Merge branch 'main' into force-routing-peer-dns-reverse-proxy

.github/workflows/agent-network-e2e.yml

@@ -5,13 +5,6 @@ on:
   schedule:
     - cron: "0 3 * * *"
   workflow_dispatch:
-    inputs:
-      bedrock_model:
-        description: >-
-          Bedrock inference-profile id to drive the matrix with, exactly as
-          AWS issues it. Leave empty for the Sonnet 4.6 default.
-        required: false
-        default: ""
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -69,8 +62,6 @@ jobs:
           CLOUDFLARE_TOKEN: ${{ secrets.E2E_CLOUDFLARE_TOKEN }}
           AWS_BEARER_TOKEN_BEDROCK: ${{ secrets.E2E_AWS_BEARER_TOKEN_BEDROCK }}
           AWS_REGION: ${{ secrets.E2E_AWS_REGION }}
-          # Bedrock model override: dispatch input wins, then the repo variable, else the test default.
-          AWS_BEDROCK_MODEL: ${{ inputs.bedrock_model || vars.E2E_AWS_BEDROCK_MODEL }}
           # Vertex (Anthropic-on-Vertex): SA + project required; region defaults
           # to "global", model to a pinned claude snapshot.
           GOOGLE_VERTEX_SA_BASE64: ${{ secrets.E2E_GOOGLE_VERTEX_SA_BASE64 }}

client/iface/iface_test.go

@@ -464,8 +464,6 @@ func Test_RemovePeer(t *testing.T) {
 }
 
 func Test_ConnectPeers(t *testing.T) {
-	t.Setenv("NB_DISABLE_EBPF_WG_PROXY", "true")
-
 	peer1ifaceName := fmt.Sprintf("utun%d", WgIntNumber+400)
 	peer1wgIP := netip.MustParsePrefix("10.99.99.17/30")
 	peer1Key, _ := wgtypes.GeneratePrivateKey()
@@ -507,8 +505,12 @@ func Test_ConnectPeers(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	localIP1 := "127.0.0.1"
-	peer1endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP1, peer1wgPort))
+	localIP, err := getLocalIP()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	peer1endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP, peer1wgPort))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -544,8 +546,7 @@ func Test_ConnectPeers(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	localIP2 := "127.0.0.1"
-	peer2endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP2, peer2wgPort))
+	peer2endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP, peer2wgPort))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -620,3 +621,28 @@ func getPeer(ifaceName, peerPubKey string) (wgtypes.Peer, error) {
 	}
 	return wgtypes.Peer{}, fmt.Errorf("peer not found")
 }
+
+func getLocalIP() (string, error) {
+	// Get all interfaces
+	addrs, err := net.InterfaceAddrs()
+	if err != nil {
+		return "", err
+	}
+
+	for _, addr := range addrs {
+		ipNet, ok := addr.(*net.IPNet)
+		if !ok {
+			continue
+		}
+		if ipNet.IP.IsLoopback() {
+			continue
+		}
+
+		if ipNet.IP.To4() == nil {
+			continue
+		}
+		return ipNet.IP.String(), nil
+	}
+
+	return "", fmt.Errorf("no local IP found")
+}

e2e/agentnetwork/chat_test.go

@@ -9,220 +9,12 @@ import (
 	"testing"
 	"time"
 
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"gorm.io/driver/sqlite"
-	"gorm.io/gorm"
 
 	"github.com/netbirdio/netbird/e2e/harness"
 	"github.com/netbirdio/netbird/shared/management/http/api"
 )
 
-// per1k is a model's published USD rates per 1k tokens. read is the prompt-cache read rate
-// (OpenAI: the cached-input discount rate); write is the cache-creation rate where one exists.
-type per1k struct{ in, out, read, write float64 }
-
-// publishedPer1k hardcodes the vendors' PUBLISHED rates for the models the live matrix can drive,
-// keyed by the normalized model id the proxy stamps. Deliberately independent of the proxy's
-// pricing table so a wrong embedded rate or a broken normalization fails the run.
-var publishedPer1k = map[string]per1k{
-	"gpt-4o-mini":                 {0.00015, 0.0006, 0.000075, 0},
-	"gpt-4o":                      {0.0025, 0.01, 0.00125, 0},
-	"claude-haiku-4-5":            {0.001, 0.005, 0.0001, 0.00125},
-	"claude-sonnet-4-5":           {0.003, 0.015, 0.0003, 0.00375},
-	"claude-sonnet-4-6":           {0.003, 0.015, 0.0003, 0.00375},
-	"kimi-k3":                     {0.003, 0.015, 0.0003, 0.003}, // no published write rate: bills at the input rate
-	"anthropic.claude-haiku-4-5":  {0.001, 0.005, 0.0001, 0.00125},
-	"anthropic.claude-sonnet-4-5": {0.003, 0.015, 0.0003, 0.00375},
-	"anthropic.claude-sonnet-4-6": {0.003, 0.015, 0.0003, 0.00375},
-}
-
-// rawCostVerificationSQL is the operator-facing double-check, run straight against the management
-// sqlite store: recompute each usage row's expected total and cache cost from its own persisted
-// token buckets and hardcoded published rates. OpenAI counts cached tokens as a subset of input;
-// Anthropic-shape providers count cache buckets additively.
-const rawCostVerificationSQL = `
-WITH rates(model, in_rate, out_rate, read_rate, write_rate) AS (
-  VALUES
-    ('gpt-4o-mini',                 0.00015, 0.0006, 0.000075, 0.0),
-    ('gpt-4o',                      0.0025,  0.01,   0.00125,  0.0),
-    ('claude-haiku-4-5',            0.001,   0.005,  0.0001,   0.00125),
-    ('claude-sonnet-4-5',           0.003,   0.015,  0.0003,   0.00375),
-    ('claude-sonnet-4-6',           0.003,   0.015,  0.0003,   0.00375),
-    ('kimi-k3',                     0.003,   0.015,  0.0003,   0.003),
-    ('anthropic.claude-haiku-4-5',  0.001,   0.005,  0.0001,   0.00125),
-    ('anthropic.claude-sonnet-4-5', 0.003,   0.015,  0.0003,   0.00375),
-    ('anthropic.claude-sonnet-4-6', 0.003,   0.015,  0.0003,   0.00375)
-)
-SELECT
-  u.provider,
-  u.model,
-  u.input_tokens,
-  u.output_tokens,
-  u.cached_input_tokens,
-  u.cache_creation_tokens,
-  u.input_cost_usd,
-  u.cached_input_cost_usd,
-  u.cache_creation_cost_usd,
-  u.output_cost_usd,
-  -- No cost_usd / cache_cost_usd columns are stored: both are derived from the
-  -- four per-bucket columns above, exactly as the API renders them.
-  (u.input_cost_usd + u.cached_input_cost_usd + u.cache_creation_cost_usd + u.output_cost_usd) AS cost_usd,
-  (u.cached_input_cost_usd + u.cache_creation_cost_usd) AS cache_cost_usd,
-  CASE WHEN u.provider = 'openai' THEN
-    (u.input_tokens - MIN(u.cached_input_tokens, u.input_tokens))*r.in_rate/1000.0
-  ELSE
-    u.input_tokens*r.in_rate/1000.0
-  END AS expected_input,
-  CASE WHEN u.provider = 'openai' THEN
-    MIN(u.cached_input_tokens, u.input_tokens)*r.read_rate/1000.0
-  ELSE
-    u.cached_input_tokens*r.read_rate/1000.0
-  END AS expected_cached_input,
-  CASE WHEN u.provider = 'openai' THEN
-    0.0
-  ELSE
-    u.cache_creation_tokens*r.write_rate/1000.0
-  END AS expected_cache_creation,
-  u.output_tokens*r.out_rate/1000.0 AS expected_output,
-  CASE WHEN u.provider = 'openai' THEN
-    (u.input_tokens - MIN(u.cached_input_tokens, u.input_tokens))*r.in_rate/1000.0
-      + MIN(u.cached_input_tokens, u.input_tokens)*r.read_rate/1000.0
-      + u.output_tokens*r.out_rate/1000.0
-  ELSE
-    u.input_tokens*r.in_rate/1000.0 + u.cached_input_tokens*r.read_rate/1000.0
-      + u.cache_creation_tokens*r.write_rate/1000.0 + u.output_tokens*r.out_rate/1000.0
-  END AS expected_total,
-  CASE WHEN u.provider = 'openai' THEN
-    MIN(u.cached_input_tokens, u.input_tokens)*r.read_rate/1000.0
-  ELSE
-    u.cached_input_tokens*r.read_rate/1000.0 + u.cache_creation_tokens*r.write_rate/1000.0
-  END AS expected_cache
-FROM agent_network_request_usage u
-JOIN rates r ON r.model = u.model
-ORDER BY u.timestamp`
-
-// verifyUsageRowsSQL re-checks every persisted usage row directly in the management sqlite store,
-// bypassing the API path — the same audit an operator can run on a production store.db.
-func verifyUsageRowsSQL(t *testing.T, srv *harness.Combined) {
-	t.Helper()
-
-	dbPath, err := srv.SnapshotStoreDB(t.TempDir())
-	require.NoError(t, err, "snapshot management sqlite store")
-
-	db, err := gorm.Open(sqlite.Open(dbPath), &gorm.Config{})
-	require.NoError(t, err, "open store snapshot")
-	sqlDB, err := db.DB()
-	require.NoError(t, err)
-	defer func() { _ = sqlDB.Close() }()
-
-	rows, err := db.Raw(rawCostVerificationSQL).Rows()
-	require.NoError(t, err, "run raw cost verification query")
-	defer func() { _ = rows.Close() }()
-
-	verified := 0
-	for rows.Next() {
-		var provider, model string
-		var inTok, outTok, readTok, writeTok int64
-		var inCost, cachedInCost, cacheCreateCost, outCost, cost, cacheCost float64
-		var wantInput, wantCachedInput, wantCacheCreation, wantOutput, wantTotal, wantCache float64
-		require.NoError(t, rows.Scan(&provider, &model, &inTok, &outTok, &readTok, &writeTok,
-			&inCost, &cachedInCost, &cacheCreateCost, &outCost, &cost, &cacheCost,
-			&wantInput, &wantCachedInput, &wantCacheCreation, &wantOutput, &wantTotal, &wantCache), "scan usage row")
-		t.Logf("[sql] %s/%s: in=%d out=%d cache_read=%d cache_write=%d stored in/cached/create/out=$%.6f/$%.6f/$%.6f/$%.6f total=$%.6f cache=$%.6f expected total=$%.6f cache=$%.6f",
-			provider, model, inTok, outTok, readTok, writeTok,
-			inCost, cachedInCost, cacheCreateCost, outCost, cost, cacheCost, wantTotal, wantCache)
-		assert.InDeltaf(t, wantInput, inCost, 1e-6, "stored input_cost_usd for %s/%s must match the published-rate recompute", provider, model)
-		assert.InDeltaf(t, wantCachedInput, cachedInCost, 1e-6, "stored cached_input_cost_usd for %s/%s must match the published-rate recompute", provider, model)
-		assert.InDeltaf(t, wantCacheCreation, cacheCreateCost, 1e-6, "stored cache_creation_cost_usd for %s/%s must match the published-rate recompute", provider, model)
-		assert.InDeltaf(t, wantOutput, outCost, 1e-6, "stored output_cost_usd for %s/%s must match the published-rate recompute", provider, model)
-		assert.InDeltaf(t, wantTotal, cost, 1e-6, "derived cost_usd for %s/%s must match the published-rate recompute", provider, model)
-		assert.InDeltaf(t, wantCache, cacheCost, 1e-6, "derived cache_cost_usd for %s/%s must match the published-rate recompute", provider, model)
-		assert.InDeltaf(t, inCost+cachedInCost+cacheCreateCost+outCost, cost, 1e-9,
-			"stored buckets must sum to the derived cost_usd for %s/%s", provider, model)
-		verified++
-	}
-	require.NoError(t, rows.Err(), "iterate usage rows")
-	require.Positive(t, verified, "raw SQL check must cover at least one usage row")
-	t.Logf("[sql] verified %d usage rows in store.db against published rates", verified)
-
-	gwRows, err := db.Raw(`SELECT model,
-	  (input_cost_usd + cached_input_cost_usd + cache_creation_cost_usd + output_cost_usd) AS cost_usd
-	  FROM agent_network_request_usage WHERE model LIKE '%/%'`).Rows()
-	require.NoError(t, err, "query gateway-prefixed usage rows")
-	defer func() { _ = gwRows.Close() }()
-	for gwRows.Next() {
-		var model string
-		var cost float64
-		require.NoError(t, gwRows.Scan(&model, &cost), "scan gateway usage row")
-		t.Logf("[sql] gateway %s: stored=$%.6f (must be 0 — deliberately unpriced)", model, cost)
-		assert.Zerof(t, cost, "gateway-prefixed model %q must store cost 0, never a guessed rate", model)
-	}
-	require.NoError(t, gwRows.Err(), "iterate gateway usage rows")
-}
-
-// validateAccessLogCost recomputes a live access-log row's expected total and cache cost from the
-// published per-1k rates and the row's persisted token buckets, and asserts both stored values.
-// Gateway-prefixed model ids the proxy deliberately does not price must store cost 0.
-func validateAccessLogCost(t *testing.T, pc providerCase, row api.AgentNetworkAccessLog) {
-	t.Helper()
-	model := catalogModel(pc)
-	provider := ""
-	if row.Provider != nil {
-		provider = *row.Provider
-	}
-	t.Logf("[cost] %s: provider=%s model=%s in=%d out=%d total=%d cache_read=%d cache_write=%d cost=$%.6f cache_cost=$%.6f",
-		pc.name, provider, model, row.InputTokens, row.OutputTokens, row.TotalTokens,
-		row.CachedInputTokens, row.CacheCreationTokens, row.CostUsd, row.CacheCostUsd)
-
-	rates, known := publishedPer1k[model]
-	if !known {
-		if strings.Contains(model, "/") {
-			assert.Zerof(t, row.CostUsd, "gateway-prefixed model %q is not priced so the cost meter must skip (cost 0)", model)
-			return
-		}
-		t.Logf("[cost] %s: no published rate on file for model %q (env-overridden?); skipping cost validation", pc.name, model)
-		return
-	}
-
-	// input_tokens may legitimately be 0: Moonshot/Kimi reports fully cached prompts under the cache
-	// buckets only. Output and total must always be present on a priced row.
-	require.Positive(t, row.OutputTokens, "priced row must carry output tokens")
-	require.Positive(t, row.TotalTokens, "priced row must carry total tokens")
-
-	var wantInput, wantCachedInput, wantCacheCreation float64
-	if provider == "openai" {
-		cached := min(row.CachedInputTokens, row.InputTokens) // cached is a subset of input
-		wantInput = float64(row.InputTokens-cached) / 1000 * rates.in
-		wantCachedInput = float64(cached) / 1000 * rates.read
-		// OpenAI has no cache-write bucket; wantCacheCreation stays 0.
-	} else {
-		// Anthropic / Bedrock shape: cache buckets are additive to input_tokens.
-		wantInput = float64(row.InputTokens) / 1000 * rates.in
-		wantCachedInput = float64(row.CachedInputTokens) / 1000 * rates.read
-		wantCacheCreation = float64(row.CacheCreationTokens) / 1000 * rates.write
-	}
-	wantOutput := float64(row.OutputTokens) / 1000 * rates.out
-	wantCache := wantCachedInput + wantCacheCreation
-	wantTotal := wantInput + wantCache + wantOutput
-
-	t.Logf("[cost] %s: expecting input=$%.6f cached_input=$%.6f cache_creation=$%.6f output=$%.6f total=$%.6f cache=$%.6f from published rates",
-		pc.name, wantInput, wantCachedInput, wantCacheCreation, wantOutput, wantTotal, wantCache)
-	assert.InDeltaf(t, wantInput, row.InputCostUsd, 1e-6, "stored input_cost_usd for %s (%s)", pc.name, model)
-	assert.InDeltaf(t, wantCachedInput, row.CachedInputCostUsd, 1e-6, "stored cached_input_cost_usd for %s (%s)", pc.name, model)
-	assert.InDeltaf(t, wantCacheCreation, row.CacheCreationCostUsd, 1e-6, "stored cache_creation_cost_usd for %s (%s)", pc.name, model)
-	assert.InDeltaf(t, wantOutput, row.OutputCostUsd, 1e-6, "stored output_cost_usd for %s (%s)", pc.name, model)
-	assert.InDeltaf(t, wantTotal, row.CostUsd, 1e-6, "derived cost_usd for %s (%s)", pc.name, model)
-	assert.InDeltaf(t, wantCache, row.CacheCostUsd, 1e-6, "derived cache_cost_usd for %s (%s)", pc.name, model)
-
-	// The aggregates must be exactly the sum of the stored components, not an
-	// independently-computed figure that could drift from the breakdown.
-	assert.InDeltaf(t, row.InputCostUsd+row.CachedInputCostUsd+row.CacheCreationCostUsd+row.OutputCostUsd,
-		row.CostUsd, 1e-9, "stored buckets must sum to the derived cost_usd for %s (%s)", pc.name, model)
-	assert.InDeltaf(t, row.CachedInputCostUsd+row.CacheCreationCostUsd,
-		row.CacheCostUsd, 1e-9, "stored cache buckets must sum to the derived cache_cost_usd for %s (%s)", pc.name, model)
-}
-
 // providerCase is one entry in the live provider matrix. The same scenario runs
 // for every available provider; availability is keyed off env vars so the suite
 // covers whatever credentials are present (source ~/.llm-keys locally / set the
@@ -324,12 +116,12 @@ func availableProviders() []providerCase {
 		if region == "" {
 			region = "eu-central-1"
 		}
-		// A valid Bedrock inference-profile id, overridable per account (AWS_BEDROCK_MODEL, also the
-		// workflow's bedrock_model dispatch input). `global.` profiles work from any region. Defaults to
-		// Sonnet 4.6, whose id convention dropped the -YYYYMMDD-v1:0 suffix that Haiku 4.5 still carries.
+		// A valid Bedrock inference-profile id (region prefix + date + version),
+		// overridable per account. `global.` profiles can be invoked from any
+		// region; set AWS_BEDROCK_MODEL to match the enabled profile for the token.
 		model := os.Getenv("AWS_BEDROCK_MODEL")
 		if model == "" {
-			model = "global.anthropic.claude-sonnet-4-6"
+			model = "global.anthropic.claude-haiku-4-5-20251001-v1:0"
 		}
 		ps = append(ps, providerCase{name: "bedrock", catalogID: "bedrock_api", upstream: "https://bedrock-runtime." + region + ".amazonaws.com", apiKey: k, model: model, kind: harness.WireBedrock})
 	}
@@ -465,10 +257,6 @@ func TestProvidersMatrix(t *testing.T) {
 			// session id and confirm the marker propagated end-to-end.
 			sessionID := "e2e-session-" + pc.name
 
-			// A long-form prompt so completions carry realistic token counts for cost validation;
-			// max_tokens in the harness bodies (2048) lets the full answer through.
-			const matrixPrompt = "explain GitHub workflow in 1000 words"
-
 			// Retry briefly to absorb tunnel/DNS jitter on the first call.
 			var code int
 			var body string
@@ -479,11 +267,11 @@ func TestProvidersMatrix(t *testing.T) {
 				var cerr error
 				switch pc.kind {
 				case harness.WireVertex:
-					c, b, cerr = cl.Vertex(ctx, settings.Endpoint, proxyIP, pc.project, pc.region, pc.model, matrixPrompt, sessionID)
+					c, b, cerr = cl.Vertex(ctx, settings.Endpoint, proxyIP, pc.project, pc.region, pc.model, "Reply with exactly: pong", sessionID)
 				case harness.WireBedrock:
-					c, b, cerr = cl.Bedrock(ctx, settings.Endpoint, proxyIP, pc.model, matrixPrompt, sessionID)
+					c, b, cerr = cl.Bedrock(ctx, settings.Endpoint, proxyIP, pc.model, "Reply with exactly: pong", sessionID)
 				default:
-					c, b, cerr = cl.ChatPrefixed(ctx, settings.Endpoint, proxyIP, pc.pathPrefix, pc.kind, pc.model, matrixPrompt, sessionID)
+					c, b, cerr = cl.ChatPrefixed(ctx, settings.Endpoint, proxyIP, pc.pathPrefix, pc.kind, pc.model, "Reply with exactly: pong", sessionID)
 				}
 				if cerr == nil {
 					code, body = c, b
@@ -502,7 +290,6 @@ func TestProvidersMatrix(t *testing.T) {
 
 			// The session id sent as x-session-id must round-trip into the
 			// access-log row for this provider.
-			var row api.AgentNetworkAccessLog
 			require.Eventually(t, func() bool {
 				logs, lerr := srv.ListAccessLogs(ctx)
 				if lerr != nil {
@@ -510,15 +297,11 @@ func TestProvidersMatrix(t *testing.T) {
 				}
 				for _, r := range logs.Data {
 					if r.SessionId != nil && *r.SessionId == sessionID {
-						row = r
 						return true
 					}
 				}
 				return false
 			}, 30*time.Second, 2*time.Second, "session id %q must be recorded in an access-log row for %s", sessionID, pc.name)
-
-			// Stored total and cache cost must match the published rates applied to the row's buckets.
-			validateAccessLogCost(t, pc, row)
 		})
 	}
 
@@ -539,7 +322,4 @@ func TestProvidersMatrix(t *testing.T) {
 		}
 		return false
 	}, 60*time.Second, 3*time.Second, "consumption must be recorded with positive token counts after live traffic")
-
-	// Final raw-SQL audit: bypass the API and re-verify every persisted usage row in the store.
-	verifyUsageRowsSQL(t, srv)
 }

e2e/harness/client.go

@@ -256,7 +256,7 @@ func (cl *Client) ChatPrefixed(ctx context.Context, endpoint, proxyIP, pathPrefi
 	case WireMessages:
 		path = "/v1/messages"
 		headers = []string{"anthropic-version: 2023-06-01"}
-		body = fmt.Sprintf(`{"model":%q,"max_tokens":2048,"messages":[{"role":"user","content":%q}]}`, model, prompt)
+		body = fmt.Sprintf(`{"model":%q,"max_tokens":64,"messages":[{"role":"user","content":%q}]}`, model, prompt)
 	default:
 		path = "/v1/chat/completions"
 		body = fmt.Sprintf(`{"model":%q,"messages":[{"role":"user","content":%q}]}`, model, prompt)
@@ -271,7 +271,7 @@ func (cl *Client) ChatPrefixed(ctx context.Context, endpoint, proxyIP, pathPrefi
 // is sent as the universal x-session-id header the proxy records.
 func (cl *Client) Vertex(ctx context.Context, endpoint, proxyIP, project, region, model, prompt, sessionID string) (int, string, error) {
 	path := fmt.Sprintf("/v1/projects/%s/locations/%s/publishers/anthropic/models/%s:rawPredict", project, region, model)
-	body := fmt.Sprintf(`{"anthropic_version":"vertex-2023-10-16","max_tokens":2048,"messages":[{"role":"user","content":%q}]}`, prompt)
+	body := fmt.Sprintf(`{"anthropic_version":"vertex-2023-10-16","max_tokens":64,"messages":[{"role":"user","content":%q}]}`, prompt)
 	return cl.post(ctx, endpoint, proxyIP, path, body, withSessionID(nil, sessionID))
 }
 
@@ -282,7 +282,7 @@ func (cl *Client) Vertex(ctx context.Context, endpoint, proxyIP, project, region
 // header the proxy records.
 func (cl *Client) Bedrock(ctx context.Context, endpoint, proxyIP, model, prompt, sessionID string) (int, string, error) {
 	path := "/model/" + model + "/invoke"
-	body := fmt.Sprintf(`{"anthropic_version":"bedrock-2023-05-31","max_tokens":2048,"messages":[{"role":"user","content":%q}]}`, prompt)
+	body := fmt.Sprintf(`{"anthropic_version":"bedrock-2023-05-31","max_tokens":64,"messages":[{"role":"user","content":%q}]}`, prompt)
 	return cl.post(ctx, endpoint, proxyIP, path, body, withSessionID(nil, sessionID))
 }
 
@@ -341,7 +341,7 @@ func (cl *Client) Terminate(ctx context.Context) error {
 	return cl.container.Terminate(ctx)
 }
 
-// containerLogs reads up to 4 MiB of a container's logs for diagnostics — enough for a whole provider-matrix run.
+// containerLogs reads up to 256 KiB of a container's logs for diagnostics.
 func containerLogs(ctx context.Context, c testcontainers.Container) string {
 	if c == nil {
 		return ""
@@ -351,6 +351,6 @@ func containerLogs(ctx context.Context, c testcontainers.Container) string {
 		return fmt.Sprintf("<logs error: %v>", err)
 	}
 	defer r.Close()
-	b, _ := io.ReadAll(io.LimitReader(r, 4<<20))
+	b, _ := io.ReadAll(io.LimitReader(r, 256<<10))
 	return string(b)
 }

e2e/harness/combined.go

@@ -221,29 +221,6 @@ func (c *Combined) CreateProxyTokenCLI(ctx context.Context, name string) (string
 	return "", fmt.Errorf("token not found in CLI output: %s", string(out))
 }
 
-// SnapshotStoreDB copies the management sqlite store (with WAL/SHM sidecars) out of the bind-mounted
-// data dir into dstDir and returns the copy's path; reading a copy avoids locking against live writes.
-func (c *Combined) SnapshotStoreDB(dstDir string) (string, error) {
-	src := filepath.Join(c.workDir, "data", "store.db")
-	if _, err := os.Stat(src); err != nil {
-		return "", fmt.Errorf("management store not found at %s: %w", src, err)
-	}
-	dst := filepath.Join(dstDir, "store.db")
-	for _, suffix := range []string{"", "-wal", "-shm"} {
-		data, err := os.ReadFile(src + suffix)
-		if err != nil {
-			if os.IsNotExist(err) && suffix != "" {
-				continue // sidecar only exists in WAL mode
-			}
-			return "", fmt.Errorf("read %s: %w", src+suffix, err)
-		}
-		if err := os.WriteFile(dst+suffix, data, 0o600); err != nil {
-			return "", fmt.Errorf("write %s: %w", dst+suffix, err)
-		}
-	}
-	return dst, nil
-}
-
 // Logs returns the combined server container logs, for diagnostics.
 func (c *Combined) Logs(ctx context.Context) string {
 	return containerLogs(ctx, c.container)

management/internals/modules/agentnetwork/accesslog_ingest.go

@@ -18,26 +18,21 @@ import (
 // contract between the proxy and management; management flattens them into
 // queryable columns. Keep in sync with the proxy side.
 const (
-	metaKeyProvider            = "llm.provider"
-	metaKeyModel               = "llm.model"
-	metaKeyResolvedProviderID  = "llm.resolved_provider_id"
-	metaKeySelectedPolicyID    = "llm.selected_policy_id"
-	metaKeyPolicyDecision      = "llm_policy.decision"
-	metaKeyPolicyReason        = "llm_policy.reason"
-	metaKeyInputTokens         = "llm.input_tokens"          //nolint:gosec // metadata key name, not a credential
-	metaKeyOutputTokens        = "llm.output_tokens"         //nolint:gosec // metadata key name, not a credential
-	metaKeyTotalTokens         = "llm.total_tokens"          //nolint:gosec // metadata key name, not a credential
-	metaKeyCachedInputTokens   = "llm.cached_input_tokens"   //nolint:gosec // metadata key name, not a credential
-	metaKeyCacheCreationTokens = "llm.cache_creation_tokens" //nolint:gosec // metadata key name, not a credential
-	metaKeyCostUSDInput        = "cost.usd_input"
-	metaKeyCostUSDCachedInput  = "cost.usd_cached_input"
-	metaKeyCostUSDCacheCreate  = "cost.usd_cache_creation"
-	metaKeyCostUSDOutput       = "cost.usd_output"
-	metaKeyStream              = "llm.stream"
-	metaKeySessionID           = "llm.session_id"
-	metaKeyAuthorisingGroups   = "llm.authorising_groups"
-	metaKeyRequestPrompt       = "llm.request_prompt"
-	metaKeyResponseCompletion  = "llm.response_completion"
+	metaKeyProvider           = "llm.provider"
+	metaKeyModel              = "llm.model"
+	metaKeyResolvedProviderID = "llm.resolved_provider_id"
+	metaKeySelectedPolicyID   = "llm.selected_policy_id"
+	metaKeyPolicyDecision     = "llm_policy.decision"
+	metaKeyPolicyReason       = "llm_policy.reason"
+	metaKeyInputTokens        = "llm.input_tokens"  //nolint:gosec // metadata key name, not a credential
+	metaKeyOutputTokens       = "llm.output_tokens" //nolint:gosec // metadata key name, not a credential
+	metaKeyTotalTokens        = "llm.total_tokens"  //nolint:gosec // metadata key name, not a credential
+	metaKeyCostUSDTotal       = "cost.usd_total"
+	metaKeyStream             = "llm.stream"
+	metaKeySessionID          = "llm.session_id"
+	metaKeyAuthorisingGroups  = "llm.authorising_groups"
+	metaKeyRequestPrompt      = "llm.request_prompt"
+	metaKeyResponseCompletion = "llm.response_completion"
 )
 
 // IngestAccessLog flattens the metadata-bearing reverse-proxy access-log entry
@@ -113,25 +108,20 @@ func flattenAccessLog(e *accesslogs.AccessLogEntry) (*types.AgentNetworkAccessLo
 		BytesUpload:   e.BytesUpload,
 		BytesDownload: e.BytesDownload,
 
-		Provider:             meta[metaKeyProvider],
-		Model:                meta[metaKeyModel],
-		SessionID:            meta[metaKeySessionID],
-		ResolvedProviderID:   meta[metaKeyResolvedProviderID],
-		SelectedPolicyID:     meta[metaKeySelectedPolicyID],
-		Decision:             meta[metaKeyPolicyDecision],
-		DenyReason:           meta[metaKeyPolicyReason],
-		InputTokens:          parseMetaInt(meta, metaKeyInputTokens),
-		OutputTokens:         parseMetaInt(meta, metaKeyOutputTokens),
-		TotalTokens:          parseMetaInt(meta, metaKeyTotalTokens),
-		CachedInputTokens:    parseMetaInt(meta, metaKeyCachedInputTokens),
-		CacheCreationTokens:  parseMetaInt(meta, metaKeyCacheCreationTokens),
-		InputCostUSD:         parseMetaFloat(meta, metaKeyCostUSDInput),
-		CachedInputCostUSD:   parseMetaFloat(meta, metaKeyCostUSDCachedInput),
-		CacheCreationCostUSD: parseMetaFloat(meta, metaKeyCostUSDCacheCreate),
-		OutputCostUSD:        parseMetaFloat(meta, metaKeyCostUSDOutput),
-		Stream:               parseMetaBool(meta, metaKeyStream),
-		RequestPrompt:        meta[metaKeyRequestPrompt],
-		ResponseCompletion:   meta[metaKeyResponseCompletion],
+		Provider:           meta[metaKeyProvider],
+		Model:              meta[metaKeyModel],
+		SessionID:          meta[metaKeySessionID],
+		ResolvedProviderID: meta[metaKeyResolvedProviderID],
+		SelectedPolicyID:   meta[metaKeySelectedPolicyID],
+		Decision:           meta[metaKeyPolicyDecision],
+		DenyReason:         meta[metaKeyPolicyReason],
+		InputTokens:        parseMetaInt(meta, metaKeyInputTokens),
+		OutputTokens:       parseMetaInt(meta, metaKeyOutputTokens),
+		TotalTokens:        parseMetaInt(meta, metaKeyTotalTokens),
+		CostUSD:            parseMetaFloat(meta, metaKeyCostUSDTotal),
+		Stream:             parseMetaBool(meta, metaKeyStream),
+		RequestPrompt:      meta[metaKeyRequestPrompt],
+		ResponseCompletion: meta[metaKeyResponseCompletion],
 	}
 
 	var groups []types.AgentNetworkAccessLogGroup
@@ -150,23 +140,18 @@ func flattenAccessLog(e *accesslogs.AccessLogEntry) (*types.AgentNetworkAccessLo
 // log's ID so the two correlate.
 func usageFromFlattenedLog(e *types.AgentNetworkAccessLog, groups []types.AgentNetworkAccessLogGroup) (*types.AgentNetworkUsage, []types.AgentNetworkUsageGroup) {
 	usage := &types.AgentNetworkUsage{
-		ID:                   e.ID,
-		AccountID:            e.AccountID,
-		Timestamp:            e.Timestamp,
-		UserID:               e.UserID,
-		ResolvedProviderID:   e.ResolvedProviderID,
-		Provider:             e.Provider,
-		Model:                e.Model,
-		SessionID:            e.SessionID,
-		InputTokens:          e.InputTokens,
-		OutputTokens:         e.OutputTokens,
-		TotalTokens:          e.TotalTokens,
-		CachedInputTokens:    e.CachedInputTokens,
-		CacheCreationTokens:  e.CacheCreationTokens,
-		InputCostUSD:         e.InputCostUSD,
-		CachedInputCostUSD:   e.CachedInputCostUSD,
-		CacheCreationCostUSD: e.CacheCreationCostUSD,
-		OutputCostUSD:        e.OutputCostUSD,
+		ID:                 e.ID,
+		AccountID:          e.AccountID,
+		Timestamp:          e.Timestamp,
+		UserID:             e.UserID,
+		ResolvedProviderID: e.ResolvedProviderID,
+		Provider:           e.Provider,
+		Model:              e.Model,
+		SessionID:          e.SessionID,
+		InputTokens:        e.InputTokens,
+		OutputTokens:       e.OutputTokens,
+		TotalTokens:        e.TotalTokens,
+		CostUSD:            e.CostUSD,
 	}
 
 	usageGroups := make([]types.AgentNetworkUsageGroup, 0, len(groups))

management/internals/modules/agentnetwork/accesslog_ingest_realstore_test.go

@@ -28,22 +28,17 @@ func newIngestTestEntry() *accesslogs.AccessLogEntry {
 		UserId:       "user-1",
 		AgentNetwork: true,
 		Metadata: map[string]string{
-			metaKeyProvider:            "openai",
-			metaKeyModel:               "gpt-5.4",
-			metaKeyResolvedProviderID:  "prov-1",
-			metaKeySessionID:           "sess-1",
-			metaKeyInputTokens:         "100",
-			metaKeyOutputTokens:        "50",
-			metaKeyTotalTokens:         "1174",
-			metaKeyCachedInputTokens:   "256",
-			metaKeyCacheCreationTokens: "768",
-			metaKeyCostUSDInput:        "0.0071",
-			metaKeyCostUSDCachedInput:  "0.0009",
-			metaKeyCostUSDCacheCreate:  "0.0020",
-			metaKeyCostUSDOutput:       "0.0023",
-			metaKeyStream:              "true",
-			metaKeyRequestPrompt:       "hello",
-			metaKeyResponseCompletion:  "world",
+			metaKeyProvider:           "openai",
+			metaKeyModel:              "gpt-5.4",
+			metaKeyResolvedProviderID: "prov-1",
+			metaKeySessionID:          "sess-1",
+			metaKeyInputTokens:        "100",
+			metaKeyOutputTokens:       "50",
+			metaKeyTotalTokens:        "150",
+			metaKeyCostUSDTotal:       "0.0123",
+			metaKeyStream:             "true",
+			metaKeyRequestPrompt:      "hello",
+			metaKeyResponseCompletion: "world",
 			// repeated id must be de-duplicated before the group rows insert.
 			metaKeyAuthorisingGroups: "grp-eng,grp-eng,grp-ops",
 		},
@@ -70,19 +65,7 @@ func TestIngestAccessLog_RealStore_LogCollectionOff(t *testing.T) {
 	require.Len(t, usage, 1, "usage row must be written even with log collection off")
 	assert.Equal(t, int64(100), usage[0].InputTokens, "input tokens must round-trip from metadata")
 	assert.Equal(t, int64(50), usage[0].OutputTokens, "output tokens must round-trip from metadata")
-	assert.Equal(t, int64(256), usage[0].CachedInputTokens, "cache-read tokens must round-trip from metadata")
-	assert.Equal(t, int64(768), usage[0].CacheCreationTokens, "cache-write tokens must round-trip from metadata")
-	// The per-bucket breakdown is the only cost state stored, and must survive
-	// the write/read cycle as real columns — usage rows are the only cost
-	// record for accounts with log collection off, so a dropped column here
-	// loses the split permanently.
-	assert.InDelta(t, 0.0071, usage[0].InputCostUSD, 1e-9, "input cost must round-trip from metadata")
-	assert.InDelta(t, 0.0009, usage[0].CachedInputCostUSD, 1e-9, "cache-read cost must round-trip from metadata")
-	assert.InDelta(t, 0.0020, usage[0].CacheCreationCostUSD, 1e-9, "cache-write cost must round-trip from metadata")
-	assert.InDelta(t, 0.0023, usage[0].OutputCostUSD, 1e-9, "output cost must round-trip from metadata")
-	// Aggregates are derived from the stored columns, never stored themselves.
-	assert.InDelta(t, 0.0123, usage[0].TotalCostUSD(), 1e-9, "total is derived from the stored buckets")
-	assert.InDelta(t, 0.0029, usage[0].CacheCostUSD(), 1e-9, "cache cost is derived from the two cache buckets")
+	assert.InDelta(t, 0.0123, usage[0].CostUSD, 1e-9, "cost must round-trip from metadata")
 
 	logs, _, err := s.GetAgentNetworkAccessLogs(ctx, store.LockingStrengthNone, testAccountID, types.AgentNetworkAccessLogFilter{})
 	require.NoError(t, err)
@@ -113,14 +96,6 @@ func TestIngestAccessLog_RealStore_LogCollectionOn(t *testing.T) {
 	require.Equal(t, int64(1), total, "exactly one access-log row expected")
 	require.Len(t, logs, 1, "full access-log row must be written when log collection is on")
 	assert.Equal(t, "gpt-5.4", logs[0].Model, "model must flatten from metadata")
-	assert.Equal(t, int64(256), logs[0].CachedInputTokens, "cache-read tokens must flatten from metadata")
-	assert.Equal(t, int64(768), logs[0].CacheCreationTokens, "cache-write tokens must flatten from metadata")
-	assert.InDelta(t, 0.0029, logs[0].CacheCostUSD(), 1e-9, "cache cost is derived from the two cache buckets")
-	assert.InDelta(t, 0.0123, logs[0].TotalCostUSD(), 1e-9, "total is derived from the stored buckets")
-	assert.InDelta(t, 0.0071, logs[0].InputCostUSD, 1e-9, "input cost must flatten from metadata")
-	assert.InDelta(t, 0.0009, logs[0].CachedInputCostUSD, 1e-9, "cache-read cost must flatten from metadata")
-	assert.InDelta(t, 0.0020, logs[0].CacheCreationCostUSD, 1e-9, "cache-write cost must flatten from metadata")
-	assert.InDelta(t, 0.0023, logs[0].OutputCostUSD, 1e-9, "output cost must flatten from metadata")
 	assert.Equal(t, "hello", logs[0].RequestPrompt, "prompt must be retained when log collection is on")
 	assert.Equal(t, "world", logs[0].ResponseCompletion, "completion must be retained when log collection is on")
 	assert.True(t, logs[0].Stream, "stream flag must flatten from metadata")

management/internals/modules/agentnetwork/accesslog_sessions_realstore_test.go

@@ -38,7 +38,7 @@ func accessLogRow(id, sessionID string, ts time.Time, opts ...func(*types.AgentN
 		InputTokens:        100,
 		OutputTokens:       50,
 		TotalTokens:        150,
-		InputCostUSD:       0.01,
+		CostUSD:            0.01,
 	}
 	for _, o := range opts {
 		o(e)
@@ -74,7 +74,7 @@ func withTokens(in, out, total int64, cost float64) func(*types.AgentNetworkAcce
 		e.InputTokens = in
 		e.OutputTokens = out
 		e.TotalTokens = total
-		e.InputCostUSD = cost
+		e.CostUSD = cost
 	}
 }
 
@@ -155,7 +155,7 @@ func TestAccessLogSessions_FoldAndAggregate(t *testing.T) {
 	assert.Equal(t, int64(310), a.InputTokens, "input tokens summed")
 	assert.Equal(t, int64(135), a.OutputTokens, "output tokens summed")
 	assert.Equal(t, int64(445), a.TotalTokens, "total tokens summed")
-	assert.InDelta(t, 0.031, a.TotalCostUSD(), 1e-9, "cost summed")
+	assert.InDelta(t, 0.031, a.CostUSD, 1e-9, "cost summed")
 	assert.Equal(t, "deny", a.Decision, "any deny makes the session a deny")
 	assert.ElementsMatch(t, []string{"openai", "anthropic"}, a.Providers, "distinct providers")
 	assert.ElementsMatch(t, []string{"gpt-5.4", "claude-haiku-4-5"}, a.Models, "distinct models")

management/internals/modules/agentnetwork/types/accesslog.go

@@ -41,24 +41,8 @@ type AgentNetworkAccessLog struct {
 	InputTokens        int64
 	OutputTokens       int64
 	TotalTokens        int64
-	// Prompt-cache buckets: read + write token counts.
-	CachedInputTokens   int64
-	CacheCreationTokens int64
-	// Per-bucket cost breakdown — one column per token bucket the provider
-	// bills separately. These four are the only cost state stored: the total
-	// and the cache portion are derived on read (TotalCostUSD / CacheCostUSD)
-	// rather than stored alongside, so a stored aggregate can never drift out
-	// of step with the components it summarises.
-	//
-	// default:0 matters on upgrade: these columns are ALTER TABLE ADD COLUMN
-	// on an existing table, and without it every historical row holds NULL —
-	// which a raw SUM()/scan into float64 can't read. The default backfills
-	// them as 0, so pre-upgrade rows report an unknown split, not an error.
-	InputCostUSD         float64 `gorm:"not null;default:0"`
-	CachedInputCostUSD   float64 `gorm:"not null;default:0"`
-	CacheCreationCostUSD float64 `gorm:"not null;default:0"`
-	OutputCostUSD        float64 `gorm:"not null;default:0"`
-	Stream               bool
+	CostUSD            float64
+	Stream             bool
 
 	// Prompt capture. Only populated when prompt collection is enabled
 	// (account master switch AND policy guardrail). Heavy free text.
@@ -76,44 +60,19 @@ type AgentNetworkAccessLog struct {
 // the reverse-proxy AccessLogEntry table.
 func (AgentNetworkAccessLog) TableName() string { return "agent_network_access_log" }
 
-// CostUSDSQLExpr is the SQL sum of the per-bucket cost columns — the total cost
-// of a row. Used wherever a query has to sort or aggregate on total cost now
-// that no cost_usd column is stored. Plain arithmetic over NOT NULL columns, so
-// it stays portable across SQLite and Postgres.
-const CostUSDSQLExpr = "(input_cost_usd + cached_input_cost_usd + cache_creation_cost_usd + output_cost_usd)"
-
-// TotalCostUSD is the request's total cost: the sum of the four per-bucket
-// costs. Derived rather than stored so it cannot disagree with the breakdown.
-func (a *AgentNetworkAccessLog) TotalCostUSD() float64 {
-	return a.InputCostUSD + a.CachedInputCostUSD + a.CacheCreationCostUSD + a.OutputCostUSD
-}
-
-// CacheCostUSD is the portion of the total billed for prompt-cache buckets:
-// cache reads plus cache writes.
-func (a *AgentNetworkAccessLog) CacheCostUSD() float64 {
-	return a.CachedInputCostUSD + a.CacheCreationCostUSD
-}
-
 // ToAPIResponse renders the flattened entry as the API representation.
 func (a *AgentNetworkAccessLog) ToAPIResponse() api.AgentNetworkAccessLog {
 	out := api.AgentNetworkAccessLog{
-		Id:                   a.ID,
-		ServiceId:            a.ServiceID,
-		Timestamp:            a.Timestamp,
-		StatusCode:           a.StatusCode,
-		DurationMs:           int(a.Duration.Milliseconds()),
-		InputTokens:          a.InputTokens,
-		OutputTokens:         a.OutputTokens,
-		TotalTokens:          a.TotalTokens,
-		CachedInputTokens:    a.CachedInputTokens,
-		CacheCreationTokens:  a.CacheCreationTokens,
-		InputCostUsd:         a.InputCostUSD,
-		CachedInputCostUsd:   a.CachedInputCostUSD,
-		CacheCreationCostUsd: a.CacheCreationCostUSD,
-		OutputCostUsd:        a.OutputCostUSD,
-		CostUsd:              a.TotalCostUSD(),
-		CacheCostUsd:         a.CacheCostUSD(),
-		Stream:               &a.Stream,
+		Id:           a.ID,
+		ServiceId:    a.ServiceID,
+		Timestamp:    a.Timestamp,
+		StatusCode:   a.StatusCode,
+		DurationMs:   int(a.Duration.Milliseconds()),
+		InputTokens:  a.InputTokens,
+		OutputTokens: a.OutputTokens,
+		TotalTokens:  a.TotalTokens,
+		CostUsd:      a.CostUSD,
+		Stream:       &a.Stream,
 	}
 
 	out.UserId = strPtr(a.UserID)
@@ -153,36 +112,20 @@ func strPtr(s string) *string {
 // summary plus its ordered entries. Assembled in Go from a page of entries — it
 // is not a stored table.
 type AgentNetworkAccessLogSession struct {
-	SessionID            string // empty for a session-less (singleton) request
-	UserID               string
-	GroupIDs             []string // union of the entries' authorising groups
-	StartedAt            time.Time
-	EndedAt              time.Time
-	RequestCount         int
-	InputTokens          int64
-	OutputTokens         int64
-	TotalTokens          int64
-	CachedInputTokens    int64
-	CacheCreationTokens  int64
-	InputCostUSD         float64
-	CachedInputCostUSD   float64
-	CacheCreationCostUSD float64
-	OutputCostUSD        float64
-	Providers            []string // distinct vendors seen in the session
-	Models               []string // distinct models seen in the session
-	Decision             string   // "deny" if any entry was denied, else "allow"
-	Entries              []*AgentNetworkAccessLog
-}
-
-// TotalCostUSD is the session's total cost: the sum of the four per-bucket
-// costs accumulated across its entries.
-func (sess *AgentNetworkAccessLogSession) TotalCostUSD() float64 {
-	return sess.InputCostUSD + sess.CachedInputCostUSD + sess.CacheCreationCostUSD + sess.OutputCostUSD
-}
-
-// CacheCostUSD is the session's prompt-cache spend: cache reads plus writes.
-func (sess *AgentNetworkAccessLogSession) CacheCostUSD() float64 {
-	return sess.CachedInputCostUSD + sess.CacheCreationCostUSD
+	SessionID    string // empty for a session-less (singleton) request
+	UserID       string
+	GroupIDs     []string // union of the entries' authorising groups
+	StartedAt    time.Time
+	EndedAt      time.Time
+	RequestCount int
+	InputTokens  int64
+	OutputTokens int64
+	TotalTokens  int64
+	CostUSD      float64
+	Providers    []string // distinct vendors seen in the session
+	Models       []string // distinct models seen in the session
+	Decision     string   // "deny" if any entry was denied, else "allow"
+	Entries      []*AgentNetworkAccessLog
 }
 
 // sessionKey is the grouping key for an entry: its session id, or — when the
@@ -262,12 +205,7 @@ func (sess *AgentNetworkAccessLogSession) foldEntry(sk *sessionSeen, e *AgentNet
 	sess.InputTokens += e.InputTokens
 	sess.OutputTokens += e.OutputTokens
 	sess.TotalTokens += e.TotalTokens
-	sess.CachedInputTokens += e.CachedInputTokens
-	sess.CacheCreationTokens += e.CacheCreationTokens
-	sess.InputCostUSD += e.InputCostUSD
-	sess.CachedInputCostUSD += e.CachedInputCostUSD
-	sess.CacheCreationCostUSD += e.CacheCreationCostUSD
-	sess.OutputCostUSD += e.OutputCostUSD
+	sess.CostUSD += e.CostUSD
 	if e.Timestamp.Before(sess.StartedAt) {
 		sess.StartedAt = e.Timestamp
 	}
@@ -310,22 +248,15 @@ func (sess *AgentNetworkAccessLogSession) ToAPIResponse() api.AgentNetworkAccess
 	}
 
 	out := api.AgentNetworkAccessLogSession{
-		StartedAt:            sess.StartedAt,
-		EndedAt:              sess.EndedAt,
-		RequestCount:         sess.RequestCount,
-		InputTokens:          sess.InputTokens,
-		OutputTokens:         sess.OutputTokens,
-		TotalTokens:          sess.TotalTokens,
-		CachedInputTokens:    sess.CachedInputTokens,
-		CacheCreationTokens:  sess.CacheCreationTokens,
-		InputCostUsd:         sess.InputCostUSD,
-		CachedInputCostUsd:   sess.CachedInputCostUSD,
-		CacheCreationCostUsd: sess.CacheCreationCostUSD,
-		OutputCostUsd:        sess.OutputCostUSD,
-		CostUsd:              sess.TotalCostUSD(),
-		CacheCostUsd:         sess.CacheCostUSD(),
-		Decision:             sess.Decision,
-		Entries:              entries,
+		StartedAt:    sess.StartedAt,
+		EndedAt:      sess.EndedAt,
+		RequestCount: sess.RequestCount,
+		InputTokens:  sess.InputTokens,
+		OutputTokens: sess.OutputTokens,
+		TotalTokens:  sess.TotalTokens,
+		CostUsd:      sess.CostUSD,
+		Decision:     sess.Decision,
+		Entries:      entries,
 	}
 	out.SessionId = strPtr(sess.SessionID)
 	out.UserId = strPtr(sess.UserID)

management/internals/modules/agentnetwork/types/accesslogfilter.go

@@ -54,7 +54,7 @@ var accessLogSortFields = map[string]string{
 	"provider":     "provider",
 	"status_code":  "status_code",
 	"duration":     "duration",
-	"cost_usd":     CostUSDSQLExpr,
+	"cost_usd":     "cost_usd",
 	"total_tokens": "total_tokens",
 	"user_id":      "user_id",
 	"decision":     "decision",
@@ -70,7 +70,7 @@ var accessLogSortFields = map[string]string{
 var sessionSortExprs = map[string]string{ //nolint:gosec // G101 false positive: "total_tokens" sort key, not a credential
 	"timestamp":     "MAX(timestamp)",
 	"started_at":    "MIN(timestamp)",
-	"cost_usd":      "SUM" + CostUSDSQLExpr,
+	"cost_usd":      "SUM(cost_usd)",
 	"total_tokens":  "SUM(total_tokens)",
 	"duration":      "SUM(duration)",
 	"request_count": "COUNT(*)",

management/internals/modules/agentnetwork/types/cost_test.go

@@ -1,124 +0,0 @@
-package types
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// costRow builds an access-log entry carrying only a cost breakdown — the rest
-// of the row is irrelevant to the summation identities under test.
-func costRow(id, session string, ts time.Time, in, cachedIn, cacheCreate, out float64) *AgentNetworkAccessLog {
-	return &AgentNetworkAccessLog{
-		ID:                   id,
-		SessionID:            session,
-		Timestamp:            ts,
-		InputCostUSD:         in,
-		CachedInputCostUSD:   cachedIn,
-		CacheCreationCostUSD: cacheCreate,
-		OutputCostUSD:        out,
-	}
-}
-
-// TestAPIResponse_CostComponentsSumToAggregates is the contract a client adding
-// up an API response depends on: within a single rendered object, the four
-// per-bucket fields sum to cost_usd, and the two cache fields sum to
-// cache_cost_usd. Uses rates that are not exactly representable in binary
-// floating point, so the identity is checked against real arithmetic rather
-// than round numbers.
-func TestAPIResponse_CostComponentsSumToAggregates(t *testing.T) {
-	row := costRow("r1", "s1", time.Now(), 0.000768, 0.0002304, 0.00192, 0.003)
-
-	api := row.ToAPIResponse()
-	assert.InDelta(t, api.InputCostUsd+api.CachedInputCostUsd+api.CacheCreationCostUsd+api.OutputCostUsd,
-		api.CostUsd, 1e-12, "rendered buckets must sum to the rendered cost_usd")
-	assert.InDelta(t, api.CachedInputCostUsd+api.CacheCreationCostUsd, api.CacheCostUsd, 1e-12,
-		"rendered cache buckets must sum to the rendered cache_cost_usd")
-	assert.InDelta(t, 0.0059184, api.CostUsd, 1e-12, "total is the exact sum, not a separately rounded figure")
-	assert.InDelta(t, 0.0021504, api.CacheCostUsd, 1e-12, "cache cost is the exact sum of the two cache buckets")
-}
-
-// TestSessionSummary_SumsMatchSummedEntries proves a session summary equals the
-// sum of the entries it renders: a client that adds up the entries itself must
-// land on the same number the summary reports, per bucket and in total.
-func TestSessionSummary_SumsMatchSummedEntries(t *testing.T) {
-	base := time.Date(2026, 5, 5, 10, 0, 0, 0, time.UTC)
-	entries := []*AgentNetworkAccessLog{
-		costRow("r1", "s1", base, 0.000768, 0.0002304, 0.00192, 0.003),
-		costRow("r2", "s1", base.Add(time.Minute), 0.000625, 0.0009375, 0, 0.005),
-		costRow("r3", "s1", base.Add(2*time.Minute), 0.0000016, 0, 0, 0.0000032),
-	}
-
-	sessions := FoldAccessLogSessions([]string{"s1"}, entries)
-	require.Len(t, sessions, 1)
-	sess := sessions[0].ToAPIResponse()
-
-	var wantInput, wantCachedInput, wantCacheCreation, wantOutput float64
-	for _, e := range entries {
-		wantInput += e.InputCostUSD
-		wantCachedInput += e.CachedInputCostUSD
-		wantCacheCreation += e.CacheCreationCostUSD
-		wantOutput += e.OutputCostUSD
-	}
-
-	assert.InDelta(t, wantInput, sess.InputCostUsd, 1e-12, "session input cost is the sum of its entries")
-	assert.InDelta(t, wantCachedInput, sess.CachedInputCostUsd, 1e-12, "session cache-read cost is the sum of its entries")
-	assert.InDelta(t, wantCacheCreation, sess.CacheCreationCostUsd, 1e-12, "session cache-write cost is the sum of its entries")
-	assert.InDelta(t, wantOutput, sess.OutputCostUsd, 1e-12, "session output cost is the sum of its entries")
-	assert.InDelta(t, wantInput+wantCachedInput+wantCacheCreation+wantOutput, sess.CostUsd, 1e-12,
-		"session total equals the summed entry buckets")
-
-	// Summing the rendered entries must give the same answer as reading the
-	// summary — the property a UI relies on when it totals a table itself.
-	var fromEntries float64
-	for _, e := range sess.Entries {
-		fromEntries += e.CostUsd
-	}
-	assert.InDelta(t, sess.CostUsd, fromEntries, 1e-12, "summary total must match the summed rendered entries")
-
-	// The sub-microdollar row must still contribute; it would vanish under
-	// 6-decimal quantisation.
-	assert.Greater(t, sess.InputCostUsd, 0.001393, "small-cost rows must not be quantised away")
-}
-
-// TestUsageBuckets_SumsMatchSummedRows proves the same identity one level up:
-// a usage bucket equals the sum of the ledger rows folded into it, and the
-// buckets together equal the whole range.
-func TestUsageBuckets_SumsMatchSummedRows(t *testing.T) {
-	day1 := time.Date(2026, 5, 5, 9, 0, 0, 0, time.UTC)
-	day2 := time.Date(2026, 5, 6, 9, 0, 0, 0, time.UTC)
-	rows := []*AgentNetworkUsage{
-		{ID: "u1", Timestamp: day1, InputCostUSD: 0.000768, CachedInputCostUSD: 0.0002304, CacheCreationCostUSD: 0.00192, OutputCostUSD: 0.003},
-		{ID: "u2", Timestamp: day1.Add(time.Hour), InputCostUSD: 0.000625, CachedInputCostUSD: 0.0009375, OutputCostUSD: 0.005},
-		{ID: "u3", Timestamp: day2, InputCostUSD: 0.0000016, OutputCostUSD: 0.0000032},
-	}
-
-	buckets := AggregateUsageByGranularity(rows, UsageGranularityDay)
-	require.Len(t, buckets, 2, "two distinct days expected")
-
-	var total, cache float64
-	for _, b := range buckets {
-		api := b.ToAPIResponse()
-		assert.InDelta(t, api.InputCostUsd+api.CachedInputCostUsd+api.CacheCreationCostUsd+api.OutputCostUsd,
-			api.CostUsd, 1e-12, "each bucket's components must sum to its cost_usd")
-		total += api.CostUsd
-		cache += api.CacheCostUsd
-	}
-
-	var wantTotal, wantCache float64
-	for _, r := range rows {
-		wantTotal += r.TotalCostUSD()
-		wantCache += r.CacheCostUSD()
-	}
-	assert.InDelta(t, wantTotal, total, 1e-12, "buckets must sum to the total across all ledger rows")
-	assert.InDelta(t, wantCache, cache, 1e-12, "buckets must sum to the cache spend across all ledger rows")
-
-	// A month bucket over the same rows must total identically — regrouping
-	// changes the partition, never the sum.
-	monthly := AggregateUsageByGranularity(rows, UsageGranularityMonth)
-	require.Len(t, monthly, 1)
-	assert.InDelta(t, wantTotal, monthly[0].ToAPIResponse().CostUsd, 1e-12,
-		"re-bucketing at a different granularity must preserve the total")
-}

management/internals/modules/agentnetwork/types/usage.go

@@ -25,19 +25,8 @@ type AgentNetworkUsage struct {
 	InputTokens        int64
 	OutputTokens       int64
 	TotalTokens        int64
-	// Prompt-cache buckets: read + write token counts.
-	CachedInputTokens   int64
-	CacheCreationTokens int64
-	// Per-bucket cost breakdown, mirroring AgentNetworkAccessLog — the only
-	// cost state stored; total and cache portion are derived on read. Kept on
-	// the usage ledger too so spend can be attributed per bucket even for
-	// accounts with log collection turned off. See AgentNetworkAccessLog for
-	// why the columns carry a zero default.
-	InputCostUSD         float64 `gorm:"not null;default:0"`
-	CachedInputCostUSD   float64 `gorm:"not null;default:0"`
-	CacheCreationCostUSD float64 `gorm:"not null;default:0"`
-	OutputCostUSD        float64 `gorm:"not null;default:0"`
-	CreatedAt            time.Time
+	CostUSD            float64
+	CreatedAt          time.Time
 }
 
 // TableName keeps usage records in their own stripped table. Named
@@ -45,17 +34,6 @@ type AgentNetworkUsage struct {
 // agent_network_usage table in a shared database.
 func (AgentNetworkUsage) TableName() string { return "agent_network_request_usage" }
 
-// TotalCostUSD is the request's total cost: the sum of the four per-bucket
-// costs. Derived rather than stored so it cannot disagree with the breakdown.
-func (u *AgentNetworkUsage) TotalCostUSD() float64 {
-	return u.InputCostUSD + u.CachedInputCostUSD + u.CacheCreationCostUSD + u.OutputCostUSD
-}
-
-// CacheCostUSD is the portion of the total billed for prompt-cache buckets.
-func (u *AgentNetworkUsage) CacheCostUSD() float64 {
-	return u.CachedInputCostUSD + u.CacheCreationCostUSD
-}
-
 // AgentNetworkUsageGroup is the normalised many-to-many row linking a usage
 // record to one authorising group, mirroring AgentNetworkAccessLogGroup so the
 // usage overview can filter by group with a `group_id IN (...)` join.

management/internals/modules/agentnetwork/types/usageoverview.go

@@ -33,45 +33,21 @@ func ParseUsageGranularity(s string) UsageGranularity {
 // AgentNetworkUsageBucket is one aggregated usage time bucket. PeriodStart is
 // the UTC start of the bucket as YYYY-MM-DD.
 type AgentNetworkUsageBucket struct {
-	PeriodStart          string
-	InputTokens          int64
-	OutputTokens         int64
-	TotalTokens          int64
-	CachedInputTokens    int64
-	CacheCreationTokens  int64
-	InputCostUSD         float64
-	CachedInputCostUSD   float64
-	CacheCreationCostUSD float64
-	OutputCostUSD        float64
-}
-
-// TotalCostUSD is the bucket's total spend: the sum of the four per-bucket
-// costs. Derived rather than accumulated separately so it cannot disagree with
-// the components.
-func (b *AgentNetworkUsageBucket) TotalCostUSD() float64 {
-	return b.InputCostUSD + b.CachedInputCostUSD + b.CacheCreationCostUSD + b.OutputCostUSD
-}
-
-// CacheCostUSD is the bucket's prompt-cache spend: cache reads plus writes.
-func (b *AgentNetworkUsageBucket) CacheCostUSD() float64 {
-	return b.CachedInputCostUSD + b.CacheCreationCostUSD
+	PeriodStart  string
+	InputTokens  int64
+	OutputTokens int64
+	TotalTokens  int64
+	CostUSD      float64
 }
 
 // ToAPIResponse renders the bucket as the API representation.
 func (b *AgentNetworkUsageBucket) ToAPIResponse() api.AgentNetworkUsageBucket {
 	return api.AgentNetworkUsageBucket{
-		PeriodStart:          b.PeriodStart,
-		InputTokens:          b.InputTokens,
-		OutputTokens:         b.OutputTokens,
-		TotalTokens:          b.TotalTokens,
-		CachedInputTokens:    b.CachedInputTokens,
-		CacheCreationTokens:  b.CacheCreationTokens,
-		InputCostUsd:         b.InputCostUSD,
-		CachedInputCostUsd:   b.CachedInputCostUSD,
-		CacheCreationCostUsd: b.CacheCreationCostUSD,
-		OutputCostUsd:        b.OutputCostUSD,
-		CostUsd:              b.TotalCostUSD(),
-		CacheCostUsd:         b.CacheCostUSD(),
+		PeriodStart:  b.PeriodStart,
+		InputTokens:  b.InputTokens,
+		OutputTokens: b.OutputTokens,
+		TotalTokens:  b.TotalTokens,
+		CostUsd:      b.CostUSD,
 	}
 }
 
@@ -108,12 +84,7 @@ func AggregateUsageByGranularity(rows []*AgentNetworkUsage, g UsageGranularity)
 		b.InputTokens += r.InputTokens
 		b.OutputTokens += r.OutputTokens
 		b.TotalTokens += r.TotalTokens
-		b.CachedInputTokens += r.CachedInputTokens
-		b.CacheCreationTokens += r.CacheCreationTokens
-		b.InputCostUSD += r.InputCostUSD
-		b.CachedInputCostUSD += r.CachedInputCostUSD
-		b.CacheCreationCostUSD += r.CacheCreationCostUSD
-		b.OutputCostUSD += r.OutputCostUSD
+		b.CostUSD += r.CostUSD
 	}
 
 	out := make([]*AgentNetworkUsageBucket, 0, len(byPeriod))

management/internals/modules/reverseproxy/service/service.go

@@ -165,10 +165,6 @@ type AccessRestrictions struct {
 	AllowedCountries []string `json:"allowed_countries,omitempty" gorm:"serializer:json"`
 	BlockedCountries []string `json:"blocked_countries,omitempty" gorm:"serializer:json"`
 	CrowdSecMode     string   `json:"crowdsec_mode,omitempty" gorm:"serializer:json"`
-	// AllowMatch controls how the allowlists combine: "" or "all" require
-	// matching every allowlist (AND), "any" requires matching at least one (OR).
-	// Empty is treated as "all" for backward compatibility with existing records.
-	AllowMatch string `json:"allow_match,omitempty" gorm:"serializer:json"`
 }
 
 // Copy returns a deep copy of the AccessRestrictions.
@@ -179,7 +175,6 @@ func (r AccessRestrictions) Copy() AccessRestrictions {
 		AllowedCountries: slices.Clone(r.AllowedCountries),
 		BlockedCountries: slices.Clone(r.BlockedCountries),
 		CrowdSecMode:     r.CrowdSecMode,
-		AllowMatch:       r.AllowMatch,
 	}
 }
 
@@ -813,19 +808,13 @@ func restrictionsFromAPI(r *api.AccessRestrictions) (AccessRestrictions, error)
 		}
 		res.CrowdSecMode = string(*r.CrowdsecMode)
 	}
-	if r.AllowMatch != nil {
-		if !r.AllowMatch.Valid() {
-			return AccessRestrictions{}, fmt.Errorf("invalid allow_match %q", *r.AllowMatch)
-		}
-		res.AllowMatch = string(*r.AllowMatch)
-	}
 	return res, nil
 }
 
 func restrictionsToAPI(r AccessRestrictions) *api.AccessRestrictions {
 	if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 &&
 		len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 &&
-		r.CrowdSecMode == "" && r.AllowMatch == "" {
+		r.CrowdSecMode == "" {
 		return nil
 	}
 	res := &api.AccessRestrictions{}
@@ -845,17 +834,13 @@ func restrictionsToAPI(r AccessRestrictions) *api.AccessRestrictions {
 		mode := api.AccessRestrictionsCrowdsecMode(r.CrowdSecMode)
 		res.CrowdsecMode = &mode
 	}
-	if r.AllowMatch != "" {
-		match := api.AccessRestrictionsAllowMatch(r.AllowMatch)
-		res.AllowMatch = &match
-	}
 	return res
 }
 
 func restrictionsToProto(r AccessRestrictions) *proto.AccessRestrictions {
 	if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 &&
 		len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 &&
-		r.CrowdSecMode == "" && r.AllowMatch == "" {
+		r.CrowdSecMode == "" {
 		return nil
 	}
 	return &proto.AccessRestrictions{
@@ -864,7 +849,6 @@ func restrictionsToProto(r AccessRestrictions) *proto.AccessRestrictions {
 		AllowedCountries: r.AllowedCountries,
 		BlockedCountries: r.BlockedCountries,
 		CrowdsecMode:     r.CrowdSecMode,
-		AllowMatch:       r.AllowMatch,
 	}
 }
 
@@ -1258,22 +1242,10 @@ func validateCrowdSecMode(mode string) error {
 	}
 }
 
-func validateAllowMatch(mode string) error {
-	switch mode {
-	case "", "all", "any":
-		return nil
-	default:
-		return fmt.Errorf("allow_match %q is invalid", mode)
-	}
-}
-
 func validateAccessRestrictions(r *AccessRestrictions) error {
 	if err := validateCrowdSecMode(r.CrowdSecMode); err != nil {
 		return err
 	}
-	if err := validateAllowMatch(r.AllowMatch); err != nil {
-		return err
-	}
 
 	if len(r.AllowedCIDRs) > maxCIDREntries {
 		return fmt.Errorf("allowed_cidrs: exceeds maximum of %d entries", maxCIDREntries)

management/internals/modules/reverseproxy/service/service_test.go

@@ -1302,65 +1302,6 @@ func TestValidate_Private_AcceptsClusterTargetWithAccessGroups(t *testing.T) {
 	require.NoError(t, rp.Validate())
 }
 
-func TestRestrictions_AllowMatch_RoundTrip(t *testing.T) {
-	anyMatch := api.AccessRestrictionsAllowMatchAny
-	apiIn := &api.AccessRestrictions{
-		AllowedCidrs:     &[]string{"203.0.113.0/24"},
-		AllowedCountries: &[]string{"US"},
-		AllowMatch:       &anyMatch,
-	}
-
-	model, err := restrictionsFromAPI(apiIn)
-	require.NoError(t, err)
-	assert.Equal(t, "any", model.AllowMatch)
-
-	apiOut := restrictionsToAPI(model)
-	require.NotNil(t, apiOut.AllowMatch)
-	assert.Equal(t, api.AccessRestrictionsAllowMatchAny, *apiOut.AllowMatch)
-
-	protoOut := restrictionsToProto(model)
-	require.NotNil(t, protoOut)
-	assert.Equal(t, "any", protoOut.AllowMatch)
-}
-
-func TestRestrictions_AllowMatch_EmptyDefaultsToAll(t *testing.T) {
-	// A stored record with no allow_match (existing services) stays empty and
-	// must not surface a value on the API, preserving AND behavior downstream.
-	model, err := restrictionsFromAPI(&api.AccessRestrictions{
-		AllowedCidrs: &[]string{"203.0.113.0/24"},
-	})
-	require.NoError(t, err)
-	assert.Empty(t, model.AllowMatch, "unset allow_match stays empty")
-
-	apiOut := restrictionsToAPI(model)
-	require.NotNil(t, apiOut)
-	assert.Nil(t, apiOut.AllowMatch, "empty allow_match is omitted from the API response")
-}
-
-func TestRestrictions_AllowMatchOnly_Preserved(t *testing.T) {
-	// allow_match set without any list must not be dropped by the emptiness
-	// guards, so it round-trips through both the API and proto conversions.
-	model := AccessRestrictions{AllowMatch: "any"}
-
-	apiOut := restrictionsToAPI(model)
-	require.NotNil(t, apiOut, "allow-match-only restriction must not be omitted from the API response")
-	require.NotNil(t, apiOut.AllowMatch)
-	assert.Equal(t, api.AccessRestrictionsAllowMatchAny, *apiOut.AllowMatch)
-
-	protoOut := restrictionsToProto(model)
-	require.NotNil(t, protoOut, "allow-match-only restriction must not be omitted from the proto output")
-	assert.Equal(t, "any", protoOut.AllowMatch)
-}
-
-func TestValidate_RejectsInvalidAllowMatch(t *testing.T) {
-	rp := validProxy()
-	rp.Restrictions = AccessRestrictions{
-		AllowedCIDRs: []string{"203.0.113.0/24"},
-		AllowMatch:   "sometimes",
-	}
-	assert.ErrorContains(t, rp.Validate(), "allow_match")
-}
-
 func TestValidate_Private_RejectsNonHTTPMode(t *testing.T) {
 	rp := validProxy()
 	rp.Private = true

management/internals/shared/grpc/components_envelope_response.go

@@ -50,7 +50,7 @@ func ToComponentSyncResponse(
 	// TODO (dmitri) consider using invariants?
 	//
 	enableSSH := computeSSHEnabledForPeer(components, peer)
-	peerConfig := toPeerConfig(peer, components.Network, dnsName, settings, httpConfig, deviceFlowConfig, enableSSH)
+	peerConfig := toPeerConfig(peer, components.Network, dnsName, settings, httpConfig, deviceFlowConfig, enableSSH, components.ForceRoutingPeerDNSResolution)
 
 	includeIPv6 := peer.SupportsIPv6() && peer.IPv6.IsValid()
 	useSourcePrefixes := peer.SupportsSourcePrefixes()

management/internals/shared/grpc/conversion.go

@@ -119,7 +119,7 @@ func toNetbirdConfig(config *nbconfig.Config, turnCredentials *Token, relayToken
 	return nbConfig
 }
 
-func toPeerConfig(peer *nbpeer.Peer, network *types.Network, dnsName string, settings *types.Settings, httpConfig *nbconfig.HttpServerConfig, deviceFlowConfig *nbconfig.DeviceAuthorizationFlow, enableSSH bool) *proto.PeerConfig {
+func toPeerConfig(peer *nbpeer.Peer, network *types.Network, dnsName string, settings *types.Settings, httpConfig *nbconfig.HttpServerConfig, deviceFlowConfig *nbconfig.DeviceAuthorizationFlow, enableSSH bool, forceRoutingPeerDNS bool) *proto.PeerConfig {
 	netmask, _ := network.Net.Mask.Size()
 	fqdn := peer.FQDN(dnsName)
 
@@ -135,7 +135,7 @@ func toPeerConfig(peer *nbpeer.Peer, network *types.Network, dnsName string, set
 		Address:                         fmt.Sprintf("%s/%d", peer.IP.String(), netmask),
 		SshConfig:                       sshConfig,
 		Fqdn:                            fqdn,
-		RoutingPeerDnsResolutionEnabled: settings.RoutingPeerDNSResolutionEnabled,
+		RoutingPeerDnsResolutionEnabled: settings.RoutingPeerDNSResolutionEnabled || peer.ProxyMeta.Embedded || forceRoutingPeerDNS,
 		LazyConnectionEnabled:           settings.LazyConnectionEnabled,
 		AutoUpdate: &proto.AutoUpdateSettings{
 			Version:      settings.AutoUpdateVersion,
@@ -162,12 +162,12 @@ func ToSyncResponse(ctx context.Context, config *nbconfig.Config, httpConfig *nb
 	useSourcePrefixes := peer.SupportsSourcePrefixes()
 
 	response := &proto.SyncResponse{
-		PeerConfig: toPeerConfig(peer, networkMap.Network, dnsName, settings, httpConfig, deviceFlowConfig, networkMap.EnableSSH),
+		PeerConfig: toPeerConfig(peer, networkMap.Network, dnsName, settings, httpConfig, deviceFlowConfig, networkMap.EnableSSH, networkMap.ForceRoutingPeerDNSResolution),
 		NetworkMap: &proto.NetworkMap{
 			Serial:     networkMap.Network.CurrentSerial(),
 			Routes:     networkmap.ToProtocolRoutes(networkMap.Routes),
 			DNSConfig:  networkmap.ToProtocolDNSConfig(networkMap.DNSConfig, dnsCache, dnsFwdPort),
-			PeerConfig: toPeerConfig(peer, networkMap.Network, dnsName, settings, httpConfig, deviceFlowConfig, networkMap.EnableSSH),
+			PeerConfig: toPeerConfig(peer, networkMap.Network, dnsName, settings, httpConfig, deviceFlowConfig, networkMap.EnableSSH, networkMap.ForceRoutingPeerDNSResolution),
 		},
 		Checks: toProtocolChecks(ctx, checks),
 	}

management/internals/shared/grpc/conversion_test.go

@@ -2,6 +2,7 @@ package grpc
 
 import (
 	"fmt"
+	"net"
 	"net/netip"
 	"reflect"
 	"testing"
@@ -14,6 +15,7 @@ import (
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller/cache"
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/shared/management/networkmap"
 )
@@ -301,3 +303,35 @@ func TestToNetbirdConfig_RelayInvariant(t *testing.T) {
 		assert.True(t, nbCfg.Metrics.Enabled, "metrics flag should carry the settings value")
 	})
 }
+
+func TestToPeerConfig_RoutingPeerDNSResolution(t *testing.T) {
+	network := &types.Network{Net: net.IPNet{IP: net.IPv4(100, 0, 0, 0), Mask: net.CIDRMask(8, 32)}}
+
+	newPeer := func(embedded bool) *nbpeer.Peer {
+		p := &nbpeer.Peer{IP: netip.MustParseAddr("100.0.0.1")}
+		p.ProxyMeta.Embedded = embedded
+		return p
+	}
+
+	tests := []struct {
+		name        string
+		globalFlag  bool
+		embedded    bool
+		forceParam  bool
+		wantEnabled bool
+	}{
+		{name: "global off, regular peer, no force", wantEnabled: false},
+		{name: "global on wins", globalFlag: true, wantEnabled: true},
+		{name: "embedded proxy peer forced", embedded: true, wantEnabled: true},
+		{name: "routing peer forced via param", forceParam: true, wantEnabled: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			settings := &types.Settings{RoutingPeerDNSResolutionEnabled: tt.globalFlag}
+			cfg := toPeerConfig(newPeer(tt.embedded), network, "netbird.selfhosted", settings, nil, nil, false, tt.forceParam)
+			assert.Equal(t, tt.wantEnabled, cfg.RoutingPeerDnsResolutionEnabled,
+				"RoutingPeerDnsResolutionEnabled should reflect global || embedded || forced")
+		})
+	}
+}

management/internals/shared/grpc/server.go

@@ -921,7 +921,7 @@ func (s *Server) prepareLoginResponse(ctx context.Context, peer *nbpeer.Peer, ne
 	// if peer has reached this point then it has logged in
 	loginResp := &proto.LoginResponse{
 		NetbirdConfig: toNetbirdConfig(s.config, nil, relayToken, nil, settings),
-		PeerConfig:    toPeerConfig(peer, network, s.networkMapController.GetDNSDomain(settings), settings, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, enableSSH),
+		PeerConfig:    toPeerConfig(peer, network, s.networkMapController.GetDNSDomain(settings), settings, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, enableSSH, false),
 		Checks:        toProtocolChecks(ctx, postureChecks),
 	}
 

management/server/migration/migration.go

@@ -683,81 +683,3 @@ func BackfillPublicIDs[T any](ctx context.Context, db *gorm.DB) error {
 	log.WithContext(ctx).Infof("Backfill of empty public_id in table %s completed", tableName)
 	return nil
 }
-
-// FoldCostAggregatesIntoBuckets migrates a per-request cost table from the old
-// "stored aggregate" shape (cost_usd + cache_cost_usd columns) to the per-bucket
-// breakdown, where the total and cache portion are derived on read instead.
-//
-// The fold preserves both aggregates exactly for historical rows: the cache
-// total moves into cached_input_cost_usd and the remainder into
-// input_cost_usd, so a row's derived total and cache cost still match what it
-// reported before the upgrade. The finer split is genuinely unknown for those
-// rows — the old schema never recorded a read/write or input/output division —
-// so it is lumped rather than guessed; only rows written after the upgrade
-// carry a true four-way split.
-//
-// Dropping the columns before folding would zero every historical row's cost,
-// so the update runs first and the drop only happens once it succeeds. A table
-// with no cost_usd column has already been migrated (or was created fresh) and
-// is skipped.
-func FoldCostAggregatesIntoBuckets[T any](ctx context.Context, db *gorm.DB) error {
-	var model T
-
-	if !db.Migrator().HasTable(&model) {
-		log.WithContext(ctx).Debugf("table for %T does not exist, no cost-bucket migration needed", model)
-		return nil
-	}
-	if !db.Migrator().HasColumn(&model, "cost_usd") {
-		log.WithContext(ctx).Debugf("table for %T has no cost_usd column, cost buckets already migrated", model)
-		return nil
-	}
-
-	stmt := &gorm.Statement{DB: db}
-	if err := stmt.Parse(&model); err != nil {
-		return fmt.Errorf("parse model schema: %w", err)
-	}
-	tableName := stmt.Schema.Table
-
-	// COALESCE guards rows whose new columns were added as NULL by an earlier
-	// AutoMigrate run that predates the NOT NULL default.
-	hasCacheColumn := db.Migrator().HasColumn(&model, "cache_cost_usd")
-	cacheExpr := "0"
-	if hasCacheColumn {
-		cacheExpr = "COALESCE(cache_cost_usd, 0)"
-	}
-
-	if err := db.Transaction(func(tx *gorm.DB) error {
-		// Only touch rows that carry a legacy total and no breakdown yet, so
-		// the migration is idempotent and never overwrites a true split.
-		update := fmt.Sprintf(`UPDATE %s
-			SET input_cost_usd = COALESCE(cost_usd, 0) - %s,
-			    cached_input_cost_usd = %s,
-			    cache_creation_cost_usd = 0,
-			    output_cost_usd = 0
-			WHERE COALESCE(cost_usd, 0) <> 0
-			  AND COALESCE(input_cost_usd, 0) = 0
-			  AND COALESCE(cached_input_cost_usd, 0) = 0
-			  AND COALESCE(cache_creation_cost_usd, 0) = 0
-			  AND COALESCE(output_cost_usd, 0) = 0`, tableName, cacheExpr, cacheExpr)
-		res := tx.Exec(update)
-		if res.Error != nil {
-			return fmt.Errorf("fold legacy cost aggregates in %s: %w", tableName, res.Error)
-		}
-		log.WithContext(ctx).Infof("folded legacy cost aggregates into per-bucket columns for %d rows in table %s", res.RowsAffected, tableName)
-
-		if err := tx.Migrator().DropColumn(&model, "cost_usd"); err != nil {
-			return fmt.Errorf("drop cost_usd from %s: %w", tableName, err)
-		}
-		if hasCacheColumn {
-			if err := tx.Migrator().DropColumn(&model, "cache_cost_usd"); err != nil {
-				return fmt.Errorf("drop cache_cost_usd from %s: %w", tableName, err)
-			}
-		}
-		return nil
-	}); err != nil {
-		return err
-	}
-
-	log.WithContext(ctx).Infof("migration of stored cost aggregates to per-bucket columns in table %s completed", tableName)
-	return nil
-}

management/server/migration/migration_test.go

@@ -16,7 +16,6 @@ import (
 	"gorm.io/driver/sqlite"
 	"gorm.io/gorm"
 
-	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	"github.com/netbirdio/netbird/management/server/migration"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/testutil"
@@ -640,99 +639,3 @@ func TestCleanupOrphanedResources_SkipsWhenForeignKeyExists(t *testing.T) {
 	db.Model(&testChildWithFK{}).Count(&count)
 	assert.Equal(t, int64(2), count, "Both rows should survive — migration must skip when FK constraint exists")
 }
-
-// legacyCostRow is the pre-breakdown shape of the usage table: cost was stored
-// as a total plus a cache portion, with no per-bucket columns. Used to build a
-// realistic pre-upgrade table for the fold migration to run against.
-type legacyCostRow struct {
-	ID           string `gorm:"primaryKey"`
-	AccountID    string
-	Model        string
-	CostUSD      float64
-	CacheCostUSD float64
-}
-
-func (legacyCostRow) TableName() string { return "agent_network_request_usage" }
-
-// TestFoldCostAggregatesIntoBuckets_PreservesHistoricalCost covers the upgrade
-// path: a table written under the old schema must come out with its per-row
-// total and cache cost unchanged, because dropping cost_usd without folding it
-// forward would silently zero every historical row's spend.
-func TestFoldCostAggregatesIntoBuckets_PreservesHistoricalCost(t *testing.T) {
-	ctx := context.Background()
-	db := setupDatabase(t)
-	// setupDatabase hands back a process-shared database, so start from a clean
-	// table rather than inheriting rows from another test.
-	require.NoError(t, db.Migrator().DropTable(&agentNetworkTypes.AgentNetworkUsage{}))
-
-	require.NoError(t, db.AutoMigrate(&legacyCostRow{}), "legacy table must be created")
-	require.NoError(t, db.Create(&legacyCostRow{
-		ID: "u1", AccountID: "acct-1", Model: "claude-sonnet-4-6", CostUSD: 0.0123, CacheCostUSD: 0.0029,
-	}).Error)
-	require.NoError(t, db.Create(&legacyCostRow{
-		ID: "u2", AccountID: "acct-1", Model: "gpt-4o", CostUSD: 0.5, CacheCostUSD: 0,
-	}).Error)
-	// A zero-cost row (denied / unpriced request) must stay zero, not be touched.
-	require.NoError(t, db.Create(&legacyCostRow{ID: "u3", AccountID: "acct-1", Model: "gw/unpriced"}).Error)
-
-	// AutoMigrate adds the per-bucket columns alongside the legacy ones, exactly
-	// as a real upgrade does before the post-auto migrations run.
-	require.NoError(t, db.AutoMigrate(&agentNetworkTypes.AgentNetworkUsage{}), "new columns must be added")
-
-	require.NoError(t, migration.FoldCostAggregatesIntoBuckets[agentNetworkTypes.AgentNetworkUsage](ctx, db))
-
-	assert.False(t, db.Migrator().HasColumn(&agentNetworkTypes.AgentNetworkUsage{}, "cost_usd"),
-		"legacy cost_usd column must be dropped once folded")
-	assert.False(t, db.Migrator().HasColumn(&agentNetworkTypes.AgentNetworkUsage{}, "cache_cost_usd"),
-		"legacy cache_cost_usd column must be dropped once folded")
-
-	var rows []*agentNetworkTypes.AgentNetworkUsage
-	require.NoError(t, db.Order("id").Find(&rows).Error)
-	require.Len(t, rows, 3)
-
-	// u1: total and cache portion both preserved; the read/write and
-	// input/output splits are unknowable for a legacy row, so the cache total
-	// lands on cached_input and the remainder on input.
-	assert.InDelta(t, 0.0123, rows[0].TotalCostUSD(), 1e-9, "historical total must survive the fold")
-	assert.InDelta(t, 0.0029, rows[0].CacheCostUSD(), 1e-9, "historical cache cost must survive the fold")
-	assert.InDelta(t, 0.0094, rows[0].InputCostUSD, 1e-9, "non-cache remainder lands on input")
-	assert.InDelta(t, 0.0029, rows[0].CachedInputCostUSD, 1e-9, "legacy cache total lands on cached input")
-	assert.Zero(t, rows[0].CacheCreationCostUSD, "legacy rows carry no read/write split to recover")
-	assert.Zero(t, rows[0].OutputCostUSD, "legacy rows carry no input/output split to recover")
-
-	// u2: no cache spend — the whole total is the non-cache remainder.
-	assert.InDelta(t, 0.5, rows[1].TotalCostUSD(), 1e-9, "cache-free historical total must survive")
-	assert.Zero(t, rows[1].CacheCostUSD(), "a cache-free row must stay cache-free")
-
-	// u3: zero stays zero rather than being rewritten.
-	assert.Zero(t, rows[2].TotalCostUSD(), "an unpriced row must remain unpriced")
-}
-
-// TestFoldCostAggregatesIntoBuckets_SkipsAlreadyMigrated proves the migration is
-// safe to re-run: with no legacy column present it is a no-op that leaves a
-// true four-way split untouched.
-func TestFoldCostAggregatesIntoBuckets_SkipsAlreadyMigrated(t *testing.T) {
-	ctx := context.Background()
-	db := setupDatabase(t)
-	require.NoError(t, db.Migrator().DropTable(&agentNetworkTypes.AgentNetworkUsage{}))
-
-	require.NoError(t, db.AutoMigrate(&agentNetworkTypes.AgentNetworkUsage{}))
-	// Timestamp must be set explicitly: a zero time.Time serialises as
-	// '0000-00-00 00:00:00', which MySQL rejects under strict mode.
-	require.NoError(t, db.Create(&agentNetworkTypes.AgentNetworkUsage{
-		ID: "u1", AccountID: "acct-1", Model: "claude-sonnet-4-6",
-		Timestamp:    time.Date(2026, 5, 5, 9, 0, 0, 0, time.UTC),
-		InputCostUSD: 0.001, CachedInputCostUSD: 0.002, CacheCreationCostUSD: 0.003, OutputCostUSD: 0.004,
-	}).Error)
-
-	require.NoError(t, migration.FoldCostAggregatesIntoBuckets[agentNetworkTypes.AgentNetworkUsage](ctx, db),
-		"running against an already-migrated table must be a no-op, not an error")
-
-	var row agentNetworkTypes.AgentNetworkUsage
-	require.NoError(t, db.First(&row, "id = ?", "u1").Error)
-	assert.InDelta(t, 0.001, row.InputCostUSD, 1e-9, "a true split must not be rewritten")
-	assert.InDelta(t, 0.002, row.CachedInputCostUSD, 1e-9)
-	assert.InDelta(t, 0.003, row.CacheCreationCostUSD, 1e-9)
-	assert.InDelta(t, 0.004, row.OutputCostUSD, 1e-9)
-	assert.InDelta(t, 0.01, row.TotalCostUSD(), 1e-9, "derived total sums the four buckets")
-}

management/server/store/sql_store.go

@@ -2259,7 +2259,7 @@ func (s *SqlStore) getPostureChecks(ctx context.Context, accountID string) ([]*p
 }
 
 func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpservice.Service, error) {
-	const serviceQuery = `SELECT id, account_id, name, domain, enabled, auth, restrictions,
+	const serviceQuery = `SELECT id, account_id, name, domain, enabled, auth,
 		meta_created_at, meta_certificate_issued_at, meta_status, proxy_cluster,
 		pass_host_header, rewrite_redirects, session_private_key, session_public_key,
 		mode, listen_port, port_auto_assigned, source, source_peer, terminated,
@@ -2278,7 +2278,6 @@ func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpserv
 	services, err := pgx.CollectRows(serviceRows, func(row pgx.CollectableRow) (*rpservice.Service, error) {
 		var s rpservice.Service
 		var auth []byte
-		var restrictions []byte
 		var accessGroups []byte
 		var createdAt, certIssuedAt sql.NullTime
 		var status, proxyCluster, sessionPrivateKey, sessionPublicKey sql.NullString
@@ -2292,7 +2291,6 @@ func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpserv
 			&s.Domain,
 			&s.Enabled,
 			&auth,
-			&restrictions,
 			&createdAt,
 			&certIssuedAt,
 			&status,
@@ -2320,12 +2318,6 @@ func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpserv
 			}
 		}
 
-		if len(restrictions) > 0 {
-			if err := json.Unmarshal(restrictions, &s.Restrictions); err != nil {
-				return nil, fmt.Errorf("unmarshal restrictions: %w", err)
-			}
-		}
-
 		if len(accessGroups) > 0 {
 			if err := json.Unmarshal(accessGroups, &s.AccessGroups); err != nil {
 				return nil, fmt.Errorf("unmarshal access_groups: %w", err)

management/server/store/sql_store_agentnetwork.go

@@ -71,7 +71,7 @@ func (s *SqlStore) GetAgentNetworkMetrics(ctx context.Context) (AgentNetworkMetr
 	usageRow := db.Model(&agentNetworkTypes.AgentNetworkUsage{}).
 		Select("COALESCE(SUM(input_tokens), 0) AS input_tokens, " +
 			"COALESCE(SUM(output_tokens), 0) AS output_tokens, " +
-			"COALESCE(SUM" + agentNetworkTypes.CostUSDSQLExpr + ", 0) AS cost_usd").Row()
+			"COALESCE(SUM(cost_usd), 0) AS cost_usd").Row()
 	if err := usageRow.Scan(&m.InputTokens, &m.OutputTokens, &m.CostUSD); err != nil {
 		return AgentNetworkMetrics{}, fmt.Errorf("scan agent network usage metrics: %w", err)
 	}

management/server/store/sql_store_agentnetwork_accesslog_test.go

@@ -37,7 +37,7 @@ func TestAgentNetworkUsage_RealStore_RoundTrip(t *testing.T) {
 		InputTokens:        1200,
 		OutputTokens:       640,
 		TotalTokens:        1840,
-		InputCostUSD:       0.0231,
+		CostUSD:            0.0231,
 	}
 	usageGroups := []agentNetworkTypes.AgentNetworkUsageGroup{
 		{UsageID: usage.ID, GroupID: "grp-eng", AccountID: accountID},
@@ -71,7 +71,7 @@ func TestAgentNetworkUsage_RealStore_RoundTrip(t *testing.T) {
 		InputTokens:  1200,
 		OutputTokens: 640,
 		TotalTokens:  1840,
-		InputCostUSD: 0.0231,
+		CostUSD:      0.0231,
 	}
 	entryGroups := []agentNetworkTypes.AgentNetworkAccessLogGroup{
 		{LogID: entry.ID, GroupID: "grp-eng", AccountID: accountID},
@@ -127,7 +127,7 @@ func TestAgentNetworkUsageOverview_DailyAggregation(t *testing.T) {
 	mk := func(id string, ts time.Time, model string, in, out int64, cost float64) *agentNetworkTypes.AgentNetworkUsage {
 		return &agentNetworkTypes.AgentNetworkUsage{
 			ID: id, AccountID: accountID, Timestamp: ts, Model: model,
-			InputTokens: in, OutputTokens: out, TotalTokens: in + out, InputCostUSD: cost,
+			InputTokens: in, OutputTokens: out, TotalTokens: in + out, CostUSD: cost,
 		}
 	}
 	require.NoError(t, s.CreateAgentNetworkUsage(ctx, mk("u1", day1, "gpt-4o", 100, 50, 0.10), nil))
@@ -143,7 +143,7 @@ func TestAgentNetworkUsageOverview_DailyAggregation(t *testing.T) {
 	assert.Equal(t, "2026-05-05", buckets[0].PeriodStart, "oldest-first ordering")
 	assert.Equal(t, int64(300), buckets[0].InputTokens, "same-day input tokens summed")
 	assert.Equal(t, int64(130), buckets[0].OutputTokens)
-	assert.InDelta(t, 0.30, buckets[0].TotalCostUSD(), 1e-9, "same-day cost summed")
+	assert.InDelta(t, 0.30, buckets[0].CostUSD, 1e-9, "same-day cost summed")
 	assert.Equal(t, "2026-05-06", buckets[1].PeriodStart)
 	assert.Equal(t, int64(15), buckets[1].TotalTokens)
 
@@ -174,7 +174,7 @@ func TestAgentNetworkAccessLogSessions_RealStore(t *testing.T) {
 			ID: id, AccountID: accountID, ServiceID: "svc", Timestamp: ts,
 			UserID: user, StatusCode: 200, Provider: provider, Model: model,
 			SessionID: session, Decision: decision,
-			InputTokens: 100, OutputTokens: 50, TotalTokens: 150, InputCostUSD: cost,
+			InputTokens: 100, OutputTokens: 50, TotalTokens: 150, CostUSD: cost,
 		}
 	}
 
@@ -207,7 +207,7 @@ func TestAgentNetworkAccessLogSessions_RealStore(t *testing.T) {
 	s1 := sessions[2]
 	assert.Equal(t, 2, s1.RequestCount, "s1 has two requests")
 	assert.Equal(t, int64(300), s1.TotalTokens, "tokens summed across the session")
-	assert.InDelta(t, 0.30, s1.TotalCostUSD(), 1e-9, "cost summed across the session")
+	assert.InDelta(t, 0.30, s1.CostUSD, 1e-9, "cost summed across the session")
 	assert.Equal(t, "alice", s1.UserID)
 	assert.Equal(t, "allow", s1.Decision)
 	// SQLite hands times back in time.Local; normalise to UTC so the instant is

management/server/store/sql_store_service_test.go

@@ -44,42 +44,3 @@ func TestSqlStore_GetAccount_PrivateServiceRoundtrip(t *testing.T) {
 		assert.Equal(t, []string{"grp-admins", "grp-ops"}, got.AccessGroups)
 	})
 }
-
-func TestSqlStore_GetAccount_ServiceRestrictionsRoundtrip(t *testing.T) {
-	if os.Getenv("CI") == "true" && (runtime.GOOS == "darwin" || runtime.GOOS == "windows") {
-		t.Skip("skip CI tests on darwin and windows")
-	}
-
-	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
-		ctx := context.Background()
-		account := newAccountWithId(ctx, "account_svc_restrictions", "testuser", "")
-		require.NoError(t, store.SaveAccount(ctx, account))
-
-		svc := &rpservice.Service{
-			ID:        "svc-restrictions",
-			AccountID: account.Id,
-			Name:      "restricted-svc",
-			Domain:    "restricted.example",
-			Enabled:   true,
-			Mode:      rpservice.ModeHTTP,
-			Restrictions: rpservice.AccessRestrictions{
-				AllowedCIDRs:     []string{"203.0.113.0/24"},
-				AllowedCountries: []string{"US"},
-				AllowMatch:       "any",
-			},
-		}
-		require.NoError(t, store.CreateService(ctx, svc))
-
-		loaded, err := store.GetAccount(ctx, account.Id)
-		require.NoError(t, err)
-		require.Len(t, loaded.Services, 1)
-
-		// Restrictions are stored as a JSON blob; confirm the whole struct,
-		// including allow_match, survives the read path (Postgres pgx path
-		// included via runTestForAllEngines).
-		got := loaded.Services[0].Restrictions
-		assert.Equal(t, []string{"203.0.113.0/24"}, got.AllowedCIDRs)
-		assert.Equal(t, []string{"US"}, got.AllowedCountries)
-		assert.Equal(t, "any", got.AllowMatch)
-	})
-}

management/server/store/store.go

@@ -650,14 +650,6 @@ func getMigrationsPostAuto(ctx context.Context) []migrationFunc {
 		func(db *gorm.DB) error {
 			return migration.DropIndex[proxy.Proxy](ctx, db, "idx_proxy_account_id_unique")
 		},
-		// Post-auto so the per-bucket cost columns already exist when the legacy
-		// aggregates are folded into them and dropped.
-		func(db *gorm.DB) error {
-			return migration.FoldCostAggregatesIntoBuckets[agentNetworkTypes.AgentNetworkAccessLog](ctx, db)
-		},
-		func(db *gorm.DB) error {
-			return migration.FoldCostAggregatesIntoBuckets[agentNetworkTypes.AgentNetworkUsage](ctx, db)
-		},
 	}
 }
 

management/server/types/account.go

@@ -1517,6 +1517,54 @@ func (a *Account) GetResourceRoutersMap() map[string]map[string]*routerTypes.Net
 	return routers
 }
 
+// forcesRoutingPeerDNSResolution reports whether the given peer must run
+// routing-peer DNS resolution regardless of the account-global
+// RoutingPeerDNSResolutionEnabled setting. It returns true when the peer is a
+// router for a domain network resource that is targeted by an enabled
+// reverse-proxy service, so the peer's DNS forwarder starts and can resolve
+// the target for the embedded proxy peers. Embedded proxy peers themselves are
+// handled at PeerConfig build time.
+func (a *Account) forcesRoutingPeerDNSResolution(peerID string, routers map[string]map[string]*routerTypes.NetworkRouter) bool {
+	targeted := a.proxyTargetedDomainResourceIDs()
+	if len(targeted) == 0 {
+		return false
+	}
+
+	for _, resource := range a.NetworkResources {
+		if resource == nil || !resource.Enabled || resource.Type != resourceTypes.Domain {
+			continue
+		}
+		if _, ok := targeted[resource.ID]; !ok {
+			continue
+		}
+		if _, isRouter := routers[resource.NetworkID][peerID]; isRouter {
+			return true
+		}
+	}
+
+	return false
+}
+
+// proxyTargetedDomainResourceIDs returns the set of domain network resource IDs
+// targeted by an enabled, non-terminated reverse-proxy service.
+func (a *Account) proxyTargetedDomainResourceIDs() map[string]struct{} {
+	ids := make(map[string]struct{})
+	for _, svc := range a.Services {
+		if svc == nil || !svc.Enabled || svc.Terminated {
+			continue
+		}
+		for _, target := range svc.Targets {
+			if target == nil || !target.Enabled {
+				continue
+			}
+			if target.TargetType == service.TargetTypeDomain {
+				ids[target.TargetId] = struct{}{}
+			}
+		}
+	}
+	return ids
+}
+
 // getPoliciesSourcePeers collects all unique peers from the source groups defined in the given policies.
 func getPoliciesSourcePeers(policies []*Policy, groups map[string]*Group) map[string]struct{} {
 	sourcePeers := make(map[string]struct{})

management/server/types/account_components.go

@@ -140,6 +140,8 @@ func (a *Account) GetPeerNetworkMapComponents(
 		RouterPeers:               make(map[string]*ComponentPeer),
 		NetworkXIDToPublicID:      make(map[string]string, len(a.Networks)),
 		PostureCheckXIDToPublicID: make(map[string]string, len(a.PostureChecks)),
+
+		ForceRoutingPeerDNSResolution: a.forcesRoutingPeerDNSResolution(peerID, routers),
 	}
 	for _, n := range a.Networks {
 		if n != nil {

management/server/types/account_test.go

@@ -1751,3 +1751,71 @@ func hasPrivateAccessPolicy(account *Account, serviceID string) bool {
 	}
 	return false
 }
+
+func TestForcesRoutingPeerDNSResolution(t *testing.T) {
+	buildAccountRes := func(serviceEnabled, targetEnabled, resourceEnabled bool, targetType service.TargetType, resType resourceTypes.NetworkResourceType) *Account {
+		return &Account{
+			Id: "accountID",
+			Groups: map[string]*Group{
+				"router-group": {ID: "router-group", Peers: []string{"router-peer-grp"}},
+			},
+			NetworkRouters: []*routerTypes.NetworkRouter{
+				{ID: "r1", NetworkID: "net-1", AccountID: "accountID", Peer: "router-peer", Enabled: true},
+				{ID: "r2", NetworkID: "net-1", AccountID: "accountID", PeerGroups: []string{"router-group"}, Enabled: true},
+			},
+			NetworkResources: []*resourceTypes.NetworkResource{
+				{ID: "res-domain", AccountID: "accountID", NetworkID: "net-1", Type: resType, Domain: "example.org", Enabled: resourceEnabled},
+			},
+			Services: []*service.Service{
+				{
+					ID: "svc-1", AccountID: "accountID", Enabled: serviceEnabled,
+					Targets: []*service.Target{
+						{TargetId: "res-domain", TargetType: targetType, Enabled: targetEnabled},
+					},
+				},
+			},
+		}
+	}
+
+	buildAccount := func(serviceEnabled, targetEnabled, resourceEnabled bool, targetType service.TargetType) *Account {
+		return buildAccountRes(serviceEnabled, targetEnabled, resourceEnabled, targetType, resourceTypes.Domain)
+	}
+
+	t.Run("router peer for RP-targeted domain resource is forced", func(t *testing.T) {
+		account := buildAccount(true, true, true, service.TargetTypeDomain)
+		routers := account.GetResourceRoutersMap()
+		assert.True(t, account.forcesRoutingPeerDNSResolution("router-peer", routers), "direct router peer should be forced")
+		assert.True(t, account.forcesRoutingPeerDNSResolution("router-peer-grp", routers), "group-member router peer should be forced")
+	})
+
+	t.Run("non-router peer is not forced", func(t *testing.T) {
+		account := buildAccount(true, true, true, service.TargetTypeDomain)
+		assert.False(t, account.forcesRoutingPeerDNSResolution("other-peer", account.GetResourceRoutersMap()))
+	})
+
+	t.Run("not forced when service disabled", func(t *testing.T) {
+		account := buildAccount(false, true, true, service.TargetTypeDomain)
+		assert.False(t, account.forcesRoutingPeerDNSResolution("router-peer", account.GetResourceRoutersMap()))
+	})
+
+	t.Run("not forced when target disabled", func(t *testing.T) {
+		account := buildAccount(true, false, true, service.TargetTypeDomain)
+		assert.False(t, account.forcesRoutingPeerDNSResolution("router-peer", account.GetResourceRoutersMap()))
+	})
+
+	t.Run("not forced when resource disabled", func(t *testing.T) {
+		account := buildAccount(true, true, false, service.TargetTypeDomain)
+		assert.False(t, account.forcesRoutingPeerDNSResolution("router-peer", account.GetResourceRoutersMap()))
+	})
+
+	t.Run("not forced for non-domain target type", func(t *testing.T) {
+		account := buildAccount(true, true, true, service.TargetTypePeer)
+		assert.False(t, account.forcesRoutingPeerDNSResolution("router-peer", account.GetResourceRoutersMap()))
+	})
+
+	t.Run("not forced when targeted resource is not a domain", func(t *testing.T) {
+		account := buildAccountRes(true, true, true, service.TargetTypeDomain, resourceTypes.Host)
+		assert.False(t, account.forcesRoutingPeerDNSResolution("router-peer", account.GetResourceRoutersMap()),
+			"a domain target pointing at a non-domain resource must not force resolution")
+	})
+}

proxy/internal/accesslog/logger.go

@@ -221,21 +221,14 @@ func (l *Logger) allowDenyLog(serviceID types.ServiceID, reason string) bool {
 // proxy/internal/middleware/keys.go — only the dimensions management needs to
 // record a usage row (provider / model / tokens / cost / groups).
 var usageMetadataKeys = map[string]struct{}{
-	"llm.provider":              {},
-	"llm.model":                 {},
-	"llm.resolved_provider_id":  {},
-	"llm.input_tokens":          {},
-	"llm.output_tokens":         {},
-	"llm.total_tokens":          {},
-	"llm.cached_input_tokens":   {},
-	"llm.cache_creation_tokens": {},
-	"cost.usd_input":            {},
-	"cost.usd_cached_input":     {},
-	"cost.usd_cache_creation":   {},
-	"cost.usd_output":           {},
-	"cost.usd_total":            {},
-	"cost.usd_cache":            {},
-	"llm.authorising_groups":    {},
+	"llm.provider":             {},
+	"llm.model":                {},
+	"llm.resolved_provider_id": {},
+	"llm.input_tokens":         {},
+	"llm.output_tokens":        {},
+	"llm.total_tokens":         {},
+	"cost.usd_total":           {},
+	"llm.authorising_groups":   {},
 }
 
 // stripAgentNetworkEntryForUsage returns the entry reduced to what's needed to

proxy/internal/llm/bedrock.go

@@ -56,12 +56,10 @@ type bedrockResponse struct {
 		OutputTokens             int64 `json:"output_tokens"`
 		CacheReadInputTokens     int64 `json:"cache_read_input_tokens"`
 		CacheCreationInputTokens int64 `json:"cache_creation_input_tokens"`
-		// Converse — camelCase; cache buckets are additive to inputTokens (AWS names the write bucket cacheWriteInputTokens).
-		InputTokensCamel      int64 `json:"inputTokens"`
-		OutputTokensCamel     int64 `json:"outputTokens"`
-		TotalTokensCamel      int64 `json:"totalTokens"`
-		CacheReadTokensCamel  int64 `json:"cacheReadInputTokens"`
-		CacheWriteTokensCamel int64 `json:"cacheWriteInputTokens"`
+		// Converse — camelCase.
+		InputTokensCamel  int64 `json:"inputTokens"`
+		OutputTokensCamel int64 `json:"outputTokens"`
+		TotalTokensCamel  int64 `json:"totalTokens"`
 	} `json:"usage"`
 }
 
@@ -85,18 +83,16 @@ func (BedrockParser) ParseResponse(status int, contentType string, body []byte)
 	}
 	inTok := firstNonZero(resp.Usage.InputTokens, resp.Usage.InputTokensCamel)
 	outTok := firstNonZero(resp.Usage.OutputTokens, resp.Usage.OutputTokensCamel)
-	cacheRead := firstNonZero(resp.Usage.CacheReadInputTokens, resp.Usage.CacheReadTokensCamel)
-	cacheWrite := firstNonZero(resp.Usage.CacheCreationInputTokens, resp.Usage.CacheWriteTokensCamel)
 	total := resp.Usage.TotalTokensCamel
 	if total == 0 {
-		total = inTok + outTok + cacheRead + cacheWrite
+		total = inTok + outTok + resp.Usage.CacheReadInputTokens + resp.Usage.CacheCreationInputTokens
 	}
 	return Usage{
 		InputTokens:         inTok,
 		OutputTokens:        outTok,
 		TotalTokens:         total,
-		CachedInputTokens:   cacheRead,
-		CacheCreationTokens: cacheWrite,
+		CachedInputTokens:   resp.Usage.CacheReadInputTokens,
+		CacheCreationTokens: resp.Usage.CacheCreationInputTokens,
 	}, nil
 }
 

proxy/internal/llm/bedrock_test.go

@@ -26,18 +26,6 @@ func TestBedrockParser_ParseResponse_Converse(t *testing.T) {
 	require.Equal(t, int64(14), u.TotalTokens, "converse uses provider total")
 }
 
-// Converse camelCase cache fields must land in the billed Usage buckets, same as the InvokeModel snake_case fields.
-func TestBedrockParser_ParseResponse_ConverseCacheBuckets(t *testing.T) {
-	body := []byte(`{"usage":{"inputTokens":11,"outputTokens":3,"cacheReadInputTokens":7,"cacheWriteInputTokens":9}}`)
-	u, err := BedrockParser{}.ParseResponse(200, "application/json", body)
-	require.NoError(t, err)
-	require.Equal(t, int64(11), u.InputTokens, "converse input tokens")
-	require.Equal(t, int64(3), u.OutputTokens, "converse output tokens")
-	require.Equal(t, int64(7), u.CachedInputTokens, "converse cache-read tokens")
-	require.Equal(t, int64(9), u.CacheCreationTokens, "converse cache-write tokens")
-	require.Equal(t, int64(11+3+7+9), u.TotalTokens, "total backfill is additive when the provider omits totalTokens")
-}
-
 func TestBedrockParser_ParseResponse_StreamingUnsupported(t *testing.T) {
 	_, err := BedrockParser{}.ParseResponse(200, "application/vnd.amazon.eventstream", []byte("binary"))
 	require.ErrorIs(t, err, ErrStreamingUnsupported, "event-stream must route to the streaming accumulator")

proxy/internal/llm/pricing/pricing.go

@@ -128,46 +128,6 @@ type Table struct {
 //   - Other providers: cached and cacheCreation are ignored; cost is
 //     inTokens*InputPer1K + outTokens*OutputPer1K.
 func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (float64, bool) {
-	c, ok := t.Costs(provider, model, inTokens, outTokens, cachedInput, cacheCreation)
-	return c.TotalUSD, ok
-}
-
-// Costs is a per-request cost split. The four per-bucket fields are the base
-// of the breakdown — one per token bucket the provider bills separately — and
-// the two aggregates are derived from them:
-//
-//	TotalUSD = InputUSD + CachedInputUSD + CacheCreationUSD + OutputUSD
-//	CacheUSD = CachedInputUSD + CacheCreationUSD
-//
-// InputUSD is always the cost of the *non-cached* input bucket, for both
-// provider shapes: on OpenAI the cached subset is carved out of inTokens and
-// billed as CachedInputUSD, so the two never double-count. Buckets a provider
-// doesn't bill are zero, which keeps the identities above true everywhere.
-type Costs struct {
-	InputUSD         float64
-	CachedInputUSD   float64
-	CacheCreationUSD float64
-	OutputUSD        float64
-	TotalUSD         float64
-	CacheUSD         float64
-}
-
-// newCosts assembles a split from its per-bucket parts, deriving the two
-// aggregates so TotalUSD and CacheUSD can never drift from the breakdown.
-func newCosts(input, cachedInput, cacheCreation, output float64) Costs {
-	return Costs{
-		InputUSD:         input,
-		CachedInputUSD:   cachedInput,
-		CacheCreationUSD: cacheCreation,
-		OutputUSD:        output,
-		TotalUSD:         input + cachedInput + cacheCreation + output,
-		CacheUSD:         cachedInput + cacheCreation,
-	}
-}
-
-// Costs returns the estimated USD cost split for the given token counts, with
-// the same semantics as Cost.
-func (t *Table) Costs(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (Costs, bool) {
 	// Clamp negatives to zero before any pricing math so a malformed
 	// upstream count can never produce a negative cost.
 	if inTokens < 0 {
@@ -183,15 +143,15 @@ func (t *Table) Costs(provider, model string, inTokens, outTokens, cachedInput,
 		cacheCreation = 0
 	}
 	if t == nil {
-		return Costs{}, false
+		return 0, false
 	}
 	byModel, ok := t.entries[provider]
 	if !ok {
-		return Costs{}, false
+		return 0, false
 	}
 	entry, ok := byModel[model]
 	if !ok {
-		return Costs{}, false
+		return 0, false
 	}
 	output := (float64(outTokens) / 1000.0) * entry.OutputPer1K
 	switch provider {
@@ -208,7 +168,7 @@ func (t *Table) Costs(provider, model string, inTokens, outTokens, cachedInput,
 		}
 		nonCached := float64(inTokens-clamped) / 1000.0 * entry.InputPer1K
 		cached := float64(clamped) / 1000.0 * cachedRate
-		return newCosts(nonCached, cached, 0, output), true
+		return nonCached + cached + output, true
 	case "anthropic", "bedrock":
 		// Bedrock-Anthropic returns the same additive cache buckets as
 		// first-party Anthropic; non-Anthropic Bedrock models simply report
@@ -224,10 +184,10 @@ func (t *Table) Costs(provider, model string, inTokens, outTokens, cachedInput,
 		input := float64(inTokens) / 1000.0 * entry.InputPer1K
 		read := float64(cachedInput) / 1000.0 * readRate
 		create := float64(cacheCreation) / 1000.0 * createRate
-		return newCosts(input, read, create, output), true
+		return input + read + create + output, true
 	default:
 		input := float64(inTokens) / 1000.0 * entry.InputPer1K
-		return newCosts(input, 0, 0, output), true
+		return input + output, true
 	}
 }
 

proxy/internal/middleware/builtin/cost_calculation_matrix_test.go

@@ -1,329 +0,0 @@
-package builtin_test
-
-import (
-	"bytes"
-	"context"
-	"encoding/base64"
-	"encoding/json"
-	"strconv"
-	"testing"
-
-	"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/proxy/internal/middleware"
-	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
-	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin/cost_meter"
-	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_request_parser"
-	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_response_parser"
-)
-
-// Drives the real pipeline (llm_request_parser → llm_response_parser → cost_meter) on the embedded default pricing
-// table and asserts exact USD amounts hardcoded from the vendors' published prices, including the cache split.
-func TestCostCalculation_ProviderMatrix(t *testing.T) {
-	// Empty data dir → embedded defaults, like a proxy with no pricing override.
-	builtin.Configure(context.Background(), t.TempDir(), nil, nil, nil)
-
-	reqMW, err := llm_request_parser.Factory{}.New(nil)
-	require.NoError(t, err, "build llm_request_parser")
-	respMW, err := llm_response_parser.Factory{}.New(nil)
-	require.NoError(t, err, "build llm_response_parser")
-	costMW, err := cost_meter.Factory{}.New(nil)
-	require.NoError(t, err, "build cost_meter")
-	t.Cleanup(func() { _ = costMW.Close() })
-
-	const jsonCT = "application/json"
-	const sseCT = "text/event-stream"
-	const awsCT = "application/vnd.amazon.eventstream"
-
-	cases := []struct {
-		name     string
-		url      string
-		reqBody  []byte
-		respCT   string
-		respBody []byte
-
-		wantProvider  string
-		wantModel     string
-		wantCost      float64 // exact expected USD; ignored when wantSkip is set
-		wantCacheCost float64 // expected cost.usd_cache portion of wantCost
-		wantSkip      string  // expected cost.skipped reason, "" when priced
-	}{
-		{
-			// gpt-4o-mini $0.15/$0.60 per MTok: 1000×0.15/1M + 500×0.60/1M.
-			name:         "openai chat completions",
-			url:          "https://api.openai.com/v1/chat/completions",
-			reqBody:      []byte(`{"model":"gpt-4o-mini","messages":[{"role":"user","content":"hi"}]}`),
-			respCT:       jsonCT,
-			respBody:     []byte(`{"choices":[{"message":{"content":"pong"}}],"usage":{"prompt_tokens":1000,"completion_tokens":500,"total_tokens":1500}}`),
-			wantProvider: "openai",
-			wantModel:    "gpt-4o-mini",
-			wantCost:     0.00045,
-		},
-		{
-			// OpenAI cached tokens are a SUBSET of prompt_tokens at a discount; gpt-4o $2.50/$10 per MTok, cached $1.25/M:
-			// 250×2.5/1M + 750×1.25/1M + 500×10/1M.
-			name:          "openai cached subset discount",
-			url:           "https://api.openai.com/v1/chat/completions",
-			reqBody:       []byte(`{"model":"gpt-4o","messages":[{"role":"user","content":"hi"}]}`),
-			respCT:        jsonCT,
-			respBody:      []byte(`{"usage":{"prompt_tokens":1000,"completion_tokens":500,"prompt_tokens_details":{"cached_tokens":750}}}`),
-			wantProvider:  "openai",
-			wantModel:     "gpt-4o",
-			wantCost:      0.0065625,
-			wantCacheCost: 0.0009375,
-		},
-		{
-			// OpenAI streaming: usage rides the final SSE frame.
-			name:         "openai chat SSE stream",
-			url:          "https://api.openai.com/v1/chat/completions",
-			reqBody:      []byte(`{"model":"gpt-4o-mini","stream":true,"messages":[{"role":"user","content":"hi"}]}`),
-			respCT:       sseCT,
-			respBody:     sseBody(`{"choices":[{"delta":{"content":"po"}}]}`, `{"choices":[{"delta":{"content":"ng"}}]}`, `{"choices":[],"usage":{"prompt_tokens":1000,"completion_tokens":500}}`, "[DONE]"),
-			wantProvider: "openai",
-			wantModel:    "gpt-4o-mini",
-			wantCost:     0.00045,
-		},
-		{
-			// Mistral speaks the OpenAI shape: mistral-large-latest $0.50/$1.50 per MTok.
-			name:         "mistral via openai shape",
-			url:          "https://api.mistral.ai/v1/chat/completions",
-			reqBody:      []byte(`{"model":"mistral-large-latest","messages":[{"role":"user","content":"hi"}]}`),
-			respCT:       jsonCT,
-			respBody:     []byte(`{"usage":{"prompt_tokens":1000,"completion_tokens":1000}}`),
-			wantProvider: "openai",
-			wantModel:    "mistral-large-latest",
-			wantCost:     0.002,
-		},
-		{
-			// The field report, minus caching: Bedrock Sonnet 4.6 $3/$15 per MTok, 3×3/1M + 1514×15/1M = $0.022719.
-			// Also covers inference-profile normalization of the region-prefixed versioned id in the URL.
-			name:         "bedrock invoke — reported scenario, no cache",
-			url:          "https://bedrock-runtime.eu-central-1.amazonaws.com/model/global.anthropic.claude-sonnet-4-6-20260115-v1:0/invoke",
-			reqBody:      []byte(`{"messages":[{"role":"user","content":"hi"}]}`),
-			respCT:       jsonCT,
-			respBody:     []byte(`{"content":[{"type":"text","text":"pong"}],"usage":{"input_tokens":3,"output_tokens":1514}}`),
-			wantProvider: "bedrock",
-			wantModel:    "anthropic.claude-sonnet-4-6",
-			wantCost:     0.022719,
-		},
-		{
-			// The field report as observed: the FIRST call of a session also wrote a 30,528-token prompt cache at
-			// 1.25× input ($3.75/M): 0.022719 + 30528×3.75/1M = $0.137199 — the reported $0.1372.
-			name:          "bedrock invoke — reported scenario with cache write",
-			url:           "https://bedrock-runtime.eu-central-1.amazonaws.com/model/global.anthropic.claude-sonnet-4-6-20260115-v1:0/invoke",
-			reqBody:       []byte(`{"messages":[{"role":"user","content":"hi"}]}`),
-			respCT:        jsonCT,
-			respBody:      []byte(`{"usage":{"input_tokens":3,"output_tokens":1514,"cache_creation_input_tokens":30528,"cache_read_input_tokens":0}}`),
-			wantProvider:  "bedrock",
-			wantModel:     "anthropic.claude-sonnet-4-6",
-			wantCost:      0.137199,
-			wantCacheCost: 0.11448,
-		},
-		{
-			// Same numbers over the InvokeModel event-stream: message_start carries input + cache, message_delta the output.
-			name:          "bedrock invoke stream with cache write",
-			url:           "https://bedrock-runtime.eu-central-1.amazonaws.com/model/global.anthropic.claude-sonnet-4-6-20260115-v1:0/invoke-with-response-stream",
-			reqBody:       []byte(`{"messages":[{"role":"user","content":"hi"}]}`),
-			respCT:        awsCT,
-			respBody:      bedrockInvokeStream(t, `{"type":"message_start","message":{"usage":{"input_tokens":3,"output_tokens":1,"cache_creation_input_tokens":30528}}}`, `{"type":"content_block_delta","delta":{"type":"text_delta","text":"pong"}}`, `{"type":"message_delta","usage":{"output_tokens":1514}}`),
-			wantProvider:  "bedrock",
-			wantModel:     "anthropic.claude-sonnet-4-6",
-			wantCost:      0.137199,
-			wantCacheCost: 0.11448,
-		},
-		{
-			// Converse camelCase usage incl. cache buckets. Haiku 4.5 $1/$5 per MTok, read $0.10/M, write $1.25/M:
-			// 50×1/1M + 100×5/1M + 2000×0.1/1M + 1000×1.25/1M = $0.002.
-			name:          "bedrock converse with cache buckets",
-			url:           "https://bedrock-runtime.eu-central-1.amazonaws.com/model/eu.anthropic.claude-haiku-4-5-20251001-v1:0/converse",
-			reqBody:       []byte(`{"messages":[{"role":"user","content":[{"text":"hi"}]}]}`),
-			respCT:        jsonCT,
-			respBody:      []byte(`{"output":{"message":{"content":[{"text":"pong"}]}},"usage":{"inputTokens":50,"outputTokens":100,"totalTokens":3150,"cacheReadInputTokens":2000,"cacheWriteInputTokens":1000}}`),
-			wantProvider:  "bedrock",
-			wantModel:     "anthropic.claude-haiku-4-5",
-			wantCost:      0.002,
-			wantCacheCost: 0.00145,
-		},
-		{
-			// Same numbers over converse-stream: usage rides the trailing metadata frame.
-			name:    "bedrock converse stream with cache buckets",
-			url:     "https://bedrock-runtime.eu-central-1.amazonaws.com/model/eu.anthropic.claude-haiku-4-5-20251001-v1:0/converse-stream",
-			reqBody: []byte(`{"messages":[{"role":"user","content":[{"text":"hi"}]}]}`),
-			respCT:  awsCT,
-			respBody: bedrockConverseStream(t,
-				`{"delta":{"text":"pong"}}`,
-				`{"usage":{"inputTokens":50,"outputTokens":100,"totalTokens":3150,"cacheReadInputTokens":2000,"cacheWriteInputTokens":1000}}`,
-			),
-			wantProvider:  "bedrock",
-			wantModel:     "anthropic.claude-haiku-4-5",
-			wantCost:      0.002,
-			wantCacheCost: 0.00145,
-		},
-		{
-			// First-party Anthropic, additive cache buckets. Sonnet 4.6:
-			// 256×3/1M + 200×15/1M + 768×0.3/1M + 512×3.75/1M.
-			name:          "anthropic messages with cache buckets",
-			url:           "https://api.anthropic.com/v1/messages",
-			reqBody:       []byte(`{"model":"claude-sonnet-4-6","messages":[{"role":"user","content":"hi"}]}`),
-			respCT:        jsonCT,
-			respBody:      []byte(`{"content":[{"type":"text","text":"pong"}],"usage":{"input_tokens":256,"output_tokens":200,"cache_read_input_tokens":768,"cache_creation_input_tokens":512}}`),
-			wantProvider:  "anthropic",
-			wantModel:     "claude-sonnet-4-6",
-			wantCost:      0.0059184,
-			wantCacheCost: 0.0021504,
-		},
-		{
-			// Anthropic SSE: input from message_start, output from message_delta. Haiku 4.5: 1000×1/1M + 2000×5/1M.
-			name:         "anthropic SSE stream",
-			url:          "https://api.anthropic.com/v1/messages",
-			reqBody:      []byte(`{"model":"claude-haiku-4-5","stream":true,"messages":[{"role":"user","content":"hi"}]}`),
-			respCT:       sseCT,
-			respBody:     sseBody(`{"type":"message_start","message":{"usage":{"input_tokens":1000,"output_tokens":2}}}`, `{"type":"content_block_delta","delta":{"type":"text_delta","text":"pong"}}`, `{"type":"message_delta","usage":{"output_tokens":2000}}`, `{"type":"message_stop"}`),
-			wantProvider: "anthropic",
-			wantModel:    "claude-haiku-4-5",
-			wantCost:     0.011,
-		},
-		{
-			// Kimi's Anthropic-compatible endpoint: kimi-k3 $3/$15 per MTok under the anthropic table.
-			name:         "kimi anthropic shape",
-			url:          "https://api.moonshot.ai/anthropic/v1/messages",
-			reqBody:      []byte(`{"model":"kimi-k3","messages":[{"role":"user","content":"hi"}]}`),
-			respCT:       jsonCT,
-			respBody:     []byte(`{"usage":{"input_tokens":1000,"output_tokens":1000}}`),
-			wantProvider: "anthropic",
-			wantModel:    "kimi-k3",
-			wantCost:     0.018,
-		},
-		{
-			// Vertex path-routed model with "@version" stripped; Anthropic-on-Vertex priced under the anthropic table.
-			name:         "vertex anthropic path-routed",
-			url:          "https://aiplatform.googleapis.com/v1/projects/p/locations/global/publishers/anthropic/models/claude-sonnet-4-6@20260115:rawPredict",
-			reqBody:      []byte(`{"anthropic_version":"vertex-2023-10-16","messages":[{"role":"user","content":"hi"}]}`),
-			respCT:       jsonCT,
-			respBody:     []byte(`{"usage":{"input_tokens":200,"output_tokens":100}}`),
-			wantProvider: "anthropic",
-			wantModel:    "claude-sonnet-4-6",
-			wantCost:     0.0021,
-		},
-		{
-			// Gateway-prefixed model ids are not in the pricing table: the meter must SKIP, never guess a rate.
-			name:         "gateway-prefixed model skips pricing",
-			url:          "https://gateway.example.com/v1/chat/completions",
-			reqBody:      []byte(`{"model":"openai/gpt-4o-mini","messages":[{"role":"user","content":"hi"}]}`),
-			respCT:       jsonCT,
-			respBody:     []byte(`{"usage":{"prompt_tokens":1000,"completion_tokens":500}}`),
-			wantProvider: "openai",
-			wantModel:    "openai/gpt-4o-mini",
-			wantSkip:     "unknown_model",
-		},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			in := &middleware.Input{
-				Method:  "POST",
-				URL:     tc.url,
-				Headers: []middleware.KV{{Key: "Content-Type", Value: "application/json"}},
-				Body:    tc.reqBody,
-			}
-
-			reqOut, err := reqMW.Invoke(context.Background(), in)
-			require.NoError(t, err, "request parser")
-			in.Metadata = append(in.Metadata, reqOut.Metadata...)
-
-			require.Equal(t, tc.wantProvider, metaKV(in.Metadata, middleware.KeyLLMProvider), "detected provider")
-			require.Equal(t, tc.wantModel, metaKV(in.Metadata, middleware.KeyLLMModel), "detected (normalized) model")
-
-			in.Status = 200
-			in.RespHeaders = []middleware.KV{{Key: "Content-Type", Value: tc.respCT}}
-			in.RespBody = tc.respBody
-
-			respOut, err := respMW.Invoke(context.Background(), in)
-			require.NoError(t, err, "response parser")
-			in.Metadata = append(in.Metadata, respOut.Metadata...)
-
-			costOut, err := costMW.Invoke(context.Background(), in)
-			require.NoError(t, err, "cost meter")
-
-			if tc.wantSkip != "" {
-				assert.Equal(t, tc.wantSkip, metaKV(costOut.Metadata, middleware.KeyCostSkipped), "expected cost skip reason")
-				assert.Empty(t, metaKV(costOut.Metadata, middleware.KeyCostUSDTotal), "no cost may be emitted on skip")
-				return
-			}
-
-			raw := metaKV(costOut.Metadata, middleware.KeyCostUSDTotal)
-			require.NotEmpty(t, raw, "cost.usd_total must be emitted; skip=%q", metaKV(costOut.Metadata, middleware.KeyCostSkipped))
-			got, err := strconv.ParseFloat(raw, 64)
-			require.NoError(t, err, "cost must be a float")
-			// cost.usd_total is rendered with %.6f: allow half of the last printed digit on top of float error.
-			assert.InDelta(t, tc.wantCost, got, 5.1e-7, "USD cost for %s", tc.name)
-
-			rawCache := metaKV(costOut.Metadata, middleware.KeyCostUSDCache)
-			require.NotEmpty(t, rawCache, "cost.usd_cache must be emitted next to cost.usd_total")
-			gotCache, err := strconv.ParseFloat(rawCache, 64)
-			require.NoError(t, err, "cache cost must be a float")
-			assert.InDelta(t, tc.wantCacheCost, gotCache, 5.1e-7, "cache USD cost for %s", tc.name)
-		})
-	}
-}
-
-// metaKV returns the value for key in kvs, or "" when absent.
-func metaKV(kvs []middleware.KV, key string) string {
-	for _, kv := range kvs {
-		if kv.Key == key {
-			return kv.Value
-		}
-	}
-	return ""
-}
-
-// sseBody renders data frames as a text/event-stream body.
-func sseBody(frames ...string) []byte {
-	var b bytes.Buffer
-	for _, f := range frames {
-		b.WriteString("data: ")
-		b.WriteString(f)
-		b.WriteString("\n\n")
-	}
-	return b.Bytes()
-}
-
-// awsFrame encodes one AWS event-stream frame with the given :event-type.
-func awsFrame(t *testing.T, eventType string, payload []byte) []byte {
-	t.Helper()
-	var buf bytes.Buffer
-	enc := eventstream.NewEncoder()
-	require.NoError(t, enc.Encode(&buf, eventstream.Message{
-		Headers: eventstream.Headers{{Name: ":event-type", Value: eventstream.StringValue(eventType)}},
-		Payload: payload,
-	}), "encode event-stream frame")
-	return buf.Bytes()
-}
-
-// bedrockInvokeStream builds an invoke-with-response-stream body: each "chunk" frame wraps a base64 Anthropic event.
-func bedrockInvokeStream(t *testing.T, events ...string) []byte {
-	t.Helper()
-	var body bytes.Buffer
-	for _, ev := range events {
-		wrap, err := json.Marshal(map[string]string{"bytes": base64.StdEncoding.EncodeToString([]byte(ev))})
-		require.NoError(t, err)
-		body.Write(awsFrame(t, "chunk", wrap))
-	}
-	return body.Bytes()
-}
-
-// bedrockConverseStream builds a converse-stream body: contentBlockDelta frames plus a trailing metadata usage frame.
-func bedrockConverseStream(t *testing.T, deltas ...string) []byte {
-	t.Helper()
-	var body bytes.Buffer
-	for i, ev := range deltas {
-		eventType := "contentBlockDelta"
-		if i == len(deltas)-1 {
-			eventType = "metadata"
-		}
-		body.Write(awsFrame(t, eventType, []byte(ev)))
-	}
-	return body.Bytes()
-}

proxy/internal/middleware/builtin/cost_meter/middleware.go

@@ -32,12 +32,7 @@ const (
 )
 
 var metadataKeys = []string{
-	middleware.KeyCostUSDInput,
-	middleware.KeyCostUSDCachedInput,
-	middleware.KeyCostUSDCacheCreation,
-	middleware.KeyCostUSDOutput,
 	middleware.KeyCostUSDTotal,
-	middleware.KeyCostUSDCache,
 	middleware.KeyCostSkipped,
 }
 
@@ -145,38 +140,18 @@ func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middlewar
 	}
 
 	table := m.loader.Get()
-	costs, ok := table.Costs(provider, model, inTokens, outTokens, cachedTokens, cacheCreationTokens)
+	cost, ok := table.Cost(provider, model, inTokens, outTokens, cachedTokens, cacheCreationTokens)
 	if !ok {
 		out.Metadata = skip(skipUnknownModel)
 		return out, nil
 	}
 
-	// Per-bucket costs first: they're the base of the breakdown, and the two
-	// aggregates that follow are derived from exactly these four values.
 	out.Metadata = []middleware.KV{
-		{Key: middleware.KeyCostUSDInput, Value: usd(costs.InputUSD)},
-		{Key: middleware.KeyCostUSDCachedInput, Value: usd(costs.CachedInputUSD)},
-		{Key: middleware.KeyCostUSDCacheCreation, Value: usd(costs.CacheCreationUSD)},
-		{Key: middleware.KeyCostUSDOutput, Value: usd(costs.OutputUSD)},
-		{Key: middleware.KeyCostUSDTotal, Value: usd(costs.TotalUSD)},
-		{Key: middleware.KeyCostUSDCache, Value: usd(costs.CacheUSD)},
+		{Key: middleware.KeyCostUSDTotal, Value: fmt.Sprintf("%.6f", cost)},
 	}
 	return out, nil
 }
 
-// usd renders a cost as the fixed-precision string every cost.usd_* key
-// carries, so the per-bucket values and the aggregates round identically.
-//
-// 9 decimals, not 6: these values are summed downstream — per request, per
-// session, and per usage bucket — so the rounding step is applied once per
-// bucket per row and then accumulated. At 6 decimals a single row loses up to
-// 2e-6 across its four buckets (enough to break a 1e-6 reconciliation against
-// published rates), and a bucket smaller than half a microdollar quantises to
-// zero outright: 16 cache-read tokens on a cheap model is 1.6e-9, so summing
-// 10k such rows reports 0.02 instead of 0.016. Nano-dollar precision keeps the
-// per-row error ~1000x below the smallest realistic bucket.
-func usd(v float64) string { return fmt.Sprintf("%.9f", v) }
-
 // skip returns a single-entry metadata slice carrying the given skip
 // reason under KeyCostSkipped.
 func skip(reason string) []middleware.KV {

proxy/internal/middleware/builtin/cost_meter/middleware_test.go

@@ -67,15 +67,7 @@ func TestMiddleware_StaticSurface(t *testing.T) {
 	assert.NoError(t, mw.Close(), "Close on stateless middleware is a no-op")
 
 	keys := mw.MetadataKeys()
-	expected := []string{
-		middleware.KeyCostUSDInput,
-		middleware.KeyCostUSDCachedInput,
-		middleware.KeyCostUSDCacheCreation,
-		middleware.KeyCostUSDOutput,
-		middleware.KeyCostUSDTotal,
-		middleware.KeyCostUSDCache,
-		middleware.KeyCostSkipped,
-	}
+	expected := []string{middleware.KeyCostUSDTotal, middleware.KeyCostSkipped}
 	assert.Equal(t, expected, keys, "metadata key allowlist must match the spec")
 }
 
@@ -113,7 +105,7 @@ func TestFactory_DefaultPricingPathLoadsFixture(t *testing.T) {
 
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok, "cost.usd_total must be emitted for known model")
-	assert.Equal(t, "0.000750000", value, "0.00015 + 0.0006 per 1k tokens, 9-decimal format")
+	assert.Equal(t, "0.000750", value, "0.00015 + 0.0006 per 1k tokens, 6-decimal format")
 }
 
 func TestFactory_PricingPathOverride(t *testing.T) {
@@ -137,7 +129,7 @@ func TestFactory_PricingPathOverride(t *testing.T) {
 
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok, "cost.usd_total must be emitted with custom pricing path")
-	assert.Equal(t, "0.015000000", value, "2*0.0025 + 1*0.01 = 0.015 with 9-decimal format")
+	assert.Equal(t, "0.015000", value, "2*0.0025 + 1*0.01 = 0.015 with 6-decimal format")
 }
 
 func TestInvoke_ComputesCostForKnownModel(t *testing.T) {
@@ -156,7 +148,7 @@ func TestInvoke_ComputesCostForKnownModel(t *testing.T) {
 
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok, "cost.usd_total must be emitted")
-	assert.Equal(t, "0.018000000", value, "0.003 + 0.015 = 0.018 with 9-decimal format")
+	assert.Equal(t, "0.018000", value, "0.003 + 0.015 = 0.018 with 6-decimal format")
 	_, skipped := metaValue(t, out.Metadata, middleware.KeyCostSkipped)
 	assert.False(t, skipped, "cost.skipped must not be set when cost is computed")
 }
@@ -365,25 +357,8 @@ func TestInvoke_OpenAICachedSubsetDiscount(t *testing.T) {
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok, "cached subset path must produce a cost — never a skip")
 	// 250 non-cached at 0.0025/1k + 750 cached at 0.00125/1k + 500 output at 0.01/1k.
-	assert.Equal(t, "0.006562500", value,
+	assert.Equal(t, "0.006563", value,
 		"cached subset must be billed at the discount rate, non-cached at the full rate; never double-billed")
-
-	cache, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDCache)
-	require.True(t, ok, "cost.usd_cache must be emitted alongside cost.usd_total")
-	// 750 cached at 0.00125/1k = 0.0009375.
-	assert.Equal(t, "0.000937500", cache, "cache cost is the discounted cost of the cached subset")
-
-	// Per-bucket breakdown. On OpenAI the cached subset is carved out of the
-	// input bucket, so input covers only the 250 non-cached tokens — the two
-	// must never double-count the same 750 tokens.
-	assertBucket(t, out.Metadata, middleware.KeyCostUSDInput, "0.000625000",
-		"input bucket bills only the non-cached remainder")
-	assertBucket(t, out.Metadata, middleware.KeyCostUSDCachedInput, "0.000937500",
-		"cached-input bucket bills the discounted subset")
-	assertBucket(t, out.Metadata, middleware.KeyCostUSDCacheCreation, "0.000000000",
-		"OpenAI has no cache-write bucket")
-	assertBucket(t, out.Metadata, middleware.KeyCostUSDOutput, "0.005000000",
-		"output bucket bills 500 tokens at 0.01/1k")
 }
 
 // TestInvoke_AnthropicCacheBucketsAdditive proves the Anthropic
@@ -409,33 +384,9 @@ func TestInvoke_AnthropicCacheBucketsAdditive(t *testing.T) {
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok)
 	// 256 input * 0.003 + 768 cache_read * 0.0003 + 512 cache_creation * 0.00375 + 200 output * 0.015
-	// = 0.000768 + 0.0002304 + 0.00192 + 0.003 = 0.0059184.
-	assert.Equal(t, "0.005918400", value,
+	// = 0.000768 + 0.0002304 + 0.00192 + 0.003 = 0.0059184 → "0.005918" with 6-decimal format.
+	assert.Equal(t, "0.005918", value,
 		"each Anthropic input bucket must bill at its own rate — cache_read cheap, cache_creation expensive, regular input mid")
-
-	cache, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDCache)
-	require.True(t, ok, "cost.usd_cache must be emitted alongside cost.usd_total")
-	// 768 cache_read * 0.0003 + 512 cache_creation * 0.00375 = 0.0021504.
-	assert.Equal(t, "0.002150400", cache, "cache cost sums the read and creation buckets")
-
-	// Per-bucket breakdown: four separately-billed buckets, each at its own rate.
-	assertBucket(t, out.Metadata, middleware.KeyCostUSDInput, "0.000768000",
-		"input bucket bills 256 tokens at 0.003/1k")
-	assertBucket(t, out.Metadata, middleware.KeyCostUSDCachedInput, "0.000230400",
-		"cache-read bucket bills 768 tokens at the cheap 0.0003/1k")
-	assertBucket(t, out.Metadata, middleware.KeyCostUSDCacheCreation, "0.001920000",
-		"cache-write bucket bills 512 tokens at the expensive 0.00375/1k")
-	assertBucket(t, out.Metadata, middleware.KeyCostUSDOutput, "0.003000000",
-		"output bucket bills 200 tokens at 0.015/1k")
-}
-
-// assertBucket asserts one per-bucket cost key carries the expected
-// 6-decimal value.
-func assertBucket(t *testing.T, md []middleware.KV, key, want, msg string) {
-	t.Helper()
-	got, ok := metaValue(t, md, key)
-	require.Truef(t, ok, "%s must be emitted", key)
-	assert.Equal(t, want, got, msg)
 }
 
 // TestInvoke_CachedTokensAbsentFallsBackToBaseFormula covers the
@@ -460,7 +411,7 @@ func TestInvoke_CachedTokensAbsentFallsBackToBaseFormula(t *testing.T) {
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok)
 	// 1000 input * 0.0025 + 500 output * 0.01 = 0.0025 + 0.005 = 0.0075
-	assert.Equal(t, "0.007500000", value, "no cached metadata = same cost as before the feature landed")
+	assert.Equal(t, "0.007500", value, "no cached metadata = same cost as before the feature landed")
 }
 
 // TestInvoke_UnparseableCachedTokensSkippedSilently proves the
@@ -484,7 +435,7 @@ func TestInvoke_UnparseableCachedTokensSkippedSilently(t *testing.T) {
 	require.NoError(t, err)
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok, "garbage cache metadata must NOT switch the response from a cost to a skip — fall back to 0 cached")
-	assert.Equal(t, "0.007500000", value, "same as the no-cached-metadata path")
+	assert.Equal(t, "0.007500", value, "same as the no-cached-metadata path")
 }
 
 // TestMiddleware_CloseCancelsReloader proves Close stops the per-instance

proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock.go

@@ -69,18 +69,15 @@ func applyBedrockInvokeChunk(payload []byte, usage *llm.Usage, completion *strin
 }
 
 // converseStreamEvent captures the Converse stream frames carrying completion
-// text (contentBlockDelta) and the final token usage (metadata). Cache buckets
-// are additive to inputTokens (AWS write bucket: cacheWriteInputTokens).
+// text (contentBlockDelta) and the final token usage (metadata).
 type converseStreamEvent struct {
 	Delta *struct {
 		Text string `json:"text"`
 	} `json:"delta"`
 	Usage *struct {
-		InputTokens      int64 `json:"inputTokens"`
-		OutputTokens     int64 `json:"outputTokens"`
-		TotalTokens      int64 `json:"totalTokens"`
-		CacheReadTokens  int64 `json:"cacheReadInputTokens"`
-		CacheWriteTokens int64 `json:"cacheWriteInputTokens"`
+		InputTokens  int64 `json:"inputTokens"`
+		OutputTokens int64 `json:"outputTokens"`
+		TotalTokens  int64 `json:"totalTokens"`
 	} `json:"usage"`
 }
 
@@ -108,12 +105,6 @@ func applyConverseStreamEvent(eventType string, payload []byte, usage *llm.Usage
 			if ev.Usage.TotalTokens > 0 {
 				usage.TotalTokens = ev.Usage.TotalTokens
 			}
-			if ev.Usage.CacheReadTokens > 0 {
-				usage.CachedInputTokens = ev.Usage.CacheReadTokens
-			}
-			if ev.Usage.CacheWriteTokens > 0 {
-				usage.CacheCreationTokens = ev.Usage.CacheWriteTokens
-			}
 		}
 	}
 }

proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock_test.go

@@ -66,24 +66,6 @@ func TestAccumulateBedrockStream_Converse(t *testing.T) {
 	require.Equal(t, "pong", completion, "converse text deltas concatenated")
 }
 
-// The converse-stream metadata frame's camelCase cache fields must reach the billed cache buckets.
-func TestAccumulateBedrockStream_ConverseCacheBuckets(t *testing.T) {
-	var body bytes.Buffer
-	body.Write(bedrockFrame(t, "contentBlockDelta", mustJSON(t, map[string]any{"delta": map[string]any{"text": "pong"}})))
-	body.Write(bedrockFrame(t, "metadata", mustJSON(t, map[string]any{"usage": map[string]any{
-		"inputTokens": 11, "outputTokens": 3, "totalTokens": 30,
-		"cacheReadInputTokens": 7, "cacheWriteInputTokens": 9,
-	}})))
-
-	usage, completion := accumulateBedrockStream(body.Bytes())
-	require.Equal(t, int64(11), usage.InputTokens, "input tokens from metadata frame")
-	require.Equal(t, int64(3), usage.OutputTokens, "output tokens from metadata frame")
-	require.Equal(t, int64(7), usage.CachedInputTokens, "cache-read tokens from metadata frame")
-	require.Equal(t, int64(9), usage.CacheCreationTokens, "cache-write tokens from metadata frame")
-	require.Equal(t, int64(30), usage.TotalTokens, "provider-reported total wins")
-	require.Equal(t, "pong", completion)
-}
-
 func TestAccumulateBedrockStream_Truncated(t *testing.T) {
 	// A body cut mid-frame must not panic; partial usage is returned.
 	full := bedrockFrame(t, "metadata", mustJSON(t, map[string]any{"usage": map[string]any{"inputTokens": 11, "outputTokens": 3}}))

proxy/internal/middleware/keys.go

@@ -75,19 +75,8 @@ const (
 	KeyLLMAttributionGroupID = "llm.attribution_group_id"
 	KeyLLMAttributionWindowS = "llm.attribution_window_seconds"
 
-	// Cost metering (emitted by cost_meter). The four per-bucket keys are the
-	// base of the breakdown — one per token bucket the provider bills
-	// separately — and the two aggregates below are derived from them:
-	// usd_total is their sum, usd_cache is cached_input + cache_creation.
-	KeyCostUSDInput = "cost.usd_input"
-	// KeyCostUSDCachedInput is the cost of the cache-read bucket (Anthropic cache_read; OpenAI's discounted cached subset of input).
-	KeyCostUSDCachedInput = "cost.usd_cached_input"
-	// KeyCostUSDCacheCreation is the cost of the cache-write bucket. Zero for providers without one.
-	KeyCostUSDCacheCreation = "cost.usd_cache_creation"
-	KeyCostUSDOutput        = "cost.usd_output"
-	KeyCostUSDTotal         = "cost.usd_total"
-	// KeyCostUSDCache is the portion of cost.usd_total billed for prompt-cache buckets (cache read/creation, or OpenAI's cached input subset).
-	KeyCostUSDCache = "cost.usd_cache"
+	// Cost metering (emitted by cost_meter).
+	KeyCostUSDTotal = "cost.usd_total"
 	KeyCostSkipped  = "cost.skipped"
 
 	// Framework-emitted error markers. Use the mw.<id>.* prefix to

proxy/internal/restrict/restrict.go

@@ -50,28 +50,6 @@ const (
 	CrowdSecObserve CrowdSecMode = "observe"
 )
 
-// AllowMatch controls how the configured allowlists (CIDR, country) combine.
-// Blocklists are always a separate hard-deny gate and are unaffected by it.
-type AllowMatch string
-
-const (
-	// AllowMatchAll requires the address to match every configured allowlist
-	// (AND). This is the default and preserves the historical behavior.
-	AllowMatchAll AllowMatch = "all"
-	// AllowMatchAny requires the address to match at least one configured
-	// allowlist (OR), e.g. "allowed country OR allowed CIDR".
-	AllowMatchAny AllowMatch = "any"
-)
-
-// normalizeAllowMatch maps unknown or empty values to the restrictive default
-// (AllowMatchAll) so an unrecognized mode never loosens access.
-func normalizeAllowMatch(m AllowMatch) AllowMatch {
-	if m == AllowMatchAny {
-		return AllowMatchAny
-	}
-	return AllowMatchAll
-}
-
 // Filter evaluates IP restrictions. CIDR checks are performed first
 // (cheap), followed by country lookups (more expensive) only when needed.
 type Filter struct {
@@ -81,9 +59,6 @@ type Filter struct {
 	BlockedCountries []string
 	CrowdSec         CrowdSecChecker
 	CrowdSecMode     CrowdSecMode
-	// AllowMatch controls how the allowlists combine (AND vs OR). Empty means
-	// AllowMatchAll.
-	AllowMatch AllowMatch
 }
 
 // FilterConfig holds the raw configuration for building a Filter.
@@ -94,7 +69,6 @@ type FilterConfig struct {
 	BlockedCountries []string
 	CrowdSec         CrowdSecChecker
 	CrowdSecMode     CrowdSecMode
-	AllowMatch       AllowMatch
 	Logger           *log.Entry
 }
 
@@ -115,7 +89,6 @@ func ParseFilter(cfg FilterConfig) *Filter {
 	f := &Filter{
 		AllowedCountries: normalizeCountryCodes(cfg.AllowedCountries),
 		BlockedCountries: normalizeCountryCodes(cfg.BlockedCountries),
-		AllowMatch:       normalizeAllowMatch(cfg.AllowMatch),
 	}
 	if hasCS {
 		f.CrowdSec = cfg.CrowdSec
@@ -243,10 +216,6 @@ func (f *Filter) Check(addr netip.Addr, geo GeoResolver) Verdict {
 	// IPv4 CIDR rules match regardless of how the address was received.
 	addr = addr.Unmap()
 
-	if f.AllowMatch == AllowMatchAny {
-		return f.checkAny(addr, geo)
-	}
-
 	if v := f.checkCIDR(addr); v != Allow {
 		return v
 	}
@@ -256,68 +225,6 @@ func (f *Filter) Check(addr netip.Addr, geo GeoResolver) Verdict {
 	return f.checkCrowdSec(addr)
 }
 
-// checkAny evaluates the filter with OR semantics across allowlists: the
-// address is admitted if it matches any configured allowlist (CIDR or country).
-// Blocklists remain a hard-deny gate evaluated first and are independent of the
-// allow-combine mode, so a blocklist match (or unverifiable country block) still
-// denies. CrowdSec runs last, as in the default path.
-//
-// The country is resolved at most once and shared by both the blocklist and the
-// allowlist, matching what the all-mode path does. Splitting the two checks into
-// separate helpers cost a second geo lookup per connection whenever both country
-// lists were configured.
-func (f *Filter) checkAny(addr netip.Addr, geo GeoResolver) Verdict {
-	for _, prefix := range f.BlockedCIDRs {
-		if prefix.Contains(addr) {
-			return DenyCIDR
-		}
-	}
-
-	cidrActive := len(f.AllowedCIDRs) > 0
-	cidrAllowed := false
-	if cidrActive {
-		for _, prefix := range f.AllowedCIDRs {
-			if prefix.Contains(addr) {
-				cidrAllowed = true
-				break
-			}
-		}
-	}
-
-	countryActive := len(f.AllowedCountries) > 0
-	// The blocklist is a hard gate, so it needs the country even when a CIDR
-	// allowlist already admitted the address. The allowlist needs it only when
-	// the CIDR list did not admit it, which is why a matching allowed CIDR
-	// still skips the lookup when no country blocklist is configured.
-	needCountry := len(f.BlockedCountries) > 0 || (countryActive && !cidrAllowed)
-
-	country := ""
-	if needCountry {
-		if geo == nil || !geo.Available() {
-			return DenyGeoUnavailable
-		}
-		country = geo.LookupAddr(addr).CountryCode
-	}
-
-	if country != "" && slices.Contains(f.BlockedCountries, country) {
-		return DenyCountry
-	}
-
-	allowed := (!cidrActive && !countryActive) ||
-		cidrAllowed ||
-		(countryActive && country != "" && slices.Contains(f.AllowedCountries, country))
-	if !allowed {
-		// Both allowlists missing is reported against the CIDR list, the one
-		// checked first, so the reason stays stable for existing access logs.
-		if cidrActive {
-			return DenyCIDR
-		}
-		return DenyCountry
-	}
-
-	return f.checkCrowdSec(addr)
-}
-
 func (f *Filter) checkCIDR(addr netip.Addr) Verdict {
 	if len(f.AllowedCIDRs) > 0 {
 		allowed := false

proxy/internal/restrict/restrict_test.go

@@ -5,7 +5,6 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/proxy/internal/geolocation"
 )
@@ -151,187 +150,6 @@ func TestFilter_Check_CIDRAllowThenCountryBlock(t *testing.T) {
 	assert.Equal(t, DenyCIDR, f.Check(netip.MustParseAddr("192.168.1.1"), geo), "CIDR denied before country check")
 }
 
-// TestFilter_Check_CrossCategoryAllowlistsAreAND documents the current
-// behavior: when both a CIDR allowlist and a country allowlist are set, a
-// request must satisfy BOTH to be allowed (AND across categories). There is no
-// way today to express "allow if in allowed country OR in allowed CIDR", e.g.
-// "allow all US traffic plus our office IP abroad". This is the gap an
-// any/all allow-combine mode would close; the cases marked "GAP" are the ones
-// that would flip to Allow under an "any" mode.
-func TestFilter_Check_CrossCategoryAllowlistsAreAND(t *testing.T) {
-	officeAbroad := "203.0.113.7" // in allowed CIDR, but country not in allowlist
-	usOutsideOffice := "1.1.1.1"  // allowed country, but not in allowed CIDR
-	usOffice := "203.0.113.8"     // both
-	neither := "198.51.100.1"     // neither
-
-	geo := newMockGeo(map[string]string{
-		officeAbroad:    "DE",
-		usOutsideOffice: "US",
-		usOffice:        "US",
-		neither:         "CN",
-	})
-	f := ParseFilter(FilterConfig{
-		AllowedCIDRs:     []string{"203.0.113.0/24"},
-		AllowedCountries: []string{"US"},
-	})
-
-	assert.Equal(t, Allow, f.Check(netip.MustParseAddr(usOffice), geo), "in allowed CIDR and allowed country")
-	assert.Equal(t, DenyCountry, f.Check(netip.MustParseAddr(officeAbroad), geo), "GAP: in allowed CIDR but country not allowed; any-mode should Allow")
-	assert.Equal(t, DenyCIDR, f.Check(netip.MustParseAddr(usOutsideOffice), geo), "GAP: allowed country but not in allowed CIDR; any-mode should Allow")
-	assert.Equal(t, DenyCIDR, f.Check(netip.MustParseAddr(neither), geo), "neither: denied under both modes")
-}
-
-// TestFilter_Check_CrossCategoryBlockAndAllow locks the current (all/AND)
-// cross-category semantics that the evaluator must preserve: a blocklist match
-// in any category denies regardless of allowlists, and blocklists across
-// categories are effectively OR (a match in either denies).
-func TestFilter_Check_CrossCategoryBlockAndAllow(t *testing.T) {
-	geo := newMockGeo(map[string]string{
-		"1.1.1.1":  "US",
-		"10.1.2.3": "US",
-		"2.2.2.2":  "CN",
-		"3.3.3.3":  "US",
-	})
-
-	t.Run("country allowlist with CIDR blocklist", func(t *testing.T) {
-		f := ParseFilter(FilterConfig{
-			AllowedCountries: []string{"US"},
-			BlockedCIDRs:     []string{"10.1.0.0/16"},
-		})
-		assert.Equal(t, Allow, f.Check(netip.MustParseAddr("1.1.1.1"), geo), "US and not in blocked CIDR")
-		assert.Equal(t, DenyCIDR, f.Check(netip.MustParseAddr("10.1.2.3"), geo), "US but in blocked CIDR, block wins")
-		assert.Equal(t, DenyCountry, f.Check(netip.MustParseAddr("2.2.2.2"), geo), "not in allowed country")
-	})
-
-	t.Run("blocklists across categories are OR", func(t *testing.T) {
-		f := ParseFilter(FilterConfig{
-			BlockedCIDRs:     []string{"10.1.0.0/16"},
-			BlockedCountries: []string{"CN"},
-		})
-		assert.Equal(t, DenyCIDR, f.Check(netip.MustParseAddr("10.1.2.3"), geo), "in blocked CIDR")
-		assert.Equal(t, DenyCountry, f.Check(netip.MustParseAddr("2.2.2.2"), geo), "in blocked country")
-		assert.Equal(t, Allow, f.Check(netip.MustParseAddr("3.3.3.3"), geo), "in neither blocklist")
-	})
-}
-
-// TestFilter_Check_AllowCIDRPlusAllowCountryDeniesGeolessLAN documents a trap
-// with all/AND mode: pairing an allowed CIDR (a private LAN) with an allowed
-// country denies the LAN source, because a private IP has no country in the
-// geo DB and an active country allowlist denies unknown countries. Under an
-// "any" mode the CIDR match alone would admit it. This is the strongest reason
-// allow-CIDR + allow-country usually wants OR, not AND.
-func TestFilter_Check_AllowCIDRPlusAllowCountryDeniesGeolessLAN(t *testing.T) {
-	geo := newMockGeo(map[string]string{}) // no entries: every lookup is unknown country
-	f := ParseFilter(FilterConfig{
-		AllowedCIDRs:     []string{"192.168.50.0/24"},
-		AllowedCountries: []string{"US"},
-	})
-
-	got := f.Check(netip.MustParseAddr("192.168.50.5"), geo)
-	assert.Equal(t, DenyCountry, got, "GAP: LAN source in allowed CIDR is denied by the country allowlist; any-mode should Allow")
-}
-
-func TestFilter_Check_AllowMatchAny(t *testing.T) {
-	bannedIP := "203.0.113.9"
-	geo := newMockGeo(map[string]string{
-		"1.1.1.1":      "US", // allowed country, outside allowed CIDR
-		"203.0.113.7":  "DE", // allowed CIDR, non-allowed country
-		"203.0.113.8":  "US", // both
-		bannedIP:       "US", // allowed CIDR, but CrowdSec-banned
-		"198.51.100.1": "CN", // neither
-		"2.2.2.2":      "CN", // blocked country, but in allowed CIDR
-	})
-
-	tests := []struct {
-		name   string
-		config FilterConfig
-		addr   string
-		geo    GeoResolver
-		want   Verdict
-	}{
-		{
-			name:   "in allowed CIDR only",
-			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
-			addr:   "203.0.113.7", geo: geo, want: Allow,
-		},
-		{
-			name:   "in allowed country only",
-			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
-			addr:   "1.1.1.1", geo: geo, want: Allow,
-		},
-		{
-			name:   "in both",
-			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
-			addr:   "203.0.113.8", geo: geo, want: Allow,
-		},
-		{
-			name:   "in neither",
-			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
-			addr:   "198.51.100.1", geo: geo, want: DenyCIDR,
-		},
-		{
-			name:   "geoless LAN admitted via CIDR (the #597 trap, fixed)",
-			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"192.168.50.0/24"}, AllowedCountries: []string{"US"}},
-			addr:   "192.168.50.5", geo: newMockGeo(map[string]string{}), want: Allow,
-		},
-		{
-			name:   "CIDR match short-circuits geo when geo unavailable",
-			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
-			addr:   "203.0.113.7", geo: &unavailableGeo{}, want: Allow,
-		},
-		{
-			name:   "geo unavailable fails closed when CIDR does not match",
-			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
-			addr:   "1.1.1.1", geo: &unavailableGeo{}, want: DenyGeoUnavailable,
-		},
-		{
-			name:   "block gate wins over allowed CIDR (blocked country)",
-			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"0.0.0.0/0"}, BlockedCountries: []string{"CN"}},
-			addr:   "2.2.2.2", geo: geo, want: DenyCountry,
-		},
-		{
-			name:   "block gate wins over allowed country (blocked CIDR)",
-			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCountries: []string{"US"}, BlockedCIDRs: []string{"203.0.113.0/24"}},
-			addr:   "203.0.113.8", geo: geo, want: DenyCIDR,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			f := ParseFilter(tc.config)
-			assert.Equal(t, tc.want, f.Check(netip.MustParseAddr(tc.addr), tc.geo))
-		})
-	}
-}
-
-func TestFilter_Check_AllowMatchAny_CrowdSecStillRuns(t *testing.T) {
-	bannedIP := "203.0.113.9"
-	cs := &mockCrowdSec{decisions: map[string]*CrowdSecDecision{bannedIP: {Type: DecisionBan}}, ready: true}
-	geo := newMockGeo(map[string]string{bannedIP: "US", "203.0.113.7": "US"})
-
-	f := ParseFilter(FilterConfig{
-		AllowMatch:   AllowMatchAny,
-		AllowedCIDRs: []string{"203.0.113.0/24"},
-		CrowdSec:     cs,
-		CrowdSecMode: CrowdSecEnforce,
-	})
-	assert.Equal(t, DenyCrowdSecBan, f.Check(netip.MustParseAddr(bannedIP), geo), "CrowdSec ban denies even when allowlist admits")
-	assert.Equal(t, Allow, f.Check(netip.MustParseAddr("203.0.113.7"), geo), "clean IP in allowed CIDR is allowed")
-}
-
-func TestFilter_Check_UnknownAllowMatchDefaultsToAll(t *testing.T) {
-	// An unrecognized allow-combine mode must fall back to the restrictive
-	// AND default, never loosen access.
-	geo := newMockGeo(map[string]string{"203.0.113.7": "DE"})
-	f := ParseFilter(FilterConfig{
-		AllowMatch:       AllowMatch("bogus"),
-		AllowedCIDRs:     []string{"203.0.113.0/24"},
-		AllowedCountries: []string{"US"},
-	})
-	assert.Equal(t, AllowMatchAll, f.AllowMatch, "unknown mode normalizes to all")
-	assert.Equal(t, DenyCountry, f.Check(netip.MustParseAddr("203.0.113.7"), geo), "AND semantics: in CIDR but wrong country denied")
-}
-
 func TestParseFilter_Empty(t *testing.T) {
 	f := ParseFilter(FilterConfig{})
 	assert.Nil(t, f)
@@ -734,81 +552,3 @@ func TestFilter_HasRestrictions_CrowdSec(t *testing.T) {
 	f2 := ParseFilter(FilterConfig{CrowdSec: nil, CrowdSecMode: CrowdSecEnforce})
 	assert.True(t, f2.HasRestrictions())
 }
-
-// countingGeo records how many times an address was resolved.
-type countingGeo struct {
-	countries map[string]string
-	lookups   int
-}
-
-func (c *countingGeo) LookupAddr(addr netip.Addr) geolocation.Result {
-	c.lookups++
-	return geolocation.Result{CountryCode: c.countries[addr.String()]}
-}
-
-func (c *countingGeo) Available() bool { return true }
-
-// The geo lookup is the expensive part of the check and runs per connection, so
-// "any" mode must resolve the country once and share it between the blocklist
-// and the allowlist, the way "all" mode does.
-func TestCheck_AnyResolvesCountryOnce(t *testing.T) {
-	tests := []struct {
-		name        string
-		ip          string
-		want        Verdict
-		wantLookups int
-	}{
-		{"blocked and allowed lists both active", "203.0.113.1", Allow, 1},
-		{"blocked country denies", "198.51.100.1", DenyCountry, 1},
-		{"neither allowlist matches", "192.0.2.1", DenyCIDR, 1},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			geo := &countingGeo{countries: map[string]string{
-				"203.0.113.1":  "US",
-				"198.51.100.1": "CN",
-				"192.0.2.1":    "FR",
-			}}
-			f := ParseFilter(FilterConfig{
-				AllowedCIDRs:     []string{"10.0.0.0/8"},
-				AllowedCountries: []string{"US"},
-				BlockedCountries: []string{"CN"},
-				AllowMatch:       AllowMatchAny,
-			})
-			require.NotNil(t, f)
-
-			assert.Equal(t, tt.want, f.Check(netip.MustParseAddr(tt.ip), geo))
-			assert.Equal(t, tt.wantLookups, geo.lookups, "the country must be resolved at most once per check")
-		})
-	}
-}
-
-// A matching allowed CIDR short-circuits the allowlist, so with no country
-// blocklist configured there is nothing left to resolve.
-func TestCheck_AnySkipsLookupWhenCIDRAdmits(t *testing.T) {
-	geo := &countingGeo{countries: map[string]string{"10.1.2.3": "US"}}
-	f := ParseFilter(FilterConfig{
-		AllowedCIDRs:     []string{"10.0.0.0/8"},
-		AllowedCountries: []string{"DE"},
-		AllowMatch:       AllowMatchAny,
-	})
-	require.NotNil(t, f)
-
-	assert.Equal(t, Allow, f.Check(netip.MustParseAddr("10.1.2.3"), geo))
-	assert.Zero(t, geo.lookups, "an admitted CIDR needs no geo lookup")
-}
-
-// The blocklist is a hard gate, so it is consulted even when a CIDR allowlist
-// already admitted the address.
-func TestCheck_AnyBlocklistOutranksAllowedCIDR(t *testing.T) {
-	geo := &countingGeo{countries: map[string]string{"10.1.2.3": "CN"}}
-	f := ParseFilter(FilterConfig{
-		AllowedCIDRs:     []string{"10.0.0.0/8"},
-		BlockedCountries: []string{"CN"},
-		AllowMatch:       AllowMatchAny,
-	})
-	require.NotNil(t, f)
-
-	assert.Equal(t, DenyCountry, f.Check(netip.MustParseAddr("10.1.2.3"), geo))
-	assert.Equal(t, 1, geo.lookups)
-}

proxy/server.go

@@ -1904,7 +1904,6 @@ func (s *Server) parseRestrictions(mapping *proto.ProxyMapping) *restrict.Filter
 		BlockedCountries: r.GetBlockedCountries(),
 		CrowdSec:         checker,
 		CrowdSecMode:     csMode,
-		AllowMatch:       restrict.AllowMatch(r.GetAllowMatch()),
 		Logger:           log.NewEntry(s.Logger),
 	})
 }

release_files/freebsd-port-diff.sh

@@ -3,8 +3,8 @@
 # FreeBSD Port Diff Generator for NetBird
 #
 # This script generates the diff file required for submitting a FreeBSD port update.
-# It works on macOS, Linux, and FreeBSD by fetching files from the FreeBSD ports
-# GitHub mirror and computing checksums from the Go module proxy.
+# It works on macOS, Linux, and FreeBSD by fetching files from FreeBSD cgit and
+# computing checksums from the Go module proxy.
 #
 # Usage: ./freebsd-port-diff.sh [new_version]
 # Example: ./freebsd-port-diff.sh 0.60.7
@@ -14,7 +14,7 @@
 set -e
 
 GITHUB_REPO="netbirdio/netbird"
-PORTS_MIRROR_BASE="https://raw.githubusercontent.com/freebsd/freebsd-ports/main/security/netbird"
+PORTS_CGIT_BASE="https://cgit.freebsd.org/ports/plain/security/netbird"
 GO_PROXY="https://proxy.golang.org/github.com/netbirdio/netbird/@v"
 OUTPUT_DIR="${OUTPUT_DIR:-.}"
 AWK_FIRST_FIELD='{print $1}'
@@ -30,17 +30,10 @@ fetch_all_tags() {
 
 fetch_current_ports_version() {
     echo "Fetching current version from FreeBSD ports..." >&2
-    local makefile version
-    makefile=$(fetch_ports_file "Makefile") || return 1
-    version=$(echo "$makefile" | \
+    curl -sL "${PORTS_CGIT_BASE}/Makefile" 2>/dev/null | \
         grep -E "^DISTVERSION=" | \
         sed 's/DISTVERSION=[[:space:]]*//' | \
-        tr -d '\t ')
-    if [[ -z "$version" ]]; then
-        echo "Error: Could not extract DISTVERSION from ports Makefile" >&2
-        return 1
-    fi
-    echo "$version"
+        tr -d '\t '
     return 0
 }
 
@@ -52,16 +45,7 @@ fetch_latest_github_release() {
 
 fetch_ports_file() {
     local filename="$1"
-    local content
-    if ! content=$(curl -fsL --proto '=https' --proto-redir '=https' --retry 3 "${PORTS_MIRROR_BASE}/${filename}" 2>/dev/null); then
-        echo "Error: Could not fetch ${filename} from ${PORTS_MIRROR_BASE}" >&2
-        return 1
-    fi
-    if [[ "$content" == \<* ]]; then
-        echo "Error: Received HTML instead of ${filename} from ${PORTS_MIRROR_BASE}" >&2
-        return 1
-    fi
-    printf '%s' "$content"
+    curl -sL "${PORTS_CGIT_BASE}/${filename}" 2>/dev/null
     return 0
 }
 

release_files/freebsd-port-issue-body.sh

@@ -9,22 +9,18 @@
 # Example: ./freebsd-port-issue-body.sh 0.56.0 0.59.1
 #
 # If no versions are provided, the script will:
-#   - Fetch OLD version from the FreeBSD ports GitHub mirror (current version in ports tree)
+#   - Fetch OLD version from FreeBSD ports cgit (current version in ports tree)
 #   - Fetch NEW version from latest NetBird GitHub release tag
 
 set -e
 
 GITHUB_REPO="netbirdio/netbird"
-PORTS_MAKEFILE_URL="https://raw.githubusercontent.com/freebsd/freebsd-ports/main/security/netbird/Makefile"
+PORTS_CGIT_URL="https://cgit.freebsd.org/ports/plain/security/netbird/Makefile"
 
 fetch_current_ports_version() {
     echo "Fetching current version from FreeBSD ports..." >&2
     local makefile_content
-    makefile_content=$(curl -fsL --proto '=https' --proto-redir '=https' --retry 3 "$PORTS_MAKEFILE_URL" 2>/dev/null) || makefile_content=""
-    if [[ "$makefile_content" == \<* ]]; then
-        echo "Error: Received HTML instead of Makefile from ${PORTS_MAKEFILE_URL}" >&2
-        return 1
-    fi
+    makefile_content=$(curl -sL "$PORTS_CGIT_URL" 2>/dev/null)
     if [[ -z "$makefile_content" ]]; then
         echo "Error: Could not fetch Makefile from FreeBSD ports" >&2
         return 1

shared/management/client/grpc.go

@@ -187,16 +187,16 @@ func (c *GrpcClient) ready() bool {
 // Sync wraps the real client's Sync endpoint call and takes care of retries and encryption/decryption of messages
 // Blocking request. The result will be sent via msgHandler callback function
 func (c *GrpcClient) Sync(ctx context.Context, sysInfo *system.Info, msgHandler func(msg *proto.SyncResponse) error) error {
-	return c.withMgmtStream(ctx, func(ctx context.Context, serverPubKey wgtypes.Key, backOff backoff.BackOff) error {
-		return c.handleSyncStream(ctx, serverPubKey, sysInfo, msgHandler, backOff)
+	return c.withMgmtStream(ctx, func(ctx context.Context, serverPubKey wgtypes.Key) error {
+		return c.handleSyncStream(ctx, serverPubKey, sysInfo, msgHandler)
 	})
 }
 
 // Job wraps the real client's Job endpoint call and takes care of retries and encryption/decryption of messages
 // Blocking request. The result will be sent via msgHandler callback function
 func (c *GrpcClient) Job(ctx context.Context, msgHandler func(msg *proto.JobRequest) *proto.JobResponse) error {
-	return c.withMgmtStream(ctx, func(ctx context.Context, serverPubKey wgtypes.Key, backOff backoff.BackOff) error {
-		return c.handleJobStream(ctx, serverPubKey, msgHandler, backOff)
+	return c.withMgmtStream(ctx, func(ctx context.Context, serverPubKey wgtypes.Key) error {
+		return c.handleJobStream(ctx, serverPubKey, msgHandler)
 	})
 }
 
@@ -204,7 +204,7 @@ func (c *GrpcClient) Job(ctx context.Context, msgHandler func(msg *proto.JobRequ
 // It takes care of retries, connection readiness, and fetching server public key.
 func (c *GrpcClient) withMgmtStream(
 	ctx context.Context,
-	handler func(ctx context.Context, serverPubKey wgtypes.Key, backOff backoff.BackOff) error,
+	handler func(ctx context.Context, serverPubKey wgtypes.Key) error,
 ) error {
 	backOff := defaultBackoff(ctx)
 	operation := func() error {
@@ -224,7 +224,7 @@ func (c *GrpcClient) withMgmtStream(
 			return err
 		}
 
-		return handler(ctx, *serverPubKey, backOff)
+		return handler(ctx, *serverPubKey)
 	}
 
 	err := backoff.Retry(operation, backOff)
@@ -239,7 +239,6 @@ func (c *GrpcClient) handleJobStream(
 	ctx context.Context,
 	serverPubKey wgtypes.Key,
 	msgHandler func(msg *proto.JobRequest) *proto.JobResponse,
-	backOff backoff.BackOff,
 ) error {
 	ctx, cancelStream := context.WithCancel(ctx)
 	defer cancelStream()
@@ -257,19 +256,6 @@ func (c *GrpcClient) handleJobStream(
 
 	log.Debug("job stream handshake sent successfully")
 
-	// The stream is up, so reset the backoff. This matters for two reasons,
-	// both caused by the backoff lib not resetting its state on a successful
-	// connection:
-	//  1. Without a reset, after a connect followed by an error the next retry
-	//     starts from the accumulated (large) interval instead of retrying
-	//     promptly, delaying reconnection.
-	//  2. Worse, once the accumulated elapsed time exceeds MaxElapsedTime, the
-	//     next stream error makes NextBackOff() return Stop, so the retry loop
-	//     exits immediately. That error is then mislabeled unrecoverable and
-	//     bubbles up to trigger a full engine restart / data-plane teardown
-	//     instead of a silent reconnection.
-	backOff.Reset()
-
 	// Main loop: receive, process, respond
 	for {
 		jobReq, err := c.receiveJobRequest(ctx, stream, serverPubKey)
@@ -385,7 +371,7 @@ func (c *GrpcClient) sendJobResponse(
 	return nil
 }
 
-func (c *GrpcClient) handleSyncStream(ctx context.Context, serverPubKey wgtypes.Key, sysInfo *system.Info, msgHandler func(msg *proto.SyncResponse) error, backOff backoff.BackOff) error {
+func (c *GrpcClient) handleSyncStream(ctx context.Context, serverPubKey wgtypes.Key, sysInfo *system.Info, msgHandler func(msg *proto.SyncResponse) error) error {
 	ctx, cancelStream := context.WithCancel(ctx)
 	defer cancelStream()
 
@@ -404,19 +390,6 @@ func (c *GrpcClient) handleSyncStream(ctx context.Context, serverPubKey wgtypes.
 	c.notifyConnected()
 	c.setSyncStreamConnected()
 
-	// The stream is up, so reset the backoff. This matters for two reasons,
-	// both caused by the backoff lib not resetting its state on a successful
-	// connection:
-	//  1. Without a reset, after a connect followed by an error the next retry
-	//     starts from the accumulated (large) interval instead of retrying
-	//     promptly, delaying reconnection.
-	//  2. Worse, once the accumulated elapsed time exceeds MaxElapsedTime, the
-	//     next stream error makes NextBackOff() return Stop, so the retry loop
-	//     exits immediately. That error is then mislabeled unrecoverable and
-	//     bubbles up to trigger a full engine restart / data-plane teardown
-	//     instead of a silent reconnection.
-	backOff.Reset()
-
 	// blocking until error
 	err = c.receiveUpdatesEvents(stream, serverPubKey, msgHandler)
 	if err != nil {

shared/management/http/api/openapi.yml

@@ -3379,18 +3379,6 @@ components:
             - "observe"
           default: "off"
           description: CrowdSec IP reputation mode. Only available when the proxy cluster supports CrowdSec.
-        allow_match:
-          type: string
-          enum:
-            - "all"
-            - "any"
-          default: "all"
-          description: >-
-            How the allowlists (allowed_cidrs, allowed_countries) combine.
-            "all" (default) requires a connection to match every configured
-            allowlist (AND); "any" requires it to match at least one (OR), e.g.
-            an allowed country OR an allowed CIDR. Blocklists always reject on
-            match regardless of this setting.
     PasswordAuthConfig:
       type: object
       properties:
@@ -5834,48 +5822,13 @@ components:
         total_tokens:
           type: integer
           format: int64
-          description: Total tokens consumed, including prompt-cache tokens.
+          description: Total tokens consumed.
           example: 1840
-        cached_input_tokens:
-          type: integer
-          format: int64
-          description: Input tokens read from the provider's prompt cache. Additive to input_tokens for Anthropic-shape providers; a subset of input_tokens for OpenAI.
-          example: 0
-        cache_creation_tokens:
-          type: integer
-          format: int64
-          description: Input tokens written to the provider's prompt cache. Zero for providers without a cache-write bucket.
-          example: 30528
         cost_usd:
           type: number
           format: double
           description: Estimated USD cost of the request.
           example: 0.0231
-        input_cost_usd:
-          type: number
-          format: double
-          description: Cost of the non-cached input tokens. Base component of cost_usd.
-          example: 0.0048
-        cached_input_cost_usd:
-          type: number
-          format: double
-          description: Cost of the prompt-cache read tokens. Base component of cost_usd, and part of cache_cost_usd.
-          example: 0.0015
-        cache_creation_cost_usd:
-          type: number
-          format: double
-          description: Cost of the prompt-cache write tokens. Base component of cost_usd, and part of cache_cost_usd.
-          example: 0.1130
-        output_cost_usd:
-          type: number
-          format: double
-          description: Cost of the output tokens. Base component of cost_usd.
-          example: 0.0038
-        cache_cost_usd:
-          type: number
-          format: double
-          description: Portion of cost_usd billed for prompt-cache usage.
-          example: 0.1145
         stream:
           type: boolean
           description: Whether the request was a streaming completion.
@@ -5899,14 +5852,7 @@ components:
         - input_tokens
         - output_tokens
         - total_tokens
-        - cached_input_tokens
-        - cache_creation_tokens
-        - input_cost_usd
-        - cached_input_cost_usd
-        - cache_creation_cost_usd
-        - output_cost_usd
         - cost_usd
-        - cache_cost_usd
     AgentNetworkAccessLogsResponse:
       type: object
       properties:
@@ -5980,48 +5926,13 @@ components:
         total_tokens:
           type: integer
           format: int64
-          description: Total tokens across the session, including prompt-cache tokens.
+          description: Total tokens across the session.
           example: 12880
-        cached_input_tokens:
-          type: integer
-          format: int64
-          description: Total prompt-cache read tokens across the session.
-          example: 0
-        cache_creation_tokens:
-          type: integer
-          format: int64
-          description: Total prompt-cache write tokens across the session.
-          example: 30528
         cost_usd:
           type: number
           format: double
           description: Total estimated USD cost across the session.
           example: 0.1617
-        input_cost_usd:
-          type: number
-          format: double
-          description: Total cost of non-cached input tokens across the session.
-          example: 0.0210
-        cached_input_cost_usd:
-          type: number
-          format: double
-          description: Total cost of prompt-cache read tokens across the session.
-          example: 0.0015
-        cache_creation_cost_usd:
-          type: number
-          format: double
-          description: Total cost of prompt-cache write tokens across the session.
-          example: 0.1130
-        output_cost_usd:
-          type: number
-          format: double
-          description: Total cost of output tokens across the session.
-          example: 0.0262
-        cache_cost_usd:
-          type: number
-          format: double
-          description: Portion of cost_usd billed for prompt-cache usage across the session.
-          example: 0.1145
         providers:
           type: array
           items:
@@ -6048,14 +5959,7 @@ components:
         - input_tokens
         - output_tokens
         - total_tokens
-        - cached_input_tokens
-        - cache_creation_tokens
-        - input_cost_usd
-        - cached_input_cost_usd
-        - cache_creation_cost_usd
-        - output_cost_usd
         - cost_usd
-        - cache_cost_usd
         - decision
         - entries
     AgentNetworkAccessLogSessionsResponse:
@@ -6109,61 +6013,19 @@ components:
         total_tokens:
           type: integer
           format: int64
-          description: Total tokens in the bucket, including prompt-cache tokens.
+          description: Total tokens in the bucket.
           example: 184000
-        cached_input_tokens:
-          type: integer
-          format: int64
-          description: Total prompt-cache read tokens in the bucket.
-          example: 20000
-        cache_creation_tokens:
-          type: integer
-          format: int64
-          description: Total prompt-cache write tokens in the bucket.
-          example: 45000
-        input_cost_usd:
-          type: number
-          format: double
-          description: Total cost of non-cached input tokens in the bucket.
-          example: 1.12
-        cached_input_cost_usd:
-          type: number
-          format: double
-          description: Total cost of prompt-cache read tokens in the bucket.
-          example: 0.06
-        cache_creation_cost_usd:
-          type: number
-          format: double
-          description: Total cost of prompt-cache write tokens in the bucket.
-          example: 0.36
-        output_cost_usd:
-          type: number
-          format: double
-          description: Total cost of output tokens in the bucket.
-          example: 0.77
         cost_usd:
           type: number
           format: double
           description: Total estimated USD spend in the bucket.
           example: 2.31
-        cache_cost_usd:
-          type: number
-          format: double
-          description: Portion of cost_usd billed for prompt-cache usage in the bucket.
-          example: 0.42
       required:
         - period_start
         - input_tokens
         - output_tokens
         - total_tokens
-        - cached_input_tokens
-        - cache_creation_tokens
-        - input_cost_usd
-        - cached_input_cost_usd
-        - cache_creation_cost_usd
-        - output_cost_usd
         - cost_usd
-        - cache_cost_usd
     AgentNetworkSettings:
       type: object
       description: Per-account Agent Network gateway settings. One row per account; cluster and subdomain are auto-assigned on first provider create and immutable thereafter.

shared/management/http/api/types.gen.go

@@ -17,24 +17,6 @@ const (
 	TokenAuthScopes  tokenAuthContextKey  = "TokenAuth.Scopes"
 )
 
-// Defines values for AccessRestrictionsAllowMatch.
-const (
-	AccessRestrictionsAllowMatchAll AccessRestrictionsAllowMatch = "all"
-	AccessRestrictionsAllowMatchAny AccessRestrictionsAllowMatch = "any"
-)
-
-// Valid indicates whether the value is a known member of the AccessRestrictionsAllowMatch enum.
-func (e AccessRestrictionsAllowMatch) Valid() bool {
-	switch e {
-	case AccessRestrictionsAllowMatchAll:
-		return true
-	case AccessRestrictionsAllowMatchAny:
-		return true
-	default:
-		return false
-	}
-}
-
 // Defines values for AccessRestrictionsCrowdsecMode.
 const (
 	AccessRestrictionsCrowdsecModeEnforce AccessRestrictionsCrowdsecMode = "enforce"
@@ -1552,9 +1534,6 @@ func (e PutApiIntegrationsMspTenantsIdInviteJSONBodyValue) Valid() bool {
 
 // AccessRestrictions Connection-level access restrictions based on IP address or geography. Applies to both HTTP and L4 services.
 type AccessRestrictions struct {
-	// AllowMatch How the allowlists (allowed_cidrs, allowed_countries) combine. "all" (default) requires a connection to match every configured allowlist (AND); "any" requires it to match at least one (OR), e.g. an allowed country OR an allowed CIDR. Blocklists always reject on match regardless of this setting.
-	AllowMatch *AccessRestrictionsAllowMatch `json:"allow_match,omitempty"`
-
 	// AllowedCidrs CIDR allowlist. If non-empty, only IPs matching these CIDRs are allowed.
 	AllowedCidrs *[]string `json:"allowed_cidrs,omitempty"`
 
@@ -1571,9 +1550,6 @@ type AccessRestrictions struct {
 	CrowdsecMode *AccessRestrictionsCrowdsecMode `json:"crowdsec_mode,omitempty"`
 }
 
-// AccessRestrictionsAllowMatch How the allowlists (allowed_cidrs, allowed_countries) combine. "all" (default) requires a connection to match every configured allowlist (AND); "any" requires it to match at least one (OR), e.g. an allowed country OR an allowed CIDR. Blocklists always reject on match regardless of this setting.
-type AccessRestrictionsAllowMatch string
-
 // AccessRestrictionsCrowdsecMode CrowdSec IP reputation mode. Only available when the proxy cluster supports CrowdSec.
 type AccessRestrictionsCrowdsecMode string
 
@@ -1756,21 +1732,6 @@ type AccountSettings struct {
 
 // AgentNetworkAccessLog One per-request agent-network (LLM) access log entry with flattened, queryable LLM dimensions.
 type AgentNetworkAccessLog struct {
-	// CacheCostUsd Portion of cost_usd billed for prompt-cache usage.
-	CacheCostUsd float64 `json:"cache_cost_usd"`
-
-	// CacheCreationCostUsd Cost of the prompt-cache write tokens. Base component of cost_usd, and part of cache_cost_usd.
-	CacheCreationCostUsd float64 `json:"cache_creation_cost_usd"`
-
-	// CacheCreationTokens Input tokens written to the provider's prompt cache. Zero for providers without a cache-write bucket.
-	CacheCreationTokens int64 `json:"cache_creation_tokens"`
-
-	// CachedInputCostUsd Cost of the prompt-cache read tokens. Base component of cost_usd, and part of cache_cost_usd.
-	CachedInputCostUsd float64 `json:"cached_input_cost_usd"`
-
-	// CachedInputTokens Input tokens read from the provider's prompt cache. Additive to input_tokens for Anthropic-shape providers; a subset of input_tokens for OpenAI.
-	CachedInputTokens int64 `json:"cached_input_tokens"`
-
 	// CostUsd Estimated USD cost of the request.
 	CostUsd float64 `json:"cost_usd"`
 
@@ -1792,9 +1753,6 @@ type AgentNetworkAccessLog struct {
 	// Id Unique identifier for the access log entry.
 	Id string `json:"id"`
 
-	// InputCostUsd Cost of the non-cached input tokens. Base component of cost_usd.
-	InputCostUsd float64 `json:"input_cost_usd"`
-
 	// InputTokens Input (prompt) tokens consumed.
 	InputTokens int64 `json:"input_tokens"`
 
@@ -1804,9 +1762,6 @@ type AgentNetworkAccessLog struct {
 	// Model Requested LLM model.
 	Model *string `json:"model,omitempty"`
 
-	// OutputCostUsd Cost of the output tokens. Base component of cost_usd.
-	OutputCostUsd float64 `json:"output_cost_usd"`
-
 	// OutputTokens Output (completion) tokens produced.
 	OutputTokens int64 `json:"output_tokens"`
 
@@ -1846,7 +1801,7 @@ type AgentNetworkAccessLog struct {
 	// Timestamp Timestamp when the request was made.
 	Timestamp time.Time `json:"timestamp"`
 
-	// TotalTokens Total tokens consumed, including prompt-cache tokens.
+	// TotalTokens Total tokens consumed.
 	TotalTokens int64 `json:"total_tokens"`
 
 	// UserId NetBird user id of the authenticated caller, if applicable.
@@ -1855,21 +1810,6 @@ type AgentNetworkAccessLog struct {
 
 // AgentNetworkAccessLogSession A session-grouped view of agent-network access logs — all requests sharing a session id (or a single session-less request) folded into one summary plus its ordered entries.
 type AgentNetworkAccessLogSession struct {
-	// CacheCostUsd Portion of cost_usd billed for prompt-cache usage across the session.
-	CacheCostUsd float64 `json:"cache_cost_usd"`
-
-	// CacheCreationCostUsd Total cost of prompt-cache write tokens across the session.
-	CacheCreationCostUsd float64 `json:"cache_creation_cost_usd"`
-
-	// CacheCreationTokens Total prompt-cache write tokens across the session.
-	CacheCreationTokens int64 `json:"cache_creation_tokens"`
-
-	// CachedInputCostUsd Total cost of prompt-cache read tokens across the session.
-	CachedInputCostUsd float64 `json:"cached_input_cost_usd"`
-
-	// CachedInputTokens Total prompt-cache read tokens across the session.
-	CachedInputTokens int64 `json:"cached_input_tokens"`
-
 	// CostUsd Total estimated USD cost across the session.
 	CostUsd float64 `json:"cost_usd"`
 
@@ -1885,18 +1825,12 @@ type AgentNetworkAccessLogSession struct {
 	// GroupIds Union of the authorising group ids across the session's entries.
 	GroupIds *[]string `json:"group_ids,omitempty"`
 
-	// InputCostUsd Total cost of non-cached input tokens across the session.
-	InputCostUsd float64 `json:"input_cost_usd"`
-
 	// InputTokens Total input (prompt) tokens across the session.
 	InputTokens int64 `json:"input_tokens"`
 
 	// Models Distinct models seen in the session.
 	Models *[]string `json:"models,omitempty"`
 
-	// OutputCostUsd Total cost of output tokens across the session.
-	OutputCostUsd float64 `json:"output_cost_usd"`
-
 	// OutputTokens Total output (completion) tokens across the session.
 	OutputTokens int64 `json:"output_tokens"`
 
@@ -1912,7 +1846,7 @@ type AgentNetworkAccessLogSession struct {
 	// StartedAt Timestamp of the session's earliest request.
 	StartedAt time.Time `json:"started_at"`
 
-	// TotalTokens Total tokens across the session, including prompt-cache tokens.
+	// TotalTokens Total tokens across the session.
 	TotalTokens int64 `json:"total_tokens"`
 
 	// UserId NetBird user id of the session's caller.
@@ -2413,40 +2347,19 @@ type AgentNetworkSettingsRequest struct {
 
 // AgentNetworkUsageBucket One aggregated agent-network usage time bucket (UTC). The bucket width is set by the request's granularity.
 type AgentNetworkUsageBucket struct {
-	// CacheCostUsd Portion of cost_usd billed for prompt-cache usage in the bucket.
-	CacheCostUsd float64 `json:"cache_cost_usd"`
-
-	// CacheCreationCostUsd Total cost of prompt-cache write tokens in the bucket.
-	CacheCreationCostUsd float64 `json:"cache_creation_cost_usd"`
-
-	// CacheCreationTokens Total prompt-cache write tokens in the bucket.
-	CacheCreationTokens int64 `json:"cache_creation_tokens"`
-
-	// CachedInputCostUsd Total cost of prompt-cache read tokens in the bucket.
-	CachedInputCostUsd float64 `json:"cached_input_cost_usd"`
-
-	// CachedInputTokens Total prompt-cache read tokens in the bucket.
-	CachedInputTokens int64 `json:"cached_input_tokens"`
-
 	// CostUsd Total estimated USD spend in the bucket.
 	CostUsd float64 `json:"cost_usd"`
 
-	// InputCostUsd Total cost of non-cached input tokens in the bucket.
-	InputCostUsd float64 `json:"input_cost_usd"`
-
 	// InputTokens Total input (prompt) tokens in the bucket.
 	InputTokens int64 `json:"input_tokens"`
 
-	// OutputCostUsd Total cost of output tokens in the bucket.
-	OutputCostUsd float64 `json:"output_cost_usd"`
-
 	// OutputTokens Total output (completion) tokens in the bucket.
 	OutputTokens int64 `json:"output_tokens"`
 
 	// PeriodStart Start of the bucket in YYYY-MM-DD (UTC) — the day, the week start (Monday), or the month start, depending on granularity.
 	PeriodStart string `json:"period_start"`
 
-	// TotalTokens Total tokens in the bucket, including prompt-cache tokens.
+	// TotalTokens Total tokens in the bucket.
 	TotalTokens int64 `json:"total_tokens"`
 }
 

shared/management/proto/proxy_service.pb.go

@@ -990,10 +990,6 @@ type AccessRestrictions struct {
 	BlockedCountries []string `protobuf:"bytes,4,rep,name=blocked_countries,json=blockedCountries,proto3" json:"blocked_countries,omitempty"`
 	// CrowdSec IP reputation mode: "", "off", "enforce", or "observe".
 	CrowdsecMode string `protobuf:"bytes,5,opt,name=crowdsec_mode,json=crowdsecMode,proto3" json:"crowdsec_mode,omitempty"`
-	// How the allowlists (CIDR, country) combine: "" or "all" require matching
-	// every allowlist (AND); "any" requires matching at least one (OR).
-	// Blocklists are always a hard-deny gate, independent of this mode.
-	AllowMatch string `protobuf:"bytes,6,opt,name=allow_match,json=allowMatch,proto3" json:"allow_match,omitempty"`
 }
 
 func (x *AccessRestrictions) Reset() {
@@ -1063,13 +1059,6 @@ func (x *AccessRestrictions) GetCrowdsecMode() string {
 	return ""
 }
 
-func (x *AccessRestrictions) GetAllowMatch() string {
-	if x != nil {
-		return x.AllowMatch
-	}
-	return ""
-}
-
 type ProxyMapping struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -3330,7 +3319,7 @@ var file_proxy_service_proto_rawDesc = []byte{
 	0x72, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e,
 	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x65, 0x61, 0x64, 0x65,
 	0x72, 0x41, 0x75, 0x74, 0x68, 0x52, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74,
-	0x68, 0x73, 0x22, 0xfe, 0x01, 0x0a, 0x12, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x65, 0x73,
+	0x68, 0x73, 0x22, 0xdd, 0x01, 0x0a, 0x12, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x65, 0x73,
 	0x74, 0x72, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x61, 0x6c, 0x6c,
 	0x6f, 0x77, 0x65, 0x64, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09,
 	0x52, 0x0c, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x43, 0x69, 0x64, 0x72, 0x73, 0x12, 0x23,
@@ -3344,395 +3333,393 @@ var file_proxy_service_proto_rawDesc = []byte{
 	0x63, 0x6b, 0x65, 0x64, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x72, 0x69, 0x65, 0x73, 0x12, 0x23, 0x0a,
 	0x0d, 0x63, 0x72, 0x6f, 0x77, 0x64, 0x73, 0x65, 0x63, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x05,
 	0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x72, 0x6f, 0x77, 0x64, 0x73, 0x65, 0x63, 0x4d, 0x6f,
-	0x64, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x5f, 0x6d, 0x61, 0x74, 0x63,
-	0x68, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x4d, 0x61,
-	0x74, 0x63, 0x68, 0x22, 0x80, 0x04, 0x0a, 0x0c, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70,
-	0x70, 0x69, 0x6e, 0x67, 0x12, 0x36, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0e, 0x32, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61,
-	0x74, 0x65, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x0e, 0x0a, 0x02,
-	0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a,
-	0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x64,
-	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d,
-	0x61, 0x69, 0x6e, 0x12, 0x2b, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x05, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x17, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50,
-	0x61, 0x74, 0x68, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68,
-	0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x06,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x75, 0x74, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12,
-	0x2e, 0x0a, 0x04, 0x61, 0x75, 0x74, 0x68, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65,
-	0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x04, 0x61, 0x75, 0x74, 0x68, 0x12,
-	0x28, 0x0a, 0x10, 0x70, 0x61, 0x73, 0x73, 0x5f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x68, 0x65, 0x61,
-	0x64, 0x65, 0x72, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x70, 0x61, 0x73, 0x73, 0x48,
-	0x6f, 0x73, 0x74, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x2b, 0x0a, 0x11, 0x72, 0x65, 0x77,
-	0x72, 0x69, 0x74, 0x65, 0x5f, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x73, 0x18, 0x09,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x72, 0x65, 0x77, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x64,
-	0x69, 0x72, 0x65, 0x63, 0x74, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x0a,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x6c, 0x69,
-	0x73, 0x74, 0x65, 0x6e, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x05, 0x52,
-	0x0a, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x4f, 0x0a, 0x13, 0x61,
-	0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x72, 0x65, 0x73, 0x74, 0x72, 0x69, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x65, 0x73, 0x74,
-	0x72, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x12, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73,
-	0x52, 0x65, 0x73, 0x74, 0x72, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x18, 0x0a, 0x07,
-	0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x70,
-	0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x22, 0x3f, 0x0a, 0x14, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63,
-	0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x27,
-	0x0a, 0x03, 0x6c, 0x6f, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c,
-	0x6f, 0x67, 0x52, 0x03, 0x6c, 0x6f, 0x67, 0x22, 0x17, 0x0a, 0x15, 0x53, 0x65, 0x6e, 0x64, 0x41,
-	0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x22, 0xa9, 0x05, 0x0a, 0x09, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x12, 0x38,
-	0x0a, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x74,
-	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x12, 0x15, 0x0a, 0x06, 0x6c, 0x6f, 0x67, 0x5f,
-	0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6c, 0x6f, 0x67, 0x49, 0x64, 0x12,
-	0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x1d,
-	0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x12, 0x0a,
-	0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73,
-	0x74, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x1f, 0x0a, 0x0b, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x5f, 0x6d, 0x73, 0x18, 0x07, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0a, 0x64, 0x75, 0x72, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64,
-	0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x23,
-	0x0a, 0x0d, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18,
-	0x09, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0c, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x43,
-	0x6f, 0x64, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x70,
-	0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x70,
-	0x12, 0x25, 0x0a, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x63, 0x68, 0x61, 0x6e, 0x69,
-	0x73, 0x6d, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x65,
-	0x63, 0x68, 0x61, 0x6e, 0x69, 0x73, 0x6d, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f,
-	0x69, 0x64, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64,
-	0x12, 0x21, 0x0a, 0x0c, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73,
-	0x18, 0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x53, 0x75, 0x63, 0x63,
-	0x65, 0x73, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x62, 0x79, 0x74, 0x65, 0x73, 0x5f, 0x75, 0x70, 0x6c,
-	0x6f, 0x61, 0x64, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x62, 0x79, 0x74, 0x65, 0x73,
-	0x55, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x62, 0x79, 0x74, 0x65, 0x73, 0x5f,
-	0x64, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0d,
-	0x62, 0x79, 0x74, 0x65, 0x73, 0x44, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x1a, 0x0a,
-	0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x10, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x3f, 0x0a, 0x08, 0x6d, 0x65, 0x74,
-	0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x11, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c,
-	0x6f, 0x67, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79,
-	0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x23, 0x0a, 0x0d, 0x61, 0x67,
-	0x65, 0x6e, 0x74, 0x5f, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x12, 0x20, 0x01, 0x28,
-	0x08, 0x52, 0x0c, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x1a,
-	0x3b, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79,
-	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
-	0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xf8, 0x01, 0x0a,
-	0x13, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f,
-	0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e,
-	0x74, 0x49, 0x64, 0x12, 0x39, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x48, 0x00, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x2a,
-	0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x12, 0x40, 0x0a, 0x0b, 0x68, 0x65,
-	0x61, 0x64, 0x65, 0x72, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x65, 0x61,
-	0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00,
-	0x52, 0x0a, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x42, 0x09, 0x0a, 0x07,
-	0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x57, 0x0a, 0x11, 0x48, 0x65, 0x61, 0x64, 0x65,
-	0x72, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x21, 0x0a, 0x0c,
-	0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12,
-	0x1f, 0x0a, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65,
-	0x22, 0x2d, 0x0a, 0x0f, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22,
-	0x1e, 0x0a, 0x0a, 0x50, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x10, 0x0a,
-	0x03, 0x70, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x22,
-	0x55, 0x0a, 0x14, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65,
-	0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73,
-	0x73, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b,
-	0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f,
-	0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0xda, 0x02, 0x0a, 0x17, 0x53, 0x65, 0x6e, 0x64, 0x53,
-	0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49,
-	0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64,
-	0x12, 0x2f, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e,
-	0x32, 0x17, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72,
-	0x6f, 0x78, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75,
-	0x73, 0x12, 0x2d, 0x0a, 0x12, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65,
-	0x5f, 0x69, 0x73, 0x73, 0x75, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x63,
-	0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x49, 0x73, 0x73, 0x75, 0x65, 0x64,
-	0x12, 0x28, 0x0a, 0x0d, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67,
-	0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0c, 0x65, 0x72, 0x72, 0x6f, 0x72,
-	0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x88, 0x01, 0x01, 0x12, 0x50, 0x0a, 0x10, 0x69, 0x6e,
-	0x62, 0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x18, 0x32,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x4c, 0x69,
-	0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x48, 0x01, 0x52, 0x0f, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e,
-	0x64, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x88, 0x01, 0x01, 0x42, 0x10, 0x0a, 0x0e,
-	0x5f, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x42, 0x13,
-	0x0a, 0x11, 0x5f, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x6c, 0x69, 0x73, 0x74, 0x65,
-	0x6e, 0x65, 0x72, 0x22, 0x6f, 0x0a, 0x14, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x49, 0x6e, 0x62, 0x6f,
-	0x75, 0x6e, 0x64, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x12, 0x1b, 0x0a, 0x09, 0x74,
-	0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x5f, 0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
-	0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x49, 0x70, 0x12, 0x1d, 0x0a, 0x0a, 0x68, 0x74, 0x74, 0x70,
-	0x73, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x68, 0x74,
-	0x74, 0x70, 0x73, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x68, 0x74, 0x74, 0x70, 0x5f,
-	0x70, 0x6f, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x08, 0x68, 0x74, 0x74, 0x70,
-	0x50, 0x6f, 0x72, 0x74, 0x22, 0x1a, 0x0a, 0x18, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74,
-	0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x22, 0xb8, 0x01, 0x0a, 0x16, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79,
-	0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x09, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63,
-	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
-	0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b,
-	0x65, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12,
-	0x30, 0x0a, 0x14, 0x77, 0x69, 0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x5f, 0x70, 0x75, 0x62,
-	0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x77,
-	0x69, 0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65,
-	0x79, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x18, 0x05, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x07, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x22, 0x6f, 0x0a, 0x17, 0x43,
-	0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65,
+	0x64, 0x65, 0x22, 0x80, 0x04, 0x0a, 0x0c, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70,
+	0x69, 0x6e, 0x67, 0x12, 0x36, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50,
+	0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74,
+	0x65, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69,
+	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61,
+	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x12, 0x2b, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x17, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x61,
+	0x74, 0x68, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12,
+	0x1d, 0x0a, 0x0a, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x06, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x75, 0x74, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x2e,
+	0x0a, 0x04, 0x61, 0x75, 0x74, 0x68, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e,
+	0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x04, 0x61, 0x75, 0x74, 0x68, 0x12, 0x28,
+	0x0a, 0x10, 0x70, 0x61, 0x73, 0x73, 0x5f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x68, 0x65, 0x61, 0x64,
+	0x65, 0x72, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x70, 0x61, 0x73, 0x73, 0x48, 0x6f,
+	0x73, 0x74, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x2b, 0x0a, 0x11, 0x72, 0x65, 0x77, 0x72,
+	0x69, 0x74, 0x65, 0x5f, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x73, 0x18, 0x09, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x10, 0x72, 0x65, 0x77, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x64, 0x69,
+	0x72, 0x65, 0x63, 0x74, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x0a, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x6c, 0x69, 0x73,
+	0x74, 0x65, 0x6e, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0a,
+	0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x4f, 0x0a, 0x13, 0x61, 0x63,
+	0x63, 0x65, 0x73, 0x73, 0x5f, 0x72, 0x65, 0x73, 0x74, 0x72, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x65, 0x73, 0x74, 0x72,
+	0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x12, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52,
+	0x65, 0x73, 0x74, 0x72, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x70,
+	0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x70, 0x72,
+	0x69, 0x76, 0x61, 0x74, 0x65, 0x22, 0x3f, 0x0a, 0x14, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x27, 0x0a,
+	0x03, 0x6c, 0x6f, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f,
+	0x67, 0x52, 0x03, 0x6c, 0x6f, 0x67, 0x22, 0x17, 0x0a, 0x15, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63,
+	0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0xa9, 0x05, 0x0a, 0x09, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x12, 0x38, 0x0a,
+	0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x74, 0x69,
+	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x12, 0x15, 0x0a, 0x06, 0x6c, 0x6f, 0x67, 0x5f, 0x69,
+	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6c, 0x6f, 0x67, 0x49, 0x64, 0x12, 0x1d,
+	0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x1d, 0x0a,
+	0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x12, 0x0a, 0x04,
+	0x68, 0x6f, 0x73, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74,
+	0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x70, 0x61, 0x74, 0x68, 0x12, 0x1f, 0x0a, 0x0b, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x5f, 0x6d, 0x73, 0x18, 0x07, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0a, 0x64, 0x75, 0x72, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x4d, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18,
+	0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x23, 0x0a,
+	0x0d, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x09,
+	0x20, 0x01, 0x28, 0x05, 0x52, 0x0c, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x43, 0x6f,
+	0x64, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x70, 0x18,
+	0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x70, 0x12,
+	0x25, 0x0a, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x63, 0x68, 0x61, 0x6e, 0x69, 0x73,
+	0x6d, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x63,
+	0x68, 0x61, 0x6e, 0x69, 0x73, 0x6d, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69,
+	0x64, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12,
+	0x21, 0x0a, 0x0c, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x18,
+	0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x53, 0x75, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x62, 0x79, 0x74, 0x65, 0x73, 0x5f, 0x75, 0x70, 0x6c, 0x6f,
+	0x61, 0x64, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x62, 0x79, 0x74, 0x65, 0x73, 0x55,
+	0x70, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x62, 0x79, 0x74, 0x65, 0x73, 0x5f, 0x64,
+	0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0d, 0x62,
+	0x79, 0x74, 0x65, 0x73, 0x44, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x1a, 0x0a, 0x08,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x10, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x3f, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x18, 0x11, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f,
+	0x67, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
+	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x23, 0x0a, 0x0d, 0x61, 0x67, 0x65,
+	0x6e, 0x74, 0x5f, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x12, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x0c, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x1a, 0x3b,
+	0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12,
+	0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65,
+	0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xf8, 0x01, 0x0a, 0x13,
+	0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69,
+	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74,
+	0x49, 0x64, 0x12, 0x39, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x48, 0x00, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x2a, 0x0a,
+	0x03, 0x70, 0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x48, 0x00, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x12, 0x40, 0x0a, 0x0b, 0x68, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x65, 0x61, 0x64,
+	0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52,
+	0x0a, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x42, 0x09, 0x0a, 0x07, 0x72,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x57, 0x0a, 0x11, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72,
+	0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x21, 0x0a, 0x0c, 0x68,
+	0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x1f,
+	0x0a, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0a, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x22,
+	0x2d, 0x0a, 0x0f, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0x1e,
+	0x0a, 0x0a, 0x50, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x10, 0x0a, 0x03,
+	0x70, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x22, 0x55,
+	0x0a, 0x14, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65,
 	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73,
 	0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73,
-	0x12, 0x28, 0x0a, 0x0d, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67,
-	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0c, 0x65, 0x72, 0x72, 0x6f, 0x72,
-	0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x88, 0x01, 0x01, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x65,
-	0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x65, 0x0a, 0x11,
-	0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
-	0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64,
-	0x12, 0x21, 0x0a, 0x0c, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x5f, 0x75, 0x72, 0x6c,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74,
-	0x55, 0x72, 0x6c, 0x22, 0x26, 0x0a, 0x12, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52,
-	0x4c, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x22, 0x55, 0x0a, 0x16, 0x56,
-	0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x23, 0x0a,
-	0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b,
-	0x65, 0x6e, 0x22, 0xdc, 0x01, 0x0a, 0x17, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53,
-	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x14,
-	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x76,
-	0x61, 0x6c, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x1d, 0x0a,
-	0x0a, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x09, 0x75, 0x73, 0x65, 0x72, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x23, 0x0a, 0x0d,
-	0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x04, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x0c, 0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x52, 0x65, 0x61, 0x73, 0x6f,
-	0x6e, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f,
-	0x69, 0x64, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x47,
-	0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x28, 0x0a, 0x10, 0x70, 0x65, 0x65, 0x72, 0x5f,
-	0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28,
-	0x09, 0x52, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x4e, 0x61, 0x6d, 0x65,
-	0x73, 0x22, 0x50, 0x0a, 0x19, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e,
-	0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b,
-	0x0a, 0x09, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x5f, 0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x08, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x49, 0x70, 0x12, 0x16, 0x0a, 0x06, 0x64,
-	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d,
-	0x61, 0x69, 0x6e, 0x22, 0x84, 0x02, 0x0a, 0x1a, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65,
-	0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x08, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72,
-	0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49,
-	0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x75, 0x73, 0x65, 0x72, 0x45, 0x6d, 0x61, 0x69, 0x6c,
-	0x12, 0x23, 0x0a, 0x0d, 0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x61, 0x73, 0x6f,
-	0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x52,
-	0x65, 0x61, 0x73, 0x6f, 0x6e, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
-	0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65,
-	0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x06, 0x20, 0x03,
-	0x28, 0x09, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73,
-	0x12, 0x28, 0x0a, 0x10, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x6e,
-	0x61, 0x6d, 0x65, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x70, 0x65, 0x65, 0x72,
-	0x47, 0x72, 0x6f, 0x75, 0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x22, 0x81, 0x01, 0x0a, 0x13, 0x53,
-	0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x32, 0x0a, 0x04, 0x69, 0x6e, 0x69, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x79,
-	0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x49, 0x6e, 0x69, 0x74, 0x48, 0x00,
-	0x52, 0x04, 0x69, 0x6e, 0x69, 0x74, 0x12, 0x2f, 0x0a, 0x03, 0x61, 0x63, 0x6b, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x41, 0x63, 0x6b,
-	0x48, 0x00, 0x52, 0x03, 0x61, 0x63, 0x6b, 0x42, 0x05, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x22, 0xdf,
-	0x01, 0x0a, 0x10, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x49,
-	0x6e, 0x69, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x5f, 0x69, 0x64, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x49, 0x64, 0x12, 0x18,
-	0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x39, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x72,
-	0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54,
-	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x73, 0x74, 0x61, 0x72, 0x74, 0x65,
-	0x64, 0x41, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x41, 0x0a,
-	0x0c, 0x63, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x05, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69,
-	0x65, 0x73, 0x52, 0x0c, 0x63, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73,
-	0x22, 0x11, 0x0a, 0x0f, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73,
-	0x41, 0x63, 0x6b, 0x22, 0x7e, 0x0a, 0x14, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69,
-	0x6e, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x32, 0x0a, 0x07, 0x6d,
-	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d,
-	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x07, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12,
-	0x32, 0x0a, 0x15, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x79, 0x6e, 0x63, 0x5f,
-	0x63, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x13,
-	0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x79, 0x6e, 0x63, 0x43, 0x6f, 0x6d, 0x70, 0x6c,
-	0x65, 0x74, 0x65, 0x22, 0xa9, 0x01, 0x0a, 0x1b, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d,
-	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69,
-	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74,
-	0x49, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x67,
-	0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08,
-	0x67, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x72, 0x6f, 0x76,
-	0x69, 0x64, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x70,
-	0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x49, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x6d, 0x6f, 0x64,
-	0x65, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x22,
-	0xff, 0x01, 0x0a, 0x1c, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x12, 0x1a, 0x0a, 0x08, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x08, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2c, 0x0a, 0x12,
-	0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x5f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5f,
-	0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74,
-	0x65, 0x64, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x64, 0x12, 0x30, 0x0a, 0x14, 0x61, 0x74,
-	0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f,
-	0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62,
-	0x75, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x12, 0x25, 0x0a, 0x0e,
-	0x77, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x03, 0x52, 0x0d, 0x77, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x53, 0x65, 0x63, 0x6f,
-	0x6e, 0x64, 0x73, 0x12, 0x1b, 0x0a, 0x09, 0x64, 0x65, 0x6e, 0x79, 0x5f, 0x63, 0x6f, 0x64, 0x65,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x64, 0x65, 0x6e, 0x79, 0x43, 0x6f, 0x64, 0x65,
-	0x12, 0x1f, 0x0a, 0x0b, 0x64, 0x65, 0x6e, 0x79, 0x5f, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18,
-	0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x64, 0x65, 0x6e, 0x79, 0x52, 0x65, 0x61, 0x73, 0x6f,
-	0x6e, 0x22, 0x91, 0x02, 0x0a, 0x15, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55,
-	0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x61,
-	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73,
-	0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65,
-	0x72, 0x49, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x12, 0x25,
-	0x0a, 0x0e, 0x77, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0d, 0x77, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x53, 0x65,
-	0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x5f,
-	0x69, 0x6e, 0x70, 0x75, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x74, 0x6f, 0x6b,
-	0x65, 0x6e, 0x73, 0x49, 0x6e, 0x70, 0x75, 0x74, 0x12, 0x23, 0x0a, 0x0d, 0x74, 0x6f, 0x6b, 0x65,
-	0x6e, 0x73, 0x5f, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x03, 0x52,
-	0x0c, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x12, 0x19, 0x0a,
-	0x08, 0x63, 0x6f, 0x73, 0x74, 0x5f, 0x75, 0x73, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x01, 0x52,
-	0x07, 0x63, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x67, 0x72, 0x6f, 0x75,
-	0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x67, 0x72, 0x6f,
-	0x75, 0x70, 0x49, 0x64, 0x73, 0x22, 0x18, 0x0a, 0x16, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c,
-	0x4c, 0x4d, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2a,
-	0x64, 0x0a, 0x16, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55,
-	0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x17, 0x0a, 0x13, 0x55, 0x50, 0x44,
-	0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x44,
-	0x10, 0x00, 0x12, 0x18, 0x0a, 0x14, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50,
-	0x45, 0x5f, 0x4d, 0x4f, 0x44, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x01, 0x12, 0x17, 0x0a, 0x13,
-	0x55, 0x50, 0x44, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x52, 0x45, 0x4d, 0x4f,
-	0x56, 0x45, 0x44, 0x10, 0x02, 0x2a, 0x46, 0x0a, 0x0f, 0x50, 0x61, 0x74, 0x68, 0x52, 0x65, 0x77,
-	0x72, 0x69, 0x74, 0x65, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x18, 0x0a, 0x14, 0x50, 0x41, 0x54, 0x48,
-	0x5f, 0x52, 0x45, 0x57, 0x52, 0x49, 0x54, 0x45, 0x5f, 0x44, 0x45, 0x46, 0x41, 0x55, 0x4c, 0x54,
-	0x10, 0x00, 0x12, 0x19, 0x0a, 0x15, 0x50, 0x41, 0x54, 0x48, 0x5f, 0x52, 0x45, 0x57, 0x52, 0x49,
-	0x54, 0x45, 0x5f, 0x50, 0x52, 0x45, 0x53, 0x45, 0x52, 0x56, 0x45, 0x10, 0x01, 0x2a, 0x90, 0x01,
-	0x0a, 0x0e, 0x4d, 0x69, 0x64, 0x64, 0x6c, 0x65, 0x77, 0x61, 0x72, 0x65, 0x53, 0x6c, 0x6f, 0x74,
+	0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65,
+	0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
+	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0xda, 0x02, 0x0a, 0x17, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64,
+	0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12,
+	0x2f, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x17, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f,
+	0x78, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x12, 0x2d, 0x0a, 0x12, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f,
+	0x69, 0x73, 0x73, 0x75, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x63, 0x65,
+	0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x49, 0x73, 0x73, 0x75, 0x65, 0x64, 0x12,
+	0x28, 0x0a, 0x0d, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0c, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x4d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x88, 0x01, 0x01, 0x12, 0x50, 0x0a, 0x10, 0x69, 0x6e, 0x62,
+	0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x18, 0x32, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x4c, 0x69, 0x73,
+	0x74, 0x65, 0x6e, 0x65, 0x72, 0x48, 0x01, 0x52, 0x0f, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64,
+	0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x88, 0x01, 0x01, 0x42, 0x10, 0x0a, 0x0e, 0x5f,
+	0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x42, 0x13, 0x0a,
+	0x11, 0x5f, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e,
+	0x65, 0x72, 0x22, 0x6f, 0x0a, 0x14, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x49, 0x6e, 0x62, 0x6f, 0x75,
+	0x6e, 0x64, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x75,
+	0x6e, 0x6e, 0x65, 0x6c, 0x5f, 0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74,
+	0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x49, 0x70, 0x12, 0x1d, 0x0a, 0x0a, 0x68, 0x74, 0x74, 0x70, 0x73,
+	0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x68, 0x74, 0x74,
+	0x70, 0x73, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x70,
+	0x6f, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x08, 0x68, 0x74, 0x74, 0x70, 0x50,
+	0x6f, 0x72, 0x74, 0x22, 0x1a, 0x0a, 0x18, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0xb8, 0x01, 0x0a, 0x16, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50,
+	0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
+	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63,
+	0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61,
+	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65,
+	0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x30,
+	0x0a, 0x14, 0x77, 0x69, 0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x5f, 0x70, 0x75, 0x62, 0x6c,
+	0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x77, 0x69,
+	0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79,
+	0x12, 0x18, 0x0a, 0x07, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x07, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x22, 0x6f, 0x0a, 0x17, 0x43, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12,
+	0x28, 0x0a, 0x0d, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0c, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x4d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x88, 0x01, 0x01, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x65, 0x72,
+	0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x65, 0x0a, 0x11, 0x47,
+	0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64,
+	0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12,
+	0x21, 0x0a, 0x0c, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x5f, 0x75, 0x72, 0x6c, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55,
+	0x72, 0x6c, 0x22, 0x26, 0x0a, 0x12, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x22, 0x55, 0x0a, 0x16, 0x56, 0x61,
+	0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x23, 0x0a, 0x0d,
+	0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65,
+	0x6e, 0x22, 0xdc, 0x01, 0x0a, 0x17, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65,
+	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x14, 0x0a,
+	0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x76, 0x61,
+	0x6c, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a,
+	0x75, 0x73, 0x65, 0x72, 0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x09, 0x75, 0x73, 0x65, 0x72, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x23, 0x0a, 0x0d, 0x64,
+	0x65, 0x6e, 0x69, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0c, 0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x52, 0x65, 0x61, 0x73, 0x6f, 0x6e,
+	0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69,
+	0x64, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72,
+	0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x28, 0x0a, 0x10, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67,
+	0x72, 0x6f, 0x75, 0x70, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73,
+	0x22, 0x50, 0x0a, 0x19, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e,
+	0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a,
+	0x09, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x5f, 0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x08, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x49, 0x70, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x22, 0x84, 0x02, 0x0a, 0x1a, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54,
+	0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f,
+	0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64,
+	0x12, 0x1d, 0x0a, 0x0a, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x75, 0x73, 0x65, 0x72, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x12,
+	0x23, 0x0a, 0x0d, 0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x52, 0x65,
+	0x61, 0x73, 0x6f, 0x6e, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x73,
+	0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65,
+	0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12,
+	0x28, 0x0a, 0x10, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x6e, 0x61,
+	0x6d, 0x65, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x47,
+	0x72, 0x6f, 0x75, 0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x22, 0x81, 0x01, 0x0a, 0x13, 0x53, 0x79,
+	0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x32, 0x0a, 0x04, 0x69, 0x6e, 0x69, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x79, 0x6e,
+	0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x49, 0x6e, 0x69, 0x74, 0x48, 0x00, 0x52,
+	0x04, 0x69, 0x6e, 0x69, 0x74, 0x12, 0x2f, 0x0a, 0x03, 0x61, 0x63, 0x6b, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x41, 0x63, 0x6b, 0x48,
+	0x00, 0x52, 0x03, 0x61, 0x63, 0x6b, 0x42, 0x05, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x22, 0xdf, 0x01,
+	0x0a, 0x10, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x49, 0x6e,
+	0x69, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x49, 0x64, 0x12, 0x18, 0x0a,
+	0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
+	0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x39, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x72, 0x74,
+	0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69,
+	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x73, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64,
+	0x41, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x41, 0x0a, 0x0c,
+	0x63, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x05, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x50, 0x72, 0x6f, 0x78, 0x79, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65,
+	0x73, 0x52, 0x0c, 0x63, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x22,
+	0x11, 0x0a, 0x0f, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x41,
+	0x63, 0x6b, 0x22, 0x7e, 0x0a, 0x14, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e,
+	0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x32, 0x0a, 0x07, 0x6d, 0x61,
+	0x70, 0x70, 0x69, 0x6e, 0x67, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61,
+	0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x07, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x32,
+	0x0a, 0x15, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x79, 0x6e, 0x63, 0x5f, 0x63,
+	0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x13, 0x69,
+	0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x79, 0x6e, 0x63, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65,
+	0x74, 0x65, 0x22, 0xa9, 0x01, 0x0a, 0x1b, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49,
+	0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x67, 0x72,
+	0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x67,
+	0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x72, 0x6f, 0x76, 0x69,
+	0x64, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x49, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x6d, 0x6f, 0x64, 0x65,
+	0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x22, 0xff,
+	0x01, 0x0a, 0x1c, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x1a, 0x0a, 0x08, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x08, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2c, 0x0a, 0x12, 0x73,
+	0x65, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x5f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5f, 0x69,
+	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x65,
+	0x64, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x64, 0x12, 0x30, 0x0a, 0x14, 0x61, 0x74, 0x74,
+	0x72, 0x69, 0x62, 0x75, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69,
+	0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75,
+	0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x77,
+	0x69, 0x6e, 0x64, 0x6f, 0x77, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x03, 0x52, 0x0d, 0x77, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x53, 0x65, 0x63, 0x6f, 0x6e,
+	0x64, 0x73, 0x12, 0x1b, 0x0a, 0x09, 0x64, 0x65, 0x6e, 0x79, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18,
+	0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x64, 0x65, 0x6e, 0x79, 0x43, 0x6f, 0x64, 0x65, 0x12,
+	0x1f, 0x0a, 0x0b, 0x64, 0x65, 0x6e, 0x79, 0x5f, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x06,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x64, 0x65, 0x6e, 0x79, 0x52, 0x65, 0x61, 0x73, 0x6f, 0x6e,
+	0x22, 0x91, 0x02, 0x0a, 0x15, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73,
+	0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63,
+	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
+	0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65,
+	0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72,
+	0x49, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x12, 0x25, 0x0a,
+	0x0e, 0x77, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0d, 0x77, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x53, 0x65, 0x63,
+	0x6f, 0x6e, 0x64, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x5f, 0x69,
+	0x6e, 0x70, 0x75, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x74, 0x6f, 0x6b, 0x65,
+	0x6e, 0x73, 0x49, 0x6e, 0x70, 0x75, 0x74, 0x12, 0x23, 0x0a, 0x0d, 0x74, 0x6f, 0x6b, 0x65, 0x6e,
+	0x73, 0x5f, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0c,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x12, 0x19, 0x0a, 0x08,
+	0x63, 0x6f, 0x73, 0x74, 0x5f, 0x75, 0x73, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x01, 0x52, 0x07,
+	0x63, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x67, 0x72, 0x6f, 0x75, 0x70,
+	0x5f, 0x69, 0x64, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x67, 0x72, 0x6f, 0x75,
+	0x70, 0x49, 0x64, 0x73, 0x22, 0x18, 0x0a, 0x16, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c,
+	0x4d, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2a, 0x64,
+	0x0a, 0x16, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70,
+	0x64, 0x61, 0x74, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x17, 0x0a, 0x13, 0x55, 0x50, 0x44, 0x41,
+	0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x44, 0x10,
+	0x00, 0x12, 0x18, 0x0a, 0x14, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45,
+	0x5f, 0x4d, 0x4f, 0x44, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x01, 0x12, 0x17, 0x0a, 0x13, 0x55,
+	0x50, 0x44, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x52, 0x45, 0x4d, 0x4f, 0x56,
+	0x45, 0x44, 0x10, 0x02, 0x2a, 0x46, 0x0a, 0x0f, 0x50, 0x61, 0x74, 0x68, 0x52, 0x65, 0x77, 0x72,
+	0x69, 0x74, 0x65, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x18, 0x0a, 0x14, 0x50, 0x41, 0x54, 0x48, 0x5f,
+	0x52, 0x45, 0x57, 0x52, 0x49, 0x54, 0x45, 0x5f, 0x44, 0x45, 0x46, 0x41, 0x55, 0x4c, 0x54, 0x10,
+	0x00, 0x12, 0x19, 0x0a, 0x15, 0x50, 0x41, 0x54, 0x48, 0x5f, 0x52, 0x45, 0x57, 0x52, 0x49, 0x54,
+	0x45, 0x5f, 0x50, 0x52, 0x45, 0x53, 0x45, 0x52, 0x56, 0x45, 0x10, 0x01, 0x2a, 0x90, 0x01, 0x0a,
+	0x0e, 0x4d, 0x69, 0x64, 0x64, 0x6c, 0x65, 0x77, 0x61, 0x72, 0x65, 0x53, 0x6c, 0x6f, 0x74, 0x12,
+	0x1f, 0x0a, 0x1b, 0x4d, 0x49, 0x44, 0x44, 0x4c, 0x45, 0x57, 0x41, 0x52, 0x45, 0x5f, 0x53, 0x4c,
+	0x4f, 0x54, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00,
+	0x12, 0x1e, 0x0a, 0x1a, 0x4d, 0x49, 0x44, 0x44, 0x4c, 0x45, 0x57, 0x41, 0x52, 0x45, 0x5f, 0x53,
+	0x4c, 0x4f, 0x54, 0x5f, 0x4f, 0x4e, 0x5f, 0x52, 0x45, 0x51, 0x55, 0x45, 0x53, 0x54, 0x10, 0x01,
 	0x12, 0x1f, 0x0a, 0x1b, 0x4d, 0x49, 0x44, 0x44, 0x4c, 0x45, 0x57, 0x41, 0x52, 0x45, 0x5f, 0x53,
-	0x4c, 0x4f, 0x54, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10,
-	0x00, 0x12, 0x1e, 0x0a, 0x1a, 0x4d, 0x49, 0x44, 0x44, 0x4c, 0x45, 0x57, 0x41, 0x52, 0x45, 0x5f,
-	0x53, 0x4c, 0x4f, 0x54, 0x5f, 0x4f, 0x4e, 0x5f, 0x52, 0x45, 0x51, 0x55, 0x45, 0x53, 0x54, 0x10,
-	0x01, 0x12, 0x1f, 0x0a, 0x1b, 0x4d, 0x49, 0x44, 0x44, 0x4c, 0x45, 0x57, 0x41, 0x52, 0x45, 0x5f,
-	0x53, 0x4c, 0x4f, 0x54, 0x5f, 0x4f, 0x4e, 0x5f, 0x52, 0x45, 0x53, 0x50, 0x4f, 0x4e, 0x53, 0x45,
-	0x10, 0x02, 0x12, 0x1c, 0x0a, 0x18, 0x4d, 0x49, 0x44, 0x44, 0x4c, 0x45, 0x57, 0x41, 0x52, 0x45,
-	0x5f, 0x53, 0x4c, 0x4f, 0x54, 0x5f, 0x54, 0x45, 0x52, 0x4d, 0x49, 0x4e, 0x41, 0x4c, 0x10, 0x03,
-	0x2a, 0xc8, 0x01, 0x0a, 0x0b, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x12, 0x18, 0x0a, 0x14, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53,
-	0x5f, 0x50, 0x45, 0x4e, 0x44, 0x49, 0x4e, 0x47, 0x10, 0x00, 0x12, 0x17, 0x0a, 0x13, 0x50, 0x52,
-	0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x56,
-	0x45, 0x10, 0x01, 0x12, 0x23, 0x0a, 0x1f, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41,
-	0x54, 0x55, 0x53, 0x5f, 0x54, 0x55, 0x4e, 0x4e, 0x45, 0x4c, 0x5f, 0x4e, 0x4f, 0x54, 0x5f, 0x43,
-	0x52, 0x45, 0x41, 0x54, 0x45, 0x44, 0x10, 0x02, 0x12, 0x24, 0x0a, 0x20, 0x50, 0x52, 0x4f, 0x58,
-	0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49,
-	0x43, 0x41, 0x54, 0x45, 0x5f, 0x50, 0x45, 0x4e, 0x44, 0x49, 0x4e, 0x47, 0x10, 0x03, 0x12, 0x23,
-	0x0a, 0x1f, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x43,
-	0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, 0x5f, 0x46, 0x41, 0x49, 0x4c, 0x45,
-	0x44, 0x10, 0x04, 0x12, 0x16, 0x0a, 0x12, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41,
-	0x54, 0x55, 0x53, 0x5f, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x10, 0x05, 0x32, 0xfc, 0x07, 0x0a, 0x0c,
-	0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x5f, 0x0a, 0x10,
-	0x47, 0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65,
-	0x12, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65,
-	0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64,
-	0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x30, 0x01, 0x12, 0x55, 0x0a,
-	0x0c, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x1f, 0x2e,
+	0x4c, 0x4f, 0x54, 0x5f, 0x4f, 0x4e, 0x5f, 0x52, 0x45, 0x53, 0x50, 0x4f, 0x4e, 0x53, 0x45, 0x10,
+	0x02, 0x12, 0x1c, 0x0a, 0x18, 0x4d, 0x49, 0x44, 0x44, 0x4c, 0x45, 0x57, 0x41, 0x52, 0x45, 0x5f,
+	0x53, 0x4c, 0x4f, 0x54, 0x5f, 0x54, 0x45, 0x52, 0x4d, 0x49, 0x4e, 0x41, 0x4c, 0x10, 0x03, 0x2a,
+	0xc8, 0x01, 0x0a, 0x0b, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12,
+	0x18, 0x0a, 0x14, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f,
+	0x50, 0x45, 0x4e, 0x44, 0x49, 0x4e, 0x47, 0x10, 0x00, 0x12, 0x17, 0x0a, 0x13, 0x50, 0x52, 0x4f,
+	0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x56, 0x45,
+	0x10, 0x01, 0x12, 0x23, 0x0a, 0x1f, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54,
+	0x55, 0x53, 0x5f, 0x54, 0x55, 0x4e, 0x4e, 0x45, 0x4c, 0x5f, 0x4e, 0x4f, 0x54, 0x5f, 0x43, 0x52,
+	0x45, 0x41, 0x54, 0x45, 0x44, 0x10, 0x02, 0x12, 0x24, 0x0a, 0x20, 0x50, 0x52, 0x4f, 0x58, 0x59,
+	0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43,
+	0x41, 0x54, 0x45, 0x5f, 0x50, 0x45, 0x4e, 0x44, 0x49, 0x4e, 0x47, 0x10, 0x03, 0x12, 0x23, 0x0a,
+	0x1f, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x43, 0x45,
+	0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, 0x5f, 0x46, 0x41, 0x49, 0x4c, 0x45, 0x44,
+	0x10, 0x04, 0x12, 0x16, 0x0a, 0x12, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54,
+	0x55, 0x53, 0x5f, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x10, 0x05, 0x32, 0xfc, 0x07, 0x0a, 0x0c, 0x50,
+	0x72, 0x6f, 0x78, 0x79, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x5f, 0x0a, 0x10, 0x47,
+	0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x12,
+	0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74,
+	0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61,
+	0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x30, 0x01, 0x12, 0x55, 0x0a, 0x0c,
+	0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x1f, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61,
+	0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e,
 	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x4d,
-	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x79, 0x6e, 0x63,
-	0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x28, 0x01, 0x30, 0x01, 0x12, 0x54, 0x0a, 0x0d, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65,
-	0x73, 0x73, 0x4c, 0x6f, 0x67, 0x12, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c,
-	0x6f, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x51, 0x0a, 0x0c, 0x41, 0x75,
-	0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x1f, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28,
+	0x01, 0x30, 0x01, 0x12, 0x54, 0x0a, 0x0d, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x4c, 0x6f, 0x67, 0x12, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f,
+	0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x51, 0x0a, 0x0c, 0x41, 0x75, 0x74,
+	0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63,
+	0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x6d, 0x61, 0x6e,
 	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69,
-	0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74,
-	0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5d, 0x0a,
-	0x10, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74,
-	0x65, 0x12, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53,
-	0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70,
-	0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5a, 0x0a, 0x0f,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x12,
-	0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4b, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x4f,
-	0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x12, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5a, 0x0a, 0x0f, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74,
-	0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61,
-	0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x63, 0x0a, 0x12, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e,
-	0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x12, 0x25, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e,
-	0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69,
-	0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x69, 0x0a, 0x14, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c,
-	0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x12, 0x27,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x68, 0x65, 0x63,
-	0x6b, 0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x57, 0x0a, 0x0e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73,
-	0x61, 0x67, 0x65, 0x12, 0x21, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73, 0x61,
-	0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5d, 0x0a, 0x10,
+	0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65,
+	0x12, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65,
+	0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64,
+	0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5a, 0x0a, 0x0f, 0x43,
+	0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x12, 0x22,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4b, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x4f, 0x49,
+	0x44, 0x43, 0x55, 0x52, 0x4c, 0x12, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5a, 0x0a, 0x0f, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65,
+	0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73,
+	0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74,
+	0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x63, 0x0a, 0x12, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e,
+	0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x12, 0x25, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e,
+	0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64,
+	0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x69, 0x0a, 0x14, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c,
+	0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x12, 0x27, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x68, 0x65, 0x63, 0x6b,
+	0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x57, 0x0a, 0x0e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73, 0x61,
+	0x67, 0x65, 0x12, 0x21, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73, 0x61, 0x67,
+	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (

shared/management/proto/proxy_service.proto

@@ -203,10 +203,6 @@ message AccessRestrictions {
   repeated string blocked_countries = 4;
   // CrowdSec IP reputation mode: "", "off", "enforce", or "observe".
   string crowdsec_mode = 5;
-  // How the allowlists (CIDR, country) combine: "" or "all" require matching
-  // every allowlist (AND); "any" requires matching at least one (OR).
-  // Blocklists are always a hard-deny gate, independent of this mode.
-  string allow_match = 6;
 }
 
 message ProxyMapping {

shared/management/types/network.go

@@ -47,6 +47,10 @@ type NetworkMap struct {
 	ForwardingRules     []*ForwardingRule
 	AuthorizedUsers     map[string]map[string]struct{}
 	EnableSSH           bool
+	// ForceRoutingPeerDNSResolution forces the peer to run/use routing-peer DNS
+	// resolution regardless of the account-global setting, for reverse-proxy
+	// domain targets.
+	ForceRoutingPeerDNSResolution bool
 }
 
 func (nm *NetworkMap) Merge(other *NetworkMap) {
@@ -56,6 +60,7 @@ func (nm *NetworkMap) Merge(other *NetworkMap) {
 	nm.FirewallRules = mergeUnique(nm.FirewallRules, other.FirewallRules)
 	nm.RoutesFirewallRules = mergeUnique(nm.RoutesFirewallRules, other.RoutesFirewallRules)
 	nm.ForwardingRules = mergeUnique(nm.ForwardingRules, other.ForwardingRules)
+	nm.ForceRoutingPeerDNSResolution = nm.ForceRoutingPeerDNSResolution || other.ForceRoutingPeerDNSResolution
 }
 
 type comparableObject[T any] interface {

shared/management/types/networkmap_components.go

@@ -56,6 +56,11 @@ type NetworkMapComponents struct {
 
 	// true when returning an empty-like map (returned instead of nil)
 	empty bool
+
+	// ForceRoutingPeerDNSResolution forces the peer to run/use routing-peer DNS
+	// resolution regardless of the account-global setting, for reverse-proxy
+	// domain targets.
+	ForceRoutingPeerDNSResolution bool
 }
 
 type routeIndexEntry struct {
@@ -190,6 +195,8 @@ func (c *NetworkMapComponents) Calculate(ctx context.Context) *NetworkMap {
 		RoutesFirewallRules: append(networkResourcesFirewallRules, routesFirewallRules...),
 		AuthorizedUsers:     authorizedUsers,
 		EnableSSH:           sshEnabled,
+
+		ForceRoutingPeerDNSResolution: c.ForceRoutingPeerDNSResolution,
 	}
 }
 

sharedsock/sock_linux.go

@@ -24,7 +24,7 @@ import (
 )
 
 // ErrSharedSockStopped indicates that shared socket has been stopped
-var ErrSharedSockStopped = fmt.Errorf("shared socket stopped")
+var ErrSharedSockStopped = fmt.Errorf("shared socked stopped")
 
 // SharedSocket is a net.PacketConn that initiates two raw sockets (ipv4 and ipv6) and listens to UDP packets filtered
 // by BPF instructions (e.g., IncomingSTUNFilter that checks and sends only STUN packets to the listeners (ReadFrom)).