gU3cskNuf05R18=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0/go.mod h1:h06DGIukJOevXaj/xrNjhi/2098RZzcLTbc0jDAUbsg=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 h1:Hf9xI/XLML9ElpiHVDNwvqI0hIFlzV8dgIr35kV1kRU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0/go.mod h1:NfchwuyNoMcZ5MLHwPrODwUF1HWCXWrL31s8gSAdIKY=
 go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8=
 go.opentelemetry.io/otel v1.38.0/go.mod h1:zcmtmQ1+YmQM9wrNsTGV/q/uyusom3P8RxwExxkZhjM=
 go.opentelemetry.io/otel/metric v1.38.0 h1:Kl6lzIYGAh5M159u9NgiRkmoMKjvbsKtYRwgfrA6WpA=
@@ -758,12 +716,12 @@ go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJr
 go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
-go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/arch v0.14.0 h1:z9JUEZWr8x4rR0OU6c4/4t6E6jOZ8/QBS2bBYBm4tx4=
-golang.org/x/arch v0.14.0/go.mod h1:FEVrYAQjsQXMVJ1nsMoVVXPZg6p2JE2mx8psSWTDQys=
+golang.org/x/arch v0.20.0 h1:dx1zTU0MAE98U+TQ8BLl7XsJbgze2WnNKF/8tGp/Q6c=
+golang.org/x/arch v0.20.0/go.mod h1:bdwinDaKcfZUGpH09BB7ZmOfhalA8lQdzl62l8gGWsk=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
@@ -772,15 +730,16 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.4.0/go.mod h1:3quD/ATkf6oY+rnes5c3ExXTbLc8mueNue5/DoinL80=
 golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
-golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
+golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M=
+golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
+golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -791,12 +750,12 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 h1:mgKeJMpvi0yx/sU5GsxQ7p6s2wtOnGAHZWCHUM4KGzY=
-golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546/go.mod h1:j/pmGrbnkbPtQfxEe5D0VQhZC6qKbfKifgD0oM7sR70=
+golang.org/x/exp v0.0.0-20250811191247-51f88131bc50 h1:3yiSh9fhy5/RhCSntf4Sy0Tnx50DmMpQ4MQdKKk4yg4=
+golang.org/x/exp v0.0.0-20250811191247-51f88131bc50/go.mod h1:rT6SFzZ7oxADUDx58pcaKFTcZ+inxAa9fTrYx/uVYwg=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.36.0 h1:Iknbfm1afbgtwPTmHnS2gTM/6PPZfH+z2EFuOkSbqwc=
-golang.org/x/image v0.36.0/go.mod h1:YsWD2TyyGKiIX1kZlu9QfKIsQ4nAAK9bdgdrIsE7xy4=
+golang.org/x/image v0.34.0 h1:33gCkyw9hmwbZJeZkct8XyR11yH889EQt/QH4VmXMn8=
+golang.org/x/image v0.34.0/go.mod h1:2RNFBZRB+vnwwFil8GkMdRvrJOFd1AzdZI6vOY+eJVU=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -852,7 +811,6 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
@@ -861,15 +819,16 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
-golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
+golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
+golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
+golang.org/x/oauth2 v0.32.0 h1:jsCblLleRMDrxMN29H3z/k1KliIvpLgCkE6R8FXXNgY=
+golang.org/x/oauth2 v0.32.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -886,6 +845,7 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
 golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -930,29 +890,31 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
-golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
+golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.19.0/go.mod h1:2CuTdWZ7KHSQwUzKva0cbMg6q2DMI3Mmxp+gKJbskEk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
-golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
+golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
+golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
+golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -960,7 +922,6 @@ golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
@@ -968,12 +929,14 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
-golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
+golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
+golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -1022,8 +985,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
-golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
+golang.org/x/tools v0.39.0 h1:ik4ho21kwuQln40uelmciQPp9SipgNDdrafrYA4TmQQ=
+golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1046,7 +1009,8 @@ google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0M
 google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
 google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
 google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
-google.golang.org/api v0.258.0 h1:IKo1j5FBlN74fe5isA2PVozN3Y5pwNKriEgAXPOkDAc=
+google.golang.org/api v0.247.0 h1:tSd/e0QrUlLsrwMKmkbQhYVa109qIintOls2Wh6bngc=
+google.golang.org/api v0.247.0/go.mod h1:r1qZOPmxXffXg6xS5uhx16Fa/UFY8QU/K4bfKrnvovM=
 google.golang.org/api v0.258.0/go.mod h1:qhOMTQEZ6lUps63ZNq9jhODswwjkjYYguA7fA3TBFww=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -1083,11 +1047,12 @@ google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7Fc
 google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20250922171735-9219d122eba9 h1:LvZVVaPE0JSqL+ZWb6ErZfnEOKIqqFWUJE2D0fObSmc=
-google.golang.org/genproto v0.0.0-20250922171735-9219d122eba9/go.mod h1:QFOrLhdAe2PsTp3vQY4quuLKTi9j3XG3r6JPPaw7MSc=
-google.golang.org/genproto/googleapis/api v0.0.0-20251124214823-79d6a2a48846 h1:ZdyUkS9po3H7G0tuh955QVyyotWvOD4W0aEapeGeUYk=
-google.golang.org/genproto/googleapis/api v0.0.0-20251124214823-79d6a2a48846/go.mod h1:Fk4kyraUvqD7i5H6S43sj2W98fbZa75lpZz/eUyhfO0=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251213004720-97cd9d5aeac2 h1:2I6GHUeJ/4shcDpoUlLs/2WPnhg7yJwvXtqcMJt9liA=
+google.golang.org/genproto v0.0.0-20250715232539-7130f93afb79 h1:Nt6z9UHqSlIdIGJdz6KhTIs2VRx/iOsA5iE8bmQNcxs=
+google.golang.org/genproto v0.0.0-20250715232539-7130f93afb79/go.mod h1:kTmlBHMPqR5uCZPBvwa2B18mvubkjyY3CRLI0c6fj0s=
+google.golang.org/genproto/googleapis/api v0.0.0-20251022142026-3a174f9686a8 h1:mepRgnBZa07I4TRuomDE4sTIYieg/osKmzIf4USdWS4=
+google.golang.org/genproto/googleapis/api v0.0.0-20251022142026-3a174f9686a8/go.mod h1:fDMmzKV90WSg1NbozdqrE64fkuTv6mlq2zxo9ad+3yo=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251111163417-95abcf5c77ba h1:UKgtfRM7Yh93Sya0Fo8ZzhDP4qBckrrxEr2oF5UIVb8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251111163417-95abcf5c77ba/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20251213004720-97cd9d5aeac2/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
@@ -1101,8 +1066,8 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
 google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.78.0 h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc=
-google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U=
+google.golang.org/grpc v1.77.0 h1:wVVY6/8cGA6vvffn+wWK5ToddbgdU3d8MNENr4evgXM=
+google.golang.org/grpc v1.77.0/go.mod h1:z0BY1iVj0q8E1uSQCjL9cppRj+gnZjzDnzV0dHhrNig=
 google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6 h1:ExN12ndbJ608cboPYflpTny6mXSzPrDLh0iTaVrRrds=
 google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6/go.mod h1:6ytKWczdvnpnO+m+JiG9NjEDzR1FJfsnmJdG7B8QVZ8=
 google.golang.org/grpc/security/advancedtls v1.0.0 h1:/KQ7VP/1bs53/aopk9QhuPyFAp9Dm9Ejix3lzYkCrDA=
@@ -1117,7 +1082,8 @@ google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
+google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -1155,8 +1121,8 @@ rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
 sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
-storj.io/common v0.0.0-20251107171817-6221ae45072c h1:UDXSrdeLJe3QFouavSW10fYdpclK0YNu3KvQHzqq2+k=
-storj.io/common v0.0.0-20251107171817-6221ae45072c/go.mod h1:XNX7uykja6aco92y2y8RuqaXIDRPpt1YA2OQDKlKEUk=
+storj.io/common v0.0.0-20250808122759-804533d519c1 h1:z7ZjU+TlPZ2Lq2S12hT6+Fr7jFsBxPMrPBH4zZpZuUA=
+storj.io/common v0.0.0-20250808122759-804533d519c1/go.mod h1:YNr7/ty6CmtpG5C9lEPtPXK3hOymZpueCb9QCNuPMUY=
 storj.io/drpc v0.0.35-0.20250513201419-f7819ea69b55 h1:8OE12DvUnB9lfZcHe7IDGsuhjrY9GBAr964PVHmhsro=
 storj.io/drpc v0.0.35-0.20250513201419-f7819ea69b55/go.mod h1:Y9LZaa8esL1PW2IDMqJE7CFSNq7d5bQ3RI7mGPtmKMg=
 storj.io/eventkit v0.0.0-20250410172343-61f26d3de156 h1:5MZ0CyMbG6Pi0rRzUWVG6dvpXjbBYEX2oyXuj+tT+sk=
@@ -14,7 +14,8 @@ sleep 2

 echo "Querying messages..."
 cd /Users/chrislu/go/src/github.com/seaweedfs/seaweedfs/test/kafka/kafka-client-loadtest
-docker compose exec kafka-gateway /usr/bin/weed-sql \
+docker compose exec kafka-gateway /usr/local/bin/weed sql \
  -master=seaweedfs-master:9333 \
  -database=kafka \
  -query="SELECT id, timestamp, producer_id, counter, user_id, event_type FROM \"test-json-topic\" LIMIT 5;"
+
@@ -1,285 +0,0 @@
-package erasure_coding_test
-
-import (
-	"context"
-	"fmt"
-	"testing"
-	"time"
-
-	pluginworkers "github.com/seaweedfs/seaweedfs/test/plugin_workers"
-	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
-	pluginworker "github.com/seaweedfs/seaweedfs/weed/plugin/worker"
-	ecstorage "github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-	"google.golang.org/protobuf/proto"
-)
-
-type topologySpec struct {
-	name         string
-	dataCenters  int
-	racksPerDC   int
-	nodesPerRack int
-	diskTypes    []string
-	replicas     int
-	collection   string
-}
-
-type detectionCase struct {
-	name                  string
-	topology              topologySpec
-	adminCollectionFilter string
-	expectProposals       bool
-}
-
-func TestErasureCodingDetectionAcrossTopologies(t *testing.T) {
-	cases := []detectionCase{
-		{
-			name: "single-dc-multi-rack",
-			topology: topologySpec{
-				name:         "single-dc-multi-rack",
-				dataCenters:  1,
-				racksPerDC:   2,
-				nodesPerRack: 7,
-				diskTypes:    []string{"hdd"},
-				replicas:     1,
-				collection:   "ec-test",
-			},
-			expectProposals: true,
-		},
-		{
-			name: "multi-dc",
-			topology: topologySpec{
-				name:         "multi-dc",
-				dataCenters:  2,
-				racksPerDC:   1,
-				nodesPerRack: 7,
-				diskTypes:    []string{"hdd"},
-				replicas:     1,
-				collection:   "ec-test",
-			},
-			expectProposals: true,
-		},
-		{
-			name: "multi-dc-multi-rack",
-			topology: topologySpec{
-				name:         "multi-dc-multi-rack",
-				dataCenters:  2,
-				racksPerDC:   2,
-				nodesPerRack: 4,
-				diskTypes:    []string{"hdd"},
-				replicas:     1,
-				collection:   "ec-test",
-			},
-			expectProposals: true,
-		},
-		{
-			name: "mixed-disk-types",
-			topology: topologySpec{
-				name:         "mixed-disk-types",
-				dataCenters:  1,
-				racksPerDC:   2,
-				nodesPerRack: 7,
-				diskTypes:    []string{"hdd", "ssd"},
-				replicas:     1,
-				collection:   "ec-test",
-			},
-			expectProposals: true,
-		},
-		{
-			name: "multi-replica-volume",
-			topology: topologySpec{
-				name:         "multi-replica-volume",
-				dataCenters:  1,
-				racksPerDC:   2,
-				nodesPerRack: 7,
-				diskTypes:    []string{"hdd"},
-				replicas:     3,
-				collection:   "ec-test",
-			},
-			expectProposals: true,
-		},
-		{
-			name: "collection-filter-match",
-			topology: topologySpec{
-				name:         "collection-filter-match",
-				dataCenters:  1,
-				racksPerDC:   2,
-				nodesPerRack: 7,
-				diskTypes:    []string{"hdd"},
-				replicas:     1,
-				collection:   "filtered",
-			},
-			adminCollectionFilter: "filtered",
-			expectProposals:       true,
-		},
-		{
-			name: "collection-filter-mismatch",
-			topology: topologySpec{
-				name:         "collection-filter-mismatch",
-				dataCenters:  1,
-				racksPerDC:   2,
-				nodesPerRack: 7,
-				diskTypes:    []string{"hdd"},
-				replicas:     1,
-				collection:   "filtered",
-			},
-			adminCollectionFilter: "other",
-			expectProposals:       false,
-		},
-		{
-			name: "insufficient-disks",
-			topology: topologySpec{
-				name:         "insufficient-disks",
-				dataCenters:  1,
-				racksPerDC:   1,
-				nodesPerRack: 2,
-				diskTypes:    []string{"hdd"},
-				replicas:     1,
-				collection:   "ec-test",
-			},
-			expectProposals: false,
-		},
-	}
-
-	for _, tc := range cases {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			volumeID := uint32(7)
-			response := buildVolumeListResponse(t, tc.topology, volumeID)
-			master := pluginworkers.NewMasterServer(t, response)
-
-			dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
-			handler := pluginworker.NewErasureCodingHandler(dialOption, t.TempDir())
-			harness := pluginworkers.NewHarness(t, pluginworkers.HarnessConfig{
-				WorkerOptions: pluginworker.WorkerOptions{
-					GrpcDialOption: dialOption,
-				},
-				Handlers: []pluginworker.JobHandler{handler},
-			})
-			harness.WaitForJobType("erasure_coding")
-
-			if tc.adminCollectionFilter != "" {
-				err := harness.Plugin().SaveJobTypeConfig(&plugin_pb.PersistedJobTypeConfig{
-					JobType: "erasure_coding",
-					AdminConfigValues: map[string]*plugin_pb.ConfigValue{
-						"collection_filter": {
-							Kind: &plugin_pb.ConfigValue_StringValue{StringValue: tc.adminCollectionFilter},
-						},
-					},
-				})
-				require.NoError(t, err)
-			}
-
-			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-			defer cancel()
-
-			proposals, err := harness.Plugin().RunDetection(ctx, "erasure_coding", &plugin_pb.ClusterContext{
-				MasterGrpcAddresses: []string{master.Address()},
-			}, 10)
-			require.NoError(t, err)
-
-			if !tc.expectProposals {
-				require.Empty(t, proposals)
-				return
-			}
-
-			require.NotEmpty(t, proposals)
-
-			proposal := proposals[0]
-			require.Equal(t, "erasure_coding", proposal.JobType)
-			paramsValue := proposal.Parameters["task_params_pb"]
-			require.NotNil(t, paramsValue)
-
-			params := &worker_pb.TaskParams{}
-			require.NoError(t, proto.Unmarshal(paramsValue.GetBytesValue(), params))
-			require.NotEmpty(t, params.Sources)
-			require.Len(t, params.Targets, ecstorage.TotalShardsCount)
-		})
-	}
-}
-
-func buildVolumeListResponse(t *testing.T, spec topologySpec, volumeID uint32) *master_pb.VolumeListResponse {
-	t.Helper()
-
-	volumeSizeLimitMB := uint64(100)
-	volumeSize := uint64(90) * 1024 * 1024
-	volumeModifiedAt := time.Now().Add(-10 * time.Minute).Unix()
-
-	diskTypes := spec.diskTypes
-	if len(diskTypes) == 0 {
-		diskTypes = []string{"hdd"}
-	}
-	replicas := spec.replicas
-	if replicas <= 0 {
-		replicas = 1
-	}
-	collection := spec.collection
-	if collection == "" {
-		collection = "ec-test"
-	}
-
-	var dataCenters []*master_pb.DataCenterInfo
-	nodeIndex := 0
-	replicasPlaced := 0
-
-	for dc := 0; dc < spec.dataCenters; dc++ {
-		var racks []*master_pb.RackInfo
-		for rack := 0; rack < spec.racksPerDC; rack++ {
-			var nodes []*master_pb.DataNodeInfo
-			for n := 0; n < spec.nodesPerRack; n++ {
-				nodeIndex++
-				address := fmt.Sprintf("127.0.0.1:%d", 20000+nodeIndex)
-				diskType := diskTypes[(nodeIndex-1)%len(diskTypes)]
-
-				diskInfo := &master_pb.DiskInfo{
-					DiskId:         0,
-					MaxVolumeCount: 100,
-					VolumeCount:    0,
-					VolumeInfos:    []*master_pb.VolumeInformationMessage{},
-				}
-
-				if replicasPlaced < replicas {
-					diskInfo.VolumeCount = 1
-					diskInfo.VolumeInfos = append(diskInfo.VolumeInfos, &master_pb.VolumeInformationMessage{
-						Id:               volumeID,
-						Collection:       collection,
-						DiskId:           0,
-						Size:             volumeSize,
-						DeletedByteCount: 0,
-						ModifiedAtSecond: volumeModifiedAt,
-						ReplicaPlacement: 1,
-						ReadOnly:         false,
-					})
-					replicasPlaced++
-				}
-
-				nodes = append(nodes, &master_pb.DataNodeInfo{
-					Id:        address,
-					Address:   address,
-					DiskInfos: map[string]*master_pb.DiskInfo{diskType: diskInfo},
-				})
-			}
-
-			racks = append(racks, &master_pb.RackInfo{
-				Id:            fmt.Sprintf("rack-%d", rack+1),
-				DataNodeInfos: nodes,
-			})
-		}
-
-		dataCenters = append(dataCenters, &master_pb.DataCenterInfo{
-			Id:        fmt.Sprintf("dc-%d", dc+1),
-			RackInfos: racks,
-		})
-	}
-
-	return &master_pb.VolumeListResponse{
-		VolumeSizeLimitMb: volumeSizeLimitMB,
-		TopologyInfo: &master_pb.TopologyInfo{
-			DataCenterInfos: dataCenters,
-		},
-	}
-}
@@ -1,83 +0,0 @@
-package erasure_coding_test
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	pluginworkers "github.com/seaweedfs/seaweedfs/test/plugin_workers"
-	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
-	pluginworker "github.com/seaweedfs/seaweedfs/weed/plugin/worker"
-	ecstorage "github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-)
-
-func TestErasureCodingExecutionEncodesShards(t *testing.T) {
-	volumeID := uint32(123)
-	datSize := 1 * 1024 * 1024
-
-	dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
-	handler := pluginworker.NewErasureCodingHandler(dialOption, t.TempDir())
-	harness := pluginworkers.NewHarness(t, pluginworkers.HarnessConfig{
-		WorkerOptions: pluginworker.WorkerOptions{
-			GrpcDialOption: dialOption,
-		},
-		Handlers: []pluginworker.JobHandler{handler},
-	})
-	harness.WaitForJobType("erasure_coding")
-
-	sourceServer := pluginworkers.NewVolumeServer(t, "")
-	pluginworkers.WriteTestVolumeFiles(t, sourceServer.BaseDir(), volumeID, datSize)
-
-	targetServers := make([]*pluginworkers.VolumeServer, 0, ecstorage.TotalShardsCount)
-	targetAddresses := make([]string, 0, ecstorage.TotalShardsCount)
-	for i := 0; i < ecstorage.TotalShardsCount; i++ {
-		target := pluginworkers.NewVolumeServer(t, "")
-		targetServers = append(targetServers, target)
-		targetAddresses = append(targetAddresses, target.Address())
-	}
-
-	job := &plugin_pb.JobSpec{
-		JobId:   fmt.Sprintf("ec-job-%d", volumeID),
-		JobType: "erasure_coding",
-		Parameters: map[string]*plugin_pb.ConfigValue{
-			"volume_id": {
-				Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: int64(volumeID)},
-			},
-			"collection": {
-				Kind: &plugin_pb.ConfigValue_StringValue{StringValue: "ec-test"},
-			},
-			"source_server": {
-				Kind: &plugin_pb.ConfigValue_StringValue{StringValue: sourceServer.Address()},
-			},
-			"target_servers": {
-				Kind: &plugin_pb.ConfigValue_StringList{StringList: &plugin_pb.StringList{Values: targetAddresses}},
-			},
-		},
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	result, err := harness.Plugin().ExecuteJob(ctx, job, nil, 1)
-	require.NoError(t, err)
-	require.NotNil(t, result)
-	require.True(t, result.Success)
-
-	require.GreaterOrEqual(t, sourceServer.MarkReadonlyCount(), 1)
-	require.GreaterOrEqual(t, len(sourceServer.DeleteRequests()), 1)
-
-	for shardID := 0; shardID < ecstorage.TotalShardsCount; shardID++ {
-		targetIndex := shardID % len(targetServers)
-		target := targetServers[targetIndex]
-		expected := filepath.Join(target.BaseDir(), fmt.Sprintf("%d.ec%02d", volumeID, shardID))
-		info, err := os.Stat(expected)
-		require.NoErrorf(t, err, "missing shard file %s", expected)
-		require.Greater(t, info.Size(), int64(0))
-	}
-}
@@ -1,123 +0,0 @@
-package erasure_coding_test
-
-import (
-	"context"
-	"fmt"
-	"testing"
-	"time"
-
-	pluginworkers "github.com/seaweedfs/seaweedfs/test/plugin_workers"
-	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
-	pluginworker "github.com/seaweedfs/seaweedfs/weed/plugin/worker"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-)
-
-func TestErasureCodingDetectionLargeTopology(t *testing.T) {
-	const (
-		rackCount       = 100
-		serverCount     = 1000
-		volumesPerNode  = 300
-		volumeSizeLimit = uint64(100)
-	)
-
-	if serverCount%rackCount != 0 {
-		t.Fatalf("serverCount (%d) must be divisible by rackCount (%d)", serverCount, rackCount)
-	}
-
-	nodesPerRack := serverCount / rackCount
-	eligibleSize := uint64(90) * 1024 * 1024
-	ineligibleSize := uint64(10) * 1024 * 1024
-	modifiedAt := time.Now().Add(-10 * time.Minute).Unix()
-
-	volumeID := uint32(1)
-	dataCenters := make([]*master_pb.DataCenterInfo, 0, 1)
-
-	racks := make([]*master_pb.RackInfo, 0, rackCount)
-	for rack := 0; rack < rackCount; rack++ {
-		nodes := make([]*master_pb.DataNodeInfo, 0, nodesPerRack)
-		for node := 0; node < nodesPerRack; node++ {
-			address := fmt.Sprintf("10.0.%d.%d:8080", rack, node+1)
-			volumes := make([]*master_pb.VolumeInformationMessage, 0, volumesPerNode)
-			for v := 0; v < volumesPerNode; v++ {
-				size := ineligibleSize
-				if volumeID%2 == 0 {
-					size = eligibleSize
-				}
-				volumes = append(volumes, &master_pb.VolumeInformationMessage{
-					Id:               volumeID,
-					Collection:       "ec-bulk",
-					DiskId:           0,
-					Size:             size,
-					DeletedByteCount: 0,
-					ModifiedAtSecond: modifiedAt,
-					ReplicaPlacement: 1,
-					ReadOnly:         false,
-				})
-				volumeID++
-			}
-
-			diskInfo := &master_pb.DiskInfo{
-				DiskId:         0,
-				MaxVolumeCount: int64(volumesPerNode + 10),
-				VolumeCount:    int64(volumesPerNode),
-				VolumeInfos:    volumes,
-			}
-
-			nodes = append(nodes, &master_pb.DataNodeInfo{
-				Id:        address,
-				Address:   address,
-				DiskInfos: map[string]*master_pb.DiskInfo{"hdd": diskInfo},
-			})
-		}
-
-		racks = append(racks, &master_pb.RackInfo{
-			Id:            fmt.Sprintf("rack-%d", rack+1),
-			DataNodeInfos: nodes,
-		})
-	}
-
-	dataCenters = append(dataCenters, &master_pb.DataCenterInfo{
-		Id:        "dc-1",
-		RackInfos: racks,
-	})
-
-	response := &master_pb.VolumeListResponse{
-		VolumeSizeLimitMb: volumeSizeLimit,
-		TopologyInfo: &master_pb.TopologyInfo{
-			DataCenterInfos: dataCenters,
-		},
-	}
-
-	master := pluginworkers.NewMasterServer(t, response)
-
-	dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
-	handler := pluginworker.NewErasureCodingHandler(dialOption, t.TempDir())
-	harness := pluginworkers.NewHarness(t, pluginworkers.HarnessConfig{
-		WorkerOptions: pluginworker.WorkerOptions{
-			GrpcDialOption: dialOption,
-		},
-		Handlers: []pluginworker.JobHandler{handler},
-	})
-	harness.WaitForJobType("erasure_coding")
-
-	totalVolumes := serverCount * volumesPerNode
-	expectedEligible := totalVolumes / 2
-
-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
-	defer cancel()
-
-	start := time.Now()
-	proposals, err := harness.Plugin().RunDetection(ctx, "erasure_coding", &plugin_pb.ClusterContext{
-		MasterGrpcAddresses: []string{master.Address()},
-	}, 0)
-	duration := time.Since(start)
-	require.NoError(t, err)
-	require.GreaterOrEqual(t, len(proposals), 10, "should detect at least some proposals")
-	t.Logf("large topology detection completed in %s (proposals=%d, eligible=%d)", duration, len(proposals), expectedEligible)
-	if len(proposals) < expectedEligible {
-		t.Logf("large topology detection stopped early: %d proposals vs %d eligible", len(proposals), expectedEligible)
-	}
-}
@@ -1,90 +0,0 @@
-package pluginworkers
-
-import (
-	"context"
-	"net"
-	"sync"
-
-	"github.com/seaweedfs/seaweedfs/weed/pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
-	"google.golang.org/grpc"
-	"google.golang.org/protobuf/proto"
-	"testing"
-)
-
-// MasterServer provides a stub master gRPC service for topology responses.
-type MasterServer struct {
-	master_pb.UnimplementedSeaweedServer
-
-	t *testing.T
-
-	server   *grpc.Server
-	listener net.Listener
-	address  string
-
-	mu       sync.RWMutex
-	response *master_pb.VolumeListResponse
-}
-
-// NewMasterServer starts a stub master server that serves the provided response.
-func NewMasterServer(t *testing.T, response *master_pb.VolumeListResponse) *MasterServer {
-	t.Helper()
-
-	listener, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen master: %v", err)
-	}
-
-	server := pb.NewGrpcServer()
-	ms := &MasterServer{
-		t:        t,
-		server:   server,
-		listener: listener,
-		address:  listener.Addr().String(),
-		response: response,
-	}
-
-	master_pb.RegisterSeaweedServer(server, ms)
-	go func() {
-		_ = server.Serve(listener)
-	}()
-
-	t.Cleanup(func() {
-		ms.Shutdown()
-	})
-
-	return ms
-}
-
-// Address returns the gRPC address of the master server.
-func (m *MasterServer) Address() string {
-	return m.address
-}
-
-// SetVolumeListResponse updates the response served by VolumeList.
-func (m *MasterServer) SetVolumeListResponse(response *master_pb.VolumeListResponse) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.response = response
-}
-
-// VolumeList returns the configured topology response.
-func (m *MasterServer) VolumeList(ctx context.Context, req *master_pb.VolumeListRequest) (*master_pb.VolumeListResponse, error) {
-	m.mu.RLock()
-	defer m.mu.RUnlock()
-
-	if m.response == nil {
-		return &master_pb.VolumeListResponse{}, nil
-	}
-	return proto.Clone(m.response).(*master_pb.VolumeListResponse), nil
-}
-
-// Shutdown stops the master gRPC server.
-func (m *MasterServer) Shutdown() {
-	if m.server != nil {
-		m.server.GracefulStop()
-	}
-	if m.listener != nil {
-		_ = m.listener.Close()
-	}
-}
@@ -1,335 +0,0 @@
-package pluginworkers
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net"
-	"os"
-	"path/filepath"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/seaweedfs/seaweedfs/weed/pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
-	"google.golang.org/grpc"
-)
-
-// VolumeServer provides a minimal volume server for erasure coding tests.
-type VolumeServer struct {
-	volume_server_pb.UnimplementedVolumeServerServer
-
-	t *testing.T
-
-	server   *grpc.Server
-	listener net.Listener
-	address  string
-	baseDir  string
-
-	mu                 sync.Mutex
-	receivedFiles      map[string]uint64
-	mountRequests      []*volume_server_pb.VolumeEcShardsMountRequest
-	deleteRequests     []*volume_server_pb.VolumeDeleteRequest
-	markReadonlyCalls  int
-	vacuumGarbageRatio float64
-	vacuumCheckCalls   int
-	vacuumCompactCalls int
-	vacuumCommitCalls  int
-	vacuumCleanupCalls int
-	volumeCopyCalls    int
-	volumeMountCalls   int
-	tailReceiverCalls  int
-}
-
-// NewVolumeServer starts a test volume server using the provided base directory.
-func NewVolumeServer(t *testing.T, baseDir string) *VolumeServer {
-	t.Helper()
-
-	if baseDir == "" {
-		baseDir = t.TempDir()
-	}
-	if err := os.MkdirAll(baseDir, 0755); err != nil {
-		t.Fatalf("create volume base dir: %v", err)
-	}
-
-	listener, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen volume server: %v", err)
-	}
-
-	grpcPort := listener.Addr().(*net.TCPAddr).Port
-	server := pb.NewGrpcServer()
-	vs := &VolumeServer{
-		t:             t,
-		server:        server,
-		listener:      listener,
-		address:       fmt.Sprintf("127.0.0.1:0.%d", grpcPort),
-		baseDir:       baseDir,
-		receivedFiles: make(map[string]uint64),
-	}
-
-	volume_server_pb.RegisterVolumeServerServer(server, vs)
-	go func() {
-		_ = server.Serve(listener)
-	}()
-
-	t.Cleanup(func() {
-		vs.Shutdown()
-	})
-
-	return vs
-}
-
-// Address returns the gRPC address of the volume server.
-func (v *VolumeServer) Address() string {
-	return v.address
-}
-
-// BaseDir returns the base directory used by the server.
-func (v *VolumeServer) BaseDir() string {
-	return v.baseDir
-}
-
-// ReceivedFiles returns a snapshot of received files and byte counts.
-func (v *VolumeServer) ReceivedFiles() map[string]uint64 {
-	v.mu.Lock()
-	defer v.mu.Unlock()
-
-	out := make(map[string]uint64, len(v.receivedFiles))
-	for key, value := range v.receivedFiles {
-		out[key] = value
-	}
-	return out
-}
-
-// SetVacuumGarbageRatio sets the garbage ratio returned by VacuumVolumeCheck.
-func (v *VolumeServer) SetVacuumGarbageRatio(ratio float64) {
-	v.mu.Lock()
-	defer v.mu.Unlock()
-	v.vacuumGarbageRatio = ratio
-}
-
-// VacuumStats returns the vacuum RPC call counts.
-func (v *VolumeServer) VacuumStats() (check, compact, commit, cleanup int) {
-	v.mu.Lock()
-	defer v.mu.Unlock()
-	return v.vacuumCheckCalls, v.vacuumCompactCalls, v.vacuumCommitCalls, v.vacuumCleanupCalls
-}
-
-// BalanceStats returns the balance RPC call counts.
-func (v *VolumeServer) BalanceStats() (copyCalls, mountCalls, tailCalls int) {
-	v.mu.Lock()
-	defer v.mu.Unlock()
-	return v.volumeCopyCalls, v.volumeMountCalls, v.tailReceiverCalls
-}
-
-// MountRequests returns recorded mount requests.
-func (v *VolumeServer) MountRequests() []*volume_server_pb.VolumeEcShardsMountRequest {
-	v.mu.Lock()
-	defer v.mu.Unlock()
-
-	out := make([]*volume_server_pb.VolumeEcShardsMountRequest, len(v.mountRequests))
-	copy(out, v.mountRequests)
-	return out
-}
-
-// DeleteRequests returns recorded delete requests.
-func (v *VolumeServer) DeleteRequests() []*volume_server_pb.VolumeDeleteRequest {
-	v.mu.Lock()
-	defer v.mu.Unlock()
-
-	out := make([]*volume_server_pb.VolumeDeleteRequest, len(v.deleteRequests))
-	copy(out, v.deleteRequests)
-	return out
-}
-
-// MarkReadonlyCount returns the number of readonly calls.
-func (v *VolumeServer) MarkReadonlyCount() int {
-	v.mu.Lock()
-	defer v.mu.Unlock()
-	return v.markReadonlyCalls
-}
-
-// Shutdown stops the volume server.
-func (v *VolumeServer) Shutdown() {
-	if v.server != nil {
-		v.server.GracefulStop()
-	}
-	if v.listener != nil {
-		_ = v.listener.Close()
-	}
-}
-
-func (v *VolumeServer) filePath(volumeID uint32, ext string) string {
-	return filepath.Join(v.baseDir, fmt.Sprintf("%d%s", volumeID, ext))
-}
-
-func (v *VolumeServer) CopyFile(req *volume_server_pb.CopyFileRequest, stream volume_server_pb.VolumeServer_CopyFileServer) error {
-	if req == nil {
-		return fmt.Errorf("copy file request is nil")
-	}
-	path := v.filePath(req.VolumeId, req.Ext)
-	file, err := os.Open(path)
-	if err != nil {
-		if req.IgnoreSourceFileNotFound {
-			return nil
-		}
-		return err
-	}
-	defer file.Close()
-
-	buf := make([]byte, 64*1024)
-	for {
-		n, readErr := file.Read(buf)
-		if n > 0 {
-			if err := stream.Send(&volume_server_pb.CopyFileResponse{FileContent: buf[:n]}); err != nil {
-				return err
-			}
-		}
-		if readErr == io.EOF {
-			break
-		}
-		if readErr != nil {
-			return readErr
-		}
-	}
-	return nil
-}
-
-func (v *VolumeServer) ReceiveFile(stream volume_server_pb.VolumeServer_ReceiveFileServer) error {
-	var (
-		info         *volume_server_pb.ReceiveFileInfo
-		file         *os.File
-		bytesWritten uint64
-		filePath     string
-	)
-	defer func() {
-		if file != nil {
-			_ = file.Close()
-		}
-	}()
-
-	for {
-		req, err := stream.Recv()
-		if err == io.EOF {
-			if info == nil {
-				return stream.SendAndClose(&volume_server_pb.ReceiveFileResponse{Error: "missing file info"})
-			}
-			v.mu.Lock()
-			v.receivedFiles[filePath] = bytesWritten
-			v.mu.Unlock()
-			return stream.SendAndClose(&volume_server_pb.ReceiveFileResponse{BytesWritten: bytesWritten})
-		}
-		if err != nil {
-			return err
-		}
-
-		if reqInfo := req.GetInfo(); reqInfo != nil {
-			info = reqInfo
-			filePath = v.filePath(info.VolumeId, info.Ext)
-			if err := os.MkdirAll(filepath.Dir(filePath), 0755); err != nil {
-				return err
-			}
-			file, err = os.Create(filePath)
-			if err != nil {
-				return err
-			}
-			continue
-		}
-
-		chunk := req.GetFileContent()
-		if len(chunk) == 0 {
-			continue
-		}
-		if file == nil {
-			return fmt.Errorf("file info not received")
-		}
-		n, writeErr := file.Write(chunk)
-		if writeErr != nil {
-			return writeErr
-		}
-		bytesWritten += uint64(n)
-	}
-}
-
-func (v *VolumeServer) VolumeEcShardsMount(ctx context.Context, req *volume_server_pb.VolumeEcShardsMountRequest) (*volume_server_pb.VolumeEcShardsMountResponse, error) {
-	v.mu.Lock()
-	v.mountRequests = append(v.mountRequests, req)
-	v.mu.Unlock()
-	return &volume_server_pb.VolumeEcShardsMountResponse{}, nil
-}
-
-func (v *VolumeServer) VolumeDelete(ctx context.Context, req *volume_server_pb.VolumeDeleteRequest) (*volume_server_pb.VolumeDeleteResponse, error) {
-	v.mu.Lock()
-	v.deleteRequests = append(v.deleteRequests, req)
-	v.mu.Unlock()
-
-	if req != nil {
-		_ = os.Remove(v.filePath(req.VolumeId, ".dat"))
-		_ = os.Remove(v.filePath(req.VolumeId, ".idx"))
-	}
-
-	return &volume_server_pb.VolumeDeleteResponse{}, nil
-}
-
-func (v *VolumeServer) VolumeMarkReadonly(ctx context.Context, req *volume_server_pb.VolumeMarkReadonlyRequest) (*volume_server_pb.VolumeMarkReadonlyResponse, error) {
-	v.mu.Lock()
-	v.markReadonlyCalls++
-	v.mu.Unlock()
-	return &volume_server_pb.VolumeMarkReadonlyResponse{}, nil
-}
-
-func (v *VolumeServer) VacuumVolumeCheck(ctx context.Context, req *volume_server_pb.VacuumVolumeCheckRequest) (*volume_server_pb.VacuumVolumeCheckResponse, error) {
-	v.mu.Lock()
-	v.vacuumCheckCalls++
-	ratio := v.vacuumGarbageRatio
-	v.mu.Unlock()
-	return &volume_server_pb.VacuumVolumeCheckResponse{GarbageRatio: ratio}, nil
-}
-
-func (v *VolumeServer) VacuumVolumeCompact(req *volume_server_pb.VacuumVolumeCompactRequest, stream volume_server_pb.VolumeServer_VacuumVolumeCompactServer) error {
-	v.mu.Lock()
-	v.vacuumCompactCalls++
-	v.mu.Unlock()
-	return stream.Send(&volume_server_pb.VacuumVolumeCompactResponse{ProcessedBytes: 1024})
-}
-
-func (v *VolumeServer) VacuumVolumeCommit(ctx context.Context, req *volume_server_pb.VacuumVolumeCommitRequest) (*volume_server_pb.VacuumVolumeCommitResponse, error) {
-	v.mu.Lock()
-	v.vacuumCommitCalls++
-	v.mu.Unlock()
-	return &volume_server_pb.VacuumVolumeCommitResponse{}, nil
-}
-
-func (v *VolumeServer) VacuumVolumeCleanup(ctx context.Context, req *volume_server_pb.VacuumVolumeCleanupRequest) (*volume_server_pb.VacuumVolumeCleanupResponse, error) {
-	v.mu.Lock()
-	v.vacuumCleanupCalls++
-	v.mu.Unlock()
-	return &volume_server_pb.VacuumVolumeCleanupResponse{}, nil
-}
-
-func (v *VolumeServer) VolumeCopy(req *volume_server_pb.VolumeCopyRequest, stream volume_server_pb.VolumeServer_VolumeCopyServer) error {
-	v.mu.Lock()
-	v.volumeCopyCalls++
-	v.mu.Unlock()
-
-	if err := stream.Send(&volume_server_pb.VolumeCopyResponse{ProcessedBytes: 1024}); err != nil {
-		return err
-	}
-	return stream.Send(&volume_server_pb.VolumeCopyResponse{LastAppendAtNs: uint64(time.Now().UnixNano())})
-}
-
-func (v *VolumeServer) VolumeMount(ctx context.Context, req *volume_server_pb.VolumeMountRequest) (*volume_server_pb.VolumeMountResponse, error) {
-	v.mu.Lock()
-	v.volumeMountCalls++
-	v.mu.Unlock()
-	return &volume_server_pb.VolumeMountResponse{}, nil
-}
-
-func (v *VolumeServer) VolumeTailReceiver(ctx context.Context, req *volume_server_pb.VolumeTailReceiverRequest) (*volume_server_pb.VolumeTailReceiverResponse, error) {
-	v.mu.Lock()
-	v.tailReceiverCalls++
-	v.mu.Unlock()
-	return &volume_server_pb.VolumeTailReceiverResponse{}, nil
-}
@@ -1,171 +0,0 @@
-package pluginworkers
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"testing"
-	"time"
-
-	"github.com/seaweedfs/seaweedfs/weed/admin/plugin"
-	"github.com/seaweedfs/seaweedfs/weed/pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
-	pluginworker "github.com/seaweedfs/seaweedfs/weed/plugin/worker"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-)
-
-// HarnessConfig configures the shared plugin worker test harness.
-type HarnessConfig struct {
-	PluginOptions plugin.Options
-	WorkerOptions pluginworker.WorkerOptions
-	Handlers      []pluginworker.JobHandler
-}
-
-// Harness manages an in-process plugin admin server and worker.
-type Harness struct {
-	t *testing.T
-
-	pluginSvc *plugin.Plugin
-
-	adminServer   *grpc.Server
-	adminListener net.Listener
-	adminGrpcAddr string
-
-	worker       *pluginworker.Worker
-	workerCtx    context.Context
-	workerCancel context.CancelFunc
-	workerDone   chan struct{}
-}
-
-// NewHarness starts a plugin admin gRPC server and a worker connected to it.
-func NewHarness(t *testing.T, cfg HarnessConfig) *Harness {
-	t.Helper()
-
-	pluginOpts := cfg.PluginOptions
-	if pluginOpts.DataDir == "" {
-		pluginOpts.DataDir = t.TempDir()
-	}
-
-	pluginSvc, err := plugin.New(pluginOpts)
-	require.NoError(t, err)
-
-	listener, err := net.Listen("tcp", "127.0.0.1:0")
-	require.NoError(t, err)
-
-	adminServer := pb.NewGrpcServer()
-	plugin_pb.RegisterPluginControlServiceServer(adminServer, pluginSvc)
-	go func() {
-		_ = adminServer.Serve(listener)
-	}()
-
-	adminGrpcAddr := listener.Addr().String()
-	adminPort := listener.Addr().(*net.TCPAddr).Port
-	adminAddr := fmt.Sprintf("127.0.0.1:0.%d", adminPort)
-
-	workerOpts := cfg.WorkerOptions
-	if workerOpts.AdminServer == "" {
-		workerOpts.AdminServer = adminAddr
-	}
-	if workerOpts.GrpcDialOption == nil {
-		workerOpts.GrpcDialOption = grpc.WithTransportCredentials(insecure.NewCredentials())
-	}
-	if workerOpts.WorkerID == "" {
-		workerOpts.WorkerID = "plugin-worker-test"
-	}
-	if workerOpts.WorkerVersion == "" {
-		workerOpts.WorkerVersion = "test"
-	}
-	if workerOpts.WorkerAddress == "" {
-		workerOpts.WorkerAddress = "127.0.0.1"
-	}
-	if len(cfg.Handlers) > 0 {
-		workerOpts.Handlers = cfg.Handlers
-	}
-
-	worker, err := pluginworker.NewWorker(workerOpts)
-	require.NoError(t, err)
-
-	workerCtx, workerCancel := context.WithCancel(context.Background())
-	workerDone := make(chan struct{})
-	go func() {
-		defer close(workerDone)
-		_ = worker.Run(workerCtx)
-	}()
-
-	harness := &Harness{
-		t:             t,
-		pluginSvc:     pluginSvc,
-		adminServer:   adminServer,
-		adminListener: listener,
-		adminGrpcAddr: adminGrpcAddr,
-		worker:        worker,
-		workerCtx:     workerCtx,
-		workerCancel:  workerCancel,
-		workerDone:    workerDone,
-	}
-
-	require.Eventually(t, func() bool {
-		return len(pluginSvc.ListWorkers()) > 0
-	}, 5*time.Second, 50*time.Millisecond)
-
-	t.Cleanup(func() {
-		harness.Shutdown()
-	})
-
-	return harness
-}
-
-// Plugin exposes the underlying admin plugin service.
-func (h *Harness) Plugin() *plugin.Plugin {
-	return h.pluginSvc
-}
-
-// AdminGrpcAddress returns the gRPC address for the admin server.
-func (h *Harness) AdminGrpcAddress() string {
-	return h.adminGrpcAddr
-}
-
-// WaitForJobType waits until a worker with the given capability is registered.
-func (h *Harness) WaitForJobType(jobType string) {
-	h.t.Helper()
-	require.Eventually(h.t, func() bool {
-		workers := h.pluginSvc.ListWorkers()
-		for _, worker := range workers {
-			if worker == nil || worker.Capabilities == nil {
-				continue
-			}
-			if _, ok := worker.Capabilities[jobType]; ok {
-				return true
-			}
-		}
-		return false
-	}, 5*time.Second, 50*time.Millisecond)
-}
-
-// Shutdown stops the worker and admin server.
-func (h *Harness) Shutdown() {
-	if h.workerCancel != nil {
-		h.workerCancel()
-	}
-
-	if h.workerDone != nil {
-		select {
-		case <-h.workerDone:
-		case <-time.After(2 * time.Second):
-		}
-	}
-
-	if h.adminServer != nil {
-		h.adminServer.GracefulStop()
-	}
-
-	if h.adminListener != nil {
-		_ = h.adminListener.Close()
-	}
-
-	if h.pluginSvc != nil {
-		h.pluginSvc.Shutdown()
-	}
-}
@@ -1,104 +0,0 @@
-package vacuum_test
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	pluginworkers "github.com/seaweedfs/seaweedfs/test/plugin_workers"
-	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
-	pluginworker "github.com/seaweedfs/seaweedfs/weed/plugin/worker"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-	"google.golang.org/protobuf/proto"
-)
-
-func TestVacuumDetectionIntegration(t *testing.T) {
-	volumeID := uint32(101)
-	source := pluginworkers.NewVolumeServer(t, "")
-
-	response := buildVacuumVolumeListResponse(t, source.Address(), volumeID, 0.6)
-	master := pluginworkers.NewMasterServer(t, response)
-
-	dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
-	handler := pluginworker.NewVacuumHandler(dialOption, 1)
-	harness := pluginworkers.NewHarness(t, pluginworkers.HarnessConfig{
-		WorkerOptions: pluginworker.WorkerOptions{
-			GrpcDialOption: dialOption,
-		},
-		Handlers: []pluginworker.JobHandler{handler},
-	})
-	harness.WaitForJobType("vacuum")
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	proposals, err := harness.Plugin().RunDetection(ctx, "vacuum", &plugin_pb.ClusterContext{
-		MasterGrpcAddresses: []string{master.Address()},
-	}, 10)
-	require.NoError(t, err)
-	require.NotEmpty(t, proposals)
-
-	proposal := proposals[0]
-	require.Equal(t, "vacuum", proposal.JobType)
-	paramsValue := proposal.Parameters["task_params_pb"]
-	require.NotNil(t, paramsValue)
-
-	params := &worker_pb.TaskParams{}
-	require.NoError(t, proto.Unmarshal(paramsValue.GetBytesValue(), params))
-	require.NotEmpty(t, params.Sources)
-	require.NotNil(t, params.GetVacuumParams())
-}
-
-func buildVacuumVolumeListResponse(t *testing.T, serverAddress string, volumeID uint32, garbageRatio float64) *master_pb.VolumeListResponse {
-	t.Helper()
-
-	volumeSizeLimitMB := uint64(100)
-	volumeSize := uint64(90) * 1024 * 1024
-	deletedBytes := uint64(float64(volumeSize) * garbageRatio)
-	volumeModifiedAt := time.Now().Add(-48 * time.Hour).Unix()
-
-	diskInfo := &master_pb.DiskInfo{
-		DiskId:         0,
-		MaxVolumeCount: 100,
-		VolumeCount:    1,
-		VolumeInfos: []*master_pb.VolumeInformationMessage{
-			{
-				Id:               volumeID,
-				Collection:       "vac-test",
-				DiskId:           0,
-				Size:             volumeSize,
-				DeletedByteCount: deletedBytes,
-				ModifiedAtSecond: volumeModifiedAt,
-				ReplicaPlacement: 1,
-				ReadOnly:         false,
-			},
-		},
-	}
-
-	node := &master_pb.DataNodeInfo{
-		Id:        serverAddress,
-		Address:   serverAddress,
-		DiskInfos: map[string]*master_pb.DiskInfo{"hdd": diskInfo},
-	}
-
-	return &master_pb.VolumeListResponse{
-		VolumeSizeLimitMb: volumeSizeLimitMB,
-		TopologyInfo: &master_pb.TopologyInfo{
-			DataCenterInfos: []*master_pb.DataCenterInfo{
-				{
-					Id: "dc-1",
-					RackInfos: []*master_pb.RackInfo{
-						{
-							Id:            "rack-1",
-							DataNodeInfos: []*master_pb.DataNodeInfo{node},
-						},
-					},
-				},
-			},
-		},
-	}
-}
@@ -1,62 +0,0 @@
-package vacuum_test
-
-import (
-	"context"
-	"fmt"
-	"testing"
-	"time"
-
-	pluginworkers "github.com/seaweedfs/seaweedfs/test/plugin_workers"
-	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
-	pluginworker "github.com/seaweedfs/seaweedfs/weed/plugin/worker"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-)
-
-func TestVacuumExecutionIntegration(t *testing.T) {
-	volumeID := uint32(202)
-
-	dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
-	handler := pluginworker.NewVacuumHandler(dialOption, 1)
-	harness := pluginworkers.NewHarness(t, pluginworkers.HarnessConfig{
-		WorkerOptions: pluginworker.WorkerOptions{
-			GrpcDialOption: dialOption,
-		},
-		Handlers: []pluginworker.JobHandler{handler},
-	})
-	harness.WaitForJobType("vacuum")
-
-	source := pluginworkers.NewVolumeServer(t, "")
-	source.SetVacuumGarbageRatio(0.6)
-
-	job := &plugin_pb.JobSpec{
-		JobId:   fmt.Sprintf("vacuum-job-%d", volumeID),
-		JobType: "vacuum",
-		Parameters: map[string]*plugin_pb.ConfigValue{
-			"volume_id": {
-				Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: int64(volumeID)},
-			},
-			"server": {
-				Kind: &plugin_pb.ConfigValue_StringValue{StringValue: source.Address()},
-			},
-			"collection": {
-				Kind: &plugin_pb.ConfigValue_StringValue{StringValue: "vac-test"},
-			},
-		},
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	result, err := harness.Plugin().ExecuteJob(ctx, job, nil, 1)
-	require.NoError(t, err)
-	require.NotNil(t, result)
-	require.True(t, result.Success)
-
-	checkCalls, compactCalls, commitCalls, cleanupCalls := source.VacuumStats()
-	require.GreaterOrEqual(t, checkCalls, 2)
-	require.GreaterOrEqual(t, compactCalls, 1)
-	require.GreaterOrEqual(t, commitCalls, 1)
-	require.GreaterOrEqual(t, cleanupCalls, 1)
-}
@@ -1,129 +0,0 @@
-package volume_balance_test
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	pluginworkers "github.com/seaweedfs/seaweedfs/test/plugin_workers"
-	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
-	pluginworker "github.com/seaweedfs/seaweedfs/weed/plugin/worker"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-	"google.golang.org/protobuf/proto"
-)
-
-func TestVolumeBalanceDetectionIntegration(t *testing.T) {
-	response := buildBalanceVolumeListResponse(t)
-	master := pluginworkers.NewMasterServer(t, response)
-
-	dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
-	handler := pluginworker.NewVolumeBalanceHandler(dialOption)
-	harness := pluginworkers.NewHarness(t, pluginworkers.HarnessConfig{
-		WorkerOptions: pluginworker.WorkerOptions{
-			GrpcDialOption: dialOption,
-		},
-		Handlers: []pluginworker.JobHandler{handler},
-	})
-	harness.WaitForJobType("volume_balance")
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	proposals, err := harness.Plugin().RunDetection(ctx, "volume_balance", &plugin_pb.ClusterContext{
-		MasterGrpcAddresses: []string{master.Address()},
-	}, 10)
-	require.NoError(t, err)
-	require.Len(t, proposals, 1)
-
-	proposal := proposals[0]
-	require.Equal(t, "volume_balance", proposal.JobType)
-	paramsValue := proposal.Parameters["task_params_pb"]
-	require.NotNil(t, paramsValue)
-
-	params := &worker_pb.TaskParams{}
-	require.NoError(t, proto.Unmarshal(paramsValue.GetBytesValue(), params))
-	require.NotEmpty(t, params.Sources)
-	require.NotEmpty(t, params.Targets)
-}
-
-func buildBalanceVolumeListResponse(t *testing.T) *master_pb.VolumeListResponse {
-	t.Helper()
-
-	volumeSizeLimitMB := uint64(100)
-	volumeModifiedAt := time.Now().Add(-2 * time.Hour).Unix()
-
-	overloadedVolumes := make([]*master_pb.VolumeInformationMessage, 0, 10)
-	for i := 0; i < 10; i++ {
-		volumeID := uint32(1000 + i)
-		overloadedVolumes = append(overloadedVolumes, &master_pb.VolumeInformationMessage{
-			Id:               volumeID,
-			Collection:       "balance",
-			DiskId:           0,
-			Size:             20 * 1024 * 1024,
-			DeletedByteCount: 0,
-			ModifiedAtSecond: volumeModifiedAt,
-			ReplicaPlacement: 1,
-			ReadOnly:         false,
-		})
-	}
-
-	underloadedVolumes := []*master_pb.VolumeInformationMessage{
-		{
-			Id:               2000,
-			Collection:       "balance",
-			DiskId:           0,
-			Size:             20 * 1024 * 1024,
-			DeletedByteCount: 0,
-			ModifiedAtSecond: volumeModifiedAt,
-			ReplicaPlacement: 1,
-			ReadOnly:         false,
-		},
-	}
-
-	overloadedDisk := &master_pb.DiskInfo{
-		DiskId:         0,
-		MaxVolumeCount: 100,
-		VolumeCount:    int64(len(overloadedVolumes)),
-		VolumeInfos:    overloadedVolumes,
-	}
-
-	underloadedDisk := &master_pb.DiskInfo{
-		DiskId:         0,
-		MaxVolumeCount: 100,
-		VolumeCount:    int64(len(underloadedVolumes)),
-		VolumeInfos:    underloadedVolumes,
-	}
-
-	overloadedNode := &master_pb.DataNodeInfo{
-		Id:        "10.0.0.1:8080",
-		Address:   "10.0.0.1:8080",
-		DiskInfos: map[string]*master_pb.DiskInfo{"hdd": overloadedDisk},
-	}
-
-	underloadedNode := &master_pb.DataNodeInfo{
-		Id:        "10.0.0.2:8080",
-		Address:   "10.0.0.2:8080",
-		DiskInfos: map[string]*master_pb.DiskInfo{"hdd": underloadedDisk},
-	}
-
-	rack := &master_pb.RackInfo{
-		Id:            "rack-1",
-		DataNodeInfos: []*master_pb.DataNodeInfo{overloadedNode, underloadedNode},
-	}
-
-	return &master_pb.VolumeListResponse{
-		VolumeSizeLimitMb: volumeSizeLimitMB,
-		TopologyInfo: &master_pb.TopologyInfo{
-			DataCenterInfos: []*master_pb.DataCenterInfo{
-				{
-					Id:        "dc-1",
-					RackInfos: []*master_pb.RackInfo{rack},
-				},
-			},
-		},
-	}
-}
@@ -1,67 +0,0 @@
-package volume_balance_test
-
-import (
-	"context"
-	"fmt"
-	"testing"
-	"time"
-
-	pluginworkers "github.com/seaweedfs/seaweedfs/test/plugin_workers"
-	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
-	pluginworker "github.com/seaweedfs/seaweedfs/weed/plugin/worker"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-)
-
-func TestVolumeBalanceExecutionIntegration(t *testing.T) {
-	volumeID := uint32(303)
-
-	dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
-	handler := pluginworker.NewVolumeBalanceHandler(dialOption)
-	harness := pluginworkers.NewHarness(t, pluginworkers.HarnessConfig{
-		WorkerOptions: pluginworker.WorkerOptions{
-			GrpcDialOption: dialOption,
-		},
-		Handlers: []pluginworker.JobHandler{handler},
-	})
-	harness.WaitForJobType("volume_balance")
-
-	source := pluginworkers.NewVolumeServer(t, "")
-	target := pluginworkers.NewVolumeServer(t, "")
-
-	job := &plugin_pb.JobSpec{
-		JobId:   fmt.Sprintf("balance-job-%d", volumeID),
-		JobType: "volume_balance",
-		Parameters: map[string]*plugin_pb.ConfigValue{
-			"volume_id": {
-				Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: int64(volumeID)},
-			},
-			"collection": {
-				Kind: &plugin_pb.ConfigValue_StringValue{StringValue: "balance"},
-			},
-			"source_server": {
-				Kind: &plugin_pb.ConfigValue_StringValue{StringValue: source.Address()},
-			},
-			"target_server": {
-				Kind: &plugin_pb.ConfigValue_StringValue{StringValue: target.Address()},
-			},
-		},
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	result, err := harness.Plugin().ExecuteJob(ctx, job, nil, 1)
-	require.NoError(t, err)
-	require.NotNil(t, result)
-	require.True(t, result.Success)
-
-	require.GreaterOrEqual(t, source.MarkReadonlyCount(), 1)
-	require.GreaterOrEqual(t, len(source.DeleteRequests()), 1)
-
-	copyCalls, mountCalls, tailCalls := target.BalanceStats()
-	require.GreaterOrEqual(t, copyCalls, 1)
-	require.GreaterOrEqual(t, mountCalls, 1)
-	require.GreaterOrEqual(t, tailCalls, 1)
-}
@@ -1,49 +0,0 @@
-package pluginworkers
-
-import (
-	"fmt"
-	"math/rand"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/seaweedfs/seaweedfs/weed/storage/types"
-)
-
-// WriteTestVolumeFiles creates a minimal .dat/.idx pair for the given volume.
-func WriteTestVolumeFiles(t *testing.T, baseDir string, volumeID uint32, datSize int) (string, string) {
-	t.Helper()
-
-	if err := os.MkdirAll(baseDir, 0755); err != nil {
-		t.Fatalf("create volume dir: %v", err)
-	}
-
-	datPath := filepath.Join(baseDir, volumeFilename(volumeID, ".dat"))
-	idxPath := filepath.Join(baseDir, volumeFilename(volumeID, ".idx"))
-
-	data := make([]byte, datSize)
-	rng := rand.New(rand.NewSource(99))
-	_, _ = rng.Read(data)
-	if err := os.WriteFile(datPath, data, 0644); err != nil {
-		t.Fatalf("write dat file: %v", err)
-	}
-
-	entry := make([]byte, types.NeedleMapEntrySize)
-	idEnd := types.NeedleIdSize
-	offsetEnd := idEnd + types.OffsetSize
-	sizeEnd := offsetEnd + types.SizeSize
-
-	types.NeedleIdToBytes(entry[:idEnd], types.NeedleId(1))
-	types.OffsetToBytes(entry[idEnd:offsetEnd], types.ToOffset(0))
-	types.SizeToBytes(entry[offsetEnd:sizeEnd], types.Size(datSize))
-
-	if err := os.WriteFile(idxPath, entry, 0644); err != nil {
-		t.Fatalf("write idx file: %v", err)
-	}
-
-	return datPath, idxPath
-}
-
-func volumeFilename(volumeID uint32, ext string) string {
-	return fmt.Sprintf("%d%s", volumeID, ext)
-}
@@ -13,9 +13,8 @@ RUN go mod download
 # Copy source code
 COPY . .

-# Build the weed binaries without CGO
+# Build the weed binary without CGO
 RUN CGO_ENABLED=0 GOOS=linux go build -ldflags "-s -w" -o weed ./weed/
-RUN CGO_ENABLED=0 GOOS=linux go build -ldflags "-s -w" -o weed-db ./cmd/weed-db

 # Final stage - minimal runtime image
 FROM alpine:latest
@@ -25,12 +24,11 @@ RUN apk --no-cache add ca-certificates netcat-openbsd curl

 WORKDIR /root/

-# Copy the binaries from builder stage
+# Copy the weed binary from builder stage
 COPY --from=builder /app/weed .
-COPY --from=builder /app/weed-db .

 # Make it executable
-RUN chmod +x ./weed ./weed-db
+RUN chmod +x ./weed

 # Expose ports
 EXPOSE 9333 8888 8333 8085 9533 5432
@@ -280,7 +280,7 @@ This test setup proves:
 - Comprehensive error handling

 ### ✅ Performance and Scalability
- Direct SQL engine integration (same as `weed-sql`)
+- Direct SQL engine integration (same as `weed sql`)
 - No translation overhead for real queries
 - Efficient data access from stored formats
 - Scalable architecture with service discovery
@@ -1,6 +1,3 @@
-//go:build ignore
-// +build ignore
-
 package main

 import (
@@ -14,22 +11,9 @@ import (
 	_ "github.com/lib/pq"
 )

-const defaultPostgresHost = "postgres-server"
-
-func getEnv(key, def string) string {
-	if value, exists := os.LookupEnv(key); exists {
-		return value
-	}
-	return def
-}
-
 func main() {
-	clientMain()
-}
-
-func clientMain() {
 	// Get PostgreSQL connection details from environment
-	host := getEnv("POSTGRES_HOST", defaultPostgresHost)
+	host := getEnv("POSTGRES_HOST", "localhost")
 	port := getEnv("POSTGRES_PORT", "5432")
 	user := getEnv("POSTGRES_USER", "seaweedfs")
 	dbname := getEnv("POSTGRES_DB", "default")
@@ -118,7 +102,7 @@ func testSystemInfo(db *sql.DB) error {
 	}

 	// Use individual connections for each query to avoid protocol issues
-	connStr := getEnv("POSTGRES_HOST", defaultPostgresHost)
+	connStr := getEnv("POSTGRES_HOST", "postgres-server")
 	port := getEnv("POSTGRES_PORT", "5432")
 	user := getEnv("POSTGRES_USER", "seaweedfs")
 	dbname := getEnv("POSTGRES_DB", "logs")
@@ -134,12 +118,12 @@ func testSystemInfo(db *sql.DB) error {
 			log.Printf("  Query '%s' failed to connect: %v", q.query, err)
 			continue
 		}
+		defer tempDB.Close()

 		var result string
 		err = tempDB.QueryRow(q.query).Scan(&result)
 		if err != nil {
 			log.Printf("  Query '%s' failed: %v", q.query, err)
-			tempDB.Close()
 			continue
 		}
 		log.Printf("  %s: %s", q.name, result)
@@ -329,7 +313,7 @@ func testDatabaseSwitching(db *sql.DB) error {
 	databases := []string{"analytics", "ecommerce", "logs"}

 	// Use fresh connections to avoid protocol issues
-	connStr := getEnv("POSTGRES_HOST", defaultPostgresHost)
+	connStr := getEnv("POSTGRES_HOST", "postgres-server")
 	port := getEnv("POSTGRES_PORT", "5432")
 	user := getEnv("POSTGRES_USER", "seaweedfs")

@@ -344,6 +328,7 @@ func testDatabaseSwitching(db *sql.DB) error {
 			log.Printf("  Could not connect to '%s': %v", dbName, err)
 			continue
 		}
+		defer tempDB.Close()

 		// Test the connection by executing a simple query
 		var newDB string
@@ -387,7 +372,7 @@ func testSystemColumns(db *sql.DB) error {

 		// Use fresh connection to avoid protocol state issues
 		connStr := fmt.Sprintf("host=%s port=%s user=%s dbname=%s sslmode=disable",
-			getEnv("POSTGRES_HOST", defaultPostgresHost),
+			getEnv("POSTGRES_HOST", "postgres-server"),
 			getEnv("POSTGRES_PORT", "5432"),
 			getEnv("POSTGRES_USER", "seaweedfs"),
 			getEnv("POSTGRES_DB", "logs"))
@@ -397,6 +382,7 @@ func testSystemColumns(db *sql.DB) error {
 			log.Printf("    Could not create connection: %v", err)
 			continue
 		}
+		defer tempDB.Close()

 		// First check if table exists and has data (safer than COUNT which was causing crashes)
 		rows, err := tempDB.Query(fmt.Sprintf("SELECT id FROM %s LIMIT 1", table))
@@ -458,6 +444,7 @@ func testComplexQueries(db *sql.DB) error {
 			log.Printf("    Could not create connection: %v", err)
 			continue
 		}
+		defer tempDB.Close()

 		// Test basic SELECT with LIMIT (avoid COUNT which was causing crashes)
 		rows, err := tempDB.Query(fmt.Sprintf("SELECT id FROM %s LIMIT 5", table))
@@ -482,36 +469,38 @@ func testComplexQueries(db *sql.DB) error {
 			// Test WHERE clause with known ID (safer than arbitrary conditions)
 			testID := ids[0]
 			rows, err = tempDB.Query(fmt.Sprintf("SELECT id FROM %s WHERE id = %d", table, testID))
-			if err != nil {
-				log.Printf("    WHERE query failed: %v", err)
-				tempDB.Close()
-				return fmt.Errorf("WHERE clause test failed for table '%s'", table)
-			}
-
-			foundMatch := false
-			if rows.Next() {
+			if err == nil {
 				var foundID int64
-				if err := rows.Scan(&foundID); err == nil && foundID == testID {
-					log.Printf("    ✓ WHERE clause working: found record with ID %d", foundID)
-					foundMatch = true
+				if rows.Next() {
+					if err := rows.Scan(&foundID); err == nil && foundID == testID {
+						log.Printf("    ✓ WHERE clause working: found record with ID %d", foundID)
+					}
 				}
-			}
-			rows.Close()
-
-			if !foundMatch {
-				tempDB.Close()
-				return fmt.Errorf("WHERE clause test failed: no matching record found for ID %d in table '%s'", testID, table)
+				rows.Close()
 			}

 			log.Printf("  ✓ Complex queries test passed for '%s'", table)
 			tempDB.Close()
 			return nil
-		} else {
-			tempDB.Close()
-			return fmt.Errorf("no records found in table '%s' - cannot test WHERE clause", table)
 		}
+
+		tempDB.Close()
 	}

 	log.Println("  Complex queries test completed - avoided crash-prone patterns")
 	return nil
 }
+
+func stringOrNull(ns sql.NullString) string {
+	if ns.Valid {
+		return ns.String
+	}
+	return "NULL"
+}
+
+func getEnv(key, defaultValue string) string {
+	if value, exists := os.LookupEnv(key); exists {
+		return value
+	}
+	return defaultValue
+}
@@ -54,7 +54,7 @@ services:
      seaweedfs:
        condition: service_healthy
    command: >
-      ./weed-db
+      ./weed db
      -host=0.0.0.0
      -port=5432
      -master=seaweedfs:9333
@@ -322,7 +322,7 @@ func discoverFiler(masterHTTPAddress string) (string, error) {

 	// Use the first available filer and convert HTTP address to gRPC
 	filerHTTPAddress := resp.ClusterNodes[0].Address
-	httpAddr = pb.ServerAddress(filerHTTPAddress)
+	httpAddr := pb.ServerAddress(filerHTTPAddress)
 	return httpAddr.ToGrpcAddress(), nil
 }

@@ -4,7 +4,6 @@ import (
 	"testing"

 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -203,116 +202,6 @@ func TestIAMPolicyManagement(t *testing.T) {
 		})
 	})

-	t.Run("managed_policy_crud_lifecycle", func(t *testing.T) {
-		policyDoc := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::*"}]}`
-
-		policyNames := []string{"test-managed-policy-lifecycle-a", "test-managed-policy-lifecycle-b"}
-		policyArns := make([]*string, 0, len(policyNames))
-		for _, policyName := range policyNames {
-			createResp, err := iamClient.CreatePolicy(&iam.CreatePolicyInput{
-				PolicyName:     aws.String(policyName),
-				PolicyDocument: aws.String(policyDoc),
-			})
-			require.NoError(t, err)
-			policyArns = append(policyArns, createResp.Policy.Arn)
-		}
-
-		t.Cleanup(func() {
-			for _, policyArn := range policyArns {
-				_, _ = iamClient.DeletePolicy(&iam.DeletePolicyInput{PolicyArn: policyArn})
-			}
-		})
-
-		listResp, err := iamClient.ListPolicies(&iam.ListPoliciesInput{})
-		require.NoError(t, err)
-
-		foundByName := map[string]bool{}
-		for _, policy := range listResp.Policies {
-			if policy.PolicyName != nil {
-				foundByName[*policy.PolicyName] = true
-			}
-		}
-		for _, policyName := range policyNames {
-			assert.True(t, foundByName[policyName], "policy %s should be listed", policyName)
-		}
-
-		getResp, err := iamClient.GetPolicy(&iam.GetPolicyInput{PolicyArn: policyArns[0]})
-		require.NoError(t, err)
-		require.NotNil(t, getResp.Policy)
-		assert.Equal(t, policyNames[0], aws.StringValue(getResp.Policy.PolicyName))
-		assert.Equal(t, aws.StringValue(policyArns[0]), aws.StringValue(getResp.Policy.Arn))
-
-		_, err = iamClient.DeletePolicy(&iam.DeletePolicyInput{PolicyArn: policyArns[0]})
-		require.NoError(t, err)
-
-		_, err = iamClient.GetPolicy(&iam.GetPolicyInput{PolicyArn: policyArns[0]})
-		require.Error(t, err)
-		awsErr, ok := err.(awserr.Error)
-		require.True(t, ok)
-		assert.Equal(t, iam.ErrCodeNoSuchEntityException, awsErr.Code())
-
-		listAfterDeleteResp, err := iamClient.ListPolicies(&iam.ListPoliciesInput{})
-		require.NoError(t, err)
-		deletedPolicyFound := false
-		remainingPolicyFound := false
-		for _, policy := range listAfterDeleteResp.Policies {
-			if policy.PolicyName == nil {
-				continue
-			}
-			if *policy.PolicyName == policyNames[0] {
-				deletedPolicyFound = true
-			}
-			if *policy.PolicyName == policyNames[1] {
-				remainingPolicyFound = true
-			}
-		}
-		assert.False(t, deletedPolicyFound, "deleted policy should no longer be listed")
-		assert.True(t, remainingPolicyFound, "remaining policy should still be listed")
-
-		policyArns[0] = nil
-	})
-
-	t.Run("managed_policy_versions", func(t *testing.T) {
-		policyName := "test-managed-policy-version"
-		policyDoc := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"*"}]}`
-
-		createResp, err := iamClient.CreatePolicy(&iam.CreatePolicyInput{
-			PolicyName:     aws.String(policyName),
-			PolicyDocument: aws.String(policyDoc),
-		})
-		require.NoError(t, err)
-
-		t.Cleanup(func() {
-			_, _ = iamClient.DeletePolicy(&iam.DeletePolicyInput{PolicyArn: createResp.Policy.Arn})
-		})
-
-		listVersionsResp, err := iamClient.ListPolicyVersions(&iam.ListPolicyVersionsInput{
-			PolicyArn: createResp.Policy.Arn,
-		})
-		require.NoError(t, err)
-		require.NotEmpty(t, listVersionsResp.Versions)
-		assert.Equal(t, "v1", aws.StringValue(listVersionsResp.Versions[0].VersionId))
-		assert.Equal(t, true, aws.BoolValue(listVersionsResp.Versions[0].IsDefaultVersion))
-
-		getVersionResp, err := iamClient.GetPolicyVersion(&iam.GetPolicyVersionInput{
-			PolicyArn:  createResp.Policy.Arn,
-			VersionId:  aws.String("v1"),
-		})
-		require.NoError(t, err)
-		require.NotNil(t, getVersionResp.PolicyVersion)
-		assert.Equal(t, "v1", aws.StringValue(getVersionResp.PolicyVersion.VersionId))
-		assert.Contains(t, aws.StringValue(getVersionResp.PolicyVersion.Document), "s3:ListBucket")
-
-		_, err = iamClient.GetPolicyVersion(&iam.GetPolicyVersionInput{
-			PolicyArn: createResp.Policy.Arn,
-			VersionId: aws.String("v2"),
-		})
-		require.Error(t, err)
-		awsErr, ok := err.(awserr.Error)
-		require.True(t, ok)
-		assert.Equal(t, iam.ErrCodeNoSuchEntityException, awsErr.Code())
-	})
-
 	t.Run("user_inline_policy", func(t *testing.T) {
 		userName := "test-user-policy"
 		_, err := iamClient.CreateUser(&iam.CreateUserInput{
@@ -1,573 +0,0 @@
-package example
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io"
-	"net/http"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws"
-	v1credentials "github.com/aws/aws-sdk-go/aws/credentials"
-	v1signer "github.com/aws/aws-sdk-go/aws/signer/v4"
-	v1s3 "github.com/aws/aws-sdk-go/service/s3"
-	v2aws "github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/credentials"
-	v2s3 "github.com/aws/aws-sdk-go-v2/service/s3"
-	"github.com/aws/aws-sdk-go-v2/service/s3/types"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// newS3V2Client creates an AWS SDK v2 S3 client from the test cluster.
-func newS3V2Client(cluster *TestCluster) *v2s3.Client {
-	return v2s3.New(v2s3.Options{
-		Region:       testRegion,
-		BaseEndpoint: v2aws.String(cluster.s3Endpoint),
-		Credentials:  v2aws.NewCredentialsCache(credentials.NewStaticCredentialsProvider(testAccessKey, testSecretKey, "")),
-		UsePathStyle: true,
-	})
-}
-
-func TestGetObjectAttributes(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	t.Run("Basic", func(t *testing.T) {
-		testGetObjectAttributesBasic(t, cluster)
-	})
-	t.Run("MultipartObject", func(t *testing.T) {
-		testGetObjectAttributesMultipart(t, cluster)
-	})
-	t.Run("SelectiveAttributes", func(t *testing.T) {
-		testGetObjectAttributesSelective(t, cluster)
-	})
-	t.Run("InvalidAttribute", func(t *testing.T) {
-		testGetObjectAttributesInvalid(t, cluster)
-	})
-	t.Run("NonExistentObject", func(t *testing.T) {
-		testGetObjectAttributesNotFound(t, cluster)
-	})
-	t.Run("VersionedObject", func(t *testing.T) {
-		testGetObjectAttributesVersioned(t, cluster)
-	})
-	t.Run("ConditionalHeaders", func(t *testing.T) {
-		testGetObjectAttributesConditionalHeaders(t, cluster)
-	})
-	t.Run("VersionedConditionalHeaders", func(t *testing.T) {
-		testGetObjectAttributesVersionedConditionalHeaders(t, cluster)
-	})
-}
-
-func testGetObjectAttributesBasic(t *testing.T, cluster *TestCluster) {
-	bucketName := createTestBucket(t, cluster, "test-goa-basic-")
-	objectKey := "test-object.txt"
-	objectData := "Hello, GetObjectAttributes!"
-
-	_, err := cluster.s3Client.PutObject(&v1s3.PutObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-		Body:   bytes.NewReader([]byte(objectData)),
-	})
-	require.NoError(t, err)
-
-	client := newS3V2Client(cluster)
-	resp, err := client.GetObjectAttributes(context.Background(), &v2s3.GetObjectAttributesInput{
-		Bucket: v2aws.String(bucketName),
-		Key:    v2aws.String(objectKey),
-		ObjectAttributes: []types.ObjectAttributes{
-			types.ObjectAttributesEtag,
-			types.ObjectAttributesStorageClass,
-			types.ObjectAttributesObjectSize,
-			types.ObjectAttributesObjectParts,
-		},
-	})
-	require.NoError(t, err)
-
-	// ETag should be present and non-empty
-	require.NotNil(t, resp.ETag)
-	assert.NotEmpty(t, *resp.ETag)
-	assert.False(t, strings.Contains(*resp.ETag, `"`), "ETag in XML body should not have quotes")
-
-	// ObjectSize should match
-	require.NotNil(t, resp.ObjectSize)
-	assert.Equal(t, int64(len(objectData)), *resp.ObjectSize)
-
-	// StorageClass should be STANDARD (default)
-	assert.Equal(t, "STANDARD", string(resp.StorageClass))
-
-	// ObjectParts should be nil for non-multipart objects
-	assert.Nil(t, resp.ObjectParts)
-
-	// LastModified header should be present
-	assert.NotNil(t, resp.LastModified)
-
-	t.Logf("Basic GetObjectAttributes passed: ETag=%s, Size=%d, StorageClass=%s",
-		*resp.ETag, *resp.ObjectSize, resp.StorageClass)
-}
-
-func testGetObjectAttributesMultipart(t *testing.T, cluster *TestCluster) {
-	bucketName := createTestBucket(t, cluster, "test-goa-mp-")
-	objectKey := "test-multipart.bin"
-
-	// Create a 2-part multipart upload
-	part1Data := bytes.Repeat([]byte("A"), 5*1024*1024) // 5MB (minimum part size)
-	part2Data := bytes.Repeat([]byte("B"), 3*1024*1024) // 3MB
-
-	initResp, err := cluster.s3Client.CreateMultipartUpload(&v1s3.CreateMultipartUploadInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-	})
-	require.NoError(t, err)
-	uploadID := initResp.UploadId
-
-	part1Resp, err := cluster.s3Client.UploadPart(&v1s3.UploadPartInput{
-		Bucket:     aws.String(bucketName),
-		Key:        aws.String(objectKey),
-		PartNumber: aws.Int64(1),
-		UploadId:   uploadID,
-		Body:       bytes.NewReader(part1Data),
-	})
-	require.NoError(t, err)
-
-	part2Resp, err := cluster.s3Client.UploadPart(&v1s3.UploadPartInput{
-		Bucket:     aws.String(bucketName),
-		Key:        aws.String(objectKey),
-		PartNumber: aws.Int64(2),
-		UploadId:   uploadID,
-		Body:       bytes.NewReader(part2Data),
-	})
-	require.NoError(t, err)
-
-	_, err = cluster.s3Client.CompleteMultipartUpload(&v1s3.CompleteMultipartUploadInput{
-		Bucket:   aws.String(bucketName),
-		Key:      aws.String(objectKey),
-		UploadId: uploadID,
-		MultipartUpload: &v1s3.CompletedMultipartUpload{
-			Parts: []*v1s3.CompletedPart{
-				{ETag: part1Resp.ETag, PartNumber: aws.Int64(1)},
-				{ETag: part2Resp.ETag, PartNumber: aws.Int64(2)},
-			},
-		},
-	})
-	require.NoError(t, err)
-
-	// Wait briefly for metadata to settle
-	time.Sleep(200 * time.Millisecond)
-
-	client := newS3V2Client(cluster)
-	resp, err := client.GetObjectAttributes(context.Background(), &v2s3.GetObjectAttributesInput{
-		Bucket: v2aws.String(bucketName),
-		Key:    v2aws.String(objectKey),
-		ObjectAttributes: []types.ObjectAttributes{
-			types.ObjectAttributesObjectParts,
-			types.ObjectAttributesObjectSize,
-		},
-	})
-	require.NoError(t, err)
-
-	require.NotNil(t, resp.ObjectSize)
-	assert.Equal(t, int64(len(part1Data)+len(part2Data)), *resp.ObjectSize)
-
-	require.NotNil(t, resp.ObjectParts, "ObjectParts should be present for multipart objects")
-	assert.Equal(t, int32(2), *resp.ObjectParts.TotalPartsCount)
-	require.Len(t, resp.ObjectParts.Parts, 2)
-	assert.Equal(t, int32(1), *resp.ObjectParts.Parts[0].PartNumber)
-	assert.Equal(t, int64(len(part1Data)), *resp.ObjectParts.Parts[0].Size)
-	assert.Equal(t, int32(2), *resp.ObjectParts.Parts[1].PartNumber)
-	assert.Equal(t, int64(len(part2Data)), *resp.ObjectParts.Parts[1].Size)
-
-	// Test pagination: MaxParts=1
-	resp2, err := client.GetObjectAttributes(context.Background(), &v2s3.GetObjectAttributesInput{
-		Bucket:  v2aws.String(bucketName),
-		Key:     v2aws.String(objectKey),
-		MaxParts: v2aws.Int32(1),
-		ObjectAttributes: []types.ObjectAttributes{
-			types.ObjectAttributesObjectParts,
-		},
-	})
-	require.NoError(t, err)
-	require.NotNil(t, resp2.ObjectParts)
-	assert.Len(t, resp2.ObjectParts.Parts, 1)
-	assert.True(t, *resp2.ObjectParts.IsTruncated)
-	assert.Equal(t, int32(2), *resp2.ObjectParts.TotalPartsCount)
-
-	t.Logf("Multipart GetObjectAttributes passed: %d parts, total size %d",
-		*resp.ObjectParts.TotalPartsCount, *resp.ObjectSize)
-}
-
-func testGetObjectAttributesSelective(t *testing.T, cluster *TestCluster) {
-	bucketName := createTestBucket(t, cluster, "test-goa-sel-")
-	objectKey := "test-selective.txt"
-	objectData := "Selective attributes test"
-
-	_, err := cluster.s3Client.PutObject(&v1s3.PutObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-		Body:   bytes.NewReader([]byte(objectData)),
-	})
-	require.NoError(t, err)
-
-	client := newS3V2Client(cluster)
-
-	// Request only ETag
-	resp, err := client.GetObjectAttributes(context.Background(), &v2s3.GetObjectAttributesInput{
-		Bucket: v2aws.String(bucketName),
-		Key:    v2aws.String(objectKey),
-		ObjectAttributes: []types.ObjectAttributes{
-			types.ObjectAttributesEtag,
-		},
-	})
-	require.NoError(t, err)
-	require.NotNil(t, resp.ETag)
-	assert.NotEmpty(t, *resp.ETag)
-	assert.Nil(t, resp.ObjectSize, "ObjectSize should not be present when not requested")
-	assert.Empty(t, string(resp.StorageClass), "StorageClass should not be present when not requested")
-	assert.Nil(t, resp.ObjectParts, "ObjectParts should not be present when not requested")
-
-	t.Logf("Selective GetObjectAttributes passed: ETag=%s", *resp.ETag)
-}
-
-func testGetObjectAttributesInvalid(t *testing.T, cluster *TestCluster) {
-	bucketName := createTestBucket(t, cluster, "test-goa-inv-")
-	objectKey := "test-object.txt"
-
-	_, err := cluster.s3Client.PutObject(&v1s3.PutObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-		Body:   bytes.NewReader([]byte("test")),
-	})
-	require.NoError(t, err)
-
-	// Use raw HTTP to send an invalid attribute name since the SDK validates
-	reqURL := fmt.Sprintf("%s/%s/%s?attributes", cluster.s3Endpoint, bucketName, objectKey)
-	req, err := http.NewRequest("GET", reqURL, nil)
-	require.NoError(t, err)
-	req.Header.Set("X-Amz-Object-Attributes", "InvalidAttr")
-
-	signer := v1signer.NewSigner(v1credentials.NewStaticCredentials(testAccessKey, testSecretKey, ""))
-	_, err = signer.Sign(req, nil, "s3", testRegion, time.Now())
-	require.NoError(t, err)
-
-	client := &http.Client{Timeout: 10 * time.Second}
-	resp, err := client.Do(req)
-	require.NoError(t, err)
-	defer resp.Body.Close()
-	io.Copy(io.Discard, resp.Body)
-
-	assert.Equal(t, 400, resp.StatusCode)
-	t.Logf("Invalid attribute test passed: got %d", resp.StatusCode)
-}
-
-func testGetObjectAttributesNotFound(t *testing.T, cluster *TestCluster) {
-	bucketName := createTestBucket(t, cluster, "test-goa-nf-")
-
-	client := newS3V2Client(cluster)
-	_, err := client.GetObjectAttributes(context.Background(), &v2s3.GetObjectAttributesInput{
-		Bucket: v2aws.String(bucketName),
-		Key:    v2aws.String("nonexistent-key"),
-		ObjectAttributes: []types.ObjectAttributes{
-			types.ObjectAttributesEtag,
-		},
-	})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "NoSuchKey")
-
-	t.Logf("NotFound GetObjectAttributes passed")
-}
-
-func testGetObjectAttributesVersioned(t *testing.T, cluster *TestCluster) {
-	client := newS3V2Client(cluster)
-	bucketName := createTestBucket(t, cluster, "test-goa-ver-")
-
-	// Enable versioning
-	_, err := client.PutBucketVersioning(context.Background(), &v2s3.PutBucketVersioningInput{
-		Bucket: v2aws.String(bucketName),
-		VersioningConfiguration: &types.VersioningConfiguration{
-			Status: types.BucketVersioningStatusEnabled,
-		},
-	})
-	require.NoError(t, err)
-	time.Sleep(200 * time.Millisecond)
-
-	// Put two versions of the same object
-	v1Data := "version 1 content"
-	putResp1, err := client.PutObject(context.Background(), &v2s3.PutObjectInput{
-		Bucket: v2aws.String(bucketName),
-		Key:    v2aws.String("versioned-key"),
-		Body:   strings.NewReader(v1Data),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, putResp1.VersionId)
-	versionId1 := *putResp1.VersionId
-
-	v2Data := "version 2 content - longer"
-	putResp2, err := client.PutObject(context.Background(), &v2s3.PutObjectInput{
-		Bucket: v2aws.String(bucketName),
-		Key:    v2aws.String("versioned-key"),
-		Body:   strings.NewReader(v2Data),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, putResp2.VersionId)
-	versionId2 := *putResp2.VersionId
-
-	assert.NotEqual(t, versionId1, versionId2, "versions should differ")
-
-	// GetObjectAttributes for latest version (v2)
-	resp, err := client.GetObjectAttributes(context.Background(), &v2s3.GetObjectAttributesInput{
-		Bucket: v2aws.String(bucketName),
-		Key:    v2aws.String("versioned-key"),
-		ObjectAttributes: []types.ObjectAttributes{
-			types.ObjectAttributesObjectSize,
-			types.ObjectAttributesEtag,
-		},
-	})
-	require.NoError(t, err)
-	require.NotNil(t, resp.ObjectSize)
-	assert.Equal(t, int64(len(v2Data)), *resp.ObjectSize)
-	require.NotNil(t, resp.VersionId)
-	assert.Equal(t, versionId2, *resp.VersionId)
-
-	// GetObjectAttributes for specific older version (v1)
-	resp1, err := client.GetObjectAttributes(context.Background(), &v2s3.GetObjectAttributesInput{
-		Bucket:    v2aws.String(bucketName),
-		Key:       v2aws.String("versioned-key"),
-		VersionId: v2aws.String(versionId1),
-		ObjectAttributes: []types.ObjectAttributes{
-			types.ObjectAttributesObjectSize,
-			types.ObjectAttributesEtag,
-		},
-	})
-	require.NoError(t, err)
-	require.NotNil(t, resp1.ObjectSize)
-	assert.Equal(t, int64(len(v1Data)), *resp1.ObjectSize)
-	require.NotNil(t, resp1.VersionId)
-	assert.Equal(t, versionId1, *resp1.VersionId)
-
-	t.Logf("Versioned GetObjectAttributes passed: v1 size=%d (id=%s), v2 size=%d (id=%s)",
-		*resp1.ObjectSize, versionId1, *resp.ObjectSize, versionId2)
-}
-
-// signedGetObjectAttributes creates a signed GET request for ?attributes with custom headers.
-func signedGetObjectAttributes(t *testing.T, cluster *TestCluster, bucketName, objectKey string, extraHeaders map[string]string) *http.Response {
-	reqURL := fmt.Sprintf("%s/%s/%s?attributes", cluster.s3Endpoint, bucketName, objectKey)
-	req, err := http.NewRequest("GET", reqURL, nil)
-	require.NoError(t, err)
-	req.Header.Set("X-Amz-Object-Attributes", "ETag,ObjectSize")
-	for k, v := range extraHeaders {
-		req.Header.Set(k, v)
-	}
-	signer := v1signer.NewSigner(v1credentials.NewStaticCredentials(testAccessKey, testSecretKey, ""))
-	_, err = signer.Sign(req, nil, "s3", testRegion, time.Now())
-	require.NoError(t, err)
-	client := &http.Client{Timeout: 10 * time.Second}
-	resp, err := client.Do(req)
-	require.NoError(t, err)
-	return resp
-}
-
-func testGetObjectAttributesConditionalHeaders(t *testing.T, cluster *TestCluster) {
-	bucketName := createTestBucket(t, cluster, "test-goa-cond-")
-	objectKey := "cond-test.txt"
-
-	_, err := cluster.s3Client.PutObject(&v1s3.PutObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-		Body:   bytes.NewReader([]byte("conditional headers test")),
-	})
-	require.NoError(t, err)
-
-	// Get the ETag and Last-Modified for the object
-	headResp, err := cluster.s3Client.HeadObject(&v1s3.HeadObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-	})
-	require.NoError(t, err)
-	etag := aws.StringValue(headResp.ETag)
-	lastModified := headResp.LastModified
-	require.NotNil(t, lastModified)
-
-	pastDate := lastModified.Add(-1 * time.Hour).UTC().Format(http.TimeFormat)
-	futureDate := lastModified.Add(1 * time.Hour).UTC().Format(http.TimeFormat)
-
-	// RFC 7232: If-Match true + If-Unmodified-Since false => 200 OK
-	// If-Unmodified-Since is ignored when If-Match is present
-	t.Run("IfMatch_true_IfUnmodifiedSince_false", func(t *testing.T) {
-		resp := signedGetObjectAttributes(t, cluster, bucketName, objectKey, map[string]string{
-			"If-Match":            etag,
-			"If-Unmodified-Since": pastDate, // object was modified after this => false
-		})
-		defer resp.Body.Close()
-		io.Copy(io.Discard, resp.Body)
-		assert.Equal(t, 200, resp.StatusCode,
-			"If-Match=true should return 200 even when If-Unmodified-Since=false (RFC 7232 Section 3.4)")
-	})
-
-	// RFC 7232: If-None-Match false + If-Modified-Since true => 304 Not Modified
-	// If-Modified-Since is ignored when If-None-Match is present
-	t.Run("IfNoneMatch_false_IfModifiedSince_true", func(t *testing.T) {
-		resp := signedGetObjectAttributes(t, cluster, bucketName, objectKey, map[string]string{
-			"If-None-Match":     etag,
-			"If-Modified-Since": pastDate, // object was modified after this => true
-		})
-		defer resp.Body.Close()
-		io.Copy(io.Discard, resp.Body)
-		assert.Equal(t, 304, resp.StatusCode,
-			"If-None-Match=false (ETag match) should return 304 even when If-Modified-Since=true (RFC 7232 Section 3.3)")
-	})
-
-	// If-Match succeeds, If-Unmodified-Since also succeeds => 200
-	t.Run("IfMatch_true_IfUnmodifiedSince_true", func(t *testing.T) {
-		resp := signedGetObjectAttributes(t, cluster, bucketName, objectKey, map[string]string{
-			"If-Match":            etag,
-			"If-Unmodified-Since": futureDate,
-		})
-		defer resp.Body.Close()
-		io.Copy(io.Discard, resp.Body)
-		assert.Equal(t, 200, resp.StatusCode)
-	})
-
-	// If-None-Match passes (ETag differs), If-Modified-Since ignored => 200
-	// Per RFC 7232, If-Modified-Since is ignored when If-None-Match is present
-	t.Run("IfNoneMatch_true_IfModifiedSince_ignored", func(t *testing.T) {
-		resp := signedGetObjectAttributes(t, cluster, bucketName, objectKey, map[string]string{
-			"If-None-Match":     `"nonexistent-etag"`,
-			"If-Modified-Since": futureDate, // would fail alone, but is ignored
-		})
-		defer resp.Body.Close()
-		io.Copy(io.Discard, resp.Body)
-		assert.Equal(t, 200, resp.StatusCode,
-			"If-None-Match=true means If-Modified-Since is ignored, should return 200 (RFC 7232 Section 3.3)")
-	})
-
-	// If-Match fails => 412 regardless of If-Unmodified-Since
-	t.Run("IfMatch_false", func(t *testing.T) {
-		resp := signedGetObjectAttributes(t, cluster, bucketName, objectKey, map[string]string{
-			"If-Match":            `"wrong-etag"`,
-			"If-Unmodified-Since": futureDate,
-		})
-		defer resp.Body.Close()
-		io.Copy(io.Discard, resp.Body)
-		assert.Equal(t, 412, resp.StatusCode)
-	})
-
-	t.Logf("Conditional headers tests passed")
-}
-
-// signedGetObjectAttributesVersioned creates a signed GET request for ?attributes&versionId=... with custom headers.
-func signedGetObjectAttributesVersioned(t *testing.T, cluster *TestCluster, bucketName, objectKey, versionId string, extraHeaders map[string]string) *http.Response {
-	reqURL := fmt.Sprintf("%s/%s/%s?attributes&versionId=%s", cluster.s3Endpoint, bucketName, objectKey, versionId)
-	req, err := http.NewRequest("GET", reqURL, nil)
-	require.NoError(t, err)
-	req.Header.Set("X-Amz-Object-Attributes", "ETag,ObjectSize")
-	for k, v := range extraHeaders {
-		req.Header.Set(k, v)
-	}
-	signer := v1signer.NewSigner(v1credentials.NewStaticCredentials(testAccessKey, testSecretKey, ""))
-	_, err = signer.Sign(req, nil, "s3", testRegion, time.Now())
-	require.NoError(t, err)
-	client := &http.Client{Timeout: 10 * time.Second}
-	resp, err := client.Do(req)
-	require.NoError(t, err)
-	return resp
-}
-
-func testGetObjectAttributesVersionedConditionalHeaders(t *testing.T, cluster *TestCluster) {
-	client := newS3V2Client(cluster)
-	bucketName := createTestBucket(t, cluster, "test-goa-vcond-")
-
-	// Enable versioning
-	_, err := client.PutBucketVersioning(context.Background(), &v2s3.PutBucketVersioningInput{
-		Bucket: v2aws.String(bucketName),
-		VersioningConfiguration: &types.VersioningConfiguration{
-			Status: types.BucketVersioningStatusEnabled,
-		},
-	})
-	require.NoError(t, err)
-	time.Sleep(200 * time.Millisecond)
-
-	// Put two versions with different content (different ETags)
-	v1Data := "version 1 - original"
-	putResp1, err := client.PutObject(context.Background(), &v2s3.PutObjectInput{
-		Bucket: v2aws.String(bucketName),
-		Key:    v2aws.String("vcond-key"),
-		Body:   strings.NewReader(v1Data),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, putResp1.VersionId)
-	vid1 := *putResp1.VersionId
-
-	v2Data := "version 2 - updated content"
-	putResp2, err := client.PutObject(context.Background(), &v2s3.PutObjectInput{
-		Bucket: v2aws.String(bucketName),
-		Key:    v2aws.String("vcond-key"),
-		Body:   strings.NewReader(v2Data),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, putResp2.VersionId)
-	vid2 := *putResp2.VersionId
-
-	// Get ETags for each version
-	headV1, err := client.HeadObject(context.Background(), &v2s3.HeadObjectInput{
-		Bucket:    v2aws.String(bucketName),
-		Key:       v2aws.String("vcond-key"),
-		VersionId: v2aws.String(vid1),
-	})
-	require.NoError(t, err)
-	etagV1 := *headV1.ETag
-
-	headV2, err := client.HeadObject(context.Background(), &v2s3.HeadObjectInput{
-		Bucket:    v2aws.String(bucketName),
-		Key:       v2aws.String("vcond-key"),
-		VersionId: v2aws.String(vid2),
-	})
-	require.NoError(t, err)
-	etagV2 := *headV2.ETag
-	require.NotEqual(t, etagV1, etagV2, "versions should have different ETags")
-
-	// If-Match with v1's ETag + versionId=v1 => 200
-	// Before the fix, this would fail with 412 because conditional headers
-	// were evaluated against the latest version (v2) whose ETag differs
-	t.Run("IfMatch_v1_etag_versionId_v1", func(t *testing.T) {
-		resp := signedGetObjectAttributesVersioned(t, cluster, bucketName, "vcond-key", vid1, map[string]string{
-			"If-Match": etagV1,
-		})
-		defer resp.Body.Close()
-		io.Copy(io.Discard, resp.Body)
-		assert.Equal(t, 200, resp.StatusCode,
-			"If-Match with v1 ETag targeting versionId=v1 should return 200")
-	})
-
-	// If-Match with v2's ETag + versionId=v1 => 412
-	// The ETag doesn't match v1, so this should fail
-	t.Run("IfMatch_v2_etag_versionId_v1", func(t *testing.T) {
-		resp := signedGetObjectAttributesVersioned(t, cluster, bucketName, "vcond-key", vid1, map[string]string{
-			"If-Match": etagV2,
-		})
-		defer resp.Body.Close()
-		io.Copy(io.Discard, resp.Body)
-		assert.Equal(t, 412, resp.StatusCode,
-			"If-Match with v2 ETag targeting versionId=v1 should return 412")
-	})
-
-	// If-None-Match with v1's ETag + versionId=v1 => 304
-	t.Run("IfNoneMatch_v1_etag_versionId_v1", func(t *testing.T) {
-		resp := signedGetObjectAttributesVersioned(t, cluster, bucketName, "vcond-key", vid1, map[string]string{
-			"If-None-Match": etagV1,
-		})
-		defer resp.Body.Close()
-		io.Copy(io.Discard, resp.Body)
-		assert.Equal(t, 304, resp.StatusCode,
-			"If-None-Match with v1 ETag targeting versionId=v1 should return 304")
-	})
-
-	t.Logf("Versioned conditional headers tests passed: vid1=%s, vid2=%s", vid1, vid2)
-}
@@ -3,8 +3,6 @@ package example
 import (
 	"bytes"
 	"context"
-	"crypto/md5"
-	"encoding/base64"
 	"fmt"
 	"math/rand"
 	"net"
@@ -17,7 +15,6 @@ import (
 	"time"

 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/aws/credentials"
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/s3"
@@ -71,22 +68,6 @@ func TestS3Integration(t *testing.T) {
 		testPutObject(t, cluster)
 	})

-	t.Run("UploadPart", func(t *testing.T) {
-		testPutPartWithChecksum(t, cluster)
-	})
-
-	t.Run("PutObjectWithChecksum", func(t *testing.T) {
-		testPutObjectWithChecksum(t, cluster)
-	})
-
-	t.Run("UploadPartWithChecksum", func(t *testing.T) {
-		testUploadPartWithChecksum(t, cluster)
-	})
-
-	t.Run("PutObjectWithChecksumAndSSEC", func(t *testing.T) {
-		testPutObjectWithChecksumAndSSEC(t, cluster)
-	})
-
 	t.Run("GetObject", func(t *testing.T) {
 		testGetObject(t, cluster)
 	})
@@ -116,9 +97,8 @@ func findAvailablePort() (int, error) {
 	return addr.Port, nil
 }

-// startMiniCluster starts a weed mini instance directly without exec.
-// Extra flags (e.g. "-s3.allowDeleteBucketNotEmpty=false") can be appended via extraArgs.
-func startMiniCluster(t *testing.T, extraArgs ...string) (*TestCluster, error) {
+// startMiniCluster starts a weed mini instance directly without exec
+func startMiniCluster(t *testing.T) (*TestCluster, error) {
 	// Find available ports
 	masterPort, err := findAvailablePort()
 	if err != nil {
@@ -193,7 +173,7 @@ func startMiniCluster(t *testing.T, extraArgs ...string) (*TestCluster, error) {
 		// Configure args for mini command
 		// Note: When running via 'go test', os.Args[0] is the test binary
 		// We need to make it look like we're running 'weed mini'
-		os.Args = append([]string{
+		os.Args = []string{
 			"weed",
 			"-dir=" + testDir,
 			"-master.port=" + strconv.Itoa(masterPort),
@@ -206,7 +186,7 @@ func startMiniCluster(t *testing.T, extraArgs ...string) (*TestCluster, error) {
 			"-ip=127.0.0.1",
 			"-master.peers=none",     // Faster startup
 			"-s3.iam.readOnly=false", // Enable IAM write operations for tests
-		}, extraArgs...)
+		}

 		// Suppress most logging during tests
 		glog.MaxSize = 1024 * 1024
@@ -364,282 +344,6 @@ func testPutObject(t *testing.T, cluster *TestCluster) {
 	t.Logf("✓ Put object: %s/%s (%d bytes)", bucketName, objectKey, len(objectData))
 }

-func createTestBucket(t *testing.T, cluster *TestCluster, prefix string) string {
-	bucketName := prefix + randomString(8)
-	_, err := cluster.s3Client.CreateBucket(&s3.CreateBucketInput{
-		Bucket: aws.String(bucketName),
-	})
-	require.NoError(t, err)
-	time.Sleep(100 * time.Millisecond)
-	return bucketName
-}
-
-// generateSSECKey returns a 32-byte key as a raw string (what the SDK expects
-// for SSECustomerKey) and its base64-encoded MD5 (for SSECustomerKeyMD5).
-func generateSSECKey() (keyRaw, keyMD5B64 string) {
-	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
-	key := make([]byte, 32)
-	for i := range key {
-		key[i] = byte(rng.Intn(256))
-	}
-	keyRaw = string(key)
-	keyHash := md5.Sum(key)
-	keyMD5B64 = base64.StdEncoding.EncodeToString(keyHash[:])
-	return
-}
-
-func testPutObjectWithChecksum(t *testing.T, cluster *TestCluster) {
-	bucketName := createTestBucket(t, cluster, "test-put-checksum-")
-	objectKey := "test-checksummed-object.txt"
-	objectData := "Hello, SeaweedFS S3!"
-
-	correctMD5 := calculateMd5(objectData)
-	incorrectMD5 := calculateMd5(objectData + "incorrect")
-
-	// Put object with incorrect MD5 should be rejected
-	_, err := cluster.s3Client.PutObject(&s3.PutObjectInput{
-		Bucket:     aws.String(bucketName),
-		Key:        aws.String(objectKey),
-		Body:       bytes.NewReader([]byte(objectData)),
-		ContentMD5: aws.String(incorrectMD5),
-	})
-	assertBadDigestError(t, err, "PutObject should fail with incorrect MD5")
-
-	t.Logf("✓ Put object with incorrect MD5 rejected: %s/%s", bucketName, objectKey)
-
-	// Put object with correct MD5 should succeed
-	_, err = cluster.s3Client.PutObject(&s3.PutObjectInput{
-		Bucket:     aws.String(bucketName),
-		Key:        aws.String(objectKey),
-		Body:       bytes.NewReader([]byte(objectData)),
-		ContentMD5: aws.String(correctMD5),
-	})
-	require.NoError(t, err, "Failed to put object")
-
-	// Verify object exists
-	headResp, err := cluster.s3Client.HeadObject(&s3.HeadObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-	})
-	require.NoError(t, err)
-	assert.NotNil(t, headResp.ContentLength)
-	assert.Equal(t, int64(len(objectData)), aws.Int64Value(headResp.ContentLength))
-
-	t.Logf("✓ Put object with correct MD5: %s/%s (%d bytes)", bucketName, objectKey, len(objectData))
-}
-
-// putObjectSSEC sends a PutObject request with SSE-C headers over HTTP.
-// The AWS SDK v1 refuses to send SSE-C keys over plain HTTP, so we use the
-// low-level Request API and clear the Validate handlers to bypass that check.
-// We use Clear() because the specific validator is internal and not easily removable by name.
-func putObjectSSEC(client *s3.S3, input *s3.PutObjectInput) (*s3.PutObjectOutput, error) {
-	req, output := client.PutObjectRequest(input)
-	req.Handlers.Validate.Clear()
-	err := req.Send()
-	return output, err
-}
-
-func headObjectSSEC(client *s3.S3, input *s3.HeadObjectInput) (*s3.HeadObjectOutput, error) {
-	req, output := client.HeadObjectRequest(input)
-	req.Handlers.Validate.Clear()
-	err := req.Send()
-	return output, err
-}
-
-func testPutObjectWithChecksumAndSSEC(t *testing.T, cluster *TestCluster) {
-	bucketName := createTestBucket(t, cluster, "test-put-checksum-ssec-")
-	objectKey := "test-checksummed-ssec-object.txt"
-	objectData := "Hello, SeaweedFS S3 with SSE-C!"
-
-	correctMD5 := calculateMd5(objectData)
-	incorrectMD5 := calculateMd5(objectData + "incorrect")
-	keyRaw, keyMD5B64 := generateSSECKey()
-
-	// Put object with SSE-C and incorrect MD5 should be rejected
-	_, err := putObjectSSEC(cluster.s3Client, &s3.PutObjectInput{
-		Bucket:               aws.String(bucketName),
-		Key:                  aws.String(objectKey),
-		Body:                 bytes.NewReader([]byte(objectData)),
-		ContentMD5:           aws.String(incorrectMD5),
-		SSECustomerAlgorithm: aws.String("AES256"),
-		SSECustomerKey:       aws.String(keyRaw),
-		SSECustomerKeyMD5:    aws.String(keyMD5B64),
-	})
-	assertBadDigestError(t, err, "PutObject with SSE-C should fail with incorrect MD5")
-
-	t.Logf("Put object with SSE-C and incorrect MD5 rejected: %s/%s", bucketName, objectKey)
-
-	// Put object with SSE-C and correct MD5 should succeed
-	_, err = putObjectSSEC(cluster.s3Client, &s3.PutObjectInput{
-		Bucket:               aws.String(bucketName),
-		Key:                  aws.String(objectKey),
-		Body:                 bytes.NewReader([]byte(objectData)),
-		ContentMD5:           aws.String(correctMD5),
-		SSECustomerAlgorithm: aws.String("AES256"),
-		SSECustomerKey:       aws.String(keyRaw),
-		SSECustomerKeyMD5:    aws.String(keyMD5B64),
-	})
-	require.NoError(t, err, "Failed to put object with SSE-C and correct MD5")
-
-	// Verify object exists (SSE-C requires the key for HeadObject too)
-	headResp, err := headObjectSSEC(cluster.s3Client, &s3.HeadObjectInput{
-		Bucket:               aws.String(bucketName),
-		Key:                  aws.String(objectKey),
-		SSECustomerAlgorithm: aws.String("AES256"),
-		SSECustomerKey:       aws.String(keyRaw),
-		SSECustomerKeyMD5:    aws.String(keyMD5B64),
-	})
-	require.NoError(t, err)
-	assert.NotNil(t, headResp.ContentLength)
-	assert.Equal(t, int64(len(objectData)), aws.Int64Value(headResp.ContentLength))
-
-	t.Logf("Put object with SSE-C and correct MD5: %s/%s (%d bytes)", bucketName, objectKey, len(objectData))
-}
-
-func testUploadPartWithChecksum(t *testing.T, cluster *TestCluster) {
-	bucketName := createTestBucket(t, cluster, "test-upload-part-checksum-")
-	objectKey := "test-multipart-checksum.txt"
-	objectData := "Hello, SeaweedFS S3 Multipart!"
-
-	// Initiate multipart upload
-	initResp, err := cluster.s3Client.CreateMultipartUpload(&s3.CreateMultipartUploadInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-	})
-	require.NoError(t, err)
-	uploadID := initResp.UploadId
-
-	correctMD5 := calculateMd5(objectData)
-	incorrectMD5 := calculateMd5(objectData + "incorrect")
-
-	// Upload part with incorrect MD5
-	_, err = cluster.s3Client.UploadPart(&s3.UploadPartInput{
-		Bucket:     aws.String(bucketName),
-		Key:        aws.String(objectKey),
-		PartNumber: aws.Int64(1),
-		UploadId:   uploadID,
-		Body:       bytes.NewReader([]byte(objectData)),
-		ContentMD5: aws.String(incorrectMD5),
-	})
-	assertBadDigestError(t, err, "UploadPart should fail with incorrect MD5")
-
-	// Upload part with correct MD5
-	partResp, err := cluster.s3Client.UploadPart(&s3.UploadPartInput{
-		Bucket:     aws.String(bucketName),
-		Key:        aws.String(objectKey),
-		PartNumber: aws.Int64(1),
-		UploadId:   uploadID,
-		Body:       bytes.NewReader([]byte(objectData)),
-		ContentMD5: aws.String(correctMD5),
-	})
-	require.NoError(t, err, "Failed to upload part with correct MD5")
-
-	// Complete multipart upload
-	_, err = cluster.s3Client.CompleteMultipartUpload(&s3.CompleteMultipartUploadInput{
-		Bucket:   aws.String(bucketName),
-		Key:      aws.String(objectKey),
-		UploadId: uploadID,
-		MultipartUpload: &s3.CompletedMultipartUpload{
-			Parts: []*s3.CompletedPart{
-				{
-					ETag:       partResp.ETag,
-					PartNumber: aws.Int64(1),
-				},
-			},
-		},
-	})
-	require.NoError(t, err, "Failed to complete multipart upload")
-
-	// Verify object exists
-	headResp, err := cluster.s3Client.HeadObject(&s3.HeadObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-	})
-	require.NoError(t, err)
-	assert.Equal(t, int64(len(objectData)), aws.Int64Value(headResp.ContentLength))
-
-	t.Logf("✓ Multipart upload with checksum successful: %s/%s", bucketName, objectKey)
-}
-
-func testPutPartWithChecksum(t *testing.T, cluster *TestCluster) {
-	bucketName := createTestBucket(t, cluster, "test-put-checksum-")
-	objectKey := "test-checksummed-part.txt"
-
-	partData := "Hello, SeaweedFS S3!"
-
-	correctMD5 := calculateMd5(partData)
-	incorrectMD5 := calculateMd5(partData + "incorrect")
-
-	createResp, err := cluster.s3Client.CreateMultipartUpload(&s3.CreateMultipartUploadInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-	})
-	require.NoError(t, err)
-
-	uploadID := createResp.UploadId
-
-	partBody := []byte(partData)
-
-	_, err = cluster.s3Client.UploadPart(&s3.UploadPartInput{
-		Bucket:     aws.String(bucketName),
-		Key:        aws.String(objectKey),
-		UploadId:   uploadID,
-		PartNumber: aws.Int64(1),
-		Body:       bytes.NewReader(partBody),
-		ContentMD5: aws.String(incorrectMD5),
-	})
-	assertBadDigestError(t, err, "UploadPart should fail with incorrect MD5")
-
-	uploadResp, err := cluster.s3Client.UploadPart(&s3.UploadPartInput{
-		Bucket:     aws.String(bucketName),
-		Key:        aws.String(objectKey),
-		UploadId:   uploadID,
-		PartNumber: aws.Int64(1),
-		Body:       bytes.NewReader(partBody),
-		ContentMD5: aws.String(correctMD5),
-	})
-	require.NoError(t, err)
-
-	_, err = cluster.s3Client.CompleteMultipartUpload(&s3.CompleteMultipartUploadInput{
-		Bucket:   aws.String(bucketName),
-		Key:      aws.String(objectKey),
-		UploadId: uploadID,
-		MultipartUpload: &s3.CompletedMultipartUpload{
-			Parts: []*s3.CompletedPart{
-				{
-					ETag:       uploadResp.ETag,
-					PartNumber: aws.Int64(1),
-				},
-			},
-		},
-	})
-	require.NoError(t, err, "Failed to complete multipart upload")
-
-	// Verify object exists
-	headResp, err := cluster.s3Client.HeadObject(&s3.HeadObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-	})
-	require.NoError(t, err)
-	assert.Equal(t, int64(len(partData)), aws.Int64Value(headResp.ContentLength))
-
-	t.Logf("✓ UploadPart with MD5 validation: %s/%s", bucketName, objectKey)
-}
-
-func calculateMd5(objectData string) string {
-	dataBytes := []byte(objectData)
-	hash := md5.Sum(dataBytes)
-	return base64.StdEncoding.EncodeToString(hash[:])
-}
-
-func assertBadDigestError(t *testing.T, err error, description string) {
-	require.Error(t, err, description)
-
-	var awsErr awserr.Error
-	require.ErrorAs(t, err, &awsErr)
-	assert.Equal(t, "BadDigest", awsErr.Code())
-}
-
 func testGetObject(t *testing.T, cluster *TestCluster) {
 	bucketName := "test-get-" + randomString(8)
 	objectKey := "test-data.txt"
@@ -780,49 +484,6 @@ func testDeleteBucket(t *testing.T, cluster *TestCluster) {
 	t.Logf("✓ Deleted bucket: %s", bucketName)
 }

-func TestS3DeleteBucketNotEmpty(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-
-	cluster, err := startMiniCluster(t, "-s3.allowDeleteBucketNotEmpty=false")
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	t.Run("DeleteNonEmptyBucketFails", func(t *testing.T) {
-		bucketName := createTestBucket(t, cluster, "test-notempty-")
-		objectKey := "keep-me.txt"
-
-		// Put an object so the bucket is non-empty
-		_, err := cluster.s3Client.PutObject(&s3.PutObjectInput{
-			Bucket: aws.String(bucketName),
-			Key:    aws.String(objectKey),
-			Body:   bytes.NewReader([]byte("data")),
-		})
-		require.NoError(t, err)
-
-		// Attempt to delete the non-empty bucket — must fail with BucketNotEmpty (409)
-		_, err = cluster.s3Client.DeleteBucket(&s3.DeleteBucketInput{
-			Bucket: aws.String(bucketName),
-		})
-		require.Error(t, err, "deleting a non-empty bucket should fail")
-		var awsErr awserr.Error
-		require.ErrorAs(t, err, &awsErr)
-		assert.Equal(t, "BucketNotEmpty", awsErr.Code(),
-			"expected BucketNotEmpty error code, got %s: %s", awsErr.Code(), awsErr.Message())
-	})
-
-	t.Run("DeleteEmptyBucketSucceeds", func(t *testing.T) {
-		bucketName := createTestBucket(t, cluster, "test-empty-")
-
-		// Delete the empty bucket — should succeed even with the flag
-		_, err := cluster.s3Client.DeleteBucket(&s3.DeleteBucketInput{
-			Bucket: aws.String(bucketName),
-		})
-		require.NoError(t, err, "deleting an empty bucket should succeed")
-	})
-}
-
 // randomString generates a random string for unique naming
 func randomString(length int) string {
 	const charset = "abcdefghijklmnopqrstuvwxyz0123456789"
@@ -2,7 +2,6 @@ package policy

 import (
 	"context"
-	"errors"
 	"fmt"
 	"net"
 	"net/http"
@@ -15,12 +14,6 @@ import (
 	"testing"
 	"time"

-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/iam"
-	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/seaweedfs/seaweedfs/weed/command"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
@@ -137,503 +130,6 @@ func TestS3PolicyShellRevised(t *testing.T) {
 	}
 }

-func TestS3IAMAttachDetachUserPolicy(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	time.Sleep(500 * time.Millisecond)
-
-	policyName := uniqueName("managed-policy")
-	policyArn := fmt.Sprintf("arn:aws:iam:::policy/%s", policyName)
-	policyContent := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]}`
-	tmpPolicyFile, err := os.CreateTemp("", "test_policy_attach_*.json")
-	require.NoError(t, err)
-	defer os.Remove(tmpPolicyFile.Name())
-	_, err = tmpPolicyFile.WriteString(policyContent)
-	require.NoError(t, err)
-	require.NoError(t, tmpPolicyFile.Close())
-
-	weedCmd := "weed"
-	masterAddr := string(pb.NewServerAddress("127.0.0.1", cluster.masterPort, cluster.masterGrpcPort))
-	filerAddr := string(pb.NewServerAddress("127.0.0.1", cluster.filerPort, cluster.filerGrpcPort))
-	execShell(t, weedCmd, masterAddr, filerAddr, fmt.Sprintf("s3.policy -put -name=%s -file=%s", policyName, tmpPolicyFile.Name()))
-
-	iamClient := newIAMClient(t, cluster.s3Endpoint)
-
-	userName := uniqueName("iam-user")
-	_, err = iamClient.CreateUser(&iam.CreateUserInput{UserName: aws.String(userName)})
-	require.NoError(t, err)
-
-	_, err = iamClient.AttachUserPolicy(&iam.AttachUserPolicyInput{
-		UserName:  aws.String(userName),
-		PolicyArn: aws.String(policyArn),
-	})
-	require.NoError(t, err)
-
-	listOut, err := iamClient.ListAttachedUserPolicies(&iam.ListAttachedUserPoliciesInput{
-		UserName: aws.String(userName),
-	})
-	require.NoError(t, err)
-	require.True(t, attachedPolicyContains(listOut.AttachedPolicies, policyName))
-
-	_, err = iamClient.DetachUserPolicy(&iam.DetachUserPolicyInput{
-		UserName:  aws.String(userName),
-		PolicyArn: aws.String(policyArn),
-	})
-	require.NoError(t, err)
-
-	listOut, err = iamClient.ListAttachedUserPolicies(&iam.ListAttachedUserPoliciesInput{
-		UserName: aws.String(userName),
-	})
-	require.NoError(t, err)
-	require.False(t, attachedPolicyContains(listOut.AttachedPolicies, policyName))
-
-	_, err = iamClient.AttachUserPolicy(&iam.AttachUserPolicyInput{
-		UserName:  aws.String(userName),
-		PolicyArn: aws.String("arn:aws:iam:::policy/does-not-exist"),
-	})
-	require.Error(t, err)
-	if awsErr, ok := err.(awserr.Error); ok {
-		require.Equal(t, iam.ErrCodeNoSuchEntityException, awsErr.Code())
-	}
-}
-
-func TestS3IAMListPoliciesAndGetPolicy(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	time.Sleep(500 * time.Millisecond)
-
-	policyName := uniqueName("managed-policy")
-	policyArn := fmt.Sprintf("arn:aws:iam:::policy/%s", policyName)
-	policyContent := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"}]}`
-
-	iamClient := newIAMClient(t, cluster.s3Endpoint)
-	_, err = iamClient.CreatePolicy(&iam.CreatePolicyInput{
-		PolicyName:     aws.String(policyName),
-		PolicyDocument: aws.String(policyContent),
-	})
-	require.NoError(t, err)
-
-	listOut, err := iamClient.ListPolicies(&iam.ListPoliciesInput{})
-	require.NoError(t, err)
-	require.True(t, managedPolicyContains(listOut.Policies, policyName))
-
-	getOut, err := iamClient.GetPolicy(&iam.GetPolicyInput{PolicyArn: aws.String(policyArn)})
-	require.NoError(t, err)
-	require.NotNil(t, getOut.Policy)
-	require.NotNil(t, getOut.Policy.PolicyName)
-	require.Equal(t, policyName, *getOut.Policy.PolicyName)
-
-	missingArn := fmt.Sprintf("arn:aws:iam:::policy/%s", uniqueName("missing"))
-	_, err = iamClient.GetPolicy(&iam.GetPolicyInput{PolicyArn: aws.String(missingArn)})
-	require.Error(t, err)
-	var awsErr awserr.Error
-	require.True(t, errors.As(err, &awsErr))
-	require.Equal(t, iam.ErrCodeNoSuchEntityException, awsErr.Code())
-}
-
-func TestS3IAMDeletePolicyInUse(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	time.Sleep(500 * time.Millisecond)
-
-	policyName := uniqueName("managed-delete-policy")
-	policyArn := fmt.Sprintf("arn:aws:iam:::policy/%s", policyName)
-	policyContent := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}`
-
-	iamClient := newIAMClient(t, cluster.s3Endpoint)
-	_, err = iamClient.CreatePolicy(&iam.CreatePolicyInput{
-		PolicyName:     aws.String(policyName),
-		PolicyDocument: aws.String(policyContent),
-	})
-	require.NoError(t, err)
-
-	userName := uniqueName("iam-user-delete-policy")
-	_, err = iamClient.CreateUser(&iam.CreateUserInput{UserName: aws.String(userName)})
-	require.NoError(t, err)
-
-	_, err = iamClient.AttachUserPolicy(&iam.AttachUserPolicyInput{
-		UserName:  aws.String(userName),
-		PolicyArn: aws.String(policyArn),
-	})
-	require.NoError(t, err)
-
-	_, err = iamClient.DeletePolicy(&iam.DeletePolicyInput{PolicyArn: aws.String(policyArn)})
-	require.Error(t, err)
-	var awsErr awserr.Error
-	require.True(t, errors.As(err, &awsErr))
-	require.Equal(t, iam.ErrCodeDeleteConflictException, awsErr.Code())
-}
-
-func TestS3MultipartOperationsInheritPutObjectPermissions(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	time.Sleep(500 * time.Millisecond)
-
-	// Create a policy with only s3:PutObject permission
-	// This should implicitly allow multipart upload operations (CreateMultipartUpload,
-	// UploadPart, CompleteMultipartUpload, AbortMultipartUpload, ListBucketMultipartUploads, ListMultipartUploadParts)
-	policyName := uniqueName("putobject-policy")
-	policyArn := fmt.Sprintf("arn:aws:iam:::policy/%s", policyName)
-	policyContent := `{
-		"Version":"2012-10-17",
-		"Statement":[{
-			"Effect":"Allow",
-			"Action":"s3:PutObject",
-			"Resource":"*"
-		}]
-	}`
-
-	iamClient := newIAMClient(t, cluster.s3Endpoint)
-	_, err = iamClient.CreatePolicy(&iam.CreatePolicyInput{
-		PolicyName:     aws.String(policyName),
-		PolicyDocument: aws.String(policyContent),
-	})
-	require.NoError(t, err)
-
-	// Create a user and attach the policy
-	userName := uniqueName("multipart-user")
-	_, err = iamClient.CreateUser(&iam.CreateUserInput{UserName: aws.String(userName)})
-	require.NoError(t, err)
-
-	_, err = iamClient.CreateAccessKey(&iam.CreateAccessKeyInput{UserName: aws.String(userName)})
-	require.NoError(t, err)
-
-	_, err = iamClient.AttachUserPolicy(&iam.AttachUserPolicyInput{
-		UserName:  aws.String(userName),
-		PolicyArn: aws.String(policyArn),
-	})
-	require.NoError(t, err)
-
-	// Create S3 client with user credentials (using admin credentials for now, test will still validate permissions)
-	// In a real scenario, we'd use the user's access key
-	sess, err := session.NewSession(&aws.Config{
-		Region:           aws.String("us-east-1"),
-		Endpoint:         aws.String(cluster.s3Endpoint),
-		DisableSSL:       aws.Bool(true),
-		S3ForcePathStyle: aws.Bool(true),
-		Credentials:      credentials.NewStaticCredentials("admin", "admin", ""),
-	})
-	require.NoError(t, err)
-
-	s3Client := newS3Client(sess)
-
-	bucketName := uniqueName("multipart-test-bucket")
-	objectKey := "test-object"
-
-	// Create bucket
-	_, err = s3Client.CreateBucket(&s3.CreateBucketInput{Bucket: aws.String(bucketName)})
-	require.NoError(t, err)
-
-	// Test multipart upload operations with s3:PutObject permission
-	// These operations should all succeed since multipart operations are part of s3:PutObject
-
-	// 1. CreateMultipartUpload
-	createOut, err := s3Client.CreateMultipartUpload(&s3.CreateMultipartUploadInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, createOut.UploadId)
-	uploadID := *createOut.UploadId
-
-	// 2. UploadPart
-	partBody := "test part data"
-	uploadPartOut, err := s3Client.UploadPart(&s3.UploadPartInput{
-		Bucket:     aws.String(bucketName),
-		Key:        aws.String(objectKey),
-		PartNumber: aws.Int64(1),
-		UploadId:   aws.String(uploadID),
-		Body:       strings.NewReader(partBody),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, uploadPartOut.ETag)
-
-	// 3. ListParts
-	listPartsOut, err := s3Client.ListParts(&s3.ListPartsInput{
-		Bucket:   aws.String(bucketName),
-		Key:      aws.String(objectKey),
-		UploadId: aws.String(uploadID),
-	})
-	require.NoError(t, err)
-	require.Equal(t, 1, len(listPartsOut.Parts))
-
-	// 4. CompleteMultipartUpload
-	completeOut, err := s3Client.CompleteMultipartUpload(&s3.CompleteMultipartUploadInput{
-		Bucket:   aws.String(bucketName),
-		Key:      aws.String(objectKey),
-		UploadId: aws.String(uploadID),
-		MultipartUpload: &s3.CompletedMultipartUpload{
-			Parts: []*s3.CompletedPart{
-				{
-					ETag:       uploadPartOut.ETag,
-					PartNumber: aws.Int64(1),
-				},
-			},
-		},
-	})
-	require.NoError(t, err)
-	require.NotNil(t, completeOut.ETag)
-
-	// Test AbortMultipartUpload with a new upload
-	createOut2, err := s3Client.CreateMultipartUpload(&s3.CreateMultipartUploadInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey + "-abort"),
-	})
-	require.NoError(t, err)
-	uploadID2 := *createOut2.UploadId
-
-	_, err = s3Client.AbortMultipartUpload(&s3.AbortMultipartUploadInput{
-		Bucket:   aws.String(bucketName),
-		Key:      aws.String(objectKey + "-abort"),
-		UploadId: aws.String(uploadID2),
-	})
-	require.NoError(t, err)
-
-	// Test ListMultipartUploads
-	listUploadsOut, err := s3Client.ListMultipartUploads(&s3.ListMultipartUploadsInput{
-		Bucket: aws.String(bucketName),
-	})
-	require.NoError(t, err)
-	// After aborting, there should be no active uploads
-	require.Equal(t, 0, len(listUploadsOut.Uploads))
-}
-
-// TestS3IAMManagedPolicyLifecycle is an end-to-end integration test covering the
-// user-reported use case in https://github.com/seaweedfs/seaweedfs/issues/8506
-// where managed policy operations (GetPolicy, ListPolicies, DeletePolicy,
-// AttachUserPolicy, DetachUserPolicy) returned 500 errors.
-func TestS3IAMManagedPolicyLifecycle(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	iamClient := newIAMClient(t, cluster.s3Endpoint)
-
-	// Step 1: Create a user (this already worked per the issue)
-	userName := uniqueName("lifecycle-user")
-	_, err = iamClient.CreateUser(&iam.CreateUserInput{UserName: aws.String(userName)})
-	require.NoError(t, err, "CreateUser should succeed")
-
-	// Step 2: Create a managed policy via IAM API
-	policyName := uniqueName("lifecycle-policy")
-	policyArn := fmt.Sprintf("arn:aws:iam:::policy/%s", policyName)
-	policyDoc := `{
-		"Version": "2012-10-17",
-		"Statement": [{
-			"Effect": "Allow",
-			"Action": ["s3:GetObject", "s3:PutObject"],
-			"Resource": "arn:aws:s3:::*"
-		}]
-	}`
-	createOut, err := iamClient.CreatePolicy(&iam.CreatePolicyInput{
-		PolicyName:     aws.String(policyName),
-		PolicyDocument: aws.String(policyDoc),
-	})
-	require.NoError(t, err, "CreatePolicy should succeed")
-	require.NotNil(t, createOut.Policy)
-	require.Equal(t, policyName, *createOut.Policy.PolicyName)
-
-	// Step 3: ListPolicies — should include the created policy (was returning 500)
-	listOut, err := iamClient.ListPolicies(&iam.ListPoliciesInput{})
-	require.NoError(t, err, "ListPolicies should succeed (was returning 500)")
-	require.True(t, managedPolicyContains(listOut.Policies, policyName),
-		"ListPolicies should contain the newly created policy")
-
-	// Step 4: GetPolicy by ARN — should return the policy (was returning 500)
-	getOut, err := iamClient.GetPolicy(&iam.GetPolicyInput{PolicyArn: aws.String(policyArn)})
-	require.NoError(t, err, "GetPolicy should succeed (was returning 500)")
-	require.NotNil(t, getOut.Policy)
-	require.Equal(t, policyName, *getOut.Policy.PolicyName)
-	require.Equal(t, policyArn, *getOut.Policy.Arn)
-
-	// Step 5: AttachUserPolicy — should succeed (was returning 500)
-	_, err = iamClient.AttachUserPolicy(&iam.AttachUserPolicyInput{
-		UserName:  aws.String(userName),
-		PolicyArn: aws.String(policyArn),
-	})
-	require.NoError(t, err, "AttachUserPolicy should succeed (was returning 500)")
-
-	// Step 6: ListAttachedUserPolicies — verify the policy is attached
-	attachedOut, err := iamClient.ListAttachedUserPolicies(&iam.ListAttachedUserPoliciesInput{
-		UserName: aws.String(userName),
-	})
-	require.NoError(t, err, "ListAttachedUserPolicies should succeed")
-	require.True(t, attachedPolicyContains(attachedOut.AttachedPolicies, policyName),
-		"Policy should appear in user's attached policies")
-
-	// Step 7: Idempotent re-attach should not fail
-	_, err = iamClient.AttachUserPolicy(&iam.AttachUserPolicyInput{
-		UserName:  aws.String(userName),
-		PolicyArn: aws.String(policyArn),
-	})
-	require.NoError(t, err, "Re-attaching same policy should be idempotent")
-
-	// Step 8: DeletePolicy while attached — should fail with DeleteConflict (AWS behavior)
-	_, err = iamClient.DeletePolicy(&iam.DeletePolicyInput{PolicyArn: aws.String(policyArn)})
-	require.Error(t, err, "DeletePolicy should fail while policy is attached")
-	var awsErr awserr.Error
-	require.True(t, errors.As(err, &awsErr))
-	require.Equal(t, iam.ErrCodeDeleteConflictException, awsErr.Code(),
-		"Should return DeleteConflict when deleting attached policy")
-
-	// Step 9: DetachUserPolicy
-	_, err = iamClient.DetachUserPolicy(&iam.DetachUserPolicyInput{
-		UserName:  aws.String(userName),
-		PolicyArn: aws.String(policyArn),
-	})
-	require.NoError(t, err, "DetachUserPolicy should succeed")
-
-	// Verify detached
-	attachedOut, err = iamClient.ListAttachedUserPolicies(&iam.ListAttachedUserPoliciesInput{
-		UserName: aws.String(userName),
-	})
-	require.NoError(t, err)
-	require.False(t, attachedPolicyContains(attachedOut.AttachedPolicies, policyName),
-		"Policy should no longer appear in user's attached policies after detach")
-
-	// Step 10: DeletePolicy — should now succeed (was returning XML parsing error)
-	_, err = iamClient.DeletePolicy(&iam.DeletePolicyInput{PolicyArn: aws.String(policyArn)})
-	require.NoError(t, err, "DeletePolicy should succeed after detach (was returning XML parsing error)")
-
-	// Step 11: Verify the policy is gone
-	listOut, err = iamClient.ListPolicies(&iam.ListPoliciesInput{})
-	require.NoError(t, err)
-	require.False(t, managedPolicyContains(listOut.Policies, policyName),
-		"Deleted policy should not appear in ListPolicies")
-
-	_, err = iamClient.GetPolicy(&iam.GetPolicyInput{PolicyArn: aws.String(policyArn)})
-	require.Error(t, err, "GetPolicy should fail for deleted policy")
-	require.True(t, errors.As(err, &awsErr))
-	require.Equal(t, iam.ErrCodeNoSuchEntityException, awsErr.Code())
-}
-
-// TestS3IAMManagedPolicyErrorCases covers error cases from the user-reported issue:
-// invalid ARNs, missing policies, and missing users.
-func TestS3IAMManagedPolicyErrorCases(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	iamClient := newIAMClient(t, cluster.s3Endpoint)
-
-	t.Run("GetPolicy with nonexistent ARN returns NoSuchEntity", func(t *testing.T) {
-		_, err := iamClient.GetPolicy(&iam.GetPolicyInput{
-			PolicyArn: aws.String("arn:aws:iam:::policy/does-not-exist"),
-		})
-		require.Error(t, err)
-		var awsErr awserr.Error
-		require.True(t, errors.As(err, &awsErr))
-		require.Equal(t, iam.ErrCodeNoSuchEntityException, awsErr.Code())
-	})
-
-	t.Run("DeletePolicy with nonexistent ARN returns NoSuchEntity", func(t *testing.T) {
-		_, err := iamClient.DeletePolicy(&iam.DeletePolicyInput{
-			PolicyArn: aws.String("arn:aws:iam:::policy/does-not-exist"),
-		})
-		require.Error(t, err)
-		var awsErr awserr.Error
-		require.True(t, errors.As(err, &awsErr))
-		require.Equal(t, iam.ErrCodeNoSuchEntityException, awsErr.Code())
-	})
-
-	t.Run("AttachUserPolicy with nonexistent policy returns NoSuchEntity", func(t *testing.T) {
-		userName := uniqueName("err-user")
-		_, err := iamClient.CreateUser(&iam.CreateUserInput{UserName: aws.String(userName)})
-		require.NoError(t, err)
-
-		_, err = iamClient.AttachUserPolicy(&iam.AttachUserPolicyInput{
-			UserName:  aws.String(userName),
-			PolicyArn: aws.String("arn:aws:iam:::policy/does-not-exist"),
-		})
-		require.Error(t, err)
-		var awsErr awserr.Error
-		require.True(t, errors.As(err, &awsErr))
-		require.Equal(t, iam.ErrCodeNoSuchEntityException, awsErr.Code())
-	})
-
-	t.Run("AttachUserPolicy with nonexistent user returns NoSuchEntity", func(t *testing.T) {
-		policyName := uniqueName("err-policy")
-		_, err := iamClient.CreatePolicy(&iam.CreatePolicyInput{
-			PolicyName:     aws.String(policyName),
-			PolicyDocument: aws.String(`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*"}]}`),
-		})
-		require.NoError(t, err)
-
-		_, err = iamClient.AttachUserPolicy(&iam.AttachUserPolicyInput{
-			UserName:  aws.String("nonexistent-user"),
-			PolicyArn: aws.String(fmt.Sprintf("arn:aws:iam:::policy/%s", policyName)),
-		})
-		require.Error(t, err)
-		var awsErr awserr.Error
-		require.True(t, errors.As(err, &awsErr))
-		require.Equal(t, iam.ErrCodeNoSuchEntityException, awsErr.Code())
-	})
-
-	t.Run("DetachUserPolicy that is not attached returns NoSuchEntity", func(t *testing.T) {
-		userName := uniqueName("detach-user")
-		_, err := iamClient.CreateUser(&iam.CreateUserInput{UserName: aws.String(userName)})
-		require.NoError(t, err)
-
-		policyName := uniqueName("detach-policy")
-		_, err = iamClient.CreatePolicy(&iam.CreatePolicyInput{
-			PolicyName:     aws.String(policyName),
-			PolicyDocument: aws.String(`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*"}]}`),
-		})
-		require.NoError(t, err)
-
-		_, err = iamClient.DetachUserPolicy(&iam.DetachUserPolicyInput{
-			UserName:  aws.String(userName),
-			PolicyArn: aws.String(fmt.Sprintf("arn:aws:iam:::policy/%s", policyName)),
-		})
-		require.Error(t, err)
-		var awsErr awserr.Error
-		require.True(t, errors.As(err, &awsErr))
-		require.Equal(t, iam.ErrCodeNoSuchEntityException, awsErr.Code())
-	})
-
-	t.Run("ListAttachedUserPolicies for nonexistent user returns NoSuchEntity", func(t *testing.T) {
-		_, err := iamClient.ListAttachedUserPolicies(&iam.ListAttachedUserPoliciesInput{
-			UserName: aws.String("nonexistent-user"),
-		})
-		require.Error(t, err)
-		var awsErr awserr.Error
-		require.True(t, errors.As(err, &awsErr))
-		require.Equal(t, iam.ErrCodeNoSuchEntityException, awsErr.Code())
-	})
-}
-
 func execShell(t *testing.T, weedCmd, master, filer, shellCmd string) string {
 	// weed shell -master=... -filer=...
 	args := []string{"shell", "-master=" + master, "-filer=" + filer}
@@ -649,56 +145,6 @@ func execShell(t *testing.T, weedCmd, master, filer, shellCmd string) string {
 	return string(out)
 }

-func newIAMClient(t *testing.T, endpoint string) *iam.IAM {
-	t.Helper()
-
-	accessKey := os.Getenv("AWS_ACCESS_KEY_ID")
-	secretKey := os.Getenv("AWS_SECRET_ACCESS_KEY")
-	if accessKey == "" {
-		accessKey = "admin"
-	}
-	if secretKey == "" {
-		secretKey = "admin"
-	}
-
-	sess, err := session.NewSession(&aws.Config{
-		Region:           aws.String("us-east-1"),
-		Endpoint:         aws.String(endpoint),
-		DisableSSL:       aws.Bool(true),
-		S3ForcePathStyle: aws.Bool(true),
-		Credentials:      credentials.NewStaticCredentials(accessKey, secretKey, ""),
-	})
-	require.NoError(t, err)
-
-	return iam.New(sess)
-}
-
-func newS3Client(sess *session.Session) *s3.S3 {
-	return s3.New(sess)
-}
-
-func attachedPolicyContains(policies []*iam.AttachedPolicy, policyName string) bool {
-	for _, policy := range policies {
-		if policy.PolicyName != nil && *policy.PolicyName == policyName {
-			return true
-		}
-	}
-	return false
-}
-
-func managedPolicyContains(policies []*iam.Policy, policyName string) bool {
-	for _, policy := range policies {
-		if policy.PolicyName != nil && *policy.PolicyName == policyName {
-			return true
-		}
-	}
-	return false
-}
-
-func uniqueName(prefix string) string {
-	return fmt.Sprintf("%s-%s", prefix, strconv.FormatInt(time.Now().UnixNano(), 36))
-}
-
 // --- Test setup helpers ---

 func findAvailablePort() (int, error) {
@@ -804,7 +250,6 @@ enabled = true
 			"-master.volumeSizeLimitMB=32",
 			"-ip=127.0.0.1",
 			"-master.peers=none",
-			"-s3.iam.readOnly=false",
 		}
 		glog.MaxSize = 1024 * 1024
 		for _, cmd := range command.Commands {
@@ -1,12 +0,0 @@
-FROM alpine:3.20
-RUN apk add --no-cache curl && \
-    addgroup -S seaweed && \
-    adduser -S seaweed -G seaweed
-COPY weed /usr/bin/weed
-RUN chmod +x /usr/bin/weed && \
-    chown seaweed:seaweed /usr/bin/weed && \
-    mkdir -p /etc/seaweedfs /data/filerldb2 && \
-    chown -R seaweed:seaweed /etc/seaweedfs /data && \
-    chmod 755 /data /etc/seaweedfs /data/filerldb2
-WORKDIR /data
-USER seaweed
@@ -1,79 +0,0 @@
-# S3 Proxy Signature Verification Test
-
-Integration test that verifies S3 signature verification works correctly when
-SeaweedFS is deployed behind a reverse proxy (nginx).
-
-## What it tests
-
- S3 operations (create bucket, put/get/head/list/delete) through an nginx
-  reverse proxy with `X-Forwarded-Host`, `X-Forwarded-Port`, and
-  `X-Forwarded-Proto` headers
- SeaweedFS configured with `-s3.externalUrl=http://localhost:9000` so the
-  signature verification uses the client-facing host instead of the internal
-  backend address
-
-## Architecture
-
-```text
-AWS CLI (signs with Host: localhost:9000)
-    |
-    v
-nginx (:9000)
-    |  proxy_pass → seaweedfs:8333
-    |  Sets: X-Forwarded-Host: localhost
-    |         X-Forwarded-Port: 9000
-    |         X-Forwarded-Proto: http
-    v
-SeaweedFS S3 (:8333, -s3.externalUrl=http://localhost:9000)
-    |  externalHost = "localhost:9000" (parsed at startup)
-    |  extractHostHeader() returns "localhost:9000"
-    |  Matches what AWS CLI signed with
-    v
-Signature verification succeeds
-```
-
-**Note:** When `-s3.externalUrl` is configured, direct access to the backend
-port (8333) will fail signature verification because the client signs with a
-different Host header than what `externalUrl` specifies. This is expected —
-all S3 traffic should go through the proxy.
-
-## Prerequisites
-
- Docker and Docker Compose
- AWS CLI v2 (on host or via Docker, see below)
-
-## Running
-
-```bash
-# Build the weed binary first (from repo root):
-cd /path/to/seaweedfs
-go build -o test/s3/proxy_signature/weed ./weed
-cd test/s3/proxy_signature
-
-# Start services
-docker compose up -d --build
-
-# Option A: Run test with aws CLI installed locally
-./test.sh
-
-# Option B: Run test without aws CLI (uses Docker container)
-docker run --rm --network host --entrypoint "" amazon/aws-cli:latest \
-    bash < test.sh
-
-# Tear down
-docker compose down
-
-# Clean up the weed binary
-rm -f weed
-```
-
-## Troubleshooting
-
-If signature verification fails through the proxy, check:
-
-1. nginx is setting `X-Forwarded-Host` and `X-Forwarded-Port` correctly
-2. SeaweedFS is started with `-s3.externalUrl` matching the client endpoint
-3. The AWS CLI endpoint URL matches the proxy address
-
-You can also set the `S3_EXTERNAL_URL` environment variable instead of the
-`-s3.externalUrl` flag.
@@ -1,28 +0,0 @@
-services:
-  seaweedfs:
-    build:
-      context: .
-      dockerfile: Dockerfile
-    command: >
-      /usr/bin/weed mini
-      -s3.config=/etc/seaweedfs/s3.json
-      -s3.externalUrl=http://localhost:9000
-      -ip=seaweedfs
-    volumes:
-      - ./s3.json:/etc/seaweedfs/s3.json:ro
-    healthcheck:
-      test: ["CMD", "curl", "-sf", "http://seaweedfs:8333/status"]
-      interval: 3s
-      timeout: 2s
-      retries: 20
-      start_period: 5s
-
-  nginx:
-    image: nginx:alpine
-    ports:
-      - "9000:9000"
-    volumes:
-      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
-    depends_on:
-      seaweedfs:
-        condition: service_healthy
@@ -1,23 +0,0 @@
-server {
-    listen 9000;
-    server_name localhost;
-
-    # Allow large uploads
-    client_max_body_size 64m;
-
-    location / {
-        proxy_pass http://seaweedfs:8333;
-
-        # Standard reverse proxy headers — this is what Kong, Traefik, etc. do
-        proxy_set_header Host              $host:$server_port;
-        proxy_set_header X-Real-IP         $remote_addr;
-        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Host  $host;
-        proxy_set_header X-Forwarded-Port  $server_port;
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        proxy_http_version 1.1;
-        proxy_buffering off;
-        proxy_request_buffering off;
-    }
-}
@@ -1,20 +0,0 @@
-{
-  "identities": [
-    {
-      "name": "test_admin",
-      "credentials": [
-        {
-          "accessKey": "test_access_key",
-          "secretKey": "test_secret_key"
-        }
-      ],
-      "actions": [
-        "Admin",
-        "Read",
-        "List",
-        "Tagging",
-        "Write"
-      ]
-    }
-  ]
-}
@@ -1,132 +0,0 @@
-#!/usr/bin/env bash
-#
-# Integration test for S3 signature verification behind a reverse proxy.
-#
-# Usage:
-#   # With aws CLI installed locally:
-#   docker compose up -d --build && ./test.sh && docker compose down
-#
-#   # Without aws CLI (runs test inside a container):
-#   docker compose up -d --build
-#   docker run --rm --network host --entrypoint "" amazon/aws-cli:latest \
-#       bash < test.sh
-#   docker compose down
-#
-# This script tests S3 operations through an nginx reverse proxy to verify
-# that signature verification works correctly when SeaweedFS is configured
-# with -s3.externalUrl=http://localhost:9000.
-#
-set -euo pipefail
-
-PROXY_ENDPOINT="http://localhost:9000"
-ACCESS_KEY="test_access_key"
-SECRET_KEY="test_secret_key"
-REGION="us-east-1"
-BUCKET="test-proxy-sig-$$"
-
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-NC='\033[0m'
-
-pass() { echo -e "${GREEN}PASS${NC}: $1"; }
-fail() { echo -e "${RED}FAIL${NC}: $1"; exit 1; }
-
-# Helper: run aws s3api command against a given endpoint
-s3() {
-    local endpoint="$1"
-    shift
-    aws s3api \
-        --endpoint-url "$endpoint" \
-        --region "$REGION" \
-        --no-verify-ssl \
-        "$@" 2>&1
-}
-
-export AWS_ACCESS_KEY_ID="$ACCESS_KEY"
-export AWS_SECRET_ACCESS_KEY="$SECRET_KEY"
-
-echo "=== S3 Proxy Signature Verification Test ==="
-echo ""
-echo "Testing S3 access through nginx reverse proxy at $PROXY_ENDPOINT"
-echo "SeaweedFS configured with -s3.externalUrl=http://localhost:9000"
-echo "AWS CLI signs requests with Host: localhost:9000"
-echo ""
-
-# Wait for proxy to be ready
-echo "Waiting for nginx proxy to be ready..."
-for i in $(seq 1 30); do
-    # Use aws CLI for health check if curl is missing
-    if command -v curl >/dev/null 2>&1; then
-        http_code=$(curl -s -o /dev/null -w "%{http_code}" "$PROXY_ENDPOINT/" 2>/dev/null || echo "000")
-        case $http_code in
-            200|403|405) break ;;
-        esac
-    else
-        if aws s3api list-buckets --endpoint-url "$PROXY_ENDPOINT" --no-sign-request >/dev/null 2>&1; then
-            break
-        fi
-    fi
-    if [ "$i" -eq 30 ]; then
-        fail "Proxy did not become ready in time"
-    fi
-    echo "Waiting for proxy $i/30..."
-    sleep 1
-done
-echo "Proxy is ready."
-echo ""
-
-# --- Test 1: Bucket operations through proxy ---
-echo "--- Test 1: Bucket operations through proxy ---"
-s3 "$PROXY_ENDPOINT" create-bucket --bucket "$BUCKET" > /dev/null \
-    && pass "create-bucket" \
-    || fail "create-bucket — signature verification likely failed"
-
-s3 "$PROXY_ENDPOINT" list-buckets > /dev/null \
-    && pass "list-buckets" \
-    || fail "list-buckets"
-echo ""
-
-# --- Test 2: Object CRUD through proxy ---
-echo "--- Test 2: Object CRUD through proxy ---"
-echo "hello-from-proxy" > /tmp/test-proxy-sig.txt
-
-s3 "$PROXY_ENDPOINT" put-object --bucket "$BUCKET" --key "test.txt" --body /tmp/test-proxy-sig.txt > /dev/null \
-    && pass "put-object" \
-    || fail "put-object"
-
-s3 "$PROXY_ENDPOINT" head-object --bucket "$BUCKET" --key "test.txt" > /dev/null \
-    && pass "head-object" \
-    || fail "head-object"
-
-s3 "$PROXY_ENDPOINT" list-objects-v2 --bucket "$BUCKET" > /dev/null \
-    && pass "list-objects-v2" \
-    || fail "list-objects-v2"
-
-s3 "$PROXY_ENDPOINT" get-object --bucket "$BUCKET" --key "test.txt" /tmp/test-proxy-sig-get.txt > /dev/null \
-    && pass "get-object" \
-    || fail "get-object"
-
-# Verify content round-trip
-CONTENT=$(cat /tmp/test-proxy-sig-get.txt)
-if [ "$CONTENT" = "hello-from-proxy" ]; then
-    pass "content integrity (round-trip)"
-else
-    fail "content mismatch: got \"$CONTENT\", expected \"hello-from-proxy\""
-fi
-echo ""
-
-# --- Test 3: Delete operations through proxy ---
-echo "--- Test 3: Delete through proxy ---"
-s3 "$PROXY_ENDPOINT" delete-object --bucket "$BUCKET" --key "test.txt" > /dev/null \
-    && pass "delete-object" \
-    || fail "delete-object"
-
-s3 "$PROXY_ENDPOINT" delete-bucket --bucket "$BUCKET" > /dev/null \
-    && pass "delete-bucket" \
-    || fail "delete-bucket"
-echo ""
-
-# Cleanup temp files
-rm -f /tmp/test-proxy-sig.txt /tmp/test-proxy-sig-get.txt
-
-echo "=== All tests passed ==="
@@ -1,4 +1,5 @@
 //go:build integration
+// +build integration

 package sse

@@ -6,7 +6,6 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
-	"flag"
 	"fmt"
 	"io"
 	"net"
@@ -19,37 +18,6 @@ import (
 	"time"
 )

-// sharedEnv is the single TestEnvironment shared across all tests in this package.
-var sharedEnv *TestEnvironment
-
-// TestMain starts one weed mini instance for the whole package and tears it down
-// after all tests have run.
-func TestMain(m *testing.M) {
-	flag.Parse()
-	if os.Getenv("SHORT") != "" || testing.Short() {
-		// Let tests self-skip when run with -short.
-		os.Exit(m.Run())
-	}
-
-	env, err := newTestEnvironmentForMain()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "SKIP: setup failed: %v\n", err)
-		os.Exit(0) // Skip all tests rather than fail
-	}
-	sharedEnv = env
-
-	if startErr := sharedEnv.startSeaweedFSForMain(); startErr != nil {
-		fmt.Fprintf(os.Stderr, "SKIP: weed mini failed to start: %v\n", startErr)
-		sharedEnv.cleanupForMain()
-		os.Exit(0)
-	}
-
-	code := m.Run()
-
-	sharedEnv.cleanupForMain()
-	os.Exit(code)
-}
-
 // TestEnvironment contains the test environment configuration
 type TestEnvironment struct {
 	seaweedDir      string
@@ -86,15 +54,17 @@ func getFreePort() (int, net.Listener, error) {
 	return addr.Port, listener, nil
 }

-// newTestEnvironmentForMain creates a TestEnvironment without calling t.Fatalf so it
-// can be used from TestMain (which has no *testing.T).
-func newTestEnvironmentForMain() (*TestEnvironment, error) {
+// NewTestEnvironment creates a new test environment
+func NewTestEnvironment(t *testing.T) *TestEnvironment {
+	t.Helper()
+
 	// Find the SeaweedFS root directory
 	wd, err := os.Getwd()
 	if err != nil {
-		return nil, fmt.Errorf("get working directory: %w", err)
+		t.Fatalf("Failed to get working directory: %v", err)
 	}

+	// Navigate up to find the SeaweedFS root (contains go.mod)
 	seaweedDir := wd
 	for i := 0; i < 5; i++ {
 		if _, err := os.Stat(filepath.Join(seaweedDir, "go.mod")); err == nil {
@@ -106,93 +76,82 @@ func newTestEnvironmentForMain() (*TestEnvironment, error) {
 	// Check for weed binary
 	weedBinary := filepath.Join(seaweedDir, "weed", "weed")
 	if _, err := os.Stat(weedBinary); os.IsNotExist(err) {
+		// Try system PATH
 		weedBinary = "weed"
 		if _, err := exec.LookPath(weedBinary); err != nil {
-			return nil, fmt.Errorf("weed binary not found")
+			t.Skip("weed binary not found, skipping integration test")
 		}
 	}

 	// Create temporary data directory
 	dataDir, err := os.MkdirTemp("", "seaweed-iceberg-test-*")
 	if err != nil {
-		return nil, fmt.Errorf("create temp dir: %w", err)
+		t.Fatalf("Failed to create temp dir: %v", err)
 	}

 	// Allocate free ephemeral ports for each service
 	var listeners []net.Listener
-	closeListeners := func() {
+	defer func() {
 		for _, l := range listeners {
 			l.Close()
 		}
-	}
+	}()

 	var l net.Listener
 	s3Port, l, err := getFreePort()
 	if err != nil {
-		closeListeners()
-		return nil, fmt.Errorf("get free port for S3: %w", err)
+		t.Fatalf("Failed to get free port for S3: %v", err)
 	}
 	listeners = append(listeners, l)

 	icebergPort, l, err := getFreePort()
 	if err != nil {
-		closeListeners()
-		return nil, fmt.Errorf("get free port for Iceberg: %w", err)
+		t.Fatalf("Failed to get free port for Iceberg: %v", err)
 	}
 	listeners = append(listeners, l)

 	s3GrpcPort, l, err := getFreePort()
 	if err != nil {
-		closeListeners()
-		return nil, fmt.Errorf("get free port for S3 gRPC: %w", err)
+		t.Fatalf("Failed to get free port for S3 gRPC: %v", err)
 	}
 	listeners = append(listeners, l)

 	masterPort, l, err := getFreePort()
 	if err != nil {
-		closeListeners()
-		return nil, fmt.Errorf("get free port for Master: %w", err)
+		t.Fatalf("Failed to get free port for Master: %v", err)
 	}
 	listeners = append(listeners, l)

 	masterGrpcPort, l, err := getFreePort()
 	if err != nil {
-		closeListeners()
-		return nil, fmt.Errorf("get free port for Master gRPC: %w", err)
+		t.Fatalf("Failed to get free port for Master gRPC: %v", err)
 	}
 	listeners = append(listeners, l)

 	filerPort, l, err := getFreePort()
 	if err != nil {
-		closeListeners()
-		return nil, fmt.Errorf("get free port for Filer: %w", err)
+		t.Fatalf("Failed to get free port for Filer: %v", err)
 	}
 	listeners = append(listeners, l)

 	filerGrpcPort, l, err := getFreePort()
 	if err != nil {
-		closeListeners()
-		return nil, fmt.Errorf("get free port for Filer gRPC: %w", err)
+		t.Fatalf("Failed to get free port for Filer gRPC: %v", err)
 	}
 	listeners = append(listeners, l)

 	volumePort, l, err := getFreePort()
 	if err != nil {
-		closeListeners()
-		return nil, fmt.Errorf("get free port for Volume: %w", err)
+		t.Fatalf("Failed to get free port for Volume: %v", err)
 	}
 	listeners = append(listeners, l)

 	volumeGrpcPort, l, err := getFreePort()
 	if err != nil {
-		closeListeners()
-		return nil, fmt.Errorf("get free port for Volume gRPC: %w", err)
+		t.Fatalf("Failed to get free port for Volume gRPC: %v", err)
 	}
 	listeners = append(listeners, l)

-	// Release the port reservations so weed mini can bind to them
-	closeListeners()
-
 	return &TestEnvironment{
 		seaweedDir:      seaweedDir,
 		weedBinary:      weedBinary,
@@ -207,11 +166,13 @@ func newTestEnvironmentForMain() (*TestEnvironment, error) {
 		volumePort:      volumePort,
 		volumeGrpcPort:  volumeGrpcPort,
 		dockerAvailable: hasDocker(),
-	}, nil
+	}
 }

-// startSeaweedFSForMain starts weed mini without a *testing.T (for use in TestMain).
-func (env *TestEnvironment) startSeaweedFSForMain() error {
+// StartSeaweedFS starts a SeaweedFS mini cluster
+func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
+	t.Helper()
+
 	ctx, cancel := context.WithCancel(context.Background())
 	env.weedCancel = cancel

@@ -221,8 +182,7 @@ func (env *TestEnvironment) startSeaweedFSForMain() error {

 	for _, dir := range []string{masterDir, filerDir, volumeDir} {
 		if err := os.MkdirAll(dir, 0755); err != nil {
-			cancel()
-			return fmt.Errorf("create directory %s: %w", dir, err)
+			t.Fatalf("Failed to create directory %s: %v", dir, err)
 		}
 	}

@@ -243,30 +203,13 @@ func (env *TestEnvironment) startSeaweedFSForMain() error {
 	cmd.Stderr = os.Stderr

 	if err := cmd.Start(); err != nil {
-		cancel()
-		return fmt.Errorf("start SeaweedFS: %w", err)
+		t.Fatalf("Failed to start SeaweedFS: %v", err)
 	}
 	env.weedProcess = cmd

+	// Wait for services to be ready
 	if !env.waitForService(fmt.Sprintf("http://127.0.0.1:%d/v1/config", env.icebergPort), 30*time.Second) {
-		cancel()
-		cmd.Wait()
-		return fmt.Errorf("Iceberg REST API did not become ready")
-	}
-	return nil
-}
-
-// cleanupForMain stops SeaweedFS and cleans up resources (no *testing.T needed).
-func (env *TestEnvironment) cleanupForMain() {
-	if env.weedCancel != nil {
-		env.weedCancel()
-	}
-	if env.weedProcess != nil {
-		time.Sleep(2 * time.Second)
-		env.weedProcess.Wait()
-	}
-	if env.dataDir != "" {
-		os.RemoveAll(env.dataDir)
+		t.Fatalf("Iceberg REST API did not become ready")
 	}
 }

@@ -287,6 +230,25 @@ func (env *TestEnvironment) waitForService(url string, timeout time.Duration) bo
 	return false
 }

+// Cleanup stops SeaweedFS and cleans up resources
+func (env *TestEnvironment) Cleanup(t *testing.T) {
+	t.Helper()
+
+	if env.weedCancel != nil {
+		env.weedCancel()
+	}
+
+	if env.weedProcess != nil {
+		// Give process time to shut down gracefully
+		time.Sleep(2 * time.Second)
+		env.weedProcess.Wait()
+	}
+
+	if env.dataDir != "" {
+		os.RemoveAll(env.dataDir)
+	}
+}
+
 // IcebergURL returns the Iceberg REST Catalog URL
 func (env *TestEnvironment) IcebergURL() string {
 	return fmt.Sprintf("http://127.0.0.1:%d", env.icebergPort)
@@ -298,7 +260,10 @@ func TestIcebergConfig(t *testing.T) {
 		t.Skip("Skipping integration test in short mode")
 	}

-	env := sharedEnv
+	env := NewTestEnvironment(t)
+	defer env.Cleanup(t)
+
+	env.StartSeaweedFS(t)

 	// Test GET /v1/config
 	resp, err := http.Get(env.IcebergURL() + "/v1/config")
@@ -329,14 +294,16 @@ func TestIcebergNamespaces(t *testing.T) {
 		t.Skip("Skipping integration test in short mode")
 	}

-	env := sharedEnv
+	env := NewTestEnvironment(t)
+	defer env.Cleanup(t)
+
+	env.StartSeaweedFS(t)

 	// Create the default table bucket first via S3
-	bucketName := "warehouse-ns-" + randomSuffix()
-	createTableBucket(t, env, bucketName)
+	createTableBucket(t, env, "warehouse")

 	// Test GET /v1/namespaces (should return empty list initially)
-	resp, err := http.Get(env.IcebergURL() + icebergPath(bucketName, "/v1/namespaces"))
+	resp, err := http.Get(env.IcebergURL() + "/v1/namespaces")
 	if err != nil {
 		t.Fatalf("Failed to list namespaces: %v", err)
 	}
@@ -354,14 +321,16 @@ func TestStageCreateAndFinalizeFlow(t *testing.T) {
 		t.Skip("Skipping integration test in short mode")
 	}

-	env := sharedEnv
-	bucketName := "warehouse-stage-" + randomSuffix()
-	createTableBucket(t, env, bucketName)
+	env := NewTestEnvironment(t)
+	defer env.Cleanup(t)

-	namespace := "stage_ns_" + randomSuffix()
+	env.StartSeaweedFS(t)
+	createTableBucket(t, env, "warehouse")
+
+	namespace := "stage_ns"
 	tableName := "orders"

-	status, _, err := doIcebergJSONRequest(env, http.MethodPost, icebergPath(bucketName, "/v1/namespaces"), map[string]any{
+	status, _, err := doIcebergJSONRequest(env, http.MethodPost, "/v1/namespaces", map[string]any{
 		"namespace": []string{namespace},
 	})
 	if err != nil {
@@ -371,7 +340,7 @@ func TestStageCreateAndFinalizeFlow(t *testing.T) {
 		t.Fatalf("Create namespace status = %d, want 200 or 409", status)
 	}

-	status, badReqResp, err := doIcebergJSONRequest(env, http.MethodPost, icebergPath(bucketName, fmt.Sprintf("/v1/namespaces/%s/tables", namespace)), map[string]any{
+	status, badReqResp, err := doIcebergJSONRequest(env, http.MethodPost, fmt.Sprintf("/v1/namespaces/%s/tables", namespace), map[string]any{
 		"stage-create": true,
 	})
 	if err != nil {
@@ -389,7 +358,7 @@ func TestStageCreateAndFinalizeFlow(t *testing.T) {
 		t.Fatalf("error.message = %v, want it to include %q", errorObj["message"], "table name is required")
 	}

-	status, stageResp, err := doIcebergJSONRequest(env, http.MethodPost, icebergPath(bucketName, fmt.Sprintf("/v1/namespaces/%s/tables", namespace)), map[string]any{
+	status, stageResp, err := doIcebergJSONRequest(env, http.MethodPost, fmt.Sprintf("/v1/namespaces/%s/tables", namespace), map[string]any{
 		"name":         tableName,
 		"stage-create": true,
 	})
@@ -404,7 +373,7 @@ func TestStageCreateAndFinalizeFlow(t *testing.T) {
 		t.Fatalf("stage metadata-location = %q, want suffix /metadata/v1.metadata.json", stageLocation)
 	}

-	status, _, err = doIcebergJSONRequest(env, http.MethodGet, icebergPath(bucketName, fmt.Sprintf("/v1/namespaces/%s/tables/%s", namespace, tableName)), nil)
+	status, _, err = doIcebergJSONRequest(env, http.MethodGet, fmt.Sprintf("/v1/namespaces/%s/tables/%s", namespace, tableName), nil)
 	if err != nil {
 		t.Fatalf("Load staged table request failed: %v", err)
 	}
@@ -412,7 +381,7 @@ func TestStageCreateAndFinalizeFlow(t *testing.T) {
 		t.Fatalf("Load staged table status = %d, want 404", status)
 	}

-	status, commitResp, err := doIcebergJSONRequest(env, http.MethodPost, icebergPath(bucketName, fmt.Sprintf("/v1/namespaces/%s/tables/%s", namespace, tableName)), map[string]any{
+	status, commitResp, err := doIcebergJSONRequest(env, http.MethodPost, fmt.Sprintf("/v1/namespaces/%s/tables/%s", namespace, tableName), map[string]any{
 		"requirements": []map[string]any{
 			{"type": "assert-create"},
 		},
@@ -429,7 +398,7 @@ func TestStageCreateAndFinalizeFlow(t *testing.T) {
 		t.Fatalf("final metadata-location = %q, want suffix /metadata/v1.metadata.json", commitLocation)
 	}

-	status, loadResp, err := doIcebergJSONRequest(env, http.MethodGet, icebergPath(bucketName, fmt.Sprintf("/v1/namespaces/%s/tables/%s", namespace, tableName)), nil)
+	status, loadResp, err := doIcebergJSONRequest(env, http.MethodGet, fmt.Sprintf("/v1/namespaces/%s/tables/%s", namespace, tableName), nil)
 	if err != nil {
 		t.Fatalf("Load finalized table request failed: %v", err)
 	}
@@ -448,14 +417,16 @@ func TestCommitMissingTableWithoutAssertCreate(t *testing.T) {
 		t.Skip("Skipping integration test in short mode")
 	}

-	env := sharedEnv
-	bucketName := "warehouse-missing-" + randomSuffix()
-	createTableBucket(t, env, bucketName)
+	env := NewTestEnvironment(t)
+	defer env.Cleanup(t)

-	namespace := "stage_missing_assert_ns_" + randomSuffix()
+	env.StartSeaweedFS(t)
+	createTableBucket(t, env, "warehouse")
+
+	namespace := "stage_missing_assert_ns"
 	tableName := "missing_table"

-	status, _, err := doIcebergJSONRequest(env, http.MethodPost, icebergPath(bucketName, "/v1/namespaces"), map[string]any{
+	status, _, err := doIcebergJSONRequest(env, http.MethodPost, "/v1/namespaces", map[string]any{
 		"namespace": []string{namespace},
 	})
 	if err != nil {
@@ -465,7 +436,7 @@ func TestCommitMissingTableWithoutAssertCreate(t *testing.T) {
 		t.Fatalf("Create namespace status = %d, want 200 or 409", status)
 	}

-	status, _, err = doIcebergJSONRequest(env, http.MethodPost, icebergPath(bucketName, fmt.Sprintf("/v1/namespaces/%s/tables/%s", namespace, tableName)), map[string]any{
+	status, _, err = doIcebergJSONRequest(env, http.MethodPost, fmt.Sprintf("/v1/namespaces/%s/tables/%s", namespace, tableName), map[string]any{
 		"requirements": []any{},
 		"updates":      []any{},
 	})
@@ -520,21 +491,6 @@ func doIcebergJSONRequest(env *TestEnvironment, method, path string, payload any
 	return resp.StatusCode, decoded, nil
 }

-// icebergPath inserts the table bucket prefix into Iceberg REST API paths.
-// For example, "/v1/namespaces" with prefix "my-bucket" becomes
-// "/v1/my-bucket/namespaces".
-func icebergPath(prefix, path string) string {
-	if prefix == "" {
-		return path
-	}
-	const base = "/v1/"
-	if !strings.HasPrefix(path, base) {
-		return path
-	}
-	withPrefix := base + prefix + "/" + strings.TrimPrefix(path, base)
-	return withPrefix
-}
-
 // createTableBucket creates a table bucket via the S3Tables REST API
 func createTableBucket(t *testing.T, env *TestEnvironment, bucketName string) {
 	t.Helper()
@@ -564,11 +520,6 @@ func createTableBucket(t *testing.T, env *TestEnvironment, bucketName string) {
 	t.Logf("Created table bucket %s", bucketName)
 }

-// randomSuffix returns a short random hex suffix for unique resource naming.
-func randomSuffix() string {
-	return fmt.Sprintf("%x", time.Now().UnixNano()&0xffffffff)
-}
-
 // TestDuckDBIntegration tests Iceberg catalog operations using DuckDB
 // This test requires Docker to be available
 func TestDuckDBIntegration(t *testing.T) {
@@ -576,12 +527,15 @@ func TestDuckDBIntegration(t *testing.T) {
 		t.Skip("Skipping integration test in short mode")
 	}

-	env := sharedEnv
+	env := NewTestEnvironment(t)
+	defer env.Cleanup(t)

 	if !env.dockerAvailable {
 		t.Skip("Docker not available, skipping DuckDB integration test")
 	}

+	env.StartSeaweedFS(t)
+
 	// Create a temporary SQL file for DuckDB to execute
 	sqlFile := filepath.Join(env.dataDir, "test.sql")
 	sqlContent := fmt.Sprintf(`
@@ -26,14 +26,17 @@ func TestPyIcebergRestCatalog(t *testing.T) {
 		t.Skip("Skipping integration test in short mode")
 	}

-	env := sharedEnv
+	env := NewTestEnvironment(t)
+	defer env.Cleanup(t)

 	if !env.dockerAvailable {
 		t.Skip("Docker not available, skipping PyIceberg integration test")
 	}

+	env.StartSeaweedFS(t)
+
 	// Create the test bucket first
-	bucketName := "pyiceberg-compat-test-" + randomSuffix()
+	bucketName := "pyiceberg-compat-test"
 	createTableBucket(t, env, bucketName)

 	// Build the test working directory path
@@ -81,7 +84,8 @@ func TestPyIcebergRestCatalogAuthenticated(t *testing.T) {
 		t.Skip("Skipping integration test in short mode")
 	}

-	env := sharedEnv
+	env := NewTestEnvironment(t)
+	defer env.Cleanup(t)

 	if !env.dockerAvailable {
 		t.Skip("Docker not available, skipping PyIceberg integration test")
@@ -91,8 +95,11 @@ func TestPyIcebergRestCatalogAuthenticated(t *testing.T) {
 	testAccessKey := "admin"
 	testSecretKey := "admin"

+	// Start SeaweedFS (it will use default admin credentials from environment if set)
+	env.StartSeaweedFS(t)
+
 	// Create the test bucket first (using unauthenticated request, which works with DefaultAllow)
-	bucketName := "pyiceberg-auth-test-" + randomSuffix()
+	bucketName := "pyiceberg-auth-test"
 	createTableBucket(t, env, bucketName)

 	// Build the test working directory path
@@ -40,7 +40,6 @@ type TestEnvironment struct {
 	dockerAvailable bool
 	accessKey       string
 	secretKey       string
-	closers         []io.Closer
 }

 func TestTrinoIcebergCatalog(t *testing.T) {
@@ -119,66 +118,30 @@ func NewTestEnvironment(t *testing.T) *TestEnvironment {

 	bindIP := testutil.FindBindIP()

-	env := &TestEnvironment{
-		seaweedDir: seaweedDir,
-		weedBinary: weedBinary,
-		dataDir:    dataDir,
-		bindIP:     bindIP,
-		closers:    []io.Closer{},
+	masterPort, masterGrpcPort := mustFreePortPair(t, "Master")
+	volumePort, volumeGrpcPort := mustFreePortPair(t, "Volume")
+	filerPort, filerGrpcPort := mustFreePortPair(t, "Filer")
+	s3Port, s3GrpcPort := mustFreePortPair(t, "S3")
+	icebergPort := mustFreePort(t, "Iceberg")
+
+	return &TestEnvironment{
+		seaweedDir:      seaweedDir,
+		weedBinary:      weedBinary,
+		dataDir:         dataDir,
+		bindIP:          bindIP,
+		s3Port:          s3Port,
+		s3GrpcPort:      s3GrpcPort,
+		icebergPort:     icebergPort,
+		masterPort:      masterPort,
+		masterGrpcPort:  masterGrpcPort,
+		filerPort:       filerPort,
+		filerGrpcPort:   filerGrpcPort,
+		volumePort:      volumePort,
+		volumeGrpcPort:  volumeGrpcPort,
+		dockerAvailable: hasDocker(),
+		accessKey:       "AKIAIOSFODNN7EXAMPLE",
+		secretKey:       "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
 	}
-
-	env.masterPort, env.masterGrpcPort = env.mustFreePortPair("Master")
-	env.volumePort, env.volumeGrpcPort = env.mustFreePortPair("Volume")
-	env.filerPort, env.filerGrpcPort = env.mustFreePortPair("Filer")
-	env.s3Port, env.s3GrpcPort = env.mustFreePortPair("S3")
-	env.icebergPort = env.mustFreePort("Iceberg")
-
-	env.dockerAvailable = hasDocker()
-	env.accessKey = "AKIAIOSFODNN7EXAMPLE"
-	env.secretKey = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
-
-	return env
-}
-
-func (env *TestEnvironment) mustFreePort(name string) int {
-	port, closer, err := getFreePort()
-	if err != nil {
-		panic(fmt.Sprintf("Failed to get free port for %s: %v", name, err))
-	}
-	env.closers = append(env.closers, closer)
-	return port
-}
-
-func (env *TestEnvironment) mustFreePortPair(name string) (int, int) {
-	httpPort, httpCloser, grpcPort, grpcCloser, err := findAvailablePortPair()
-	if err != nil {
-		panic(fmt.Sprintf("Failed to get free port pair for %s: %v", name, err))
-	}
-	env.closers = append(env.closers, httpCloser, grpcCloser)
-	return httpPort, grpcPort
-}
-
-func mustFreePort(t *testing.T, name string) int {
-	t.Helper()
-
-	port, closer, err := getFreePort()
-	if err != nil {
-		t.Fatalf("Failed to get free port for %s: %v", name, err)
-	}
-	closer.Close()
-	return port
-}
-
-func mustFreePortPair(t *testing.T, name string) (int, int) {
-	t.Helper()
-
-	httpPort, httpCloser, grpcPort, grpcCloser, err := findAvailablePortPair()
-	if err != nil {
-		t.Fatalf("Failed to get free port pair for %s: %v", name, err)
-	}
-	httpCloser.Close()
-	grpcCloser.Close()
-	return httpPort, grpcPort
 }

 func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
@@ -198,12 +161,6 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	env.weedCancel = cancel

-	// Close all port listeners right before starting the weed process
-	for _, closer := range env.closers {
-		closer.Close()
-	}
-	env.closers = nil
-
 	cmd := exec.CommandContext(ctx, env.weedBinary, "mini",
 		"-master.port", fmt.Sprintf("%d", env.masterPort),
 		"-master.port.grpc", fmt.Sprintf("%d", env.masterGrpcPort),
@@ -514,27 +471,47 @@ func hasDocker() bool {
 	return cmd.Run() == nil
 }

-func findAvailablePortPair() (int, io.Closer, int, io.Closer, error) {
-	httpPort, httpCloser, err := getFreePort()
+func mustFreePort(t *testing.T, name string) int {
+	t.Helper()
+
+	port, err := getFreePort()
 	if err != nil {
-		return 0, nil, 0, nil, err
+		t.Fatalf("Failed to get free port for %s: %v", name, err)
 	}
-	grpcPort, grpcCloser, err := getFreePort()
-	if err != nil {
-		httpCloser.Close()
-		return 0, nil, 0, nil, err
-	}
-	return httpPort, httpCloser, grpcPort, grpcCloser, nil
+	return port
 }

-func getFreePort() (int, io.Closer, error) {
+func mustFreePortPair(t *testing.T, name string) (int, int) {
+	t.Helper()
+
+	httpPort, grpcPort, err := findAvailablePortPair()
+	if err != nil {
+		t.Fatalf("Failed to get free port pair for %s: %v", name, err)
+	}
+	return httpPort, grpcPort
+}
+
+func findAvailablePortPair() (int, int, error) {
+	httpPort, err := getFreePort()
+	if err != nil {
+		return 0, 0, err
+	}
+	grpcPort, err := getFreePort()
+	if err != nil {
+		return 0, 0, err
+	}
+	return httpPort, grpcPort, nil
+}
+
+func getFreePort() (int, error) {
 	listener, err := net.Listen("tcp", "0.0.0.0:0")
 	if err != nil {
-		return 0, nil, err
+		return 0, err
 	}
+	defer listener.Close()

 	addr := listener.Addr().(*net.TCPAddr)
-	return addr.Port, listener, nil
+	return addr.Port, nil
 }

 func randomString(length int) string {
@@ -1,32 +1,15 @@
 package lakekeeper

 import (
-	"bytes"
 	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
 	"fmt"
-	"io"
-	"net/http"
-	"net/url"
 	"os"
 	"os/exec"
 	"path/filepath"
-	"strings"
 	"testing"
 	"time"

-	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/aws/signer/v4"
-	"github.com/aws/aws-sdk-go-v2/config"
-	"github.com/aws/aws-sdk-go-v2/credentials"
-	"github.com/aws/aws-sdk-go-v2/service/s3"
-	s3types "github.com/aws/aws-sdk-go-v2/service/s3/types"
-	"github.com/aws/aws-sdk-go-v2/service/sts"
-
 	"github.com/seaweedfs/seaweedfs/test/s3tables/testutil"
-	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
 )

 type TestEnvironment struct {
@@ -48,19 +31,15 @@ type TestEnvironment struct {
 	secretKey      string
 }

-const (
-	lakekeeperRegion      = "us-east-1"
-	lakekeeperRoleArn     = "arn:aws:iam::000000000000:role/LakekeeperVendedRole"
-	lakekeeperSessionName = "lakekeeper-session"
-)
-
-type lakekeeperSession struct {
-	endpoint string
-	region   string
-	creds    aws.Credentials
-}
-
 func TestLakekeeperIntegration(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	if !testutil.HasDocker() {
+		t.Skip("Docker not available, skipping Lakekeeper integration test")
+	}
+
 	env := NewTestEnvironment(t)
 	defer env.Cleanup(t)

@@ -72,18 +51,6 @@ func TestLakekeeperIntegration(t *testing.T) {
 	runLakekeeperRepro(t, env)
 }

-func TestLakekeeperTableBucketIntegration(t *testing.T) {
-	env := NewTestEnvironment(t)
-	defer env.Cleanup(t)
-
-	fmt.Printf(">>> Starting SeaweedFS with Lakekeeper configuration...\n")
-	env.StartSeaweedFS(t)
-	fmt.Printf(">>> SeaweedFS started.\n")
-
-	// Run python script in docker to test STS and S3 Tables operations
-	runLakekeeperTableBucketRepro(t, env)
-}
-
 func NewTestEnvironment(t *testing.T) *TestEnvironment {
 	t.Helper()

@@ -251,439 +218,124 @@ func (env *TestEnvironment) Cleanup(t *testing.T) {
 func runLakekeeperRepro(t *testing.T, env *TestEnvironment) {
 	t.Helper()

-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	defer cancel()
+	scriptContent := fmt.Sprintf(`
+import boto3
+import botocore.config
+import botocore
+from botocore.exceptions import ClientError
+import os
+import sys
+import time
+import logging

-	session, err := newLakekeeperSession(ctx, env)
-	if err != nil {
-		t.Fatalf("AssumeRole failed: %v", err)
+# Enable botocore debug logging to see signature calculation
+logging.basicConfig(level=logging.DEBUG)
+botocore.session.get_session().set_debug_logger()
+
+print("Starting Lakekeeper repro test...")
+
+endpoint_url = "http://host.docker.internal:%d"
+access_key = "%s"
+secret_key = "%s"
+region = "us-east-1"
+
+print(f"Connecting to {endpoint_url}")
+
+try:
+    config = botocore.config.Config(
+        retries={'max_attempts': 3}
+    )
+    sts = boto3.client(
+        'sts',
+        endpoint_url=endpoint_url,
+        aws_access_key_id=access_key,
+        aws_secret_access_key=secret_key,
+        region_name=region,
+        config=config
+    )
+
+    role_arn = "arn:aws:iam::000000000000:role/LakekeeperVendedRole"
+    session_name = "lakekeeper-session"
+
+    print(f"Calling AssumeRole on {role_arn} with POST body...")
+    
+    # Standard boto3 call sends parameters in POST body
+    response = sts.assume_role(
+        RoleArn=role_arn,
+        RoleSessionName=session_name
+    )
+
+    creds = response['Credentials']
+    access_key_id = creds['AccessKeyId']
+    secret_access_key = creds['SecretAccessKey']
+    session_token = creds['SessionToken']
+
+    print(f"Success! Got credentials with prefix: {access_key_id[:4]}")
+    
+    if not access_key_id.startswith("ASIA"):
+        print(f"FAILED: Expected ASIA prefix, got {access_key_id}")
+        sys.exit(1)
+
+    print("Verifying S3 operations with vended credentials...")
+    s3 = boto3.client(
+        's3',
+        endpoint_url=endpoint_url,
+        aws_access_key_id=access_key_id,
+        aws_secret_access_key=secret_access_key,
+        aws_session_token=session_token,
+        region_name=region,
+        config=config
+    )
+
+    bucket = "lakekeeper-vended-bucket"
+    print(f"Creating bucket {bucket}...")
+    s3.create_bucket(Bucket=bucket)
+
+    print("Listing buckets...")
+    response = s3.list_buckets()
+    buckets = [b['Name'] for b in response['Buckets']]
+    print(f"Found buckets: {buckets}")
+
+    if bucket not in buckets:
+        print(f"FAILED: Bucket {bucket} not found in list")
+        sys.exit(1)
+
+    print("SUCCESS: Lakekeeper flow verified!")
+    sys.exit(0)
+    
+except Exception as e:
+    print(f"FAILED: {e}")
+    # Print more details if it is a ClientError
+    if hasattr(e, 'response'):
+        print(f"Response: {e.response}")
+    sys.exit(1)
+`, env.s3Port, env.accessKey, env.secretKey)
+
+	scriptPath := filepath.Join(env.dataDir, "lakekeeper_repro.py")
+	if err := os.WriteFile(scriptPath, []byte(scriptContent), 0644); err != nil {
+		t.Fatalf("Failed to write python script: %v", err)
 	}

-	s3Client, err := newS3Client(ctx, session.endpoint, session.region, session.creds)
-	if err != nil {
-		t.Fatalf("Create S3 client failed: %v", err)
-	}
+	containerName := "seaweed-lakekeeper-client-" + fmt.Sprintf("%d", time.Now().UnixNano())

-	bucketName := fmt.Sprintf("lakekeeper-vended-bucket-%d", time.Now().UnixNano())
-	if _, err := s3Client.CreateBucket(ctx, &s3.CreateBucketInput{
-		Bucket: aws.String(bucketName),
-	}); err != nil {
-		t.Fatalf("CreateBucket failed: %v", err)
-	}
+	// Create a context with timeout for the docker run command
+	dockerCtx, dockerCancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	defer dockerCancel()

-	bucketCreated := true
-	defer func() {
-		if !bucketCreated {
-			return
-		}
-		_, _ = s3Client.DeleteBucket(ctx, &s3.DeleteBucketInput{
-			Bucket: aws.String(bucketName),
-		})
-	}()
-
-	listResp, err := s3Client.ListBuckets(ctx, &s3.ListBucketsInput{})
-	if err != nil {
-		t.Fatalf("ListBuckets failed: %v", err)
-	}
-
-	found := false
-	for _, bucket := range listResp.Buckets {
-		if aws.ToString(bucket.Name) == bucketName {
-			found = true
-			break
-		}
-	}
-	if !found {
-		t.Fatalf("Bucket %s not found in list", bucketName)
-	}
-
-	if _, err := s3Client.DeleteBucket(ctx, &s3.DeleteBucketInput{
-		Bucket: aws.String(bucketName),
-	}); err != nil {
-		t.Fatalf("DeleteBucket failed: %v", err)
-	}
-	bucketCreated = false
-}
-
-func runLakekeeperTableBucketRepro(t *testing.T, env *TestEnvironment) {
-	t.Helper()
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	defer cancel()
-
-	session, err := newLakekeeperSession(ctx, env)
-	if err != nil {
-		t.Fatalf("AssumeRole failed: %v", err)
-	}
-
-	client := newS3TablesClient(session.endpoint, session.region, session.creds)
-	bucketName := fmt.Sprintf("lakekeeper-table-bucket-%d", time.Now().UnixNano())
-	bucketARN, err := client.CreateTableBucket(ctx, bucketName)
-	if err != nil {
-		t.Fatalf("CreateTableBucket failed: %v", err)
-	}
-
-	bucketDeleted := false
-	namespaceCreated := false
-	tableCreated := false
-	namespaceName := fmt.Sprintf("lakekeeper_ns_%d", time.Now().UnixNano())
-	tableName := fmt.Sprintf("lakekeeper_table_%d", time.Now().UnixNano())
-	defer func() {
-		if tableCreated {
-			if err := client.DeleteTable(ctx, bucketARN, namespaceName, tableName); err != nil {
-				t.Logf("Failed to delete table: %v", err)
-			}
-		}
-		if namespaceCreated {
-			if err := client.DeleteNamespace(ctx, bucketARN, namespaceName); err != nil {
-				t.Logf("Failed to delete namespace: %v", err)
-			}
-		}
-		if bucketDeleted {
-			return
-		}
-		if err := client.DeleteTableBucket(ctx, bucketARN); err != nil {
-			t.Logf("Failed to delete table bucket: %v", err)
-		}
-	}()
-
-	buckets, err := client.ListTableBuckets(ctx)
-	if err != nil {
-		t.Fatalf("ListTableBuckets failed: %v", err)
-	}
-	found := false
-	for _, b := range buckets {
-		if b.Name == bucketName {
-			found = true
-			break
-		}
-	}
-	if !found {
-		t.Fatalf("Created table bucket %s not found in list", bucketName)
-	}
-
-	if _, err := client.GetTableBucket(ctx, bucketARN); err != nil {
-		t.Fatalf("GetTableBucket failed: %v", err)
-	}
-
-	if err := client.CreateNamespace(ctx, bucketARN, namespaceName); err != nil {
-		t.Fatalf("CreateNamespace failed: %v", err)
-	}
-	namespaceCreated = true
-
-	if err := client.CreateTable(ctx, bucketARN, namespaceName, tableName); err != nil {
-		t.Fatalf("CreateTable failed: %v", err)
-	}
-	tableCreated = true
-
-	s3Client, err := newS3Client(ctx, session.endpoint, session.region, session.creds)
-	if err != nil {
-		t.Fatalf("Create S3 client failed: %v", err)
-	}
-
-	objectKey := fmt.Sprintf("%s/%s/data/part-%d.parquet", namespaceName, tableName, time.Now().UnixNano())
-	createResp, err := s3Client.CreateMultipartUpload(ctx, &s3.CreateMultipartUploadInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-	})
-	if err != nil {
-		t.Fatalf("CreateMultipartUpload failed: %v", err)
-	}
-	uploadID := aws.ToString(createResp.UploadId)
-	multipartCompleted := false
-	defer func() {
-		if uploadID == "" || multipartCompleted {
-			return
-		}
-		_, _ = s3Client.AbortMultipartUpload(ctx, &s3.AbortMultipartUploadInput{
-			Bucket:   aws.String(bucketName),
-			Key:      aws.String(objectKey),
-			UploadId: aws.String(uploadID),
-		})
-	}()
-
-	partSize := 5 * 1024 * 1024
-	part1 := bytes.Repeat([]byte("a"), partSize)
-	part2 := bytes.Repeat([]byte("b"), 1024*1024)
-
-	part1Resp, err := s3Client.UploadPart(ctx, &s3.UploadPartInput{
-		Bucket:     aws.String(bucketName),
-		Key:        aws.String(objectKey),
-		UploadId:   aws.String(uploadID),
-		PartNumber: aws.Int32(1),
-		Body:       bytes.NewReader(part1),
-	})
-	if err != nil {
-		t.Fatalf("UploadPart 1 failed: %v", err)
-	}
-
-	part2Resp, err := s3Client.UploadPart(ctx, &s3.UploadPartInput{
-		Bucket:     aws.String(bucketName),
-		Key:        aws.String(objectKey),
-		UploadId:   aws.String(uploadID),
-		PartNumber: aws.Int32(2),
-		Body:       bytes.NewReader(part2),
-	})
-	if err != nil {
-		t.Fatalf("UploadPart 2 failed: %v", err)
-	}
-
-	_, err = s3Client.CompleteMultipartUpload(ctx, &s3.CompleteMultipartUploadInput{
-		Bucket:   aws.String(bucketName),
-		Key:      aws.String(objectKey),
-		UploadId: aws.String(uploadID),
-		MultipartUpload: &s3types.CompletedMultipartUpload{
-			Parts: []s3types.CompletedPart{
-				{
-					ETag:       part1Resp.ETag,
-					PartNumber: aws.Int32(1),
-				},
-				{
-					ETag:       part2Resp.ETag,
-					PartNumber: aws.Int32(2),
-				},
-			},
-		},
-	})
-	if err != nil {
-		t.Fatalf("CompleteMultipartUpload failed: %v", err)
-	}
-	multipartCompleted = true
-
-	headResp, err := s3Client.HeadObject(ctx, &s3.HeadObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-	})
-	if err != nil {
-		t.Fatalf("HeadObject after multipart upload failed: %v", err)
-	}
-	expectedSize := int64(len(part1) + len(part2))
-	if headResp.ContentLength == nil || *headResp.ContentLength != expectedSize {
-		t.Fatalf("Unexpected content length: got %d want %d", aws.ToInt64(headResp.ContentLength), expectedSize)
-	}
-
-	if err := client.DeleteTable(ctx, bucketARN, namespaceName, tableName); err != nil {
-		t.Fatalf("DeleteTable failed: %v", err)
-	}
-	tableCreated = false
-
-	if err := client.DeleteNamespace(ctx, bucketARN, namespaceName); err != nil {
-		t.Fatalf("DeleteNamespace failed: %v", err)
-	}
-	namespaceCreated = false
-
-	if err := client.DeleteTableBucket(ctx, bucketARN); err != nil {
-		t.Fatalf("DeleteTableBucket failed: %v", err)
-	}
-	bucketDeleted = true
-
-	if _, err := client.GetTableBucket(ctx, bucketARN); err == nil {
-		t.Fatalf("expected GetTableBucket to fail after deletion")
-	}
-}
-
-type s3TablesClient struct {
-	endpoint   string
-	region     string
-	creds      aws.Credentials
-	httpClient *http.Client
-}
-
-func newS3TablesClient(endpoint, region string, creds aws.Credentials) *s3TablesClient {
-	return &s3TablesClient{
-		endpoint: endpoint,
-		region:   region,
-		creds:    creds,
-		httpClient: &http.Client{
-			Timeout: 30 * time.Second,
-		},
-	}
-}
-
-func (c *s3TablesClient) CreateTableBucket(ctx context.Context, name string) (string, error) {
-	req := &s3tables.CreateTableBucketRequest{Name: name}
-	var resp s3tables.CreateTableBucketResponse
-	if err := c.doRequest(ctx, "CreateTableBucket", http.MethodPut, "/buckets", req, &resp); err != nil {
-		return "", err
-	}
-	return resp.ARN, nil
-}
-
-func (c *s3TablesClient) GetTableBucket(ctx context.Context, arn string) (*s3tables.GetTableBucketResponse, error) {
-	path := "/buckets/" + url.PathEscape(arn)
-	var resp s3tables.GetTableBucketResponse
-	if err := c.doRequest(ctx, "GetTableBucket", http.MethodGet, path, nil, &resp); err != nil {
-		return nil, err
-	}
-	return &resp, nil
-}
-
-func (c *s3TablesClient) ListTableBuckets(ctx context.Context) ([]s3tables.TableBucketSummary, error) {
-	var resp s3tables.ListTableBucketsResponse
-	if err := c.doRequest(ctx, "ListTableBuckets", http.MethodGet, "/buckets", nil, &resp); err != nil {
-		return nil, err
-	}
-	return resp.TableBuckets, nil
-}
-
-func (c *s3TablesClient) DeleteTableBucket(ctx context.Context, arn string) error {
-	path := "/buckets/" + url.PathEscape(arn)
-	return c.doRequest(ctx, "DeleteTableBucket", http.MethodDelete, path, nil, nil)
-}
-
-func (c *s3TablesClient) CreateNamespace(ctx context.Context, bucketARN, namespace string) error {
-	req := &s3tables.CreateNamespaceRequest{
-		Namespace: []string{namespace},
-	}
-	path := "/namespaces/" + url.PathEscape(bucketARN)
-	return c.doRequest(ctx, "CreateNamespace", http.MethodPut, path, req, nil)
-}
-
-func (c *s3TablesClient) DeleteNamespace(ctx context.Context, bucketARN, namespace string) error {
-	path := "/namespaces/" + url.PathEscape(bucketARN) + "/" + url.PathEscape(namespace)
-	return c.doRequest(ctx, "DeleteNamespace", http.MethodDelete, path, nil, nil)
-}
-
-func (c *s3TablesClient) CreateTable(ctx context.Context, bucketARN, namespace, name string) error {
-	req := &s3tables.CreateTableRequest{
-		Name:   name,
-		Format: "ICEBERG",
-	}
-	path := "/tables/" + url.PathEscape(bucketARN) + "/" + url.PathEscape(namespace)
-	return c.doRequest(ctx, "CreateTable", http.MethodPut, path, req, nil)
-}
-
-func (c *s3TablesClient) DeleteTable(ctx context.Context, bucketARN, namespace, name string) error {
-	path := "/tables/" + url.PathEscape(bucketARN) + "/" + url.PathEscape(namespace) + "/" + url.PathEscape(name)
-	return c.doRequest(ctx, "DeleteTable", http.MethodDelete, path, nil, nil)
-}
-
-func (c *s3TablesClient) doRequest(ctx context.Context, operation, method, path string, body interface{}, out interface{}) error {
-	var bodyBytes []byte
-	if body != nil {
-		encoded, err := json.Marshal(body)
-		if err != nil {
-			return fmt.Errorf("%s: marshal request: %w", operation, err)
-		}
-		bodyBytes = encoded
-	}
-	req, err := http.NewRequestWithContext(ctx, method, c.endpoint+path, bytes.NewReader(bodyBytes))
-	if err != nil {
-		return fmt.Errorf("%s: create request: %w", operation, err)
-	}
-	if body != nil {
-		req.Header.Set("Content-Type", "application/x-amz-json-1.1")
-	}
-	req.Host = req.URL.Host
-	req.Header.Set("Host", req.URL.Host)
-
-	payloadHash := sha256.Sum256(bodyBytes)
-	if err := v4.NewSigner().SignHTTP(ctx, c.creds, req, hex.EncodeToString(payloadHash[:]), "s3tables", c.region, time.Now()); err != nil {
-		return fmt.Errorf("%s: sign request: %w", operation, err)
-	}
-
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		return fmt.Errorf("%s: request failed: %w", operation, err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		bodyBytes, readErr := io.ReadAll(resp.Body)
-		if readErr != nil {
-			return fmt.Errorf("%s failed with status %d and could not read response body: %v", operation, resp.StatusCode, readErr)
-		}
-		var errResp s3tables.S3TablesError
-		if jsonErr := json.Unmarshal(bodyBytes, &errResp); jsonErr == nil && (errResp.Type != "" || errResp.Message != "") {
-			return fmt.Errorf("%s failed: %s - %s", operation, errResp.Type, errResp.Message)
-		}
-		return fmt.Errorf("%s failed with status %d: %s", operation, resp.StatusCode, strings.TrimSpace(string(bodyBytes)))
-	}
-
-	if out == nil {
-		return nil
-	}
-	if err := json.NewDecoder(resp.Body).Decode(out); err != nil {
-		return fmt.Errorf("%s: decode response: %w", operation, err)
-	}
-	return nil
-}
-
-func assumeRole(ctx context.Context, endpoint, region, accessKey, secretKey, roleArn, sessionName string) (aws.Credentials, error) {
-	resolver := aws.EndpointResolverWithOptionsFunc(func(service, region string, options ...interface{}) (aws.Endpoint, error) {
-		if service == sts.ServiceID {
-			return aws.Endpoint{
-				URL:               endpoint,
-				SigningRegion:     region,
-				HostnameImmutable: true,
-			}, nil
-		}
-		return aws.Endpoint{}, &aws.EndpointNotFoundError{}
-	})
-
-	cfg, err := config.LoadDefaultConfig(ctx,
-		config.WithRegion(region),
-		config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(accessKey, secretKey, "")),
-		config.WithEndpointResolverWithOptions(resolver),
+	cmd := exec.CommandContext(dockerCtx, "docker", "run", "--rm",
+		"--name", containerName,
+		"--add-host", "host.docker.internal:host-gateway",
+		"-v", fmt.Sprintf("%s:/work", env.dataDir),
+		"python:3",
+		"/bin/bash", "-c", "pip install boto3 && python /work/lakekeeper_repro.py",
 	)
-	if err != nil {
-		return aws.Credentials{}, err
-	}

-	client := sts.NewFromConfig(cfg)
-	resp, err := client.AssumeRole(ctx, &sts.AssumeRoleInput{
-		RoleArn:         aws.String(roleArn),
-		RoleSessionName: aws.String(sessionName),
-	})
+	output, err := cmd.CombinedOutput()
 	if err != nil {
-		return aws.Credentials{}, err
-	}
-	if resp.Credentials == nil {
-		return aws.Credentials{}, fmt.Errorf("missing credentials in AssumeRole response")
-	}
-	return aws.Credentials{
-		AccessKeyID:     aws.ToString(resp.Credentials.AccessKeyId),
-		SecretAccessKey: aws.ToString(resp.Credentials.SecretAccessKey),
-		SessionToken:    aws.ToString(resp.Credentials.SessionToken),
-		Source:          "lakekeeper-sts",
-	}, nil
-}
-
-func newS3Client(ctx context.Context, endpoint, region string, creds aws.Credentials) (*s3.Client, error) {
-	resolver := aws.EndpointResolverWithOptionsFunc(func(service, region string, options ...interface{}) (aws.Endpoint, error) {
-		if service == s3.ServiceID {
-			return aws.Endpoint{
-				URL:               endpoint,
-				SigningRegion:     region,
-				HostnameImmutable: true,
-			}, nil
+		if dockerCtx.Err() == context.DeadlineExceeded {
+			t.Fatalf("Lakekeeper repro client timed out after 5 minutes\nOutput:\n%s", string(output))
 		}
-		return aws.Endpoint{}, &aws.EndpointNotFoundError{}
-	})
-
-	cfg, err := config.LoadDefaultConfig(ctx,
-		config.WithRegion(region),
-		config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(creds.AccessKeyID, creds.SecretAccessKey, creds.SessionToken)),
-		config.WithEndpointResolverWithOptions(resolver),
-	)
-	if err != nil {
-		return nil, err
+		t.Fatalf("Lakekeeper repro client failed: %v\nOutput:\n%s", err, string(output))
 	}
-
-	return s3.NewFromConfig(cfg, func(o *s3.Options) {
-		o.UsePathStyle = true
-	}), nil
-}
-
-func newLakekeeperSession(ctx context.Context, env *TestEnvironment) (lakekeeperSession, error) {
-	endpoint := fmt.Sprintf("http://127.0.0.1:%d", env.s3Port)
-	creds, err := assumeRole(ctx, endpoint, lakekeeperRegion, env.accessKey, env.secretKey, lakekeeperRoleArn, lakekeeperSessionName)
-	if err != nil {
-		return lakekeeperSession{}, err
-	}
-	return lakekeeperSession{
-		endpoint: endpoint,
-		region:   lakekeeperRegion,
-		creds:    creds,
-	}, nil
+	t.Logf("Lakekeeper repro client output:\n%s", string(output))
 }
@@ -1,377 +0,0 @@
-package polaris
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/config"
-	"github.com/aws/aws-sdk-go-v2/credentials"
-	"github.com/aws/aws-sdk-go-v2/service/s3"
-
-	"github.com/seaweedfs/seaweedfs/test/s3tables/testutil"
-)
-
-const (
-	polarisImage            = "apache/polaris:latest"
-	polarisRealm            = "POLARIS"
-	polarisRootClientID     = "root"
-	polarisRootClientSecret = "s3cr3t"
-	polarisRegion           = "us-east-1"
-	polarisRoleArn          = "arn:aws:iam::000000000000:role/PolarisVendedRole"
-	polarisSigningKey       = "dGVzdC1zaWduaW5nLWtleS1mb3Itc3RzLWludGVncmF0aW9uLXRlc3Rz" // gitleaks:allow - test signing key
-)
-
-type TestEnvironment struct {
-	seaweedDir       string
-	weedBinary       string
-	dataDir          string
-	bindIP           string
-	s3Port           int
-	s3GrpcPort       int
-	masterPort       int
-	masterGrpcPort   int
-	filerPort        int
-	filerGrpcPort    int
-	volumePort       int
-	volumeGrpcPort   int
-	polarisPort      int
-	polarisAdminPort int
-	weedProcess      *exec.Cmd
-	weedCancel       context.CancelFunc
-	polarisContainer string
-	accessKey        string
-	secretKey        string
-}
-
-func NewTestEnvironment(t *testing.T) *TestEnvironment {
-	t.Helper()
-
-	if !testutil.HasDocker() {
-		t.Skip("Docker is required for Polaris integration tests")
-	}
-
-	wd, err := os.Getwd()
-	if err != nil {
-		t.Fatalf("Failed to get working directory: %v", err)
-	}
-
-	seaweedDir := wd
-	for i := 0; i < 6; i++ {
-		if _, err := os.Stat(filepath.Join(seaweedDir, "go.mod")); err == nil {
-			break
-		}
-		seaweedDir = filepath.Dir(seaweedDir)
-	}
-
-	weedBinary := filepath.Join(seaweedDir, "weed", "weed")
-	if _, err := os.Stat(weedBinary); err != nil {
-		weedBinary = "weed"
-		if _, err := exec.LookPath(weedBinary); err != nil {
-			t.Skip("weed binary not found, skipping integration test")
-		}
-	}
-
-	dataDir, err := os.MkdirTemp("", "seaweed-polaris-test-*")
-	if err != nil {
-		t.Fatalf("Failed to create temp dir: %v", err)
-	}
-
-	bindIP := testutil.FindBindIP()
-
-	masterPort, masterGrpcPort := testutil.MustFreePortPair(t, "Master")
-	volumePort, volumeGrpcPort := testutil.MustFreePortPair(t, "Volume")
-	filerPort, filerGrpcPort := testutil.MustFreePortPair(t, "Filer")
-	s3Port, s3GrpcPort := testutil.MustFreePortPair(t, "S3")
-	polarisPort, polarisAdminPort := testutil.MustFreePortPair(t, "Polaris")
-
-	return &TestEnvironment{
-		seaweedDir:       seaweedDir,
-		weedBinary:       weedBinary,
-		dataDir:          dataDir,
-		bindIP:           bindIP,
-		s3Port:           s3Port,
-		s3GrpcPort:       s3GrpcPort,
-		masterPort:       masterPort,
-		masterGrpcPort:   masterGrpcPort,
-		filerPort:        filerPort,
-		filerGrpcPort:    filerGrpcPort,
-		volumePort:       volumePort,
-		volumeGrpcPort:   volumeGrpcPort,
-		polarisPort:      polarisPort,
-		polarisAdminPort: polarisAdminPort,
-		accessKey:        "admin",
-		secretKey:        "admin",
-	}
-}
-
-func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
-	t.Helper()
-
-	iamConfigPath := filepath.Join(env.dataDir, "iam.json")
-	iamConfig := fmt.Sprintf(`{
-  "identities": [
-    {
-      "name": "admin",
-      "credentials": [
-        {
-          "accessKey": "%s",
-          "secretKey": "%s"
-        }
-      ],
-      "actions": ["Admin", "Read", "List", "Tagging", "Write"]
-    }
-  ],
-  "sts": {
-    "tokenDuration": "12h",
-    "maxSessionLength": "24h",
-    "issuer": "seaweedfs-sts",
-    "signingKey": "%s"
-  },
-  "roles": [
-    {
-      "roleName": "PolarisVendedRole",
-      "roleArn": "%s",
-      "trustPolicy": {
-        "Version": "2012-10-17",
-        "Statement": [
-          {
-            "Effect": "Allow",
-            "Principal": "*",
-            "Action": "sts:AssumeRole"
-          }
-        ]
-      },
-      "attachedPolicies": ["FullAccess"]
-    }
-  ],
-  "policies": [
-    {
-      "name": "FullAccess",
-      "document": {
-        "Version": "2012-10-17",
-        "Statement": [
-          {
-            "Effect": "Allow",
-            "Action": "*",
-            "Resource": "*"
-          }
-        ]
-      }
-    }
-  ]
-}`, env.accessKey, env.secretKey, polarisSigningKey, polarisRoleArn)
-
-	if err := os.WriteFile(iamConfigPath, []byte(iamConfig), 0644); err != nil {
-		t.Fatalf("Failed to create IAM config: %v", err)
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	env.weedCancel = cancel
-
-	cmd := exec.CommandContext(ctx, env.weedBinary, "-v", "4", "mini",
-		"-master.port", fmt.Sprintf("%d", env.masterPort),
-		"-master.port.grpc", fmt.Sprintf("%d", env.masterGrpcPort),
-		"-volume.port", fmt.Sprintf("%d", env.volumePort),
-		"-volume.port.grpc", fmt.Sprintf("%d", env.volumeGrpcPort),
-		"-filer.port", fmt.Sprintf("%d", env.filerPort),
-		"-filer.port.grpc", fmt.Sprintf("%d", env.filerGrpcPort),
-		"-s3.port", fmt.Sprintf("%d", env.s3Port),
-		"-s3.port.grpc", fmt.Sprintf("%d", env.s3GrpcPort),
-		"-s3.config", iamConfigPath,
-		"-s3.iam.config", iamConfigPath,
-		"-s3.iam.readOnly=false",
-		"-ip", env.bindIP,
-		"-ip.bind", "0.0.0.0",
-		"-dir", env.dataDir,
-	)
-	cmd.Dir = env.dataDir
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("Failed to start SeaweedFS: %v", err)
-	}
-	env.weedProcess = cmd
-
-	if !testutil.WaitForService(fmt.Sprintf("http://localhost:%d/status", env.s3Port), 30*time.Second) {
-		t.Fatalf("S3 API failed to become ready")
-	}
-}
-
-func (env *TestEnvironment) StartPolaris(t *testing.T) {
-	t.Helper()
-
-	containerName := fmt.Sprintf("seaweed-polaris-%d", time.Now().UnixNano())
-	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
-	defer cancel()
-
-	cmd := exec.CommandContext(ctx, "docker", "run", "-d", "--rm",
-		"--name", containerName,
-		"--add-host", "host.docker.internal:host-gateway",
-		"-p", fmt.Sprintf("%d:8181", env.polarisPort),
-		"-p", fmt.Sprintf("%d:8182", env.polarisAdminPort),
-		"-e", fmt.Sprintf("AWS_REGION=%s", polarisRegion),
-		"-e", fmt.Sprintf("AWS_ACCESS_KEY_ID=%s", env.accessKey),
-		"-e", fmt.Sprintf("AWS_SECRET_ACCESS_KEY=%s", env.secretKey),
-		"-e", fmt.Sprintf("POLARIS_BOOTSTRAP_CREDENTIALS=%s,%s,%s", polarisRealm, polarisRootClientID, polarisRootClientSecret),
-		"-e", fmt.Sprintf("polaris.realm-context.realms=%s", polarisRealm),
-		"-e", "quarkus.otel.sdk.disabled=true",
-		polarisImage,
-	)
-
-	output, err := cmd.CombinedOutput()
-	if err != nil {
-		if ctx.Err() == context.DeadlineExceeded {
-			t.Fatalf("Timed out waiting for Polaris container: %v\nOutput:\n%s", ctx.Err(), string(output))
-		}
-		t.Fatalf("Failed to start Polaris: %v\nOutput:\n%s", err, string(output))
-	}
-	env.polarisContainer = containerName
-
-	if !testutil.WaitForService(fmt.Sprintf("http://localhost:%d/q/health", env.polarisAdminPort), 60*time.Second) {
-		logCtx, logCancel := context.WithTimeout(context.Background(), 10*time.Second)
-		defer logCancel()
-		logs, _ := exec.CommandContext(logCtx, "docker", "logs", env.polarisContainer).CombinedOutput()
-		t.Fatalf("Polaris failed to become ready\nLogs:\n%s", string(logs))
-	}
-}
-
-func (env *TestEnvironment) Cleanup(t *testing.T) {
-	t.Helper()
-	if env.weedCancel != nil {
-		env.weedCancel()
-	}
-	if env.weedProcess != nil {
-		time.Sleep(1 * time.Second)
-		_ = env.weedProcess.Wait()
-	}
-	if env.polarisContainer != "" {
-		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-		defer cancel()
-		_ = exec.CommandContext(ctx, "docker", "rm", "-f", env.polarisContainer).Run()
-	}
-	if env.dataDir != "" {
-		_ = os.RemoveAll(env.dataDir)
-	}
-}
-
-func (env *TestEnvironment) polarisEndpoint() string {
-	return fmt.Sprintf("http://127.0.0.1:%d", env.polarisPort)
-}
-
-func (env *TestEnvironment) s3Endpoint() string {
-	return fmt.Sprintf("http://127.0.0.1:%d", env.s3Port)
-}
-
-func (env *TestEnvironment) s3InternalEndpoint() string {
-	return fmt.Sprintf("http://host.docker.internal:%d", env.s3Port)
-}
-
-type polarisHTTPClient struct {
-	baseURL    string
-	realm      string
-	token      string
-	httpClient *http.Client
-}
-
-func newPolarisHTTPClient(baseURL, realm, token string) *polarisHTTPClient {
-	return &polarisHTTPClient{
-		baseURL: baseURL,
-		realm:   realm,
-		token:   token,
-		httpClient: &http.Client{
-			Timeout: 30 * time.Second,
-		},
-	}
-}
-
-func (c *polarisHTTPClient) doJSON(ctx context.Context, method, path string, body interface{}, out interface{}) error {
-	return c.doJSONWithHeaders(ctx, method, path, body, out, nil)
-}
-
-func (c *polarisHTTPClient) doJSONWithHeaders(ctx context.Context, method, path string, body interface{}, out interface{}, headers map[string]string) error {
-	var reader io.Reader
-	if body != nil {
-		encoded, err := json.Marshal(body)
-		if err != nil {
-			return fmt.Errorf("encode request body: %w", err)
-		}
-		reader = bytes.NewReader(encoded)
-	}
-
-	req, err := http.NewRequestWithContext(ctx, method, c.baseURL+path, reader)
-	if err != nil {
-		return fmt.Errorf("create request: %w", err)
-	}
-	if body != nil {
-		req.Header.Set("Content-Type", "application/json")
-	}
-	req.Header.Set("Accept", "application/json")
-	if c.realm != "" {
-		req.Header.Set("Polaris-Realm", c.realm)
-	}
-	if c.token != "" {
-		req.Header.Set("Authorization", "Bearer "+c.token)
-	}
-	for key, value := range headers {
-		req.Header.Set(key, value)
-	}
-
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		return fmt.Errorf("request failed: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-		bodyBytes, readErr := io.ReadAll(resp.Body)
-		if readErr != nil {
-			return fmt.Errorf("request failed with status %d and could not read response body: %w", resp.StatusCode, readErr)
-		}
-		return fmt.Errorf("request failed with status %d: %s", resp.StatusCode, strings.TrimSpace(string(bodyBytes)))
-	}
-	if out == nil {
-		return nil
-	}
-	if err := json.NewDecoder(resp.Body).Decode(out); err != nil {
-		return fmt.Errorf("decode response: %w", err)
-	}
-	return nil
-}
-
-func newS3Client(ctx context.Context, endpoint, region string, creds aws.Credentials, pathStyle bool) (*s3.Client, error) {
-	resolver := aws.EndpointResolverWithOptionsFunc(func(service, region string, options ...interface{}) (aws.Endpoint, error) {
-		if service == s3.ServiceID {
-			return aws.Endpoint{
-				URL:               endpoint,
-				SigningRegion:     region,
-				HostnameImmutable: true,
-			}, nil
-		}
-		return aws.Endpoint{}, &aws.EndpointNotFoundError{}
-	})
-
-	cfg, err := config.LoadDefaultConfig(ctx,
-		config.WithRegion(region),
-		config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(creds.AccessKeyID, creds.SecretAccessKey, creds.SessionToken)),
-		config.WithEndpointResolverWithOptions(resolver),
-	)
-	if err != nil {
-		return nil, err
-	}
-
-	return s3.NewFromConfig(cfg, func(o *s3.Options) {
-		o.UsePathStyle = pathStyle
-	}), nil
-}
@@ -1,764 +0,0 @@
-package polaris
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/s3"
-	s3types "github.com/aws/aws-sdk-go-v2/service/s3/types"
-)
-
-type polarisSession struct {
-	catalogName  string
-	bucketName   string
-	token        string
-	baseLocation string
-}
-
-type polarisTableSetup struct {
-	namespace     string
-	table         string
-	dataKeyPrefix string
-	s3Client      *s3.Client
-}
-
-type polarisCatalogClient struct {
-	http    *polarisHTTPClient
-	catalog string
-}
-
-type polarisCredentials struct {
-	ClientID     string `json:"clientId"`
-	ClientSecret string `json:"clientSecret"`
-}
-
-type createPrincipalResponse struct {
-	Credentials polarisCredentials `json:"credentials"`
-}
-
-type createCatalogRequest struct {
-	Catalog polarisCatalog `json:"catalog"`
-}
-
-type polarisCatalog struct {
-	Name              string               `json:"name"`
-	Type              string               `json:"type"`
-	ReadOnly          bool                 `json:"readOnly"`
-	Properties        map[string]string    `json:"properties"`
-	StorageConfigInfo polarisStorageConfig `json:"storageConfigInfo"`
-}
-
-type polarisStorageConfig struct {
-	StorageType      string   `json:"storageType"`
-	AllowedLocations []string `json:"allowedLocations"`
-	Endpoint         string   `json:"endpoint"`
-	EndpointInternal string   `json:"endpointInternal"`
-	StsEndpoint      string   `json:"stsEndpoint"`
-	PathStyleAccess  bool     `json:"pathStyleAccess"`
-	RoleArn          string   `json:"roleArn"`
-	Region           string   `json:"region"`
-}
-
-type createNamespaceRequest struct {
-	Namespace []string `json:"namespace"`
-}
-
-type createTableRequest struct {
-	Name          string            `json:"name"`
-	Location      string            `json:"location"`
-	Schema        icebergSchema     `json:"schema"`
-	PartitionSpec icebergPartition  `json:"partition-spec"`
-	SortOrder     icebergSortOrder  `json:"sort-order"`
-	Properties    map[string]string `json:"properties"`
-}
-
-type icebergSchema struct {
-	Type     string               `json:"type"`
-	SchemaID int                  `json:"schema-id"`
-	Fields   []icebergSchemaField `json:"fields"`
-}
-
-type icebergSchemaField struct {
-	ID       int    `json:"id"`
-	Name     string `json:"name"`
-	Type     string `json:"type"`
-	Required bool   `json:"required"`
-}
-
-type icebergPartition struct {
-	SpecID int                     `json:"spec-id"`
-	Fields []icebergPartitionField `json:"fields"`
-}
-
-type icebergPartitionField struct {
-	SourceID  int    `json:"source-id"`
-	FieldID   int    `json:"field-id"`
-	Name      string `json:"name"`
-	Transform string `json:"transform"`
-}
-
-type icebergSortOrder struct {
-	OrderID int                `json:"order-id"`
-	Fields  []icebergSortField `json:"fields"`
-}
-
-type icebergSortField struct {
-	SourceID  int    `json:"source-id"`
-	Direction string `json:"direction"`
-	NullOrder string `json:"null-order"`
-}
-
-type loadTableResponse struct {
-	Config             map[string]string   `json:"config"`
-	StorageCredentials []storageCredential `json:"storage-credentials"`
-}
-
-type loadCredentialsResponse struct {
-	StorageCredentials []storageCredential `json:"storage-credentials"`
-}
-
-type storageCredential struct {
-	Prefix string            `json:"prefix"`
-	Config map[string]string `json:"config"`
-}
-
-func bootstrapPolarisTest(t *testing.T, env *TestEnvironment) (context.Context, context.CancelFunc, polarisSession, *polarisTableSetup, func()) {
-	t.Helper()
-
-	t.Logf(">>> Starting SeaweedFS with Polaris configuration...")
-	env.StartSeaweedFS(t)
-	t.Logf(">>> SeaweedFS started.")
-
-	t.Logf(">>> Starting Polaris...")
-	env.StartPolaris(t)
-	t.Logf(">>> Polaris started.")
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	session := newPolarisSession(t, ctx, env)
-	setup, cleanup := setupPolarisTable(t, ctx, env, session)
-
-	return ctx, cancel, session, setup, cleanup
-}
-
-func TestPolarisIntegration(t *testing.T) {
-	env := NewTestEnvironment(t)
-	defer env.Cleanup(t)
-
-	ctx, cancel, session, setup, cleanup := bootstrapPolarisTest(t, env)
-	defer cancel()
-	defer cleanup()
-
-	objectKey := fmt.Sprintf("%s/hello-%d.txt", setup.dataKeyPrefix, time.Now().UnixNano())
-	payload := []byte("polaris")
-
-	if _, err := setup.s3Client.PutObject(ctx, &s3.PutObjectInput{
-		Bucket: aws.String(session.bucketName),
-		Key:    aws.String(objectKey),
-		Body:   bytes.NewReader(payload),
-	}); err != nil {
-		t.Fatalf("PutObject failed: %v", err)
-	}
-
-	listObjects, err := setup.s3Client.ListObjectsV2(ctx, &s3.ListObjectsV2Input{
-		Bucket: aws.String(session.bucketName),
-		Prefix: aws.String(objectKey),
-	})
-	if err != nil {
-		t.Fatalf("ListObjectsV2 failed: %v", err)
-	}
-
-	found := false
-	for _, obj := range listObjects.Contents {
-		if aws.ToString(obj.Key) == objectKey {
-			found = true
-			break
-		}
-	}
-	if !found {
-		t.Fatalf("Object %s not found in list", objectKey)
-	}
-
-	getResp, err := setup.s3Client.GetObject(ctx, &s3.GetObjectInput{
-		Bucket: aws.String(session.bucketName),
-		Key:    aws.String(objectKey),
-	})
-	if err != nil {
-		t.Fatalf("GetObject failed: %v", err)
-	}
-	body, err := io.ReadAll(getResp.Body)
-	_ = getResp.Body.Close()
-	if err != nil {
-		t.Fatalf("Read object body failed: %v", err)
-	}
-	if !bytes.Equal(body, payload) {
-		t.Fatalf("Unexpected object payload: got %q want %q", string(body), string(payload))
-	}
-
-	if _, err := setup.s3Client.DeleteObject(ctx, &s3.DeleteObjectInput{
-		Bucket: aws.String(session.bucketName),
-		Key:    aws.String(objectKey),
-	}); err != nil {
-		t.Fatalf("DeleteObject failed: %v", err)
-	}
-}
-
-func TestPolarisTableIntegration(t *testing.T) {
-	env := NewTestEnvironment(t)
-	defer env.Cleanup(t)
-
-	ctx, cancel, session, setup, cleanup := bootstrapPolarisTest(t, env)
-	defer cancel()
-	defer cleanup()
-
-	objectKey := fmt.Sprintf("%s/part-%d.parquet", setup.dataKeyPrefix, time.Now().UnixNano())
-	createResp, err := setup.s3Client.CreateMultipartUpload(ctx, &s3.CreateMultipartUploadInput{
-		Bucket: aws.String(session.bucketName),
-		Key:    aws.String(objectKey),
-	})
-	if err != nil {
-		t.Fatalf("CreateMultipartUpload failed: %v", err)
-	}
-
-	uploadID := aws.ToString(createResp.UploadId)
-	multipartCompleted := false
-	defer func() {
-		if uploadID == "" || multipartCompleted {
-			return
-		}
-		_, _ = setup.s3Client.AbortMultipartUpload(ctx, &s3.AbortMultipartUploadInput{
-			Bucket:   aws.String(session.bucketName),
-			Key:      aws.String(objectKey),
-			UploadId: aws.String(uploadID),
-		})
-	}()
-
-	partSize := 5 * 1024 * 1024
-	part1 := bytes.Repeat([]byte("a"), partSize)
-	part2 := bytes.Repeat([]byte("b"), 1024*1024)
-
-	part1Resp, err := setup.s3Client.UploadPart(ctx, &s3.UploadPartInput{
-		Bucket:     aws.String(session.bucketName),
-		Key:        aws.String(objectKey),
-		UploadId:   aws.String(uploadID),
-		PartNumber: aws.Int32(1),
-		Body:       bytes.NewReader(part1),
-	})
-	if err != nil {
-		t.Fatalf("UploadPart 1 failed: %v", err)
-	}
-
-	part2Resp, err := setup.s3Client.UploadPart(ctx, &s3.UploadPartInput{
-		Bucket:     aws.String(session.bucketName),
-		Key:        aws.String(objectKey),
-		UploadId:   aws.String(uploadID),
-		PartNumber: aws.Int32(2),
-		Body:       bytes.NewReader(part2),
-	})
-	if err != nil {
-		t.Fatalf("UploadPart 2 failed: %v", err)
-	}
-
-	_, err = setup.s3Client.CompleteMultipartUpload(ctx, &s3.CompleteMultipartUploadInput{
-		Bucket:   aws.String(session.bucketName),
-		Key:      aws.String(objectKey),
-		UploadId: aws.String(uploadID),
-		MultipartUpload: &s3types.CompletedMultipartUpload{
-			Parts: []s3types.CompletedPart{
-				{
-					ETag:       part1Resp.ETag,
-					PartNumber: aws.Int32(1),
-				},
-				{
-					ETag:       part2Resp.ETag,
-					PartNumber: aws.Int32(2),
-				},
-			},
-		},
-	})
-	if err != nil {
-		t.Fatalf("CompleteMultipartUpload failed: %v", err)
-	}
-	multipartCompleted = true
-
-	headResp, err := setup.s3Client.HeadObject(ctx, &s3.HeadObjectInput{
-		Bucket: aws.String(session.bucketName),
-		Key:    aws.String(objectKey),
-	})
-	if err != nil {
-		t.Fatalf("HeadObject after multipart upload failed: %v", err)
-	}
-	expectedSize := int64(len(part1) + len(part2))
-	if headResp.ContentLength == nil || *headResp.ContentLength != expectedSize {
-		t.Fatalf("Unexpected content length: got %d want %d", aws.ToInt64(headResp.ContentLength), expectedSize)
-	}
-}
-
-func newPolarisSession(t *testing.T, ctx context.Context, env *TestEnvironment) polarisSession {
-	t.Helper()
-
-	adminCreds := aws.Credentials{
-		AccessKeyID:     env.accessKey,
-		SecretAccessKey: env.secretKey,
-		Source:          "polaris-admin",
-	}
-	adminS3, err := newS3Client(ctx, env.s3Endpoint(), polarisRegion, adminCreds, true)
-	if err != nil {
-		t.Fatalf("Create admin S3 client failed: %v", err)
-	}
-
-	bucketName := fmt.Sprintf("polaris-bucket-%d", time.Now().UnixNano())
-	if _, err := adminS3.CreateBucket(ctx, &s3.CreateBucketInput{
-		Bucket: aws.String(bucketName),
-	}); err != nil {
-		t.Fatalf("CreateBucket failed: %v", err)
-	}
-	policyDoc := map[string]interface{}{
-		"Version": "2012-10-17",
-		"Statement": []map[string]interface{}{
-			{
-				"Sid":       "AllowPolarisVendedAccess",
-				"Effect":    "Allow",
-				"Principal": "*",
-				"Action":    "s3:*",
-				"Resource": []string{
-					fmt.Sprintf("arn:aws:s3:::%s", bucketName),
-					fmt.Sprintf("arn:aws:s3:::%s/polaris/*", bucketName),
-				},
-			},
-		},
-	}
-	policyBytes, err := json.Marshal(policyDoc)
-	if err != nil {
-		t.Fatalf("Failed to marshal bucket policy: %v", err)
-	}
-	if _, err := adminS3.PutBucketPolicy(ctx, &s3.PutBucketPolicyInput{
-		Bucket: aws.String(bucketName),
-		Policy: aws.String(string(policyBytes)),
-	}); err != nil {
-		t.Fatalf("PutBucketPolicy failed: %v", err)
-	}
-
-	rootToken, err := fetchPolarisToken(ctx, env.polarisEndpoint(), polarisRootClientID, polarisRootClientSecret)
-	if err != nil {
-		t.Fatalf("Polaris root token request failed: %v", err)
-	}
-
-	managementClient := newPolarisHTTPClient(env.polarisEndpoint(), polarisRealm, rootToken)
-	catalogName := fmt.Sprintf("polaris_catalog_%d", time.Now().UnixNano())
-	baseLocation := fmt.Sprintf("s3://%s/polaris", bucketName)
-
-	catalogRequest := createCatalogRequest{
-		Catalog: polarisCatalog{
-			Name:     catalogName,
-			Type:     "INTERNAL",
-			ReadOnly: false,
-			Properties: map[string]string{
-				"default-base-location": baseLocation,
-			},
-			StorageConfigInfo: polarisStorageConfig{
-				StorageType:      "S3",
-				AllowedLocations: []string{baseLocation},
-				Endpoint:         env.s3Endpoint(),
-				EndpointInternal: env.s3InternalEndpoint(),
-				StsEndpoint:      env.s3InternalEndpoint(),
-				PathStyleAccess:  true,
-				RoleArn:          polarisRoleArn,
-				Region:           polarisRegion,
-			},
-		},
-	}
-
-	if err := managementClient.doJSON(ctx, http.MethodPost, "/api/management/v1/catalogs", catalogRequest, nil); err != nil {
-		t.Fatalf("Create catalog failed: %v", err)
-	}
-
-	principalName := fmt.Sprintf("polaris_user_%d", time.Now().UnixNano())
-	principalRoleName := fmt.Sprintf("polaris_principal_role_%d", time.Now().UnixNano())
-	catalogRoleName := fmt.Sprintf("polaris_catalog_role_%d", time.Now().UnixNano())
-
-	var principalResp createPrincipalResponse
-	if err := managementClient.doJSON(ctx, http.MethodPost, "/api/management/v1/principals", map[string]interface{}{
-		"principal": map[string]interface{}{
-			"name":       principalName,
-			"properties": map[string]string{},
-		},
-	}, &principalResp); err != nil {
-		t.Fatalf("Create principal failed: %v", err)
-	}
-	if principalResp.Credentials.ClientID == "" || principalResp.Credentials.ClientSecret == "" {
-		t.Fatalf("Missing principal credentials in response")
-	}
-
-	if err := managementClient.doJSON(ctx, http.MethodPost, "/api/management/v1/principal-roles", map[string]interface{}{
-		"principalRole": map[string]interface{}{
-			"name":       principalRoleName,
-			"properties": map[string]string{},
-		},
-	}, nil); err != nil {
-		t.Fatalf("Create principal role failed: %v", err)
-	}
-
-	if err := managementClient.doJSON(ctx, http.MethodPost, fmt.Sprintf("/api/management/v1/catalogs/%s/catalog-roles", url.PathEscape(catalogName)), map[string]interface{}{
-		"catalogRole": map[string]interface{}{
-			"name":       catalogRoleName,
-			"properties": map[string]string{},
-		},
-	}, nil); err != nil {
-		t.Fatalf("Create catalog role failed: %v", err)
-	}
-
-	if err := managementClient.doJSON(ctx, http.MethodPut, fmt.Sprintf("/api/management/v1/principals/%s/principal-roles", url.PathEscape(principalName)), map[string]interface{}{
-		"principalRole": map[string]interface{}{
-			"name": principalRoleName,
-		},
-	}, nil); err != nil {
-		t.Fatalf("Assign principal role failed: %v", err)
-	}
-
-	if err := managementClient.doJSON(ctx, http.MethodPut, fmt.Sprintf("/api/management/v1/principal-roles/%s/catalog-roles/%s", url.PathEscape(principalRoleName), url.PathEscape(catalogName)), map[string]interface{}{
-		"catalogRole": map[string]interface{}{
-			"name": catalogRoleName,
-		},
-	}, nil); err != nil {
-		t.Fatalf("Assign catalog role failed: %v", err)
-	}
-
-	if err := managementClient.doJSON(ctx, http.MethodPut, fmt.Sprintf("/api/management/v1/catalogs/%s/catalog-roles/%s/grants", url.PathEscape(catalogName), url.PathEscape(catalogRoleName)), map[string]interface{}{
-		"type":      "catalog",
-		"privilege": "CATALOG_MANAGE_CONTENT",
-	}, nil); err != nil {
-		t.Fatalf("Grant catalog privilege failed: %v", err)
-	}
-
-	userToken, err := fetchPolarisToken(ctx, env.polarisEndpoint(), principalResp.Credentials.ClientID, principalResp.Credentials.ClientSecret)
-	if err != nil {
-		t.Fatalf("Polaris user token request failed: %v", err)
-	}
-
-	return polarisSession{
-		catalogName:  catalogName,
-		bucketName:   bucketName,
-		token:        userToken,
-		baseLocation: baseLocation,
-	}
-}
-
-func setupPolarisTable(t *testing.T, ctx context.Context, env *TestEnvironment, session polarisSession) (*polarisTableSetup, func()) {
-	t.Helper()
-
-	catalogClient := newPolarisCatalogClient(env.polarisEndpoint(), polarisRealm, session.token, session.catalogName)
-	namespace := fmt.Sprintf("polaris_ns_%d", time.Now().UnixNano())
-	table := fmt.Sprintf("polaris_table_%d", time.Now().UnixNano())
-
-	if err := catalogClient.CreateNamespace(ctx, namespace); err != nil {
-		t.Fatalf("CreateNamespace failed: %v", err)
-	}
-
-	location := fmt.Sprintf("%s/%s/%s", session.baseLocation, namespace, table)
-	if err := catalogClient.CreateTable(ctx, namespace, table, location); err != nil {
-		t.Fatalf("CreateTable failed: %v", err)
-	}
-
-	loadResp, err := catalogClient.LoadTable(ctx, namespace, table)
-	if err != nil {
-		t.Fatalf("LoadTable failed: %v", err)
-	}
-
-	credsResp, err := catalogClient.LoadCredentials(ctx, namespace, table)
-	if err != nil {
-		t.Fatalf("LoadCredentials failed: %v", err)
-	}
-	if len(credsResp.StorageCredentials) == 0 {
-		t.Fatalf("LoadCredentials returned no storage credentials")
-	}
-
-	credentialSource := &loadTableResponse{
-		Config:             loadResp.Config,
-		StorageCredentials: credsResp.StorageCredentials,
-	}
-
-	dataPrefix := location + "/data"
-	creds, endpoint, region, pathStyle, err := extractS3Credentials(credentialSource, dataPrefix, env.s3Endpoint(), polarisRegion)
-	if err != nil {
-		t.Fatalf("Extract vended credentials failed: %v", err)
-	}
-	dataKeyPrefix, err := s3URIToKeyPrefix(dataPrefix, session.bucketName)
-	if err != nil {
-		t.Fatalf("Invalid data prefix %s: %v", dataPrefix, err)
-	}
-
-	s3Client, err := newS3Client(ctx, endpoint, region, creds, pathStyle)
-	if err != nil {
-		t.Fatalf("Create vended S3 client failed: %v", err)
-	}
-
-	cleanup := func() {
-		cleanupCtx, cleanupCancel := context.WithTimeout(context.Background(), 30*time.Second)
-		defer cleanupCancel()
-		if err := catalogClient.DeleteTable(cleanupCtx, namespace, table); err != nil {
-			t.Logf("DeleteTable failed: %v", err)
-		}
-		if err := catalogClient.DeleteNamespace(cleanupCtx, namespace); err != nil {
-			t.Logf("DeleteNamespace failed: %v", err)
-		}
-	}
-
-	return &polarisTableSetup{
-		namespace:     namespace,
-		table:         table,
-		dataKeyPrefix: dataKeyPrefix,
-		s3Client:      s3Client,
-	}, cleanup
-}
-
-func fetchPolarisToken(ctx context.Context, baseURL, clientID, clientSecret string) (string, error) {
-	form := url.Values{}
-	form.Set("grant_type", "client_credentials")
-	form.Set("client_id", clientID)
-	form.Set("client_secret", clientSecret)
-	form.Set("scope", "PRINCIPAL_ROLE:ALL")
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, baseURL+"/api/catalog/v1/oauth/tokens", strings.NewReader(form.Encode()))
-	if err != nil {
-		return "", fmt.Errorf("create token request: %w", err)
-	}
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	req.Header.Set("Accept", "application/json")
-
-	client := &http.Client{Timeout: 30 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return "", fmt.Errorf("token request failed: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		body, readErr := io.ReadAll(resp.Body)
-		if readErr != nil {
-			return "", fmt.Errorf("token request failed with status %d and reading body: %w", resp.StatusCode, readErr)
-		}
-		return "", fmt.Errorf("token request failed with status %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
-	}
-
-	var tokenResp struct {
-		AccessToken string `json:"access_token"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {
-		return "", fmt.Errorf("decode token response: %w", err)
-	}
-	if tokenResp.AccessToken == "" {
-		return "", fmt.Errorf("missing access token in response")
-	}
-
-	return tokenResp.AccessToken, nil
-}
-
-func newPolarisCatalogClient(baseURL, realm, token, catalog string) *polarisCatalogClient {
-	return &polarisCatalogClient{
-		http:    newPolarisHTTPClient(baseURL, realm, token),
-		catalog: catalog,
-	}
-}
-
-func (c *polarisCatalogClient) CreateNamespace(ctx context.Context, namespace string) error {
-	path := fmt.Sprintf("/api/catalog/v1/%s/namespaces", url.PathEscape(c.catalog))
-	req := createNamespaceRequest{Namespace: []string{namespace}}
-	return c.http.doJSON(ctx, http.MethodPost, path, req, nil)
-}
-
-func (c *polarisCatalogClient) DeleteNamespace(ctx context.Context, namespace string) error {
-	path := fmt.Sprintf("/api/catalog/v1/%s/namespaces/%s", url.PathEscape(c.catalog), url.PathEscape(namespace))
-	return c.http.doJSON(ctx, http.MethodDelete, path, nil, nil)
-}
-
-func (c *polarisCatalogClient) CreateTable(ctx context.Context, namespace, table, location string) error {
-	path := fmt.Sprintf("/api/catalog/v1/%s/namespaces/%s/tables", url.PathEscape(c.catalog), url.PathEscape(namespace))
-
-	req := createTableRequest{
-		Name:     table,
-		Location: location,
-		Schema: icebergSchema{
-			Type:     "struct",
-			SchemaID: 0,
-			Fields: []icebergSchemaField{
-				{
-					ID:       1,
-					Name:     "id",
-					Type:     "long",
-					Required: false,
-				},
-			},
-		},
-		PartitionSpec: icebergPartition{
-			SpecID: 0,
-			Fields: []icebergPartitionField{},
-		},
-		SortOrder: icebergSortOrder{
-			OrderID: 0,
-			Fields:  []icebergSortField{},
-		},
-		Properties: map[string]string{
-			"format-version": "2",
-		},
-	}
-
-	return c.http.doJSON(ctx, http.MethodPost, path, req, nil)
-}
-
-func (c *polarisCatalogClient) DeleteTable(ctx context.Context, namespace, table string) error {
-	path := fmt.Sprintf("/api/catalog/v1/%s/namespaces/%s/tables/%s", url.PathEscape(c.catalog), url.PathEscape(namespace), url.PathEscape(table))
-	return c.http.doJSON(ctx, http.MethodDelete, path, nil, nil)
-}
-
-func (c *polarisCatalogClient) LoadTable(ctx context.Context, namespace, table string) (*loadTableResponse, error) {
-	path := fmt.Sprintf("/api/catalog/v1/%s/namespaces/%s/tables/%s", url.PathEscape(c.catalog), url.PathEscape(namespace), url.PathEscape(table))
-	var resp loadTableResponse
-	headers := map[string]string{
-		"X-Iceberg-Access-Delegation": "vended-credentials",
-	}
-	if err := c.http.doJSONWithHeaders(ctx, http.MethodGet, path, nil, &resp, headers); err != nil {
-		return nil, err
-	}
-	return &resp, nil
-}
-
-func (c *polarisCatalogClient) LoadCredentials(ctx context.Context, namespace, table string) (*loadCredentialsResponse, error) {
-	path := fmt.Sprintf("/api/catalog/v1/%s/namespaces/%s/tables/%s/credentials", url.PathEscape(c.catalog), url.PathEscape(namespace), url.PathEscape(table))
-	var resp loadCredentialsResponse
-	if err := c.http.doJSON(ctx, http.MethodGet, path, nil, &resp); err != nil {
-		return nil, err
-	}
-	return &resp, nil
-}
-
-func extractS3Credentials(load *loadTableResponse, targetPrefix, fallbackEndpoint, fallbackRegion string) (aws.Credentials, string, string, bool, error) {
-	credentialConfig, err := selectStorageConfig(load, targetPrefix)
-	if err != nil {
-		return aws.Credentials{}, "", "", false, err
-	}
-
-	lookupConfig := func(key string) string {
-		if load != nil && load.Config != nil {
-			if val, ok := load.Config[key]; ok && strings.TrimSpace(val) != "" {
-				return strings.TrimSpace(val)
-			}
-		}
-		if val, ok := credentialConfig[key]; ok && strings.TrimSpace(val) != "" {
-			return strings.TrimSpace(val)
-		}
-		return ""
-	}
-
-	accessKey := strings.TrimSpace(credentialConfig["s3.access-key-id"])
-	secretKey := strings.TrimSpace(credentialConfig["s3.secret-access-key"])
-	sessionToken := strings.TrimSpace(credentialConfig["s3.session-token"])
-	if accessKey == "" || secretKey == "" {
-		return aws.Credentials{}, "", "", false, fmt.Errorf("missing s3.access-key-id or s3.secret-access-key in selected storage credential")
-	}
-
-	endpoint := lookupConfig("s3.endpoint")
-	if endpoint == "" {
-		endpoint = fallbackEndpoint
-	}
-	if endpoint != "" && !strings.HasPrefix(endpoint, "http") {
-		endpoint = "http://" + endpoint
-	}
-
-	region := lookupConfig("client.region")
-	if region == "" {
-		region = fallbackRegion
-	}
-
-	pathStyle := true
-	if value := lookupConfig("s3.path-style-access"); value != "" {
-		pathStyle = strings.EqualFold(value, "true")
-	}
-
-	return aws.Credentials{
-		AccessKeyID:     accessKey,
-		SecretAccessKey: secretKey,
-		SessionToken:    sessionToken,
-		Source:          "polaris-vended",
-	}, endpoint, region, pathStyle, nil
-}
-
-func selectStorageConfig(load *loadTableResponse, targetPrefix string) (map[string]string, error) {
-	if load == nil {
-		return nil, fmt.Errorf("load table response is nil")
-	}
-
-	switch len(load.StorageCredentials) {
-	case 0:
-		if load.Config == nil {
-			return nil, fmt.Errorf("polaris returned no storage credentials or config")
-		}
-		return load.Config, nil
-	case 1:
-		cred := load.StorageCredentials[0]
-		if cred.Config == nil {
-			return nil, fmt.Errorf("storage credential for prefix %s returned nil config", cred.Prefix)
-		}
-		return cred.Config, nil
-	default:
-		if targetPrefix == "" {
-			return nil, fmt.Errorf("multiple storage credentials (%d) returned but no target prefix provided", len(load.StorageCredentials))
-		}
-		normalizedTarget := normalizePrefix(targetPrefix)
-		if normalizedTarget == "" {
-			return nil, fmt.Errorf("target prefix %q normalized to empty string", targetPrefix)
-		}
-		var bestConfig map[string]string
-		bestLen := -1
-		for _, cred := range load.StorageCredentials {
-			if cred.Config == nil {
-				continue
-			}
-			prefix := normalizePrefix(cred.Prefix)
-			if prefix == "" {
-				if bestLen < 0 {
-					bestLen = 0
-					bestConfig = cred.Config
-				}
-				continue
-			}
-			if normalizedTarget == prefix || strings.HasPrefix(normalizedTarget, prefix+"/") {
-				if len(prefix) > bestLen {
-					bestLen = len(prefix)
-					bestConfig = cred.Config
-				}
-			}
-		}
-		if bestConfig != nil {
-			return bestConfig, nil
-		}
-		return nil, fmt.Errorf("none of the %d storage credentials matched prefix %s", len(load.StorageCredentials), targetPrefix)
-	}
-}
-
-func normalizePrefix(prefix string) string {
-	p := strings.TrimSpace(prefix)
-	p = strings.TrimSuffix(p, "/")
-	return p
-}
-
-func s3URIToKeyPrefix(uri, bucket string) (string, error) {
-	prefix := "s3://" + bucket + "/"
-	if !strings.HasPrefix(uri, prefix) {
-		return "", fmt.Errorf("uri %q does not match bucket %q", uri, bucket)
-	}
-	keyPrefix := strings.TrimPrefix(uri, prefix)
-	keyPrefix = strings.TrimPrefix(keyPrefix, "/")
-	if keyPrefix == "" {
-		return "", fmt.Errorf("empty key prefix in uri %q", uri)
-	}
-	return keyPrefix, nil
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Chris Lu	f62c37bf88	feat: Add ID option to plugin_worker command - Add -id CLI flag to allow custom worker IDs - Auto-generates ID if not specified (worker-{hostname}-{timestamp}) - ID defaults to empty string and is optional - Log the custom ID when specified - Update usage examples to show -id option - Worker can now be identified by custom name in admin UI	2026-02-17 11:14:48 -08:00
Chris Lu	7608b8ba44	fix: Sort plugins by ID in admin UI - Add sort package to imports - Sort plugins list by ID before rendering - Ensures consistent display order regardless of connection order - Plugin IDs are properly used in action link URLs (/plugins/jobs/{id}, /plugins/config/{id})	2026-02-17 11:12:11 -08:00
Chris Lu	5342328836	fix: Display connected plugins in admin UI - Fix ShowPlugins handler to fetch plugins from registry instead of returning empty - Update PluginsPageData struct to use []map[string]interface{} for proper data handling - Rewrite plugins.templ to properly iterate and display plugin details - Plugin count now displays correctly in the card header - Plugin table shows ID, Name, Status, Version, Capabilities, and Actions - Plugin worker successfully connects and displays in admin dashboard fix: Add plugin routes to non-auth section and resolve route conflicts - Plugin routes were only registered when authRequired=true (password set) - When no admin password was set, auth was disabled and routes were skipped - Also changed route paths to avoid conflicts in Gin router: - Changed /jobs/:type to /jobs/by-type/:type to avoid conflict with /jobs/:id/cancel - Changed /jobs/:type/trigger-detection to /trigger-detection/:type - Changed /jobs/:id/cancel to /cancel-job/:id - Plugin UI now accessible at http://localhost:23646/plugins feat: Add plugin_worker command for new plugin system - Create new generic plugin worker that connects to admin server via gRPC - Supports multiple plugins: erasure_coding, vacuum, balance - Replaces old task-based worker system with plugin-based approach - Automatically registers with admin server on startup - Sends periodic health reports to admin server - Configuration saved in working directory - Usage: weed plugin_worker -admin=localhost:33650 -plugins=erasure_coding,vacuum,balance fix: Initialize plugin manager and register PluginService on gRPC server - Initialize plugin manager in admin_server.initPluginManager() instead of placeholder - Create plugin configuration directory in admin dataDir/plugins - Register PluginService, AdminQueryService, and AdminCommandService on worker gRPC server - Plugin worker can now connect and register with admin server Changes: - weed/admin/dash/admin_server.go: Properly initialize plugin manager - weed/admin/dash/worker_grpc_server.go: Register plugin services on gRPC server Testing: - Plugin worker connects successfully to admin server - Plugin capabilities are registered correctly - Health reporting works as expected	2026-02-17 11:08:35 -08:00
Chris Lu	3241275885	Revert "feat(plugin): Add Plugins link to admin dashboard" This reverts commit `3e207087a0`.	2026-02-17 09:03:00 -08:00
Chris Lu	acd1985ca0	fix(plugin): Fix sidebar menu items for plugins section	2026-02-17 08:33:36 -08:00
Chris Lu	3e207087a0	feat(plugin): Add Plugins link to admin dashboard	2026-02-17 08:27:12 -08:00
Chris Lu	7b04656f2a	build(plugin): Finalize plugin system build integration	2026-02-17 04:03:38 -08:00
Chris Lu	298d72fe53	feat(plugin): Add detailed execution logging to all executors	2026-02-17 04:01:18 -08:00
Chris Lu	bb35b81709	feat(plugin): Add detailed detection logging to all detectors	2026-02-17 04:00:51 -08:00
Chris Lu	ea926e45a8	feat(plugin): Add plugins menu to admin layout	2026-02-17 03:51:42 -08:00
Chris Lu	1dbaca70f8	feat(plugin): Register plugin routes and API handlers	2026-02-17 03:19:52 -08:00
Chris Lu	d387be45aa	feat(plugin): Integrate plugin manager into admin server	2026-02-17 02:08:18 -08:00
Chris Lu	405e281218	feat(plugin): Add configuration page template	2026-02-17 02:07:48 -08:00
Chris Lu	37d1a8ad12	feat(plugin): Add job monitoring page template	2026-02-17 02:07:30 -08:00
Chris Lu	bfb0771a5b	feat(plugin): Add plugins overview page template	2026-02-17 02:07:16 -08:00
Chris Lu	01f310ac9b	feat(plugin): Add UI template helpers	2026-02-17 02:06:57 -08:00
Chris Lu	f266a25a32	feat(plugin): Add HTTP API handlers for plugin management	2026-02-17 02:06:39 -08:00
Chris Lu	2be97d7190	feat(plugin): Add history management to plugin manager	2026-02-17 02:06:13 -08:00
Chris Lu	75644c7e3d	feat(plugin): Add history tracking to plugin types	2026-02-17 02:06:05 -08:00
Chris Lu	3320911984	fix(plugin): Fix testing framework and plugin compilation issues	2026-02-17 02:03:38 -08:00
Chris Lu	dafa8d79f5	feat(plugin): Add balance plugin implementation	2026-02-17 02:00:39 -08:00
Chris Lu	e7efe201e3	feat(plugin): Add vacuum plugin implementation	2026-02-17 02:00:36 -08:00
Chris Lu	9b2fd24e52	feat(plugin): Add balance plugin implementation	2026-02-17 01:57:51 -08:00
Chris Lu	574f72906a	feat(plugin): Add vacuum plugin implementation	2026-02-17 01:55:11 -08:00
Chris Lu	babc4751db	test(plugin): Add EC plugin comprehensive tests	2026-02-17 01:46:34 -08:00
Chris Lu	efb69400ff	feat(plugin): Add EC plugin worker client	2026-02-17 01:46:12 -08:00
Chris Lu	7dc40d3747	feat(plugin): Add EC plugin execution logic	2026-02-17 01:45:49 -08:00
Chris Lu	fb7c7b3744	feat(plugin): Add EC plugin detection logic	2026-02-17 01:45:30 -08:00
Chris Lu	7ff0026e46	feat(plugin): Add EC plugin configuration schema	2026-02-17 01:45:11 -08:00
Chris Lu	f57992b81e	feat(plugin): Add test harness for plugin testing	2026-02-17 01:44:52 -08:00
Chris Lu	471b0cf8f3	feat(plugin): Add mock plugin for testing	2026-02-17 01:44:24 -08:00
Chris Lu	a2d2d77e09	feat(plugin): Add mock admin server for testing	2026-02-17 01:43:57 -08:00
Chris Lu	eb13f9ce82	fix(plugin): Fix protobuf enum naming and build issues	2026-02-17 01:41:19 -08:00
Chris Lu	8c6e627af2	build(plugin): Add plugin.proto to build system	2026-02-17 01:39:41 -08:00
Chris Lu	67e37e180e	feat(plugin): Add plugin manager orchestrator	2026-02-17 01:39:28 -08:00
Chris Lu	2fcd6a3056	feat(plugin): Add gRPC server implementation	2026-02-17 01:39:06 -08:00
Chris Lu	13f39d4ad2	feat(plugin): Add configuration manager for persistence	2026-02-17 01:38:39 -08:00
Chris Lu	eead8b2337	feat(plugin): Add job dispatcher for orchestration	2026-02-17 01:38:20 -08:00
Chris Lu	b728dc00ed	feat(plugin): Add job queue with priority and deduplication	2026-02-17 01:37:58 -08:00
Chris Lu	5ac3e80d2b	feat(plugin): Add plugin registry with lifecycle management	2026-02-17 01:37:39 -08:00
Chris Lu	42c52f9371	feat(plugin): Add plugin system core types and domain models	2026-02-17 01:37:22 -08:00
Chris Lu	2b4600cb08	feat(plugin): Add plugin system gRPC protocol definition	2026-02-17 01:37:06 -08:00