From 46816071df2edb0e05cf527c8cedf3bdd61bda6b Mon Sep 17 00:00:00 2001
From: Semir Patel <semir.patel@hashicorp.com>
Date: Mon, 24 Apr 2023 08:14:51 -0500
Subject: [PATCH 01/92] De-scope tenenacy requirements to OSS only for now.
 (#17087)

Partition and namespace must be "default"
Peername must be "local"
---
 .../services/resource/delete_test.go          | 12 ++---
 .../services/resource/read_test.go            | 12 ++---
 .../grpc-external/services/resource/server.go | 16 +++---
 .../grpc-external/services/resource/write.go  |  5 +-
 .../services/resource/write_test.go           | 51 +++++--------------
 5 files changed, 34 insertions(+), 62 deletions(-)

diff --git a/agent/grpc-external/services/resource/delete_test.go b/agent/grpc-external/services/resource/delete_test.go
index ddbefbd1166d..3147fb5b3000 100644
--- a/agent/grpc-external/services/resource/delete_test.go
+++ b/agent/grpc-external/services/resource/delete_test.go
@@ -30,17 +30,17 @@ func TestDelete_InputValidation(t *testing.T) {
 		"no tenancy": func(req *pbresource.DeleteRequest) { req.Id.Tenancy = nil },
 		"no name":    func(req *pbresource.DeleteRequest) { req.Id.Name = "" },
 		// clone necessary to not pollute DefaultTenancy
-		"tenancy partition wildcard": func(req *pbresource.DeleteRequest) {
+		"tenancy partition not default": func(req *pbresource.DeleteRequest) {
 			req.Id.Tenancy = clone(req.Id.Tenancy)
-			req.Id.Tenancy.Partition = storage.Wildcard
+			req.Id.Tenancy.Partition = ""
 		},
-		"tenancy namespace wildcard": func(req *pbresource.DeleteRequest) {
+		"tenancy namespace not default": func(req *pbresource.DeleteRequest) {
 			req.Id.Tenancy = clone(req.Id.Tenancy)
-			req.Id.Tenancy.Namespace = storage.Wildcard
+			req.Id.Tenancy.Namespace = ""
 		},
-		"tenancy peername wildcard": func(req *pbresource.DeleteRequest) {
+		"tenancy peername not local": func(req *pbresource.DeleteRequest) {
 			req.Id.Tenancy = clone(req.Id.Tenancy)
-			req.Id.Tenancy.PeerName = storage.Wildcard
+			req.Id.Tenancy.PeerName = ""
 		},
 	}
 	for desc, modFn := range testCases {
diff --git a/agent/grpc-external/services/resource/read_test.go b/agent/grpc-external/services/resource/read_test.go
index 6f7f80a090ab..e7265043f3ce 100644
--- a/agent/grpc-external/services/resource/read_test.go
+++ b/agent/grpc-external/services/resource/read_test.go
@@ -33,17 +33,17 @@ func TestRead_InputValidation(t *testing.T) {
 		"no tenancy": func(req *pbresource.ReadRequest) { req.Id.Tenancy = nil },
 		"no name":    func(req *pbresource.ReadRequest) { req.Id.Name = "" },
 		// clone necessary to not pollute DefaultTenancy
-		"tenancy partition wildcard": func(req *pbresource.ReadRequest) {
+		"tenancy partition not default": func(req *pbresource.ReadRequest) {
 			req.Id.Tenancy = clone(req.Id.Tenancy)
-			req.Id.Tenancy.Partition = storage.Wildcard
+			req.Id.Tenancy.Partition = ""
 		},
-		"tenancy namespace wildcard": func(req *pbresource.ReadRequest) {
+		"tenancy namespace not default": func(req *pbresource.ReadRequest) {
 			req.Id.Tenancy = clone(req.Id.Tenancy)
-			req.Id.Tenancy.Namespace = storage.Wildcard
+			req.Id.Tenancy.Namespace = ""
 		},
-		"tenancy peername wildcard": func(req *pbresource.ReadRequest) {
+		"tenancy peername not local": func(req *pbresource.ReadRequest) {
 			req.Id.Tenancy = clone(req.Id.Tenancy)
-			req.Id.Tenancy.PeerName = storage.Wildcard
+			req.Id.Tenancy.PeerName = ""
 		},
 	}
 	for desc, modFn := range testCases {
diff --git a/agent/grpc-external/services/resource/server.go b/agent/grpc-external/services/resource/server.go
index 46bbbef17e22..51bb4610d527 100644
--- a/agent/grpc-external/services/resource/server.go
+++ b/agent/grpc-external/services/resource/server.go
@@ -131,17 +131,19 @@ func validateId(id *pbresource.ID, errorPrefix string) error {
 		return status.Errorf(codes.InvalidArgument, "%s.%s is required", errorPrefix, field)
 	}
 
+	// Revisit defaulting and non-namespaced resources post-1.16
+	var expected string
 	switch {
-	case id.Tenancy.Namespace == storage.Wildcard:
-		field = "tenancy.namespace"
-	case id.Tenancy.Partition == storage.Wildcard:
-		field = "tenancy.partition"
-	case id.Tenancy.PeerName == storage.Wildcard:
-		field = "tenancy.peername"
+	case id.Tenancy.Partition != "default":
+		field, expected = "partition", "default"
+	case id.Tenancy.Namespace != "default":
+		field, expected = "namespace", "default"
+	case id.Tenancy.PeerName != "local":
+		field, expected = "peername", "local"
 	}
 
 	if field != "" {
-		return status.Errorf(codes.InvalidArgument, "%s.%s cannot be a wildcard", errorPrefix, field)
+		return status.Errorf(codes.InvalidArgument, "%s.tenancy.%s must be %s", errorPrefix, field, expected)
 	}
 	return nil
 }
diff --git a/agent/grpc-external/services/resource/write.go b/agent/grpc-external/services/resource/write.go
index e5c4f3db73a3..121c7ce39ccc 100644
--- a/agent/grpc-external/services/resource/write.go
+++ b/agent/grpc-external/services/resource/write.go
@@ -119,10 +119,7 @@ func (s *Server) Write(ctx context.Context, req *pbresource.WriteRequest) (*pbre
 				return errUseWriteStatus
 			}
 
-			// Enforce same tenancy for owner
-			if input.Owner != nil && !proto.Equal(input.Id.Tenancy, input.Owner.Tenancy) {
-				return status.Errorf(codes.InvalidArgument, "owner and resource tenancy must be the same")
-			}
+			// TODO(spatel): Revisit owner<->resource tenancy rules post-1.16
 
 		// Update path.
 		case err == nil:
diff --git a/agent/grpc-external/services/resource/write_test.go b/agent/grpc-external/services/resource/write_test.go
index 6d0645d1fe33..666937c12ee5 100644
--- a/agent/grpc-external/services/resource/write_test.go
+++ b/agent/grpc-external/services/resource/write_test.go
@@ -36,17 +36,17 @@ func TestWrite_InputValidation(t *testing.T) {
 		"no name":     func(req *pbresource.WriteRequest) { req.Resource.Id.Name = "" },
 		"no data":     func(req *pbresource.WriteRequest) { req.Resource.Data = nil },
 		// clone necessary to not pollute DefaultTenancy
-		"tenancy partition wildcard": func(req *pbresource.WriteRequest) {
+		"tenancy partition not default": func(req *pbresource.WriteRequest) {
 			req.Resource.Id.Tenancy = clone(req.Resource.Id.Tenancy)
-			req.Resource.Id.Tenancy.Partition = storage.Wildcard
+			req.Resource.Id.Tenancy.Partition = ""
 		},
-		"tenancy namespace wildcard": func(req *pbresource.WriteRequest) {
+		"tenancy namespace not default": func(req *pbresource.WriteRequest) {
 			req.Resource.Id.Tenancy = clone(req.Resource.Id.Tenancy)
-			req.Resource.Id.Tenancy.Namespace = storage.Wildcard
+			req.Resource.Id.Tenancy.Namespace = ""
 		},
-		"tenancy peername wildcard": func(req *pbresource.WriteRequest) {
+		"tenancy peername not local": func(req *pbresource.WriteRequest) {
 			req.Resource.Id.Tenancy = clone(req.Resource.Id.Tenancy)
-			req.Resource.Id.Tenancy.PeerName = storage.Wildcard
+			req.Resource.Id.Tenancy.PeerName = ""
 		},
 		"wrong data type": func(req *pbresource.WriteRequest) {
 			var err error
@@ -99,24 +99,24 @@ func TestWrite_OwnerValidation(t *testing.T) {
 			errorContains: "resource.owner.name",
 		},
 		// clone necessary to not pollute DefaultTenancy
-		"owner tenancy partition wildcard": {
+		"owner tenancy partition not default": {
 			modReqFn: func(req *pbresource.WriteRequest) {
 				req.Resource.Owner.Tenancy = clone(req.Resource.Owner.Tenancy)
-				req.Resource.Owner.Tenancy.Partition = storage.Wildcard
+				req.Resource.Owner.Tenancy.Partition = ""
 			},
 			errorContains: "resource.owner.tenancy.partition",
 		},
-		"owner tenancy namespace wildcard": {
+		"owner tenancy namespace not default": {
 			modReqFn: func(req *pbresource.WriteRequest) {
 				req.Resource.Owner.Tenancy = clone(req.Resource.Owner.Tenancy)
-				req.Resource.Owner.Tenancy.Namespace = storage.Wildcard
+				req.Resource.Owner.Tenancy.Namespace = ""
 			},
 			errorContains: "resource.owner.tenancy.namespace",
 		},
-		"owner tenancy peername wildcard": {
+		"owner tenancy peername not local": {
 			modReqFn: func(req *pbresource.WriteRequest) {
 				req.Resource.Owner.Tenancy = clone(req.Resource.Owner.Tenancy)
-				req.Resource.Owner.Tenancy.PeerName = storage.Wildcard
+				req.Resource.Owner.Tenancy.PeerName = ""
 			},
 			errorContains: "resource.owner.tenancy.peername",
 		},
@@ -491,33 +491,6 @@ func TestWrite_Owner_Immutable(t *testing.T) {
 	require.ErrorContains(t, err, "owner cannot be changed")
 }
 
-func TestWrite_Owner_RequireSameTenancy(t *testing.T) {
-	server := testServer(t)
-	client := testClient(t, server)
-
-	demo.Register(server.Registry)
-
-	artist, err := demo.GenerateV2Artist()
-	require.NoError(t, err)
-	rsp1, err := client.Write(testContext(t), &pbresource.WriteRequest{Resource: artist})
-	require.NoError(t, err)
-
-	// change album tenancy to be different from artist tenancy
-	album, err := demo.GenerateV2Album(rsp1.Resource.Id)
-	require.NoError(t, err)
-	album.Owner.Tenancy = &pbresource.Tenancy{
-		Partition: "some",
-		Namespace: "other",
-		PeerName:  "tenancy",
-	}
-
-	// verify create fails
-	_, err = client.Write(testContext(t), &pbresource.WriteRequest{Resource: album})
-	require.Error(t, err)
-	require.Equal(t, codes.InvalidArgument.String(), status.Code(err).String())
-	require.ErrorContains(t, err, "tenancy must be the same")
-}
-
 type blockOnceBackend struct {
 	storage.Backend
 

From a33b224a55fb570f4775bb8944eb0e39a4b680c7 Mon Sep 17 00:00:00 2001
From: Derek Menteer <105233703+hashi-derek@users.noreply.github.com>
Date: Mon, 24 Apr 2023 12:03:26 -0500
Subject: [PATCH 02/92] Fix virtual services being included in intention
 topology as downstreams. (#17099)

---
 agent/consul/state/intention.go | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/agent/consul/state/intention.go b/agent/consul/state/intention.go
index 3212b2038982..3b03b91007e2 100644
--- a/agent/consul/state/intention.go
+++ b/agent/consul/state/intention.go
@@ -1079,16 +1079,21 @@ func (s *Store) intentionTopologyTxn(
 		}
 		addSvcs(tempServices)
 
-		// Query the virtual ip table as well to include virtual services that don't have a registered instance yet.
-		vipIndex, vipServices, err := servicesVirtualIPsTxn(tx)
-		if err != nil {
-			return index, nil, fmt.Errorf("failed to list service virtual IPs: %v", err)
-		}
-		for _, svc := range vipServices {
-			services[svc.Service.ServiceName] = struct{}{}
-		}
-		if vipIndex > index {
-			index = vipIndex
+		if !downstreams {
+			// Query the virtual ip table as well to include virtual services that don't have a registered instance yet.
+			// We only need to do this for upstreams currently, so that tproxy can find which discovery chains should be
+			// contacted for failover scenarios. Virtual services technically don't need to be considered as downstreams,
+			// because they will take on the identity of the calling service, rather than the chain itself.
+			vipIndex, vipServices, err := servicesVirtualIPsTxn(tx)
+			if err != nil {
+				return index, nil, fmt.Errorf("failed to list service virtual IPs: %v", err)
+			}
+			for _, svc := range vipServices {
+				services[svc.Service.ServiceName] = struct{}{}
+			}
+			if vipIndex > index {
+				index = vipIndex
+			}
 		}
 	} else {
 		// destinations can only ever be upstream, since they are only allowed as intention destination.

From d4cacc7232808f85de67a7bfc11d14abd2ce1d8e Mon Sep 17 00:00:00 2001
From: Anita Akaeze <anita.akaeze@hashicorp.com>
Date: Mon, 24 Apr 2023 14:23:24 -0400
Subject: [PATCH 03/92] Merge pull request #5200 from hashicorp/NET-3758
 (#17102)

* Merge pull request #5200 from hashicorp/NET-3758

NET-3758: connect: update supported envoy versions to 1.26.0

* lint
---
 .changelog/5200.txt                           |   3 +
 .github/workflows/test-integrations.yml       |   4 +-
 .../xdscommon/envoy_versioning_test.go        | 104 ++++++++++--------
 envoyextensions/xdscommon/proxysupport.go     |   2 +-
 4 files changed, 64 insertions(+), 49 deletions(-)
 create mode 100644 .changelog/5200.txt

diff --git a/.changelog/5200.txt b/.changelog/5200.txt
new file mode 100644
index 000000000000..289c222159e9
--- /dev/null
+++ b/.changelog/5200.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: update supported envoy versions to 1.23.8, 1.24.6, 1.25.4, 1.26.0
+```
\ No newline at end of file
diff --git a/.github/workflows/test-integrations.yml b/.github/workflows/test-integrations.yml
index 731045d8cced..3c44198ed757 100644
--- a/.github/workflows/test-integrations.yml
+++ b/.github/workflows/test-integrations.yml
@@ -153,7 +153,7 @@ jobs:
           # this is further going to multiplied in envoy-integration tests by the 
           # other dimensions in the matrix.  Currently TOTAL_RUNNERS would be
           # multiplied by 8 based on these values:
-          # envoy-version: ["1.22.11", "1.23.8", "1.24.6", "1.25.4"]
+          # envoy-version: ["1.23.8", "1.24.6", "1.25.4", "1.26.0"]
           # xds-target: ["server", "client"]
           TOTAL_RUNNERS: 4 
           JQ_SLICER: '[ inputs ] | [_nwise(length / $runnercount | floor)]'
@@ -186,7 +186,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        envoy-version: ["1.22.11", "1.23.8", "1.24.6", "1.25.4"]
+        envoy-version: ["1.23.8", "1.24.6", "1.25.4", "1.26.0"]
         xds-target: ["server", "client"]
         test-cases: ${{ fromJSON(needs.generate-envoy-job-matrices.outputs.envoy-matrix) }}
     env:
diff --git a/envoyextensions/xdscommon/envoy_versioning_test.go b/envoyextensions/xdscommon/envoy_versioning_test.go
index 96f6f305d4fa..ff9318239348 100644
--- a/envoyextensions/xdscommon/envoy_versioning_test.go
+++ b/envoyextensions/xdscommon/envoy_versioning_test.go
@@ -81,50 +81,62 @@ func TestDetermineSupportedProxyFeaturesFromString(t *testing.T) {
 
 	// Just the bad versions
 	cases := map[string]testcase{
-		"1.9.0":  {expectErr: "Envoy 1.9.0 " + errTooOld},
-		"1.10.0": {expectErr: "Envoy 1.10.0 " + errTooOld},
-		"1.11.0": {expectErr: "Envoy 1.11.0 " + errTooOld},
-		"1.12.0": {expectErr: "Envoy 1.12.0 " + errTooOld},
-		"1.12.1": {expectErr: "Envoy 1.12.1 " + errTooOld},
-		"1.12.2": {expectErr: "Envoy 1.12.2 " + errTooOld},
-		"1.12.3": {expectErr: "Envoy 1.12.3 " + errTooOld},
-		"1.12.4": {expectErr: "Envoy 1.12.4 " + errTooOld},
-		"1.12.5": {expectErr: "Envoy 1.12.5 " + errTooOld},
-		"1.12.6": {expectErr: "Envoy 1.12.6 " + errTooOld},
-		"1.12.7": {expectErr: "Envoy 1.12.7 " + errTooOld},
-		"1.13.0": {expectErr: "Envoy 1.13.0 " + errTooOld},
-		"1.13.1": {expectErr: "Envoy 1.13.1 " + errTooOld},
-		"1.13.2": {expectErr: "Envoy 1.13.2 " + errTooOld},
-		"1.13.3": {expectErr: "Envoy 1.13.3 " + errTooOld},
-		"1.13.4": {expectErr: "Envoy 1.13.4 " + errTooOld},
-		"1.13.5": {expectErr: "Envoy 1.13.5 " + errTooOld},
-		"1.13.6": {expectErr: "Envoy 1.13.6 " + errTooOld},
-		"1.13.7": {expectErr: "Envoy 1.13.7 " + errTooOld},
-		"1.14.0": {expectErr: "Envoy 1.14.0 " + errTooOld},
-		"1.14.1": {expectErr: "Envoy 1.14.1 " + errTooOld},
-		"1.14.2": {expectErr: "Envoy 1.14.2 " + errTooOld},
-		"1.14.3": {expectErr: "Envoy 1.14.3 " + errTooOld},
-		"1.14.4": {expectErr: "Envoy 1.14.4 " + errTooOld},
-		"1.14.5": {expectErr: "Envoy 1.14.5 " + errTooOld},
-		"1.14.6": {expectErr: "Envoy 1.14.6 " + errTooOld},
-		"1.14.7": {expectErr: "Envoy 1.14.7 " + errTooOld},
-		"1.15.0": {expectErr: "Envoy 1.15.0 " + errTooOld},
-		"1.15.1": {expectErr: "Envoy 1.15.1 " + errTooOld},
-		"1.15.2": {expectErr: "Envoy 1.15.2 " + errTooOld},
-		"1.15.3": {expectErr: "Envoy 1.15.3 " + errTooOld},
-		"1.15.4": {expectErr: "Envoy 1.15.4 " + errTooOld},
-		"1.15.5": {expectErr: "Envoy 1.15.5 " + errTooOld},
-		"1.16.1": {expectErr: "Envoy 1.16.1 " + errTooOld},
-		"1.16.2": {expectErr: "Envoy 1.16.2 " + errTooOld},
-		"1.16.3": {expectErr: "Envoy 1.16.3 " + errTooOld},
-		"1.16.4": {expectErr: "Envoy 1.16.4 " + errTooOld},
-		"1.16.5": {expectErr: "Envoy 1.16.5 " + errTooOld},
-		"1.16.6": {expectErr: "Envoy 1.16.6 " + errTooOld},
-		"1.17.4": {expectErr: "Envoy 1.17.4 " + errTooOld},
-		"1.18.6": {expectErr: "Envoy 1.18.6 " + errTooOld},
-		"1.19.5": {expectErr: "Envoy 1.19.5 " + errTooOld},
-		"1.20.7": {expectErr: "Envoy 1.20.7 " + errTooOld},
-		"1.21.5": {expectErr: "Envoy 1.21.5 " + errTooOld},
+		"1.9.0":   {expectErr: "Envoy 1.9.0 " + errTooOld},
+		"1.10.0":  {expectErr: "Envoy 1.10.0 " + errTooOld},
+		"1.11.0":  {expectErr: "Envoy 1.11.0 " + errTooOld},
+		"1.12.0":  {expectErr: "Envoy 1.12.0 " + errTooOld},
+		"1.12.1":  {expectErr: "Envoy 1.12.1 " + errTooOld},
+		"1.12.2":  {expectErr: "Envoy 1.12.2 " + errTooOld},
+		"1.12.3":  {expectErr: "Envoy 1.12.3 " + errTooOld},
+		"1.12.4":  {expectErr: "Envoy 1.12.4 " + errTooOld},
+		"1.12.5":  {expectErr: "Envoy 1.12.5 " + errTooOld},
+		"1.12.6":  {expectErr: "Envoy 1.12.6 " + errTooOld},
+		"1.12.7":  {expectErr: "Envoy 1.12.7 " + errTooOld},
+		"1.13.0":  {expectErr: "Envoy 1.13.0 " + errTooOld},
+		"1.13.1":  {expectErr: "Envoy 1.13.1 " + errTooOld},
+		"1.13.2":  {expectErr: "Envoy 1.13.2 " + errTooOld},
+		"1.13.3":  {expectErr: "Envoy 1.13.3 " + errTooOld},
+		"1.13.4":  {expectErr: "Envoy 1.13.4 " + errTooOld},
+		"1.13.5":  {expectErr: "Envoy 1.13.5 " + errTooOld},
+		"1.13.6":  {expectErr: "Envoy 1.13.6 " + errTooOld},
+		"1.13.7":  {expectErr: "Envoy 1.13.7 " + errTooOld},
+		"1.14.0":  {expectErr: "Envoy 1.14.0 " + errTooOld},
+		"1.14.1":  {expectErr: "Envoy 1.14.1 " + errTooOld},
+		"1.14.2":  {expectErr: "Envoy 1.14.2 " + errTooOld},
+		"1.14.3":  {expectErr: "Envoy 1.14.3 " + errTooOld},
+		"1.14.4":  {expectErr: "Envoy 1.14.4 " + errTooOld},
+		"1.14.5":  {expectErr: "Envoy 1.14.5 " + errTooOld},
+		"1.14.6":  {expectErr: "Envoy 1.14.6 " + errTooOld},
+		"1.14.7":  {expectErr: "Envoy 1.14.7 " + errTooOld},
+		"1.15.0":  {expectErr: "Envoy 1.15.0 " + errTooOld},
+		"1.15.1":  {expectErr: "Envoy 1.15.1 " + errTooOld},
+		"1.15.2":  {expectErr: "Envoy 1.15.2 " + errTooOld},
+		"1.15.3":  {expectErr: "Envoy 1.15.3 " + errTooOld},
+		"1.15.4":  {expectErr: "Envoy 1.15.4 " + errTooOld},
+		"1.15.5":  {expectErr: "Envoy 1.15.5 " + errTooOld},
+		"1.16.1":  {expectErr: "Envoy 1.16.1 " + errTooOld},
+		"1.16.2":  {expectErr: "Envoy 1.16.2 " + errTooOld},
+		"1.16.3":  {expectErr: "Envoy 1.16.3 " + errTooOld},
+		"1.16.4":  {expectErr: "Envoy 1.16.4 " + errTooOld},
+		"1.16.5":  {expectErr: "Envoy 1.16.5 " + errTooOld},
+		"1.16.6":  {expectErr: "Envoy 1.16.6 " + errTooOld},
+		"1.17.4":  {expectErr: "Envoy 1.17.4 " + errTooOld},
+		"1.18.6":  {expectErr: "Envoy 1.18.6 " + errTooOld},
+		"1.19.5":  {expectErr: "Envoy 1.19.5 " + errTooOld},
+		"1.20.7":  {expectErr: "Envoy 1.20.7 " + errTooOld},
+		"1.21.5":  {expectErr: "Envoy 1.21.5 " + errTooOld},
+		"1.22.0":  {expectErr: "Envoy 1.22.0 " + errTooOld},
+		"1.22.1":  {expectErr: "Envoy 1.22.1 " + errTooOld},
+		"1.22.2":  {expectErr: "Envoy 1.22.2 " + errTooOld},
+		"1.22.3":  {expectErr: "Envoy 1.22.3 " + errTooOld},
+		"1.22.4":  {expectErr: "Envoy 1.22.4 " + errTooOld},
+		"1.22.5":  {expectErr: "Envoy 1.22.5 " + errTooOld},
+		"1.22.6":  {expectErr: "Envoy 1.22.6 " + errTooOld},
+		"1.22.7":  {expectErr: "Envoy 1.22.7 " + errTooOld},
+		"1.22.8":  {expectErr: "Envoy 1.22.8 " + errTooOld},
+		"1.22.9":  {expectErr: "Envoy 1.22.9 " + errTooOld},
+		"1.22.10": {expectErr: "Envoy 1.22.10 " + errTooOld},
+		"1.22.11": {expectErr: "Envoy 1.22.11 " + errTooOld},
 	}
 
 	// Insert a bunch of valid versions.
@@ -139,10 +151,9 @@ func TestDetermineSupportedProxyFeaturesFromString(t *testing.T) {
 	}
 	*/
 	for _, v := range []string{
-		"1.22.0", "1.22.1", "1.22.2", "1.22.3", "1.22.4", "1.22.5", "1.22.6", "1.22.7", "1.22.8", "1.22.9", "1.22.10", "1.22.11",
 		"1.23.0", "1.23.1", "1.23.2", "1.23.3", "1.23.4", "1.23.5", "1.23.6", "1.23.7", "1.23.8",
 		"1.24.0", "1.24.1", "1.24.2", "1.24.3", "1.24.4", "1.24.5", "1.24.6",
-		"1.25.0", "1.25.1", "1.25.2", "1.25.3", "1.25.4",
+		"1.25.0", "1.25.1", "1.25.2", "1.25.3", "1.25.4", "1.26.0",
 	} {
 		cases[v] = testcase{expect: SupportedProxyFeatures{}}
 	}
@@ -152,6 +163,7 @@ func TestDetermineSupportedProxyFeaturesFromString(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			sf, err := DetermineSupportedProxyFeaturesFromString(name)
 			if tc.expectErr == "" {
+				require.NoError(t, err)
 				require.Equal(t, tc.expect, sf)
 			} else {
 				testutil.RequireErrorContains(t, err, tc.expectErr)
diff --git a/envoyextensions/xdscommon/proxysupport.go b/envoyextensions/xdscommon/proxysupport.go
index c4a96e818154..ff4b79d7354c 100644
--- a/envoyextensions/xdscommon/proxysupport.go
+++ b/envoyextensions/xdscommon/proxysupport.go
@@ -12,10 +12,10 @@ import "strings"
 //
 // see: https://www.consul.io/docs/connect/proxies/envoy#supported-versions
 var EnvoyVersions = []string{
+	"1.26.0",
 	"1.25.4",
 	"1.24.6",
 	"1.23.8",
-	"1.22.11",
 }
 
 // UnsupportedEnvoyVersions lists any unsupported Envoy versions (mainly minor versions) that fall

From 9ce50aefbbb58e1f276682396de61317db712214 Mon Sep 17 00:00:00 2001
From: Dan Bond <danbond@protonmail.com>
Date: Mon, 24 Apr 2023 11:34:53 -0700
Subject: [PATCH 04/92] CI: remove uneeded AWS creds from test-integrations
 (#17104)

* Update test-integrations.yml

* removing permission lies now that vault is not used in this job.

---------

Co-authored-by: John Murret <john.murret@hashicorp.com>
---
 .github/workflows/test-integrations.yml | 21 ---------------------
 1 file changed, 21 deletions(-)

diff --git a/.github/workflows/test-integrations.yml b/.github/workflows/test-integrations.yml
index 3c44198ed757..720360ee801f 100644
--- a/.github/workflows/test-integrations.yml
+++ b/.github/workflows/test-integrations.yml
@@ -176,9 +176,6 @@ jobs:
   
   envoy-integration-test:
     runs-on: ${{ fromJSON(needs.setup.outputs.compute-xl) }}
-    permissions:
-      id-token: write # NOTE: this permission is explicitly required for Vault auth.
-      contents: read
     needs:
       - setup
       - generate-envoy-job-matrices
@@ -194,24 +191,6 @@ jobs:
       XDS_TARGET: ${{ matrix.xds-target }}
       AWS_LAMBDA_REGION: us-west-2
     steps:
-      # NOTE: ENT specific step as we store secrets in Vault.
-      - name: Authenticate to Vault
-        if: ${{ endsWith(github.repository, '-enterprise') }}
-        id: vault-auth
-        run: vault-auth
-
-      # NOTE: ENT specific step as we store secrets in Vault.
-      - name: Fetch Secrets
-        if: ${{ endsWith(github.repository, '-enterprise') }}
-        id: secrets
-        uses: hashicorp/vault-action@v2.5.0
-        with:
-          url: ${{ steps.vault-auth.outputs.addr }}
-          caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
-          token: ${{ steps.vault-auth.outputs.token }}
-          secrets: |
-            kv/data/github/${{ github.repository }}/aws arn | AWS_ROLE_ARN ;
-
       - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
       - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
         with:

From 001d540afc9694600e059c19b39c053e9a90e738 Mon Sep 17 00:00:00 2001
From: Michael Wilkerson <62034708+wilkermichael@users.noreply.github.com>
Date: Mon, 24 Apr 2023 13:21:28 -0700
Subject: [PATCH 05/92] Add sameness group field to prepared queries (#17089)

* added method for converting SamenessGroupConfigEntry
- added new method `ToQueryFailoverTargets` for converting a SamenessGroupConfigEntry's members to a list of QueryFailoverTargets
- renamed `ToFailoverTargets` ToServiceResolverFailoverTargets to distinguish it from `ToQueryFailoverTargets`

* Added SamenessGroup to PreparedQuery
- exposed Service.Partition to API when defining a prepared query
- added a method for determining if a QueryFailoverOptions is empty
- This will be useful for validation
- added unit tests

* added method for retrieving a SamenessGroup to state store

* added logic for using PQ with SamenessGroup
- added branching path for SamenessGroup handling in execute. It will be handled separate from the normal PQ case
- added a new interface so that the `GetSamenessGroupFailoverTargets` can be properly tested
- separated the execute logic into a `targetSelector` function so that it can be used for both failover and sameness group PQs
- split OSS only methods into new PQ OSS files
- added validation that `samenessGroup` is an enterprise only feature

* added documentation for PQ SamenessGroup
---
 agent/consul/discoverychain/compile.go        |   2 +-
 agent/consul/prepared_query/walk_test.go      |   1 +
 agent/consul/prepared_query_endpoint.go       | 287 ++++++++++--------
 agent/consul/prepared_query_endpoint_oss.go   |  38 +++
 .../prepared_query_endpoint_oss_test.go       |  52 ++++
 agent/consul/prepared_query_endpoint_test.go  |  43 ++-
 .../state/config_entry_sameness_group.go      |  19 ++
 .../config_entry_sameness_group_oss.go        |  13 +-
 agent/structs/prepared_query.go               |  13 +
 agent/structs/prepared_query_test.go          |  53 ++++
 api/prepared_query.go                         |  10 +-
 website/content/api-docs/query.mdx            |  17 +-
 12 files changed, 417 insertions(+), 131 deletions(-)
 create mode 100644 agent/consul/prepared_query_endpoint_oss.go
 create mode 100644 agent/consul/prepared_query_endpoint_oss_test.go
 create mode 100644 agent/consul/state/config_entry_sameness_group.go

diff --git a/agent/consul/discoverychain/compile.go b/agent/consul/discoverychain/compile.go
index b355ff9dd6d3..3be5a4aaa490 100644
--- a/agent/consul/discoverychain/compile.go
+++ b/agent/consul/discoverychain/compile.go
@@ -1196,7 +1196,7 @@ func (c *compiler) makeSamenessGroupFailover(target *structs.DiscoveryTarget, op
 	}
 
 	var failoverTargets []*structs.DiscoveryTarget
-	for _, t := range samenessGroup.ToFailoverTargets() {
+	for _, t := range samenessGroup.ToServiceResolverFailoverTargets() {
 		// Rewrite the target as per the failover policy.
 		targetOpts := structs.MergeDiscoveryTargetOpts(opts, t.ToDiscoveryTargetOpts())
 		failoverTarget := c.rewriteTarget(target, targetOpts)
diff --git a/agent/consul/prepared_query/walk_test.go b/agent/consul/prepared_query/walk_test.go
index a151d71c8e10..9ff380248bd2 100644
--- a/agent/consul/prepared_query/walk_test.go
+++ b/agent/consul/prepared_query/walk_test.go
@@ -46,6 +46,7 @@ func TestWalk_ServiceQuery(t *testing.T) {
 		".Tags[1]:tag2",
 		".Tags[2]:tag3",
 		".Peer:",
+		".SamenessGroup:",
 	}
 	expected = append(expected, entMetaWalkFields...)
 	sort.Strings(expected)
diff --git a/agent/consul/prepared_query_endpoint.go b/agent/consul/prepared_query_endpoint.go
index 9c8c26335ac3..df4ffdc1c647 100644
--- a/agent/consul/prepared_query_endpoint.go
+++ b/agent/consul/prepared_query_endpoint.go
@@ -141,7 +141,7 @@ func (p *PreparedQuery) Apply(args *structs.PreparedQueryRequest, reply *string)
 }
 
 // parseQuery makes sure the entries of a query are valid for a create or
-// update operation. Some of the fields are not checked or are partially
+// update operation. Some fields are not checked or are partially
 // checked, as noted in the comments below. This also updates all the parsed
 // fields of the query.
 func parseQuery(query *structs.PreparedQuery) error {
@@ -205,6 +205,10 @@ func parseService(svc *structs.ServiceQuery) error {
 		return err
 	}
 
+	if err := parseSameness(svc); err != nil {
+		return err
+	}
+
 	// We skip a few fields:
 	// - There's no validation for Datacenters; we skip any unknown entries
 	//   at execution time.
@@ -371,108 +375,117 @@ func (p *PreparedQuery) Execute(args *structs.PreparedQueryExecuteRequest,
 		return structs.ErrQueryNotFound
 	}
 
-	// Execute the query for the local DC.
-	if err := p.execute(query, reply, args.Connect); err != nil {
-		return err
-	}
+	// If we have a sameness group, it controls the initial query and
+	// subsequent failover if required (Enterprise Only)
+	if query.Service.SamenessGroup != "" {
+		wrapper := newQueryServerWrapper(p.srv, p.ExecuteRemote)
+		if err := querySameness(wrapper, *query, args, reply); err != nil {
+			return err
+		}
+	} else {
+		// Execute the query for the local DC.
+		if err := p.execute(query, reply, args.Connect); err != nil {
+			return err
+		}
 
-	// If they supplied a token with the query, use that, otherwise use the
-	// token passed in with the request.
-	token := args.QueryOptions.Token
-	if query.Token != "" {
-		token = query.Token
-	}
-	if err := p.srv.filterACL(token, reply); err != nil {
-		return err
-	}
+		// If they supplied a token with the query, use that, otherwise use the
+		// token passed in with the request.
+		token := args.QueryOptions.Token
+		if query.Token != "" {
+			token = query.Token
+		}
+		if err := p.srv.filterACL(token, reply); err != nil {
+			return err
+		}
 
-	// TODO (slackpad) We could add a special case here that will avoid the
-	// fail over if we filtered everything due to ACLs. This seems like it
-	// might not be worth the code complexity and behavior differences,
-	// though, since this is essentially a misconfiguration.
+		// TODO (slackpad) We could add a special case here that will avoid the
+		// fail over if we filtered everything due to ACLs. This seems like it
+		// might not be worth the code complexity and behavior differences,
+		// though, since this is essentially a misconfiguration.
 
-	// We have to do this ourselves since we are not doing a blocking RPC.
-	p.srv.setQueryMeta(&reply.QueryMeta, token)
+		// We have to do this ourselves since we are not doing a blocking RPC.
+		p.srv.setQueryMeta(&reply.QueryMeta, token)
 
-	// Shuffle the results in case coordinates are not available if they
-	// requested an RTT sort.
-	reply.Nodes.Shuffle()
+		// Shuffle the results in case coordinates are not available if they
+		// requested an RTT sort.
+		reply.Nodes.Shuffle()
 
-	// Build the query source. This can be provided by the client, or by
-	// the prepared query. Client-specified takes priority.
-	qs := args.Source
-	if qs.Datacenter == "" {
-		qs.Datacenter = args.Agent.Datacenter
-	}
-	if query.Service.Near != "" && qs.Node == "" {
-		qs.Node = query.Service.Near
-	}
+		// Build the query source. This can be provided by the client, or by
+		// the prepared query. Client-specified takes priority.
+		qs := args.Source
+		if qs.Datacenter == "" {
+			qs.Datacenter = args.Agent.Datacenter
+		}
+		if query.Service.Near != "" && qs.Node == "" {
+			qs.Node = query.Service.Near
+		}
 
-	// Respect the magic "_agent" flag.
-	if qs.Node == "_agent" {
-		qs.Node = args.Agent.Node
-	} else if qs.Node == "_ip" {
-		if args.Source.Ip != "" {
-			_, nodes, err := state.Nodes(nil, structs.NodeEnterpriseMetaInDefaultPartition(), structs.TODOPeerKeyword)
-			if err != nil {
-				return err
-			}
+		// Respect the magic "_agent" flag.
+		if qs.Node == "_agent" {
+			qs.Node = args.Agent.Node
+		} else if qs.Node == "_ip" {
+			if args.Source.Ip != "" {
+				_, nodes, err := state.Nodes(nil, structs.NodeEnterpriseMetaInDefaultPartition(), structs.TODOPeerKeyword)
+				if err != nil {
+					return err
+				}
 
-			for _, node := range nodes {
-				if args.Source.Ip == node.Address {
-					qs.Node = node.Node
-					break
+				for _, node := range nodes {
+					if args.Source.Ip == node.Address {
+						qs.Node = node.Node
+						break
+					}
 				}
+			} else {
+				p.logger.Warn("Prepared Query using near=_ip requires " +
+					"the source IP to be set but none was provided. No distance " +
+					"sorting will be done.")
+
 			}
-		} else {
-			p.logger.Warn("Prepared Query using near=_ip requires " +
-				"the source IP to be set but none was provided. No distance " +
-				"sorting will be done.")
 
+			// Either a source IP was given, but we couldn't find the associated node
+			// or no source ip was given. In both cases we should wipe the Node value
+			if qs.Node == "_ip" {
+				qs.Node = ""
+			}
 		}
 
-		// Either a source IP was given but we couldnt find the associated node
-		// or no source ip was given. In both cases we should wipe the Node value
-		if qs.Node == "_ip" {
-			qs.Node = ""
+		// Perform the distance sort
+		err = p.srv.sortNodesByDistanceFrom(qs, reply.Nodes)
+		if err != nil {
+			return err
 		}
-	}
-
-	// Perform the distance sort
-	err = p.srv.sortNodesByDistanceFrom(qs, reply.Nodes)
-	if err != nil {
-		return err
-	}
 
-	// If we applied a distance sort, make sure that the node queried for is in
-	// position 0, provided the results are from the same datacenter.
-	if qs.Node != "" && reply.Datacenter == qs.Datacenter {
-		for i, node := range reply.Nodes {
-			if strings.EqualFold(node.Node.Node, qs.Node) {
-				reply.Nodes[0], reply.Nodes[i] = reply.Nodes[i], reply.Nodes[0]
-				break
-			}
+		// If we applied a distance sort, make sure that the node queried for is in
+		// position 0, provided the results are from the same datacenter.
+		if qs.Node != "" && reply.Datacenter == qs.Datacenter {
+			for i, node := range reply.Nodes {
+				if strings.EqualFold(node.Node.Node, qs.Node) {
+					reply.Nodes[0], reply.Nodes[i] = reply.Nodes[i], reply.Nodes[0]
+					break
+				}
 
-			// Put a cap on the depth of the search. The local agent should
-			// never be further in than this if distance sorting was applied.
-			if i == 9 {
-				break
+				// Put a cap on the depth of the search. The local agent should
+				// never be further in than this if distance sorting was applied.
+				if i == 9 {
+					break
+				}
 			}
 		}
-	}
 
-	// Apply the limit if given.
-	if args.Limit > 0 && len(reply.Nodes) > args.Limit {
-		reply.Nodes = reply.Nodes[:args.Limit]
-	}
+		// Apply the limit if given.
+		if args.Limit > 0 && len(reply.Nodes) > args.Limit {
+			reply.Nodes = reply.Nodes[:args.Limit]
+		}
 
-	// In the happy path where we found some healthy nodes we go with that
-	// and bail out. Otherwise, we fail over and try remote DCs, as allowed
-	// by the query setup.
-	if len(reply.Nodes) == 0 {
-		wrapper := &queryServerWrapper{srv: p.srv, executeRemote: p.ExecuteRemote}
-		if err := queryFailover(wrapper, *query, args, reply); err != nil {
-			return err
+		// In the happy path where we found some healthy nodes we go with that
+		// and bail out. Otherwise, we fail over and try remote DCs, as allowed
+		// by the query setup.
+		if len(reply.Nodes) == 0 {
+			wrapper := newQueryServerWrapper(p.srv, p.ExecuteRemote)
+			if err := queryFailover(wrapper, *query, args, reply); err != nil {
+				return err
+			}
 		}
 	}
 
@@ -660,20 +673,38 @@ func serviceMetaFilter(filters map[string]string, nodes structs.CheckServiceNode
 	return filtered
 }
 
+type stateLookuper interface {
+	samenessGroupLookup(name string, entMeta acl.EnterpriseMeta) (uint64, *structs.SamenessGroupConfigEntry, error)
+}
+
+type stateLookup struct {
+	srv *Server
+}
+
 // queryServer is a wrapper that makes it easier to test the failover logic.
 type queryServer interface {
 	GetLogger() hclog.Logger
 	GetOtherDatacentersByDistance() ([]string, error)
 	GetLocalDC() string
 	ExecuteRemote(args *structs.PreparedQueryExecuteRemoteRequest, reply *structs.PreparedQueryExecuteResponse) error
+	GetSamenessGroupFailoverTargets(name string, entMeta acl.EnterpriseMeta) ([]structs.QueryFailoverTarget, error)
 }
 
 // queryServerWrapper applies the queryServer interface to a Server.
 type queryServerWrapper struct {
 	srv           *Server
+	sl            stateLookuper
 	executeRemote func(args *structs.PreparedQueryExecuteRemoteRequest, reply *structs.PreparedQueryExecuteResponse) error
 }
 
+func newQueryServerWrapper(srv *Server, executeRemote func(args *structs.PreparedQueryExecuteRemoteRequest, reply *structs.PreparedQueryExecuteResponse) error) *queryServerWrapper {
+	return &queryServerWrapper{
+		srv:           srv,
+		executeRemote: executeRemote,
+		sl:            stateLookup{srv},
+	}
+}
+
 // GetLocalDC returns the name of the local datacenter.
 func (q *queryServerWrapper) GetLocalDC() string {
 	return q.srv.config.Datacenter
@@ -771,43 +802,8 @@ func queryFailover(q queryServer, query structs.PreparedQuery,
 		// This keeps track of how many iterations we actually run.
 		failovers++
 
-		// Be super paranoid and set the nodes slice to nil since it's
-		// the same slice we used before. We know there's nothing in
-		// there, but the underlying msgpack library has a policy of
-		// updating the slice when it's non-nil, and that feels dirty.
-		// Let's just set it to nil so there's no way to communicate
-		// through this slice across successive RPC calls.
-		reply.Nodes = nil
-
-		// Reset Peer, because it may have been set by a previous failover
-		// target.
-		query.Service.Peer = target.Peer
-		query.Service.EnterpriseMeta = target.EnterpriseMeta
-		dc := target.Datacenter
-		if target.Peer != "" {
-			dc = q.GetLocalDC()
-		}
-
-		// Note that we pass along the limit since may be applied
-		// remotely to save bandwidth. We also pass along the consistency
-		// mode information and token we were given, so that applies to
-		// the remote query as well.
-		remote := &structs.PreparedQueryExecuteRemoteRequest{
-			Datacenter:   dc,
-			Query:        query,
-			Limit:        args.Limit,
-			QueryOptions: args.QueryOptions,
-			Connect:      args.Connect,
-		}
-
-		if err = q.ExecuteRemote(remote, reply); err != nil {
-			q.GetLogger().Warn("Failed querying for service in datacenter",
-				"service", query.Service.Service,
-				"peerName", query.Service.Peer,
-				"datacenter", dc,
-				"enterpriseMeta", query.Service.EnterpriseMeta,
-				"error", err,
-			)
+		err = targetSelector(q, query, args, target, reply)
+		if err != nil {
 			continue
 		}
 
@@ -823,3 +819,52 @@ func queryFailover(q queryServer, query structs.PreparedQuery,
 
 	return nil
 }
+
+func targetSelector(q queryServer,
+	query structs.PreparedQuery,
+	args *structs.PreparedQueryExecuteRequest,
+	target structs.QueryFailoverTarget,
+	reply *structs.PreparedQueryExecuteResponse) error {
+	// Be super paranoid and set the nodes slice to nil since it's
+	// the same slice we used before. We know there's nothing in
+	// there, but the underlying msgpack library has a policy of
+	// updating the slice when it's non-nil, and that feels dirty.
+	// Let's just set it to nil so there's no way to communicate
+	// through this slice across successive RPC calls.
+	reply.Nodes = nil
+
+	// Reset Peer, because it may have been set by a previous failover
+	// target.
+	query.Service.Peer = target.Peer
+	query.Service.EnterpriseMeta = target.EnterpriseMeta
+	dc := target.Datacenter
+	if target.Peer != "" {
+		dc = q.GetLocalDC()
+	}
+
+	// Note that we pass along the limit since may be applied
+	// remotely to save bandwidth. We also pass along the consistency
+	// mode information and token we were given, so that applies to
+	// the remote query as well.
+	remote := &structs.PreparedQueryExecuteRemoteRequest{
+		Datacenter:   dc,
+		Query:        query,
+		Limit:        args.Limit,
+		QueryOptions: args.QueryOptions,
+		Connect:      args.Connect,
+	}
+
+	var err error
+	if err = q.ExecuteRemote(remote, reply); err != nil {
+		q.GetLogger().Warn("Failed querying for service in datacenter",
+			"service", query.Service.Service,
+			"peerName", query.Service.Peer,
+			"datacenter", dc,
+			"enterpriseMeta", query.Service.EnterpriseMeta,
+			"error", err,
+		)
+		return err
+	}
+
+	return nil
+}
diff --git a/agent/consul/prepared_query_endpoint_oss.go b/agent/consul/prepared_query_endpoint_oss.go
new file mode 100644
index 000000000000..612b81b2e688
--- /dev/null
+++ b/agent/consul/prepared_query_endpoint_oss.go
@@ -0,0 +1,38 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build !consulent
+// +build !consulent
+
+package consul
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/consul/acl"
+	"github.com/hashicorp/consul/agent/structs"
+)
+
+func parseSameness(svc *structs.ServiceQuery) error {
+	if svc.SamenessGroup != "" {
+		return fmt.Errorf("sameness-groups are an enterprise-only feature")
+	}
+	return nil
+}
+
+func (sl stateLookup) samenessGroupLookup(_ string, _ acl.EnterpriseMeta) (uint64, *structs.SamenessGroupConfigEntry, error) {
+	return 0, nil, nil
+}
+
+// GetSamenessGroupFailoverTargets supports Sameness Groups an enterprise only feature. This satisfies the queryServer interface
+func (q *queryServerWrapper) GetSamenessGroupFailoverTargets(_ string, _ acl.EnterpriseMeta) ([]structs.QueryFailoverTarget, error) {
+	return []structs.QueryFailoverTarget{}, nil
+}
+
+func querySameness(_ queryServer,
+	_ structs.PreparedQuery,
+	_ *structs.PreparedQueryExecuteRequest,
+	_ *structs.PreparedQueryExecuteResponse) error {
+
+	return nil
+}
diff --git a/agent/consul/prepared_query_endpoint_oss_test.go b/agent/consul/prepared_query_endpoint_oss_test.go
new file mode 100644
index 000000000000..ee96a7b2671a
--- /dev/null
+++ b/agent/consul/prepared_query_endpoint_oss_test.go
@@ -0,0 +1,52 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build !consulent
+// +build !consulent
+
+package consul
+
+import (
+	"os"
+	"testing"
+
+	msgpackrpc "github.com/hashicorp/consul-net-rpc/net-rpc-msgpackrpc"
+	"github.com/hashicorp/consul/agent/structs"
+	"github.com/hashicorp/consul/testrpc"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPreparedQuery_OSS_Apply(t *testing.T) {
+	if testing.Short() {
+		t.Skip("too slow for testing.Short")
+	}
+
+	t.Parallel()
+	dir1, s1 := testServerWithConfig(t)
+	defer os.RemoveAll(dir1)
+	defer s1.Shutdown()
+	codec := rpcClient(t, s1)
+	defer codec.Close()
+
+	testrpc.WaitForLeader(t, s1.RPC, "dc1")
+
+	// Set up a bare bones query.
+	query := structs.PreparedQueryRequest{
+		Datacenter: "dc1",
+		Op:         structs.PreparedQueryCreate,
+		Query: &structs.PreparedQuery{
+			Name: "test",
+			Service: structs.ServiceQuery{
+				Service: "redis",
+			},
+		},
+	}
+	var reply string
+
+	// Fix that and ensure Targets and Datacenters cannot be set at the same time.
+	query.Query.Service.SamenessGroup = "sg"
+	err := msgpackrpc.CallWithCodec(codec, "PreparedQuery.Apply", &query, &reply)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "enterprise")
+}
diff --git a/agent/consul/prepared_query_endpoint_test.go b/agent/consul/prepared_query_endpoint_test.go
index 0e365a30d48c..63277adfe27c 100644
--- a/agent/consul/prepared_query_endpoint_test.go
+++ b/agent/consul/prepared_query_endpoint_test.go
@@ -6,6 +6,7 @@ package consul
 import (
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"os"
 	"reflect"
@@ -37,6 +38,8 @@ import (
 	"github.com/hashicorp/consul/types"
 )
 
+const localTestDC = "dc1"
+
 func TestPreparedQuery_Apply(t *testing.T) {
 	if testing.Short() {
 		t.Skip("too slow for testing.Short")
@@ -2814,13 +2817,17 @@ func TestPreparedQuery_Wrapper(t *testing.T) {
 	})
 }
 
+var _ queryServer = (*mockQueryServer)(nil)
+
 type mockQueryServer struct {
+	queryServerWrapper
 	Datacenters      []string
 	DatacentersError error
 	QueryLog         []string
 	QueryFn          func(args *structs.PreparedQueryExecuteRemoteRequest, reply *structs.PreparedQueryExecuteResponse) error
 	Logger           hclog.Logger
 	LogBuffer        *bytes.Buffer
+	SamenessGroup    map[string]*structs.SamenessGroupConfigEntry
 }
 
 func (m *mockQueryServer) JoinQueryLog() string {
@@ -2841,7 +2848,7 @@ func (m *mockQueryServer) GetLogger() hclog.Logger {
 }
 
 func (m *mockQueryServer) GetLocalDC() string {
-	return "dc1"
+	return localTestDC
 }
 
 func (m *mockQueryServer) GetOtherDatacentersByDistance() ([]string, error) {
@@ -2850,14 +2857,21 @@ func (m *mockQueryServer) GetOtherDatacentersByDistance() ([]string, error) {
 
 func (m *mockQueryServer) ExecuteRemote(args *structs.PreparedQueryExecuteRemoteRequest, reply *structs.PreparedQueryExecuteResponse) error {
 	peerName := args.Query.Service.Peer
+	partitionName := args.Query.Service.PartitionOrEmpty()
+	namespaceName := args.Query.Service.NamespaceOrEmpty()
 	dc := args.Datacenter
 	if peerName != "" {
 		m.QueryLog = append(m.QueryLog, fmt.Sprintf("peer:%s", peerName))
+	} else if partitionName != "" {
+		m.QueryLog = append(m.QueryLog, fmt.Sprintf("partition:%s", partitionName))
+	} else if namespaceName != "" {
+		m.QueryLog = append(m.QueryLog, fmt.Sprintf("namespace:%s", namespaceName))
 	} else {
 		m.QueryLog = append(m.QueryLog, fmt.Sprintf("%s:%s", dc, "PreparedQuery.ExecuteRemote"))
 	}
 	reply.PeerName = peerName
 	reply.Datacenter = dc
+	reply.EnterpriseMeta = acl.NewEnterpriseMetaWithPartition(partitionName, namespaceName)
 
 	if m.QueryFn != nil {
 		return m.QueryFn(args, reply)
@@ -2865,6 +2879,33 @@ func (m *mockQueryServer) ExecuteRemote(args *structs.PreparedQueryExecuteRemote
 	return nil
 }
 
+type mockStateLookup struct {
+	SamenessGroup map[string]*structs.SamenessGroupConfigEntry
+}
+
+func (sl mockStateLookup) samenessGroupLookup(name string, entMeta acl.EnterpriseMeta) (uint64, *structs.SamenessGroupConfigEntry, error) {
+	lookup := name
+	if ap := entMeta.PartitionOrEmpty(); ap != "" {
+		lookup = fmt.Sprintf("%s-%s", lookup, ap)
+	} else if ns := entMeta.NamespaceOrEmpty(); ns != "" {
+		lookup = fmt.Sprintf("%s-%s", lookup, ns)
+	}
+
+	sg, ok := sl.SamenessGroup[lookup]
+	if !ok {
+		return 0, nil, errors.New("unable to find sameness group")
+	}
+
+	return 0, sg, nil
+}
+
+func (m *mockQueryServer) GetSamenessGroupFailoverTargets(name string, entMeta acl.EnterpriseMeta) ([]structs.QueryFailoverTarget, error) {
+	m.sl = mockStateLookup{
+		SamenessGroup: m.SamenessGroup,
+	}
+	return m.queryServerWrapper.GetSamenessGroupFailoverTargets(name, entMeta)
+}
+
 func TestPreparedQuery_queryFailover(t *testing.T) {
 	t.Parallel()
 	query := structs.PreparedQuery{
diff --git a/agent/consul/state/config_entry_sameness_group.go b/agent/consul/state/config_entry_sameness_group.go
new file mode 100644
index 000000000000..7f02787b6553
--- /dev/null
+++ b/agent/consul/state/config_entry_sameness_group.go
@@ -0,0 +1,19 @@
+package state
+
+import (
+	"github.com/hashicorp/consul/agent/configentry"
+	"github.com/hashicorp/consul/agent/structs"
+	"github.com/hashicorp/go-memdb"
+)
+
+// GetSamenessGroup returns a SamenessGroupConfigEntry from the state
+// store using the provided parameters.
+func (s *Store) GetSamenessGroup(ws memdb.WatchSet,
+	name string,
+	overrides map[configentry.KindName]structs.ConfigEntry,
+	partition string) (uint64, *structs.SamenessGroupConfigEntry, error) {
+	tx := s.db.ReadTxn()
+	defer tx.Abort()
+
+	return getSamenessGroupConfigEntryTxn(tx, ws, name, overrides, partition)
+}
diff --git a/agent/structs/config_entry_sameness_group_oss.go b/agent/structs/config_entry_sameness_group_oss.go
index ee23feb3908b..0693ed0ee850 100644
--- a/agent/structs/config_entry_sameness_group_oss.go
+++ b/agent/structs/config_entry_sameness_group_oss.go
@@ -8,20 +8,27 @@ package structs
 
 import "fmt"
 
+// Validate assures that the sameness-groups are an enterprise only feature
 func (s *SamenessGroupConfigEntry) Validate() error {
 	return fmt.Errorf("sameness-groups are an enterprise-only feature")
 }
 
-// RelatedPeers returns all peers that are members of a sameness group config entry.
+// RelatedPeers is an OSS placeholder noop
 func (s *SamenessGroupConfigEntry) RelatedPeers() []string {
 	return nil
 }
 
-// AllMembers adds the local partition to Members when it is set.
+// AllMembers is an OSS placeholder noop
 func (s *SamenessGroupConfigEntry) AllMembers() []SamenessGroupMember {
 	return nil
 }
 
-func (s *SamenessGroupConfigEntry) ToFailoverTargets() []ServiceResolverFailoverTarget {
+// ToServiceResolverFailoverTargets is an OSS placeholder noop
+func (s *SamenessGroupConfigEntry) ToServiceResolverFailoverTargets() []ServiceResolverFailoverTarget {
+	return nil
+}
+
+// ToQueryFailoverTargets is an OSS placeholder noop
+func (s *SamenessGroupConfigEntry) ToQueryFailoverTargets(namespace string) []QueryFailoverTarget {
 	return nil
 }
diff --git a/agent/structs/prepared_query.go b/agent/structs/prepared_query.go
index c5b75a052978..71b0eba81bc3 100644
--- a/agent/structs/prepared_query.go
+++ b/agent/structs/prepared_query.go
@@ -44,6 +44,14 @@ func (f *QueryFailoverOptions) AsTargets() []QueryFailoverTarget {
 	return f.Targets
 }
 
+// IsEmpty returns true if the QueryFailoverOptions are empty (not set), false otherwise
+func (f *QueryFailoverOptions) IsEmpty() bool {
+	if f == nil || (f.NearestN == 0 && len(f.Datacenters) == 0 && len(f.Targets) == 0) {
+		return true
+	}
+	return false
+}
+
 type QueryFailoverTarget struct {
 	// Peer specifies a peer to try during failover.
 	Peer string
@@ -66,6 +74,11 @@ type ServiceQuery struct {
 	// Service is the service to query.
 	Service string
 
+	// SamenessGroup specifies a sameness group to query. The first member of the Sameness Group will
+	// be targeted first on PQ execution and subsequent members will be targeted during failover scenarios.
+	// This field is mutually exclusive with Failover.
+	SamenessGroup string
+
 	// Failover controls what we do if there are no healthy nodes in the
 	// local datacenter.
 	Failover QueryFailoverOptions
diff --git a/agent/structs/prepared_query_test.go b/agent/structs/prepared_query_test.go
index b74504ed58e1..a6d6e64849af 100644
--- a/agent/structs/prepared_query_test.go
+++ b/agent/structs/prepared_query_test.go
@@ -5,6 +5,8 @@ package structs
 
 import (
 	"testing"
+
+	"github.com/stretchr/testify/assert"
 )
 
 func TestStructs_PreparedQuery_GetACLPrefix(t *testing.T) {
@@ -36,3 +38,54 @@ func TestPreparedQueryExecuteRequest_CacheInfoKey(t *testing.T) {
 	ignored := []string{"Agent", "QueryOptions"}
 	assertCacheInfoKeyIsComplete(t, &PreparedQueryExecuteRequest{}, ignored...)
 }
+
+func TestQueryFailoverOptions_IsEmpty(t *testing.T) {
+	tests := []struct {
+		name            string
+		query           QueryFailoverOptions
+		isExpectedEmpty bool
+	}{
+		{
+			name:            "expect empty",
+			query:           QueryFailoverOptions{},
+			isExpectedEmpty: true,
+		},
+		{
+			name: "expect not empty NearestN",
+			query: QueryFailoverOptions{
+				NearestN: 1,
+			},
+			isExpectedEmpty: false,
+		},
+		{
+			name: "expect not empty NearestN negative",
+			query: QueryFailoverOptions{
+				NearestN: -1,
+			},
+			isExpectedEmpty: false,
+		},
+		{
+			name: "expect not empty datacenters",
+			query: QueryFailoverOptions{
+				Datacenters: []string{"dc"},
+			},
+			isExpectedEmpty: false,
+		},
+		{
+			name: "expect not empty targets",
+			query: QueryFailoverOptions{
+				Targets: []QueryFailoverTarget{
+					{
+						Peer: "peer",
+					},
+				},
+			},
+			isExpectedEmpty: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.isExpectedEmpty, tt.query.IsEmpty())
+		})
+	}
+}
diff --git a/api/prepared_query.go b/api/prepared_query.go
index b79c9ae41281..bb40e6a7fddd 100644
--- a/api/prepared_query.go
+++ b/api/prepared_query.go
@@ -51,9 +51,17 @@ type ServiceQuery struct {
 	// Service is the service to query.
 	Service string
 
+	// SamenessGroup specifies a sameness group to query. The first member of the Sameness Group will
+	// be targeted first on PQ execution and subsequent members will be targeted during failover scenarios.
+	// This field is mutually exclusive with Failover.
+	SamenessGroup string `json:",omitempty"`
+
 	// Namespace of the service to query
 	Namespace string `json:",omitempty"`
 
+	// Partition of the service to query
+	Partition string `json:",omitempty"`
+
 	// Near allows baking in the name of a node to automatically distance-
 	// sort from. The magic "_agent" value is supported, which sorts near
 	// the agent which initiated the request by default.
@@ -61,7 +69,7 @@ type ServiceQuery struct {
 
 	// Failover controls what we do if there are no healthy nodes in the
 	// local datacenter.
-	Failover QueryFailoverOptions
+	Failover QueryFailoverOptions `json:",omitempty"`
 
 	// IgnoreCheckIDs is an optional list of health check IDs to ignore when
 	// considering which nodes are healthy. It is useful as an emergency measure
diff --git a/website/content/api-docs/query.mdx b/website/content/api-docs/query.mdx
index 81c6ed0e4ac9..3a46b383d42d 100644
--- a/website/content/api-docs/query.mdx
+++ b/website/content/api-docs/query.mdx
@@ -177,13 +177,22 @@ The table below shows this endpoint's support for
   - `Service` `(string: <required>)` - Specifies the name of the service to
     query.
 
+  - `SamenessGroup` `(string: "")` <EnterpriseAlert inline /> - Specifies a Sameness group to forward the
+  query to. The `SamenessGroup` will forward to its members in the order defined, returning on the first
+  healthy query. `SamenessGroup` is mutually exclusive with `Failover` as `SamenessGroup` members will be used
+  in place of a defined list of failovers.
+
   - `Namespace` `(string: "")` <EnterpriseAlert inline /> - Specifies the Consul namespace
-    to query. If not provided the query will use Consul default namespace for resolution.
+    to query. If not provided the query will use Consul default namespace for resolution. When combined with
+  `SamenessGroup` this will specify the namespaces in which the `SamenessGroup` will resolve all members listed.
+
+  - `Partition` `(string: "")` <EnterpriseAlert inline /> - Specifies the Consul partition
+  to query. If not provided the query will use Consul's default partition for resolution. When combined with
+  `SamenessGroup`, this will specify the partition where the `SamenessGroup` exists.
 
-  - `Failover` contains two fields, both of which are optional, and determine
-    what happens if no healthy nodes are available in the local datacenter when
+  - `Failover` Determines what happens if no healthy nodes are available in the local datacenter when
     the query is executed. It allows the use of nodes in other datacenters with
-    very little configuration.
+    very little configuration. This field is mutually exclusive with `SamenessGroup`.
 
     - `NearestN` `(int: 0)` - Specifies that the query will be forwarded to up
       to `NearestN` other datacenters based on their estimated network round

From e47f3216e51b7938681b0ad923f86dc8b408918f Mon Sep 17 00:00:00 2001
From: John Maguire <john.maguire@hashicorp.com>
Date: Mon, 24 Apr 2023 16:22:55 -0400
Subject: [PATCH 06/92] APIGW Normalize Status Conditions (#16994)

* normalize status conditions for gateways and routes

* Added tests for checking condition status and panic conditions for
validating combinations, added dummy code for fsm store

* get rid of unneeded gateway condition generator struct

* Remove unused file

* run go mod tidy

* Update tests, add conflicted gateway status

* put back removed status for test

* Fix linting violation, remove custom conflicted status

* Update fsm commands oss

* Fix incorrect combination of type/condition/status

* cleaning up from PR review

* Change "invalidCertificate" to be of accepted status

* Move status condition enums into api package

* Update gateways controller and generated code

* Update conditions in fsm oss tests

* run go mod tidy on consul-container module to fix linting

* Fix type for gateway endpoint test

* go mod tidy from changes to api

* go mod tidy on troubleshoot

* Fix route conflicted reason

* fix route conflict reason rename

* Fix text for gateway conflicted status

* Add valid certificate ref condition setting

* Revert change to resolved refs to be handled in future PR
---
 agent/consul/fsm/commands_oss_test.go         |  21 +-
 agent/consul/fsm_data_store.go                |  80 -----
 agent/consul/gateways/controller_gateways.go  | 269 ++++++++---------
 .../gateways/controller_gateways_test.go      | 266 +++++++++--------
 agent/structs/config_entry_status.go          |  89 ++++--
 api/config_entry_status.go                    | 282 +++++++++++++++++-
 api/config_entry_status_test.go               | 187 ++++++++++++
 api/go.mod                                    |   6 +-
 api/go.sum                                    |  12 +-
 envoyextensions/go.mod                        |   3 +-
 envoyextensions/go.sum                        |   8 +-
 go.mod                                        |   4 +-
 go.sum                                        |   8 +-
 test/integration/consul-container/go.mod      |   2 +-
 test/integration/consul-container/go.sum      |   4 +-
 .../test/gateways/gateway_endpoint_test.go    |   2 +-
 troubleshoot/go.mod                           |   2 +-
 troubleshoot/go.sum                           |   3 +-
 18 files changed, 826 insertions(+), 422 deletions(-)
 delete mode 100644 agent/consul/fsm_data_store.go
 create mode 100644 api/config_entry_status_test.go

diff --git a/agent/consul/fsm/commands_oss_test.go b/agent/consul/fsm/commands_oss_test.go
index 981de232a6ba..cea6f05f54f3 100644
--- a/agent/consul/fsm/commands_oss_test.go
+++ b/agent/consul/fsm/commands_oss_test.go
@@ -13,11 +13,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/hashicorp/go-raftchunking"
-	raftchunkingtypes "github.com/hashicorp/go-raftchunking/types"
-	"github.com/hashicorp/go-uuid"
-	"github.com/hashicorp/raft"
-	"github.com/hashicorp/serf/coordinate"
 	"github.com/mitchellh/mapstructure"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -34,6 +29,11 @@ import (
 	"github.com/hashicorp/consul/proto/private/prototest"
 	"github.com/hashicorp/consul/sdk/testutil"
 	"github.com/hashicorp/consul/types"
+	"github.com/hashicorp/go-raftchunking"
+	raftchunkingtypes "github.com/hashicorp/go-raftchunking/types"
+	"github.com/hashicorp/go-uuid"
+	"github.com/hashicorp/raft"
+	"github.com/hashicorp/serf/coordinate"
 )
 
 func generateUUID() (ret string) {
@@ -1372,9 +1372,10 @@ func TestFSM_ConfigEntry_StatusCAS(t *testing.T) {
 		EnterpriseMeta: *structs.DefaultEnterpriseMetaInDefaultPartition(),
 		Status: structs.Status{
 			Conditions: []structs.Condition{{
-				Status: "Foo",
+				Status: string(api.ConditionStatusTrue),
 			}},
-		}}
+		},
+	}
 
 	// Create a new request.
 	req := &structs.ConfigEntryRequest{
@@ -1403,7 +1404,7 @@ func TestFSM_ConfigEntry_StatusCAS(t *testing.T) {
 	// do a status update
 	entry.Status = structs.Status{
 		Conditions: []structs.Condition{{
-			Status: "Foo",
+			Status: string(api.ConditionStatusTrue),
 		}},
 	}
 	req = &structs.ConfigEntryRequest{
@@ -1427,7 +1428,7 @@ func TestFSM_ConfigEntry_StatusCAS(t *testing.T) {
 		entry.RaftIndex.ModifyIndex = 2
 		conditions := config.(*structs.APIGatewayConfigEntry).Status.Conditions
 		require.Len(t, conditions, 1)
-		require.Equal(t, "Foo", conditions[0].Status)
+		require.Equal(t, string(api.ConditionStatusTrue), conditions[0].Status)
 	}
 
 	// attempt to change the status with a regular update and make sure it's ignored
@@ -1456,7 +1457,7 @@ func TestFSM_ConfigEntry_StatusCAS(t *testing.T) {
 		require.NoError(t, err)
 		conditions := config.(*structs.APIGatewayConfigEntry).Status.Conditions
 		require.Len(t, conditions, 1)
-		require.Equal(t, "Foo", conditions[0].Status)
+		require.Equal(t, string(api.ConditionStatusTrue), conditions[0].Status)
 	}
 }
 
diff --git a/agent/consul/fsm_data_store.go b/agent/consul/fsm_data_store.go
deleted file mode 100644
index 46c3ca2f0f4e..000000000000
--- a/agent/consul/fsm_data_store.go
+++ /dev/null
@@ -1,80 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package consul
-
-import (
-	"github.com/hashicorp/consul/acl"
-	"github.com/hashicorp/consul/agent/consul/fsm"
-	"github.com/hashicorp/consul/agent/structs"
-)
-
-// FSMDataStore implements the DataStore interface using the Consul server and finite state manager.
-type FSMDataStore struct {
-	server *Server
-	fsm    *fsm.FSM
-}
-
-func NewFSMDataStore(server *Server, fsm *fsm.FSM) *FSMDataStore {
-	return &FSMDataStore{
-		server: server,
-		fsm:    fsm,
-	}
-}
-
-// GetConfigEntry takes in a kind, name, and meta and returns a configentry and an error from the FSM state
-func (f *FSMDataStore) GetConfigEntry(kind string, name string, meta *acl.EnterpriseMeta) (structs.ConfigEntry, error) {
-	store := f.fsm.State()
-
-	_, entry, err := store.ConfigEntry(nil, kind, name, meta)
-	if err != nil {
-		return nil, err
-	}
-	return entry, nil
-}
-
-// GetConfigEntriesByKind takes in a kind and returns all instances of that kind of config entry from the FSM state
-func (f *FSMDataStore) GetConfigEntriesByKind(kind string) ([]structs.ConfigEntry, error) {
-	store := f.fsm.State()
-
-	_, entries, err := store.ConfigEntriesByKind(nil, kind, acl.WildcardEnterpriseMeta())
-	if err != nil {
-		return nil, err
-	}
-	return entries, nil
-}
-
-// Update takes a config entry and upserts it in the FSM state
-func (f *FSMDataStore) Update(entry structs.ConfigEntry) error {
-	_, err := f.server.leaderRaftApply("ConfigEntry.Apply", structs.ConfigEntryRequestType, &structs.ConfigEntryRequest{
-		Op:    structs.ConfigEntryUpsertCAS,
-		Entry: entry,
-	})
-	return err
-}
-
-// UpdateStatus takes a config entry, an error, and updates the status field as needed in the FSM state
-func (f *FSMDataStore) UpdateStatus(entry structs.ControlledConfigEntry, err error) error {
-	if err == nil {
-		//TODO additional status messages for success?
-		return nil
-	}
-	status := structs.Status{
-		Conditions: []structs.Condition{{
-
-			Status: err.Error() + ": Accepted == false",
-		},
-		},
-	}
-	entry.SetStatus(status)
-	return f.Update(entry)
-}
-
-// Delete takes a config entry and deletes it from the FSM state
-func (f *FSMDataStore) Delete(entry structs.ConfigEntry) error {
-	_, err := f.server.leaderRaftApply("ConfigEntry.Delete", structs.ConfigEntryRequestType, &structs.ConfigEntryRequest{
-		Op:    structs.ConfigEntryDelete,
-		Entry: entry,
-	})
-	return err
-}
diff --git a/agent/consul/gateways/controller_gateways.go b/agent/consul/gateways/controller_gateways.go
index afb687fe0971..e399503f355f 100644
--- a/agent/consul/gateways/controller_gateways.go
+++ b/agent/consul/gateways/controller_gateways.go
@@ -8,7 +8,6 @@ import (
 	"errors"
 	"fmt"
 	"sync"
-	"time"
 
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-memdb"
@@ -20,6 +19,7 @@ import (
 	"github.com/hashicorp/consul/agent/consul/state"
 	"github.com/hashicorp/consul/agent/consul/stream"
 	"github.com/hashicorp/consul/agent/structs"
+	"github.com/hashicorp/consul/api"
 )
 
 var (
@@ -211,8 +211,6 @@ func (r *apiGatewayReconciler) cleanupGateway(_ context.Context, req controller.
 // referenced this gateway. It then persists any status updates for the gateway,
 // the modified routes, and updates the bound gateway.
 func (r *apiGatewayReconciler) reconcileGateway(_ context.Context, req controller.Request, store *state.Store, gateway *structs.APIGatewayConfigEntry) error {
-	conditions := newGatewayConditionGenerator()
-
 	logger := gatewayRequestLogger(r.logger, req)
 
 	logger.Trace("started reconciling gateway")
@@ -244,13 +242,13 @@ func (r *apiGatewayReconciler) reconcileGateway(_ context.Context, req controlle
 	}
 
 	for ref, err := range certificateErrors {
-		updater.SetCondition(conditions.invalidCertificate(ref, err))
+		updater.SetCondition(invalidCertificate(ref, err))
 	}
 
 	if len(certificateErrors) > 0 {
-		updater.SetCondition(conditions.invalidCertificates())
+		updater.SetCondition(invalidCertificates())
 	} else {
-		updater.SetCondition(conditions.gatewayAccepted())
+		updater.SetCondition(gatewayAccepted())
 	}
 
 	// now we bind all of the routes we can
@@ -262,19 +260,19 @@ func (r *apiGatewayReconciler) reconcileGateway(_ context.Context, req controlle
 		// unset the old gateway binding in case it's stale
 		for _, parent := range route.GetParents() {
 			if parent.Kind == gateway.Kind && parent.Name == gateway.Name && parent.EnterpriseMeta.IsSame(&gateway.EnterpriseMeta) {
-				routeUpdater.RemoveCondition(conditions.routeBound(parent))
+				routeUpdater.RemoveCondition(routeBound(parent))
 			}
 		}
 
 		// set the status for parents that have bound successfully
 		for _, ref := range boundRefs {
-			routeUpdater.SetCondition(conditions.routeBound(ref))
+			routeUpdater.SetCondition(routeBound(ref))
 		}
 
 		// set the status for any parents that have errored trying to
 		// bind
 		for ref, err := range bindErrors {
-			routeUpdater.SetCondition(conditions.routeUnbound(ref, err))
+			routeUpdater.SetCondition(routeUnbound(ref, err))
 		}
 
 		// if we've updated any statuses, then store them as needing
@@ -354,8 +352,6 @@ func (r *apiGatewayReconciler) cleanupRoute(_ context.Context, req controller.Re
 // gateways that now have route conflicts, and updates all statuses and states
 // as necessary.
 func (r *apiGatewayReconciler) reconcileRoute(_ context.Context, req controller.Request, store *state.Store, route structs.BoundRoute) error {
-	conditions := newGatewayConditionGenerator()
-
 	logger := routeRequestLogger(r.logger, req)
 
 	logger.Trace("reconciling route")
@@ -435,23 +431,23 @@ func (r *apiGatewayReconciler) reconcileRoute(_ context.Context, req controller.
 			Entries:               chainSet,
 		})
 		if err != nil {
-			updater.SetCondition(conditions.routeInvalidDiscoveryChain(err))
+			updater.SetCondition(routeInvalidDiscoveryChain(err))
 			continue
 		}
 
 		if chain.Protocol != string(route.GetProtocol()) {
-			updater.SetCondition(conditions.routeInvalidDiscoveryChain(errInvalidProtocol))
+			updater.SetCondition(routeInvalidDiscoveryChain(errInvalidProtocol))
 			continue
 		}
 
-		updater.SetCondition(conditions.routeAccepted())
+		updater.SetCondition(routeAccepted())
 	}
 
 	// if we have no upstream targets, then set the route as invalid
 	// this should already happen in the validation check on write, but
 	// we'll do it here too just in case
 	if len(route.GetServiceNames()) == 0 {
-		updater.SetCondition(conditions.routeNoUpstreams())
+		updater.SetCondition(routeNoUpstreams())
 	}
 
 	// the route is valid, attempt to bind it to all gateways
@@ -460,12 +456,12 @@ func (r *apiGatewayReconciler) reconcileRoute(_ context.Context, req controller.
 
 	// set the status of the references that are bound
 	for _, ref := range boundRefs {
-		updater.SetCondition(conditions.routeBound(ref))
+		updater.SetCondition(routeBound(ref))
 	}
 
 	// set any binding errors
 	for ref, err := range bindErrors {
-		updater.SetCondition(conditions.routeUnbound(ref, err))
+		updater.SetCondition(routeUnbound(ref, err))
 	}
 
 	// set any refs that haven't been bound or explicitly errored
@@ -479,7 +475,7 @@ PARENT_LOOP:
 		if _, ok := bindErrors[ref]; ok {
 			continue PARENT_LOOP
 		}
-		updater.SetCondition(conditions.gatewayNotFound(ref))
+		updater.SetCondition(gatewayNotFound(ref))
 	}
 
 	return finalize(modifiedGateways)
@@ -549,8 +545,6 @@ type gatewayMeta struct {
 	// the map values are pointers so that we can update them directly
 	// and have the changes propagate back to the container gateways.
 	boundListeners map[string]*structs.BoundAPIGatewayListener
-
-	generator *gatewayConditionGenerator
 }
 
 // getAllGatewayMeta returns a pre-constructed list of all valid gateway and state
@@ -678,13 +672,13 @@ func (g *gatewayMeta) bindRoute(listener *structs.APIGatewayListener, bound *str
 	}
 
 	// check to make sure we're not binding to an invalid gateway
-	if !g.Gateway.Status.MatchesConditionStatus(g.generator.gatewayAccepted()) {
+	if !g.Gateway.Status.MatchesConditionStatus(gatewayAccepted()) {
 		return false, fmt.Errorf("failed to bind route to gateway %s: gateway has not been accepted", g.Gateway.Name)
 	}
 
 	// check to make sure we're not binding to an invalid route
 	status := route.GetStatus()
-	if !status.MatchesConditionStatus(g.generator.routeAccepted()) {
+	if !status.MatchesConditionStatus(routeAccepted()) {
 		return false, fmt.Errorf("failed to bind route to gateway %s: route has not been accepted", g.Gateway.Name)
 	}
 
@@ -755,7 +749,6 @@ func (g *gatewayMeta) checkCertificates(store *state.Store) (map[structs.Resourc
 		}
 		return nil
 	})
-
 	if err != nil {
 		return nil, err
 	}
@@ -773,8 +766,6 @@ func (g *gatewayMeta) checkConflicts() (structs.ControlledConfigEntry, bool) {
 // setConflicts ensures that no TCP listener has more than the one allowed route and
 // assigns an appropriate status
 func (g *gatewayMeta) setConflicts(updater *structs.StatusUpdater) {
-	conditions := newGatewayConditionGenerator()
-
 	g.eachListener(func(listener *structs.APIGatewayListener, bound *structs.BoundAPIGatewayListener) error {
 		ref := structs.ResourceReference{
 			Kind:           structs.APIGateway,
@@ -785,19 +776,17 @@ func (g *gatewayMeta) setConflicts(updater *structs.StatusUpdater) {
 		switch listener.Protocol {
 		case structs.ListenerProtocolTCP:
 			if len(bound.Routes) > 1 {
-				updater.SetCondition(conditions.gatewayListenerConflicts(ref))
+				updater.SetCondition(gatewayListenerConflicts(ref))
 				return nil
 			}
 		}
-		updater.SetCondition(conditions.gatewayListenerNoConflicts(ref))
+		updater.SetCondition(gatewayListenerNoConflicts(ref))
 		return nil
 	})
 }
 
 // initialize sets up the listener maps that we use for quickly indexing the listeners in our binding logic
 func (g *gatewayMeta) initialize() *gatewayMeta {
-	g.generator = newGatewayConditionGenerator()
-
 	// set up the maps for fast access
 	g.boundListeners = make(map[string]*structs.BoundAPIGatewayListener, len(g.BoundGateway.Listeners))
 	for i, listener := range g.BoundGateway.Listeners {
@@ -840,151 +829,132 @@ func newGatewayMeta(gateway *structs.APIGatewayConfigEntry, bound structs.Config
 	}).initialize()
 }
 
-// gatewayConditionGenerator is a simple struct used for isolating
-// the status conditions that we generate for our components
-type gatewayConditionGenerator struct {
-	now *time.Time
-}
-
-// newGatewayConditionGenerator initializes a status conditions generator
-func newGatewayConditionGenerator() *gatewayConditionGenerator {
-	return &gatewayConditionGenerator{
-		now: pointerTo(time.Now().UTC()),
-	}
+// gatewayAccepted marks the APIGateway as valid.
+func gatewayAccepted() structs.Condition {
+	return structs.NewGatewayCondition(
+		api.GatewayConditionAccepted,
+		api.ConditionStatusTrue,
+		api.GatewayReasonAccepted,
+		"gateway is valid",
+		structs.ResourceReference{},
+	)
 }
 
 // invalidCertificate returns a condition used when a gateway references a
 // certificate that does not exist. It takes a ref used to scope the condition
 // to a given APIGateway listener.
-func (g *gatewayConditionGenerator) invalidCertificate(ref structs.ResourceReference, err error) structs.Condition {
-	return structs.Condition{
-		Type:               "Accepted",
-		Status:             "False",
-		Reason:             "InvalidCertificate",
-		Message:            err.Error(),
-		Resource:           pointerTo(ref),
-		LastTransitionTime: g.now,
-	}
+func invalidCertificate(ref structs.ResourceReference, err error) structs.Condition {
+	return structs.NewGatewayCondition(
+		api.GatewayConditionAccepted,
+		api.ConditionStatusFalse,
+		api.GatewayListenerReasonInvalidCertificateRef,
+		err.Error(),
+		ref,
+	)
 }
 
 // invalidCertificates is used to set the overall condition of the APIGateway
 // to invalid due to missing certificates that it references.
-func (g *gatewayConditionGenerator) invalidCertificates() structs.Condition {
-	return structs.Condition{
-		Type:               "Accepted",
-		Status:             "False",
-		Reason:             "InvalidCertificates",
-		Message:            "gateway references invalid certificates",
-		LastTransitionTime: g.now,
-	}
+func invalidCertificates() structs.Condition {
+	return structs.NewGatewayCondition(
+		api.GatewayConditionAccepted,
+		api.ConditionStatusFalse,
+		api.GatewayReasonInvalidCertificates,
+		"gateway references invalid certificates",
+		structs.ResourceReference{},
+	)
 }
 
-// gatewayAccepted marks the APIGateway as valid.
-func (g *gatewayConditionGenerator) gatewayAccepted() structs.Condition {
-	return structs.Condition{
-		Type:               "Accepted",
-		Status:             "True",
-		Reason:             "Accepted",
-		Message:            "gateway is valid",
-		LastTransitionTime: g.now,
-	}
+// gatewayListenerNoConflicts marks an APIGateway listener as having no conflicts within its
+// bound routes
+func gatewayListenerNoConflicts(ref structs.ResourceReference) structs.Condition {
+	return structs.NewGatewayCondition(
+		api.GatewayConditionConflicted,
+		api.ConditionStatusFalse,
+		api.GatewayReasonNoConflict,
+		"listener has no route conflicts",
+		ref,
+	)
+}
+
+// gatewayListenerConflicts marks an APIGateway listener as having bound routes that conflict with each other
+// and make the listener, therefore invalid
+func gatewayListenerConflicts(ref structs.ResourceReference) structs.Condition {
+	return structs.NewGatewayCondition(
+		api.GatewayConditionConflicted,
+		api.ConditionStatusTrue,
+		api.GatewayReasonRouteConflict,
+		"TCP-based listeners currently only support binding a single route",
+		ref,
+	)
 }
 
 // routeBound marks a Route as bound to the referenced APIGateway
-func (g *gatewayConditionGenerator) routeBound(ref structs.ResourceReference) structs.Condition {
-	return structs.Condition{
-		Type:               "Bound",
-		Status:             "True",
-		Reason:             "Bound",
-		Resource:           pointerTo(ref),
-		Message:            "successfully bound route",
-		LastTransitionTime: g.now,
-	}
+func routeBound(ref structs.ResourceReference) structs.Condition {
+	return structs.NewRouteCondition(
+		api.RouteConditionBound,
+		api.ConditionStatusTrue,
+		api.RouteReasonBound,
+		"successfully bound route",
+		ref,
+	)
 }
 
-// routeAccepted marks the Route as valid
-func (g *gatewayConditionGenerator) routeAccepted() structs.Condition {
-	return structs.Condition{
-		Type:               "Accepted",
-		Status:             "True",
-		Reason:             "Accepted",
-		Message:            "route is valid",
-		LastTransitionTime: g.now,
-	}
+// gatewayNotFound marks a Route as having failed to bind to a referenced APIGateway due to
+// the Gateway not existing (or having not been reconciled yet)
+func gatewayNotFound(ref structs.ResourceReference) structs.Condition {
+	return structs.NewRouteCondition(
+		api.RouteConditionBound,
+		api.ConditionStatusFalse,
+		api.RouteReasonGatewayNotFound,
+		"gateway was not found",
+		ref,
+	)
 }
 
 // routeUnbound marks the route as having failed to bind to the referenced APIGateway
-func (g *gatewayConditionGenerator) routeUnbound(ref structs.ResourceReference, err error) structs.Condition {
-	return structs.Condition{
-		Type:               "Bound",
-		Status:             "False",
-		Reason:             "FailedToBind",
-		Resource:           pointerTo(ref),
-		Message:            err.Error(),
-		LastTransitionTime: g.now,
-	}
+func routeUnbound(ref structs.ResourceReference, err error) structs.Condition {
+	return structs.NewRouteCondition(
+		api.RouteConditionBound,
+		api.ConditionStatusFalse,
+		api.RouteReasonFailedToBind,
+		err.Error(),
+		ref,
+	)
+}
+
+// routeAccepted marks the Route as valid
+func routeAccepted() structs.Condition {
+	return structs.NewRouteCondition(
+		api.RouteConditionAccepted,
+		api.ConditionStatusTrue,
+		api.RouteReasonAccepted,
+		"route is valid",
+		structs.ResourceReference{},
+	)
 }
 
 // routeInvalidDiscoveryChain marks the route as invalid due to an error while validating its referenced
 // discovery chian
-func (g *gatewayConditionGenerator) routeInvalidDiscoveryChain(err error) structs.Condition {
-	return structs.Condition{
-		Type:               "Accepted",
-		Status:             "False",
-		Reason:             "InvalidDiscoveryChain",
-		Message:            err.Error(),
-		LastTransitionTime: g.now,
-	}
+func routeInvalidDiscoveryChain(err error) structs.Condition {
+	return structs.NewRouteCondition(
+		api.RouteConditionAccepted,
+		api.ConditionStatusFalse,
+		api.RouteReasonInvalidDiscoveryChain,
+		err.Error(),
+		structs.ResourceReference{},
+	)
 }
 
 // routeNoUpstreams marks the route as invalid because it has no upstreams that it targets
-func (g *gatewayConditionGenerator) routeNoUpstreams() structs.Condition {
-	return structs.Condition{
-		Type:               "Accepted",
-		Status:             "False",
-		Reason:             "NoUpstreamServicesTargeted",
-		Message:            "route must target at least one upstream service",
-		LastTransitionTime: g.now,
-	}
-}
-
-// gatewayListenerConflicts marks an APIGateway listener as having bound routes that conflict with each other
-// and make the listener, therefore invalid
-func (g *gatewayConditionGenerator) gatewayListenerConflicts(ref structs.ResourceReference) structs.Condition {
-	return structs.Condition{
-		Type:               "Conflicted",
-		Status:             "True",
-		Reason:             "RouteConflict",
-		Resource:           pointerTo(ref),
-		Message:            "TCP-based listeners currently only support binding a single route",
-		LastTransitionTime: g.now,
-	}
-}
-
-// gatewayListenerNoConflicts marks an APIGateway listener as having no conflicts within its
-// bound routes
-func (g *gatewayConditionGenerator) gatewayListenerNoConflicts(ref structs.ResourceReference) structs.Condition {
-	return structs.Condition{
-		Type:               "Conflicted",
-		Status:             "False",
-		Reason:             "NoConflict",
-		Resource:           pointerTo(ref),
-		Message:            "listener has no route conflicts",
-		LastTransitionTime: g.now,
-	}
-}
-
-// gatewayNotFound marks a Route as having failed to bind to a referenced APIGateway due to
-// the Gateway not existing (or having not been reconciled yet)
-func (g *gatewayConditionGenerator) gatewayNotFound(ref structs.ResourceReference) structs.Condition {
-	return structs.Condition{
-		Type:               "Bound",
-		Status:             "False",
-		Reason:             "GatewayNotFound",
-		Resource:           pointerTo(ref),
-		Message:            "gateway was not found",
-		LastTransitionTime: g.now,
-	}
+func routeNoUpstreams() structs.Condition {
+	return structs.NewRouteCondition(
+		api.RouteConditionAccepted,
+		api.ConditionStatusFalse,
+		api.RouteReasonNoUpstreamServicesTargeted,
+		"route must target at least one upstream service",
+		structs.ResourceReference{},
+	)
 }
 
 // bindRoutesToGateways takes a route variadic number of gateways.
@@ -1024,7 +994,6 @@ func bindRoutesToGateways(route structs.BoundRoute, gateways ...*gatewayMeta) ([
 // removeGateway sets the route's status appropriately when the gateway that it's
 // attempting to bind to does not exist
 func removeGateway(gateway structs.ResourceReference, entries ...structs.BoundRoute) []structs.ControlledConfigEntry {
-	conditions := newGatewayConditionGenerator()
 	modified := []structs.ControlledConfigEntry{}
 
 	for _, route := range entries {
@@ -1032,7 +1001,7 @@ func removeGateway(gateway structs.ResourceReference, entries ...structs.BoundRo
 
 		for _, parent := range route.GetParents() {
 			if parent.Kind == gateway.Kind && parent.Name == gateway.Name && parent.EnterpriseMeta.IsSame(&gateway.EnterpriseMeta) {
-				updater.SetCondition(conditions.gatewayNotFound(parent))
+				updater.SetCondition(gatewayNotFound(parent))
 			}
 		}
 
diff --git a/agent/consul/gateways/controller_gateways_test.go b/agent/consul/gateways/controller_gateways_test.go
index 3049dd60c1ec..2b304989e48f 100644
--- a/agent/consul/gateways/controller_gateways_test.go
+++ b/agent/consul/gateways/controller_gateways_test.go
@@ -11,9 +11,10 @@ import (
 	"testing"
 	"time"
 
-	"github.com/hashicorp/go-hclog"
 	"github.com/stretchr/testify/require"
 
+	"github.com/hashicorp/go-hclog"
+
 	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/agent/consul/controller"
 	"github.com/hashicorp/consul/agent/consul/fsm"
@@ -55,7 +56,7 @@ func TestBoundAPIGatewayBindRoute(t *testing.T) {
 					},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().gatewayAccepted(),
+							gatewayAccepted(),
 						},
 					},
 				},
@@ -72,7 +73,7 @@ func TestBoundAPIGatewayBindRoute(t *testing.T) {
 				},
 				Status: structs.Status{
 					Conditions: []structs.Condition{
-						newGatewayConditionGenerator().routeAccepted(),
+						routeAccepted(),
 					},
 				},
 			},
@@ -132,7 +133,7 @@ func TestBoundAPIGatewayBindRoute(t *testing.T) {
 					},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().gatewayAccepted(),
+							gatewayAccepted(),
 						},
 					},
 				},
@@ -148,7 +149,7 @@ func TestBoundAPIGatewayBindRoute(t *testing.T) {
 				},
 				Status: structs.Status{
 					Conditions: []structs.Condition{
-						newGatewayConditionGenerator().routeAccepted(),
+						routeAccepted(),
 					},
 				},
 			},
@@ -443,7 +444,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 						},
 						Status: structs.Status{
 							Conditions: []structs.Condition{
-								newGatewayConditionGenerator().gatewayAccepted(),
+								gatewayAccepted(),
 							},
 						},
 					},
@@ -462,7 +463,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 					},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().routeAccepted(),
+							routeAccepted(),
 						},
 					},
 				},
@@ -557,7 +558,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 						},
 						Status: structs.Status{
 							Conditions: []structs.Condition{
-								newGatewayConditionGenerator().gatewayAccepted(),
+								gatewayAccepted(),
 							},
 						},
 					},
@@ -582,7 +583,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 						},
 						Status: structs.Status{
 							Conditions: []structs.Condition{
-								newGatewayConditionGenerator().gatewayAccepted(),
+								gatewayAccepted(),
 							},
 						},
 					},
@@ -606,7 +607,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 					},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().routeAccepted(),
+							routeAccepted(),
 						},
 					},
 				},
@@ -675,7 +676,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 						},
 						Status: structs.Status{
 							Conditions: []structs.Condition{
-								newGatewayConditionGenerator().gatewayAccepted(),
+								gatewayAccepted(),
 							},
 						},
 					},
@@ -694,7 +695,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 					},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().routeAccepted(),
+							routeAccepted(),
 						},
 					},
 				},
@@ -752,7 +753,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 						},
 						Status: structs.Status{
 							Conditions: []structs.Condition{
-								newGatewayConditionGenerator().gatewayAccepted(),
+								gatewayAccepted(),
 							},
 						},
 					},
@@ -771,7 +772,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 					},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().routeAccepted(),
+							routeAccepted(),
 						},
 					},
 				},
@@ -841,7 +842,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 						},
 						Status: structs.Status{
 							Conditions: []structs.Condition{
-								newGatewayConditionGenerator().gatewayAccepted(),
+								gatewayAccepted(),
 							},
 						},
 					},
@@ -860,7 +861,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 					},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().routeAccepted(),
+							routeAccepted(),
 						},
 					},
 				},
@@ -924,7 +925,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 						},
 						Status: structs.Status{
 							Conditions: []structs.Condition{
-								newGatewayConditionGenerator().gatewayAccepted(),
+								gatewayAccepted(),
 							},
 						},
 					},
@@ -957,7 +958,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 						},
 						Status: structs.Status{
 							Conditions: []structs.Condition{
-								newGatewayConditionGenerator().gatewayAccepted(),
+								gatewayAccepted(),
 							},
 						},
 					},
@@ -981,7 +982,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 					},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().routeAccepted(),
+							routeAccepted(),
 						},
 					},
 				},
@@ -1064,7 +1065,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 						},
 						Status: structs.Status{
 							Conditions: []structs.Condition{
-								newGatewayConditionGenerator().gatewayAccepted(),
+								gatewayAccepted(),
 							},
 						},
 					},
@@ -1083,7 +1084,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 					},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().routeAccepted(),
+							routeAccepted(),
 						},
 					},
 				},
@@ -1133,7 +1134,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 						},
 						Status: structs.Status{
 							Conditions: []structs.Condition{
-								newGatewayConditionGenerator().gatewayAccepted(),
+								gatewayAccepted(),
 							},
 						},
 					},
@@ -1158,7 +1159,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 						},
 						Status: structs.Status{
 							Conditions: []structs.Condition{
-								newGatewayConditionGenerator().gatewayAccepted(),
+								gatewayAccepted(),
 							},
 						},
 					},
@@ -1177,7 +1178,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 					},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().routeAccepted(),
+							routeAccepted(),
 						},
 					},
 				},
@@ -1193,7 +1194,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 					},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().routeAccepted(),
+							routeAccepted(),
 						},
 					},
 				},
@@ -1254,7 +1255,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 						},
 						Status: structs.Status{
 							Conditions: []structs.Condition{
-								newGatewayConditionGenerator().gatewayAccepted(),
+								gatewayAccepted(),
 							},
 						},
 					},
@@ -1273,7 +1274,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 					},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().routeAccepted(),
+							routeAccepted(),
 						},
 					},
 				},
@@ -1317,7 +1318,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 						},
 						Status: structs.Status{
 							Conditions: []structs.Condition{
-								newGatewayConditionGenerator().gatewayAccepted(),
+								gatewayAccepted(),
 							},
 						},
 					},
@@ -1336,14 +1337,13 @@ func TestBindRoutesToGateways(t *testing.T) {
 					},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().routeAccepted(),
+							routeAccepted(),
 						},
 					},
 				},
 			},
 			expectedBoundAPIGateways: []*structs.BoundAPIGatewayConfigEntry{
 				{
-
 					Name: "Gateway",
 					Listeners: []structs.BoundAPIGatewayListener{
 						{
@@ -1435,7 +1435,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 						},
 						Status: structs.Status{
 							Conditions: []structs.Condition{
-								newGatewayConditionGenerator().gatewayAccepted(),
+								gatewayAccepted(),
 							},
 						},
 					},
@@ -1453,7 +1453,7 @@ func TestBindRoutesToGateways(t *testing.T) {
 					},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().routeAccepted(),
+							routeAccepted(),
 						},
 					},
 				},
@@ -1493,7 +1493,6 @@ func TestBindRoutesToGateways(t *testing.T) {
 }
 
 func TestAPIGatewayController(t *testing.T) {
-	conditions := newGatewayConditionGenerator()
 	defaultMeta := acl.DefaultEnterpriseMeta()
 	for name, tc := range map[string]struct {
 		requests       []controller.Request
@@ -1521,7 +1520,7 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.gatewayAccepted(),
+							gatewayAccepted(),
 						},
 					},
 				},
@@ -1552,7 +1551,7 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeNoUpstreams(),
+							routeNoUpstreams(),
 						},
 					},
 				},
@@ -1578,7 +1577,7 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeNoUpstreams(),
+							routeNoUpstreams(),
 						},
 					},
 				},
@@ -1628,8 +1627,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.routeUnbound(structs.ResourceReference{
+							routeAccepted(),
+							routeUnbound(structs.ResourceReference{
 								Name:           "api-gateway",
 								EnterpriseMeta: *defaultMeta,
 							}, errors.New("failed to bind route to gateway api-gateway: gateway has not been accepted")),
@@ -1646,7 +1645,7 @@ func TestAPIGatewayController(t *testing.T) {
 					}},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.gatewayListenerNoConflicts(structs.ResourceReference{
+							gatewayListenerNoConflicts(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "api-gateway",
 								SectionName:    "listener",
@@ -1694,7 +1693,7 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeInvalidDiscoveryChain(errInvalidProtocol),
+							routeInvalidDiscoveryChain(errInvalidProtocol),
 						},
 					},
 				},
@@ -1733,8 +1732,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.gatewayNotFound(structs.ResourceReference{
+							routeAccepted(),
+							gatewayNotFound(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -1787,8 +1786,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.gatewayNotFound(structs.ResourceReference{
+							routeAccepted(),
+							gatewayNotFound(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -1851,8 +1850,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.routeUnbound(structs.ResourceReference{
+							routeAccepted(),
+							routeUnbound(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -1920,8 +1919,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.gatewayNotFound(structs.ResourceReference{
+							routeAccepted(),
+							gatewayNotFound(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -1956,7 +1955,7 @@ func TestAPIGatewayController(t *testing.T) {
 					}},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().routeAccepted(),
+							routeAccepted(),
 						},
 					},
 				},
@@ -1976,7 +1975,7 @@ func TestAPIGatewayController(t *testing.T) {
 					}},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().gatewayAccepted(),
+							gatewayAccepted(),
 						},
 					},
 				},
@@ -2006,8 +2005,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.gatewayAccepted(),
-							conditions.gatewayListenerNoConflicts(structs.ResourceReference{
+							gatewayAccepted(),
+							gatewayListenerNoConflicts(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -2022,8 +2021,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.routeBound(structs.ResourceReference{
+							routeAccepted(),
+							routeBound(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -2058,7 +2057,7 @@ func TestAPIGatewayController(t *testing.T) {
 					}},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().routeAccepted(),
+							routeAccepted(),
 						},
 					},
 				},
@@ -2098,8 +2097,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.gatewayAccepted(),
-							conditions.gatewayListenerNoConflicts(structs.ResourceReference{
+							gatewayAccepted(),
+							gatewayListenerNoConflicts(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -2114,8 +2113,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.routeUnbound(structs.ResourceReference{
+							routeAccepted(),
+							routeUnbound(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -2154,7 +2153,7 @@ func TestAPIGatewayController(t *testing.T) {
 					}},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().routeAccepted(),
+							routeAccepted(),
 						},
 					},
 				},
@@ -2172,7 +2171,7 @@ func TestAPIGatewayController(t *testing.T) {
 					}},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().routeAccepted(),
+							routeAccepted(),
 						},
 					},
 				},
@@ -2221,8 +2220,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.gatewayAccepted(),
-							conditions.gatewayListenerConflicts(structs.ResourceReference{
+							gatewayAccepted(),
+							gatewayListenerConflicts(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -2237,8 +2236,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.routeBound(structs.ResourceReference{
+							routeAccepted(),
+							routeBound(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -2252,8 +2251,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.routeBound(structs.ResourceReference{
+							routeAccepted(),
+							routeBound(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -2294,7 +2293,7 @@ func TestAPIGatewayController(t *testing.T) {
 					}},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().routeAccepted(),
+							routeAccepted(),
 						},
 					},
 				},
@@ -2314,7 +2313,7 @@ func TestAPIGatewayController(t *testing.T) {
 					}},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().routeAccepted(),
+							routeAccepted(),
 						},
 					},
 				},
@@ -2364,8 +2363,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.gatewayAccepted(),
-							conditions.gatewayListenerNoConflicts(structs.ResourceReference{
+							gatewayAccepted(),
+							gatewayListenerNoConflicts(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -2380,8 +2379,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.routeBound(structs.ResourceReference{
+							routeAccepted(),
+							routeBound(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -2395,8 +2394,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.routeBound(structs.ResourceReference{
+							routeAccepted(),
+							routeBound(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -2505,8 +2504,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.gatewayAccepted(),
-							conditions.gatewayListenerNoConflicts(structs.ResourceReference{
+							gatewayAccepted(),
+							gatewayListenerNoConflicts(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -2521,8 +2520,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.routeBound(structs.ResourceReference{
+							routeAccepted(),
+							routeBound(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -2536,8 +2535,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.routeUnbound(structs.ResourceReference{
+							routeAccepted(),
+							routeUnbound(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -2578,7 +2577,7 @@ func TestAPIGatewayController(t *testing.T) {
 					}},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().routeAccepted(),
+							routeAccepted(),
 						},
 					},
 				},
@@ -2596,7 +2595,7 @@ func TestAPIGatewayController(t *testing.T) {
 					}},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							newGatewayConditionGenerator().routeAccepted(),
+							routeAccepted(),
 						},
 					},
 				},
@@ -2659,13 +2658,13 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.gatewayAccepted(),
-							conditions.gatewayListenerNoConflicts(structs.ResourceReference{
+							gatewayAccepted(),
+							gatewayListenerNoConflicts(structs.ResourceReference{
 								Kind:        structs.APIGateway,
 								Name:        "gateway",
 								SectionName: "http-listener",
 							}),
-							conditions.gatewayListenerNoConflicts(structs.ResourceReference{
+							gatewayListenerNoConflicts(structs.ResourceReference{
 								Kind:        structs.APIGateway,
 								Name:        "gateway",
 								SectionName: "tcp-listener",
@@ -2679,8 +2678,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.routeBound(structs.ResourceReference{
+							routeAccepted(),
+							routeBound(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -2694,8 +2693,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.routeBound(structs.ResourceReference{
+							routeAccepted(),
+							routeBound(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -2721,8 +2720,8 @@ func TestAPIGatewayController(t *testing.T) {
 					}},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.routeBound(structs.ResourceReference{
+							routeAccepted(),
+							routeBound(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -2776,7 +2775,7 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.gatewayListenerNoConflicts(structs.ResourceReference{
+							gatewayListenerNoConflicts(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								SectionName:    "tcp-listener",
@@ -2791,7 +2790,7 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
+							routeAccepted(),
 						},
 					},
 				},
@@ -2810,8 +2809,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.routeBound(structs.ResourceReference{
+							routeAccepted(),
+							routeBound(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -2865,7 +2864,7 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.gatewayListenerNoConflicts(structs.ResourceReference{
+							gatewayListenerNoConflicts(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								SectionName:    "tcp-listener",
@@ -2880,7 +2879,7 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeNoUpstreams(),
+							routeNoUpstreams(),
 						},
 					},
 				},
@@ -2908,8 +2907,8 @@ func TestAPIGatewayController(t *testing.T) {
 					}},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.routeBound(structs.ResourceReference{
+							routeAccepted(),
+							routeBound(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -2934,8 +2933,8 @@ func TestAPIGatewayController(t *testing.T) {
 					}},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.routeUnbound(structs.ResourceReference{
+							routeAccepted(),
+							routeUnbound(structs.ResourceReference{
 								Kind: structs.APIGateway,
 								Name: "gateway",
 							}, errors.New("foo")),
@@ -2965,8 +2964,8 @@ func TestAPIGatewayController(t *testing.T) {
 					}},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.gatewayAccepted(),
-							conditions.gatewayListenerNoConflicts(structs.ResourceReference{
+							gatewayAccepted(),
+							gatewayListenerNoConflicts(structs.ResourceReference{
 								Kind:        structs.APIGateway,
 								Name:        "gateway",
 								SectionName: "tcp-listener",
@@ -3008,8 +3007,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.gatewayAccepted(),
-							conditions.gatewayListenerNoConflicts(structs.ResourceReference{
+							gatewayAccepted(),
+							gatewayListenerNoConflicts(structs.ResourceReference{
 								Kind:        structs.APIGateway,
 								Name:        "gateway",
 								SectionName: "http-listener",
@@ -3023,8 +3022,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.routeUnbound(structs.ResourceReference{
+							routeAccepted(),
+							routeUnbound(structs.ResourceReference{
 								Kind: structs.APIGateway,
 								Name: "gateway",
 							}, errors.New("failed to bind route tcp-route to gateway gateway with listener ''")),
@@ -3037,8 +3036,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.routeBound(structs.ResourceReference{
+							routeAccepted(),
+							routeBound(structs.ResourceReference{
 								Kind: structs.APIGateway,
 								Name: "gateway",
 							}),
@@ -3073,8 +3072,8 @@ func TestAPIGatewayController(t *testing.T) {
 					}},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.routeBound(structs.ResourceReference{
+							routeAccepted(),
+							routeBound(structs.ResourceReference{
 								Kind:           structs.APIGateway,
 								Name:           "gateway",
 								EnterpriseMeta: *defaultMeta,
@@ -3109,8 +3108,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.gatewayNotFound(structs.ResourceReference{
+							routeAccepted(),
+							gatewayNotFound(structs.ResourceReference{
 								Kind: structs.APIGateway,
 								Name: "gateway",
 							}),
@@ -3150,8 +3149,8 @@ func TestAPIGatewayController(t *testing.T) {
 					}},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.gatewayAccepted(),
-							conditions.gatewayListenerNoConflicts(structs.ResourceReference{
+							gatewayAccepted(),
+							gatewayListenerNoConflicts(structs.ResourceReference{
 								Kind:        structs.APIGateway,
 								Name:        "gateway",
 								SectionName: "tcp-listener",
@@ -3176,8 +3175,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.gatewayAccepted(),
-							conditions.gatewayListenerNoConflicts(structs.ResourceReference{
+							gatewayAccepted(),
+							gatewayListenerNoConflicts(structs.ResourceReference{
 								Kind:        structs.APIGateway,
 								Name:        "gateway",
 								SectionName: "tcp-listener",
@@ -3221,8 +3220,8 @@ func TestAPIGatewayController(t *testing.T) {
 					}},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.routeBound(structs.ResourceReference{
+							routeAccepted(),
+							routeBound(structs.ResourceReference{
 								Kind: structs.APIGateway,
 								Name: "gateway",
 							}),
@@ -3237,8 +3236,8 @@ func TestAPIGatewayController(t *testing.T) {
 					EnterpriseMeta: *defaultMeta,
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.routeAccepted(),
-							conditions.gatewayNotFound(structs.ResourceReference{
+							routeAccepted(),
+							gatewayNotFound(structs.ResourceReference{
 								Kind: structs.APIGateway,
 								Name: "gateway",
 							}),
@@ -3287,12 +3286,12 @@ func TestAPIGatewayController(t *testing.T) {
 					}},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.invalidCertificate(structs.ResourceReference{
+							invalidCertificate(structs.ResourceReference{
 								Kind: structs.InlineCertificate,
 								Name: "certificate",
 							}, errors.New("certificate not found")),
-							conditions.invalidCertificates(),
-							conditions.gatewayListenerNoConflicts(structs.ResourceReference{
+							invalidCertificates(),
+							gatewayListenerNoConflicts(structs.ResourceReference{
 								Kind:        structs.APIGateway,
 								Name:        "gateway",
 								SectionName: "http-listener",
@@ -3355,8 +3354,8 @@ func TestAPIGatewayController(t *testing.T) {
 					}},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.gatewayAccepted(),
-							conditions.gatewayListenerNoConflicts(structs.ResourceReference{
+							gatewayAccepted(),
+							gatewayListenerNoConflicts(structs.ResourceReference{
 								Kind:        structs.APIGateway,
 								Name:        "gateway",
 								SectionName: "http-listener",
@@ -3402,12 +3401,12 @@ func TestAPIGatewayController(t *testing.T) {
 					}},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.invalidCertificate(structs.ResourceReference{
+							invalidCertificate(structs.ResourceReference{
 								Kind: structs.InlineCertificate,
 								Name: "certificate",
 							}, errors.New("certificate not found")),
-							conditions.invalidCertificates(),
-							conditions.gatewayListenerNoConflicts(structs.ResourceReference{
+							invalidCertificates(),
+							gatewayListenerNoConflicts(structs.ResourceReference{
 								Kind:        structs.APIGateway,
 								Name:        "gateway",
 								SectionName: "http-listener",
@@ -3438,8 +3437,8 @@ func TestAPIGatewayController(t *testing.T) {
 					}},
 					Status: structs.Status{
 						Conditions: []structs.Condition{
-							conditions.gatewayAccepted(),
-							conditions.gatewayListenerNoConflicts(structs.ResourceReference{
+							gatewayAccepted(),
+							gatewayListenerNoConflicts(structs.ResourceReference{
 								Kind:        structs.APIGateway,
 								Name:        "gateway",
 								SectionName: "http-listener",
@@ -3705,12 +3704,15 @@ func (n *noopController) WithWorkers(i int) controller.Controller
 func (n *noopController) WithQueueFactory(fn func(ctx context.Context, baseBackoff time.Duration, maxBackoff time.Duration) controller.WorkQueue) controller.Controller {
 	return n
 }
+
 func (n *noopController) AddTrigger(request controller.Request, trigger func(ctx context.Context) error) {
 	n.triggers[request] = struct{}{}
 }
+
 func (n *noopController) RemoveTrigger(request controller.Request) {
 	delete(n.triggers, request)
 }
+
 func (n *noopController) Enqueue(requests ...controller.Request) {
 	n.enqueued = append(n.enqueued, requests...)
 }
diff --git a/agent/structs/config_entry_status.go b/agent/structs/config_entry_status.go
index 264efb1fa67c..fb91a0add374 100644
--- a/agent/structs/config_entry_status.go
+++ b/agent/structs/config_entry_status.go
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/consul/acl"
+	"github.com/hashicorp/consul/api"
 )
 
 // ResourceReference is a reference to a ConfigEntry
@@ -67,30 +68,6 @@ func (s Status) SameConditions(other Status) bool {
 	if len(s.Conditions) != len(other.Conditions) {
 		return false
 	}
-	lessResource := func(one, two *ResourceReference) bool {
-		if one == nil && two == nil {
-			return false
-		}
-		if one == nil {
-			return true
-		}
-		if two == nil {
-			return false
-		}
-		if one.Kind < two.Kind {
-			return true
-		}
-		if one.Kind > two.Kind {
-			return false
-		}
-		if one.Name < two.Name {
-			return true
-		}
-		if one.Name > two.Name {
-			return false
-		}
-		return one.SectionName < two.SectionName
-	}
 	sortConditions := func(conditions []Condition) []Condition {
 		sort.SliceStable(conditions, func(i, j int) bool {
 			if conditions[i].Type < conditions[j].Type {
@@ -114,6 +91,31 @@ func (s Status) SameConditions(other Status) bool {
 	return true
 }
 
+func lessResource(one, two *ResourceReference) bool {
+	if one == nil && two == nil {
+		return false
+	}
+	if one == nil {
+		return true
+	}
+	if two == nil {
+		return false
+	}
+	if one.Kind < two.Kind {
+		return true
+	}
+	if one.Kind > two.Kind {
+		return false
+	}
+	if one.Name < two.Name {
+		return true
+	}
+	if one.Name > two.Name {
+		return false
+	}
+	return one.SectionName < two.SectionName
+}
+
 // Condition is used for a single message and state associated
 // with an object. For example, a ConfigEntry that references
 // multiple other resources may have different statuses with
@@ -195,3 +197,42 @@ func (u *StatusUpdater) UpdateEntry() (ControlledConfigEntry, bool) {
 	u.entry.SetStatus(u.status)
 	return u.entry, true
 }
+
+func NewGatewayCondition(name api.GatewayConditionType, status api.ConditionStatus, reason api.GatewayConditionReason, message string, resource ResourceReference) Condition {
+	if err := api.ValidateGatewayConditionReason(name, status, reason); err != nil {
+		// note we panic here because an invalid combination is a programmer error
+		// this  should never actually be hit
+		panic(err)
+	}
+
+	return Condition{
+		Type:               string(name),
+		Status:             string(status),
+		Reason:             string(reason),
+		Message:            message,
+		Resource:           ptrTo(resource),
+		LastTransitionTime: ptrTo(time.Now().UTC()),
+	}
+}
+
+// NewRouteCondition is a helper to build allowable Conditions for a Route config entry
+func NewRouteCondition(name api.RouteConditionType, status api.ConditionStatus, reason api.RouteConditionReason, message string, ref ResourceReference) Condition {
+	if err := api.ValidateRouteConditionReason(name, status, reason); err != nil {
+		// note we panic here because an invalid combination is a programmer error
+		// this  should never actually be hit
+		panic(err)
+	}
+
+	return Condition{
+		Type:               string(name),
+		Status:             string(status),
+		Reason:             string(reason),
+		Message:            message,
+		Resource:           ptrTo(ref),
+		LastTransitionTime: ptrTo(time.Now().UTC()),
+	}
+}
+
+func ptrTo[T any](val T) *T {
+	return &val
+}
diff --git a/api/config_entry_status.go b/api/config_entry_status.go
index 45197dcc6a5e..dfb97eb4c9bc 100644
--- a/api/config_entry_status.go
+++ b/api/config_entry_status.go
@@ -4,7 +4,10 @@
 package api
 
 import (
+	"fmt"
 	"time"
+
+	"golang.org/x/exp/slices"
 )
 
 // ResourceReference is a reference to a ConfigEntry
@@ -46,7 +49,7 @@ type Condition struct {
 	// Type is a value from a bounded set of types that an object might have
 	Type string
 	// Status is a value from a bounded set of statuses that an object might have
-	Status string
+	Status ConditionStatus
 	// Reason is a value from a bounded set of reasons for a given status
 	Reason string
 	// Message is a message that gives more detailed information about
@@ -58,3 +61,280 @@ type Condition struct {
 	// LastTransitionTime is the time at which this Condition was created
 	LastTransitionTime *time.Time
 }
+
+type (
+	ConditionStatus string
+)
+
+const (
+	ConditionStatusTrue    ConditionStatus = "True"
+	ConditionStatusFalse   ConditionStatus = "False"
+	ConditionStatusUnknown ConditionStatus = "Unknown"
+)
+
+// GatewayConditionType is a type of condition associated with a
+// Gateway. This type should be used with the GatewayStatus.Conditions
+// field.
+type GatewayConditionType string
+
+// GatewayConditionReason defines the set of reasons that explain why a
+// particular Gateway condition type has been raised.
+type GatewayConditionReason string
+
+// the following are directly from the k8s spec
+const (
+	// This condition is true when the controller managing the Gateway is
+	// syntactically and semantically valid enough to produce some configuration
+	// in the underlying data plane. This does not indicate whether or not the
+	// configuration has been propagated to the data plane.
+	//
+	// Possible reasons for this condition to be True are:
+	//
+	// * "Accepted"
+	//
+	// Possible reasons for this condition to be False are:
+	//
+	// * InvalidCertificates
+	//
+	GatewayConditionAccepted GatewayConditionType = "Accepted"
+
+	// This reason is used with the "Accepted" condition when the condition is
+	// True.
+	GatewayReasonAccepted GatewayConditionReason = "Accepted"
+
+	// This reason is used with the "Accepted" condition when the gateway has multiple invalid
+	// certificates and cannot bind to any routes
+	GatewayReasonInvalidCertificates GatewayConditionReason = "InvalidCertificates"
+
+	// This condition indicates that the gateway was unable to resolve
+	// conflicting specification requirements for this Listener. If a
+	// Listener is conflicted, its network port should not be configured
+	// on any network elements.
+	//
+	// Possible reasons for this condition to be true are:
+	//
+	// * "RouteConflict"
+	//
+	// Possible reasons for this condition to be False are:
+	//
+	// * "NoConflict"
+	//
+	// Controllers may raise this condition with other reasons,
+	// but should prefer to use the reasons listed above to improve
+	// interoperability.
+	GatewayConditionConflicted GatewayConditionType = "Conflicted"
+	// This reason is used with the "Conflicted" condition when the condition
+	// is False.
+	GatewayReasonNoConflict GatewayConditionReason = "NoConflict"
+	// This reason is used with the "Conflicted" condition when the route is
+	// in a conflicted state, such as when a TCPListener attempts to bind to two routes
+	GatewayReasonRouteConflict GatewayConditionReason = "RouteConflict"
+
+	// This condition indicates whether the controller was able to
+	// resolve all the object references for the Gateway. When setting this
+	// condition to False, a ResourceReference to the misconfigured Listener should
+	// be provided.
+	//
+	// Possible reasons for this condition to be true are:
+	//
+	// * "ResolvedRefs"
+	//
+	// Possible reasons for this condition to be False are:
+	//
+	// * "InvalidCertificateRef"
+	// * "InvalidRouteKinds"
+	// * "RefNotPermitted"
+	//
+	GatewayConditionResolvedRefs GatewayConditionType = "ResolvedRefs"
+
+	// This reason is used with the "ResolvedRefs" condition when the condition
+	// is true.
+	GatewayReasonResolvedRefs GatewayConditionReason = "ResolvedRefs"
+
+	// This reason is used with the "ResolvedRefs" condition when a
+	// Listener has a TLS configuration with at least one TLS CertificateRef
+	// that is invalid or does not exist.
+	// A CertificateRef is considered invalid when it refers to a nonexistent
+	// or unsupported resource or kind, or when the data within that resource
+	// is malformed.
+	// This reason must be used only when the reference is allowed, either by
+	// referencing an object in the same namespace as the Gateway, or when
+	// a cross-namespace reference has been explicitly allowed by a ReferenceGrant.
+	// If the reference is not allowed, the reason RefNotPermitted must be used
+	// instead.
+	GatewayListenerReasonInvalidCertificateRef GatewayConditionReason = "InvalidCertificateRef"
+)
+
+var validGatewayConditionReasonsMapping = map[GatewayConditionType]map[ConditionStatus][]GatewayConditionReason{
+	GatewayConditionAccepted: {
+		ConditionStatusTrue: {
+			GatewayReasonAccepted,
+		},
+		ConditionStatusFalse: {
+			GatewayListenerReasonInvalidCertificateRef, // TODO: remove this in follow up PR
+			GatewayReasonInvalidCertificates,
+		},
+		ConditionStatusUnknown: {},
+	},
+	GatewayConditionConflicted: {
+		ConditionStatusTrue: {
+			GatewayReasonRouteConflict,
+		},
+		ConditionStatusFalse: {
+			GatewayReasonNoConflict,
+		},
+		ConditionStatusUnknown: {},
+	},
+	GatewayConditionResolvedRefs: {
+		ConditionStatusTrue: {
+			GatewayReasonResolvedRefs,
+		},
+		ConditionStatusFalse: {
+			GatewayListenerReasonInvalidCertificateRef,
+		},
+		ConditionStatusUnknown: {},
+	},
+}
+
+func ValidateGatewayConditionReason(name GatewayConditionType, status ConditionStatus, reason GatewayConditionReason) error {
+	if err := checkConditionStatus(status); err != nil {
+		return err
+	}
+
+	reasons, ok := validGatewayConditionReasonsMapping[name]
+	if !ok {
+		return fmt.Errorf("unrecognized GatewayConditionType %q", name)
+	}
+
+	reasonsForStatus, ok := reasons[status]
+	if !ok {
+		return fmt.Errorf("unrecognized ConditionStatus %q", status)
+	}
+
+	if !slices.Contains(reasonsForStatus, reason) {
+		return fmt.Errorf("gateway condition reason %q not allowed for gateway condition type %q with status %q", reason, name, status)
+	}
+	return nil
+}
+
+// RouteConditionType is a type of condition for a route.
+type RouteConditionType string
+
+// RouteConditionReason is a reason for a route condition.
+type RouteConditionReason string
+
+// The following statuses are taken from the K8's Spec
+// With the exception of: "RouteReasonInvalidDiscoveryChain" and "NoUpstreamServicesTargeted"
+const (
+	// This condition indicates whether the route has been accepted or rejected
+	// by a Gateway, and why.
+	//
+	// Possible reasons for this condition to be true are:
+	//
+	// * "Accepted"
+	//
+	// Possible reasons for this condition to be False are:
+	//
+	// * "InvalidDiscoveryChain"
+	// * "NoUpstreamServicesTargeted"
+	//
+	//
+	// Controllers may raise this condition with other reasons,
+	// but should prefer to use the reasons listed above to improve
+	// interoperability.
+	RouteConditionAccepted RouteConditionType = "Accepted"
+
+	// This reason is used with the "Accepted" condition when the Route has been
+	// accepted by the Gateway.
+	RouteReasonAccepted RouteConditionReason = "Accepted"
+
+	// This reason is used with the "Accepted" condition when the route has an
+	// invalid discovery chain, this includes conditions like the protocol being invalid
+	// or the discovery chain failing to compile
+	RouteReasonInvalidDiscoveryChain RouteConditionReason = "InvalidDiscoveryChain"
+
+	// This reason is used with the "Accepted" condition when the route
+	RouteReasonNoUpstreamServicesTargeted RouteConditionReason = "NoUpstreamServicesTargeted"
+)
+
+// the following statuses are custom to Consul
+const (
+	// This condition indicates whether the route was able to successfully bind the
+	// Listener on the gateway
+	// Possible reasons for this condition to be true are:
+	//
+	// * "Bound"
+	//
+	// Possible reasons for this condition to be false are:
+	//
+	// * "FailedToBind"
+	// * "GatewayNotFound"
+	//
+	RouteConditionBound RouteConditionType = "Bound"
+
+	// This reason is used with the "Bound" condition when the condition
+	// is true
+	RouteReasonBound RouteConditionReason = "Bound"
+
+	// This reason is used with the "Bound" condition when the route failed
+	// to bind to the gateway
+	RouteReasonFailedToBind RouteConditionReason = "FailedToBind"
+
+	// This reason is used with the "Bound" condition when the route fails
+	// to find the gateway
+	RouteReasonGatewayNotFound RouteConditionReason = "GatewayNotFound"
+)
+
+var validRouteConditionReasonsMapping = map[RouteConditionType]map[ConditionStatus][]RouteConditionReason{
+	RouteConditionAccepted: {
+		ConditionStatusTrue: {
+			RouteReasonAccepted,
+		},
+		ConditionStatusFalse: {
+			RouteReasonInvalidDiscoveryChain,
+			RouteReasonNoUpstreamServicesTargeted,
+		},
+		ConditionStatusUnknown: {},
+	},
+	RouteConditionBound: {
+		ConditionStatusTrue: {
+			RouteReasonBound,
+		},
+		ConditionStatusFalse: {
+			RouteReasonGatewayNotFound,
+			RouteReasonFailedToBind,
+		},
+		ConditionStatusUnknown: {},
+	},
+}
+
+func ValidateRouteConditionReason(name RouteConditionType, status ConditionStatus, reason RouteConditionReason) error {
+	if err := checkConditionStatus(status); err != nil {
+		return err
+	}
+
+	reasons, ok := validRouteConditionReasonsMapping[name]
+	if !ok {
+		return fmt.Errorf("unrecognized RouteConditionType %s", name)
+	}
+
+	reasonsForStatus, ok := reasons[status]
+	if !ok {
+		return fmt.Errorf("unrecognized ConditionStatus %s", name)
+	}
+
+	if !slices.Contains(reasonsForStatus, reason) {
+		return fmt.Errorf("route condition reason %s not allowed for route condition type %s with status %s", reason, name, status)
+	}
+
+	return nil
+}
+
+func checkConditionStatus(status ConditionStatus) error {
+	switch status {
+	case ConditionStatusTrue, ConditionStatusFalse, ConditionStatusUnknown:
+		return nil
+	default:
+		return fmt.Errorf("unrecognized condition status: %q", status)
+	}
+}
diff --git a/api/config_entry_status_test.go b/api/config_entry_status_test.go
new file mode 100644
index 000000000000..9c6eaf034c32
--- /dev/null
+++ b/api/config_entry_status_test.go
@@ -0,0 +1,187 @@
+package api
+
+import "testing"
+
+func TestValidateGatewayConditionReasonWithValidCombinations(t *testing.T) {
+	testCases := map[string]struct {
+		status   ConditionStatus
+		reason   GatewayConditionReason
+		condType GatewayConditionType
+	}{
+		"accepted": {
+			status:   ConditionStatusTrue,
+			reason:   GatewayReasonAccepted,
+			condType: GatewayConditionAccepted,
+		},
+		"accepted invalid certificates": {
+			status:   ConditionStatusFalse,
+			reason:   GatewayReasonInvalidCertificates,
+			condType: GatewayConditionAccepted,
+		},
+		"conflicted": {
+			status:   ConditionStatusTrue,
+			reason:   GatewayReasonRouteConflict,
+			condType: GatewayConditionConflicted,
+		},
+		"conflicted no conflicts": {
+			status:   ConditionStatusFalse,
+			reason:   GatewayReasonNoConflict,
+			condType: GatewayConditionConflicted,
+		},
+
+		"resolved refs": {
+			status:   ConditionStatusTrue,
+			reason:   GatewayReasonResolvedRefs,
+			condType: GatewayConditionResolvedRefs,
+		},
+		"resolved refs invalid certificate ref": {
+			status:   ConditionStatusFalse,
+			reason:   GatewayListenerReasonInvalidCertificateRef,
+			condType: GatewayConditionResolvedRefs,
+		},
+	}
+
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			err := ValidateGatewayConditionReason(tc.condType, tc.status, tc.reason)
+			if err != nil {
+				t.Error("Expected gateway condition reason to be valid but it was not")
+			}
+		})
+	}
+}
+
+func TestValidateGatewayConditionReasonWithInvalidCombinationsReturnsError(t *testing.T) {
+	// This is not an exhaustive list of all invalid combinations, just a few to confirm
+	testCases := map[string]struct {
+		status   ConditionStatus
+		reason   GatewayConditionReason
+		condType GatewayConditionType
+	}{
+		"reason and condition type are valid but status is not": {
+			status:   ConditionStatusTrue,
+			reason:   GatewayReasonNoConflict,
+			condType: GatewayConditionConflicted,
+		},
+		"reason and status are valid but condition type is not": {
+			status:   ConditionStatusFalse,
+			reason:   GatewayReasonNoConflict,
+			condType: GatewayConditionResolvedRefs,
+		},
+		"condition type and status are valid but status is not": {
+			status:   ConditionStatusTrue,
+			reason:   GatewayReasonNoConflict,
+			condType: GatewayConditionAccepted,
+		},
+		"all are invalid": {
+			status:   ConditionStatusUnknown,
+			reason:   GatewayReasonAccepted,
+			condType: GatewayConditionResolvedRefs,
+		},
+		"pass something other than a condition status": {
+			status:   ConditionStatus("hello"),
+			reason:   GatewayReasonAccepted,
+			condType: GatewayConditionResolvedRefs,
+		},
+	}
+
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			err := ValidateGatewayConditionReason(tc.condType, tc.status, tc.reason)
+			if err == nil {
+				t.Error("Expected route condition reason to be invalid, but it was valid")
+			}
+		})
+	}
+}
+
+func TestValidateRouteConfigReasonWithValidCombinations(t *testing.T) {
+	testCases := map[string]struct {
+		status   ConditionStatus
+		reason   RouteConditionReason
+		condType RouteConditionType
+	}{
+		"accepted all around": {
+			status:   ConditionStatusTrue,
+			reason:   RouteReasonAccepted,
+			condType: RouteConditionAccepted,
+		},
+		"accepted invalid discovery chain": {
+			status:   ConditionStatusFalse,
+			reason:   RouteReasonInvalidDiscoveryChain,
+			condType: RouteConditionAccepted,
+		},
+		"accepted no upstream services targeted": {
+			status:   ConditionStatusFalse,
+			reason:   RouteReasonNoUpstreamServicesTargeted,
+			condType: RouteConditionAccepted,
+		},
+		"route bound": {
+			status:   ConditionStatusTrue,
+			reason:   RouteReasonBound,
+			condType: RouteConditionBound,
+		},
+		"route bound gateway not found": {
+			status:   ConditionStatusFalse,
+			reason:   RouteReasonGatewayNotFound,
+			condType: RouteConditionBound,
+		},
+		"route bound failed to bind": {
+			status:   ConditionStatusFalse,
+			reason:   RouteReasonFailedToBind,
+			condType: RouteConditionBound,
+		},
+	}
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			err := ValidateRouteConditionReason(tc.condType, tc.status, tc.reason)
+			if err != nil {
+				t.Errorf("Expected route condition reason to be valid, it was not")
+			}
+		})
+	}
+}
+
+func TestValidateRouteConditionReasonInvalidCombinationsCausePanic(t *testing.T) {
+	// This is not an exhaustive list of all invalid combinations, just a few to confirm
+	testCases := map[string]struct {
+		status   ConditionStatus
+		reason   RouteConditionReason
+		condType RouteConditionType
+	}{
+		"reason and condition type are valid but status is not": {
+			status:   ConditionStatusTrue,
+			reason:   RouteReasonNoUpstreamServicesTargeted,
+			condType: RouteConditionAccepted,
+		},
+		"reason and status are valid but condition type is not": {
+			status:   ConditionStatusFalse,
+			reason:   RouteReasonInvalidDiscoveryChain,
+			condType: RouteConditionBound,
+		},
+		"condition type and status are valid but status is not": {
+			status:   ConditionStatusUnknown,
+			reason:   RouteReasonBound,
+			condType: RouteConditionBound,
+		},
+		"all are invalid": {
+			status:   ConditionStatusUnknown,
+			reason:   RouteReasonGatewayNotFound,
+			condType: RouteConditionBound,
+		},
+		"pass something other than a condition status": {
+			status:   ConditionStatus("hello"),
+			reason:   RouteReasonAccepted,
+			condType: RouteConditionAccepted,
+		},
+	}
+
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			err := ValidateRouteConditionReason(tc.condType, tc.status, tc.reason)
+			if err == nil {
+				t.Error("Expected route condition reason to be invalid, it was valid")
+			}
+		})
+	}
+}
diff --git a/api/go.mod b/api/go.mod
index e53e4908c43c..bd9b2c6780f9 100644
--- a/api/go.mod
+++ b/api/go.mod
@@ -5,7 +5,7 @@ go 1.19
 replace github.com/hashicorp/consul/sdk => ../sdk
 
 require (
-	github.com/google/go-cmp v0.5.7
+	github.com/google/go-cmp v0.5.8
 	github.com/hashicorp/consul/sdk v0.13.1
 	github.com/hashicorp/go-cleanhttp v0.5.1
 	github.com/hashicorp/go-hclog v0.12.0
@@ -14,6 +14,7 @@ require (
 	github.com/hashicorp/serf v0.10.1
 	github.com/mitchellh/mapstructure v1.4.1
 	github.com/stretchr/testify v1.7.0
+	golang.org/x/exp v0.0.0-20230321023759-10a507213a29
 )
 
 require (
@@ -40,7 +41,6 @@ require (
 	github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect
 	github.com/stretchr/objx v0.1.0 // indirect
 	golang.org/x/net v0.0.0-20211216030914-fe4d6282115f // indirect
-	golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10 // indirect
-	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
+	golang.org/x/sys v0.1.0 // indirect
 	gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c // indirect
 )
diff --git a/api/go.sum b/api/go.sum
index 043db4cd1efc..8e56a6b16f45 100644
--- a/api/go.sum
+++ b/api/go.sum
@@ -13,8 +13,8 @@ github.com/fatih/color v1.9.0 h1:8xPHl4/q1VyqGIPif1F+1V3Y3lSmrq01EabUW3CoW5s=
 github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c h1:964Od4U6p2jUkFxvCydnIczKteheJEzHRToSGK3Bnlw=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/go-cmp v0.5.7 h1:81/ik6ipDQS2aGcBfIN5dHDB36BwrStyeAQquSYCV4o=
-github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
+github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
+github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-cleanhttp v0.5.1 h1:dH3aiDG9Jvb5r5+bYHsikaOUIpcM0xvgMXVoDkXMzJM=
@@ -96,6 +96,8 @@ github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5Cc
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY=
+golang.org/x/exp v0.0.0-20230321023759-10a507213a29 h1:ooxPy7fPvB4kwsA2h+iBNHkAbp/4JxTSwCmvdjEYmug=
+golang.org/x/exp v0.0.0-20230321023759-10a507213a29/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -118,8 +120,9 @@ golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210303074136-134d130e1a04/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10 h1:WIoqL4EROvwiPdUtaip4VcDdpZ4kha7wBWZrbVKCIZg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
@@ -128,9 +131,6 @@ golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190907020128-2ca718005c18/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
diff --git a/envoyextensions/go.mod b/envoyextensions/go.mod
index 6dc8e782b880..225ed86d5817 100644
--- a/envoyextensions/go.mod
+++ b/envoyextensions/go.mod
@@ -36,6 +36,7 @@ require (
 	github.com/mitchellh/mapstructure v1.4.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10 // indirect
+	golang.org/x/exp v0.0.0-20230321023759-10a507213a29 // indirect
+	golang.org/x/sys v0.1.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/envoyextensions/go.sum b/envoyextensions/go.sum
index 28b2402b3ec8..c0b34dd3c70a 100644
--- a/envoyextensions/go.sum
+++ b/envoyextensions/go.sum
@@ -55,7 +55,7 @@ github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.7 h1:81/ik6ipDQS2aGcBfIN5dHDB36BwrStyeAQquSYCV4o=
+github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
 github.com/hashicorp/consul/sdk v0.13.1 h1:EygWVWWMczTzXGpO93awkHFzfUka6hLYJ0qhETd+6lY=
@@ -143,6 +143,8 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20230321023759-10a507213a29 h1:ooxPy7fPvB4kwsA2h+iBNHkAbp/4JxTSwCmvdjEYmug=
+golang.org/x/exp v0.0.0-20230321023759-10a507213a29/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
@@ -185,8 +187,9 @@ golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10 h1:WIoqL4EROvwiPdUtaip4VcDdpZ4kha7wBWZrbVKCIZg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
@@ -200,7 +203,6 @@ golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBn
 golang.org/x/tools v0.0.0-20190907020128-2ca718005c18/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
diff --git a/go.mod b/go.mod
index ad16988f8529..d78707f8c9a6 100644
--- a/go.mod
+++ b/go.mod
@@ -227,11 +227,11 @@ require (
 	go.opencensus.io v0.23.0 // indirect
 	go.opentelemetry.io/proto/otlp v0.7.0 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
-	golang.org/x/exp v0.0.0-20220827204233-334a2380cb91 // indirect
+	golang.org/x/exp v0.0.0-20230321023759-10a507213a29 // indirect
 	golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 // indirect
 	golang.org/x/term v0.5.0 // indirect
 	golang.org/x/text v0.7.0 // indirect
-	golang.org/x/tools v0.1.12 // indirect
+	golang.org/x/tools v0.2.0 // indirect
 	google.golang.org/api v0.57.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
diff --git a/go.sum b/go.sum
index 4abe9164b498..964f00fa91e0 100644
--- a/go.sum
+++ b/go.sum
@@ -1115,8 +1115,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20220827204233-334a2380cb91 h1:tnebWN09GYg9OLPss1KXj8txwZc6X6uMr6VFdcGNbHw=
-golang.org/x/exp v0.0.0-20220827204233-334a2380cb91/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE=
+golang.org/x/exp v0.0.0-20230321023759-10a507213a29 h1:ooxPy7fPvB4kwsA2h+iBNHkAbp/4JxTSwCmvdjEYmug=
+golang.org/x/exp v0.0.0-20230321023759-10a507213a29/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -1426,8 +1426,8 @@ golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.12 h1:VveCTK38A2rkS8ZqFY25HIDFscX5X9OoEhJd3quQmXU=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.2.0 h1:G6AHpWxTMGY1KyEYoAQ5WTtIekUUvDNjan3ugu60JvE=
+golang.org/x/tools v0.2.0/go.mod h1:y4OqIKeOV/fWJetJ8bXPU1sEVniLMIyDAZWeHdV+NTA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/test/integration/consul-container/go.mod b/test/integration/consul-container/go.mod
index 1a3a8510487b..59c6d252eea9 100644
--- a/test/integration/consul-container/go.mod
+++ b/test/integration/consul-container/go.mod
@@ -77,7 +77,7 @@ require (
 	github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect
 	github.com/sirupsen/logrus v1.8.1 // indirect
 	go.opencensus.io v0.23.0 // indirect
-	golang.org/x/exp v0.0.0-20230303215020-44a13b063f3e // indirect
+	golang.org/x/exp v0.0.0-20230321023759-10a507213a29 // indirect
 	golang.org/x/net v0.8.0 // indirect
 	golang.org/x/sys v0.6.0 // indirect
 	golang.org/x/text v0.8.0 // indirect
diff --git a/test/integration/consul-container/go.sum b/test/integration/consul-container/go.sum
index 9b87f20ebf08..0f6c95e286ec 100644
--- a/test/integration/consul-container/go.sum
+++ b/test/integration/consul-container/go.sum
@@ -874,8 +874,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20230303215020-44a13b063f3e h1:S8xf0d0OEmWrClvbMiUSp+7cGD00txONylwExlf9wR0=
-golang.org/x/exp v0.0.0-20230303215020-44a13b063f3e/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
+golang.org/x/exp v0.0.0-20230321023759-10a507213a29 h1:ooxPy7fPvB4kwsA2h+iBNHkAbp/4JxTSwCmvdjEYmug=
+golang.org/x/exp v0.0.0-20230321023759-10a507213a29/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
diff --git a/test/integration/consul-container/test/gateways/gateway_endpoint_test.go b/test/integration/consul-container/test/gateways/gateway_endpoint_test.go
index b08bb4715026..309538e89ce6 100644
--- a/test/integration/consul-container/test/gateways/gateway_endpoint_test.go
+++ b/test/integration/consul-container/test/gateways/gateway_endpoint_test.go
@@ -137,7 +137,7 @@ func isBound(conditions []api.Condition) bool {
 
 func conditionStatusIsValue(typeName string, statusValue string, conditions []api.Condition) bool {
 	for _, c := range conditions {
-		if c.Type == typeName && c.Status == statusValue {
+		if c.Type == typeName && string(c.Status) == statusValue {
 			return true
 		}
 	}
diff --git a/troubleshoot/go.mod b/troubleshoot/go.mod
index 54838b51d79a..48529793be0a 100644
--- a/troubleshoot/go.mod
+++ b/troubleshoot/go.mod
@@ -28,7 +28,6 @@ require (
 	github.com/fatih/color v1.13.0 // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/btree v1.0.0 // indirect
-	github.com/google/go-cmp v0.5.8 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-hclog v1.2.1 // indirect
@@ -47,6 +46,7 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_model v0.2.0 // indirect
 	go.opentelemetry.io/proto/otlp v0.7.0 // indirect
+	golang.org/x/exp v0.0.0-20230321023759-10a507213a29 // indirect
 	golang.org/x/net v0.4.0 // indirect
 	golang.org/x/sys v0.3.0 // indirect
 	golang.org/x/text v0.5.0 // indirect
diff --git a/troubleshoot/go.sum b/troubleshoot/go.sum
index b8177b292c84..7629cbde9e5b 100644
--- a/troubleshoot/go.sum
+++ b/troubleshoot/go.sum
@@ -79,7 +79,6 @@ github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
-github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
@@ -211,6 +210,8 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20230321023759-10a507213a29 h1:ooxPy7fPvB4kwsA2h+iBNHkAbp/4JxTSwCmvdjEYmug=
+golang.org/x/exp v0.0.0-20230321023759-10a507213a29/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=

From f56b25472d04149d9b59b6831ea50af5542e6dda Mon Sep 17 00:00:00 2001
From: John Murret <john.murret@hashicorp.com>
Date: Mon, 24 Apr 2023 14:25:57 -0600
Subject: [PATCH 07/92] ci: fix runner calculation to exclude the top level
 directory as part of the calculation (#17090)

* fix runner calculation to exclude the top level directory as part of the calculation

* fix the logic for generating the directories/functions

* De-scope tenenacy requirements to OSS only for now. (#17087)

Partition and namespace must be "default"
Peername must be "local"

* Fix virtual services being included in intention topology as downstreams. (#17099)

* Merge pull request #5200 from hashicorp/NET-3758 (#17102)

* Merge pull request #5200 from hashicorp/NET-3758

NET-3758: connect: update supported envoy versions to 1.26.0

* lint

* CI: remove uneeded AWS creds from test-integrations (#17104)

* Update test-integrations.yml

* removing permission lies now that vault is not used in this job.

---------

Co-authored-by: John Murret <john.murret@hashicorp.com>

* update based on feedback

---------

Co-authored-by: Semir Patel <semir.patel@hashicorp.com>
Co-authored-by: Derek Menteer <105233703+hashi-derek@users.noreply.github.com>
Co-authored-by: Anita Akaeze <anita.akaeze@hashicorp.com>
Co-authored-by: Dan Bond <danbond@protonmail.com>
---
 .github/workflows/test-integrations.yml | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/test-integrations.yml b/.github/workflows/test-integrations.yml
index 720360ee801f..515774acca8a 100644
--- a/.github/workflows/test-integrations.yml
+++ b/.github/workflows/test-integrations.yml
@@ -159,10 +159,11 @@ jobs:
           JQ_SLICER: '[ inputs ] | [_nwise(length / $runnercount | floor)]'
         run: |
           NUM_RUNNERS=$TOTAL_RUNNERS
-          NUM_DIRS=$(find ./test/integration/connect/envoy -maxdepth 1 -type d | wc -l)
+          NUM_DIRS=$(find ./test/integration/connect/envoy -mindepth 1 -maxdepth 1 -type d | wc -l)
+
           if [ "$NUM_DIRS" -lt "$NUM_RUNNERS" ]; then
             echo "TOTAL_RUNNERS is larger than the number of tests/packages to split."
-            NUM_RUNNERS=$NUM_DIRS
+            NUM_RUNNERS=$((NUM_DIRS-1))
           fi
           # fix issue where test splitting calculation generates 1 more split than TOTAL_RUNNERS.
           NUM_RUNNERS=$((NUM_RUNNERS-1))
@@ -252,10 +253,11 @@ jobs:
         run: |
           cd ./test/integration/consul-container
           NUM_RUNNERS=$TOTAL_RUNNERS
-          NUM_DIRS=$(find ./test -maxdepth 2 -type d | wc -l)
+          NUM_DIRS=$(find ./test -mindepth 1 -maxdepth 2 -type d | wc -l)
+
           if [ "$NUM_DIRS" -lt "$NUM_RUNNERS" ]; then
             echo "TOTAL_RUNNERS is larger than the number of tests/packages to split."
-            NUM_RUNNERS=$NUM_DIRS
+            NUM_RUNNERS=$((NUM_DIRS-1))
           fi
           # fix issue where test splitting calculation generates 1 more split than TOTAL_RUNNERS.
           NUM_RUNNERS=$((NUM_RUNNERS-1))
@@ -358,9 +360,10 @@ jobs:
           cd ./test/integration/consul-container/test/upgrade
           NUM_RUNNERS=$TOTAL_RUNNERS
           NUM_DIRS=$(go test ./...  -list=. -json | jq -r '.Output | select (. !=null) |  select(. | startswith("Test")) | gsub("[\\n\\t]"; "")' | wc -l)
+          
           if [ "$NUM_DIRS" -lt "$NUM_RUNNERS" ]; then
             echo "TOTAL_RUNNERS is larger than the number of tests/packages to split."
-            NUM_RUNNERS=$NUM_DIRS
+            NUM_RUNNERS=$((NUM_DIRS-1))
           fi
           # fix issue where test splitting calculation generates 1 more split than TOTAL_RUNNERS.
           NUM_RUNNERS=$((NUM_RUNNERS-1))

From 2d3038874f2d054eb71fb557070ca83a0315e23c Mon Sep 17 00:00:00 2001
From: malizz <maliheh.monshizadeh@hashicorp.com>
Date: Mon, 24 Apr 2023 15:30:00 -0700
Subject: [PATCH 08/92] remove envoy endpoint flag from k8s docs (#17105)

---
 website/content/docs/k8s/k8s-cli.mdx | 2 --
 1 file changed, 2 deletions(-)

diff --git a/website/content/docs/k8s/k8s-cli.mdx b/website/content/docs/k8s/k8s-cli.mdx
index bb45986e11e1..d0ad98c49a86 100644
--- a/website/content/docs/k8s/k8s-cli.mdx
+++ b/website/content/docs/k8s/k8s-cli.mdx
@@ -794,7 +794,6 @@ $ consul-k8s troubleshoot upstreams -pod <pod> <OPTIONS>
 | Flag                                 | Description                                           | Default                                                                                                                |
 | ------------------------------------ | ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
 | <nobr>`-namespace`, `-n`</nobr>      | `String` The Kubernetes namespace to list proxies in. | Current [kubeconfig](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) namespace. |
-| <nobr>`-envoy-admin-endpoint`</nobr> | `String` Envoy sidecar address and port               | `127.0.0.1:19000`                                                                                                      |
 
 #### Example Commands
 
@@ -839,7 +838,6 @@ $ consul-k8s troubleshoot proxy -pod <pod> -upstream-envoy-id <envoy-id> <OPTION
 | Flag                                 | Description                                           | Default                                                                                                                |
 | ------------------------------------ | ----------------------------------------------------------| ---------------------------------------------------------------------------------------------------------------------- |
 | <nobr>`-namespace`, `-n`</nobr>      | `String` The Kubernetes namespace to list proxies in.     | Current [kubeconfig](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) namespace. |
-| <nobr>`-envoy-admin-endpoint`</nobr> | `String` Envoy sidecar address and port                   | `127.0.0.1:19000`                                                                                                               |
 | <nobr>`-upstream-ip`</nobr>          | `String` The IP address of the upstream transparent proxy |                                                                                                                |
 | <nobr>`-upstream-envoy-id`</nobr>    | `String` The Envoy identifier of the upstream             |                                                                                                                |
 

From 3f6069bd345ec67eba7fbec4c189ba0456a1f9e7 Mon Sep 17 00:00:00 2001
From: Rosemary Wang <915624+joatmon08@users.noreply.github.com>
Date: Mon, 24 Apr 2023 20:04:32 -0400
Subject: [PATCH 09/92] Clarify OpenTelemetry support for tracing (#17082)

---
 website/content/docs/connect/distributed-tracing.mdx | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/website/content/docs/connect/distributed-tracing.mdx b/website/content/docs/connect/distributed-tracing.mdx
index 1c601ec27fc6..939cde52d5a5 100644
--- a/website/content/docs/connect/distributed-tracing.mdx
+++ b/website/content/docs/connect/distributed-tracing.mdx
@@ -234,8 +234,11 @@ config to take effect.
 1. Requests through [Ingress Gateways](/consul/docs/connect/gateways/ingress-gateway) will not be traced unless the header
    `x-client-trace-id: 1` is set (see [hashicorp/consul#6645](https://github.com/hashicorp/consul/issues/6645)).
 
-1. Consul does not currently support interoperation with [OpenTelemetry](https://opentelemetry.io/) libraries due to
-   Envoy not yet having support.
+1. Consul's proxies do not currently support [OpenTelemetry](https://opentelemetry.io/) spans, as Envoy has not
+   [fully implemented](https://github.com/envoyproxy/envoy/issues/9958) it. Instead, you can add
+   OpenTelemetry libraries to your application to emit spans for other
+   [tracing protocols](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/observability/tracing)
+   supported by Envoy, such as Zipkin or Jaeger.
 
 1. Tracing is only supported with Envoy proxies, not the built-in proxy.
 

From e66b18d0484f6dc903522738a16b0226f3e7f78e Mon Sep 17 00:00:00 2001
From: JUN YANG <yang.jun22@zte.com.cn>
Date: Tue, 25 Apr 2023 09:32:22 +0800
Subject: [PATCH 10/92] Fix broken link in changelog (#17093)

Co-authored-by: David Yu <dyu@hashicorp.com>
---
 CHANGELOG.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c1ea14f6fd6f..64e8da344765 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3321,12 +3321,12 @@ BUG FIXES:
 * snapshot: Fixed a bug where node metadata wasn't being included in or restored from the snapshots. [[GH-4524](https://github.com/hashicorp/consul/issues/4524)]
 * connect: Fixed a bug where managed proxy instances registered for instances with different name and ID and with restrictive ACL would not be allowed. [[GH-4619](https://github.com/hashicorp/consul/issues/4619)]
 * connect: Fixed a bug where built-in CA state was not correctly restored from a snapshot [[GH-4535](https://github.com/hashicorp/consul/pull/4535)]
-* connect: Fixed a bug where Checks with `deregister_critical_service_after` would deregister the service but not remove the managed proxy [[GH-4649](github.com/hashicorp/consul/pull/4649)]
+* connect: Fixed a bug where Checks with `deregister_critical_service_after` would deregister the service but not remove the managed proxy [[GH-4649](https://github.com/hashicorp/consul/issues/4649)]
 * connect: Fixed a bug that would output an error about pruning CAs every hour on the leader and might cause some CA configurations not to be pruned correctly [[GH-4669](https://github.com/hashicorp/consul/pull/4669)]
 * raft: Update raft vendoring to pull in a fix for a potential memory leak. [[GH-4539](https://github.com/hashicorp/consul/pull/4539)]
 * license: (Consul Enterprise) Fix an issue with the license not being reloaded from snapshots.
 * license: (Consul Enterprise) Fix an issue with encoding/decoding of the license package type from the /v1/operator/license endpoint.
-* cli: Correctly exit with error code 1 when failing to list DCs with the catalog command [[GH-4583]]
+* cli: Correctly exit with error code 1 when failing to list DCs with the catalog command [[GH-4583]](https://github.com/hashicorp/consul/pull/4583)
 * ui: Improve layout on screens of a large portrait orientation [[GH-4564]](https://github.com/hashicorp/consul/pull/4564)
 * ui: Various browser layout bugs for various vendors/setups [[GH-4608]](https://github.com/hashicorp/consul/pull/4608) [[GH-4613]](https://github.com/hashicorp/consul/pull/4613) [[GH-4615]](https://github.com/hashicorp/consul/pull/4615)
 

From ba4a314772c69883cd6527e108653203dc1f1c82 Mon Sep 17 00:00:00 2001
From: Dan Upton <daniel@floppy.co>
Date: Tue, 25 Apr 2023 11:48:13 +0100
Subject: [PATCH 11/92] storage: fix bug where WatchList would (rarely) return
 duplicate events (#17067)

---
 internal/storage/inmem/watch.go | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/internal/storage/inmem/watch.go b/internal/storage/inmem/watch.go
index 3c95ec6a7ddc..de340bb39e4c 100644
--- a/internal/storage/inmem/watch.go
+++ b/internal/storage/inmem/watch.go
@@ -26,6 +26,7 @@ type Watch struct {
 
 // Next returns the next WatchEvent, blocking until one is available.
 func (w *Watch) Next(ctx context.Context) (*pbresource.WatchEvent, error) {
+	var idx uint64
 	for {
 		e, err := w.nextEvent(ctx)
 		if err == stream.ErrSubForceClosed {
@@ -35,6 +36,26 @@ func (w *Watch) Next(ctx context.Context) (*pbresource.WatchEvent, error) {
 			return nil, err
 		}
 
+		// This works around a *very* rare race-condition in the EventPublisher where
+		// it's possible to see duplicate events when events are published at the same
+		// time as the first subscription is created on a {topic, subject} pair.
+		//
+		// We see this problem when a call to WriteCAS is happening in parallel with
+		// a call to WatchList. It happens because our snapshot handler returns events
+		// that have not yet been published (in the gap between us committing changes
+		// to MemDB and the EventPublisher dispatching events onto its event buffers).
+		//
+		// An intuitive solution to this problem would be to take eventLock in the
+		// snapshot handler to avoid it racing with publishing, but this does not
+		// work because publishing is asynchronous.
+		//
+		// We should fix this problem at the root, but it's complicated, so for now
+		// we'll work around it.
+		if e.Index <= idx {
+			continue
+		}
+		idx = e.Index
+
 		event := e.Payload.(eventPayload).event
 		if w.query.matches(event.Resource) {
 			return event, nil

From b9c485dcb8ff2ae7428d362a506796eb5e580793 Mon Sep 17 00:00:00 2001
From: Dan Upton <daniel@floppy.co>
Date: Tue, 25 Apr 2023 12:52:35 +0100
Subject: [PATCH 12/92] Controller Supervision (#17016)

---
 agent/consul/server.go                        |  11 +-
 .../services/resource/delete_test.go          |  11 +-
 .../services/resource/list_test.go            |  16 +-
 .../services/resource/read_test.go            |  14 +-
 .../services/resource/watch_test.go           |  12 +-
 .../services/resource/write_status_test.go    |  12 +-
 .../services/resource/write_test.go           |  30 ++--
 internal/controller/api.go                    |  20 +++
 internal/controller/controller.go             |  22 +++
 internal/controller/lease.go                  |  24 +++
 internal/controller/manager.go                |  89 +++++++++++
 internal/controller/supervisor.go             | 140 ++++++++++++++++++
 internal/controller/supervisor_test.go        | 118 +++++++++++++++
 internal/resource/demo/controller.go          |  13 ++
 internal/resource/demo/demo.go                |   6 +-
 lib/retry/retry.go                            |  13 +-
 logging/names.go                              |   1 +
 17 files changed, 498 insertions(+), 54 deletions(-)
 create mode 100644 internal/controller/api.go
 create mode 100644 internal/controller/controller.go
 create mode 100644 internal/controller/lease.go
 create mode 100644 internal/controller/manager.go
 create mode 100644 internal/controller/supervisor.go
 create mode 100644 internal/controller/supervisor_test.go
 create mode 100644 internal/resource/demo/controller.go

diff --git a/agent/consul/server.go b/agent/consul/server.go
index 8b67cc372b97..e5140fcc2a3a 100644
--- a/agent/consul/server.go
+++ b/agent/consul/server.go
@@ -68,6 +68,7 @@ import (
 	"github.com/hashicorp/consul/agent/rpc/peering"
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/agent/token"
+	"github.com/hashicorp/consul/internal/controller"
 	"github.com/hashicorp/consul/internal/resource"
 	"github.com/hashicorp/consul/internal/resource/demo"
 	raftstorage "github.com/hashicorp/consul/internal/storage/raft"
@@ -435,6 +436,10 @@ type Server struct {
 	// with the Resource Service in-process (i.e. not via the network) without auth.
 	// It should only be used for purely-internal workloads, such as controllers.
 	internalResourceServiceClient pbresource.ResourceServiceClient
+
+	// controllerManager schedules the execution of controllers.
+	controllerManager *controller.Manager
+
 	// handles metrics reporting to HashiCorp
 	reportingManager *reporting.ReportingManager
 }
@@ -500,6 +505,7 @@ func NewServer(config *Config, flat Deps, externalGRPCServer *grpc.Server, incom
 		incomingRPCLimiter:      incomingRPCLimiter,
 		routineManager:          routine.NewManager(logger.Named(logging.ConsulServer)),
 		typeRegistry:            resource.NewRegistry(),
+		controllerManager:       controller.NewManager(logger.Named(logging.ControllerRuntime)),
 	}
 	incomingRPCLimiter.Register(s)
 
@@ -824,8 +830,10 @@ func NewServer(config *Config, flat Deps, externalGRPCServer *grpc.Server, incom
 	}
 
 	if s.config.DevMode {
-		demo.Register(s.typeRegistry)
+		demo.RegisterTypes(s.typeRegistry)
+		demo.RegisterControllers(s.controllerManager)
 	}
+	go s.controllerManager.Run(&lib.StopChannelContext{StopCh: shutdownCh})
 
 	return s, nil
 }
@@ -1951,6 +1959,7 @@ func (s *Server) trackLeaderChanges() {
 			s.grpcLeaderForwarder.UpdateLeaderAddr(s.config.Datacenter, string(leaderObs.LeaderAddr))
 			s.peeringBackend.SetLeaderAddress(string(leaderObs.LeaderAddr))
 			s.raftStorageBackend.LeaderChanged()
+			s.controllerManager.SetRaftLeader(s.IsLeader())
 
 			// Trigger sending an update to HCP status
 			s.hcpManager.SendUpdate()
diff --git a/agent/grpc-external/services/resource/delete_test.go b/agent/grpc-external/services/resource/delete_test.go
index 3147fb5b3000..39af826eb784 100644
--- a/agent/grpc-external/services/resource/delete_test.go
+++ b/agent/grpc-external/services/resource/delete_test.go
@@ -22,7 +22,7 @@ func TestDelete_InputValidation(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
 
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	testCases := map[string]func(*pbresource.DeleteRequest){
 		"no id":      func(req *pbresource.DeleteRequest) { req.Id = nil },
@@ -101,7 +101,7 @@ func TestDelete_ACLs(t *testing.T) {
 			mockACLResolver.On("ResolveTokenAndDefaultMeta", mock.Anything, mock.Anything, mock.Anything).
 				Return(tc.authz, nil)
 			server.ACLResolver = mockACLResolver
-			demo.Register(server.Registry)
+			demo.RegisterTypes(server.Registry)
 
 			artist, err := demo.GenerateV2Artist()
 			require.NoError(t, err)
@@ -122,8 +122,7 @@ func TestDelete_Success(t *testing.T) {
 	for desc, tc := range deleteTestCases() {
 		t.Run(desc, func(t *testing.T) {
 			server, client, ctx := testDeps(t)
-			demo.Register(server.Registry)
-
+			demo.RegisterTypes(server.Registry)
 			artist, err := demo.GenerateV2Artist()
 			require.NoError(t, err)
 
@@ -150,7 +149,7 @@ func TestDelete_NotFound(t *testing.T) {
 	for desc, tc := range deleteTestCases() {
 		t.Run(desc, func(t *testing.T) {
 			server, client, ctx := testDeps(t)
-			demo.Register(server.Registry)
+			demo.RegisterTypes(server.Registry)
 			artist, err := demo.GenerateV2Artist()
 			require.NoError(t, err)
 
@@ -165,7 +164,7 @@ func TestDelete_VersionMismatch(t *testing.T) {
 	t.Parallel()
 
 	server, client, ctx := testDeps(t)
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 	artist, err := demo.GenerateV2Artist()
 	require.NoError(t, err)
 	rsp, err := client.Write(ctx, &pbresource.WriteRequest{Resource: artist})
diff --git a/agent/grpc-external/services/resource/list_test.go b/agent/grpc-external/services/resource/list_test.go
index ef0ba96cea80..b476c82aef7b 100644
--- a/agent/grpc-external/services/resource/list_test.go
+++ b/agent/grpc-external/services/resource/list_test.go
@@ -40,7 +40,7 @@ func TestList_Empty(t *testing.T) {
 	for desc, tc := range listTestCases() {
 		t.Run(desc, func(t *testing.T) {
 			server := testServer(t)
-			demo.Register(server.Registry)
+			demo.RegisterTypes(server.Registry)
 			client := testClient(t, server)
 
 			rsp, err := client.List(tc.ctx, &pbresource.ListRequest{
@@ -58,7 +58,7 @@ func TestList_Many(t *testing.T) {
 	for desc, tc := range listTestCases() {
 		t.Run(desc, func(t *testing.T) {
 			server := testServer(t)
-			demo.Register(server.Registry)
+			demo.RegisterTypes(server.Registry)
 			client := testClient(t, server)
 
 			resources := make([]*pbresource.Resource, 10)
@@ -89,7 +89,7 @@ func TestList_GroupVersionMismatch(t *testing.T) {
 	for desc, tc := range listTestCases() {
 		t.Run(desc, func(t *testing.T) {
 			server := testServer(t)
-			demo.Register(server.Registry)
+			demo.RegisterTypes(server.Registry)
 			client := testClient(t, server)
 
 			artist, err := demo.GenerateV2Artist()
@@ -116,7 +116,7 @@ func TestList_VerifyReadConsistencyArg(t *testing.T) {
 			mockBackend := NewMockBackend(t)
 			server := testServer(t)
 			server.Backend = mockBackend
-			demo.Register(server.Registry)
+			demo.RegisterTypes(server.Registry)
 
 			artist, err := demo.GenerateV2Artist()
 			require.NoError(t, err)
@@ -133,7 +133,7 @@ func TestList_VerifyReadConsistencyArg(t *testing.T) {
 	}
 }
 
-// N.B. Uses key ACLs for now. See demo.Register()
+// N.B. Uses key ACLs for now. See demo.RegisterTypes()
 func TestList_ACL_ListDenied(t *testing.T) {
 	t.Parallel()
 
@@ -146,7 +146,7 @@ func TestList_ACL_ListDenied(t *testing.T) {
 	require.Contains(t, err.Error(), "lacks permission 'key:list'")
 }
 
-// N.B. Uses key ACLs for now. See demo.Register()
+// N.B. Uses key ACLs for now. See demo.RegisterTypes()
 func TestList_ACL_ListAllowed_ReadDenied(t *testing.T) {
 	t.Parallel()
 
@@ -160,7 +160,7 @@ func TestList_ACL_ListAllowed_ReadDenied(t *testing.T) {
 	require.Empty(t, rsp.Resources)
 }
 
-// N.B. Uses key ACLs for now. See demo.Register()
+// N.B. Uses key ACLs for now. See demo.RegisterTypes()
 func TestList_ACL_ListAllowed_ReadAllowed(t *testing.T) {
 	t.Parallel()
 
@@ -184,7 +184,7 @@ func roundTripList(t *testing.T, authz acl.Authorizer) (*pbresource.Resource, *p
 	mockACLResolver.On("ResolveTokenAndDefaultMeta", mock.Anything, mock.Anything, mock.Anything).
 		Return(authz, nil)
 	server.ACLResolver = mockACLResolver
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	artist, err := demo.GenerateV2Artist()
 	require.NoError(t, err)
diff --git a/agent/grpc-external/services/resource/read_test.go b/agent/grpc-external/services/resource/read_test.go
index e7265043f3ce..237895eacc55 100644
--- a/agent/grpc-external/services/resource/read_test.go
+++ b/agent/grpc-external/services/resource/read_test.go
@@ -25,7 +25,7 @@ func TestRead_InputValidation(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
 
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	testCases := map[string]func(*pbresource.ReadRequest){
 		"no id":      func(req *pbresource.ReadRequest) { req.Id = nil },
@@ -79,7 +79,7 @@ func TestRead_ResourceNotFound(t *testing.T) {
 		t.Run(desc, func(t *testing.T) {
 			server := testServer(t)
 
-			demo.Register(server.Registry)
+			demo.RegisterTypes(server.Registry)
 			client := testClient(t, server)
 
 			artist, err := demo.GenerateV2Artist()
@@ -98,7 +98,7 @@ func TestRead_GroupVersionMismatch(t *testing.T) {
 		t.Run(desc, func(t *testing.T) {
 			server := testServer(t)
 
-			demo.Register(server.Registry)
+			demo.RegisterTypes(server.Registry)
 			client := testClient(t, server)
 
 			artist, err := demo.GenerateV2Artist()
@@ -123,7 +123,7 @@ func TestRead_Success(t *testing.T) {
 		t.Run(desc, func(t *testing.T) {
 			server := testServer(t)
 
-			demo.Register(server.Registry)
+			demo.RegisterTypes(server.Registry)
 			client := testClient(t, server)
 
 			artist, err := demo.GenerateV2Artist()
@@ -146,7 +146,7 @@ func TestRead_VerifyReadConsistencyArg(t *testing.T) {
 			server := testServer(t)
 			mockBackend := NewMockBackend(t)
 			server.Backend = mockBackend
-			demo.Register(server.Registry)
+			demo.RegisterTypes(server.Registry)
 
 			artist, err := demo.GenerateV2Artist()
 			require.NoError(t, err)
@@ -162,7 +162,7 @@ func TestRead_VerifyReadConsistencyArg(t *testing.T) {
 	}
 }
 
-// N.B. Uses key ACLs for now. See demo.Register()
+// N.B. Uses key ACLs for now. See demo.RegisterTypes()
 func TestRead_ACLs(t *testing.T) {
 	type testCase struct {
 		authz resolver.Result
@@ -188,7 +188,7 @@ func TestRead_ACLs(t *testing.T) {
 			mockACLResolver.On("ResolveTokenAndDefaultMeta", mock.Anything, mock.Anything, mock.Anything).
 				Return(tc.authz, nil)
 			server.ACLResolver = mockACLResolver
-			demo.Register(server.Registry)
+			demo.RegisterTypes(server.Registry)
 
 			artist, err := demo.GenerateV2Artist()
 			require.NoError(t, err)
diff --git a/agent/grpc-external/services/resource/watch_test.go b/agent/grpc-external/services/resource/watch_test.go
index af6f68e58082..b62dc8a4079f 100644
--- a/agent/grpc-external/services/resource/watch_test.go
+++ b/agent/grpc-external/services/resource/watch_test.go
@@ -46,7 +46,7 @@ func TestWatchList_GroupVersionMatches(t *testing.T) {
 
 	server := testServer(t)
 	client := testClient(t, server)
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 	ctx := context.Background()
 
 	// create a watch
@@ -90,7 +90,7 @@ func TestWatchList_GroupVersionMismatch(t *testing.T) {
 	t.Parallel()
 
 	server := testServer(t)
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 	client := testClient(t, server)
 	ctx := context.Background()
 
@@ -123,7 +123,7 @@ func TestWatchList_GroupVersionMismatch(t *testing.T) {
 	mustGetNoResource(t, rspCh)
 }
 
-// N.B. Uses key ACLs for now. See demo.Register()
+// N.B. Uses key ACLs for now. See demo.RegisterTypes()
 func TestWatchList_ACL_ListDenied(t *testing.T) {
 	t.Parallel()
 
@@ -137,7 +137,7 @@ func TestWatchList_ACL_ListDenied(t *testing.T) {
 	require.Contains(t, err.Error(), "lacks permission 'key:list'")
 }
 
-// N.B. Uses key ACLs for now. See demo.Register()
+// N.B. Uses key ACLs for now. See demo.RegisterTypes()
 func TestWatchList_ACL_ListAllowed_ReadDenied(t *testing.T) {
 	t.Parallel()
 
@@ -152,7 +152,7 @@ func TestWatchList_ACL_ListAllowed_ReadDenied(t *testing.T) {
 	mustGetNoResource(t, rspCh)
 }
 
-// N.B. Uses key ACLs for now. See demo.Register()
+// N.B. Uses key ACLs for now. See demo.RegisterTypes()
 func TestWatchList_ACL_ListAllowed_ReadAllowed(t *testing.T) {
 	t.Parallel()
 
@@ -177,7 +177,7 @@ func roundTripACL(t *testing.T, authz acl.Authorizer) (<-chan resourceOrError, *
 	mockACLResolver.On("ResolveTokenAndDefaultMeta", mock.Anything, mock.Anything, mock.Anything).
 		Return(authz, nil)
 	server.ACLResolver = mockACLResolver
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	artist, err := demo.GenerateV2Artist()
 	require.NoError(t, err)
diff --git a/agent/grpc-external/services/resource/write_status_test.go b/agent/grpc-external/services/resource/write_status_test.go
index 35eb26385634..c64a277e790e 100644
--- a/agent/grpc-external/services/resource/write_status_test.go
+++ b/agent/grpc-external/services/resource/write_status_test.go
@@ -69,7 +69,7 @@ func TestWriteStatus_InputValidation(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
 
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	testCases := map[string]func(*pbresource.WriteStatusRequest){
 		"no id":                   func(req *pbresource.WriteStatusRequest) { req.Id = nil },
@@ -113,7 +113,7 @@ func TestWriteStatus_Success(t *testing.T) {
 			server := testServer(t)
 			client := testClient(t, server)
 
-			demo.Register(server.Registry)
+			demo.RegisterTypes(server.Registry)
 
 			res, err := demo.GenerateV2Artist()
 			require.NoError(t, err)
@@ -148,7 +148,7 @@ func TestWriteStatus_CASFailure(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
 
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	res, err := demo.GenerateV2Artist()
 	require.NoError(t, err)
@@ -183,7 +183,7 @@ func TestWriteStatus_TypeNotFound(t *testing.T) {
 func TestWriteStatus_ResourceNotFound(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	res, err := demo.GenerateV2Artist()
 	require.NoError(t, err)
@@ -198,7 +198,7 @@ func TestWriteStatus_ResourceNotFound(t *testing.T) {
 func TestWriteStatus_WrongUid(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	res, err := demo.GenerateV2Artist()
 	require.NoError(t, err)
@@ -219,7 +219,7 @@ func TestWriteStatus_NonCASUpdate_Retry(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
 
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	res, err := demo.GenerateV2Artist()
 	require.NoError(t, err)
diff --git a/agent/grpc-external/services/resource/write_test.go b/agent/grpc-external/services/resource/write_test.go
index 666937c12ee5..f8620f4a3431 100644
--- a/agent/grpc-external/services/resource/write_test.go
+++ b/agent/grpc-external/services/resource/write_test.go
@@ -26,7 +26,7 @@ func TestWrite_InputValidation(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
 
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	testCases := map[string]func(*pbresource.WriteRequest){
 		"no resource": func(req *pbresource.WriteRequest) { req.Resource = nil },
@@ -79,7 +79,7 @@ func TestWrite_OwnerValidation(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
 
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	type testCase struct {
 		modReqFn      func(req *pbresource.WriteRequest)
@@ -183,7 +183,7 @@ func TestWrite_ACLs(t *testing.T) {
 			mockACLResolver.On("ResolveTokenAndDefaultMeta", mock.Anything, mock.Anything, mock.Anything).
 				Return(tc.authz, nil)
 			server.ACLResolver = mockACLResolver
-			demo.Register(server.Registry)
+			demo.RegisterTypes(server.Registry)
 
 			artist, err := demo.GenerateV2Artist()
 			require.NoError(t, err)
@@ -198,7 +198,7 @@ func TestWrite_ACLs(t *testing.T) {
 func TestWrite_Mutate(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	artist, err := demo.GenerateV2Artist()
 	require.NoError(t, err)
@@ -224,7 +224,7 @@ func TestWrite_ResourceCreation_Success(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
 
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	res, err := demo.GenerateV2Artist()
 	require.NoError(t, err)
@@ -240,7 +240,7 @@ func TestWrite_CASUpdate_Success(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
 
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	res, err := demo.GenerateV2Artist()
 	require.NoError(t, err)
@@ -262,7 +262,7 @@ func TestWrite_ResourceCreation_StatusProvided(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
 
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	res, err := demo.GenerateV2Artist()
 	require.NoError(t, err)
@@ -281,7 +281,7 @@ func TestWrite_CASUpdate_Failure(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
 
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	res, err := demo.GenerateV2Artist()
 	require.NoError(t, err)
@@ -302,7 +302,7 @@ func TestWrite_Update_WrongUid(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
 
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	res, err := demo.GenerateV2Artist()
 	require.NoError(t, err)
@@ -323,7 +323,7 @@ func TestWrite_Update_StatusModified(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
 
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	res, err := demo.GenerateV2Artist()
 	require.NoError(t, err)
@@ -353,7 +353,7 @@ func TestWrite_Update_NilStatus(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
 
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	res, err := demo.GenerateV2Artist()
 	require.NoError(t, err)
@@ -377,7 +377,7 @@ func TestWrite_Update_NoUid(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
 
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	res, err := demo.GenerateV2Artist()
 	require.NoError(t, err)
@@ -396,7 +396,7 @@ func TestWrite_NonCASUpdate_Success(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
 
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	res, err := demo.GenerateV2Artist()
 	require.NoError(t, err)
@@ -417,7 +417,7 @@ func TestWrite_NonCASUpdate_Retry(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
 
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	res, err := demo.GenerateV2Artist()
 	require.NoError(t, err)
@@ -467,7 +467,7 @@ func TestWrite_Owner_Immutable(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
 
-	demo.Register(server.Registry)
+	demo.RegisterTypes(server.Registry)
 
 	artist, err := demo.GenerateV2Artist()
 	require.NoError(t, err)
diff --git a/internal/controller/api.go b/internal/controller/api.go
new file mode 100644
index 000000000000..8545d339a7d6
--- /dev/null
+++ b/internal/controller/api.go
@@ -0,0 +1,20 @@
+package controller
+
+import (
+	"github.com/hashicorp/consul/proto-public/pbresource"
+)
+
+// ForType begins building a Controller for the given resource type.
+func ForType(managedType *pbresource.Type) Controller {
+	return Controller{managedType: managedType}
+}
+
+// Controller runs a reconciliation loop to respond to changes in resources and
+// their dependencies. It is heavily inspired by Kubernetes' controller pattern:
+// https://kubernetes.io/docs/concepts/architecture/controller/
+//
+// Use the builder methods in this package (starting with ForType) to construct
+// a controller, and then pass it to a Manager to be executed.
+type Controller struct {
+	managedType *pbresource.Type
+}
diff --git a/internal/controller/controller.go b/internal/controller/controller.go
new file mode 100644
index 000000000000..11933b39facc
--- /dev/null
+++ b/internal/controller/controller.go
@@ -0,0 +1,22 @@
+package controller
+
+import (
+	"context"
+
+	"github.com/hashicorp/go-hclog"
+)
+
+// controllerRunner contains the actual implementation of running a controller
+// including creating watches, calling the reconciler, handling retries, etc.
+type controllerRunner struct {
+	ctrl   Controller
+	logger hclog.Logger
+}
+
+func (c *controllerRunner) run(ctx context.Context) error {
+	c.logger.Debug("controller running")
+	defer c.logger.Debug("controller stopping")
+
+	<-ctx.Done()
+	return ctx.Err()
+}
diff --git a/internal/controller/lease.go b/internal/controller/lease.go
new file mode 100644
index 000000000000..33e284a69c7c
--- /dev/null
+++ b/internal/controller/lease.go
@@ -0,0 +1,24 @@
+package controller
+
+// Lease is used to ensure controllers are run as singletons (i.e. one leader-
+// elected instance per cluster).
+//
+// Currently, this is just an abstraction over Raft leadership. In the future,
+// we'll build a backend-agnostic leasing system into the Resource Service which
+// will allow us to balance controllers between many servers.
+type Lease interface {
+	// Held returns whether we are the current lease-holders.
+	Held() bool
+
+	// Changed returns a channel on which you can receive notifications whenever
+	// the lease is acquired or lost.
+	Changed() <-chan struct{}
+}
+
+type raftLease struct {
+	m  *Manager
+	ch <-chan struct{}
+}
+
+func (l *raftLease) Held() bool               { return l.m.raftLeader.Load() }
+func (l *raftLease) Changed() <-chan struct{} { return l.ch }
diff --git a/internal/controller/manager.go b/internal/controller/manager.go
new file mode 100644
index 000000000000..90b9f2994bae
--- /dev/null
+++ b/internal/controller/manager.go
@@ -0,0 +1,89 @@
+package controller
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+
+	"github.com/hashicorp/go-hclog"
+
+	"github.com/hashicorp/consul/internal/resource"
+)
+
+// Manager is responsible for scheduling the execution of controllers.
+type Manager struct {
+	logger hclog.Logger
+
+	raftLeader atomic.Bool
+
+	mu          sync.Mutex
+	running     bool
+	controllers []Controller
+	leaseChans  []chan struct{}
+}
+
+// NewManager creates a Manager. logger will be used by the Manager, and as the
+// base logger for controllers when one is not specified using WithLogger.
+func NewManager(logger hclog.Logger) *Manager {
+	return &Manager{logger: logger}
+}
+
+// Register the given controller to be executed by the Manager. Cannot be called
+// once the Manager is running.
+func (m *Manager) Register(ctrl Controller) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	if m.running {
+		panic("cannot register additional controllers after calling Run")
+	}
+
+	m.controllers = append(m.controllers, ctrl)
+}
+
+// Run the Manager and start executing controllers until the given context is
+// canceled. Cannot be called more than once.
+func (m *Manager) Run(ctx context.Context) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	if m.running {
+		panic("cannot call Run more than once")
+	}
+	m.running = true
+
+	for _, desc := range m.controllers {
+		runner := &controllerRunner{
+			ctrl:   desc,
+			logger: m.logger.With("managed_type", resource.ToGVK(desc.managedType)),
+		}
+		go newSupervisor(runner.run, m.newLeaseLocked()).run(ctx)
+	}
+}
+
+// SetRaftLeader notifies the Manager of Raft leadership changes. Controllers
+// are currently only executed on the Raft leader, so calling this method will
+// cause the Manager to spin them up/down accordingly.
+func (m *Manager) SetRaftLeader(leader bool) {
+	m.raftLeader.Store(leader)
+
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	for _, ch := range m.leaseChans {
+		select {
+		case ch <- struct{}{}:
+		default:
+			// Do not block if there's nothing receiving on ch (because the supervisor is
+			// busy doing something else). Note that ch has a buffer of 1, so we'll never
+			// miss the notification that something has changed so we need to re-evaluate
+			// the lease.
+		}
+	}
+}
+
+func (m *Manager) newLeaseLocked() Lease {
+	ch := make(chan struct{}, 1)
+	m.leaseChans = append(m.leaseChans, ch)
+	return &raftLease{m: m, ch: ch}
+}
diff --git a/internal/controller/supervisor.go b/internal/controller/supervisor.go
new file mode 100644
index 000000000000..ed9fdccdbc45
--- /dev/null
+++ b/internal/controller/supervisor.go
@@ -0,0 +1,140 @@
+package controller
+
+import (
+	"context"
+	"time"
+
+	"github.com/hashicorp/consul/lib/retry"
+)
+
+// flapThreshold is the minimum amount of time between restarts for us *not* to
+// consider a controller to be stuck in a crash-loop.
+const flapThreshold = 2 * time.Second
+
+// supervisor keeps a task running, restarting it on-error, for as long as the
+// given lease is held. When the lease is lost, the context given to the task
+// will be canceled. If the task persistently fails (i.e. the controller is in
+// a crash-loop) supervisor will use exponential backoff to delay restarts.
+type supervisor struct {
+	task  task
+	lease Lease
+
+	running    bool
+	startedAt  time.Time
+	errCh      chan error
+	cancelTask context.CancelFunc
+
+	backoff        *retry.Waiter
+	backoffUntil   time.Time
+	backoffTimerCh <-chan time.Time
+}
+
+func newSupervisor(task task, lease Lease) *supervisor {
+	return &supervisor{
+		task:  task,
+		lease: lease,
+		errCh: make(chan error),
+		backoff: &retry.Waiter{
+			MinFailures: 1,
+			MinWait:     500 * time.Millisecond,
+			MaxWait:     time.Minute,
+			Jitter:      retry.NewJitter(25),
+		},
+	}
+}
+
+type task func(context.Context) error
+
+func (s *supervisor) run(ctx context.Context) {
+	for {
+		if s.shouldStart() {
+			s.startTask(ctx)
+		} else if s.shouldStop() {
+			s.stopTask()
+		}
+
+		select {
+		// Outer context canceled.
+		case <-ctx.Done():
+			if s.cancelTask != nil {
+				s.cancelTask()
+			}
+			return
+
+		// Task stopped running.
+		case err := <-s.errCh:
+			stopBackoffTimer := s.handleError(err)
+			if stopBackoffTimer != nil {
+				defer stopBackoffTimer()
+			}
+
+		// Unblock when the lease is acquired/lost, or the backoff timer fires.
+		case <-s.lease.Changed():
+		case <-s.backoffTimerCh:
+		}
+	}
+}
+
+func (s *supervisor) shouldStart() bool {
+	if s.running {
+		return false
+	}
+
+	if !s.lease.Held() {
+		return false
+	}
+
+	if time.Now().Before(s.backoffUntil) {
+		return false
+	}
+
+	return true
+}
+
+func (s *supervisor) startTask(ctx context.Context) {
+	if s.cancelTask != nil {
+		s.cancelTask()
+	}
+
+	taskCtx, cancelTask := context.WithCancel(ctx)
+	s.cancelTask = cancelTask
+	s.startedAt = time.Now()
+	s.running = true
+
+	go func() {
+		err := s.task(taskCtx)
+
+		select {
+		case s.errCh <- err:
+		case <-ctx.Done():
+		}
+	}()
+}
+
+func (s *supervisor) shouldStop() bool {
+	return s.running && !s.lease.Held()
+}
+
+func (s *supervisor) stopTask() {
+	s.cancelTask()
+	s.backoff.Reset()
+	s.running = false
+}
+
+func (s *supervisor) handleError(err error) func() bool {
+	s.running = false
+
+	if time.Since(s.startedAt) > flapThreshold {
+		s.backoff.Reset()
+		s.backoffUntil = time.Time{}
+	} else {
+		delay := s.backoff.WaitDuration()
+		s.backoffUntil = time.Now().Add(delay)
+
+		timer := time.NewTimer(delay)
+		s.backoffTimerCh = timer.C
+		return timer.Stop
+	}
+
+	return nil
+}
diff --git a/internal/controller/supervisor_test.go b/internal/controller/supervisor_test.go
new file mode 100644
index 000000000000..1792b8b95c21
--- /dev/null
+++ b/internal/controller/supervisor_test.go
@@ -0,0 +1,118 @@
+package controller
+
+import (
+	"context"
+	"errors"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestSupervise(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	runCh := make(chan struct{})
+	stopCh := make(chan struct{})
+	errCh := make(chan error)
+
+	task := func(taskCtx context.Context) error {
+		runCh <- struct{}{}
+
+		select {
+		case err := <-errCh:
+			return err
+		case <-taskCtx.Done():
+			stopCh <- struct{}{}
+			return taskCtx.Err()
+		}
+	}
+
+	lease := newTestLease()
+
+	go newSupervisor(task, lease).run(ctx)
+
+	select {
+	case <-runCh:
+		t.Fatal("task should not be running before lease is held")
+	case <-time.After(500 * time.Millisecond):
+	}
+
+	lease.acquired()
+
+	select {
+	case <-runCh:
+	case <-time.After(500 * time.Millisecond):
+		t.Fatal("task not running after lease is acquired")
+	}
+
+	select {
+	case <-stopCh:
+		t.Fatal("task should not have stopped before lease is lost")
+	case <-time.After(500 * time.Millisecond):
+	}
+
+	lease.lost()
+
+	select {
+	case <-stopCh:
+	case <-time.After(500 * time.Millisecond):
+		t.Fatal("task still running after lease was lost")
+	}
+
+	select {
+	case <-runCh:
+		t.Fatal("task should not be run again before lease is re-acquired")
+	case <-time.After(500 * time.Millisecond):
+	}
+
+	lease.acquired()
+
+	select {
+	case <-runCh:
+	case <-time.After(500 * time.Millisecond):
+		t.Fatal("task not running after lease is re-acquired")
+	}
+
+	errCh <- errors.New("KABOOM")
+
+	select {
+	case <-runCh:
+	case <-time.After(2 * time.Second):
+		t.Fatal("task was not restarted")
+	}
+
+	cancel()
+
+	select {
+	case <-stopCh:
+	case <-time.After(500 * time.Millisecond):
+		t.Fatal("task still running after parent context was canceled")
+	}
+}
+
+func newTestLease() *testLease {
+	return &testLease{ch: make(chan struct{}, 1)}
+}
+
+type testLease struct {
+	held atomic.Bool
+	ch   chan struct{}
+}
+
+func (l *testLease) Held() bool               { return l.held.Load() }
+func (l *testLease) Changed() <-chan struct{} { return l.ch }
+
+func (l *testLease) acquired() { l.setHeld(true) }
+func (l *testLease) lost()     { l.setHeld(false) }
+
+func (l *testLease) setHeld(held bool) {
+	l.held.Store(held)
+
+	select {
+	case l.ch <- struct{}{}:
+	default:
+	}
+}
diff --git a/internal/resource/demo/controller.go b/internal/resource/demo/controller.go
new file mode 100644
index 000000000000..f2172f0f852c
--- /dev/null
+++ b/internal/resource/demo/controller.go
@@ -0,0 +1,13 @@
+package demo
+
+import "github.com/hashicorp/consul/internal/controller"
+
+// RegisterControllers registers controllers for the demo types. Should only be
+// called in dev mode.
+func RegisterControllers(mgr *controller.Manager) {
+	mgr.Register(artistController())
+}
+
+func artistController() controller.Controller {
+	return controller.ForType(TypeV2Artist)
+}
diff --git a/internal/resource/demo/demo.go b/internal/resource/demo/demo.go
index 20c630d5ec56..fde9272aeb02 100644
--- a/internal/resource/demo/demo.go
+++ b/internal/resource/demo/demo.go
@@ -66,12 +66,12 @@ const (
 	ArtistV2ListPolicy  = `key_prefix "resource/" { policy = "list" }`
 )
 
-// Register demo types. Should only be called in tests and dev mode.
-// acls are optional.
+// RegisterTypes registers the demo types. Should only be called in tests and
+// dev mode.
 //
 // TODO(spatel): We're standing-in key ACLs for demo resources until our ACL
 // system can be more modularly extended (or support generic resource permissions).
-func Register(r resource.Registry) {
+func RegisterTypes(r resource.Registry) {
 	readACL := func(authz acl.Authorizer, id *pbresource.ID) error {
 		key := fmt.Sprintf("resource/%s/%s", resource.ToGVK(id.Type), id.Name)
 		return authz.ToAllowAuthorizer().KeyReadAllowed(key, &acl.AuthorizerContext{})
diff --git a/lib/retry/retry.go b/lib/retry/retry.go
index 2a358966170c..ee9a8b2354e6 100644
--- a/lib/retry/retry.go
+++ b/lib/retry/retry.go
@@ -104,8 +104,8 @@ func (w *Waiter) Failures() int {
 // such as when the context is canceled. This makes it suitable for
 // long-running routines that do not get re-initialized, such as replication.
 func (w *Waiter) Wait(ctx context.Context) error {
-	w.failures++
-	timer := time.NewTimer(w.delay())
+	delay := w.WaitDuration()
+	timer := time.NewTimer(delay)
 	select {
 	case <-ctx.Done():
 		timer.Stop()
@@ -115,6 +115,15 @@ func (w *Waiter) Wait(ctx context.Context) error {
 	}
 }
 
+// WaitDuration increases the number of failures by one, and returns the
+// duration the caller must wait for. This is an alternative to the Wait
+// method for cases where you want to handle the timer yourself (e.g. as
+// part of a larger select statement).
+func (w *Waiter) WaitDuration() time.Duration {
+	w.failures++
+	return w.delay()
+}
+
 // NextWait returns the period the next call to Wait with block for assuming
 // it's context is not cancelled. It's useful for informing a user how long
 // it will be before the next attempt is made.
diff --git a/logging/names.go b/logging/names.go
index 955a1bf260f7..1c7ecc448787 100644
--- a/logging/names.go
+++ b/logging/names.go
@@ -20,6 +20,7 @@ const (
 	Consul                string = "consul"
 	ConsulClient          string = "client"
 	ConsulServer          string = "server"
+	ControllerRuntime     string = "controller-runtime"
 	Coordinate            string = "coordinate"
 	DNS                   string = "dns"
 	Envoy                 string = "envoy"

From 9e35c47bbd6aba69b7568ee8c7c9da2e345392bd Mon Sep 17 00:00:00 2001
From: Paul Banks <pbanks@hashicorp.com>
Date: Tue, 25 Apr 2023 15:25:26 +0100
Subject: [PATCH 13/92] De-flake snapshot test (#17120)

---
 .../test/snapshot/snapshot_restore_test.go    | 29 +++++++++++++++----
 1 file changed, 24 insertions(+), 5 deletions(-)

diff --git a/test/integration/consul-container/test/snapshot/snapshot_restore_test.go b/test/integration/consul-container/test/snapshot/snapshot_restore_test.go
index d472f6efc7a2..fa26ff924483 100644
--- a/test/integration/consul-container/test/snapshot/snapshot_restore_test.go
+++ b/test/integration/consul-container/test/snapshot/snapshot_restore_test.go
@@ -5,14 +5,17 @@ package snapshot
 
 import (
 	"fmt"
+	"io"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
 	"github.com/hashicorp/consul/api"
 	"github.com/hashicorp/consul/sdk/testutil/retry"
 	libcluster "github.com/hashicorp/consul/test/integration/consul-container/libs/cluster"
 	libtopology "github.com/hashicorp/consul/test/integration/consul-container/libs/topology"
 	"github.com/hashicorp/consul/test/integration/consul-container/libs/utils"
-	"github.com/stretchr/testify/require"
-	"io"
-	"testing"
 )
 
 func TestSnapshotRestore(t *testing.T) {
@@ -105,11 +108,27 @@ func testSnapShotRestoreForLogStore(t *testing.T, logStore libcluster.LogStore)
 		require.Equal(r, LeaderLogIndex, followerLogIndex)
 	})
 
-	for i := 0; i < 100; i++ {
+	// Follower might not have finished loading snapshot yet which means attempts
+	// could return nil or "key not found" for a while.
+	failer := func() *retry.Timer {
+		return &retry.Timer{Timeout: 10 * time.Second, Wait: 100 * time.Millisecond}
+	}
+
+	retry.RunWith(failer(), t, func(r *retry.R) {
+		kv, _, err := fc.KV().Get(fmt.Sprintf("key-%d", 1), &api.QueryOptions{AllowStale: true})
+		require.NoError(t, err)
+		require.NotNil(t, kv)
+		require.Equal(t, kv.Key, fmt.Sprintf("key-%d", 1))
+		require.Equal(t, kv.Value, []byte(fmt.Sprintf("value-%d", 1)))
+	})
+
+	// Now we have at least one non-nil key, the snapshot must be loaded so check
+	// we can read all the rest of them too.
+	for i := 2; i < 100; i++ {
 		kv, _, err := fc.KV().Get(fmt.Sprintf("key-%d", i), &api.QueryOptions{AllowStale: true})
 		require.NoError(t, err)
+		require.NotNil(t, kv)
 		require.Equal(t, kv.Key, fmt.Sprintf("key-%d", i))
 		require.Equal(t, kv.Value, []byte(fmt.Sprintf("value-%d", i)))
 	}
-
 }

From cc5cbcba7c10616f17de1cf14b5f65626f838bdc Mon Sep 17 00:00:00 2001
From: David Yu <dyu@hashicorp.com>
Date: Tue, 25 Apr 2023 09:42:31 -0700
Subject: [PATCH 14/92] Update single-dc-multi-k8s.mdx (#17126)

---
 .../docs/k8s/deployment-configurations/single-dc-multi-k8s.mdx | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/website/content/docs/k8s/deployment-configurations/single-dc-multi-k8s.mdx b/website/content/docs/k8s/deployment-configurations/single-dc-multi-k8s.mdx
index 46fc2228016a..4f23ccddabe9 100644
--- a/website/content/docs/k8s/deployment-configurations/single-dc-multi-k8s.mdx
+++ b/website/content/docs/k8s/deployment-configurations/single-dc-multi-k8s.mdx
@@ -15,7 +15,8 @@ This example uses two Kubernetes clusters, but this approach could be extended t
 
 ## Requirements
 
-* Consul-Helm version `v1.0.0` or higher
+* `consul-k8s` v1.0.x or higher, and Consul 1.14.x or higher 
+* Kubernetes clusters must be able to communicate over LAN on a flat network.
 * Either the Helm release name for each Kubernetes cluster must be unique, or `global.name` for each Kubernetes cluster must be unique to prevent collisions of ACL resources with the same prefix.
 
 ## Prepare Helm release name ahead of installs

From e7bb8fdf159df69d287cf9f114fdcd77eb179b51 Mon Sep 17 00:00:00 2001
From: Semir Patel <semir.patel@hashicorp.com>
Date: Tue, 25 Apr 2023 15:17:48 -0500
Subject: [PATCH 15/92] Fix or disable pipeline breaking changes that made it
 into main in last day or so (#17130)

* Fix straggler from renaming Register->RegisterTypes

* somehow a lint failure got through previously

* Fix lint-consul-retry errors

* adding in fix for success jobs getting skipped. (#17132)

* Temporarily disable inmem backend conformance test to get green pipeline

* Another test needs disabling

---------

Co-authored-by: John Murret <john.murret@hashicorp.com>
---
 .github/workflows/build-artifacts.yml         | 13 +++---
 .github/workflows/build-distros.yml           | 13 +++---
 .github/workflows/frontend.yml                | 13 +++---
 .github/workflows/go-tests.yml                | 13 +++---
 .github/workflows/test-integrations.yml       | 13 +++---
 .../services/resource/write_status_test.go    |  2 +-
 internal/controller/supervisor.go             |  2 +
 internal/storage/inmem/backend_test.go        | 30 ++++++-------
 internal/storage/raft/conformance_test.go     | 43 ++++++++++---------
 .../test/snapshot/snapshot_restore_test.go    |  8 ++--
 10 files changed, 83 insertions(+), 67 deletions(-)

diff --git a/.github/workflows/build-artifacts.yml b/.github/workflows/build-artifacts.yml
index 632950b01d13..2e87d767f5e4 100644
--- a/.github/workflows/build-artifacts.yml
+++ b/.github/workflows/build-artifacts.yml
@@ -123,9 +123,12 @@ jobs:
     - setup
     - dev-build-push
     runs-on: ${{ fromJSON(needs.setup.outputs.compute-small) }}
-    if: |
-      (always() && ! cancelled()) &&
-      !contains(needs.*.result, 'failure') &&
-      !contains(needs.*.result, 'cancelled')
+    if: ${{ always() }}
     steps:
-      - run: echo "build-artifacts succeeded"
+      - name: evaluate upstream job results
+        run: |
+          # exit 1 if failure or cancelled result for any upstream job
+          if printf '${{ toJSON(needs) }}' | grep -E -i '\"result\": \"(failure|cancelled)\"'; then
+            printf "Tests failed or workflow cancelled:\n\n${{ toJSON(needs) }}"
+            exit 1
+          fi
diff --git a/.github/workflows/build-distros.yml b/.github/workflows/build-distros.yml
index a423030be5bf..6f5722a82ab9 100644
--- a/.github/workflows/build-distros.yml
+++ b/.github/workflows/build-distros.yml
@@ -138,9 +138,12 @@ jobs:
     - build-amd64
     - build-arm
     runs-on: ${{ fromJSON(needs.setup.outputs.compute-small) }}
-    if: |
-      (always() && ! cancelled()) &&
-      !contains(needs.*.result, 'failure') &&
-      !contains(needs.*.result, 'cancelled')
+    if: ${{ always() }}
     steps:
-      - run: echo "build-distros succeeded"
+      - name: evaluate upstream job results
+        run: |
+          # exit 1 if failure or cancelled result for any upstream job
+          if printf '${{ toJSON(needs) }}' | grep -E -i '\"result\": \"(failure|cancelled)\"'; then
+            printf "Tests failed or workflow cancelled:\n\n${{ toJSON(needs) }}"
+            exit 1
+          fi
diff --git a/.github/workflows/frontend.yml b/.github/workflows/frontend.yml
index bcce35da60d6..5eab231c65a5 100644
--- a/.github/workflows/frontend.yml
+++ b/.github/workflows/frontend.yml
@@ -133,9 +133,12 @@ jobs:
     - node-tests
     - ember-build-test
     runs-on: ${{ fromJSON(needs.setup.outputs.compute-small) }}
-    if: |
-      (always() && ! cancelled()) &&
-      !contains(needs.*.result, 'failure') &&
-      !contains(needs.*.result, 'cancelled')
+    if: ${{ always() }}
     steps:
-      - run: echo "frontend succeeded"
+      - name: evaluate upstream job results
+        run: |
+          # exit 1 if failure or cancelled result for any upstream job
+          if printf '${{ toJSON(needs) }}' | grep -E -i '\"result\": \"(failure|cancelled)\"'; then
+            printf "Tests failed or workflow cancelled:\n\n${{ toJSON(needs) }}"
+            exit 1
+          fi
diff --git a/.github/workflows/go-tests.yml b/.github/workflows/go-tests.yml
index 6ac623887480..d15b874ef671 100644
--- a/.github/workflows/go-tests.yml
+++ b/.github/workflows/go-tests.yml
@@ -405,9 +405,12 @@ jobs:
     - go-test-sdk-1-20
     - go-test-32bit
     runs-on: ${{ fromJSON(needs.setup.outputs.compute-small) }}
-    if: |
-      (always() && ! cancelled()) &&
-      !contains(needs.*.result, 'failure') &&
-      !contains(needs.*.result, 'cancelled')
+    if: ${{ always() }}
     steps:
-      - run: echo "go-tests succeeded"
+      - name: evaluate upstream job results
+        run: |
+          # exit 1 if failure or cancelled result for any upstream job
+          if printf '${{ toJSON(needs) }}' | grep -E -i '\"result\": \"(failure|cancelled)\"'; then
+            printf "Tests failed or workflow cancelled:\n\n${{ toJSON(needs) }}"
+            exit 1
+          fi
diff --git a/.github/workflows/test-integrations.yml b/.github/workflows/test-integrations.yml
index 515774acca8a..37423b567b87 100644
--- a/.github/workflows/test-integrations.yml
+++ b/.github/workflows/test-integrations.yml
@@ -491,9 +491,12 @@ jobs:
     - generate-upgrade-job-matrices
     - upgrade-integration-test
     runs-on: ${{ fromJSON(needs.setup.outputs.compute-small) }}
-    if: |
-      (always() && ! cancelled()) &&
-      !contains(needs.*.result, 'failure') &&
-      !contains(needs.*.result, 'cancelled')
+    if: ${{ always() }}
     steps:
-      - run: echo "test-integrations succeeded"
+      - name: evaluate upstream job results
+        run: |
+          # exit 1 if failure or cancelled result for any upstream job
+          if printf '${{ toJSON(needs) }}' | grep -E -i '\"result\": \"(failure|cancelled)\"'; then
+            printf "Tests failed or workflow cancelled:\n\n${{ toJSON(needs) }}"
+            exit 1
+          fi
diff --git a/agent/grpc-external/services/resource/write_status_test.go b/agent/grpc-external/services/resource/write_status_test.go
index c64a277e790e..c5cc301c1ed9 100644
--- a/agent/grpc-external/services/resource/write_status_test.go
+++ b/agent/grpc-external/services/resource/write_status_test.go
@@ -49,7 +49,7 @@ func TestWriteStatus_ACL(t *testing.T) {
 			mockACLResolver.On("ResolveTokenAndDefaultMeta", mock.Anything, mock.Anything, mock.Anything).
 				Return(tc.authz, nil)
 			server.ACLResolver = mockACLResolver
-			demo.Register(server.Registry)
+			demo.RegisterTypes(server.Registry)
 
 			artist, err := demo.GenerateV2Artist()
 			require.NoError(t, err)
diff --git a/internal/controller/supervisor.go b/internal/controller/supervisor.go
index ed9fdccdbc45..8174b86d6d20 100644
--- a/internal/controller/supervisor.go
+++ b/internal/controller/supervisor.go
@@ -122,6 +122,8 @@ func (s *supervisor) stopTask() {
 }
 
 func (s *supervisor) handleError(err error) func() bool {
+	// TODO(spatel): Fix unused err flagged by lint
+	_ = err
 	s.running = false
 
 	if time.Since(s.startedAt) > flapThreshold {
diff --git a/internal/storage/inmem/backend_test.go b/internal/storage/inmem/backend_test.go
index e37de15afab4..65cfca85d465 100644
--- a/internal/storage/inmem/backend_test.go
+++ b/internal/storage/inmem/backend_test.go
@@ -4,28 +4,26 @@
 package inmem_test
 
 import (
-	"context"
 	"testing"
 
 	"github.com/stretchr/testify/require"
-
-	"github.com/hashicorp/consul/internal/storage"
-	"github.com/hashicorp/consul/internal/storage/conformance"
-	"github.com/hashicorp/consul/internal/storage/inmem"
 )
 
 func TestBackend_Conformance(t *testing.T) {
-	conformance.Test(t, conformance.TestOptions{
-		NewBackend: func(t *testing.T) storage.Backend {
-			backend, err := inmem.NewBackend()
-			require.NoError(t, err)
+	// TODO(spatel): temporarily commenting out to get a green pipleine.
+	require.True(t, true)
+
+	// conformance.Test(t, conformance.TestOptions{
+	// 	NewBackend: func(t *testing.T) storage.Backend {
+	// 		backend, err := inmem.NewBackend()
+	// 		require.NoError(t, err)
 
-			ctx, cancel := context.WithCancel(context.Background())
-			t.Cleanup(cancel)
-			go backend.Run(ctx)
+	// 		ctx, cancel := context.WithCancel(context.Background())
+	// 		t.Cleanup(cancel)
+	// 		go backend.Run(ctx)
 
-			return backend
-		},
-		SupportsStronglyConsistentList: true,
-	})
+	// 		return backend
+	// 	},
+	// 	SupportsStronglyConsistentList: true,
+	// })
 }
diff --git a/internal/storage/raft/conformance_test.go b/internal/storage/raft/conformance_test.go
index ef79087e171d..230f4ca11987 100644
--- a/internal/storage/raft/conformance_test.go
+++ b/internal/storage/raft/conformance_test.go
@@ -16,32 +16,33 @@ import (
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 
-	"github.com/hashicorp/consul/internal/storage"
-	"github.com/hashicorp/consul/internal/storage/conformance"
 	"github.com/hashicorp/consul/internal/storage/raft"
 	"github.com/hashicorp/consul/sdk/testutil"
 )
 
 func TestBackend_Conformance(t *testing.T) {
-	t.Run("Leader", func(t *testing.T) {
-		conformance.Test(t, conformance.TestOptions{
-			NewBackend: func(t *testing.T) storage.Backend {
-				leader, _ := newRaftCluster(t)
-				return leader
-			},
-			SupportsStronglyConsistentList: true,
-		})
-	})
-
-	t.Run("Follower", func(t *testing.T) {
-		conformance.Test(t, conformance.TestOptions{
-			NewBackend: func(t *testing.T) storage.Backend {
-				_, follower := newRaftCluster(t)
-				return follower
-			},
-			SupportsStronglyConsistentList: true,
-		})
-	})
+	// TODO(spatel): Temporarily disable to get a green pipeline
+	require.True(t, true)
+
+	// t.Run("Leader", func(t *testing.T) {
+	// 	conformance.Test(t, conformance.TestOptions{
+	// 		NewBackend: func(t *testing.T) storage.Backend {
+	// 			leader, _ := newRaftCluster(t)
+	// 			return leader
+	// 		},
+	// 		SupportsStronglyConsistentList: true,
+	// 	})
+	// })
+
+	// t.Run("Follower", func(t *testing.T) {
+	// 	conformance.Test(t, conformance.TestOptions{
+	// 		NewBackend: func(t *testing.T) storage.Backend {
+	// 			_, follower := newRaftCluster(t)
+	// 			return follower
+	// 		},
+	// 		SupportsStronglyConsistentList: true,
+	// 	})
+	// })
 }
 
 func newRaftCluster(t *testing.T) (*raft.Backend, *raft.Backend) {
diff --git a/test/integration/consul-container/test/snapshot/snapshot_restore_test.go b/test/integration/consul-container/test/snapshot/snapshot_restore_test.go
index fa26ff924483..47a03f43236d 100644
--- a/test/integration/consul-container/test/snapshot/snapshot_restore_test.go
+++ b/test/integration/consul-container/test/snapshot/snapshot_restore_test.go
@@ -116,10 +116,10 @@ func testSnapShotRestoreForLogStore(t *testing.T, logStore libcluster.LogStore)
 
 	retry.RunWith(failer(), t, func(r *retry.R) {
 		kv, _, err := fc.KV().Get(fmt.Sprintf("key-%d", 1), &api.QueryOptions{AllowStale: true})
-		require.NoError(t, err)
-		require.NotNil(t, kv)
-		require.Equal(t, kv.Key, fmt.Sprintf("key-%d", 1))
-		require.Equal(t, kv.Value, []byte(fmt.Sprintf("value-%d", 1)))
+		require.NoError(r, err)
+		require.NotNil(r, kv)
+		require.Equal(r, kv.Key, fmt.Sprintf("key-%d", 1))
+		require.Equal(r, kv.Value, []byte(fmt.Sprintf("value-%d", 1)))
 	})
 
 	// Now we have at least one non-nil key, the snapshot must be loaded so check

From faae7bb5f279c7cadce50f941a291d4b0eb9ed7f Mon Sep 17 00:00:00 2001
From: Dan Upton <daniel@floppy.co>
Date: Wed, 26 Apr 2023 11:57:10 +0100
Subject: [PATCH 16/92] testing: `RunResourceService` helper (#17068)

---
 .../services/resource/testing/testing.go      | 59 +++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 agent/grpc-external/services/resource/testing/testing.go

diff --git a/agent/grpc-external/services/resource/testing/testing.go b/agent/grpc-external/services/resource/testing/testing.go
new file mode 100644
index 000000000000..5bcbc148e7bb
--- /dev/null
+++ b/agent/grpc-external/services/resource/testing/testing.go
@@ -0,0 +1,59 @@
+package testing
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/hashicorp/consul/acl/resolver"
+	svc "github.com/hashicorp/consul/agent/grpc-external/services/resource"
+	internal "github.com/hashicorp/consul/agent/grpc-internal"
+	"github.com/hashicorp/consul/internal/resource"
+	"github.com/hashicorp/consul/internal/storage/inmem"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/hashicorp/consul/sdk/testutil"
+)
+
+// RunResourceService runs a Resource Service for the duration of the test and
+// returns a client to interact with it. ACLs will be disabled.
+func RunResourceService(t *testing.T, registerFns ...func(resource.Registry)) pbresource.ResourceServiceClient {
+	t.Helper()
+
+	backend, err := inmem.NewBackend()
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	go backend.Run(ctx)
+
+	registry := resource.NewRegistry()
+	for _, fn := range registerFns {
+		fn(registry)
+	}
+
+	server := grpc.NewServer()
+
+	svc.NewServer(svc.Config{
+		Backend:     backend,
+		Registry:    registry,
+		Logger:      testutil.Logger(t),
+		ACLResolver: resolver.DANGER_NO_AUTH{},
+	}).Register(server)
+
+	pipe := internal.NewPipeListener()
+	go server.Serve(pipe)
+	t.Cleanup(server.Stop)
+
+	conn, err := grpc.Dial("",
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		grpc.WithContextDialer(pipe.DialContext),
+		grpc.WithBlock(),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+
+	return pbresource.NewResourceServiceClient(conn)
+}

From eeaa63616456678fc07bc94f46567cae1e519200 Mon Sep 17 00:00:00 2001
From: Dan Upton <daniel@floppy.co>
Date: Wed, 26 Apr 2023 13:59:58 +0100
Subject: [PATCH 17/92] =?UTF-8?q?Cleanup=20from=20unblocking=20the=20pipel?=
 =?UTF-8?q?ine=20=F0=9F=A7=B9=20(#17121)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 internal/controller/supervisor.go         |  8 ++---
 internal/storage/inmem/backend_test.go    | 30 ++++++++--------
 internal/storage/inmem/watch.go           | 42 +++++++++++-----------
 internal/storage/raft/conformance_test.go | 43 +++++++++++------------
 4 files changed, 61 insertions(+), 62 deletions(-)

diff --git a/internal/controller/supervisor.go b/internal/controller/supervisor.go
index 8174b86d6d20..5983ff4c4b7b 100644
--- a/internal/controller/supervisor.go
+++ b/internal/controller/supervisor.go
@@ -62,8 +62,8 @@ func (s *supervisor) run(ctx context.Context) {
 			return
 
 		// Task stopped running.
-		case err := <-s.errCh:
-			stopBackoffTimer := s.handleError(err)
+		case <-s.errCh:
+			stopBackoffTimer := s.handleError()
 			if stopBackoffTimer != nil {
 				defer stopBackoffTimer()
 			}
@@ -121,9 +121,7 @@ func (s *supervisor) stopTask() {
 	s.running = false
 }
 
-func (s *supervisor) handleError(err error) func() bool {
-	// TODO(spatel): Fix unused err flagged by lint
-	_ = err
+func (s *supervisor) handleError() func() bool {
 	s.running = false
 
 	if time.Since(s.startedAt) > flapThreshold {
diff --git a/internal/storage/inmem/backend_test.go b/internal/storage/inmem/backend_test.go
index 65cfca85d465..e37de15afab4 100644
--- a/internal/storage/inmem/backend_test.go
+++ b/internal/storage/inmem/backend_test.go
@@ -4,26 +4,28 @@
 package inmem_test
 
 import (
+	"context"
 	"testing"
 
 	"github.com/stretchr/testify/require"
+
+	"github.com/hashicorp/consul/internal/storage"
+	"github.com/hashicorp/consul/internal/storage/conformance"
+	"github.com/hashicorp/consul/internal/storage/inmem"
 )
 
 func TestBackend_Conformance(t *testing.T) {
-	// TODO(spatel): temporarily commenting out to get a green pipleine.
-	require.True(t, true)
-
-	// conformance.Test(t, conformance.TestOptions{
-	// 	NewBackend: func(t *testing.T) storage.Backend {
-	// 		backend, err := inmem.NewBackend()
-	// 		require.NoError(t, err)
+	conformance.Test(t, conformance.TestOptions{
+		NewBackend: func(t *testing.T) storage.Backend {
+			backend, err := inmem.NewBackend()
+			require.NoError(t, err)
 
-	// 		ctx, cancel := context.WithCancel(context.Background())
-	// 		t.Cleanup(cancel)
-	// 		go backend.Run(ctx)
+			ctx, cancel := context.WithCancel(context.Background())
+			t.Cleanup(cancel)
+			go backend.Run(ctx)
 
-	// 		return backend
-	// 	},
-	// 	SupportsStronglyConsistentList: true,
-	// })
+			return backend
+		},
+		SupportsStronglyConsistentList: true,
+	})
 }
diff --git a/internal/storage/inmem/watch.go b/internal/storage/inmem/watch.go
index de340bb39e4c..85c657e3a3c6 100644
--- a/internal/storage/inmem/watch.go
+++ b/internal/storage/inmem/watch.go
@@ -26,7 +26,6 @@ type Watch struct {
 
 // Next returns the next WatchEvent, blocking until one is available.
 func (w *Watch) Next(ctx context.Context) (*pbresource.WatchEvent, error) {
-	var idx uint64
 	for {
 		e, err := w.nextEvent(ctx)
 		if err == stream.ErrSubForceClosed {
@@ -36,26 +35,6 @@ func (w *Watch) Next(ctx context.Context) (*pbresource.WatchEvent, error) {
 			return nil, err
 		}
 
-		// This works around a *very* rare race-condition in the EventPublisher where
-		// it's possible to see duplicate events when events are published at the same
-		// time as the first subscription is created on a {topic, subject} pair.
-		//
-		// We see this problem when a call to WriteCAS is happening in parallel with
-		// a call to WatchList. It happens because our snapshot handler returns events
-		// that have not yet been published (in the gap between us committing changes
-		// to MemDB and the EventPublisher dispatching events onto its event buffers).
-		//
-		// An intuitive solution to this problem would be to take eventLock in the
-		// snapshot handler to avoid it racing with publishing, but this does not
-		// work because publishing is asynchronous.
-		//
-		// We should fix this problem at the root, but it's complicated, so for now
-		// we'll work around it.
-		if e.Index <= idx {
-			continue
-		}
-		idx = e.Index
-
 		event := e.Payload.(eventPayload).event
 		if w.query.matches(event.Resource) {
 			return event, nil
@@ -70,6 +49,7 @@ func (w *Watch) nextEvent(ctx context.Context) (*stream.Event, error) {
 		return &event, nil
 	}
 
+	var idx uint64
 	for {
 		e, err := w.sub.Next(ctx)
 		if err != nil {
@@ -80,6 +60,26 @@ func (w *Watch) nextEvent(ctx context.Context) (*stream.Event, error) {
 			continue
 		}
 
+		// This works around a *very* rare race-condition in the EventPublisher where
+		// it's possible to see duplicate events when events are published at the same
+		// time as the first subscription is created on a {topic, subject} pair.
+		//
+		// We see this problem when a call to WriteCAS is happening in parallel with
+		// a call to WatchList. It happens because our snapshot handler returns events
+		// that have not yet been published (in the gap between us committing changes
+		// to MemDB and the EventPublisher dispatching events onto its event buffers).
+		//
+		// An intuitive solution to this problem would be to take eventLock in the
+		// snapshot handler to avoid it racing with publishing, but this does not
+		// work because publishing is asynchronous.
+		//
+		// We should fix this problem at the root, but it's complicated, so for now
+		// we'll work around it.
+		if e.Index <= idx {
+			continue
+		}
+		idx = e.Index
+
 		switch t := e.Payload.(type) {
 		case eventPayload:
 			return &e, nil
diff --git a/internal/storage/raft/conformance_test.go b/internal/storage/raft/conformance_test.go
index 230f4ca11987..ef79087e171d 100644
--- a/internal/storage/raft/conformance_test.go
+++ b/internal/storage/raft/conformance_test.go
@@ -16,33 +16,32 @@ import (
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 
+	"github.com/hashicorp/consul/internal/storage"
+	"github.com/hashicorp/consul/internal/storage/conformance"
 	"github.com/hashicorp/consul/internal/storage/raft"
 	"github.com/hashicorp/consul/sdk/testutil"
 )
 
 func TestBackend_Conformance(t *testing.T) {
-	// TODO(spatel): Temporarily disable to get a green pipeline
-	require.True(t, true)
-
-	// t.Run("Leader", func(t *testing.T) {
-	// 	conformance.Test(t, conformance.TestOptions{
-	// 		NewBackend: func(t *testing.T) storage.Backend {
-	// 			leader, _ := newRaftCluster(t)
-	// 			return leader
-	// 		},
-	// 		SupportsStronglyConsistentList: true,
-	// 	})
-	// })
-
-	// t.Run("Follower", func(t *testing.T) {
-	// 	conformance.Test(t, conformance.TestOptions{
-	// 		NewBackend: func(t *testing.T) storage.Backend {
-	// 			_, follower := newRaftCluster(t)
-	// 			return follower
-	// 		},
-	// 		SupportsStronglyConsistentList: true,
-	// 	})
-	// })
+	t.Run("Leader", func(t *testing.T) {
+		conformance.Test(t, conformance.TestOptions{
+			NewBackend: func(t *testing.T) storage.Backend {
+				leader, _ := newRaftCluster(t)
+				return leader
+			},
+			SupportsStronglyConsistentList: true,
+		})
+	})
+
+	t.Run("Follower", func(t *testing.T) {
+		conformance.Test(t, conformance.TestOptions{
+			NewBackend: func(t *testing.T) storage.Backend {
+				_, follower := newRaftCluster(t)
+				return follower
+			},
+			SupportsStronglyConsistentList: true,
+		})
+	})
 }
 
 func newRaftCluster(t *testing.T) (*raft.Backend, *raft.Backend) {

From c1e63cba7d618b3c39ad3766012ff5e9e6a0b770 Mon Sep 17 00:00:00 2001
From: Eric Haberkorn <erichaberkorn@gmail.com>
Date: Wed, 26 Apr 2023 10:00:18 -0400
Subject: [PATCH 18/92] add sameness intentions in api package (#17096)

---
 api/config_entry_intentions.go | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/api/config_entry_intentions.go b/api/config_entry_intentions.go
index d26fddda6581..3f03b0875b9c 100644
--- a/api/config_entry_intentions.go
+++ b/api/config_entry_intentions.go
@@ -21,15 +21,16 @@ type ServiceIntentionsConfigEntry struct {
 }
 
 type SourceIntention struct {
-	Name        string
-	Peer        string                 `json:",omitempty"`
-	Partition   string                 `json:",omitempty"`
-	Namespace   string                 `json:",omitempty"`
-	Action      IntentionAction        `json:",omitempty"`
-	Permissions []*IntentionPermission `json:",omitempty"`
-	Precedence  int
-	Type        IntentionSourceType
-	Description string `json:",omitempty"`
+	Name          string
+	Peer          string                 `json:",omitempty"`
+	Partition     string                 `json:",omitempty"`
+	Namespace     string                 `json:",omitempty"`
+	SamenessGroup string                 `json:",omitempty" alias:"sameness_group"`
+	Action        IntentionAction        `json:",omitempty"`
+	Permissions   []*IntentionPermission `json:",omitempty"`
+	Precedence    int
+	Type          IntentionSourceType
+	Description   string `json:",omitempty"`
 
 	LegacyID         string            `json:",omitempty" alias:"legacy_id"`
 	LegacyMeta       map[string]string `json:",omitempty" alias:"legacy_meta"`

From a87115c59815aeb2451801fde6684ab560a50f5d Mon Sep 17 00:00:00 2001
From: Eric Haberkorn <erichaberkorn@gmail.com>
Date: Wed, 26 Apr 2023 10:57:35 -0400
Subject: [PATCH 19/92] add acl filter logs (#17143)

---
 agent/structs/aclfilter/filter.go | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/agent/structs/aclfilter/filter.go b/agent/structs/aclfilter/filter.go
index e990732e050f..ddd63db10e68 100644
--- a/agent/structs/aclfilter/filter.go
+++ b/agent/structs/aclfilter/filter.go
@@ -258,7 +258,10 @@ func (f *Filter) filterServiceNodes(nodes *structs.ServiceNodes) bool {
 			continue
 		}
 		removed = true
-		f.logger.Debug("dropping node from result due to ACLs", "node", structs.NodeNameString(node.Node, &node.EnterpriseMeta))
+		node.CompoundServiceID()
+		f.logger.Debug("dropping service node from result due to ACLs",
+			"node", structs.NodeNameString(node.Node, &node.EnterpriseMeta),
+			"service", node.CompoundServiceID())
 		sn = append(sn[:i], sn[i+1:]...)
 		i--
 	}
@@ -340,7 +343,9 @@ func (f *Filter) filterCheckServiceNodes(nodes *structs.CheckServiceNodes) bool
 		if node.CanRead(f.authorizer) == acl.Allow {
 			continue
 		}
-		f.logger.Debug("dropping node from result due to ACLs", "node", structs.NodeNameString(node.Node.Node, node.Node.GetEnterpriseMeta()))
+		f.logger.Debug("dropping check service node from result due to ACLs",
+			"node", structs.NodeNameString(node.Node.Node, node.Node.GetEnterpriseMeta()),
+			"service", node.Service.CompoundServiceID())
 		removed = true
 		csn = append(csn[:i], csn[i+1:]...)
 		i--

From c501da01ebf6e82b661cb1ec05e9e925db2a40ee Mon Sep 17 00:00:00 2001
From: "R.B. Boyer" <4903+rboyer@users.noreply.github.com>
Date: Wed, 26 Apr 2023 10:01:17 -0500
Subject: [PATCH 20/92] api: ensure empty locality field is not transmitted to
 Consul (#17137)

---
 api/catalog.go | 4 ++--
 api/peering.go | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/api/catalog.go b/api/catalog.go
index 8f9c6567ac33..0040ca6e7a85 100644
--- a/api/catalog.go
+++ b/api/catalog.go
@@ -78,8 +78,8 @@ type CatalogRegistration struct {
 	Check           *AgentCheck
 	Checks          HealthChecks
 	SkipNodeUpdate  bool
-	Partition       string `json:",omitempty"`
-	Locality        *Locality
+	Partition       string    `json:",omitempty"`
+	Locality        *Locality `json:",omitempty"`
 }
 
 type CatalogDeregistration struct {
diff --git a/api/peering.go b/api/peering.go
index 352d224fe60b..dd7780f630a6 100644
--- a/api/peering.go
+++ b/api/peering.go
@@ -47,7 +47,7 @@ type PeeringRemoteInfo struct {
 	Partition string
 	// Datacenter is the remote peer's datacenter.
 	Datacenter string
-	Locality   *Locality
+	Locality   *Locality `json:",omitempty"`
 }
 
 // Locality identifies where a given entity is running.

From cd1837388a26cabee20b62af5cd2d5f51843c0ec Mon Sep 17 00:00:00 2001
From: Eric Haberkorn <erichaberkorn@gmail.com>
Date: Wed, 26 Apr 2023 11:02:20 -0400
Subject: [PATCH 21/92] fix backward compat issue caused by localities being
 set to `null` when they are unset (#17144)


From 75669ed4c486b10e8fe54c61979148f465f18cdd Mon Sep 17 00:00:00 2001
From: Dan Upton <daniel@floppy.co>
Date: Wed, 26 Apr 2023 16:26:54 +0100
Subject: [PATCH 22/92] proto-public: document resource service (#17119)

---
 proto-public/pbresource/resource.pb.binary.go |  20 +-
 proto-public/pbresource/resource.pb.go        | 659 +++++++++++-------
 proto-public/pbresource/resource.proto        | 292 +++++++-
 proto-public/pbresource/resource_grpc.pb.go   | 122 ++++
 4 files changed, 816 insertions(+), 277 deletions(-)

diff --git a/proto-public/pbresource/resource.pb.binary.go b/proto-public/pbresource/resource.pb.binary.go
index 00bf89d498c4..e12f33fb6da9 100644
--- a/proto-public/pbresource/resource.pb.binary.go
+++ b/proto-public/pbresource/resource.pb.binary.go
@@ -77,16 +77,6 @@ func (msg *Reference) UnmarshalBinary(b []byte) error {
 	return proto.Unmarshal(b, msg)
 }
 
-// MarshalBinary implements encoding.BinaryMarshaler
-func (msg *WatchEvent) MarshalBinary() ([]byte, error) {
-	return proto.Marshal(msg)
-}
-
-// UnmarshalBinary implements encoding.BinaryUnmarshaler
-func (msg *WatchEvent) UnmarshalBinary(b []byte) error {
-	return proto.Unmarshal(b, msg)
-}
-
 // MarshalBinary implements encoding.BinaryMarshaler
 func (msg *ReadRequest) MarshalBinary() ([]byte, error) {
 	return proto.Marshal(msg)
@@ -196,3 +186,13 @@ func (msg *WatchListRequest) MarshalBinary() ([]byte, error) {
 func (msg *WatchListRequest) UnmarshalBinary(b []byte) error {
 	return proto.Unmarshal(b, msg)
 }
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *WatchEvent) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *WatchEvent) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
diff --git a/proto-public/pbresource/resource.pb.go b/proto-public/pbresource/resource.pb.go
index 5cccb46c5de0..488dbdb8242f 100644
--- a/proto-public/pbresource/resource.pb.go
+++ b/proto-public/pbresource/resource.pb.go
@@ -25,13 +25,18 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
+// State represents the state of the condition (i.e. true/false/unknown).
 type Condition_State int32
 
 const (
+	// STATE_UNKNOWN means that the state of the condition is unknown.
+	//
 	// buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
 	Condition_STATE_UNKNOWN Condition_State = 0
-	Condition_STATE_TRUE    Condition_State = 1
-	Condition_STATE_FALSE   Condition_State = 2
+	// STATE_TRUE means that the state of the condition is true.
+	Condition_STATE_TRUE Condition_State = 1
+	// STATE_FALSE means that the state of the condition is false.
+	Condition_STATE_FALSE Condition_State = 2
 )
 
 // Enum value maps for Condition_State.
@@ -75,12 +80,19 @@ func (Condition_State) EnumDescriptor() ([]byte, []int) {
 	return file_pbresource_resource_proto_rawDescGZIP(), []int{5, 0}
 }
 
+// Operation describes the type of event.
 type WatchEvent_Operation int32
 
 const (
+	// OPERATION_UNSPECIFIED is the default/zero value. You should not see it
+	// in practice.
 	WatchEvent_OPERATION_UNSPECIFIED WatchEvent_Operation = 0
-	WatchEvent_OPERATION_UPSERT      WatchEvent_Operation = 1
-	WatchEvent_OPERATION_DELETE      WatchEvent_Operation = 2
+	// OPERATION_UPSERT indicates that the resource was written (i.e. created or
+	// updated). All events from the initial state-of-the-world will be upsert
+	// events.
+	WatchEvent_OPERATION_UPSERT WatchEvent_Operation = 1
+	// OPERATION_DELETED indicates that the resource was deleted.
+	WatchEvent_OPERATION_DELETE WatchEvent_Operation = 2
 )
 
 // Enum value maps for WatchEvent_Operation.
@@ -121,17 +133,25 @@ func (x WatchEvent_Operation) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use WatchEvent_Operation.Descriptor instead.
 func (WatchEvent_Operation) EnumDescriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{7, 0}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{18, 0}
 }
 
+// Type describes a resource's type. It follows the GVK (Group Version Kind)
+// [pattern](https://book.kubebuilder.io/cronjob-tutorial/gvks.html) established
+// by Kubernetes.
 type Type struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Group        string `protobuf:"bytes,1,opt,name=group,proto3" json:"group,omitempty"`
+	// Group describes the area of functionality to which this resource type
+	// relates (e.g. "catalog", "authorization").
+	Group string `protobuf:"bytes,1,opt,name=group,proto3" json:"group,omitempty"`
+	// GroupVersion is incremented when sweeping or backward-incompatible changes
+	// are made to the group's resource types.
 	GroupVersion string `protobuf:"bytes,2,opt,name=group_version,json=groupVersion,proto3" json:"group_version,omitempty"`
-	Kind         string `protobuf:"bytes,3,opt,name=kind,proto3" json:"kind,omitempty"`
+	// Kind identifies the specific resource type within the group.
+	Kind string `protobuf:"bytes,3,opt,name=kind,proto3" json:"kind,omitempty"`
 }
 
 func (x *Type) Reset() {
@@ -187,14 +207,30 @@ func (x *Type) GetKind() string {
 	return ""
 }
 
+// Tenancy describes the tenancy units in which the resource resides.
 type Tenancy struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
+	// Partition is the topmost administrative boundary within a cluster.
+	// https://developer.hashicorp.com/consul/docs/enterprise/admin-partitions
+	//
+	// When using the List and WatchList endpoints, provide the wildcard value "*"
+	// to list resources across all partitions.
 	Partition string `protobuf:"bytes,1,opt,name=partition,proto3" json:"partition,omitempty"`
+	// Namespace further isolates resources within a partition.
+	// https://developer.hashicorp.com/consul/docs/enterprise/namespaces
+	//
+	// When using the List and WatchList endpoints, provide the wildcard value "*"
+	// to list resources across all namespaces.
 	Namespace string `protobuf:"bytes,2,opt,name=namespace,proto3" json:"namespace,omitempty"`
-	PeerName  string `protobuf:"bytes,3,opt,name=peer_name,json=peerName,proto3" json:"peer_name,omitempty"`
+	// PeerName identifies which peer the resource is imported from.
+	// https://developer.hashicorp.com/consul/docs/connect/cluster-peering
+	//
+	// When using the List and WatchList endpoints, provide the wildcard value "*"
+	// to list resources across all peers.
+	PeerName string `protobuf:"bytes,3,opt,name=peer_name,json=peerName,proto3" json:"peer_name,omitempty"`
 }
 
 func (x *Tenancy) Reset() {
@@ -250,14 +286,26 @@ func (x *Tenancy) GetPeerName() string {
 	return ""
 }
 
+// ID uniquely identifies a resource.
 type ID struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Uid     string   `protobuf:"bytes,1,opt,name=uid,proto3" json:"uid,omitempty"`
-	Name    string   `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
-	Type    *Type    `protobuf:"bytes,3,opt,name=type,proto3" json:"type,omitempty"`
+	// Uid is the unique internal identifier we gave to the resource.
+	//
+	// It is primarily used to tell the difference between the current resource
+	// and previous deleted resources with the same user-given name.
+	//
+	// Concretely, Uid is a [ULID](https://github.com/ulid/spec) and you can treat
+	// its timestamp component as the resource's creation time.
+	Uid string `protobuf:"bytes,1,opt,name=uid,proto3" json:"uid,omitempty"`
+	// Name is the user-given name of the resource (e.g. the "billing" service).
+	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	// Type identifies the resource's type.
+	Type *Type `protobuf:"bytes,3,opt,name=type,proto3" json:"type,omitempty"`
+	// Tenancy identifies the tenancy units (i.e. partition, namespace) in which
+	// the resource resides.
 	Tenancy *Tenancy `protobuf:"bytes,4,opt,name=tenancy,proto3" json:"tenancy,omitempty"`
 }
 
@@ -321,18 +369,44 @@ func (x *ID) GetTenancy() *Tenancy {
 	return nil
 }
 
+// Resource describes a resource of a known type managed by Consul.
 type Resource struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Id         *ID                `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-	Owner      *ID                `protobuf:"bytes,2,opt,name=owner,proto3" json:"owner,omitempty"`
-	Version    string             `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
-	Generation string             `protobuf:"bytes,4,opt,name=generation,proto3" json:"generation,omitempty"`
-	Metadata   map[string]string  `protobuf:"bytes,5,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-	Status     map[string]*Status `protobuf:"bytes,6,rep,name=status,proto3" json:"status,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-	Data       *anypb.Any         `protobuf:"bytes,7,opt,name=data,proto3" json:"data,omitempty"`
+	// ID uniquely identifies the resource.
+	Id *ID `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// Owner (optionally) describes which resource "owns" this resource, it is
+	// immutable and can only be set on resource creation. Owned resources will
+	// be automatically deleted when their owner is deleted.
+	Owner *ID `protobuf:"bytes,2,opt,name=owner,proto3" json:"owner,omitempty"`
+	// Version is the low-level version identifier used by the storage backend
+	// in CAS (Compare-And-Swap) operations. It will change when the resource is
+	// modified in any way, including status updates.
+	//
+	// When calling the Write endpoint, providing a non-blank version will perform
+	// a CAS (Compare-And-Swap) write, which will result in an Aborted error code
+	// if the given version doesn't match what is stored.
+	Version string `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
+	// Generation is incremented whenever the resource's content (i.e. not its
+	// status) is modified. You can think of it as being the "user version".
+	//
+	// Concretely, Generation is a [ULID](https://github.com/ulid/spec) and you
+	// can treat its timestamp component as the resource's modification time.
+	Generation string `protobuf:"bytes,4,opt,name=generation,proto3" json:"generation,omitempty"`
+	// Metadata contains key/value pairs of arbitrary metadata about the resource.
+	Metadata map[string]string `protobuf:"bytes,5,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// Status is used by controllers to communicate the result of attempting to
+	// reconcile and apply the resource (e.g. surface semantic validation errors)
+	// with users and other controllers. Each status is identified by a unique key
+	// and should only ever be updated by one controller.
+	//
+	// Status can only be updated via the WriteStatus endpoint. Attempting to do
+	// so via the Write endpoint will result in an InvalidArgument error code.
+	Status map[string]*Status `protobuf:"bytes,6,rep,name=status,proto3" json:"status,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// Data contains the resource's type-specific content.
+	Data *anypb.Any `protobuf:"bytes,7,opt,name=data,proto3" json:"data,omitempty"`
 }
 
 func (x *Resource) Reset() {
@@ -416,13 +490,21 @@ func (x *Resource) GetData() *anypb.Any {
 	return nil
 }
 
+// Status is used by controllers to communicate the result of attempting to
+// reconcile and apply a resource (e.g. surface semantic validation errors)
+// with users and other controllers.
 type Status struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	ObservedGeneration string       `protobuf:"bytes,1,opt,name=observed_generation,json=observedGeneration,proto3" json:"observed_generation,omitempty"`
-	Conditions         []*Condition `protobuf:"bytes,2,rep,name=conditions,proto3" json:"conditions,omitempty"`
+	// ObservedGeneration identifies which generation of a resource this status
+	// related to. It can be used to determine whether the current generation of
+	// a resource has been reconciled.
+	ObservedGeneration string `protobuf:"bytes,1,opt,name=observed_generation,json=observedGeneration,proto3" json:"observed_generation,omitempty"`
+	// Conditions contains a set of discreet observations about the resource in
+	// relation to the current state of the system (e.g. it is semantically valid).
+	Conditions []*Condition `protobuf:"bytes,2,rep,name=conditions,proto3" json:"conditions,omitempty"`
 }
 
 func (x *Status) Reset() {
@@ -471,16 +553,28 @@ func (x *Status) GetConditions() []*Condition {
 	return nil
 }
 
+// Condition represents a discreet observation about a resource in relation to
+// the current state of the system.
+//
+// It is heavily inspired by Kubernetes' [conditions](https://bit.ly/3H9Y6IK)
+// and the Gateway API [types and reasons](https://bit.ly/3n2PPiP).
 type Condition struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Type     string          `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
-	State    Condition_State `protobuf:"varint,2,opt,name=state,proto3,enum=hashicorp.consul.resource.Condition_State" json:"state,omitempty"`
-	Reason   string          `protobuf:"bytes,3,opt,name=reason,proto3" json:"reason,omitempty"`
-	Message  string          `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"`
-	Resource *Reference      `protobuf:"bytes,5,opt,name=resource,proto3" json:"resource,omitempty"`
+	// Type identifies the type of condition (e.g. "Invalid", "ResolvedRefs").
+	Type string `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
+	// State represents the state of the condition (i.e. true/false/unknown).
+	State Condition_State `protobuf:"varint,2,opt,name=state,proto3,enum=hashicorp.consul.resource.Condition_State" json:"state,omitempty"`
+	// Reason provides more machine-readable details about the condition (e.g.
+	// "InvalidProtocol").
+	Reason string `protobuf:"bytes,3,opt,name=reason,proto3" json:"reason,omitempty"`
+	// Message contains a human-friendly description of the status.
+	Message string `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"`
+	// Resource identifies which resource this condition relates to, when it is
+	// not the core resource itself.
+	Resource *Reference `protobuf:"bytes,5,opt,name=resource,proto3" json:"resource,omitempty"`
 }
 
 func (x *Condition) Reset() {
@@ -550,15 +644,22 @@ func (x *Condition) GetResource() *Reference {
 	return nil
 }
 
+// Reference identifies which resource a condition relates to, when it is not
+// the core resource itself.
 type Reference struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Type    *Type    `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
+	// Type identifies the resource's type.
+	Type *Type `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
+	// Tenancy identifies the tenancy units (i.e. partition, namespace) in which
+	// the resource resides.
 	Tenancy *Tenancy `protobuf:"bytes,2,opt,name=tenancy,proto3" json:"tenancy,omitempty"`
-	Name    string   `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
-	Section string   `protobuf:"bytes,4,opt,name=section,proto3" json:"section,omitempty"`
+	// Name is the user-given name of the resource (e.g. the "billing" service).
+	Name string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
+	// Section identifies which part of the resource the condition relates to.
+	Section string `protobuf:"bytes,4,opt,name=section,proto3" json:"section,omitempty"`
 }
 
 func (x *Reference) Reset() {
@@ -621,73 +722,20 @@ func (x *Reference) GetSection() string {
 	return ""
 }
 
-type WatchEvent struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Operation WatchEvent_Operation `protobuf:"varint,1,opt,name=operation,proto3,enum=hashicorp.consul.resource.WatchEvent_Operation" json:"operation,omitempty"`
-	Resource  *Resource            `protobuf:"bytes,2,opt,name=resource,proto3" json:"resource,omitempty"`
-}
-
-func (x *WatchEvent) Reset() {
-	*x = WatchEvent{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *WatchEvent) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*WatchEvent) ProtoMessage() {}
-
-func (x *WatchEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[7]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use WatchEvent.ProtoReflect.Descriptor instead.
-func (*WatchEvent) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{7}
-}
-
-func (x *WatchEvent) GetOperation() WatchEvent_Operation {
-	if x != nil {
-		return x.Operation
-	}
-	return WatchEvent_OPERATION_UNSPECIFIED
-}
-
-func (x *WatchEvent) GetResource() *Resource {
-	if x != nil {
-		return x.Resource
-	}
-	return nil
-}
-
+// ReadRequest contains the parameters to the Read endpoint.
 type ReadRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
+	// ID of the resource.
 	Id *ID `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
 }
 
 func (x *ReadRequest) Reset() {
 	*x = ReadRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[8]
+		mi := &file_pbresource_resource_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -700,7 +748,7 @@ func (x *ReadRequest) String() string {
 func (*ReadRequest) ProtoMessage() {}
 
 func (x *ReadRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[8]
+	mi := &file_pbresource_resource_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -713,7 +761,7 @@ func (x *ReadRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReadRequest.ProtoReflect.Descriptor instead.
 func (*ReadRequest) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{8}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *ReadRequest) GetId() *ID {
@@ -723,18 +771,20 @@ func (x *ReadRequest) GetId() *ID {
 	return nil
 }
 
+// ReadResponse contains the results of calling the Read endpoint.
 type ReadResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
+	// Resource that was read.
 	Resource *Resource `protobuf:"bytes,1,opt,name=resource,proto3" json:"resource,omitempty"`
 }
 
 func (x *ReadResponse) Reset() {
 	*x = ReadResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[9]
+		mi := &file_pbresource_resource_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -747,7 +797,7 @@ func (x *ReadResponse) String() string {
 func (*ReadResponse) ProtoMessage() {}
 
 func (x *ReadResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[9]
+	mi := &file_pbresource_resource_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -760,7 +810,7 @@ func (x *ReadResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReadResponse.ProtoReflect.Descriptor instead.
 func (*ReadResponse) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{9}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *ReadResponse) GetResource() *Resource {
@@ -770,20 +820,26 @@ func (x *ReadResponse) GetResource() *Resource {
 	return nil
 }
 
+// ListRequest contains the parameters to the List endpoint.
 type ListRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Type       *Type    `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
-	Tenancy    *Tenancy `protobuf:"bytes,2,opt,name=tenancy,proto3" json:"tenancy,omitempty"`
-	NamePrefix string   `protobuf:"bytes,3,opt,name=name_prefix,json=namePrefix,proto3" json:"name_prefix,omitempty"`
+	// Type of resource to list.
+	Type *Type `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
+	// Tenancy units in which to list resources. To list resources in all units,
+	// provide the wildcard "*" value.
+	Tenancy *Tenancy `protobuf:"bytes,2,opt,name=tenancy,proto3" json:"tenancy,omitempty"`
+	// NamePrefix filters the results to those with a name beginning with the
+	// given prefix.
+	NamePrefix string `protobuf:"bytes,3,opt,name=name_prefix,json=namePrefix,proto3" json:"name_prefix,omitempty"`
 }
 
 func (x *ListRequest) Reset() {
 	*x = ListRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[10]
+		mi := &file_pbresource_resource_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -796,7 +852,7 @@ func (x *ListRequest) String() string {
 func (*ListRequest) ProtoMessage() {}
 
 func (x *ListRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[10]
+	mi := &file_pbresource_resource_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -809,7 +865,7 @@ func (x *ListRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListRequest.ProtoReflect.Descriptor instead.
 func (*ListRequest) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{10}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *ListRequest) GetType() *Type {
@@ -833,18 +889,20 @@ func (x *ListRequest) GetNamePrefix() string {
 	return ""
 }
 
+// ListResponse contains the results of calling the List endpoint.
 type ListResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
+	// Resources that were listed.
 	Resources []*Resource `protobuf:"bytes,1,rep,name=resources,proto3" json:"resources,omitempty"`
 }
 
 func (x *ListResponse) Reset() {
 	*x = ListResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[11]
+		mi := &file_pbresource_resource_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -857,7 +915,7 @@ func (x *ListResponse) String() string {
 func (*ListResponse) ProtoMessage() {}
 
 func (x *ListResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[11]
+	mi := &file_pbresource_resource_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -870,7 +928,7 @@ func (x *ListResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListResponse.ProtoReflect.Descriptor instead.
 func (*ListResponse) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{11}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *ListResponse) GetResources() []*Resource {
@@ -880,18 +938,20 @@ func (x *ListResponse) GetResources() []*Resource {
 	return nil
 }
 
+// WriteRequest contains the parameters to the Write endpoint.
 type WriteRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
+	// Resource to write.
 	Resource *Resource `protobuf:"bytes,1,opt,name=resource,proto3" json:"resource,omitempty"`
 }
 
 func (x *WriteRequest) Reset() {
 	*x = WriteRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[12]
+		mi := &file_pbresource_resource_proto_msgTypes[11]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -904,7 +964,7 @@ func (x *WriteRequest) String() string {
 func (*WriteRequest) ProtoMessage() {}
 
 func (x *WriteRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[12]
+	mi := &file_pbresource_resource_proto_msgTypes[11]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -917,7 +977,7 @@ func (x *WriteRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WriteRequest.ProtoReflect.Descriptor instead.
 func (*WriteRequest) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{12}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *WriteRequest) GetResource() *Resource {
@@ -927,18 +987,20 @@ func (x *WriteRequest) GetResource() *Resource {
 	return nil
 }
 
+// WriteResponse contains the results of calling the Write endpoint.
 type WriteResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
+	// Resource that was written.
 	Resource *Resource `protobuf:"bytes,1,opt,name=resource,proto3" json:"resource,omitempty"`
 }
 
 func (x *WriteResponse) Reset() {
 	*x = WriteResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[13]
+		mi := &file_pbresource_resource_proto_msgTypes[12]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -951,7 +1013,7 @@ func (x *WriteResponse) String() string {
 func (*WriteResponse) ProtoMessage() {}
 
 func (x *WriteResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[13]
+	mi := &file_pbresource_resource_proto_msgTypes[12]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -964,7 +1026,7 @@ func (x *WriteResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WriteResponse.ProtoReflect.Descriptor instead.
 func (*WriteResponse) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{13}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *WriteResponse) GetResource() *Resource {
@@ -974,21 +1036,34 @@ func (x *WriteResponse) GetResource() *Resource {
 	return nil
 }
 
+// WriteStatusRequest contains the parameters to the WriteStatus endpoint.
 type WriteStatusRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Id      *ID     `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-	Version string  `protobuf:"bytes,2,opt,name=version,proto3" json:"version,omitempty"`
-	Key     string  `protobuf:"bytes,3,opt,name=key,proto3" json:"key,omitempty"`
-	Status  *Status `protobuf:"bytes,4,opt,name=status,proto3" json:"status,omitempty"`
+	// ID of the resource to which the status will be written. Must contain a Uid.
+	Id *ID `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// Version may be provided to perform a CAS (Compare-And-Swap) update of the
+	// status. If the given version doesn't match what is currently stored, an
+	// Aborted error code will be returned.
+	//
+	// Note: in most cases, CAS status updates are not necessary because updates
+	// are scoped to a specific status key and controllers are leader-elected so
+	// there is no chance of a conflict.
+	Version string `protobuf:"bytes,2,opt,name=version,proto3" json:"version,omitempty"`
+	// Key identifies which status will be written. Generally, each controller
+	// should write 1 status which it owns exclusively (i.e. no other controller
+	// updates it).
+	Key string `protobuf:"bytes,3,opt,name=key,proto3" json:"key,omitempty"`
+	// Status that will be written to the resource.
+	Status *Status `protobuf:"bytes,4,opt,name=status,proto3" json:"status,omitempty"`
 }
 
 func (x *WriteStatusRequest) Reset() {
 	*x = WriteStatusRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[14]
+		mi := &file_pbresource_resource_proto_msgTypes[13]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1001,7 +1076,7 @@ func (x *WriteStatusRequest) String() string {
 func (*WriteStatusRequest) ProtoMessage() {}
 
 func (x *WriteStatusRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[14]
+	mi := &file_pbresource_resource_proto_msgTypes[13]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1014,7 +1089,7 @@ func (x *WriteStatusRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WriteStatusRequest.ProtoReflect.Descriptor instead.
 func (*WriteStatusRequest) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{14}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *WriteStatusRequest) GetId() *ID {
@@ -1045,18 +1120,20 @@ func (x *WriteStatusRequest) GetStatus() *Status {
 	return nil
 }
 
+// WriteStatusResponse contains the results of calling the WriteStatus endpoint.
 type WriteStatusResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
+	// Resource to which the status was written.
 	Resource *Resource `protobuf:"bytes,1,opt,name=resource,proto3" json:"resource,omitempty"`
 }
 
 func (x *WriteStatusResponse) Reset() {
 	*x = WriteStatusResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[15]
+		mi := &file_pbresource_resource_proto_msgTypes[14]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1069,7 +1146,7 @@ func (x *WriteStatusResponse) String() string {
 func (*WriteStatusResponse) ProtoMessage() {}
 
 func (x *WriteStatusResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[15]
+	mi := &file_pbresource_resource_proto_msgTypes[14]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1082,7 +1159,7 @@ func (x *WriteStatusResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WriteStatusResponse.ProtoReflect.Descriptor instead.
 func (*WriteStatusResponse) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{15}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *WriteStatusResponse) GetResource() *Resource {
@@ -1092,19 +1169,24 @@ func (x *WriteStatusResponse) GetResource() *Resource {
 	return nil
 }
 
+// DeleteRequest contains the parameters to the Delete endpoint.
 type DeleteRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Id      *ID    `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// ID of the resource that will be deleted.
+	Id *ID `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// Version may be provided to perform a CAS (Compare-And-Swap) deletion of the
+	// resource. If the given version doesn't match what is currently stored, an
+	// Aborted error code will be returned.
 	Version string `protobuf:"bytes,2,opt,name=version,proto3" json:"version,omitempty"`
 }
 
 func (x *DeleteRequest) Reset() {
 	*x = DeleteRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[16]
+		mi := &file_pbresource_resource_proto_msgTypes[15]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1117,7 +1199,7 @@ func (x *DeleteRequest) String() string {
 func (*DeleteRequest) ProtoMessage() {}
 
 func (x *DeleteRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[16]
+	mi := &file_pbresource_resource_proto_msgTypes[15]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1130,7 +1212,7 @@ func (x *DeleteRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteRequest.ProtoReflect.Descriptor instead.
 func (*DeleteRequest) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{16}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *DeleteRequest) GetId() *ID {
@@ -1147,6 +1229,7 @@ func (x *DeleteRequest) GetVersion() string {
 	return ""
 }
 
+// DeleteResponse contains the results of calling the Delete endpoint.
 type DeleteResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -1156,7 +1239,7 @@ type DeleteResponse struct {
 func (x *DeleteResponse) Reset() {
 	*x = DeleteResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[17]
+		mi := &file_pbresource_resource_proto_msgTypes[16]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1169,7 +1252,7 @@ func (x *DeleteResponse) String() string {
 func (*DeleteResponse) ProtoMessage() {}
 
 func (x *DeleteResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[17]
+	mi := &file_pbresource_resource_proto_msgTypes[16]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1182,23 +1265,29 @@ func (x *DeleteResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteResponse.ProtoReflect.Descriptor instead.
 func (*DeleteResponse) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{17}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{16}
 }
 
+// WatchListRequest contains the parameters to the WatchList endpoint.
 type WatchListRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Type       *Type    `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
-	Tenancy    *Tenancy `protobuf:"bytes,2,opt,name=tenancy,proto3" json:"tenancy,omitempty"`
-	NamePrefix string   `protobuf:"bytes,3,opt,name=name_prefix,json=namePrefix,proto3" json:"name_prefix,omitempty"`
+	// Type of resource to watch.
+	Type *Type `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
+	// Tenancy units in which to watch resources. To list resources in all units,
+	// provide the wildcard "*" value.
+	Tenancy *Tenancy `protobuf:"bytes,2,opt,name=tenancy,proto3" json:"tenancy,omitempty"`
+	// NamePrefix filters the results to those with a name beginning with the
+	// given prefix.
+	NamePrefix string `protobuf:"bytes,3,opt,name=name_prefix,json=namePrefix,proto3" json:"name_prefix,omitempty"`
 }
 
 func (x *WatchListRequest) Reset() {
 	*x = WatchListRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[18]
+		mi := &file_pbresource_resource_proto_msgTypes[17]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1211,7 +1300,7 @@ func (x *WatchListRequest) String() string {
 func (*WatchListRequest) ProtoMessage() {}
 
 func (x *WatchListRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[18]
+	mi := &file_pbresource_resource_proto_msgTypes[17]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1224,7 +1313,7 @@ func (x *WatchListRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WatchListRequest.ProtoReflect.Descriptor instead.
 func (*WatchListRequest) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{18}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *WatchListRequest) GetType() *Type {
@@ -1248,6 +1337,64 @@ func (x *WatchListRequest) GetNamePrefix() string {
 	return ""
 }
 
+// WatchEvent is emitted on the WatchList stream when a resource changes.
+type WatchEvent struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Operation describes the type of event.
+	Operation WatchEvent_Operation `protobuf:"varint,1,opt,name=operation,proto3,enum=hashicorp.consul.resource.WatchEvent_Operation" json:"operation,omitempty"`
+	// Resource the event relates to.
+	Resource *Resource `protobuf:"bytes,2,opt,name=resource,proto3" json:"resource,omitempty"`
+}
+
+func (x *WatchEvent) Reset() {
+	*x = WatchEvent{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbresource_resource_proto_msgTypes[18]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WatchEvent) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WatchEvent) ProtoMessage() {}
+
+func (x *WatchEvent) ProtoReflect() protoreflect.Message {
+	mi := &file_pbresource_resource_proto_msgTypes[18]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WatchEvent.ProtoReflect.Descriptor instead.
+func (*WatchEvent) Descriptor() ([]byte, []int) {
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{18}
+}
+
+func (x *WatchEvent) GetOperation() WatchEvent_Operation {
+	if x != nil {
+		return x.Operation
+	}
+	return WatchEvent_OPERATION_UNSPECIFIED
+}
+
+func (x *WatchEvent) GetResource() *Resource {
+	if x != nil {
+		return x.Resource
+	}
+	return nil
+}
+
 var File_pbresource_resource_proto protoreflect.FileDescriptor
 
 var file_pbresource_resource_proto_rawDesc = []byte{
@@ -1349,90 +1496,90 @@ var file_pbresource_resource_proto_rawDesc = []byte{
 	0x63, 0x79, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
 	0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x65, 0x63, 0x74, 0x69, 0x6f,
 	0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x22, 0xf0, 0x01, 0x0a, 0x0a, 0x57, 0x61, 0x74, 0x63, 0x68, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12,
-	0x4d, 0x0a, 0x09, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0e, 0x32, 0x2f, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
-	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x57,
-	0x61, 0x74, 0x63, 0x68, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x2e, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x09, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3f,
-	0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
+	0x22, 0x3c, 0x0a, 0x0b, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x02, 0x69, 0x64, 0x22, 0x4f,
+	0x0a, 0x0c, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f,
+	0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
 	0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
 	0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73,
 	0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22,
-	0x52, 0x0a, 0x09, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x19, 0x0a, 0x15,
-	0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43,
-	0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x14, 0x0a, 0x10, 0x4f, 0x50, 0x45, 0x52, 0x41,
-	0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x50, 0x53, 0x45, 0x52, 0x54, 0x10, 0x01, 0x12, 0x14, 0x0a,
-	0x10, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x44, 0x45, 0x4c, 0x45, 0x54,
-	0x45, 0x10, 0x02, 0x22, 0x3c, 0x0a, 0x0b, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d,
-	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
-	0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x02, 0x69,
-	0x64, 0x22, 0x4f, 0x0a, 0x0c, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
-	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e,
-	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x22, 0xa1, 0x01, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x33, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x1f, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
-	0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x54, 0x79, 0x70,
-	0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x3c, 0x0a, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e,
-	0x63, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
+	0xa1, 0x01, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x33, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e,
+	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04,
+	0x74, 0x79, 0x70, 0x65, 0x12, 0x3c, 0x0a, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x2e, 0x54, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x52, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e,
+	0x63, 0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69,
+	0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x72, 0x65,
+	0x66, 0x69, 0x78, 0x22, 0x51, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x41, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
+	0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x09, 0x72, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x22, 0x4f, 0x0a, 0x0c, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
 	0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x2e, 0x54, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x52, 0x07, 0x74, 0x65,
-	0x6e, 0x61, 0x6e, 0x63, 0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x72,
-	0x65, 0x66, 0x69, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x61, 0x6d, 0x65,
-	0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x22, 0x51, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x41, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68,
-	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x09,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x22, 0x4f, 0x0a, 0x0c, 0x57, 0x72, 0x69,
-	0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61,
+	0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x50, 0x0a, 0x0d, 0x57, 0x72, 0x69, 0x74, 0x65,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52,
+	0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0xaa, 0x01, 0x0a, 0x12, 0x57, 0x72,
+	0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x02, 0x69, 0x64, 0x12,
+	0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x39, 0x0a, 0x06, 0x73,
+	0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x68, 0x61,
 	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x50, 0x0a, 0x0d, 0x57, 0x72,
-	0x69, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a, 0x08, 0x72,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06,
+	0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x56, 0x0a, 0x13, 0x57, 0x72, 0x69, 0x74, 0x65, 0x53,
+	0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a,
+	0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x58,
+	0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x02, 0x69, 0x64, 0x12, 0x18,
+	0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x10, 0x0a, 0x0e, 0x44, 0x65, 0x6c, 0x65,
+	0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xa6, 0x01, 0x0a, 0x10, 0x57,
+	0x61, 0x74, 0x63, 0x68, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x33, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e,
 	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
-	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0xaa, 0x01, 0x0a,
-	0x12, 0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x1d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
-	0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x02,
-	0x69, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x10, 0x0a, 0x03,
-	0x6b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x39,
-	0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21,
-	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
-	0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75,
-	0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x56, 0x0a, 0x13, 0x57, 0x72, 0x69,
-	0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
-	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x22, 0x58, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d,
-	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
-	0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x02, 0x69,
-	0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x10, 0x0a, 0x0e, 0x44,
-	0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xa6, 0x01,
-	0x0a, 0x10, 0x57, 0x61, 0x74, 0x63, 0x68, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x33, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x1f, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
-	0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x54, 0x79, 0x70,
-	0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x3c, 0x0a, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e,
-	0x63, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
-	0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x2e, 0x54, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x52, 0x07, 0x74, 0x65,
-	0x6e, 0x61, 0x6e, 0x63, 0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x72,
-	0x65, 0x66, 0x69, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x61, 0x6d, 0x65,
-	0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x32, 0x8b, 0x05, 0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75,
+	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04,
+	0x74, 0x79, 0x70, 0x65, 0x12, 0x3c, 0x0a, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x2e, 0x54, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x52, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e,
+	0x63, 0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69,
+	0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x72, 0x65,
+	0x66, 0x69, 0x78, 0x22, 0xf0, 0x01, 0x0a, 0x0a, 0x57, 0x61, 0x74, 0x63, 0x68, 0x45, 0x76, 0x65,
+	0x6e, 0x74, 0x12, 0x4d, 0x0a, 0x09, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2f, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x2e, 0x57, 0x61, 0x74, 0x63, 0x68, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x2e, 0x4f, 0x70, 0x65,
+	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
+	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e,
+	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x22, 0x52, 0x0a, 0x09, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x19, 0x0a, 0x15, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53,
+	0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x14, 0x0a, 0x10, 0x4f, 0x50,
+	0x45, 0x52, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x50, 0x53, 0x45, 0x52, 0x54, 0x10, 0x01,
+	0x12, 0x14, 0x0a, 0x10, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x44, 0x45,
+	0x4c, 0x45, 0x54, 0x45, 0x10, 0x02, 0x32, 0x8b, 0x05, 0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75,
 	0x72, 0x63, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x61, 0x0a, 0x04, 0x52, 0x65,
 	0x61, 0x64, 0x12, 0x26, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
 	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52,
@@ -1515,18 +1662,18 @@ var file_pbresource_resource_proto_goTypes = []interface{}{
 	(*Status)(nil),              // 6: hashicorp.consul.resource.Status
 	(*Condition)(nil),           // 7: hashicorp.consul.resource.Condition
 	(*Reference)(nil),           // 8: hashicorp.consul.resource.Reference
-	(*WatchEvent)(nil),          // 9: hashicorp.consul.resource.WatchEvent
-	(*ReadRequest)(nil),         // 10: hashicorp.consul.resource.ReadRequest
-	(*ReadResponse)(nil),        // 11: hashicorp.consul.resource.ReadResponse
-	(*ListRequest)(nil),         // 12: hashicorp.consul.resource.ListRequest
-	(*ListResponse)(nil),        // 13: hashicorp.consul.resource.ListResponse
-	(*WriteRequest)(nil),        // 14: hashicorp.consul.resource.WriteRequest
-	(*WriteResponse)(nil),       // 15: hashicorp.consul.resource.WriteResponse
-	(*WriteStatusRequest)(nil),  // 16: hashicorp.consul.resource.WriteStatusRequest
-	(*WriteStatusResponse)(nil), // 17: hashicorp.consul.resource.WriteStatusResponse
-	(*DeleteRequest)(nil),       // 18: hashicorp.consul.resource.DeleteRequest
-	(*DeleteResponse)(nil),      // 19: hashicorp.consul.resource.DeleteResponse
-	(*WatchListRequest)(nil),    // 20: hashicorp.consul.resource.WatchListRequest
+	(*ReadRequest)(nil),         // 9: hashicorp.consul.resource.ReadRequest
+	(*ReadResponse)(nil),        // 10: hashicorp.consul.resource.ReadResponse
+	(*ListRequest)(nil),         // 11: hashicorp.consul.resource.ListRequest
+	(*ListResponse)(nil),        // 12: hashicorp.consul.resource.ListResponse
+	(*WriteRequest)(nil),        // 13: hashicorp.consul.resource.WriteRequest
+	(*WriteResponse)(nil),       // 14: hashicorp.consul.resource.WriteResponse
+	(*WriteStatusRequest)(nil),  // 15: hashicorp.consul.resource.WriteStatusRequest
+	(*WriteStatusResponse)(nil), // 16: hashicorp.consul.resource.WriteStatusResponse
+	(*DeleteRequest)(nil),       // 17: hashicorp.consul.resource.DeleteRequest
+	(*DeleteResponse)(nil),      // 18: hashicorp.consul.resource.DeleteResponse
+	(*WatchListRequest)(nil),    // 19: hashicorp.consul.resource.WatchListRequest
+	(*WatchEvent)(nil),          // 20: hashicorp.consul.resource.WatchEvent
 	nil,                         // 21: hashicorp.consul.resource.Resource.MetadataEntry
 	nil,                         // 22: hashicorp.consul.resource.Resource.StatusEntry
 	(*anypb.Any)(nil),           // 23: google.protobuf.Any
@@ -1544,34 +1691,34 @@ var file_pbresource_resource_proto_depIdxs = []int32{
 	8,  // 9: hashicorp.consul.resource.Condition.resource:type_name -> hashicorp.consul.resource.Reference
 	2,  // 10: hashicorp.consul.resource.Reference.type:type_name -> hashicorp.consul.resource.Type
 	3,  // 11: hashicorp.consul.resource.Reference.tenancy:type_name -> hashicorp.consul.resource.Tenancy
-	1,  // 12: hashicorp.consul.resource.WatchEvent.operation:type_name -> hashicorp.consul.resource.WatchEvent.Operation
-	5,  // 13: hashicorp.consul.resource.WatchEvent.resource:type_name -> hashicorp.consul.resource.Resource
-	4,  // 14: hashicorp.consul.resource.ReadRequest.id:type_name -> hashicorp.consul.resource.ID
-	5,  // 15: hashicorp.consul.resource.ReadResponse.resource:type_name -> hashicorp.consul.resource.Resource
-	2,  // 16: hashicorp.consul.resource.ListRequest.type:type_name -> hashicorp.consul.resource.Type
-	3,  // 17: hashicorp.consul.resource.ListRequest.tenancy:type_name -> hashicorp.consul.resource.Tenancy
-	5,  // 18: hashicorp.consul.resource.ListResponse.resources:type_name -> hashicorp.consul.resource.Resource
-	5,  // 19: hashicorp.consul.resource.WriteRequest.resource:type_name -> hashicorp.consul.resource.Resource
-	5,  // 20: hashicorp.consul.resource.WriteResponse.resource:type_name -> hashicorp.consul.resource.Resource
-	4,  // 21: hashicorp.consul.resource.WriteStatusRequest.id:type_name -> hashicorp.consul.resource.ID
-	6,  // 22: hashicorp.consul.resource.WriteStatusRequest.status:type_name -> hashicorp.consul.resource.Status
-	5,  // 23: hashicorp.consul.resource.WriteStatusResponse.resource:type_name -> hashicorp.consul.resource.Resource
-	4,  // 24: hashicorp.consul.resource.DeleteRequest.id:type_name -> hashicorp.consul.resource.ID
-	2,  // 25: hashicorp.consul.resource.WatchListRequest.type:type_name -> hashicorp.consul.resource.Type
-	3,  // 26: hashicorp.consul.resource.WatchListRequest.tenancy:type_name -> hashicorp.consul.resource.Tenancy
+	4,  // 12: hashicorp.consul.resource.ReadRequest.id:type_name -> hashicorp.consul.resource.ID
+	5,  // 13: hashicorp.consul.resource.ReadResponse.resource:type_name -> hashicorp.consul.resource.Resource
+	2,  // 14: hashicorp.consul.resource.ListRequest.type:type_name -> hashicorp.consul.resource.Type
+	3,  // 15: hashicorp.consul.resource.ListRequest.tenancy:type_name -> hashicorp.consul.resource.Tenancy
+	5,  // 16: hashicorp.consul.resource.ListResponse.resources:type_name -> hashicorp.consul.resource.Resource
+	5,  // 17: hashicorp.consul.resource.WriteRequest.resource:type_name -> hashicorp.consul.resource.Resource
+	5,  // 18: hashicorp.consul.resource.WriteResponse.resource:type_name -> hashicorp.consul.resource.Resource
+	4,  // 19: hashicorp.consul.resource.WriteStatusRequest.id:type_name -> hashicorp.consul.resource.ID
+	6,  // 20: hashicorp.consul.resource.WriteStatusRequest.status:type_name -> hashicorp.consul.resource.Status
+	5,  // 21: hashicorp.consul.resource.WriteStatusResponse.resource:type_name -> hashicorp.consul.resource.Resource
+	4,  // 22: hashicorp.consul.resource.DeleteRequest.id:type_name -> hashicorp.consul.resource.ID
+	2,  // 23: hashicorp.consul.resource.WatchListRequest.type:type_name -> hashicorp.consul.resource.Type
+	3,  // 24: hashicorp.consul.resource.WatchListRequest.tenancy:type_name -> hashicorp.consul.resource.Tenancy
+	1,  // 25: hashicorp.consul.resource.WatchEvent.operation:type_name -> hashicorp.consul.resource.WatchEvent.Operation
+	5,  // 26: hashicorp.consul.resource.WatchEvent.resource:type_name -> hashicorp.consul.resource.Resource
 	6,  // 27: hashicorp.consul.resource.Resource.StatusEntry.value:type_name -> hashicorp.consul.resource.Status
-	10, // 28: hashicorp.consul.resource.ResourceService.Read:input_type -> hashicorp.consul.resource.ReadRequest
-	14, // 29: hashicorp.consul.resource.ResourceService.Write:input_type -> hashicorp.consul.resource.WriteRequest
-	16, // 30: hashicorp.consul.resource.ResourceService.WriteStatus:input_type -> hashicorp.consul.resource.WriteStatusRequest
-	12, // 31: hashicorp.consul.resource.ResourceService.List:input_type -> hashicorp.consul.resource.ListRequest
-	18, // 32: hashicorp.consul.resource.ResourceService.Delete:input_type -> hashicorp.consul.resource.DeleteRequest
-	20, // 33: hashicorp.consul.resource.ResourceService.WatchList:input_type -> hashicorp.consul.resource.WatchListRequest
-	11, // 34: hashicorp.consul.resource.ResourceService.Read:output_type -> hashicorp.consul.resource.ReadResponse
-	15, // 35: hashicorp.consul.resource.ResourceService.Write:output_type -> hashicorp.consul.resource.WriteResponse
-	17, // 36: hashicorp.consul.resource.ResourceService.WriteStatus:output_type -> hashicorp.consul.resource.WriteStatusResponse
-	13, // 37: hashicorp.consul.resource.ResourceService.List:output_type -> hashicorp.consul.resource.ListResponse
-	19, // 38: hashicorp.consul.resource.ResourceService.Delete:output_type -> hashicorp.consul.resource.DeleteResponse
-	9,  // 39: hashicorp.consul.resource.ResourceService.WatchList:output_type -> hashicorp.consul.resource.WatchEvent
+	9,  // 28: hashicorp.consul.resource.ResourceService.Read:input_type -> hashicorp.consul.resource.ReadRequest
+	13, // 29: hashicorp.consul.resource.ResourceService.Write:input_type -> hashicorp.consul.resource.WriteRequest
+	15, // 30: hashicorp.consul.resource.ResourceService.WriteStatus:input_type -> hashicorp.consul.resource.WriteStatusRequest
+	11, // 31: hashicorp.consul.resource.ResourceService.List:input_type -> hashicorp.consul.resource.ListRequest
+	17, // 32: hashicorp.consul.resource.ResourceService.Delete:input_type -> hashicorp.consul.resource.DeleteRequest
+	19, // 33: hashicorp.consul.resource.ResourceService.WatchList:input_type -> hashicorp.consul.resource.WatchListRequest
+	10, // 34: hashicorp.consul.resource.ResourceService.Read:output_type -> hashicorp.consul.resource.ReadResponse
+	14, // 35: hashicorp.consul.resource.ResourceService.Write:output_type -> hashicorp.consul.resource.WriteResponse
+	16, // 36: hashicorp.consul.resource.ResourceService.WriteStatus:output_type -> hashicorp.consul.resource.WriteStatusResponse
+	12, // 37: hashicorp.consul.resource.ResourceService.List:output_type -> hashicorp.consul.resource.ListResponse
+	18, // 38: hashicorp.consul.resource.ResourceService.Delete:output_type -> hashicorp.consul.resource.DeleteResponse
+	20, // 39: hashicorp.consul.resource.ResourceService.WatchList:output_type -> hashicorp.consul.resource.WatchEvent
 	34, // [34:40] is the sub-list for method output_type
 	28, // [28:34] is the sub-list for method input_type
 	28, // [28:28] is the sub-list for extension type_name
@@ -1670,7 +1817,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WatchEvent); i {
+			switch v := v.(*ReadRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1682,7 +1829,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ReadRequest); i {
+			switch v := v.(*ReadResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1694,7 +1841,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ReadResponse); i {
+			switch v := v.(*ListRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1706,7 +1853,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListRequest); i {
+			switch v := v.(*ListResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1718,7 +1865,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListResponse); i {
+			switch v := v.(*WriteRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1730,7 +1877,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WriteRequest); i {
+			switch v := v.(*WriteResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1742,7 +1889,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WriteResponse); i {
+			switch v := v.(*WriteStatusRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1754,7 +1901,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WriteStatusRequest); i {
+			switch v := v.(*WriteStatusResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1766,7 +1913,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WriteStatusResponse); i {
+			switch v := v.(*DeleteRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1778,7 +1925,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeleteRequest); i {
+			switch v := v.(*DeleteResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1790,7 +1937,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeleteResponse); i {
+			switch v := v.(*WatchListRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1802,7 +1949,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WatchListRequest); i {
+			switch v := v.(*WatchEvent); i {
 			case 0:
 				return &v.state
 			case 1:
diff --git a/proto-public/pbresource/resource.proto b/proto-public/pbresource/resource.proto
index affb2df7fb0a..3fa18d5d6b2c 100644
--- a/proto-public/pbresource/resource.proto
+++ b/proto-public/pbresource/resource.proto
@@ -8,76 +8,215 @@ package hashicorp.consul.resource;
 import "annotations/ratelimit/ratelimit.proto";
 import "google/protobuf/any.proto";
 
+// Type describes a resource's type. It follows the GVK (Group Version Kind)
+// [pattern](https://book.kubebuilder.io/cronjob-tutorial/gvks.html) established
+// by Kubernetes.
 message Type {
+  // Group describes the area of functionality to which this resource type
+  // relates (e.g. "catalog", "authorization").
   string group = 1;
+
+  // GroupVersion is incremented when sweeping or backward-incompatible changes
+  // are made to the group's resource types.
   string group_version = 2;
+
+  // Kind identifies the specific resource type within the group.
   string kind = 3;
 }
 
+// Tenancy describes the tenancy units in which the resource resides.
 message Tenancy {
+  // Partition is the topmost administrative boundary within a cluster.
+  // https://developer.hashicorp.com/consul/docs/enterprise/admin-partitions
+  //
+  // When using the List and WatchList endpoints, provide the wildcard value "*"
+  // to list resources across all partitions.
   string partition = 1;
+
+  // Namespace further isolates resources within a partition.
+  // https://developer.hashicorp.com/consul/docs/enterprise/namespaces
+  //
+  // When using the List and WatchList endpoints, provide the wildcard value "*"
+  // to list resources across all namespaces.
   string namespace = 2;
+
+  // PeerName identifies which peer the resource is imported from.
+  // https://developer.hashicorp.com/consul/docs/connect/cluster-peering
+  //
+  // When using the List and WatchList endpoints, provide the wildcard value "*"
+  // to list resources across all peers.
   string peer_name = 3;
 }
 
+// ID uniquely identifies a resource.
 message ID {
+  // Uid is the unique internal identifier we gave to the resource.
+  //
+  // It is primarily used to tell the difference between the current resource
+  // and previous deleted resources with the same user-given name.
+  //
+  // Concretely, Uid is a [ULID](https://github.com/ulid/spec) and you can treat
+  // its timestamp component as the resource's creation time.
   string uid = 1;
+
+  // Name is the user-given name of the resource (e.g. the "billing" service).
   string name = 2;
+
+  // Type identifies the resource's type.
   Type type = 3;
+
+  // Tenancy identifies the tenancy units (i.e. partition, namespace) in which
+  // the resource resides.
   Tenancy tenancy = 4;
 }
 
+// Resource describes a resource of a known type managed by Consul.
 message Resource {
+  // ID uniquely identifies the resource.
   ID id = 1;
+
+  // Owner (optionally) describes which resource "owns" this resource, it is
+  // immutable and can only be set on resource creation. Owned resources will
+  // be automatically deleted when their owner is deleted.
   ID owner = 2;
+
+  // Version is the low-level version identifier used by the storage backend
+  // in CAS (Compare-And-Swap) operations. It will change when the resource is
+  // modified in any way, including status updates.
+  //
+  // When calling the Write endpoint, providing a non-blank version will perform
+  // a CAS (Compare-And-Swap) write, which will result in an Aborted error code
+  // if the given version doesn't match what is stored.
   string version = 3;
+
+  // Generation is incremented whenever the resource's content (i.e. not its
+  // status) is modified. You can think of it as being the "user version".
+  //
+  // Concretely, Generation is a [ULID](https://github.com/ulid/spec) and you
+  // can treat its timestamp component as the resource's modification time.
   string generation = 4;
 
+  // Metadata contains key/value pairs of arbitrary metadata about the resource.
   map<string, string> metadata = 5;
+
+  // Status is used by controllers to communicate the result of attempting to
+  // reconcile and apply the resource (e.g. surface semantic validation errors)
+  // with users and other controllers. Each status is identified by a unique key
+  // and should only ever be updated by one controller.
+  //
+  // Status can only be updated via the WriteStatus endpoint. Attempting to do
+  // so via the Write endpoint will result in an InvalidArgument error code.
   map<string, Status> status = 6;
 
+  // Data contains the resource's type-specific content.
   google.protobuf.Any data = 7;
 }
 
+// Status is used by controllers to communicate the result of attempting to
+// reconcile and apply a resource (e.g. surface semantic validation errors)
+// with users and other controllers.
 message Status {
+  // ObservedGeneration identifies which generation of a resource this status
+  // related to. It can be used to determine whether the current generation of
+  // a resource has been reconciled.
   string observed_generation = 1;
+
+  // Conditions contains a set of discreet observations about the resource in
+  // relation to the current state of the system (e.g. it is semantically valid).
   repeated Condition conditions = 2;
 }
 
+// Condition represents a discreet observation about a resource in relation to
+// the current state of the system.
+//
+// It is heavily inspired by Kubernetes' [conditions](https://bit.ly/3H9Y6IK)
+// and the Gateway API [types and reasons](https://bit.ly/3n2PPiP).
 message Condition {
+  // State represents the state of the condition (i.e. true/false/unknown).
   enum State {
+    // STATE_UNKNOWN means that the state of the condition is unknown.
+    //
     // buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
     STATE_UNKNOWN = 0;
+
+    // STATE_TRUE means that the state of the condition is true.
     STATE_TRUE = 1;
+
+    // STATE_FALSE means that the state of the condition is false.
     STATE_FALSE = 2;
   }
 
+  // Type identifies the type of condition (e.g. "Invalid", "ResolvedRefs").
   string type = 1;
+
+  // State represents the state of the condition (i.e. true/false/unknown).
   State state = 2;
+
+  // Reason provides more machine-readable details about the condition (e.g.
+  // "InvalidProtocol").
   string reason = 3;
+
+  // Message contains a human-friendly description of the status.
   string message = 4;
+
+  // Resource identifies which resource this condition relates to, when it is
+  // not the core resource itself.
   Reference resource = 5;
 }
 
+// Reference identifies which resource a condition relates to, when it is not
+// the core resource itself.
 message Reference {
+  // Type identifies the resource's type.
   Type type = 1;
+
+  // Tenancy identifies the tenancy units (i.e. partition, namespace) in which
+  // the resource resides.
   Tenancy tenancy = 2;
-  string name = 3;
-  string section = 4;
-}
 
-message WatchEvent {
-  enum Operation {
-    OPERATION_UNSPECIFIED = 0;
-    OPERATION_UPSERT = 1;
-    OPERATION_DELETE = 2;
-  }
+  // Name is the user-given name of the resource (e.g. the "billing" service).
+  string name = 3;
 
-  Operation operation = 1;
-  Resource resource = 2;
+  // Section identifies which part of the resource the condition relates to.
+  string section = 4;
 }
 
+// ResourceService provides the shared primitives for storing, querying, and
+// watching resources of different types.
+//
+// It is exposed on our external gRPC port and used internally by controllers.
+//
+// # Consistency Guarentees
+//
+// All reads are eventually consistent by default. Concretely, we guarantee
+// [monotonic reads](https://jepsen.io/consistency/models/monotonic-reads).
+//
+// That is, a read will always return results that are as up-to-date as an
+// earlier read, provided both happen on the same Consul server. But we do
+// not make any such guarantee about writes. In other words, reads won't
+// necessarily reflect earlier writes, even when made against the same server.
+//
+// This guarantee also holds between the Read and WatchList endpoints such that
+// you'll never receive an event about a resource that you cannot immediately
+// read, provided both the Read and WatchList happen on the same server.
+//
+// The Read endpoint also supports a strong consistency mode that guarantees
+// [linearizability](https://jepsen.io/consistency/models/linearizable), such
+// that a read will always return the most up-to-date version of a resource,
+// without caveat.
+//
+// This is much more expensive than eventual consistency and when using the Raft
+// storage backend, will increase load on the cluster leader, so should be used
+// sparingly.
+//
+// To opt-in to strongly consistent reads set the `x-consul-consistency-mode`
+// gRPC metadata field to "consistent".
 service ResourceService {
+  // Read a resource by ID.
+  //
+  // By default, reads are eventually consistent, but you can opt-in to strong
+  // consistency via the x-consul-consistency-mode metadata (see ResourceService
+  // docs for more info).
   rpc Read(ReadRequest) returns (ReadResponse) {
     option (hashicorp.consul.internal.ratelimit.spec) = {
       operation_type: OPERATION_TYPE_READ,
@@ -85,6 +224,19 @@ service ResourceService {
     };
   }
 
+  // Write a resource.
+  //
+  // To perform a CAS (Compare-And-Swap) write, provide the current resource
+  // version in the Resource.Version field. If the given version doesn't match
+  // what is currently stored, an Aborted error code will be returned.
+  //
+  // Resource.Id.Uid can (and by controllers, should) be provided to avoid
+  // accidentally modifying a resource if it has been deleted and recreated.
+  // If the given Uid doesn't match what is stored, a FailedPrecondition error
+  // code will be returned.
+  //
+  // It is not possible to modify the resource's status using Write. You must
+  // use WriteStatus instead.
   rpc Write(WriteRequest) returns (WriteResponse) {
     option (hashicorp.consul.internal.ratelimit.spec) = {
       operation_type: OPERATION_TYPE_WRITE,
@@ -92,6 +244,20 @@ service ResourceService {
     };
   }
 
+  // WriteStatus updates one of the resource's statuses. It should only be used
+  // by controllers.
+  //
+  // To perform a CAS (Compare-And-Swap) write, provide the current resource
+  // version in the Version field. If the given version doesn't match what is
+  // currently stored, an Aborted error code will be returned.
+  //
+  // Note: in most cases, CAS status updates are not necessary because updates
+  // are scoped to a specific status key and controllers are leader-elected so
+  // there is no chance of a conflict.
+  //
+  // Id.Uid must be provided to avoid accidentally modifying a resource if it has
+  // been deleted and recreated. If the given Uid doesn't match what is stored,
+  // a FailedPrecondition error code will be returned.
   rpc WriteStatus(WriteStatusRequest) returns (WriteStatusResponse) {
     option (hashicorp.consul.internal.ratelimit.spec) = {
       operation_type: OPERATION_TYPE_WRITE,
@@ -99,6 +265,11 @@ service ResourceService {
     };
   }
 
+  // List resources of a given type, tenancy, and optionally name prefix.
+  //
+  // To list resources across all tenancy units, provide the wildcard "*" value.
+  //
+  // Results are eventually consistent (see ResourceService docs for more info).
   rpc List(ListRequest) returns (ListResponse) {
     option (hashicorp.consul.internal.ratelimit.spec) = {
       operation_type: OPERATION_TYPE_READ,
@@ -106,6 +277,19 @@ service ResourceService {
     };
   }
 
+  // Delete a resource by ID.
+  //
+  // Deleting a non-existent resource will return a successful response for
+  // idempotency.
+  //
+  // To perform a CAS (Compare-And-Swap) deletion, provide the current resource
+  // version in the Version field. If the given version doesn't match what is
+  // currently stored, an Aborted error code will be returned.
+  //
+  // Resource.Id.Uid can (and by controllers, should) be provided to avoid
+  // accidentally modifying a resource if it has been deleted and recreated.
+  // If the given Uid doesn't match what is stored, a FailedPrecondition error
+  // code will be returned.
   rpc Delete(DeleteRequest) returns (DeleteResponse) {
     option (hashicorp.consul.internal.ratelimit.spec) = {
       operation_type: OPERATION_TYPE_WRITE,
@@ -113,6 +297,17 @@ service ResourceService {
     };
   }
 
+  // WatchList watches resources of the given type, tenancy, and optionally name
+  // prefix. It returns results for the current state-of-the-world at the start
+  // of the stream, and delta events whenever resources are written or deleted.
+  //
+  // To watch resources across all tenancy units, provide the wildcard "*" value.
+  //
+  // WatchList makes no guarantees about event timeliness (e.g. an event for a
+  // write may not be received immediately), but it does guarantee that events
+  // will be emitted in the correct order. See ResourceService docs for more
+  // info about consistency guarentees.
+  //
   // buf:lint:ignore RPC_RESPONSE_STANDARD_NAME
   rpc WatchList(WatchListRequest) returns (stream WatchEvent) {
     option (hashicorp.consul.internal.ratelimit.spec) = {
@@ -122,52 +317,127 @@ service ResourceService {
   }
 }
 
+// ReadRequest contains the parameters to the Read endpoint.
 message ReadRequest {
+  // ID of the resource.
   ID id = 1;
 }
 
+// ReadResponse contains the results of calling the Read endpoint.
 message ReadResponse {
+  // Resource that was read.
   Resource resource = 1;
 }
 
+// ListRequest contains the parameters to the List endpoint.
 message ListRequest {
+  // Type of resource to list.
   Type type = 1;
+
+  // Tenancy units in which to list resources. To list resources in all units,
+  // provide the wildcard "*" value.
   Tenancy tenancy = 2;
+
+  // NamePrefix filters the results to those with a name beginning with the
+  // given prefix.
   string name_prefix = 3;
 }
 
+// ListResponse contains the results of calling the List endpoint.
 message ListResponse {
+  // Resources that were listed.
   repeated Resource resources = 1;
 }
 
+// WriteRequest contains the parameters to the Write endpoint.
 message WriteRequest {
+  // Resource to write.
   Resource resource = 1;
 }
 
+// WriteResponse contains the results of calling the Write endpoint.
 message WriteResponse {
+  // Resource that was written.
   Resource resource = 1;
 }
 
+// WriteStatusRequest contains the parameters to the WriteStatus endpoint.
 message WriteStatusRequest {
+  // ID of the resource to which the status will be written. Must contain a Uid.
   ID id = 1;
+
+  // Version may be provided to perform a CAS (Compare-And-Swap) update of the
+  // status. If the given version doesn't match what is currently stored, an
+  // Aborted error code will be returned.
+  //
+  // Note: in most cases, CAS status updates are not necessary because updates
+  // are scoped to a specific status key and controllers are leader-elected so
+  // there is no chance of a conflict.
   string version = 2;
+
+  // Key identifies which status will be written. Generally, each controller
+  // should write 1 status which it owns exclusively (i.e. no other controller
+  // updates it).
   string key = 3;
+
+  // Status that will be written to the resource.
   Status status = 4;
 }
 
+// WriteStatusResponse contains the results of calling the WriteStatus endpoint.
 message WriteStatusResponse {
+  // Resource to which the status was written.
   Resource resource = 1;
 }
 
+// DeleteRequest contains the parameters to the Delete endpoint.
 message DeleteRequest {
+  // ID of the resource that will be deleted.
   ID id = 1;
+
+  // Version may be provided to perform a CAS (Compare-And-Swap) deletion of the
+  // resource. If the given version doesn't match what is currently stored, an
+  // Aborted error code will be returned.
   string version = 2;
 }
 
+// DeleteResponse contains the results of calling the Delete endpoint.
 message DeleteResponse {}
 
+// WatchListRequest contains the parameters to the WatchList endpoint.
 message WatchListRequest {
+  // Type of resource to watch.
   Type type = 1;
+
+  // Tenancy units in which to watch resources. To list resources in all units,
+  // provide the wildcard "*" value.
   Tenancy tenancy = 2;
+
+  // NamePrefix filters the results to those with a name beginning with the
+  // given prefix.
   string name_prefix = 3;
 }
+
+// WatchEvent is emitted on the WatchList stream when a resource changes.
+message WatchEvent {
+  // Operation describes the type of event.
+  enum Operation {
+    // OPERATION_UNSPECIFIED is the default/zero value. You should not see it
+    // in practice.
+    OPERATION_UNSPECIFIED = 0;
+
+    // OPERATION_UPSERT indicates that the resource was written (i.e. created or
+    // updated). All events from the initial state-of-the-world will be upsert
+    // events.
+    OPERATION_UPSERT = 1;
+
+    // OPERATION_DELETED indicates that the resource was deleted.
+    OPERATION_DELETE = 2;
+  }
+
+  // Operation describes the type of event.
+  Operation operation = 1;
+
+  // Resource the event relates to.
+  Resource resource = 2;
+}
diff --git a/proto-public/pbresource/resource_grpc.pb.go b/proto-public/pbresource/resource_grpc.pb.go
index 68f84d55204f..f44208b2990c 100644
--- a/proto-public/pbresource/resource_grpc.pb.go
+++ b/proto-public/pbresource/resource_grpc.pb.go
@@ -22,11 +22,72 @@ const _ = grpc.SupportPackageIsVersion7
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
 type ResourceServiceClient interface {
+	// Read a resource by ID.
+	//
+	// By default, reads are eventually consistent, but you can opt-in to strong
+	// consistency via the x-consul-consistency-mode metadata (see ResourceService
+	// docs for more info).
 	Read(ctx context.Context, in *ReadRequest, opts ...grpc.CallOption) (*ReadResponse, error)
+	// Write a resource.
+	//
+	// To perform a CAS (Compare-And-Swap) write, provide the current resource
+	// version in the Resource.Version field. If the given version doesn't match
+	// what is currently stored, an Aborted error code will be returned.
+	//
+	// Resource.Id.Uid can (and by controllers, should) be provided to avoid
+	// accidentally modifying a resource if it has been deleted and recreated.
+	// If the given Uid doesn't match what is stored, a FailedPrecondition error
+	// code will be returned.
+	//
+	// It is not possible to modify the resource's status using Write. You must
+	// use WriteStatus instead.
 	Write(ctx context.Context, in *WriteRequest, opts ...grpc.CallOption) (*WriteResponse, error)
+	// WriteStatus updates one of the resource's statuses. It should only be used
+	// by controllers.
+	//
+	// To perform a CAS (Compare-And-Swap) write, provide the current resource
+	// version in the Version field. If the given version doesn't match what is
+	// currently stored, an Aborted error code will be returned.
+	//
+	// Note: in most cases, CAS status updates are not necessary because updates
+	// are scoped to a specific status key and controllers are leader-elected so
+	// there is no chance of a conflict.
+	//
+	// Id.Uid must be provided to avoid accidentally modifying a resource if it has
+	// been deleted and recreated. If the given Uid doesn't match what is stored,
+	// a FailedPrecondition error code will be returned.
 	WriteStatus(ctx context.Context, in *WriteStatusRequest, opts ...grpc.CallOption) (*WriteStatusResponse, error)
+	// List resources of a given type, tenancy, and optionally name prefix.
+	//
+	// To list resources across all tenancy units, provide the wildcard "*" value.
+	//
+	// Results are eventually consistent (see ResourceService docs for more info).
 	List(ctx context.Context, in *ListRequest, opts ...grpc.CallOption) (*ListResponse, error)
+	// Delete a resource by ID.
+	//
+	// Deleting a non-existent resource will return a successful response for
+	// idempotency.
+	//
+	// To perform a CAS (Compare-And-Swap) deletion, provide the current resource
+	// version in the Version field. If the given version doesn't match what is
+	// currently stored, an Aborted error code will be returned.
+	//
+	// Resource.Id.Uid can (and by controllers, should) be provided to avoid
+	// accidentally modifying a resource if it has been deleted and recreated.
+	// If the given Uid doesn't match what is stored, a FailedPrecondition error
+	// code will be returned.
 	Delete(ctx context.Context, in *DeleteRequest, opts ...grpc.CallOption) (*DeleteResponse, error)
+	// WatchList watches resources of the given type, tenancy, and optionally name
+	// prefix. It returns results for the current state-of-the-world at the start
+	// of the stream, and delta events whenever resources are written or deleted.
+	//
+	// To watch resources across all tenancy units, provide the wildcard "*" value.
+	//
+	// WatchList makes no guarantees about event timeliness (e.g. an event for a
+	// write may not be received immediately), but it does guarantee that events
+	// will be emitted in the correct order. See ResourceService docs for more
+	// info about consistency guarentees.
+	//
 	// buf:lint:ignore RPC_RESPONSE_STANDARD_NAME
 	WatchList(ctx context.Context, in *WatchListRequest, opts ...grpc.CallOption) (ResourceService_WatchListClient, error)
 }
@@ -120,11 +181,72 @@ func (x *resourceServiceWatchListClient) Recv() (*WatchEvent, error) {
 // All implementations should embed UnimplementedResourceServiceServer
 // for forward compatibility
 type ResourceServiceServer interface {
+	// Read a resource by ID.
+	//
+	// By default, reads are eventually consistent, but you can opt-in to strong
+	// consistency via the x-consul-consistency-mode metadata (see ResourceService
+	// docs for more info).
 	Read(context.Context, *ReadRequest) (*ReadResponse, error)
+	// Write a resource.
+	//
+	// To perform a CAS (Compare-And-Swap) write, provide the current resource
+	// version in the Resource.Version field. If the given version doesn't match
+	// what is currently stored, an Aborted error code will be returned.
+	//
+	// Resource.Id.Uid can (and by controllers, should) be provided to avoid
+	// accidentally modifying a resource if it has been deleted and recreated.
+	// If the given Uid doesn't match what is stored, a FailedPrecondition error
+	// code will be returned.
+	//
+	// It is not possible to modify the resource's status using Write. You must
+	// use WriteStatus instead.
 	Write(context.Context, *WriteRequest) (*WriteResponse, error)
+	// WriteStatus updates one of the resource's statuses. It should only be used
+	// by controllers.
+	//
+	// To perform a CAS (Compare-And-Swap) write, provide the current resource
+	// version in the Version field. If the given version doesn't match what is
+	// currently stored, an Aborted error code will be returned.
+	//
+	// Note: in most cases, CAS status updates are not necessary because updates
+	// are scoped to a specific status key and controllers are leader-elected so
+	// there is no chance of a conflict.
+	//
+	// Id.Uid must be provided to avoid accidentally modifying a resource if it has
+	// been deleted and recreated. If the given Uid doesn't match what is stored,
+	// a FailedPrecondition error code will be returned.
 	WriteStatus(context.Context, *WriteStatusRequest) (*WriteStatusResponse, error)
+	// List resources of a given type, tenancy, and optionally name prefix.
+	//
+	// To list resources across all tenancy units, provide the wildcard "*" value.
+	//
+	// Results are eventually consistent (see ResourceService docs for more info).
 	List(context.Context, *ListRequest) (*ListResponse, error)
+	// Delete a resource by ID.
+	//
+	// Deleting a non-existent resource will return a successful response for
+	// idempotency.
+	//
+	// To perform a CAS (Compare-And-Swap) deletion, provide the current resource
+	// version in the Version field. If the given version doesn't match what is
+	// currently stored, an Aborted error code will be returned.
+	//
+	// Resource.Id.Uid can (and by controllers, should) be provided to avoid
+	// accidentally modifying a resource if it has been deleted and recreated.
+	// If the given Uid doesn't match what is stored, a FailedPrecondition error
+	// code will be returned.
 	Delete(context.Context, *DeleteRequest) (*DeleteResponse, error)
+	// WatchList watches resources of the given type, tenancy, and optionally name
+	// prefix. It returns results for the current state-of-the-world at the start
+	// of the stream, and delta events whenever resources are written or deleted.
+	//
+	// To watch resources across all tenancy units, provide the wildcard "*" value.
+	//
+	// WatchList makes no guarantees about event timeliness (e.g. an event for a
+	// write may not be received immediately), but it does guarantee that events
+	// will be emitted in the correct order. See ResourceService docs for more
+	// info about consistency guarentees.
+	//
 	// buf:lint:ignore RPC_RESPONSE_STANDARD_NAME
 	WatchList(*WatchListRequest, ResourceService_WatchListServer) error
 }

From c5c35ec92414cc171898e9be5bf1dbe82bf7b3c8 Mon Sep 17 00:00:00 2001
From: Freddy <freddygv@users.noreply.github.com>
Date: Wed, 26 Apr 2023 10:04:57 -0600
Subject: [PATCH 23/92] [CC-4519] Include Consul NodeID in Envoy bootstrap
 metadata (#17139)

This is being added so that metrics sent to HCP can be augmented with the source node's ID.

Opting not to add this to stats_tag out of caution, since it would increase the cardinality of metrics emitted by Envoy for all users.

There is no functional impact to Envoy expected from this change.
---
 command/connect/envoy/bootstrap_tpl.go                      | 4 ++++
 command/connect/envoy/envoy.go                              | 6 ++++++
 command/connect/envoy/envoy_test.go                         | 1 +
 .../CONSUL_GRPC_ADDR-with-https-scheme-enables-tls.golden   | 1 +
 ...P_ADDR-with-https-scheme-does-not-affect-grpc-tls.golden | 1 +
 command/connect/envoy/testdata/access-log-path.golden       | 1 +
 .../envoy/testdata/access-logs-enabled-custom.golden        | 1 +
 command/connect/envoy/testdata/access-logs-enabled.golden   | 1 +
 command/connect/envoy/testdata/acl-enabled-and-token.golden | 1 +
 .../connect/envoy/testdata/acl-enabled-but-no-token.golden  | 1 +
 ...L_HTTP_ADDR-PLAIN-and-CONSUL_GRPC_ADDR-TLS-is-tls.golden | 1 +
 ...HTTP_ADDR-TLS-and-CONSUL_GRPC_ADDR-PLAIN-is-plain.golden | 1 +
 command/connect/envoy/testdata/defaults-nodemeta.golden     | 1 +
 command/connect/envoy/testdata/defaults.golden              | 1 +
 .../envoy/testdata/deprecated-grpc-addr-config.golden       | 1 +
 command/connect/envoy/testdata/envoy-readiness-probe.golden | 1 +
 command/connect/envoy/testdata/existing-ca-file.golden      | 1 +
 command/connect/envoy/testdata/existing-ca-path.golden      | 1 +
 command/connect/envoy/testdata/extra_-multiple.golden       | 1 +
 command/connect/envoy/testdata/extra_-single.golden         | 1 +
 command/connect/envoy/testdata/grpc-addr-env.golden         | 1 +
 command/connect/envoy/testdata/grpc-addr-flag.golden        | 1 +
 .../connect/envoy/testdata/grpc-addr-unix-with-tls.golden   | 1 +
 command/connect/envoy/testdata/grpc-addr-unix.golden        | 1 +
 command/connect/envoy/testdata/grpc-tls-addr-config.golden  | 1 +
 command/connect/envoy/testdata/hcp-metrics.golden           | 1 +
 .../envoy/testdata/ingress-gateway-address-specified.golden | 1 +
 .../envoy/testdata/ingress-gateway-no-auto-register.golden  | 1 +
 .../connect/envoy/testdata/ingress-gateway-nodemeta.golden  | 1 +
 ...ngress-gateway-register-with-service-and-proxy-id.golden | 1 +
 ...ss-gateway-register-with-service-without-proxy-id.golden | 1 +
 command/connect/envoy/testdata/ingress-gateway.golden       | 1 +
 .../envoy/testdata/prometheus-metrics-tls-ca-file.golden    | 1 +
 .../envoy/testdata/prometheus-metrics-tls-ca-path.golden    | 1 +
 command/connect/envoy/testdata/prometheus-metrics.golden    | 1 +
 command/connect/envoy/testdata/stats-config-override.golden | 1 +
 command/connect/envoy/testdata/token-arg.golden             | 1 +
 command/connect/envoy/testdata/token-env.golden             | 1 +
 command/connect/envoy/testdata/token-file-arg.golden        | 1 +
 command/connect/envoy/testdata/token-file-env.golden        | 1 +
 command/connect/envoy/testdata/xds-addr-config.golden       | 1 +
 command/connect/envoy/testdata/zipkin-tracing-config.golden | 1 +
 42 files changed, 50 insertions(+)

diff --git a/command/connect/envoy/bootstrap_tpl.go b/command/connect/envoy/bootstrap_tpl.go
index 78d88f9b1d11..9cce86c6b9b5 100644
--- a/command/connect/envoy/bootstrap_tpl.go
+++ b/command/connect/envoy/bootstrap_tpl.go
@@ -17,6 +17,9 @@ type BootstrapTplArgs struct {
 	// the agent to deliver the correct configuration.
 	ProxyID string
 
+	// NodeID is the ID of the node on which the proxy service instance is registered.
+	NodeID string
+
 	// NodeName is the name of the node on which the proxy service instance is registered.
 	NodeName string
 
@@ -184,6 +187,7 @@ const bootstrapTemplate = `{
       {{- if .NodeName }}
       "node_name": "{{ .NodeName }}",
       {{- end }}
+      "node_id": "{{ .NodeID }}",
       "namespace": "{{if ne .Namespace ""}}{{ .Namespace }}{{else}}default{{end}}",
       "partition": "{{if ne .Partition ""}}{{ .Partition }}{{else}}default{{end}}"
     }
diff --git a/command/connect/envoy/envoy.go b/command/connect/envoy/envoy.go
index 4c1ff6b80a19..06f5963e098f 100644
--- a/command/connect/envoy/envoy.go
+++ b/command/connect/envoy/envoy.go
@@ -722,6 +722,12 @@ func (c *cmd) generateConfig() ([]byte, error) {
 		args.Datacenter = datacenter
 	}
 
+	info, err := c.client.Agent().Self()
+	if err != nil {
+		return nil, err
+	}
+	args.NodeID, _ = info["Config"]["NodeID"].(string)
+
 	if err := generateAccessLogs(c, args); err != nil {
 		return nil, err
 	}
diff --git a/command/connect/envoy/envoy_test.go b/command/connect/envoy/envoy_test.go
index ebfc30631173..f655a2e906c1 100644
--- a/command/connect/envoy/envoy_test.go
+++ b/command/connect/envoy/envoy_test.go
@@ -1691,6 +1691,7 @@ func testMockAgentSelf(
 		resp := agent.Self{
 			Config: map[string]interface{}{
 				"Datacenter": "dc1",
+				"NodeID":     "7cbef9fc-4fb1-4c84-b100-689db9755449",
 			},
 		}
 
diff --git a/command/connect/envoy/testdata/CONSUL_GRPC_ADDR-with-https-scheme-enables-tls.golden b/command/connect/envoy/testdata/CONSUL_GRPC_ADDR-with-https-scheme-enables-tls.golden
index a8ba4704f5e3..22680a5eb78e 100644
--- a/command/connect/envoy/testdata/CONSUL_GRPC_ADDR-with-https-scheme-enables-tls.golden
+++ b/command/connect/envoy/testdata/CONSUL_GRPC_ADDR-with-https-scheme-enables-tls.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/CONSUL_HTTP_ADDR-with-https-scheme-does-not-affect-grpc-tls.golden b/command/connect/envoy/testdata/CONSUL_HTTP_ADDR-with-https-scheme-does-not-affect-grpc-tls.golden
index 5485256b4f99..bac5b1d0f6af 100644
--- a/command/connect/envoy/testdata/CONSUL_HTTP_ADDR-with-https-scheme-does-not-affect-grpc-tls.golden
+++ b/command/connect/envoy/testdata/CONSUL_HTTP_ADDR-with-https-scheme-does-not-affect-grpc-tls.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/access-log-path.golden b/command/connect/envoy/testdata/access-log-path.golden
index 18a28a491e86..f25ab92cf50e 100644
--- a/command/connect/envoy/testdata/access-log-path.golden
+++ b/command/connect/envoy/testdata/access-log-path.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/access-logs-enabled-custom.golden b/command/connect/envoy/testdata/access-logs-enabled-custom.golden
index 6af720bdaccb..1f42d1450ece 100644
--- a/command/connect/envoy/testdata/access-logs-enabled-custom.golden
+++ b/command/connect/envoy/testdata/access-logs-enabled-custom.golden
@@ -25,6 +25,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/access-logs-enabled.golden b/command/connect/envoy/testdata/access-logs-enabled.golden
index 892cf46324b4..2a1a40947dd0 100644
--- a/command/connect/envoy/testdata/access-logs-enabled.golden
+++ b/command/connect/envoy/testdata/access-logs-enabled.golden
@@ -47,6 +47,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/acl-enabled-and-token.golden b/command/connect/envoy/testdata/acl-enabled-and-token.golden
index 3342f0390471..5694e08e1efa 100644
--- a/command/connect/envoy/testdata/acl-enabled-and-token.golden
+++ b/command/connect/envoy/testdata/acl-enabled-and-token.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/acl-enabled-but-no-token.golden b/command/connect/envoy/testdata/acl-enabled-but-no-token.golden
index 5485256b4f99..bac5b1d0f6af 100644
--- a/command/connect/envoy/testdata/acl-enabled-but-no-token.golden
+++ b/command/connect/envoy/testdata/acl-enabled-but-no-token.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-PLAIN-and-CONSUL_GRPC_ADDR-TLS-is-tls.golden b/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-PLAIN-and-CONSUL_GRPC_ADDR-TLS-is-tls.golden
index a8ba4704f5e3..22680a5eb78e 100644
--- a/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-PLAIN-and-CONSUL_GRPC_ADDR-TLS-is-tls.golden
+++ b/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-PLAIN-and-CONSUL_GRPC_ADDR-TLS-is-tls.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-TLS-and-CONSUL_GRPC_ADDR-PLAIN-is-plain.golden b/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-TLS-and-CONSUL_GRPC_ADDR-PLAIN-is-plain.golden
index 5485256b4f99..bac5b1d0f6af 100644
--- a/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-TLS-and-CONSUL_GRPC_ADDR-PLAIN-is-plain.golden
+++ b/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-TLS-and-CONSUL_GRPC_ADDR-PLAIN-is-plain.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/defaults-nodemeta.golden b/command/connect/envoy/testdata/defaults-nodemeta.golden
index 41788c3c42e4..3371495e81b0 100644
--- a/command/connect/envoy/testdata/defaults-nodemeta.golden
+++ b/command/connect/envoy/testdata/defaults-nodemeta.golden
@@ -13,6 +13,7 @@
     "id": "test-proxy",
     "metadata": {
       "node_name": "test-node",
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/defaults.golden b/command/connect/envoy/testdata/defaults.golden
index 5485256b4f99..bac5b1d0f6af 100644
--- a/command/connect/envoy/testdata/defaults.golden
+++ b/command/connect/envoy/testdata/defaults.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/deprecated-grpc-addr-config.golden b/command/connect/envoy/testdata/deprecated-grpc-addr-config.golden
index ab87aa9b438f..303950c696db 100644
--- a/command/connect/envoy/testdata/deprecated-grpc-addr-config.golden
+++ b/command/connect/envoy/testdata/deprecated-grpc-addr-config.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/envoy-readiness-probe.golden b/command/connect/envoy/testdata/envoy-readiness-probe.golden
index 444528e8808e..799d93afb0ec 100644
--- a/command/connect/envoy/testdata/envoy-readiness-probe.golden
+++ b/command/connect/envoy/testdata/envoy-readiness-probe.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/existing-ca-file.golden b/command/connect/envoy/testdata/existing-ca-file.golden
index a8ba4704f5e3..22680a5eb78e 100644
--- a/command/connect/envoy/testdata/existing-ca-file.golden
+++ b/command/connect/envoy/testdata/existing-ca-file.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/existing-ca-path.golden b/command/connect/envoy/testdata/existing-ca-path.golden
index e246dbb324eb..b82331d4e765 100644
--- a/command/connect/envoy/testdata/existing-ca-path.golden
+++ b/command/connect/envoy/testdata/existing-ca-path.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/extra_-multiple.golden b/command/connect/envoy/testdata/extra_-multiple.golden
index 038e65d8d9fb..84306e6ce715 100644
--- a/command/connect/envoy/testdata/extra_-multiple.golden
+++ b/command/connect/envoy/testdata/extra_-multiple.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/extra_-single.golden b/command/connect/envoy/testdata/extra_-single.golden
index 14b8f0820500..84dcb8081c7c 100644
--- a/command/connect/envoy/testdata/extra_-single.golden
+++ b/command/connect/envoy/testdata/extra_-single.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/grpc-addr-env.golden b/command/connect/envoy/testdata/grpc-addr-env.golden
index ab87aa9b438f..303950c696db 100644
--- a/command/connect/envoy/testdata/grpc-addr-env.golden
+++ b/command/connect/envoy/testdata/grpc-addr-env.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/grpc-addr-flag.golden b/command/connect/envoy/testdata/grpc-addr-flag.golden
index ab87aa9b438f..303950c696db 100644
--- a/command/connect/envoy/testdata/grpc-addr-flag.golden
+++ b/command/connect/envoy/testdata/grpc-addr-flag.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/grpc-addr-unix-with-tls.golden b/command/connect/envoy/testdata/grpc-addr-unix-with-tls.golden
index 89764c310a47..118a98d1167c 100644
--- a/command/connect/envoy/testdata/grpc-addr-unix-with-tls.golden
+++ b/command/connect/envoy/testdata/grpc-addr-unix-with-tls.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/grpc-addr-unix.golden b/command/connect/envoy/testdata/grpc-addr-unix.golden
index eb8841ae993f..41e515b69d01 100644
--- a/command/connect/envoy/testdata/grpc-addr-unix.golden
+++ b/command/connect/envoy/testdata/grpc-addr-unix.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/grpc-tls-addr-config.golden b/command/connect/envoy/testdata/grpc-tls-addr-config.golden
index e79cf0455d2b..1de20dd5d215 100644
--- a/command/connect/envoy/testdata/grpc-tls-addr-config.golden
+++ b/command/connect/envoy/testdata/grpc-tls-addr-config.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/hcp-metrics.golden b/command/connect/envoy/testdata/hcp-metrics.golden
index 563d662e4436..dbae64eecf67 100644
--- a/command/connect/envoy/testdata/hcp-metrics.golden
+++ b/command/connect/envoy/testdata/hcp-metrics.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/ingress-gateway-address-specified.golden b/command/connect/envoy/testdata/ingress-gateway-address-specified.golden
index cc2e504eaf95..ecbf44d3fa70 100644
--- a/command/connect/envoy/testdata/ingress-gateway-address-specified.golden
+++ b/command/connect/envoy/testdata/ingress-gateway-address-specified.golden
@@ -12,6 +12,7 @@
     "cluster": "ingress-gateway",
     "id": "ingress-gateway",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/ingress-gateway-no-auto-register.golden b/command/connect/envoy/testdata/ingress-gateway-no-auto-register.golden
index cddaa490dd2c..d0a9bfe53945 100644
--- a/command/connect/envoy/testdata/ingress-gateway-no-auto-register.golden
+++ b/command/connect/envoy/testdata/ingress-gateway-no-auto-register.golden
@@ -12,6 +12,7 @@
     "cluster": "ingress-gateway",
     "id": "ingress-gateway",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/ingress-gateway-nodemeta.golden b/command/connect/envoy/testdata/ingress-gateway-nodemeta.golden
index d79739ed7280..484d926982ff 100644
--- a/command/connect/envoy/testdata/ingress-gateway-nodemeta.golden
+++ b/command/connect/envoy/testdata/ingress-gateway-nodemeta.golden
@@ -13,6 +13,7 @@
     "id": "ingress-gateway-1",
     "metadata": {
       "node_name": "test-node",
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/ingress-gateway-register-with-service-and-proxy-id.golden b/command/connect/envoy/testdata/ingress-gateway-register-with-service-and-proxy-id.golden
index 3149fc4b33a5..72b6bdae73ae 100644
--- a/command/connect/envoy/testdata/ingress-gateway-register-with-service-and-proxy-id.golden
+++ b/command/connect/envoy/testdata/ingress-gateway-register-with-service-and-proxy-id.golden
@@ -12,6 +12,7 @@
     "cluster": "my-gateway-123",
     "id": "my-gateway-123",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/ingress-gateway-register-with-service-without-proxy-id.golden b/command/connect/envoy/testdata/ingress-gateway-register-with-service-without-proxy-id.golden
index f8eb44754117..a2dd34310f6f 100644
--- a/command/connect/envoy/testdata/ingress-gateway-register-with-service-without-proxy-id.golden
+++ b/command/connect/envoy/testdata/ingress-gateway-register-with-service-without-proxy-id.golden
@@ -12,6 +12,7 @@
     "cluster": "my-gateway",
     "id": "my-gateway",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/ingress-gateway.golden b/command/connect/envoy/testdata/ingress-gateway.golden
index c4fba520ed99..102a1dfaaeb3 100644
--- a/command/connect/envoy/testdata/ingress-gateway.golden
+++ b/command/connect/envoy/testdata/ingress-gateway.golden
@@ -12,6 +12,7 @@
     "cluster": "ingress-gateway-1",
     "id": "ingress-gateway-1",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/prometheus-metrics-tls-ca-file.golden b/command/connect/envoy/testdata/prometheus-metrics-tls-ca-file.golden
index 71b82250e30d..077745bf5333 100644
--- a/command/connect/envoy/testdata/prometheus-metrics-tls-ca-file.golden
+++ b/command/connect/envoy/testdata/prometheus-metrics-tls-ca-file.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/prometheus-metrics-tls-ca-path.golden b/command/connect/envoy/testdata/prometheus-metrics-tls-ca-path.golden
index 07e56ae878a7..f1683a870a49 100644
--- a/command/connect/envoy/testdata/prometheus-metrics-tls-ca-path.golden
+++ b/command/connect/envoy/testdata/prometheus-metrics-tls-ca-path.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/prometheus-metrics.golden b/command/connect/envoy/testdata/prometheus-metrics.golden
index 5adc8a9485ee..4276c54ca563 100644
--- a/command/connect/envoy/testdata/prometheus-metrics.golden
+++ b/command/connect/envoy/testdata/prometheus-metrics.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/stats-config-override.golden b/command/connect/envoy/testdata/stats-config-override.golden
index d2a2371f20ea..0409b321b8e8 100644
--- a/command/connect/envoy/testdata/stats-config-override.golden
+++ b/command/connect/envoy/testdata/stats-config-override.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/token-arg.golden b/command/connect/envoy/testdata/token-arg.golden
index ac057e9a60b1..7f83eff98424 100644
--- a/command/connect/envoy/testdata/token-arg.golden
+++ b/command/connect/envoy/testdata/token-arg.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/token-env.golden b/command/connect/envoy/testdata/token-env.golden
index ac057e9a60b1..7f83eff98424 100644
--- a/command/connect/envoy/testdata/token-env.golden
+++ b/command/connect/envoy/testdata/token-env.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/token-file-arg.golden b/command/connect/envoy/testdata/token-file-arg.golden
index ac057e9a60b1..7f83eff98424 100644
--- a/command/connect/envoy/testdata/token-file-arg.golden
+++ b/command/connect/envoy/testdata/token-file-arg.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/token-file-env.golden b/command/connect/envoy/testdata/token-file-env.golden
index ac057e9a60b1..7f83eff98424 100644
--- a/command/connect/envoy/testdata/token-file-env.golden
+++ b/command/connect/envoy/testdata/token-file-env.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/xds-addr-config.golden b/command/connect/envoy/testdata/xds-addr-config.golden
index ab87aa9b438f..303950c696db 100644
--- a/command/connect/envoy/testdata/xds-addr-config.golden
+++ b/command/connect/envoy/testdata/xds-addr-config.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/zipkin-tracing-config.golden b/command/connect/envoy/testdata/zipkin-tracing-config.golden
index fd52f5ae3f57..7fa56c330157 100644
--- a/command/connect/envoy/testdata/zipkin-tracing-config.golden
+++ b/command/connect/envoy/testdata/zipkin-tracing-config.golden
@@ -12,6 +12,7 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
+      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }

From b431b04d0ca94656274a9ff96f677e41d7b28c3a Mon Sep 17 00:00:00 2001
From: Paul Glass <pglass@hashicorp.com>
Date: Wed, 26 Apr 2023 11:49:38 -0500
Subject: [PATCH 24/92] TProxy integration test (#17103)

* TProxy integration test
* Fix GHA compatibility integration test command

Previously, when test splitting allocated multiple test directories to a
runner, the workflow ran `go tests "./test/dir1 ./test/dir2"` which
results in a directory not found error. This fixes that.
---
 .github/workflows/test-integrations.yml       |   4 +-
 .../service/assets/Dockerfile-consul-envoy    |  13 ++
 .../libs/service/assets/tproxy-startup.sh     |  15 ++
 .../consul-container/libs/service/common.go   |  24 +++-
 .../consul-container/libs/service/connect.go  |  28 +++-
 .../consul-container/libs/service/helpers.go  |  60 +++++---
 .../libs/topology/peering_topology.go         |   2 +-
 .../libs/topology/service_topology.go         |   2 +-
 .../test/basic/connect_service_test.go        |   2 +-
 .../test/tproxy/tproxy_test.go                | 131 ++++++++++++++++++
 .../test/upgrade/ingress_gateway_grpc_test.go |   2 +-
 .../resolver_default_subset_test.go           |   2 +-
 .../upgrade/peering_control_plane_mgw_test.go |   2 +-
 .../test/upgrade/peering_http_test.go         |   2 +-
 .../test/wanfed/wanfed_peering_test.go        |   2 +-
 15 files changed, 252 insertions(+), 39 deletions(-)
 create mode 100644 test/integration/consul-container/libs/service/assets/tproxy-startup.sh
 create mode 100644 test/integration/consul-container/test/tproxy/tproxy_test.go

diff --git a/.github/workflows/test-integrations.yml b/.github/workflows/test-integrations.yml
index 37423b567b87..452e3e87e1a5 100644
--- a/.github/workflows/test-integrations.yml
+++ b/.github/workflows/test-integrations.yml
@@ -309,7 +309,7 @@ jobs:
             docker run --rm ${{ env.CONSUL_LATEST_IMAGE_NAME }}:local consul version
             echo "Running $(sed 's,|, ,g' <<< "${{ matrix.test-cases }}" |wc -w) subtests"
             # shellcheck disable=SC2001
-            sed 's,|,\n,g' <<< "${{ matrix.test-cases }}"
+            sed 's, ,\n,g' <<< "${{ matrix.test-cases }}"
             go run gotest.tools/gotestsum@v${{env.GOTESTSUM_VERSION}} \
               --raw-command \
               --format=short-verbose \
@@ -321,7 +321,7 @@ jobs:
               -tags "${{ env.GOTAGS }}" \
               -timeout=30m \
               -json \
-              "${{ matrix.test-cases }}" \
+              ${{ matrix.test-cases }} \
               --target-image ${{ env.CONSUL_LATEST_IMAGE_NAME }} \
               --target-version local \
               --latest-image ${{ env.CONSUL_LATEST_IMAGE_NAME }} \
diff --git a/test/integration/consul-container/libs/service/assets/Dockerfile-consul-envoy b/test/integration/consul-container/libs/service/assets/Dockerfile-consul-envoy
index 72b5802d27bb..5365ac7bb471 100644
--- a/test/integration/consul-container/libs/service/assets/Dockerfile-consul-envoy
+++ b/test/integration/consul-container/libs/service/assets/Dockerfile-consul-envoy
@@ -5,4 +5,17 @@ ARG ENVOY_VERSION
 FROM ${CONSUL_IMAGE} as consul
 
 FROM docker.mirror.hashicorp.services/envoyproxy/envoy:v${ENVOY_VERSION}
+
+# Install iptables and sudo, needed for tproxy.
+RUN apt update -y \
+	&& apt install -y iptables sudo curl dnsutils \
+	&& adduser envoy sudo \
+	&& echo 'envoy ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
+
+COPY tproxy-startup.sh /bin/tproxy-startup.sh
+RUN chmod +x /bin/tproxy-startup.sh \
+	&& chown envoy:envoy /bin/tproxy-startup.sh
+
 COPY --from=consul /bin/consul /bin/consul
+
+USER envoy
diff --git a/test/integration/consul-container/libs/service/assets/tproxy-startup.sh b/test/integration/consul-container/libs/service/assets/tproxy-startup.sh
new file mode 100644
index 000000000000..1e5963fe9fe9
--- /dev/null
+++ b/test/integration/consul-container/libs/service/assets/tproxy-startup.sh
@@ -0,0 +1,15 @@
+#!/usr/bin/env sh
+
+set -ex
+
+# HACK: UID of consul in the consul-client container
+# This is conveniently also the UID of apt in the envoy container
+CONSUL_UID=100
+ENVOY_UID=$(id -u)
+
+sudo consul connect redirect-traffic \
+    -proxy-uid $ENVOY_UID \
+    -exclude-uid $CONSUL_UID \
+    $REDIRECT_TRAFFIC_ARGS
+
+exec "$@"
diff --git a/test/integration/consul-container/libs/service/common.go b/test/integration/consul-container/libs/service/common.go
index ce65775df0c0..9b71f4fbd8c0 100644
--- a/test/integration/consul-container/libs/service/common.go
+++ b/test/integration/consul-container/libs/service/common.go
@@ -21,7 +21,10 @@ const (
 )
 
 //go:embed assets/Dockerfile-consul-envoy
-var consulEnvoyDockerfile string
+var consulEnvoyDockerfile []byte
+
+//go:embed assets/tproxy-startup.sh
+var tproxyStartupScript []byte
 
 // getDevContainerDockerfile returns the necessary context to build a combined consul and
 // envoy image for running "consul connect envoy ..."
@@ -29,18 +32,29 @@ func getDevContainerDockerfile() (testcontainers.FromDockerfile, error) {
 	var buf bytes.Buffer
 	tw := tar.NewWriter(&buf)
 
-	dockerfileBytes := []byte(consulEnvoyDockerfile)
-
 	hdr := &tar.Header{
 		Name: "Dockerfile",
 		Mode: 0600,
-		Size: int64(len(dockerfileBytes)),
+		Size: int64(len(consulEnvoyDockerfile)),
+	}
+	if err := tw.WriteHeader(hdr); err != nil {
+		return testcontainers.FromDockerfile{}, err
+	}
+
+	if _, err := tw.Write(consulEnvoyDockerfile); err != nil {
+		return testcontainers.FromDockerfile{}, err
+	}
+
+	hdr = &tar.Header{
+		Name: "tproxy-startup.sh",
+		Mode: 0600,
+		Size: int64(len(tproxyStartupScript)),
 	}
 	if err := tw.WriteHeader(hdr); err != nil {
 		return testcontainers.FromDockerfile{}, err
 	}
 
-	if _, err := tw.Write(dockerfileBytes); err != nil {
+	if _, err := tw.Write(tproxyStartupScript); err != nil {
 		return testcontainers.FromDockerfile{}, err
 	}
 
diff --git a/test/integration/consul-container/libs/service/connect.go b/test/integration/consul-container/libs/service/connect.go
index b1fadc867e62..d172204b5df5 100644
--- a/test/integration/consul-container/libs/service/connect.go
+++ b/test/integration/consul-container/libs/service/connect.go
@@ -10,6 +10,7 @@ import (
 	"io"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/testcontainers/testcontainers-go"
@@ -146,9 +147,10 @@ func (g ConnectContainer) GetStatus() (string, error) {
 }
 
 type SidecarConfig struct {
-	Name      string
-	ServiceID string
-	Namespace string
+	Name         string
+	ServiceID    string
+	Namespace    string
+	EnableTProxy bool
 }
 
 // NewConnectService returns a container that runs envoy sidecar, launched by
@@ -199,6 +201,26 @@ func NewConnectService(ctx context.Context, sidecarCfg SidecarConfig, serviceBin
 		Env: make(map[string]string),
 	}
 
+	if sidecarCfg.EnableTProxy {
+		req.Entrypoint = []string{"/bin/tproxy-startup.sh"}
+		req.Env["REDIRECT_TRAFFIC_ARGS"] = strings.Join(
+			[]string{
+				"-exclude-inbound-port", fmt.Sprint(internalAdminPort),
+				"-exclude-inbound-port", "8300",
+				"-exclude-inbound-port", "8301",
+				"-exclude-inbound-port", "8302",
+				"-exclude-inbound-port", "8500",
+				"-exclude-inbound-port", "8502",
+				"-exclude-inbound-port", "8600",
+				"-consul-dns-ip", "127.0.0.1",
+				"-consul-dns-port", "8600",
+				"-proxy-id", fmt.Sprintf("%s-sidecar-proxy", sidecarCfg.ServiceID),
+			},
+			" ",
+		)
+		req.CapAdd = append(req.CapAdd, "NET_ADMIN")
+	}
+
 	nodeInfo := node.GetInfo()
 	if nodeInfo.UseTLSForAPI || nodeInfo.UseTLSForGRPC {
 		req.Mounts = append(req.Mounts, testcontainers.ContainerMount{
diff --git a/test/integration/consul-container/libs/service/helpers.go b/test/integration/consul-container/libs/service/helpers.go
index 362bdb537ad9..2c06a4cd2d0b 100644
--- a/test/integration/consul-container/libs/service/helpers.go
+++ b/test/integration/consul-container/libs/service/helpers.go
@@ -27,7 +27,12 @@ type Checks struct {
 }
 
 type SidecarService struct {
-	Port int
+	Port  int
+	Proxy ConnectProxy
+}
+
+type ConnectProxy struct {
+	Mode string
 }
 
 type ServiceOpts struct {
@@ -63,9 +68,10 @@ func createAndRegisterStaticServerAndSidecar(node libcluster.Agent, httpPort int
 		_ = serverService.Terminate()
 	})
 	sidecarCfg := SidecarConfig{
-		Name:      fmt.Sprintf("%s-sidecar", svc.ID),
-		ServiceID: svc.ID,
-		Namespace: svc.Namespace,
+		Name:         fmt.Sprintf("%s-sidecar", svc.ID),
+		ServiceID:    svc.ID,
+		Namespace:    svc.Namespace,
+		EnableTProxy: svc.Proxy != nil && svc.Proxy.Mode == "transparent",
 	}
 	serverConnectProxy, err := NewConnectService(context.Background(), sidecarCfg, []int{svc.Port}, node) // bindPort not used
 	if err != nil {
@@ -102,7 +108,9 @@ func CreateAndRegisterStaticServerAndSidecar(node libcluster.Agent, serviceOpts
 		Port: p,
 		Connect: &api.AgentServiceConnect{
 			SidecarService: &api.AgentServiceRegistration{
-				Proxy: &api.AgentServiceConnectProxyConfig{},
+				Proxy: &api.AgentServiceConnectProxyConfig{
+					Mode: api.ProxyMode(serviceOpts.Connect.Proxy.Mode),
+				},
 			},
 		},
 		Namespace: serviceOpts.Namespace,
@@ -141,15 +149,34 @@ func CreateAndRegisterStaticClientSidecar(
 	node libcluster.Agent,
 	peerName string,
 	localMeshGateway bool,
+	enableTProxy bool,
 ) (*ConnectContainer, error) {
 	// Do some trickery to ensure that partial completion is correctly torn
 	// down, but successful execution is not.
 	var deferClean utils.ResettableDefer
 	defer deferClean.Execute()
 
-	mgwMode := api.MeshGatewayModeRemote
-	if localMeshGateway {
-		mgwMode = api.MeshGatewayModeLocal
+	var proxy *api.AgentServiceConnectProxyConfig
+	if enableTProxy {
+		proxy = &api.AgentServiceConnectProxyConfig{
+			Mode: "transparent",
+		}
+	} else {
+		mgwMode := api.MeshGatewayModeRemote
+		if localMeshGateway {
+			mgwMode = api.MeshGatewayModeLocal
+		}
+		proxy = &api.AgentServiceConnectProxyConfig{
+			Upstreams: []api.Upstream{{
+				DestinationName:  StaticServerServiceName,
+				DestinationPeer:  peerName,
+				LocalBindAddress: "0.0.0.0",
+				LocalBindPort:    libcluster.ServiceUpstreamLocalBindPort,
+				MeshGateway: api.MeshGatewayConfig{
+					Mode: mgwMode,
+				},
+			}},
+		}
 	}
 
 	// Register the static-client service and sidecar first to prevent race with sidecar
@@ -159,17 +186,7 @@ func CreateAndRegisterStaticClientSidecar(
 		Port: 8080,
 		Connect: &api.AgentServiceConnect{
 			SidecarService: &api.AgentServiceRegistration{
-				Proxy: &api.AgentServiceConnectProxyConfig{
-					Upstreams: []api.Upstream{{
-						DestinationName:  StaticServerServiceName,
-						DestinationPeer:  peerName,
-						LocalBindAddress: "0.0.0.0",
-						LocalBindPort:    libcluster.ServiceUpstreamLocalBindPort,
-						MeshGateway: api.MeshGatewayConfig{
-							Mode: mgwMode,
-						},
-					}},
-				},
+				Proxy: proxy,
 			},
 		},
 	}
@@ -180,8 +197,9 @@ func CreateAndRegisterStaticClientSidecar(
 
 	// Create a service and proxy instance
 	sidecarCfg := SidecarConfig{
-		Name:      fmt.Sprintf("%s-sidecar", StaticClientServiceName),
-		ServiceID: StaticClientServiceName,
+		Name:         fmt.Sprintf("%s-sidecar", StaticClientServiceName),
+		ServiceID:    StaticClientServiceName,
+		EnableTProxy: enableTProxy,
 	}
 
 	clientConnectProxy, err := NewConnectService(context.Background(), sidecarCfg, []int{libcluster.ServiceUpstreamLocalBindPort}, node)
diff --git a/test/integration/consul-container/libs/topology/peering_topology.go b/test/integration/consul-container/libs/topology/peering_topology.go
index ecc1356e882b..6e579db18cbe 100644
--- a/test/integration/consul-container/libs/topology/peering_topology.go
+++ b/test/integration/consul-container/libs/topology/peering_topology.go
@@ -140,7 +140,7 @@ func BasicPeeringTwoClustersSetup(
 
 		// Create a service and proxy instance
 		var err error
-		clientSidecarService, err = libservice.CreateAndRegisterStaticClientSidecar(clientNode, DialingPeerName, true)
+		clientSidecarService, err = libservice.CreateAndRegisterStaticClientSidecar(clientNode, DialingPeerName, true, false)
 		require.NoError(t, err)
 
 		libassert.CatalogServiceExists(t, dialingClient, "static-client-sidecar-proxy", nil)
diff --git a/test/integration/consul-container/libs/topology/service_topology.go b/test/integration/consul-container/libs/topology/service_topology.go
index 93bc638094fa..52bf217e73df 100644
--- a/test/integration/consul-container/libs/topology/service_topology.go
+++ b/test/integration/consul-container/libs/topology/service_topology.go
@@ -45,7 +45,7 @@ func CreateServices(t *testing.T, cluster *libcluster.Cluster) (libservice.Servi
 	libassert.CatalogServiceExists(t, client, libservice.StaticServerServiceName, nil)
 
 	// Create a client proxy instance with the server as an upstream
-	clientConnectProxy, err := libservice.CreateAndRegisterStaticClientSidecar(node, "", false)
+	clientConnectProxy, err := libservice.CreateAndRegisterStaticClientSidecar(node, "", false, false)
 	require.NoError(t, err)
 
 	libassert.CatalogServiceExists(t, client, fmt.Sprintf("%s-sidecar-proxy", libservice.StaticClientServiceName), nil)
diff --git a/test/integration/consul-container/test/basic/connect_service_test.go b/test/integration/consul-container/test/basic/connect_service_test.go
index e896b2a83df3..3875ad3528a9 100644
--- a/test/integration/consul-container/test/basic/connect_service_test.go
+++ b/test/integration/consul-container/test/basic/connect_service_test.go
@@ -71,7 +71,7 @@ func createServices(t *testing.T, cluster *libcluster.Cluster) libservice.Servic
 	libassert.CatalogServiceExists(t, client, libservice.StaticServerServiceName, nil)
 
 	// Create a client proxy instance with the server as an upstream
-	clientConnectProxy, err := libservice.CreateAndRegisterStaticClientSidecar(node, "", false)
+	clientConnectProxy, err := libservice.CreateAndRegisterStaticClientSidecar(node, "", false, false)
 	require.NoError(t, err)
 
 	libassert.CatalogServiceExists(t, client, "static-client-sidecar-proxy", nil)
diff --git a/test/integration/consul-container/test/tproxy/tproxy_test.go b/test/integration/consul-container/test/tproxy/tproxy_test.go
new file mode 100644
index 000000000000..36e13ceb6484
--- /dev/null
+++ b/test/integration/consul-container/test/tproxy/tproxy_test.go
@@ -0,0 +1,131 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package tproxy
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/hashicorp/consul/sdk/testutil/retry"
+	libassert "github.com/hashicorp/consul/test/integration/consul-container/libs/assert"
+	libcluster "github.com/hashicorp/consul/test/integration/consul-container/libs/cluster"
+	libservice "github.com/hashicorp/consul/test/integration/consul-container/libs/service"
+	"github.com/hashicorp/consul/test/integration/consul-container/libs/topology"
+)
+
+// TestTProxyService
+// This test makes sure two services in the same datacenter have connectivity
+// with transparent proxy enabled.
+//
+// Steps:
+//   - Create a single server cluster.
+//   - Create the example static-server and sidecar containers, then register them both with Consul
+//   - Create an example static-client sidecar, then register both the service and sidecar with Consul
+//   - Make sure a request from static-client to the virtual address (<svc>.virtual.consul) returns a
+//     response from the upstream.
+func TestTProxyService(t *testing.T) {
+	t.Parallel()
+
+	cluster, _, _ := topology.NewCluster(t, &topology.ClusterConfig{
+		NumServers:                1,
+		NumClients:                2,
+		ApplyDefaultProxySettings: true,
+		BuildOpts: &libcluster.BuildOptions{
+			Datacenter:             "dc1",
+			InjectAutoEncryption:   true,
+			InjectGossipEncryption: true,
+			// TODO(rb): fix the test to not need the service/envoy stack to use :8500
+			AllowHTTPAnyway: true,
+		},
+	})
+
+	clientService := createServices(t, cluster)
+	_, adminPort := clientService.GetAdminAddr()
+
+	libassert.AssertUpstreamEndpointStatus(t, adminPort, "static-server.default", "HEALTHY", 1)
+	libassert.AssertContainerState(t, clientService, "running")
+	assertHTTPRequestToVirtualAddress(t, clientService)
+}
+
+func assertHTTPRequestToVirtualAddress(t *testing.T, clientService libservice.Service) {
+	timer := &retry.Timer{Timeout: 120 * time.Second, Wait: 500 * time.Millisecond}
+
+	retry.RunWith(timer, t, func(r *retry.R) {
+		// Test that we can make a request to the virtual ip to reach the upstream.
+		//
+		// This uses a workaround for DNS because I had trouble modifying
+		// /etc/resolv.conf. There is a --dns option to docker run, but it
+		// didn't seem to be exposed via testcontainers. I'm not sure if it would
+		// do what I want. In any case, Docker sets up /etc/resolv.conf for certain
+		// functionality so it seems better to leave DNS alone.
+		//
+		// But, that means DNS queries aren't redirected to Consul out of the box.
+		// As a workaround, we `dig @localhost:53` which is iptables-redirected to
+		// localhost:8600 where the Consul client responds with the virtual ip.
+		//
+		// In tproxy tests, Envoy is not configured with a unique listener for each
+		// upstream. This means the usual approach for non-tproxy tests doesn't
+		// work - where we send the request to a host address mapped in to Envoy's
+		// upstream listener. Instead, we exec into the container and run curl.
+		//
+		// We must make this request with a non-envoy user. The envoy and consul
+		// users are excluded from traffic redirection rules, so instead we
+		// make the request as root.
+		out, err := clientService.Exec(
+			context.Background(),
+			[]string{"sudo", "sh", "-c", `
+			set -e
+			VIRTUAL=$(dig @localhost +short static-server.virtual.consul)
+			echo "Virtual IP: $VIRTUAL"
+			curl -s "$VIRTUAL/debug?env=dump"
+			`,
+			},
+		)
+		t.Logf("making call to upstream\nerr = %v\nout = %s", err, out)
+		require.NoError(r, err)
+		require.Regexp(r, `Virtual IP: 240.0.0.\d+`, out)
+		require.Contains(r, out, "FORTIO_NAME=static-server")
+	})
+}
+
+func createServices(t *testing.T, cluster *libcluster.Cluster) libservice.Service {
+	{
+		node := cluster.Agents[1]
+		client := node.GetClient()
+		// Create a service and proxy instance
+		serviceOpts := &libservice.ServiceOpts{
+			Name:     libservice.StaticServerServiceName,
+			ID:       "static-server",
+			HTTPPort: 8080,
+			GRPCPort: 8079,
+			Connect: libservice.SidecarService{
+				Proxy: libservice.ConnectProxy{
+					Mode: "transparent",
+				},
+			},
+		}
+
+		// Create a service and proxy instance
+		_, _, err := libservice.CreateAndRegisterStaticServerAndSidecar(node, serviceOpts)
+		require.NoError(t, err)
+
+		libassert.CatalogServiceExists(t, client, "static-server-sidecar-proxy", nil)
+		libassert.CatalogServiceExists(t, client, libservice.StaticServerServiceName, nil)
+	}
+
+	{
+		node := cluster.Agents[2]
+		client := node.GetClient()
+
+		// Create a client proxy instance with the server as an upstream
+		clientConnectProxy, err := libservice.CreateAndRegisterStaticClientSidecar(node, "", false, true)
+		require.NoError(t, err)
+
+		libassert.CatalogServiceExists(t, client, "static-client-sidecar-proxy", nil)
+		return clientConnectProxy
+	}
+}
diff --git a/test/integration/consul-container/test/upgrade/ingress_gateway_grpc_test.go b/test/integration/consul-container/test/upgrade/ingress_gateway_grpc_test.go
index 1abec11458e3..e7d3ff02d0e0 100644
--- a/test/integration/consul-container/test/upgrade/ingress_gateway_grpc_test.go
+++ b/test/integration/consul-container/test/upgrade/ingress_gateway_grpc_test.go
@@ -91,7 +91,7 @@ func TestIngressGateway_GRPC_UpgradeToTarget_fromLatest(t *testing.T) {
 	serverNodes := cluster.Servers()
 	require.NoError(t, err)
 	require.True(t, len(serverNodes) > 0)
-	staticClientSvcSidecar, err := libservice.CreateAndRegisterStaticClientSidecar(serverNodes[0], "", true)
+	staticClientSvcSidecar, err := libservice.CreateAndRegisterStaticClientSidecar(serverNodes[0], "", true, false)
 	require.NoError(t, err)
 
 	tests := func(t *testing.T) {
diff --git a/test/integration/consul-container/test/upgrade/l7_traffic_management/resolver_default_subset_test.go b/test/integration/consul-container/test/upgrade/l7_traffic_management/resolver_default_subset_test.go
index c45c6698b497..d2c99a3ce718 100644
--- a/test/integration/consul-container/test/upgrade/l7_traffic_management/resolver_default_subset_test.go
+++ b/test/integration/consul-container/test/upgrade/l7_traffic_management/resolver_default_subset_test.go
@@ -344,7 +344,7 @@ func setup(t *testing.T) (*libcluster.Cluster, libservice.Service, libservice.Se
 	require.NoError(t, err)
 
 	// Create a client proxy instance with the server as an upstream
-	staticClientProxy, err := libservice.CreateAndRegisterStaticClientSidecar(node, "", false)
+	staticClientProxy, err := libservice.CreateAndRegisterStaticClientSidecar(node, "", false, false)
 	require.NoError(t, err)
 
 	require.NoError(t, err)
diff --git a/test/integration/consul-container/test/upgrade/peering_control_plane_mgw_test.go b/test/integration/consul-container/test/upgrade/peering_control_plane_mgw_test.go
index 1aa68d2bb2dc..e341c347a5c8 100644
--- a/test/integration/consul-container/test/upgrade/peering_control_plane_mgw_test.go
+++ b/test/integration/consul-container/test/upgrade/peering_control_plane_mgw_test.go
@@ -80,7 +80,7 @@ func TestPeering_ControlPlaneMGW(t *testing.T) {
 		"upstream_cx_total", 1)
 	require.NoError(t, accepting.Gateway.Start())
 
-	clientSidecarService, err := libservice.CreateAndRegisterStaticClientSidecar(dialingCluster.Servers()[0], libtopology.DialingPeerName, true)
+	clientSidecarService, err := libservice.CreateAndRegisterStaticClientSidecar(dialingCluster.Servers()[0], libtopology.DialingPeerName, true, false)
 	require.NoError(t, err)
 	_, port := clientSidecarService.GetAddr()
 	_, adminPort := clientSidecarService.GetAdminAddr()
diff --git a/test/integration/consul-container/test/upgrade/peering_http_test.go b/test/integration/consul-container/test/upgrade/peering_http_test.go
index 9132208d8505..76e38ca679f8 100644
--- a/test/integration/consul-container/test/upgrade/peering_http_test.go
+++ b/test/integration/consul-container/test/upgrade/peering_http_test.go
@@ -324,7 +324,7 @@ func peeringUpgrade(t *testing.T, accepting, dialing *libtopology.BuiltCluster,
 func peeringPostUpgradeValidation(t *testing.T, dialing *libtopology.BuiltCluster) {
 	t.Helper()
 
-	clientSidecarService, err := libservice.CreateAndRegisterStaticClientSidecar(dialing.Cluster.Servers()[0], libtopology.DialingPeerName, true)
+	clientSidecarService, err := libservice.CreateAndRegisterStaticClientSidecar(dialing.Cluster.Servers()[0], libtopology.DialingPeerName, true, false)
 	require.NoError(t, err)
 	_, port := clientSidecarService.GetAddr()
 	_, adminPort := clientSidecarService.GetAdminAddr()
diff --git a/test/integration/consul-container/test/wanfed/wanfed_peering_test.go b/test/integration/consul-container/test/wanfed/wanfed_peering_test.go
index f25db3bbb06e..33503da2bfbe 100644
--- a/test/integration/consul-container/test/wanfed/wanfed_peering_test.go
+++ b/test/integration/consul-container/test/wanfed/wanfed_peering_test.go
@@ -57,7 +57,7 @@ func TestPeering_WanFedSecondaryDC(t *testing.T) {
 		require.NoError(t, service.Export("default", "alpha-to-secondary", c3Agent.GetClient()))
 
 		// Create a testing sidecar to proxy requests through
-		clientConnectProxy, err := libservice.CreateAndRegisterStaticClientSidecar(c2Agent, "secondary-to-alpha", false)
+		clientConnectProxy, err := libservice.CreateAndRegisterStaticClientSidecar(c2Agent, "secondary-to-alpha", false, false)
 		require.NoError(t, err)
 		libassert.CatalogServiceExists(t, c2Agent.GetClient(), "static-client-sidecar-proxy", nil)
 

From f93bb65913aef6949e6891c2c4145575eccc3a01 Mon Sep 17 00:00:00 2001
From: Mike Morris <mikemorris@users.noreply.github.com>
Date: Wed, 26 Apr 2023 13:46:22 -0400
Subject: [PATCH 25/92] docs: fixup note about node scope for admin partitions
 (#17147)

---
 website/content/docs/enterprise/admin-partitions.mdx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/website/content/docs/enterprise/admin-partitions.mdx b/website/content/docs/enterprise/admin-partitions.mdx
index 230b3d60150b..9be5a70d2e7e 100644
--- a/website/content/docs/enterprise/admin-partitions.mdx
+++ b/website/content/docs/enterprise/admin-partitions.mdx
@@ -23,7 +23,7 @@ Admin partitions exist a level above namespaces in the identity hierarchy. They
 
 As of Consul v1.11, every _datacenter_ contains a single administrative partition named `default` when created. With Consul Enterprise, operators have the option of creating multiple partitions within a single datacenter.
 
--> **Preexisting resource nodes and namespaces**: Admin partitions were introduced in Consul 1.11. Resource nodes were not namespaced prior to 1.11. After upgrading to Consul 1.11 or later, all resource nodes will be namespaced.
+-> **Preexisting nodes**: Admin partitions were introduced in Consul 1.11. Nodes existed in global scope prior to 1.11. After upgrading to Consul 1.11 or later, all nodes will be scoped to an admin partition, which will be the `default` partition when initially upgrading an existing deployment or for OSS versions.
 
 There are tutorials available to help you get started with admin partitions.
 

From 80b1dbcc7da95a272630d4708e9dfbf006a67756 Mon Sep 17 00:00:00 2001
From: Michael Wilkerson <62034708+wilkermichael@users.noreply.github.com>
Date: Wed, 26 Apr 2023 14:53:23 -0700
Subject: [PATCH 26/92] fixed aliases for sameness group (sameness_group)
 (#17161)

---
 agent/structs/config_entry_intentions.go | 2 +-
 api/config_entry_discoverychain.go       | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/agent/structs/config_entry_intentions.go b/agent/structs/config_entry_intentions.go
index 4e334065d542..bc4d36863b56 100644
--- a/agent/structs/config_entry_intentions.go
+++ b/agent/structs/config_entry_intentions.go
@@ -277,7 +277,7 @@ type SourceIntention struct {
 	Peer string `json:",omitempty"`
 
 	// SamenessGroup is the name of the sameness group, if applicable.
-	SamenessGroup string `json:",omitempty"`
+	SamenessGroup string `json:",omitempty" alias:"sameness_group"`
 }
 
 type IntentionJWTRequirement struct {
diff --git a/api/config_entry_discoverychain.go b/api/config_entry_discoverychain.go
index 13500d0c42cf..3696f7be554a 100644
--- a/api/config_entry_discoverychain.go
+++ b/api/config_entry_discoverychain.go
@@ -241,7 +241,7 @@ type ServiceResolverRedirect struct {
 	Partition     string `json:",omitempty"`
 	Datacenter    string `json:",omitempty"`
 	Peer          string `json:",omitempty"`
-	SamenessGroup string `json:",omitempty"`
+	SamenessGroup string `json:",omitempty" alias:"sameness_group"`
 }
 
 type ServiceResolverFailover struct {
@@ -252,7 +252,7 @@ type ServiceResolverFailover struct {
 	Datacenters   []string                        `json:",omitempty"`
 	Targets       []ServiceResolverFailoverTarget `json:",omitempty"`
 	Policy        *ServiceResolverFailoverPolicy  `json:",omitempty"`
-	SamenessGroup string                          `json:",omitempty"`
+	SamenessGroup string                          `json:",omitempty" alias:"sameness_group"`
 }
 
 type ServiceResolverFailoverTarget struct {

From 5eaeb7b8e5638375caf2602de912c25f48698479 Mon Sep 17 00:00:00 2001
From: Semir Patel <semir.patel@hashicorp.com>
Date: Wed, 26 Apr 2023 17:59:48 -0500
Subject: [PATCH 27/92] Support Envoy's MaxEjectionPercent and BaseEjectionTime
 config entries for passive health checks (#15979)

* Add MaxEjectionPercent to config entry

* Add BaseEjectionTime to config entry

* Add MaxEjectionPercent and BaseEjectionTime to protobufs

* Add MaxEjectionPercent and BaseEjectionTime to api

* Fix integration test breakage

* Verify MaxEjectionPercent and BaseEjectionTime in integration test upstream confings

* Website docs for MaxEjectionPercent and BaseEjection time

* Add `make docs` to browse docs at http://localhost:3000

* Changelog entry

* so that is the difference between consul-docker and dev-docker

* blah

* update proto funcs

* update proto

---------

Co-authored-by: Maliz <maliheh.monshizadeh@hashicorp.com>
---
 .changelog/15979.txt                          |   3 +
 GNUmakefile                                   |   6 +
 agent/consul/config_endpoint_test.go          |  10 +
 agent/proxycfg/proxycfg.deepcopy.go           |   9 +
 agent/structs/config_entry.go                 |  19 +
 agent/structs/config_entry_test.go            | 115 ++-
 agent/structs/structs.deepcopy.go             |  24 +
 agent/structs/structs.go                      |  20 +
 agent/xds/clusters_test.go                    |   5 +-
 agent/xds/config.go                           |  18 +-
 .../custom-passive-healthcheck.latest.golden  |   6 +-
 api/config_entry.go                           |   9 +
 api/config_entry_test.go                      |  23 +-
 .../private/pbconfigentry/config_entry.gen.go |   4 +
 .../private/pbconfigentry/config_entry.pb.go  | 950 +++++++++---------
 .../private/pbconfigentry/config_entry.proto  |   4 +
 .../connect/envoy/case-http/verify.bats       |   2 +
 .../envoy/case-upstream-config/service_s1.hcl |   3 +
 .../envoy/case-upstream-config/verify.bats    |   3 +
 .../config-entries/service-defaults.mdx       |  28 +
 .../content/docs/connect/proxies/envoy.mdx    |   7 +
 21 files changed, 775 insertions(+), 493 deletions(-)
 create mode 100644 .changelog/15979.txt

diff --git a/.changelog/15979.txt b/.changelog/15979.txt
new file mode 100644
index 000000000000..d06c39be24f5
--- /dev/null
+++ b/.changelog/15979.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+envoy: add `MaxEjectionPercent` and `BaseEjectionTime` to passive health check configs.
+```
\ No newline at end of file
diff --git a/GNUmakefile b/GNUmakefile
index da1dbaf7c2cf..6fd0379dd48a 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -405,6 +405,7 @@ ui-build-image:
 	@echo "Building UI build container"
 	@docker build $(NOCACHE) $(QUIET) -t $(UI_BUILD_TAG) - < build-support/docker/Build-UI.dockerfile
 
+# Builds consul in a docker container and then dumps executable into ./pkg/bin/...
 consul-docker: go-build-image
 	@$(SHELL) $(CURDIR)/build-support/scripts/build-docker.sh consul
 
@@ -538,6 +539,11 @@ envoy-regen:
 	@find "command/connect/envoy/testdata" -name '*.golden' -delete
 	@go test -tags '$(GOTAGS)' ./command/connect/envoy -update
 
+# Point your web browser to http://localhost:3000/consul to live render docs from ./website/
+.PHONY: docs
+docs:
+	make -C website
+
 .PHONY: help
 help:
 	$(info available make targets)
diff --git a/agent/consul/config_endpoint_test.go b/agent/consul/config_endpoint_test.go
index 4772e10ded20..e5584d857e1a 100644
--- a/agent/consul/config_endpoint_test.go
+++ b/agent/consul/config_endpoint_test.go
@@ -1484,6 +1484,8 @@ func TestConfigEntry_ResolveServiceConfig_Upstreams(t *testing.T) {
 								Interval:                10,
 								MaxFailures:             2,
 								EnforcingConsecutive5xx: uintPointer(60),
+								MaxEjectionPercent:      uintPointer(61),
+								BaseEjectionTime:        durationPointer(62 * time.Second),
 							},
 						},
 						Overrides: []*structs.UpstreamConfig{
@@ -1518,6 +1520,8 @@ func TestConfigEntry_ResolveServiceConfig_Upstreams(t *testing.T) {
 								"Interval":                int64(10),
 								"MaxFailures":             int64(2),
 								"EnforcingConsecutive5xx": int64(60),
+								"MaxEjectionPercent":      int64(61),
+								"BaseEjectionTime":        uint64(62 * time.Second),
 							},
 							"mesh_gateway": map[string]interface{}{
 								"Mode": "none",
@@ -1532,6 +1536,8 @@ func TestConfigEntry_ResolveServiceConfig_Upstreams(t *testing.T) {
 								"Interval":                int64(10),
 								"MaxFailures":             int64(2),
 								"EnforcingConsecutive5xx": int64(60),
+								"MaxEjectionPercent":      int64(61),
+								"BaseEjectionTime":        uint64(62 * time.Second),
 							},
 							"mesh_gateway": map[string]interface{}{
 								"Mode": "local",
@@ -2639,3 +2645,7 @@ func Test_gateWriteToSecondary_AllowedKinds(t *testing.T) {
 func uintPointer(v uint32) *uint32 {
 	return &v
 }
+
+func durationPointer(d time.Duration) *time.Duration {
+	return &d
+}
diff --git a/agent/proxycfg/proxycfg.deepcopy.go b/agent/proxycfg/proxycfg.deepcopy.go
index 8346032c93a8..f0d5d528ea51 100644
--- a/agent/proxycfg/proxycfg.deepcopy.go
+++ b/agent/proxycfg/proxycfg.deepcopy.go
@@ -7,6 +7,7 @@ import (
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/proto/private/pbpeering"
 	"github.com/hashicorp/consul/types"
+	"time"
 )
 
 // DeepCopy generates a deep copy of *ConfigSnapshot
@@ -452,6 +453,14 @@ func (o *configSnapshotIngressGateway) DeepCopy() *configSnapshotIngressGateway
 			cp.Defaults.PassiveHealthCheck.EnforcingConsecutive5xx = new(uint32)
 			*cp.Defaults.PassiveHealthCheck.EnforcingConsecutive5xx = *o.Defaults.PassiveHealthCheck.EnforcingConsecutive5xx
 		}
+		if o.Defaults.PassiveHealthCheck.MaxEjectionPercent != nil {
+			cp.Defaults.PassiveHealthCheck.MaxEjectionPercent = new(uint32)
+			*cp.Defaults.PassiveHealthCheck.MaxEjectionPercent = *o.Defaults.PassiveHealthCheck.MaxEjectionPercent
+		}
+		if o.Defaults.PassiveHealthCheck.BaseEjectionTime != nil {
+			cp.Defaults.PassiveHealthCheck.BaseEjectionTime = new(time.Duration)
+			*cp.Defaults.PassiveHealthCheck.BaseEjectionTime = *o.Defaults.PassiveHealthCheck.BaseEjectionTime
+		}
 	}
 	return &cp
 }
diff --git a/agent/structs/config_entry.go b/agent/structs/config_entry.go
index 663dde6e0a35..dd6671268e0d 100644
--- a/agent/structs/config_entry.go
+++ b/agent/structs/config_entry.go
@@ -1101,6 +1101,16 @@ type PassiveHealthCheck struct {
 	// when an outlier status is detected through consecutive 5xx.
 	// This setting can be used to disable ejection or to ramp it up slowly. Defaults to 100.
 	EnforcingConsecutive5xx *uint32 `json:",omitempty" alias:"enforcing_consecutive_5xx"`
+
+	// The maximum % of an upstream cluster that can be ejected due to outlier detection.
+	// Defaults to 10% but will eject at least one host regardless of the value.
+	// TODO: remove me
+	MaxEjectionPercent *uint32 `json:",omitempty" alias:"max_ejection_percent"`
+
+	// The base time that a host is ejected for. The real time is equal to the base time
+	// multiplied by the number of times the host has been ejected and is capped by
+	// max_ejection_time (Default 300s). Defaults to 30000ms or 30s.
+	BaseEjectionTime *time.Duration `json:",omitempty" alias:"base_ejection_time"`
 }
 
 func (chk *PassiveHealthCheck) Clone() *PassiveHealthCheck {
@@ -1120,6 +1130,15 @@ func (chk PassiveHealthCheck) Validate() error {
 	if chk.Interval < 0*time.Second {
 		return fmt.Errorf("passive health check interval cannot be negative")
 	}
+	if chk.EnforcingConsecutive5xx != nil && *chk.EnforcingConsecutive5xx > 100 {
+		return fmt.Errorf("passive health check enforcing_consecutive_5xx must be a percentage between 0 and 100")
+	}
+	if chk.MaxEjectionPercent != nil && *chk.MaxEjectionPercent > 100 {
+		return fmt.Errorf("passive health check max_ejection_percent must be a percentage between 0 and 100")
+	}
+	if chk.BaseEjectionTime != nil && *chk.BaseEjectionTime < 0*time.Second {
+		return fmt.Errorf("passive health check base_ejection_time cannot be negative")
+	}
 	return nil
 }
 
diff --git a/agent/structs/config_entry_test.go b/agent/structs/config_entry_test.go
index b4670f5be9ef..b7fad39a37a5 100644
--- a/agent/structs/config_entry_test.go
+++ b/agent/structs/config_entry_test.go
@@ -416,6 +416,9 @@ func TestDecodeConfigEntry(t *testing.T) {
 							passive_health_check {
 								interval = "2s"
 								max_failures = 3
+								enforcing_consecutive_5xx = 4
+								max_ejection_percent = 5
+								base_ejection_time = "6s"
 							}
 						},
 						{
@@ -460,6 +463,9 @@ func TestDecodeConfigEntry(t *testing.T) {
 							PassiveHealthCheck {
 								MaxFailures = 3
 								Interval = "2s"
+								EnforcingConsecutive5xx = 4
+								MaxEjectionPercent = 5
+								BaseEjectionTime = "6s"
 							}
 						},
 						{
@@ -502,8 +508,11 @@ func TestDecodeConfigEntry(t *testing.T) {
 						{
 							Name: "redis",
 							PassiveHealthCheck: &PassiveHealthCheck{
-								MaxFailures: 3,
-								Interval:    2 * time.Second,
+								MaxFailures:             3,
+								Interval:                2 * time.Second,
+								EnforcingConsecutive5xx: uintPointer(4),
+								MaxEjectionPercent:      uintPointer(5),
+								BaseEjectionTime:        durationPointer(6 * time.Second),
 							},
 						},
 						{
@@ -2351,6 +2360,39 @@ func TestPassiveHealthCheck_Validate(t *testing.T) {
 			wantErr: true,
 			wantMsg: "cannot be negative",
 		},
+		{
+			name:    "valid enforcing_consecutive_5xx",
+			input:   PassiveHealthCheck{EnforcingConsecutive5xx: uintPointer(100)},
+			wantErr: false,
+		},
+		{
+			name:    "invalid enforcing_consecutive_5xx",
+			input:   PassiveHealthCheck{EnforcingConsecutive5xx: uintPointer(101)},
+			wantErr: true,
+			wantMsg: "must be a percentage",
+		},
+		{
+			name:    "valid max_ejection_percent",
+			input:   PassiveHealthCheck{MaxEjectionPercent: uintPointer(100)},
+			wantErr: false,
+		},
+		{
+			name:    "invalid max_ejection_percent",
+			input:   PassiveHealthCheck{MaxEjectionPercent: uintPointer(101)},
+			wantErr: true,
+			wantMsg: "must be a percentage",
+		},
+		{
+			name:    "valid base_ejection_time",
+			input:   PassiveHealthCheck{BaseEjectionTime: durationPointer(0 * time.Second)},
+			wantErr: false,
+		},
+		{
+			name:    "negative base_ejection_time",
+			input:   PassiveHealthCheck{BaseEjectionTime: durationPointer(-1 * time.Second)},
+			wantErr: true,
+			wantMsg: "cannot be negative",
+		},
 	}
 
 	for _, tc := range tt {
@@ -2890,8 +2932,11 @@ func TestUpstreamConfig_MergeInto(t *testing.T) {
 					MaxConcurrentRequests: intPointer(5),
 				},
 				PassiveHealthCheck: &PassiveHealthCheck{
-					MaxFailures: 3,
-					Interval:    2 * time.Second,
+					Interval:                2 * time.Second,
+					MaxFailures:             3,
+					EnforcingConsecutive5xx: uintPointer(4),
+					MaxEjectionPercent:      uintPointer(5),
+					BaseEjectionTime:        durationPointer(6 * time.Second),
 				},
 				MeshGateway: MeshGatewayConfig{Mode: MeshGatewayModeRemote},
 			},
@@ -2908,8 +2953,11 @@ func TestUpstreamConfig_MergeInto(t *testing.T) {
 					MaxConcurrentRequests: intPointer(5),
 				},
 				"passive_health_check": &PassiveHealthCheck{
-					MaxFailures: 3,
-					Interval:    2 * time.Second,
+					Interval:                2 * time.Second,
+					MaxFailures:             3,
+					EnforcingConsecutive5xx: uintPointer(4),
+					MaxEjectionPercent:      uintPointer(5),
+					BaseEjectionTime:        durationPointer(6 * time.Second),
 				},
 				"mesh_gateway": MeshGatewayConfig{Mode: MeshGatewayModeRemote},
 			},
@@ -2928,8 +2976,11 @@ func TestUpstreamConfig_MergeInto(t *testing.T) {
 					MaxConcurrentRequests: intPointer(5),
 				},
 				PassiveHealthCheck: &PassiveHealthCheck{
-					MaxFailures: 3,
-					Interval:    2 * time.Second,
+					Interval:                2 * time.Second,
+					MaxFailures:             3,
+					EnforcingConsecutive5xx: uintPointer(4),
+					MaxEjectionPercent:      uintPointer(5),
+					BaseEjectionTime:        durationPointer(6 * time.Second),
 				},
 				MeshGateway: MeshGatewayConfig{Mode: MeshGatewayModeRemote},
 			},
@@ -2945,8 +2996,11 @@ func TestUpstreamConfig_MergeInto(t *testing.T) {
 					MaxConcurrentRequests: intPointer(12),
 				},
 				"passive_health_check": &PassiveHealthCheck{
-					MaxFailures: 13,
-					Interval:    14 * time.Second,
+					MaxFailures:             13,
+					Interval:                14 * time.Second,
+					EnforcingConsecutive5xx: uintPointer(15),
+					MaxEjectionPercent:      uintPointer(16),
+					BaseEjectionTime:        durationPointer(17 * time.Second),
 				},
 				"mesh_gateway": MeshGatewayConfig{Mode: MeshGatewayModeLocal},
 			},
@@ -2962,8 +3016,11 @@ func TestUpstreamConfig_MergeInto(t *testing.T) {
 					MaxConcurrentRequests: intPointer(5),
 				},
 				"passive_health_check": &PassiveHealthCheck{
-					MaxFailures: 3,
-					Interval:    2 * time.Second,
+					Interval:                2 * time.Second,
+					MaxFailures:             3,
+					EnforcingConsecutive5xx: uintPointer(4),
+					MaxEjectionPercent:      uintPointer(5),
+					BaseEjectionTime:        durationPointer(6 * time.Second),
 				},
 				"mesh_gateway": MeshGatewayConfig{Mode: MeshGatewayModeRemote},
 			},
@@ -2985,7 +3042,9 @@ func TestUpstreamConfig_MergeInto(t *testing.T) {
 				"passive_health_check": &PassiveHealthCheck{
 					MaxFailures:             13,
 					Interval:                14 * time.Second,
-					EnforcingConsecutive5xx: uintPointer(80),
+					EnforcingConsecutive5xx: uintPointer(15),
+					MaxEjectionPercent:      uintPointer(16),
+					BaseEjectionTime:        durationPointer(17 * time.Second),
 				},
 				"mesh_gateway": MeshGatewayConfig{Mode: MeshGatewayModeLocal},
 			},
@@ -3003,7 +3062,9 @@ func TestUpstreamConfig_MergeInto(t *testing.T) {
 				"passive_health_check": &PassiveHealthCheck{
 					MaxFailures:             13,
 					Interval:                14 * time.Second,
-					EnforcingConsecutive5xx: uintPointer(80),
+					EnforcingConsecutive5xx: uintPointer(15),
+					MaxEjectionPercent:      uintPointer(16),
+					BaseEjectionTime:        durationPointer(17 * time.Second),
 				},
 				"mesh_gateway": MeshGatewayConfig{Mode: MeshGatewayModeLocal},
 			},
@@ -3138,15 +3199,21 @@ func TestParseUpstreamConfig(t *testing.T) {
 			name: "passive health check map",
 			input: map[string]interface{}{
 				"passive_health_check": map[string]interface{}{
-					"interval":     "22s",
-					"max_failures": 7,
+					"interval":                  "22s",
+					"max_failures":              7,
+					"enforcing_consecutive_5xx": 8,
+					"max_ejection_percent":      9,
+					"base_ejection_time":        "10s",
 				},
 			},
 			want: UpstreamConfig{
 				ConnectTimeoutMs: 5000,
 				PassiveHealthCheck: &PassiveHealthCheck{
-					Interval:    22 * time.Second,
-					MaxFailures: 7,
+					Interval:                22 * time.Second,
+					MaxFailures:             7,
+					EnforcingConsecutive5xx: uintPointer(8),
+					MaxEjectionPercent:      uintPointer(9),
+					BaseEjectionTime:        durationPointer(10 * time.Second),
 				},
 				Protocol: "tcp",
 			},
@@ -3273,10 +3340,6 @@ func requireContainsLower(t *testing.T, haystack, needle string) {
 	require.Contains(t, strings.ToLower(haystack), strings.ToLower(needle))
 }
 
-func intPointer(i int) *int {
-	return &i
-}
-
 func TestConfigEntryQuery_CacheInfoKey(t *testing.T) {
 	assertCacheInfoKeyIsComplete(t, &ConfigEntryQuery{})
 }
@@ -3371,6 +3434,14 @@ func testConfigEntryNormalizeAndValidate(t *testing.T, cases map[string]configEn
 	}
 }
 
+func intPointer(i int) *int {
+	return &i
+}
+
 func uintPointer(v uint32) *uint32 {
 	return &v
 }
+
+func durationPointer(d time.Duration) *time.Duration {
+	return &d
+}
diff --git a/agent/structs/structs.deepcopy.go b/agent/structs/structs.deepcopy.go
index 42c8be82e8da..a72557fef749 100644
--- a/agent/structs/structs.deepcopy.go
+++ b/agent/structs/structs.deepcopy.go
@@ -529,6 +529,14 @@ func (o *IngressListener) DeepCopy() *IngressListener {
 					cp.Services[i2].PassiveHealthCheck.EnforcingConsecutive5xx = new(uint32)
 					*cp.Services[i2].PassiveHealthCheck.EnforcingConsecutive5xx = *o.Services[i2].PassiveHealthCheck.EnforcingConsecutive5xx
 				}
+				if o.Services[i2].PassiveHealthCheck.MaxEjectionPercent != nil {
+					cp.Services[i2].PassiveHealthCheck.MaxEjectionPercent = new(uint32)
+					*cp.Services[i2].PassiveHealthCheck.MaxEjectionPercent = *o.Services[i2].PassiveHealthCheck.MaxEjectionPercent
+				}
+				if o.Services[i2].PassiveHealthCheck.BaseEjectionTime != nil {
+					cp.Services[i2].PassiveHealthCheck.BaseEjectionTime = new(time.Duration)
+					*cp.Services[i2].PassiveHealthCheck.BaseEjectionTime = *o.Services[i2].PassiveHealthCheck.BaseEjectionTime
+				}
 			}
 			if o.Services[i2].Meta != nil {
 				cp.Services[i2].Meta = make(map[string]string, len(o.Services[i2].Meta))
@@ -1134,6 +1142,14 @@ func (o *UpstreamConfiguration) DeepCopy() *UpstreamConfiguration {
 						cp.Overrides[i2].PassiveHealthCheck.EnforcingConsecutive5xx = new(uint32)
 						*cp.Overrides[i2].PassiveHealthCheck.EnforcingConsecutive5xx = *o.Overrides[i2].PassiveHealthCheck.EnforcingConsecutive5xx
 					}
+					if o.Overrides[i2].PassiveHealthCheck.MaxEjectionPercent != nil {
+						cp.Overrides[i2].PassiveHealthCheck.MaxEjectionPercent = new(uint32)
+						*cp.Overrides[i2].PassiveHealthCheck.MaxEjectionPercent = *o.Overrides[i2].PassiveHealthCheck.MaxEjectionPercent
+					}
+					if o.Overrides[i2].PassiveHealthCheck.BaseEjectionTime != nil {
+						cp.Overrides[i2].PassiveHealthCheck.BaseEjectionTime = new(time.Duration)
+						*cp.Overrides[i2].PassiveHealthCheck.BaseEjectionTime = *o.Overrides[i2].PassiveHealthCheck.BaseEjectionTime
+					}
 				}
 			}
 		}
@@ -1164,6 +1180,14 @@ func (o *UpstreamConfiguration) DeepCopy() *UpstreamConfiguration {
 				cp.Defaults.PassiveHealthCheck.EnforcingConsecutive5xx = new(uint32)
 				*cp.Defaults.PassiveHealthCheck.EnforcingConsecutive5xx = *o.Defaults.PassiveHealthCheck.EnforcingConsecutive5xx
 			}
+			if o.Defaults.PassiveHealthCheck.MaxEjectionPercent != nil {
+				cp.Defaults.PassiveHealthCheck.MaxEjectionPercent = new(uint32)
+				*cp.Defaults.PassiveHealthCheck.MaxEjectionPercent = *o.Defaults.PassiveHealthCheck.MaxEjectionPercent
+			}
+			if o.Defaults.PassiveHealthCheck.BaseEjectionTime != nil {
+				cp.Defaults.PassiveHealthCheck.BaseEjectionTime = new(time.Duration)
+				*cp.Defaults.PassiveHealthCheck.BaseEjectionTime = *o.Defaults.PassiveHealthCheck.BaseEjectionTime
+			}
 		}
 	}
 	return &cp
diff --git a/agent/structs/structs.go b/agent/structs/structs.go
index ccde4f19473b..3e12999e7baf 100644
--- a/agent/structs/structs.go
+++ b/agent/structs/structs.go
@@ -3026,6 +3026,26 @@ func DurationFromProto(d *durationpb.Duration) time.Duration {
 	return d.AsDuration()
 }
 
+// This should only be used for conversions generated by MOG
+func DurationPointerToProto(d *time.Duration) *durationpb.Duration {
+	if d == nil {
+		return nil
+	}
+	return durationpb.New(*d)
+}
+
+// This should only be used for conversions generated by MOG
+func DurationPointerFromProto(d *durationpb.Duration) *time.Duration {
+	if d == nil {
+		return nil
+	}
+	return DurationPointer(d.AsDuration())
+}
+
+func DurationPointer(d time.Duration) *time.Duration {
+	return &d
+}
+
 // This should only be used for conversions generated by MOG
 func TimeFromProto(s *timestamppb.Timestamp) time.Time {
 	return s.AsTime()
diff --git a/agent/xds/clusters_test.go b/agent/xds/clusters_test.go
index 14f49ba17eb0..ff72bd35c8c9 100644
--- a/agent/xds/clusters_test.go
+++ b/agent/xds/clusters_test.go
@@ -9,6 +9,7 @@ import (
 	"sort"
 	"testing"
 	"text/template"
+	"time"
 
 	envoy_cluster_v3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
 	"github.com/hashicorp/consul/agent/xds/testcommon"
@@ -270,7 +271,9 @@ func TestClustersFromSnapshot(t *testing.T) {
 					ns.Proxy.Upstreams[0].Config["passive_health_check"] = map[string]interface{}{
 						"enforcing_consecutive_5xx": float64(80),
 						"max_failures":              float64(5),
-						"interval":                  float64(10),
+						"interval":                  float64(10 * time.Second),
+						"max_ejection_percent":      float64(100),
+						"base_ejection_time":        float64(10 * time.Second),
 					}
 				}, nil)
 			},
diff --git a/agent/xds/config.go b/agent/xds/config.go
index b2f759f82ff4..967bcb213dec 100644
--- a/agent/xds/config.go
+++ b/agent/xds/config.go
@@ -178,7 +178,7 @@ func ParseGatewayConfig(m map[string]interface{}) (GatewayConfig, error) {
 	return cfg, err
 }
 
-// Return an envoy.OutlierDetection populated by the values from structs.PassiveHealthChec.
+// Return an envoy.OutlierDetection populated by the values from structs.PassiveHealthCheck.
 // If all values are zero a default empty OutlierDetection will be returned to
 // enable outlier detection with default values.
 //   - If override is not nil, it will overwrite the values from p, e.g., ingress gateway defaults
@@ -197,13 +197,20 @@ func ToOutlierDetection(p *structs.PassiveHealthCheck, override *structs.Passive
 		}
 
 		if p.EnforcingConsecutive5xx != nil {
-			// NOTE: EnforcingConsecutive5xx must be great than 0 for ingress-gateway
+			// NOTE: EnforcingConsecutive5xx must be greater than 0 for ingress-gateway
 			if *p.EnforcingConsecutive5xx != 0 {
 				od.EnforcingConsecutive_5Xx = &wrapperspb.UInt32Value{Value: *p.EnforcingConsecutive5xx}
 			} else if allowZero {
 				od.EnforcingConsecutive_5Xx = &wrapperspb.UInt32Value{Value: *p.EnforcingConsecutive5xx}
 			}
 		}
+
+		if p.MaxEjectionPercent != nil {
+			od.MaxEjectionPercent = &wrapperspb.UInt32Value{Value: *p.MaxEjectionPercent}
+		}
+		if p.BaseEjectionTime != nil {
+			od.BaseEjectionTime = durationpb.New(*p.BaseEjectionTime)
+		}
 	}
 
 	if override == nil {
@@ -227,5 +234,12 @@ func ToOutlierDetection(p *structs.PassiveHealthCheck, override *structs.Passive
 		}
 	}
 
+	if override.MaxEjectionPercent != nil {
+		od.MaxEjectionPercent = &wrapperspb.UInt32Value{Value: *override.MaxEjectionPercent}
+	}
+	if override.BaseEjectionTime != nil {
+		od.BaseEjectionTime = durationpb.New(*override.BaseEjectionTime)
+	}
+
 	return od
 }
diff --git a/agent/xds/testdata/clusters/custom-passive-healthcheck.latest.golden b/agent/xds/testdata/clusters/custom-passive-healthcheck.latest.golden
index 41bc16f6efce..e00633358e57 100644
--- a/agent/xds/testdata/clusters/custom-passive-healthcheck.latest.golden
+++ b/agent/xds/testdata/clusters/custom-passive-healthcheck.latest.golden
@@ -20,8 +20,10 @@
       },
       "outlierDetection": {
         "consecutive5xx": 5,
-        "interval": "0.000000010s",
-        "enforcingConsecutive5xx": 80
+        "interval": "10s",
+        "enforcingConsecutive5xx": 80,
+        "maxEjectionPercent": 100,
+        "baseEjectionTime": "10s"
       },
       "commonLbConfig": {
         "healthyPanicThreshold": {
diff --git a/api/config_entry.go b/api/config_entry.go
index fe735a03fceb..259031b9366b 100644
--- a/api/config_entry.go
+++ b/api/config_entry.go
@@ -277,6 +277,15 @@ type PassiveHealthCheck struct {
 	// when an outlier status is detected through consecutive 5xx.
 	// This setting can be used to disable ejection or to ramp it up slowly.
 	EnforcingConsecutive5xx *uint32 `json:",omitempty" alias:"enforcing_consecutive_5xx"`
+
+	// The maximum % of an upstream cluster that can be ejected due to outlier detection.
+	// Defaults to 10% but will eject at least one host regardless of the value.
+	MaxEjectionPercent *uint32 `json:",omitempty" alias:"max_ejection_percent"`
+
+	// The base time that a host is ejected for. The real time is equal to the base time
+	// multiplied by the number of times the host has been ejected and is capped by
+	// max_ejection_time (Default 300s). Defaults to 30000ms or 30s.
+	BaseEjectionTime *time.Duration `json:",omitempty" alias:"base_ejection_time"`
 }
 
 // UpstreamLimits describes the limits that are associated with a specific
diff --git a/api/config_entry_test.go b/api/config_entry_test.go
index deee4395f819..2461c387b35f 100644
--- a/api/config_entry_test.go
+++ b/api/config_entry_test.go
@@ -484,7 +484,9 @@ func TestDecodeConfigEntry(t *testing.T) {
 							"PassiveHealthCheck": {
 								"MaxFailures": 3,
 								"Interval": "2s",
-								"EnforcingConsecutive5xx": 60
+								"EnforcingConsecutive5xx": 60,
+								"MaxEjectionPercent": 4,
+								"BaseEjectionTime": "5s"
 							},
 							"BalanceOutboundConnections": "exact_balance"
 						},
@@ -507,7 +509,11 @@ func TestDecodeConfigEntry(t *testing.T) {
 						},
 						"PassiveHealthCheck": {
 								"MaxFailures": 5,
-								"Interval": "4s"
+								"Interval": "4s",
+								"EnforcingConsecutive5xx": 61,
+								"MaxEjectionPercent": 5,
+								"BaseEjectionTime": "6s"
+
 						}
 					}
 				}
@@ -539,6 +545,8 @@ func TestDecodeConfigEntry(t *testing.T) {
 								MaxFailures:             3,
 								Interval:                2 * time.Second,
 								EnforcingConsecutive5xx: uint32Pointer(60),
+								MaxEjectionPercent:      uint32Pointer(4),
+								BaseEjectionTime:        durationPointer(5 * time.Second),
 							},
 							BalanceOutboundConnections: "exact_balance",
 						},
@@ -558,8 +566,11 @@ func TestDecodeConfigEntry(t *testing.T) {
 							MaxConcurrentRequests: intPointer(5),
 						},
 						PassiveHealthCheck: &PassiveHealthCheck{
-							MaxFailures: 5,
-							Interval:    4 * time.Second,
+							MaxFailures:             5,
+							Interval:                4 * time.Second,
+							EnforcingConsecutive5xx: uint32Pointer(61),
+							MaxEjectionPercent:      uint32Pointer(5),
+							BaseEjectionTime:        durationPointer(6 * time.Second),
 						},
 					},
 				},
@@ -1429,3 +1440,7 @@ func intPointer(v int) *int {
 func uint32Pointer(v uint32) *uint32 {
 	return &v
 }
+
+func durationPointer(d time.Duration) *time.Duration {
+	return &d
+}
diff --git a/proto/private/pbconfigentry/config_entry.gen.go b/proto/private/pbconfigentry/config_entry.gen.go
index 1ebf58b235b0..b41abe776d9b 100644
--- a/proto/private/pbconfigentry/config_entry.gen.go
+++ b/proto/private/pbconfigentry/config_entry.gen.go
@@ -1243,6 +1243,8 @@ func PassiveHealthCheckToStructs(s *PassiveHealthCheck, t *structs.PassiveHealth
 	t.Interval = structs.DurationFromProto(s.Interval)
 	t.MaxFailures = s.MaxFailures
 	t.EnforcingConsecutive5xx = pointerToUint32FromUint32(s.EnforcingConsecutive5Xx)
+	t.MaxEjectionPercent = pointerToUint32FromUint32(s.MaxEjectionPercent)
+	t.BaseEjectionTime = structs.DurationPointerFromProto(s.BaseEjectionTime)
 }
 func PassiveHealthCheckFromStructs(t *structs.PassiveHealthCheck, s *PassiveHealthCheck) {
 	if s == nil {
@@ -1251,6 +1253,8 @@ func PassiveHealthCheckFromStructs(t *structs.PassiveHealthCheck, s *PassiveHeal
 	s.Interval = structs.DurationToProto(t.Interval)
 	s.MaxFailures = t.MaxFailures
 	s.EnforcingConsecutive5Xx = uint32FromPointerToUint32(t.EnforcingConsecutive5xx)
+	s.MaxEjectionPercent = uint32FromPointerToUint32(t.MaxEjectionPercent)
+	s.BaseEjectionTime = structs.DurationPointerToProto(t.BaseEjectionTime)
 }
 func PeeringMeshConfigToStructs(s *PeeringMeshConfig, t *structs.PeeringMeshConfig) {
 	if s == nil {
diff --git a/proto/private/pbconfigentry/config_entry.pb.go b/proto/private/pbconfigentry/config_entry.pb.go
index 163e6edea0cc..0ab948bad7c5 100644
--- a/proto/private/pbconfigentry/config_entry.pb.go
+++ b/proto/private/pbconfigentry/config_entry.pb.go
@@ -4142,6 +4142,10 @@ type PassiveHealthCheck struct {
 	MaxFailures uint32               `protobuf:"varint,2,opt,name=MaxFailures,proto3" json:"MaxFailures,omitempty"`
 	// mog: target=EnforcingConsecutive5xx func-to=pointerToUint32FromUint32 func-from=uint32FromPointerToUint32
 	EnforcingConsecutive5Xx uint32 `protobuf:"varint,3,opt,name=EnforcingConsecutive5xx,proto3" json:"EnforcingConsecutive5xx,omitempty"`
+	// mog: func-to=pointerToUint32FromUint32 func-from=uint32FromPointerToUint32
+	MaxEjectionPercent uint32 `protobuf:"varint,4,opt,name=MaxEjectionPercent,proto3" json:"MaxEjectionPercent,omitempty"`
+	// mog: func-to=structs.DurationPointerFromProto func-from=structs.DurationPointerToProto
+	BaseEjectionTime *durationpb.Duration `protobuf:"bytes,5,opt,name=BaseEjectionTime,proto3" json:"BaseEjectionTime,omitempty"`
 }
 
 func (x *PassiveHealthCheck) Reset() {
@@ -4197,6 +4201,20 @@ func (x *PassiveHealthCheck) GetEnforcingConsecutive5Xx() uint32 {
 	return 0
 }
 
+func (x *PassiveHealthCheck) GetMaxEjectionPercent() uint32 {
+	if x != nil {
+		return x.MaxEjectionPercent
+	}
+	return 0
+}
+
+func (x *PassiveHealthCheck) GetBaseEjectionTime() *durationpb.Duration {
+	if x != nil {
+		return x.BaseEjectionTime
+	}
+	return nil
+}
+
 // mog annotation:
 //
 // target=github.com/hashicorp/consul/agent/structs.DestinationConfig
@@ -6707,7 +6725,7 @@ var file_private_pbconfigentry_config_entry_proto_rawDesc = []byte{
 	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x12, 0x34, 0x0a, 0x15, 0x4d, 0x61, 0x78, 0x43, 0x6f,
 	0x6e, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73,
 	0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x15, 0x4d, 0x61, 0x78, 0x43, 0x6f, 0x6e, 0x63, 0x75,
-	0x72, 0x72, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x22, 0xa7, 0x01,
+	0x72, 0x72, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x22, 0x9e, 0x02,
 	0x0a, 0x12, 0x50, 0x61, 0x73, 0x73, 0x69, 0x76, 0x65, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43,
 	0x68, 0x65, 0x63, 0x6b, 0x12, 0x35, 0x0a, 0x08, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c,
 	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
@@ -6718,447 +6736,454 @@ var file_private_pbconfigentry_config_entry_proto_rawDesc = []byte{
 	0x17, 0x45, 0x6e, 0x66, 0x6f, 0x72, 0x63, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6e, 0x73, 0x65, 0x63,
 	0x75, 0x74, 0x69, 0x76, 0x65, 0x35, 0x78, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x17,
 	0x45, 0x6e, 0x66, 0x6f, 0x72, 0x63, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6e, 0x73, 0x65, 0x63, 0x75,
-	0x74, 0x69, 0x76, 0x65, 0x35, 0x78, 0x78, 0x22, 0x45, 0x0a, 0x11, 0x44, 0x65, 0x73, 0x74, 0x69,
-	0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1c, 0x0a, 0x09,
-	0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52,
-	0x09, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x65, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x6f,
-	0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x22, 0xb6,
-	0x02, 0x0a, 0x0a, 0x41, 0x50, 0x49, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x12, 0x4f, 0x0a,
-	0x04, 0x4d, 0x65, 0x74, 0x61, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3b, 0x2e, 0x68, 0x61,
-	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69,
-	0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e,
-	0x74, 0x72, 0x79, 0x2e, 0x41, 0x50, 0x49, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x2e, 0x4d,
-	0x65, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x04, 0x4d, 0x65, 0x74, 0x61, 0x12, 0x57,
-	0x0a, 0x09, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x39, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
-	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x41, 0x50, 0x49, 0x47, 0x61, 0x74,
-	0x65, 0x77, 0x61, 0x79, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x52, 0x09, 0x4c, 0x69,
-	0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x73, 0x12, 0x45, 0x0a, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75,
-	0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
-	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72,
-	0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e,
-	0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x1a, 0x37,
-	0x0a, 0x09, 0x4d, 0x65, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b,
-	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a,
-	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61,
-	0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x5a, 0x0a, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75,
-	0x73, 0x12, 0x50, 0x0a, 0x0a, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18,
-	0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
-	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61,
-	0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x43, 0x6f,
-	0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x22, 0x8b, 0x02, 0x0a, 0x09, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f,
-	0x6e, 0x12, 0x12, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x16, 0x0a,
-	0x06, 0x52, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x52,
-	0x65, 0x61, 0x73, 0x6f, 0x6e, 0x12, 0x18, 0x0a, 0x07, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12,
-	0x54, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x38, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
-	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x52, 0x08, 0x52, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x4a, 0x0a, 0x12, 0x4c, 0x61, 0x73, 0x74, 0x54, 0x72, 0x61,
-	0x6e, 0x73, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x69, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x12, 0x4c,
-	0x61, 0x73, 0x74, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x69, 0x6d,
-	0x65, 0x22, 0x8c, 0x02, 0x0a, 0x12, 0x41, 0x50, 0x49, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79,
-	0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08,
-	0x48, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
-	0x48, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x6f, 0x72, 0x74,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x5d, 0x0a, 0x08,
-	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x41,
+	0x74, 0x69, 0x76, 0x65, 0x35, 0x78, 0x78, 0x12, 0x2e, 0x0a, 0x12, 0x4d, 0x61, 0x78, 0x45, 0x6a,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x65, 0x72, 0x63, 0x65, 0x6e, 0x74, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x0d, 0x52, 0x12, 0x4d, 0x61, 0x78, 0x45, 0x6a, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x50, 0x65, 0x72, 0x63, 0x65, 0x6e, 0x74, 0x12, 0x45, 0x0a, 0x10, 0x42, 0x61, 0x73, 0x65, 0x45,
+	0x6a, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x69, 0x6d, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x10, 0x42, 0x61,
+	0x73, 0x65, 0x45, 0x6a, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x69, 0x6d, 0x65, 0x22, 0x45,
+	0x0a, 0x11, 0x44, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x12, 0x1c, 0x0a, 0x09, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x65, 0x73,
+	0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x09, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x65,
+	0x73, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52,
+	0x04, 0x50, 0x6f, 0x72, 0x74, 0x22, 0xb6, 0x02, 0x0a, 0x0a, 0x41, 0x50, 0x49, 0x47, 0x61, 0x74,
+	0x65, 0x77, 0x61, 0x79, 0x12, 0x4f, 0x0a, 0x04, 0x4d, 0x65, 0x74, 0x61, 0x18, 0x01, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x3b, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x41, 0x50, 0x49, 0x47, 0x61,
+	0x74, 0x65, 0x77, 0x61, 0x79, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
+	0x04, 0x4d, 0x65, 0x74, 0x61, 0x12, 0x57, 0x0a, 0x09, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65,
+	0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x39, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
+	0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65,
+	0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79,
+	0x2e, 0x41, 0x50, 0x49, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x4c, 0x69, 0x73, 0x74, 0x65,
+	0x6e, 0x65, 0x72, 0x52, 0x09, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x73, 0x12, 0x45,
+	0x0a, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d,
 	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
 	0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x41, 0x50, 0x49, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61,
-	0x79, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f,
-	0x6c, 0x52, 0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x53, 0x0a, 0x03, 0x54,
-	0x4c, 0x53, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x41, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
+	0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x53,
+	0x74, 0x61, 0x74, 0x75, 0x73, 0x1a, 0x37, 0x0a, 0x09, 0x4d, 0x65, 0x74, 0x61, 0x45, 0x6e, 0x74,
+	0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x5a,
+	0x0a, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x50, 0x0a, 0x0a, 0x43, 0x6f, 0x6e, 0x64,
+	0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
+	0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65,
+	0x6e, 0x74, 0x72, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0a,
+	0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0x8b, 0x02, 0x0a, 0x09, 0x43,
+	0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x16, 0x0a, 0x06,
+	0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x53, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x52, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x52, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x12, 0x18, 0x0a, 0x07,
+	0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x4d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x54, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
 	0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65,
 	0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79,
-	0x2e, 0x41, 0x50, 0x49, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x54, 0x4c, 0x53, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x03, 0x54, 0x4c, 0x53,
-	0x22, 0xde, 0x01, 0x0a, 0x1a, 0x41, 0x50, 0x49, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x54,
-	0x4c, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12,
-	0x5c, 0x0a, 0x0c, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x18,
-	0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e,
+	0x63, 0x65, 0x52, 0x08, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x4a, 0x0a, 0x12,
+	0x4c, 0x61, 0x73, 0x74, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x69,
+	0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73,
+	0x74, 0x61, 0x6d, 0x70, 0x52, 0x12, 0x4c, 0x61, 0x73, 0x74, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x69,
+	0x74, 0x69, 0x6f, 0x6e, 0x54, 0x69, 0x6d, 0x65, 0x22, 0x8c, 0x02, 0x0a, 0x12, 0x41, 0x50, 0x49,
+	0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x12,
+	0x12, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e,
+	0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x48, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x48, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x12,
+	0x12, 0x0a, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x04, 0x50,
+	0x6f, 0x72, 0x74, 0x12, 0x5d, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x41, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
 	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61,
-	0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x52, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x52,
-	0x0c, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x12, 0x1e, 0x0a,
-	0x0a, 0x4d, 0x69, 0x6e, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0a, 0x4d, 0x69, 0x6e, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1e, 0x0a,
-	0x0a, 0x4d, 0x61, 0x78, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0a, 0x4d, 0x61, 0x78, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x22, 0x0a,
-	0x0c, 0x43, 0x69, 0x70, 0x68, 0x65, 0x72, 0x53, 0x75, 0x69, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20,
-	0x03, 0x28, 0x09, 0x52, 0x0c, 0x43, 0x69, 0x70, 0x68, 0x65, 0x72, 0x53, 0x75, 0x69, 0x74, 0x65,
-	0x73, 0x22, 0xb7, 0x01, 0x0a, 0x11, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65,
-	0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x4b, 0x69, 0x6e, 0x64, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4b, 0x69, 0x6e, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x4e,
-	0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12,
-	0x20, 0x0a, 0x0b, 0x53, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x53, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x4e, 0x61, 0x6d,
-	0x65, 0x12, 0x58, 0x0a, 0x0e, 0x45, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x4d,
-	0x65, 0x74, 0x61, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x68, 0x61, 0x73, 0x68,
+	0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x41, 0x50,
+	0x49, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72,
+	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63,
+	0x6f, 0x6c, 0x12, 0x53, 0x0a, 0x03, 0x54, 0x4c, 0x53, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x41, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x41, 0x50, 0x49, 0x47, 0x61, 0x74, 0x65, 0x77,
+	0x61, 0x79, 0x54, 0x4c, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x03, 0x54, 0x4c, 0x53, 0x22, 0xde, 0x01, 0x0a, 0x1a, 0x41, 0x50, 0x49, 0x47,
+	0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x54, 0x4c, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75,
+	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x5c, 0x0a, 0x0c, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66,
+	0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
+	0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65,
+	0x6e, 0x74, 0x72, 0x79, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x66,
+	0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x52, 0x0c, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
+	0x61, 0x74, 0x65, 0x73, 0x12, 0x1e, 0x0a, 0x0a, 0x4d, 0x69, 0x6e, 0x56, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x4d, 0x69, 0x6e, 0x56, 0x65, 0x72,
+	0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1e, 0x0a, 0x0a, 0x4d, 0x61, 0x78, 0x56, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x4d, 0x61, 0x78, 0x56, 0x65, 0x72,
+	0x73, 0x69, 0x6f, 0x6e, 0x12, 0x22, 0x0a, 0x0c, 0x43, 0x69, 0x70, 0x68, 0x65, 0x72, 0x53, 0x75,
+	0x69, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x43, 0x69, 0x70, 0x68,
+	0x65, 0x72, 0x53, 0x75, 0x69, 0x74, 0x65, 0x73, 0x22, 0xb7, 0x01, 0x0a, 0x11, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x12, 0x12,
+	0x0a, 0x04, 0x4b, 0x69, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4b, 0x69,
+	0x6e, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x53, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x53, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x58, 0x0a, 0x0e, 0x45, 0x6e, 0x74, 0x65,
+	0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x30, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6d,
+	0x6d, 0x6f, 0x6e, 0x2e, 0x45, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x4d, 0x65,
+	0x74, 0x61, 0x52, 0x0e, 0x45, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x4d, 0x65,
+	0x74, 0x61, 0x22, 0xfe, 0x01, 0x0a, 0x0f, 0x42, 0x6f, 0x75, 0x6e, 0x64, 0x41, 0x50, 0x49, 0x47,
+	0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x12, 0x54, 0x0a, 0x04, 0x4d, 0x65, 0x74, 0x61, 0x18, 0x01,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x40, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c,
+	0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x42, 0x6f, 0x75,
+	0x6e, 0x64, 0x41, 0x50, 0x49, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x2e, 0x4d, 0x65, 0x74,
+	0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x04, 0x4d, 0x65, 0x74, 0x61, 0x12, 0x5c, 0x0a, 0x09,
+	0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x3e, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x42, 0x6f, 0x75, 0x6e, 0x64, 0x41, 0x50, 0x49,
+	0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x52,
+	0x09, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x73, 0x1a, 0x37, 0x0a, 0x09, 0x4d, 0x65,
+	0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a,
+	0x02, 0x38, 0x01, 0x22, 0xdd, 0x01, 0x0a, 0x17, 0x42, 0x6f, 0x75, 0x6e, 0x64, 0x41, 0x50, 0x49,
+	0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x12,
+	0x12, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e,
+	0x61, 0x6d, 0x65, 0x12, 0x5c, 0x0a, 0x0c, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61,
+	0x74, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x68, 0x61, 0x73, 0x68,
 	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74,
-	0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x45, 0x6e, 0x74,
-	0x65, 0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x52, 0x0e, 0x45, 0x6e, 0x74,
-	0x65, 0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x22, 0xfe, 0x01, 0x0a, 0x0f,
-	0x42, 0x6f, 0x75, 0x6e, 0x64, 0x41, 0x50, 0x49, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x12,
-	0x54, 0x0a, 0x04, 0x4d, 0x65, 0x74, 0x61, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x40, 0x2e,
+	0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72,
+	0x79, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65,
+	0x6e, 0x63, 0x65, 0x52, 0x0c, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65,
+	0x73, 0x12, 0x50, 0x0a, 0x06, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x38, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x52, 0x06, 0x52, 0x6f, 0x75,
+	0x74, 0x65, 0x73, 0x22, 0xe6, 0x01, 0x0a, 0x11, 0x49, 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x43, 0x65,
+	0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x56, 0x0a, 0x04, 0x4d, 0x65, 0x74,
+	0x61, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x42, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72,
+	0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e,
+	0x49, 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
+	0x65, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x04, 0x4d, 0x65, 0x74,
+	0x61, 0x12, 0x20, 0x0a, 0x0b, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
+	0x61, 0x74, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65,
+	0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65,
+	0x4b, 0x65, 0x79, 0x1a, 0x37, 0x0a, 0x09, 0x4d, 0x65, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79,
+	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
+	0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x99, 0x03, 0x0a,
+	0x09, 0x48, 0x54, 0x54, 0x50, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x4e, 0x0a, 0x04, 0x4d, 0x65,
+	0x74, 0x61, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3a, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
+	0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65,
+	0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79,
+	0x2e, 0x48, 0x54, 0x54, 0x50, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x45,
+	0x6e, 0x74, 0x72, 0x79, 0x52, 0x04, 0x4d, 0x65, 0x74, 0x61, 0x12, 0x52, 0x0a, 0x07, 0x50, 0x61,
+	0x72, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x68, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69,
+	0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e,
+	0x74, 0x72, 0x79, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x66, 0x65,
+	0x72, 0x65, 0x6e, 0x63, 0x65, 0x52, 0x07, 0x50, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x4a,
+	0x0a, 0x05, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x34, 0x2e,
 	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
 	0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x42, 0x6f, 0x75, 0x6e, 0x64, 0x41, 0x50, 0x49, 0x47, 0x61,
-	0x74, 0x65, 0x77, 0x61, 0x79, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
-	0x04, 0x4d, 0x65, 0x74, 0x61, 0x12, 0x5c, 0x0a, 0x09, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65,
-	0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3e, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
+	0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52,
+	0x75, 0x6c, 0x65, 0x52, 0x05, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x1c, 0x0a, 0x09, 0x48, 0x6f,
+	0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x09, 0x48,
+	0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x12, 0x45, 0x0a, 0x06, 0x53, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
 	0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65,
 	0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79,
-	0x2e, 0x42, 0x6f, 0x75, 0x6e, 0x64, 0x41, 0x50, 0x49, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79,
-	0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x52, 0x09, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e,
-	0x65, 0x72, 0x73, 0x1a, 0x37, 0x0a, 0x09, 0x4d, 0x65, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79,
-	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
-	0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xdd, 0x01, 0x0a,
-	0x17, 0x42, 0x6f, 0x75, 0x6e, 0x64, 0x41, 0x50, 0x49, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79,
-	0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x5c, 0x0a, 0x0c,
-	0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x38, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
-	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x52, 0x0c, 0x43, 0x65,
-	0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x12, 0x50, 0x0a, 0x06, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x68, 0x61, 0x73,
-	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e,
-	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74,
-	0x72, 0x79, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x66, 0x65, 0x72,
-	0x65, 0x6e, 0x63, 0x65, 0x52, 0x06, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x22, 0xe6, 0x01, 0x0a,
-	0x11, 0x49, 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61,
-	0x74, 0x65, 0x12, 0x56, 0x0a, 0x04, 0x4d, 0x65, 0x74, 0x61, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x42, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
-	0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x49, 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x43,
-	0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x45,
-	0x6e, 0x74, 0x72, 0x79, 0x52, 0x04, 0x4d, 0x65, 0x74, 0x61, 0x12, 0x20, 0x0a, 0x0b, 0x43, 0x65,
-	0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0b, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x1e, 0x0a, 0x0a,
-	0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x0a, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x1a, 0x37, 0x0a, 0x09,
-	0x4d, 0x65, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x99, 0x03, 0x0a, 0x09, 0x48, 0x54, 0x54, 0x50, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x12, 0x4e, 0x0a, 0x04, 0x4d, 0x65, 0x74, 0x61, 0x18, 0x01, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x3a, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
-	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x04, 0x4d,
-	0x65, 0x74, 0x61, 0x12, 0x52, 0x0a, 0x07, 0x50, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x02,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
-	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c,
-	0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x52, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x52, 0x07,
-	0x50, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x4a, 0x0a, 0x05, 0x52, 0x75, 0x6c, 0x65, 0x73,
-	0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x34, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x1a,
+	0x37, 0x0a, 0x09, 0x4d, 0x65, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03,
+	0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14,
+	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xf9, 0x01, 0x0a, 0x0d, 0x48, 0x54, 0x54,
+	0x50, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x4c, 0x0a, 0x07, 0x46, 0x69,
+	0x6c, 0x74, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x68, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69,
+	0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e,
+	0x74, 0x72, 0x79, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x52,
+	0x07, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x12, 0x4a, 0x0a, 0x07, 0x4d, 0x61, 0x74, 0x63,
+	0x68, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x68, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74,
+	0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72,
+	0x79, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x52, 0x07, 0x4d, 0x61, 0x74,
+	0x63, 0x68, 0x65, 0x73, 0x12, 0x4e, 0x0a, 0x08, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73,
+	0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
 	0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e,
 	0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x48,
-	0x54, 0x54, 0x50, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x05, 0x52, 0x75,
-	0x6c, 0x65, 0x73, 0x12, 0x1c, 0x0a, 0x09, 0x48, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x73,
-	0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x09, 0x48, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65,
-	0x73, 0x12, 0x45, 0x0a, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x2d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
-	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x52, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x1a, 0x37, 0x0a, 0x09, 0x4d, 0x65, 0x74, 0x61,
-	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
-	0x01, 0x22, 0xf9, 0x01, 0x0a, 0x0d, 0x48, 0x54, 0x54, 0x50, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52,
-	0x75, 0x6c, 0x65, 0x12, 0x4c, 0x0a, 0x07, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x54, 0x54, 0x50, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x08, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x73, 0x22, 0xc4, 0x02, 0x0a, 0x09, 0x48, 0x54, 0x54, 0x50, 0x4d, 0x61, 0x74,
+	0x63, 0x68, 0x12, 0x50, 0x0a, 0x07, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
+	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e,
+	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x48, 0x54, 0x54, 0x50,
+	0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x52, 0x07, 0x48, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x73, 0x12, 0x4e, 0x0a, 0x06, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0e, 0x32, 0x36, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
 	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c,
 	0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x48, 0x54, 0x54,
-	0x50, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x52, 0x07, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72,
-	0x73, 0x12, 0x4a, 0x0a, 0x07, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x30, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x50, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x52, 0x06, 0x4d, 0x65,
+	0x74, 0x68, 0x6f, 0x64, 0x12, 0x48, 0x0a, 0x04, 0x50, 0x61, 0x74, 0x68, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x34, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
 	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x4d,
-	0x61, 0x74, 0x63, 0x68, 0x52, 0x07, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x12, 0x4e, 0x0a,
-	0x08, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x32, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
-	0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x53, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x52, 0x08, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x22, 0xc4, 0x02,
-	0x0a, 0x09, 0x48, 0x54, 0x54, 0x50, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x12, 0x50, 0x0a, 0x07, 0x48,
-	0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x68,
-	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
-	0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65,
-	0x6e, 0x74, 0x72, 0x79, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x4d,
-	0x61, 0x74, 0x63, 0x68, 0x52, 0x07, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x12, 0x4e, 0x0a,
-	0x06, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x36, 0x2e,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x50,
+	0x61, 0x74, 0x68, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x52, 0x04, 0x50, 0x61, 0x74, 0x68, 0x12, 0x4b,
+	0x0a, 0x05, 0x51, 0x75, 0x65, 0x72, 0x79, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x35, 0x2e,
 	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
 	0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x4d,
-	0x65, 0x74, 0x68, 0x6f, 0x64, 0x52, 0x06, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x48, 0x0a,
-	0x04, 0x50, 0x61, 0x74, 0x68, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x34, 0x2e, 0x68, 0x61,
+	0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x51, 0x75, 0x65, 0x72, 0x79, 0x4d,
+	0x61, 0x74, 0x63, 0x68, 0x52, 0x05, 0x51, 0x75, 0x65, 0x72, 0x79, 0x22, 0x8d, 0x01, 0x0a, 0x0f,
+	0x48, 0x54, 0x54, 0x50, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x12,
+	0x50, 0x0a, 0x05, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x3a,
+	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x48, 0x65, 0x61, 0x64, 0x65,
+	0x72, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x54, 0x79, 0x70, 0x65, 0x52, 0x05, 0x4d, 0x61, 0x74, 0x63,
+	0x68, 0x12, 0x12, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x75, 0x0a, 0x0d, 0x48,
+	0x54, 0x54, 0x50, 0x50, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x12, 0x4e, 0x0a, 0x05,
+	0x4d, 0x61, 0x74, 0x63, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x38, 0x2e, 0x68, 0x61,
 	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69,
 	0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e,
 	0x74, 0x72, 0x79, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x50, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x74, 0x63,
-	0x68, 0x52, 0x04, 0x50, 0x61, 0x74, 0x68, 0x12, 0x4b, 0x0a, 0x05, 0x51, 0x75, 0x65, 0x72, 0x79,
-	0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x35, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
-	0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e,
-	0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x48,
-	0x54, 0x54, 0x50, 0x51, 0x75, 0x65, 0x72, 0x79, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x52, 0x05, 0x51,
-	0x75, 0x65, 0x72, 0x79, 0x22, 0x8d, 0x01, 0x0a, 0x0f, 0x48, 0x54, 0x54, 0x50, 0x48, 0x65, 0x61,
-	0x64, 0x65, 0x72, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x12, 0x50, 0x0a, 0x05, 0x4d, 0x61, 0x74, 0x63,
-	0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x3a, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
-	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72,
-	0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e,
-	0x48, 0x54, 0x54, 0x50, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x54,
-	0x79, 0x70, 0x65, 0x52, 0x05, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x12, 0x12, 0x0a, 0x04, 0x4e, 0x61,
-	0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x14,
-	0x0a, 0x05, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x56,
-	0x61, 0x6c, 0x75, 0x65, 0x22, 0x75, 0x0a, 0x0d, 0x48, 0x54, 0x54, 0x50, 0x50, 0x61, 0x74, 0x68,
-	0x4d, 0x61, 0x74, 0x63, 0x68, 0x12, 0x4e, 0x0a, 0x05, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0e, 0x32, 0x38, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x68, 0x54, 0x79, 0x70, 0x65, 0x52, 0x05, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x12, 0x14, 0x0a, 0x05,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x22, 0x8b, 0x01, 0x0a, 0x0e, 0x48, 0x54, 0x54, 0x50, 0x51, 0x75, 0x65, 0x72, 0x79,
+	0x4d, 0x61, 0x74, 0x63, 0x68, 0x12, 0x4f, 0x0a, 0x05, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0e, 0x32, 0x39, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
 	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c,
 	0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x48, 0x54, 0x54,
-	0x50, 0x50, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x54, 0x79, 0x70, 0x65, 0x52, 0x05,
-	0x4d, 0x61, 0x74, 0x63, 0x68, 0x12, 0x14, 0x0a, 0x05, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x8b, 0x01, 0x0a, 0x0e,
-	0x48, 0x54, 0x54, 0x50, 0x51, 0x75, 0x65, 0x72, 0x79, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x12, 0x4f,
-	0x0a, 0x05, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x39, 0x2e,
-	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
-	0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x51, 0x75, 0x65, 0x72, 0x79, 0x4d,
-	0x61, 0x74, 0x63, 0x68, 0x54, 0x79, 0x70, 0x65, 0x52, 0x05, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x12,
-	0x12, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e,
-	0x61, 0x6d, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x05, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x22, 0xb3, 0x01, 0x0a, 0x0b, 0x48, 0x54,
-	0x54, 0x50, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x12, 0x51, 0x0a, 0x07, 0x48, 0x65, 0x61,
-	0x64, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x37, 0x2e, 0x68, 0x61, 0x73,
+	0x50, 0x51, 0x75, 0x65, 0x72, 0x79, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x54, 0x79, 0x70, 0x65, 0x52,
+	0x05, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x12, 0x12, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x56, 0x61,
+	0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x22, 0xb3, 0x01, 0x0a, 0x0b, 0x48, 0x54, 0x54, 0x50, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73,
+	0x12, 0x51, 0x0a, 0x07, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x37, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x48, 0x65,
+	0x61, 0x64, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x52, 0x07, 0x48, 0x65, 0x61, 0x64,
+	0x65, 0x72, 0x73, 0x12, 0x51, 0x0a, 0x0a, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x77, 0x72, 0x69, 0x74,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x31, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72,
+	0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e,
+	0x55, 0x52, 0x4c, 0x52, 0x65, 0x77, 0x72, 0x69, 0x74, 0x65, 0x52, 0x0a, 0x55, 0x52, 0x4c, 0x52,
+	0x65, 0x77, 0x72, 0x69, 0x74, 0x65, 0x22, 0x20, 0x0a, 0x0a, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x77,
+	0x72, 0x69, 0x74, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x50, 0x61, 0x74, 0x68, 0x22, 0xc2, 0x02, 0x0a, 0x10, 0x48, 0x54, 0x54,
+	0x50, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x52, 0x0a,
+	0x03, 0x41, 0x64, 0x64, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x40, 0x2e, 0x68, 0x61, 0x73,
 	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e,
 	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74,
 	0x72, 0x79, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x46, 0x69, 0x6c,
-	0x74, 0x65, 0x72, 0x52, 0x07, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x12, 0x51, 0x0a, 0x0a,
-	0x55, 0x52, 0x4c, 0x52, 0x65, 0x77, 0x72, 0x69, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x31, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
-	0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x77, 0x72,
-	0x69, 0x74, 0x65, 0x52, 0x0a, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x77, 0x72, 0x69, 0x74, 0x65, 0x22,
-	0x20, 0x0a, 0x0a, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x77, 0x72, 0x69, 0x74, 0x65, 0x12, 0x12, 0x0a,
-	0x04, 0x50, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x50, 0x61, 0x74,
-	0x68, 0x22, 0xc2, 0x02, 0x0a, 0x10, 0x48, 0x54, 0x54, 0x50, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72,
-	0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x52, 0x0a, 0x03, 0x41, 0x64, 0x64, 0x18, 0x01, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x40, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
-	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e,
-	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x48, 0x54, 0x54, 0x50,
-	0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x41, 0x64, 0x64,
-	0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x03, 0x41, 0x64, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x52, 0x65,
-	0x6d, 0x6f, 0x76, 0x65, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x52, 0x65, 0x6d, 0x6f,
-	0x76, 0x65, 0x12, 0x52, 0x0a, 0x03, 0x53, 0x65, 0x74, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x40, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
-	0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x48, 0x65, 0x61, 0x64,
-	0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x53, 0x65, 0x74, 0x45, 0x6e, 0x74, 0x72,
-	0x79, 0x52, 0x03, 0x53, 0x65, 0x74, 0x1a, 0x36, 0x0a, 0x08, 0x41, 0x64, 0x64, 0x45, 0x6e, 0x74,
-	0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x36,
-	0x0a, 0x08, 0x53, 0x65, 0x74, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65,
-	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05,
-	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c,
-	0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xe1, 0x01, 0x0a, 0x0b, 0x48, 0x54, 0x54, 0x50, 0x53,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x57, 0x65,
-	0x69, 0x67, 0x68, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x57, 0x65, 0x69, 0x67,
-	0x68, 0x74, 0x12, 0x4c, 0x0a, 0x07, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
-	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e,
-	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x48, 0x54, 0x54, 0x50,
-	0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x52, 0x07, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73,
-	0x12, 0x58, 0x0a, 0x0e, 0x45, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x4d, 0x65,
-	0x74, 0x61, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
-	0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65,
-	0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x45, 0x6e, 0x74, 0x65,
-	0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x52, 0x0e, 0x45, 0x6e, 0x74, 0x65,
-	0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x22, 0xfc, 0x02, 0x0a, 0x08, 0x54,
-	0x43, 0x50, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x4d, 0x0a, 0x04, 0x4d, 0x65, 0x74, 0x61, 0x18,
-	0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x39, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
-	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61,
-	0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x54, 0x43,
-	0x50, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79,
-	0x52, 0x04, 0x4d, 0x65, 0x74, 0x61, 0x12, 0x52, 0x0a, 0x07, 0x50, 0x61, 0x72, 0x65, 0x6e, 0x74,
-	0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
-	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72,
-	0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e,
-	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63,
-	0x65, 0x52, 0x07, 0x50, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x4d, 0x0a, 0x08, 0x53, 0x65,
-	0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x31, 0x2e, 0x68,
+	0x74, 0x65, 0x72, 0x2e, 0x41, 0x64, 0x64, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x03, 0x41, 0x64,
+	0x64, 0x12, 0x16, 0x0a, 0x06, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x18, 0x02, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x06, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x12, 0x52, 0x0a, 0x03, 0x53, 0x65, 0x74,
+	0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x40, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e,
+	0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x48,
+	0x54, 0x54, 0x50, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e,
+	0x53, 0x65, 0x74, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x03, 0x53, 0x65, 0x74, 0x1a, 0x36, 0x0a,
+	0x08, 0x41, 0x64, 0x64, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x36, 0x0a, 0x08, 0x53, 0x65, 0x74, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
+	0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xe1, 0x01,
+	0x0a, 0x0b, 0x48, 0x54, 0x54, 0x50, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x12, 0x0a,
+	0x04, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e, 0x61, 0x6d,
+	0x65, 0x12, 0x16, 0x0a, 0x06, 0x57, 0x65, 0x69, 0x67, 0x68, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x05, 0x52, 0x06, 0x57, 0x65, 0x69, 0x67, 0x68, 0x74, 0x12, 0x4c, 0x0a, 0x07, 0x46, 0x69, 0x6c,
+	0x74, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e,
+	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74,
+	0x72, 0x79, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x52, 0x07,
+	0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x12, 0x58, 0x0a, 0x0e, 0x45, 0x6e, 0x74, 0x65, 0x72,
+	0x70, 0x72, 0x69, 0x73, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x30, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x6d,
+	0x6f, 0x6e, 0x2e, 0x45, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x4d, 0x65, 0x74,
+	0x61, 0x52, 0x0e, 0x45, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x4d, 0x65, 0x74,
+	0x61, 0x22, 0xfc, 0x02, 0x0a, 0x08, 0x54, 0x43, 0x50, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x4d,
+	0x0a, 0x04, 0x4d, 0x65, 0x74, 0x61, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x39, 0x2e, 0x68,
 	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
 	0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65,
-	0x6e, 0x74, 0x72, 0x79, 0x2e, 0x54, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52,
-	0x08, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x45, 0x0a, 0x06, 0x53, 0x74, 0x61,
-	0x74, 0x75, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x68, 0x61, 0x73, 0x68,
-	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74,
-	0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72,
-	0x79, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x1a, 0x37, 0x0a, 0x09, 0x4d, 0x65, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
-	0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
-	0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
-	0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x7a, 0x0a, 0x0a, 0x54, 0x43, 0x50,
-	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x58, 0x0a, 0x0e, 0x45,
-	0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
+	0x6e, 0x74, 0x72, 0x79, 0x2e, 0x54, 0x43, 0x50, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x2e, 0x4d, 0x65,
+	0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x04, 0x4d, 0x65, 0x74, 0x61, 0x12, 0x52, 0x0a,
+	0x07, 0x50, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x38,
+	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52,
+	0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x52, 0x07, 0x50, 0x61, 0x72, 0x65, 0x6e, 0x74,
+	0x73, 0x12, 0x4d, 0x0a, 0x08, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x03, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x31, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
 	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e,
-	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x45, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x69, 0x73,
-	0x65, 0x4d, 0x65, 0x74, 0x61, 0x52, 0x0e, 0x45, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x69, 0x73,
-	0x65, 0x4d, 0x65, 0x74, 0x61, 0x22, 0xb4, 0x03, 0x0a, 0x0d, 0x53, 0x61, 0x6d, 0x65, 0x6e, 0x65,
-	0x73, 0x73, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x12, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2e, 0x0a, 0x12, 0x44,
-	0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x46, 0x6f, 0x72, 0x46, 0x61, 0x69, 0x6c, 0x6f, 0x76, 0x65,
-	0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74,
-	0x46, 0x6f, 0x72, 0x46, 0x61, 0x69, 0x6c, 0x6f, 0x76, 0x65, 0x72, 0x12, 0x22, 0x0a, 0x0c, 0x49,
-	0x6e, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x08, 0x52, 0x0c, 0x49, 0x6e, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x12,
-	0x54, 0x0a, 0x07, 0x4d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x3a, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
+	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x54, 0x43, 0x50, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x08, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73,
+	0x12, 0x45, 0x0a, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x2d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
 	0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x53, 0x61, 0x6d, 0x65, 0x6e, 0x65, 0x73,
-	0x73, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x4d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x52, 0x07, 0x4d, 0x65,
-	0x6d, 0x62, 0x65, 0x72, 0x73, 0x12, 0x52, 0x0a, 0x04, 0x4d, 0x65, 0x74, 0x61, 0x18, 0x05, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x3e, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
-	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e,
-	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x53, 0x61, 0x6d, 0x65,
-	0x6e, 0x65, 0x73, 0x73, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x45, 0x6e,
-	0x74, 0x72, 0x79, 0x52, 0x04, 0x4d, 0x65, 0x74, 0x61, 0x12, 0x58, 0x0a, 0x0e, 0x45, 0x6e, 0x74,
-	0x65, 0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x18, 0x06, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x30, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
-	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f,
-	0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x45, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x4d,
-	0x65, 0x74, 0x61, 0x52, 0x0e, 0x45, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x4d,
-	0x65, 0x74, 0x61, 0x1a, 0x37, 0x0a, 0x09, 0x4d, 0x65, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79,
-	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
-	0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x47, 0x0a, 0x13,
+	0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52,
+	0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x1a, 0x37, 0x0a, 0x09, 0x4d, 0x65, 0x74, 0x61, 0x45,
+	0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01,
+	0x22, 0x7a, 0x0a, 0x0a, 0x54, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x12,
+	0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e, 0x61,
+	0x6d, 0x65, 0x12, 0x58, 0x0a, 0x0e, 0x45, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x69, 0x73, 0x65,
+	0x4d, 0x65, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e,
+	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x45, 0x6e,
+	0x74, 0x65, 0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x52, 0x0e, 0x45, 0x6e,
+	0x74, 0x65, 0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x22, 0xb4, 0x03, 0x0a,
+	0x0d, 0x53, 0x61, 0x6d, 0x65, 0x6e, 0x65, 0x73, 0x73, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x12,
+	0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e, 0x61,
+	0x6d, 0x65, 0x12, 0x2e, 0x0a, 0x12, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x46, 0x6f, 0x72,
+	0x46, 0x61, 0x69, 0x6c, 0x6f, 0x76, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12,
+	0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x46, 0x6f, 0x72, 0x46, 0x61, 0x69, 0x6c, 0x6f, 0x76,
+	0x65, 0x72, 0x12, 0x22, 0x0a, 0x0c, 0x49, 0x6e, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x4c, 0x6f, 0x63,
+	0x61, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x49, 0x6e, 0x63, 0x6c, 0x75, 0x64,
+	0x65, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x12, 0x54, 0x0a, 0x07, 0x4d, 0x65, 0x6d, 0x62, 0x65, 0x72,
+	0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3a, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72,
+	0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x2e,
 	0x53, 0x61, 0x6d, 0x65, 0x6e, 0x65, 0x73, 0x73, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x4d, 0x65, 0x6d,
-	0x62, 0x65, 0x72, 0x12, 0x1c, 0x0a, 0x09, 0x50, 0x61, 0x72, 0x74, 0x69, 0x74, 0x69, 0x6f, 0x6e,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x50, 0x61, 0x72, 0x74, 0x69, 0x74, 0x69, 0x6f,
-	0x6e, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x65, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x04, 0x50, 0x65, 0x65, 0x72, 0x2a, 0x94, 0x02, 0x0a, 0x04, 0x4b, 0x69, 0x6e, 0x64, 0x12, 0x0f,
-	0x0a, 0x0b, 0x4b, 0x69, 0x6e, 0x64, 0x55, 0x6e, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x10, 0x00, 0x12,
-	0x12, 0x0a, 0x0e, 0x4b, 0x69, 0x6e, 0x64, 0x4d, 0x65, 0x73, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x10, 0x01, 0x12, 0x17, 0x0a, 0x13, 0x4b, 0x69, 0x6e, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x72, 0x10, 0x02, 0x12, 0x16, 0x0a, 0x12,
-	0x4b, 0x69, 0x6e, 0x64, 0x49, 0x6e, 0x67, 0x72, 0x65, 0x73, 0x73, 0x47, 0x61, 0x74, 0x65, 0x77,
-	0x61, 0x79, 0x10, 0x03, 0x12, 0x19, 0x0a, 0x15, 0x4b, 0x69, 0x6e, 0x64, 0x53, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x49, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x10, 0x04, 0x12,
-	0x17, 0x0a, 0x13, 0x4b, 0x69, 0x6e, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x44, 0x65,
-	0x66, 0x61, 0x75, 0x6c, 0x74, 0x73, 0x10, 0x05, 0x12, 0x19, 0x0a, 0x15, 0x4b, 0x69, 0x6e, 0x64,
-	0x49, 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
-	0x65, 0x10, 0x06, 0x12, 0x12, 0x0a, 0x0e, 0x4b, 0x69, 0x6e, 0x64, 0x41, 0x50, 0x49, 0x47, 0x61,
-	0x74, 0x65, 0x77, 0x61, 0x79, 0x10, 0x07, 0x12, 0x17, 0x0a, 0x13, 0x4b, 0x69, 0x6e, 0x64, 0x42,
-	0x6f, 0x75, 0x6e, 0x64, 0x41, 0x50, 0x49, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x10, 0x08,
-	0x12, 0x11, 0x0a, 0x0d, 0x4b, 0x69, 0x6e, 0x64, 0x48, 0x54, 0x54, 0x50, 0x52, 0x6f, 0x75, 0x74,
-	0x65, 0x10, 0x09, 0x12, 0x10, 0x0a, 0x0c, 0x4b, 0x69, 0x6e, 0x64, 0x54, 0x43, 0x50, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x10, 0x0a, 0x12, 0x15, 0x0a, 0x11, 0x4b, 0x69, 0x6e, 0x64, 0x53, 0x61, 0x6d,
-	0x65, 0x6e, 0x65, 0x73, 0x73, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x10, 0x0b, 0x2a, 0x26, 0x0a, 0x0f,
-	0x49, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x69, 0x6f, 0x6e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
-	0x08, 0x0a, 0x04, 0x44, 0x65, 0x6e, 0x79, 0x10, 0x00, 0x12, 0x09, 0x0a, 0x05, 0x41, 0x6c, 0x6c,
-	0x6f, 0x77, 0x10, 0x01, 0x2a, 0x21, 0x0a, 0x13, 0x49, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x69, 0x6f,
-	0x6e, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0a, 0x0a, 0x06, 0x43,
-	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x10, 0x00, 0x2a, 0x50, 0x0a, 0x09, 0x50, 0x72, 0x6f, 0x78, 0x79,
-	0x4d, 0x6f, 0x64, 0x65, 0x12, 0x14, 0x0a, 0x10, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x6f, 0x64,
-	0x65, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x10, 0x00, 0x12, 0x18, 0x0a, 0x14, 0x50, 0x72,
-	0x6f, 0x78, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x61, 0x72, 0x65,
-	0x6e, 0x74, 0x10, 0x01, 0x12, 0x13, 0x0a, 0x0f, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x6f, 0x64,
-	0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x10, 0x02, 0x2a, 0x5f, 0x0a, 0x0d, 0x4d, 0x75, 0x74,
-	0x75, 0x61, 0x6c, 0x54, 0x4c, 0x53, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x18, 0x0a, 0x14, 0x4d, 0x75,
-	0x74, 0x75, 0x61, 0x6c, 0x54, 0x4c, 0x53, 0x4d, 0x6f, 0x64, 0x65, 0x44, 0x65, 0x66, 0x61, 0x75,
-	0x6c, 0x74, 0x10, 0x00, 0x12, 0x17, 0x0a, 0x13, 0x4d, 0x75, 0x74, 0x75, 0x61, 0x6c, 0x54, 0x4c,
-	0x53, 0x4d, 0x6f, 0x64, 0x65, 0x53, 0x74, 0x72, 0x69, 0x63, 0x74, 0x10, 0x01, 0x12, 0x1b, 0x0a,
-	0x17, 0x4d, 0x75, 0x74, 0x75, 0x61, 0x6c, 0x54, 0x4c, 0x53, 0x4d, 0x6f, 0x64, 0x65, 0x50, 0x65,
-	0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x76, 0x65, 0x10, 0x02, 0x2a, 0x7b, 0x0a, 0x0f, 0x4d, 0x65,
-	0x73, 0x68, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x1a, 0x0a,
-	0x16, 0x4d, 0x65, 0x73, 0x68, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x4d, 0x6f, 0x64, 0x65,
-	0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x10, 0x00, 0x12, 0x17, 0x0a, 0x13, 0x4d, 0x65, 0x73,
-	0x68, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x4e, 0x6f, 0x6e, 0x65,
-	0x10, 0x01, 0x12, 0x18, 0x0a, 0x14, 0x4d, 0x65, 0x73, 0x68, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61,
-	0x79, 0x4d, 0x6f, 0x64, 0x65, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x10, 0x02, 0x12, 0x19, 0x0a, 0x15,
-	0x4d, 0x65, 0x73, 0x68, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x52,
-	0x65, 0x6d, 0x6f, 0x74, 0x65, 0x10, 0x03, 0x2a, 0x4f, 0x0a, 0x1a, 0x41, 0x50, 0x49, 0x47, 0x61,
-	0x74, 0x65, 0x77, 0x61, 0x79, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x50, 0x72, 0x6f,
-	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x18, 0x0a, 0x14, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65,
-	0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x48, 0x54, 0x54, 0x50, 0x10, 0x00, 0x12,
-	0x17, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f,
-	0x63, 0x6f, 0x6c, 0x54, 0x43, 0x50, 0x10, 0x01, 0x2a, 0x92, 0x02, 0x0a, 0x0f, 0x48, 0x54, 0x54,
-	0x50, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x16, 0x0a, 0x12,
-	0x48, 0x54, 0x54, 0x50, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x41,
-	0x6c, 0x6c, 0x10, 0x00, 0x12, 0x1a, 0x0a, 0x16, 0x48, 0x54, 0x54, 0x50, 0x4d, 0x61, 0x74, 0x63,
-	0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x10, 0x01,
-	0x12, 0x19, 0x0a, 0x15, 0x48, 0x54, 0x54, 0x50, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x4d, 0x65, 0x74,
-	0x68, 0x6f, 0x64, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x10, 0x02, 0x12, 0x16, 0x0a, 0x12, 0x48,
-	0x54, 0x54, 0x50, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x47, 0x65,
-	0x74, 0x10, 0x03, 0x12, 0x17, 0x0a, 0x13, 0x48, 0x54, 0x54, 0x50, 0x4d, 0x61, 0x74, 0x63, 0x68,
-	0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x48, 0x65, 0x61, 0x64, 0x10, 0x04, 0x12, 0x1a, 0x0a, 0x16,
-	0x48, 0x54, 0x54, 0x50, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x4f,
-	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x10, 0x05, 0x12, 0x18, 0x0a, 0x14, 0x48, 0x54, 0x54, 0x50,
-	0x4d, 0x61, 0x74, 0x63, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x50, 0x61, 0x74, 0x63, 0x68,
-	0x10, 0x06, 0x12, 0x17, 0x0a, 0x13, 0x48, 0x54, 0x54, 0x50, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x4d,
-	0x65, 0x74, 0x68, 0x6f, 0x64, 0x50, 0x6f, 0x73, 0x74, 0x10, 0x07, 0x12, 0x16, 0x0a, 0x12, 0x48,
-	0x54, 0x54, 0x50, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x50, 0x75,
-	0x74, 0x10, 0x08, 0x12, 0x18, 0x0a, 0x14, 0x48, 0x54, 0x54, 0x50, 0x4d, 0x61, 0x74, 0x63, 0x68,
-	0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x54, 0x72, 0x61, 0x63, 0x65, 0x10, 0x09, 0x2a, 0xa7, 0x01,
-	0x0a, 0x13, 0x48, 0x54, 0x54, 0x50, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x4d, 0x61, 0x74, 0x63,
-	0x68, 0x54, 0x79, 0x70, 0x65, 0x12, 0x18, 0x0a, 0x14, 0x48, 0x54, 0x54, 0x50, 0x48, 0x65, 0x61,
-	0x64, 0x65, 0x72, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x45, 0x78, 0x61, 0x63, 0x74, 0x10, 0x00, 0x12,
-	0x19, 0x0a, 0x15, 0x48, 0x54, 0x54, 0x50, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x4d, 0x61, 0x74,
-	0x63, 0x68, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x10, 0x01, 0x12, 0x1a, 0x0a, 0x16, 0x48, 0x54,
-	0x54, 0x50, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x50, 0x72, 0x65,
-	0x73, 0x65, 0x6e, 0x74, 0x10, 0x02, 0x12, 0x24, 0x0a, 0x20, 0x48, 0x54, 0x54, 0x50, 0x48, 0x65,
-	0x61, 0x64, 0x65, 0x72, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x67, 0x75, 0x6c, 0x61, 0x72,
-	0x45, 0x78, 0x70, 0x72, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x10, 0x03, 0x12, 0x19, 0x0a, 0x15,
-	0x48, 0x54, 0x54, 0x50, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x53,
-	0x75, 0x66, 0x66, 0x69, 0x78, 0x10, 0x04, 0x2a, 0x68, 0x0a, 0x11, 0x48, 0x54, 0x54, 0x50, 0x50,
-	0x61, 0x74, 0x68, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x54, 0x79, 0x70, 0x65, 0x12, 0x16, 0x0a, 0x12,
-	0x48, 0x54, 0x54, 0x50, 0x50, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x45, 0x78, 0x61,
-	0x63, 0x74, 0x10, 0x00, 0x12, 0x17, 0x0a, 0x13, 0x48, 0x54, 0x54, 0x50, 0x50, 0x61, 0x74, 0x68,
-	0x4d, 0x61, 0x74, 0x63, 0x68, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x10, 0x01, 0x12, 0x22, 0x0a,
-	0x1e, 0x48, 0x54, 0x54, 0x50, 0x50, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65,
-	0x67, 0x75, 0x6c, 0x61, 0x72, 0x45, 0x78, 0x70, 0x72, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x10,
-	0x03, 0x2a, 0x6d, 0x0a, 0x12, 0x48, 0x54, 0x54, 0x50, 0x51, 0x75, 0x65, 0x72, 0x79, 0x4d, 0x61,
-	0x74, 0x63, 0x68, 0x54, 0x79, 0x70, 0x65, 0x12, 0x17, 0x0a, 0x13, 0x48, 0x54, 0x54, 0x50, 0x51,
-	0x75, 0x65, 0x72, 0x79, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x45, 0x78, 0x61, 0x63, 0x74, 0x10, 0x00,
-	0x12, 0x19, 0x0a, 0x15, 0x48, 0x54, 0x54, 0x50, 0x51, 0x75, 0x65, 0x72, 0x79, 0x4d, 0x61, 0x74,
-	0x63, 0x68, 0x50, 0x72, 0x65, 0x73, 0x65, 0x6e, 0x74, 0x10, 0x01, 0x12, 0x23, 0x0a, 0x1f, 0x48,
-	0x54, 0x54, 0x50, 0x51, 0x75, 0x65, 0x72, 0x79, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x67,
-	0x75, 0x6c, 0x61, 0x72, 0x45, 0x78, 0x70, 0x72, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x10, 0x03,
-	0x42, 0xae, 0x02, 0x0a, 0x29, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
-	0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e,
-	0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x42, 0x10,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x50, 0x72, 0x6f, 0x74, 0x6f,
-	0x50, 0x01, 0x5a, 0x37, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68,
-	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x2f, 0x70, 0x62,
-	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0xa2, 0x02, 0x04, 0x48, 0x43,
-	0x49, 0x43, 0xaa, 0x02, 0x25, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43,
-	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0xca, 0x02, 0x25, 0x48, 0x61, 0x73,
-	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x49, 0x6e,
-	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5c, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74,
-	0x72, 0x79, 0xe2, 0x02, 0x31, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43,
-	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5c, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x28, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
-	0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x49, 0x6e, 0x74, 0x65,
-	0x72, 0x6e, 0x61, 0x6c, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72,
-	0x79, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x62, 0x65, 0x72, 0x52, 0x07, 0x4d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x73, 0x12, 0x52, 0x0a, 0x04,
+	0x4d, 0x65, 0x74, 0x61, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3e, 0x2e, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e,
+	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74,
+	0x72, 0x79, 0x2e, 0x53, 0x61, 0x6d, 0x65, 0x6e, 0x65, 0x73, 0x73, 0x47, 0x72, 0x6f, 0x75, 0x70,
+	0x2e, 0x4d, 0x65, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x04, 0x4d, 0x65, 0x74, 0x61,
+	0x12, 0x58, 0x0a, 0x0e, 0x45, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x4d, 0x65,
+	0x74, 0x61, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
+	0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x69, 0x6e, 0x74, 0x65,
+	0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x45, 0x6e, 0x74, 0x65,
+	0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x52, 0x0e, 0x45, 0x6e, 0x74, 0x65,
+	0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x1a, 0x37, 0x0a, 0x09, 0x4d, 0x65,
+	0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a,
+	0x02, 0x38, 0x01, 0x22, 0x47, 0x0a, 0x13, 0x53, 0x61, 0x6d, 0x65, 0x6e, 0x65, 0x73, 0x73, 0x47,
+	0x72, 0x6f, 0x75, 0x70, 0x4d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x12, 0x1c, 0x0a, 0x09, 0x50, 0x61,
+	0x72, 0x74, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x50,
+	0x61, 0x72, 0x74, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x65, 0x65, 0x72,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x50, 0x65, 0x65, 0x72, 0x2a, 0x94, 0x02, 0x0a,
+	0x04, 0x4b, 0x69, 0x6e, 0x64, 0x12, 0x0f, 0x0a, 0x0b, 0x4b, 0x69, 0x6e, 0x64, 0x55, 0x6e, 0x6b,
+	0x6e, 0x6f, 0x77, 0x6e, 0x10, 0x00, 0x12, 0x12, 0x0a, 0x0e, 0x4b, 0x69, 0x6e, 0x64, 0x4d, 0x65,
+	0x73, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x10, 0x01, 0x12, 0x17, 0x0a, 0x13, 0x4b, 0x69,
+	0x6e, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65,
+	0x72, 0x10, 0x02, 0x12, 0x16, 0x0a, 0x12, 0x4b, 0x69, 0x6e, 0x64, 0x49, 0x6e, 0x67, 0x72, 0x65,
+	0x73, 0x73, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x10, 0x03, 0x12, 0x19, 0x0a, 0x15, 0x4b,
+	0x69, 0x6e, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x74, 0x65, 0x6e, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x10, 0x04, 0x12, 0x17, 0x0a, 0x13, 0x4b, 0x69, 0x6e, 0x64, 0x53, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x73, 0x10, 0x05, 0x12,
+	0x19, 0x0a, 0x15, 0x4b, 0x69, 0x6e, 0x64, 0x49, 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x43, 0x65, 0x72,
+	0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x10, 0x06, 0x12, 0x12, 0x0a, 0x0e, 0x4b, 0x69,
+	0x6e, 0x64, 0x41, 0x50, 0x49, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x10, 0x07, 0x12, 0x17,
+	0x0a, 0x13, 0x4b, 0x69, 0x6e, 0x64, 0x42, 0x6f, 0x75, 0x6e, 0x64, 0x41, 0x50, 0x49, 0x47, 0x61,
+	0x74, 0x65, 0x77, 0x61, 0x79, 0x10, 0x08, 0x12, 0x11, 0x0a, 0x0d, 0x4b, 0x69, 0x6e, 0x64, 0x48,
+	0x54, 0x54, 0x50, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x10, 0x09, 0x12, 0x10, 0x0a, 0x0c, 0x4b, 0x69,
+	0x6e, 0x64, 0x54, 0x43, 0x50, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x10, 0x0a, 0x12, 0x15, 0x0a, 0x11,
+	0x4b, 0x69, 0x6e, 0x64, 0x53, 0x61, 0x6d, 0x65, 0x6e, 0x65, 0x73, 0x73, 0x47, 0x72, 0x6f, 0x75,
+	0x70, 0x10, 0x0b, 0x2a, 0x26, 0x0a, 0x0f, 0x49, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x69, 0x6f, 0x6e,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x08, 0x0a, 0x04, 0x44, 0x65, 0x6e, 0x79, 0x10, 0x00,
+	0x12, 0x09, 0x0a, 0x05, 0x41, 0x6c, 0x6c, 0x6f, 0x77, 0x10, 0x01, 0x2a, 0x21, 0x0a, 0x13, 0x49,
+	0x6e, 0x74, 0x65, 0x6e, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x54, 0x79,
+	0x70, 0x65, 0x12, 0x0a, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x10, 0x00, 0x2a, 0x50,
+	0x0a, 0x09, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x14, 0x0a, 0x10, 0x50,
+	0x72, 0x6f, 0x78, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x10,
+	0x00, 0x12, 0x18, 0x0a, 0x14, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x54, 0x72,
+	0x61, 0x6e, 0x73, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x10, 0x01, 0x12, 0x13, 0x0a, 0x0f, 0x50,
+	0x72, 0x6f, 0x78, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x10, 0x02,
+	0x2a, 0x5f, 0x0a, 0x0d, 0x4d, 0x75, 0x74, 0x75, 0x61, 0x6c, 0x54, 0x4c, 0x53, 0x4d, 0x6f, 0x64,
+	0x65, 0x12, 0x18, 0x0a, 0x14, 0x4d, 0x75, 0x74, 0x75, 0x61, 0x6c, 0x54, 0x4c, 0x53, 0x4d, 0x6f,
+	0x64, 0x65, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x10, 0x00, 0x12, 0x17, 0x0a, 0x13, 0x4d,
+	0x75, 0x74, 0x75, 0x61, 0x6c, 0x54, 0x4c, 0x53, 0x4d, 0x6f, 0x64, 0x65, 0x53, 0x74, 0x72, 0x69,
+	0x63, 0x74, 0x10, 0x01, 0x12, 0x1b, 0x0a, 0x17, 0x4d, 0x75, 0x74, 0x75, 0x61, 0x6c, 0x54, 0x4c,
+	0x53, 0x4d, 0x6f, 0x64, 0x65, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x76, 0x65, 0x10,
+	0x02, 0x2a, 0x7b, 0x0a, 0x0f, 0x4d, 0x65, 0x73, 0x68, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79,
+	0x4d, 0x6f, 0x64, 0x65, 0x12, 0x1a, 0x0a, 0x16, 0x4d, 0x65, 0x73, 0x68, 0x47, 0x61, 0x74, 0x65,
+	0x77, 0x61, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x10, 0x00,
+	0x12, 0x17, 0x0a, 0x13, 0x4d, 0x65, 0x73, 0x68, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x4d,
+	0x6f, 0x64, 0x65, 0x4e, 0x6f, 0x6e, 0x65, 0x10, 0x01, 0x12, 0x18, 0x0a, 0x14, 0x4d, 0x65, 0x73,
+	0x68, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x4c, 0x6f, 0x63, 0x61,
+	0x6c, 0x10, 0x02, 0x12, 0x19, 0x0a, 0x15, 0x4d, 0x65, 0x73, 0x68, 0x47, 0x61, 0x74, 0x65, 0x77,
+	0x61, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x10, 0x03, 0x2a, 0x4f,
+	0x0a, 0x1a, 0x41, 0x50, 0x49, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x4c, 0x69, 0x73, 0x74,
+	0x65, 0x6e, 0x65, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x18, 0x0a, 0x14,
+	0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c,
+	0x48, 0x54, 0x54, 0x50, 0x10, 0x00, 0x12, 0x17, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e,
+	0x65, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x54, 0x43, 0x50, 0x10, 0x01, 0x2a,
+	0x92, 0x02, 0x0a, 0x0f, 0x48, 0x54, 0x54, 0x50, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x4d, 0x65, 0x74,
+	0x68, 0x6f, 0x64, 0x12, 0x16, 0x0a, 0x12, 0x48, 0x54, 0x54, 0x50, 0x4d, 0x61, 0x74, 0x63, 0x68,
+	0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x41, 0x6c, 0x6c, 0x10, 0x00, 0x12, 0x1a, 0x0a, 0x16, 0x48,
+	0x54, 0x54, 0x50, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x43, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x10, 0x01, 0x12, 0x19, 0x0a, 0x15, 0x48, 0x54, 0x54, 0x50, 0x4d,
+	0x61, 0x74, 0x63, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
+	0x10, 0x02, 0x12, 0x16, 0x0a, 0x12, 0x48, 0x54, 0x54, 0x50, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x4d,
+	0x65, 0x74, 0x68, 0x6f, 0x64, 0x47, 0x65, 0x74, 0x10, 0x03, 0x12, 0x17, 0x0a, 0x13, 0x48, 0x54,
+	0x54, 0x50, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x48, 0x65, 0x61,
+	0x64, 0x10, 0x04, 0x12, 0x1a, 0x0a, 0x16, 0x48, 0x54, 0x54, 0x50, 0x4d, 0x61, 0x74, 0x63, 0x68,
+	0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x10, 0x05, 0x12,
+	0x18, 0x0a, 0x14, 0x48, 0x54, 0x54, 0x50, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x4d, 0x65, 0x74, 0x68,
+	0x6f, 0x64, 0x50, 0x61, 0x74, 0x63, 0x68, 0x10, 0x06, 0x12, 0x17, 0x0a, 0x13, 0x48, 0x54, 0x54,
+	0x50, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x50, 0x6f, 0x73, 0x74,
+	0x10, 0x07, 0x12, 0x16, 0x0a, 0x12, 0x48, 0x54, 0x54, 0x50, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x4d,
+	0x65, 0x74, 0x68, 0x6f, 0x64, 0x50, 0x75, 0x74, 0x10, 0x08, 0x12, 0x18, 0x0a, 0x14, 0x48, 0x54,
+	0x54, 0x50, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x54, 0x72, 0x61,
+	0x63, 0x65, 0x10, 0x09, 0x2a, 0xa7, 0x01, 0x0a, 0x13, 0x48, 0x54, 0x54, 0x50, 0x48, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x54, 0x79, 0x70, 0x65, 0x12, 0x18, 0x0a, 0x14,
+	0x48, 0x54, 0x54, 0x50, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x45,
+	0x78, 0x61, 0x63, 0x74, 0x10, 0x00, 0x12, 0x19, 0x0a, 0x15, 0x48, 0x54, 0x54, 0x50, 0x48, 0x65,
+	0x61, 0x64, 0x65, 0x72, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x10,
+	0x01, 0x12, 0x1a, 0x0a, 0x16, 0x48, 0x54, 0x54, 0x50, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x4d,
+	0x61, 0x74, 0x63, 0x68, 0x50, 0x72, 0x65, 0x73, 0x65, 0x6e, 0x74, 0x10, 0x02, 0x12, 0x24, 0x0a,
+	0x20, 0x48, 0x54, 0x54, 0x50, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x4d, 0x61, 0x74, 0x63, 0x68,
+	0x52, 0x65, 0x67, 0x75, 0x6c, 0x61, 0x72, 0x45, 0x78, 0x70, 0x72, 0x65, 0x73, 0x73, 0x69, 0x6f,
+	0x6e, 0x10, 0x03, 0x12, 0x19, 0x0a, 0x15, 0x48, 0x54, 0x54, 0x50, 0x48, 0x65, 0x61, 0x64, 0x65,
+	0x72, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x53, 0x75, 0x66, 0x66, 0x69, 0x78, 0x10, 0x04, 0x2a, 0x68,
+	0x0a, 0x11, 0x48, 0x54, 0x54, 0x50, 0x50, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x54,
+	0x79, 0x70, 0x65, 0x12, 0x16, 0x0a, 0x12, 0x48, 0x54, 0x54, 0x50, 0x50, 0x61, 0x74, 0x68, 0x4d,
+	0x61, 0x74, 0x63, 0x68, 0x45, 0x78, 0x61, 0x63, 0x74, 0x10, 0x00, 0x12, 0x17, 0x0a, 0x13, 0x48,
+	0x54, 0x54, 0x50, 0x50, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x50, 0x72, 0x65, 0x66,
+	0x69, 0x78, 0x10, 0x01, 0x12, 0x22, 0x0a, 0x1e, 0x48, 0x54, 0x54, 0x50, 0x50, 0x61, 0x74, 0x68,
+	0x4d, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x67, 0x75, 0x6c, 0x61, 0x72, 0x45, 0x78, 0x70, 0x72,
+	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x10, 0x03, 0x2a, 0x6d, 0x0a, 0x12, 0x48, 0x54, 0x54, 0x50,
+	0x51, 0x75, 0x65, 0x72, 0x79, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x54, 0x79, 0x70, 0x65, 0x12, 0x17,
+	0x0a, 0x13, 0x48, 0x54, 0x54, 0x50, 0x51, 0x75, 0x65, 0x72, 0x79, 0x4d, 0x61, 0x74, 0x63, 0x68,
+	0x45, 0x78, 0x61, 0x63, 0x74, 0x10, 0x00, 0x12, 0x19, 0x0a, 0x15, 0x48, 0x54, 0x54, 0x50, 0x51,
+	0x75, 0x65, 0x72, 0x79, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x50, 0x72, 0x65, 0x73, 0x65, 0x6e, 0x74,
+	0x10, 0x01, 0x12, 0x23, 0x0a, 0x1f, 0x48, 0x54, 0x54, 0x50, 0x51, 0x75, 0x65, 0x72, 0x79, 0x4d,
+	0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x67, 0x75, 0x6c, 0x61, 0x72, 0x45, 0x78, 0x70, 0x72, 0x65,
+	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x10, 0x03, 0x42, 0xae, 0x02, 0x0a, 0x29, 0x63, 0x6f, 0x6d, 0x2e,
+	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x65, 0x6e, 0x74, 0x72, 0x79, 0x42, 0x10, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x45, 0x6e, 0x74,
+	0x72, 0x79, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x37, 0x67, 0x69, 0x74, 0x68, 0x75,
+	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f,
+	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x70, 0x72, 0x69,
+	0x76, 0x61, 0x74, 0x65, 0x2f, 0x70, 0x62, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74,
+	0x72, 0x79, 0xa2, 0x02, 0x04, 0x48, 0x43, 0x49, 0x43, 0xaa, 0x02, 0x25, 0x48, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x49, 0x6e, 0x74,
+	0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72,
+	0x79, 0xca, 0x02, 0x25, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5c, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0xe2, 0x02, 0x31, 0x48, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x49, 0x6e, 0x74,
+	0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5c, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72,
+	0x79, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x28,
+	0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x3a, 0x3a, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x3a, 0x3a, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -7368,56 +7393,57 @@ var file_private_pbconfigentry_config_entry_proto_depIdxs = []int32{
 	54,  // 84: hashicorp.consul.internal.configentry.UpstreamConfig.PassiveHealthCheck:type_name -> hashicorp.consul.internal.configentry.PassiveHealthCheck
 	48,  // 85: hashicorp.consul.internal.configentry.UpstreamConfig.MeshGateway:type_name -> hashicorp.consul.internal.configentry.MeshGatewayConfig
 	100, // 86: hashicorp.consul.internal.configentry.PassiveHealthCheck.Interval:type_name -> google.protobuf.Duration
-	90,  // 87: hashicorp.consul.internal.configentry.APIGateway.Meta:type_name -> hashicorp.consul.internal.configentry.APIGateway.MetaEntry
-	59,  // 88: hashicorp.consul.internal.configentry.APIGateway.Listeners:type_name -> hashicorp.consul.internal.configentry.APIGatewayListener
-	57,  // 89: hashicorp.consul.internal.configentry.APIGateway.Status:type_name -> hashicorp.consul.internal.configentry.Status
-	58,  // 90: hashicorp.consul.internal.configentry.Status.Conditions:type_name -> hashicorp.consul.internal.configentry.Condition
-	61,  // 91: hashicorp.consul.internal.configentry.Condition.Resource:type_name -> hashicorp.consul.internal.configentry.ResourceReference
-	101, // 92: hashicorp.consul.internal.configentry.Condition.LastTransitionTime:type_name -> google.protobuf.Timestamp
-	6,   // 93: hashicorp.consul.internal.configentry.APIGatewayListener.Protocol:type_name -> hashicorp.consul.internal.configentry.APIGatewayListenerProtocol
-	60,  // 94: hashicorp.consul.internal.configentry.APIGatewayListener.TLS:type_name -> hashicorp.consul.internal.configentry.APIGatewayTLSConfiguration
-	61,  // 95: hashicorp.consul.internal.configentry.APIGatewayTLSConfiguration.Certificates:type_name -> hashicorp.consul.internal.configentry.ResourceReference
-	98,  // 96: hashicorp.consul.internal.configentry.ResourceReference.EnterpriseMeta:type_name -> hashicorp.consul.internal.common.EnterpriseMeta
-	91,  // 97: hashicorp.consul.internal.configentry.BoundAPIGateway.Meta:type_name -> hashicorp.consul.internal.configentry.BoundAPIGateway.MetaEntry
-	63,  // 98: hashicorp.consul.internal.configentry.BoundAPIGateway.Listeners:type_name -> hashicorp.consul.internal.configentry.BoundAPIGatewayListener
-	61,  // 99: hashicorp.consul.internal.configentry.BoundAPIGatewayListener.Certificates:type_name -> hashicorp.consul.internal.configentry.ResourceReference
-	61,  // 100: hashicorp.consul.internal.configentry.BoundAPIGatewayListener.Routes:type_name -> hashicorp.consul.internal.configentry.ResourceReference
-	92,  // 101: hashicorp.consul.internal.configentry.InlineCertificate.Meta:type_name -> hashicorp.consul.internal.configentry.InlineCertificate.MetaEntry
-	93,  // 102: hashicorp.consul.internal.configentry.HTTPRoute.Meta:type_name -> hashicorp.consul.internal.configentry.HTTPRoute.MetaEntry
-	61,  // 103: hashicorp.consul.internal.configentry.HTTPRoute.Parents:type_name -> hashicorp.consul.internal.configentry.ResourceReference
-	66,  // 104: hashicorp.consul.internal.configentry.HTTPRoute.Rules:type_name -> hashicorp.consul.internal.configentry.HTTPRouteRule
-	57,  // 105: hashicorp.consul.internal.configentry.HTTPRoute.Status:type_name -> hashicorp.consul.internal.configentry.Status
-	71,  // 106: hashicorp.consul.internal.configentry.HTTPRouteRule.Filters:type_name -> hashicorp.consul.internal.configentry.HTTPFilters
-	67,  // 107: hashicorp.consul.internal.configentry.HTTPRouteRule.Matches:type_name -> hashicorp.consul.internal.configentry.HTTPMatch
-	74,  // 108: hashicorp.consul.internal.configentry.HTTPRouteRule.Services:type_name -> hashicorp.consul.internal.configentry.HTTPService
-	68,  // 109: hashicorp.consul.internal.configentry.HTTPMatch.Headers:type_name -> hashicorp.consul.internal.configentry.HTTPHeaderMatch
-	7,   // 110: hashicorp.consul.internal.configentry.HTTPMatch.Method:type_name -> hashicorp.consul.internal.configentry.HTTPMatchMethod
-	69,  // 111: hashicorp.consul.internal.configentry.HTTPMatch.Path:type_name -> hashicorp.consul.internal.configentry.HTTPPathMatch
-	70,  // 112: hashicorp.consul.internal.configentry.HTTPMatch.Query:type_name -> hashicorp.consul.internal.configentry.HTTPQueryMatch
-	8,   // 113: hashicorp.consul.internal.configentry.HTTPHeaderMatch.Match:type_name -> hashicorp.consul.internal.configentry.HTTPHeaderMatchType
-	9,   // 114: hashicorp.consul.internal.configentry.HTTPPathMatch.Match:type_name -> hashicorp.consul.internal.configentry.HTTPPathMatchType
-	10,  // 115: hashicorp.consul.internal.configentry.HTTPQueryMatch.Match:type_name -> hashicorp.consul.internal.configentry.HTTPQueryMatchType
-	73,  // 116: hashicorp.consul.internal.configentry.HTTPFilters.Headers:type_name -> hashicorp.consul.internal.configentry.HTTPHeaderFilter
-	72,  // 117: hashicorp.consul.internal.configentry.HTTPFilters.URLRewrite:type_name -> hashicorp.consul.internal.configentry.URLRewrite
-	94,  // 118: hashicorp.consul.internal.configentry.HTTPHeaderFilter.Add:type_name -> hashicorp.consul.internal.configentry.HTTPHeaderFilter.AddEntry
-	95,  // 119: hashicorp.consul.internal.configentry.HTTPHeaderFilter.Set:type_name -> hashicorp.consul.internal.configentry.HTTPHeaderFilter.SetEntry
-	71,  // 120: hashicorp.consul.internal.configentry.HTTPService.Filters:type_name -> hashicorp.consul.internal.configentry.HTTPFilters
-	98,  // 121: hashicorp.consul.internal.configentry.HTTPService.EnterpriseMeta:type_name -> hashicorp.consul.internal.common.EnterpriseMeta
-	96,  // 122: hashicorp.consul.internal.configentry.TCPRoute.Meta:type_name -> hashicorp.consul.internal.configentry.TCPRoute.MetaEntry
-	61,  // 123: hashicorp.consul.internal.configentry.TCPRoute.Parents:type_name -> hashicorp.consul.internal.configentry.ResourceReference
-	76,  // 124: hashicorp.consul.internal.configentry.TCPRoute.Services:type_name -> hashicorp.consul.internal.configentry.TCPService
-	57,  // 125: hashicorp.consul.internal.configentry.TCPRoute.Status:type_name -> hashicorp.consul.internal.configentry.Status
-	98,  // 126: hashicorp.consul.internal.configentry.TCPService.EnterpriseMeta:type_name -> hashicorp.consul.internal.common.EnterpriseMeta
-	78,  // 127: hashicorp.consul.internal.configentry.SamenessGroup.Members:type_name -> hashicorp.consul.internal.configentry.SamenessGroupMember
-	97,  // 128: hashicorp.consul.internal.configentry.SamenessGroup.Meta:type_name -> hashicorp.consul.internal.configentry.SamenessGroup.MetaEntry
-	98,  // 129: hashicorp.consul.internal.configentry.SamenessGroup.EnterpriseMeta:type_name -> hashicorp.consul.internal.common.EnterpriseMeta
-	19,  // 130: hashicorp.consul.internal.configentry.ServiceResolver.SubsetsEntry.value:type_name -> hashicorp.consul.internal.configentry.ServiceResolverSubset
-	21,  // 131: hashicorp.consul.internal.configentry.ServiceResolver.FailoverEntry.value:type_name -> hashicorp.consul.internal.configentry.ServiceResolverFailover
-	132, // [132:132] is the sub-list for method output_type
-	132, // [132:132] is the sub-list for method input_type
-	132, // [132:132] is the sub-list for extension type_name
-	132, // [132:132] is the sub-list for extension extendee
-	0,   // [0:132] is the sub-list for field type_name
+	100, // 87: hashicorp.consul.internal.configentry.PassiveHealthCheck.BaseEjectionTime:type_name -> google.protobuf.Duration
+	90,  // 88: hashicorp.consul.internal.configentry.APIGateway.Meta:type_name -> hashicorp.consul.internal.configentry.APIGateway.MetaEntry
+	59,  // 89: hashicorp.consul.internal.configentry.APIGateway.Listeners:type_name -> hashicorp.consul.internal.configentry.APIGatewayListener
+	57,  // 90: hashicorp.consul.internal.configentry.APIGateway.Status:type_name -> hashicorp.consul.internal.configentry.Status
+	58,  // 91: hashicorp.consul.internal.configentry.Status.Conditions:type_name -> hashicorp.consul.internal.configentry.Condition
+	61,  // 92: hashicorp.consul.internal.configentry.Condition.Resource:type_name -> hashicorp.consul.internal.configentry.ResourceReference
+	101, // 93: hashicorp.consul.internal.configentry.Condition.LastTransitionTime:type_name -> google.protobuf.Timestamp
+	6,   // 94: hashicorp.consul.internal.configentry.APIGatewayListener.Protocol:type_name -> hashicorp.consul.internal.configentry.APIGatewayListenerProtocol
+	60,  // 95: hashicorp.consul.internal.configentry.APIGatewayListener.TLS:type_name -> hashicorp.consul.internal.configentry.APIGatewayTLSConfiguration
+	61,  // 96: hashicorp.consul.internal.configentry.APIGatewayTLSConfiguration.Certificates:type_name -> hashicorp.consul.internal.configentry.ResourceReference
+	98,  // 97: hashicorp.consul.internal.configentry.ResourceReference.EnterpriseMeta:type_name -> hashicorp.consul.internal.common.EnterpriseMeta
+	91,  // 98: hashicorp.consul.internal.configentry.BoundAPIGateway.Meta:type_name -> hashicorp.consul.internal.configentry.BoundAPIGateway.MetaEntry
+	63,  // 99: hashicorp.consul.internal.configentry.BoundAPIGateway.Listeners:type_name -> hashicorp.consul.internal.configentry.BoundAPIGatewayListener
+	61,  // 100: hashicorp.consul.internal.configentry.BoundAPIGatewayListener.Certificates:type_name -> hashicorp.consul.internal.configentry.ResourceReference
+	61,  // 101: hashicorp.consul.internal.configentry.BoundAPIGatewayListener.Routes:type_name -> hashicorp.consul.internal.configentry.ResourceReference
+	92,  // 102: hashicorp.consul.internal.configentry.InlineCertificate.Meta:type_name -> hashicorp.consul.internal.configentry.InlineCertificate.MetaEntry
+	93,  // 103: hashicorp.consul.internal.configentry.HTTPRoute.Meta:type_name -> hashicorp.consul.internal.configentry.HTTPRoute.MetaEntry
+	61,  // 104: hashicorp.consul.internal.configentry.HTTPRoute.Parents:type_name -> hashicorp.consul.internal.configentry.ResourceReference
+	66,  // 105: hashicorp.consul.internal.configentry.HTTPRoute.Rules:type_name -> hashicorp.consul.internal.configentry.HTTPRouteRule
+	57,  // 106: hashicorp.consul.internal.configentry.HTTPRoute.Status:type_name -> hashicorp.consul.internal.configentry.Status
+	71,  // 107: hashicorp.consul.internal.configentry.HTTPRouteRule.Filters:type_name -> hashicorp.consul.internal.configentry.HTTPFilters
+	67,  // 108: hashicorp.consul.internal.configentry.HTTPRouteRule.Matches:type_name -> hashicorp.consul.internal.configentry.HTTPMatch
+	74,  // 109: hashicorp.consul.internal.configentry.HTTPRouteRule.Services:type_name -> hashicorp.consul.internal.configentry.HTTPService
+	68,  // 110: hashicorp.consul.internal.configentry.HTTPMatch.Headers:type_name -> hashicorp.consul.internal.configentry.HTTPHeaderMatch
+	7,   // 111: hashicorp.consul.internal.configentry.HTTPMatch.Method:type_name -> hashicorp.consul.internal.configentry.HTTPMatchMethod
+	69,  // 112: hashicorp.consul.internal.configentry.HTTPMatch.Path:type_name -> hashicorp.consul.internal.configentry.HTTPPathMatch
+	70,  // 113: hashicorp.consul.internal.configentry.HTTPMatch.Query:type_name -> hashicorp.consul.internal.configentry.HTTPQueryMatch
+	8,   // 114: hashicorp.consul.internal.configentry.HTTPHeaderMatch.Match:type_name -> hashicorp.consul.internal.configentry.HTTPHeaderMatchType
+	9,   // 115: hashicorp.consul.internal.configentry.HTTPPathMatch.Match:type_name -> hashicorp.consul.internal.configentry.HTTPPathMatchType
+	10,  // 116: hashicorp.consul.internal.configentry.HTTPQueryMatch.Match:type_name -> hashicorp.consul.internal.configentry.HTTPQueryMatchType
+	73,  // 117: hashicorp.consul.internal.configentry.HTTPFilters.Headers:type_name -> hashicorp.consul.internal.configentry.HTTPHeaderFilter
+	72,  // 118: hashicorp.consul.internal.configentry.HTTPFilters.URLRewrite:type_name -> hashicorp.consul.internal.configentry.URLRewrite
+	94,  // 119: hashicorp.consul.internal.configentry.HTTPHeaderFilter.Add:type_name -> hashicorp.consul.internal.configentry.HTTPHeaderFilter.AddEntry
+	95,  // 120: hashicorp.consul.internal.configentry.HTTPHeaderFilter.Set:type_name -> hashicorp.consul.internal.configentry.HTTPHeaderFilter.SetEntry
+	71,  // 121: hashicorp.consul.internal.configentry.HTTPService.Filters:type_name -> hashicorp.consul.internal.configentry.HTTPFilters
+	98,  // 122: hashicorp.consul.internal.configentry.HTTPService.EnterpriseMeta:type_name -> hashicorp.consul.internal.common.EnterpriseMeta
+	96,  // 123: hashicorp.consul.internal.configentry.TCPRoute.Meta:type_name -> hashicorp.consul.internal.configentry.TCPRoute.MetaEntry
+	61,  // 124: hashicorp.consul.internal.configentry.TCPRoute.Parents:type_name -> hashicorp.consul.internal.configentry.ResourceReference
+	76,  // 125: hashicorp.consul.internal.configentry.TCPRoute.Services:type_name -> hashicorp.consul.internal.configentry.TCPService
+	57,  // 126: hashicorp.consul.internal.configentry.TCPRoute.Status:type_name -> hashicorp.consul.internal.configentry.Status
+	98,  // 127: hashicorp.consul.internal.configentry.TCPService.EnterpriseMeta:type_name -> hashicorp.consul.internal.common.EnterpriseMeta
+	78,  // 128: hashicorp.consul.internal.configentry.SamenessGroup.Members:type_name -> hashicorp.consul.internal.configentry.SamenessGroupMember
+	97,  // 129: hashicorp.consul.internal.configentry.SamenessGroup.Meta:type_name -> hashicorp.consul.internal.configentry.SamenessGroup.MetaEntry
+	98,  // 130: hashicorp.consul.internal.configentry.SamenessGroup.EnterpriseMeta:type_name -> hashicorp.consul.internal.common.EnterpriseMeta
+	19,  // 131: hashicorp.consul.internal.configentry.ServiceResolver.SubsetsEntry.value:type_name -> hashicorp.consul.internal.configentry.ServiceResolverSubset
+	21,  // 132: hashicorp.consul.internal.configentry.ServiceResolver.FailoverEntry.value:type_name -> hashicorp.consul.internal.configentry.ServiceResolverFailover
+	133, // [133:133] is the sub-list for method output_type
+	133, // [133:133] is the sub-list for method input_type
+	133, // [133:133] is the sub-list for extension type_name
+	133, // [133:133] is the sub-list for extension extendee
+	0,   // [0:133] is the sub-list for field type_name
 }
 
 func init() { file_private_pbconfigentry_config_entry_proto_init() }
diff --git a/proto/private/pbconfigentry/config_entry.proto b/proto/private/pbconfigentry/config_entry.proto
index 2a72777c17e2..a6ceb9fe0028 100644
--- a/proto/private/pbconfigentry/config_entry.proto
+++ b/proto/private/pbconfigentry/config_entry.proto
@@ -633,6 +633,10 @@ message PassiveHealthCheck {
   uint32 MaxFailures = 2;
   // mog: target=EnforcingConsecutive5xx func-to=pointerToUint32FromUint32 func-from=uint32FromPointerToUint32
   uint32 EnforcingConsecutive5xx = 3;
+  // mog: func-to=pointerToUint32FromUint32 func-from=uint32FromPointerToUint32
+  uint32 MaxEjectionPercent = 4;
+  // mog: func-to=structs.DurationPointerFromProto func-from=structs.DurationPointerToProto
+  google.protobuf.Duration BaseEjectionTime = 5;
 }
 
 // mog annotation:
diff --git a/test/integration/connect/envoy/case-http/verify.bats b/test/integration/connect/envoy/case-http/verify.bats
index 646928aaf603..2163719eaac6 100644
--- a/test/integration/connect/envoy/case-http/verify.bats
+++ b/test/integration/connect/envoy/case-http/verify.bats
@@ -76,6 +76,8 @@ load helpers
   [ "$(echo $CLUSTER_CONFIG | jq --raw-output '.outlier_detection.interval')" = "22s" ]
   [ "$(echo $CLUSTER_CONFIG | jq --raw-output '.outlier_detection.consecutive_5xx')" = null ]
   [ "$(echo $CLUSTER_CONFIG | jq --raw-output '.outlier_detection.enforcing_consecutive_5xx')" = null ]
+  [ "$(echo $CLUSTER_CONFIG | jq --raw-output '.outlier_detection.max_ejection_percent')" = null ]
+  [ "$(echo $CLUSTER_CONFIG | jq --raw-output '.outlier_detection.base_ejection_time')" = null ]
 }
 
 @test "s2 proxy should have been configured with http rbac filters" {
diff --git a/test/integration/connect/envoy/case-upstream-config/service_s1.hcl b/test/integration/connect/envoy/case-upstream-config/service_s1.hcl
index c449b95f2451..6d3da674ed96 100644
--- a/test/integration/connect/envoy/case-upstream-config/service_s1.hcl
+++ b/test/integration/connect/envoy/case-upstream-config/service_s1.hcl
@@ -20,6 +20,9 @@ services {
               passive_health_check {
                 interval = "22s"
                 max_failures = 4
+                enforcing_consecutive_5xx = 99
+                max_ejection_percent = 50
+                base_ejection_time = "60s"
               }
             }
           }
diff --git a/test/integration/connect/envoy/case-upstream-config/verify.bats b/test/integration/connect/envoy/case-upstream-config/verify.bats
index 426595fa9714..70f8966413a1 100644
--- a/test/integration/connect/envoy/case-upstream-config/verify.bats
+++ b/test/integration/connect/envoy/case-upstream-config/verify.bats
@@ -49,4 +49,7 @@ load helpers
 
   [ "$(echo $CLUSTER_CONFIG | jq --raw-output '.outlier_detection.consecutive_5xx')" = "4" ]
   [ "$(echo $CLUSTER_CONFIG | jq --raw-output '.outlier_detection.interval')" = "22s" ]
+  [ "$(echo $CLUSTER_CONFIG | jq --raw-output '.outlier_detection.enforcing_consecutive_5xx')" = "99" ]
+  [ "$(echo $CLUSTER_CONFIG | jq --raw-output '.outlier_detection.max_ejection_percent')" = "50" ]
+  [ "$(echo $CLUSTER_CONFIG | jq --raw-output '.outlier_detection.base_ejection_time')" = "60s" ]
 }
diff --git a/website/content/docs/connect/config-entries/service-defaults.mdx b/website/content/docs/connect/config-entries/service-defaults.mdx
index 3205f4659235..d15ac43735cb 100644
--- a/website/content/docs/connect/config-entries/service-defaults.mdx
+++ b/website/content/docs/connect/config-entries/service-defaults.mdx
@@ -1746,6 +1746,20 @@ represents a location outside the Consul cluster. Services can dial destinations
                        after a passive health check detects an outlier status through consecutive 5xx.`,
                   },
                 },
+                {
+                  name: 'MaxEjectionPercent',
+                  type: 'int: 10',
+                  description: `Measured in percent (%), the maximum percentage of hosts that can be ejected
+                    from a upstream cluster due to passive health check failures. If not specified, inherits 
+                    Envoy's default of 10% or at least one host.`,
+                },
+                {
+                  name: 'BaseEjectionTime',
+                  type: 'duration: 30s',
+                  description: `The base time that a host is ejected for. The real time is equal to the base
+                    time multiplied by the number of times the host has been ejected and is capped by 
+                    max_ejection_time (Default 300s). If not speficied, inherits Envoy's default value of 30s.`,
+                },
               ],
             },
           ],
@@ -1897,6 +1911,20 @@ represents a location outside the Consul cluster. Services can dial destinations
                        after a passive health check detects an outlier status through consecutive 5xx.`,
                   },
                 },
+                {
+                  name: 'MaxEjectionPercent',
+                  type: 'int: 10',
+                  description: `Measured in percent (%), the maximum percentage of hosts that can be ejected
+                    from a upstream cluster due to passive health check failures. If not specified, inherits 
+                    Envoy's default of 10% or at least one host.`,
+                },
+                {
+                  name: 'BaseEjectionTime',
+                  type: 'duration: 30s',
+                  description: `The base time that a host is ejected for. The real time is equal to the base
+                    time multiplied by the number of times the host has been ejected and is capped by 
+                    max_ejection_time (Default 300s). If not speficied, inherits Envoy's default value of 30s.`,
+                },
               ],
             },
           ],
diff --git a/website/content/docs/connect/proxies/envoy.mdx b/website/content/docs/connect/proxies/envoy.mdx
index 15b7856a0826..53f6d816ad6e 100644
--- a/website/content/docs/connect/proxies/envoy.mdx
+++ b/website/content/docs/connect/proxies/envoy.mdx
@@ -412,6 +412,13 @@ definition](/consul/docs/connect/registration/service-registration) or
     host will be actually ejected when the proxy detects an outlier status
     through consecutive errors in the 500 code range. If not specified, Consul
     uses the proxy's default value. For example, `100` for Envoy proxy.
+  - `max_ejection_percent` - The maximum percentage of hosts that can be ejected
+    from a upstream cluster due to passive health check failures. If not specified,
+    inherits Envoy's default of 10% or at least one host.
+  - `base_ejection_time` - The base time that a host is ejected for. The real 
+     time is equal to the base time multiplied by the number of times the host has 
+     been ejected and is capped by max_ejection_time (Default 300s). If not 
+     speficied, inherits Envoy's default value of 30s.
 
 - `balance_outbound_connections` - Specifies the strategy for balancing outbound connections
   across Envoy worker threads. Consul service mesh Envoy integration supports the

From f03d6a06bedaf1b5c96168828b113d955ceeef3a Mon Sep 17 00:00:00 2001
From: Anita Akaeze <anita.akaeze@hashicorp.com>
Date: Wed, 26 Apr 2023 20:29:43 -0400
Subject: [PATCH 28/92] Merge pull request #5288 from hashicorp/NET-3648_fix
 (#17163)

NET-3648: perform envoy version verification
---
 .github/scripts/verify_envoy_version.sh    | 178 +++++++++++++++++++++
 .github/workflows/verify-envoy-version.yml |  28 ++++
 2 files changed, 206 insertions(+)
 create mode 100755 .github/scripts/verify_envoy_version.sh
 create mode 100644 .github/workflows/verify-envoy-version.yml

diff --git a/.github/scripts/verify_envoy_version.sh b/.github/scripts/verify_envoy_version.sh
new file mode 100755
index 000000000000..773431f50bc8
--- /dev/null
+++ b/.github/scripts/verify_envoy_version.sh
@@ -0,0 +1,178 @@
+#!/bin/bash
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+set -euo pipefail
+
+current_branch=$GITHUB_REF
+GITHUB_DEFAULT_BRANCH='main'
+
+if [ -z "$GITHUB_TOKEN" ]; then
+  echo "GITHUB_TOKEN must be set"
+  exit 1
+fi
+
+if [ -z "$current_branch" ]; then
+  echo "GITHUB_REF must be set"
+  exit 1
+fi
+
+# Get Consul and Envoy version 
+SCRIPT_DIR="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"
+pushd $SCRIPT_DIR/../.. # repository root
+consul_envoy_data_json=$(echo go run ./test/integration/consul-container/test/consul_envoy_version/consul_envoy_version.go)
+# go back to where you started when finished
+popd
+
+if [ -z "$consul_envoy_data_json" ]; then
+  echo "Error! Consul and Envoy versions not returned: $consul_envoy_data_json"
+  exit 1
+fi
+
+# sanitize_consul_envoy_version removes characters from result that may contain new lines, spaces, and [...]
+# example envoyVersions:[1.25.4 1.24.6 1.23.8 1.22.11] => 1.25.4 1.24.6 1.23.8 1.22.11
+sanitize_consul_envoy_version() {
+  local _consul_version=$(eval "$consul_envoy_data_json" | jq -r '.ConsulVersion')
+  local _envoy_version=$(eval "$consul_envoy_data_json" | jq -r '.EnvoyVersions' | tr -d '"' | tr -d '\n' | tr -d ' '| tr -d '[]')
+  echo "${_consul_version}" "${_envoy_version}"
+}
+
+# get major version for Consul and Envoy
+get_major_version(){
+  local _verison="$1"
+  local _abbrVersion="$(cut -d "." -f1-2 <<< $_verison)"
+  echo "${_abbrVersion}"
+}
+
+get_latest_envoy_version() {
+  OUTPUT_FILE=$(mktemp)
+  HTTP_CODE=$(curl -L --silent --output "$OUTPUT_FILE" -w "%{http_code}" \
+    -H "Accept: application/vnd.github+json" \
+    -H "Authorization: Bearer ${GITHUB_TOKEN}"\
+    -H "X-GitHub-Api-Version: 2022-11-28" \
+    https://api.github.com/repos/envoyproxy/envoy/releases/latest)
+  if [[ ${HTTP_CODE} -lt 200 || ${HTTP_CODE} -gt 299 ]]; then
+    cat >&2 "$OUTPUT_FILE"
+    rm "$OUTPUT_FILE"
+    exit 1
+  fi
+  _latest_envoy_version=$(jq -r '.tag_name' "$OUTPUT_FILE")
+  echo "$_latest_envoy_version" 
+  rm "$OUTPUT_FILE"
+}
+
+# major_envoy_versions takes multiple arguments
+major_envoy_versions(){
+  version=("$@")
+  for i in "${version[@]}";
+  do
+    envoy_versions_array+="$(cut -d "." -f1-2 <<< $i)"
+  done
+  echo "${envoy_versions_array}"
+}
+
+# Get latest Envoy version from envoyproxy repo
+released_envoy_version=$(get_latest_envoy_version)
+major_released_envoy_version="${released_envoy_version[@]:1:4}"
+
+validate_envoy_version_main(){
+  echo "verify "main" GitHub branch has latest envoy version"
+  # Get envoy version for current branch
+  ENVOY_VERSIONS=$(sanitize_consul_envoy_version | awk '{print $2}' | tr ',' ' ')
+  envoy_version_main_branch=$(get_major_version ${ENVOY_VERSIONS})
+
+  if [[ "$envoy_version_main_branch" != "$major_released_envoy_version" ]]; then
+    echo
+    echo "Latest released Envoy version is: "$released_envoy_version""
+    echo "ERROR! Branch $current_branch; Envoy versions: "$ENVOY_VERSIONS" needs to be updated."
+    exit 1
+    else
+      echo "#### SUCCESS! ##### Compatible Envoy versions found: ${ENVOY_VERSIONS}"
+      exit 0
+  fi
+}
+
+if [[ "$current_branch" == *"$GITHUB_DEFAULT_BRANCH"* ]]; then
+  validate_envoy_version_main
+fi 
+
+# filter consul and envoy version 
+CONSUL_VERSION=$(sanitize_consul_envoy_version | awk '{print $1}')
+ENVOY_VERSIONS=$(sanitize_consul_envoy_version | awk '{print $2}' | tr ',' ' ') 
+
+# Get Consul and Envoy version from default branch
+echo checking out "${GITHUB_DEFAULT_BRANCH}" branch
+git checkout "${GITHUB_DEFAULT_BRANCH}"
+
+# filter consul and envoy version from default branch 
+CONSUL_VERSION_DEFAULT_BRANCH=$(sanitize_consul_envoy_version | awk '{print $1}')
+ENVOY_VERSIONS_DEFAULT_BRANCH=$(sanitize_consul_envoy_version | awk '{print $2}' | tr ',' ' ') 
+
+# Ensure required values are not empty
+if [ -z "$CONSUL_VERSION" ] || [ -z "$CONSUL_VERSION_DEFAULT_BRANCH" ] || [ -z "$ENVOY_VERSIONS" ] || [ -z "$ENVOY_VERSIONS_DEFAULT_BRANCH" ]; then
+  echo "Error! Consul version: $CONSUL_VERSION | Consul version default branch: $CONSUL_VERSION_DEFAULT_BRANCH | Envoy version: $ENVOY_VERSIONS | Envoy version default branch: $ENVOY_VERSIONS_DEFAULT_BRANCH cannot be empty"
+  exit 1
+fi
+
+echo checking out branch: "${current_branch}"
+git checkout "${current_branch}"
+
+echo
+echo "Branch ${current_branch} =>Consul version: ${CONSUL_VERSION}; Envoy Version: ${ENVOY_VERSIONS}" 
+echo "Branch ${GITHUB_DEFAULT_BRANCH} =>Consul version: ${CONSUL_VERSION_DEFAULT_BRANCH}; Envoy Version: ${ENVOY_VERSIONS_DEFAULT_BRANCH}" 
+
+## Get major Consul and Envoy versions on release and default branch
+MAJOR_CONSUL_VERSION=$(get_major_version ${CONSUL_VERSION})
+MAJOR_CONSUL_VERSION_DEFAULT_BRANCH=$(get_major_version ${CONSUL_VERSION_DEFAULT_BRANCH})
+MAJOR_ENVOY_VERSION_DEFAULT_BRANCH=$(get_major_version ${ENVOY_VERSIONS_DEFAULT_BRANCH})
+
+_envoy_versions=($ENVOY_VERSIONS)
+_envoy_versions_default=($ENVOY_VERSIONS_DEFAULT_BRANCH)
+
+## Validate supported envoy versions available - should be 4
+echo
+echo "Validating supported envoy versions available on branches: $current_branch and $GITHUB_DEFAULT_BRANCH"
+if [ "${#_envoy_versions_default[@]}" != 4 ] || [ "${#_envoy_versions[@]}" != 4 ]; then
+  echo "Branch $GITHUB_DEFAULT_BRANCH =>Consul version: ${CONSUL_VERSION_DEFAULT_BRANCH}; Envoy versions: $ENVOY_VERSIONS_DEFAULT_BRANCH"
+  echo "Branch $current_branch =>Consul version: ${CONSUL_VERSION}; Envoy versions: $_envoy_versions"
+  echo "ERROR! Envoy should have 4 compatible versions."
+  exit 1
+fi 
+
+echo "Checking if branch $GITHUB_DEFAULT_BRANCH has latest Envoy version"
+## 1. Check "main" GitHub branch has latest envoy version
+if [[ "$MAJOR_ENVOY_VERSION_DEFAULT_BRANCH" != "$major_released_envoy_version" ]]; then
+  echo
+  echo "Latest released Envoy version is: "$released_envoy_version""
+  echo "ERROR! Branch $GITHUB_DEFAULT_BRANCH; Envoy versions: "$ENVOY_VERSIONS_DEFAULT_BRANCH" needs to be updated."
+  exit 1
+  else
+    echo "#### SUCCESS! #####. Compatible Envoy versions found: ${ENVOY_VERSIONS_DEFAULT_BRANCH}"
+    echo
+
+    ## 2. Check main branch and release branch support the same Envoy major versions
+    ## Get the major Consul version on the main and release branch. If both branches have
+    ## the same major Consul version, verify both branches have the same major Envoy versions.
+    ## Return error if major envoy versions are not the same.
+    echo "Checking branch $current_branch and $GITHUB_DEFAULT_BRANCH have the same compatible major Envoy versions."
+    consul_version_diff=$(echo "$MAJOR_CONSUL_VERSION_DEFAULT_BRANCH $MAJOR_CONSUL_VERSION" | awk '{print $1 - $2}')
+    check=$(echo "$consul_version_diff == 0" | bc -l)
+
+    if (( $check )); then
+      echo "Branch $current_branch and $GITHUB_DEFAULT_BRANCH have the same major Consul version "$MAJOR_CONSUL_VERSION""
+      echo "Validating branches have the same Envoy major versions..."
+      _major_envoy_versions=$(major_envoy_versions $ENVOY_VERSIONS)
+      _major_envoy_versions_default=$(major_envoy_versions $ENVOY_VERSIONS_DEFAULT_BRANCH)
+
+      if [[ "$_major_envoy_versions_default" != "$_major_envoy_versions" ]]; then
+          echo "Branch $GITHUB_DEFAULT_BRANCH =>Envoy versions: $_major_envoy_versions"
+          echo "Branch $current_branch =>Envoy versions: $_major_envoy_versions_default"
+          echo "ERROR! Branches should support the same major versions for envoy."
+          exit 1
+          else
+            echo "#### SUCCESS! #####. Compatible Envoy major versions found: $ENVOY_VERSIONS_DEFAULT_BRANCH"
+      fi
+      else 
+        echo "No validation needed. Branches have different Consul versions"
+    fi
+fi
\ No newline at end of file
diff --git a/.github/workflows/verify-envoy-version.yml b/.github/workflows/verify-envoy-version.yml
new file mode 100644
index 000000000000..d097e335d37b
--- /dev/null
+++ b/.github/workflows/verify-envoy-version.yml
@@ -0,0 +1,28 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+# This action ensures that Envoy is up to date on main and release branches.
+# This workflow is only triggered on the main and release branches and will
+# only perform a version check when a new release branch is created
+# Contact Consul team for any questions
+
+name: Verify Envoy Version
+
+on:
+  push:
+    branches:
+      - main
+      - release/**
+
+jobs:
+  verify-envoy-version:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0 # by default the checkout action doesn't checkout all branches
+      - name: Run Envoy Version Verification for main and release branches
+        run: ./.github/scripts/verify_envoy_version.sh
+        env:
+          GITHUB_TOKEN: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
\ No newline at end of file

From 391ed069c46187aafc235e2cc754d8a62a6a9806 Mon Sep 17 00:00:00 2001
From: John Maguire <john.maguire@hashicorp.com>
Date: Thu, 27 Apr 2023 11:54:44 -0400
Subject: [PATCH 29/92] APIGW: Update how status conditions for certificates
 are handled (#17115)

* Move status condition for invalid certifcate to reference the listener
that is using the certificate

* Fix where we set the condition status for listeners and certificate
refs, added tests

* Add changelog
---
 .changelog/17115.txt                          |   3 +
 agent/consul/gateways/controller_gateways.go  |  36 +-
 .../gateways/controller_gateways_test.go      | 403 +++++++++++++++++-
 api/config_entry_status.go                    |   1 -
 4 files changed, 436 insertions(+), 7 deletions(-)
 create mode 100644 .changelog/17115.txt

diff --git a/.changelog/17115.txt b/.changelog/17115.txt
new file mode 100644
index 000000000000..8b6a9090db97
--- /dev/null
+++ b/.changelog/17115.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+gateway: Change status condition reason for invalid certificate on a listener from "Accepted" to "ResolvedRefs".
+```
diff --git a/agent/consul/gateways/controller_gateways.go b/agent/consul/gateways/controller_gateways.go
index e399503f355f..46651f004370 100644
--- a/agent/consul/gateways/controller_gateways.go
+++ b/agent/consul/gateways/controller_gateways.go
@@ -241,6 +241,19 @@ func (r *apiGatewayReconciler) reconcileGateway(_ context.Context, req controlle
 		return err
 	}
 
+	// set each listener as having valid certs, then overwrite that status condition
+	// if there are any certificate errors
+	meta.eachListener(func(listener *structs.APIGatewayListener, bound *structs.BoundAPIGatewayListener) error {
+		listenerRef := structs.ResourceReference{
+			Kind:           structs.APIGateway,
+			Name:           meta.BoundGateway.Name,
+			SectionName:    bound.Name,
+			EnterpriseMeta: meta.BoundGateway.EnterpriseMeta,
+		}
+		updater.SetCondition(validCertificate(listenerRef))
+		return nil
+	})
+
 	for ref, err := range certificateErrors {
 		updater.SetCondition(invalidCertificate(ref, err))
 	}
@@ -741,8 +754,14 @@ func (g *gatewayMeta) checkCertificates(store *state.Store) (map[structs.Resourc
 			if err != nil {
 				return err
 			}
+			listenerRef := structs.ResourceReference{
+				Kind:           structs.APIGateway,
+				Name:           g.BoundGateway.Name,
+				SectionName:    bound.Name,
+				EnterpriseMeta: g.BoundGateway.EnterpriseMeta,
+			}
 			if certificate == nil {
-				certificateErrors[ref] = errors.New("certificate not found")
+				certificateErrors[listenerRef] = fmt.Errorf("certificate %q not found", ref.Name)
 			} else {
 				bound.Certificates = append(bound.Certificates, ref)
 			}
@@ -840,12 +859,25 @@ func gatewayAccepted() structs.Condition {
 	)
 }
 
+// invalidCertificate returns a condition used when a gateway references a
+// certificate that does not exist. It takes a ref used to scope the condition
+// to a given APIGateway listener.
+func validCertificate(ref structs.ResourceReference) structs.Condition {
+	return structs.NewGatewayCondition(
+		api.GatewayConditionResolvedRefs,
+		api.ConditionStatusTrue,
+		api.GatewayReasonResolvedRefs,
+		"resolved refs",
+		ref,
+	)
+}
+
 // invalidCertificate returns a condition used when a gateway references a
 // certificate that does not exist. It takes a ref used to scope the condition
 // to a given APIGateway listener.
 func invalidCertificate(ref structs.ResourceReference, err error) structs.Condition {
 	return structs.NewGatewayCondition(
-		api.GatewayConditionAccepted,
+		api.GatewayConditionResolvedRefs,
 		api.ConditionStatusFalse,
 		api.GatewayListenerReasonInvalidCertificateRef,
 		err.Error(),
diff --git a/agent/consul/gateways/controller_gateways_test.go b/agent/consul/gateways/controller_gateways_test.go
index 2b304989e48f..d88c7a96bdb6 100644
--- a/agent/consul/gateways/controller_gateways_test.go
+++ b/agent/consul/gateways/controller_gateways_test.go
@@ -2012,6 +2012,12 @@ func TestAPIGatewayController(t *testing.T) {
 								EnterpriseMeta: *defaultMeta,
 								SectionName:    "listener",
 							}),
+							validCertificate(structs.ResourceReference{
+								Kind:           structs.APIGateway,
+								Name:           "gateway",
+								EnterpriseMeta: *defaultMeta,
+								SectionName:    "listener",
+							}),
 						},
 					},
 				},
@@ -2104,6 +2110,12 @@ func TestAPIGatewayController(t *testing.T) {
 								EnterpriseMeta: *defaultMeta,
 								SectionName:    "listener",
 							}),
+							validCertificate(structs.ResourceReference{
+								Kind:           structs.APIGateway,
+								Name:           "gateway",
+								EnterpriseMeta: *defaultMeta,
+								SectionName:    "listener",
+							}),
 						},
 					},
 				},
@@ -2227,6 +2239,12 @@ func TestAPIGatewayController(t *testing.T) {
 								EnterpriseMeta: *defaultMeta,
 								SectionName:    "listener",
 							}),
+							validCertificate(structs.ResourceReference{
+								Kind:           structs.APIGateway,
+								Name:           "gateway",
+								EnterpriseMeta: *defaultMeta,
+								SectionName:    "listener",
+							}),
 						},
 					},
 				},
@@ -2370,6 +2388,12 @@ func TestAPIGatewayController(t *testing.T) {
 								EnterpriseMeta: *defaultMeta,
 								SectionName:    "listener",
 							}),
+							validCertificate(structs.ResourceReference{
+								Kind:           structs.APIGateway,
+								Name:           "gateway",
+								EnterpriseMeta: *defaultMeta,
+								SectionName:    "listener",
+							}),
 						},
 					},
 				},
@@ -2511,6 +2535,12 @@ func TestAPIGatewayController(t *testing.T) {
 								EnterpriseMeta: *defaultMeta,
 								SectionName:    "listener",
 							}),
+							validCertificate(structs.ResourceReference{
+								Kind:           structs.APIGateway,
+								Name:           "gateway",
+								EnterpriseMeta: *defaultMeta,
+								SectionName:    "listener",
+							}),
 						},
 					},
 				},
@@ -2669,6 +2699,16 @@ func TestAPIGatewayController(t *testing.T) {
 								Name:        "gateway",
 								SectionName: "tcp-listener",
 							}),
+							validCertificate(structs.ResourceReference{
+								Kind:        structs.APIGateway,
+								Name:        "gateway",
+								SectionName: "http-listener",
+							}),
+							validCertificate(structs.ResourceReference{
+								Kind:        structs.APIGateway,
+								Name:        "gateway",
+								SectionName: "tcp-listener",
+							}),
 						},
 					},
 				},
@@ -3013,6 +3053,11 @@ func TestAPIGatewayController(t *testing.T) {
 								Name:        "gateway",
 								SectionName: "http-listener",
 							}),
+							validCertificate(structs.ResourceReference{
+								Kind:        structs.APIGateway,
+								Name:        "gateway",
+								SectionName: "http-listener",
+							}),
 						},
 					},
 				},
@@ -3287,9 +3332,10 @@ func TestAPIGatewayController(t *testing.T) {
 					Status: structs.Status{
 						Conditions: []structs.Condition{
 							invalidCertificate(structs.ResourceReference{
-								Kind: structs.InlineCertificate,
-								Name: "certificate",
-							}, errors.New("certificate not found")),
+								Kind:        structs.APIGateway,
+								Name:        "gateway",
+								SectionName: "http-listener",
+							}, errors.New("certificate \"certificate\" not found")),
 							invalidCertificates(),
 							gatewayListenerNoConflicts(structs.ResourceReference{
 								Kind:        structs.APIGateway,
@@ -3360,6 +3406,11 @@ func TestAPIGatewayController(t *testing.T) {
 								Name:        "gateway",
 								SectionName: "http-listener",
 							}),
+							validCertificate(structs.ResourceReference{
+								Kind:        structs.APIGateway,
+								Name:        "gateway",
+								SectionName: "http-listener",
+							}),
 						},
 					},
 				},
@@ -3378,6 +3429,345 @@ func TestAPIGatewayController(t *testing.T) {
 				},
 			},
 		},
+		"all-listeners-valid-certificate-refs": {
+			requests: []controller.Request{{
+				Kind: structs.APIGateway,
+				Name: "gateway",
+				Meta: acl.DefaultEnterpriseMeta(),
+			}},
+			initialEntries: []structs.ConfigEntry{
+				&structs.APIGatewayConfigEntry{
+					Kind:           structs.APIGateway,
+					Name:           "gateway",
+					EnterpriseMeta: *defaultMeta,
+					Listeners: []structs.APIGatewayListener{
+						{
+							Name: "listener-1",
+							Port: 80,
+							TLS: structs.APIGatewayTLSConfiguration{
+								Certificates: []structs.ResourceReference{{
+									Kind: structs.InlineCertificate,
+									Name: "cert-1",
+								}},
+							},
+						},
+						{
+							Name: "listener-2",
+							Port: 80,
+							TLS: structs.APIGatewayTLSConfiguration{
+								Certificates: []structs.ResourceReference{{
+									Kind: structs.InlineCertificate,
+									Name: "cert-2",
+								}},
+							},
+						},
+					},
+				},
+				&structs.InlineCertificateConfigEntry{
+					Kind:           structs.InlineCertificate,
+					Name:           "cert-1",
+					EnterpriseMeta: *defaultMeta,
+				},
+				&structs.InlineCertificateConfigEntry{
+					Kind:           structs.InlineCertificate,
+					Name:           "cert-2",
+					EnterpriseMeta: *defaultMeta,
+				},
+			},
+			finalEntries: []structs.ConfigEntry{
+				&structs.APIGatewayConfigEntry{
+					Kind:           structs.APIGateway,
+					Name:           "gateway",
+					EnterpriseMeta: *defaultMeta,
+					Listeners: []structs.APIGatewayListener{
+						{
+							Name: "listener-1",
+							Port: 80,
+							TLS: structs.APIGatewayTLSConfiguration{
+								Certificates: []structs.ResourceReference{{
+									Kind: structs.InlineCertificate,
+									Name: "cert-1",
+								}},
+							},
+						},
+						{
+							Name: "listener-2",
+							Port: 80,
+							TLS: structs.APIGatewayTLSConfiguration{
+								Certificates: []structs.ResourceReference{{
+									Kind: structs.InlineCertificate,
+									Name: "cert-2",
+								}},
+							},
+						},
+					},
+					Status: structs.Status{
+						Conditions: []structs.Condition{
+							validCertificate(structs.ResourceReference{
+								Kind:        structs.APIGateway,
+								Name:        "gateway",
+								SectionName: "listener-1",
+							}),
+							validCertificate(structs.ResourceReference{
+								Kind:        structs.APIGateway,
+								Name:        "gateway",
+								SectionName: "listener-2",
+							}),
+							gatewayListenerNoConflicts(structs.ResourceReference{
+								Kind:        structs.APIGateway,
+								Name:        "gateway",
+								SectionName: "listener-1",
+							}),
+							gatewayListenerNoConflicts(structs.ResourceReference{
+								Kind:        structs.APIGateway,
+								Name:        "gateway",
+								SectionName: "listener-2",
+							}),
+							gatewayAccepted(),
+						},
+					},
+				},
+				&structs.BoundAPIGatewayConfigEntry{
+					Kind:           structs.BoundAPIGateway,
+					Name:           "gateway",
+					EnterpriseMeta: *defaultMeta,
+					Listeners: []structs.BoundAPIGatewayListener{
+						{
+							Name: "listener-1",
+							Certificates: []structs.ResourceReference{
+								{
+									Kind: structs.InlineCertificate,
+									Name: "cert-1",
+								},
+							},
+						},
+						{
+							Name: "listener-2",
+							Certificates: []structs.ResourceReference{
+								{
+									Kind: structs.InlineCertificate,
+									Name: "cert-2",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		"all-listeners-invalid-certificates": {
+			requests: []controller.Request{{
+				Kind: structs.APIGateway,
+				Name: "gateway",
+				Meta: acl.DefaultEnterpriseMeta(),
+			}},
+			initialEntries: []structs.ConfigEntry{
+				&structs.APIGatewayConfigEntry{
+					Kind:           structs.APIGateway,
+					Name:           "gateway",
+					EnterpriseMeta: *defaultMeta,
+					Listeners: []structs.APIGatewayListener{
+						{
+							Name: "listener-1",
+							Port: 80,
+							TLS: structs.APIGatewayTLSConfiguration{
+								Certificates: []structs.ResourceReference{{
+									Kind: structs.InlineCertificate,
+									Name: "missing certificate",
+								}},
+							},
+						},
+						{
+							Name: "listener-2",
+							Port: 80,
+							TLS: structs.APIGatewayTLSConfiguration{
+								Certificates: []structs.ResourceReference{{
+									Kind: structs.InlineCertificate,
+									Name: "another missing certificate",
+								}},
+							},
+						},
+					},
+				},
+			},
+			finalEntries: []structs.ConfigEntry{
+				&structs.APIGatewayConfigEntry{
+					Kind:           structs.APIGateway,
+					Name:           "gateway",
+					EnterpriseMeta: *defaultMeta,
+					Listeners: []structs.APIGatewayListener{
+						{
+							Name: "listener-1",
+							Port: 80,
+							TLS: structs.APIGatewayTLSConfiguration{
+								Certificates: []structs.ResourceReference{{
+									Kind: structs.InlineCertificate,
+									Name: "missing certificate",
+								}},
+							},
+						},
+						{
+							Name: "listener-2",
+							Port: 80,
+							TLS: structs.APIGatewayTLSConfiguration{
+								Certificates: []structs.ResourceReference{{
+									Kind: structs.InlineCertificate,
+									Name: "another missing certificate",
+								}},
+							},
+						},
+					},
+					Status: structs.Status{
+						Conditions: []structs.Condition{
+							invalidCertificate(structs.ResourceReference{
+								Kind:        structs.APIGateway,
+								Name:        "gateway",
+								SectionName: "listener-1",
+							}, errors.New("certificate \"missing certificate\" not found")),
+							invalidCertificate(structs.ResourceReference{
+								Kind:        structs.APIGateway,
+								Name:        "gateway",
+								SectionName: "listener-2",
+							}, errors.New("certificate \"another missing certificate\" not found")),
+							invalidCertificates(),
+							gatewayListenerNoConflicts(structs.ResourceReference{
+								Kind:        structs.APIGateway,
+								Name:        "gateway",
+								SectionName: "listener-1",
+							}),
+							gatewayListenerNoConflicts(structs.ResourceReference{
+								Kind:        structs.APIGateway,
+								Name:        "gateway",
+								SectionName: "listener-2",
+							}),
+						},
+					},
+				},
+				&structs.BoundAPIGatewayConfigEntry{
+					Kind:           structs.BoundAPIGateway,
+					Name:           "gateway",
+					EnterpriseMeta: *defaultMeta,
+					Listeners: []structs.BoundAPIGatewayListener{
+						{Name: "listener-1"},
+						{Name: "listener-2"},
+					},
+				},
+			},
+		},
+		"mixed-valid-and-invalid-certificate-refs-for-listeners": {
+			requests: []controller.Request{{
+				Kind: structs.APIGateway,
+				Name: "gateway",
+				Meta: acl.DefaultEnterpriseMeta(),
+			}},
+			initialEntries: []structs.ConfigEntry{
+				&structs.APIGatewayConfigEntry{
+					Kind:           structs.APIGateway,
+					Name:           "gateway",
+					EnterpriseMeta: *defaultMeta,
+					Listeners: []structs.APIGatewayListener{
+						{
+							Name: "invalid-listener",
+							Port: 80,
+							TLS: structs.APIGatewayTLSConfiguration{
+								Certificates: []structs.ResourceReference{{
+									Kind: structs.InlineCertificate,
+									Name: "missing certificate",
+								}},
+							},
+						},
+						{
+							Name: "valid-listener",
+							Port: 80,
+							TLS: structs.APIGatewayTLSConfiguration{
+								Certificates: []structs.ResourceReference{{
+									Kind: structs.InlineCertificate,
+									Name: "certificate",
+								}},
+							},
+						},
+					},
+				},
+				&structs.InlineCertificateConfigEntry{
+					Kind:           structs.InlineCertificate,
+					Name:           "certificate",
+					EnterpriseMeta: *defaultMeta,
+				},
+			},
+			finalEntries: []structs.ConfigEntry{
+				&structs.APIGatewayConfigEntry{
+					Kind:           structs.APIGateway,
+					Name:           "gateway",
+					EnterpriseMeta: *defaultMeta,
+					Listeners: []structs.APIGatewayListener{
+						{
+							Name: "invalid-listener",
+							Port: 80,
+							TLS: structs.APIGatewayTLSConfiguration{
+								Certificates: []structs.ResourceReference{{
+									Kind: structs.InlineCertificate,
+									Name: "missing certificate",
+								}},
+							},
+						},
+						{
+							Name: "valid-listener",
+							Port: 80,
+							TLS: structs.APIGatewayTLSConfiguration{
+								Certificates: []structs.ResourceReference{{
+									Kind: structs.InlineCertificate,
+									Name: "certificate",
+								}},
+							},
+						},
+					},
+					Status: structs.Status{
+						Conditions: []structs.Condition{
+							invalidCertificate(structs.ResourceReference{
+								Kind:        structs.APIGateway,
+								Name:        "gateway",
+								SectionName: "invalid-listener",
+							}, errors.New("certificate \"missing certificate\" not found")),
+							validCertificate(structs.ResourceReference{
+								Kind:        structs.APIGateway,
+								Name:        "gateway",
+								SectionName: "valid-listener",
+							}),
+
+							invalidCertificates(),
+							gatewayListenerNoConflicts(structs.ResourceReference{
+								Kind:        structs.APIGateway,
+								Name:        "gateway",
+								SectionName: "valid-listener",
+							}),
+							gatewayListenerNoConflicts(structs.ResourceReference{
+								Kind:        structs.APIGateway,
+								Name:        "gateway",
+								SectionName: "invalid-listener",
+							}),
+						},
+					},
+				},
+				&structs.BoundAPIGatewayConfigEntry{
+					Kind:           structs.BoundAPIGateway,
+					Name:           "gateway",
+					EnterpriseMeta: *defaultMeta,
+					Listeners: []structs.BoundAPIGatewayListener{
+						{
+							Name: "valid-listener",
+							Certificates: []structs.ResourceReference{
+								{
+									Kind: structs.InlineCertificate,
+									Name: "certificate",
+								},
+							},
+						},
+						{
+							Name: "invalid-listener",
+						},
+					},
+				},
+			},
+		},
 		"updated-gateway-certificates": {
 			requests: []controller.Request{{
 				Kind: structs.APIGateway,
@@ -3443,6 +3833,11 @@ func TestAPIGatewayController(t *testing.T) {
 								Name:        "gateway",
 								SectionName: "http-listener",
 							}),
+							validCertificate(structs.ResourceReference{
+								Kind:        structs.APIGateway,
+								Name:        "gateway",
+								SectionName: "http-listener",
+							}),
 						},
 					},
 				},
@@ -3625,7 +4020,7 @@ func TestAPIGatewayController(t *testing.T) {
 						require.NoError(t, err)
 						ppExpected, err := json.MarshalIndent(expectedStatus, "", "  ")
 						require.NoError(t, err)
-						require.True(t, statusEqual, fmt.Sprintf("statuses are unequal: %+v != %+v", string(ppActual), string(ppExpected)))
+						require.True(t, statusEqual, fmt.Sprintf("statuses are unequal (actual != expected): %+v != %+v", string(ppActual), string(ppExpected)))
 						if bound, ok := controlled.(*structs.BoundAPIGatewayConfigEntry); ok {
 							ppActual, err := json.MarshalIndent(bound, "", "  ")
 							require.NoError(t, err)
diff --git a/api/config_entry_status.go b/api/config_entry_status.go
index dfb97eb4c9bc..2d16ea0fc4e5 100644
--- a/api/config_entry_status.go
+++ b/api/config_entry_status.go
@@ -171,7 +171,6 @@ var validGatewayConditionReasonsMapping = map[GatewayConditionType]map[Condition
 			GatewayReasonAccepted,
 		},
 		ConditionStatusFalse: {
-			GatewayListenerReasonInvalidCertificateRef, // TODO: remove this in follow up PR
 			GatewayReasonInvalidCertificates,
 		},
 		ConditionStatusUnknown: {},

From e02ef16f021ce4d95ce90196c6b7e61be0e59343 Mon Sep 17 00:00:00 2001
From: Freddy <freddygv@users.noreply.github.com>
Date: Thu, 27 Apr 2023 14:27:39 -0600
Subject: [PATCH 30/92] Update HCP bootstrapping to support existing clusters
 (#16916)

* Persist HCP management token from server config

We want to move away from injecting an initial management token into
Consul clusters linked to HCP. The reasoning is that by using a separate
class of token we can have more flexibility in terms of allowing HCP's
token to co-exist with the user's management token.

Down the line we can also more easily adjust the permissions attached to
HCP's token to limit it's scope.

With these changes, the cloud management token is like the initial
management token in that iit has the same global management policy and
if it is created it effectively bootstraps the ACL system.

* Update SDK and mock HCP server

The HCP management token will now be sent in a special field rather than
as Consul's "initial management" token configuration.

This commit also updates the mock HCP server to more accurately reflect
the behavior of the CCM backend.

* Refactor HCP bootstrapping logic and add tests

We want to allow users to link Consul clusters that already exist to
HCP. Existing clusters need care when bootstrapped by HCP, since we do
not want to do things like change ACL/TLS settings for a running
cluster.

Additional changes:

* Deconstruct MaybeBootstrap so that it can be tested. The HCP Go SDK
  requires HTTPS to fetch a token from the Auth URL, even if the backend
  server is mocked. By pulling the hcp.Client creation out we can modify
  its TLS configuration in tests while keeping the secure behavior in
  production code.

* Add light validation for data received/loaded.

* Sanitize initial_management token from received config, since HCP will
  only ever use the CloudConfig.MangementToken.

* Add changelog entry
---
 .changelog/16916.txt                          |   3 +
 agent/agent.go                                |   2 +
 agent/config/builder.go                       |   9 +-
 agent/config/runtime.go                       |   3 +
 agent/config/runtime_test.go                  |  68 +++
 .../TestRuntimeConfig_Sanitize.golden         |   4 +-
 agent/consul/acl_server.go                    |   2 +-
 agent/consul/config.go                        |   2 +
 agent/consul/config_cloud.go                  |   5 +
 agent/consul/leader.go                        | 137 +++--
 agent/consul/leader_test.go                   |  62 +-
 agent/hcp/bootstrap/bootstrap.go              | 548 +++++++++++++-----
 agent/hcp/bootstrap/bootstrap_test.go         | 467 +++++++++++++++
 agent/hcp/bootstrap/testing.go                |  75 ++-
 agent/hcp/client.go                           |   4 +-
 agent/hcp/config/config.go                    |  20 +-
 agent/hcp/scada/mock_Provider.go              | 141 ++++-
 agent/hcp/testing.go                          |  34 +-
 command/agent/agent.go                        |  23 +-
 go.mod                                        |  44 +-
 go.sum                                        |  93 +--
 21 files changed, 1413 insertions(+), 333 deletions(-)
 create mode 100644 .changelog/16916.txt
 create mode 100644 agent/consul/config_cloud.go
 create mode 100644 agent/hcp/bootstrap/bootstrap_test.go

diff --git a/.changelog/16916.txt b/.changelog/16916.txt
new file mode 100644
index 000000000000..a911e14d7e0a
--- /dev/null
+++ b/.changelog/16916.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+hcp: Add support for linking existing Consul clusters to HCP management plane.
+```
\ No newline at end of file
diff --git a/agent/agent.go b/agent/agent.go
index e67e9b0601da..65467dc7ea60 100644
--- a/agent/agent.go
+++ b/agent/agent.go
@@ -1517,6 +1517,8 @@ func newConsulConfig(runtimeCfg *config.RuntimeConfig, logger hclog.Logger) (*co
 	cfg.RequestLimitsWriteRate = runtimeCfg.RequestLimitsWriteRate
 	cfg.Locality = runtimeCfg.StructLocality()
 
+	cfg.Cloud.ManagementToken = runtimeCfg.Cloud.ManagementToken
+
 	cfg.Reporting.License.Enabled = runtimeCfg.Reporting.License.Enabled
 
 	enterpriseConsulConfig(cfg, runtimeCfg)
diff --git a/agent/config/builder.go b/agent/config/builder.go
index 2ead17543e86..513d5931c7b5 100644
--- a/agent/config/builder.go
+++ b/agent/config/builder.go
@@ -2527,18 +2527,23 @@ func validateAutoConfigAuthorizer(rt RuntimeConfig) error {
 	return nil
 }
 
-func (b *builder) cloudConfigVal(v *CloudConfigRaw) (val hcpconfig.CloudConfig) {
+func (b *builder) cloudConfigVal(v *CloudConfigRaw) hcpconfig.CloudConfig {
+	val := hcpconfig.CloudConfig{
+		ResourceID: os.Getenv("HCP_RESOURCE_ID"),
+	}
 	if v == nil {
 		return val
 	}
 
-	val.ResourceID = stringVal(v.ResourceID)
 	val.ClientID = stringVal(v.ClientID)
 	val.ClientSecret = stringVal(v.ClientSecret)
 	val.AuthURL = stringVal(v.AuthURL)
 	val.Hostname = stringVal(v.Hostname)
 	val.ScadaAddress = stringVal(v.ScadaAddress)
 
+	if resourceID := stringVal(v.ResourceID); resourceID != "" {
+		val.ResourceID = resourceID
+	}
 	return val
 }
 
diff --git a/agent/config/runtime.go b/agent/config/runtime.go
index 790eec425a94..a8d6c62ebde9 100644
--- a/agent/config/runtime.go
+++ b/agent/config/runtime.go
@@ -1749,6 +1749,9 @@ func (c *RuntimeConfig) Sanitized() map[string]interface{} {
 
 // IsCloudEnabled returns true if a cloud.resource_id is set and the server mode is enabled
 func (c *RuntimeConfig) IsCloudEnabled() bool {
+	if c == nil {
+		return false
+	}
 	return c.ServerMode && c.Cloud.ResourceID != ""
 }
 
diff --git a/agent/config/runtime_test.go b/agent/config/runtime_test.go
index cd1a83cbb961..8b8ee4f86a10 100644
--- a/agent/config/runtime_test.go
+++ b/agent/config/runtime_test.go
@@ -2301,6 +2301,74 @@ func TestLoad_IntegrationWithFlags(t *testing.T) {
 			rt.HTTPUseCache = false
 		},
 	})
+	run(t, testCase{
+		desc: "cloud resource id from env",
+		args: []string{
+			`-server`,
+			`-data-dir=` + dataDir,
+		},
+		setup: func() {
+			os.Setenv("HCP_RESOURCE_ID", "env-id")
+			t.Cleanup(func() {
+				os.Unsetenv("HCP_RESOURCE_ID")
+			})
+		},
+		expected: func(rt *RuntimeConfig) {
+			rt.DataDir = dataDir
+			rt.Cloud = hcpconfig.CloudConfig{
+				// ID is only populated from env if not populated from other sources.
+				ResourceID: "env-id",
+			}
+
+			// server things
+			rt.ServerMode = true
+			rt.TLS.ServerMode = true
+			rt.LeaveOnTerm = false
+			rt.SkipLeaveOnInt = true
+			rt.RPCConfig.EnableStreaming = true
+			rt.GRPCTLSPort = 8503
+			rt.GRPCTLSAddrs = []net.Addr{defaultGrpcTlsAddr}
+		},
+	})
+	run(t, testCase{
+		desc: "cloud resource id from file",
+		args: []string{
+			`-server`,
+			`-data-dir=` + dataDir,
+		},
+		setup: func() {
+			os.Setenv("HCP_RESOURCE_ID", "env-id")
+			t.Cleanup(func() {
+				os.Unsetenv("HCP_RESOURCE_ID")
+			})
+		},
+		json: []string{`{
+			  "cloud": {
+              	"resource_id": "file-id" 
+              }
+			}`},
+		hcl: []string{`
+			  cloud = {
+	            resource_id = "file-id" 
+			  }
+			`},
+		expected: func(rt *RuntimeConfig) {
+			rt.DataDir = dataDir
+			rt.Cloud = hcpconfig.CloudConfig{
+				// ID is only populated from env if not populated from other sources.
+				ResourceID: "file-id",
+			}
+
+			// server things
+			rt.ServerMode = true
+			rt.TLS.ServerMode = true
+			rt.LeaveOnTerm = false
+			rt.SkipLeaveOnInt = true
+			rt.RPCConfig.EnableStreaming = true
+			rt.GRPCTLSPort = 8503
+			rt.GRPCTLSAddrs = []net.Addr{defaultGrpcTlsAddr}
+		},
+	})
 	run(t, testCase{
 		desc: "sidecar_service can't have ID",
 		args: []string{
diff --git a/agent/config/testdata/TestRuntimeConfig_Sanitize.golden b/agent/config/testdata/TestRuntimeConfig_Sanitize.golden
index 054a284aeb85..f2bd8f2f3ca5 100644
--- a/agent/config/testdata/TestRuntimeConfig_Sanitize.golden
+++ b/agent/config/testdata/TestRuntimeConfig_Sanitize.golden
@@ -131,8 +131,10 @@
         "ClientID": "id",
         "ClientSecret": "hidden",
         "Hostname": "",
+        "ManagementToken": "hidden",
         "ResourceID": "cluster1",
-        "ScadaAddress": ""
+        "ScadaAddress": "",
+        "TLSConfig": null
     },
     "ConfigEntryBootstrap": [],
     "ConnectCAConfig": {},
diff --git a/agent/consul/acl_server.go b/agent/consul/acl_server.go
index b6d0ef4aafd7..6d92c02597b3 100644
--- a/agent/consul/acl_server.go
+++ b/agent/consul/acl_server.go
@@ -153,7 +153,7 @@ func (s *Server) ResolveIdentityFromToken(token string) (bool, structs.ACLIdenti
 	}
 	if aclToken == nil && token == acl.AnonymousTokenSecret {
 		// synthesize the anonymous token for early use, bootstrapping has not completed
-		s.InsertAnonymousToken()
+		s.insertAnonymousToken()
 		fallbackId := structs.ACLToken{
 			AccessorID:  acl.AnonymousTokenID,
 			SecretID:    acl.AnonymousTokenSecret,
diff --git a/agent/consul/config.go b/agent/consul/config.go
index b6f0dae87304..61ed8b8eab8f 100644
--- a/agent/consul/config.go
+++ b/agent/consul/config.go
@@ -441,6 +441,8 @@ type Config struct {
 
 	Locality *structs.Locality
 
+	Cloud CloudConfig
+
 	Reporting Reporting
 
 	// Embedded Consul Enterprise specific configuration
diff --git a/agent/consul/config_cloud.go b/agent/consul/config_cloud.go
new file mode 100644
index 000000000000..b0780052f668
--- /dev/null
+++ b/agent/consul/config_cloud.go
@@ -0,0 +1,5 @@
+package consul
+
+type CloudConfig struct {
+	ManagementToken string
+}
diff --git a/agent/consul/leader.go b/agent/consul/leader.go
index d2e25d0e917c..f2905e6d8f44 100644
--- a/agent/consul/leader.go
+++ b/agent/consul/leader.go
@@ -450,72 +450,22 @@ func (s *Server) initializeACLs(ctx context.Context) error {
 
 		// Check for configured initial management token.
 		if initialManagement := s.config.ACLInitialManagementToken; len(initialManagement) > 0 {
-			state := s.fsm.State()
-			if _, err := uuid.ParseUUID(initialManagement); err != nil {
-				s.logger.Warn("Configuring a non-UUID initial management token is deprecated")
-			}
-
-			_, token, err := state.ACLTokenGetBySecret(nil, initialManagement, nil)
+			err := s.initializeManagementToken("Initial Management Token", initialManagement)
 			if err != nil {
-				return fmt.Errorf("failed to get initial management token: %v", err)
+				return fmt.Errorf("failed to initialize initial management token: %w", err)
 			}
-			// Ignoring expiration times to avoid an insertion collision.
-			if token == nil {
-				accessor, err := lib.GenerateUUID(s.checkTokenUUID)
-				if err != nil {
-					return fmt.Errorf("failed to generate the accessor ID for the initial management token: %v", err)
-				}
-
-				token := structs.ACLToken{
-					AccessorID:  accessor,
-					SecretID:    initialManagement,
-					Description: "Initial Management Token",
-					Policies: []structs.ACLTokenPolicyLink{
-						{
-							ID: structs.ACLPolicyGlobalManagementID,
-						},
-					},
-					CreateTime:     time.Now(),
-					Local:          false,
-					EnterpriseMeta: *structs.DefaultEnterpriseMetaInDefaultPartition(),
-				}
-
-				token.SetHash(true)
-
-				done := false
-				if canBootstrap, _, err := state.CanBootstrapACLToken(); err == nil && canBootstrap {
-					req := structs.ACLTokenBootstrapRequest{
-						Token:      token,
-						ResetIndex: 0,
-					}
-					if _, err := s.raftApply(structs.ACLBootstrapRequestType, &req); err == nil {
-						s.logger.Info("Bootstrapped ACL initial management token from configuration")
-						done = true
-					} else {
-						if err.Error() != structs.ACLBootstrapNotAllowedErr.Error() &&
-							err.Error() != structs.ACLBootstrapInvalidResetIndexErr.Error() {
-							return fmt.Errorf("failed to bootstrap initial management token: %v", err)
-						}
-					}
-				}
-
-				if !done {
-					// either we didn't attempt to or setting the token with a bootstrap request failed.
-					req := structs.ACLTokenBatchSetRequest{
-						Tokens: structs.ACLTokens{&token},
-						CAS:    false,
-					}
-					if _, err := s.raftApply(structs.ACLTokenSetRequestType, &req); err != nil {
-						return fmt.Errorf("failed to create initial management token: %v", err)
-					}
+		}
 
-					s.logger.Info("Created ACL initial management token from configuration")
-				}
+		// Check for configured management token from HCP. It MUST NOT override the user-provided initial management token.
+		if hcpManagement := s.config.Cloud.ManagementToken; len(hcpManagement) > 0 {
+			err := s.initializeManagementToken("HCP Management Token", hcpManagement)
+			if err != nil {
+				return fmt.Errorf("failed to initialize HCP management token: %w", err)
 			}
 		}
 
 		// Insert the anonymous token if it does not exist.
-		if err := s.InsertAnonymousToken(); err != nil {
+		if err := s.insertAnonymousToken(); err != nil {
 			return err
 		}
 	} else {
@@ -540,7 +490,74 @@ func (s *Server) initializeACLs(ctx context.Context) error {
 	return nil
 }
 
-func (s *Server) InsertAnonymousToken() error {
+func (s *Server) initializeManagementToken(name, secretID string) error {
+	state := s.fsm.State()
+	if _, err := uuid.ParseUUID(secretID); err != nil {
+		s.logger.Warn("Configuring a non-UUID management token is deprecated")
+	}
+
+	_, token, err := state.ACLTokenGetBySecret(nil, secretID, nil)
+	if err != nil {
+		return fmt.Errorf("failed to get %s: %v", name, err)
+	}
+	// Ignoring expiration times to avoid an insertion collision.
+	if token == nil {
+		accessor, err := lib.GenerateUUID(s.checkTokenUUID)
+		if err != nil {
+			return fmt.Errorf("failed to generate the accessor ID for %s: %v", name, err)
+		}
+
+		token := structs.ACLToken{
+			AccessorID:  accessor,
+			SecretID:    secretID,
+			Description: name,
+			Policies: []structs.ACLTokenPolicyLink{
+				{
+					ID: structs.ACLPolicyGlobalManagementID,
+				},
+			},
+			CreateTime:     time.Now(),
+			Local:          false,
+			EnterpriseMeta: *structs.DefaultEnterpriseMetaInDefaultPartition(),
+		}
+
+		token.SetHash(true)
+
+		done := false
+		if canBootstrap, _, err := state.CanBootstrapACLToken(); err == nil && canBootstrap {
+			req := structs.ACLTokenBootstrapRequest{
+				Token:      token,
+				ResetIndex: 0,
+			}
+			if _, err := s.raftApply(structs.ACLBootstrapRequestType, &req); err == nil {
+				s.logger.Info("Bootstrapped ACL token from configuration", "description", name)
+				done = true
+			} else {
+				if err.Error() != structs.ACLBootstrapNotAllowedErr.Error() &&
+					err.Error() != structs.ACLBootstrapInvalidResetIndexErr.Error() {
+					return fmt.Errorf("failed to bootstrap with %s: %v", name, err)
+				}
+			}
+		}
+
+		if !done {
+			// either we didn't attempt to or setting the token with a bootstrap request failed.
+			req := structs.ACLTokenBatchSetRequest{
+				Tokens: structs.ACLTokens{&token},
+				CAS:    false,
+			}
+			if _, err := s.raftApply(structs.ACLTokenSetRequestType, &req); err != nil {
+				return fmt.Errorf("failed to create %s: %v", name, err)
+			}
+
+			s.logger.Info("Created ACL token from configuration", "description", name)
+		}
+	}
+
+	return nil
+}
+
+func (s *Server) insertAnonymousToken() error {
 	state := s.fsm.State()
 	_, token, err := state.ACLTokenGetBySecret(nil, anonymousToken, nil)
 	if err != nil {
diff --git a/agent/consul/leader_test.go b/agent/consul/leader_test.go
index 09d9d6de5151..48b9876ae76d 100644
--- a/agent/consul/leader_test.go
+++ b/agent/consul/leader_test.go
@@ -1261,47 +1261,77 @@ func TestLeader_ACL_Initialization(t *testing.T) {
 
 	tests := []struct {
 		name              string
-		build             string
 		initialManagement string
-		bootstrap         bool
+		hcpManagement     string
+
+		// canBootstrap tracks whether the ACL system can be bootstrapped
+		// after the leader initializes ACLs. Bootstrapping is the act
+		// of persisting a token with the Global Management policy.
+		canBootstrap bool
 	}{
-		{"old version, no initial management", "0.8.0", "", true},
-		{"old version, initial management", "0.8.0", "root", false},
-		{"new version, no initial management", "0.9.1", "", true},
-		{"new version, initial management", "0.9.1", "root", false},
+		{
+			name:              "bootstrap from initial management",
+			initialManagement: "c9ad785a-420d-470d-9b4d-6d9f084bfa87",
+			hcpManagement:     "",
+			canBootstrap:      false,
+		},
+		{
+			name:              "bootstrap from hcp management",
+			initialManagement: "",
+			hcpManagement:     "924bc0e1-a41b-4f3a-b5e8-0899502fc50e",
+			canBootstrap:      false,
+		},
+		{
+			name:              "bootstrap with both",
+			initialManagement: "c9ad785a-420d-470d-9b4d-6d9f084bfa87",
+			hcpManagement:     "924bc0e1-a41b-4f3a-b5e8-0899502fc50e",
+			canBootstrap:      false,
+		},
+		{
+			name:              "did not bootstrap",
+			initialManagement: "",
+			hcpManagement:     "",
+			canBootstrap:      true,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			conf := func(c *Config) {
-				c.Build = tt.build
 				c.Bootstrap = true
 				c.Datacenter = "dc1"
 				c.PrimaryDatacenter = "dc1"
 				c.ACLsEnabled = true
 				c.ACLInitialManagementToken = tt.initialManagement
+				c.Cloud.ManagementToken = tt.hcpManagement
 			}
-			dir1, s1 := testServerWithConfig(t, conf)
-			defer os.RemoveAll(dir1)
-			defer s1.Shutdown()
+			_, s1 := testServerWithConfig(t, conf)
 			testrpc.WaitForTestAgent(t, s1.RPC, "dc1")
 
+			_, policy, err := s1.fsm.State().ACLPolicyGetByID(nil, structs.ACLPolicyGlobalManagementID, nil)
+			require.NoError(t, err)
+			require.NotNil(t, policy)
+
 			if tt.initialManagement != "" {
 				_, initialManagement, err := s1.fsm.State().ACLTokenGetBySecret(nil, tt.initialManagement, nil)
 				require.NoError(t, err)
 				require.NotNil(t, initialManagement)
+				require.Equal(t, tt.initialManagement, initialManagement.SecretID)
 			}
 
-			_, anon, err := s1.fsm.State().ACLTokenGetBySecret(nil, anonymousToken, nil)
-			require.NoError(t, err)
-			require.NotNil(t, anon)
+			if tt.hcpManagement != "" {
+				_, hcpManagement, err := s1.fsm.State().ACLTokenGetBySecret(nil, tt.hcpManagement, nil)
+				require.NoError(t, err)
+				require.NotNil(t, hcpManagement)
+				require.Equal(t, tt.hcpManagement, hcpManagement.SecretID)
+			}
 
 			canBootstrap, _, err := s1.fsm.State().CanBootstrapACLToken()
 			require.NoError(t, err)
-			require.Equal(t, tt.bootstrap, canBootstrap)
+			require.Equal(t, tt.canBootstrap, canBootstrap)
 
-			_, policy, err := s1.fsm.State().ACLPolicyGetByID(nil, structs.ACLPolicyGlobalManagementID, nil)
+			_, anon, err := s1.fsm.State().ACLTokenGetBySecret(nil, anonymousToken, nil)
 			require.NoError(t, err)
-			require.NotNil(t, policy)
+			require.NotNil(t, anon)
 
 			serverToken, err := s1.GetSystemMetadata(structs.ServerManagementTokenAccessorID)
 			require.NoError(t, err)
diff --git a/agent/hcp/bootstrap/bootstrap.go b/agent/hcp/bootstrap/bootstrap.go
index 55e1231f5cf4..e6a1ae120a6b 100644
--- a/agent/hcp/bootstrap/bootstrap.go
+++ b/agent/hcp/bootstrap/bootstrap.go
@@ -10,7 +10,10 @@ package bootstrap
 import (
 	"bufio"
 	"context"
+	"crypto/tls"
+	"crypto/x509"
 	"encoding/json"
+	"encoding/pem"
 	"errors"
 	"fmt"
 	"os"
@@ -19,17 +22,22 @@ import (
 	"time"
 
 	"github.com/hashicorp/consul/agent/config"
+	"github.com/hashicorp/consul/agent/connect"
 	"github.com/hashicorp/consul/agent/hcp"
 	"github.com/hashicorp/consul/lib"
 	"github.com/hashicorp/consul/lib/retry"
+	"github.com/hashicorp/go-uuid"
 )
 
 const (
-	caFileName     = "server-tls-cas.pem"
-	certFileName   = "server-tls-cert.pem"
-	keyFileName    = "server-tls-key.pem"
-	configFileName = "server-config.json"
-	subDir         = "hcp-config"
+	subDir = "hcp-config"
+
+	caFileName      = "server-tls-cas.pem"
+	certFileName    = "server-tls-cert.pem"
+	configFileName  = "server-config.json"
+	keyFileName     = "server-tls-key.pem"
+	tokenFileName   = "hcp-management-token"
+	successFileName = "successful-bootstrap"
 )
 
 type ConfigLoader func(source config.Source) (config.LoadResult, error)
@@ -46,44 +54,80 @@ type UI interface {
 	Error(string)
 }
 
-// MaybeBootstrap will use the passed ConfigLoader to read the existing
-// configuration, and if required attempt to bootstrap from HCP. It will retry
-// until successful or a terminal error condition is found (e.g. permission
-// denied). It must be passed a (CLI) UI implementation so it can deliver progress
-// updates to the user, for example if it is waiting to retry for a long period.
-func MaybeBootstrap(ctx context.Context, loader ConfigLoader, ui UI) (bool, ConfigLoader, error) {
-	loader = wrapConfigLoader(loader)
-	res, err := loader(nil)
-	if err != nil {
-		return false, nil, err
-	}
-
-	// Check to see if this is a server and HCP is configured
-
-	if !res.RuntimeConfig.IsCloudEnabled() {
-		// Not a server, let agent continue unmodified
-		return false, loader, nil
-	}
+// RawBootstrapConfig contains the Consul config as a raw JSON string and the management token
+// which either was retrieved from persisted files or from the bootstrap endpoint
+type RawBootstrapConfig struct {
+	ConfigJSON      string
+	ManagementToken string
+}
 
-	ui.Output("Bootstrapping configuration from HCP")
+// LoadConfig will attempt to load previously-fetched config from disk and fall back to
+// fetch from HCP servers if the local data is incomplete.
+// It must be passed a (CLI) UI implementation so it can deliver progress
+// updates to the user, for example if it is waiting to retry for a long period.
+func LoadConfig(ctx context.Context, client hcp.Client, dataDir string, loader ConfigLoader, ui UI) (ConfigLoader, error) {
+	ui.Output("Loading configuration from HCP")
 
 	// See if we have existing config on disk
-	cfgJSON, ok := loadPersistedBootstrapConfig(res.RuntimeConfig, ui)
-
+	//
+	// OPTIMIZE: We could probably be more intelligent about config loading.
+	// The currently implemented approach is:
+	// 1. Attempt to load data from disk
+	// 2. If that fails or the data is incomplete, block indefinitely fetching remote config.
+	//
+	// What if instead we had the following flow:
+	// 1. Attempt to fetch config from HCP.
+	// 2. If that fails, fall back to data on disk from last fetch.
+	// 3. If that fails, go into blocking loop to fetch remote config.
+	//
+	// This should allow us to more gracefully transition cases like when
+	// an existing cluster is linked, but then wants to receive TLS materials
+	// at a later time. Currently, if we observe the existing-cluster marker we
+	// don't attempt to fetch any additional configuration from HCP.
+
+	cfg, ok := loadPersistedBootstrapConfig(dataDir, ui)
 	if !ok {
-		// Fetch from HCP
-		ui.Info("Fetching configuration from HCP")
-		cfgJSON, err = doHCPBootstrap(ctx, res.RuntimeConfig, ui)
+		ui.Info("Fetching configuration from HCP servers")
+
+		var err error
+		cfg, err = fetchBootstrapConfig(ctx, client, dataDir, ui)
 		if err != nil {
-			return false, nil, fmt.Errorf("failed to bootstrap from HCP: %w", err)
+			return nil, fmt.Errorf("failed to bootstrap from HCP: %w", err)
 		}
 		ui.Info("Configuration fetched from HCP and saved on local disk")
+
 	} else {
-		ui.Info("Loaded configuration from local disk")
+		ui.Info("Loaded HCP configuration from local disk")
+
 	}
 
 	// Create a new loader func to return
-	newLoader := func(source config.Source) (config.LoadResult, error) {
+	newLoader := bootstrapConfigLoader(loader, cfg)
+	return newLoader, nil
+}
+
+// bootstrapConfigLoader is a ConfigLoader for passing bootstrap JSON config received from HCP
+// to the config.builder. ConfigLoaders are functions used to build an agent's RuntimeConfig
+// from various sources like files and flags. This config is contained in the config.LoadResult.
+//
+// The flow to include bootstrap config from HCP as a loader's data source is as follows:
+//
+//  1. A base ConfigLoader function (baseLoader) is created on agent start, and it sets the input
+//     source argument as the DefaultConfig.
+//
+//  2. When a server agent can be configured by HCP that baseLoader is wrapped in this bootstrapConfigLoader.
+//
+//  3. The bootstrapConfigLoader calls that base loader with the bootstrap JSON config as the
+//     default source. This data will be merged with other valid sources in the config.builder.
+//
+//  4. The result of the call to baseLoader() below contains the resulting RuntimeConfig, and we do some
+//     additional modifications to attach data that doesn't get populated during the build in the config pkg.
+//
+// Note that since the ConfigJSON is stored as the baseLoader's DefaultConfig, its data is the first
+// to be merged by the config.builder and could be overwritten by user-provided values in config files or
+// CLI flags. However, values set to RuntimeConfig after the baseLoader call are final.
+func bootstrapConfigLoader(baseLoader ConfigLoader, cfg *RawBootstrapConfig) ConfigLoader {
+	return func(source config.Source) (config.LoadResult, error) {
 		// Don't allow any further attempts to provide a DefaultSource. This should
 		// only ever be needed later in client agent AutoConfig code but that should
 		// be mutually exclusive from this bootstrapping mechanism since this is
@@ -94,34 +138,50 @@ func MaybeBootstrap(ctx context.Context, loader ConfigLoader, ui UI) (bool, Conf
 			return config.LoadResult{},
 				fmt.Errorf("non-nil config source provided to a loader after HCP bootstrap already provided a DefaultSource")
 		}
+
 		// Otherwise, just call to the loader we were passed with our own additional
 		// JSON as the source.
-		s := config.FileSource{
+		//
+		// OPTIMIZE: We could check/log whether any fields set by the remote config were overwritten by a user-provided flag.
+		res, err := baseLoader(config.FileSource{
 			Name:   "HCP Bootstrap",
 			Format: "json",
-			Data:   cfgJSON,
+			Data:   cfg.ConfigJSON,
+		})
+		if err != nil {
+			return res, fmt.Errorf("failed to load HCP Bootstrap config: %w", err)
 		}
-		return loader(s)
-	}
 
-	return true, newLoader, nil
+		finalizeRuntimeConfig(res.RuntimeConfig, cfg)
+		return res, nil
+	}
 }
 
-func wrapConfigLoader(loader ConfigLoader) ConfigLoader {
-	return func(source config.Source) (config.LoadResult, error) {
-		res, err := loader(source)
-		if err != nil {
-			return res, err
-		}
+const (
+	accessControlHeaderName  = "Access-Control-Expose-Headers"
+	accessControlHeaderValue = "x-consul-default-acl-policy"
+)
 
-		if res.RuntimeConfig.Cloud.ResourceID == "" {
-			res.RuntimeConfig.Cloud.ResourceID = os.Getenv("HCP_RESOURCE_ID")
-		}
-		return res, nil
+// finalizeRuntimeConfig will set additional HCP-specific values that are not
+// handled by the config.builder.
+func finalizeRuntimeConfig(rc *config.RuntimeConfig, cfg *RawBootstrapConfig) {
+	rc.Cloud.ManagementToken = cfg.ManagementToken
+
+	// HTTP response headers are modified for the HCP UI to work.
+	if rc.HTTPResponseHeaders == nil {
+		rc.HTTPResponseHeaders = make(map[string]string)
+	}
+	prevValue, ok := rc.HTTPResponseHeaders[accessControlHeaderName]
+	if !ok {
+		rc.HTTPResponseHeaders[accessControlHeaderName] = accessControlHeaderValue
+	} else {
+		rc.HTTPResponseHeaders[accessControlHeaderName] = prevValue + "," + accessControlHeaderValue
 	}
 }
 
-func doHCPBootstrap(ctx context.Context, rc *config.RuntimeConfig, ui UI) (string, error) {
+// fetchBootstrapConfig will fetch boostrap configuration from remote servers and persist it to disk.
+// It will retry until successful or a terminal error condition is found (e.g. permission denied).
+func fetchBootstrapConfig(ctx context.Context, client hcp.Client, dataDir string, ui UI) (*RawBootstrapConfig, error) {
 	w := retry.Waiter{
 		MinWait: 1 * time.Second,
 		MaxWait: 5 * time.Minute,
@@ -129,12 +189,6 @@ func doHCPBootstrap(ctx context.Context, rc *config.RuntimeConfig, ui UI) (strin
 	}
 
 	var bsCfg *hcp.BootstrapConfig
-
-	client, err := hcp.NewClient(rc.Cloud)
-	if err != nil {
-		return "", err
-	}
-
 	for {
 		// Note we don't want to shadow `ctx` here since we need that for the Wait
 		// below.
@@ -143,10 +197,10 @@ func doHCPBootstrap(ctx context.Context, rc *config.RuntimeConfig, ui UI) (strin
 
 		resp, err := client.FetchBootstrap(reqCtx)
 		if err != nil {
-			ui.Error(fmt.Sprintf("failed to fetch bootstrap config from HCP, will retry in %s: %s",
+			ui.Error(fmt.Sprintf("Error: failed to fetch bootstrap config from HCP, will retry in %s: %s",
 				w.NextWait().Round(time.Second), err))
 			if err := w.Wait(ctx); err != nil {
-				return "", err
+				return nil, err
 			}
 			// Finished waiting, restart loop
 			continue
@@ -155,9 +209,24 @@ func doHCPBootstrap(ctx context.Context, rc *config.RuntimeConfig, ui UI) (strin
 		break
 	}
 
-	dataDir := rc.DataDir
-	shouldPersist := true
-	if dataDir == "" {
+	devMode := dataDir == ""
+
+	cfgJSON, err := persistAndProcessConfig(dataDir, devMode, bsCfg)
+	if err != nil {
+		return nil, fmt.Errorf("failed to persist config for existing cluster: %w", err)
+	}
+
+	return &RawBootstrapConfig{
+		ConfigJSON:      cfgJSON,
+		ManagementToken: bsCfg.ManagementToken,
+	}, nil
+}
+
+// persistAndProcessConfig is called when we receive data from CCM.
+// We validate and persist everything that was received, then also update
+// the JSON config as needed.
+func persistAndProcessConfig(dataDir string, devMode bool, bsCfg *hcp.BootstrapConfig) (string, error) {
+	if devMode {
 		// Agent in dev mode, we still need somewhere to persist the certs
 		// temporarily though to be able to start up at all since we don't support
 		// inline certs right now. Use temp dir
@@ -166,41 +235,92 @@ func doHCPBootstrap(ctx context.Context, rc *config.RuntimeConfig, ui UI) (strin
 			return "", fmt.Errorf("failed to create temp dir for certificates: %w", err)
 		}
 		dataDir = tmp
-		shouldPersist = false
 	}
 
-	// Persist the TLS cert files from the response since we need to refer to them
-	// as disk files either way.
-	if err := persistTLSCerts(dataDir, bsCfg); err != nil {
-		return "", fmt.Errorf("failed to persist TLS certificates to dir %q: %w", dataDir, err)
+	// Create subdir if it's not already there.
+	dir := filepath.Join(dataDir, subDir)
+	if err := lib.EnsurePath(dir, true); err != nil {
+		return "", fmt.Errorf("failed to ensure directory %q: %w", dir, err)
 	}
-	// Update the config JSON to include those TLS cert files
-	cfgJSON, err := injectTLSCerts(dataDir, bsCfg.ConsulConfig)
-	if err != nil {
-		return "", fmt.Errorf("failed to inject TLS Certs into bootstrap config: %w", err)
+
+	// Parse just to a map for now as we only have to inject to a specific place
+	// and parsing whole Config struct is complicated...
+	var cfg map[string]any
+
+	if err := json.Unmarshal([]byte(bsCfg.ConsulConfig), &cfg); err != nil {
+		return "", fmt.Errorf("failed to unmarshal bootstrap config: %w", err)
+	}
+
+	// Avoid ever setting an initial_management token from HCP now that we can
+	// separately bootstrap an HCP management token with a distinct accessor ID.
+	//
+	// CCM will continue to return an initial_management token because previous versions of Consul
+	// cannot bootstrap an HCP management token distinct from the initial management token.
+	// This block can be deleted once CCM supports tailoring bootstrap config responses
+	// based on the version of Consul that requested it.
+	acls, aclsOK := cfg["acl"].(map[string]any)
+	if aclsOK {
+		tokens, tokensOK := acls["tokens"].(map[string]interface{})
+		if tokensOK {
+			delete(tokens, "initial_management")
+		}
 	}
 
-	// Persist the final config we need to add for restarts. Assuming this wasn't
-	// a tmp dir to start with.
-	if shouldPersist {
-		if err := persistBootstrapConfig(dataDir, cfgJSON); err != nil {
-			return "", fmt.Errorf("failed to persist bootstrap config to dir %q: %w", dataDir, err)
+	var cfgJSON string
+	if bsCfg.TLSCert != "" {
+		if err := validateTLSCerts(bsCfg.TLSCert, bsCfg.TLSCertKey, bsCfg.TLSCAs); err != nil {
+			return "", fmt.Errorf("invalid certificates: %w", err)
+		}
+
+		// Persist the TLS cert files from the response since we need to refer to them
+		// as disk files either way.
+		if err := persistTLSCerts(dir, bsCfg.TLSCert, bsCfg.TLSCertKey, bsCfg.TLSCAs); err != nil {
+			return "", fmt.Errorf("failed to persist TLS certificates to dir %q: %w", dataDir, err)
+		}
+
+		// Store paths to the persisted TLS cert files.
+		cfg["ca_file"] = filepath.Join(dir, caFileName)
+		cfg["cert_file"] = filepath.Join(dir, certFileName)
+		cfg["key_file"] = filepath.Join(dir, keyFileName)
+
+		// Convert the bootstrap config map back into a string
+		cfgJSONBytes, err := json.Marshal(cfg)
+		if err != nil {
+			return "", err
 		}
+		cfgJSON = string(cfgJSONBytes)
 	}
 
+	if !devMode {
+		// Persist the final config we need to add so that it is available locally after a restart.
+		// Assuming the configured data dir wasn't a tmp dir to start with.
+		if err := persistBootstrapConfig(dir, cfgJSON); err != nil {
+			return "", fmt.Errorf("failed to persist bootstrap config: %w", err)
+		}
+
+		if err := validateManagementToken(bsCfg.ManagementToken); err != nil {
+			return "", fmt.Errorf("invalid management token: %w", err)
+		}
+		if err := persistManagementToken(dir, bsCfg.ManagementToken); err != nil {
+			return "", fmt.Errorf("failed to persist HCP management token: %w", err)
+		}
+
+		if err := persistSucessMarker(dir); err != nil {
+			return "", fmt.Errorf("failed to persist success marker: %w", err)
+		}
+	}
 	return cfgJSON, nil
 }
 
-func persistTLSCerts(dataDir string, bsCfg *hcp.BootstrapConfig) error {
-	dir := filepath.Join(dataDir, subDir)
+func persistSucessMarker(dir string) error {
+	name := filepath.Join(dir, successFileName)
+	return os.WriteFile(name, []byte(""), 0600)
 
-	if bsCfg.TLSCert == "" || bsCfg.TLSCertKey == "" {
-		return fmt.Errorf("unexpected bootstrap response from HCP: missing TLS information")
-	}
+}
 
-	// Create a subdir if it's not already there
-	if err := lib.EnsurePath(dir, true); err != nil {
-		return err
+func persistTLSCerts(dir string, serverCert, serverKey string, caCerts []string) error {
+	if serverCert == "" || serverKey == "" {
+		return fmt.Errorf("unexpected bootstrap response from HCP: missing TLS information")
 	}
 
 	// Write out CA cert(s). We write them all to one file because Go's x509
@@ -211,7 +331,7 @@ func persistTLSCerts(dataDir string, bsCfg *hcp.BootstrapConfig) error {
 		return err
 	}
 	bf := bufio.NewWriter(f)
-	for _, caPEM := range bsCfg.TLSCAs {
+	for _, caPEM := range caCerts {
 		bf.WriteString(caPEM + "\n")
 	}
 	if err := bf.Flush(); err != nil {
@@ -221,87 +341,243 @@ func persistTLSCerts(dataDir string, bsCfg *hcp.BootstrapConfig) error {
 		return err
 	}
 
-	if err := os.WriteFile(filepath.Join(dir, certFileName), []byte(bsCfg.TLSCert), 0600); err != nil {
+	if err := os.WriteFile(filepath.Join(dir, certFileName), []byte(serverCert), 0600); err != nil {
 		return err
 	}
 
-	if err := os.WriteFile(filepath.Join(dir, keyFileName), []byte(bsCfg.TLSCertKey), 0600); err != nil {
+	if err := os.WriteFile(filepath.Join(dir, keyFileName), []byte(serverKey), 0600); err != nil {
 		return err
 	}
 
 	return nil
 }
 
-func injectTLSCerts(dataDir string, bootstrapJSON string) (string, error) {
-	// Parse just to a map for now as we only have to inject to a specific place
-	// and parsing whole Config struct is complicated...
-	var cfg map[string]interface{}
-
-	if err := json.Unmarshal([]byte(bootstrapJSON), &cfg); err != nil {
-		return "", err
+// Basic validation to ensure a UUID was loaded.
+func validateManagementToken(token string) error {
+	if token == "" {
+		return errors.New("missing HCP management token")
 	}
 
-	// Inject TLS cert files
-	cfg["ca_file"] = filepath.Join(dataDir, subDir, caFileName)
-	cfg["cert_file"] = filepath.Join(dataDir, subDir, certFileName)
-	cfg["key_file"] = filepath.Join(dataDir, subDir, keyFileName)
-
-	jsonBs, err := json.Marshal(cfg)
-	if err != nil {
-		return "", err
+	if _, err := uuid.ParseUUID(token); err != nil {
+		return errors.New("management token is not a valid UUID")
 	}
+	return nil
+}
 
-	return string(jsonBs), nil
+func persistManagementToken(dir, token string) error {
+	name := filepath.Join(dir, tokenFileName)
+	return os.WriteFile(name, []byte(token), 0600)
 }
 
-func persistBootstrapConfig(dataDir, cfgJSON string) error {
+func persistBootstrapConfig(dir, cfgJSON string) error {
 	// Persist the important bits we got from bootstrapping. The TLS certs are
 	// already persisted, just need to persist the config we are going to add.
-	name := filepath.Join(dataDir, subDir, configFileName)
+	name := filepath.Join(dir, configFileName)
 	return os.WriteFile(name, []byte(cfgJSON), 0600)
 }
 
-func loadPersistedBootstrapConfig(rc *config.RuntimeConfig, ui UI) (string, bool) {
-	// Check if the files all exist
+func loadPersistedBootstrapConfig(dataDir string, ui UI) (*RawBootstrapConfig, bool) {
+	if dataDir == "" {
+		// There's no files to load when in dev mode.
+		return nil, false
+	}
+
+	dir := filepath.Join(dataDir, subDir)
+
+	_, err := os.Stat(filepath.Join(dir, successFileName))
+	if os.IsNotExist(err) {
+		// Haven't bootstrapped from HCP.
+		return nil, false
+	}
+	if err != nil {
+		ui.Warn("failed to check for config on disk, re-fetching from HCP: " + err.Error())
+		return nil, false
+	}
+
+	if err := checkCerts(dir); err != nil {
+		ui.Warn("failed to validate certs on disk, re-fetching from HCP: " + err.Error())
+		return nil, false
+	}
+
+	configJSON, err := loadBootstrapConfigJSON(dataDir)
+	if err != nil {
+		ui.Warn("failed to load bootstrap config from disk, re-fetching from HCP: " + err.Error())
+		return nil, false
+	}
+
+	mgmtToken, err := loadManagementToken(dir)
+	if err != nil {
+		ui.Warn("failed to load HCP management token from disk, re-fetching from HCP: " + err.Error())
+		return nil, false
+	}
+
+	return &RawBootstrapConfig{
+		ConfigJSON:      configJSON,
+		ManagementToken: mgmtToken,
+	}, true
+}
+
+func loadBootstrapConfigJSON(dataDir string) (string, error) {
+	filename := filepath.Join(dataDir, subDir, configFileName)
+
+	_, err := os.Stat(filename)
+	if os.IsNotExist(err) {
+		return "", nil
+	}
+	if err != nil {
+		return "", fmt.Errorf("failed to check for bootstrap config: %w", err)
+	}
+
+	// Attempt to load persisted config to check for errors and basic validity.
+	// Errors here will raise issues like referencing unsupported config fields.
+	_, err = config.Load(config.LoadOpts{
+		ConfigFiles: []string{filename},
+		HCL: []string{
+			"server = true",
+			`bind_addr = "127.0.0.1"`,
+			fmt.Sprintf("data_dir = %q", dataDir),
+		},
+		ConfigFormat: "json",
+	})
+	if err != nil {
+		return "", fmt.Errorf("failed to parse local bootstrap config: %w", err)
+	}
+
+	jsonBs, err := os.ReadFile(filename)
+	if err != nil {
+		return "", fmt.Errorf(fmt.Sprintf("failed to read local bootstrap config file: %s", err))
+	}
+	return strings.TrimSpace(string(jsonBs)), nil
+}
+
+func loadManagementToken(dir string) (string, error) {
+	name := filepath.Join(dir, tokenFileName)
+	bytes, err := os.ReadFile(name)
+	if os.IsNotExist(err) {
+		return "", errors.New("configuration files on disk are incomplete, missing: " + name)
+	}
+	if err != nil {
+		return "", fmt.Errorf("failed to read: %w", err)
+	}
+
+	token := string(bytes)
+	if err := validateManagementToken(token); err != nil {
+		return "", fmt.Errorf("invalid management token: %w", err)
+	}
+
+	return token, nil
+}
+
+func checkCerts(dir string) error {
 	files := []string{
-		filepath.Join(rc.DataDir, subDir, configFileName),
-		filepath.Join(rc.DataDir, subDir, caFileName),
-		filepath.Join(rc.DataDir, subDir, certFileName),
-		filepath.Join(rc.DataDir, subDir, keyFileName),
-	}
-	hasSome := false
-	for _, name := range files {
-		if _, err := os.Stat(name); errors.Is(err, os.ErrNotExist) {
-			// At least one required file doesn't exist, failed loading. This is not
-			// an error though
-			if hasSome {
-				ui.Warn("ignoring incomplete local bootstrap config files")
-			}
-			return "", false
+		filepath.Join(dir, caFileName),
+		filepath.Join(dir, certFileName),
+		filepath.Join(dir, keyFileName),
+	}
+
+	missing := make([]string, 0)
+	for _, file := range files {
+		_, err := os.Stat(file)
+		if os.IsNotExist(err) {
+			missing = append(missing, file)
+			continue
+		}
+		if err != nil {
+			return err
 		}
-		hasSome = true
 	}
 
-	name := filepath.Join(rc.DataDir, subDir, configFileName)
-	jsonBs, err := os.ReadFile(name)
+	// If all the TLS files are missing, assume this is intentional.
+	// Existing clusters do not receive any TLS certs.
+	if len(missing) == len(files) {
+		return nil
+	}
+
+	// If only some of the files are missing, something went wrong.
+	if len(missing) > 0 {
+		return fmt.Errorf("configuration files on disk are incomplete, missing: %v", missing)
+	}
+
+	cert, key, caCerts, err := loadCerts(dir)
+	if err != nil {
+		return fmt.Errorf("failed to load certs from disk: %w", err)
+	}
+
+	if err = validateTLSCerts(cert, key, caCerts); err != nil {
+		return fmt.Errorf("invalid certs on disk: %w", err)
+	}
+	return nil
+}
+
+func loadCerts(dir string) (cert, key string, caCerts []string, err error) {
+	certPEMBlock, err := os.ReadFile(filepath.Join(dir, certFileName))
+	if err != nil {
+		return "", "", nil, err
+	}
+	keyPEMBlock, err := os.ReadFile(filepath.Join(dir, keyFileName))
+	if err != nil {
+		return "", "", nil, err
+	}
+
+	caPEMs, err := os.ReadFile(filepath.Join(dir, caFileName))
+	if err != nil {
+		return "", "", nil, err
+	}
+	caCerts, err = splitCACerts(caPEMs)
 	if err != nil {
-		ui.Warn(fmt.Sprintf("failed to read local bootstrap config file, ignoring local files: %s", err))
-		return "", false
+		return "", "", nil, fmt.Errorf("failed to parse CA certs: %w", err)
+	}
+
+	return string(certPEMBlock), string(keyPEMBlock), caCerts, nil
+}
+
+// splitCACerts takes a list of concatenated PEM blocks and splits
+// them back up into strings. This is used because CACerts are written
+// into a single file, but validated individually.
+func splitCACerts(caPEMs []byte) ([]string, error) {
+	var out []string
+
+	for {
+		nextBlock, remaining := pem.Decode(caPEMs)
+		if nextBlock == nil {
+			break
+		}
+		if nextBlock.Type != "CERTIFICATE" {
+			return nil, fmt.Errorf("PEM-block should be CERTIFICATE type")
+		}
+
+		// Collect up to the start of the remaining bytes.
+		// We don't grab nextBlock.Bytes because it's not PEM encoded.
+		out = append(out, string(caPEMs[:len(caPEMs)-len(remaining)]))
+		caPEMs = remaining
 	}
 
-	// Check this looks non-empty at least
-	jsonStr := strings.TrimSpace(string(jsonBs))
-	// 50 is arbitrary but config containing the right secrets would always be
-	// bigger than this in JSON format so it is a reasonable test that this wasn't
-	// empty or just an empty JSON object or something.
-	if len(jsonStr) < 50 {
-		ui.Warn("ignoring incomplete local bootstrap config files")
-		return "", false
+	if len(out) == 0 {
+		return nil, errors.New("invalid CA certificate")
+	}
+	return out, nil
+}
+
+// validateTLSCerts checks that the CA cert, server cert, and key on disk are structurally valid.
+//
+// OPTIMIZE: This could be improved by returning an error if certs are expired or close to expiration.
+// However, that requires issuing new certs on bootstrap requests, since returning an error
+// would trigger a re-fetch from HCP.
+func validateTLSCerts(cert, key string, caCerts []string) error {
+	leaf, err := tls.X509KeyPair([]byte(cert), []byte(key))
+	if err != nil {
+		return errors.New("invalid server certificate or key")
+	}
+	_, err = x509.ParseCertificate(leaf.Certificate[0])
+	if err != nil {
+		return errors.New("invalid server certificate")
 	}
 
-	// TODO we could parse the certificates and check they are still valid here
-	// and force a reload if not. We could also attempt to parse config and check
-	// it's all valid just in case the local config was really old and has
-	// deprecated fields or something?
-	return jsonStr, true
+	for _, caCert := range caCerts {
+		_, err = connect.ParseCert(caCert)
+		if err != nil {
+			return errors.New("invalid CA certificate")
+		}
+	}
+	return nil
 }
diff --git a/agent/hcp/bootstrap/bootstrap_test.go b/agent/hcp/bootstrap/bootstrap_test.go
new file mode 100644
index 000000000000..5d00d3372d08
--- /dev/null
+++ b/agent/hcp/bootstrap/bootstrap_test.go
@@ -0,0 +1,467 @@
+package bootstrap
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/hashicorp/consul/agent/config"
+	"github.com/hashicorp/consul/agent/hcp"
+	"github.com/hashicorp/consul/lib"
+	"github.com/hashicorp/consul/tlsutil"
+	"github.com/hashicorp/go-uuid"
+	"github.com/mitchellh/cli"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBootstrapConfigLoader(t *testing.T) {
+	baseLoader := func(source config.Source) (config.LoadResult, error) {
+		return config.Load(config.LoadOpts{
+			DefaultConfig: source,
+			HCL: []string{
+				`server = true`,
+				`bind_addr = "127.0.0.1"`,
+				`data_dir = "/tmp/consul-data"`,
+			},
+		})
+	}
+
+	bootstrapLoader := func(source config.Source) (config.LoadResult, error) {
+		return bootstrapConfigLoader(baseLoader, &RawBootstrapConfig{
+			ConfigJSON:      `{"bootstrap_expect": 8}`,
+			ManagementToken: "test-token",
+		})(source)
+	}
+
+	result, err := bootstrapLoader(nil)
+	require.NoError(t, err)
+
+	// bootstrap_expect and management token are injected from bootstrap config received from HCP.
+	require.Equal(t, 8, result.RuntimeConfig.BootstrapExpect)
+	require.Equal(t, "test-token", result.RuntimeConfig.Cloud.ManagementToken)
+
+	// Response header is always injected from a constant.
+	require.Equal(t, "x-consul-default-acl-policy", result.RuntimeConfig.HTTPResponseHeaders[accessControlHeaderName])
+}
+
+func Test_finalizeRuntimeConfig(t *testing.T) {
+	type testCase struct {
+		rc       *config.RuntimeConfig
+		cfg      *RawBootstrapConfig
+		verifyFn func(t *testing.T, rc *config.RuntimeConfig)
+	}
+	run := func(t *testing.T, tc testCase) {
+		finalizeRuntimeConfig(tc.rc, tc.cfg)
+		tc.verifyFn(t, tc.rc)
+	}
+
+	tt := map[string]testCase{
+		"set header if not present": {
+			rc: &config.RuntimeConfig{},
+			cfg: &RawBootstrapConfig{
+				ManagementToken: "test-token",
+			},
+			verifyFn: func(t *testing.T, rc *config.RuntimeConfig) {
+				require.Equal(t, "test-token", rc.Cloud.ManagementToken)
+				require.Equal(t, "x-consul-default-acl-policy", rc.HTTPResponseHeaders[accessControlHeaderName])
+			},
+		},
+		"append to header if present": {
+			rc: &config.RuntimeConfig{
+				HTTPResponseHeaders: map[string]string{
+					accessControlHeaderName: "Content-Encoding",
+				},
+			},
+			cfg: &RawBootstrapConfig{
+				ManagementToken: "test-token",
+			},
+			verifyFn: func(t *testing.T, rc *config.RuntimeConfig) {
+				require.Equal(t, "test-token", rc.Cloud.ManagementToken)
+				require.Equal(t, "Content-Encoding,x-consul-default-acl-policy", rc.HTTPResponseHeaders[accessControlHeaderName])
+			},
+		},
+	}
+
+	for name, tc := range tt {
+		t.Run(name, func(t *testing.T) {
+			run(t, tc)
+		})
+	}
+}
+
+func boolPtr(value bool) *bool {
+	return &value
+}
+
+func TestLoadConfig_Persistence(t *testing.T) {
+	type testCase struct {
+		// resourceID is the HCP resource ID. If set, a server is considered to be cloud-enabled.
+		resourceID string
+
+		// devMode indicates whether the loader should not have a data directory.
+		devMode bool
+
+		// verifyFn issues case-specific assertions.
+		verifyFn func(t *testing.T, rc *config.RuntimeConfig)
+	}
+
+	run := func(t *testing.T, tc testCase) {
+		dir, err := os.MkdirTemp(os.TempDir(), "bootstrap-test-")
+		require.NoError(t, err)
+		t.Cleanup(func() { os.RemoveAll(dir) })
+
+		s := hcp.NewMockHCPServer()
+		s.AddEndpoint(TestEndpoint())
+
+		// Use an HTTPS server since that's what the HCP SDK expects for auth.
+		srv := httptest.NewTLSServer(s)
+		defer srv.Close()
+
+		caCert, err := x509.ParseCertificate(srv.TLS.Certificates[0].Certificate[0])
+		require.NoError(t, err)
+
+		pool := x509.NewCertPool()
+		pool.AddCert(caCert)
+		clientTLS := &tls.Config{RootCAs: pool}
+
+		baseOpts := config.LoadOpts{
+			HCL: []string{
+				`server = true`,
+				`bind_addr = "127.0.0.1"`,
+				fmt.Sprintf(`http_config = { response_headers = { %s = "Content-Encoding" } }`, accessControlHeaderName),
+				fmt.Sprintf(`cloud { client_id="test" client_secret="test" hostname=%q auth_url=%q resource_id=%q }`,
+					srv.Listener.Addr().String(), srv.URL, tc.resourceID),
+			},
+		}
+		if tc.devMode {
+			baseOpts.DevMode = boolPtr(true)
+		} else {
+			baseOpts.HCL = append(baseOpts.HCL, fmt.Sprintf(`data_dir = %q`, dir))
+		}
+
+		baseLoader := func(source config.Source) (config.LoadResult, error) {
+			baseOpts.DefaultConfig = source
+			return config.Load(baseOpts)
+		}
+
+		ui := cli.NewMockUi()
+
+		// Load initial config to check whether bootstrapping from HCP is enabled.
+		initial, err := baseLoader(nil)
+		require.NoError(t, err)
+
+		// Override the client TLS config so that the test server can be trusted.
+		initial.RuntimeConfig.Cloud.WithTLSConfig(clientTLS)
+		client, err := hcp.NewClient(initial.RuntimeConfig.Cloud)
+		require.NoError(t, err)
+
+		loader, err := LoadConfig(context.Background(), client, initial.RuntimeConfig.DataDir, baseLoader, ui)
+		require.NoError(t, err)
+
+		// Load the agent config with the potentially wrapped loader.
+		fromRemote, err := loader(nil)
+		require.NoError(t, err)
+
+		// HCP-enabled cases should fetch from HCP on the first run of LoadConfig.
+		require.Contains(t, ui.OutputWriter.String(), "Fetching configuration from HCP")
+
+		// Run case-specific verification.
+		tc.verifyFn(t, fromRemote.RuntimeConfig)
+
+		require.Empty(t, fromRemote.RuntimeConfig.ACLInitialManagementToken,
+			"initial_management token should have been sanitized")
+
+		if tc.devMode {
+			// Re-running the bootstrap func below isn't relevant to dev mode
+			// since they don't have a data directory to load data from.
+			return
+		}
+
+		// Run LoadConfig again to exercise the logic of loading config from disk.
+		loader, err = LoadConfig(context.Background(), client, initial.RuntimeConfig.DataDir, baseLoader, ui)
+		require.NoError(t, err)
+
+		fromDisk, err := loader(nil)
+		require.NoError(t, err)
+
+		// HCP-enabled cases should fetch from disk on the second run.
+		require.Contains(t, ui.OutputWriter.String(), "Loaded HCP configuration from local disk")
+
+		// Config loaded from disk should be the same as the one that was initially fetched from the HCP servers.
+		require.Equal(t, fromRemote.RuntimeConfig, fromDisk.RuntimeConfig)
+	}
+
+	tt := map[string]testCase{
+		"dev mode": {
+			devMode: true,
+
+			resourceID: "organization/0b9de9a3-8403-4ca6-aba8-fca752f42100/" +
+				"project/0b9de9a3-8403-4ca6-aba8-fca752f42100/" +
+				"consul.cluster/new-cluster-id",
+
+			verifyFn: func(t *testing.T, rc *config.RuntimeConfig) {
+				require.Empty(t, rc.DataDir)
+
+				// Dev mode should have persisted certs since they can't be inlined.
+				require.NotEmpty(t, rc.TLS.HTTPS.CertFile)
+				require.NotEmpty(t, rc.TLS.HTTPS.KeyFile)
+				require.NotEmpty(t, rc.TLS.HTTPS.CAFile)
+
+				// Find the temporary directory they got stored in.
+				dir := filepath.Dir(rc.TLS.HTTPS.CertFile)
+
+				// Ensure we only stored the TLS materials.
+				entries, err := os.ReadDir(dir)
+				require.NoError(t, err)
+				require.Len(t, entries, 3)
+
+				haveFiles := make([]string, 3)
+				for i, entry := range entries {
+					haveFiles[i] = entry.Name()
+				}
+
+				wantFiles := []string{caFileName, certFileName, keyFileName}
+				require.ElementsMatch(t, wantFiles, haveFiles)
+			},
+		},
+		"new cluster": {
+			resourceID: "organization/0b9de9a3-8403-4ca6-aba8-fca752f42100/" +
+				"project/0b9de9a3-8403-4ca6-aba8-fca752f42100/" +
+				"consul.cluster/new-cluster-id",
+
+			// New clusters should have received and persisted the whole suite of config.
+			verifyFn: func(t *testing.T, rc *config.RuntimeConfig) {
+				dir := filepath.Join(rc.DataDir, subDir)
+
+				entries, err := os.ReadDir(dir)
+				require.NoError(t, err)
+				require.Len(t, entries, 6)
+
+				files := []string{
+					filepath.Join(dir, configFileName),
+					filepath.Join(dir, caFileName),
+					filepath.Join(dir, certFileName),
+					filepath.Join(dir, keyFileName),
+					filepath.Join(dir, tokenFileName),
+					filepath.Join(dir, successFileName),
+				}
+				for _, name := range files {
+					_, err := os.Stat(name)
+					require.NoError(t, err)
+				}
+
+				require.Equal(t, filepath.Join(dir, certFileName), rc.TLS.HTTPS.CertFile)
+				require.Equal(t, filepath.Join(dir, keyFileName), rc.TLS.HTTPS.KeyFile)
+				require.Equal(t, filepath.Join(dir, caFileName), rc.TLS.HTTPS.CAFile)
+
+				cert, key, caCerts, err := loadCerts(dir)
+				require.NoError(t, err)
+
+				require.NoError(t, validateTLSCerts(cert, key, caCerts))
+			},
+		},
+		"existing cluster": {
+			resourceID: "organization/0b9de9a3-8403-4ca6-aba8-fca752f42100/" +
+				"project/0b9de9a3-8403-4ca6-aba8-fca752f42100/" +
+				"consul.cluster/" + TestExistingClusterID,
+
+			// Existing clusters should have only received and persisted the management token.
+			verifyFn: func(t *testing.T, rc *config.RuntimeConfig) {
+				dir := filepath.Join(rc.DataDir, subDir)
+
+				entries, err := os.ReadDir(dir)
+				require.NoError(t, err)
+				require.Len(t, entries, 3)
+
+				files := []string{
+					filepath.Join(dir, tokenFileName),
+					filepath.Join(dir, successFileName),
+					filepath.Join(dir, configFileName),
+				}
+				for _, name := range files {
+					_, err := os.Stat(name)
+					require.NoError(t, err)
+				}
+			},
+		},
+	}
+
+	for name, tc := range tt {
+		t.Run(name, func(t *testing.T) {
+			run(t, tc)
+		})
+	}
+}
+
+func Test_loadPersistedBootstrapConfig(t *testing.T) {
+	type expect struct {
+		loaded  bool
+		warning string
+	}
+	type testCase struct {
+		existingCluster bool
+		mutateFn        func(t *testing.T, dir string)
+		expect          expect
+	}
+
+	run := func(t *testing.T, tc testCase) {
+		dataDir, err := os.MkdirTemp(os.TempDir(), "load-bootstrap-test-")
+		require.NoError(t, err)
+		t.Cleanup(func() { os.RemoveAll(dataDir) })
+
+		dir := filepath.Join(dataDir, subDir)
+
+		// Do some common setup as if we received config from HCP and persisted it to disk.
+		require.NoError(t, lib.EnsurePath(dir, true))
+		require.NoError(t, persistSucessMarker(dir))
+
+		if !tc.existingCluster {
+			caCert, caKey, err := tlsutil.GenerateCA(tlsutil.CAOpts{})
+			require.NoError(t, err)
+
+			serverCert, serverKey, err := testLeaf(caCert, caKey)
+			require.NoError(t, err)
+			require.NoError(t, persistTLSCerts(dir, serverCert, serverKey, []string{caCert}))
+
+			cfgJSON := `{"bootstrap_expect": 8}`
+			require.NoError(t, persistBootstrapConfig(dir, cfgJSON))
+		}
+
+		token, err := uuid.GenerateUUID()
+		require.NoError(t, err)
+		require.NoError(t, persistManagementToken(dir, token))
+
+		// Optionally mutate the persisted data to trigger errors while loading.
+		if tc.mutateFn != nil {
+			tc.mutateFn(t, dir)
+		}
+
+		ui := cli.NewMockUi()
+		cfg, loaded := loadPersistedBootstrapConfig(dataDir, ui)
+		require.Equal(t, tc.expect.loaded, loaded, ui.ErrorWriter.String())
+		if loaded {
+			require.Equal(t, token, cfg.ManagementToken)
+			require.Empty(t, ui.ErrorWriter.String())
+
+		} else {
+			require.Nil(t, cfg)
+			require.Contains(t, ui.ErrorWriter.String(), tc.expect.warning)
+		}
+	}
+
+	tt := map[string]testCase{
+		"existing cluster with valid files": {
+			existingCluster: true,
+			// Don't mutate, files from setup are valid.
+			mutateFn: nil,
+			expect: expect{
+				loaded:  true,
+				warning: "",
+			},
+		},
+		"existing cluster missing token": {
+			existingCluster: true,
+			mutateFn: func(t *testing.T, dir string) {
+				// Remove the token file while leaving the existing cluster marker.
+				require.NoError(t, os.Remove(filepath.Join(dir, tokenFileName)))
+			},
+			expect: expect{
+				loaded:  false,
+				warning: "configuration files on disk are incomplete",
+			},
+		},
+		"existing cluster no files": {
+			existingCluster: true,
+			mutateFn: func(t *testing.T, dir string) {
+				// Remove all files
+				require.NoError(t, os.RemoveAll(dir))
+			},
+			expect: expect{
+				loaded: false,
+				// No warnings since we assume we need to fetch config from HCP for the first time.
+				warning: "",
+			},
+		},
+		"new cluster with valid files": {
+			// Don't mutate, files from setup are valid.
+			mutateFn: nil,
+			expect: expect{
+				loaded:  true,
+				warning: "",
+			},
+		},
+		"new cluster some files": {
+			mutateFn: func(t *testing.T, dir string) {
+				// Remove one of the required files
+				require.NoError(t, os.Remove(filepath.Join(dir, certFileName)))
+			},
+			expect: expect{
+				loaded:  false,
+				warning: "configuration files on disk are incomplete",
+			},
+		},
+		"new cluster no files": {
+			mutateFn: func(t *testing.T, dir string) {
+				// Remove all files
+				require.NoError(t, os.RemoveAll(dir))
+			},
+			expect: expect{
+				loaded: false,
+				// No warnings since we assume we need to fetch config from HCP for the first time.
+				warning: "",
+			},
+		},
+		"new cluster invalid cert": {
+			mutateFn: func(t *testing.T, dir string) {
+				name := filepath.Join(dir, certFileName)
+				require.NoError(t, os.WriteFile(name, []byte("not-a-cert"), 0600))
+			},
+			expect: expect{
+				loaded:  false,
+				warning: "invalid server certificate",
+			},
+		},
+		"new cluster invalid CA": {
+			mutateFn: func(t *testing.T, dir string) {
+				name := filepath.Join(dir, caFileName)
+				require.NoError(t, os.WriteFile(name, []byte("not-a-ca-cert"), 0600))
+			},
+			expect: expect{
+				loaded:  false,
+				warning: "invalid CA certificate",
+			},
+		},
+		"new cluster invalid config flag": {
+			mutateFn: func(t *testing.T, dir string) {
+				name := filepath.Join(dir, configFileName)
+				require.NoError(t, os.WriteFile(name, []byte(`{"not_a_consul_agent_config_field" = "zap"}`), 0600))
+			},
+			expect: expect{
+				loaded:  false,
+				warning: "failed to parse local bootstrap config",
+			},
+		},
+		"existing cluster invalid token": {
+			existingCluster: true,
+			mutateFn: func(t *testing.T, dir string) {
+				name := filepath.Join(dir, tokenFileName)
+				require.NoError(t, os.WriteFile(name, []byte("not-a-uuid"), 0600))
+			},
+			expect: expect{
+				loaded:  false,
+				warning: "is not a valid UUID",
+			},
+		},
+	}
+
+	for name, tc := range tt {
+		t.Run(name, func(t *testing.T) {
+			run(t, tc)
+		})
+	}
+}
diff --git a/agent/hcp/bootstrap/testing.go b/agent/hcp/bootstrap/testing.go
index 10e1f8fe49c5..a10a5d2bc8ad 100644
--- a/agent/hcp/bootstrap/testing.go
+++ b/agent/hcp/bootstrap/testing.go
@@ -13,12 +13,11 @@ import (
 	"net/http"
 	"strings"
 
-	gnmmod "github.com/hashicorp/hcp-sdk-go/clients/cloud-global-network-manager-service/preview/2022-02-15/models"
-	"github.com/hashicorp/hcp-sdk-go/resource"
-
 	"github.com/hashicorp/consul/agent/hcp"
 	"github.com/hashicorp/consul/tlsutil"
 	"github.com/hashicorp/go-uuid"
+	gnmmod "github.com/hashicorp/hcp-sdk-go/clients/cloud-global-network-manager-service/preview/2022-02-15/models"
+	"github.com/hashicorp/hcp-sdk-go/resource"
 )
 
 // TestEndpoint returns an hcp.TestEndpoint to be used in an hcp.MockHCPServer.
@@ -49,6 +48,29 @@ func handleBootstrap(data map[string]gnmmod.HashicorpCloudGlobalNetworkManager20
 	return resp, nil
 }
 
+const TestExistingClusterID = "133114e7-9745-41ce-b1c9-9644a20d2952"
+
+func testLeaf(caCert, caKey string) (serverCert, serverKey string, err error) {
+	signer, err := tlsutil.ParseSigner(caKey)
+	if err != nil {
+		return "", "", err
+	}
+
+	serverCert, serverKey, err = tlsutil.GenerateCert(tlsutil.CertOpts{
+		Signer:      signer,
+		CA:          caCert,
+		Name:        "server.dc1.consul",
+		Days:        30,
+		DNSNames:    []string{"server.dc1.consul", "localhost"},
+		IPAddresses: append([]net.IP{}, net.ParseIP("127.0.0.1")),
+		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
+	})
+	if err != nil {
+		return "", "", err
+	}
+	return serverCert, serverKey, nil
+}
+
 func generateClusterData(cluster resource.Resource) (gnmmod.HashicorpCloudGlobalNetworkManager20220215AgentBootstrapResponse, error) {
 	resp := gnmmod.HashicorpCloudGlobalNetworkManager20220215AgentBootstrapResponse{
 		Cluster: &gnmmod.HashicorpCloudGlobalNetworkManager20220215Cluster{},
@@ -56,32 +78,28 @@ func generateClusterData(cluster resource.Resource) (gnmmod.HashicorpCloudGlobal
 			ServerTLS: &gnmmod.HashicorpCloudGlobalNetworkManager20220215ServerTLS{},
 		},
 	}
-
-	CACert, CAKey, err := tlsutil.GenerateCA(tlsutil.CAOpts{})
-	if err != nil {
-		return resp, err
+	if cluster.ID == TestExistingClusterID {
+		token, err := uuid.GenerateUUID()
+		if err != nil {
+			return resp, err
+		}
+		resp.Bootstrap.ConsulConfig = "{}"
+		resp.Bootstrap.ManagementToken = token
+		return resp, nil
 	}
 
-	resp.Bootstrap.ServerTLS.CertificateAuthorities = append(resp.Bootstrap.ServerTLS.CertificateAuthorities, CACert)
-	signer, err := tlsutil.ParseSigner(CAKey)
+	caCert, caKey, err := tlsutil.GenerateCA(tlsutil.CAOpts{})
 	if err != nil {
 		return resp, err
 	}
-
-	cert, priv, err := tlsutil.GenerateCert(tlsutil.CertOpts{
-		Signer:      signer,
-		CA:          CACert,
-		Name:        "server.dc1.consul",
-		Days:        30,
-		DNSNames:    []string{"server.dc1.consul", "localhost"},
-		IPAddresses: append([]net.IP{}, net.ParseIP("127.0.0.1")),
-		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
-	})
+	serverCert, serverKey, err := testLeaf(caCert, caKey)
 	if err != nil {
 		return resp, err
 	}
-	resp.Bootstrap.ServerTLS.Cert = cert
-	resp.Bootstrap.ServerTLS.PrivateKey = priv
+
+	resp.Bootstrap.ServerTLS.CertificateAuthorities = append(resp.Bootstrap.ServerTLS.CertificateAuthorities, caCert)
+	resp.Bootstrap.ServerTLS.Cert = serverCert
+	resp.Bootstrap.ServerTLS.PrivateKey = serverKey
 
 	// Generate Config. We don't use the read config.Config struct because it
 	// doesn't have `omitempty` which makes the output gross. We only want a tiny
@@ -116,8 +134,9 @@ func generateClusterData(cluster resource.Resource) (gnmmod.HashicorpCloudGlobal
 
 		// Enable HTTPS port, disable HTTP
 		"ports": map[string]interface{}{
-			"https": 8501,
-			"http":  -1,
+			"https":    8501,
+			"http":     -1,
+			"grpc_tls": 8503,
 		},
 
 		// RAFT Peers
@@ -128,16 +147,18 @@ func generateClusterData(cluster resource.Resource) (gnmmod.HashicorpCloudGlobal
 	}
 
 	// ACLs
-	management, err := uuid.GenerateUUID()
+	token, err := uuid.GenerateUUID()
 	if err != nil {
 		return resp, err
 	}
+	resp.Bootstrap.ManagementToken = token
+
 	cfg["acl"] = map[string]interface{}{
 		"tokens": map[string]interface{}{
-			"initial_management": management,
-			// Also setup the server's own agent token to be the same so it has
+			// Also setup the server's own agent token to be the management token so it has
 			// permission to register itself.
-			"agent": management,
+			"agent":              token,
+			"initial_management": token,
 		},
 		"default_policy":           "deny",
 		"enabled":                  true,
diff --git a/agent/hcp/client.go b/agent/hcp/client.go
index e48bb0f65f72..c28e1b9c7f08 100644
--- a/agent/hcp/client.go
+++ b/agent/hcp/client.go
@@ -37,6 +37,7 @@ type BootstrapConfig struct {
 	TLSCertKey      string
 	TLSCAs          []string
 	ConsulConfig    string
+	ManagementToken string
 }
 
 type hcpClient struct {
@@ -106,6 +107,7 @@ func bootstrapConfigFromHCP(res *gnmmod.HashicorpCloudGlobalNetworkManager202202
 		TLSCertKey:      serverTLS.PrivateKey,
 		TLSCAs:          serverTLS.CertificateAuthorities,
 		ConsulConfig:    res.Bootstrap.ConsulConfig,
+		ManagementToken: res.Bootstrap.ManagementToken,
 	}
 }
 
@@ -115,7 +117,7 @@ func (c *hcpClient) PushServerStatus(ctx context.Context, s *ServerStatus) error
 		WithLocationOrganizationID(c.resource.Organization).
 		WithLocationProjectID(c.resource.Project)
 
-	params.SetBody(&gnmmod.HashicorpCloudGlobalNetworkManager20220215AgentPushServerStateRequest{
+	params.SetBody(hcpgnm.AgentPushServerStateBody{
 		ServerState: serverStatusToHCP(s),
 	})
 
diff --git a/agent/hcp/config/config.go b/agent/hcp/config/config.go
index 8430891cbd7d..a6d4c31979db 100644
--- a/agent/hcp/config/config.go
+++ b/agent/hcp/config/config.go
@@ -17,20 +17,34 @@ type CloudConfig struct {
 	Hostname     string
 	AuthURL      string
 	ScadaAddress string
+
+	// Management token used by HCP management plane.
+	// Cannot be set via config files.
+	ManagementToken string
+
+	// TlsConfig for testing.
+	TLSConfig *tls.Config
+}
+
+func (c *CloudConfig) WithTLSConfig(cfg *tls.Config) {
+	c.TLSConfig = cfg
 }
 
 func (c *CloudConfig) HCPConfig(opts ...hcpcfg.HCPConfigOption) (hcpcfg.HCPConfig, error) {
+	if c.TLSConfig == nil {
+		c.TLSConfig = &tls.Config{}
+	}
 	if c.ClientID != "" && c.ClientSecret != "" {
 		opts = append(opts, hcpcfg.WithClientCredentials(c.ClientID, c.ClientSecret))
 	}
 	if c.AuthURL != "" {
-		opts = append(opts, hcpcfg.WithAuth(c.AuthURL, &tls.Config{}))
+		opts = append(opts, hcpcfg.WithAuth(c.AuthURL, c.TLSConfig))
 	}
 	if c.Hostname != "" {
-		opts = append(opts, hcpcfg.WithAPI(c.Hostname, &tls.Config{}))
+		opts = append(opts, hcpcfg.WithAPI(c.Hostname, c.TLSConfig))
 	}
 	if c.ScadaAddress != "" {
-		opts = append(opts, hcpcfg.WithSCADA(c.ScadaAddress, &tls.Config{}))
+		opts = append(opts, hcpcfg.WithSCADA(c.ScadaAddress, c.TLSConfig))
 	}
 	opts = append(opts, hcpcfg.FromEnv())
 	return hcpcfg.NewHCPConfig(opts...)
diff --git a/agent/hcp/scada/mock_Provider.go b/agent/hcp/scada/mock_Provider.go
index 251178095bc2..b9a0fd2d4967 100644
--- a/agent/hcp/scada/mock_Provider.go
+++ b/agent/hcp/scada/mock_Provider.go
@@ -1,4 +1,4 @@
-// Code generated by mockery v2.15.0. DO NOT EDIT.
+// Code generated by mockery v2.20.0. DO NOT EDIT.
 
 package scada
 
@@ -7,6 +7,8 @@ import (
 
 	mock "github.com/stretchr/testify/mock"
 
+	provider "github.com/hashicorp/hcp-scada-provider"
+
 	time "time"
 )
 
@@ -23,6 +25,98 @@ func (_m *MockProvider) EXPECT() *MockProvider_Expecter {
 	return &MockProvider_Expecter{mock: &_m.Mock}
 }
 
+// AddMeta provides a mock function with given fields: _a0
+func (_m *MockProvider) AddMeta(_a0 ...provider.Meta) {
+	_va := make([]interface{}, len(_a0))
+	for _i := range _a0 {
+		_va[_i] = _a0[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, _va...)
+	_m.Called(_ca...)
+}
+
+// MockProvider_AddMeta_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'AddMeta'
+type MockProvider_AddMeta_Call struct {
+	*mock.Call
+}
+
+// AddMeta is a helper method to define mock.On call
+//   - _a0 ...provider.Meta
+func (_e *MockProvider_Expecter) AddMeta(_a0 ...interface{}) *MockProvider_AddMeta_Call {
+	return &MockProvider_AddMeta_Call{Call: _e.mock.On("AddMeta",
+		append([]interface{}{}, _a0...)...)}
+}
+
+func (_c *MockProvider_AddMeta_Call) Run(run func(_a0 ...provider.Meta)) *MockProvider_AddMeta_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		variadicArgs := make([]provider.Meta, len(args)-0)
+		for i, a := range args[0:] {
+			if a != nil {
+				variadicArgs[i] = a.(provider.Meta)
+			}
+		}
+		run(variadicArgs...)
+	})
+	return _c
+}
+
+func (_c *MockProvider_AddMeta_Call) Return() *MockProvider_AddMeta_Call {
+	_c.Call.Return()
+	return _c
+}
+
+func (_c *MockProvider_AddMeta_Call) RunAndReturn(run func(...provider.Meta)) *MockProvider_AddMeta_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// DeleteMeta provides a mock function with given fields: _a0
+func (_m *MockProvider) DeleteMeta(_a0 ...string) {
+	_va := make([]interface{}, len(_a0))
+	for _i := range _a0 {
+		_va[_i] = _a0[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, _va...)
+	_m.Called(_ca...)
+}
+
+// MockProvider_DeleteMeta_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'DeleteMeta'
+type MockProvider_DeleteMeta_Call struct {
+	*mock.Call
+}
+
+// DeleteMeta is a helper method to define mock.On call
+//   - _a0 ...string
+func (_e *MockProvider_Expecter) DeleteMeta(_a0 ...interface{}) *MockProvider_DeleteMeta_Call {
+	return &MockProvider_DeleteMeta_Call{Call: _e.mock.On("DeleteMeta",
+		append([]interface{}{}, _a0...)...)}
+}
+
+func (_c *MockProvider_DeleteMeta_Call) Run(run func(_a0 ...string)) *MockProvider_DeleteMeta_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		variadicArgs := make([]string, len(args)-0)
+		for i, a := range args[0:] {
+			if a != nil {
+				variadicArgs[i] = a.(string)
+			}
+		}
+		run(variadicArgs...)
+	})
+	return _c
+}
+
+func (_c *MockProvider_DeleteMeta_Call) Return() *MockProvider_DeleteMeta_Call {
+	_c.Call.Return()
+	return _c
+}
+
+func (_c *MockProvider_DeleteMeta_Call) RunAndReturn(run func(...string)) *MockProvider_DeleteMeta_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // GetMeta provides a mock function with given fields:
 func (_m *MockProvider) GetMeta() map[string]string {
 	ret := _m.Called()
@@ -61,18 +155,26 @@ func (_c *MockProvider_GetMeta_Call) Return(_a0 map[string]string) *MockProvider
 	return _c
 }
 
+func (_c *MockProvider_GetMeta_Call) RunAndReturn(run func() map[string]string) *MockProvider_GetMeta_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // LastError provides a mock function with given fields:
 func (_m *MockProvider) LastError() (time.Time, error) {
 	ret := _m.Called()
 
 	var r0 time.Time
+	var r1 error
+	if rf, ok := ret.Get(0).(func() (time.Time, error)); ok {
+		return rf()
+	}
 	if rf, ok := ret.Get(0).(func() time.Time); ok {
 		r0 = rf()
 	} else {
 		r0 = ret.Get(0).(time.Time)
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func() error); ok {
 		r1 = rf()
 	} else {
@@ -104,11 +206,20 @@ func (_c *MockProvider_LastError_Call) Return(_a0 time.Time, _a1 error) *MockPro
 	return _c
 }
 
+func (_c *MockProvider_LastError_Call) RunAndReturn(run func() (time.Time, error)) *MockProvider_LastError_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // Listen provides a mock function with given fields: capability
 func (_m *MockProvider) Listen(capability string) (net.Listener, error) {
 	ret := _m.Called(capability)
 
 	var r0 net.Listener
+	var r1 error
+	if rf, ok := ret.Get(0).(func(string) (net.Listener, error)); ok {
+		return rf(capability)
+	}
 	if rf, ok := ret.Get(0).(func(string) net.Listener); ok {
 		r0 = rf(capability)
 	} else {
@@ -117,7 +228,6 @@ func (_m *MockProvider) Listen(capability string) (net.Listener, error) {
 		}
 	}
 
-	var r1 error
 	if rf, ok := ret.Get(1).(func(string) error); ok {
 		r1 = rf(capability)
 	} else {
@@ -150,6 +260,11 @@ func (_c *MockProvider_Listen_Call) Return(_a0 net.Listener, _a1 error) *MockPro
 	return _c
 }
 
+func (_c *MockProvider_Listen_Call) RunAndReturn(run func(string) (net.Listener, error)) *MockProvider_Listen_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // SessionStatus provides a mock function with given fields:
 func (_m *MockProvider) SessionStatus() string {
 	ret := _m.Called()
@@ -186,6 +301,11 @@ func (_c *MockProvider_SessionStatus_Call) Return(_a0 string) *MockProvider_Sess
 	return _c
 }
 
+func (_c *MockProvider_SessionStatus_Call) RunAndReturn(run func() string) *MockProvider_SessionStatus_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // Start provides a mock function with given fields:
 func (_m *MockProvider) Start() error {
 	ret := _m.Called()
@@ -222,6 +342,11 @@ func (_c *MockProvider_Start_Call) Return(_a0 error) *MockProvider_Start_Call {
 	return _c
 }
 
+func (_c *MockProvider_Start_Call) RunAndReturn(run func() error) *MockProvider_Start_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // Stop provides a mock function with given fields:
 func (_m *MockProvider) Stop() error {
 	ret := _m.Called()
@@ -258,6 +383,11 @@ func (_c *MockProvider_Stop_Call) Return(_a0 error) *MockProvider_Stop_Call {
 	return _c
 }
 
+func (_c *MockProvider_Stop_Call) RunAndReturn(run func() error) *MockProvider_Stop_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // UpdateMeta provides a mock function with given fields: _a0
 func (_m *MockProvider) UpdateMeta(_a0 map[string]string) {
 	_m.Called(_a0)
@@ -286,6 +416,11 @@ func (_c *MockProvider_UpdateMeta_Call) Return() *MockProvider_UpdateMeta_Call {
 	return _c
 }
 
+func (_c *MockProvider_UpdateMeta_Call) RunAndReturn(run func(map[string]string)) *MockProvider_UpdateMeta_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 type mockConstructorTestingTNewMockProvider interface {
 	mock.TestingT
 	Cleanup(func())
diff --git a/agent/hcp/testing.go b/agent/hcp/testing.go
index dbcd7f479b0a..94f3122c33d2 100644
--- a/agent/hcp/testing.go
+++ b/agent/hcp/testing.go
@@ -13,6 +13,7 @@ import (
 	"sync"
 	"time"
 
+	hcpgnm "github.com/hashicorp/hcp-sdk-go/clients/cloud-global-network-manager-service/preview/2022-02-15/client/global_network_manager_service"
 	gnmmod "github.com/hashicorp/hcp-sdk-go/clients/cloud-global-network-manager-service/preview/2022-02-15/models"
 	"github.com/hashicorp/hcp-sdk-go/resource"
 )
@@ -63,7 +64,7 @@ func (s *MockHCPServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
-	if r.URL.Path == "/oauth/token" {
+	if r.URL.Path == "/oauth2/token" {
 		mockTokenResponse(w)
 		return
 	}
@@ -136,30 +137,31 @@ func enforceMethod(w http.ResponseWriter, r *http.Request, methods []string) boo
 }
 
 func mockTokenResponse(w http.ResponseWriter) {
+	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(http.StatusOK)
-	w.Write([]byte(`{access_token: "token", token_type: "Bearer"}`))
+
+	w.Write([]byte(`{"access_token": "token", "token_type": "Bearer"}`))
 }
 
 func (s *MockHCPServer) handleStatus(r *http.Request, cluster resource.Resource) (interface{}, error) {
-	var req gnmmod.HashicorpCloudGlobalNetworkManager20220215AgentPushServerStateRequest
+	var req hcpgnm.AgentPushServerStateBody
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		return nil, err
 	}
-	status := req.ServerState
 	log.Printf("STATUS UPDATE: server=%s version=%s leader=%v hasLeader=%v healthy=%v tlsCertExpiryDays=%1.0f",
-		status.Name,
-		status.Version,
-		status.Raft.IsLeader,
-		status.Raft.KnownLeader,
-		status.Autopilot.Healthy,
-		time.Until(time.Time(status.TLS.CertExpiry)).Hours()/24,
+		req.ServerState.Name,
+		req.ServerState.Version,
+		req.ServerState.Raft.IsLeader,
+		req.ServerState.Raft.KnownLeader,
+		req.ServerState.Autopilot.Healthy,
+		time.Until(time.Time(req.ServerState.TLS.CertExpiry)).Hours()/24,
 	)
-	s.servers[status.Name] = &gnmmod.HashicorpCloudGlobalNetworkManager20220215Server{
-		GossipPort: status.GossipPort,
-		ID:         status.ID,
-		LanAddress: status.LanAddress,
-		Name:       status.Name,
-		RPCPort:    status.RPCPort,
+	s.servers[req.ServerState.Name] = &gnmmod.HashicorpCloudGlobalNetworkManager20220215Server{
+		GossipPort: req.ServerState.GossipPort,
+		ID:         req.ServerState.ID,
+		LanAddress: req.ServerState.LanAddress,
+		Name:       req.ServerState.Name,
+		RPCPort:    req.ServerState.RPCPort,
 	}
 	return "{}", nil
 }
diff --git a/command/agent/agent.go b/command/agent/agent.go
index 356faf30d3f4..a4784f626f45 100644
--- a/command/agent/agent.go
+++ b/command/agent/agent.go
@@ -15,6 +15,7 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/hashicorp/consul/agent/hcp"
 	"github.com/hashicorp/go-checkpoint"
 	"github.com/hashicorp/go-hclog"
 	mcli "github.com/mitchellh/cli"
@@ -159,14 +160,28 @@ func (c *cmd) run(args []string) int {
 	go handleStartupSignals(ctx, cancel, signalCh, suLogger)
 
 	// See if we need to bootstrap config from HCP before we go any further with
-	// agent startup. We override loader with the one returned as it may be
-	// modified to include HCP-provided config.
-	var err error
-	_, loader, err = hcpbootstrap.MaybeBootstrap(ctx, loader, ui)
+	// agent startup. First do a preliminary load of agent configuration using the given loader.
+	// This is just to peek whether bootstrapping from HCP is enabled. The result is discarded
+	// on the call to agent.NewBaseDeps so that the wrapped loader takes effect.
+	res, err := loader(nil)
 	if err != nil {
 		ui.Error(err.Error())
 		return 1
 	}
+	if res.RuntimeConfig.IsCloudEnabled() {
+		client, err := hcp.NewClient(res.RuntimeConfig.Cloud)
+		if err != nil {
+			ui.Error("error building HCP HTTP client: " + err.Error())
+			return 1
+		}
+
+		// We override loader with the one returned as it was modified to include HCP-provided config.
+		loader, err = hcpbootstrap.LoadConfig(ctx, client, res.RuntimeConfig.DataDir, loader, ui)
+		if err != nil {
+			ui.Error(err.Error())
+			return 1
+		}
+	}
 
 	bd, err := agent.NewBaseDeps(loader, logGate, nil)
 	if err != nil {
diff --git a/go.mod b/go.mod
index d78707f8c9a6..333b699300f2 100644
--- a/go.mod
+++ b/go.mod
@@ -28,10 +28,10 @@ require (
 	github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1
 	github.com/fatih/color v1.13.0
 	github.com/fsnotify/fsnotify v1.5.1
-	github.com/go-openapi/runtime v0.24.1
+	github.com/go-openapi/runtime v0.25.0
 	github.com/go-openapi/strfmt v0.21.3
 	github.com/golang/protobuf v1.5.2
-	github.com/google/go-cmp v0.5.8
+	github.com/google/go-cmp v0.5.9
 	github.com/google/gofuzz v1.2.0
 	github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1
 	github.com/google/tcpproxy v0.0.0-20180808230851-dfa16c61dad2
@@ -60,8 +60,8 @@ require (
 	github.com/hashicorp/go-version v1.2.1
 	github.com/hashicorp/golang-lru v0.5.4
 	github.com/hashicorp/hcl v1.0.0
-	github.com/hashicorp/hcp-scada-provider v0.2.0
-	github.com/hashicorp/hcp-sdk-go v0.23.1-0.20220921131124-49168300a7dc
+	github.com/hashicorp/hcp-scada-provider v0.2.3
+	github.com/hashicorp/hcp-sdk-go v0.40.1-0.20230404193545-846aea419cd1
 	github.com/hashicorp/hil v0.0.0-20200423225030-a18a1cd20038
 	github.com/hashicorp/memberlist v0.5.0
 	github.com/hashicorp/raft v1.5.0
@@ -97,10 +97,10 @@ require (
 	go.etcd.io/bbolt v1.3.6
 	go.uber.org/goleak v1.1.10
 	golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d
-	golang.org/x/net v0.7.0
-	golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1
-	golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4
-	golang.org/x/sys v0.5.0
+	golang.org/x/net v0.8.0
+	golang.org/x/oauth2 v0.6.0
+	golang.org/x/sync v0.1.0
+	golang.org/x/sys v0.6.0
 	golang.org/x/time v0.3.0
 	google.golang.org/genproto v0.0.0-20220921223823-23cae91e6737
 	google.golang.org/grpc v1.49.0
@@ -127,8 +127,6 @@ require (
 	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
 	github.com/DataDog/datadog-go v3.2.0+incompatible // indirect
 	github.com/Microsoft/go-winio v0.4.3 // indirect
-	github.com/PuerkitoBio/purell v1.1.1 // indirect
-	github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
 	github.com/benbjohnson/immutable v0.4.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
@@ -149,15 +147,17 @@ require (
 	github.com/dimchansky/utfbom v1.1.0 // indirect
 	github.com/envoyproxy/protoc-gen-validate v0.1.0 // indirect
 	github.com/form3tech-oss/jwt-go v3.2.2+incompatible // indirect
+	github.com/go-logr/logr v1.2.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
-	github.com/go-openapi/analysis v0.21.2 // indirect
-	github.com/go-openapi/errors v0.20.2 // indirect
+	github.com/go-openapi/analysis v0.21.4 // indirect
+	github.com/go-openapi/errors v0.20.3 // indirect
 	github.com/go-openapi/jsonpointer v0.19.5 // indirect
-	github.com/go-openapi/jsonreference v0.19.6 // indirect
-	github.com/go-openapi/loads v0.21.1 // indirect
-	github.com/go-openapi/spec v0.20.4 // indirect
-	github.com/go-openapi/swag v0.21.1 // indirect
-	github.com/go-openapi/validate v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.20.0 // indirect
+	github.com/go-openapi/loads v0.21.2 // indirect
+	github.com/go-openapi/spec v0.20.8 // indirect
+	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/go-openapi/validate v0.22.1 // indirect
 	github.com/go-ozzo/ozzo-validation v3.6.0+incompatible // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e // indirect
@@ -223,15 +223,17 @@ require (
 	github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926 // indirect
 	github.com/vmware/govmomi v0.18.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.2 // indirect
-	go.mongodb.org/mongo-driver v1.10.0 // indirect
+	go.mongodb.org/mongo-driver v1.11.0 // indirect
 	go.opencensus.io v0.23.0 // indirect
+	go.opentelemetry.io/otel v1.11.1 // indirect
+	go.opentelemetry.io/otel/trace v1.11.1 // indirect
 	go.opentelemetry.io/proto/otlp v0.7.0 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
 	golang.org/x/exp v0.0.0-20230321023759-10a507213a29 // indirect
 	golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 // indirect
-	golang.org/x/term v0.5.0 // indirect
-	golang.org/x/text v0.7.0 // indirect
-	golang.org/x/tools v0.2.0 // indirect
+	golang.org/x/term v0.6.0 // indirect
+	golang.org/x/text v0.8.0 // indirect
+	golang.org/x/tools v0.6.0 // indirect
 	google.golang.org/api v0.57.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
diff --git a/go.sum b/go.sum
index 964f00fa91e0..2bb892bc9ca3 100644
--- a/go.sum
+++ b/go.sum
@@ -114,10 +114,8 @@ github.com/NYTimes/gziphandler v1.0.1/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/OpenDNS/vegadns2client v0.0.0-20180418235048-a3fa4a771d87/go.mod h1:iGLljf5n9GjT6kc0HBvyI1nOKnGQbNB66VzSNbK5iks=
 github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
-github.com/PuerkitoBio/purell v1.1.1 h1:WEQqlqaGbrPkxLJWfBwQmfEAE1Z7ONdDLqrN38tNFfI=
 github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
-github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 h1:d+Bc7a5rLufV/sSk/8dngufqelfh6jnri85riMAaF/M=
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
 github.com/Shopify/sarama v1.19.0/go.mod h1:FVkBWblsNy7DGZRfXLU0O9RCGt5g3g3yEuWXgklEdEo=
 github.com/Shopify/sarama v1.21.0/go.mod h1:yuqtN/pe8cXRWG5zPaO7hCfNJp5MwmkoJEoLjkm5tCQ=
@@ -247,7 +245,6 @@ github.com/dnsimple/dnsimple-go v0.30.0/go.mod h1:O5TJ0/U6r7AfT8niYNlmohpLbCSG+c
 github.com/dnstap/golang-dnstap v0.0.0-20170829151710-2cf77a2b5e11/go.mod h1:s1PfVYYVmTMgCSPtho4LKBDecEHJWtiVDPNv78Z985U=
 github.com/docker/go-connections v0.3.0 h1:3lOnM9cSzgGwx8VfK/NGOW5fLQ0GjIlCkaktF+n1M6o=
 github.com/docker/go-connections v0.3.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
-github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
 github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
@@ -311,45 +308,55 @@ github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
 github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.2.3 h1:2DntVwHkVopvECVRSlL5PSo9eG+cAkDCuckLubN+rq0=
+github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
-github.com/go-openapi/analysis v0.21.2 h1:hXFrOYFHUAMQdu6zwAiKKJHJQ8kqZs1ux/ru1P1wLJU=
 github.com/go-openapi/analysis v0.21.2/go.mod h1:HZwRk4RRisyG8vx2Oe6aqeSQcoxRp47Xkp3+K6q+LdY=
+github.com/go-openapi/analysis v0.21.4 h1:ZDFLvSNxpDaomuCueM0BlSXxpANBlFYiBvr+GXrvIHc=
+github.com/go-openapi/analysis v0.21.4/go.mod h1:4zQ35W4neeZTqh3ol0rv/O8JBbka9QyAgQRPp9y3pfo=
 github.com/go-openapi/errors v0.19.8/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpXe8DOa1Mi1M=
 github.com/go-openapi/errors v0.19.9/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpXe8DOa1Mi1M=
-github.com/go-openapi/errors v0.20.2 h1:dxy7PGTqEh94zj2E3h1cUmQQWiM1+aeCROfAr02EmK8=
 github.com/go-openapi/errors v0.20.2/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpXe8DOa1Mi1M=
+github.com/go-openapi/errors v0.20.3 h1:rz6kiC84sqNQoqrtulzaL/VERgkoCyB6WdEkc2ujzUc=
+github.com/go-openapi/errors v0.20.3/go.mod h1:Z3FlZ4I8jEGxjUK+bugx3on2mIAk4txuAOhlsB1FSgk=
 github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+35s3my2LFTysnkMfxsJBAMHj/DoqoB9knIWoYG/Vk0=
 github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
 github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY=
 github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
 github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1:W3Z9FmVs9qj+KR4zFKmDPGiLdk1D9Rlm7cyMvf57TTg=
-github.com/go-openapi/jsonreference v0.19.6 h1:UBIxjkht+AWIgYzCDSv2GN+E/togfwXUJFRTWhl2Jjs=
 github.com/go-openapi/jsonreference v0.19.6/go.mod h1:diGHMEHg2IqXZGKxqyvWdfWU/aim5Dprw5bqpKkTvns=
-github.com/go-openapi/loads v0.21.1 h1:Wb3nVZpdEzDTcly8S4HMkey6fjARRzb7iEaySimlDW0=
+github.com/go-openapi/jsonreference v0.20.0 h1:MYlu0sBgChmCfJxxUKZ8g1cPWFOB37YSZqewK7OKeyA=
+github.com/go-openapi/jsonreference v0.20.0/go.mod h1:Ag74Ico3lPc+zR+qjn4XBUmXymS4zJbYVCZmcgkasdo=
 github.com/go-openapi/loads v0.21.1/go.mod h1:/DtAMXXneXFjbQMGEtbamCZb+4x7eGwkvZCvBmwUG+g=
-github.com/go-openapi/runtime v0.24.1 h1:Sml5cgQKGYQHF+M7yYSHaH1eOjvTykrddTE/KtQVjqo=
-github.com/go-openapi/runtime v0.24.1/go.mod h1:AKurw9fNre+h3ELZfk6ILsfvPN+bvvlaU/M9q/r9hpk=
+github.com/go-openapi/loads v0.21.2 h1:r2a/xFIYeZ4Qd2TnGpWDIQNcP80dIaZgf704za8enro=
+github.com/go-openapi/loads v0.21.2/go.mod h1:Jq58Os6SSGz0rzh62ptiu8Z31I+OTHqmULx5e/gJbNw=
+github.com/go-openapi/runtime v0.25.0 h1:7yQTCdRbWhX8vnIjdzU8S00tBYf7Sg71EBeorlPHvhc=
+github.com/go-openapi/runtime v0.25.0/go.mod h1:Ux6fikcHXyyob6LNWxtE96hWwjBPYF0DXgVFuMTneOs=
 github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc=
-github.com/go-openapi/spec v0.20.4 h1:O8hJrt0UMnhHcluhIdUgCLRWyM2x7QkBXRvOs7m+O1M=
 github.com/go-openapi/spec v0.20.4/go.mod h1:faYFR1CvsJZ0mNsmsphTMSoRrNV3TEDoAM7FOEWeq8I=
+github.com/go-openapi/spec v0.20.6/go.mod h1:2OpW+JddWPrpXSCIX8eOx7lZ5iyuWj3RYR6VaaBKcWA=
+github.com/go-openapi/spec v0.20.8 h1:ubHmXNY3FCIOinT8RNrrPfGc9t7I1qhPtdOGoG2AxRU=
+github.com/go-openapi/spec v0.20.8/go.mod h1:2OpW+JddWPrpXSCIX8eOx7lZ5iyuWj3RYR6VaaBKcWA=
 github.com/go-openapi/strfmt v0.21.0/go.mod h1:ZRQ409bWMj+SOgXofQAGTIo2Ebu72Gs+WaRADcS5iNg=
 github.com/go-openapi/strfmt v0.21.1/go.mod h1:I/XVKeLc5+MM5oPNN7P6urMOpuLXEcNrCX/rPGuWb0k=
-github.com/go-openapi/strfmt v0.21.2/go.mod h1:I/XVKeLc5+MM5oPNN7P6urMOpuLXEcNrCX/rPGuWb0k=
 github.com/go-openapi/strfmt v0.21.3 h1:xwhj5X6CjXEZZHMWy1zKJxvW9AfHC9pkyUjLvHtKG7o=
 github.com/go-openapi/strfmt v0.21.3/go.mod h1:k+RzNO0Da+k3FrrynSNN8F7n/peCmQQqbbXjtDfvmGg=
 github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dpr1UfpPtxFw+EFuQ41HhCWZfha5jSVRG7C7I=
 github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
 github.com/go-openapi/swag v0.19.15/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
-github.com/go-openapi/swag v0.21.1 h1:wm0rhTb5z7qpJRHBdPOMuY4QjVUMbF6/kwoYeRAOrKU=
 github.com/go-openapi/swag v0.21.1/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
-github.com/go-openapi/validate v0.21.0 h1:+Wqk39yKOhfpLqNLEC0/eViCkzM5FVXVqrvt526+wcI=
-github.com/go-openapi/validate v0.21.0/go.mod h1:rjnrwK57VJ7A8xqfpAOEKRH8yQSGUriMu5/zuPSQ1hg=
+github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g=
+github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-openapi/validate v0.22.1 h1:G+c2ub6q47kfX1sOBLwIQwzBVt8qmOAARyo/9Fqs9NU=
+github.com/go-openapi/validate v0.22.1/go.mod h1:rjnrwK57VJ7A8xqfpAOEKRH8yQSGUriMu5/zuPSQ1hg=
 github.com/go-ozzo/ozzo-validation v3.6.0+incompatible h1:msy24VGS42fKO9K1vLz82/GeYW1cILu7Nuuj1N3BBkE=
 github.com/go-ozzo/ozzo-validation v3.6.0+incompatible/go.mod h1:gsEKFIVnabGBt6mXmxK0MoFy+cZoTJY6mu5Ll3LVLBU=
 github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/go-stack/stack v1.8.1/go.mod h1:dcoOX6HbPZSZptuspn9bctJ+N/CnF5gGygcUP3XYfe4=
 github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/go-test/deep v1.1.0 h1:WOcxcdHcvdgThNXjw0t76K42FXTU7HpNQWHpA2HHNlg=
 github.com/go-test/deep v1.1.0/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
@@ -443,8 +450,9 @@ github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-querystring v0.0.0-20170111101155-53e6ce116135/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
 github.com/google/go-querystring v1.0.0 h1:Xkwi/a1rcvNg1PPYe5vI8GbeBY/jrVuDX5ASuANWTrk=
 github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
@@ -594,10 +602,10 @@ github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+l
 github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/hcp-scada-provider v0.2.0 h1:iD3Y+c7LTdjeaWKHq/ym6ahEdSL1R+9GHvKWBb4t+aM=
-github.com/hashicorp/hcp-scada-provider v0.2.0/go.mod h1:Q0WpS2RyhBKOPD4X/8oW7AJe7jA2HXB09EwDzwRTao0=
-github.com/hashicorp/hcp-sdk-go v0.23.1-0.20220921131124-49168300a7dc h1:on26TCKYnX7JzZCtwkR/LWHSqMu40PoZ6h/0e6Pq8ug=
-github.com/hashicorp/hcp-sdk-go v0.23.1-0.20220921131124-49168300a7dc/go.mod h1:/9UoDY2FYYA8lFaKBb2HmM/jKYZGANmf65q9QRc/cVw=
+github.com/hashicorp/hcp-scada-provider v0.2.3 h1:AarYR+/Pcv+cMvPdAlb92uOBmZfEH6ny4+DT+4NY2VQ=
+github.com/hashicorp/hcp-scada-provider v0.2.3/go.mod h1:ZFTgGwkzNv99PLQjTsulzaCplCzOTBh0IUQsPKzrQFo=
+github.com/hashicorp/hcp-sdk-go v0.40.1-0.20230404193545-846aea419cd1 h1:C1des4/oIeUqQJVUWypnZth19Kg+k01q+V59OVNMB+Q=
+github.com/hashicorp/hcp-sdk-go v0.40.1-0.20230404193545-846aea419cd1/go.mod h1:hZqky4HEzsKwvLOt4QJlZUrjeQmb4UCZUhDP2HyQFfc=
 github.com/hashicorp/hil v0.0.0-20200423225030-a18a1cd20038 h1:n9J0rwVWXDpNd5iZnwY7w4WZyq53/rROeI7OVvLW8Ok=
 github.com/hashicorp/hil v0.0.0-20200423225030-a18a1cd20038/go.mod h1:n2TSygSNwsLJ76m8qFXTSc7beTb+auJxYdqrnoqwZWE=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
@@ -786,7 +794,6 @@ github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:F
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.3.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/mitchellh/mapstructure v1.4.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/pointerstructure v1.2.1 h1:ZhBBeX8tSlRpu/FFhXH4RC4OJzFlqsQhoHZAz4x7TIw=
@@ -812,7 +819,6 @@ github.com/naoina/toml v0.1.1/go.mod h1:NBIhNtsFMo3G2szEBne+bO4gS192HuIYRqfvOWb4
 github.com/nbio/st v0.0.0-20140626010706-e9e8d9816f32/go.mod h1:9wM+0iRr9ahx58uYLpLIr5fm8diHn0JbqRycJi6w0Ms=
 github.com/nicolai86/scaleway-sdk v1.10.2-0.20180628010248-798f60e20bb2 h1:BQ1HW7hr4IVovMwWg0E0PYcyW8CzqDcVmaew9cujU4s=
 github.com/nicolai86/scaleway-sdk v1.10.2-0.20180628010248-798f60e20bb2/go.mod h1:TLb2Sg7HQcgGdloNxkrmtgDNR9uVYF3lfdFIN4Ro6Sk=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/nrdcg/auroradns v1.0.0/go.mod h1:6JPXKzIRzZzMqtTDgueIhTi6rFf1QvYE/HzqidhOhjw=
 github.com/nrdcg/goinwx v0.6.1/go.mod h1:XPiut7enlbEdntAqalBIqcYcTEVhpv/dKWgDCX2SwKQ=
@@ -838,7 +844,6 @@ github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1Cpa
 github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/opentracing-contrib/go-observer v0.0.0-20170622124052-a52f23424492/go.mod h1:Ngi6UdF0k5OKD5t5wlmGhe/EDKPoUM3BXZSSfIuJbis=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
-github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
 github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b h1:FfH+VrHHk6Lxt9HdVS0PXzSXFyS2NbZKXv33FYPol0A=
 github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b/go.mod h1:AC62GU6hc0BrNm+9RK9VSiwa/EUe1bkIeFORAMcHvJU=
 github.com/openzipkin-contrib/zipkin-go-opentracing v0.3.5/go.mod h1:uVHyebswE1cCXr2A73cRM2frx5ld1RJUCJkFNZ90ZiI=
@@ -1055,9 +1060,9 @@ go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4=
 go.etcd.io/etcd v0.5.0-alpha.5.0.20190917205325-a14579fbfb1a/go.mod h1:dnLIgRNXwCJa5e+c6mIZCrds/GIG4ncV9HhK5PX7jPg=
 go.mongodb.org/mongo-driver v1.7.3/go.mod h1:NqaYOwnXWr5Pm7AOpO5QFxKJ503nbMse/R79oO62zWg=
 go.mongodb.org/mongo-driver v1.7.5/go.mod h1:VXEWRZ6URJIkUq2SCAyapmhH0ZLRBP+FT4xhp5Zvxng=
-go.mongodb.org/mongo-driver v1.8.3/go.mod h1:0sQWfOeY63QTntERDJJ/0SuKK0T1uVSgKCuAROlKEPY=
-go.mongodb.org/mongo-driver v1.10.0 h1:UtV6N5k14upNp4LTduX0QCufG124fSu25Wz9tu94GLg=
 go.mongodb.org/mongo-driver v1.10.0/go.mod h1:wsihk0Kdgv8Kqu1Anit4sfK+22vSFbUrAVEYRhCXrA8=
+go.mongodb.org/mongo-driver v1.11.0 h1:FZKhBSTydeuffHj9CBjXlR8vQLee1cQyTWYPA6/tqiE=
+go.mongodb.org/mongo-driver v1.11.0/go.mod h1:s7p5vEtfbeR1gYi6pnj3c3/urpbLv2T5Sfd6Rp2HBB8=
 go.opencensus.io v0.20.1/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=
 go.opencensus.io v0.20.2/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
@@ -1068,6 +1073,11 @@ go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
 go.opencensus.io v0.23.0 h1:gqCw0LfLxScz8irSi8exQc7fyQ0fKQU/qnC/X8+V/1M=
 go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
+go.opentelemetry.io/otel v1.11.1 h1:4WLLAmcfkmDk2ukNXJyq3/kiz/3UzCaYq6PskJsaou4=
+go.opentelemetry.io/otel v1.11.1/go.mod h1:1nNhXBbWSD0nsL38H6btgnFN2k4i0sNLHNNMZMSbUGE=
+go.opentelemetry.io/otel/sdk v1.11.1 h1:F7KmQgoHljhUuJyA+9BiU+EkJfyX5nVVF4wyzWZpKxs=
+go.opentelemetry.io/otel/trace v1.11.1 h1:ofxdnzsNrGBYXbP7t7zpUK281+go5rF7dvdIZXF8gdQ=
+go.opentelemetry.io/otel/trace v1.11.1/go.mod h1:f/Q9G7vzk5u91PhbmKbg1Qn0rzH1LJ4vbPHFGkTPtOk=
 go.opentelemetry.io/proto/otlp v0.7.0 h1:rwOQPCuKAKmwGKq2aVNnYIibI6wnV7EvzgfTCzcdGg8=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
@@ -1101,7 +1111,6 @@ golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20201216223049-8b5274cf687f/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
 golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d h1:sK3txAijHtOK88l68nt020reeT1ZdKLIYetKl95FzVY=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
@@ -1143,6 +1152,7 @@ golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.8.0 h1:LUYupSeNrTNCGzR/hVBk2NHZO4hXcVaW1k4Qx7rjPx8=
 golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180530234432-1e491301e022/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180611182652-db08ff08e862/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1202,8 +1212,8 @@ golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20211216030914-fe4d6282115f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g=
-golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.8.0 h1:Zrh2ngAOFYneWTAIAPethzeaQLuHwhuBkuV6ZiRnUaQ=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190402181905-9f3314589c9a/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1221,8 +1231,8 @@ golang.org/x/oauth2 v0.0.0-20210628180205-a41e5a781914/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
-golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1 h1:lxqLZaMad/dJHMFZH0NiNpiEZI/nhgWhe4wgzpE+MuA=
-golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
+golang.org/x/oauth2 v0.6.0 h1:Lh8GPgSKBfWSwFvtuWOfeI3aAAnbXTSutYxJiOJFgIw=
+golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -1235,8 +1245,8 @@ golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4 h1:uVc8UZUe6tr40fFVnUP5Oj+veunVezqYl9z7DYw9xzw=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20170830134202-bb24a47a89ea/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180622082034-63fc586f45fe/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1330,13 +1340,12 @@ golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
+golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0 h1:n2a8QNdAb0sZNpU9R1ALUXBbY+w51fCQDN+7EdxNBsY=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.6.0 h1:clScbb1cHjoCkyRbWwBEUZ5H/tIFu5TAXIqaZD0Gcjw=
+golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1348,8 +1357,8 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.8.0 h1:57P1ETyNKtuIjB4SRd15iJxuhj8Gc416Y78H3qgMh68=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/time v0.0.0-20161028155119-f51c12702a4d/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1426,8 +1435,8 @@ golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.2.0 h1:G6AHpWxTMGY1KyEYoAQ5WTtIekUUvDNjan3ugu60JvE=
-golang.org/x/tools v0.2.0/go.mod h1:y4OqIKeOV/fWJetJ8bXPU1sEVniLMIyDAZWeHdV+NTA=
+golang.org/x/tools v0.6.0 h1:BOw41kyTf3PuCW1pVQf8+Cyg8pMlkYB1oo9iJ6D/lKM=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1585,8 +1594,8 @@ gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLks
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=

From eff5dd1812370fa13bffd6b41d6f8f5242e72467 Mon Sep 17 00:00:00 2001
From: Dan Upton <daniel@floppy.co>
Date: Fri, 28 Apr 2023 11:22:42 +0100
Subject: [PATCH 31/92] resource: owner references must include a uid (#17169)

---
 .../grpc-external/services/resource/write.go  | 25 +++++++++
 .../services/resource/write_test.go           | 51 +++++++++++++++++++
 2 files changed, 76 insertions(+)

diff --git a/agent/grpc-external/services/resource/write.go b/agent/grpc-external/services/resource/write.go
index 121c7ce39ccc..ad17e61c51d9 100644
--- a/agent/grpc-external/services/resource/write.go
+++ b/agent/grpc-external/services/resource/write.go
@@ -119,6 +119,31 @@ func (s *Server) Write(ctx context.Context, req *pbresource.WriteRequest) (*pbre
 				return errUseWriteStatus
 			}
 
+			// Generally, we expect resources with owners to be created by controllers,
+			// and they should provide the Uid. In cases where no Uid is given (e.g. the
+			// owner is specified in the resource HCL) we'll look up whatever the current
+			// Uid is and use that.
+			//
+			// An important note on consistency:
+			//
+			// We read the owner with StrongConsistency here to reduce the likelihood of
+			// creating a resource pointing to the wrong "incarnation" of the owner in
+			// cases where the owner is deleted and re-created in quick succession.
+			//
+			// That said, there is still a chance that the owner has been deleted by the
+			// time we write this resource. This is not a relational database and we do
+			// not support ACID transactions or real foreign key constraints.
+			if input.Owner != nil && input.Owner.Uid == "" {
+				owner, err := s.Backend.Read(ctx, storage.StrongConsistency, input.Owner)
+				switch {
+				case errors.Is(err, storage.ErrNotFound):
+					return status.Error(codes.InvalidArgument, "resource.owner does not exist")
+				case err != nil:
+					return status.Errorf(codes.Internal, "failed to resolve owner: %v", err)
+				}
+				input.Owner = owner.Id
+			}
+
 			// TODO(spatel): Revisit owner<->resource tenancy rules post-1.16
 
 		// Update path.
diff --git a/agent/grpc-external/services/resource/write_test.go b/agent/grpc-external/services/resource/write_test.go
index f8620f4a3431..b2960a9243d7 100644
--- a/agent/grpc-external/services/resource/write_test.go
+++ b/agent/grpc-external/services/resource/write_test.go
@@ -491,6 +491,57 @@ func TestWrite_Owner_Immutable(t *testing.T) {
 	require.ErrorContains(t, err, "owner cannot be changed")
 }
 
+func TestWrite_Owner_Uid(t *testing.T) {
+	server := testServer(t)
+	client := testClient(t, server)
+
+	demo.RegisterTypes(server.Registry)
+
+	t.Run("uid given", func(t *testing.T) {
+		artist, err := demo.GenerateV2Artist()
+		require.NoError(t, err)
+
+		album, err := demo.GenerateV2Album(artist.Id)
+		require.NoError(t, err)
+		album.Owner.Uid = ulid.Make().String()
+
+		_, err = client.Write(testContext(t), &pbresource.WriteRequest{Resource: album})
+		require.NoError(t, err)
+	})
+
+	t.Run("no uid - owner not found", func(t *testing.T) {
+		artist, err := demo.GenerateV2Artist()
+		require.NoError(t, err)
+
+		album, err := demo.GenerateV2Album(artist.Id)
+		require.NoError(t, err)
+
+		_, err = client.Write(testContext(t), &pbresource.WriteRequest{Resource: album})
+		require.Error(t, err)
+		require.Equal(t, codes.InvalidArgument.String(), status.Code(err).String())
+	})
+
+	t.Run("no uid - automatically resolved", func(t *testing.T) {
+		artist, err := demo.GenerateV2Artist()
+		require.NoError(t, err)
+
+		rsp1, err := client.Write(testContext(t), &pbresource.WriteRequest{Resource: artist})
+		require.NoError(t, err)
+		artist = rsp1.Resource
+
+		album, err := demo.GenerateV2Album(clone(artist.Id))
+		require.NoError(t, err)
+
+		// Blank out the owner Uid to check it gets automatically filled in.
+		album.Owner.Uid = ""
+
+		rsp2, err := client.Write(testContext(t), &pbresource.WriteRequest{Resource: album})
+		require.NoError(t, err)
+		require.NotEmpty(t, rsp2.Resource.Owner.Uid)
+		require.Equal(t, artist.Id.Uid, rsp2.Resource.Owner.Uid)
+	})
+}
+
 type blockOnceBackend struct {
 	storage.Backend
 

From 9fef1c7f17bbbc1cb4937f6f0c38cc6427fe3309 Mon Sep 17 00:00:00 2001
From: Semir Patel <semir.patel@hashicorp.com>
Date: Fri, 28 Apr 2023 10:49:08 -0500
Subject: [PATCH 32/92] Create tombstone on resource `Delete` (#17108)

---
 .../grpc-external/services/resource/delete.go |  75 ++-
 .../services/resource/delete_test.go          |  49 ++
 internal/resource/registry.go                 |  14 +-
 internal/resource/registry_test.go            |  82 ++-
 internal/resource/tombstone.go                |  11 +
 proto-public/pbresource/resource.pb.binary.go |  10 +
 proto-public/pbresource/resource.pb.go        | 526 ++++++++++--------
 proto-public/pbresource/resource.proto        |  12 +
 proto-public/pbresource/resource_grpc.pb.go   |  10 +
 9 files changed, 510 insertions(+), 279 deletions(-)
 create mode 100644 internal/resource/tombstone.go

diff --git a/agent/grpc-external/services/resource/delete.go b/agent/grpc-external/services/resource/delete.go
index 5fcfaaf6c0df..a072dcee3cf9 100644
--- a/agent/grpc-external/services/resource/delete.go
+++ b/agent/grpc-external/services/resource/delete.go
@@ -6,11 +6,17 @@ package resource
 import (
 	"context"
 	"errors"
+	"fmt"
+	"time"
 
+	"github.com/golang/protobuf/proto"
+	"github.com/oklog/ulid/v2"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/anypb"
 
 	"github.com/hashicorp/consul/acl"
+	"github.com/hashicorp/consul/internal/resource"
 	"github.com/hashicorp/consul/internal/storage"
 	"github.com/hashicorp/consul/proto-public/pbresource"
 )
@@ -21,8 +27,6 @@ import (
 // - Delete of a previously deleted or non-existent resource is a no-op to support idempotency.
 // - Errors with Aborted if the requested Version does not match the stored Version.
 // - Errors with PermissionDenied if ACL check fails
-//
-// TODO(spatel): Move docs to the proto file
 func (s *Server) Delete(ctx context.Context, req *pbresource.DeleteRequest) (*pbresource.DeleteResponse, error) {
 	if err := validateDeleteRequest(req); err != nil {
 		return nil, err
@@ -69,6 +73,10 @@ func (s *Server) Delete(ctx context.Context, req *pbresource.DeleteRequest) (*pb
 		}
 	}
 
+	if err := s.maybeCreateTombstone(ctx, deleteId); err != nil {
+		return nil, err
+	}
+
 	err = s.Backend.DeleteCAS(ctx, deleteId, deleteVersion)
 	switch {
 	case err == nil:
@@ -80,6 +88,62 @@ func (s *Server) Delete(ctx context.Context, req *pbresource.DeleteRequest) (*pb
 	}
 }
 
+// Create a tombstone to capture the intent to delete child resources.
+// Tombstones are created preemptively to prevent partial failures even though
+// we are currently unaware of the success/failure/no-op of DeleteCAS. In
+// the failure and no-op cases the tombstone is effectively a no-op and will
+// still be deleted from the system by the reaper controller.
+func (s *Server) maybeCreateTombstone(ctx context.Context, deleteId *pbresource.ID) error {
+	// Don't create a tombstone when the resource being deleted is itself a tombstone.
+	if proto.Equal(resource.TypeV1Tombstone, deleteId.Type) {
+		return nil
+	}
+
+	data, err := anypb.New(&pbresource.Tombstone{Owner: deleteId})
+	if err != nil {
+		return status.Errorf(codes.Internal, "failed creating tombstone: %v", err)
+	}
+
+	// Since a tombstone is an internal resource type that should not be visible
+	// or accessible by users, we're writing to the backend directly instead of
+	// using the resource service's Write endpoint. This bypasses resource level
+	// concerns that are either not relevant (valiation and mutation hooks) or
+	// futher complicate the implementation (user provided tokens having
+	// awareness of tombstone ACLs).
+	//
+	// ErrCASFailure should never happen since an empty Version is always passed.
+	//
+	// TODO(spatel): Probably a good idea to block writes of TypeV1Tombstone
+	//  	on the ResourceService.Write() endpoint to lock things down?
+	_, err = s.Backend.WriteCAS(ctx, &pbresource.Resource{
+		Id: &pbresource.ID{
+			Type:    resource.TypeV1Tombstone,
+			Tenancy: deleteId.Tenancy,
+			Name:    tombstoneName(deleteId),
+			Uid:     ulid.Make().String(),
+		},
+		Generation: ulid.Make().String(),
+		Data:       data,
+		Metadata: map[string]string{
+			"generated_at": time.Now().Format(time.RFC3339),
+		},
+	})
+
+	switch {
+	case err == nil:
+		// Success!
+		return nil
+	case errors.Is(err, storage.ErrWrongUid):
+		// Backend has detected that we're trying to change the Uid for an
+		// existing tombstone (probably created from a previously failed Delete
+		// where the tombstone WriteCAS succeeded but the resource DeleteCAS
+		// failed). The fact that the tombstone already exists means we're good.
+		return nil
+	default:
+		return status.Errorf(codes.Internal, "failed writing tombstone: %v", err)
+	}
+}
+
 func validateDeleteRequest(req *pbresource.DeleteRequest) error {
 	if req.Id == nil {
 		return status.Errorf(codes.InvalidArgument, "id is required")
@@ -90,3 +154,10 @@ func validateDeleteRequest(req *pbresource.DeleteRequest) error {
 	}
 	return nil
 }
+
+// Maintains a deterministic mapping between a resource and it's tombstone's
+// name by embedding the resources's Uid in the name.
+func tombstoneName(deleteId *pbresource.ID) string {
+	// deleteId.Name is just included for easier identification
+	return fmt.Sprintf("tombstone-%v-%v", deleteId.Name, deleteId.Uid)
+}
diff --git a/agent/grpc-external/services/resource/delete_test.go b/agent/grpc-external/services/resource/delete_test.go
index 39af826eb784..0e98d3fd57a7 100644
--- a/agent/grpc-external/services/resource/delete_test.go
+++ b/agent/grpc-external/services/resource/delete_test.go
@@ -13,6 +13,7 @@ import (
 	"google.golang.org/grpc/status"
 
 	"github.com/hashicorp/consul/acl/resolver"
+	"github.com/hashicorp/consul/internal/resource"
 	"github.com/hashicorp/consul/internal/resource/demo"
 	"github.com/hashicorp/consul/internal/storage"
 	"github.com/hashicorp/consul/proto-public/pbresource"
@@ -139,10 +140,58 @@ func TestDelete_Success(t *testing.T) {
 			_, err = server.Backend.Read(ctx, storage.StrongConsistency, artistId)
 			require.Error(t, err)
 			require.ErrorIs(t, err, storage.ErrNotFound)
+
+			// verify tombstone created
+			_, err = client.Read(ctx, &pbresource.ReadRequest{
+				Id: &pbresource.ID{
+					Name:    tombstoneName(artistId),
+					Type:    resource.TypeV1Tombstone,
+					Tenancy: artist.Id.Tenancy,
+				},
+			})
+			require.NoError(t, err)
 		})
 	}
 }
 
+func TestDelete_TombstoneDeletionDoesNotCreateNewTombstone(t *testing.T) {
+	t.Parallel()
+
+	server, client, ctx := testDeps(t)
+	demo.RegisterTypes(server.Registry)
+
+	artist, err := demo.GenerateV2Artist()
+	require.NoError(t, err)
+
+	rsp, err := client.Write(ctx, &pbresource.WriteRequest{Resource: artist})
+	require.NoError(t, err)
+	artist = rsp.Resource
+
+	// delete artist
+	_, err = client.Delete(ctx, &pbresource.DeleteRequest{Id: artist.Id, Version: ""})
+	require.NoError(t, err)
+
+	// verify artist's tombstone created
+	rsp2, err := client.Read(ctx, &pbresource.ReadRequest{
+		Id: &pbresource.ID{
+			Name:    tombstoneName(artist.Id),
+			Type:    resource.TypeV1Tombstone,
+			Tenancy: artist.Id.Tenancy,
+		},
+	})
+	require.NoError(t, err)
+	tombstone := rsp2.Resource
+
+	// delete artist's tombstone
+	_, err = client.Delete(ctx, &pbresource.DeleteRequest{Id: tombstone.Id, Version: tombstone.Version})
+	require.NoError(t, err)
+
+	// verify no new tombstones created and artist's existing tombstone deleted
+	rsp3, err := client.List(ctx, &pbresource.ListRequest{Type: resource.TypeV1Tombstone, Tenancy: artist.Id.Tenancy})
+	require.NoError(t, err)
+	require.Empty(t, rsp3.Resources)
+}
+
 func TestDelete_NotFound(t *testing.T) {
 	t.Parallel()
 
diff --git a/internal/resource/registry.go b/internal/resource/registry.go
index dac144ab85d7..232e3998d4e2 100644
--- a/internal/resource/registry.go
+++ b/internal/resource/registry.go
@@ -68,9 +68,17 @@ type TypeRegistry struct {
 }
 
 func NewRegistry() Registry {
-	return &TypeRegistry{
-		registrations: make(map[string]Registration),
-	}
+	registry := &TypeRegistry{registrations: make(map[string]Registration)}
+	// Tombstone is an implicitly registered type since it is used to implement
+	// the cascading deletion of resources. ACLs end up being defaulted to
+	// operator:<read,write>. It is useful to note that tombstone creation
+	// does not get routed through the resource service and bypasses ACLs
+	// as part of the Delete endpoint.
+	registry.Register(Registration{
+		Type:  TypeV1Tombstone,
+		Proto: &pbresource.Tombstone{},
+	})
+	return registry
 }
 
 func (r *TypeRegistry) Register(registration Registration) {
diff --git a/internal/resource/registry_test.go b/internal/resource/registry_test.go
index a2e24badc3e4..7979d618c470 100644
--- a/internal/resource/registry_test.go
+++ b/internal/resource/registry_test.go
@@ -11,52 +11,53 @@ import (
 	"github.com/hashicorp/consul/internal/resource"
 	"github.com/hashicorp/consul/internal/resource/demo"
 	"github.com/hashicorp/consul/proto-public/pbresource"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 )
 
 func TestRegister(t *testing.T) {
 	r := resource.NewRegistry()
 
-	serviceType := &pbresource.Type{
-		Group:        "mesh",
-		GroupVersion: "v1",
-		Kind:         "service",
-	}
-
 	// register success
-	serviceRegistration := resource.Registration{Type: serviceType}
-	r.Register(serviceRegistration)
+	reg := resource.Registration{Type: demo.TypeV2Artist}
+	r.Register(reg)
+	actual, ok := r.Resolve(demo.TypeV2Artist)
+	require.True(t, ok)
+	require.True(t, proto.Equal(demo.TypeV2Artist, actual.Type))
 
 	// register existing should panic
-	assertRegisterPanics(t, r.Register, serviceRegistration, "resource type mesh.v1.service already registered")
+	require.PanicsWithValue(t, "resource type demo.v2.artist already registered", func() {
+		r.Register(reg)
+	})
 
-	// register empty Group should panic
-	assertRegisterPanics(t, r.Register, resource.Registration{
-		Type: &pbresource.Type{
+	// type missing required fields should panic
+	testcases := map[string]*pbresource.Type{
+		"empty group": {
 			Group:        "",
-			GroupVersion: "v1",
-			Kind:         "service",
+			GroupVersion: "v2",
+			Kind:         "artist",
 		},
-	}, "type field(s) cannot be empty")
-
-	// register empty GroupVersion should panic
-	assertRegisterPanics(t, r.Register, resource.Registration{
-		Type: &pbresource.Type{
-			Group:        "mesh",
-			GroupVersion: "",
-			Kind:         "service",
+		"empty group version": {
+			Group:        "",
+			GroupVersion: "v2",
+			Kind:         "artist",
 		},
-	}, "type field(s) cannot be empty")
-
-	// register empty Kind should panic
-	assertRegisterPanics(t, r.Register, resource.Registration{
-		Type: &pbresource.Type{
-			Group:        "mesh",
-			GroupVersion: "v1",
+		"empty kind": {
+			Group:        "demo",
+			GroupVersion: "v2",
 			Kind:         "",
 		},
-	}, "type field(s) cannot be empty")
+	}
+
+	for desc, typ := range testcases {
+		t.Run(desc, func(t *testing.T) {
+			require.PanicsWithValue(t, "type field(s) cannot be empty", func() {
+				r.Register(resource.Registration{Type: typ})
+			})
+		})
+	}
 }
 
 func TestRegister_Defaults(t *testing.T) {
@@ -87,21 +88,12 @@ func TestRegister_Defaults(t *testing.T) {
 	require.NoError(t, reg.Mutate(nil))
 }
 
-func assertRegisterPanics(t *testing.T, registerFn func(reg resource.Registration), registration resource.Registration, panicString string) {
-	defer func() {
-		if r := recover(); r == nil {
-			t.Errorf("expected panic, but none occurred")
-		} else {
-			errstr, ok := r.(string)
-			if !ok {
-				t.Errorf("unexpected error type returned from panic")
-			} else if errstr != panicString {
-				t.Errorf("expected %s error message but got: %s", panicString, errstr)
-			}
-		}
-	}()
-
-	registerFn(registration)
+func TestNewRegistry(t *testing.T) {
+	r := resource.NewRegistry()
+
+	// verify tombstone type registered implicitly
+	_, ok := r.Resolve(resource.TypeV1Tombstone)
+	require.True(t, ok)
 }
 
 func TestResolve(t *testing.T) {
diff --git a/internal/resource/tombstone.go b/internal/resource/tombstone.go
new file mode 100644
index 000000000000..289aec2d5161
--- /dev/null
+++ b/internal/resource/tombstone.go
@@ -0,0 +1,11 @@
+package resource
+
+import "github.com/hashicorp/consul/proto-public/pbresource"
+
+var (
+	TypeV1Tombstone = &pbresource.Type{
+		Group:        "internal",
+		GroupVersion: "v1",
+		Kind:         "tombstone",
+	}
+)
diff --git a/proto-public/pbresource/resource.pb.binary.go b/proto-public/pbresource/resource.pb.binary.go
index e12f33fb6da9..4f6c4a382fa1 100644
--- a/proto-public/pbresource/resource.pb.binary.go
+++ b/proto-public/pbresource/resource.pb.binary.go
@@ -77,6 +77,16 @@ func (msg *Reference) UnmarshalBinary(b []byte) error {
 	return proto.Unmarshal(b, msg)
 }
 
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *Tombstone) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *Tombstone) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
 // MarshalBinary implements encoding.BinaryMarshaler
 func (msg *ReadRequest) MarshalBinary() ([]byte, error) {
 	return proto.Marshal(msg)
diff --git a/proto-public/pbresource/resource.pb.go b/proto-public/pbresource/resource.pb.go
index 488dbdb8242f..397d423440c5 100644
--- a/proto-public/pbresource/resource.pb.go
+++ b/proto-public/pbresource/resource.pb.go
@@ -133,7 +133,7 @@ func (x WatchEvent_Operation) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use WatchEvent_Operation.Descriptor instead.
 func (WatchEvent_Operation) EnumDescriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{18, 0}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{19, 0}
 }
 
 // Type describes a resource's type. It follows the GVK (Group Version Kind)
@@ -722,6 +722,56 @@ func (x *Reference) GetSection() string {
 	return ""
 }
 
+// Tombstone represents a promise to delete all of a resource's immediately
+// owned (child) resources, if any.
+type Tombstone struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Owner resource identifier.
+	Owner *ID `protobuf:"bytes,1,opt,name=owner,proto3" json:"owner,omitempty"`
+}
+
+func (x *Tombstone) Reset() {
+	*x = Tombstone{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbresource_resource_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Tombstone) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Tombstone) ProtoMessage() {}
+
+func (x *Tombstone) ProtoReflect() protoreflect.Message {
+	mi := &file_pbresource_resource_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Tombstone.ProtoReflect.Descriptor instead.
+func (*Tombstone) Descriptor() ([]byte, []int) {
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *Tombstone) GetOwner() *ID {
+	if x != nil {
+		return x.Owner
+	}
+	return nil
+}
+
 // ReadRequest contains the parameters to the Read endpoint.
 type ReadRequest struct {
 	state         protoimpl.MessageState
@@ -735,7 +785,7 @@ type ReadRequest struct {
 func (x *ReadRequest) Reset() {
 	*x = ReadRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[7]
+		mi := &file_pbresource_resource_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -748,7 +798,7 @@ func (x *ReadRequest) String() string {
 func (*ReadRequest) ProtoMessage() {}
 
 func (x *ReadRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[7]
+	mi := &file_pbresource_resource_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -761,7 +811,7 @@ func (x *ReadRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReadRequest.ProtoReflect.Descriptor instead.
 func (*ReadRequest) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{7}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *ReadRequest) GetId() *ID {
@@ -784,7 +834,7 @@ type ReadResponse struct {
 func (x *ReadResponse) Reset() {
 	*x = ReadResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[8]
+		mi := &file_pbresource_resource_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -797,7 +847,7 @@ func (x *ReadResponse) String() string {
 func (*ReadResponse) ProtoMessage() {}
 
 func (x *ReadResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[8]
+	mi := &file_pbresource_resource_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -810,7 +860,7 @@ func (x *ReadResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReadResponse.ProtoReflect.Descriptor instead.
 func (*ReadResponse) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{8}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *ReadResponse) GetResource() *Resource {
@@ -839,7 +889,7 @@ type ListRequest struct {
 func (x *ListRequest) Reset() {
 	*x = ListRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[9]
+		mi := &file_pbresource_resource_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -852,7 +902,7 @@ func (x *ListRequest) String() string {
 func (*ListRequest) ProtoMessage() {}
 
 func (x *ListRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[9]
+	mi := &file_pbresource_resource_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -865,7 +915,7 @@ func (x *ListRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListRequest.ProtoReflect.Descriptor instead.
 func (*ListRequest) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{9}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *ListRequest) GetType() *Type {
@@ -902,7 +952,7 @@ type ListResponse struct {
 func (x *ListResponse) Reset() {
 	*x = ListResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[10]
+		mi := &file_pbresource_resource_proto_msgTypes[11]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -915,7 +965,7 @@ func (x *ListResponse) String() string {
 func (*ListResponse) ProtoMessage() {}
 
 func (x *ListResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[10]
+	mi := &file_pbresource_resource_proto_msgTypes[11]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -928,7 +978,7 @@ func (x *ListResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListResponse.ProtoReflect.Descriptor instead.
 func (*ListResponse) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{10}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *ListResponse) GetResources() []*Resource {
@@ -951,7 +1001,7 @@ type WriteRequest struct {
 func (x *WriteRequest) Reset() {
 	*x = WriteRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[11]
+		mi := &file_pbresource_resource_proto_msgTypes[12]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -964,7 +1014,7 @@ func (x *WriteRequest) String() string {
 func (*WriteRequest) ProtoMessage() {}
 
 func (x *WriteRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[11]
+	mi := &file_pbresource_resource_proto_msgTypes[12]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -977,7 +1027,7 @@ func (x *WriteRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WriteRequest.ProtoReflect.Descriptor instead.
 func (*WriteRequest) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{11}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *WriteRequest) GetResource() *Resource {
@@ -1000,7 +1050,7 @@ type WriteResponse struct {
 func (x *WriteResponse) Reset() {
 	*x = WriteResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[12]
+		mi := &file_pbresource_resource_proto_msgTypes[13]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1013,7 +1063,7 @@ func (x *WriteResponse) String() string {
 func (*WriteResponse) ProtoMessage() {}
 
 func (x *WriteResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[12]
+	mi := &file_pbresource_resource_proto_msgTypes[13]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1026,7 +1076,7 @@ func (x *WriteResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WriteResponse.ProtoReflect.Descriptor instead.
 func (*WriteResponse) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{12}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *WriteResponse) GetResource() *Resource {
@@ -1063,7 +1113,7 @@ type WriteStatusRequest struct {
 func (x *WriteStatusRequest) Reset() {
 	*x = WriteStatusRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[13]
+		mi := &file_pbresource_resource_proto_msgTypes[14]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1076,7 +1126,7 @@ func (x *WriteStatusRequest) String() string {
 func (*WriteStatusRequest) ProtoMessage() {}
 
 func (x *WriteStatusRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[13]
+	mi := &file_pbresource_resource_proto_msgTypes[14]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1089,7 +1139,7 @@ func (x *WriteStatusRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WriteStatusRequest.ProtoReflect.Descriptor instead.
 func (*WriteStatusRequest) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{13}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *WriteStatusRequest) GetId() *ID {
@@ -1133,7 +1183,7 @@ type WriteStatusResponse struct {
 func (x *WriteStatusResponse) Reset() {
 	*x = WriteStatusResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[14]
+		mi := &file_pbresource_resource_proto_msgTypes[15]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1146,7 +1196,7 @@ func (x *WriteStatusResponse) String() string {
 func (*WriteStatusResponse) ProtoMessage() {}
 
 func (x *WriteStatusResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[14]
+	mi := &file_pbresource_resource_proto_msgTypes[15]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1159,7 +1209,7 @@ func (x *WriteStatusResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WriteStatusResponse.ProtoReflect.Descriptor instead.
 func (*WriteStatusResponse) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{14}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *WriteStatusResponse) GetResource() *Resource {
@@ -1186,7 +1236,7 @@ type DeleteRequest struct {
 func (x *DeleteRequest) Reset() {
 	*x = DeleteRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[15]
+		mi := &file_pbresource_resource_proto_msgTypes[16]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1199,7 +1249,7 @@ func (x *DeleteRequest) String() string {
 func (*DeleteRequest) ProtoMessage() {}
 
 func (x *DeleteRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[15]
+	mi := &file_pbresource_resource_proto_msgTypes[16]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1212,7 +1262,7 @@ func (x *DeleteRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteRequest.ProtoReflect.Descriptor instead.
 func (*DeleteRequest) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{15}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *DeleteRequest) GetId() *ID {
@@ -1239,7 +1289,7 @@ type DeleteResponse struct {
 func (x *DeleteResponse) Reset() {
 	*x = DeleteResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[16]
+		mi := &file_pbresource_resource_proto_msgTypes[17]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1252,7 +1302,7 @@ func (x *DeleteResponse) String() string {
 func (*DeleteResponse) ProtoMessage() {}
 
 func (x *DeleteResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[16]
+	mi := &file_pbresource_resource_proto_msgTypes[17]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1265,7 +1315,7 @@ func (x *DeleteResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteResponse.ProtoReflect.Descriptor instead.
 func (*DeleteResponse) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{16}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{17}
 }
 
 // WatchListRequest contains the parameters to the WatchList endpoint.
@@ -1287,7 +1337,7 @@ type WatchListRequest struct {
 func (x *WatchListRequest) Reset() {
 	*x = WatchListRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[17]
+		mi := &file_pbresource_resource_proto_msgTypes[18]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1300,7 +1350,7 @@ func (x *WatchListRequest) String() string {
 func (*WatchListRequest) ProtoMessage() {}
 
 func (x *WatchListRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[17]
+	mi := &file_pbresource_resource_proto_msgTypes[18]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1313,7 +1363,7 @@ func (x *WatchListRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WatchListRequest.ProtoReflect.Descriptor instead.
 func (*WatchListRequest) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{17}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *WatchListRequest) GetType() *Type {
@@ -1352,7 +1402,7 @@ type WatchEvent struct {
 func (x *WatchEvent) Reset() {
 	*x = WatchEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[18]
+		mi := &file_pbresource_resource_proto_msgTypes[19]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1365,7 +1415,7 @@ func (x *WatchEvent) String() string {
 func (*WatchEvent) ProtoMessage() {}
 
 func (x *WatchEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[18]
+	mi := &file_pbresource_resource_proto_msgTypes[19]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1378,7 +1428,7 @@ func (x *WatchEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WatchEvent.ProtoReflect.Descriptor instead.
 func (*WatchEvent) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{18}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *WatchEvent) GetOperation() WatchEvent_Operation {
@@ -1496,146 +1546,150 @@ var file_pbresource_resource_proto_rawDesc = []byte{
 	0x63, 0x79, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
 	0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x65, 0x63, 0x74, 0x69, 0x6f,
 	0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x22, 0x3c, 0x0a, 0x0b, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68, 0x61,
-	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x02, 0x69, 0x64, 0x22, 0x4f,
-	0x0a, 0x0c, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f,
-	0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
-	0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22,
-	0xa1, 0x01, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x33, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e,
+	0x22, 0x40, 0x0a, 0x09, 0x54, 0x6f, 0x6d, 0x62, 0x73, 0x74, 0x6f, 0x6e, 0x65, 0x12, 0x33, 0x0a,
+	0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x05, 0x6f, 0x77, 0x6e,
+	0x65, 0x72, 0x22, 0x3c, 0x0a, 0x0b, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e,
 	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
-	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04,
-	0x74, 0x79, 0x70, 0x65, 0x12, 0x3c, 0x0a, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
-	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x2e, 0x54, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x52, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e,
-	0x63, 0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69,
-	0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x72, 0x65,
-	0x66, 0x69, 0x78, 0x22, 0x51, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x12, 0x41, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
-	0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
-	0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x09, 0x72, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x22, 0x4f, 0x0a, 0x0c, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
+	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x02, 0x69, 0x64,
+	0x22, 0x4f, 0x0a, 0x0c, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x22, 0xa1, 0x01, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x33, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1f, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x54, 0x79, 0x70, 0x65,
+	0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x3c, 0x0a, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e, 0x63,
+	0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x2e, 0x54, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x52, 0x07, 0x74, 0x65, 0x6e,
+	0x61, 0x6e, 0x63, 0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x72, 0x65,
+	0x66, 0x69, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x61, 0x6d, 0x65, 0x50,
+	0x72, 0x65, 0x66, 0x69, 0x78, 0x22, 0x51, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x41, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
 	0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x50, 0x0a, 0x0d, 0x57, 0x72, 0x69, 0x74, 0x65,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x09, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x22, 0x4f, 0x0a, 0x0c, 0x57, 0x72, 0x69, 0x74,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f,
 	0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73,
 	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65,
 	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52,
-	0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0xaa, 0x01, 0x0a, 0x12, 0x57, 0x72,
-	0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x12, 0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68,
+	0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x50, 0x0a, 0x0d, 0x57, 0x72, 0x69,
+	0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68,
 	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x02, 0x69, 0x64, 0x12,
-	0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x39, 0x0a, 0x06, 0x73,
-	0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x68, 0x61,
-	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06,
-	0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x56, 0x0a, 0x13, 0x57, 0x72, 0x69, 0x74, 0x65, 0x53,
-	0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a,
-	0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
-	0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x58,
-	0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68, 0x61,
-	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x02, 0x69, 0x64, 0x12, 0x18,
-	0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x10, 0x0a, 0x0e, 0x44, 0x65, 0x6c, 0x65,
-	0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xa6, 0x01, 0x0a, 0x10, 0x57,
-	0x61, 0x74, 0x63, 0x68, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x33, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0xaa, 0x01, 0x0a, 0x12,
+	0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d,
+	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x02, 0x69,
+	0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x10, 0x0a, 0x03, 0x6b,
+	0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x39, 0x0a,
+	0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e,
 	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
-	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04,
-	0x74, 0x79, 0x70, 0x65, 0x12, 0x3c, 0x0a, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
-	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x2e, 0x54, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x52, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e,
-	0x63, 0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69,
-	0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x72, 0x65,
-	0x66, 0x69, 0x78, 0x22, 0xf0, 0x01, 0x0a, 0x0a, 0x57, 0x61, 0x74, 0x63, 0x68, 0x45, 0x76, 0x65,
-	0x6e, 0x74, 0x12, 0x4d, 0x0a, 0x09, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2f, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x56, 0x0a, 0x13, 0x57, 0x72, 0x69, 0x74,
+	0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x22, 0x58, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e,
+	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x02, 0x69, 0x64,
+	0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x10, 0x0a, 0x0e, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xa6, 0x01, 0x0a,
+	0x10, 0x57, 0x61, 0x74, 0x63, 0x68, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x33, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1f, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x54, 0x79, 0x70, 0x65,
+	0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x3c, 0x0a, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e, 0x63,
+	0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x2e, 0x54, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x52, 0x07, 0x74, 0x65, 0x6e,
+	0x61, 0x6e, 0x63, 0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x72, 0x65,
+	0x66, 0x69, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x61, 0x6d, 0x65, 0x50,
+	0x72, 0x65, 0x66, 0x69, 0x78, 0x22, 0xf0, 0x01, 0x0a, 0x0a, 0x57, 0x61, 0x74, 0x63, 0x68, 0x45,
+	0x76, 0x65, 0x6e, 0x74, 0x12, 0x4d, 0x0a, 0x09, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2f, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x2e, 0x57, 0x61, 0x74, 0x63, 0x68, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x2e, 0x4f,
+	0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
 	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x2e, 0x57, 0x61, 0x74, 0x63, 0x68, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x2e, 0x4f, 0x70, 0x65,
-	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
+	0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x22, 0x52, 0x0a, 0x09, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x12, 0x19, 0x0a, 0x15, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55,
+	0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x14, 0x0a, 0x10,
+	0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x50, 0x53, 0x45, 0x52, 0x54,
+	0x10, 0x01, 0x12, 0x14, 0x0a, 0x10, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f,
+	0x44, 0x45, 0x4c, 0x45, 0x54, 0x45, 0x10, 0x02, 0x32, 0x8b, 0x05, 0x0a, 0x0f, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x61, 0x0a, 0x04,
+	0x52, 0x65, 0x61, 0x64, 0x12, 0x26, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x2e, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x27, 0x2e, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x02, 0x10, 0x0b, 0x12,
+	0x64, 0x0a, 0x05, 0x57, 0x72, 0x69, 0x74, 0x65, 0x12, 0x27, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
+	0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x28, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x72,
+	0x69, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04,
+	0x04, 0x08, 0x03, 0x10, 0x0b, 0x12, 0x76, 0x0a, 0x0b, 0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x12, 0x2d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x2e, 0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x2e, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
 	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e,
-	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x22, 0x52, 0x0a, 0x09, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12,
-	0x19, 0x0a, 0x15, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53,
-	0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x14, 0x0a, 0x10, 0x4f, 0x50,
-	0x45, 0x52, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x50, 0x53, 0x45, 0x52, 0x54, 0x10, 0x01,
-	0x12, 0x14, 0x0a, 0x10, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x44, 0x45,
-	0x4c, 0x45, 0x54, 0x45, 0x10, 0x02, 0x32, 0x8b, 0x05, 0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x61, 0x0a, 0x04, 0x52, 0x65,
-	0x61, 0x64, 0x12, 0x26, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
-	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52,
-	0x65, 0x61, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x27, 0x2e, 0x68, 0x61, 0x73,
+	0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x03, 0x10, 0x0b, 0x12, 0x61, 0x0a,
+	0x04, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x26, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x27, 0x2e,
+	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x02, 0x10, 0x0b,
+	0x12, 0x67, 0x0a, 0x06, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x28, 0x2e, 0x68, 0x61, 0x73,
 	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x02, 0x10, 0x0b, 0x12, 0x64, 0x0a,
-	0x05, 0x57, 0x72, 0x69, 0x74, 0x65, 0x12, 0x27, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x29, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x03, 0x10, 0x0b, 0x12, 0x6b, 0x0a, 0x09, 0x57, 0x61, 0x74,
+	0x63, 0x68, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x2b, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
 	0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x2e, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
-	0x28, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
-	0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x72, 0x69, 0x74,
-	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08,
-	0x03, 0x10, 0x0b, 0x12, 0x76, 0x0a, 0x0b, 0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74,
-	0x75, 0x73, 0x12, 0x2d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
-	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x57,
-	0x72, 0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x2e, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
-	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x72,
-	0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x03, 0x10, 0x0b, 0x12, 0x61, 0x0a, 0x04, 0x4c,
-	0x69, 0x73, 0x74, 0x12, 0x26, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
+	0x63, 0x65, 0x2e, 0x57, 0x61, 0x74, 0x63, 0x68, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
 	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e,
-	0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x27, 0x2e, 0x68, 0x61,
-	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x02, 0x10, 0x0b, 0x12, 0x67,
-	0x0a, 0x06, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x28, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
-	0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x29, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
-	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x44,
-	0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2,
-	0x86, 0x04, 0x04, 0x08, 0x03, 0x10, 0x0b, 0x12, 0x6b, 0x0a, 0x09, 0x57, 0x61, 0x74, 0x63, 0x68,
-	0x4c, 0x69, 0x73, 0x74, 0x12, 0x2b, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
-	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x2e, 0x57, 0x61, 0x74, 0x63, 0x68, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x25, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
-	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x61,
-	0x74, 0x63, 0x68, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x02,
-	0x10, 0x0b, 0x30, 0x01, 0x42, 0xe9, 0x01, 0x0a, 0x1d, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73,
-	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x42, 0x0d, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x33, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
-	0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f,
-	0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69,
-	0x63, 0x2f, 0x70, 0x62, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0xa2, 0x02, 0x03, 0x48,
-	0x43, 0x52, 0xaa, 0x02, 0x19, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43,
-	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0xca, 0x02,
-	0x19, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75,
-	0x6c, 0x5c, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0xe2, 0x02, 0x25, 0x48, 0x61, 0x73,
-	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x52, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0xea, 0x02, 0x1b, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a,
-	0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x57, 0x61, 0x74, 0x63, 0x68, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04,
+	0x08, 0x02, 0x10, 0x0b, 0x30, 0x01, 0x42, 0xe9, 0x01, 0x0a, 0x1d, 0x63, 0x6f, 0x6d, 0x2e, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x42, 0x0d, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x33, 0x67, 0x69, 0x74, 0x68, 0x75,
+	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f,
+	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62,
+	0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0xa2, 0x02,
+	0x03, 0x48, 0x43, 0x52, 0xaa, 0x02, 0x19, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0xca, 0x02, 0x19, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x5c, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0xe2, 0x02, 0x25, 0x48,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c,
+	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x1b, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -1651,7 +1705,7 @@ func file_pbresource_resource_proto_rawDescGZIP() []byte {
 }
 
 var file_pbresource_resource_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
-var file_pbresource_resource_proto_msgTypes = make([]protoimpl.MessageInfo, 21)
+var file_pbresource_resource_proto_msgTypes = make([]protoimpl.MessageInfo, 22)
 var file_pbresource_resource_proto_goTypes = []interface{}{
 	(Condition_State)(0),        // 0: hashicorp.consul.resource.Condition.State
 	(WatchEvent_Operation)(0),   // 1: hashicorp.consul.resource.WatchEvent.Operation
@@ -1662,68 +1716,70 @@ var file_pbresource_resource_proto_goTypes = []interface{}{
 	(*Status)(nil),              // 6: hashicorp.consul.resource.Status
 	(*Condition)(nil),           // 7: hashicorp.consul.resource.Condition
 	(*Reference)(nil),           // 8: hashicorp.consul.resource.Reference
-	(*ReadRequest)(nil),         // 9: hashicorp.consul.resource.ReadRequest
-	(*ReadResponse)(nil),        // 10: hashicorp.consul.resource.ReadResponse
-	(*ListRequest)(nil),         // 11: hashicorp.consul.resource.ListRequest
-	(*ListResponse)(nil),        // 12: hashicorp.consul.resource.ListResponse
-	(*WriteRequest)(nil),        // 13: hashicorp.consul.resource.WriteRequest
-	(*WriteResponse)(nil),       // 14: hashicorp.consul.resource.WriteResponse
-	(*WriteStatusRequest)(nil),  // 15: hashicorp.consul.resource.WriteStatusRequest
-	(*WriteStatusResponse)(nil), // 16: hashicorp.consul.resource.WriteStatusResponse
-	(*DeleteRequest)(nil),       // 17: hashicorp.consul.resource.DeleteRequest
-	(*DeleteResponse)(nil),      // 18: hashicorp.consul.resource.DeleteResponse
-	(*WatchListRequest)(nil),    // 19: hashicorp.consul.resource.WatchListRequest
-	(*WatchEvent)(nil),          // 20: hashicorp.consul.resource.WatchEvent
-	nil,                         // 21: hashicorp.consul.resource.Resource.MetadataEntry
-	nil,                         // 22: hashicorp.consul.resource.Resource.StatusEntry
-	(*anypb.Any)(nil),           // 23: google.protobuf.Any
+	(*Tombstone)(nil),           // 9: hashicorp.consul.resource.Tombstone
+	(*ReadRequest)(nil),         // 10: hashicorp.consul.resource.ReadRequest
+	(*ReadResponse)(nil),        // 11: hashicorp.consul.resource.ReadResponse
+	(*ListRequest)(nil),         // 12: hashicorp.consul.resource.ListRequest
+	(*ListResponse)(nil),        // 13: hashicorp.consul.resource.ListResponse
+	(*WriteRequest)(nil),        // 14: hashicorp.consul.resource.WriteRequest
+	(*WriteResponse)(nil),       // 15: hashicorp.consul.resource.WriteResponse
+	(*WriteStatusRequest)(nil),  // 16: hashicorp.consul.resource.WriteStatusRequest
+	(*WriteStatusResponse)(nil), // 17: hashicorp.consul.resource.WriteStatusResponse
+	(*DeleteRequest)(nil),       // 18: hashicorp.consul.resource.DeleteRequest
+	(*DeleteResponse)(nil),      // 19: hashicorp.consul.resource.DeleteResponse
+	(*WatchListRequest)(nil),    // 20: hashicorp.consul.resource.WatchListRequest
+	(*WatchEvent)(nil),          // 21: hashicorp.consul.resource.WatchEvent
+	nil,                         // 22: hashicorp.consul.resource.Resource.MetadataEntry
+	nil,                         // 23: hashicorp.consul.resource.Resource.StatusEntry
+	(*anypb.Any)(nil),           // 24: google.protobuf.Any
 }
 var file_pbresource_resource_proto_depIdxs = []int32{
 	2,  // 0: hashicorp.consul.resource.ID.type:type_name -> hashicorp.consul.resource.Type
 	3,  // 1: hashicorp.consul.resource.ID.tenancy:type_name -> hashicorp.consul.resource.Tenancy
 	4,  // 2: hashicorp.consul.resource.Resource.id:type_name -> hashicorp.consul.resource.ID
 	4,  // 3: hashicorp.consul.resource.Resource.owner:type_name -> hashicorp.consul.resource.ID
-	21, // 4: hashicorp.consul.resource.Resource.metadata:type_name -> hashicorp.consul.resource.Resource.MetadataEntry
-	22, // 5: hashicorp.consul.resource.Resource.status:type_name -> hashicorp.consul.resource.Resource.StatusEntry
-	23, // 6: hashicorp.consul.resource.Resource.data:type_name -> google.protobuf.Any
+	22, // 4: hashicorp.consul.resource.Resource.metadata:type_name -> hashicorp.consul.resource.Resource.MetadataEntry
+	23, // 5: hashicorp.consul.resource.Resource.status:type_name -> hashicorp.consul.resource.Resource.StatusEntry
+	24, // 6: hashicorp.consul.resource.Resource.data:type_name -> google.protobuf.Any
 	7,  // 7: hashicorp.consul.resource.Status.conditions:type_name -> hashicorp.consul.resource.Condition
 	0,  // 8: hashicorp.consul.resource.Condition.state:type_name -> hashicorp.consul.resource.Condition.State
 	8,  // 9: hashicorp.consul.resource.Condition.resource:type_name -> hashicorp.consul.resource.Reference
 	2,  // 10: hashicorp.consul.resource.Reference.type:type_name -> hashicorp.consul.resource.Type
 	3,  // 11: hashicorp.consul.resource.Reference.tenancy:type_name -> hashicorp.consul.resource.Tenancy
-	4,  // 12: hashicorp.consul.resource.ReadRequest.id:type_name -> hashicorp.consul.resource.ID
-	5,  // 13: hashicorp.consul.resource.ReadResponse.resource:type_name -> hashicorp.consul.resource.Resource
-	2,  // 14: hashicorp.consul.resource.ListRequest.type:type_name -> hashicorp.consul.resource.Type
-	3,  // 15: hashicorp.consul.resource.ListRequest.tenancy:type_name -> hashicorp.consul.resource.Tenancy
-	5,  // 16: hashicorp.consul.resource.ListResponse.resources:type_name -> hashicorp.consul.resource.Resource
-	5,  // 17: hashicorp.consul.resource.WriteRequest.resource:type_name -> hashicorp.consul.resource.Resource
-	5,  // 18: hashicorp.consul.resource.WriteResponse.resource:type_name -> hashicorp.consul.resource.Resource
-	4,  // 19: hashicorp.consul.resource.WriteStatusRequest.id:type_name -> hashicorp.consul.resource.ID
-	6,  // 20: hashicorp.consul.resource.WriteStatusRequest.status:type_name -> hashicorp.consul.resource.Status
-	5,  // 21: hashicorp.consul.resource.WriteStatusResponse.resource:type_name -> hashicorp.consul.resource.Resource
-	4,  // 22: hashicorp.consul.resource.DeleteRequest.id:type_name -> hashicorp.consul.resource.ID
-	2,  // 23: hashicorp.consul.resource.WatchListRequest.type:type_name -> hashicorp.consul.resource.Type
-	3,  // 24: hashicorp.consul.resource.WatchListRequest.tenancy:type_name -> hashicorp.consul.resource.Tenancy
-	1,  // 25: hashicorp.consul.resource.WatchEvent.operation:type_name -> hashicorp.consul.resource.WatchEvent.Operation
-	5,  // 26: hashicorp.consul.resource.WatchEvent.resource:type_name -> hashicorp.consul.resource.Resource
-	6,  // 27: hashicorp.consul.resource.Resource.StatusEntry.value:type_name -> hashicorp.consul.resource.Status
-	9,  // 28: hashicorp.consul.resource.ResourceService.Read:input_type -> hashicorp.consul.resource.ReadRequest
-	13, // 29: hashicorp.consul.resource.ResourceService.Write:input_type -> hashicorp.consul.resource.WriteRequest
-	15, // 30: hashicorp.consul.resource.ResourceService.WriteStatus:input_type -> hashicorp.consul.resource.WriteStatusRequest
-	11, // 31: hashicorp.consul.resource.ResourceService.List:input_type -> hashicorp.consul.resource.ListRequest
-	17, // 32: hashicorp.consul.resource.ResourceService.Delete:input_type -> hashicorp.consul.resource.DeleteRequest
-	19, // 33: hashicorp.consul.resource.ResourceService.WatchList:input_type -> hashicorp.consul.resource.WatchListRequest
-	10, // 34: hashicorp.consul.resource.ResourceService.Read:output_type -> hashicorp.consul.resource.ReadResponse
-	14, // 35: hashicorp.consul.resource.ResourceService.Write:output_type -> hashicorp.consul.resource.WriteResponse
-	16, // 36: hashicorp.consul.resource.ResourceService.WriteStatus:output_type -> hashicorp.consul.resource.WriteStatusResponse
-	12, // 37: hashicorp.consul.resource.ResourceService.List:output_type -> hashicorp.consul.resource.ListResponse
-	18, // 38: hashicorp.consul.resource.ResourceService.Delete:output_type -> hashicorp.consul.resource.DeleteResponse
-	20, // 39: hashicorp.consul.resource.ResourceService.WatchList:output_type -> hashicorp.consul.resource.WatchEvent
-	34, // [34:40] is the sub-list for method output_type
-	28, // [28:34] is the sub-list for method input_type
-	28, // [28:28] is the sub-list for extension type_name
-	28, // [28:28] is the sub-list for extension extendee
-	0,  // [0:28] is the sub-list for field type_name
+	4,  // 12: hashicorp.consul.resource.Tombstone.owner:type_name -> hashicorp.consul.resource.ID
+	4,  // 13: hashicorp.consul.resource.ReadRequest.id:type_name -> hashicorp.consul.resource.ID
+	5,  // 14: hashicorp.consul.resource.ReadResponse.resource:type_name -> hashicorp.consul.resource.Resource
+	2,  // 15: hashicorp.consul.resource.ListRequest.type:type_name -> hashicorp.consul.resource.Type
+	3,  // 16: hashicorp.consul.resource.ListRequest.tenancy:type_name -> hashicorp.consul.resource.Tenancy
+	5,  // 17: hashicorp.consul.resource.ListResponse.resources:type_name -> hashicorp.consul.resource.Resource
+	5,  // 18: hashicorp.consul.resource.WriteRequest.resource:type_name -> hashicorp.consul.resource.Resource
+	5,  // 19: hashicorp.consul.resource.WriteResponse.resource:type_name -> hashicorp.consul.resource.Resource
+	4,  // 20: hashicorp.consul.resource.WriteStatusRequest.id:type_name -> hashicorp.consul.resource.ID
+	6,  // 21: hashicorp.consul.resource.WriteStatusRequest.status:type_name -> hashicorp.consul.resource.Status
+	5,  // 22: hashicorp.consul.resource.WriteStatusResponse.resource:type_name -> hashicorp.consul.resource.Resource
+	4,  // 23: hashicorp.consul.resource.DeleteRequest.id:type_name -> hashicorp.consul.resource.ID
+	2,  // 24: hashicorp.consul.resource.WatchListRequest.type:type_name -> hashicorp.consul.resource.Type
+	3,  // 25: hashicorp.consul.resource.WatchListRequest.tenancy:type_name -> hashicorp.consul.resource.Tenancy
+	1,  // 26: hashicorp.consul.resource.WatchEvent.operation:type_name -> hashicorp.consul.resource.WatchEvent.Operation
+	5,  // 27: hashicorp.consul.resource.WatchEvent.resource:type_name -> hashicorp.consul.resource.Resource
+	6,  // 28: hashicorp.consul.resource.Resource.StatusEntry.value:type_name -> hashicorp.consul.resource.Status
+	10, // 29: hashicorp.consul.resource.ResourceService.Read:input_type -> hashicorp.consul.resource.ReadRequest
+	14, // 30: hashicorp.consul.resource.ResourceService.Write:input_type -> hashicorp.consul.resource.WriteRequest
+	16, // 31: hashicorp.consul.resource.ResourceService.WriteStatus:input_type -> hashicorp.consul.resource.WriteStatusRequest
+	12, // 32: hashicorp.consul.resource.ResourceService.List:input_type -> hashicorp.consul.resource.ListRequest
+	18, // 33: hashicorp.consul.resource.ResourceService.Delete:input_type -> hashicorp.consul.resource.DeleteRequest
+	20, // 34: hashicorp.consul.resource.ResourceService.WatchList:input_type -> hashicorp.consul.resource.WatchListRequest
+	11, // 35: hashicorp.consul.resource.ResourceService.Read:output_type -> hashicorp.consul.resource.ReadResponse
+	15, // 36: hashicorp.consul.resource.ResourceService.Write:output_type -> hashicorp.consul.resource.WriteResponse
+	17, // 37: hashicorp.consul.resource.ResourceService.WriteStatus:output_type -> hashicorp.consul.resource.WriteStatusResponse
+	13, // 38: hashicorp.consul.resource.ResourceService.List:output_type -> hashicorp.consul.resource.ListResponse
+	19, // 39: hashicorp.consul.resource.ResourceService.Delete:output_type -> hashicorp.consul.resource.DeleteResponse
+	21, // 40: hashicorp.consul.resource.ResourceService.WatchList:output_type -> hashicorp.consul.resource.WatchEvent
+	35, // [35:41] is the sub-list for method output_type
+	29, // [29:35] is the sub-list for method input_type
+	29, // [29:29] is the sub-list for extension type_name
+	29, // [29:29] is the sub-list for extension extendee
+	0,  // [0:29] is the sub-list for field type_name
 }
 
 func init() { file_pbresource_resource_proto_init() }
@@ -1817,7 +1873,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ReadRequest); i {
+			switch v := v.(*Tombstone); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1829,7 +1885,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ReadResponse); i {
+			switch v := v.(*ReadRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1841,7 +1897,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListRequest); i {
+			switch v := v.(*ReadResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1853,7 +1909,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListResponse); i {
+			switch v := v.(*ListRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1865,7 +1921,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WriteRequest); i {
+			switch v := v.(*ListResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1877,7 +1933,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WriteResponse); i {
+			switch v := v.(*WriteRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1889,7 +1945,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WriteStatusRequest); i {
+			switch v := v.(*WriteResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1901,7 +1957,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WriteStatusResponse); i {
+			switch v := v.(*WriteStatusRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1913,7 +1969,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeleteRequest); i {
+			switch v := v.(*WriteStatusResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1925,7 +1981,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeleteResponse); i {
+			switch v := v.(*DeleteRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1937,7 +1993,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WatchListRequest); i {
+			switch v := v.(*DeleteResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1949,6 +2005,18 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WatchListRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbresource_resource_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*WatchEvent); i {
 			case 0:
 				return &v.state
@@ -1967,7 +2035,7 @@ func file_pbresource_resource_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_pbresource_resource_proto_rawDesc,
 			NumEnums:      2,
-			NumMessages:   21,
+			NumMessages:   22,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/proto-public/pbresource/resource.proto b/proto-public/pbresource/resource.proto
index 3fa18d5d6b2c..b5609bbc11a6 100644
--- a/proto-public/pbresource/resource.proto
+++ b/proto-public/pbresource/resource.proto
@@ -181,6 +181,13 @@ message Reference {
   string section = 4;
 }
 
+// Tombstone represents a promise to delete all of a resource's immediately
+// owned (child) resources, if any.
+message Tombstone {
+  // Owner resource identifier.
+  ID owner = 1;
+}
+
 // ResourceService provides the shared primitives for storing, querying, and
 // watching resources of different types.
 //
@@ -230,6 +237,11 @@ service ResourceService {
   // version in the Resource.Version field. If the given version doesn't match
   // what is currently stored, an Aborted error code will be returned.
   //
+  // To perform a blanket write (update regardless of the stored version),
+  // provide an empty Version in the Resource.Version field. Note that the
+  // write may still fail due to not being able to internally do a CAS write
+  // and return an Aborted error code.
+  //
   // Resource.Id.Uid can (and by controllers, should) be provided to avoid
   // accidentally modifying a resource if it has been deleted and recreated.
   // If the given Uid doesn't match what is stored, a FailedPrecondition error
diff --git a/proto-public/pbresource/resource_grpc.pb.go b/proto-public/pbresource/resource_grpc.pb.go
index f44208b2990c..59ecbcb0debe 100644
--- a/proto-public/pbresource/resource_grpc.pb.go
+++ b/proto-public/pbresource/resource_grpc.pb.go
@@ -34,6 +34,11 @@ type ResourceServiceClient interface {
 	// version in the Resource.Version field. If the given version doesn't match
 	// what is currently stored, an Aborted error code will be returned.
 	//
+	// To perform a blanket write (update regardless of the stored version),
+	// provide an empty Version in the Resource.Version field. Note that the
+	// write may still fail due to not being able to internally do a CAS write
+	// and return an Aborted error code.
+	//
 	// Resource.Id.Uid can (and by controllers, should) be provided to avoid
 	// accidentally modifying a resource if it has been deleted and recreated.
 	// If the given Uid doesn't match what is stored, a FailedPrecondition error
@@ -193,6 +198,11 @@ type ResourceServiceServer interface {
 	// version in the Resource.Version field. If the given version doesn't match
 	// what is currently stored, an Aborted error code will be returned.
 	//
+	// To perform a blanket write (update regardless of the stored version),
+	// provide an empty Version in the Resource.Version field. Note that the
+	// write may still fail due to not being able to internally do a CAS write
+	// and return an Aborted error code.
+	//
 	// Resource.Id.Uid can (and by controllers, should) be provided to avoid
 	// accidentally modifying a resource if it has been deleted and recreated.
 	// If the given Uid doesn't match what is stored, a FailedPrecondition error

From eded58b62a236d58dd739fc3a507f5c56583f7fa Mon Sep 17 00:00:00 2001
From: John Landa <jonathanlanda@gmail.com>
Date: Fri, 28 Apr 2023 10:57:30 -0500
Subject: [PATCH 33/92] Remove artificial ACLTokenMaxTTL limit for configuring
 acl token expiry (#17066)

* Remove artificial ACLTokenMaxTTL limit for configuring acl token expiry

* Add changelog

* Remove test on default MaxTokenTTL

* Change to imperitive tense for changelog entry
---
 .changelog/17066.txt                          |  3 ++
 agent/consul/acl_endpoint_test.go             | 15 --------
 agent/consul/config.go                        | 18 +++++-----
 command/acl/token/create/token_create_test.go | 34 +++++++++++++++++--
 4 files changed, 45 insertions(+), 25 deletions(-)
 create mode 100644 .changelog/17066.txt

diff --git a/.changelog/17066.txt b/.changelog/17066.txt
new file mode 100644
index 000000000000..9b8b181859d0
--- /dev/null
+++ b/.changelog/17066.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+command: Allow creating ACL Token TTL with greater than 24 hours with the -expires-ttl flag.
+```
diff --git a/agent/consul/acl_endpoint_test.go b/agent/consul/acl_endpoint_test.go
index 9507f9c62001..6f674810b5da 100644
--- a/agent/consul/acl_endpoint_test.go
+++ b/agent/consul/acl_endpoint_test.go
@@ -3261,21 +3261,6 @@ func TestACLEndpoint_AuthMethodSet(t *testing.T) {
 		err := aclEp.AuthMethodSet(&req, &resp)
 		testutil.RequireErrorContains(t, err, "MaxTokenTTL 1ms cannot be less than")
 	})
-
-	t.Run("Create with MaxTokenTTL too big", func(t *testing.T) {
-		reqMethod := newAuthMethod("test")
-		reqMethod.MaxTokenTTL = 25 * time.Hour
-
-		req := structs.ACLAuthMethodSetRequest{
-			Datacenter:   "dc1",
-			AuthMethod:   reqMethod,
-			WriteRequest: structs.WriteRequest{Token: TestDefaultInitialManagementToken},
-		}
-		resp := structs.ACLAuthMethod{}
-
-		err := aclEp.AuthMethodSet(&req, &resp)
-		testutil.RequireErrorContains(t, err, "MaxTokenTTL 25h0m0s cannot be more than")
-	})
 }
 
 func TestACLEndpoint_AuthMethodDelete(t *testing.T) {
diff --git a/agent/consul/config.go b/agent/consul/config.go
index 61ed8b8eab8f..e35fceb5560d 100644
--- a/agent/consul/config.go
+++ b/agent/consul/config.go
@@ -238,9 +238,9 @@ type Config struct {
 	AutoConfigAuthzAllowReuse      bool
 
 	// TombstoneTTL is used to control how long KV tombstones are retained.
-	// This provides a window of time where the X-Consul-Index is monotonic.
+	// This provides a window of time when the X-Consul-Index is monotonic.
 	// Outside this window, the index may not be monotonic. This is a result
-	// of a few trade offs:
+	// of a few trade-offs:
 	// 1) The index is defined by the data view and not globally. This is a
 	// performance optimization that prevents any write from incrementing the
 	// index for all data views.
@@ -248,10 +248,10 @@ type Config struct {
 	// is also monotonic. This prevents deletes from reducing the disk space
 	// used.
 	// In theory, neither of these are intrinsic limitations, however for the
-	// purposes of building a practical system, they are reasonable trade offs.
+	// purposes of building a practical system, they are reasonable trade-offs.
 	//
 	// It is also possible to set this to an incredibly long time, thereby
-	// simulating infinite retention. This is not recommended however.
+	// simulating infinite retention. This is not recommended, however.
 	//
 	TombstoneTTL time.Duration
 
@@ -524,11 +524,13 @@ func DefaultConfig() *Config {
 		TombstoneTTLGranularity:              30 * time.Second,
 		SessionTTLMin:                        10 * time.Second,
 		ACLTokenMinExpirationTTL:             1 * time.Minute,
-		ACLTokenMaxExpirationTTL:             24 * time.Hour,
+		// Duration is stored as an int64. Setting the default max
+		// to the max possible duration (approx 290 years).
+		ACLTokenMaxExpirationTTL: 1<<63 - 1,
 
 		// These are tuned to provide a total throughput of 128 updates
-		// per second. If you update these, you should update the client-
-		// side SyncCoordinateRateTarget parameter accordingly.
+		// per second. If you update these, you should update the client-side
+		// SyncCoordinateRateTarget parameter accordingly.
 		CoordinateUpdatePeriod:     5 * time.Second,
 		CoordinateUpdateBatchSize:  128,
 		CoordinateUpdateMaxBatches: 5,
@@ -560,7 +562,7 @@ func DefaultConfig() *Config {
 			},
 		},
 
-		// Stay under the 10 second aggregation interval of
+		// Stay under the 10-second aggregation interval of
 		// go-metrics. This ensures we always report the
 		// usage metrics in each cycle.
 		MetricsReportingInterval: 9 * time.Second,
diff --git a/command/acl/token/create/token_create_test.go b/command/acl/token/create/token_create_test.go
index 876cc16687da..747d9415171d 100644
--- a/command/acl/token/create/token_create_test.go
+++ b/command/acl/token/create/token_create_test.go
@@ -7,12 +7,14 @@ import (
 	"encoding/json"
 	"strings"
 	"testing"
+	"time"
+
+	"github.com/mitchellh/cli"
+	"github.com/stretchr/testify/require"
 
 	"github.com/hashicorp/consul/agent"
 	"github.com/hashicorp/consul/api"
 	"github.com/hashicorp/consul/testrpc"
-	"github.com/mitchellh/cli"
-	"github.com/stretchr/testify/require"
 )
 
 func TestTokenCreateCommand_noTabs(t *testing.T) {
@@ -119,6 +121,34 @@ func TestTokenCreateCommand_Pretty(t *testing.T) {
 		require.Equal(t, "3d852bb8-5153-4388-a3ca-8ca78661889f", token.AccessorID)
 		require.Equal(t, "3a69a8d8-c4d4-485d-9b19-b5b61648ea0c", token.SecretID)
 	})
+
+	// create with an expires-ttl (<24h)
+	t.Run("expires-ttl_short", func(t *testing.T) {
+		token := run(t, []string{
+			"-http-addr=" + a.HTTPAddr(),
+			"-token=root",
+			"-policy-name=" + policy.Name,
+			"-description=test token",
+			"-expires-ttl=1h",
+		})
+
+		// check diff between creation and expires time since we
+		// always set the token.ExpirationTTL value to 0 at the moment
+		require.Equal(t, time.Hour, token.ExpirationTime.Sub(token.CreateTime))
+	})
+
+	// create with an expires-ttl long (>24h)
+	t.Run("expires-ttl_long", func(t *testing.T) {
+		token := run(t, []string{
+			"-http-addr=" + a.HTTPAddr(),
+			"-token=root",
+			"-policy-name=" + policy.Name,
+			"-description=test token",
+			"-expires-ttl=8760h",
+		})
+
+		require.Equal(t, 8760*time.Hour, token.ExpirationTime.Sub(token.CreateTime))
+	})
 }
 
 func TestTokenCreateCommand_JSON(t *testing.T) {

From 1037bf7f69ba96345309be1dd961fc9570f22ffe Mon Sep 17 00:00:00 2001
From: Semir Patel <semir.patel@hashicorp.com>
Date: Fri, 28 Apr 2023 12:14:37 -0500
Subject: [PATCH 34/92] Sync .golangci.yml from ENT (#17180)

---
 .golangci.yml                                 | 27 +++++--------------
 .../grpc-external/services/resource/delete.go |  2 +-
 2 files changed, 7 insertions(+), 22 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index 21f5d8228d50..245f04d7a955 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -23,29 +23,14 @@ issues:
     # Temp Ignore SA9004: only the first constant in this group has an explicit type
     # https://staticcheck.io/docs/checks#SA9004
     - linters: [staticcheck]
-      text: 'SA9004:'
-
-    - linters: [staticcheck]
-      text: 'SA1019: "github.com/golang/protobuf/jsonpb" is deprecated: Use the "google.golang.org/protobuf/encoding/protojson" package instead.'
-
-    - linters: [staticcheck]
-      text: 'SA1019: "github.com/golang/protobuf/proto" is deprecated: Use the "google.golang.org/protobuf/proto" package instead.'
-
-    - linters: [staticcheck]
-      text: 'SA1019: ptypes.MarshalAny is deprecated'
-
-    - linters: [staticcheck]
-      text: 'SA1019: ptypes.UnmarshalAny is deprecated'
-
-    - linters: [staticcheck]
-      text: 'SA1019: "github.com/golang/protobuf/ptypes" is deprecated: Well-known types have specialized functionality directly injected into the generated packages for each message type. See the deprecation notice for each function for the suggested alternative.'
+      text: "SA9004:"
 
     - linters: [staticcheck]
       text: 'SA1019: "io/ioutil" has been deprecated since Go 1.16'
 
     # An argument that always receives the same value is often not a problem.
     - linters: [unparam]
-      text: 'always receives'
+      text: "always receives"
 
     # Often functions will implement an interface that returns an error without
     # needing to return an error. Sometimes the error return value is unnecessary
@@ -59,18 +44,18 @@ issues:
     # self-documentation than a single underscore by itself.  Underscore arguments
     # should generally only be used when a function is implementing an interface.
     - linters: [unparam]
-      text: '`_[^`]*` is unused'
+      text: "`_[^`]*` is unused"
 
     # Temp ignore some common unused parameters so that unparam can be added
     # incrementally.
     - linters: [unparam]
-      text: '`(t|resp|req|entMeta)` is unused'
+      text: "`(t|resp|req|entMeta)` is unused"
 
     # Temp ignore everything in _oss(_test).go and _ent(_test).go. Many of these
     # could use underscore to ignore the unused arguments, but the "always returns"
     # issue will likely remain in oss, and will need to be excluded.
     - linters: [unparam]
-      path: '(_oss.go|_oss_test.go|_ent.go|_ent_test.go)'
+      path: "(_oss.go|_oss_test.go|_ent.go|_ent_test.go)"
 
 linters-settings:
   govet:
@@ -115,7 +100,7 @@ linters-settings:
     # Specify an error message to output when a denied package is used.
     # Default: []
     packages-with-error-message:
-      - net/rpc: 'only use forked copy in github.com/hashicorp/consul-net-rpc/net/rpc'
+      - net/rpc: "only use forked copy in github.com/hashicorp/consul-net-rpc/net/rpc"
 
 run:
   timeout: 10m
diff --git a/agent/grpc-external/services/resource/delete.go b/agent/grpc-external/services/resource/delete.go
index a072dcee3cf9..f15fafa5931e 100644
--- a/agent/grpc-external/services/resource/delete.go
+++ b/agent/grpc-external/services/resource/delete.go
@@ -9,10 +9,10 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/golang/protobuf/proto"
 	"github.com/oklog/ulid/v2"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/anypb"
 
 	"github.com/hashicorp/consul/acl"

From 6b4986907d5606fe93e3c34c8ee3e8a5314fa013 Mon Sep 17 00:00:00 2001
From: "R.B. Boyer" <4903+rboyer@users.noreply.github.com>
Date: Fri, 28 Apr 2023 12:36:08 -0500
Subject: [PATCH 35/92] peering: ensure that merged central configs of peered
 upstreams for partitioned downstreams work (#17179)

Partitioned downstreams with peered upstreams could not properly merge central config info (i.e. proxy-defaults and service-defaults things like mesh gateway modes) if the upstream had an empty DestinationPartition field in Enterprise.

Due to data flow, if this setup is done using Consul client agents the field is never empty and thus does not experience the bug.

When a service is registered directly to the catalog as is the case for consul-dataplane use this field may be empty and and the internal machinery of the merging function doesn't handle this well.

This PR ensures the internal machinery of that function is referentially self-consistent.
---
 .changelog/17179.txt                          |   3 +
 agent/configentry/merge_service_config.go     |  30 ++-
 .../configentry/merge_service_config_test.go  | 209 ++++++++++++++++++
 3 files changed, 237 insertions(+), 5 deletions(-)
 create mode 100644 .changelog/17179.txt

diff --git a/.changelog/17179.txt b/.changelog/17179.txt
new file mode 100644
index 000000000000..efcfba709272
--- /dev/null
+++ b/.changelog/17179.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+peering: ensure that merged central configs of peered upstreams for partitioned downstreams work
+```
diff --git a/agent/configentry/merge_service_config.go b/agent/configentry/merge_service_config.go
index b761174ea3b4..cc692e789b37 100644
--- a/agent/configentry/merge_service_config.go
+++ b/agent/configentry/merge_service_config.go
@@ -161,17 +161,31 @@ func MergeServiceConfig(defaults *structs.ServiceConfigResponse, service *struct
 	// remoteUpstreams contains synthetic Upstreams generated from central config (service-defaults.UpstreamConfigs).
 	remoteUpstreams := make(map[structs.PeeredServiceName]structs.Upstream)
 
+	// If the arguments did not fully normalize tenancy stuff, take care of that now.
+	entMeta := ns.EnterpriseMeta
+	entMeta.Normalize()
+
 	for _, us := range defaults.UpstreamConfigs {
 		parsed, err := structs.ParseUpstreamConfigNoDefaults(us.Config)
 		if err != nil {
 			return nil, fmt.Errorf("failed to parse upstream config map for %s: %v", us.Upstream.String(), err)
 		}
 
-		remoteUpstreams[us.Upstream] = structs.Upstream{
-			DestinationNamespace: us.Upstream.ServiceName.NamespaceOrDefault(),
-			DestinationPartition: us.Upstream.ServiceName.PartitionOrDefault(),
-			DestinationName:      us.Upstream.ServiceName.Name,
-			DestinationPeer:      us.Upstream.Peer,
+		// If the defaults did not fully normalize tenancy stuff, take care of
+		// that now too.
+		psn := us.Upstream // only normalize the copy
+		psn.ServiceName.EnterpriseMeta.Normalize()
+
+		// Normalize the partition field specially.
+		if psn.Peer != "" {
+			psn.ServiceName.OverridePartition(entMeta.PartitionOrDefault())
+		}
+
+		remoteUpstreams[psn] = structs.Upstream{
+			DestinationNamespace: psn.ServiceName.NamespaceOrDefault(),
+			DestinationPartition: psn.ServiceName.PartitionOrDefault(),
+			DestinationName:      psn.ServiceName.Name,
+			DestinationPeer:      psn.Peer,
 			Config:               us.Config,
 			MeshGateway:          parsed.MeshGateway,
 			CentrallyConfigured:  true,
@@ -192,6 +206,12 @@ func MergeServiceConfig(defaults *structs.ServiceConfigResponse, service *struct
 		}
 
 		uid := us.DestinationID()
+
+		// Normalize the partition field specially.
+		if uid.Peer != "" {
+			uid.ServiceName.OverridePartition(entMeta.PartitionOrDefault())
+		}
+
 		localUpstreams[uid] = struct{}{}
 		remoteCfg, ok := remoteUpstreams[uid]
 		if !ok {
diff --git a/agent/configentry/merge_service_config_test.go b/agent/configentry/merge_service_config_test.go
index 03a34eefdac6..4f6dbb55488a 100644
--- a/agent/configentry/merge_service_config_test.go
+++ b/agent/configentry/merge_service_config_test.go
@@ -10,6 +10,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/agent/structs"
 )
 
@@ -275,6 +276,214 @@ func Test_MergeServiceConfig_Extensions(t *testing.T) {
 	}
 }
 
+func isEnterprise() bool {
+	return acl.PartitionOrDefault("") == "default"
+}
+
+func Test_MergeServiceConfig_peeredCentralDefaultsMerging(t *testing.T) {
+	partitions := []string{"default"}
+	if isEnterprise() {
+		partitions = append(partitions, "part1")
+	}
+
+	const peerName = "my-peer"
+
+	newDefaults := func(partition string) *structs.ServiceConfigResponse {
+		// client agents
+		return &structs.ServiceConfigResponse{
+			ProxyConfig: map[string]any{
+				"protocol": "http",
+			},
+			UpstreamConfigs: []structs.OpaqueUpstreamConfig{
+				{
+					Upstream: structs.PeeredServiceName{
+						ServiceName: structs.ServiceName{
+							Name:           "*",
+							EnterpriseMeta: acl.NewEnterpriseMetaWithPartition(partition, "*"),
+						},
+					},
+					Config: map[string]any{
+						"mesh_gateway": map[string]any{
+							"Mode": "local",
+						},
+						"protocol": "http",
+					},
+				},
+				{
+					Upstream: structs.PeeredServiceName{
+						ServiceName: structs.ServiceName{
+							Name:           "static-server",
+							EnterpriseMeta: acl.NewEnterpriseMetaWithPartition(partition, "default"),
+						},
+						Peer: peerName,
+					},
+					Config: map[string]any{
+						"mesh_gateway": map[string]any{
+							"Mode": "local",
+						},
+						"protocol": "http",
+					},
+				},
+			},
+			MeshGateway: structs.MeshGatewayConfig{
+				Mode: "local",
+			},
+		}
+	}
+
+	for _, partition := range partitions {
+		t.Run("partition="+partition, func(t *testing.T) {
+			t.Run("clients", func(t *testing.T) {
+				defaults := newDefaults(partition)
+
+				service := &structs.NodeService{
+					Kind:    "connect-proxy",
+					ID:      "static-client-sidecar-proxy",
+					Service: "static-client-sidecar-proxy",
+					Address: "",
+					Port:    21000,
+					Proxy: structs.ConnectProxyConfig{
+						DestinationServiceName: "static-client",
+						DestinationServiceID:   "static-client",
+						LocalServiceAddress:    "127.0.0.1",
+						LocalServicePort:       8080,
+						Upstreams: []structs.Upstream{
+							{
+								DestinationType:      "service",
+								DestinationNamespace: "default",
+								DestinationPartition: partition,
+								DestinationPeer:      peerName,
+								DestinationName:      "static-server",
+								LocalBindAddress:     "0.0.0.0",
+								LocalBindPort:        5000,
+							},
+						},
+					},
+					EnterpriseMeta: acl.NewEnterpriseMetaWithPartition(partition, "default"),
+				}
+
+				expect := &structs.NodeService{
+					Kind:    "connect-proxy",
+					ID:      "static-client-sidecar-proxy",
+					Service: "static-client-sidecar-proxy",
+					Address: "",
+					Port:    21000,
+					Proxy: structs.ConnectProxyConfig{
+						DestinationServiceName: "static-client",
+						DestinationServiceID:   "static-client",
+						LocalServiceAddress:    "127.0.0.1",
+						LocalServicePort:       8080,
+						Config: map[string]any{
+							"protocol": "http",
+						},
+						Upstreams: []structs.Upstream{
+							{
+								DestinationType:      "service",
+								DestinationNamespace: "default",
+								DestinationPartition: partition,
+								DestinationPeer:      peerName,
+								DestinationName:      "static-server",
+								LocalBindAddress:     "0.0.0.0",
+								LocalBindPort:        5000,
+								MeshGateway: structs.MeshGatewayConfig{
+									Mode: "local",
+								},
+								Config: map[string]any{},
+							},
+						},
+						MeshGateway: structs.MeshGatewayConfig{
+							Mode: "local",
+						},
+					},
+					EnterpriseMeta: acl.NewEnterpriseMetaWithPartition(partition, "default"),
+				}
+
+				got, err := MergeServiceConfig(defaults, service)
+				require.NoError(t, err)
+				require.Equal(t, expect, got)
+			})
+
+			t.Run("dataplanes", func(t *testing.T) {
+				defaults := newDefaults(partition)
+
+				service := &structs.NodeService{
+					Kind:    "connect-proxy",
+					ID:      "static-client-sidecar-proxy",
+					Service: "static-client-sidecar-proxy",
+					Address: "10.61.57.9",
+					TaggedAddresses: map[string]structs.ServiceAddress{
+						"consul-virtual": {
+							Address: "240.0.0.2",
+							Port:    20000,
+						},
+					},
+					Port: 20000,
+					Proxy: structs.ConnectProxyConfig{
+						DestinationServiceName: "static-client",
+						DestinationServiceID:   "static-client",
+						LocalServicePort:       8080,
+						Upstreams: []structs.Upstream{
+							{
+								DestinationType:      "",
+								DestinationNamespace: "default",
+								DestinationPeer:      peerName,
+								DestinationName:      "static-server",
+								LocalBindAddress:     "0.0.0.0",
+								LocalBindPort:        5000,
+							},
+						},
+					},
+					EnterpriseMeta: acl.NewEnterpriseMetaWithPartition(partition, "default"),
+				}
+
+				expect := &structs.NodeService{
+					Kind:    "connect-proxy",
+					ID:      "static-client-sidecar-proxy",
+					Service: "static-client-sidecar-proxy",
+					Address: "10.61.57.9",
+					TaggedAddresses: map[string]structs.ServiceAddress{
+						"consul-virtual": {
+							Address: "240.0.0.2",
+							Port:    20000,
+						},
+					},
+					Port: 20000,
+					Proxy: structs.ConnectProxyConfig{
+						DestinationServiceName: "static-client",
+						DestinationServiceID:   "static-client",
+						LocalServicePort:       8080,
+						Config: map[string]any{
+							"protocol": "http",
+						},
+						Upstreams: []structs.Upstream{
+							{
+								DestinationType:      "",
+								DestinationNamespace: "default",
+								DestinationPeer:      peerName,
+								DestinationName:      "static-server",
+								LocalBindAddress:     "0.0.0.0",
+								LocalBindPort:        5000,
+								MeshGateway: structs.MeshGatewayConfig{
+									Mode: "local", // This field vanishes if the merging does not work for dataplanes.
+								},
+								Config: map[string]any{},
+							},
+						},
+						MeshGateway: structs.MeshGatewayConfig{
+							Mode: "local",
+						},
+					},
+					EnterpriseMeta: acl.NewEnterpriseMetaWithPartition(partition, "default"),
+				}
+
+				got, err := MergeServiceConfig(defaults, service)
+				require.NoError(t, err)
+				require.Equal(t, expect, got)
+			})
+		})
+	}
+}
+
 func Test_MergeServiceConfig_UpstreamOverrides(t *testing.T) {
 	type args struct {
 		defaults *structs.ServiceConfigResponse

From e4a341c88a4a3e57f43176a628a7e6fe3627652f Mon Sep 17 00:00:00 2001
From: Paul Glass <pglass@hashicorp.com>
Date: Fri, 28 Apr 2023 12:51:36 -0500
Subject: [PATCH 36/92] Permissive mTLS: Config entry filtering and CLI
 warnings (#17183)

This adds filtering for service-defaults: consul config list -filter 'MutualTLSMode == "permissive"'.

It adds CLI warnings when the CLI writes a config entry and sees that either service-defaults or proxy-defaults contains MutualTLSMode=permissive, or sees that the mesh config entry contains AllowEnablingPermissiveMutualTLSMode=true.
---
 .changelog/17183.txt                      |   7 ++
 agent/consul/config_endpoint.go           |  25 +++++
 agent/consul/config_endpoint_test.go      | 125 ++++++++++++++++++++++
 command/config/config.go                  |  49 +++++++++
 command/config/list/config_list.go        |   9 +-
 command/config/list/config_list_test.go   |  56 ++++++++--
 command/config/write/config_write.go      |   6 ++
 command/config/write/config_write_test.go |  92 ++++++++++++++++
 8 files changed, 356 insertions(+), 13 deletions(-)
 create mode 100644 .changelog/17183.txt

diff --git a/.changelog/17183.txt b/.changelog/17183.txt
new file mode 100644
index 000000000000..1d4326c552b0
--- /dev/null
+++ b/.changelog/17183.txt
@@ -0,0 +1,7 @@
+```release-note:improvement
+* cli: Add `-filter` option to `consul config list` for filtering config entries.
+```
+```release-note:improvement
+* api: Support filtering for config entries.
+```
+
diff --git a/agent/consul/config_endpoint.go b/agent/consul/config_endpoint.go
index 4ed7c450aadb..4108eb20b95c 100644
--- a/agent/consul/config_endpoint.go
+++ b/agent/consul/config_endpoint.go
@@ -10,6 +10,7 @@ import (
 
 	metrics "github.com/armon/go-metrics"
 	"github.com/armon/go-metrics/prometheus"
+	"github.com/hashicorp/go-bexpr"
 	"github.com/hashicorp/go-hclog"
 	memdb "github.com/hashicorp/go-memdb"
 	hashstructure_v2 "github.com/mitchellh/hashstructure/v2"
@@ -248,6 +249,22 @@ func (c *ConfigEntry) List(args *structs.ConfigEntryQuery, reply *structs.Indexe
 		}
 	}
 
+	// Filtering.
+	// This is only supported for certain config entries.
+	var filter *bexpr.Filter
+	if args.Filter != "" {
+		switch args.Kind {
+		case structs.ServiceDefaults:
+			f, err := bexpr.CreateFilter(args.Filter, nil, []*structs.ServiceConfigEntry{})
+			if err != nil {
+				return err
+			}
+			filter = f
+		default:
+			return fmt.Errorf("filtering not supported for config entry kind=%v", args.Kind)
+		}
+	}
+
 	var (
 		priorHash uint64
 		ranOnce   bool
@@ -283,6 +300,14 @@ func (c *ConfigEntry) List(args *structs.ConfigEntryQuery, reply *structs.Indexe
 				return fmt.Errorf("error hashing reply for spurious wakeup suppression: %w", err)
 			}
 
+			if filter != nil {
+				raw, err := filter.Execute(reply.Entries)
+				if err != nil {
+					return err
+				}
+				reply.Entries = raw.([]structs.ConfigEntry)
+			}
+
 			if ranOnce && priorHash == newHash {
 				priorHash = newHash
 				return errNotChanged
diff --git a/agent/consul/config_endpoint_test.go b/agent/consul/config_endpoint_test.go
index e5584d857e1a..ad6dac744cfc 100644
--- a/agent/consul/config_endpoint_test.go
+++ b/agent/consul/config_endpoint_test.go
@@ -633,6 +633,131 @@ func TestConfigEntry_ListAll(t *testing.T) {
 	})
 }
 
+func TestConfigEntry_List_Filter(t *testing.T) {
+	if testing.Short() {
+		t.Skip("too slow for testing.Short")
+	}
+
+	t.Parallel()
+
+	dir1, s1 := testServer(t)
+	t.Cleanup(func() { os.RemoveAll(dir1) })
+	t.Cleanup(func() { s1.Shutdown() })
+	codec := rpcClient(t, s1)
+	t.Cleanup(func() { codec.Close() })
+
+	// Create some services
+	state := s1.fsm.State()
+	expected := structs.IndexedConfigEntries{
+		Entries: []structs.ConfigEntry{
+			&structs.ServiceConfigEntry{
+				Kind:          structs.ServiceDefaults,
+				Name:          "svc1",
+				MutualTLSMode: structs.MutualTLSModeDefault,
+			},
+			&structs.ServiceConfigEntry{
+				Kind:          structs.ServiceDefaults,
+				Name:          "svc2",
+				MutualTLSMode: structs.MutualTLSModeStrict,
+			},
+			&structs.ServiceConfigEntry{
+				Kind:          structs.ServiceDefaults,
+				Name:          "svc3",
+				MutualTLSMode: structs.MutualTLSModePermissive,
+			},
+		},
+	}
+
+	require.NoError(t, state.EnsureConfigEntry(1, &structs.MeshConfigEntry{
+		AllowEnablingPermissiveMutualTLS: true,
+	}))
+	for i, e := range expected.Entries {
+		require.NoError(t, state.EnsureConfigEntry(uint64(i+2), e))
+	}
+
+	cases := []struct {
+		filter   string
+		expected []structs.ConfigEntry
+	}{
+		{
+			filter:   `MutualTLSMode == ""`,
+			expected: expected.Entries[0:1],
+		},
+		{
+			filter:   `MutualTLSMode == "strict"`,
+			expected: expected.Entries[1:2],
+		},
+		{
+			filter:   `MutualTLSMode == "permissive"`,
+			expected: expected.Entries[2:3],
+		},
+	}
+	for _, c := range cases {
+		c := c
+		t.Run(c.filter, func(t *testing.T) {
+			args := structs.ConfigEntryQuery{
+				Kind:       structs.ServiceDefaults,
+				Datacenter: "dc1",
+				QueryOptions: structs.QueryOptions{
+					Filter: c.filter,
+				},
+			}
+
+			var out structs.IndexedConfigEntries
+			require.NoError(t, msgpackrpc.CallWithCodec(codec, "ConfigEntry.List", &args, &out))
+			require.Equal(t, out.Entries, c.expected)
+		})
+	}
+}
+
+func TestConfigEntry_List_Filter_UnsupportedType(t *testing.T) {
+	if testing.Short() {
+		t.Skip("too slow for testing.Short")
+	}
+
+	t.Parallel()
+
+	dir1, s1 := testServer(t)
+	t.Cleanup(func() { os.RemoveAll(dir1) })
+	t.Cleanup(func() { s1.Shutdown() })
+	codec := rpcClient(t, s1)
+	t.Cleanup(func() { codec.Close() })
+
+	for _, kind := range []string{
+		// Only service-defaults is supported for now.
+		structs.ProxyDefaults,
+		structs.ServiceRouter,
+		structs.ServiceSplitter,
+		structs.ServiceResolver,
+		structs.IngressGateway,
+		structs.TerminatingGateway,
+		structs.ServiceIntentions,
+		structs.MeshConfig,
+		structs.ExportedServices,
+		structs.SamenessGroup,
+		structs.APIGateway,
+		structs.BoundAPIGateway,
+		structs.InlineCertificate,
+		structs.HTTPRoute,
+		structs.TCPRoute,
+		structs.JWTProvider,
+	} {
+		args := structs.ConfigEntryQuery{
+			Kind:       kind,
+			Datacenter: "dc1",
+			QueryOptions: structs.QueryOptions{
+				Filter: `X == "y"`,
+			},
+		}
+
+		var out structs.IndexedConfigEntries
+		err := msgpackrpc.CallWithCodec(codec, "ConfigEntry.List", &args, &out)
+		require.Error(t, err)
+		require.Equal(t, "filtering not supported for config entry kind="+kind, err.Error())
+	}
+
+}
+
 func TestConfigEntry_List_ACLDeny(t *testing.T) {
 	if testing.Short() {
 		t.Skip("too slow for testing.Short")
diff --git a/command/config/config.go b/command/config/config.go
index 65088cdf547a..e5fbe803a8dc 100644
--- a/command/config/config.go
+++ b/command/config/config.go
@@ -4,6 +4,7 @@
 package config
 
 import (
+	"github.com/hashicorp/consul/api"
 	"github.com/hashicorp/consul/command/flags"
 	"github.com/mitchellh/cli"
 )
@@ -52,3 +53,51 @@ Usage: consul config <subcommand> [options] [args]
 
   For more examples, ask for subcommand help or view the documentation.
 `
+
+const (
+	// TODO(pglass): These warnings can go away when the UI provides visibility into
+	// permissive mTLS settings (expected 1.17).
+	WarningServiceDefaultsPermissiveMTLS = "MutualTLSMode=permissive is insecure. " +
+		"Set to `strict` when your service no longer needs to accept non-mTLS " +
+		"traffic. Check `tcp.permissive_public_listener` metrics in Envoy for " +
+		"non-mTLS traffic. Refer to Consul documentation for more information."
+
+	WarningProxyDefaultsPermissiveMTLS = "MutualTLSMode=permissive is insecure. " +
+		"To keep your services secure, set MutualTLSMode to `strict` whenever possible " +
+		"and override with service-defaults only if necessary. To check which " +
+		"service-defaults are currently in permissive mode, run `consul config list " +
+		"-kind service-defaults -filter 'MutualTLSMode = \"permissive\"'`."
+
+	WarningMeshAllowEnablingPermissiveMutualTLS = "AllowEnablingPermissiveMutualTLS=true " +
+		"allows insecure MutualTLSMode=permissive configurations in the proxy-defaults " +
+		"and service-defaults config entries. You can set " +
+		"AllowEnablingPermissiveMutualTLS=false at any time to disallow additional " +
+		"permissive configurations. To list services in permissive mode, run `consul " +
+		"config list -kind service-defaults -filter 'MutualTLSMode = \"permissive\"'`."
+)
+
+// KindSpecificWriteWarning returns a warning message for the given config
+// entry write. Use this to inform the user of (un)recommended settings when
+// they read or write config entries with the CLI.
+//
+// Do not return a warning on default/zero values. Because the config
+// entry is parsed, we cannot distinguish between an absent field in the
+// user-provided content and a zero value, so we'd end up warning on
+// every invocation.
+func KindSpecificWriteWarning(reqEntry api.ConfigEntry) string {
+	switch req := reqEntry.(type) {
+	case *api.ServiceConfigEntry:
+		if req.MutualTLSMode == api.MutualTLSModePermissive {
+			return WarningServiceDefaultsPermissiveMTLS
+		}
+	case *api.ProxyConfigEntry:
+		if req.MutualTLSMode == api.MutualTLSModePermissive {
+			return WarningProxyDefaultsPermissiveMTLS
+		}
+	case *api.MeshConfigEntry:
+		if req.AllowEnablingPermissiveMutualTLS == true {
+			return WarningMeshAllowEnablingPermissiveMutualTLS
+		}
+	}
+	return ""
+}
diff --git a/command/config/list/config_list.go b/command/config/list/config_list.go
index 46b0980174ef..978804a19199 100644
--- a/command/config/list/config_list.go
+++ b/command/config/list/config_list.go
@@ -7,6 +7,7 @@ import (
 	"flag"
 	"fmt"
 
+	"github.com/hashicorp/consul/api"
 	"github.com/hashicorp/consul/command/flags"
 	"github.com/mitchellh/cli"
 )
@@ -23,12 +24,14 @@ type cmd struct {
 	http  *flags.HTTPFlags
 	help  string
 
-	kind string
+	kind   string
+	filter string
 }
 
 func (c *cmd) init() {
 	c.flags = flag.NewFlagSet("", flag.ContinueOnError)
 	c.flags.StringVar(&c.kind, "kind", "", "The kind of configurations to list.")
+	c.flags.StringVar(&c.filter, "filter", "", "Filter to use with the request.")
 	c.http = &flags.HTTPFlags{}
 	flags.Merge(c.flags, c.http.ClientFlags())
 	flags.Merge(c.flags, c.http.ServerFlags())
@@ -52,7 +55,9 @@ func (c *cmd) Run(args []string) int {
 		return 1
 	}
 
-	entries, _, err := client.ConfigEntries().List(c.kind, nil)
+	entries, _, err := client.ConfigEntries().List(c.kind, &api.QueryOptions{
+		Filter: c.filter,
+	})
 	if err != nil {
 		c.UI.Error(fmt.Sprintf("Error listing config entries for kind %q: %v", c.kind, err))
 		return 1
diff --git a/command/config/list/config_list_test.go b/command/config/list/config_list_test.go
index 79da797ed79c..bf188f51bd96 100644
--- a/command/config/list/config_list_test.go
+++ b/command/config/list/config_list_test.go
@@ -28,9 +28,6 @@ func TestConfigList(t *testing.T) {
 	defer a.Shutdown()
 	client := a.Client()
 
-	ui := cli.NewMockUi()
-	c := New(ui)
-
 	_, _, err := client.ConfigEntries().Set(&api.ServiceConfigEntry{
 		Kind:     api.ServiceDefaults,
 		Name:     "web",
@@ -48,21 +45,58 @@ func TestConfigList(t *testing.T) {
 	_, _, err = client.ConfigEntries().Set(&api.ServiceConfigEntry{
 		Kind:     api.ServiceDefaults,
 		Name:     "api",
-		Protocol: "tcp",
+		Protocol: "http",
 	}, nil)
 	require.NoError(t, err)
 
-	args := []string{
-		"-http-addr=" + a.HTTPAddr(),
-		"-kind=" + api.ServiceDefaults,
+	cases := map[string]struct {
+		args     []string
+		expected []string
+		errMsg   string
+	}{
+		"list service-defaults": {
+			args: []string{
+				"-http-addr=" + a.HTTPAddr(),
+				"-kind=" + api.ServiceDefaults,
+			},
+			expected: []string{"web", "foo", "api"},
+		},
+		"filter service-defaults": {
+			args: []string{
+				"-http-addr=" + a.HTTPAddr(),
+				"-kind=" + api.ServiceDefaults,
+				"-filter=" + `Protocol == "http"`,
+			},
+			expected: []string{"api"},
+		},
+		"filter unsupported kind": {
+			args: []string{
+				"-http-addr=" + a.HTTPAddr(),
+				"-kind=" + api.ProxyDefaults,
+				"-filter", `Mode == "transparent"`,
+			},
+			errMsg: "filtering not supported for config entry kind=proxy-defaults",
+		},
 	}
+	for name, c := range cases {
+		c := c
+		t.Run(name, func(t *testing.T) {
+			ui := cli.NewMockUi()
+			cmd := New(ui)
 
-	code := c.Run(args)
-	require.Equal(t, 0, code)
+			code := cmd.Run(c.args)
 
-	services := strings.Split(strings.Trim(ui.OutputWriter.String(), "\n"), "\n")
+			if c.errMsg == "" {
+				require.Equal(t, 0, code)
+				services := strings.Split(strings.Trim(ui.OutputWriter.String(), "\n"), "\n")
+				require.ElementsMatch(t, c.expected, services)
+			} else {
+				require.NotEqual(t, 0, code)
+				require.Contains(t, ui.ErrorWriter.String(), c.errMsg)
+			}
 
-	require.ElementsMatch(t, []string{"web", "foo", "api"}, services)
+		})
+	}
 }
 
 func TestConfigList_InvalidArgs(t *testing.T) {
diff --git a/command/config/write/config_write.go b/command/config/write/config_write.go
index 44e4b1311aad..d6a0c188b8fa 100644
--- a/command/config/write/config_write.go
+++ b/command/config/write/config_write.go
@@ -14,6 +14,7 @@ import (
 	"github.com/mitchellh/mapstructure"
 
 	"github.com/hashicorp/consul/api"
+	"github.com/hashicorp/consul/command/config"
 	"github.com/hashicorp/consul/command/flags"
 	"github.com/hashicorp/consul/command/helpers"
 	"github.com/hashicorp/consul/lib/decode"
@@ -100,6 +101,11 @@ func (c *cmd) Run(args []string) int {
 	}
 
 	c.UI.Info(fmt.Sprintf("Config entry written: %s/%s", entry.GetKind(), entry.GetName()))
+
+	if msg := config.KindSpecificWriteWarning(entry); msg != "" {
+		c.UI.Warn("WARNING: " + msg)
+	}
+
 	return 0
 }
 
diff --git a/command/config/write/config_write_test.go b/command/config/write/config_write_test.go
index cf8933106b32..3319084f4f21 100644
--- a/command/config/write/config_write_test.go
+++ b/command/config/write/config_write_test.go
@@ -14,6 +14,7 @@ import (
 
 	"github.com/hashicorp/consul/agent"
 	"github.com/hashicorp/consul/api"
+	"github.com/hashicorp/consul/command/config"
 	"github.com/hashicorp/consul/sdk/testutil"
 )
 
@@ -171,6 +172,97 @@ kind = "proxy-defaults"
 	})
 }
 
+func TestConfigWrite_Warning(t *testing.T) {
+	t.Parallel()
+
+	if testing.Short() {
+		t.Skip("too slow for testing.Short")
+	}
+
+	a := agent.NewTestAgent(t, ``)
+	defer a.Shutdown()
+	client := a.Client()
+
+	cases := map[string]struct {
+		entry   string
+		warning string
+	}{
+		"service-defaults no warning": {
+			entry: `
+				Kind = "service-defaults"
+				Name = "web"
+				MutualTLSMode = "strict"
+			`,
+		},
+		"proxy-defaults no warning": {
+			entry: `
+				Kind = "proxy-defaults"
+				Name = "global"
+				MutualTLSMode = "strict"
+			`,
+		},
+		"mesh config entry no warning": {
+			entry: `
+				Kind = "mesh"
+				AllowEnablingPermissiveMutualTLS = false
+			`,
+		},
+		"service-defaults warning on MutualTLSMode=permissive": {
+			entry: `
+				Kind = "service-defaults"
+				Name = "web"
+				MutualTLSMode = "permissive"
+			`,
+			warning: config.WarningServiceDefaultsPermissiveMTLS,
+		},
+		"proxy-defaults warning on MutualTLSMode=permissive": {
+			entry: `
+				Kind = "proxy-defaults"
+				Name = "global"
+				MutualTLSMode = "permissive"
+			`,
+			warning: config.WarningProxyDefaultsPermissiveMTLS,
+		},
+		"mesh config entry warning on AllowEnablingPermissiveMutualTLS=true": {
+			entry: `
+				Kind = "mesh"
+				AllowEnablingPermissiveMutualTLS = true
+			`,
+			warning: config.WarningMeshAllowEnablingPermissiveMutualTLS,
+		},
+	}
+	for name, c := range cases {
+		c := c
+		t.Run(name, func(t *testing.T) {
+			// Always reset this setting to avoid causing validation errors.
+			_, _, err := client.ConfigEntries().Set(&api.MeshConfigEntry{
+				AllowEnablingPermissiveMutualTLS: true,
+			}, nil)
+			require.NoError(t, err)
+
+			f := testutil.TempFile(t, "config-write-warning-*.hcl")
+			_, err = f.WriteString(c.entry)
+			require.NoError(t, err)
+
+			ui := cli.NewMockUi()
+			code := New(ui).Run([]string{
+				"-http-addr=" + a.HTTPAddr(),
+				f.Name(),
+			})
+
+			require.Equal(t, 0, code)
+			require.Contains(t, ui.OutputWriter.String(), `Config entry written`)
+
+			errMsg := ui.ErrorWriter.String()
+			if c.warning != "" {
+				require.Contains(t, errMsg, c.warning)
+			} else {
+				require.Empty(t, errMsg)
+			}
+		})
+	}
+}
+
 func requireContainsLower(t *testing.T, haystack, needle string) {
 	t.Helper()
 	require.Contains(t, strings.ToLower(haystack), strings.ToLower(needle))

From 2c0da88ce740bbe1dc6216f049296cda0ae4cc50 Mon Sep 17 00:00:00 2001
From: Eric Haberkorn <erichaberkorn@gmail.com>
Date: Fri, 28 Apr 2023 16:27:57 -0400
Subject: [PATCH 37/92] fix panic in `injectSANMatcher` when `tlsContext` is
 `nil` (#17185)

---
 .changelog/17185.txt  | 3 +++
 agent/xds/clusters.go | 4 ++++
 2 files changed, 7 insertions(+)
 create mode 100644 .changelog/17185.txt

diff --git a/.changelog/17185.txt b/.changelog/17185.txt
new file mode 100644
index 000000000000..cde123e2deb4
--- /dev/null
+++ b/.changelog/17185.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+xds: Fix possible panic that can when generating clusters before the root certificates have been fetched.
+```
diff --git a/agent/xds/clusters.go b/agent/xds/clusters.go
index d29d00a25646..35d31af9cc62 100644
--- a/agent/xds/clusters.go
+++ b/agent/xds/clusters.go
@@ -1427,6 +1427,10 @@ func (s *ResourceGenerator) makeExportedUpstreamClustersForMeshGateway(cfgSnap *
 
 // injectSANMatcher updates a TLS context so that it verifies the upstream SAN.
 func injectSANMatcher(tlsContext *envoy_tls_v3.CommonTlsContext, matchStrings ...string) error {
+	if tlsContext == nil {
+		return fmt.Errorf("invalid type: expected CommonTlsContext_ValidationContext not to be nil")
+	}
+
 	validationCtx, ok := tlsContext.ValidationContextType.(*envoy_tls_v3.CommonTlsContext_ValidationContext)
 	if !ok {
 		return fmt.Errorf("invalid type: expected CommonTlsContext_ValidationContext, got %T",

From 0fc4fc642942b71223b04cd958f801fbfeab00ac Mon Sep 17 00:00:00 2001
From: Freddy <freddygv@users.noreply.github.com>
Date: Fri, 28 Apr 2023 15:23:55 -0600
Subject: [PATCH 38/92] Revert "[CC-4519] Include Consul NodeID in Envoy
 bootstrap metadata" (#17191)

---
 command/connect/envoy/bootstrap_tpl.go                      | 4 ----
 command/connect/envoy/envoy.go                              | 6 ------
 command/connect/envoy/envoy_test.go                         | 1 -
 .../CONSUL_GRPC_ADDR-with-https-scheme-enables-tls.golden   | 1 -
 ...P_ADDR-with-https-scheme-does-not-affect-grpc-tls.golden | 1 -
 command/connect/envoy/testdata/access-log-path.golden       | 1 -
 .../envoy/testdata/access-logs-enabled-custom.golden        | 1 -
 command/connect/envoy/testdata/access-logs-enabled.golden   | 1 -
 command/connect/envoy/testdata/acl-enabled-and-token.golden | 1 -
 .../connect/envoy/testdata/acl-enabled-but-no-token.golden  | 1 -
 ...L_HTTP_ADDR-PLAIN-and-CONSUL_GRPC_ADDR-TLS-is-tls.golden | 1 -
 ...HTTP_ADDR-TLS-and-CONSUL_GRPC_ADDR-PLAIN-is-plain.golden | 1 -
 command/connect/envoy/testdata/defaults-nodemeta.golden     | 1 -
 command/connect/envoy/testdata/defaults.golden              | 1 -
 .../envoy/testdata/deprecated-grpc-addr-config.golden       | 1 -
 command/connect/envoy/testdata/envoy-readiness-probe.golden | 1 -
 command/connect/envoy/testdata/existing-ca-file.golden      | 1 -
 command/connect/envoy/testdata/existing-ca-path.golden      | 1 -
 command/connect/envoy/testdata/extra_-multiple.golden       | 1 -
 command/connect/envoy/testdata/extra_-single.golden         | 1 -
 command/connect/envoy/testdata/grpc-addr-env.golden         | 1 -
 command/connect/envoy/testdata/grpc-addr-flag.golden        | 1 -
 .../connect/envoy/testdata/grpc-addr-unix-with-tls.golden   | 1 -
 command/connect/envoy/testdata/grpc-addr-unix.golden        | 1 -
 command/connect/envoy/testdata/grpc-tls-addr-config.golden  | 1 -
 command/connect/envoy/testdata/hcp-metrics.golden           | 1 -
 .../envoy/testdata/ingress-gateway-address-specified.golden | 1 -
 .../envoy/testdata/ingress-gateway-no-auto-register.golden  | 1 -
 .../connect/envoy/testdata/ingress-gateway-nodemeta.golden  | 1 -
 ...ngress-gateway-register-with-service-and-proxy-id.golden | 1 -
 ...ss-gateway-register-with-service-without-proxy-id.golden | 1 -
 command/connect/envoy/testdata/ingress-gateway.golden       | 1 -
 .../envoy/testdata/prometheus-metrics-tls-ca-file.golden    | 1 -
 .../envoy/testdata/prometheus-metrics-tls-ca-path.golden    | 1 -
 command/connect/envoy/testdata/prometheus-metrics.golden    | 1 -
 command/connect/envoy/testdata/stats-config-override.golden | 1 -
 command/connect/envoy/testdata/token-arg.golden             | 1 -
 command/connect/envoy/testdata/token-env.golden             | 1 -
 command/connect/envoy/testdata/token-file-arg.golden        | 1 -
 command/connect/envoy/testdata/token-file-env.golden        | 1 -
 command/connect/envoy/testdata/xds-addr-config.golden       | 1 -
 command/connect/envoy/testdata/zipkin-tracing-config.golden | 1 -
 42 files changed, 50 deletions(-)

diff --git a/command/connect/envoy/bootstrap_tpl.go b/command/connect/envoy/bootstrap_tpl.go
index 9cce86c6b9b5..78d88f9b1d11 100644
--- a/command/connect/envoy/bootstrap_tpl.go
+++ b/command/connect/envoy/bootstrap_tpl.go
@@ -17,9 +17,6 @@ type BootstrapTplArgs struct {
 	// the agent to deliver the correct configuration.
 	ProxyID string
 
-	// NodeID is the ID of the node on which the proxy service instance is registered.
-	NodeID string
-
 	// NodeName is the name of the node on which the proxy service instance is registered.
 	NodeName string
 
@@ -187,7 +184,6 @@ const bootstrapTemplate = `{
       {{- if .NodeName }}
       "node_name": "{{ .NodeName }}",
       {{- end }}
-      "node_id": "{{ .NodeID }}",
       "namespace": "{{if ne .Namespace ""}}{{ .Namespace }}{{else}}default{{end}}",
       "partition": "{{if ne .Partition ""}}{{ .Partition }}{{else}}default{{end}}"
     }
diff --git a/command/connect/envoy/envoy.go b/command/connect/envoy/envoy.go
index 06f5963e098f..4c1ff6b80a19 100644
--- a/command/connect/envoy/envoy.go
+++ b/command/connect/envoy/envoy.go
@@ -722,12 +722,6 @@ func (c *cmd) generateConfig() ([]byte, error) {
 		args.Datacenter = datacenter
 	}
 
-	info, err := c.client.Agent().Self()
-	if err != nil {
-		return nil, err
-	}
-	args.NodeID, _ = info["Config"]["NodeID"].(string)
-
 	if err := generateAccessLogs(c, args); err != nil {
 		return nil, err
 	}
diff --git a/command/connect/envoy/envoy_test.go b/command/connect/envoy/envoy_test.go
index f655a2e906c1..ebfc30631173 100644
--- a/command/connect/envoy/envoy_test.go
+++ b/command/connect/envoy/envoy_test.go
@@ -1691,7 +1691,6 @@ func testMockAgentSelf(
 		resp := agent.Self{
 			Config: map[string]interface{}{
 				"Datacenter": "dc1",
-				"NodeID":     "7cbef9fc-4fb1-4c84-b100-689db9755449",
 			},
 		}
 
diff --git a/command/connect/envoy/testdata/CONSUL_GRPC_ADDR-with-https-scheme-enables-tls.golden b/command/connect/envoy/testdata/CONSUL_GRPC_ADDR-with-https-scheme-enables-tls.golden
index 22680a5eb78e..a8ba4704f5e3 100644
--- a/command/connect/envoy/testdata/CONSUL_GRPC_ADDR-with-https-scheme-enables-tls.golden
+++ b/command/connect/envoy/testdata/CONSUL_GRPC_ADDR-with-https-scheme-enables-tls.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/CONSUL_HTTP_ADDR-with-https-scheme-does-not-affect-grpc-tls.golden b/command/connect/envoy/testdata/CONSUL_HTTP_ADDR-with-https-scheme-does-not-affect-grpc-tls.golden
index bac5b1d0f6af..5485256b4f99 100644
--- a/command/connect/envoy/testdata/CONSUL_HTTP_ADDR-with-https-scheme-does-not-affect-grpc-tls.golden
+++ b/command/connect/envoy/testdata/CONSUL_HTTP_ADDR-with-https-scheme-does-not-affect-grpc-tls.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/access-log-path.golden b/command/connect/envoy/testdata/access-log-path.golden
index f25ab92cf50e..18a28a491e86 100644
--- a/command/connect/envoy/testdata/access-log-path.golden
+++ b/command/connect/envoy/testdata/access-log-path.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/access-logs-enabled-custom.golden b/command/connect/envoy/testdata/access-logs-enabled-custom.golden
index 1f42d1450ece..6af720bdaccb 100644
--- a/command/connect/envoy/testdata/access-logs-enabled-custom.golden
+++ b/command/connect/envoy/testdata/access-logs-enabled-custom.golden
@@ -25,7 +25,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/access-logs-enabled.golden b/command/connect/envoy/testdata/access-logs-enabled.golden
index 2a1a40947dd0..892cf46324b4 100644
--- a/command/connect/envoy/testdata/access-logs-enabled.golden
+++ b/command/connect/envoy/testdata/access-logs-enabled.golden
@@ -47,7 +47,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/acl-enabled-and-token.golden b/command/connect/envoy/testdata/acl-enabled-and-token.golden
index 5694e08e1efa..3342f0390471 100644
--- a/command/connect/envoy/testdata/acl-enabled-and-token.golden
+++ b/command/connect/envoy/testdata/acl-enabled-and-token.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/acl-enabled-but-no-token.golden b/command/connect/envoy/testdata/acl-enabled-but-no-token.golden
index bac5b1d0f6af..5485256b4f99 100644
--- a/command/connect/envoy/testdata/acl-enabled-but-no-token.golden
+++ b/command/connect/envoy/testdata/acl-enabled-but-no-token.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-PLAIN-and-CONSUL_GRPC_ADDR-TLS-is-tls.golden b/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-PLAIN-and-CONSUL_GRPC_ADDR-TLS-is-tls.golden
index 22680a5eb78e..a8ba4704f5e3 100644
--- a/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-PLAIN-and-CONSUL_GRPC_ADDR-TLS-is-tls.golden
+++ b/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-PLAIN-and-CONSUL_GRPC_ADDR-TLS-is-tls.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-TLS-and-CONSUL_GRPC_ADDR-PLAIN-is-plain.golden b/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-TLS-and-CONSUL_GRPC_ADDR-PLAIN-is-plain.golden
index bac5b1d0f6af..5485256b4f99 100644
--- a/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-TLS-and-CONSUL_GRPC_ADDR-PLAIN-is-plain.golden
+++ b/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-TLS-and-CONSUL_GRPC_ADDR-PLAIN-is-plain.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/defaults-nodemeta.golden b/command/connect/envoy/testdata/defaults-nodemeta.golden
index 3371495e81b0..41788c3c42e4 100644
--- a/command/connect/envoy/testdata/defaults-nodemeta.golden
+++ b/command/connect/envoy/testdata/defaults-nodemeta.golden
@@ -13,7 +13,6 @@
     "id": "test-proxy",
     "metadata": {
       "node_name": "test-node",
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/defaults.golden b/command/connect/envoy/testdata/defaults.golden
index bac5b1d0f6af..5485256b4f99 100644
--- a/command/connect/envoy/testdata/defaults.golden
+++ b/command/connect/envoy/testdata/defaults.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/deprecated-grpc-addr-config.golden b/command/connect/envoy/testdata/deprecated-grpc-addr-config.golden
index 303950c696db..ab87aa9b438f 100644
--- a/command/connect/envoy/testdata/deprecated-grpc-addr-config.golden
+++ b/command/connect/envoy/testdata/deprecated-grpc-addr-config.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/envoy-readiness-probe.golden b/command/connect/envoy/testdata/envoy-readiness-probe.golden
index 799d93afb0ec..444528e8808e 100644
--- a/command/connect/envoy/testdata/envoy-readiness-probe.golden
+++ b/command/connect/envoy/testdata/envoy-readiness-probe.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/existing-ca-file.golden b/command/connect/envoy/testdata/existing-ca-file.golden
index 22680a5eb78e..a8ba4704f5e3 100644
--- a/command/connect/envoy/testdata/existing-ca-file.golden
+++ b/command/connect/envoy/testdata/existing-ca-file.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/existing-ca-path.golden b/command/connect/envoy/testdata/existing-ca-path.golden
index b82331d4e765..e246dbb324eb 100644
--- a/command/connect/envoy/testdata/existing-ca-path.golden
+++ b/command/connect/envoy/testdata/existing-ca-path.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/extra_-multiple.golden b/command/connect/envoy/testdata/extra_-multiple.golden
index 84306e6ce715..038e65d8d9fb 100644
--- a/command/connect/envoy/testdata/extra_-multiple.golden
+++ b/command/connect/envoy/testdata/extra_-multiple.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/extra_-single.golden b/command/connect/envoy/testdata/extra_-single.golden
index 84dcb8081c7c..14b8f0820500 100644
--- a/command/connect/envoy/testdata/extra_-single.golden
+++ b/command/connect/envoy/testdata/extra_-single.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/grpc-addr-env.golden b/command/connect/envoy/testdata/grpc-addr-env.golden
index 303950c696db..ab87aa9b438f 100644
--- a/command/connect/envoy/testdata/grpc-addr-env.golden
+++ b/command/connect/envoy/testdata/grpc-addr-env.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/grpc-addr-flag.golden b/command/connect/envoy/testdata/grpc-addr-flag.golden
index 303950c696db..ab87aa9b438f 100644
--- a/command/connect/envoy/testdata/grpc-addr-flag.golden
+++ b/command/connect/envoy/testdata/grpc-addr-flag.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/grpc-addr-unix-with-tls.golden b/command/connect/envoy/testdata/grpc-addr-unix-with-tls.golden
index 118a98d1167c..89764c310a47 100644
--- a/command/connect/envoy/testdata/grpc-addr-unix-with-tls.golden
+++ b/command/connect/envoy/testdata/grpc-addr-unix-with-tls.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/grpc-addr-unix.golden b/command/connect/envoy/testdata/grpc-addr-unix.golden
index 41e515b69d01..eb8841ae993f 100644
--- a/command/connect/envoy/testdata/grpc-addr-unix.golden
+++ b/command/connect/envoy/testdata/grpc-addr-unix.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/grpc-tls-addr-config.golden b/command/connect/envoy/testdata/grpc-tls-addr-config.golden
index 1de20dd5d215..e79cf0455d2b 100644
--- a/command/connect/envoy/testdata/grpc-tls-addr-config.golden
+++ b/command/connect/envoy/testdata/grpc-tls-addr-config.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/hcp-metrics.golden b/command/connect/envoy/testdata/hcp-metrics.golden
index dbae64eecf67..563d662e4436 100644
--- a/command/connect/envoy/testdata/hcp-metrics.golden
+++ b/command/connect/envoy/testdata/hcp-metrics.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/ingress-gateway-address-specified.golden b/command/connect/envoy/testdata/ingress-gateway-address-specified.golden
index ecbf44d3fa70..cc2e504eaf95 100644
--- a/command/connect/envoy/testdata/ingress-gateway-address-specified.golden
+++ b/command/connect/envoy/testdata/ingress-gateway-address-specified.golden
@@ -12,7 +12,6 @@
     "cluster": "ingress-gateway",
     "id": "ingress-gateway",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/ingress-gateway-no-auto-register.golden b/command/connect/envoy/testdata/ingress-gateway-no-auto-register.golden
index d0a9bfe53945..cddaa490dd2c 100644
--- a/command/connect/envoy/testdata/ingress-gateway-no-auto-register.golden
+++ b/command/connect/envoy/testdata/ingress-gateway-no-auto-register.golden
@@ -12,7 +12,6 @@
     "cluster": "ingress-gateway",
     "id": "ingress-gateway",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/ingress-gateway-nodemeta.golden b/command/connect/envoy/testdata/ingress-gateway-nodemeta.golden
index 484d926982ff..d79739ed7280 100644
--- a/command/connect/envoy/testdata/ingress-gateway-nodemeta.golden
+++ b/command/connect/envoy/testdata/ingress-gateway-nodemeta.golden
@@ -13,7 +13,6 @@
     "id": "ingress-gateway-1",
     "metadata": {
       "node_name": "test-node",
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/ingress-gateway-register-with-service-and-proxy-id.golden b/command/connect/envoy/testdata/ingress-gateway-register-with-service-and-proxy-id.golden
index 72b6bdae73ae..3149fc4b33a5 100644
--- a/command/connect/envoy/testdata/ingress-gateway-register-with-service-and-proxy-id.golden
+++ b/command/connect/envoy/testdata/ingress-gateway-register-with-service-and-proxy-id.golden
@@ -12,7 +12,6 @@
     "cluster": "my-gateway-123",
     "id": "my-gateway-123",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/ingress-gateway-register-with-service-without-proxy-id.golden b/command/connect/envoy/testdata/ingress-gateway-register-with-service-without-proxy-id.golden
index a2dd34310f6f..f8eb44754117 100644
--- a/command/connect/envoy/testdata/ingress-gateway-register-with-service-without-proxy-id.golden
+++ b/command/connect/envoy/testdata/ingress-gateway-register-with-service-without-proxy-id.golden
@@ -12,7 +12,6 @@
     "cluster": "my-gateway",
     "id": "my-gateway",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/ingress-gateway.golden b/command/connect/envoy/testdata/ingress-gateway.golden
index 102a1dfaaeb3..c4fba520ed99 100644
--- a/command/connect/envoy/testdata/ingress-gateway.golden
+++ b/command/connect/envoy/testdata/ingress-gateway.golden
@@ -12,7 +12,6 @@
     "cluster": "ingress-gateway-1",
     "id": "ingress-gateway-1",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/prometheus-metrics-tls-ca-file.golden b/command/connect/envoy/testdata/prometheus-metrics-tls-ca-file.golden
index 077745bf5333..71b82250e30d 100644
--- a/command/connect/envoy/testdata/prometheus-metrics-tls-ca-file.golden
+++ b/command/connect/envoy/testdata/prometheus-metrics-tls-ca-file.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/prometheus-metrics-tls-ca-path.golden b/command/connect/envoy/testdata/prometheus-metrics-tls-ca-path.golden
index f1683a870a49..07e56ae878a7 100644
--- a/command/connect/envoy/testdata/prometheus-metrics-tls-ca-path.golden
+++ b/command/connect/envoy/testdata/prometheus-metrics-tls-ca-path.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/prometheus-metrics.golden b/command/connect/envoy/testdata/prometheus-metrics.golden
index 4276c54ca563..5adc8a9485ee 100644
--- a/command/connect/envoy/testdata/prometheus-metrics.golden
+++ b/command/connect/envoy/testdata/prometheus-metrics.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/stats-config-override.golden b/command/connect/envoy/testdata/stats-config-override.golden
index 0409b321b8e8..d2a2371f20ea 100644
--- a/command/connect/envoy/testdata/stats-config-override.golden
+++ b/command/connect/envoy/testdata/stats-config-override.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/token-arg.golden b/command/connect/envoy/testdata/token-arg.golden
index 7f83eff98424..ac057e9a60b1 100644
--- a/command/connect/envoy/testdata/token-arg.golden
+++ b/command/connect/envoy/testdata/token-arg.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/token-env.golden b/command/connect/envoy/testdata/token-env.golden
index 7f83eff98424..ac057e9a60b1 100644
--- a/command/connect/envoy/testdata/token-env.golden
+++ b/command/connect/envoy/testdata/token-env.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/token-file-arg.golden b/command/connect/envoy/testdata/token-file-arg.golden
index 7f83eff98424..ac057e9a60b1 100644
--- a/command/connect/envoy/testdata/token-file-arg.golden
+++ b/command/connect/envoy/testdata/token-file-arg.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/token-file-env.golden b/command/connect/envoy/testdata/token-file-env.golden
index 7f83eff98424..ac057e9a60b1 100644
--- a/command/connect/envoy/testdata/token-file-env.golden
+++ b/command/connect/envoy/testdata/token-file-env.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/xds-addr-config.golden b/command/connect/envoy/testdata/xds-addr-config.golden
index 303950c696db..ab87aa9b438f 100644
--- a/command/connect/envoy/testdata/xds-addr-config.golden
+++ b/command/connect/envoy/testdata/xds-addr-config.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }
diff --git a/command/connect/envoy/testdata/zipkin-tracing-config.golden b/command/connect/envoy/testdata/zipkin-tracing-config.golden
index 7fa56c330157..fd52f5ae3f57 100644
--- a/command/connect/envoy/testdata/zipkin-tracing-config.golden
+++ b/command/connect/envoy/testdata/zipkin-tracing-config.golden
@@ -12,7 +12,6 @@
     "cluster": "test",
     "id": "test-proxy",
     "metadata": {
-      "node_id": "7cbef9fc-4fb1-4c84-b100-689db9755449",
       "namespace": "default",
       "partition": "default"
     }

From ef5d54fd4cca8c2d64506308a3ed6a82955f4470 Mon Sep 17 00:00:00 2001
From: Poonam Jadhav <poonam.jadhav@hashicorp.com>
Date: Fri, 28 Apr 2023 20:07:03 -0400
Subject: [PATCH 39/92] feat: add no-op reporting background routine (#17178)

---
 agent/consul/reporting/reporting.go     | 24 +++++++++++++++++++-----
 agent/consul/reporting/reporting_oss.go |  8 ++++++++
 agent/consul/server.go                  |  3 ++-
 3 files changed, 29 insertions(+), 6 deletions(-)

diff --git a/agent/consul/reporting/reporting.go b/agent/consul/reporting/reporting.go
index a136cbef5451..fec7050f695b 100644
--- a/agent/consul/reporting/reporting.go
+++ b/agent/consul/reporting/reporting.go
@@ -5,19 +5,26 @@ package reporting
 
 import (
 	"sync"
+	"time"
 
+	"github.com/hashicorp/consul/agent/consul/state"
+	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-memdb"
 )
 
 type ReportingManager struct {
-	logger hclog.Logger
-	server ServerDelegate
+	logger         hclog.Logger
+	server         ServerDelegate
+	stateProvider  StateDelegate
+	tickerInterval time.Duration
 	EntDeps
 	sync.RWMutex
 }
 
 const (
 	SystemMetadataReportingProcessID = "reporting-process-id"
+	ReportingInterval                = 1 * time.Hour
 )
 
 //go:generate mockery --name ServerDelegate --inpackage
@@ -27,10 +34,17 @@ type ServerDelegate interface {
 	IsLeader() bool
 }
 
-func NewReportingManager(logger hclog.Logger, deps EntDeps, server ServerDelegate) *ReportingManager {
+type StateDelegate interface {
+	NodeUsage() (uint64, state.NodeUsage, error)
+	ServiceUsage(ws memdb.WatchSet) (uint64, structs.ServiceUsage, error)
+}
+
+func NewReportingManager(logger hclog.Logger, deps EntDeps, server ServerDelegate, stateProvider StateDelegate) *ReportingManager {
 	rm := &ReportingManager{
-		logger: logger.Named("reporting"),
-		server: server,
+		logger:         logger.Named("reporting"),
+		server:         server,
+		stateProvider:  stateProvider,
+		tickerInterval: ReportingInterval,
 	}
 	err := rm.initEnterpriseReporting(deps)
 	if err != nil {
diff --git a/agent/consul/reporting/reporting_oss.go b/agent/consul/reporting/reporting_oss.go
index d12254f6cfe3..a1e95a177416 100644
--- a/agent/consul/reporting/reporting_oss.go
+++ b/agent/consul/reporting/reporting_oss.go
@@ -6,6 +6,10 @@
 
 package reporting
 
+import (
+	"context"
+)
+
 type EntDeps struct{}
 
 func (rm *ReportingManager) initEnterpriseReporting(entDeps EntDeps) error {
@@ -22,3 +26,7 @@ func (rm *ReportingManager) StopReportingAgent() error {
 	// no op
 	return nil
 }
+
+func (m *ReportingManager) Run(ctx context.Context) {
+	// no op
+}
diff --git a/agent/consul/server.go b/agent/consul/server.go
index e5140fcc2a3a..1f3476c92a3e 100644
--- a/agent/consul/server.go
+++ b/agent/consul/server.go
@@ -769,7 +769,8 @@ func NewServer(config *Config, flat Deps, externalGRPCServer *grpc.Server, incom
 	s.overviewManager = NewOverviewManager(s.logger, s.fsm, s.config.MetricsReportingInterval)
 	go s.overviewManager.Run(&lib.StopChannelContext{StopCh: s.shutdownCh})
 
-	s.reportingManager = reporting.NewReportingManager(s.logger, getEnterpriseReportingDeps(flat), s)
+	s.reportingManager = reporting.NewReportingManager(s.logger, getEnterpriseReportingDeps(flat), s, s.fsm.State())
+	go s.reportingManager.Run(&lib.StopChannelContext{StopCh: s.shutdownCh})
 
 	// Initialize external gRPC server
 	s.setupExternalGRPC(config, logger)

From 90fc9bd9e5935ea79425276d8fe768db084601d6 Mon Sep 17 00:00:00 2001
From: Eddie Rowe <74205376+eddie-rowe@users.noreply.github.com>
Date: Mon, 1 May 2023 09:24:52 -0500
Subject: [PATCH 40/92] Fix broken lightstep link (#17201)

---
 website/content/docs/integrate/partnerships.mdx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/website/content/docs/integrate/partnerships.mdx b/website/content/docs/integrate/partnerships.mdx
index 34bcfe2631fe..9f2334af7916 100644
--- a/website/content/docs/integrate/partnerships.mdx
+++ b/website/content/docs/integrate/partnerships.mdx
@@ -99,7 +99,7 @@ Here are links to resources, documentation, examples and best practices to guide
 
 - [Splunk SignalFX OpenTelemetry integration with Consul](https://docs.splunk.com/Observability/gdi/consul/consul.html)
 - [Ship HashiCorp Consul metrics with OpenTelemetry to Logz.io](https://docs.logz.io/shipping/prometheus-sources/consul.html)
-- [Ingest Consul metrics through OpenTelemetry into Lightstep Observability](https://docs.lightstep.com/docs/ingest-metrics-consul)
+- [Ingest Consul metrics through OpenTelemetry into Lightstep Observability](https://docs.lightstep.com/integrations/ingest-metrics-consul)
 
 **Logging and Alerts**
 

From bdef22354bb62fb4455e87ca99b5bc7554bbc5b8 Mon Sep 17 00:00:00 2001
From: Nathan Coleman <nathan.coleman@hashicorp.com>
Date: Tue, 2 May 2023 16:23:42 -0400
Subject: [PATCH 41/92] Use auth context when evaluating service read
 permissions (#17207)

Co-authored-by: Blake Covarrubias <1812+blake@users.noreply.github.com>
---
 agent/proxycfg-glue/resolved_service_config.go | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/agent/proxycfg-glue/resolved_service_config.go b/agent/proxycfg-glue/resolved_service_config.go
index 7289db090d5c..89611bbc0711 100644
--- a/agent/proxycfg-glue/resolved_service_config.go
+++ b/agent/proxycfg-glue/resolved_service_config.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/hashicorp/go-memdb"
 
+	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/agent/cache"
 	cachetype "github.com/hashicorp/consul/agent/cache-types"
 	"github.com/hashicorp/consul/agent/configentry"
@@ -41,12 +42,13 @@ func (s *serverResolvedServiceConfig) Notify(ctx context.Context, req *structs.S
 
 	return watch.ServerLocalNotify(ctx, correlationID, s.deps.GetStore,
 		func(ws memdb.WatchSet, store Store) (uint64, *structs.ServiceConfigResponse, error) {
-			authz, err := s.deps.ACLResolver.ResolveTokenAndDefaultMeta(req.Token, &req.EnterpriseMeta, nil)
+			var authzContext acl.AuthorizerContext
+			authz, err := s.deps.ACLResolver.ResolveTokenAndDefaultMeta(req.Token, &req.EnterpriseMeta, &authzContext)
 			if err != nil {
 				return 0, nil, err
 			}
 
-			if err := authz.ToAllowAuthorizer().ServiceReadAllowed(req.Name, nil); err != nil {
+			if err := authz.ToAllowAuthorizer().ServiceReadAllowed(req.Name, &authzContext); err != nil {
 				return 0, nil, err
 			}
 

From bd76fdeaeb469b107a97e5ffd944816e6b30e531 Mon Sep 17 00:00:00 2001
From: John Eikenberry <jae@zhar.net>
Date: Wed, 3 May 2023 20:30:37 +0000
Subject: [PATCH 42/92] enable auto-tidy expired issuers in vault (as CA)

When using vault as a CA and generating the local signing cert, try to
enable the PKI endpoint's auto-tidy feature with it set to tidy expired
issuers.
---
 .changelog/17138.txt                    |  4 +++
 agent/connect/ca/provider_vault.go      | 36 ++++++++++++++++++++++
 agent/connect/ca/provider_vault_test.go | 41 +++++++++++++++++++++++++
 agent/connect/ca/testing.go             |  2 ++
 4 files changed, 83 insertions(+)
 create mode 100644 .changelog/17138.txt

diff --git a/.changelog/17138.txt b/.changelog/17138.txt
new file mode 100644
index 000000000000..63843690b0e3
--- /dev/null
+++ b/.changelog/17138.txt
@@ -0,0 +1,4 @@
+```release-note:improvement
+ca: automatically set up Vault's auto-tidy setting for tidy_expired_issuers when using Vault as a CA provider.
+```
+
diff --git a/agent/connect/ca/provider_vault.go b/agent/connect/ca/provider_vault.go
index 9bb8f40a04bc..00a598d92dea 100644
--- a/agent/connect/ca/provider_vault.go
+++ b/agent/connect/ca/provider_vault.go
@@ -438,6 +438,9 @@ func (v *VaultProvider) setupIntermediatePKIPath() error {
 		"require_cn":       false,
 	})
 
+	// enable auto-tidy with tidy_expired_issuers
+	v.autotidyIssuers(v.config.IntermediatePKIPath)
+
 	return err
 }
 
@@ -864,6 +867,39 @@ func (v *VaultProvider) setNamespace(namespace string) func() {
 	}
 }
 
+// autotidyIssuers sets Vault's auto-tidy to remove expired issuers
+// Returns a boolean on success for testing (as there is no post-facto way of
+// checking if it is set). Logs at info level on failure to set and why,
+// returning the log message for test purposes as well.
+func (v *VaultProvider) autotidyIssuers(path string) (bool, string) {
+	s, err := v.client.Logical().Write(path+"/config/auto-tidy",
+		map[string]interface{}{
+			"enabled":              true,
+			"tidy_expired_issuers": true,
+		})
+	var errStr string
+	if err != nil {
+		errStr = err.Error()
+		switch {
+		case strings.Contains(errStr, "404"):
+			errStr = "vault versions < 1.12 don't support auto-tidy"
+		case strings.Contains(errStr, "400"):
+			errStr = "vault versions < 1.13 don't support the tidy_expired_issuers field"
+		case strings.Contains(errStr, "403"):
+			errStr = "permission denied on auto-tidy path in vault"
+		}
+		v.logger.Info("Unable to enable Vault's auto-tidy feature for expired issuers", "reason", errStr, "path", path)
+	}
+	// return values for tests
+	tidySet := false
+	if s != nil {
+		if tei, ok := s.Data["tidy_expired_issuers"]; ok {
+			tidySet, _ = tei.(bool)
+		}
+	}
+	return tidySet, errStr
+}
+
 func ParseVaultCAConfig(raw map[string]interface{}) (*structs.VaultCAProviderConfig, error) {
 	config := structs.VaultCAProviderConfig{
 		CommonCAProviderConfig: defaultCommonConfig(),
diff --git a/agent/connect/ca/provider_vault_test.go b/agent/connect/ca/provider_vault_test.go
index 31932b030be8..b0e341fe91ee 100644
--- a/agent/connect/ca/provider_vault_test.go
+++ b/agent/connect/ca/provider_vault_test.go
@@ -8,6 +8,8 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"strconv"
+	"strings"
 	"sync/atomic"
 	"testing"
 	"time"
@@ -1143,6 +1145,45 @@ func TestVaultCAProvider_GenerateIntermediate(t *testing.T) {
 	require.NotEqual(t, orig, new)
 }
 
+func TestVaultCAProvider_AutoTidyExpiredIssuers(t *testing.T) {
+	SkipIfVaultNotPresent(t)
+	t.Parallel()
+
+	testVault := NewTestVaultServer(t)
+	attr := &VaultTokenAttributes{
+		RootPath:         "pki-root",
+		IntermediatePath: "pki-intermediate",
+		ConsulManaged:    true,
+	}
+	token := CreateVaultTokenWithAttrs(t, testVault.client, attr)
+	provider := createVaultProvider(t, true, testVault.Addr, token,
+		map[string]any{
+			"RootPKIPath":         "pki-root/",
+			"IntermediatePKIPath": "pki-intermediate/",
+		})
+
+	version := strings.Split(vaultTestVersion, ".")
+	require.Len(t, version, 3)
+	minorVersion, err := strconv.Atoi(version[1])
+	require.NoError(t, err)
+	expIssSet, errStr := provider.autotidyIssuers("pki-intermediate/")
+	switch {
+	case minorVersion <= 11:
+		require.False(t, expIssSet)
+		require.Contains(t, errStr, "auto-tidy")
+	case minorVersion == 12:
+		require.False(t, expIssSet)
+		require.Contains(t, errStr, "tidy_expired_issuers")
+	default: // Consul 1.13+
+		require.True(t, expIssSet)
+	}
+
+	// check permission denied
+	expIssSet, errStr = provider.autotidyIssuers("pki-bad/")
+	require.False(t, expIssSet)
+	require.Contains(t, errStr, "permission denied")
+}
+
 func TestVaultCAProvider_GenerateIntermediate_inSecondary(t *testing.T) {
 	SkipIfVaultNotPresent(t)
 
diff --git a/agent/connect/ca/testing.go b/agent/connect/ca/testing.go
index cfe4697d7066..d7458bcda8d6 100644
--- a/agent/connect/ca/testing.go
+++ b/agent/connect/ca/testing.go
@@ -184,6 +184,7 @@ type TestVaultServer struct {
 }
 
 var printedVaultVersion sync.Once
+var vaultTestVersion string
 
 func (v *TestVaultServer) Client() *vaultapi.Client {
 	return v.client
@@ -205,6 +206,7 @@ func (v *TestVaultServer) WaitUntilReady(t testing.T) {
 		version = resp.Version
 	})
 	printedVaultVersion.Do(func() {
+		vaultTestVersion = version
 		fmt.Fprintf(os.Stderr, "[INFO] agent/connect/ca: testing with vault server version: %s\n", version)
 	})
 }

From 4715a86358d57d24b48cd86e68eb6f84c643888d Mon Sep 17 00:00:00 2001
From: Matt Keeler <mkeeler@users.noreply.github.com>
Date: Fri, 5 May 2023 09:47:28 -0400
Subject: [PATCH 43/92] Initial Catalog & Mesh Protobuf Definitions (#17123)

---
 .../pbcatalog/v1alpha1/dns.pb.binary.go       |   28 +
 proto-public/pbcatalog/v1alpha1/dns.pb.go     |  259 ++++
 proto-public/pbcatalog/v1alpha1/dns.proto     |   18 +
 .../pbcatalog/v1alpha1/health.pb.binary.go    |   98 ++
 proto-public/pbcatalog/v1alpha1/health.pb.go  | 1050 +++++++++++++++++
 proto-public/pbcatalog/v1alpha1/health.proto  |   81 ++
 .../pbcatalog/v1alpha1/node.pb.binary.go      |   28 +
 proto-public/pbcatalog/v1alpha1/node.pb.go    |  244 ++++
 proto-public/pbcatalog/v1alpha1/node.proto    |   19 +
 .../pbcatalog/v1alpha1/protocol.pb.go         |  166 +++
 .../pbcatalog/v1alpha1/protocol.proto         |   17 +
 .../pbcatalog/v1alpha1/selector.pb.binary.go  |   18 +
 .../pbcatalog/v1alpha1/selector.pb.go         |  177 +++
 .../pbcatalog/v1alpha1/selector.proto         |   12 +
 .../pbcatalog/v1alpha1/service.pb.binary.go   |   28 +
 proto-public/pbcatalog/v1alpha1/service.pb.go |  301 +++++
 proto-public/pbcatalog/v1alpha1/service.proto |   36 +
 .../v1alpha1/service_endpoints.pb.binary.go   |   28 +
 .../v1alpha1/service_endpoints.pb.go          |  308 +++++
 .../v1alpha1/service_endpoints.proto          |   32 +
 .../pbcatalog/v1alpha1/vip.pb.binary.go       |   28 +
 proto-public/pbcatalog/v1alpha1/vip.pb.go     |  244 ++++
 proto-public/pbcatalog/v1alpha1/vip.proto     |   20 +
 .../pbcatalog/v1alpha1/workload.pb.binary.go  |   48 +
 .../pbcatalog/v1alpha1/workload.pb.go         |  520 ++++++++
 .../pbcatalog/v1alpha1/workload.proto         |   66 ++
 .../pbmesh/v1alpha1/connection.pb.binary.go   |   28 +
 proto-public/pbmesh/v1alpha1/connection.pb.go |  316 +++++
 proto-public/pbmesh/v1alpha1/connection.proto |   22 +
 .../pbmesh/v1alpha1/expose.pb.binary.go       |   28 +
 proto-public/pbmesh/v1alpha1/expose.pb.go     |  269 +++++
 proto-public/pbmesh/v1alpha1/expose.proto     |   19 +
 .../pbmesh/v1alpha1/proxy.pb.binary.go        |   48 +
 proto-public/pbmesh/v1alpha1/proxy.pb.go      |  816 +++++++++++++
 proto-public/pbmesh/v1alpha1/proxy.proto      |  104 ++
 proto-public/pbmesh/v1alpha1/routing.pb.go    |  181 +++
 proto-public/pbmesh/v1alpha1/routing.proto    |   36 +
 .../pbmesh/v1alpha1/upstreams.pb.binary.go    |   88 ++
 proto-public/pbmesh/v1alpha1/upstreams.pb.go  |  997 ++++++++++++++++
 proto-public/pbmesh/v1alpha1/upstreams.proto  |  100 ++
 40 files changed, 6926 insertions(+)
 create mode 100644 proto-public/pbcatalog/v1alpha1/dns.pb.binary.go
 create mode 100644 proto-public/pbcatalog/v1alpha1/dns.pb.go
 create mode 100644 proto-public/pbcatalog/v1alpha1/dns.proto
 create mode 100644 proto-public/pbcatalog/v1alpha1/health.pb.binary.go
 create mode 100644 proto-public/pbcatalog/v1alpha1/health.pb.go
 create mode 100644 proto-public/pbcatalog/v1alpha1/health.proto
 create mode 100644 proto-public/pbcatalog/v1alpha1/node.pb.binary.go
 create mode 100644 proto-public/pbcatalog/v1alpha1/node.pb.go
 create mode 100644 proto-public/pbcatalog/v1alpha1/node.proto
 create mode 100644 proto-public/pbcatalog/v1alpha1/protocol.pb.go
 create mode 100644 proto-public/pbcatalog/v1alpha1/protocol.proto
 create mode 100644 proto-public/pbcatalog/v1alpha1/selector.pb.binary.go
 create mode 100644 proto-public/pbcatalog/v1alpha1/selector.pb.go
 create mode 100644 proto-public/pbcatalog/v1alpha1/selector.proto
 create mode 100644 proto-public/pbcatalog/v1alpha1/service.pb.binary.go
 create mode 100644 proto-public/pbcatalog/v1alpha1/service.pb.go
 create mode 100644 proto-public/pbcatalog/v1alpha1/service.proto
 create mode 100644 proto-public/pbcatalog/v1alpha1/service_endpoints.pb.binary.go
 create mode 100644 proto-public/pbcatalog/v1alpha1/service_endpoints.pb.go
 create mode 100644 proto-public/pbcatalog/v1alpha1/service_endpoints.proto
 create mode 100644 proto-public/pbcatalog/v1alpha1/vip.pb.binary.go
 create mode 100644 proto-public/pbcatalog/v1alpha1/vip.pb.go
 create mode 100644 proto-public/pbcatalog/v1alpha1/vip.proto
 create mode 100644 proto-public/pbcatalog/v1alpha1/workload.pb.binary.go
 create mode 100644 proto-public/pbcatalog/v1alpha1/workload.pb.go
 create mode 100644 proto-public/pbcatalog/v1alpha1/workload.proto
 create mode 100644 proto-public/pbmesh/v1alpha1/connection.pb.binary.go
 create mode 100644 proto-public/pbmesh/v1alpha1/connection.pb.go
 create mode 100644 proto-public/pbmesh/v1alpha1/connection.proto
 create mode 100644 proto-public/pbmesh/v1alpha1/expose.pb.binary.go
 create mode 100644 proto-public/pbmesh/v1alpha1/expose.pb.go
 create mode 100644 proto-public/pbmesh/v1alpha1/expose.proto
 create mode 100644 proto-public/pbmesh/v1alpha1/proxy.pb.binary.go
 create mode 100644 proto-public/pbmesh/v1alpha1/proxy.pb.go
 create mode 100644 proto-public/pbmesh/v1alpha1/proxy.proto
 create mode 100644 proto-public/pbmesh/v1alpha1/routing.pb.go
 create mode 100644 proto-public/pbmesh/v1alpha1/routing.proto
 create mode 100644 proto-public/pbmesh/v1alpha1/upstreams.pb.binary.go
 create mode 100644 proto-public/pbmesh/v1alpha1/upstreams.pb.go
 create mode 100644 proto-public/pbmesh/v1alpha1/upstreams.proto

diff --git a/proto-public/pbcatalog/v1alpha1/dns.pb.binary.go b/proto-public/pbcatalog/v1alpha1/dns.pb.binary.go
new file mode 100644
index 000000000000..21c190584f9a
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/dns.pb.binary.go
@@ -0,0 +1,28 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbcatalog/v1alpha1/dns.proto
+
+package catalogv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *DNSPolicy) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *DNSPolicy) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *Weights) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *Weights) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
diff --git a/proto-public/pbcatalog/v1alpha1/dns.pb.go b/proto-public/pbcatalog/v1alpha1/dns.pb.go
new file mode 100644
index 000000000000..1c66131ef7d8
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/dns.pb.go
@@ -0,0 +1,259 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: pbcatalog/v1alpha1/dns.proto
+
+package catalogv1alpha1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type DNSPolicy struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Workloads *WorkloadSelector `protobuf:"bytes,1,opt,name=workloads,proto3" json:"workloads,omitempty"`
+	Weights   *Weights          `protobuf:"bytes,2,opt,name=weights,proto3" json:"weights,omitempty"`
+}
+
+func (x *DNSPolicy) Reset() {
+	*x = DNSPolicy{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_dns_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DNSPolicy) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DNSPolicy) ProtoMessage() {}
+
+func (x *DNSPolicy) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_dns_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DNSPolicy.ProtoReflect.Descriptor instead.
+func (*DNSPolicy) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_dns_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *DNSPolicy) GetWorkloads() *WorkloadSelector {
+	if x != nil {
+		return x.Workloads
+	}
+	return nil
+}
+
+func (x *DNSPolicy) GetWeights() *Weights {
+	if x != nil {
+		return x.Weights
+	}
+	return nil
+}
+
+type Weights struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Passing uint32 `protobuf:"varint,1,opt,name=passing,proto3" json:"passing,omitempty"`
+	Warning uint32 `protobuf:"varint,2,opt,name=warning,proto3" json:"warning,omitempty"`
+}
+
+func (x *Weights) Reset() {
+	*x = Weights{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_dns_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Weights) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Weights) ProtoMessage() {}
+
+func (x *Weights) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_dns_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Weights.ProtoReflect.Descriptor instead.
+func (*Weights) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_dns_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *Weights) GetPassing() uint32 {
+	if x != nil {
+		return x.Passing
+	}
+	return 0
+}
+
+func (x *Weights) GetWarning() uint32 {
+	if x != nil {
+		return x.Warning
+	}
+	return 0
+}
+
+var File_pbcatalog_v1alpha1_dns_proto protoreflect.FileDescriptor
+
+var file_pbcatalog_v1alpha1_dns_proto_rawDesc = []byte{
+	0x0a, 0x1c, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x2f, 0x64, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x21,
+	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x1a, 0x21, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x22, 0xa4, 0x01, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x50, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x12, 0x51, 0x0a, 0x09, 0x77, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x73, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x33, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67,
+	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x6c, 0x6f,
+	0x61, 0x64, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x52, 0x09, 0x77, 0x6f, 0x72, 0x6b,
+	0x6c, 0x6f, 0x61, 0x64, 0x73, 0x12, 0x44, 0x0a, 0x07, 0x77, 0x65, 0x69, 0x67, 0x68, 0x74, 0x73,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f,
+	0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x57, 0x65, 0x69, 0x67, 0x68,
+	0x74, 0x73, 0x52, 0x07, 0x77, 0x65, 0x69, 0x67, 0x68, 0x74, 0x73, 0x22, 0x3d, 0x0a, 0x07, 0x57,
+	0x65, 0x69, 0x67, 0x68, 0x74, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x61, 0x73, 0x73, 0x69, 0x6e,
+	0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x70, 0x61, 0x73, 0x73, 0x69, 0x6e, 0x67,
+	0x12, 0x18, 0x0a, 0x07, 0x77, 0x61, 0x72, 0x6e, 0x69, 0x6e, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0d, 0x52, 0x07, 0x77, 0x61, 0x72, 0x6e, 0x69, 0x6e, 0x67, 0x42, 0xa5, 0x02, 0x0a, 0x25, 0x63,
+	0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x42, 0x08, 0x44, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01,
+	0x5a, 0x4b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62, 0x63, 0x61, 0x74,
+	0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x3b, 0x63, 0x61,
+	0x74, 0x61, 0x6c, 0x6f, 0x67, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xa2, 0x02, 0x03,
+	0x48, 0x43, 0x43, 0xaa, 0x02, 0x21, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
+	0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x56,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xca, 0x02, 0x21, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x43, 0x61, 0x74, 0x61, 0x6c,
+	0x6f, 0x67, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xe2, 0x02, 0x2d, 0x48, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x43,
+	0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x5c,
+	0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x24, 0x48, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a,
+	0x3a, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x3a, 0x3a, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_pbcatalog_v1alpha1_dns_proto_rawDescOnce sync.Once
+	file_pbcatalog_v1alpha1_dns_proto_rawDescData = file_pbcatalog_v1alpha1_dns_proto_rawDesc
+)
+
+func file_pbcatalog_v1alpha1_dns_proto_rawDescGZIP() []byte {
+	file_pbcatalog_v1alpha1_dns_proto_rawDescOnce.Do(func() {
+		file_pbcatalog_v1alpha1_dns_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbcatalog_v1alpha1_dns_proto_rawDescData)
+	})
+	return file_pbcatalog_v1alpha1_dns_proto_rawDescData
+}
+
+var file_pbcatalog_v1alpha1_dns_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_pbcatalog_v1alpha1_dns_proto_goTypes = []interface{}{
+	(*DNSPolicy)(nil),        // 0: hashicorp.consul.catalog.v1alpha1.DNSPolicy
+	(*Weights)(nil),          // 1: hashicorp.consul.catalog.v1alpha1.Weights
+	(*WorkloadSelector)(nil), // 2: hashicorp.consul.catalog.v1alpha1.WorkloadSelector
+}
+var file_pbcatalog_v1alpha1_dns_proto_depIdxs = []int32{
+	2, // 0: hashicorp.consul.catalog.v1alpha1.DNSPolicy.workloads:type_name -> hashicorp.consul.catalog.v1alpha1.WorkloadSelector
+	1, // 1: hashicorp.consul.catalog.v1alpha1.DNSPolicy.weights:type_name -> hashicorp.consul.catalog.v1alpha1.Weights
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_pbcatalog_v1alpha1_dns_proto_init() }
+func file_pbcatalog_v1alpha1_dns_proto_init() {
+	if File_pbcatalog_v1alpha1_dns_proto != nil {
+		return
+	}
+	file_pbcatalog_v1alpha1_selector_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_pbcatalog_v1alpha1_dns_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DNSPolicy); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbcatalog_v1alpha1_dns_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Weights); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbcatalog_v1alpha1_dns_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbcatalog_v1alpha1_dns_proto_goTypes,
+		DependencyIndexes: file_pbcatalog_v1alpha1_dns_proto_depIdxs,
+		MessageInfos:      file_pbcatalog_v1alpha1_dns_proto_msgTypes,
+	}.Build()
+	File_pbcatalog_v1alpha1_dns_proto = out.File
+	file_pbcatalog_v1alpha1_dns_proto_rawDesc = nil
+	file_pbcatalog_v1alpha1_dns_proto_goTypes = nil
+	file_pbcatalog_v1alpha1_dns_proto_depIdxs = nil
+}
diff --git a/proto-public/pbcatalog/v1alpha1/dns.proto b/proto-public/pbcatalog/v1alpha1/dns.proto
new file mode 100644
index 000000000000..35ca336b11fd
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/dns.proto
@@ -0,0 +1,18 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.catalog.v1alpha1;
+
+import "pbcatalog/v1alpha1/selector.proto";
+
+message DNSPolicy {
+  WorkloadSelector workloads = 1;
+  Weights weights = 2;
+}
+
+message Weights {
+  uint32 passing = 1;
+  uint32 warning = 2;
+}
diff --git a/proto-public/pbcatalog/v1alpha1/health.pb.binary.go b/proto-public/pbcatalog/v1alpha1/health.pb.binary.go
new file mode 100644
index 000000000000..9953a0e71633
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/health.pb.binary.go
@@ -0,0 +1,98 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbcatalog/v1alpha1/health.proto
+
+package catalogv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *HealthStatus) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *HealthStatus) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *HealthChecks) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *HealthChecks) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *HealthCheck) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *HealthCheck) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *HTTPCheck) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *HTTPCheck) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *TCPCheck) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *TCPCheck) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *UDPCheck) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *UDPCheck) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *GRPCCheck) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *GRPCCheck) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *OSServiceCheck) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *OSServiceCheck) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *CheckTLSConfig) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *CheckTLSConfig) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
diff --git a/proto-public/pbcatalog/v1alpha1/health.pb.go b/proto-public/pbcatalog/v1alpha1/health.pb.go
new file mode 100644
index 000000000000..01bc1ea6a66c
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/health.pb.go
@@ -0,0 +1,1050 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: pbcatalog/v1alpha1/health.proto
+
+package catalogv1alpha1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	durationpb "google.golang.org/protobuf/types/known/durationpb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type Health int32
+
+const (
+	// buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
+	Health_HEALTH_ANY         Health = 0
+	Health_HEALTH_PASSING     Health = 1
+	Health_HEALTH_WARNING     Health = 2
+	Health_HEALTH_CRITICAL    Health = 3
+	Health_HEALTH_MAINTENANCE Health = 4
+)
+
+// Enum value maps for Health.
+var (
+	Health_name = map[int32]string{
+		0: "HEALTH_ANY",
+		1: "HEALTH_PASSING",
+		2: "HEALTH_WARNING",
+		3: "HEALTH_CRITICAL",
+		4: "HEALTH_MAINTENANCE",
+	}
+	Health_value = map[string]int32{
+		"HEALTH_ANY":         0,
+		"HEALTH_PASSING":     1,
+		"HEALTH_WARNING":     2,
+		"HEALTH_CRITICAL":    3,
+		"HEALTH_MAINTENANCE": 4,
+	}
+)
+
+func (x Health) Enum() *Health {
+	p := new(Health)
+	*p = x
+	return p
+}
+
+func (x Health) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Health) Descriptor() protoreflect.EnumDescriptor {
+	return file_pbcatalog_v1alpha1_health_proto_enumTypes[0].Descriptor()
+}
+
+func (Health) Type() protoreflect.EnumType {
+	return &file_pbcatalog_v1alpha1_health_proto_enumTypes[0]
+}
+
+func (x Health) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Health.Descriptor instead.
+func (Health) EnumDescriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_health_proto_rawDescGZIP(), []int{0}
+}
+
+// This resource will belong to a workload or a node and will have an ownership relationship.
+type HealthStatus struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Type is the type of this health check, such as http, tcp, or kubernetes-readiness
+	Type string `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
+	// Health is the status. This maps to existing health check statuses.
+	Status Health `protobuf:"varint,2,opt,name=status,proto3,enum=hashicorp.consul.catalog.v1alpha1.Health" json:"status,omitempty"`
+	// Description is the description for this status.
+	Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
+	// Output is the output from running the check that resulted in this status
+	Output string `protobuf:"bytes,4,opt,name=output,proto3" json:"output,omitempty"`
+}
+
+func (x *HealthStatus) Reset() {
+	*x = HealthStatus{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_health_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HealthStatus) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HealthStatus) ProtoMessage() {}
+
+func (x *HealthStatus) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_health_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HealthStatus.ProtoReflect.Descriptor instead.
+func (*HealthStatus) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_health_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *HealthStatus) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
+func (x *HealthStatus) GetStatus() Health {
+	if x != nil {
+		return x.Status
+	}
+	return Health_HEALTH_ANY
+}
+
+func (x *HealthStatus) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+func (x *HealthStatus) GetOutput() string {
+	if x != nil {
+		return x.Output
+	}
+	return ""
+}
+
+type HealthChecks struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Workloads    *WorkloadSelector `protobuf:"bytes,1,opt,name=workloads,proto3" json:"workloads,omitempty"`
+	HealthChecks []*HealthCheck    `protobuf:"bytes,2,rep,name=health_checks,json=healthChecks,proto3" json:"health_checks,omitempty"`
+}
+
+func (x *HealthChecks) Reset() {
+	*x = HealthChecks{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_health_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HealthChecks) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HealthChecks) ProtoMessage() {}
+
+func (x *HealthChecks) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_health_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HealthChecks.ProtoReflect.Descriptor instead.
+func (*HealthChecks) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_health_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *HealthChecks) GetWorkloads() *WorkloadSelector {
+	if x != nil {
+		return x.Workloads
+	}
+	return nil
+}
+
+func (x *HealthChecks) GetHealthChecks() []*HealthCheck {
+	if x != nil {
+		return x.HealthChecks
+	}
+	return nil
+}
+
+type HealthCheck struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Types that are assignable to Definition:
+	//
+	//	*HealthCheck_Http
+	//	*HealthCheck_Tcp
+	//	*HealthCheck_Udp
+	//	*HealthCheck_Grpc
+	//	*HealthCheck_OsService
+	Definition              isHealthCheck_Definition `protobuf_oneof:"definition"`
+	Interval                *durationpb.Duration     `protobuf:"bytes,7,opt,name=interval,proto3" json:"interval,omitempty"`
+	Timeout                 *durationpb.Duration     `protobuf:"bytes,8,opt,name=timeout,proto3" json:"timeout,omitempty"`
+	DeregisterCriticalAfter *durationpb.Duration     `protobuf:"bytes,9,opt,name=deregister_critical_after,json=deregisterCriticalAfter,proto3" json:"deregister_critical_after,omitempty"`
+}
+
+func (x *HealthCheck) Reset() {
+	*x = HealthCheck{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_health_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HealthCheck) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HealthCheck) ProtoMessage() {}
+
+func (x *HealthCheck) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_health_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HealthCheck.ProtoReflect.Descriptor instead.
+func (*HealthCheck) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_health_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *HealthCheck) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (m *HealthCheck) GetDefinition() isHealthCheck_Definition {
+	if m != nil {
+		return m.Definition
+	}
+	return nil
+}
+
+func (x *HealthCheck) GetHttp() *HTTPCheck {
+	if x, ok := x.GetDefinition().(*HealthCheck_Http); ok {
+		return x.Http
+	}
+	return nil
+}
+
+func (x *HealthCheck) GetTcp() *TCPCheck {
+	if x, ok := x.GetDefinition().(*HealthCheck_Tcp); ok {
+		return x.Tcp
+	}
+	return nil
+}
+
+func (x *HealthCheck) GetUdp() *UDPCheck {
+	if x, ok := x.GetDefinition().(*HealthCheck_Udp); ok {
+		return x.Udp
+	}
+	return nil
+}
+
+func (x *HealthCheck) GetGrpc() *GRPCCheck {
+	if x, ok := x.GetDefinition().(*HealthCheck_Grpc); ok {
+		return x.Grpc
+	}
+	return nil
+}
+
+func (x *HealthCheck) GetOsService() *OSServiceCheck {
+	if x, ok := x.GetDefinition().(*HealthCheck_OsService); ok {
+		return x.OsService
+	}
+	return nil
+}
+
+func (x *HealthCheck) GetInterval() *durationpb.Duration {
+	if x != nil {
+		return x.Interval
+	}
+	return nil
+}
+
+func (x *HealthCheck) GetTimeout() *durationpb.Duration {
+	if x != nil {
+		return x.Timeout
+	}
+	return nil
+}
+
+func (x *HealthCheck) GetDeregisterCriticalAfter() *durationpb.Duration {
+	if x != nil {
+		return x.DeregisterCriticalAfter
+	}
+	return nil
+}
+
+type isHealthCheck_Definition interface {
+	isHealthCheck_Definition()
+}
+
+type HealthCheck_Http struct {
+	Http *HTTPCheck `protobuf:"bytes,2,opt,name=http,proto3,oneof"`
+}
+
+type HealthCheck_Tcp struct {
+	Tcp *TCPCheck `protobuf:"bytes,3,opt,name=tcp,proto3,oneof"`
+}
+
+type HealthCheck_Udp struct {
+	Udp *UDPCheck `protobuf:"bytes,4,opt,name=udp,proto3,oneof"`
+}
+
+type HealthCheck_Grpc struct {
+	Grpc *GRPCCheck `protobuf:"bytes,5,opt,name=grpc,proto3,oneof"`
+}
+
+type HealthCheck_OsService struct {
+	OsService *OSServiceCheck `protobuf:"bytes,6,opt,name=os_service,json=osService,proto3,oneof"`
+}
+
+func (*HealthCheck_Http) isHealthCheck_Definition() {}
+
+func (*HealthCheck_Tcp) isHealthCheck_Definition() {}
+
+func (*HealthCheck_Udp) isHealthCheck_Definition() {}
+
+func (*HealthCheck_Grpc) isHealthCheck_Definition() {}
+
+func (*HealthCheck_OsService) isHealthCheck_Definition() {}
+
+type HTTPCheck struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Url              string            `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
+	Header           map[string]string `protobuf:"bytes,2,rep,name=header,proto3" json:"header,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	Method           string            `protobuf:"bytes,3,opt,name=method,proto3" json:"method,omitempty"`
+	Body             string            `protobuf:"bytes,4,opt,name=body,proto3" json:"body,omitempty"`
+	DisableRedirects bool              `protobuf:"varint,5,opt,name=disable_redirects,json=disableRedirects,proto3" json:"disable_redirects,omitempty"`
+	Tls              *CheckTLSConfig   `protobuf:"bytes,6,opt,name=tls,proto3" json:"tls,omitempty"`
+}
+
+func (x *HTTPCheck) Reset() {
+	*x = HTTPCheck{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_health_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPCheck) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPCheck) ProtoMessage() {}
+
+func (x *HTTPCheck) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_health_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPCheck.ProtoReflect.Descriptor instead.
+func (*HTTPCheck) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_health_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *HTTPCheck) GetUrl() string {
+	if x != nil {
+		return x.Url
+	}
+	return ""
+}
+
+func (x *HTTPCheck) GetHeader() map[string]string {
+	if x != nil {
+		return x.Header
+	}
+	return nil
+}
+
+func (x *HTTPCheck) GetMethod() string {
+	if x != nil {
+		return x.Method
+	}
+	return ""
+}
+
+func (x *HTTPCheck) GetBody() string {
+	if x != nil {
+		return x.Body
+	}
+	return ""
+}
+
+func (x *HTTPCheck) GetDisableRedirects() bool {
+	if x != nil {
+		return x.DisableRedirects
+	}
+	return false
+}
+
+func (x *HTTPCheck) GetTls() *CheckTLSConfig {
+	if x != nil {
+		return x.Tls
+	}
+	return nil
+}
+
+type TCPCheck struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Address string `protobuf:"bytes,1,opt,name=address,proto3" json:"address,omitempty"`
+}
+
+func (x *TCPCheck) Reset() {
+	*x = TCPCheck{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_health_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TCPCheck) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TCPCheck) ProtoMessage() {}
+
+func (x *TCPCheck) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_health_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TCPCheck.ProtoReflect.Descriptor instead.
+func (*TCPCheck) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_health_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *TCPCheck) GetAddress() string {
+	if x != nil {
+		return x.Address
+	}
+	return ""
+}
+
+type UDPCheck struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Address string `protobuf:"bytes,1,opt,name=address,proto3" json:"address,omitempty"`
+}
+
+func (x *UDPCheck) Reset() {
+	*x = UDPCheck{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_health_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UDPCheck) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UDPCheck) ProtoMessage() {}
+
+func (x *UDPCheck) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_health_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UDPCheck.ProtoReflect.Descriptor instead.
+func (*UDPCheck) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_health_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *UDPCheck) GetAddress() string {
+	if x != nil {
+		return x.Address
+	}
+	return ""
+}
+
+type GRPCCheck struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Address string          `protobuf:"bytes,1,opt,name=address,proto3" json:"address,omitempty"`
+	Tls     *CheckTLSConfig `protobuf:"bytes,2,opt,name=tls,proto3" json:"tls,omitempty"`
+}
+
+func (x *GRPCCheck) Reset() {
+	*x = GRPCCheck{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_health_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GRPCCheck) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GRPCCheck) ProtoMessage() {}
+
+func (x *GRPCCheck) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_health_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GRPCCheck.ProtoReflect.Descriptor instead.
+func (*GRPCCheck) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_health_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *GRPCCheck) GetAddress() string {
+	if x != nil {
+		return x.Address
+	}
+	return ""
+}
+
+func (x *GRPCCheck) GetTls() *CheckTLSConfig {
+	if x != nil {
+		return x.Tls
+	}
+	return nil
+}
+
+type OSServiceCheck struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Address string `protobuf:"bytes,1,opt,name=address,proto3" json:"address,omitempty"`
+}
+
+func (x *OSServiceCheck) Reset() {
+	*x = OSServiceCheck{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_health_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *OSServiceCheck) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*OSServiceCheck) ProtoMessage() {}
+
+func (x *OSServiceCheck) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_health_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use OSServiceCheck.ProtoReflect.Descriptor instead.
+func (*OSServiceCheck) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_health_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *OSServiceCheck) GetAddress() string {
+	if x != nil {
+		return x.Address
+	}
+	return ""
+}
+
+type CheckTLSConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	TlsServerName string `protobuf:"bytes,1,opt,name=tls_server_name,json=tlsServerName,proto3" json:"tls_server_name,omitempty"`
+	TlsSkipVerify bool   `protobuf:"varint,2,opt,name=tls_skip_verify,json=tlsSkipVerify,proto3" json:"tls_skip_verify,omitempty"`
+	UseTls        bool   `protobuf:"varint,3,opt,name=use_tls,json=useTls,proto3" json:"use_tls,omitempty"`
+}
+
+func (x *CheckTLSConfig) Reset() {
+	*x = CheckTLSConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_health_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CheckTLSConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckTLSConfig) ProtoMessage() {}
+
+func (x *CheckTLSConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_health_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckTLSConfig.ProtoReflect.Descriptor instead.
+func (*CheckTLSConfig) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_health_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *CheckTLSConfig) GetTlsServerName() string {
+	if x != nil {
+		return x.TlsServerName
+	}
+	return ""
+}
+
+func (x *CheckTLSConfig) GetTlsSkipVerify() bool {
+	if x != nil {
+		return x.TlsSkipVerify
+	}
+	return false
+}
+
+func (x *CheckTLSConfig) GetUseTls() bool {
+	if x != nil {
+		return x.UseTls
+	}
+	return false
+}
+
+var File_pbcatalog_v1alpha1_health_proto protoreflect.FileDescriptor
+
+var file_pbcatalog_v1alpha1_health_proto_rawDesc = []byte{
+	0x0a, 0x1f, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x2f, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x12, 0x21, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x21, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f,
+	0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x9f, 0x01, 0x0a, 0x0c, 0x48, 0x65, 0x61, 0x6c,
+	0x74, 0x68, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x41, 0x0a, 0x06,
+	0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x29, 0x2e, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
+	0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0x2e, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12,
+	0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x12, 0x16, 0x0a, 0x06, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x06, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x22, 0xb6, 0x01, 0x0a, 0x0c, 0x48, 0x65,
+	0x61, 0x6c, 0x74, 0x68, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x12, 0x51, 0x0a, 0x09, 0x77, 0x6f,
+	0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x33, 0x2e,
+	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74,
+	0x6f, 0x72, 0x52, 0x09, 0x77, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x73, 0x12, 0x53, 0x0a,
+	0x0d, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x5f, 0x63, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x18, 0x02,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43,
+	0x68, 0x65, 0x63, 0x6b, 0x52, 0x0c, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43, 0x68, 0x65, 0x63,
+	0x6b, 0x73, 0x22, 0xd0, 0x04, 0x0a, 0x0b, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43, 0x68, 0x65,
+	0x63, 0x6b, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x42, 0x0a, 0x04, 0x68, 0x74, 0x74, 0x70, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x43, 0x68, 0x65,
+	0x63, 0x6b, 0x48, 0x00, 0x52, 0x04, 0x68, 0x74, 0x74, 0x70, 0x12, 0x3f, 0x0a, 0x03, 0x74, 0x63,
+	0x70, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c,
+	0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x54, 0x43, 0x50, 0x43,
+	0x68, 0x65, 0x63, 0x6b, 0x48, 0x00, 0x52, 0x03, 0x74, 0x63, 0x70, 0x12, 0x3f, 0x0a, 0x03, 0x75,
+	0x64, 0x70, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
+	0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61,
+	0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x55, 0x44, 0x50,
+	0x43, 0x68, 0x65, 0x63, 0x6b, 0x48, 0x00, 0x52, 0x03, 0x75, 0x64, 0x70, 0x12, 0x42, 0x0a, 0x04,
+	0x67, 0x72, 0x70, 0x63, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61,
+	0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x47,
+	0x52, 0x50, 0x43, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x48, 0x00, 0x52, 0x04, 0x67, 0x72, 0x70, 0x63,
+	0x12, 0x52, 0x0a, 0x0a, 0x6f, 0x73, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x18, 0x06,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x31, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x4f, 0x53, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x48, 0x00, 0x52, 0x09, 0x6f, 0x73, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x12, 0x35, 0x0a, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c,
+	0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x52, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12, 0x33, 0x0a, 0x07, 0x74,
+	0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44,
+	0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x07, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74,
+	0x12, 0x55, 0x0a, 0x19, 0x64, 0x65, 0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x63,
+	0x72, 0x69, 0x74, 0x69, 0x63, 0x61, 0x6c, 0x5f, 0x61, 0x66, 0x74, 0x65, 0x72, 0x18, 0x09, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x17,
+	0x64, 0x65, 0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x43, 0x72, 0x69, 0x74, 0x69, 0x63,
+	0x61, 0x6c, 0x41, 0x66, 0x74, 0x65, 0x72, 0x42, 0x0c, 0x0a, 0x0a, 0x64, 0x65, 0x66, 0x69, 0x6e,
+	0x69, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0xc8, 0x02, 0x0a, 0x09, 0x48, 0x54, 0x54, 0x50, 0x43, 0x68,
+	0x65, 0x63, 0x6b, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x50, 0x0a, 0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x18,
+	0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67,
+	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x43, 0x68,
+	0x65, 0x63, 0x6b, 0x2e, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
+	0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f,
+	0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12,
+	0x12, 0x0a, 0x04, 0x62, 0x6f, 0x64, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x62,
+	0x6f, 0x64, 0x79, 0x12, 0x2b, 0x0a, 0x11, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x72,
+	0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10,
+	0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x73,
+	0x12, 0x43, 0x0a, 0x03, 0x74, 0x6c, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x31, 0x2e,
+	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2e, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x54, 0x4c, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x52, 0x03, 0x74, 0x6c, 0x73, 0x1a, 0x39, 0x0a, 0x0b, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x45,
+	0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01,
+	0x22, 0x24, 0x0a, 0x08, 0x54, 0x43, 0x50, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x12, 0x18, 0x0a, 0x07,
+	0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61,
+	0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x22, 0x24, 0x0a, 0x08, 0x55, 0x44, 0x50, 0x43, 0x68, 0x65,
+	0x63, 0x6b, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x22, 0x6a, 0x0a, 0x09,
+	0x47, 0x52, 0x50, 0x43, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64,
+	0x72, 0x65, 0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72,
+	0x65, 0x73, 0x73, 0x12, 0x43, 0x0a, 0x03, 0x74, 0x6c, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x31, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x2e, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x54, 0x4c, 0x53, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x52, 0x03, 0x74, 0x6c, 0x73, 0x22, 0x2a, 0x0a, 0x0e, 0x4f, 0x53, 0x53, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64,
+	0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64,
+	0x72, 0x65, 0x73, 0x73, 0x22, 0x79, 0x0a, 0x0e, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x54, 0x4c, 0x53,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x26, 0x0a, 0x0f, 0x74, 0x6c, 0x73, 0x5f, 0x73, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0d, 0x74, 0x6c, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x26,
+	0x0a, 0x0f, 0x74, 0x6c, 0x73, 0x5f, 0x73, 0x6b, 0x69, 0x70, 0x5f, 0x76, 0x65, 0x72, 0x69, 0x66,
+	0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x74, 0x6c, 0x73, 0x53, 0x6b, 0x69, 0x70,
+	0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x5f, 0x74, 0x6c,
+	0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x75, 0x73, 0x65, 0x54, 0x6c, 0x73, 0x2a,
+	0x6d, 0x0a, 0x06, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x12, 0x0e, 0x0a, 0x0a, 0x48, 0x45, 0x41,
+	0x4c, 0x54, 0x48, 0x5f, 0x41, 0x4e, 0x59, 0x10, 0x00, 0x12, 0x12, 0x0a, 0x0e, 0x48, 0x45, 0x41,
+	0x4c, 0x54, 0x48, 0x5f, 0x50, 0x41, 0x53, 0x53, 0x49, 0x4e, 0x47, 0x10, 0x01, 0x12, 0x12, 0x0a,
+	0x0e, 0x48, 0x45, 0x41, 0x4c, 0x54, 0x48, 0x5f, 0x57, 0x41, 0x52, 0x4e, 0x49, 0x4e, 0x47, 0x10,
+	0x02, 0x12, 0x13, 0x0a, 0x0f, 0x48, 0x45, 0x41, 0x4c, 0x54, 0x48, 0x5f, 0x43, 0x52, 0x49, 0x54,
+	0x49, 0x43, 0x41, 0x4c, 0x10, 0x03, 0x12, 0x16, 0x0a, 0x12, 0x48, 0x45, 0x41, 0x4c, 0x54, 0x48,
+	0x5f, 0x4d, 0x41, 0x49, 0x4e, 0x54, 0x45, 0x4e, 0x41, 0x4e, 0x43, 0x45, 0x10, 0x04, 0x42, 0xa8,
+	0x02, 0x0a, 0x25, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x42, 0x0b, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68,
+	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x4b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
+	0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69,
+	0x63, 0x2f, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x3b, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0xa2, 0x02, 0x03, 0x48, 0x43, 0x43, 0xaa, 0x02, 0x21, 0x48, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x43, 0x61,
+	0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xca, 0x02,
+	0x21, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x5c, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0xe2, 0x02, 0x2d, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x5c, 0x56, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0xea, 0x02, 0x24, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a,
+	0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x3a,
+	0x3a, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
+}
+
+var (
+	file_pbcatalog_v1alpha1_health_proto_rawDescOnce sync.Once
+	file_pbcatalog_v1alpha1_health_proto_rawDescData = file_pbcatalog_v1alpha1_health_proto_rawDesc
+)
+
+func file_pbcatalog_v1alpha1_health_proto_rawDescGZIP() []byte {
+	file_pbcatalog_v1alpha1_health_proto_rawDescOnce.Do(func() {
+		file_pbcatalog_v1alpha1_health_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbcatalog_v1alpha1_health_proto_rawDescData)
+	})
+	return file_pbcatalog_v1alpha1_health_proto_rawDescData
+}
+
+var file_pbcatalog_v1alpha1_health_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_pbcatalog_v1alpha1_health_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
+var file_pbcatalog_v1alpha1_health_proto_goTypes = []interface{}{
+	(Health)(0),                 // 0: hashicorp.consul.catalog.v1alpha1.Health
+	(*HealthStatus)(nil),        // 1: hashicorp.consul.catalog.v1alpha1.HealthStatus
+	(*HealthChecks)(nil),        // 2: hashicorp.consul.catalog.v1alpha1.HealthChecks
+	(*HealthCheck)(nil),         // 3: hashicorp.consul.catalog.v1alpha1.HealthCheck
+	(*HTTPCheck)(nil),           // 4: hashicorp.consul.catalog.v1alpha1.HTTPCheck
+	(*TCPCheck)(nil),            // 5: hashicorp.consul.catalog.v1alpha1.TCPCheck
+	(*UDPCheck)(nil),            // 6: hashicorp.consul.catalog.v1alpha1.UDPCheck
+	(*GRPCCheck)(nil),           // 7: hashicorp.consul.catalog.v1alpha1.GRPCCheck
+	(*OSServiceCheck)(nil),      // 8: hashicorp.consul.catalog.v1alpha1.OSServiceCheck
+	(*CheckTLSConfig)(nil),      // 9: hashicorp.consul.catalog.v1alpha1.CheckTLSConfig
+	nil,                         // 10: hashicorp.consul.catalog.v1alpha1.HTTPCheck.HeaderEntry
+	(*WorkloadSelector)(nil),    // 11: hashicorp.consul.catalog.v1alpha1.WorkloadSelector
+	(*durationpb.Duration)(nil), // 12: google.protobuf.Duration
+}
+var file_pbcatalog_v1alpha1_health_proto_depIdxs = []int32{
+	0,  // 0: hashicorp.consul.catalog.v1alpha1.HealthStatus.status:type_name -> hashicorp.consul.catalog.v1alpha1.Health
+	11, // 1: hashicorp.consul.catalog.v1alpha1.HealthChecks.workloads:type_name -> hashicorp.consul.catalog.v1alpha1.WorkloadSelector
+	3,  // 2: hashicorp.consul.catalog.v1alpha1.HealthChecks.health_checks:type_name -> hashicorp.consul.catalog.v1alpha1.HealthCheck
+	4,  // 3: hashicorp.consul.catalog.v1alpha1.HealthCheck.http:type_name -> hashicorp.consul.catalog.v1alpha1.HTTPCheck
+	5,  // 4: hashicorp.consul.catalog.v1alpha1.HealthCheck.tcp:type_name -> hashicorp.consul.catalog.v1alpha1.TCPCheck
+	6,  // 5: hashicorp.consul.catalog.v1alpha1.HealthCheck.udp:type_name -> hashicorp.consul.catalog.v1alpha1.UDPCheck
+	7,  // 6: hashicorp.consul.catalog.v1alpha1.HealthCheck.grpc:type_name -> hashicorp.consul.catalog.v1alpha1.GRPCCheck
+	8,  // 7: hashicorp.consul.catalog.v1alpha1.HealthCheck.os_service:type_name -> hashicorp.consul.catalog.v1alpha1.OSServiceCheck
+	12, // 8: hashicorp.consul.catalog.v1alpha1.HealthCheck.interval:type_name -> google.protobuf.Duration
+	12, // 9: hashicorp.consul.catalog.v1alpha1.HealthCheck.timeout:type_name -> google.protobuf.Duration
+	12, // 10: hashicorp.consul.catalog.v1alpha1.HealthCheck.deregister_critical_after:type_name -> google.protobuf.Duration
+	10, // 11: hashicorp.consul.catalog.v1alpha1.HTTPCheck.header:type_name -> hashicorp.consul.catalog.v1alpha1.HTTPCheck.HeaderEntry
+	9,  // 12: hashicorp.consul.catalog.v1alpha1.HTTPCheck.tls:type_name -> hashicorp.consul.catalog.v1alpha1.CheckTLSConfig
+	9,  // 13: hashicorp.consul.catalog.v1alpha1.GRPCCheck.tls:type_name -> hashicorp.consul.catalog.v1alpha1.CheckTLSConfig
+	14, // [14:14] is the sub-list for method output_type
+	14, // [14:14] is the sub-list for method input_type
+	14, // [14:14] is the sub-list for extension type_name
+	14, // [14:14] is the sub-list for extension extendee
+	0,  // [0:14] is the sub-list for field type_name
+}
+
+func init() { file_pbcatalog_v1alpha1_health_proto_init() }
+func file_pbcatalog_v1alpha1_health_proto_init() {
+	if File_pbcatalog_v1alpha1_health_proto != nil {
+		return
+	}
+	file_pbcatalog_v1alpha1_selector_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_pbcatalog_v1alpha1_health_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HealthStatus); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbcatalog_v1alpha1_health_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HealthChecks); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbcatalog_v1alpha1_health_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HealthCheck); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbcatalog_v1alpha1_health_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HTTPCheck); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbcatalog_v1alpha1_health_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TCPCheck); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbcatalog_v1alpha1_health_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UDPCheck); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbcatalog_v1alpha1_health_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GRPCCheck); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbcatalog_v1alpha1_health_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*OSServiceCheck); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbcatalog_v1alpha1_health_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CheckTLSConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_pbcatalog_v1alpha1_health_proto_msgTypes[2].OneofWrappers = []interface{}{
+		(*HealthCheck_Http)(nil),
+		(*HealthCheck_Tcp)(nil),
+		(*HealthCheck_Udp)(nil),
+		(*HealthCheck_Grpc)(nil),
+		(*HealthCheck_OsService)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbcatalog_v1alpha1_health_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   10,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbcatalog_v1alpha1_health_proto_goTypes,
+		DependencyIndexes: file_pbcatalog_v1alpha1_health_proto_depIdxs,
+		EnumInfos:         file_pbcatalog_v1alpha1_health_proto_enumTypes,
+		MessageInfos:      file_pbcatalog_v1alpha1_health_proto_msgTypes,
+	}.Build()
+	File_pbcatalog_v1alpha1_health_proto = out.File
+	file_pbcatalog_v1alpha1_health_proto_rawDesc = nil
+	file_pbcatalog_v1alpha1_health_proto_goTypes = nil
+	file_pbcatalog_v1alpha1_health_proto_depIdxs = nil
+}
diff --git a/proto-public/pbcatalog/v1alpha1/health.proto b/proto-public/pbcatalog/v1alpha1/health.proto
new file mode 100644
index 000000000000..477aa15fc517
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/health.proto
@@ -0,0 +1,81 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.catalog.v1alpha1;
+
+import "google/protobuf/duration.proto";
+import "pbcatalog/v1alpha1/selector.proto";
+
+// This resource will belong to a workload or a node and will have an ownership relationship.
+message HealthStatus {
+  // Type is the type of this health check, such as http, tcp, or kubernetes-readiness
+  string type = 1;
+  // Health is the status. This maps to existing health check statuses.
+  Health status = 2;
+  // Description is the description for this status.
+  string description = 3;
+  // Output is the output from running the check that resulted in this status
+  string output = 4;
+}
+
+enum Health {
+  // buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
+  HEALTH_ANY = 0;
+  HEALTH_PASSING = 1;
+  HEALTH_WARNING = 2;
+  HEALTH_CRITICAL = 3;
+  HEALTH_MAINTENANCE = 4;
+}
+
+message HealthChecks {
+  WorkloadSelector workloads = 1;
+  repeated HealthCheck health_checks = 2;
+}
+
+message HealthCheck {
+  string name = 1;
+  oneof definition {
+    HTTPCheck http = 2;
+    TCPCheck tcp = 3;
+    UDPCheck udp = 4;
+    GRPCCheck grpc = 5;
+    OSServiceCheck os_service = 6;
+  }
+  google.protobuf.Duration interval = 7;
+  google.protobuf.Duration timeout = 8;
+  google.protobuf.Duration deregister_critical_after = 9;
+}
+
+message HTTPCheck {
+  string url = 1;
+  map<string, string> header = 2;
+  string method = 3;
+  string body = 4;
+  bool disable_redirects = 5;
+  CheckTLSConfig tls = 6;
+}
+
+message TCPCheck {
+  string address = 1;
+}
+
+message UDPCheck {
+  string address = 1;
+}
+
+message GRPCCheck {
+  string address = 1;
+  CheckTLSConfig tls = 2;
+}
+
+message OSServiceCheck {
+  string address = 1;
+}
+
+message CheckTLSConfig {
+  string tls_server_name = 1;
+  bool tls_skip_verify = 2;
+  bool use_tls = 3;
+}
diff --git a/proto-public/pbcatalog/v1alpha1/node.pb.binary.go b/proto-public/pbcatalog/v1alpha1/node.pb.binary.go
new file mode 100644
index 000000000000..d654f1c433b4
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/node.pb.binary.go
@@ -0,0 +1,28 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbcatalog/v1alpha1/node.proto
+
+package catalogv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *Node) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *Node) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *NodeAddress) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *NodeAddress) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
diff --git a/proto-public/pbcatalog/v1alpha1/node.pb.go b/proto-public/pbcatalog/v1alpha1/node.pb.go
new file mode 100644
index 000000000000..5ee5809a2f85
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/node.pb.go
@@ -0,0 +1,244 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: pbcatalog/v1alpha1/node.proto
+
+package catalogv1alpha1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type Node struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Addresses []*NodeAddress `protobuf:"bytes,1,rep,name=addresses,proto3" json:"addresses,omitempty"`
+}
+
+func (x *Node) Reset() {
+	*x = Node{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_node_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Node) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Node) ProtoMessage() {}
+
+func (x *Node) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_node_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Node.ProtoReflect.Descriptor instead.
+func (*Node) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_node_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Node) GetAddresses() []*NodeAddress {
+	if x != nil {
+		return x.Addresses
+	}
+	return nil
+}
+
+type NodeAddress struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// host can be an IP or DNS name.Í
+	Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
+	// external indicates whether this address should be used for external communication
+	// (aka a WAN address).
+	External bool `protobuf:"varint,3,opt,name=external,proto3" json:"external,omitempty"`
+}
+
+func (x *NodeAddress) Reset() {
+	*x = NodeAddress{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_node_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *NodeAddress) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NodeAddress) ProtoMessage() {}
+
+func (x *NodeAddress) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_node_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NodeAddress.ProtoReflect.Descriptor instead.
+func (*NodeAddress) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_node_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *NodeAddress) GetHost() string {
+	if x != nil {
+		return x.Host
+	}
+	return ""
+}
+
+func (x *NodeAddress) GetExternal() bool {
+	if x != nil {
+		return x.External
+	}
+	return false
+}
+
+var File_pbcatalog_v1alpha1_node_proto protoreflect.FileDescriptor
+
+var file_pbcatalog_v1alpha1_node_proto_rawDesc = []byte{
+	0x0a, 0x1d, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x2f, 0x6e, 0x6f, 0x64, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12,
+	0x21, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x22, 0x54, 0x0a, 0x04, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x4c, 0x0a, 0x09, 0x61, 0x64,
+	0x64, 0x72, 0x65, 0x73, 0x73, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2e, 0x2e,
+	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2e, 0x4e, 0x6f, 0x64, 0x65, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x52, 0x09, 0x61,
+	0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x65, 0x73, 0x22, 0x3d, 0x0a, 0x0b, 0x4e, 0x6f, 0x64, 0x65,
+	0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x65,
+	0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x65,
+	0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x42, 0xa6, 0x02, 0x0a, 0x25, 0x63, 0x6f, 0x6d, 0x2e,
+	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x42, 0x09, 0x4e, 0x6f, 0x64, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x4b,
+	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69,
+	0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c,
+	0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x3b, 0x63, 0x61, 0x74, 0x61,
+	0x6c, 0x6f, 0x67, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xa2, 0x02, 0x03, 0x48, 0x43,
+	0x43, 0xaa, 0x02, 0x21, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x56, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0xca, 0x02, 0x21, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67,
+	0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xe2, 0x02, 0x2d, 0x48, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x43, 0x61, 0x74,
+	0x61, 0x6c, 0x6f, 0x67, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x5c, 0x47, 0x50,
+	0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x24, 0x48, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x43,
+	0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x3a, 0x3a, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_pbcatalog_v1alpha1_node_proto_rawDescOnce sync.Once
+	file_pbcatalog_v1alpha1_node_proto_rawDescData = file_pbcatalog_v1alpha1_node_proto_rawDesc
+)
+
+func file_pbcatalog_v1alpha1_node_proto_rawDescGZIP() []byte {
+	file_pbcatalog_v1alpha1_node_proto_rawDescOnce.Do(func() {
+		file_pbcatalog_v1alpha1_node_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbcatalog_v1alpha1_node_proto_rawDescData)
+	})
+	return file_pbcatalog_v1alpha1_node_proto_rawDescData
+}
+
+var file_pbcatalog_v1alpha1_node_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_pbcatalog_v1alpha1_node_proto_goTypes = []interface{}{
+	(*Node)(nil),        // 0: hashicorp.consul.catalog.v1alpha1.Node
+	(*NodeAddress)(nil), // 1: hashicorp.consul.catalog.v1alpha1.NodeAddress
+}
+var file_pbcatalog_v1alpha1_node_proto_depIdxs = []int32{
+	1, // 0: hashicorp.consul.catalog.v1alpha1.Node.addresses:type_name -> hashicorp.consul.catalog.v1alpha1.NodeAddress
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_pbcatalog_v1alpha1_node_proto_init() }
+func file_pbcatalog_v1alpha1_node_proto_init() {
+	if File_pbcatalog_v1alpha1_node_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_pbcatalog_v1alpha1_node_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Node); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbcatalog_v1alpha1_node_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*NodeAddress); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbcatalog_v1alpha1_node_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbcatalog_v1alpha1_node_proto_goTypes,
+		DependencyIndexes: file_pbcatalog_v1alpha1_node_proto_depIdxs,
+		MessageInfos:      file_pbcatalog_v1alpha1_node_proto_msgTypes,
+	}.Build()
+	File_pbcatalog_v1alpha1_node_proto = out.File
+	file_pbcatalog_v1alpha1_node_proto_rawDesc = nil
+	file_pbcatalog_v1alpha1_node_proto_goTypes = nil
+	file_pbcatalog_v1alpha1_node_proto_depIdxs = nil
+}
diff --git a/proto-public/pbcatalog/v1alpha1/node.proto b/proto-public/pbcatalog/v1alpha1/node.proto
new file mode 100644
index 000000000000..56a7ce3a2cfa
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/node.proto
@@ -0,0 +1,19 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.catalog.v1alpha1;
+
+message Node {
+  repeated NodeAddress addresses = 1;
+}
+
+message NodeAddress {
+  // host can be an IP or DNS name.Í
+  string host = 1;
+
+  // external indicates whether this address should be used for external communication
+  // (aka a WAN address).
+  bool external = 3;
+}
diff --git a/proto-public/pbcatalog/v1alpha1/protocol.pb.go b/proto-public/pbcatalog/v1alpha1/protocol.pb.go
new file mode 100644
index 000000000000..39f13e212bf4
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/protocol.pb.go
@@ -0,0 +1,166 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: pbcatalog/v1alpha1/protocol.proto
+
+package catalogv1alpha1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type Protocol int32
+
+const (
+	// buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
+	Protocol_PROTOCOL_TCP   Protocol = 0
+	Protocol_PROTOCOL_HTTP  Protocol = 1
+	Protocol_PROTOCOL_HTTP2 Protocol = 2
+	Protocol_PROTOCOL_GRPC  Protocol = 3
+	// Protocol Mesh indicates that this port can speak Consul's mTLS based mesh protocol.
+	Protocol_PROTOCOL_MESH Protocol = 4
+)
+
+// Enum value maps for Protocol.
+var (
+	Protocol_name = map[int32]string{
+		0: "PROTOCOL_TCP",
+		1: "PROTOCOL_HTTP",
+		2: "PROTOCOL_HTTP2",
+		3: "PROTOCOL_GRPC",
+		4: "PROTOCOL_MESH",
+	}
+	Protocol_value = map[string]int32{
+		"PROTOCOL_TCP":   0,
+		"PROTOCOL_HTTP":  1,
+		"PROTOCOL_HTTP2": 2,
+		"PROTOCOL_GRPC":  3,
+		"PROTOCOL_MESH":  4,
+	}
+)
+
+func (x Protocol) Enum() *Protocol {
+	p := new(Protocol)
+	*p = x
+	return p
+}
+
+func (x Protocol) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Protocol) Descriptor() protoreflect.EnumDescriptor {
+	return file_pbcatalog_v1alpha1_protocol_proto_enumTypes[0].Descriptor()
+}
+
+func (Protocol) Type() protoreflect.EnumType {
+	return &file_pbcatalog_v1alpha1_protocol_proto_enumTypes[0]
+}
+
+func (x Protocol) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Protocol.Descriptor instead.
+func (Protocol) EnumDescriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_protocol_proto_rawDescGZIP(), []int{0}
+}
+
+var File_pbcatalog_v1alpha1_protocol_proto protoreflect.FileDescriptor
+
+var file_pbcatalog_v1alpha1_protocol_proto_rawDesc = []byte{
+	0x0a, 0x21, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x12, 0x21, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2a, 0x69, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63,
+	0x6f, 0x6c, 0x12, 0x10, 0x0a, 0x0c, 0x50, 0x52, 0x4f, 0x54, 0x4f, 0x43, 0x4f, 0x4c, 0x5f, 0x54,
+	0x43, 0x50, 0x10, 0x00, 0x12, 0x11, 0x0a, 0x0d, 0x50, 0x52, 0x4f, 0x54, 0x4f, 0x43, 0x4f, 0x4c,
+	0x5f, 0x48, 0x54, 0x54, 0x50, 0x10, 0x01, 0x12, 0x12, 0x0a, 0x0e, 0x50, 0x52, 0x4f, 0x54, 0x4f,
+	0x43, 0x4f, 0x4c, 0x5f, 0x48, 0x54, 0x54, 0x50, 0x32, 0x10, 0x02, 0x12, 0x11, 0x0a, 0x0d, 0x50,
+	0x52, 0x4f, 0x54, 0x4f, 0x43, 0x4f, 0x4c, 0x5f, 0x47, 0x52, 0x50, 0x43, 0x10, 0x03, 0x12, 0x11,
+	0x0a, 0x0d, 0x50, 0x52, 0x4f, 0x54, 0x4f, 0x43, 0x4f, 0x4c, 0x5f, 0x4d, 0x45, 0x53, 0x48, 0x10,
+	0x04, 0x42, 0xaa, 0x02, 0x0a, 0x25, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c,
+	0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x42, 0x0d, 0x50, 0x72, 0x6f,
+	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x4b, 0x67, 0x69,
+	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d,
+	0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67,
+	0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x3b, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f,
+	0x67, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xa2, 0x02, 0x03, 0x48, 0x43, 0x43, 0xaa,
+	0x02, 0x21, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x56, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0xca, 0x02, 0x21, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c,
+	0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x5c, 0x56,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xe2, 0x02, 0x2d, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x43, 0x61, 0x74, 0x61, 0x6c,
+	0x6f, 0x67, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x24, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x43, 0x61, 0x74,
+	0x61, 0x6c, 0x6f, 0x67, 0x3a, 0x3a, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62, 0x06,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_pbcatalog_v1alpha1_protocol_proto_rawDescOnce sync.Once
+	file_pbcatalog_v1alpha1_protocol_proto_rawDescData = file_pbcatalog_v1alpha1_protocol_proto_rawDesc
+)
+
+func file_pbcatalog_v1alpha1_protocol_proto_rawDescGZIP() []byte {
+	file_pbcatalog_v1alpha1_protocol_proto_rawDescOnce.Do(func() {
+		file_pbcatalog_v1alpha1_protocol_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbcatalog_v1alpha1_protocol_proto_rawDescData)
+	})
+	return file_pbcatalog_v1alpha1_protocol_proto_rawDescData
+}
+
+var file_pbcatalog_v1alpha1_protocol_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_pbcatalog_v1alpha1_protocol_proto_goTypes = []interface{}{
+	(Protocol)(0), // 0: hashicorp.consul.catalog.v1alpha1.Protocol
+}
+var file_pbcatalog_v1alpha1_protocol_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_pbcatalog_v1alpha1_protocol_proto_init() }
+func file_pbcatalog_v1alpha1_protocol_proto_init() {
+	if File_pbcatalog_v1alpha1_protocol_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbcatalog_v1alpha1_protocol_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   0,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbcatalog_v1alpha1_protocol_proto_goTypes,
+		DependencyIndexes: file_pbcatalog_v1alpha1_protocol_proto_depIdxs,
+		EnumInfos:         file_pbcatalog_v1alpha1_protocol_proto_enumTypes,
+	}.Build()
+	File_pbcatalog_v1alpha1_protocol_proto = out.File
+	file_pbcatalog_v1alpha1_protocol_proto_rawDesc = nil
+	file_pbcatalog_v1alpha1_protocol_proto_goTypes = nil
+	file_pbcatalog_v1alpha1_protocol_proto_depIdxs = nil
+}
diff --git a/proto-public/pbcatalog/v1alpha1/protocol.proto b/proto-public/pbcatalog/v1alpha1/protocol.proto
new file mode 100644
index 000000000000..a18351c5d6d8
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/protocol.proto
@@ -0,0 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.catalog.v1alpha1;
+
+enum Protocol {
+  // buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
+  PROTOCOL_TCP = 0;
+  PROTOCOL_HTTP = 1;
+  PROTOCOL_HTTP2 = 2;
+  PROTOCOL_GRPC = 3;
+
+  // Protocol Mesh indicates that this port can speak Consul's mTLS based mesh protocol.
+  PROTOCOL_MESH = 4;
+}
diff --git a/proto-public/pbcatalog/v1alpha1/selector.pb.binary.go b/proto-public/pbcatalog/v1alpha1/selector.pb.binary.go
new file mode 100644
index 000000000000..b3afb21d4799
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/selector.pb.binary.go
@@ -0,0 +1,18 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbcatalog/v1alpha1/selector.proto
+
+package catalogv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *WorkloadSelector) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *WorkloadSelector) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
diff --git a/proto-public/pbcatalog/v1alpha1/selector.pb.go b/proto-public/pbcatalog/v1alpha1/selector.pb.go
new file mode 100644
index 000000000000..51b0d7cc5dd0
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/selector.pb.go
@@ -0,0 +1,177 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: pbcatalog/v1alpha1/selector.proto
+
+package catalogv1alpha1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// WorkloadSelector represents criteria for selecting a subset of workloads.
+type WorkloadSelector struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Prefixes []string `protobuf:"bytes,1,rep,name=prefixes,proto3" json:"prefixes,omitempty"`
+	Names    []string `protobuf:"bytes,2,rep,name=names,proto3" json:"names,omitempty"`
+}
+
+func (x *WorkloadSelector) Reset() {
+	*x = WorkloadSelector{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_selector_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WorkloadSelector) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WorkloadSelector) ProtoMessage() {}
+
+func (x *WorkloadSelector) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_selector_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WorkloadSelector.ProtoReflect.Descriptor instead.
+func (*WorkloadSelector) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_selector_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *WorkloadSelector) GetPrefixes() []string {
+	if x != nil {
+		return x.Prefixes
+	}
+	return nil
+}
+
+func (x *WorkloadSelector) GetNames() []string {
+	if x != nil {
+		return x.Names
+	}
+	return nil
+}
+
+var File_pbcatalog_v1alpha1_selector_proto protoreflect.FileDescriptor
+
+var file_pbcatalog_v1alpha1_selector_proto_rawDesc = []byte{
+	0x0a, 0x21, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x2f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x12, 0x21, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x22, 0x44, 0x0a, 0x10, 0x57, 0x6f, 0x72, 0x6b, 0x6c, 0x6f,
+	0x61, 0x64, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x72,
+	0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x70, 0x72,
+	0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18,
+	0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x42, 0xaa, 0x02, 0x0a,
+	0x25, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x42, 0x0d, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72,
+	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x4b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
+	0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69,
+	0x63, 0x2f, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x3b, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0xa2, 0x02, 0x03, 0x48, 0x43, 0x43, 0xaa, 0x02, 0x21, 0x48, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x43, 0x61,
+	0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xca, 0x02,
+	0x21, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x5c, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0xe2, 0x02, 0x2d, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x5c, 0x56, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0xea, 0x02, 0x24, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a,
+	0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x3a,
+	0x3a, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
+}
+
+var (
+	file_pbcatalog_v1alpha1_selector_proto_rawDescOnce sync.Once
+	file_pbcatalog_v1alpha1_selector_proto_rawDescData = file_pbcatalog_v1alpha1_selector_proto_rawDesc
+)
+
+func file_pbcatalog_v1alpha1_selector_proto_rawDescGZIP() []byte {
+	file_pbcatalog_v1alpha1_selector_proto_rawDescOnce.Do(func() {
+		file_pbcatalog_v1alpha1_selector_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbcatalog_v1alpha1_selector_proto_rawDescData)
+	})
+	return file_pbcatalog_v1alpha1_selector_proto_rawDescData
+}
+
+var file_pbcatalog_v1alpha1_selector_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_pbcatalog_v1alpha1_selector_proto_goTypes = []interface{}{
+	(*WorkloadSelector)(nil), // 0: hashicorp.consul.catalog.v1alpha1.WorkloadSelector
+}
+var file_pbcatalog_v1alpha1_selector_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_pbcatalog_v1alpha1_selector_proto_init() }
+func file_pbcatalog_v1alpha1_selector_proto_init() {
+	if File_pbcatalog_v1alpha1_selector_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_pbcatalog_v1alpha1_selector_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WorkloadSelector); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbcatalog_v1alpha1_selector_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbcatalog_v1alpha1_selector_proto_goTypes,
+		DependencyIndexes: file_pbcatalog_v1alpha1_selector_proto_depIdxs,
+		MessageInfos:      file_pbcatalog_v1alpha1_selector_proto_msgTypes,
+	}.Build()
+	File_pbcatalog_v1alpha1_selector_proto = out.File
+	file_pbcatalog_v1alpha1_selector_proto_rawDesc = nil
+	file_pbcatalog_v1alpha1_selector_proto_goTypes = nil
+	file_pbcatalog_v1alpha1_selector_proto_depIdxs = nil
+}
diff --git a/proto-public/pbcatalog/v1alpha1/selector.proto b/proto-public/pbcatalog/v1alpha1/selector.proto
new file mode 100644
index 000000000000..b1b39409ba3a
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/selector.proto
@@ -0,0 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.catalog.v1alpha1;
+
+// WorkloadSelector represents criteria for selecting a subset of workloads.
+message WorkloadSelector {
+  repeated string prefixes = 1;
+  repeated string names = 2;
+}
diff --git a/proto-public/pbcatalog/v1alpha1/service.pb.binary.go b/proto-public/pbcatalog/v1alpha1/service.pb.binary.go
new file mode 100644
index 000000000000..1dd7eca1d2e8
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/service.pb.binary.go
@@ -0,0 +1,28 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbcatalog/v1alpha1/service.proto
+
+package catalogv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *Service) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *Service) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *ServicePort) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *ServicePort) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
diff --git a/proto-public/pbcatalog/v1alpha1/service.pb.go b/proto-public/pbcatalog/v1alpha1/service.pb.go
new file mode 100644
index 000000000000..b388472b0e26
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/service.pb.go
@@ -0,0 +1,301 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: pbcatalog/v1alpha1/service.proto
+
+package catalogv1alpha1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type Service struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// workloads is a selector for the workloads this service should represent.
+	Workloads *WorkloadSelector `protobuf:"bytes,1,opt,name=workloads,proto3" json:"workloads,omitempty"`
+	// ports is the list of mappings of workload ports that this service
+	// represents.
+	Ports []*ServicePort `protobuf:"bytes,2,rep,name=ports,proto3" json:"ports,omitempty"`
+	// virtual_ips is a list of virtual IPs for this service. This is useful when you need to set
+	// an IP from an external system (like Kubernetes). This can be an IPv4 or IPv6 string.
+	VirtualIps []string `protobuf:"bytes,3,rep,name=virtual_ips,json=virtualIps,proto3" json:"virtual_ips,omitempty"`
+}
+
+func (x *Service) Reset() {
+	*x = Service{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_service_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Service) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Service) ProtoMessage() {}
+
+func (x *Service) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_service_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Service.ProtoReflect.Descriptor instead.
+func (*Service) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_service_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Service) GetWorkloads() *WorkloadSelector {
+	if x != nil {
+		return x.Workloads
+	}
+	return nil
+}
+
+func (x *Service) GetPorts() []*ServicePort {
+	if x != nil {
+		return x.Ports
+	}
+	return nil
+}
+
+func (x *Service) GetVirtualIps() []string {
+	if x != nil {
+		return x.VirtualIps
+	}
+	return nil
+}
+
+type ServicePort struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// virtual_port is the port that could only be used when transparent
+	// proxy is used alongside a virtual IP or a virtual DNS address.
+	// This value is ignored in other cases. Whether or not using transparent
+	// proxy, this value is optional.
+	VirtualPort uint32 `protobuf:"varint,1,opt,name=virtual_port,json=virtualPort,proto3" json:"virtual_port,omitempty"`
+	// target_port is the name of the workload port.
+	TargetPort string `protobuf:"bytes,2,opt,name=target_port,json=targetPort,proto3" json:"target_port,omitempty"`
+	// protocol is the port's protocol. This should be set to "mesh"
+	// if the target port is the proxy's inbound port.
+	Protocol Protocol `protobuf:"varint,3,opt,name=protocol,proto3,enum=hashicorp.consul.catalog.v1alpha1.Protocol" json:"protocol,omitempty"`
+}
+
+func (x *ServicePort) Reset() {
+	*x = ServicePort{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_service_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ServicePort) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServicePort) ProtoMessage() {}
+
+func (x *ServicePort) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_service_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServicePort.ProtoReflect.Descriptor instead.
+func (*ServicePort) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ServicePort) GetVirtualPort() uint32 {
+	if x != nil {
+		return x.VirtualPort
+	}
+	return 0
+}
+
+func (x *ServicePort) GetTargetPort() string {
+	if x != nil {
+		return x.TargetPort
+	}
+	return ""
+}
+
+func (x *ServicePort) GetProtocol() Protocol {
+	if x != nil {
+		return x.Protocol
+	}
+	return Protocol_PROTOCOL_TCP
+}
+
+var File_pbcatalog_v1alpha1_service_proto protoreflect.FileDescriptor
+
+var file_pbcatalog_v1alpha1_service_proto_rawDesc = []byte{
+	0x0a, 0x20, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x12, 0x21, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x1a, 0x21, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67,
+	0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63,
+	0x6f, 0x6c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x21, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61,
+	0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x73, 0x65, 0x6c,
+	0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xc3, 0x01, 0x0a, 0x07,
+	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x51, 0x0a, 0x09, 0x77, 0x6f, 0x72, 0x6b, 0x6c,
+	0x6f, 0x61, 0x64, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x33, 0x2e, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61,
+	0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x57,
+	0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x52,
+	0x09, 0x77, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x73, 0x12, 0x44, 0x0a, 0x05, 0x70, 0x6f,
+	0x72, 0x74, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x68, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74,
+	0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x53, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x50, 0x6f, 0x72, 0x74, 0x52, 0x05, 0x70, 0x6f, 0x72, 0x74, 0x73,
+	0x12, 0x1f, 0x0a, 0x0b, 0x76, 0x69, 0x72, 0x74, 0x75, 0x61, 0x6c, 0x5f, 0x69, 0x70, 0x73, 0x18,
+	0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x76, 0x69, 0x72, 0x74, 0x75, 0x61, 0x6c, 0x49, 0x70,
+	0x73, 0x22, 0x9a, 0x01, 0x0a, 0x0b, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x50, 0x6f, 0x72,
+	0x74, 0x12, 0x21, 0x0a, 0x0c, 0x76, 0x69, 0x72, 0x74, 0x75, 0x61, 0x6c, 0x5f, 0x70, 0x6f, 0x72,
+	0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0b, 0x76, 0x69, 0x72, 0x74, 0x75, 0x61, 0x6c,
+	0x50, 0x6f, 0x72, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x70,
+	0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x74, 0x61, 0x72, 0x67, 0x65,
+	0x74, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x47, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f,
+	0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2b, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c,
+	0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x74,
+	0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x42, 0xa9,
+	0x02, 0x0a, 0x25, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x42, 0x0c, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x4b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c,
+	0x69, 0x63, 0x2f, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x3b, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0xa2, 0x02, 0x03, 0x48, 0x43, 0x43, 0xaa, 0x02, 0x21, 0x48, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x43,
+	0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xca,
+	0x02, 0x21, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x5c, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0xe2, 0x02, 0x2d, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c,
+	0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x5c, 0x56,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0xea, 0x02, 0x24, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a,
+	0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67,
+	0x3a, 0x3a, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x33,
+}
+
+var (
+	file_pbcatalog_v1alpha1_service_proto_rawDescOnce sync.Once
+	file_pbcatalog_v1alpha1_service_proto_rawDescData = file_pbcatalog_v1alpha1_service_proto_rawDesc
+)
+
+func file_pbcatalog_v1alpha1_service_proto_rawDescGZIP() []byte {
+	file_pbcatalog_v1alpha1_service_proto_rawDescOnce.Do(func() {
+		file_pbcatalog_v1alpha1_service_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbcatalog_v1alpha1_service_proto_rawDescData)
+	})
+	return file_pbcatalog_v1alpha1_service_proto_rawDescData
+}
+
+var file_pbcatalog_v1alpha1_service_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_pbcatalog_v1alpha1_service_proto_goTypes = []interface{}{
+	(*Service)(nil),          // 0: hashicorp.consul.catalog.v1alpha1.Service
+	(*ServicePort)(nil),      // 1: hashicorp.consul.catalog.v1alpha1.ServicePort
+	(*WorkloadSelector)(nil), // 2: hashicorp.consul.catalog.v1alpha1.WorkloadSelector
+	(Protocol)(0),            // 3: hashicorp.consul.catalog.v1alpha1.Protocol
+}
+var file_pbcatalog_v1alpha1_service_proto_depIdxs = []int32{
+	2, // 0: hashicorp.consul.catalog.v1alpha1.Service.workloads:type_name -> hashicorp.consul.catalog.v1alpha1.WorkloadSelector
+	1, // 1: hashicorp.consul.catalog.v1alpha1.Service.ports:type_name -> hashicorp.consul.catalog.v1alpha1.ServicePort
+	3, // 2: hashicorp.consul.catalog.v1alpha1.ServicePort.protocol:type_name -> hashicorp.consul.catalog.v1alpha1.Protocol
+	3, // [3:3] is the sub-list for method output_type
+	3, // [3:3] is the sub-list for method input_type
+	3, // [3:3] is the sub-list for extension type_name
+	3, // [3:3] is the sub-list for extension extendee
+	0, // [0:3] is the sub-list for field type_name
+}
+
+func init() { file_pbcatalog_v1alpha1_service_proto_init() }
+func file_pbcatalog_v1alpha1_service_proto_init() {
+	if File_pbcatalog_v1alpha1_service_proto != nil {
+		return
+	}
+	file_pbcatalog_v1alpha1_protocol_proto_init()
+	file_pbcatalog_v1alpha1_selector_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_pbcatalog_v1alpha1_service_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Service); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbcatalog_v1alpha1_service_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ServicePort); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbcatalog_v1alpha1_service_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbcatalog_v1alpha1_service_proto_goTypes,
+		DependencyIndexes: file_pbcatalog_v1alpha1_service_proto_depIdxs,
+		MessageInfos:      file_pbcatalog_v1alpha1_service_proto_msgTypes,
+	}.Build()
+	File_pbcatalog_v1alpha1_service_proto = out.File
+	file_pbcatalog_v1alpha1_service_proto_rawDesc = nil
+	file_pbcatalog_v1alpha1_service_proto_goTypes = nil
+	file_pbcatalog_v1alpha1_service_proto_depIdxs = nil
+}
diff --git a/proto-public/pbcatalog/v1alpha1/service.proto b/proto-public/pbcatalog/v1alpha1/service.proto
new file mode 100644
index 000000000000..4d4d681308d9
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/service.proto
@@ -0,0 +1,36 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.catalog.v1alpha1;
+
+import "pbcatalog/v1alpha1/protocol.proto";
+import "pbcatalog/v1alpha1/selector.proto";
+
+message Service {
+  // workloads is a selector for the workloads this service should represent.
+  WorkloadSelector workloads = 1;
+  // ports is the list of mappings of workload ports that this service
+  // represents.
+  repeated ServicePort ports = 2;
+
+  // virtual_ips is a list of virtual IPs for this service. This is useful when you need to set
+  // an IP from an external system (like Kubernetes). This can be an IPv4 or IPv6 string.
+  repeated string virtual_ips = 3;
+}
+
+message ServicePort {
+  // virtual_port is the port that could only be used when transparent
+  // proxy is used alongside a virtual IP or a virtual DNS address.
+  // This value is ignored in other cases. Whether or not using transparent
+  // proxy, this value is optional.
+  uint32 virtual_port = 1;
+
+  // target_port is the name of the workload port.
+  string target_port = 2;
+
+  // protocol is the port's protocol. This should be set to "mesh"
+  // if the target port is the proxy's inbound port.
+  Protocol protocol = 3;
+}
diff --git a/proto-public/pbcatalog/v1alpha1/service_endpoints.pb.binary.go b/proto-public/pbcatalog/v1alpha1/service_endpoints.pb.binary.go
new file mode 100644
index 000000000000..f20a805a4d2b
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/service_endpoints.pb.binary.go
@@ -0,0 +1,28 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbcatalog/v1alpha1/service_endpoints.proto
+
+package catalogv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *ServiceEndpoints) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *ServiceEndpoints) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *Endpoint) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *Endpoint) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
diff --git a/proto-public/pbcatalog/v1alpha1/service_endpoints.pb.go b/proto-public/pbcatalog/v1alpha1/service_endpoints.pb.go
new file mode 100644
index 000000000000..d1c7045103c0
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/service_endpoints.pb.go
@@ -0,0 +1,308 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: pbcatalog/v1alpha1/service_endpoints.proto
+
+package catalogv1alpha1
+
+import (
+	pbresource "github.com/hashicorp/consul/proto-public/pbresource"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type ServiceEndpoints struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Endpoints []*Endpoint `protobuf:"bytes,1,rep,name=endpoints,proto3" json:"endpoints,omitempty"`
+}
+
+func (x *ServiceEndpoints) Reset() {
+	*x = ServiceEndpoints{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_service_endpoints_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ServiceEndpoints) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServiceEndpoints) ProtoMessage() {}
+
+func (x *ServiceEndpoints) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_service_endpoints_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServiceEndpoints.ProtoReflect.Descriptor instead.
+func (*ServiceEndpoints) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_service_endpoints_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ServiceEndpoints) GetEndpoints() []*Endpoint {
+	if x != nil {
+		return x.Endpoints
+	}
+	return nil
+}
+
+type Endpoint struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// target_ref is the reference to the resource
+	// for this endpoint endpoint. This currently must be a workload.
+	TargetRef *pbresource.ID `protobuf:"bytes,1,opt,name=target_ref,json=targetRef,proto3" json:"target_ref,omitempty"`
+	// addresses is the list of addresses for this endpoint.
+	// This has the same structure as the workload addresses.
+	Addresses []*WorkloadAddress `protobuf:"bytes,2,rep,name=addresses,proto3" json:"addresses,omitempty"`
+	// ports is the map of ports for this endpoint.
+	// This has the same structure as the workload ports but
+	// will be filtered to just the ports selected by the service.
+	Ports map[string]*WorkloadPort `protobuf:"bytes,3,rep,name=ports,proto3" json:"ports,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// health_status is the aggregated health status of this endpoint.
+	HealthStatus Health `protobuf:"varint,4,opt,name=health_status,json=healthStatus,proto3,enum=hashicorp.consul.catalog.v1alpha1.Health" json:"health_status,omitempty"`
+}
+
+func (x *Endpoint) Reset() {
+	*x = Endpoint{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_service_endpoints_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Endpoint) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Endpoint) ProtoMessage() {}
+
+func (x *Endpoint) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_service_endpoints_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Endpoint.ProtoReflect.Descriptor instead.
+func (*Endpoint) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_service_endpoints_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *Endpoint) GetTargetRef() *pbresource.ID {
+	if x != nil {
+		return x.TargetRef
+	}
+	return nil
+}
+
+func (x *Endpoint) GetAddresses() []*WorkloadAddress {
+	if x != nil {
+		return x.Addresses
+	}
+	return nil
+}
+
+func (x *Endpoint) GetPorts() map[string]*WorkloadPort {
+	if x != nil {
+		return x.Ports
+	}
+	return nil
+}
+
+func (x *Endpoint) GetHealthStatus() Health {
+	if x != nil {
+		return x.HealthStatus
+	}
+	return Health_HEALTH_ANY
+}
+
+var File_pbcatalog_v1alpha1_service_endpoints_proto protoreflect.FileDescriptor
+
+var file_pbcatalog_v1alpha1_service_endpoints_proto_rawDesc = []byte{
+	0x0a, 0x2a, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x65, 0x6e, 0x64,
+	0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x21, 0x68, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63,
+	0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x1a,
+	0x1f, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x2f, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x1a, 0x21, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x2f, 0x77, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x1a, 0x19, 0x70, 0x62, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2f,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x5d,
+	0x0a, 0x10, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
+	0x74, 0x73, 0x12, 0x49, 0x0a, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x18,
+	0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67,
+	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69,
+	0x6e, 0x74, 0x52, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x22, 0xa3, 0x03,
+	0x0a, 0x08, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x3c, 0x0a, 0x0a, 0x74, 0x61,
+	0x72, 0x67, 0x65, 0x74, 0x5f, 0x72, 0x65, 0x66, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d,
+	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x09, 0x74,
+	0x61, 0x72, 0x67, 0x65, 0x74, 0x52, 0x65, 0x66, 0x12, 0x50, 0x0a, 0x09, 0x61, 0x64, 0x64, 0x72,
+	0x65, 0x73, 0x73, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x68, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63,
+	0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e,
+	0x57, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x52,
+	0x09, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x65, 0x73, 0x12, 0x4c, 0x0a, 0x05, 0x70, 0x6f,
+	0x72, 0x74, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x68, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74,
+	0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x45, 0x6e,
+	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x73, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x52, 0x05, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x12, 0x4e, 0x0a, 0x0d, 0x68, 0x65, 0x61, 0x6c,
+	0x74, 0x68, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x29, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x2e, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x52, 0x0c, 0x68, 0x65, 0x61, 0x6c,
+	0x74, 0x68, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x1a, 0x69, 0x0a, 0x0a, 0x50, 0x6f, 0x72, 0x74,
+	0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x45, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c,
+	0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x57, 0x6f, 0x72, 0x6b,
+	0x6c, 0x6f, 0x61, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a,
+	0x02, 0x38, 0x01, 0x42, 0xb2, 0x02, 0x0a, 0x25, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74,
+	0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x42, 0x15, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x50,
+	0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x4b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63,
+	0x2f, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x3b, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0xa2, 0x02, 0x03, 0x48, 0x43, 0x43, 0xaa, 0x02, 0x21, 0x48, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x43, 0x61, 0x74,
+	0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xca, 0x02, 0x21,
+	0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x5c, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0xe2, 0x02, 0x2d, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x5c, 0x56, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0xea, 0x02, 0x24, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x3a, 0x3a,
+	0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_pbcatalog_v1alpha1_service_endpoints_proto_rawDescOnce sync.Once
+	file_pbcatalog_v1alpha1_service_endpoints_proto_rawDescData = file_pbcatalog_v1alpha1_service_endpoints_proto_rawDesc
+)
+
+func file_pbcatalog_v1alpha1_service_endpoints_proto_rawDescGZIP() []byte {
+	file_pbcatalog_v1alpha1_service_endpoints_proto_rawDescOnce.Do(func() {
+		file_pbcatalog_v1alpha1_service_endpoints_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbcatalog_v1alpha1_service_endpoints_proto_rawDescData)
+	})
+	return file_pbcatalog_v1alpha1_service_endpoints_proto_rawDescData
+}
+
+var file_pbcatalog_v1alpha1_service_endpoints_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_pbcatalog_v1alpha1_service_endpoints_proto_goTypes = []interface{}{
+	(*ServiceEndpoints)(nil), // 0: hashicorp.consul.catalog.v1alpha1.ServiceEndpoints
+	(*Endpoint)(nil),         // 1: hashicorp.consul.catalog.v1alpha1.Endpoint
+	nil,                      // 2: hashicorp.consul.catalog.v1alpha1.Endpoint.PortsEntry
+	(*pbresource.ID)(nil),    // 3: hashicorp.consul.resource.ID
+	(*WorkloadAddress)(nil),  // 4: hashicorp.consul.catalog.v1alpha1.WorkloadAddress
+	(Health)(0),              // 5: hashicorp.consul.catalog.v1alpha1.Health
+	(*WorkloadPort)(nil),     // 6: hashicorp.consul.catalog.v1alpha1.WorkloadPort
+}
+var file_pbcatalog_v1alpha1_service_endpoints_proto_depIdxs = []int32{
+	1, // 0: hashicorp.consul.catalog.v1alpha1.ServiceEndpoints.endpoints:type_name -> hashicorp.consul.catalog.v1alpha1.Endpoint
+	3, // 1: hashicorp.consul.catalog.v1alpha1.Endpoint.target_ref:type_name -> hashicorp.consul.resource.ID
+	4, // 2: hashicorp.consul.catalog.v1alpha1.Endpoint.addresses:type_name -> hashicorp.consul.catalog.v1alpha1.WorkloadAddress
+	2, // 3: hashicorp.consul.catalog.v1alpha1.Endpoint.ports:type_name -> hashicorp.consul.catalog.v1alpha1.Endpoint.PortsEntry
+	5, // 4: hashicorp.consul.catalog.v1alpha1.Endpoint.health_status:type_name -> hashicorp.consul.catalog.v1alpha1.Health
+	6, // 5: hashicorp.consul.catalog.v1alpha1.Endpoint.PortsEntry.value:type_name -> hashicorp.consul.catalog.v1alpha1.WorkloadPort
+	6, // [6:6] is the sub-list for method output_type
+	6, // [6:6] is the sub-list for method input_type
+	6, // [6:6] is the sub-list for extension type_name
+	6, // [6:6] is the sub-list for extension extendee
+	0, // [0:6] is the sub-list for field type_name
+}
+
+func init() { file_pbcatalog_v1alpha1_service_endpoints_proto_init() }
+func file_pbcatalog_v1alpha1_service_endpoints_proto_init() {
+	if File_pbcatalog_v1alpha1_service_endpoints_proto != nil {
+		return
+	}
+	file_pbcatalog_v1alpha1_health_proto_init()
+	file_pbcatalog_v1alpha1_workload_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_pbcatalog_v1alpha1_service_endpoints_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ServiceEndpoints); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbcatalog_v1alpha1_service_endpoints_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Endpoint); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbcatalog_v1alpha1_service_endpoints_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   3,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbcatalog_v1alpha1_service_endpoints_proto_goTypes,
+		DependencyIndexes: file_pbcatalog_v1alpha1_service_endpoints_proto_depIdxs,
+		MessageInfos:      file_pbcatalog_v1alpha1_service_endpoints_proto_msgTypes,
+	}.Build()
+	File_pbcatalog_v1alpha1_service_endpoints_proto = out.File
+	file_pbcatalog_v1alpha1_service_endpoints_proto_rawDesc = nil
+	file_pbcatalog_v1alpha1_service_endpoints_proto_goTypes = nil
+	file_pbcatalog_v1alpha1_service_endpoints_proto_depIdxs = nil
+}
diff --git a/proto-public/pbcatalog/v1alpha1/service_endpoints.proto b/proto-public/pbcatalog/v1alpha1/service_endpoints.proto
new file mode 100644
index 000000000000..df3c70e0312f
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/service_endpoints.proto
@@ -0,0 +1,32 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.catalog.v1alpha1;
+
+import "pbcatalog/v1alpha1/health.proto";
+import "pbcatalog/v1alpha1/workload.proto";
+import "pbresource/resource.proto";
+
+message ServiceEndpoints {
+  repeated Endpoint endpoints = 1;
+}
+
+message Endpoint {
+  // target_ref is the reference to the resource
+  // for this endpoint endpoint. This currently must be a workload.
+  hashicorp.consul.resource.ID target_ref = 1;
+
+  // addresses is the list of addresses for this endpoint.
+  // This has the same structure as the workload addresses.
+  repeated WorkloadAddress addresses = 2;
+
+  // ports is the map of ports for this endpoint.
+  // This has the same structure as the workload ports but
+  // will be filtered to just the ports selected by the service.
+  map<string, WorkloadPort> ports = 3;
+
+  // health_status is the aggregated health status of this endpoint.
+  Health health_status = 4;
+}
diff --git a/proto-public/pbcatalog/v1alpha1/vip.pb.binary.go b/proto-public/pbcatalog/v1alpha1/vip.pb.binary.go
new file mode 100644
index 000000000000..fa7cf2dec274
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/vip.pb.binary.go
@@ -0,0 +1,28 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbcatalog/v1alpha1/vip.proto
+
+package catalogv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *VirtualIPs) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *VirtualIPs) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *IP) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *IP) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
diff --git a/proto-public/pbcatalog/v1alpha1/vip.pb.go b/proto-public/pbcatalog/v1alpha1/vip.pb.go
new file mode 100644
index 000000000000..dda5ea823892
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/vip.pb.go
@@ -0,0 +1,244 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: pbcatalog/v1alpha1/vip.proto
+
+package catalogv1alpha1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type VirtualIPs struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Ips []*IP `protobuf:"bytes,1,rep,name=ips,proto3" json:"ips,omitempty"`
+}
+
+func (x *VirtualIPs) Reset() {
+	*x = VirtualIPs{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_vip_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *VirtualIPs) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*VirtualIPs) ProtoMessage() {}
+
+func (x *VirtualIPs) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_vip_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use VirtualIPs.ProtoReflect.Descriptor instead.
+func (*VirtualIPs) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_vip_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *VirtualIPs) GetIps() []*IP {
+	if x != nil {
+		return x.Ips
+	}
+	return nil
+}
+
+type IP struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// address is the string IPv4 address.
+	// This could also store IPv6 in the future.
+	Address string `protobuf:"bytes,1,opt,name=address,proto3" json:"address,omitempty"`
+	// generated indicates whether Consul generated or it is user-provided
+	// (e.g. a ClusterIP of the Kubernetes service).
+	Generated bool `protobuf:"varint,2,opt,name=generated,proto3" json:"generated,omitempty"`
+}
+
+func (x *IP) Reset() {
+	*x = IP{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_vip_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *IP) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IP) ProtoMessage() {}
+
+func (x *IP) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_vip_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IP.ProtoReflect.Descriptor instead.
+func (*IP) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_vip_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *IP) GetAddress() string {
+	if x != nil {
+		return x.Address
+	}
+	return ""
+}
+
+func (x *IP) GetGenerated() bool {
+	if x != nil {
+		return x.Generated
+	}
+	return false
+}
+
+var File_pbcatalog_v1alpha1_vip_proto protoreflect.FileDescriptor
+
+var file_pbcatalog_v1alpha1_vip_proto_rawDesc = []byte{
+	0x0a, 0x1c, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x2f, 0x76, 0x69, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x21,
+	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x22, 0x45, 0x0a, 0x0a, 0x56, 0x69, 0x72, 0x74, 0x75, 0x61, 0x6c, 0x49, 0x50, 0x73, 0x12,
+	0x37, 0x0a, 0x03, 0x69, 0x70, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
+	0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0x2e, 0x49, 0x50, 0x52, 0x03, 0x69, 0x70, 0x73, 0x22, 0x3c, 0x0a, 0x02, 0x49, 0x50, 0x12, 0x18,
+	0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x1c, 0x0a, 0x09, 0x67, 0x65, 0x6e, 0x65,
+	0x72, 0x61, 0x74, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x67, 0x65, 0x6e,
+	0x65, 0x72, 0x61, 0x74, 0x65, 0x64, 0x42, 0xa5, 0x02, 0x0a, 0x25, 0x63, 0x6f, 0x6d, 0x2e, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
+	0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0x42, 0x08, 0x56, 0x69, 0x70, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x4b, 0x67, 0x69,
+	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d,
+	0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67,
+	0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x3b, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f,
+	0x67, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xa2, 0x02, 0x03, 0x48, 0x43, 0x43, 0xaa,
+	0x02, 0x21, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x56, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0xca, 0x02, 0x21, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c,
+	0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x5c, 0x56,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xe2, 0x02, 0x2d, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x43, 0x61, 0x74, 0x61, 0x6c,
+	0x6f, 0x67, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x24, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x43, 0x61, 0x74,
+	0x61, 0x6c, 0x6f, 0x67, 0x3a, 0x3a, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62, 0x06,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_pbcatalog_v1alpha1_vip_proto_rawDescOnce sync.Once
+	file_pbcatalog_v1alpha1_vip_proto_rawDescData = file_pbcatalog_v1alpha1_vip_proto_rawDesc
+)
+
+func file_pbcatalog_v1alpha1_vip_proto_rawDescGZIP() []byte {
+	file_pbcatalog_v1alpha1_vip_proto_rawDescOnce.Do(func() {
+		file_pbcatalog_v1alpha1_vip_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbcatalog_v1alpha1_vip_proto_rawDescData)
+	})
+	return file_pbcatalog_v1alpha1_vip_proto_rawDescData
+}
+
+var file_pbcatalog_v1alpha1_vip_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_pbcatalog_v1alpha1_vip_proto_goTypes = []interface{}{
+	(*VirtualIPs)(nil), // 0: hashicorp.consul.catalog.v1alpha1.VirtualIPs
+	(*IP)(nil),         // 1: hashicorp.consul.catalog.v1alpha1.IP
+}
+var file_pbcatalog_v1alpha1_vip_proto_depIdxs = []int32{
+	1, // 0: hashicorp.consul.catalog.v1alpha1.VirtualIPs.ips:type_name -> hashicorp.consul.catalog.v1alpha1.IP
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_pbcatalog_v1alpha1_vip_proto_init() }
+func file_pbcatalog_v1alpha1_vip_proto_init() {
+	if File_pbcatalog_v1alpha1_vip_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_pbcatalog_v1alpha1_vip_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*VirtualIPs); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbcatalog_v1alpha1_vip_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*IP); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbcatalog_v1alpha1_vip_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbcatalog_v1alpha1_vip_proto_goTypes,
+		DependencyIndexes: file_pbcatalog_v1alpha1_vip_proto_depIdxs,
+		MessageInfos:      file_pbcatalog_v1alpha1_vip_proto_msgTypes,
+	}.Build()
+	File_pbcatalog_v1alpha1_vip_proto = out.File
+	file_pbcatalog_v1alpha1_vip_proto_rawDesc = nil
+	file_pbcatalog_v1alpha1_vip_proto_goTypes = nil
+	file_pbcatalog_v1alpha1_vip_proto_depIdxs = nil
+}
diff --git a/proto-public/pbcatalog/v1alpha1/vip.proto b/proto-public/pbcatalog/v1alpha1/vip.proto
new file mode 100644
index 000000000000..5efee624fcaa
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/vip.proto
@@ -0,0 +1,20 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.catalog.v1alpha1;
+
+message VirtualIPs {
+  repeated IP ips = 1;
+}
+
+message IP {
+  // address is the string IPv4 address.
+  // This could also store IPv6 in the future.
+  string address = 1;
+
+  // generated indicates whether Consul generated or it is user-provided
+  // (e.g. a ClusterIP of the Kubernetes service).
+  bool generated = 2;
+}
diff --git a/proto-public/pbcatalog/v1alpha1/workload.pb.binary.go b/proto-public/pbcatalog/v1alpha1/workload.pb.binary.go
new file mode 100644
index 000000000000..ffc54f072619
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/workload.pb.binary.go
@@ -0,0 +1,48 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbcatalog/v1alpha1/workload.proto
+
+package catalogv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *Workload) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *Workload) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *WorkloadAddress) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *WorkloadAddress) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *WorkloadPort) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *WorkloadPort) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *Locality) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *Locality) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
diff --git a/proto-public/pbcatalog/v1alpha1/workload.pb.go b/proto-public/pbcatalog/v1alpha1/workload.pb.go
new file mode 100644
index 000000000000..e5d914e2f61d
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/workload.pb.go
@@ -0,0 +1,520 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: pbcatalog/v1alpha1/workload.proto
+
+package catalogv1alpha1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Workload is the representation of a unit of addressable work. This could
+// represent a process on a VM, a Kubernetes pod or something else entirely.
+type Workload struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// addresses has a list of all workload addresses. This should include
+	// LAN and WAN addresses as well as any addresses a proxy would need
+	// to bind to (if different from the default address).
+	Addresses []*WorkloadAddress `protobuf:"bytes,1,rep,name=addresses,proto3" json:"addresses,omitempty"`
+	// ports is a map from port name to workload port’s number and protocol.
+	Ports map[string]*WorkloadPort `protobuf:"bytes,2,rep,name=ports,proto3" json:"ports,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// node_name is the name of the node this workload belongs to.
+	NodeName string `protobuf:"bytes,3,opt,name=node_name,json=nodeName,proto3" json:"node_name,omitempty"`
+	// identity is the name of the workload identity this workload is associated with.
+	Identity string `protobuf:"bytes,4,opt,name=identity,proto3" json:"identity,omitempty"`
+	// Locality specifies workload locality.
+	Locality *Locality `protobuf:"bytes,5,opt,name=locality,proto3" json:"locality,omitempty"`
+	// deprecated: tags correspond to service tags that you can add to a service for DNS resolution.
+	//
+	// Deprecated: Do not use.
+	Tags []string `protobuf:"bytes,6,rep,name=tags,proto3" json:"tags,omitempty"`
+	// deprecated: enable_tag_override indicates whether agents should be overriding tags during anti-entropy syncs.
+	//
+	// Deprecated: Do not use.
+	EnableTagOverride bool `protobuf:"varint,7,opt,name=enable_tag_override,json=enableTagOverride,proto3" json:"enable_tag_override,omitempty"`
+	// deprecated: connect_native indicates whether this workload is connect native which will allow it to be
+	// part of MeshEndpoints without having the corresponding Proxy resource.
+	//
+	// Deprecated: Do not use.
+	ConnectNative bool `protobuf:"varint,8,opt,name=connect_native,json=connectNative,proto3" json:"connect_native,omitempty"`
+}
+
+func (x *Workload) Reset() {
+	*x = Workload{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_workload_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Workload) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Workload) ProtoMessage() {}
+
+func (x *Workload) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_workload_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Workload.ProtoReflect.Descriptor instead.
+func (*Workload) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_workload_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Workload) GetAddresses() []*WorkloadAddress {
+	if x != nil {
+		return x.Addresses
+	}
+	return nil
+}
+
+func (x *Workload) GetPorts() map[string]*WorkloadPort {
+	if x != nil {
+		return x.Ports
+	}
+	return nil
+}
+
+func (x *Workload) GetNodeName() string {
+	if x != nil {
+		return x.NodeName
+	}
+	return ""
+}
+
+func (x *Workload) GetIdentity() string {
+	if x != nil {
+		return x.Identity
+	}
+	return ""
+}
+
+func (x *Workload) GetLocality() *Locality {
+	if x != nil {
+		return x.Locality
+	}
+	return nil
+}
+
+// Deprecated: Do not use.
+func (x *Workload) GetTags() []string {
+	if x != nil {
+		return x.Tags
+	}
+	return nil
+}
+
+// Deprecated: Do not use.
+func (x *Workload) GetEnableTagOverride() bool {
+	if x != nil {
+		return x.EnableTagOverride
+	}
+	return false
+}
+
+// Deprecated: Do not use.
+func (x *Workload) GetConnectNative() bool {
+	if x != nil {
+		return x.ConnectNative
+	}
+	return false
+}
+
+type WorkloadAddress struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// host can be an IP, DNS name or a unix socket.
+	// If it's a unix socket, only one port can be provided.
+	Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
+	// ports is a list of names of ports that this host binds to.
+	// If no ports are provided, we will assume all ports from the ports map.
+	Ports []string `protobuf:"bytes,2,rep,name=ports,proto3" json:"ports,omitempty"`
+	// external indicates whether this address should be used for external communication
+	// (aka a WAN address).
+	External bool `protobuf:"varint,3,opt,name=external,proto3" json:"external,omitempty"`
+}
+
+func (x *WorkloadAddress) Reset() {
+	*x = WorkloadAddress{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_workload_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WorkloadAddress) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WorkloadAddress) ProtoMessage() {}
+
+func (x *WorkloadAddress) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_workload_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WorkloadAddress.ProtoReflect.Descriptor instead.
+func (*WorkloadAddress) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_workload_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *WorkloadAddress) GetHost() string {
+	if x != nil {
+		return x.Host
+	}
+	return ""
+}
+
+func (x *WorkloadAddress) GetPorts() []string {
+	if x != nil {
+		return x.Ports
+	}
+	return nil
+}
+
+func (x *WorkloadAddress) GetExternal() bool {
+	if x != nil {
+		return x.External
+	}
+	return false
+}
+
+type WorkloadPort struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Port     uint32   `protobuf:"varint,1,opt,name=port,proto3" json:"port,omitempty"`
+	Protocol Protocol `protobuf:"varint,2,opt,name=protocol,proto3,enum=hashicorp.consul.catalog.v1alpha1.Protocol" json:"protocol,omitempty"`
+}
+
+func (x *WorkloadPort) Reset() {
+	*x = WorkloadPort{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_workload_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WorkloadPort) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WorkloadPort) ProtoMessage() {}
+
+func (x *WorkloadPort) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_workload_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WorkloadPort.ProtoReflect.Descriptor instead.
+func (*WorkloadPort) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_workload_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *WorkloadPort) GetPort() uint32 {
+	if x != nil {
+		return x.Port
+	}
+	return 0
+}
+
+func (x *WorkloadPort) GetProtocol() Protocol {
+	if x != nil {
+		return x.Protocol
+	}
+	return Protocol_PROTOCOL_TCP
+}
+
+type Locality struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Region is region the zone belongs to.
+	Region string `protobuf:"bytes,1,opt,name=region,proto3" json:"region,omitempty"`
+	// Zone is the zone the entity is running in.
+	Zone string `protobuf:"bytes,2,opt,name=zone,proto3" json:"zone,omitempty"`
+}
+
+func (x *Locality) Reset() {
+	*x = Locality{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbcatalog_v1alpha1_workload_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Locality) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Locality) ProtoMessage() {}
+
+func (x *Locality) ProtoReflect() protoreflect.Message {
+	mi := &file_pbcatalog_v1alpha1_workload_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Locality.ProtoReflect.Descriptor instead.
+func (*Locality) Descriptor() ([]byte, []int) {
+	return file_pbcatalog_v1alpha1_workload_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *Locality) GetRegion() string {
+	if x != nil {
+		return x.Region
+	}
+	return ""
+}
+
+func (x *Locality) GetZone() string {
+	if x != nil {
+		return x.Zone
+	}
+	return ""
+}
+
+var File_pbcatalog_v1alpha1_workload_proto protoreflect.FileDescriptor
+
+var file_pbcatalog_v1alpha1_workload_proto_rawDesc = []byte{
+	0x0a, 0x21, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x2f, 0x77, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x12, 0x21, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x1a, 0x21, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f,
+	0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x63, 0x6f, 0x6c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x8e, 0x04, 0x0a, 0x08, 0x57, 0x6f,
+	0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x50, 0x0a, 0x09, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73,
+	0x73, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x68, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74,
+	0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x57, 0x6f,
+	0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x52, 0x09, 0x61,
+	0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x65, 0x73, 0x12, 0x4c, 0x0a, 0x05, 0x70, 0x6f, 0x72, 0x74,
+	0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c,
+	0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x57, 0x6f, 0x72, 0x6b,
+	0x6c, 0x6f, 0x61, 0x64, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
+	0x05, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x64, 0x65, 0x5f, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6e, 0x6f, 0x64, 0x65, 0x4e,
+	0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12,
+	0x47, 0x0a, 0x08, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x69, 0x74, 0x79, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x2b, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x69, 0x74, 0x79, 0x52, 0x08,
+	0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x69, 0x74, 0x79, 0x12, 0x16, 0x0a, 0x04, 0x74, 0x61, 0x67, 0x73,
+	0x18, 0x06, 0x20, 0x03, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x04, 0x74, 0x61, 0x67, 0x73,
+	0x12, 0x32, 0x0a, 0x13, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x74, 0x61, 0x67, 0x5f, 0x6f,
+	0x76, 0x65, 0x72, 0x72, 0x69, 0x64, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x42, 0x02, 0x18,
+	0x01, 0x52, 0x11, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x54, 0x61, 0x67, 0x4f, 0x76, 0x65, 0x72,
+	0x72, 0x69, 0x64, 0x65, 0x12, 0x29, 0x0a, 0x0e, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x5f,
+	0x6e, 0x61, 0x74, 0x69, 0x76, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x42, 0x02, 0x18, 0x01,
+	0x52, 0x0d, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x4e, 0x61, 0x74, 0x69, 0x76, 0x65, 0x1a,
+	0x69, 0x0a, 0x0a, 0x50, 0x6f, 0x72, 0x74, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
+	0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
+	0x45, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f,
+	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x52,
+	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x57, 0x0a, 0x0f, 0x57, 0x6f,
+	0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x12, 0x0a,
+	0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73,
+	0x74, 0x12, 0x14, 0x0a, 0x05, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x05, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x78, 0x74, 0x65, 0x72,
+	0x6e, 0x61, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x65, 0x78, 0x74, 0x65, 0x72,
+	0x6e, 0x61, 0x6c, 0x22, 0x6b, 0x0a, 0x0c, 0x57, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x50,
+	0x6f, 0x72, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0d, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x47, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x63, 0x6f, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2b, 0x2e, 0x68, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74,
+	0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x50, 0x72,
+	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c,
+	0x22, 0x36, 0x0a, 0x08, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x69, 0x74, 0x79, 0x12, 0x16, 0x0a, 0x06,
+	0x72, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x72, 0x65,
+	0x67, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x7a, 0x6f, 0x6e, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x7a, 0x6f, 0x6e, 0x65, 0x42, 0xaa, 0x02, 0x0a, 0x25, 0x63, 0x6f, 0x6d,
+	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x42, 0x0d, 0x57, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x50, 0x72, 0x6f, 0x74,
+	0x6f, 0x50, 0x01, 0x5a, 0x4b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
+	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62,
+	0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0x3b, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0xa2, 0x02, 0x03, 0x48, 0x43, 0x43, 0xaa, 0x02, 0x21, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f,
+	0x67, 0x2e, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xca, 0x02, 0x21, 0x48, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x43, 0x61,
+	0x74, 0x61, 0x6c, 0x6f, 0x67, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xe2, 0x02,
+	0x2d, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x5c, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02,
+	0x24, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x3a, 0x3a, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x3a, 0x3a, 0x56, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_pbcatalog_v1alpha1_workload_proto_rawDescOnce sync.Once
+	file_pbcatalog_v1alpha1_workload_proto_rawDescData = file_pbcatalog_v1alpha1_workload_proto_rawDesc
+)
+
+func file_pbcatalog_v1alpha1_workload_proto_rawDescGZIP() []byte {
+	file_pbcatalog_v1alpha1_workload_proto_rawDescOnce.Do(func() {
+		file_pbcatalog_v1alpha1_workload_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbcatalog_v1alpha1_workload_proto_rawDescData)
+	})
+	return file_pbcatalog_v1alpha1_workload_proto_rawDescData
+}
+
+var file_pbcatalog_v1alpha1_workload_proto_msgTypes = make([]protoimpl.MessageInfo, 5)
+var file_pbcatalog_v1alpha1_workload_proto_goTypes = []interface{}{
+	(*Workload)(nil),        // 0: hashicorp.consul.catalog.v1alpha1.Workload
+	(*WorkloadAddress)(nil), // 1: hashicorp.consul.catalog.v1alpha1.WorkloadAddress
+	(*WorkloadPort)(nil),    // 2: hashicorp.consul.catalog.v1alpha1.WorkloadPort
+	(*Locality)(nil),        // 3: hashicorp.consul.catalog.v1alpha1.Locality
+	nil,                     // 4: hashicorp.consul.catalog.v1alpha1.Workload.PortsEntry
+	(Protocol)(0),           // 5: hashicorp.consul.catalog.v1alpha1.Protocol
+}
+var file_pbcatalog_v1alpha1_workload_proto_depIdxs = []int32{
+	1, // 0: hashicorp.consul.catalog.v1alpha1.Workload.addresses:type_name -> hashicorp.consul.catalog.v1alpha1.WorkloadAddress
+	4, // 1: hashicorp.consul.catalog.v1alpha1.Workload.ports:type_name -> hashicorp.consul.catalog.v1alpha1.Workload.PortsEntry
+	3, // 2: hashicorp.consul.catalog.v1alpha1.Workload.locality:type_name -> hashicorp.consul.catalog.v1alpha1.Locality
+	5, // 3: hashicorp.consul.catalog.v1alpha1.WorkloadPort.protocol:type_name -> hashicorp.consul.catalog.v1alpha1.Protocol
+	2, // 4: hashicorp.consul.catalog.v1alpha1.Workload.PortsEntry.value:type_name -> hashicorp.consul.catalog.v1alpha1.WorkloadPort
+	5, // [5:5] is the sub-list for method output_type
+	5, // [5:5] is the sub-list for method input_type
+	5, // [5:5] is the sub-list for extension type_name
+	5, // [5:5] is the sub-list for extension extendee
+	0, // [0:5] is the sub-list for field type_name
+}
+
+func init() { file_pbcatalog_v1alpha1_workload_proto_init() }
+func file_pbcatalog_v1alpha1_workload_proto_init() {
+	if File_pbcatalog_v1alpha1_workload_proto != nil {
+		return
+	}
+	file_pbcatalog_v1alpha1_protocol_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_pbcatalog_v1alpha1_workload_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Workload); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbcatalog_v1alpha1_workload_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WorkloadAddress); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbcatalog_v1alpha1_workload_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WorkloadPort); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbcatalog_v1alpha1_workload_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Locality); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbcatalog_v1alpha1_workload_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   5,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbcatalog_v1alpha1_workload_proto_goTypes,
+		DependencyIndexes: file_pbcatalog_v1alpha1_workload_proto_depIdxs,
+		MessageInfos:      file_pbcatalog_v1alpha1_workload_proto_msgTypes,
+	}.Build()
+	File_pbcatalog_v1alpha1_workload_proto = out.File
+	file_pbcatalog_v1alpha1_workload_proto_rawDesc = nil
+	file_pbcatalog_v1alpha1_workload_proto_goTypes = nil
+	file_pbcatalog_v1alpha1_workload_proto_depIdxs = nil
+}
diff --git a/proto-public/pbcatalog/v1alpha1/workload.proto b/proto-public/pbcatalog/v1alpha1/workload.proto
new file mode 100644
index 000000000000..00c82b8eebd3
--- /dev/null
+++ b/proto-public/pbcatalog/v1alpha1/workload.proto
@@ -0,0 +1,66 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.catalog.v1alpha1;
+
+import "pbcatalog/v1alpha1/protocol.proto";
+
+// Workload is the representation of a unit of addressable work. This could
+// represent a process on a VM, a Kubernetes pod or something else entirely.
+message Workload {
+  // addresses has a list of all workload addresses. This should include
+  // LAN and WAN addresses as well as any addresses a proxy would need
+  // to bind to (if different from the default address).
+  repeated WorkloadAddress addresses = 1;
+
+  // ports is a map from port name to workload port’s number and protocol.
+  map<string, WorkloadPort> ports = 2;
+
+  // node_name is the name of the node this workload belongs to.
+  string node_name = 3;
+
+  // identity is the name of the workload identity this workload is associated with.
+  string identity = 4;
+
+  // Locality specifies workload locality.
+  Locality locality = 5;
+
+  // Below fields are deprecated but kept here for backward compatibility reasons.
+
+  // deprecated: tags correspond to service tags that you can add to a service for DNS resolution.
+  repeated string tags = 6 [deprecated = true];
+  // deprecated: enable_tag_override indicates whether agents should be overriding tags during anti-entropy syncs.
+  bool enable_tag_override = 7 [deprecated = true];
+  // deprecated: connect_native indicates whether this workload is connect native which will allow it to be
+  // part of MeshEndpoints without having the corresponding Proxy resource.
+  bool connect_native = 8 [deprecated = true];
+}
+
+message WorkloadAddress {
+  // host can be an IP, DNS name or a unix socket.
+  // If it's a unix socket, only one port can be provided.
+  string host = 1;
+
+  // ports is a list of names of ports that this host binds to.
+  // If no ports are provided, we will assume all ports from the ports map.
+  repeated string ports = 2;
+
+  // external indicates whether this address should be used for external communication
+  // (aka a WAN address).
+  bool external = 3;
+}
+
+message WorkloadPort {
+  uint32 port = 1;
+  Protocol protocol = 2;
+}
+
+message Locality {
+  // Region is region the zone belongs to.
+  string region = 1;
+
+  // Zone is the zone the entity is running in.
+  string zone = 2;
+}
diff --git a/proto-public/pbmesh/v1alpha1/connection.pb.binary.go b/proto-public/pbmesh/v1alpha1/connection.pb.binary.go
new file mode 100644
index 000000000000..778f7ac4f741
--- /dev/null
+++ b/proto-public/pbmesh/v1alpha1/connection.pb.binary.go
@@ -0,0 +1,28 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbmesh/v1alpha1/connection.proto
+
+package meshv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *ConnectionConfig) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *ConnectionConfig) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *InboundConnectionsConfig) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *InboundConnectionsConfig) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
diff --git a/proto-public/pbmesh/v1alpha1/connection.pb.go b/proto-public/pbmesh/v1alpha1/connection.pb.go
new file mode 100644
index 000000000000..c720a23093d6
--- /dev/null
+++ b/proto-public/pbmesh/v1alpha1/connection.pb.go
@@ -0,0 +1,316 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: pbmesh/v1alpha1/connection.proto
+
+package meshv1alpha1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type BalanceInboundConnections int32
+
+const (
+	// buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
+	BalanceInboundConnections_BALANCE_INBOUND_CONNECTIONS_DEFAULT BalanceInboundConnections = 0
+	BalanceInboundConnections_BALANCE_INBOUND_CONNECTIONS_EXACT   BalanceInboundConnections = 1
+)
+
+// Enum value maps for BalanceInboundConnections.
+var (
+	BalanceInboundConnections_name = map[int32]string{
+		0: "BALANCE_INBOUND_CONNECTIONS_DEFAULT",
+		1: "BALANCE_INBOUND_CONNECTIONS_EXACT",
+	}
+	BalanceInboundConnections_value = map[string]int32{
+		"BALANCE_INBOUND_CONNECTIONS_DEFAULT": 0,
+		"BALANCE_INBOUND_CONNECTIONS_EXACT":   1,
+	}
+)
+
+func (x BalanceInboundConnections) Enum() *BalanceInboundConnections {
+	p := new(BalanceInboundConnections)
+	*p = x
+	return p
+}
+
+func (x BalanceInboundConnections) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (BalanceInboundConnections) Descriptor() protoreflect.EnumDescriptor {
+	return file_pbmesh_v1alpha1_connection_proto_enumTypes[0].Descriptor()
+}
+
+func (BalanceInboundConnections) Type() protoreflect.EnumType {
+	return &file_pbmesh_v1alpha1_connection_proto_enumTypes[0]
+}
+
+func (x BalanceInboundConnections) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use BalanceInboundConnections.Descriptor instead.
+func (BalanceInboundConnections) EnumDescriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_connection_proto_rawDescGZIP(), []int{0}
+}
+
+type ConnectionConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ConnectTimeoutMs uint64 `protobuf:"varint,2,opt,name=connect_timeout_ms,json=connectTimeoutMs,proto3" json:"connect_timeout_ms,omitempty"`
+	RequestTimeoutMs uint64 `protobuf:"varint,3,opt,name=request_timeout_ms,json=requestTimeoutMs,proto3" json:"request_timeout_ms,omitempty"`
+}
+
+func (x *ConnectionConfig) Reset() {
+	*x = ConnectionConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_connection_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ConnectionConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ConnectionConfig) ProtoMessage() {}
+
+func (x *ConnectionConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_connection_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ConnectionConfig.ProtoReflect.Descriptor instead.
+func (*ConnectionConfig) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_connection_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ConnectionConfig) GetConnectTimeoutMs() uint64 {
+	if x != nil {
+		return x.ConnectTimeoutMs
+	}
+	return 0
+}
+
+func (x *ConnectionConfig) GetRequestTimeoutMs() uint64 {
+	if x != nil {
+		return x.RequestTimeoutMs
+	}
+	return 0
+}
+
+type InboundConnectionsConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	MaxInboundConnections     uint64                    `protobuf:"varint,12,opt,name=max_inbound_connections,json=maxInboundConnections,proto3" json:"max_inbound_connections,omitempty"`
+	BalanceInboundConnections BalanceInboundConnections `protobuf:"varint,13,opt,name=balance_inbound_connections,json=balanceInboundConnections,proto3,enum=hashicorp.consul.mesh.v1alpha1.BalanceInboundConnections" json:"balance_inbound_connections,omitempty"`
+}
+
+func (x *InboundConnectionsConfig) Reset() {
+	*x = InboundConnectionsConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_connection_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *InboundConnectionsConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*InboundConnectionsConfig) ProtoMessage() {}
+
+func (x *InboundConnectionsConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_connection_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use InboundConnectionsConfig.ProtoReflect.Descriptor instead.
+func (*InboundConnectionsConfig) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_connection_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *InboundConnectionsConfig) GetMaxInboundConnections() uint64 {
+	if x != nil {
+		return x.MaxInboundConnections
+	}
+	return 0
+}
+
+func (x *InboundConnectionsConfig) GetBalanceInboundConnections() BalanceInboundConnections {
+	if x != nil {
+		return x.BalanceInboundConnections
+	}
+	return BalanceInboundConnections_BALANCE_INBOUND_CONNECTIONS_DEFAULT
+}
+
+var File_pbmesh_v1alpha1_connection_proto protoreflect.FileDescriptor
+
+var file_pbmesh_v1alpha1_connection_proto_rawDesc = []byte{
+	0x0a, 0x20, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x12, 0x1e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x22, 0x6e, 0x0a, 0x10, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2c, 0x0a, 0x12, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x5f, 0x6d, 0x73, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x04, 0x52, 0x10, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x54, 0x69, 0x6d, 0x65, 0x6f,
+	0x75, 0x74, 0x4d, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f,
+	0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x5f, 0x6d, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04,
+	0x52, 0x10, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x54, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74,
+	0x4d, 0x73, 0x22, 0xcd, 0x01, 0x0a, 0x18, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x43, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12,
+	0x36, 0x0a, 0x17, 0x6d, 0x61, 0x78, 0x5f, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x63,
+	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x04,
+	0x52, 0x15, 0x6d, 0x61, 0x78, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x43, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x79, 0x0a, 0x1b, 0x62, 0x61, 0x6c, 0x61, 0x6e,
+	0x63, 0x65, 0x5f, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x39, 0x2e, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
+	0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x42, 0x61,
+	0x6c, 0x61, 0x6e, 0x63, 0x65, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x43, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x19, 0x62, 0x61, 0x6c, 0x61, 0x6e, 0x63, 0x65,
+	0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x2a, 0x6b, 0x0a, 0x19, 0x42, 0x61, 0x6c, 0x61, 0x6e, 0x63, 0x65, 0x49, 0x6e, 0x62,
+	0x6f, 0x75, 0x6e, 0x64, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12,
+	0x27, 0x0a, 0x23, 0x42, 0x41, 0x4c, 0x41, 0x4e, 0x43, 0x45, 0x5f, 0x49, 0x4e, 0x42, 0x4f, 0x55,
+	0x4e, 0x44, 0x5f, 0x43, 0x4f, 0x4e, 0x4e, 0x45, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x53, 0x5f, 0x44,
+	0x45, 0x46, 0x41, 0x55, 0x4c, 0x54, 0x10, 0x00, 0x12, 0x25, 0x0a, 0x21, 0x42, 0x41, 0x4c, 0x41,
+	0x4e, 0x43, 0x45, 0x5f, 0x49, 0x4e, 0x42, 0x4f, 0x55, 0x4e, 0x44, 0x5f, 0x43, 0x4f, 0x4e, 0x4e,
+	0x45, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x53, 0x5f, 0x45, 0x58, 0x41, 0x43, 0x54, 0x10, 0x01, 0x42,
+	0x97, 0x02, 0x0a, 0x22, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x42, 0x0f, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x45, 0x67, 0x69, 0x74, 0x68, 0x75,
+	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f,
+	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62,
+	0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x3b, 0x6d, 0x65, 0x73, 0x68, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0xa2, 0x02, 0x03, 0x48, 0x43, 0x4d, 0xaa, 0x02, 0x1e, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x4d, 0x65, 0x73, 0x68, 0x2e, 0x56,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xca, 0x02, 0x1e, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68, 0x5c,
+	0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xe2, 0x02, 0x2a, 0x48, 0x61, 0x73, 0x68, 0x69,
+	0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68,
+	0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x21, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x4d, 0x65, 0x73, 0x68, 0x3a,
+	0x3a, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
+}
+
+var (
+	file_pbmesh_v1alpha1_connection_proto_rawDescOnce sync.Once
+	file_pbmesh_v1alpha1_connection_proto_rawDescData = file_pbmesh_v1alpha1_connection_proto_rawDesc
+)
+
+func file_pbmesh_v1alpha1_connection_proto_rawDescGZIP() []byte {
+	file_pbmesh_v1alpha1_connection_proto_rawDescOnce.Do(func() {
+		file_pbmesh_v1alpha1_connection_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbmesh_v1alpha1_connection_proto_rawDescData)
+	})
+	return file_pbmesh_v1alpha1_connection_proto_rawDescData
+}
+
+var file_pbmesh_v1alpha1_connection_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_pbmesh_v1alpha1_connection_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_pbmesh_v1alpha1_connection_proto_goTypes = []interface{}{
+	(BalanceInboundConnections)(0),   // 0: hashicorp.consul.mesh.v1alpha1.BalanceInboundConnections
+	(*ConnectionConfig)(nil),         // 1: hashicorp.consul.mesh.v1alpha1.ConnectionConfig
+	(*InboundConnectionsConfig)(nil), // 2: hashicorp.consul.mesh.v1alpha1.InboundConnectionsConfig
+}
+var file_pbmesh_v1alpha1_connection_proto_depIdxs = []int32{
+	0, // 0: hashicorp.consul.mesh.v1alpha1.InboundConnectionsConfig.balance_inbound_connections:type_name -> hashicorp.consul.mesh.v1alpha1.BalanceInboundConnections
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_pbmesh_v1alpha1_connection_proto_init() }
+func file_pbmesh_v1alpha1_connection_proto_init() {
+	if File_pbmesh_v1alpha1_connection_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_pbmesh_v1alpha1_connection_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ConnectionConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_connection_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*InboundConnectionsConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbmesh_v1alpha1_connection_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbmesh_v1alpha1_connection_proto_goTypes,
+		DependencyIndexes: file_pbmesh_v1alpha1_connection_proto_depIdxs,
+		EnumInfos:         file_pbmesh_v1alpha1_connection_proto_enumTypes,
+		MessageInfos:      file_pbmesh_v1alpha1_connection_proto_msgTypes,
+	}.Build()
+	File_pbmesh_v1alpha1_connection_proto = out.File
+	file_pbmesh_v1alpha1_connection_proto_rawDesc = nil
+	file_pbmesh_v1alpha1_connection_proto_goTypes = nil
+	file_pbmesh_v1alpha1_connection_proto_depIdxs = nil
+}
diff --git a/proto-public/pbmesh/v1alpha1/connection.proto b/proto-public/pbmesh/v1alpha1/connection.proto
new file mode 100644
index 000000000000..8a1f4f0e7c57
--- /dev/null
+++ b/proto-public/pbmesh/v1alpha1/connection.proto
@@ -0,0 +1,22 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.mesh.v1alpha1;
+
+message ConnectionConfig {
+  uint64 connect_timeout_ms = 2;
+  uint64 request_timeout_ms = 3;
+}
+
+message InboundConnectionsConfig {
+  uint64 max_inbound_connections = 12;
+  BalanceInboundConnections balance_inbound_connections = 13;
+}
+
+enum BalanceInboundConnections {
+  // buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
+  BALANCE_INBOUND_CONNECTIONS_DEFAULT = 0;
+  BALANCE_INBOUND_CONNECTIONS_EXACT = 1;
+}
diff --git a/proto-public/pbmesh/v1alpha1/expose.pb.binary.go b/proto-public/pbmesh/v1alpha1/expose.pb.binary.go
new file mode 100644
index 000000000000..f849d03db5a0
--- /dev/null
+++ b/proto-public/pbmesh/v1alpha1/expose.pb.binary.go
@@ -0,0 +1,28 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbmesh/v1alpha1/expose.proto
+
+package meshv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *ExposeConfig) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *ExposeConfig) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *ExposePath) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *ExposePath) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
diff --git a/proto-public/pbmesh/v1alpha1/expose.pb.go b/proto-public/pbmesh/v1alpha1/expose.pb.go
new file mode 100644
index 000000000000..8905de369f15
--- /dev/null
+++ b/proto-public/pbmesh/v1alpha1/expose.pb.go
@@ -0,0 +1,269 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: pbmesh/v1alpha1/expose.proto
+
+package meshv1alpha1
+
+import (
+	v1alpha1 "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type ExposeConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ExposePaths []*ExposePath `protobuf:"bytes,1,rep,name=expose_paths,json=exposePaths,proto3" json:"expose_paths,omitempty"`
+}
+
+func (x *ExposeConfig) Reset() {
+	*x = ExposeConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_expose_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ExposeConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExposeConfig) ProtoMessage() {}
+
+func (x *ExposeConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_expose_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExposeConfig.ProtoReflect.Descriptor instead.
+func (*ExposeConfig) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_expose_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ExposeConfig) GetExposePaths() []*ExposePath {
+	if x != nil {
+		return x.ExposePaths
+	}
+	return nil
+}
+
+type ExposePath struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ListenerPort  uint32            `protobuf:"varint,1,opt,name=listener_port,json=listenerPort,proto3" json:"listener_port,omitempty"`
+	Path          string            `protobuf:"bytes,2,opt,name=path,proto3" json:"path,omitempty"`
+	LocalPathPort uint32            `protobuf:"varint,3,opt,name=local_path_port,json=localPathPort,proto3" json:"local_path_port,omitempty"`
+	Protocol      v1alpha1.Protocol `protobuf:"varint,4,opt,name=protocol,proto3,enum=hashicorp.consul.catalog.v1alpha1.Protocol" json:"protocol,omitempty"`
+}
+
+func (x *ExposePath) Reset() {
+	*x = ExposePath{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_expose_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ExposePath) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExposePath) ProtoMessage() {}
+
+func (x *ExposePath) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_expose_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExposePath.ProtoReflect.Descriptor instead.
+func (*ExposePath) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_expose_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ExposePath) GetListenerPort() uint32 {
+	if x != nil {
+		return x.ListenerPort
+	}
+	return 0
+}
+
+func (x *ExposePath) GetPath() string {
+	if x != nil {
+		return x.Path
+	}
+	return ""
+}
+
+func (x *ExposePath) GetLocalPathPort() uint32 {
+	if x != nil {
+		return x.LocalPathPort
+	}
+	return 0
+}
+
+func (x *ExposePath) GetProtocol() v1alpha1.Protocol {
+	if x != nil {
+		return x.Protocol
+	}
+	return v1alpha1.Protocol(0)
+}
+
+var File_pbmesh_v1alpha1_expose_proto protoreflect.FileDescriptor
+
+var file_pbmesh_v1alpha1_expose_proto_rawDesc = []byte{
+	0x0a, 0x1c, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2f, 0x65, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1e,
+	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x1a, 0x21,
+	0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x22, 0x5d, 0x0a, 0x0c, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x12, 0x4d, 0x0a, 0x0c, 0x65, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x5f, 0x70, 0x61, 0x74, 0x68,
+	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x50,
+	0x61, 0x74, 0x68, 0x52, 0x0b, 0x65, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x50, 0x61, 0x74, 0x68, 0x73,
+	0x22, 0xb6, 0x01, 0x0a, 0x0a, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x50, 0x61, 0x74, 0x68, 0x12,
+	0x23, 0x0a, 0x0d, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x5f, 0x70, 0x6f, 0x72, 0x74,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0c, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72,
+	0x50, 0x6f, 0x72, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x26, 0x0a, 0x0f, 0x6c, 0x6f, 0x63, 0x61,
+	0x6c, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0d, 0x52, 0x0d, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x50, 0x61, 0x74, 0x68, 0x50, 0x6f, 0x72, 0x74,
+	0x12, 0x47, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x0e, 0x32, 0x2b, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52,
+	0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x42, 0x93, 0x02, 0x0a, 0x22, 0x63, 0x6f,
+	0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0x42, 0x0b, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a,
+	0x45, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68,
+	0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x3b, 0x6d, 0x65, 0x73, 0x68, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xa2, 0x02, 0x03, 0x48, 0x43, 0x4d, 0xaa, 0x02, 0x1e, 0x48,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
+	0x4d, 0x65, 0x73, 0x68, 0x2e, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xca, 0x02, 0x1e,
+	0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x5c, 0x4d, 0x65, 0x73, 0x68, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xe2, 0x02,
+	0x2a, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x5c,
+	0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x21, 0x48, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a,
+	0x3a, 0x4d, 0x65, 0x73, 0x68, 0x3a, 0x3a, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_pbmesh_v1alpha1_expose_proto_rawDescOnce sync.Once
+	file_pbmesh_v1alpha1_expose_proto_rawDescData = file_pbmesh_v1alpha1_expose_proto_rawDesc
+)
+
+func file_pbmesh_v1alpha1_expose_proto_rawDescGZIP() []byte {
+	file_pbmesh_v1alpha1_expose_proto_rawDescOnce.Do(func() {
+		file_pbmesh_v1alpha1_expose_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbmesh_v1alpha1_expose_proto_rawDescData)
+	})
+	return file_pbmesh_v1alpha1_expose_proto_rawDescData
+}
+
+var file_pbmesh_v1alpha1_expose_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_pbmesh_v1alpha1_expose_proto_goTypes = []interface{}{
+	(*ExposeConfig)(nil),   // 0: hashicorp.consul.mesh.v1alpha1.ExposeConfig
+	(*ExposePath)(nil),     // 1: hashicorp.consul.mesh.v1alpha1.ExposePath
+	(v1alpha1.Protocol)(0), // 2: hashicorp.consul.catalog.v1alpha1.Protocol
+}
+var file_pbmesh_v1alpha1_expose_proto_depIdxs = []int32{
+	1, // 0: hashicorp.consul.mesh.v1alpha1.ExposeConfig.expose_paths:type_name -> hashicorp.consul.mesh.v1alpha1.ExposePath
+	2, // 1: hashicorp.consul.mesh.v1alpha1.ExposePath.protocol:type_name -> hashicorp.consul.catalog.v1alpha1.Protocol
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_pbmesh_v1alpha1_expose_proto_init() }
+func file_pbmesh_v1alpha1_expose_proto_init() {
+	if File_pbmesh_v1alpha1_expose_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_pbmesh_v1alpha1_expose_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ExposeConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_expose_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ExposePath); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbmesh_v1alpha1_expose_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbmesh_v1alpha1_expose_proto_goTypes,
+		DependencyIndexes: file_pbmesh_v1alpha1_expose_proto_depIdxs,
+		MessageInfos:      file_pbmesh_v1alpha1_expose_proto_msgTypes,
+	}.Build()
+	File_pbmesh_v1alpha1_expose_proto = out.File
+	file_pbmesh_v1alpha1_expose_proto_rawDesc = nil
+	file_pbmesh_v1alpha1_expose_proto_goTypes = nil
+	file_pbmesh_v1alpha1_expose_proto_depIdxs = nil
+}
diff --git a/proto-public/pbmesh/v1alpha1/expose.proto b/proto-public/pbmesh/v1alpha1/expose.proto
new file mode 100644
index 000000000000..bf8591f20d74
--- /dev/null
+++ b/proto-public/pbmesh/v1alpha1/expose.proto
@@ -0,0 +1,19 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.mesh.v1alpha1;
+
+import "pbcatalog/v1alpha1/protocol.proto";
+
+message ExposeConfig {
+  repeated ExposePath expose_paths = 1;
+}
+
+message ExposePath {
+  uint32 listener_port = 1;
+  string path = 2;
+  uint32 local_path_port = 3;
+  hashicorp.consul.catalog.v1alpha1.Protocol protocol = 4;
+}
diff --git a/proto-public/pbmesh/v1alpha1/proxy.pb.binary.go b/proto-public/pbmesh/v1alpha1/proxy.pb.binary.go
new file mode 100644
index 000000000000..f39ae6afec84
--- /dev/null
+++ b/proto-public/pbmesh/v1alpha1/proxy.pb.binary.go
@@ -0,0 +1,48 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbmesh/v1alpha1/proxy.proto
+
+package meshv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *ProxyConfiguration) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *ProxyConfiguration) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *DynamicConfig) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *DynamicConfig) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *TransparentProxy) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *TransparentProxy) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *BootstrapConfig) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *BootstrapConfig) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
diff --git a/proto-public/pbmesh/v1alpha1/proxy.pb.go b/proto-public/pbmesh/v1alpha1/proxy.pb.go
new file mode 100644
index 000000000000..036b7a214b56
--- /dev/null
+++ b/proto-public/pbmesh/v1alpha1/proxy.pb.go
@@ -0,0 +1,816 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: pbmesh/v1alpha1/proxy.proto
+
+package meshv1alpha1
+
+import (
+	v1alpha1 "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	structpb "google.golang.org/protobuf/types/known/structpb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type ProxyMode int32
+
+const (
+	// ProxyModeDefault represents no specific mode and should
+	// be used to indicate that a different layer of the configuration
+	// chain should take precedence
+	// buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
+	ProxyMode_PROXY_MODE_DEFAULT ProxyMode = 0
+	// ProxyModeTransparent represents that inbound and outbound application
+	// traffic is being captured and redirected through the proxy.
+	ProxyMode_PROXY_MODE_TRANSPARENT ProxyMode = 1
+	// ProxyModeDirect represents that the proxy's listeners must be dialed directly
+	// by the local application and other proxies.
+	ProxyMode_PROXY_MODE_DIRECT ProxyMode = 2
+)
+
+// Enum value maps for ProxyMode.
+var (
+	ProxyMode_name = map[int32]string{
+		0: "PROXY_MODE_DEFAULT",
+		1: "PROXY_MODE_TRANSPARENT",
+		2: "PROXY_MODE_DIRECT",
+	}
+	ProxyMode_value = map[string]int32{
+		"PROXY_MODE_DEFAULT":     0,
+		"PROXY_MODE_TRANSPARENT": 1,
+		"PROXY_MODE_DIRECT":      2,
+	}
+)
+
+func (x ProxyMode) Enum() *ProxyMode {
+	p := new(ProxyMode)
+	*p = x
+	return p
+}
+
+func (x ProxyMode) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ProxyMode) Descriptor() protoreflect.EnumDescriptor {
+	return file_pbmesh_v1alpha1_proxy_proto_enumTypes[0].Descriptor()
+}
+
+func (ProxyMode) Type() protoreflect.EnumType {
+	return &file_pbmesh_v1alpha1_proxy_proto_enumTypes[0]
+}
+
+func (x ProxyMode) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ProxyMode.Descriptor instead.
+func (ProxyMode) EnumDescriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_proxy_proto_rawDescGZIP(), []int{0}
+}
+
+type ProxyConfiguration struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Selection of workloads this proxy configuration should apply to.
+	// These can be prefixes or specific workload names.
+	Workloads *v1alpha1.WorkloadSelector `protobuf:"bytes,1,opt,name=workloads,proto3" json:"workloads,omitempty"`
+	// dynamic_config is the configuration that could be changed
+	// dynamically (i.e. without needing restart).
+	DynamicConfig *DynamicConfig `protobuf:"bytes,2,opt,name=dynamic_config,json=dynamicConfig,proto3" json:"dynamic_config,omitempty"`
+	// bootstrap_config is the configuration that requires proxies
+	// to be restarted to be applied.
+	BootstrapConfig *BootstrapConfig `protobuf:"bytes,3,opt,name=bootstrap_config,json=bootstrapConfig,proto3" json:"bootstrap_config,omitempty"`
+	// deprecated: prevent usage when using v2 APIs directly.
+	// needed for backwards compatibility
+	//
+	// Deprecated: Do not use.
+	OpaqueConfig *structpb.Struct `protobuf:"bytes,4,opt,name=opaque_config,json=opaqueConfig,proto3" json:"opaque_config,omitempty"`
+}
+
+func (x *ProxyConfiguration) Reset() {
+	*x = ProxyConfiguration{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_proxy_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ProxyConfiguration) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ProxyConfiguration) ProtoMessage() {}
+
+func (x *ProxyConfiguration) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_proxy_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ProxyConfiguration.ProtoReflect.Descriptor instead.
+func (*ProxyConfiguration) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_proxy_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ProxyConfiguration) GetWorkloads() *v1alpha1.WorkloadSelector {
+	if x != nil {
+		return x.Workloads
+	}
+	return nil
+}
+
+func (x *ProxyConfiguration) GetDynamicConfig() *DynamicConfig {
+	if x != nil {
+		return x.DynamicConfig
+	}
+	return nil
+}
+
+func (x *ProxyConfiguration) GetBootstrapConfig() *BootstrapConfig {
+	if x != nil {
+		return x.BootstrapConfig
+	}
+	return nil
+}
+
+// Deprecated: Do not use.
+func (x *ProxyConfiguration) GetOpaqueConfig() *structpb.Struct {
+	if x != nil {
+		return x.OpaqueConfig
+	}
+	return nil
+}
+
+type DynamicConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// mode indicates the proxy's mode. This will default to 'transparent'.
+	Mode             ProxyMode         `protobuf:"varint,1,opt,name=mode,proto3,enum=hashicorp.consul.mesh.v1alpha1.ProxyMode" json:"mode,omitempty"`
+	TransparentProxy *TransparentProxy `protobuf:"bytes,2,opt,name=transparent_proxy,json=transparentProxy,proto3" json:"transparent_proxy,omitempty"`
+	// local_connection is the configuration that should be used
+	// to connect to the local application provided per-port.
+	// The map keys should correspond to port names on the workload.
+	LocalConnection map[string]*ConnectionConfig `protobuf:"bytes,3,rep,name=local_connection,json=localConnection,proto3" json:"local_connection,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// inbound_connections configures inbound connections to the proxy.
+	InboundConnections  *InboundConnectionsConfig `protobuf:"bytes,4,opt,name=inbound_connections,json=inboundConnections,proto3" json:"inbound_connections,omitempty"`
+	MeshGatewayMode     MeshGatewayMode           `protobuf:"varint,5,opt,name=mesh_gateway_mode,json=meshGatewayMode,proto3,enum=hashicorp.consul.mesh.v1alpha1.MeshGatewayMode" json:"mesh_gateway_mode,omitempty"`
+	ExposeConfig        *ExposeConfig             `protobuf:"bytes,6,opt,name=expose_config,json=exposeConfig,proto3" json:"expose_config,omitempty"`
+	PublicListenerJson  string                    `protobuf:"bytes,7,opt,name=public_listener_json,json=publicListenerJson,proto3" json:"public_listener_json,omitempty"`
+	ListenerTracingJson string                    `protobuf:"bytes,8,opt,name=listener_tracing_json,json=listenerTracingJson,proto3" json:"listener_tracing_json,omitempty"`
+	LocalClusterJson    string                    `protobuf:"bytes,9,opt,name=local_cluster_json,json=localClusterJson,proto3" json:"local_cluster_json,omitempty"`
+	// deprecated:
+	// local_workload_address, local_workload_port, and local_workload_socket_path
+	// are deprecated and are only needed for migration of existing resources.
+	//
+	// Deprecated: Do not use.
+	LocalWorkloadAddress string `protobuf:"bytes,10,opt,name=local_workload_address,json=localWorkloadAddress,proto3" json:"local_workload_address,omitempty"`
+	// Deprecated: Do not use.
+	LocalWorkloadPort uint32 `protobuf:"varint,11,opt,name=local_workload_port,json=localWorkloadPort,proto3" json:"local_workload_port,omitempty"`
+	// Deprecated: Do not use.
+	LocalWorkloadSocketPath string `protobuf:"bytes,12,opt,name=local_workload_socket_path,json=localWorkloadSocketPath,proto3" json:"local_workload_socket_path,omitempty"`
+}
+
+func (x *DynamicConfig) Reset() {
+	*x = DynamicConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_proxy_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DynamicConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DynamicConfig) ProtoMessage() {}
+
+func (x *DynamicConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_proxy_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DynamicConfig.ProtoReflect.Descriptor instead.
+func (*DynamicConfig) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_proxy_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *DynamicConfig) GetMode() ProxyMode {
+	if x != nil {
+		return x.Mode
+	}
+	return ProxyMode_PROXY_MODE_DEFAULT
+}
+
+func (x *DynamicConfig) GetTransparentProxy() *TransparentProxy {
+	if x != nil {
+		return x.TransparentProxy
+	}
+	return nil
+}
+
+func (x *DynamicConfig) GetLocalConnection() map[string]*ConnectionConfig {
+	if x != nil {
+		return x.LocalConnection
+	}
+	return nil
+}
+
+func (x *DynamicConfig) GetInboundConnections() *InboundConnectionsConfig {
+	if x != nil {
+		return x.InboundConnections
+	}
+	return nil
+}
+
+func (x *DynamicConfig) GetMeshGatewayMode() MeshGatewayMode {
+	if x != nil {
+		return x.MeshGatewayMode
+	}
+	return MeshGatewayMode_MESH_GATEWAY_MODE_UNSPECIFIED
+}
+
+func (x *DynamicConfig) GetExposeConfig() *ExposeConfig {
+	if x != nil {
+		return x.ExposeConfig
+	}
+	return nil
+}
+
+func (x *DynamicConfig) GetPublicListenerJson() string {
+	if x != nil {
+		return x.PublicListenerJson
+	}
+	return ""
+}
+
+func (x *DynamicConfig) GetListenerTracingJson() string {
+	if x != nil {
+		return x.ListenerTracingJson
+	}
+	return ""
+}
+
+func (x *DynamicConfig) GetLocalClusterJson() string {
+	if x != nil {
+		return x.LocalClusterJson
+	}
+	return ""
+}
+
+// Deprecated: Do not use.
+func (x *DynamicConfig) GetLocalWorkloadAddress() string {
+	if x != nil {
+		return x.LocalWorkloadAddress
+	}
+	return ""
+}
+
+// Deprecated: Do not use.
+func (x *DynamicConfig) GetLocalWorkloadPort() uint32 {
+	if x != nil {
+		return x.LocalWorkloadPort
+	}
+	return 0
+}
+
+// Deprecated: Do not use.
+func (x *DynamicConfig) GetLocalWorkloadSocketPath() string {
+	if x != nil {
+		return x.LocalWorkloadSocketPath
+	}
+	return ""
+}
+
+type TransparentProxy struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// outbound_listener_port is the port for the proxy's outbound listener.
+	// This defaults to 15001.
+	OutboundListenerPort uint32 `protobuf:"varint,1,opt,name=outbound_listener_port,json=outboundListenerPort,proto3" json:"outbound_listener_port,omitempty"`
+	// dialed_directly indicates whether this proxy should be dialed using original destination IP
+	// in the connection rather than load balance between all endpoints.
+	DialedDirectly bool `protobuf:"varint,2,opt,name=dialed_directly,json=dialedDirectly,proto3" json:"dialed_directly,omitempty"`
+}
+
+func (x *TransparentProxy) Reset() {
+	*x = TransparentProxy{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_proxy_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TransparentProxy) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TransparentProxy) ProtoMessage() {}
+
+func (x *TransparentProxy) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_proxy_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TransparentProxy.ProtoReflect.Descriptor instead.
+func (*TransparentProxy) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_proxy_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *TransparentProxy) GetOutboundListenerPort() uint32 {
+	if x != nil {
+		return x.OutboundListenerPort
+	}
+	return 0
+}
+
+func (x *TransparentProxy) GetDialedDirectly() bool {
+	if x != nil {
+		return x.DialedDirectly
+	}
+	return false
+}
+
+// BootstrapConfig is equivalent to configuration defined
+// in our docs.
+type BootstrapConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	StatsdUrl           string   `protobuf:"bytes,1,opt,name=statsd_url,json=statsdUrl,proto3" json:"statsd_url,omitempty"`
+	DogstatsdUrl        string   `protobuf:"bytes,2,opt,name=dogstatsd_url,json=dogstatsdUrl,proto3" json:"dogstatsd_url,omitempty"`
+	StatsTags           []string `protobuf:"bytes,3,rep,name=stats_tags,json=statsTags,proto3" json:"stats_tags,omitempty"`
+	PrometheusBindAddr  string   `protobuf:"bytes,4,opt,name=prometheus_bind_addr,json=prometheusBindAddr,proto3" json:"prometheus_bind_addr,omitempty"`
+	StatsBindAddr       string   `protobuf:"bytes,5,opt,name=stats_bind_addr,json=statsBindAddr,proto3" json:"stats_bind_addr,omitempty"`
+	ReadyBindAddr       string   `protobuf:"bytes,6,opt,name=ready_bind_addr,json=readyBindAddr,proto3" json:"ready_bind_addr,omitempty"`
+	OverrideJsonTpl     string   `protobuf:"bytes,7,opt,name=override_json_tpl,json=overrideJsonTpl,proto3" json:"override_json_tpl,omitempty"`
+	StaticClustersJson  string   `protobuf:"bytes,8,opt,name=static_clusters_json,json=staticClustersJson,proto3" json:"static_clusters_json,omitempty"`
+	StaticListenersJson string   `protobuf:"bytes,9,opt,name=static_listeners_json,json=staticListenersJson,proto3" json:"static_listeners_json,omitempty"`
+	StatsSinksJson      string   `protobuf:"bytes,10,opt,name=stats_sinks_json,json=statsSinksJson,proto3" json:"stats_sinks_json,omitempty"`
+	StatsConfigJson     string   `protobuf:"bytes,11,opt,name=stats_config_json,json=statsConfigJson,proto3" json:"stats_config_json,omitempty"`
+	StatsFlushInterval  string   `protobuf:"bytes,12,opt,name=stats_flush_interval,json=statsFlushInterval,proto3" json:"stats_flush_interval,omitempty"`
+	TracingConfigJson   string   `protobuf:"bytes,13,opt,name=tracing_config_json,json=tracingConfigJson,proto3" json:"tracing_config_json,omitempty"`
+}
+
+func (x *BootstrapConfig) Reset() {
+	*x = BootstrapConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_proxy_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BootstrapConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BootstrapConfig) ProtoMessage() {}
+
+func (x *BootstrapConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_proxy_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BootstrapConfig.ProtoReflect.Descriptor instead.
+func (*BootstrapConfig) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_proxy_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *BootstrapConfig) GetStatsdUrl() string {
+	if x != nil {
+		return x.StatsdUrl
+	}
+	return ""
+}
+
+func (x *BootstrapConfig) GetDogstatsdUrl() string {
+	if x != nil {
+		return x.DogstatsdUrl
+	}
+	return ""
+}
+
+func (x *BootstrapConfig) GetStatsTags() []string {
+	if x != nil {
+		return x.StatsTags
+	}
+	return nil
+}
+
+func (x *BootstrapConfig) GetPrometheusBindAddr() string {
+	if x != nil {
+		return x.PrometheusBindAddr
+	}
+	return ""
+}
+
+func (x *BootstrapConfig) GetStatsBindAddr() string {
+	if x != nil {
+		return x.StatsBindAddr
+	}
+	return ""
+}
+
+func (x *BootstrapConfig) GetReadyBindAddr() string {
+	if x != nil {
+		return x.ReadyBindAddr
+	}
+	return ""
+}
+
+func (x *BootstrapConfig) GetOverrideJsonTpl() string {
+	if x != nil {
+		return x.OverrideJsonTpl
+	}
+	return ""
+}
+
+func (x *BootstrapConfig) GetStaticClustersJson() string {
+	if x != nil {
+		return x.StaticClustersJson
+	}
+	return ""
+}
+
+func (x *BootstrapConfig) GetStaticListenersJson() string {
+	if x != nil {
+		return x.StaticListenersJson
+	}
+	return ""
+}
+
+func (x *BootstrapConfig) GetStatsSinksJson() string {
+	if x != nil {
+		return x.StatsSinksJson
+	}
+	return ""
+}
+
+func (x *BootstrapConfig) GetStatsConfigJson() string {
+	if x != nil {
+		return x.StatsConfigJson
+	}
+	return ""
+}
+
+func (x *BootstrapConfig) GetStatsFlushInterval() string {
+	if x != nil {
+		return x.StatsFlushInterval
+	}
+	return ""
+}
+
+func (x *BootstrapConfig) GetTracingConfigJson() string {
+	if x != nil {
+		return x.TracingConfigJson
+	}
+	return ""
+}
+
+var File_pbmesh_v1alpha1_proxy_proto protoreflect.FileDescriptor
+
+var file_pbmesh_v1alpha1_proxy_proto_rawDesc = []byte{
+	0x0a, 0x1b, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2f, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1e, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
+	0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x1a, 0x1c, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x73,
+	0x74, 0x72, 0x75, 0x63, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x21, 0x70, 0x62, 0x63,
+	0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f,
+	0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x20,
+	0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f,
+	0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x1a, 0x1c, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2f, 0x65, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1d,
+	0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f,
+	0x72, 0x6f, 0x75, 0x74, 0x69, 0x6e, 0x67, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xdb, 0x02,
+	0x0a, 0x12, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x51, 0x0a, 0x09, 0x77, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64,
+	0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x33, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c,
+	0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x57, 0x6f, 0x72, 0x6b,
+	0x6c, 0x6f, 0x61, 0x64, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x52, 0x09, 0x77, 0x6f,
+	0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x73, 0x12, 0x54, 0x0a, 0x0e, 0x64, 0x79, 0x6e, 0x61, 0x6d,
+	0x69, 0x63, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x2d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0d,
+	0x64, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x5a, 0x0a,
+	0x10, 0x62, 0x6f, 0x6f, 0x74, 0x73, 0x74, 0x72, 0x61, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x42, 0x6f, 0x6f, 0x74, 0x73, 0x74, 0x72,
+	0x61, 0x70, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0f, 0x62, 0x6f, 0x6f, 0x74, 0x73, 0x74,
+	0x72, 0x61, 0x70, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x40, 0x0a, 0x0d, 0x6f, 0x70, 0x61,
+	0x71, 0x75, 0x65, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x42, 0x02, 0x18, 0x01, 0x52, 0x0c, 0x6f,
+	0x70, 0x61, 0x71, 0x75, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0xf0, 0x07, 0x0a, 0x0d,
+	0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x3d, 0x0a,
+	0x04, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x29, 0x2e, 0x68, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d,
+	0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x50, 0x72, 0x6f,
+	0x78, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x52, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x12, 0x5d, 0x0a, 0x11,
+	0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x5f, 0x70, 0x72, 0x6f, 0x78,
+	0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x61,
+	0x72, 0x65, 0x6e, 0x74, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x52, 0x10, 0x74, 0x72, 0x61, 0x6e, 0x73,
+	0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x12, 0x6d, 0x0a, 0x10, 0x6c,
+	0x6f, 0x63, 0x61, 0x6c, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18,
+	0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x42, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x2e, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0f, 0x6c, 0x6f, 0x63, 0x61, 0x6c,
+	0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x69, 0x0a, 0x13, 0x69, 0x6e,
+	0x62, 0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64,
+	0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x52, 0x12, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x5b, 0x0a, 0x11, 0x6d, 0x65, 0x73, 0x68, 0x5f, 0x67, 0x61,
+	0x74, 0x65, 0x77, 0x61, 0x79, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0e,
+	0x32, 0x2f, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2e, 0x4d, 0x65, 0x73, 0x68, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x4d, 0x6f, 0x64,
+	0x65, 0x52, 0x0f, 0x6d, 0x65, 0x73, 0x68, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x4d, 0x6f,
+	0x64, 0x65, 0x12, 0x51, 0x0a, 0x0d, 0x65, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x5f, 0x63, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x68, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73,
+	0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x45, 0x78, 0x70, 0x6f, 0x73,
+	0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0c, 0x65, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x30, 0x0a, 0x14, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f,
+	0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x5f, 0x6a, 0x73, 0x6f, 0x6e, 0x18, 0x07, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x12, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4c, 0x69, 0x73, 0x74, 0x65,
+	0x6e, 0x65, 0x72, 0x4a, 0x73, 0x6f, 0x6e, 0x12, 0x32, 0x0a, 0x15, 0x6c, 0x69, 0x73, 0x74, 0x65,
+	0x6e, 0x65, 0x72, 0x5f, 0x74, 0x72, 0x61, 0x63, 0x69, 0x6e, 0x67, 0x5f, 0x6a, 0x73, 0x6f, 0x6e,
+	0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72,
+	0x54, 0x72, 0x61, 0x63, 0x69, 0x6e, 0x67, 0x4a, 0x73, 0x6f, 0x6e, 0x12, 0x2c, 0x0a, 0x12, 0x6c,
+	0x6f, 0x63, 0x61, 0x6c, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x6a, 0x73, 0x6f,
+	0x6e, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x43, 0x6c,
+	0x75, 0x73, 0x74, 0x65, 0x72, 0x4a, 0x73, 0x6f, 0x6e, 0x12, 0x38, 0x0a, 0x16, 0x6c, 0x6f, 0x63,
+	0x61, 0x6c, 0x5f, 0x77, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x5f, 0x61, 0x64, 0x64, 0x72,
+	0x65, 0x73, 0x73, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x14, 0x6c,
+	0x6f, 0x63, 0x61, 0x6c, 0x57, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x41, 0x64, 0x64, 0x72,
+	0x65, 0x73, 0x73, 0x12, 0x32, 0x0a, 0x13, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x5f, 0x77, 0x6f, 0x72,
+	0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0d,
+	0x42, 0x02, 0x18, 0x01, 0x52, 0x11, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x57, 0x6f, 0x72, 0x6b, 0x6c,
+	0x6f, 0x61, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x3f, 0x0a, 0x1a, 0x6c, 0x6f, 0x63, 0x61, 0x6c,
+	0x5f, 0x77, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x5f, 0x73, 0x6f, 0x63, 0x6b, 0x65, 0x74,
+	0x5f, 0x70, 0x61, 0x74, 0x68, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52,
+	0x17, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x57, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x53, 0x6f,
+	0x63, 0x6b, 0x65, 0x74, 0x50, 0x61, 0x74, 0x68, 0x1a, 0x74, 0x0a, 0x14, 0x4c, 0x6f, 0x63, 0x61,
+	0x6c, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x74, 0x72, 0x79,
+	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
+	0x65, 0x79, 0x12, 0x46, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x30, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x2e, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x71,
+	0x0a, 0x10, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x50, 0x72, 0x6f,
+	0x78, 0x79, 0x12, 0x34, 0x0a, 0x16, 0x6f, 0x75, 0x74, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x6c,
+	0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0d, 0x52, 0x14, 0x6f, 0x75, 0x74, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x4c, 0x69, 0x73, 0x74,
+	0x65, 0x6e, 0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x27, 0x0a, 0x0f, 0x64, 0x69, 0x61, 0x6c,
+	0x65, 0x64, 0x5f, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6c, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x0e, 0x64, 0x69, 0x61, 0x6c, 0x65, 0x64, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6c,
+	0x79, 0x22, 0xc0, 0x04, 0x0a, 0x0f, 0x42, 0x6f, 0x6f, 0x74, 0x73, 0x74, 0x72, 0x61, 0x70, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x74, 0x73, 0x64, 0x5f,
+	0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x74, 0x61, 0x74, 0x73,
+	0x64, 0x55, 0x72, 0x6c, 0x12, 0x23, 0x0a, 0x0d, 0x64, 0x6f, 0x67, 0x73, 0x74, 0x61, 0x74, 0x73,
+	0x64, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x64, 0x6f, 0x67,
+	0x73, 0x74, 0x61, 0x74, 0x73, 0x64, 0x55, 0x72, 0x6c, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x74, 0x61,
+	0x74, 0x73, 0x5f, 0x74, 0x61, 0x67, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x09, 0x73,
+	0x74, 0x61, 0x74, 0x73, 0x54, 0x61, 0x67, 0x73, 0x12, 0x30, 0x0a, 0x14, 0x70, 0x72, 0x6f, 0x6d,
+	0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x5f, 0x62, 0x69, 0x6e, 0x64, 0x5f, 0x61, 0x64, 0x64, 0x72,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x70, 0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65,
+	0x75, 0x73, 0x42, 0x69, 0x6e, 0x64, 0x41, 0x64, 0x64, 0x72, 0x12, 0x26, 0x0a, 0x0f, 0x73, 0x74,
+	0x61, 0x74, 0x73, 0x5f, 0x62, 0x69, 0x6e, 0x64, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0d, 0x73, 0x74, 0x61, 0x74, 0x73, 0x42, 0x69, 0x6e, 0x64, 0x41, 0x64,
+	0x64, 0x72, 0x12, 0x26, 0x0a, 0x0f, 0x72, 0x65, 0x61, 0x64, 0x79, 0x5f, 0x62, 0x69, 0x6e, 0x64,
+	0x5f, 0x61, 0x64, 0x64, 0x72, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x72, 0x65, 0x61,
+	0x64, 0x79, 0x42, 0x69, 0x6e, 0x64, 0x41, 0x64, 0x64, 0x72, 0x12, 0x2a, 0x0a, 0x11, 0x6f, 0x76,
+	0x65, 0x72, 0x72, 0x69, 0x64, 0x65, 0x5f, 0x6a, 0x73, 0x6f, 0x6e, 0x5f, 0x74, 0x70, 0x6c, 0x18,
+	0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x6f, 0x76, 0x65, 0x72, 0x72, 0x69, 0x64, 0x65, 0x4a,
+	0x73, 0x6f, 0x6e, 0x54, 0x70, 0x6c, 0x12, 0x30, 0x0a, 0x14, 0x73, 0x74, 0x61, 0x74, 0x69, 0x63,
+	0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x73, 0x5f, 0x6a, 0x73, 0x6f, 0x6e, 0x18, 0x08,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x73, 0x74, 0x61, 0x74, 0x69, 0x63, 0x43, 0x6c, 0x75, 0x73,
+	0x74, 0x65, 0x72, 0x73, 0x4a, 0x73, 0x6f, 0x6e, 0x12, 0x32, 0x0a, 0x15, 0x73, 0x74, 0x61, 0x74,
+	0x69, 0x63, 0x5f, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x73, 0x5f, 0x6a, 0x73, 0x6f,
+	0x6e, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x73, 0x74, 0x61, 0x74, 0x69, 0x63, 0x4c,
+	0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x73, 0x4a, 0x73, 0x6f, 0x6e, 0x12, 0x28, 0x0a, 0x10,
+	0x73, 0x74, 0x61, 0x74, 0x73, 0x5f, 0x73, 0x69, 0x6e, 0x6b, 0x73, 0x5f, 0x6a, 0x73, 0x6f, 0x6e,
+	0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x73, 0x74, 0x61, 0x74, 0x73, 0x53, 0x69, 0x6e,
+	0x6b, 0x73, 0x4a, 0x73, 0x6f, 0x6e, 0x12, 0x2a, 0x0a, 0x11, 0x73, 0x74, 0x61, 0x74, 0x73, 0x5f,
+	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x6a, 0x73, 0x6f, 0x6e, 0x18, 0x0b, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0f, 0x73, 0x74, 0x61, 0x74, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x4a, 0x73,
+	0x6f, 0x6e, 0x12, 0x30, 0x0a, 0x14, 0x73, 0x74, 0x61, 0x74, 0x73, 0x5f, 0x66, 0x6c, 0x75, 0x73,
+	0x68, 0x5f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x12, 0x73, 0x74, 0x61, 0x74, 0x73, 0x46, 0x6c, 0x75, 0x73, 0x68, 0x49, 0x6e, 0x74, 0x65,
+	0x72, 0x76, 0x61, 0x6c, 0x12, 0x2e, 0x0a, 0x13, 0x74, 0x72, 0x61, 0x63, 0x69, 0x6e, 0x67, 0x5f,
+	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x6a, 0x73, 0x6f, 0x6e, 0x18, 0x0d, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x11, 0x74, 0x72, 0x61, 0x63, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x4a, 0x73, 0x6f, 0x6e, 0x2a, 0x56, 0x0a, 0x09, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x6f, 0x64,
+	0x65, 0x12, 0x16, 0x0a, 0x12, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x4d, 0x4f, 0x44, 0x45, 0x5f,
+	0x44, 0x45, 0x46, 0x41, 0x55, 0x4c, 0x54, 0x10, 0x00, 0x12, 0x1a, 0x0a, 0x16, 0x50, 0x52, 0x4f,
+	0x58, 0x59, 0x5f, 0x4d, 0x4f, 0x44, 0x45, 0x5f, 0x54, 0x52, 0x41, 0x4e, 0x53, 0x50, 0x41, 0x52,
+	0x45, 0x4e, 0x54, 0x10, 0x01, 0x12, 0x15, 0x0a, 0x11, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x4d,
+	0x4f, 0x44, 0x45, 0x5f, 0x44, 0x49, 0x52, 0x45, 0x43, 0x54, 0x10, 0x02, 0x42, 0x92, 0x02, 0x0a,
+	0x22, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x42, 0x0a, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50,
+	0x01, 0x5a, 0x45, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62, 0x6d, 0x65,
+	0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x3b, 0x6d, 0x65, 0x73, 0x68,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xa2, 0x02, 0x03, 0x48, 0x43, 0x4d, 0xaa, 0x02,
+	0x1e, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x4d, 0x65, 0x73, 0x68, 0x2e, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xca,
+	0x02, 0x1e, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0xe2, 0x02, 0x2a, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x21,
+	0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x3a, 0x3a, 0x4d, 0x65, 0x73, 0x68, 0x3a, 0x3a, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_pbmesh_v1alpha1_proxy_proto_rawDescOnce sync.Once
+	file_pbmesh_v1alpha1_proxy_proto_rawDescData = file_pbmesh_v1alpha1_proxy_proto_rawDesc
+)
+
+func file_pbmesh_v1alpha1_proxy_proto_rawDescGZIP() []byte {
+	file_pbmesh_v1alpha1_proxy_proto_rawDescOnce.Do(func() {
+		file_pbmesh_v1alpha1_proxy_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbmesh_v1alpha1_proxy_proto_rawDescData)
+	})
+	return file_pbmesh_v1alpha1_proxy_proto_rawDescData
+}
+
+var file_pbmesh_v1alpha1_proxy_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_pbmesh_v1alpha1_proxy_proto_msgTypes = make([]protoimpl.MessageInfo, 5)
+var file_pbmesh_v1alpha1_proxy_proto_goTypes = []interface{}{
+	(ProxyMode)(0),                    // 0: hashicorp.consul.mesh.v1alpha1.ProxyMode
+	(*ProxyConfiguration)(nil),        // 1: hashicorp.consul.mesh.v1alpha1.ProxyConfiguration
+	(*DynamicConfig)(nil),             // 2: hashicorp.consul.mesh.v1alpha1.DynamicConfig
+	(*TransparentProxy)(nil),          // 3: hashicorp.consul.mesh.v1alpha1.TransparentProxy
+	(*BootstrapConfig)(nil),           // 4: hashicorp.consul.mesh.v1alpha1.BootstrapConfig
+	nil,                               // 5: hashicorp.consul.mesh.v1alpha1.DynamicConfig.LocalConnectionEntry
+	(*v1alpha1.WorkloadSelector)(nil), // 6: hashicorp.consul.catalog.v1alpha1.WorkloadSelector
+	(*structpb.Struct)(nil),           // 7: google.protobuf.Struct
+	(*InboundConnectionsConfig)(nil),  // 8: hashicorp.consul.mesh.v1alpha1.InboundConnectionsConfig
+	(MeshGatewayMode)(0),              // 9: hashicorp.consul.mesh.v1alpha1.MeshGatewayMode
+	(*ExposeConfig)(nil),              // 10: hashicorp.consul.mesh.v1alpha1.ExposeConfig
+	(*ConnectionConfig)(nil),          // 11: hashicorp.consul.mesh.v1alpha1.ConnectionConfig
+}
+var file_pbmesh_v1alpha1_proxy_proto_depIdxs = []int32{
+	6,  // 0: hashicorp.consul.mesh.v1alpha1.ProxyConfiguration.workloads:type_name -> hashicorp.consul.catalog.v1alpha1.WorkloadSelector
+	2,  // 1: hashicorp.consul.mesh.v1alpha1.ProxyConfiguration.dynamic_config:type_name -> hashicorp.consul.mesh.v1alpha1.DynamicConfig
+	4,  // 2: hashicorp.consul.mesh.v1alpha1.ProxyConfiguration.bootstrap_config:type_name -> hashicorp.consul.mesh.v1alpha1.BootstrapConfig
+	7,  // 3: hashicorp.consul.mesh.v1alpha1.ProxyConfiguration.opaque_config:type_name -> google.protobuf.Struct
+	0,  // 4: hashicorp.consul.mesh.v1alpha1.DynamicConfig.mode:type_name -> hashicorp.consul.mesh.v1alpha1.ProxyMode
+	3,  // 5: hashicorp.consul.mesh.v1alpha1.DynamicConfig.transparent_proxy:type_name -> hashicorp.consul.mesh.v1alpha1.TransparentProxy
+	5,  // 6: hashicorp.consul.mesh.v1alpha1.DynamicConfig.local_connection:type_name -> hashicorp.consul.mesh.v1alpha1.DynamicConfig.LocalConnectionEntry
+	8,  // 7: hashicorp.consul.mesh.v1alpha1.DynamicConfig.inbound_connections:type_name -> hashicorp.consul.mesh.v1alpha1.InboundConnectionsConfig
+	9,  // 8: hashicorp.consul.mesh.v1alpha1.DynamicConfig.mesh_gateway_mode:type_name -> hashicorp.consul.mesh.v1alpha1.MeshGatewayMode
+	10, // 9: hashicorp.consul.mesh.v1alpha1.DynamicConfig.expose_config:type_name -> hashicorp.consul.mesh.v1alpha1.ExposeConfig
+	11, // 10: hashicorp.consul.mesh.v1alpha1.DynamicConfig.LocalConnectionEntry.value:type_name -> hashicorp.consul.mesh.v1alpha1.ConnectionConfig
+	11, // [11:11] is the sub-list for method output_type
+	11, // [11:11] is the sub-list for method input_type
+	11, // [11:11] is the sub-list for extension type_name
+	11, // [11:11] is the sub-list for extension extendee
+	0,  // [0:11] is the sub-list for field type_name
+}
+
+func init() { file_pbmesh_v1alpha1_proxy_proto_init() }
+func file_pbmesh_v1alpha1_proxy_proto_init() {
+	if File_pbmesh_v1alpha1_proxy_proto != nil {
+		return
+	}
+	file_pbmesh_v1alpha1_connection_proto_init()
+	file_pbmesh_v1alpha1_expose_proto_init()
+	file_pbmesh_v1alpha1_routing_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_pbmesh_v1alpha1_proxy_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ProxyConfiguration); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_proxy_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DynamicConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_proxy_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TransparentProxy); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_proxy_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BootstrapConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbmesh_v1alpha1_proxy_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   5,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbmesh_v1alpha1_proxy_proto_goTypes,
+		DependencyIndexes: file_pbmesh_v1alpha1_proxy_proto_depIdxs,
+		EnumInfos:         file_pbmesh_v1alpha1_proxy_proto_enumTypes,
+		MessageInfos:      file_pbmesh_v1alpha1_proxy_proto_msgTypes,
+	}.Build()
+	File_pbmesh_v1alpha1_proxy_proto = out.File
+	file_pbmesh_v1alpha1_proxy_proto_rawDesc = nil
+	file_pbmesh_v1alpha1_proxy_proto_goTypes = nil
+	file_pbmesh_v1alpha1_proxy_proto_depIdxs = nil
+}
diff --git a/proto-public/pbmesh/v1alpha1/proxy.proto b/proto-public/pbmesh/v1alpha1/proxy.proto
new file mode 100644
index 000000000000..06ebecbf4aba
--- /dev/null
+++ b/proto-public/pbmesh/v1alpha1/proxy.proto
@@ -0,0 +1,104 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.mesh.v1alpha1;
+
+import "google/protobuf/struct.proto";
+import "pbcatalog/v1alpha1/selector.proto";
+import "pbmesh/v1alpha1/connection.proto";
+import "pbmesh/v1alpha1/expose.proto";
+import "pbmesh/v1alpha1/routing.proto";
+
+message ProxyConfiguration {
+  // Selection of workloads this proxy configuration should apply to.
+  // These can be prefixes or specific workload names.
+  hashicorp.consul.catalog.v1alpha1.WorkloadSelector workloads = 1;
+
+  // dynamic_config is the configuration that could be changed
+  // dynamically (i.e. without needing restart).
+  DynamicConfig dynamic_config = 2;
+
+  // bootstrap_config is the configuration that requires proxies
+  // to be restarted to be applied.
+  BootstrapConfig bootstrap_config = 3;
+
+  // deprecated: prevent usage when using v2 APIs directly.
+  // needed for backwards compatibility
+  google.protobuf.Struct opaque_config = 4 [deprecated = true];
+}
+
+message DynamicConfig {
+  // mode indicates the proxy's mode. This will default to 'transparent'.
+  ProxyMode mode = 1;
+
+  TransparentProxy transparent_proxy = 2;
+
+  // local_connection is the configuration that should be used
+  // to connect to the local application provided per-port.
+  // The map keys should correspond to port names on the workload.
+  map<string, ConnectionConfig> local_connection = 3;
+
+  // inbound_connections configures inbound connections to the proxy.
+  InboundConnectionsConfig inbound_connections = 4;
+
+  MeshGatewayMode mesh_gateway_mode = 5;
+
+  ExposeConfig expose_config = 6;
+
+  string public_listener_json = 7;
+  string listener_tracing_json = 8;
+  string local_cluster_json = 9;
+
+  // deprecated:
+  // local_workload_address, local_workload_port, and local_workload_socket_path
+  // are deprecated and are only needed for migration of existing resources.
+  string local_workload_address = 10 [deprecated = true];
+  uint32 local_workload_port = 11 [deprecated = true];
+  string local_workload_socket_path = 12 [deprecated = true];
+}
+
+message TransparentProxy {
+  // outbound_listener_port is the port for the proxy's outbound listener.
+  // This defaults to 15001.
+  uint32 outbound_listener_port = 1;
+
+  // dialed_directly indicates whether this proxy should be dialed using original destination IP
+  // in the connection rather than load balance between all endpoints.
+  bool dialed_directly = 2;
+}
+
+// BootstrapConfig is equivalent to configuration defined
+// in our docs.
+message BootstrapConfig {
+  string statsd_url = 1;
+  string dogstatsd_url = 2;
+  repeated string stats_tags = 3;
+  string prometheus_bind_addr = 4;
+  string stats_bind_addr = 5;
+  string ready_bind_addr = 6;
+  string override_json_tpl = 7;
+  string static_clusters_json = 8;
+  string static_listeners_json = 9;
+  string stats_sinks_json = 10;
+  string stats_config_json = 11;
+  string stats_flush_interval = 12;
+  string tracing_config_json = 13;
+}
+
+enum ProxyMode {
+  // ProxyModeDefault represents no specific mode and should
+  // be used to indicate that a different layer of the configuration
+  // chain should take precedence
+  // buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
+  PROXY_MODE_DEFAULT = 0;
+
+  // ProxyModeTransparent represents that inbound and outbound application
+  // traffic is being captured and redirected through the proxy.
+  PROXY_MODE_TRANSPARENT = 1;
+
+  // ProxyModeDirect represents that the proxy's listeners must be dialed directly
+  // by the local application and other proxies.
+  PROXY_MODE_DIRECT = 2;
+}
diff --git a/proto-public/pbmesh/v1alpha1/routing.pb.go b/proto-public/pbmesh/v1alpha1/routing.pb.go
new file mode 100644
index 000000000000..f979d3bf6864
--- /dev/null
+++ b/proto-public/pbmesh/v1alpha1/routing.pb.go
@@ -0,0 +1,181 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: pbmesh/v1alpha1/routing.proto
+
+package meshv1alpha1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type MeshGatewayMode int32
+
+const (
+	// MESH_GATEWAY_MODE_UNSPECIFIED represents no specific mode and should be
+	// used to indicate that a the decision on the mode will be made by other
+	// configuration or default settings.
+	MeshGatewayMode_MESH_GATEWAY_MODE_UNSPECIFIED MeshGatewayMode = 0
+	// MESH_GATEWAY_MODE_NONE is the mode to use when traffic should not be
+	// routed through any gateway but instead be routed directly to the
+	// destination.
+	MeshGatewayMode_MESH_GATEWAY_MODE_NONE MeshGatewayMode = 1
+	// MESH_GATEWAY_MODE_LOCAL is the mode to use when traffic should be routed
+	// to the local gateway. The local gateway will then ensure that the
+	// connection is proxied correctly to its final destination. This mode will
+	// most often be needed for workloads that are prevented from making outbound
+	// requests outside of their local network/environment. In this case a
+	// gateway will sit at the edge of sit at the edge of the network and will
+	// proxy outbound connections potentially to other gateways in remote
+	// environments.
+	MeshGatewayMode_MESH_GATEWAY_MODE_LOCAL MeshGatewayMode = 2
+	// MESH_GATEWAY_MODE_REMOTE is the mode to use when traffic should be routed
+	// to a remote mesh gateway. This mode will most often be used when workloads
+	// can make outbound requests destined for a remote network/environment but
+	// where the remote network/environment will not allow direct addressing. The
+	// mesh gateway in the remote environment will sit at the edge and proxy
+	// requests into that environment.
+	MeshGatewayMode_MESH_GATEWAY_MODE_REMOTE MeshGatewayMode = 3
+)
+
+// Enum value maps for MeshGatewayMode.
+var (
+	MeshGatewayMode_name = map[int32]string{
+		0: "MESH_GATEWAY_MODE_UNSPECIFIED",
+		1: "MESH_GATEWAY_MODE_NONE",
+		2: "MESH_GATEWAY_MODE_LOCAL",
+		3: "MESH_GATEWAY_MODE_REMOTE",
+	}
+	MeshGatewayMode_value = map[string]int32{
+		"MESH_GATEWAY_MODE_UNSPECIFIED": 0,
+		"MESH_GATEWAY_MODE_NONE":        1,
+		"MESH_GATEWAY_MODE_LOCAL":       2,
+		"MESH_GATEWAY_MODE_REMOTE":      3,
+	}
+)
+
+func (x MeshGatewayMode) Enum() *MeshGatewayMode {
+	p := new(MeshGatewayMode)
+	*p = x
+	return p
+}
+
+func (x MeshGatewayMode) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (MeshGatewayMode) Descriptor() protoreflect.EnumDescriptor {
+	return file_pbmesh_v1alpha1_routing_proto_enumTypes[0].Descriptor()
+}
+
+func (MeshGatewayMode) Type() protoreflect.EnumType {
+	return &file_pbmesh_v1alpha1_routing_proto_enumTypes[0]
+}
+
+func (x MeshGatewayMode) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use MeshGatewayMode.Descriptor instead.
+func (MeshGatewayMode) EnumDescriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_routing_proto_rawDescGZIP(), []int{0}
+}
+
+var File_pbmesh_v1alpha1_routing_proto protoreflect.FileDescriptor
+
+var file_pbmesh_v1alpha1_routing_proto_rawDesc = []byte{
+	0x0a, 0x1d, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2f, 0x72, 0x6f, 0x75, 0x74, 0x69, 0x6e, 0x67, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12,
+	0x1e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2a,
+	0x8b, 0x01, 0x0a, 0x0f, 0x4d, 0x65, 0x73, 0x68, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x4d,
+	0x6f, 0x64, 0x65, 0x12, 0x21, 0x0a, 0x1d, 0x4d, 0x45, 0x53, 0x48, 0x5f, 0x47, 0x41, 0x54, 0x45,
+	0x57, 0x41, 0x59, 0x5f, 0x4d, 0x4f, 0x44, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49,
+	0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1a, 0x0a, 0x16, 0x4d, 0x45, 0x53, 0x48, 0x5f, 0x47,
+	0x41, 0x54, 0x45, 0x57, 0x41, 0x59, 0x5f, 0x4d, 0x4f, 0x44, 0x45, 0x5f, 0x4e, 0x4f, 0x4e, 0x45,
+	0x10, 0x01, 0x12, 0x1b, 0x0a, 0x17, 0x4d, 0x45, 0x53, 0x48, 0x5f, 0x47, 0x41, 0x54, 0x45, 0x57,
+	0x41, 0x59, 0x5f, 0x4d, 0x4f, 0x44, 0x45, 0x5f, 0x4c, 0x4f, 0x43, 0x41, 0x4c, 0x10, 0x02, 0x12,
+	0x1c, 0x0a, 0x18, 0x4d, 0x45, 0x53, 0x48, 0x5f, 0x47, 0x41, 0x54, 0x45, 0x57, 0x41, 0x59, 0x5f,
+	0x4d, 0x4f, 0x44, 0x45, 0x5f, 0x52, 0x45, 0x4d, 0x4f, 0x54, 0x45, 0x10, 0x03, 0x42, 0x94, 0x02,
+	0x0a, 0x22, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
+	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x42, 0x0c, 0x52, 0x6f, 0x75, 0x74, 0x69, 0x6e, 0x67, 0x50, 0x72, 0x6f,
+	0x74, 0x6f, 0x50, 0x01, 0x5a, 0x45, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
+	0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x70,
+	0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x3b, 0x6d,
+	0x65, 0x73, 0x68, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xa2, 0x02, 0x03, 0x48, 0x43,
+	0x4d, 0xaa, 0x02, 0x1e, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x4d, 0x65, 0x73, 0x68, 0x2e, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0xca, 0x02, 0x1e, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0xe2, 0x02, 0x2a, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c,
+	0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68, 0x5c, 0x56, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0xea, 0x02, 0x21, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x4d, 0x65, 0x73, 0x68, 0x3a, 0x3a, 0x56, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_pbmesh_v1alpha1_routing_proto_rawDescOnce sync.Once
+	file_pbmesh_v1alpha1_routing_proto_rawDescData = file_pbmesh_v1alpha1_routing_proto_rawDesc
+)
+
+func file_pbmesh_v1alpha1_routing_proto_rawDescGZIP() []byte {
+	file_pbmesh_v1alpha1_routing_proto_rawDescOnce.Do(func() {
+		file_pbmesh_v1alpha1_routing_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbmesh_v1alpha1_routing_proto_rawDescData)
+	})
+	return file_pbmesh_v1alpha1_routing_proto_rawDescData
+}
+
+var file_pbmesh_v1alpha1_routing_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_pbmesh_v1alpha1_routing_proto_goTypes = []interface{}{
+	(MeshGatewayMode)(0), // 0: hashicorp.consul.mesh.v1alpha1.MeshGatewayMode
+}
+var file_pbmesh_v1alpha1_routing_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_pbmesh_v1alpha1_routing_proto_init() }
+func file_pbmesh_v1alpha1_routing_proto_init() {
+	if File_pbmesh_v1alpha1_routing_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbmesh_v1alpha1_routing_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   0,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbmesh_v1alpha1_routing_proto_goTypes,
+		DependencyIndexes: file_pbmesh_v1alpha1_routing_proto_depIdxs,
+		EnumInfos:         file_pbmesh_v1alpha1_routing_proto_enumTypes,
+	}.Build()
+	File_pbmesh_v1alpha1_routing_proto = out.File
+	file_pbmesh_v1alpha1_routing_proto_rawDesc = nil
+	file_pbmesh_v1alpha1_routing_proto_goTypes = nil
+	file_pbmesh_v1alpha1_routing_proto_depIdxs = nil
+}
diff --git a/proto-public/pbmesh/v1alpha1/routing.proto b/proto-public/pbmesh/v1alpha1/routing.proto
new file mode 100644
index 000000000000..d2b1cdd8b095
--- /dev/null
+++ b/proto-public/pbmesh/v1alpha1/routing.proto
@@ -0,0 +1,36 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.mesh.v1alpha1;
+
+enum MeshGatewayMode {
+  // MESH_GATEWAY_MODE_UNSPECIFIED represents no specific mode and should be
+  // used to indicate that a the decision on the mode will be made by other
+  // configuration or default settings.
+  MESH_GATEWAY_MODE_UNSPECIFIED = 0;
+
+  // MESH_GATEWAY_MODE_NONE is the mode to use when traffic should not be
+  // routed through any gateway but instead be routed directly to the
+  // destination.
+  MESH_GATEWAY_MODE_NONE = 1;
+
+  // MESH_GATEWAY_MODE_LOCAL is the mode to use when traffic should be routed
+  // to the local gateway. The local gateway will then ensure that the
+  // connection is proxied correctly to its final destination. This mode will
+  // most often be needed for workloads that are prevented from making outbound
+  // requests outside of their local network/environment. In this case a
+  // gateway will sit at the edge of sit at the edge of the network and will
+  // proxy outbound connections potentially to other gateways in remote
+  // environments.
+  MESH_GATEWAY_MODE_LOCAL = 2;
+
+  // MESH_GATEWAY_MODE_REMOTE is the mode to use when traffic should be routed
+  // to a remote mesh gateway. This mode will most often be used when workloads
+  // can make outbound requests destined for a remote network/environment but
+  // where the remote network/environment will not allow direct addressing. The
+  // mesh gateway in the remote environment will sit at the edge and proxy
+  // requests into that environment.
+  MESH_GATEWAY_MODE_REMOTE = 3;
+}
diff --git a/proto-public/pbmesh/v1alpha1/upstreams.pb.binary.go b/proto-public/pbmesh/v1alpha1/upstreams.pb.binary.go
new file mode 100644
index 000000000000..cc8214e75a68
--- /dev/null
+++ b/proto-public/pbmesh/v1alpha1/upstreams.pb.binary.go
@@ -0,0 +1,88 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbmesh/v1alpha1/upstreams.proto
+
+package meshv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *Upstreams) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *Upstreams) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *Upstream) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *Upstream) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *TCPAddress) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *TCPAddress) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *UnixSocketAddress) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *UnixSocketAddress) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *PreparedQueryUpstream) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *PreparedQueryUpstream) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *UpstreamConfig) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *UpstreamConfig) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *UpstreamLimits) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *UpstreamLimits) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *PassiveHealthCheck) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *PassiveHealthCheck) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
diff --git a/proto-public/pbmesh/v1alpha1/upstreams.pb.go b/proto-public/pbmesh/v1alpha1/upstreams.pb.go
new file mode 100644
index 000000000000..6d8abade402b
--- /dev/null
+++ b/proto-public/pbmesh/v1alpha1/upstreams.pb.go
@@ -0,0 +1,997 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: pbmesh/v1alpha1/upstreams.proto
+
+package meshv1alpha1
+
+import (
+	v1alpha1 "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	pbresource "github.com/hashicorp/consul/proto-public/pbresource"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	durationpb "google.golang.org/protobuf/types/known/durationpb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type Upstreams struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Selection of workloads these upstreams should apply to.
+	// These can be prefixes or specific workload names.
+	Workloads      *v1alpha1.WorkloadSelector `protobuf:"bytes,1,opt,name=workloads,proto3" json:"workloads,omitempty"`
+	Upstreams      []*Upstream                `protobuf:"bytes,2,rep,name=upstreams,proto3" json:"upstreams,omitempty"`
+	PqUpstreams    []*PreparedQueryUpstream   `protobuf:"bytes,3,rep,name=pq_upstreams,json=pqUpstreams,proto3" json:"pq_upstreams,omitempty"`
+	UpstreamConfig *UpstreamConfig            `protobuf:"bytes,4,opt,name=upstream_config,json=upstreamConfig,proto3" json:"upstream_config,omitempty"`
+}
+
+func (x *Upstreams) Reset() {
+	*x = Upstreams{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_upstreams_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Upstreams) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Upstreams) ProtoMessage() {}
+
+func (x *Upstreams) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_upstreams_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Upstreams.ProtoReflect.Descriptor instead.
+func (*Upstreams) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_upstreams_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Upstreams) GetWorkloads() *v1alpha1.WorkloadSelector {
+	if x != nil {
+		return x.Workloads
+	}
+	return nil
+}
+
+func (x *Upstreams) GetUpstreams() []*Upstream {
+	if x != nil {
+		return x.Upstreams
+	}
+	return nil
+}
+
+func (x *Upstreams) GetPqUpstreams() []*PreparedQueryUpstream {
+	if x != nil {
+		return x.PqUpstreams
+	}
+	return nil
+}
+
+func (x *Upstreams) GetUpstreamConfig() *UpstreamConfig {
+	if x != nil {
+		return x.UpstreamConfig
+	}
+	return nil
+}
+
+type Upstream struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	DestinationRef  *pbresource.ID `protobuf:"bytes,1,opt,name=destination_ref,json=destinationRef,proto3" json:"destination_ref,omitempty"`
+	DestinationPort string         `protobuf:"bytes,2,opt,name=destination_port,json=destinationPort,proto3" json:"destination_port,omitempty"`
+	Datacenter      string         `protobuf:"bytes,3,opt,name=datacenter,proto3" json:"datacenter,omitempty"`
+	// Types that are assignable to ListenAddr:
+	//
+	//	*Upstream_Tcp
+	//	*Upstream_Unix
+	ListenAddr     isUpstream_ListenAddr `protobuf_oneof:"listen_addr"`
+	UpstreamConfig *UpstreamConfig       `protobuf:"bytes,7,opt,name=upstream_config,json=upstreamConfig,proto3" json:"upstream_config,omitempty"`
+}
+
+func (x *Upstream) Reset() {
+	*x = Upstream{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_upstreams_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Upstream) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Upstream) ProtoMessage() {}
+
+func (x *Upstream) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_upstreams_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Upstream.ProtoReflect.Descriptor instead.
+func (*Upstream) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_upstreams_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *Upstream) GetDestinationRef() *pbresource.ID {
+	if x != nil {
+		return x.DestinationRef
+	}
+	return nil
+}
+
+func (x *Upstream) GetDestinationPort() string {
+	if x != nil {
+		return x.DestinationPort
+	}
+	return ""
+}
+
+func (x *Upstream) GetDatacenter() string {
+	if x != nil {
+		return x.Datacenter
+	}
+	return ""
+}
+
+func (m *Upstream) GetListenAddr() isUpstream_ListenAddr {
+	if m != nil {
+		return m.ListenAddr
+	}
+	return nil
+}
+
+func (x *Upstream) GetTcp() *TCPAddress {
+	if x, ok := x.GetListenAddr().(*Upstream_Tcp); ok {
+		return x.Tcp
+	}
+	return nil
+}
+
+func (x *Upstream) GetUnix() *UnixSocketAddress {
+	if x, ok := x.GetListenAddr().(*Upstream_Unix); ok {
+		return x.Unix
+	}
+	return nil
+}
+
+func (x *Upstream) GetUpstreamConfig() *UpstreamConfig {
+	if x != nil {
+		return x.UpstreamConfig
+	}
+	return nil
+}
+
+type isUpstream_ListenAddr interface {
+	isUpstream_ListenAddr()
+}
+
+type Upstream_Tcp struct {
+	Tcp *TCPAddress `protobuf:"bytes,4,opt,name=tcp,proto3,oneof"`
+}
+
+type Upstream_Unix struct {
+	Unix *UnixSocketAddress `protobuf:"bytes,5,opt,name=unix,proto3,oneof"`
+}
+
+func (*Upstream_Tcp) isUpstream_ListenAddr() {}
+
+func (*Upstream_Unix) isUpstream_ListenAddr() {}
+
+type TCPAddress struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Ip   string `protobuf:"bytes,1,opt,name=ip,proto3" json:"ip,omitempty"`
+	Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
+}
+
+func (x *TCPAddress) Reset() {
+	*x = TCPAddress{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_upstreams_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TCPAddress) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TCPAddress) ProtoMessage() {}
+
+func (x *TCPAddress) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_upstreams_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TCPAddress.ProtoReflect.Descriptor instead.
+func (*TCPAddress) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_upstreams_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *TCPAddress) GetIp() string {
+	if x != nil {
+		return x.Ip
+	}
+	return ""
+}
+
+func (x *TCPAddress) GetPort() uint32 {
+	if x != nil {
+		return x.Port
+	}
+	return 0
+}
+
+type UnixSocketAddress struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Path string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
+	Mode string `protobuf:"bytes,2,opt,name=mode,proto3" json:"mode,omitempty"`
+}
+
+func (x *UnixSocketAddress) Reset() {
+	*x = UnixSocketAddress{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_upstreams_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UnixSocketAddress) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UnixSocketAddress) ProtoMessage() {}
+
+func (x *UnixSocketAddress) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_upstreams_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UnixSocketAddress.ProtoReflect.Descriptor instead.
+func (*UnixSocketAddress) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_upstreams_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *UnixSocketAddress) GetPath() string {
+	if x != nil {
+		return x.Path
+	}
+	return ""
+}
+
+func (x *UnixSocketAddress) GetMode() string {
+	if x != nil {
+		return x.Mode
+	}
+	return ""
+}
+
+type PreparedQueryUpstream struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name       string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Datacenter string `protobuf:"bytes,2,opt,name=datacenter,proto3" json:"datacenter,omitempty"`
+	// Types that are assignable to ListenAddr:
+	//
+	//	*PreparedQueryUpstream_Tcp
+	//	*PreparedQueryUpstream_Unix
+	ListenAddr     isPreparedQueryUpstream_ListenAddr `protobuf_oneof:"listen_addr"`
+	UpstreamConfig *UpstreamConfig                    `protobuf:"bytes,6,opt,name=upstream_config,json=upstreamConfig,proto3" json:"upstream_config,omitempty"`
+}
+
+func (x *PreparedQueryUpstream) Reset() {
+	*x = PreparedQueryUpstream{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_upstreams_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PreparedQueryUpstream) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PreparedQueryUpstream) ProtoMessage() {}
+
+func (x *PreparedQueryUpstream) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_upstreams_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PreparedQueryUpstream.ProtoReflect.Descriptor instead.
+func (*PreparedQueryUpstream) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_upstreams_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *PreparedQueryUpstream) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *PreparedQueryUpstream) GetDatacenter() string {
+	if x != nil {
+		return x.Datacenter
+	}
+	return ""
+}
+
+func (m *PreparedQueryUpstream) GetListenAddr() isPreparedQueryUpstream_ListenAddr {
+	if m != nil {
+		return m.ListenAddr
+	}
+	return nil
+}
+
+func (x *PreparedQueryUpstream) GetTcp() *TCPAddress {
+	if x, ok := x.GetListenAddr().(*PreparedQueryUpstream_Tcp); ok {
+		return x.Tcp
+	}
+	return nil
+}
+
+func (x *PreparedQueryUpstream) GetUnix() *UnixSocketAddress {
+	if x, ok := x.GetListenAddr().(*PreparedQueryUpstream_Unix); ok {
+		return x.Unix
+	}
+	return nil
+}
+
+func (x *PreparedQueryUpstream) GetUpstreamConfig() *UpstreamConfig {
+	if x != nil {
+		return x.UpstreamConfig
+	}
+	return nil
+}
+
+type isPreparedQueryUpstream_ListenAddr interface {
+	isPreparedQueryUpstream_ListenAddr()
+}
+
+type PreparedQueryUpstream_Tcp struct {
+	Tcp *TCPAddress `protobuf:"bytes,4,opt,name=tcp,proto3,oneof"`
+}
+
+type PreparedQueryUpstream_Unix struct {
+	Unix *UnixSocketAddress `protobuf:"bytes,5,opt,name=unix,proto3,oneof"`
+}
+
+func (*PreparedQueryUpstream_Tcp) isPreparedQueryUpstream_ListenAddr() {}
+
+func (*PreparedQueryUpstream_Unix) isPreparedQueryUpstream_ListenAddr() {}
+
+type UpstreamConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ConnectTimeoutMs          uint64                    `protobuf:"varint,2,opt,name=connect_timeout_ms,json=connectTimeoutMs,proto3" json:"connect_timeout_ms,omitempty"`
+	Limits                    *UpstreamLimits           `protobuf:"bytes,3,opt,name=limits,proto3" json:"limits,omitempty"`
+	PassiveHealthCheck        *PassiveHealthCheck       `protobuf:"bytes,4,opt,name=passive_health_check,json=passiveHealthCheck,proto3" json:"passive_health_check,omitempty"`
+	BalanceInboundConnections BalanceInboundConnections `protobuf:"varint,5,opt,name=balance_inbound_connections,json=balanceInboundConnections,proto3,enum=hashicorp.consul.mesh.v1alpha1.BalanceInboundConnections" json:"balance_inbound_connections,omitempty"`
+	MeshGatewayMode           MeshGatewayMode           `protobuf:"varint,6,opt,name=mesh_gateway_mode,json=meshGatewayMode,proto3,enum=hashicorp.consul.mesh.v1alpha1.MeshGatewayMode" json:"mesh_gateway_mode,omitempty"`
+}
+
+func (x *UpstreamConfig) Reset() {
+	*x = UpstreamConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_upstreams_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpstreamConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpstreamConfig) ProtoMessage() {}
+
+func (x *UpstreamConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_upstreams_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpstreamConfig.ProtoReflect.Descriptor instead.
+func (*UpstreamConfig) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_upstreams_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *UpstreamConfig) GetConnectTimeoutMs() uint64 {
+	if x != nil {
+		return x.ConnectTimeoutMs
+	}
+	return 0
+}
+
+func (x *UpstreamConfig) GetLimits() *UpstreamLimits {
+	if x != nil {
+		return x.Limits
+	}
+	return nil
+}
+
+func (x *UpstreamConfig) GetPassiveHealthCheck() *PassiveHealthCheck {
+	if x != nil {
+		return x.PassiveHealthCheck
+	}
+	return nil
+}
+
+func (x *UpstreamConfig) GetBalanceInboundConnections() BalanceInboundConnections {
+	if x != nil {
+		return x.BalanceInboundConnections
+	}
+	return BalanceInboundConnections_BALANCE_INBOUND_CONNECTIONS_DEFAULT
+}
+
+func (x *UpstreamConfig) GetMeshGatewayMode() MeshGatewayMode {
+	if x != nil {
+		return x.MeshGatewayMode
+	}
+	return MeshGatewayMode_MESH_GATEWAY_MODE_UNSPECIFIED
+}
+
+// UpstreamLimits describes the limits that are associated with a specific
+// upstream of a service instance.
+type UpstreamLimits struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// MaxConnections is the maximum number of connections the local proxy can
+	// make to the upstream service.
+	MaxConnections int32 `protobuf:"varint,1,opt,name=max_connections,json=maxConnections,proto3" json:"max_connections,omitempty"`
+	// MaxPendingRequests is the maximum number of requests that will be queued
+	// waiting for an available connection. This is mostly applicable to HTTP/1.1
+	// clusters since all HTTP/2 requests are streamed over a single
+	// connection.
+	MaxPendingRequests int32 `protobuf:"varint,2,opt,name=max_pending_requests,json=maxPendingRequests,proto3" json:"max_pending_requests,omitempty"`
+	// MaxConcurrentRequests is the maximum number of in-flight requests that will be allowed
+	// to the upstream cluster at a point in time. This is mostly applicable to HTTP/2
+	// clusters since all HTTP/1.1 requests are limited by MaxConnections.
+	MaxConcurrentRequests int32 `protobuf:"varint,3,opt,name=max_concurrent_requests,json=maxConcurrentRequests,proto3" json:"max_concurrent_requests,omitempty"`
+}
+
+func (x *UpstreamLimits) Reset() {
+	*x = UpstreamLimits{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_upstreams_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpstreamLimits) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpstreamLimits) ProtoMessage() {}
+
+func (x *UpstreamLimits) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_upstreams_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpstreamLimits.ProtoReflect.Descriptor instead.
+func (*UpstreamLimits) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_upstreams_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *UpstreamLimits) GetMaxConnections() int32 {
+	if x != nil {
+		return x.MaxConnections
+	}
+	return 0
+}
+
+func (x *UpstreamLimits) GetMaxPendingRequests() int32 {
+	if x != nil {
+		return x.MaxPendingRequests
+	}
+	return 0
+}
+
+func (x *UpstreamLimits) GetMaxConcurrentRequests() int32 {
+	if x != nil {
+		return x.MaxConcurrentRequests
+	}
+	return 0
+}
+
+type PassiveHealthCheck struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Interval between health check analysis sweeps. Each sweep may remove
+	// hosts or return hosts to the pool.
+	Interval *durationpb.Duration `protobuf:"bytes,1,opt,name=interval,proto3" json:"interval,omitempty"`
+	// MaxFailures is the count of consecutive failures that results in a host
+	// being removed from the pool.
+	MaxFailures uint32 `protobuf:"varint,2,opt,name=max_failures,json=maxFailures,proto3" json:"max_failures,omitempty"`
+	// EnforcingConsecutive5xx is the % chance that a host will be actually ejected
+	// when an outlier status is detected through consecutive 5xx.
+	// This setting can be used to disable ejection or to ramp it up slowly. Defaults to 100.
+	EnforcingConsecutive_5Xx uint32 `protobuf:"varint,3,opt,name=enforcing_consecutive_5xx,json=enforcingConsecutive5xx,proto3" json:"enforcing_consecutive_5xx,omitempty"`
+}
+
+func (x *PassiveHealthCheck) Reset() {
+	*x = PassiveHealthCheck{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_upstreams_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PassiveHealthCheck) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PassiveHealthCheck) ProtoMessage() {}
+
+func (x *PassiveHealthCheck) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_upstreams_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PassiveHealthCheck.ProtoReflect.Descriptor instead.
+func (*PassiveHealthCheck) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_upstreams_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *PassiveHealthCheck) GetInterval() *durationpb.Duration {
+	if x != nil {
+		return x.Interval
+	}
+	return nil
+}
+
+func (x *PassiveHealthCheck) GetMaxFailures() uint32 {
+	if x != nil {
+		return x.MaxFailures
+	}
+	return 0
+}
+
+func (x *PassiveHealthCheck) GetEnforcingConsecutive_5Xx() uint32 {
+	if x != nil {
+		return x.EnforcingConsecutive_5Xx
+	}
+	return 0
+}
+
+var File_pbmesh_v1alpha1_upstreams_proto protoreflect.FileDescriptor
+
+var file_pbmesh_v1alpha1_upstreams_proto_rawDesc = []byte{
+	0x0a, 0x1f, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2f, 0x75, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x12, 0x1e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2f, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x1a, 0x21, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x20, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1d, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x72, 0x6f, 0x75, 0x74, 0x69, 0x6e, 0x67, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x19, 0x70, 0x62, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x22, 0xd9, 0x02, 0x0a, 0x09, 0x55, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x73, 0x12, 0x51,
+	0x0a, 0x09, 0x77, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x33, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x53, 0x65,
+	0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x52, 0x09, 0x77, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64,
+	0x73, 0x12, 0x46, 0x0a, 0x09, 0x75, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x73, 0x18, 0x02,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x55, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x52, 0x09,
+	0x75, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x73, 0x12, 0x58, 0x0a, 0x0c, 0x70, 0x71, 0x5f,
+	0x75, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x35, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0x2e, 0x50, 0x72, 0x65, 0x70, 0x61, 0x72, 0x65, 0x64, 0x51, 0x75, 0x65, 0x72, 0x79, 0x55, 0x70,
+	0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x52, 0x0b, 0x70, 0x71, 0x55, 0x70, 0x73, 0x74, 0x72, 0x65,
+	0x61, 0x6d, 0x73, 0x12, 0x57, 0x0a, 0x0f, 0x75, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x5f,
+	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
+	0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x55, 0x70,
+	0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0e, 0x75, 0x70,
+	0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x8e, 0x03, 0x0a,
+	0x08, 0x55, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x12, 0x46, 0x0a, 0x0f, 0x64, 0x65, 0x73,
+	0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x72, 0x65, 0x66, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49,
+	0x44, 0x52, 0x0e, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x66, 0x12, 0x29, 0x0a, 0x10, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x64, 0x65, 0x73,
+	0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x1e, 0x0a, 0x0a,
+	0x64, 0x61, 0x74, 0x61, 0x63, 0x65, 0x6e, 0x74, 0x65, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0a, 0x64, 0x61, 0x74, 0x61, 0x63, 0x65, 0x6e, 0x74, 0x65, 0x72, 0x12, 0x3e, 0x0a, 0x03,
+	0x74, 0x63, 0x70, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x68, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73,
+	0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x54, 0x43, 0x50, 0x41, 0x64,
+	0x64, 0x72, 0x65, 0x73, 0x73, 0x48, 0x00, 0x52, 0x03, 0x74, 0x63, 0x70, 0x12, 0x47, 0x0a, 0x04,
+	0x75, 0x6e, 0x69, 0x78, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x31, 0x2e, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65,
+	0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x55, 0x6e, 0x69, 0x78,
+	0x53, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x48, 0x00, 0x52,
+	0x04, 0x75, 0x6e, 0x69, 0x78, 0x12, 0x57, 0x0a, 0x0f, 0x75, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61,
+	0x6d, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e,
+	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e,
+	0x55, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0e,
+	0x75, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x42, 0x0d,
+	0x0a, 0x0b, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x22, 0x30, 0x0a,
+	0x0a, 0x54, 0x43, 0x50, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x0e, 0x0a, 0x02, 0x69,
+	0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x70, 0x12, 0x12, 0x0a, 0x04, 0x70,
+	0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x22,
+	0x3b, 0x0a, 0x11, 0x55, 0x6e, 0x69, 0x78, 0x53, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x41, 0x64, 0x64,
+	0x72, 0x65, 0x73, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x12, 0x0a, 0x04, 0x6d, 0x6f, 0x64, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x22, 0xbc, 0x02, 0x0a,
+	0x15, 0x50, 0x72, 0x65, 0x70, 0x61, 0x72, 0x65, 0x64, 0x51, 0x75, 0x65, 0x72, 0x79, 0x55, 0x70,
+	0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x64, 0x61,
+	0x74, 0x61, 0x63, 0x65, 0x6e, 0x74, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a,
+	0x64, 0x61, 0x74, 0x61, 0x63, 0x65, 0x6e, 0x74, 0x65, 0x72, 0x12, 0x3e, 0x0a, 0x03, 0x74, 0x63,
+	0x70, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x54, 0x43, 0x50, 0x41, 0x64, 0x64, 0x72,
+	0x65, 0x73, 0x73, 0x48, 0x00, 0x52, 0x03, 0x74, 0x63, 0x70, 0x12, 0x47, 0x0a, 0x04, 0x75, 0x6e,
+	0x69, 0x78, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x31, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
+	0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68,
+	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x55, 0x6e, 0x69, 0x78, 0x53, 0x6f,
+	0x63, 0x6b, 0x65, 0x74, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x48, 0x00, 0x52, 0x04, 0x75,
+	0x6e, 0x69, 0x78, 0x12, 0x57, 0x0a, 0x0f, 0x75, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x5f,
+	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
+	0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x55, 0x70,
+	0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0e, 0x75, 0x70,
+	0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x42, 0x0d, 0x0a, 0x0b,
+	0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x22, 0xc4, 0x03, 0x0a, 0x0e,
+	0x55, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2c,
+	0x0a, 0x12, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75,
+	0x74, 0x5f, 0x6d, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x52, 0x10, 0x63, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x54, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x4d, 0x73, 0x12, 0x46, 0x0a, 0x06,
+	0x6c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
+	0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x55, 0x70,
+	0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52, 0x06, 0x6c, 0x69,
+	0x6d, 0x69, 0x74, 0x73, 0x12, 0x64, 0x0a, 0x14, 0x70, 0x61, 0x73, 0x73, 0x69, 0x76, 0x65, 0x5f,
+	0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x5f, 0x63, 0x68, 0x65, 0x63, 0x6b, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x32, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x2e, 0x50, 0x61, 0x73, 0x73, 0x69, 0x76, 0x65, 0x48, 0x65, 0x61, 0x6c, 0x74,
+	0x68, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x52, 0x12, 0x70, 0x61, 0x73, 0x73, 0x69, 0x76, 0x65, 0x48,
+	0x65, 0x61, 0x6c, 0x74, 0x68, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x12, 0x79, 0x0a, 0x1b, 0x62, 0x61,
+	0x6c, 0x61, 0x6e, 0x63, 0x65, 0x5f, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x63, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x39, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0x2e, 0x42, 0x61, 0x6c, 0x61, 0x6e, 0x63, 0x65, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x43,
+	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x19, 0x62, 0x61, 0x6c, 0x61,
+	0x6e, 0x63, 0x65, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x5b, 0x0a, 0x11, 0x6d, 0x65, 0x73, 0x68, 0x5f, 0x67, 0x61,
+	0x74, 0x65, 0x77, 0x61, 0x79, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0e,
+	0x32, 0x2f, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2e, 0x4d, 0x65, 0x73, 0x68, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x4d, 0x6f, 0x64,
+	0x65, 0x52, 0x0f, 0x6d, 0x65, 0x73, 0x68, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x4d, 0x6f,
+	0x64, 0x65, 0x22, 0xa3, 0x01, 0x0a, 0x0e, 0x55, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x4c,
+	0x69, 0x6d, 0x69, 0x74, 0x73, 0x12, 0x27, 0x0a, 0x0f, 0x6d, 0x61, 0x78, 0x5f, 0x63, 0x6f, 0x6e,
+	0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0e,
+	0x6d, 0x61, 0x78, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x30,
+	0x0a, 0x14, 0x6d, 0x61, 0x78, 0x5f, 0x70, 0x65, 0x6e, 0x64, 0x69, 0x6e, 0x67, 0x5f, 0x72, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x12, 0x6d, 0x61,
+	0x78, 0x50, 0x65, 0x6e, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73,
+	0x12, 0x36, 0x0a, 0x17, 0x6d, 0x61, 0x78, 0x5f, 0x63, 0x6f, 0x6e, 0x63, 0x75, 0x72, 0x72, 0x65,
+	0x6e, 0x74, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x05, 0x52, 0x15, 0x6d, 0x61, 0x78, 0x43, 0x6f, 0x6e, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x22, 0xaa, 0x01, 0x0a, 0x12, 0x50, 0x61, 0x73,
+	0x73, 0x69, 0x76, 0x65, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x12,
+	0x35, 0x0a, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x08, 0x69, 0x6e,
+	0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12, 0x21, 0x0a, 0x0c, 0x6d, 0x61, 0x78, 0x5f, 0x66, 0x61,
+	0x69, 0x6c, 0x75, 0x72, 0x65, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0b, 0x6d, 0x61,
+	0x78, 0x46, 0x61, 0x69, 0x6c, 0x75, 0x72, 0x65, 0x73, 0x12, 0x3a, 0x0a, 0x19, 0x65, 0x6e, 0x66,
+	0x6f, 0x72, 0x63, 0x69, 0x6e, 0x67, 0x5f, 0x63, 0x6f, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x74, 0x69,
+	0x76, 0x65, 0x5f, 0x35, 0x78, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x17, 0x65, 0x6e,
+	0x66, 0x6f, 0x72, 0x63, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x74, 0x69,
+	0x76, 0x65, 0x35, 0x78, 0x78, 0x42, 0x96, 0x02, 0x0a, 0x22, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d,
+	0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x42, 0x0e, 0x55, 0x70,
+	0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x45,
+	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69,
+	0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x3b, 0x6d, 0x65, 0x73, 0x68, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0xa2, 0x02, 0x03, 0x48, 0x43, 0x4d, 0xaa, 0x02, 0x1e, 0x48, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x4d,
+	0x65, 0x73, 0x68, 0x2e, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xca, 0x02, 0x1e, 0x48,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c,
+	0x4d, 0x65, 0x73, 0x68, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xe2, 0x02, 0x2a,
+	0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x5c, 0x4d, 0x65, 0x73, 0x68, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x5c, 0x47,
+	0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x21, 0x48, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a,
+	0x4d, 0x65, 0x73, 0x68, 0x3a, 0x3a, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62, 0x06,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_pbmesh_v1alpha1_upstreams_proto_rawDescOnce sync.Once
+	file_pbmesh_v1alpha1_upstreams_proto_rawDescData = file_pbmesh_v1alpha1_upstreams_proto_rawDesc
+)
+
+func file_pbmesh_v1alpha1_upstreams_proto_rawDescGZIP() []byte {
+	file_pbmesh_v1alpha1_upstreams_proto_rawDescOnce.Do(func() {
+		file_pbmesh_v1alpha1_upstreams_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbmesh_v1alpha1_upstreams_proto_rawDescData)
+	})
+	return file_pbmesh_v1alpha1_upstreams_proto_rawDescData
+}
+
+var file_pbmesh_v1alpha1_upstreams_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
+var file_pbmesh_v1alpha1_upstreams_proto_goTypes = []interface{}{
+	(*Upstreams)(nil),                 // 0: hashicorp.consul.mesh.v1alpha1.Upstreams
+	(*Upstream)(nil),                  // 1: hashicorp.consul.mesh.v1alpha1.Upstream
+	(*TCPAddress)(nil),                // 2: hashicorp.consul.mesh.v1alpha1.TCPAddress
+	(*UnixSocketAddress)(nil),         // 3: hashicorp.consul.mesh.v1alpha1.UnixSocketAddress
+	(*PreparedQueryUpstream)(nil),     // 4: hashicorp.consul.mesh.v1alpha1.PreparedQueryUpstream
+	(*UpstreamConfig)(nil),            // 5: hashicorp.consul.mesh.v1alpha1.UpstreamConfig
+	(*UpstreamLimits)(nil),            // 6: hashicorp.consul.mesh.v1alpha1.UpstreamLimits
+	(*PassiveHealthCheck)(nil),        // 7: hashicorp.consul.mesh.v1alpha1.PassiveHealthCheck
+	(*v1alpha1.WorkloadSelector)(nil), // 8: hashicorp.consul.catalog.v1alpha1.WorkloadSelector
+	(*pbresource.ID)(nil),             // 9: hashicorp.consul.resource.ID
+	(BalanceInboundConnections)(0),    // 10: hashicorp.consul.mesh.v1alpha1.BalanceInboundConnections
+	(MeshGatewayMode)(0),              // 11: hashicorp.consul.mesh.v1alpha1.MeshGatewayMode
+	(*durationpb.Duration)(nil),       // 12: google.protobuf.Duration
+}
+var file_pbmesh_v1alpha1_upstreams_proto_depIdxs = []int32{
+	8,  // 0: hashicorp.consul.mesh.v1alpha1.Upstreams.workloads:type_name -> hashicorp.consul.catalog.v1alpha1.WorkloadSelector
+	1,  // 1: hashicorp.consul.mesh.v1alpha1.Upstreams.upstreams:type_name -> hashicorp.consul.mesh.v1alpha1.Upstream
+	4,  // 2: hashicorp.consul.mesh.v1alpha1.Upstreams.pq_upstreams:type_name -> hashicorp.consul.mesh.v1alpha1.PreparedQueryUpstream
+	5,  // 3: hashicorp.consul.mesh.v1alpha1.Upstreams.upstream_config:type_name -> hashicorp.consul.mesh.v1alpha1.UpstreamConfig
+	9,  // 4: hashicorp.consul.mesh.v1alpha1.Upstream.destination_ref:type_name -> hashicorp.consul.resource.ID
+	2,  // 5: hashicorp.consul.mesh.v1alpha1.Upstream.tcp:type_name -> hashicorp.consul.mesh.v1alpha1.TCPAddress
+	3,  // 6: hashicorp.consul.mesh.v1alpha1.Upstream.unix:type_name -> hashicorp.consul.mesh.v1alpha1.UnixSocketAddress
+	5,  // 7: hashicorp.consul.mesh.v1alpha1.Upstream.upstream_config:type_name -> hashicorp.consul.mesh.v1alpha1.UpstreamConfig
+	2,  // 8: hashicorp.consul.mesh.v1alpha1.PreparedQueryUpstream.tcp:type_name -> hashicorp.consul.mesh.v1alpha1.TCPAddress
+	3,  // 9: hashicorp.consul.mesh.v1alpha1.PreparedQueryUpstream.unix:type_name -> hashicorp.consul.mesh.v1alpha1.UnixSocketAddress
+	5,  // 10: hashicorp.consul.mesh.v1alpha1.PreparedQueryUpstream.upstream_config:type_name -> hashicorp.consul.mesh.v1alpha1.UpstreamConfig
+	6,  // 11: hashicorp.consul.mesh.v1alpha1.UpstreamConfig.limits:type_name -> hashicorp.consul.mesh.v1alpha1.UpstreamLimits
+	7,  // 12: hashicorp.consul.mesh.v1alpha1.UpstreamConfig.passive_health_check:type_name -> hashicorp.consul.mesh.v1alpha1.PassiveHealthCheck
+	10, // 13: hashicorp.consul.mesh.v1alpha1.UpstreamConfig.balance_inbound_connections:type_name -> hashicorp.consul.mesh.v1alpha1.BalanceInboundConnections
+	11, // 14: hashicorp.consul.mesh.v1alpha1.UpstreamConfig.mesh_gateway_mode:type_name -> hashicorp.consul.mesh.v1alpha1.MeshGatewayMode
+	12, // 15: hashicorp.consul.mesh.v1alpha1.PassiveHealthCheck.interval:type_name -> google.protobuf.Duration
+	16, // [16:16] is the sub-list for method output_type
+	16, // [16:16] is the sub-list for method input_type
+	16, // [16:16] is the sub-list for extension type_name
+	16, // [16:16] is the sub-list for extension extendee
+	0,  // [0:16] is the sub-list for field type_name
+}
+
+func init() { file_pbmesh_v1alpha1_upstreams_proto_init() }
+func file_pbmesh_v1alpha1_upstreams_proto_init() {
+	if File_pbmesh_v1alpha1_upstreams_proto != nil {
+		return
+	}
+	file_pbmesh_v1alpha1_connection_proto_init()
+	file_pbmesh_v1alpha1_routing_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_pbmesh_v1alpha1_upstreams_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Upstreams); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_upstreams_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Upstream); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_upstreams_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TCPAddress); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_upstreams_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UnixSocketAddress); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_upstreams_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PreparedQueryUpstream); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_upstreams_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UpstreamConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_upstreams_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UpstreamLimits); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_upstreams_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PassiveHealthCheck); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_pbmesh_v1alpha1_upstreams_proto_msgTypes[1].OneofWrappers = []interface{}{
+		(*Upstream_Tcp)(nil),
+		(*Upstream_Unix)(nil),
+	}
+	file_pbmesh_v1alpha1_upstreams_proto_msgTypes[4].OneofWrappers = []interface{}{
+		(*PreparedQueryUpstream_Tcp)(nil),
+		(*PreparedQueryUpstream_Unix)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbmesh_v1alpha1_upstreams_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   8,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbmesh_v1alpha1_upstreams_proto_goTypes,
+		DependencyIndexes: file_pbmesh_v1alpha1_upstreams_proto_depIdxs,
+		MessageInfos:      file_pbmesh_v1alpha1_upstreams_proto_msgTypes,
+	}.Build()
+	File_pbmesh_v1alpha1_upstreams_proto = out.File
+	file_pbmesh_v1alpha1_upstreams_proto_rawDesc = nil
+	file_pbmesh_v1alpha1_upstreams_proto_goTypes = nil
+	file_pbmesh_v1alpha1_upstreams_proto_depIdxs = nil
+}
diff --git a/proto-public/pbmesh/v1alpha1/upstreams.proto b/proto-public/pbmesh/v1alpha1/upstreams.proto
new file mode 100644
index 000000000000..9239bac774b8
--- /dev/null
+++ b/proto-public/pbmesh/v1alpha1/upstreams.proto
@@ -0,0 +1,100 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.mesh.v1alpha1;
+
+import "google/protobuf/duration.proto";
+import "pbcatalog/v1alpha1/selector.proto";
+import "pbmesh/v1alpha1/connection.proto";
+import "pbmesh/v1alpha1/routing.proto";
+import "pbresource/resource.proto";
+
+message Upstreams {
+  // Selection of workloads these upstreams should apply to.
+  // These can be prefixes or specific workload names.
+  hashicorp.consul.catalog.v1alpha1.WorkloadSelector workloads = 1;
+
+  repeated Upstream upstreams = 2;
+  repeated PreparedQueryUpstream pq_upstreams = 3;
+
+  UpstreamConfig upstream_config = 4;
+}
+
+message Upstream {
+  hashicorp.consul.resource.ID destination_ref = 1;
+  string destination_port = 2;
+  string datacenter = 3;
+
+  oneof listen_addr {
+    TCPAddress tcp = 4;
+    UnixSocketAddress unix = 5;
+  }
+
+  UpstreamConfig upstream_config = 7;
+}
+
+message TCPAddress {
+  string ip = 1;
+  uint32 port = 2;
+}
+
+message UnixSocketAddress {
+  string path = 1;
+  string mode = 2;
+}
+
+message PreparedQueryUpstream {
+  string name = 1;
+  string datacenter = 2;
+
+  oneof listen_addr {
+    TCPAddress tcp = 4;
+    UnixSocketAddress unix = 5;
+  }
+
+  UpstreamConfig upstream_config = 6;
+}
+
+message UpstreamConfig {
+  uint64 connect_timeout_ms = 2;
+  UpstreamLimits limits = 3;
+  PassiveHealthCheck passive_health_check = 4;
+  BalanceInboundConnections balance_inbound_connections = 5;
+  MeshGatewayMode mesh_gateway_mode = 6;
+}
+
+// UpstreamLimits describes the limits that are associated with a specific
+// upstream of a service instance.
+message UpstreamLimits {
+  // MaxConnections is the maximum number of connections the local proxy can
+  // make to the upstream service.
+  int32 max_connections = 1;
+
+  // MaxPendingRequests is the maximum number of requests that will be queued
+  // waiting for an available connection. This is mostly applicable to HTTP/1.1
+  // clusters since all HTTP/2 requests are streamed over a single
+  // connection.
+  int32 max_pending_requests = 2;
+
+  // MaxConcurrentRequests is the maximum number of in-flight requests that will be allowed
+  // to the upstream cluster at a point in time. This is mostly applicable to HTTP/2
+  // clusters since all HTTP/1.1 requests are limited by MaxConnections.
+  int32 max_concurrent_requests = 3;
+}
+
+message PassiveHealthCheck {
+  // Interval between health check analysis sweeps. Each sweep may remove
+  // hosts or return hosts to the pool.
+  google.protobuf.Duration interval = 1;
+
+  // MaxFailures is the count of consecutive failures that results in a host
+  // being removed from the pool.
+  uint32 max_failures = 2;
+
+  // EnforcingConsecutive5xx is the % chance that a host will be actually ejected
+  // when an outlier status is detected through consecutive 5xx.
+  // This setting can be used to disable ejection or to ramp it up slowly. Defaults to 100.
+  uint32 enforcing_consecutive_5xx = 3;
+}

From 917afcf3c6bf2c1dcf1f5233264300b939562e5a Mon Sep 17 00:00:00 2001
From: Dan Upton <daniel@floppy.co>
Date: Fri, 5 May 2023 15:38:22 +0100
Subject: [PATCH 44/92] controller: make the `WorkQueue` generic (#16982)

---
 agent/consul/controller/controller.go         | 16 +++--
 agent/consul/controller/controller_test.go    | 13 ++--
 agent/consul/controller/{ => queue}/defer.go  | 68 +++++++++----------
 agent/consul/controller/{ => queue}/queue.go  | 66 +++++++++---------
 agent/consul/controller/{ => queue}/rate.go   | 24 +++----
 .../controller/{ => queue}/rate_test.go       | 10 +--
 agent/consul/controller/queue_test.go         | 40 +++++------
 .../gateways/controller_gateways_test.go      |  3 +-
 8 files changed, 126 insertions(+), 114 deletions(-)
 rename agent/consul/controller/{ => queue}/defer.go (74%)
 rename agent/consul/controller/{ => queue}/queue.go (76%)
 rename agent/consul/controller/{ => queue}/rate.go (75%)
 rename agent/consul/controller/{ => queue}/rate_test.go (86%)

diff --git a/agent/consul/controller/controller.go b/agent/consul/controller/controller.go
index ddd99ea65763..f8d6a50c7f82 100644
--- a/agent/consul/controller/controller.go
+++ b/agent/consul/controller/controller.go
@@ -11,11 +11,13 @@ import (
 	"sync/atomic"
 	"time"
 
+	"github.com/hashicorp/go-hclog"
+	"golang.org/x/sync/errgroup"
+
+	"github.com/hashicorp/consul/agent/consul/controller/queue"
 	"github.com/hashicorp/consul/agent/consul/state"
 	"github.com/hashicorp/consul/agent/consul/stream"
 	"github.com/hashicorp/consul/agent/structs"
-	"github.com/hashicorp/go-hclog"
-	"golang.org/x/sync/errgroup"
 )
 
 // much of this is a re-implementation of
@@ -53,7 +55,7 @@ type Controller interface {
 	// WithQueueFactory allows a Controller to replace its underlying work queue
 	// implementation. This is most useful for testing. This should only ever be called
 	// prior to running Run.
-	WithQueueFactory(fn func(ctx context.Context, baseBackoff time.Duration, maxBackoff time.Duration) WorkQueue) Controller
+	WithQueueFactory(fn func(ctx context.Context, baseBackoff time.Duration, maxBackoff time.Duration) queue.WorkQueue[Request]) Controller
 	// AddTrigger allows for triggering a reconciliation request when a
 	// triggering function returns, when the passed in context is canceled
 	// the trigger must return
@@ -79,11 +81,11 @@ type controller struct {
 
 	// makeQueue is the factory used for creating the work queue, generally
 	// this shouldn't be touched, but can be updated for testing purposes
-	makeQueue func(ctx context.Context, baseBackoff time.Duration, maxBackoff time.Duration) WorkQueue
+	makeQueue func(ctx context.Context, baseBackoff time.Duration, maxBackoff time.Duration) queue.WorkQueue[Request]
 	// workers is the number of workers to use to process data
 	workers int
 	// work is the internal work queue that pending Requests are added to
-	work WorkQueue
+	work queue.WorkQueue[Request]
 	// baseBackoff is the starting backoff time for the work queue's rate limiter
 	baseBackoff time.Duration
 	// maxBackoff is the maximum backoff time for the work queue's rate limiter
@@ -125,7 +127,7 @@ func New(publisher state.EventPublisher, reconciler Reconciler) Controller {
 		workers:     1,
 		baseBackoff: 5 * time.Millisecond,
 		maxBackoff:  1000 * time.Second,
-		makeQueue:   RunWorkQueue,
+		makeQueue:   queue.RunWorkQueue[Request],
 		started:     make(chan struct{}),
 		triggers:    make(map[Request]func()),
 		logger:      hclog.NewNullLogger(),
@@ -179,7 +181,7 @@ func (c *controller) WithLogger(logger hclog.Logger) Controller {
 // WithQueueFactory changes the initialization method for the Controller's work
 // queue, this is predominantly just used for testing. This should only ever be called
 // prior to running Start.
-func (c *controller) WithQueueFactory(fn func(ctx context.Context, baseBackoff time.Duration, maxBackoff time.Duration) WorkQueue) Controller {
+func (c *controller) WithQueueFactory(fn func(ctx context.Context, baseBackoff time.Duration, maxBackoff time.Duration) queue.WorkQueue[Request]) Controller {
 	c.ensureNotRunning()
 
 	c.makeQueue = fn
diff --git a/agent/consul/controller/controller_test.go b/agent/consul/controller/controller_test.go
index 1f948c484332..97d110222b3e 100644
--- a/agent/consul/controller/controller_test.go
+++ b/agent/consul/controller/controller_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/hashicorp/go-memdb"
 	"github.com/stretchr/testify/require"
 
+	"github.com/hashicorp/consul/agent/consul/controller/queue"
 	"github.com/hashicorp/consul/agent/consul/fsm"
 	"github.com/hashicorp/consul/agent/consul/state"
 	"github.com/hashicorp/consul/agent/consul/stream"
@@ -144,13 +145,13 @@ func TestBasicController_Retry(t *testing.T) {
 		StorageBackend: fsm.NullStorageBackend,
 	}).State()
 
-	queueInitialized := make(chan *countingWorkQueue)
+	queueInitialized := make(chan *countingWorkQueue[Request])
 	controller := New(publisher, reconciler).Subscribe(&stream.SubscribeRequest{
 		Topic:   state.EventTopicIngressGateway,
 		Subject: stream.SubjectWildcard,
 	}).WithWorkers(-1).WithBackoff(1*time.Millisecond, 1*time.Millisecond)
-	go controller.WithQueueFactory(func(ctx context.Context, baseBackoff, maxBackoff time.Duration) WorkQueue {
-		queue := newCountingWorkQueue(RunWorkQueue(ctx, baseBackoff, maxBackoff))
+	go controller.WithQueueFactory(func(ctx context.Context, baseBackoff, maxBackoff time.Duration) queue.WorkQueue[Request] {
+		queue := newCountingWorkQueue(queue.RunWorkQueue[Request](ctx, baseBackoff, maxBackoff))
 		queueInitialized <- queue
 		return queue
 	}).Run(ctx)
@@ -244,9 +245,9 @@ func TestBasicController_RunPanicAssertions(t *testing.T) {
 	started := make(chan struct{})
 	reconciler := newTestReconciler(false)
 	publisher := stream.NewEventPublisher(0)
-	controller := New(publisher, reconciler).WithQueueFactory(func(ctx context.Context, baseBackoff, maxBackoff time.Duration) WorkQueue {
+	controller := New(publisher, reconciler).WithQueueFactory(func(ctx context.Context, baseBackoff, maxBackoff time.Duration) queue.WorkQueue[Request] {
 		close(started)
-		return RunWorkQueue(ctx, baseBackoff, maxBackoff)
+		return queue.RunWorkQueue[Request](ctx, baseBackoff, maxBackoff)
 	})
 	subscription := &stream.SubscribeRequest{
 		Topic:   state.EventTopicIngressGateway,
@@ -276,7 +277,7 @@ func TestBasicController_RunPanicAssertions(t *testing.T) {
 		controller.WithWorkers(1)
 	})
 	require.Panics(t, func() {
-		controller.WithQueueFactory(RunWorkQueue)
+		controller.WithQueueFactory(queue.RunWorkQueue[Request])
 	})
 }
 
diff --git a/agent/consul/controller/defer.go b/agent/consul/controller/queue/defer.go
similarity index 74%
rename from agent/consul/controller/defer.go
rename to agent/consul/controller/queue/defer.go
index f0c5af5f3afe..d6e261288f58 100644
--- a/agent/consul/controller/defer.go
+++ b/agent/consul/controller/queue/defer.go
@@ -1,7 +1,7 @@
 // Copyright (c) HashiCorp, Inc.
 // SPDX-License-Identifier: MPL-2.0
 
-package controller
+package queue
 
 import (
 	"container/heap"
@@ -14,24 +14,24 @@ import (
 
 // DeferQueue is a generic priority queue implementation that
 // allows for deferring and later processing Requests.
-type DeferQueue interface {
+type DeferQueue[T ItemType] interface {
 	// Defer defers processing a Request until a given time. When
 	// the timeout is hit, the request will be processed by the
 	// callback given in the Process loop. If the given context
 	// is canceled, the item is not deferred.
-	Defer(ctx context.Context, item Request, until time.Time)
+	Defer(ctx context.Context, item T, until time.Time)
 	// Process processes all items in the defer queue with the
 	// given callback, blocking until the given context is canceled.
 	// Callers should only ever call Process once, likely in a
 	// long-lived goroutine.
-	Process(ctx context.Context, callback func(item Request))
+	Process(ctx context.Context, callback func(item T))
 }
 
 // deferredRequest is a wrapped Request with information about
 // when a retry should be attempted
-type deferredRequest struct {
+type deferredRequest[T ItemType] struct {
 	enqueueAt time.Time
-	item      Request
+	item      T
 	// index holds the index for the given heap entry so that if
 	// the entry is updated the heap can be re-sorted
 	index int
@@ -39,24 +39,24 @@ type deferredRequest struct {
 
 // deferQueue is a priority queue for deferring Requests for
 // future processing
-type deferQueue struct {
-	heap    *deferHeap
-	entries map[Request]*deferredRequest
+type deferQueue[T ItemType] struct {
+	heap    *deferHeap[T]
+	entries map[T]*deferredRequest[T]
 
-	addChannel     chan *deferredRequest
+	addChannel     chan *deferredRequest[T]
 	heartbeat      *time.Ticker
 	nextReadyTimer *time.Timer
 }
 
 // NewDeferQueue returns a priority queue for deferred Requests.
-func NewDeferQueue(tick time.Duration) DeferQueue {
-	dHeap := &deferHeap{}
+func NewDeferQueue[T ItemType](tick time.Duration) DeferQueue[T] {
+	dHeap := &deferHeap[T]{}
 	heap.Init(dHeap)
 
-	return &deferQueue{
+	return &deferQueue[T]{
 		heap:       dHeap,
-		entries:    make(map[Request]*deferredRequest),
-		addChannel: make(chan *deferredRequest),
+		entries:    make(map[T]*deferredRequest[T]),
+		addChannel: make(chan *deferredRequest[T]),
 		heartbeat:  time.NewTicker(tick),
 	}
 }
@@ -64,8 +64,8 @@ func NewDeferQueue(tick time.Duration) DeferQueue {
 // Defer defers the given Request until the given time in the future. If the
 // passed in context is canceled before the Request is deferred, then this
 // immediately returns.
-func (q *deferQueue) Defer(ctx context.Context, item Request, until time.Time) {
-	entry := &deferredRequest{
+func (q *deferQueue[T]) Defer(ctx context.Context, item T, until time.Time) {
+	entry := &deferredRequest[T]{
 		enqueueAt: until,
 		item:      item,
 	}
@@ -77,7 +77,7 @@ func (q *deferQueue) Defer(ctx context.Context, item Request, until time.Time) {
 }
 
 // deferEntry adds a deferred request to the priority queue
-func (q *deferQueue) deferEntry(entry *deferredRequest) {
+func (q *deferQueue[T]) deferEntry(entry *deferredRequest[T]) {
 	existing, exists := q.entries[entry.item]
 	if exists {
 		// insert or update the item deferral time
@@ -95,26 +95,26 @@ func (q *deferQueue) deferEntry(entry *deferredRequest) {
 
 // readyRequest returns a pointer to the next ready Request or
 // nil if no Requests are ready to be processed
-func (q *deferQueue) readyRequest() *Request {
+func (q *deferQueue[T]) readyRequest() *T {
 	if q.heap.Len() == 0 {
 		return nil
 	}
 
 	now := time.Now()
 
-	entry := q.heap.Peek().(*deferredRequest)
+	entry := q.heap.Peek().(*deferredRequest[T])
 	if entry.enqueueAt.After(now) {
 		return nil
 	}
 
-	entry = heap.Pop(q.heap).(*deferredRequest)
+	entry = heap.Pop(q.heap).(*deferredRequest[T])
 	delete(q.entries, entry.item)
 	return &entry.item
 }
 
 // signalReady returns a timer signal to the next Request
 // that will be ready on the queue
-func (q *deferQueue) signalReady() <-chan time.Time {
+func (q *deferQueue[T]) signalReady() <-chan time.Time {
 	if q.heap.Len() == 0 {
 		return make(<-chan time.Time)
 	}
@@ -123,7 +123,7 @@ func (q *deferQueue) signalReady() <-chan time.Time {
 		q.nextReadyTimer.Stop()
 	}
 	now := time.Now()
-	entry := q.heap.Peek().(*deferredRequest)
+	entry := q.heap.Peek().(*deferredRequest[T])
 	q.nextReadyTimer = time.NewTimer(entry.enqueueAt.Sub(now))
 	return q.nextReadyTimer.C
 }
@@ -132,7 +132,7 @@ func (q *deferQueue) signalReady() <-chan time.Time {
 // given callback, blocking until the given context is canceled.
 // Callers should only ever call Process once, likely in a
 // long-lived goroutine.
-func (q *deferQueue) Process(ctx context.Context, callback func(item Request)) {
+func (q *deferQueue[T]) Process(ctx context.Context, callback func(item T)) {
 	for {
 		ready := q.readyRequest()
 		if ready != nil {
@@ -156,7 +156,7 @@ func (q *deferQueue) Process(ctx context.Context, callback func(item Request)) {
 			// continue the loop, which process ready items
 
 		case entry := <-q.addChannel:
-			enqueueOrProcess := func(entry *deferredRequest) {
+			enqueueOrProcess := func(entry *deferredRequest[T]) {
 				now := time.Now()
 				if entry.enqueueAt.After(now) {
 					q.deferEntry(entry)
@@ -182,38 +182,38 @@ func (q *deferQueue) Process(ctx context.Context, callback func(item Request)) {
 	}
 }
 
-var _ heap.Interface = &deferHeap{}
+var _ heap.Interface = &deferHeap[string]{}
 
 // deferHeap implements heap.Interface
-type deferHeap []*deferredRequest
+type deferHeap[T ItemType] []*deferredRequest[T]
 
 // Len returns the length of the heap.
-func (h deferHeap) Len() int {
+func (h deferHeap[T]) Len() int {
 	return len(h)
 }
 
 // Less compares heap items for purposes of sorting.
-func (h deferHeap) Less(i, j int) bool {
+func (h deferHeap[T]) Less(i, j int) bool {
 	return h[i].enqueueAt.Before(h[j].enqueueAt)
 }
 
 // Swap swaps two entries in the heap.
-func (h deferHeap) Swap(i, j int) {
+func (h deferHeap[T]) Swap(i, j int) {
 	h[i], h[j] = h[j], h[i]
 	h[i].index = i
 	h[j].index = j
 }
 
 // Push pushes an entry onto the heap.
-func (h *deferHeap) Push(x interface{}) {
+func (h *deferHeap[T]) Push(x interface{}) {
 	n := len(*h)
-	item := x.(*deferredRequest)
+	item := x.(*deferredRequest[T])
 	item.index = n
 	*h = append(*h, item)
 }
 
 // Pop pops an entry off the heap.
-func (h *deferHeap) Pop() interface{} {
+func (h *deferHeap[T]) Pop() interface{} {
 	n := len(*h)
 	item := (*h)[n-1]
 	item.index = -1
@@ -222,6 +222,6 @@ func (h *deferHeap) Pop() interface{} {
 }
 
 // Peek returns the next item on the heap.
-func (h deferHeap) Peek() interface{} {
+func (h deferHeap[T]) Peek() interface{} {
 	return h[0]
 }
diff --git a/agent/consul/controller/queue.go b/agent/consul/controller/queue/queue.go
similarity index 76%
rename from agent/consul/controller/queue.go
rename to agent/consul/controller/queue/queue.go
index ede7a00c0f8d..fd712b40a4c0 100644
--- a/agent/consul/controller/queue.go
+++ b/agent/consul/controller/queue/queue.go
@@ -1,7 +1,7 @@
 // Copyright (c) HashiCorp, Inc.
 // SPDX-License-Identifier: MPL-2.0
 
-package controller
+package queue
 
 import (
 	"context"
@@ -12,43 +12,46 @@ import (
 // much of this is a re-implementation of
 // https://github.com/kubernetes/client-go/blob/release-1.25/util/workqueue/queue.go
 
+// ItemType is the type constraint for items in the WorkQueue.
+type ItemType comparable
+
 // WorkQueue is an interface for a work queue with semantics to help with
 // retries and rate limiting.
-type WorkQueue interface {
+type WorkQueue[T ItemType] interface {
 	// Get retrieves the next Request in the queue, blocking until a Request is
 	// available, if shutdown is true, then the queue is shutting down and should
 	// no longer be used by the caller.
-	Get() (item Request, shutdown bool)
+	Get() (item T, shutdown bool)
 	// Add immediately adds a Request to the work queue.
-	Add(item Request)
+	Add(item T)
 	// AddAfter adds a Request to the work queue after a given amount of time.
-	AddAfter(item Request, duration time.Duration)
+	AddAfter(item T, duration time.Duration)
 	// AddRateLimited adds a Request to the work queue after the amount of time
 	// specified by applying the queue's rate limiter.
-	AddRateLimited(item Request)
+	AddRateLimited(item T)
 	// Forget signals the queue to reset the rate-limiting for the given Request.
-	Forget(item Request)
+	Forget(item T)
 	// Done tells the work queue that the Request has been successfully processed
 	// and can be deleted from the queue.
-	Done(item Request)
+	Done(item T)
 }
 
 // queue implements a rate-limited work queue
-type queue struct {
+type queue[T ItemType] struct {
 	// queue holds an ordered list of Requests needing to be processed
-	queue []Request
+	queue []T
 
 	// dirty holds the working set of all Requests, whether they are being
 	// processed or not
-	dirty map[Request]struct{}
+	dirty map[T]struct{}
 	// processing holds the set of current requests being processed
-	processing map[Request]struct{}
+	processing map[T]struct{}
 
 	// deferred is an internal priority queue that tracks deferred
 	// Requests
-	deferred DeferQueue
+	deferred DeferQueue[T]
 	// ratelimiter is the internal rate-limiter for the queue
-	ratelimiter Limiter
+	ratelimiter Limiter[T]
 
 	// cond synchronizes queue access and handles signalling for when
 	// data is available in the queue
@@ -58,15 +61,15 @@ type queue struct {
 	ctx context.Context
 }
 
-// RunWorkQueue returns a started WorkQueue that has per-Request exponential backoff rate-limiting.
+// RunWorkQueue returns a started WorkQueue that has per-item exponential backoff rate-limiting.
 // When the passed in context is canceled, the queue shuts down.
-func RunWorkQueue(ctx context.Context, baseBackoff, maxBackoff time.Duration) WorkQueue {
-	q := &queue{
-		ratelimiter: NewRateLimiter(baseBackoff, maxBackoff),
-		dirty:       make(map[Request]struct{}),
-		processing:  make(map[Request]struct{}),
+func RunWorkQueue[T ItemType](ctx context.Context, baseBackoff, maxBackoff time.Duration) WorkQueue[T] {
+	q := &queue[T]{
+		ratelimiter: NewRateLimiter[T](baseBackoff, maxBackoff),
+		dirty:       make(map[T]struct{}),
+		processing:  make(map[T]struct{}),
 		cond:        sync.NewCond(&sync.Mutex{}),
-		deferred:    NewDeferQueue(500 * time.Millisecond),
+		deferred:    NewDeferQueue[T](500 * time.Millisecond),
 		ctx:         ctx,
 	}
 	go q.start()
@@ -75,8 +78,8 @@ func RunWorkQueue(ctx context.Context, baseBackoff, maxBackoff time.Duration) Wo
 }
 
 // start begins the asynchronous processing loop for the deferral queue
-func (q *queue) start() {
-	go q.deferred.Process(q.ctx, func(item Request) {
+func (q *queue[T]) start() {
+	go q.deferred.Process(q.ctx, func(item T) {
 		q.Add(item)
 	})
 
@@ -85,7 +88,7 @@ func (q *queue) start() {
 }
 
 // shuttingDown returns whether the queue is in the process of shutting down
-func (q *queue) shuttingDown() bool {
+func (q *queue[T]) shuttingDown() bool {
 	select {
 	case <-q.ctx.Done():
 		return true
@@ -98,7 +101,7 @@ func (q *queue) shuttingDown() bool {
 // an item is available in the queue. If the returned shutdown parameter is true,
 // then the caller should stop using the queue. Any Requests returned by a call
 // to Get must be explicitly marked as processed via the Done method.
-func (q *queue) Get() (item Request, shutdown bool) {
+func (q *queue[T]) Get() (item T, shutdown bool) {
 	q.cond.L.Lock()
 	defer q.cond.L.Unlock()
 	for len(q.queue) == 0 && !q.shuttingDown() {
@@ -106,7 +109,8 @@ func (q *queue) Get() (item Request, shutdown bool) {
 	}
 	if len(q.queue) == 0 {
 		// We must be shutting down.
-		return Request{}, true
+		var zero T
+		return zero, true
 	}
 
 	item, q.queue = q.queue[0], q.queue[1:]
@@ -119,7 +123,7 @@ func (q *queue) Get() (item Request, shutdown bool) {
 
 // Add puts the given Request in the queue. If the Request is already in
 // the queue or the queue is stopping, then this is a no-op.
-func (q *queue) Add(item Request) {
+func (q *queue[T]) Add(item T) {
 	q.cond.L.Lock()
 	defer q.cond.L.Unlock()
 	if q.shuttingDown() {
@@ -139,7 +143,7 @@ func (q *queue) Add(item Request) {
 }
 
 // AddAfter adds a Request to the work queue after a given amount of time.
-func (q *queue) AddAfter(item Request, duration time.Duration) {
+func (q *queue[T]) AddAfter(item T, duration time.Duration) {
 	// don't add if we're already shutting down
 	if q.shuttingDown() {
 		return
@@ -156,18 +160,18 @@ func (q *queue) AddAfter(item Request, duration time.Duration) {
 
 // AddRateLimited adds the given Request to the queue after applying the
 // rate limiter to determine when the Request should next be processed.
-func (q *queue) AddRateLimited(item Request) {
+func (q *queue[T]) AddRateLimited(item T) {
 	q.AddAfter(item, q.ratelimiter.NextRetry(item))
 }
 
 // Forget signals the queue to reset the rate-limiting for the given Request.
-func (q *queue) Forget(item Request) {
+func (q *queue[T]) Forget(item T) {
 	q.ratelimiter.Forget(item)
 }
 
 // Done removes the item from the queue, if it has been marked dirty
 // again while being processed, it is re-added to the queue.
-func (q *queue) Done(item Request) {
+func (q *queue[T]) Done(item T) {
 	q.cond.L.Lock()
 	defer q.cond.L.Unlock()
 
diff --git a/agent/consul/controller/rate.go b/agent/consul/controller/queue/rate.go
similarity index 75%
rename from agent/consul/controller/rate.go
rename to agent/consul/controller/queue/rate.go
index 76bc48f31c3b..f4f0dc5ad9a0 100644
--- a/agent/consul/controller/rate.go
+++ b/agent/consul/controller/queue/rate.go
@@ -1,7 +1,7 @@
 // Copyright (c) HashiCorp, Inc.
 // SPDX-License-Identifier: MPL-2.0
 
-package controller
+package queue
 
 import (
 	"math"
@@ -14,18 +14,18 @@ import (
 
 // Limiter is an interface for a rate limiter that can limit
 // the number of retries processed in the work queue.
-type Limiter interface {
+type Limiter[T ItemType] interface {
 	// NextRetry returns the remaining time until the queue should
 	// reprocess a Request.
-	NextRetry(request Request) time.Duration
+	NextRetry(request T) time.Duration
 	// Forget causes the Limiter to reset the backoff for the Request.
-	Forget(request Request)
+	Forget(request T)
 }
 
-var _ Limiter = &ratelimiter{}
+var _ Limiter[string] = &ratelimiter[string]{}
 
-type ratelimiter struct {
-	failures map[Request]int
+type ratelimiter[T ItemType] struct {
+	failures map[T]int
 	base     time.Duration
 	max      time.Duration
 	mutex    sync.RWMutex
@@ -33,9 +33,9 @@ type ratelimiter struct {
 
 // NewRateLimiter returns a Limiter that does per-item exponential
 // backoff.
-func NewRateLimiter(base, max time.Duration) Limiter {
-	return &ratelimiter{
-		failures: make(map[Request]int),
+func NewRateLimiter[T ItemType](base, max time.Duration) Limiter[T] {
+	return &ratelimiter[T]{
+		failures: make(map[T]int),
 		base:     base,
 		max:      max,
 	}
@@ -43,7 +43,7 @@ func NewRateLimiter(base, max time.Duration) Limiter {
 
 // NextRetry returns the remaining time until the queue should
 // reprocess a Request.
-func (r *ratelimiter) NextRetry(request Request) time.Duration {
+func (r *ratelimiter[T]) NextRetry(request T) time.Duration {
 	r.mutex.RLock()
 	defer r.mutex.RUnlock()
 
@@ -65,7 +65,7 @@ func (r *ratelimiter) NextRetry(request Request) time.Duration {
 }
 
 // Forget causes the Limiter to reset the backoff for the Request.
-func (r *ratelimiter) Forget(request Request) {
+func (r *ratelimiter[T]) Forget(request T) {
 	r.mutex.Lock()
 	defer r.mutex.Unlock()
 
diff --git a/agent/consul/controller/rate_test.go b/agent/consul/controller/queue/rate_test.go
similarity index 86%
rename from agent/consul/controller/rate_test.go
rename to agent/consul/controller/queue/rate_test.go
index 676a28ee6026..f44df15e1b4d 100644
--- a/agent/consul/controller/rate_test.go
+++ b/agent/consul/controller/queue/rate_test.go
@@ -1,7 +1,7 @@
 // Copyright (c) HashiCorp, Inc.
 // SPDX-License-Identifier: MPL-2.0
 
-package controller
+package queue
 
 import (
 	"testing"
@@ -10,10 +10,12 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+type Request struct{ Kind string }
+
 func TestRateLimiter_Backoff(t *testing.T) {
 	t.Parallel()
 
-	limiter := NewRateLimiter(1*time.Millisecond, 1*time.Second)
+	limiter := NewRateLimiter[Request](1*time.Millisecond, 1*time.Second)
 
 	request := Request{Kind: "one"}
 	require.Equal(t, 1*time.Millisecond, limiter.NextRetry(request))
@@ -33,7 +35,7 @@ func TestRateLimiter_Backoff(t *testing.T) {
 func TestRateLimiter_Overflow(t *testing.T) {
 	t.Parallel()
 
-	limiter := NewRateLimiter(1*time.Millisecond, 1000*time.Second)
+	limiter := NewRateLimiter[Request](1*time.Millisecond, 1000*time.Second)
 
 	request := Request{Kind: "one"}
 	for i := 0; i < 5; i++ {
@@ -49,7 +51,7 @@ func TestRateLimiter_Overflow(t *testing.T) {
 	// make sure we're capped at the passed in max backoff
 	require.Equal(t, 1000*time.Second, limiter.NextRetry(overflow))
 
-	limiter = NewRateLimiter(1*time.Minute, 1000*time.Hour)
+	limiter = NewRateLimiter[Request](1*time.Minute, 1000*time.Hour)
 
 	for i := 0; i < 2; i++ {
 		limiter.NextRetry(request)
diff --git a/agent/consul/controller/queue_test.go b/agent/consul/controller/queue_test.go
index 63571511def4..867dfeff134b 100644
--- a/agent/consul/controller/queue_test.go
+++ b/agent/consul/controller/queue_test.go
@@ -6,11 +6,13 @@ package controller
 import (
 	"sync/atomic"
 	"time"
+
+	"github.com/hashicorp/consul/agent/consul/controller/queue"
 )
 
-var _ WorkQueue = &countingWorkQueue{}
+var _ queue.WorkQueue[string] = &countingWorkQueue[string]{}
 
-type countingWorkQueue struct {
+type countingWorkQueue[T queue.ItemType] struct {
 	getCounter            uint64
 	addCounter            uint64
 	addAfterCounter       uint64
@@ -18,16 +20,16 @@ type countingWorkQueue struct {
 	forgetCounter         uint64
 	doneCounter           uint64
 
-	inner WorkQueue
+	inner queue.WorkQueue[T]
 }
 
-func newCountingWorkQueue(inner WorkQueue) *countingWorkQueue {
-	return &countingWorkQueue{
+func newCountingWorkQueue[T queue.ItemType](inner queue.WorkQueue[T]) *countingWorkQueue[T] {
+	return &countingWorkQueue[T]{
 		inner: inner,
 	}
 }
 
-func (c *countingWorkQueue) reset() {
+func (c *countingWorkQueue[T]) reset() {
 	atomic.StoreUint64(&c.getCounter, 0)
 	atomic.StoreUint64(&c.addCounter, 0)
 	atomic.StoreUint64(&c.addAfterCounter, 0)
@@ -36,61 +38,61 @@ func (c *countingWorkQueue) reset() {
 	atomic.StoreUint64(&c.doneCounter, 0)
 }
 
-func (c *countingWorkQueue) requeues() uint64 {
+func (c *countingWorkQueue[T]) requeues() uint64 {
 	return c.addAfters() + c.addRateLimiteds()
 }
 
-func (c *countingWorkQueue) Get() (item Request, shutdown bool) {
+func (c *countingWorkQueue[T]) Get() (item T, shutdown bool) {
 	item, err := c.inner.Get()
 	atomic.AddUint64(&c.getCounter, 1)
 	return item, err
 }
 
-func (c *countingWorkQueue) gets() uint64 {
+func (c *countingWorkQueue[T]) gets() uint64 {
 	return atomic.LoadUint64(&c.getCounter)
 }
 
-func (c *countingWorkQueue) Add(item Request) {
+func (c *countingWorkQueue[T]) Add(item T) {
 	c.inner.Add(item)
 	atomic.AddUint64(&c.addCounter, 1)
 }
 
-func (c *countingWorkQueue) adds() uint64 {
+func (c *countingWorkQueue[T]) adds() uint64 {
 	return atomic.LoadUint64(&c.addCounter)
 }
 
-func (c *countingWorkQueue) AddAfter(item Request, duration time.Duration) {
+func (c *countingWorkQueue[T]) AddAfter(item T, duration time.Duration) {
 	c.inner.AddAfter(item, duration)
 	atomic.AddUint64(&c.addAfterCounter, 1)
 }
 
-func (c *countingWorkQueue) addAfters() uint64 {
+func (c *countingWorkQueue[T]) addAfters() uint64 {
 	return atomic.LoadUint64(&c.addAfterCounter)
 }
 
-func (c *countingWorkQueue) AddRateLimited(item Request) {
+func (c *countingWorkQueue[T]) AddRateLimited(item T) {
 	c.inner.AddRateLimited(item)
 	atomic.AddUint64(&c.addRateLimitedCounter, 1)
 }
 
-func (c *countingWorkQueue) addRateLimiteds() uint64 {
+func (c *countingWorkQueue[T]) addRateLimiteds() uint64 {
 	return atomic.LoadUint64(&c.addRateLimitedCounter)
 }
 
-func (c *countingWorkQueue) Forget(item Request) {
+func (c *countingWorkQueue[T]) Forget(item T) {
 	c.inner.Forget(item)
 	atomic.AddUint64(&c.forgetCounter, 1)
 }
 
-func (c *countingWorkQueue) forgets() uint64 {
+func (c *countingWorkQueue[T]) forgets() uint64 {
 	return atomic.LoadUint64(&c.forgetCounter)
 }
 
-func (c *countingWorkQueue) Done(item Request) {
+func (c *countingWorkQueue[T]) Done(item T) {
 	c.inner.Done(item)
 	atomic.AddUint64(&c.doneCounter, 1)
 }
 
-func (c *countingWorkQueue) dones() uint64 {
+func (c *countingWorkQueue[T]) dones() uint64 {
 	return atomic.LoadUint64(&c.doneCounter)
 }
diff --git a/agent/consul/gateways/controller_gateways_test.go b/agent/consul/gateways/controller_gateways_test.go
index d88c7a96bdb6..07d85357acdc 100644
--- a/agent/consul/gateways/controller_gateways_test.go
+++ b/agent/consul/gateways/controller_gateways_test.go
@@ -17,6 +17,7 @@ import (
 
 	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/agent/consul/controller"
+	"github.com/hashicorp/consul/agent/consul/controller/queue"
 	"github.com/hashicorp/consul/agent/consul/fsm"
 	"github.com/hashicorp/consul/agent/consul/state"
 	"github.com/hashicorp/consul/agent/consul/stream"
@@ -4096,7 +4097,7 @@ func (n *noopController) Subscribe(request *stream.SubscribeRequest, transformer
 func (n *noopController) WithBackoff(base, max time.Duration) controller.Controller { return n }
 func (n *noopController) WithLogger(logger hclog.Logger) controller.Controller      { return n }
 func (n *noopController) WithWorkers(i int) controller.Controller                   { return n }
-func (n *noopController) WithQueueFactory(fn func(ctx context.Context, baseBackoff time.Duration, maxBackoff time.Duration) controller.WorkQueue) controller.Controller {
+func (n *noopController) WithQueueFactory(fn func(ctx context.Context, baseBackoff time.Duration, maxBackoff time.Duration) queue.WorkQueue[controller.Request]) controller.Controller {
 	return n
 }
 

From 166d7a39e82e39f641f5f0053ed660ad1d7218e7 Mon Sep 17 00:00:00 2001
From: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>
Date: Fri, 5 May 2023 13:41:40 -0400
Subject: [PATCH 45/92] docs: consistently name Consul service mesh (#17222)

Remove outdated usage of "Consul Connect" instead of Consul service mesh.

The connect subsystem in Consul provides Consul's service mesh capabilities.
However, the term "Consul Connect" should not be used as an alternative to
the name "Consul service mesh".
---
 website/content/api-docs/agent/connect.mdx    | 18 +++----
 website/content/api-docs/agent/service.mdx    | 16 +++---
 website/content/api-docs/catalog.mdx          | 12 ++---
 website/content/api-docs/connect/ca.mdx       |  6 +--
 website/content/api-docs/connect/index.mdx    | 13 +++--
 .../content/api-docs/connect/intentions.mdx   |  2 +-
 website/content/api-docs/discovery-chain.mdx  |  4 +-
 website/content/api-docs/health.mdx           |  8 +--
 website/content/api-docs/operator/usage.mdx   | 10 ++--
 website/content/api-docs/query.mdx            | 10 ++--
 website/content/commands/config/write.mdx     | 29 ++++------
 website/content/commands/connect/ca.mdx       | 13 ++---
 website/content/commands/connect/envoy.mdx    |  2 +-
 website/content/commands/connect/expose.mdx   |  6 +--
 website/content/commands/connect/index.mdx    | 22 ++++----
 website/content/commands/connect/proxy.mdx    | 12 ++---
 .../commands/connect/redirect-traffic.mdx     |  2 +-
 website/content/commands/index.mdx            |  4 +-
 website/content/commands/intention/index.mdx  |  2 +-
 website/content/commands/operator/usage.mdx   |  2 +-
 .../content/docs/agent/config/cli-flags.mdx   |  2 +-
 .../docs/agent/config/config-files.mdx        | 29 +++++-----
 website/content/docs/agent/index.mdx          |  2 +-
 website/content/docs/agent/telemetry.mdx      | 14 ++---
 website/content/docs/architecture/scale.mdx   |  2 +-
 website/content/docs/connect/ca/aws.mdx       |  6 +--
 website/content/docs/connect/ca/consul.mdx    | 10 ++--
 website/content/docs/connect/ca/index.mdx     | 10 ++--
 website/content/docs/connect/ca/vault.mdx     |  4 +-
 .../docs/connect/config-entries/index.mdx     |  2 +-
 .../docs/connect/config-entries/mesh.mdx      |  2 +-
 .../connect/config-entries/proxy-defaults.mdx |  8 +--
 .../config-entries/service-defaults.mdx       | 16 +++---
 .../config-entries/service-resolver.mdx       |  2 +-
 .../connect/config-entries/service-router.mdx |  4 +-
 .../config-entries/terminating-gateway.mdx    |  4 +-
 .../content/docs/connect/configuration.mdx    | 43 ++++++++-------
 .../docs/connect/connect-internals.mdx        |  7 ++-
 .../docs/connect/connectivity-tasks.mdx       |  2 +-
 website/content/docs/connect/dev.mdx          |  6 +--
 .../connect/gateways/api-gateway/usage.mdx    |  2 +-
 .../content/docs/connect/gateways/index.mdx   |  2 +-
 .../docs/connect/gateways/ingress-gateway.mdx |  6 +--
 .../connect/gateways/mesh-gateway/index.mdx   | 12 ++---
 .../service-to-service-traffic-partitions.mdx |  8 +--
 ...ice-to-service-traffic-wan-datacenters.mdx | 18 +++----
 .../connect/gateways/terminating-gateway.mdx  | 14 ++---
 website/content/docs/connect/index.mdx        | 24 +++++----
 .../content/docs/connect/intentions/index.mdx |  2 +-
 .../docs/connect/intentions/legacy.mdx        | 13 +++--
 .../connect/l7-traffic/discovery-chain.mdx    | 10 ++--
 .../content/docs/connect/l7-traffic/index.mdx |  4 +-
 website/content/docs/connect/native/go.mdx    | 39 +++++++-------
 website/content/docs/connect/native/index.mdx | 39 +++++++-------
 website/content/docs/connect/nomad.mdx        | 12 ++---
 .../docs/connect/observability/index.mdx      |  4 +-
 .../observability/ui-visualization.mdx        |  5 +-
 .../content/docs/connect/proxies/built-in.mdx |  6 +--
 .../content/docs/connect/proxies/envoy.mdx    | 28 +++++-----
 .../content/docs/connect/proxies/index.mdx    |  2 +-
 .../docs/connect/proxies/integrate.mdx        | 15 +++---
 .../registration/service-registration.mdx     |  6 +--
 .../connect/registration/sidecar-service.mdx  |  2 +-
 website/content/docs/connect/security.mdx     | 20 +++----
 .../docs/connect/transparent-proxy.mdx        |  2 +-
 website/content/docs/ecs/index.mdx            |  2 +-
 website/content/docs/ecs/manual/install.mdx   |  2 +-
 website/content/docs/guides/index.mdx         |  2 +-
 website/content/docs/install/performance.mdx  |  8 +--
 .../content/docs/integrate/download-tools.mdx |  2 +-
 .../content/docs/integrate/partnerships.mdx   |  2 +-
 .../docs/k8s/annotations-and-labels.mdx       | 11 ++--
 .../docs/k8s/connect/connect-ca-provider.mdx  | 20 +++----
 website/content/docs/k8s/connect/index.mdx    | 33 +++++++-----
 .../docs/k8s/connect/ingress-gateways.mdx     |  2 +-
 .../k8s/connect/observability/metrics.mdx     |  8 +--
 .../content/docs/k8s/crds/upgrade-to-crds.mdx |  4 +-
 .../multi-cluster/kubernetes.mdx              |  2 +-
 .../servers-outside-kubernetes.mdx            |  2 +-
 .../vault/data-integration/connect-ca.mdx     | 12 ++---
 .../vault/wan-federation.mdx                  |  2 +-
 website/content/docs/k8s/helm.mdx             | 54 +++++++++----------
 .../operations/tls-on-existing-cluster.mdx    | 10 ++--
 website/content/docs/lambda/invocation.mdx    | 16 +++---
 .../docs/release-notes/consul/v1_11_x.mdx     |  2 +-
 .../content/docs/security/acl/acl-rules.mdx   |  2 +-
 .../docs/security/acl/auth-methods/index.mdx  |  4 +-
 .../docs/security/security-models/core.mdx    | 32 +++++------
 .../docs/security/security-models/nia.mdx     |  2 +-
 website/content/docs/services/services.mdx    |  2 +-
 .../docs/upgrading/upgrade-specific.mdx       | 23 ++++----
 .../public/img/connect_proxy_to_lambda.svg    |  2 +-
 .../img/terminating_gateway_to_lambda.svg     |  2 +-
 93 files changed, 475 insertions(+), 453 deletions(-)

diff --git a/website/content/api-docs/agent/connect.mdx b/website/content/api-docs/agent/connect.mdx
index 68944b404bde..c45eae34999f 100644
--- a/website/content/api-docs/agent/connect.mdx
+++ b/website/content/api-docs/agent/connect.mdx
@@ -2,18 +2,18 @@
 layout: api
 page_title: Connect - Agent - HTTP API
 description: >-
-  The /agent/connect endpoints interact with Connect with agent-local
+  The /agent/connect endpoints interact with agent-local service mesh
   operations.
 ---
 
 # Connect - Agent HTTP API
 
-The `/agent/connect` endpoints interact with [Connect](/consul/docs/connect)
-with agent-local operations.
+The `/agent/connect` endpoints interact with
+with agent-local [service mesh](/consul/docs/connect) operations.
 
-These endpoints may mirror the [non-agent Connect endpoints](/consul/api-docs/connect)
-in some cases. Almost all agent-local Connect endpoints perform local caching
-to optimize performance of Connect without having to make requests to the server.
+These endpoints may mirror the [non-agent service mesh endpoints](/consul/api-docs/connect)
+in some cases. Almost all agent-local service mesh endpoints perform local caching
+to optimize performance of the mesh without having to make requests to the server.
 
 ## Authorize
 
@@ -29,7 +29,7 @@ This endpoint tests whether a connection attempt is authorized between
 two services. This is the primary API that must be implemented by
 [proxies](/consul/docs/connect/proxies) or
 [native integrations](/consul/docs/connect/native)
-that wish to integrate with Connect. Prior to calling this API, it is expected
+that wish to integrate with the service mesh. Prior to calling this API, it is expected
 that the client TLS certificate has been properly verified against the
 current CA roots.
 
@@ -108,7 +108,7 @@ This is used by [proxies](/consul/docs/connect/proxies) or
 [native integrations](/consul/docs/connect/native) to verify served client
 or server certificates are valid.
 
-This is equivalent to the [non-Agent Connect endpoint](/consul/api-docs/connect),
+This is equivalent to the [non-Agent service mesh endpoint](/consul/api-docs/connect),
 but the response of this request is cached locally at the agent. This allows
 for very fast response times and for fail open behavior if the server is
 unavailable. This endpoint should be used by proxies and native integrations.
@@ -248,7 +248,7 @@ $ curl \
 
 ## Methods to Specify Namespace <EnterpriseAlert inline />
 
-Local agent connect endpoints
+Local agent service mesh endpoints
 support several methods for specifying the namespace of resources
 with the following order of precedence:
 1. `Namespace` field of the JSON request body -
diff --git a/website/content/api-docs/agent/service.mdx b/website/content/api-docs/agent/service.mdx
index 38eedad35362..acaa2e8d0fb1 100644
--- a/website/content/api-docs/agent/service.mdx
+++ b/website/content/api-docs/agent/service.mdx
@@ -130,7 +130,7 @@ following selectors and filter operations being supported:
 
 This endpoint was added in Consul 1.3.0 and returns the full service definition
 for a single service instance registered on the local agent. It is used by
-[Connect proxies](/consul/docs/connect/proxies) to discover the embedded proxy
+[service mesh proxies](/consul/docs/connect/proxies) to discover the embedded proxy
 configuration that was registered with the instance.
 
 It is important to note that the services known by the agent may be different
@@ -632,18 +632,18 @@ The `/agent/service/register` endpoint supports camel case and _snake case_ for
 
 - `Kind` `(string: "")` - The kind of service. Defaults to "" which is a
   typical Consul service. This value may also be "connect-proxy" for
-  [Connect](/consul/docs/connect) proxies representing another service,
-  "mesh-gateway" for instances of a [mesh gateway](/consul/docs/connect/gateways/mesh-gateway#connect-proxy-configuration),
+  [service mesh](/consul/docs/connect) proxies representing another service,
+  "mesh-gateway" for instances of a [mesh gateway](/consul/docs/connect/gateways/mesh-gateway#service-mesh-proxy-configuration),
   "terminating-gateway" for instances of a [terminating gateway](/consul/docs/connect/gateways/terminating-gateway),
   or "ingress-gateway" for instances of a [ingress gateway](/consul/docs/connect/gateways/ingress-gateway).
 
 - `Proxy` `(Proxy: nil)` - From 1.2.3 on, specifies the configuration for a
-  Connect service proxy instance. This is only valid if `Kind` defines a proxy or gateway.
+  service mesh proxy instance. This is only valid if `Kind` defines a proxy or gateway.
   See the [Proxy documentation](/consul/docs/connect/registration/service-registration)
   for full details.
 
 - `Connect` `(Connect: nil)` - Specifies the
-  [configuration for Connect](/consul/docs/connect/configuration). See the
+  [configuration for service mesh](/consul/docs/connect/configuration). The connect subsystem provides Consul's service mesh capabilities. Refer to the
   [Connect Structure](#connect-structure) section below for supported fields.
 
 - `Check` `(Check: nil)` - Specifies a check. Please see the
@@ -689,12 +689,12 @@ The `/agent/service/register` endpoint supports camel case and _snake case_ for
 For the `Connect` field, the parameters are:
 
 - `Native` `(bool: false)` - Specifies whether this service supports
-  the [Connect](/consul/docs/connect) protocol [natively](/consul/docs/connect/native).
-  If this is true, then Connect proxies, DNS queries, etc. will be able to
+  the [Consul service mesh](/consul/docs/connect) protocol [natively](/consul/docs/connect/native).
+  If this is true, then service mesh proxies, DNS queries, etc. will be able to
   service discover this service.
 - `Proxy` `(Proxy: nil)` -
   [**Deprecated**](/consul/docs/connect/proxies/managed-deprecated) Specifies that
-  a managed Connect proxy should be started for this service instance, and
+  a managed service mesh proxy should be started for this service instance, and
   optionally provides configuration for the proxy. The format is as documented
   in [Managed Proxy Deprecation](/consul/docs/connect/proxies/managed-deprecated).
 - `SidecarService` `(ServiceDefinition: nil)` - Specifies an optional nested
diff --git a/website/content/api-docs/catalog.mdx b/website/content/api-docs/catalog.mdx
index 2b470dd57886..c7f715849ccf 100644
--- a/website/content/api-docs/catalog.mdx
+++ b/website/content/api-docs/catalog.mdx
@@ -650,9 +650,9 @@ $ curl \
   [service registration API](/consul/api-docs/agent/service#kind) for more information.
 
 - `ServiceProxy` is the proxy config as specified in
-  [Connect Proxies](/consul/docs/connect/proxies).
+  [service mesh Proxies](/consul/docs/connect/proxies).
 
-- `ServiceConnect` are the [Connect](/consul/docs/connect) settings. The
+- `ServiceConnect` are the [service mesh](/consul/docs/connect) settings. The
   value of this struct is equivalent to the `Connect` field for service
   registration.
 
@@ -704,13 +704,13 @@ following selectors and filter operations being supported:
 | `TaggedAddresses.<any>`                              | Equal, Not Equal, In, Not In, Matches, Not Matches |
 | `TaggedAddresses`                                    | Is Empty, Is Not Empty, In, Not In                 |
 
-## List Nodes for Connect-capable Service
+## List Nodes for Mesh-capable Service
 
 This endpoint returns the nodes providing a
-[Connect-capable](/consul/docs/connect) service in a given datacenter.
+[mesh-capable](/consul/docs/connect) service in a given datacenter.
 This will include both proxies and native integrations. A service may
-register both Connect-capable and incapable services at the same time,
-so this endpoint may be used to filter only the Connect-capable endpoints.
+register both mesh-capable and incapable services at the same time,
+so this endpoint may be used to filter only the mesh-capable endpoints.
 
 @include 'http_api_results_filtered_by_acls.mdx'
 
diff --git a/website/content/api-docs/connect/ca.mdx b/website/content/api-docs/connect/ca.mdx
index 75a1e2ab9159..ad808c13df44 100644
--- a/website/content/api-docs/connect/ca.mdx
+++ b/website/content/api-docs/connect/ca.mdx
@@ -8,7 +8,7 @@ description: |-
 
 # Certificate Authority (CA) - Connect HTTP API
 
-The `/connect/ca` endpoints provide tools for interacting with Connect's
+The `/connect/ca` endpoints provide tools for interacting with the service mesh's
 Certificate Authority mechanism.
 
 ## List CA Root Certificates
@@ -33,7 +33,7 @@ The table below shows this endpoint's support for
 ### Query Parameters
 
 - `pem` `(boolean: false)` - Specifies that the return body should be a PEM encoded
-  certificate chain suitable for use by applications needing to trust Connect CA
+  certificate chain suitable for use by applications needing to trust service mesh CA
   signed certificates. The Content-Type will be set to `application/pem-certificate-chain`
   to indicate the format of the response.
 
@@ -181,7 +181,7 @@ The corresponding CLI command is [`consul connect ca set-config`](/consul/comman
 - `Provider` `(string: <required>)` - Specifies the CA provider type to use.
 
 - `Config` `(map[string]string: <required>)` - The raw configuration to use
-  for the chosen provider. For more information on configuring the Connect CA
+  for the chosen provider. For more information on configuring the service mesh CA
   providers, see [Provider Config](/consul/docs/connect/ca).
 
 - `ForceWithoutCrossSigning` `(bool: false)` - Indicates that the CA change
diff --git a/website/content/api-docs/connect/index.mdx b/website/content/api-docs/connect/index.mdx
index 3324ec14e782..609a8d4f08bf 100644
--- a/website/content/api-docs/connect/index.mdx
+++ b/website/content/api-docs/connect/index.mdx
@@ -2,20 +2,25 @@
 layout: api
 page_title: Connect - HTTP API
 description: >-
-  The `/connect` endpoints provide access to Connect-related operations for
+  The `/connect` endpoints provide access to service mesh-related operations for
   intentions and the certificate authority.
 ---
 
 # Connect HTTP Endpoint
 
 The `/connect` endpoints provide access to
-[Connect-related](/consul/docs/connect) operations for
+[service mesh-related](/consul/docs/connect) operations for
 intentions and the certificate authority.
 
-There are also Connect-related endpoints in the
+There are also service mesh-related endpoints in the
 [Agent](/consul/api-docs/agent) and [Catalog](/consul/api-docs/catalog) APIs. For example,
 the API for requesting a TLS certificate for a service is part of the agent
-APIs. And the catalog API has an endpoint for finding all Connect-capable
+APIs. And the catalog API has an endpoint for finding all mesh-capable
 services in the catalog.
 
+The noun _connect_ is used throughout this documentation to refer to the connect
+subsystem that provides Consul's service mesh capabilities.
+Where you encounter the _noun_ connect, it is usually functionality specific to
+service mesh.
+
 Please choose a sub-section in the navigation for more information.
diff --git a/website/content/api-docs/connect/intentions.mdx b/website/content/api-docs/connect/intentions.mdx
index 1658b16992fb..cdfeb463cda0 100644
--- a/website/content/api-docs/connect/intentions.mdx
+++ b/website/content/api-docs/connect/intentions.mdx
@@ -672,7 +672,7 @@ $ curl \
 
 ## Methods to Specify Namespace <EnterpriseAlert inline />
 
-Connect intention endpoints
+Intention endpoints
 support several methods for specifying the namespace of intention resources
 with the following order of precedence:
 1. `ns` query parameter
diff --git a/website/content/api-docs/discovery-chain.mdx b/website/content/api-docs/discovery-chain.mdx
index a96f0e89fe5a..ba222116ec65 100644
--- a/website/content/api-docs/discovery-chain.mdx
+++ b/website/content/api-docs/discovery-chain.mdx
@@ -9,7 +9,7 @@ description: The /discovery-chain endpoints are for interacting with the discove
 -> **1.6.0+:** The discovery chain API is available in Consul versions 1.6.0 and newer.
 
 ~> This is a low-level API primarily targeted at developers building external
-[Connect proxy integrations](/consul/docs/connect/proxies/integrate). Future
+[service mesh proxy integrations](/consul/docs/connect/proxies/integrate). Future
 high-level proxy integration APIs may obviate the need for this API over time.
 
 The `/discovery-chain` endpoint returns the compiled [discovery
@@ -17,7 +17,7 @@ chain](/consul/docs/connect/l7-traffic/discovery-chain) for a service.
 
 This will fetch all related [configuration
 entries](/consul/docs/agent/config-entries) and render them into a form suitable
-for use by a [connect proxy](/consul/docs/connect/proxies) implementation. This
+for use by a [service mesh proxy](/consul/docs/connect/proxies) implementation. This
 is a key component of [L7 Traffic
 Management](/consul/docs/connect/l7-traffic).
 
diff --git a/website/content/api-docs/health.mdx b/website/content/api-docs/health.mdx
index 645381a209be..cb8ef9f4eaf0 100644
--- a/website/content/api-docs/health.mdx
+++ b/website/content/api-docs/health.mdx
@@ -410,13 +410,13 @@ following selectors and filter operations being supported:
 | `Service.Weights.Passing`                             | Equal, Not Equal                                   |
 | `Service.Weights.Warning`                             | Equal, Not Equal                                   |
 
-## List Service Instances for Connect-enabled Service
+## List Service Instances for Mesh-enabled Service
 
 This endpoint returns the service instances providing a
-[Connect-capable](/consul/docs/connect) service in a given datacenter.
+[mesh-capable](/consul/docs/connect) service in a given datacenter.
 This will include both proxies and native integrations. A service may
-register both Connect-capable and incapable services at the same time,
-so this endpoint may be used to filter only the Connect-capable endpoints.
+register both mesh-capable and incapable services at the same time,
+so this endpoint may be used to filter only the mesh-capable endpoints.
 
 @include 'http_api_results_filtered_by_acls.mdx'
 
diff --git a/website/content/api-docs/operator/usage.mdx b/website/content/api-docs/operator/usage.mdx
index 75298e32b209..b1dc75c39e08 100644
--- a/website/content/api-docs/operator/usage.mdx
+++ b/website/content/api-docs/operator/usage.mdx
@@ -3,14 +3,14 @@ layout: api
 page_title: Usage - Operator - HTTP API
 description: |-
   The /operator/usage endpoint returns usage information about the number of
-  services, service instances and Connect-enabled service instances by
+  services, service instances and mesh-enabled service instances by
   datacenter.
 ---
 
 # Usage Operator HTTP API
 
 The `/operator/usage` endpoint returns usage information about the number of
-services, service instances and Connect-enabled service instances by datacenter.
+services, service instances and mesh-enabled service instances by datacenter.
 
 | Method | Path              | Produces           |
 | ------ | ----------------- | ------------------ |
@@ -142,12 +142,12 @@ $ curl \
 - `ServiceInstances` is the total number of service instances registered in
   the datacenter.
 
-- `ConnectServiceInstances` is the total number of Connect service instances
+- `ConnectServiceInstances` is the total number of mesh service instances
   registered in the datacenter.
 
 - `BillableServiceInstances` is the total number of billable service instances
   registered in the datacenter. This is only relevant in Consul Enterprise
-  and is the total service instance count, not including any Connect service
+  and is the total service instance count, not including any mesh service
   instances or any Consul server instances.
 
 - `PartitionNamespaceServices` <EnterpriseAlert inline /> is the total number
@@ -163,5 +163,5 @@ $ curl \
   by partition and namespace.
 
 - `PartitionNamespaceConnectServiceInstances` <EnterpriseAlert inline /> is
-  the total number of Connect service instances registered in the datacenter,
+  the total number of mesh service instances registered in the datacenter,
   by partition and namespace.
diff --git a/website/content/api-docs/query.mdx b/website/content/api-docs/query.mdx
index 3a46b383d42d..f8c71bfb065a 100644
--- a/website/content/api-docs/query.mdx
+++ b/website/content/api-docs/query.mdx
@@ -266,12 +266,12 @@ The table below shows this endpoint's support for
   key/value pairs that will be used for filtering the query results to services
   with the given metadata values present.
 
-* `Connect` `(bool: false)` - If true, only [Connect-capable](/consul/docs/connect) services
+* `Connect` `(bool: false)` - If true, only [mesh-capable](/consul/docs/connect) services
   for the specified service name will be returned. This includes both
   natively integrated services and proxies. For proxies, the proxy name
   may not match `Service`, because the proxy destination will. Any
-  constrains beyond the service name such as `Near`, `Tags`, and `NodeMeta`
-  are applied to Connect-capable service.
+  constraints beyond the service name such as `Near`, `Tags`, and `NodeMeta`
+  are applied to mesh-capable service.
 
 * `DNS` `(DNS: nil)` - Specifies DNS configuration
 
@@ -550,8 +550,8 @@ be used.
   This is applied after any sorting or shuffling.
 
 - `connect` `(bool: false)` - If true, limit results to nodes that are
-  Connect-capable only. This parameter can also be specified directly on the template
-  itself to force all executions of a query to be Connect-only. See the
+  mesh-capable only. This parameter can also be specified directly on the template
+  itself to force all executions of a query to be mesh-only. See the
   template documentation for more information.
 
 ### Sample Request
diff --git a/website/content/commands/config/write.mdx b/website/content/commands/config/write.mdx
index 24e17aa34ae4..bb98d8e49888 100644
--- a/website/content/commands/config/write.mdx
+++ b/website/content/commands/config/write.mdx
@@ -79,8 +79,9 @@ supported config entries.
 
 #### Service defaults
 
-Service defaults control default global values for a service, such as the
-protocol and Connect fields.
+Service defaults control default global values for a service in the service mesh.
+For example, the following configuration defines that all instances of the `web`
+service use the `http` protocol.
 
 ```json
 {
@@ -90,33 +91,23 @@ protocol and Connect fields.
 }
 ```
 
-- `Name` - Sets the name of the config entry. For service defaults, this must be
-  the name of the service being configured.
-
-- `Protocol` - Sets the protocol of the service. This is used by Connect proxies
-  for things like observability features.
-
-- `Connect` - This block contains Connect-related fields for the service.
-
-  - `SidecarProxy` - Sets whether or not instances of this service should get a
-    sidecar proxy by default.
+For more information, refer to the [service defaults configuration reference](/consul/docs/connect/config-entries/service-defaults).
 
 #### Proxy defaults
 
-Proxy defaults allow for configuring global config defaults across all services
-for Connect proxy config. Currently, only one global entry is supported.
+Proxy defaults lets you configure global config defaults across all proxies
+in the service mesh. Currently, it supports only one global entry.
+For example, the following configuration overrides a default timeout for all
+Envoy proxies.
 
 ```json
 {
   "Kind": "proxy-defaults",
   "Name": "global",
   "Config": {
-    "foo": 1
+    "local_idle_timeout_ms": 20000
   }
 }
 ```
 
-- `Name` - Sets the name of the config entry. Currently, only a single `proxy-defaults`
-  entry with the name `global` is supported.
-
-* `Config` - An arbitrary map of configuration values used by Connect proxies.
+For more information, refer to the [proxy defaults configuration reference](/consul/docs/connect/config-entries/proxy-defaults).
diff --git a/website/content/commands/connect/ca.mdx b/website/content/commands/connect/ca.mdx
index 17a76a622214..350d18e6d318 100644
--- a/website/content/commands/connect/ca.mdx
+++ b/website/content/commands/connect/ca.mdx
@@ -10,14 +10,15 @@ description: >
 
 Command: `consul connect ca`
 
-The CA connect command is used to interact with Consul Connect's Certificate Authority
-subsystem. The command can be used to view or modify the current CA configuration. See the
-[Connect CA documentation](/consul/docs/connect/ca) for more information.
+This command is used to interact with Consul service mesh's Certificate Authority
+managed by the connect subsystem.
+It can be used to view or modify the current CA configuration. Refer to the
+[service mesh CA documentation](/consul/docs/connect/ca) for more information.
 
 ```text
 Usage: consul connect ca <subcommand> [options] [args]
 
-  This command has subcommands for interacting with Consul Connect's
+  This command has subcommands for interacting with Consul service mesh's
   Certificate Authority (CA).
 
   Here are some simple examples, and more detailed examples are available
@@ -34,8 +35,8 @@ Usage: consul connect ca <subcommand> [options] [args]
   For more examples, ask for subcommand help or view the documentation.
 
 Subcommands:
-    get-config    Display the current Connect Certificate Authority (CA) configuration
-    set-config    Modify the current Connect CA configuration
+    get-config    Display the current service mesh Certificate Authority (CA) configuration
+    set-config    Modify the current service mesh CA configuration
 ```
 
 ## get-config
diff --git a/website/content/commands/connect/envoy.mdx b/website/content/commands/connect/envoy.mdx
index c9e0ffb2e932..8d60e6996516 100644
--- a/website/content/commands/connect/envoy.mdx
+++ b/website/content/commands/connect/envoy.mdx
@@ -11,7 +11,7 @@ Command: `consul connect envoy`
 
 The connect Envoy command is used to generate a bootstrap configuration for
 [Envoy proxy](https://envoyproxy.io) for use with [Consul
-Connect](/consul/docs/connect/).
+service mesh](/consul/docs/connect/).
 
 Refer to the [examples](#examples) for guidance on common use cases,
 such as [launching a service instance's sidecar proxy
diff --git a/website/content/commands/connect/expose.mdx b/website/content/commands/connect/expose.mdx
index 97ca3910fc06..79be1e0e60ae 100644
--- a/website/content/commands/connect/expose.mdx
+++ b/website/content/commands/connect/expose.mdx
@@ -2,7 +2,7 @@
 layout: commands
 page_title: 'Commands: Connect Expose'
 description: >
-  The connect expose subcommand is used to expose a Connect-enabled service
+  The connect expose subcommand is used to expose a mesh-enabled service
   through an Ingress gateway by modifying the gateway's configuration and adding
   an intention to allow traffic from the gateway to the service.
 ---
@@ -11,7 +11,7 @@ description: >
 
 Command: `consul connect expose`
 
-The connect expose subcommand is used to expose a Connect-enabled service
+The connect expose subcommand is used to expose a mesh-enabled service
 through an Ingress gateway by modifying the gateway's configuration and adding
 an intention to allow traffic from the gateway to the service. See the
 [Ingress gateway documentation](/consul/docs/connect/gateways/ingress-gateway) for more information
@@ -20,7 +20,7 @@ about Ingress gateways.
 ```text
 Usage: consul connect expose [options]
 
-  Exposes a Connect-enabled service through the given ingress gateway, using the
+  Exposes a mesh-enabled service through the given ingress gateway, using the
   given protocol and port.
 ```
 
diff --git a/website/content/commands/connect/index.mdx b/website/content/commands/connect/index.mdx
index b390f1899354..8ebf11a7beaf 100644
--- a/website/content/commands/connect/index.mdx
+++ b/website/content/commands/connect/index.mdx
@@ -9,10 +9,10 @@ description: >-
 
 Command: `consul connect`
 
-The `connect` command is used to interact with Consul
-[service mesh](/consul/docs/connect) subsystems. It exposes commands for
-running the built-in mTLS proxy and viewing/updating the Certificate Authority
-(CA) configuration. This command is available in Consul 1.2 and later.
+The `connect` command is used to interact with the connect subsystem
+that provides Consul's [service mesh](/consul/docs/connect) capabilities.
+It exposes commands for running service mesh proxies and
+for viewing/updating the service mesh Certificate Authority (CA) configuration.
 
 ## Usage
 
@@ -24,22 +24,22 @@ the complete list of subcommands.
 ```text
 Usage: consul connect <subcommand> [options] [args]
 
-  This command has subcommands for interacting with Consul Connect.
+  This command has subcommands for interacting with Consul service mesh.
 
   Here are some simple examples, and more detailed examples are available
   in the subcommands or the documentation.
 
-  Run the built-in Connect mTLS proxy
+  Run the production service mesh proxy
 
-      $ consul connect proxy
+      $ consul connect envoy
 
   For more examples, ask for subcommand help or view the documentation.
 
 Subcommands:
-    ca                  Interact with the Consul Connect Certificate Authority (CA)
-    envoy               Runs or Configures Envoy as a Connect proxy
-    expose              Expose a Connect-enabled service through an Ingress gateway
-    proxy               Runs a Consul Connect proxy
+    ca                  Interact with the Consul service mesh Certificate Authority (CA)
+    envoy               Runs or configures Envoy as a service mesh proxy
+    expose              Expose a mesh-enabled service through an Ingress gateway
+    proxy               Runs a non-production, built-in service mesh sidecar proxy
     redirect-traffic    Applies iptables rules for traffic redirection
 ```
 
diff --git a/website/content/commands/connect/proxy.mdx b/website/content/commands/connect/proxy.mdx
index 2bdfb2a9a2b3..db3192dbee4f 100644
--- a/website/content/commands/connect/proxy.mdx
+++ b/website/content/commands/connect/proxy.mdx
@@ -3,7 +3,7 @@ layout: commands
 page_title: 'Commands: Connect Proxy'
 description: >
   The connect proxy subcommand is used to run the built-in mTLS proxy for
-  Connect.
+  Consul service mesh.
 ---
 
 # Consul Connect Proxy
@@ -11,9 +11,9 @@ description: >
 Command: `consul connect proxy`
 
 The connect proxy command is used to run Consul's built-in mTLS proxy for
-use with Connect. This can be used in production to enable a Connect-unaware
-application to accept and establish Connect-based connections. This proxy
-can also be used in development to connect to Connect-enabled services.
+use with Consul service mesh. This can be used in production to enable a mesh-unaware
+application to accept and establish mesh-based connections. This proxy
+can also be used in development to connect to mesh-enabled services.
 
 ## Usage
 
@@ -49,7 +49,7 @@ Usage: `consul connect proxy [options]`
 - `-upstream` - Upstream service to support connecting to. The format should be
   'name:addr', such as 'db:8181'. This will make 'db' available on port 8181.
   When a regular TCP connection is made to port 8181, the proxy will service
-  discover "db" and establish a Connect mTLS connection identifying as
+  discover "db" and establish a Consul service mesh mTLS connection identifying as
   the `-service` value. This flag can be repeated multiple times.
 
 - `-listen` - Address to listen for inbound connections to the proxied service.
@@ -60,7 +60,7 @@ Usage: `consul connect proxy [options]`
   `-listen`.
 
 - `-register` - Self-register with the local Consul agent, making this
-  proxy available as Connect-capable service in the catalog. This is only
+  proxy available as mesh-capable service in the catalog. This is only
   useful with `-listen`.
 
 - `-register-id` - Optional ID suffix for the service when `-register` is set to
diff --git a/website/content/commands/connect/redirect-traffic.mdx b/website/content/commands/connect/redirect-traffic.mdx
index ded81c4a9424..44decfef4071 100644
--- a/website/content/commands/connect/redirect-traffic.mdx
+++ b/website/content/commands/connect/redirect-traffic.mdx
@@ -13,7 +13,7 @@ Command: `consul connect redirect-traffic`
 
 The connect redirect-traffic command is used to apply traffic redirection rules to enforce
 all traffic to go through the [Envoy proxy](https://envoyproxy.io) when using [Consul
-Service Mesh](/consul/docs/connect/) in the Transparent Proxy mode.
+service mesh](/consul/docs/connect/) in the Transparent Proxy mode.
 
 This command requires `iptables` command line utility to be installed,
 and as a result, this command can currently only run on linux.
diff --git a/website/content/commands/index.mdx b/website/content/commands/index.mdx
index 415fc551d331..a3e500811034 100644
--- a/website/content/commands/index.mdx
+++ b/website/content/commands/index.mdx
@@ -31,13 +31,13 @@ Available commands are:
     acl            Interact with Consul's ACLs
     agent          Runs a Consul agent
     catalog        Interact with the catalog
-    connect        Interact with Consul Connect
+    connect        Interact with service mesh functionality
     debug          Records a debugging archive for operators
     event          Fire a new event
     exec           Executes a command on Consul nodes
     force-leave    Forces a member of the cluster to enter the "left" state
     info           Provides debugging information for operators.
-    intention      Interact with Connect service intentions
+    intention      Interact with service mesh intentions
     join           Tell Consul agent to join cluster
     keygen         Generates a new encryption key
     keyring        Manages gossip layer encryption keys
diff --git a/website/content/commands/intention/index.mdx b/website/content/commands/intention/index.mdx
index d3e4fc56c431..f7ea711a27fb 100644
--- a/website/content/commands/intention/index.mdx
+++ b/website/content/commands/intention/index.mdx
@@ -9,7 +9,7 @@ description: >-
 
 Command: `consul intention`
 
-The `intention` command is used to interact with Connect
+The `intention` command is used to interact with service mesh
 [intentions](/consul/docs/connect/intentions). It exposes commands for
 creating, updating, reading, deleting, checking, and managing intentions.
 This command is available in Consul 1.2 and later.
diff --git a/website/content/commands/operator/usage.mdx b/website/content/commands/operator/usage.mdx
index b0d7d03db2f9..56d364862690 100644
--- a/website/content/commands/operator/usage.mdx
+++ b/website/content/commands/operator/usage.mdx
@@ -97,4 +97,4 @@ Total                                    3
 
 - `-billable` - Display only billable service information. Default is `false`.
 
-- `-connect` - Display only Connect service information. Default is `false`.
+- `-connect` - Display only Consul service mesh component information. Default is `false`.
diff --git a/website/content/docs/agent/config/cli-flags.mdx b/website/content/docs/agent/config/cli-flags.mdx
index 863b05f2c68b..82d44d02528b 100644
--- a/website/content/docs/agent/config/cli-flags.mdx
+++ b/website/content/docs/agent/config/cli-flags.mdx
@@ -82,7 +82,7 @@ information.
 - `-dev` ((#\_dev)) - Enable development server mode. This is useful for
   quickly starting a Consul agent with all persistence options turned off, enabling
   an in-memory server which can be used for rapid prototyping or developing against
-  the API. In this mode, [Connect is enabled](/consul/docs/connect/configuration) and
+  the API. In this mode, [service mesh is enabled](/consul/docs/connect/configuration) and
   will by default create a new root CA certificate on startup. This mode is **not**
   intended for production use as it does not write any data to disk. The gRPC port
   is also defaulted to `8502` in this mode.
diff --git a/website/content/docs/agent/config/config-files.mdx b/website/content/docs/agent/config/config-files.mdx
index 4ba7ba54313e..e13cd6b4e369 100644
--- a/website/content/docs/agent/config/config-files.mdx
+++ b/website/content/docs/agent/config/config-files.mdx
@@ -245,8 +245,8 @@ Refer to the [formatting specification](https://golang.org/pkg/time/#ParseDurati
     The initial RPC uses a JWT specified with either `intro_token`,
     `intro_token_file` or the `CONSUL_INTRO_TOKEN` environment variable to authorize
     the request. How the JWT token is verified is controlled by the `auto_config.authorizer`
-    object available for use on Consul servers. Enabling this option also turns
-    on Connect because it is vital for `auto_config`, more specifically the CA
+    object available for use on Consul servers. Enabling this option also enables
+    service mesh because it is vital for `auto_config`, more specifically the service mesh CA
     and certificates infrastructure.
 
     ~> **Warning:** Enabling `auto_config` conflicts with the [`auto_encrypt.tls`](#tls) feature.
@@ -651,7 +651,7 @@ Refer to the [formatting specification](https://golang.org/pkg/time/#ParseDurati
 
 - `primary_datacenter` - This designates the datacenter
   which is authoritative for ACL information, intentions and is the root Certificate
-  Authority for Connect. It must be provided to enable ACLs. All servers and datacenters
+  Authority for service mesh. It must be provided to enable ACLs. All servers and datacenters
   must agree on the primary datacenter. Setting it on the servers is all you need
   for cluster-level enforcement, but for the APIs to forward properly from the clients,
   it must be set on them too. In Consul 0.8 and later, this also enables agent-level
@@ -946,7 +946,7 @@ Refer to the [formatting specification](https://golang.org/pkg/time/#ParseDurati
 
     - `replication` ((#acl_tokens_replication)) - The ACL token used to
       authorize secondary datacenters with the primary datacenter for replication
-      operations. This token is required for servers outside the [`primary_datacenter`](#primary_datacenter) when ACLs are enabled. This token may be provided later using the [agent token API](/consul/api-docs/agent#update-acl-tokens) on each server. This token must have at least "read" permissions on ACL data but if ACL token replication is enabled then it must have "write" permissions. This also enables Connect replication, for which the token will require both operator "write" and intention "read" permissions for replicating CA and Intention data.
+      operations. This token is required for servers outside the [`primary_datacenter`](#primary_datacenter) when ACLs are enabled. This token may be provided later using the [agent token API](/consul/api-docs/agent#update-acl-tokens) on each server. This token must have at least "read" permissions on ACL data but if ACL token replication is enabled then it must have "write" permissions. This also enables service mesh data replication, for which the token will require both operator "write" and intention "read" permissions for replicating CA and Intention data.
 
       ~> **Warning:** When enabling ACL token replication on the secondary datacenter,
       policies and roles already present in the secondary datacenter will be lost. For
@@ -1088,7 +1088,10 @@ Refer to the [formatting specification](https://golang.org/pkg/time/#ParseDurati
 
 - `bootstrap_expect` Equivalent to the [`-bootstrap-expect` command-line flag](/consul/docs/agent/config/cli-flags#_bootstrap_expect).
 
-## Connect Parameters
+## Service Mesh Parameters ((#connect-parameters))
+
+The noun _connect_ is used throughout this documentation to refer to the connect
+subsystem that provides Consul's service mesh capabilities.
 
 - `connect` This object allows setting options for the Connect feature.
 
@@ -1096,14 +1099,14 @@ Refer to the [formatting specification](https://golang.org/pkg/time/#ParseDurati
 
   - `enabled` ((#connect_enabled)) (Defaults to `true`) Controls whether Connect features are
     enabled on this agent. Should be enabled on all servers in the cluster
-    in order for Connect to function properly.
+    in order for service mesh to function properly.
     Will be set to `true` automatically if `auto_config.enabled` or `auto_encrypt.allow_tls` is `true`.
 
   - `enable_mesh_gateway_wan_federation` ((#connect_enable_mesh_gateway_wan_federation)) (Defaults to `false`) Controls whether cross-datacenter federation traffic between servers is funneled
     through mesh gateways. This was added in Consul 1.8.0.
 
   - `ca_provider` ((#connect_ca_provider)) Controls which CA provider to
-    use for Connect's CA. Currently only the `aws-pca`, `consul`, and `vault` providers are supported.
+    use for the service mesh's CA. Currently only the `aws-pca`, `consul`, and `vault` providers are supported.
     This is only used when initially bootstrapping the cluster. For an existing cluster,
     use the [Update CA Configuration Endpoint](/consul/api-docs/connect/ca#update-ca-configuration).
 
@@ -1140,13 +1143,13 @@ Refer to the [formatting specification](https://golang.org/pkg/time/#ParseDurati
 
     - `root_pki_path` ((#vault_ca_root_pki)) The path to use for the root
       CA pki backend in Vault. This can be an existing backend with a CA already
-      configured, or a blank/unmounted backend in which case Connect will automatically
+      configured, or a blank/unmounted backend in which case Consul will automatically
       mount/generate the CA. The Vault token given above must have `sudo` access
       to this backend, as well as permission to mount the backend at this path if
       it is not already mounted.
 
     - `intermediate_pki_path` ((#vault_ca_intermediate_pki))
-      The path to use for the temporary intermediate CA pki backend in Vault. **Connect
+      The path to use for the temporary intermediate CA pki backend in Vault. **Consul
       will overwrite any data at this path in order to generate a temporary intermediate
       CA**. The Vault token given above must have `write` access to this backend,
       as well as permission to mount the backend at this path if it is not already
@@ -1391,14 +1394,14 @@ Refer to the [formatting specification](https://golang.org/pkg/time/#ParseDurati
 
   - `allow_tls` (Defaults to `false`) This option enables
     `auto_encrypt` on the servers and allows them to automatically distribute certificates
-    from the Connect CA to the clients. If enabled, the server can accept incoming
-    connections from both the built-in CA and the Connect CA, as well as their certificates.
+    from the service mesh CA to the clients. If enabled, the server can accept incoming
+    connections from both the built-in CA and the service mesh CA, as well as their certificates.
     Note, the server will only present the built-in CA and certificate, which the
     client can verify using the CA it received from `auto_encrypt` endpoint. If disabled,
     a client configured with `auto_encrypt.tls` will be unable to start.
 
   - `tls` (Defaults to `false`) Allows the client to request the
-    Connect CA and certificates from the servers, for encrypting RPC communication.
+    service mesh CA and certificates from the servers, for encrypting RPC communication.
     The client will make the request to any servers listed in the `-retry-join`
     option. This requires that every server to have `auto_encrypt.allow_tls` enabled.
     When both `auto_encrypt` options are used, it allows clients to receive certificates
@@ -2186,7 +2189,7 @@ specially crafted certificate signed by the CA can be used to gain full access t
 
       ~> **Security Note:** `verify_server_hostname` *must* be set to true to prevent a
       compromised client from gaining full read and write access to all cluster
-      data *including all ACL tokens and Connect CA root keys*.
+      data *including all ACL tokens and service mesh CA root keys*.
 
 - `server_name` When provided, this overrides the [`node_name`](#_node)
   for the TLS certificate. It can be used to ensure that the certificate name matches
diff --git a/website/content/docs/agent/index.mdx b/website/content/docs/agent/index.mdx
index 7d06a6b5994e..ec68e0a1ce1f 100644
--- a/website/content/docs/agent/index.mdx
+++ b/website/content/docs/agent/index.mdx
@@ -201,7 +201,7 @@ The following settings are commonly used in the configuration file (also called
 ### Server node in a service mesh
 
 The following example configuration is for a server agent named "`consul-server`". The server is [bootstrapped](/consul/docs/agent/config/cli-flags#_bootstrap) and the Consul GUI is enabled.
-The reason this server agent is configured for a service mesh is that the `connect` configuration is enabled. Connect is Consul's service mesh component that provides service-to-service connection authorization and encryption using mutual Transport Layer Security (TLS). Applications can use sidecar proxies in a service mesh configuration to establish TLS connections for inbound and outbound connections without being aware of Connect at all. See [Connect](/consul/docs/connect) for details.
+The reason this server agent is configured for a service mesh is that the `connect` configuration is enabled. The connect subsystem provides Consul's service mesh capabilities, including service-to-service connection authorization and encryption using mutual Transport Layer Security (TLS). Applications can use sidecar proxies in a service mesh configuration to establish TLS connections for inbound and outbound connections without being aware of Consul service mesh at all. Refer to [Consul Service Mesh](/consul/docs/connect) for details.
 
 <CodeTabs>
 
diff --git a/website/content/docs/agent/telemetry.mdx b/website/content/docs/agent/telemetry.mdx
index 7e5e208a66ee..27626d9be8d5 100644
--- a/website/content/docs/agent/telemetry.mdx
+++ b/website/content/docs/agent/telemetry.mdx
@@ -413,7 +413,7 @@ This is a full list of metrics emitted by Consul.
 | `consul.state.services`                                | Measures the current number of unique services registered with Consul, based on service name. It is only emitted by Consul servers. Added in v1.9.0.                                                                                                                                                                                                                                                                       | number of objects    | gauge   |
 | `consul.state.service_instances`                       | Measures the current number of unique service instances registered with Consul. It is only emitted by Consul servers. Added in v1.9.0.                                                                                                                                                                                                                                                                                     | number of objects    | gauge   |
 | `consul.state.kv_entries`                              | Measures the current number of entries in the Consul KV store. It is only emitted by Consul servers. Added in v1.10.3.                                                                                                                                                                                                                                                                                                     | number of objects    | gauge   |
-| `consul.state.connect_instances`                       | Measures the current number of unique connect service instances registered with Consul labeled by Kind (e.g. connect-proxy, connect-native, etc). Added in v1.10.4                                                                                                                                                                                                                                                         | number of objects    | gauge   |
+| `consul.state.connect_instances`                       | Measures the current number of unique mesh service instances registered with Consul labeled by Kind (e.g. connect-proxy, connect-native, etc). Added in v1.10.4                                                                                                                                                                                                                                                         | number of objects    | gauge   |
 | `consul.state.config_entries`                          | Measures the current number of configuration entries registered with Consul labeled by Kind (e.g. service-defaults, proxy-defaults, etc). See [Configuration Entries](/consul/docs/connect/config-entries) for more information. Added in v1.10.4                                                                                                                                                                                 | number of objects    | gauge   |
 | `consul.members.clients`                               | Measures the current number of client agents registered with Consul. It is only emitted by Consul servers. Added in v1.9.6.                                                                                                                                                                                                                                                                                                | number of clients    | gauge   |
 | `consul.members.servers`                               | Measures the current number of server agents registered with Consul. It is only emitted by Consul servers. Added in v1.9.6.                                                                                                                                                                                                                                                                                                | number of servers    | gauge   |
@@ -687,14 +687,14 @@ are allowed for <EnterpriseAlert inline />.
 | `consul.catalog.service.query-tag`     | Increments for each catalog query for the given service with the given tag.                                                                                                                                                                                                                                                                                                                                                        | queries                                 | counter |
 | `consul.catalog.service.query-tags`    | Increments for each catalog query for the given service with the given tags.                                                                                                                                                                                                                                                                                                                                                       | queries                                 | counter |
 | `consul.catalog.service.not-found`     | Increments for each catalog query where the given service could not be found.                                                                                                                                                                                                                                                                                                                                                      | queries                                 | counter |
-| `consul.catalog.connect.query`         | Increments for each connect-based catalog query for the given service.                                                                                                                                                                                                                                                                                                                                                             | queries                                 | counter |
-| `consul.catalog.connect.query-tag`     | Increments for each connect-based catalog query for the given service with the given tag.                                                                                                                                                                                                                                                                                                                                          | queries                                 | counter |
-| `consul.catalog.connect.query-tags`    | Increments for each connect-based catalog query for the given service with the given tags.                                                                                                                                                                                                                                                                                                                                         | queries                                 | counter |
-| `consul.catalog.connect.not-found`     | Increments for each connect-based catalog query where the given service could not be found.                                                                                                                                                                                                                                                                                                                                        | queries                                 | counter |
+| `consul.catalog.connect.query`         | Increments for each mesh-based catalog query for the given service.                                                                                                                                                                                                                                                                                                                                                             | queries                                 | counter |
+| `consul.catalog.connect.query-tag`     | Increments for each mesh-based catalog query for the given service with the given tag.                                                                                                                                                                                                                                                                                                                                          | queries                                 | counter |
+| `consul.catalog.connect.query-tags`    | Increments for each mesh-based catalog query for the given service with the given tags.                                                                                                                                                                                                                                                                                                                                         | queries                                 | counter |
+| `consul.catalog.connect.not-found`     | Increments for each mesh-based catalog query where the given service could not be found.                                                                                                                                                                                                                                                                                                                                        | queries                                 | counter |
 
-## Connect Built-in Proxy Metrics
+## Service Mesh Built-in Proxy Metrics
 
-Consul Connect's built-in proxy is by default configured to log metrics to the
+Consul service mesh's built-in proxy is by default configured to log metrics to the
 same sink as the agent that starts it.
 
 When running in this mode it emits some basic metrics. These will be expanded
diff --git a/website/content/docs/architecture/scale.mdx b/website/content/docs/architecture/scale.mdx
index da2031fd95ba..1cf31162da86 100644
--- a/website/content/docs/architecture/scale.mdx
+++ b/website/content/docs/architecture/scale.mdx
@@ -257,7 +257,7 @@ Consul ESM enables health checks and monitoring for external services. When usin
 Because Consul’s service mesh uses service discovery subsystems, service mesh performance is also optimized by deploying multiple small clusters with consistent numbers of service instances and watches. Service mesh performance is influenced by the following additional factors:
 
 - The [transparent proxy](/consul/docs/connect/transparent-proxy) feature causes client agents to listen for service instance updates across all services instead of a subset. To prevent performance issues, we recommend that you do not use the permissive intention, `default: allow`, with the transparent proxy feature. When combined, every service instance update propagates to every proxy, which causes additional server load.
-- When you use the [built in CA provider](/consul/docs/connect/ca/consul#built-in-ca), Consul leaders are responsible for signing certificates used for mTLS across the service mesh. The impact on CPU utilization depends on the total number of service instances and configured certificate TTLs. You can use the [CA provider configuration options](/consul/docs/agent/config/config-files#common-ca-config-options) to control the number of requests a server processes. We recommend adjusting [`csr_max_concurrent`](/consul/docs/agent/config/config-files#ca_csr_max_concurrent) and [`csr_max_per_second`](/consul/docs/agent/config/config-files#ca_csr_max_concurrent) to suit your environment.
+- When you use the [built-in service mesh CA provider](/consul/docs/connect/ca/consul#built-in-ca), Consul leaders are responsible for signing certificates used for mTLS across the service mesh. The impact on CPU utilization depends on the total number of service instances and configured certificate TTLs. You can use the [CA provider configuration options](/consul/docs/agent/config/config-files#common-ca-config-options) to control the number of requests a server processes. We recommend adjusting [`csr_max_concurrent`](/consul/docs/agent/config/config-files#ca_csr_max_concurrent) and [`csr_max_per_second`](/consul/docs/agent/config/config-files#ca_csr_max_concurrent) to suit your environment.
 
 ### K/V store
 
diff --git a/website/content/docs/connect/ca/aws.mdx b/website/content/docs/connect/ca/aws.mdx
index e10a8f5cfac0..cac5cb46e650 100644
--- a/website/content/docs/connect/ca/aws.mdx
+++ b/website/content/docs/connect/ca/aws.mdx
@@ -49,7 +49,7 @@ optional configuration value.
 
 Example configurations are shown below:
 
-<CodeTabs heading="Connect CA configuration" tabs={["Agent configuration", "API"]}>
+<CodeTabs heading="Service mesh CA configuration" tabs={["Agent configuration", "API"]}>
 
 <CodeBlockConfig filename="/etc/consul.d/config.hcl" highlight="4,6">
 
@@ -116,7 +116,7 @@ ACM Private CA has several
 that restrict how fast certificates can be issued. This may impact how quickly
 large clusters can rotate all issued certificates.
 
-Currently, the ACM Private CA provider for Connect has some additional
+Currently, the ACM Private CA provider for service mesh has some additional
 limitations described below.
 
 ### Unable to Cross-sign Other CAs
@@ -150,7 +150,7 @@ CA](https://aws.amazon.com/certificate-manager/pricing/) for actual cost
 information.
 
 Assume the following Consul datacenters exist and are configured to use ACM
-Private CA as their Connect CA with the default leaf certificate lifetime of
+Private CA as their service mesh CA with the default leaf certificate lifetime of
 72 hours:
 
 | Datacenter | Primary | CA Resource Created | Number of service instances |
diff --git a/website/content/docs/connect/ca/consul.mdx b/website/content/docs/connect/ca/consul.mdx
index 23d7f2ab4d49..8d36c001211f 100644
--- a/website/content/docs/connect/ca/consul.mdx
+++ b/website/content/docs/connect/ca/consul.mdx
@@ -7,12 +7,12 @@ description: >-
 
 # Built-In Certificate Authority for Service Mesh
 
-Consul ships with a built-in CA system so that Connect can be
+Consul ships with a built-in CA system so that service mesh can be
 easily enabled out of the box. The built-in CA generates and stores the
 root certificate and private key on Consul servers. It can also be
 configured with a custom certificate and private key if needed.
 
-If Connect is enabled and no CA provider is specified, the built-in
+If service mesh is enabled and no CA provider is specified, the built-in
 CA is the default provider used. The provider can be
 [updated and rotated](/consul/docs/connect/ca#root-certificate-rotation)
 at any point to migrate to a new provider.
@@ -24,7 +24,7 @@ CA providers.
 
 ## Configuration
 
-The built-in CA provider has no required configuration. Enabling Connect
+The built-in CA provider has no required configuration. Enabling service mesh
 alone will configure the built-in CA provider, and will automatically generate
 a root certificate and private key:
 
@@ -84,8 +84,8 @@ $ curl localhost:8500/v1/connect/ca/configuration
 }
 ```
 
-This is the default Connect CA configuration if nothing is explicitly set when
-Connect is enabled - the PrivateKey and RootCert fields have not been set, so those have
+This is the default service mesh CA configuration if nothing is explicitly set when
+service mesh is enabled - the PrivateKey and RootCert fields have not been set, so those have
 been generated (as seen above in the roots list).
 
 There are two ways to have the Consul CA use a custom private key and root certificate:
diff --git a/website/content/docs/connect/ca/index.mdx b/website/content/docs/connect/ca/index.mdx
index 03502a7395a4..13cc56c72d35 100644
--- a/website/content/docs/connect/ca/index.mdx
+++ b/website/content/docs/connect/ca/index.mdx
@@ -7,8 +7,8 @@ description: >-
 
 # Service Mesh Certificate Authority Overview
 
-Certificate management in Connect is done centrally through the Consul
-servers using the configured CA (Certificate Authority) provider. A CA provider
+Service mesh certificate management is done centrally through the Consul
+servers using the configured service mesh CA (Certificate Authority) provider. A CA provider
 manages root and intermediate certificates and performs certificate signing
 operations. The Consul leader orchestrates CA provider operations as necessary,
 such as when a service needs a new certificate or during CA rotation events.
@@ -42,7 +42,7 @@ datacenter.
 
 CA initialization happens automatically when a new Consul leader is elected
 as long as
-[Connect is enabled](/consul/docs/connect/configuration#agent-configuration),
+[service mesh is enabled](/consul/docs/connect/configuration#agent-configuration),
 and the CA system has not already been initialized. This initialization process
 will generate the initial root certificates and setup the internal Consul server
 state.
@@ -55,7 +55,7 @@ If a CA is already initialized, any changes to the CA configuration in the
 agent configuration file (including removing the configuration completely)
 will have no effect.
 
-If no specific provider is configured when Connect is enabled, the built-in
+If no specific provider is configured when service mesh is enabled, the built-in
 Consul CA provider will be used and a private key and root certificate will
 be generated automatically.
 
@@ -133,7 +133,7 @@ Cross-Signing](#forced-rotation-without-cross-signing).
 This also automatically occurs when a completely different CA provider is
 configured (since this changes the root key). Therefore, this automatic rotation
 process can also be used to cleanly transition between CA providers. For example,
-updating Connect to use Vault instead of the built-in CA.
+updating the service mesh to use Vault instead of the built-in CA.
 
 During rotation, an intermediate CA certificate is requested from the new root,
 which is then cross-signed by the old root. This cross-signed certificate is
diff --git a/website/content/docs/connect/ca/vault.mdx b/website/content/docs/connect/ca/vault.mdx
index 708e3e8dd2e0..ce35744e9242 100644
--- a/website/content/docs/connect/ca/vault.mdx
+++ b/website/content/docs/connect/ca/vault.mdx
@@ -19,7 +19,7 @@ This page describes how configure the Vault CA provider.
 
 - Vault 0.10.3 to 1.10.x.
 
-~> **Compatibility note:** If you use Vault 1.11.0+ as Consul's Connect CA, versions of Consul released before Dec 13, 2022 will develop an issue with Consul control plane or service mesh communication ([GH-15525](https://github.com/hashicorp/consul/pull/15525)). Use or upgrade to a [Consul version that includes the fix](https://support.hashicorp.com/hc/en-us/articles/11308460105491#01GMC24E6PPGXMRX8DMT4HZYTW) to avoid this problem.
+~> **Compatibility note:** If you use Vault 1.11.0+ as Consul's service mesh CA, versions of Consul released before Dec 13, 2022 will develop an issue with Consul control plane or service mesh communication ([GH-15525](https://github.com/hashicorp/consul/pull/15525)). Use or upgrade to a [Consul version that includes the fix](https://support.hashicorp.com/hc/en-us/articles/11308460105491#01GMC24E6PPGXMRX8DMT4HZYTW) to avoid this problem.
 
 ## Enable Vault as the CA
 
@@ -32,7 +32,7 @@ Refer to the [Configuration Reference](#configuration-reference) for details abo
 
 The following example shows the required configurations for a default implementation:
 
-<CodeTabs heading="Connect CA configuration" tabs={["Agent configuration", "API"]}>
+<CodeTabs heading="Service mesh CA configuration" tabs={["Agent configuration", "API"]}>
 
 <CodeBlockConfig filename="/etc/consul.d/config.hcl" highlight="4,6-9">
 
diff --git a/website/content/docs/connect/config-entries/index.mdx b/website/content/docs/connect/config-entries/index.mdx
index 6d29a27cc387..de5acd1bce96 100644
--- a/website/content/docs/connect/config-entries/index.mdx
+++ b/website/content/docs/connect/config-entries/index.mdx
@@ -7,7 +7,7 @@ description: >-
 
 # Configuration Entry Overview
 
-Configuration entries can be used to configure the behavior of Consul Connect.
+Configuration entries can be used to configure the behavior of Consul service mesh.
 
 The following configuration entries are supported:
 
diff --git a/website/content/docs/connect/config-entries/mesh.mdx b/website/content/docs/connect/config-entries/mesh.mdx
index 7900a8104a9b..f65ed6162287 100644
--- a/website/content/docs/connect/config-entries/mesh.mdx
+++ b/website/content/docs/connect/config-entries/mesh.mdx
@@ -333,7 +333,7 @@ Note that the Kubernetes example does not include a `partition` field. Configura
           type: 'bool: false',
           description: `Determines whether sidecar proxies operating in transparent mode can
                         proxy traffic to IP addresses not registered in Consul's mesh. If enabled, traffic will only be proxied
-                        to upstream proxies or Connect-native services. If disabled, requests will be proxied as-is to the
+                        to upstream proxies or mesh-native services. If disabled, requests will be proxied as-is to the
                         original destination IP address. Consul will not encrypt the connection.`,
         },
       ],
diff --git a/website/content/docs/connect/config-entries/proxy-defaults.mdx b/website/content/docs/connect/config-entries/proxy-defaults.mdx
index bf75c130d2a3..917bc0504494 100644
--- a/website/content/docs/connect/config-entries/proxy-defaults.mdx
+++ b/website/content/docs/connect/config-entries/proxy-defaults.mdx
@@ -342,8 +342,8 @@ spec:
     {
       name: 'Config',
       type: 'map[string]arbitrary',
-      description: `An arbitrary map of configuration values used by Connect proxies.
-    The available configurations depend on the Connect proxy you use.
+      description: `An arbitrary map of configuration values used by service mesh proxies.
+    The available configurations depend on the mesh proxy you use.
      Any values that your proxy allows can be configured globally here. To explore these options please see the documentation for your chosen proxy.
      <ul><li>[Envoy](/consul/docs/connect/proxies/envoy#proxy-config-options)</li>
      <li>[Consul's built-in proxy](/consul/docs/connect/proxies/built-in#proxy-config-key-reference)</li></ul>`,
@@ -409,7 +409,7 @@ spec:
       name: 'MeshGateway',
       type: 'MeshGatewayConfig: <optional>',
       description: `Controls the default
-      [mesh gateway configuration](/consul/docs/connect/gateways/mesh-gateway#connect-proxy-configuration)
+      [mesh gateway configuration](/consul/docs/connect/gateways/mesh-gateway#service-mesh-proxy-configuration)
       for all proxies. Added in v1.6.0.`,
       children: [
         {
@@ -426,7 +426,7 @@ spec:
                       [expose path configuration](/consul/docs/connect/registration/service-registration#expose-paths-configuration-reference)
                       for Envoy. Added in v1.6.2.<br><br>
                       Exposing paths through Envoy enables a service to protect itself by only listening on localhost, while still allowing
-                      non-Connect-enabled applications to contact an HTTP endpoint.
+                      non-mesh-enabled applications to contact an HTTP endpoint.
                       Some examples include: exposing a \`/metrics\` path for Prometheus or \`/healthz\` for kubelet liveness checks.`,
       children: [
         {
diff --git a/website/content/docs/connect/config-entries/service-defaults.mdx b/website/content/docs/connect/config-entries/service-defaults.mdx
index d15ac43735cb..000b63246c4e 100644
--- a/website/content/docs/connect/config-entries/service-defaults.mdx
+++ b/website/content/docs/connect/config-entries/service-defaults.mdx
@@ -570,7 +570,7 @@ We recommend configuring the upstream timeout in the [`connection_timeout`](/con
 
 ### `UpstreamConfig.Overrides[].MeshGateway`
 
-Map that contains the default mesh gateway `mode` field for the upstream. Refer to [Connect Proxy Configuration](/consul/docs/connect/gateways/mesh-gateway#connect-proxy-configuration) in the mesh gateway documentation for additional information. 
+Map that contains the default mesh gateway `mode` field for the upstream. Refer to [Service Mesh Proxy Configuration](/consul/docs/connect/gateways/mesh-gateway#service-mesh-proxy-configuration) in the mesh gateway documentation for additional information. 
 
 #### Values
 
@@ -651,7 +651,7 @@ For non-Kubernetes environments, we recommend configuring the upstream timeout i
 
 ### `UpstreamConfig.Defaults.MeshGateway`
 
-Specifies the default mesh gateway `mode` field for all upstreams. Refer to [Connect Proxy Configuration](/consul/docs/connect/gateways/mesh-gateway#connect-proxy-configuration) in the mesh gateway documentation for additional information. 
+Specifies the default mesh gateway `mode` field for all upstreams. Refer to [Service Mesh Proxy Configuration](/consul/docs/connect/gateways/mesh-gateway#service-mesh-proxy-configuration) in the mesh gateway documentation for additional information. 
 
 You can specify the following string values for the `mode` field:
 
@@ -743,7 +743,7 @@ Specifies the timeout for HTTP requests to the local application instance. Appli
 
 ### `MeshGateway`
 
-Specifies the default mesh gateway `mode` field for the service. Refer to [Connect Proxy Configuration](/consul/docs/connect/gateways/mesh-gateway#connect-proxy-configuration) in the mesh gateway documentation for additional information. 
+Specifies the default mesh gateway `mode` field for the service. Refer to [Service Mesh Proxy Configuration](/consul/docs/connect/gateways/mesh-gateway#service-mesh-proxy-configuration) in the mesh gateway documentation for additional information. 
 
 You can specify the following string values for the `mode` field:
 
@@ -1030,7 +1030,7 @@ We recommend configuring the upstream timeout in the [`connectTimeout`](/consul/
 
 ### `spec.upstreamConfig.defaults.meshGateway.mode`
 
-Specifies the default mesh gateway `mode` field for all upstreams. Refer to [Connect Proxy Configuration](/consul/docs/connect/gateways/mesh-gateway#connect-proxy-configuration) in the mesh gateway documentation for additional information. 
+Specifies the default mesh gateway `mode` field for all upstreams. Refer to [Service Mesh Proxy Configuration](/consul/docs/connect/gateways/mesh-gateway#service-mesh-proxy-configuration) in the mesh gateway documentation for additional information. 
 
 #### Values
 
@@ -1144,7 +1144,7 @@ Specifies the timeout for HTTP requests to the local application instance. Appli
 - Data type: string
 
 ### `spec.meshGateway.mode` 
-Specifies the default mesh gateway `mode` field for the service. Refer to [Connect Proxy Configuration](/consul/docs/connect/gateways/mesh-gateway#connect-proxy-configuration) in the mesh gateway documentation for additional information. 
+Specifies the default mesh gateway `mode` field for the service. Refer to [Service Mesh Proxy Configuration](/consul/docs/connect/gateways/mesh-gateway#service-mesh-proxy-configuration) in the mesh gateway documentation for additional information. 
 
 #### Values
 
@@ -1532,7 +1532,7 @@ represents a location outside the Consul cluster. Services can dial destinations
       name: 'Protocol',
       type: `string: "tcp"`,
       description: `Sets the protocol of the service. This is used
-                      by Connect proxies for things like observability features and to unlock usage
+                      by service mesh proxies for things like observability features and to unlock usage
                       of the [\`service-splitter\`](/consul/docs/connect/config-entries/service-splitter) and
                       [\`service-router\`](/consul/docs/connect/config-entries/service-router) config entries
                       for a service. It also unlocks the ability to define L7 intentions via
@@ -2012,7 +2012,7 @@ represents a location outside the Consul cluster. Services can dial destinations
       type: 'string: ""',
       description: `This is an optional setting that allows for
                       the TLS [SNI](https://en.wikipedia.org/wiki/Server_Name_Indication) value to
-                      be changed to a non-connect value when federating with an external system.
+                      be changed to a non-mesh value when federating with an external system.
                       Added in v1.6.0.`,
     },
     {
@@ -2022,7 +2022,7 @@ represents a location outside the Consul cluster. Services can dial destinations
                       [expose path configuration](/consul/docs/connect/registration/service-registration#expose-paths-configuration-reference)
                       for Envoy. Added in v1.6.2.<br><br>
                       Exposing paths through Envoy enables a service to protect itself by only listening on localhost, while still allowing
-                      non-Connect-enabled applications to contact an HTTP endpoint.
+                      non-mesh-enabled applications to contact an HTTP endpoint.
                       Some examples include: exposing a \`/metrics\` path for Prometheus or \`/healthz\` for kubelet liveness checks.`,
       children: [
         {
diff --git a/website/content/docs/connect/config-entries/service-resolver.mdx b/website/content/docs/connect/config-entries/service-resolver.mdx
index 1136c15cfef9..766467235f02 100644
--- a/website/content/docs/connect/config-entries/service-resolver.mdx
+++ b/website/content/docs/connect/config-entries/service-resolver.mdx
@@ -11,7 +11,7 @@ description: >-
 **v1.6.0+:** On other platforms, this config entry is supported in Consul versions 1.6.0+.
 
 The `service-resolver` config entry kind (`ServiceResolver` on Kubernetes) controls which service instances
-should satisfy Connect upstream discovery requests for a given service name.
+should satisfy service mesh upstream discovery requests for a given service name.
 
 If no resolver config is defined the chain assumes 100% of traffic goes to the
 healthy instances of the default service in the current datacenter+namespace
diff --git a/website/content/docs/connect/config-entries/service-router.mdx b/website/content/docs/connect/config-entries/service-router.mdx
index 1a12e3cdf9fa..64d0a11b53de 100644
--- a/website/content/docs/connect/config-entries/service-router.mdx
+++ b/website/content/docs/connect/config-entries/service-router.mdx
@@ -7,7 +7,7 @@ description: >-
 
 # Service Router Configuration Entry
 
-The `service-router` config entry kind (`ServiceRouter` on Kubernetes) controls Connect traffic routing and
+The `service-router` config entry kind (`ServiceRouter` on Kubernetes) controls service mesh traffic routing and
 manipulation at networking layer 7 (e.g. HTTP).
 
 If a router is not explicitly configured or is configured with no routes then
@@ -16,7 +16,7 @@ service of the same name.
 
 ## Requirements
 
-- Consul [service mesh connect](/consul/docs/connect/configuration) enabled services
+- Consul [service mesh](/consul/docs/connect/configuration) enabled services
 - Service to service communication over the protocol `http`
 
 ## Interaction with other Config Entries
diff --git a/website/content/docs/connect/config-entries/terminating-gateway.mdx b/website/content/docs/connect/config-entries/terminating-gateway.mdx
index b7e0f38b7c48..e0c1ff6032cf 100644
--- a/website/content/docs/connect/config-entries/terminating-gateway.mdx
+++ b/website/content/docs/connect/config-entries/terminating-gateway.mdx
@@ -12,7 +12,7 @@ description: >-
 
 The `terminating-gateway` config entry kind (`TerminatingGateway` on Kubernetes) allows you to configure terminating gateways
 to proxy traffic from services in the Consul service mesh to services registered with Consul that do not have a
-[Connect service sidecar proxy](/consul/docs/connect/proxies). The configuration is associated with the name of a gateway service
+[service mesh sidecar proxy](/consul/docs/connect/proxies). The configuration is associated with the name of a gateway service
 and will apply to all instances of the gateway with that name.
 
 ~> [Configuration entries](/consul/docs/agent/config-entries) are global in scope. A configuration entry for a gateway name applies
@@ -41,7 +41,7 @@ Terminating gateways can optionally target all services within a Consul namespac
 as the service name. Configuration options set on the wildcard act as defaults that can be overridden
 by options set on a specific service name.
 
-Note that if the wildcard specifier is used, and some services in that namespace have a Connect sidecar proxy,
+Note that if the wildcard specifier is used, and some services in that namespace have a service mesh sidecar proxy,
 traffic from the mesh to those services will be evenly load-balanced between the gateway and their sidecars.
 
 ## Sample Config Entries
diff --git a/website/content/docs/connect/configuration.mdx b/website/content/docs/connect/configuration.mdx
index e33694688598..5edf02886ba1 100644
--- a/website/content/docs/connect/configuration.mdx
+++ b/website/content/docs/connect/configuration.mdx
@@ -2,7 +2,7 @@
 layout: docs
 page_title: Service Mesh Configuration - Overview
 description: >-
-  Learn how to enable and configure Consul's service mesh capabilities in agent configurations, and how to integrate with schedulers like Kubernetes and Nomad. ""Connect"" is the subsystem that provides Consul’s service mesh capabilities.
+  Learn how to enable and configure Consul's service mesh capabilities in agent configurations, and how to integrate with schedulers like Kubernetes and Nomad. Consul's service mesh capabilities are provided by the ""connect"" subsystem.
 ---
 
 # Service Mesh Configuration Overview
@@ -11,14 +11,17 @@ There are many configuration options exposed for Consul service mesh. The only o
 that must be set is the `connect.enabled` option on Consul servers to enable Consul service mesh.
 All other configurations are optional and have defaults suitable for many environments.
 
-The terms _Consul Connect_ and _Consul service mesh_ are used interchangeably throughout this documentation. 
+The noun _connect_ is used throughout this documentation to refer to the connect
+subsystem that provides Consul's service mesh capabilities.
+Where you encounter the _noun_ connect, it is usually functionality specific to
+service mesh.
 
 ## Agent configuration
 
-Begin by enabling Connect for your Consul
-cluster. By default, Connect is disabled. Enabling Connect requires changing
+Begin by enabling service mesh for your Consul
+cluster. By default, service is disabled. Enabling service mesh requires changing
 the configuration of only your Consul _servers_ (not client agents). To enable
-Connect, add the following to a new or existing
+service mesh, add the following to a new or existing
 [server configuration file](/consul/docs/agent/config/config-files). In an existing cluster, this configuration change requires a Consul server restart, which you can perform one server at a time to maintain availability. In HCL:
 
 
@@ -37,17 +40,17 @@ connect {
 ```
 </CodeTabs>
 
-This will enable Connect and configure your Consul cluster to use the
+This will enable service mesh and configure your Consul cluster to use the
 built-in certificate authority for creating and managing certificates.
 You may also configure Consul to use an external
 [certificate management system](/consul/docs/connect/ca), such as
 [Vault](https://www.vaultproject.io/).
 
-Services and proxies may always register with Connect settings, but they will
-fail to retrieve or verify any TLS certificates. This causes all Connect-based
-connection attempts to fail until Connect is enabled on the server agents.
+Services and proxies may always register with service mesh settings, but unless
+service mesh is enabled on the server agents, their attempts to communicate will fail
+because they have no means to obtain or verify service mesh TLS certificates.
 
-Other optional Connect configurations that you can set in the server
+Other optional service mesh configurations that you can set in the server
 configuration file include:
 
 - [certificate authority settings](/consul/docs/agent/config/config-files#connect)
@@ -55,10 +58,10 @@ configuration file include:
 - [dev mode](/consul/docs/agent/config/cli-flags#_dev)
 - [server host name verification](/consul/docs/agent/config/config-files#tls_internal_rpc_verify_server_hostname)
 
-If you would like to use Envoy as your Connect proxy you will need to [enable
+If you would like to use Envoy as your service mesh proxy you will need to [enable
 gRPC](/consul/docs/agent/config/config-files#grpc_port).
 
-Additionally if you plan on using the observability features of Connect, it can
+Additionally if you plan on using the observability features of Consul service mesh, it can
 be convenient to configure your proxies and services using [configuration
 entries](/consul/docs/agent/config-entries) which you can interact with using the
 CLI or API, or by creating configuration entry files. You will want to enable
@@ -67,8 +70,8 @@ configuration](/consul/docs/agent/config/config-files#enable_central_service_con
 clients, which allows each service's proxy configuration to be managed centrally
 via API.
 
-!> **Security note:** Enabling Connect is enough to try the feature but doesn't
-automatically ensure complete security. Please read the [Connect production
+!> **Security note:** Enabling service mesh is enough to try the feature but doesn't
+automatically ensure complete security. Please read the [service mesh production
 tutorial](/consul/tutorials/developer-mesh/service-mesh-production-checklist) to understand the additional steps
 needed for a secure deployment.
 
@@ -81,7 +84,7 @@ definitions](/consul/docs/services/usage/define-services).
 
 ## Schedulers
 
-Consul Connect is especially useful if you are using an orchestrator like Nomad
+Consul service mesh is especially useful if you are using an orchestrator like Nomad
 or Kubernetes, because these orchestrators can deploy thousands of service instances
 which frequently move hosts. Sidecars for each service can be configured through
 these schedulers, and in some cases they can automate Consul configuration,
@@ -89,16 +92,16 @@ sidecar deployment, and service registration.
 
 ### Nomad
 
-Connect can be used with Nomad to provide secure service-to-service
+Consul service mesh can be used with Nomad to provide secure service-to-service
 communication between Nomad jobs and task groups. The ability to use the dynamic
-port feature of Nomad makes Connect particularly easy to use. Learn about how to
-configure Connect on Nomad by reading the
+port feature of Nomad makes Consul service mesh particularly easy to use. Learn about how to
+configure Consul service mesh on Nomad by reading the
 [integration documentation](/consul/docs/connect/nomad).
 
 ### Kubernetes
 
-The Consul Helm chart can automate much of Consul Connect's configuration, and
+The Consul Helm chart can automate much of Consul's service mesh configuration, and
 makes it easy to automatically inject Envoy sidecars into new pods when they are
 deployed. Learn about the [Helm chart](/consul/docs/k8s/helm) in general,
 or if you are already familiar with it, check out its
-[connect specific configurations](/consul/docs/k8s/connect).
+[service mesh specific configurations](/consul/docs/k8s/connect).
diff --git a/website/content/docs/connect/connect-internals.mdx b/website/content/docs/connect/connect-internals.mdx
index 826a2bde2226..73a3cc1e8980 100644
--- a/website/content/docs/connect/connect-internals.mdx
+++ b/website/content/docs/connect/connect-internals.mdx
@@ -11,7 +11,10 @@ This topic describes how many of the core features of Consul's service mesh func
 It is not a prerequisite,
 but this information will help you understand how Consul service mesh behaves in more complex scenarios.
 
-Consul Connect is the component shipped with Consul that enables service mesh functionality. The terms _Consul Connect_ and _Consul service mesh_ are used interchangeably throughout this documentation.
+The noun _connect_ is used throughout this documentation to refer to the connect
+subsystem that provides Consul's service mesh capabilities.
+Where you encounter the _noun_ connect, it is usually functionality specific to
+service mesh.
 
 To try service mesh locally, complete the [Getting Started with Consul service
 mesh](/consul/tutorials/kubernetes-deploy/service-mesh?utm_source=docs)
@@ -59,7 +62,7 @@ in-memory data.
 
 ## Agent Caching and Performance
 
-To enable fast responses on endpoints such as the [agent Connect
+To enable fast responses on endpoints such as the [agent connect
 API](/consul/api-docs/agent/connect), the Consul agent locally caches most Consul service mesh-related
 data and sets up background [blocking queries](/consul/api-docs/features/blocking) against
 the server to update the cache in the background. This allows most API calls
diff --git a/website/content/docs/connect/connectivity-tasks.mdx b/website/content/docs/connect/connectivity-tasks.mdx
index c81c0ebda544..bd5a4bc66f66 100644
--- a/website/content/docs/connect/connectivity-tasks.mdx
+++ b/website/content/docs/connect/connectivity-tasks.mdx
@@ -59,7 +59,7 @@ Services outside the mesh do not have sidecar proxies or are not [integrated nat
 These may be services running on legacy infrastructure or managed cloud services running on
 infrastructure you do not control.
 
-Terminating gateways effectively act as egress proxies that can represent one or more services. They terminate Connect
+Terminating gateways effectively act as egress proxies that can represent one or more services. They terminate service mesh
 mTLS connections, enforce Consul intentions, and forward requests to the appropriate destination.
 
 These gateways also simplify authorization from dynamic service addresses. Consul's intentions determine whether
diff --git a/website/content/docs/connect/dev.mdx b/website/content/docs/connect/dev.mdx
index 6f494bc37518..6a4eddec5ccb 100644
--- a/website/content/docs/connect/dev.mdx
+++ b/website/content/docs/connect/dev.mdx
@@ -8,17 +8,17 @@ description: >-
 # Service Mesh Debugging
 
 It is often necessary to connect to a service for development or debugging.
-If a service only exposes a Connect listener, then we need a way to establish
+If a service only exposes a service mesh listener, then we need a way to establish
 a mutual TLS connection to the service. The
 [`consul connect proxy` command](/consul/commands/connect/proxy) can be used
 for this task on any machine with access to a Consul agent (local or remote).
 
-Restricting access to services only via Connect ensures that the only way to
+Restricting access to services only via servoce ,esj ensures that the only way to
 connect to a service is through valid authorization of the
 [intentions](/consul/docs/connect/intentions). This can extend to developers
 and operators, too.
 
-## Connecting to Connect-only Services
+## Connecting to Mesh-only Services
 
 As an example, let's assume that we have a PostgreSQL database running that
 we want to connect to via `psql`, but the only non-loopback listener is
diff --git a/website/content/docs/connect/gateways/api-gateway/usage.mdx b/website/content/docs/connect/gateways/api-gateway/usage.mdx
index a5fea6e8176c..9f314fd2f4e3 100644
--- a/website/content/docs/connect/gateways/api-gateway/usage.mdx
+++ b/website/content/docs/connect/gateways/api-gateway/usage.mdx
@@ -12,7 +12,7 @@ in a Kubernetes environment, refer to [API Gateway for Kubernetes](/consul/docs/
 
 ## Introduction
 
-Consul API gateways provide a configurable ingress points for requests into a Consul network. Usethe following configuration entries to set up API gateways:
+Consul API gateways provide a configurable ingress points for requests into a Consul network. Use the following configuration entries to set up API gateways:
 
 - [API gateway](/consul/docs/connect/gateways/api-gateway/configuration/api-gateway): Provides an endpoint for requests to enter the network. Define listeners that expose ports on the endpoint for ingress.
 - [HTTP routes](/consul/docs/connect/gateways/api-gateway/configuration/http-route) and [TCP routes](/consul/docs/connect/gateways/api-gateway/configuration/tcp-route): The routes attach to listeners defined in the gateway and control how requests route to services in the network.
diff --git a/website/content/docs/connect/gateways/index.mdx b/website/content/docs/connect/gateways/index.mdx
index fb04a9e54943..344b63dd0ad2 100644
--- a/website/content/docs/connect/gateways/index.mdx
+++ b/website/content/docs/connect/gateways/index.mdx
@@ -64,7 +64,7 @@ Services outside the mesh do not have sidecar proxies or are not [integrated nat
 These may be services running on legacy infrastructure or managed cloud services running on
 infrastructure you do not control.
 
-Terminating gateways effectively act as egress proxies that can represent one or more services. They terminate Connect
+Terminating gateways effectively act as egress proxies that can represent one or more services. They terminate service mesh
 mTLS connections, enforce Consul intentions, and forward requests to the appropriate destination.
 
 These gateways also simplify authorization from dynamic service addresses. Consul's intentions determine whether
diff --git a/website/content/docs/connect/gateways/ingress-gateway.mdx b/website/content/docs/connect/gateways/ingress-gateway.mdx
index 2ba36b3d79bd..b5a8cc213f9a 100644
--- a/website/content/docs/connect/gateways/ingress-gateway.mdx
+++ b/website/content/docs/connect/gateways/ingress-gateway.mdx
@@ -39,7 +39,7 @@ the [hosts](/consul/docs/connect/config-entries/ingress-gateway#hosts) field.
 Ingress gateways also require that your Consul datacenters are configured correctly:
 
 - You'll need to use Consul version 1.8.0 or newer.
-- Consul [Connect](/consul/docs/agent/config/config-files#connect) must be enabled on the datacenter's Consul servers.
+- Consul [service mesh](/consul/docs/agent/config/config-files#connect) must be enabled on the datacenter's Consul servers.
 - [gRPC](/consul/docs/agent/config/config-files#grpc_port) must be enabled on all client agents.
 
 Currently, [Envoy](https://www.envoyproxy.io/) is the only proxy with ingress gateway capabilities in Consul.
@@ -54,13 +54,13 @@ review the [ingress gateway tutorial](/consul/tutorials/developer-mesh/service-m
 Ingress gateways are configured in service definitions and registered with Consul like other services, with two exceptions.
 The first is that the [kind](/consul/api-docs/agent/service#kind) must be "ingress-gateway". Second,
 the ingress gateway service definition may contain a `Proxy.Config` entry just like a
-Connect proxy service, to define opaque configuration parameters useful for the actual proxy software.
+service mesh proxy service, to define opaque configuration parameters useful for the actual proxy software.
 For Envoy there are some supported [gateway options](/consul/docs/connect/proxies/envoy#gateway-options) as well as
 [escape-hatch overrides](/consul/docs/connect/proxies/envoy#escape-hatch-overrides).
 
 -> **Note:** If ACLs are enabled, ingress gateways must be registered with a token granting `service:write` for the ingress gateway's service name,
 `service:read` for all services in the ingress gateway's configuration entry, and `node:read` for all nodes of the services
-in the ingress gateway's configuration entry. These privileges authorize the token to route communications to other Connect services.
+in the ingress gateway's configuration entry. These privileges authorize the token to route communications to other mesh services.
 If the Consul client agent on the gateway's node is not configured to use the default gRPC port, 8502, then the gateway's token
 must also provide `agent:read` for its node's name in order to discover the agent's gRPC port. gRPC is used to expose Envoy's xDS API to Envoy proxies.
 
diff --git a/website/content/docs/connect/gateways/mesh-gateway/index.mdx b/website/content/docs/connect/gateways/mesh-gateway/index.mdx
index e5c5229dfcf8..89d64b8d1ebe 100644
--- a/website/content/docs/connect/gateways/mesh-gateway/index.mdx
+++ b/website/content/docs/connect/gateways/mesh-gateway/index.mdx
@@ -57,17 +57,17 @@ Configure the following settings to register the mesh gateway as a service in Co
 Each upstream associated with a service mesh proxy can be configured so that it is routed through a mesh gateway.
 Depending on your network, the proxy's connection to the gateway can operate in one of the following modes:
 
-* `none` - No gateway is used and a service mesh connect proxy makes its outbound connections directly
+* `none` - No gateway is used and a service mesh sidecar proxy makes its outbound connections directly
   to the destination services. This is the default for WAN federation. This setting is invalid for peered clusters
   and will be treated as remote instead. 
 
-* `local` - The service mesh connect proxy makes an outbound connection to a gateway running in the
+* `local` - The service mesh sidecar proxy makes an outbound connection to a gateway running in the
   same datacenter. That gateway is responsible for ensuring that the data is forwarded to gateways in the destination datacenter.
 
-* `remote` - The service mesh proxy makes an outbound connection to a gateway running in the destination datacenter.
+* `remote` - The service mesh sidecar proxy makes an outbound connection to a gateway running in the destination datacenter.
   The gateway forwards the data to the final destination service. This is the default for peered clusters.
 
-### Connect Proxy Configuration
+### Service Mesh Proxy Configuration
 
 Set the proxy to the preferred [mode](#modes) to configure the service mesh proxy. You can specify the mode globally or within child configurations to control proxy behaviors at a lower level. Consul recognizes the following order of precedence if the gateway mode is configured in multiple locations the order of precedence:
 
@@ -82,7 +82,7 @@ Use the following example configurations to help you understand some of the comm
 
 ### Enabling Gateways Globally
 
-The following `proxy-defaults` configuration will enable gateways for all Connect services in the `local` mode.
+The following `proxy-defaults` configuration will enable gateways for all mesh services in the `local` mode.
 
 <CodeTabs heading="Example: Enabling gateways globally.">
 
@@ -104,7 +104,7 @@ Name: global
 
 ### Enabling Gateways Per Service
 
-The following `service-defaults` configuration will enable gateways for all Connect services with the name `web`.
+The following `service-defaults` configuration will enable gateways for all mesh services with the name `web`.
 
 <CodeTabs heading="Example: Enabling gateways per service.">
 
diff --git a/website/content/docs/connect/gateways/mesh-gateway/service-to-service-traffic-partitions.mdx b/website/content/docs/connect/gateways/mesh-gateway/service-to-service-traffic-partitions.mdx
index d993b70f6983..4e269d00fd48 100644
--- a/website/content/docs/connect/gateways/mesh-gateway/service-to-service-traffic-partitions.mdx
+++ b/website/content/docs/connect/gateways/mesh-gateway/service-to-service-traffic-partitions.mdx
@@ -36,7 +36,7 @@ Consul can only translate mesh gateway registration information into Envoy confi
 
 Sidecar proxies that send traffic to an upstream service through a gateway need to know the location of that gateway. They discover the gateway based on their sidecar proxy registrations. Consul can only translate the gateway registration information into Envoy configuration.
 
-Sidecar proxies that do not send upstream traffic through a gateway are not affected when you deploy gateways. If you are using Consul's built-in proxy as a Connect sidecar it will continue to work for intra-datacenter traffic and will receive incoming traffic even if that traffic has passed through a gateway.
+Sidecar proxies that do not send upstream traffic through a gateway are not affected when you deploy gateways. If you are using Consul's built-in proxy as a service mesh sidecar it will continue to work for intra-datacenter traffic and will receive incoming traffic even if that traffic has passed through a gateway.
 
 ## Configuration
 
@@ -61,7 +61,7 @@ Depending on your network, the proxy's connection to the gateway can operate in
 * `remote` - The service mesh connect proxy makes an outbound connection to a gateway running in the destination datacenter.
   The gateway forwards the data to the final destination service.
 
-### Connect Proxy Configuration
+### Service Mesh Proxy Configuration
 
 Set the proxy to the preferred [mode](#modes) to configure the service mesh proxy. You can specify the mode globally or within child configurations to control proxy behaviors at a lower level. Consul recognizes the following order of precedence if the gateway mode is configured in multiple locations the order of precedence:
 
@@ -76,7 +76,7 @@ Use the following example configurations to help you understand some of the comm
 
 ### Enabling Gateways Globally
 
-The following `proxy-defaults` configuration will enable gateways for all Connect services in the `local` mode.
+The following `proxy-defaults` configuration will enable gateways for all mesh services in the `local` mode.
 
 <CodeTabs heading="Example: Enabling gateways globally.">
 
@@ -99,7 +99,7 @@ Name: global
 
 ### Enabling Gateways Per Service
 
-The following `service-defaults` configuration will enable gateways for all Connect services with the name `web`.
+The following `service-defaults` configuration will enable gateways for all mesh services with the name `web`.
 
 <CodeTabs heading="Example: Enabling gateways per service.">
 
diff --git a/website/content/docs/connect/gateways/mesh-gateway/service-to-service-traffic-wan-datacenters.mdx b/website/content/docs/connect/gateways/mesh-gateway/service-to-service-traffic-wan-datacenters.mdx
index 520f6c01ff2b..5a764c437248 100644
--- a/website/content/docs/connect/gateways/mesh-gateway/service-to-service-traffic-wan-datacenters.mdx
+++ b/website/content/docs/connect/gateways/mesh-gateway/service-to-service-traffic-wan-datacenters.mdx
@@ -29,10 +29,10 @@ Ensure that your Consul environment meets the following requirements.
 
 * Consul version 1.6.0 or newer.
 * A local Consul agent is required to manage its configuration.
-* Consul [Connect](/consul/docs/agent/config/config-files#connect) must be enabled in both datacenters.
+* Consul [service mesh](/consul/docs/agent/config/config-files#connect) must be enabled in both datacenters.
 * Each [datacenter](/consul/docs/agent/config/config-files#datacenter) must have a unique name.
 * Each datacenters must be [WAN joined](/consul/tutorials/networking/federation-gossip-wan).
-* The [primary datacenter](/consul/docs/agent/config/config-files#primary_datacenter) must be set to the same value in both datacenters. This specifies which datacenter is the authority for Connect certificates and is required for services in all datacenters to establish mutual TLS with each other.
+* The [primary datacenter](/consul/docs/agent/config/config-files#primary_datacenter) must be set to the same value in both datacenters. This specifies which datacenter is the authority for service mesh certificates and is required for services in all datacenters to establish mutual TLS with each other.
 * [gRPC](/consul/docs/agent/config/config-files#grpc_port) must be enabled.
 * If you want to [enable gateways globally](/consul/docs/connect/gateways/mesh-gateway/service-to-service-traffic-wan-datacenters#enabling-gateways-globally) you must enable [centralized configuration](/consul/docs/agent/config/config-files#enable_central_service_config).
 
@@ -50,7 +50,7 @@ Consul can only translate mesh gateway registration information into Envoy confi
 
 Sidecar proxies that send traffic to an upstream service through a gateway need to know the location of that gateway. They discover the gateway based on their sidecar proxy registrations. Consul can only translate the gateway registration information into Envoy configuration.
 
-Sidecar proxies that do not send upstream traffic through a gateway are not affected when you deploy gateways. If you are using Consul's built-in proxy as a Connect sidecar it will continue to work for intra-datacenter traffic and will receive incoming traffic even if that traffic has passed through a gateway.
+Sidecar proxies that do not send upstream traffic through a gateway are not affected when you deploy gateways. If you are using Consul's built-in proxy as a service mesh sidecar it will continue to work for intra-datacenter traffic and will receive incoming traffic even if that traffic has passed through a gateway.
 
 ## Configuration
 
@@ -66,18 +66,18 @@ Configure the following settings to register the mesh gateway as a service in Co
 Each upstream associated with a service mesh proxy can be configured so that it is routed through a mesh gateway.
 Depending on your network, the proxy's connection to the gateway can operate in one of the following modes (refer to the [mesh-architecture-diagram](#mesh-architecture-diagram)):
 
-* `none` - (Default) No gateway is used and a service mesh connect proxy makes its outbound connections directly
+* `none` - (Default) No gateway is used and a service mesh sidecar proxy makes its outbound connections directly
   to the destination services.
 
-* `local` - The service mesh connect proxy makes an outbound connection to a gateway running in the
+* `local` - The service mesh sidecar proxy makes an outbound connection to a gateway running in the
   same datacenter. That gateway is responsible for ensuring that the data is forwarded to gateways in the destination datacenter.
   Refer to the flow labeled `local` in the [mesh-architecture-diagram](#mesh-architecture-diagram).
 
-* `remote` - The service mesh proxy makes an outbound connection to a gateway running in the destination datacenter.
+* `remote` - The service mesh sidecar proxy makes an outbound connection to a gateway running in the destination datacenter.
   The gateway forwards the data to the final destination service.
   Refer to the flow labeled `remote` in the [mesh-architecture-diagram](#mesh-architecture-diagram).
 
-### Connect Proxy Configuration
+### Service Mesh Proxy Configuration
 
 Set the proxy to the preferred [mode](#modes) to configure the service mesh proxy. You can specify the mode globally or within child configurations to control proxy behaviors at a lower level. Consul recognizes the following order of precedence if the gateway mode is configured in multiple locations the order of precedence:
 
@@ -92,7 +92,7 @@ Use the following example configurations to help you understand some of the comm
 
 ### Enabling Gateways Globally
 
-The following `proxy-defaults` configuration will enable gateways for all Connect services in the `local` mode.
+The following `proxy-defaults` configuration will enable gateways for all mesh services in the `local` mode.
 
 <CodeTabs heading="Example: Enabling gateways globally.">
 
@@ -114,7 +114,7 @@ Name: global
 
 ### Enabling Gateways Per Service
 
-The following `service-defaults` configuration will enable gateways for all Connect services with the name `web`.
+The following `service-defaults` configuration will enable gateways for all mesh services with the name `web`.
 
 <CodeTabs heading="Example: Enabling gateways per service.">
 
diff --git a/website/content/docs/connect/gateways/terminating-gateway.mdx b/website/content/docs/connect/gateways/terminating-gateway.mdx
index 05f48eee5f45..17a926c0cd98 100644
--- a/website/content/docs/connect/gateways/terminating-gateway.mdx
+++ b/website/content/docs/connect/gateways/terminating-gateway.mdx
@@ -10,8 +10,8 @@ description: >-
 -> **1.8.0+:** This feature is available in Consul versions 1.8.0 and newer.
 
 Terminating gateways enable connectivity within your organizational network from services in the Consul service mesh to
-services and [destinations](/consul/docs/connect/config-entries/service-defaults#terminating-gateway-destination) outside the mesh. These gateways effectively act as Connect proxies that can
-represent more than one service. They terminate Connect mTLS connections, enforce intentions,
+services and [destinations](/consul/docs/connect/config-entries/service-defaults#terminating-gateway-destination) outside the mesh. These gateways effectively act as service mesh proxies that can
+represent more than one service. They terminate service mesh mTLS connections, enforce intentions,
 and forward requests to the appropriate destination.
 
 ![Terminating Gateway Architecture](/img/terminating-gateways.png)
@@ -26,7 +26,7 @@ for filtering by instance.
 ## Security Considerations
 
 ~> We recommend that terminating gateways are not exposed to the WAN or open internet. This is because terminating gateways
-hold certificates to decrypt Consul Connect traffic directed at them and may be configured with credentials to connect
+hold certificates to decrypt Consul service mesh traffic directed at them and may be configured with credentials to connect
 to linked services. Connections over the WAN or open internet should flow through [mesh gateways](/consul/docs/connect/gateways/mesh-gateway)
 whenever possible since they are not capable of decrypting traffic or connecting directly to services.
 
@@ -58,7 +58,7 @@ Each terminating gateway needs:
 Terminating gateways also require that your Consul datacenters are configured correctly:
 
 - You'll need to use Consul version 1.8.0 or newer.
-- Consul [Connect](/consul/docs/agent/config/config-files#connect) must be enabled on the datacenter's Consul servers.
+- Consul [service mesh](/consul/docs/agent/config/config-files#connect) must be enabled on the datacenter's Consul servers.
 - [gRPC](/consul/docs/agent/config/config-files#grpc_port) must be enabled on all client agents.
 
 Currently, [Envoy](https://www.envoyproxy.io/) is the only proxy with terminating gateway capabilities in Consul.
@@ -68,9 +68,9 @@ Currently, [Envoy](https://www.envoyproxy.io/) is the only proxy with terminatin
   can only translate terminating gateway registration information into Envoy
   configuration, therefore the proxies acting as terminating gateways must be Envoy.
 
-Connect proxies that send upstream traffic through a gateway aren't
+Service mesh proxies that send upstream traffic through a gateway aren't
 affected when you deploy terminating gateways. If you are using non-Envoy proxies as
-Connect proxies they will continue to work for traffic directed at services linked to
+Service mesh proxies they will continue to work for traffic directed at services linked to
 a terminating gateway as long as they discover upstreams with the
 [/health/connect](/consul/api-docs/health#list-nodes-for-connect-capable-service) endpoint.
 
@@ -84,7 +84,7 @@ services outside the mesh, review the [terminating gateway tutorial](/consul/tut
 Terminating gateways are configured in service definitions and registered with Consul like other services, with two exceptions.
 The first is that the [kind](/consul/api-docs/agent/service#kind) must be "terminating-gateway". Second,
 the terminating gateway service definition may contain a `Proxy.Config` entry just like a
-Connect proxy service, to define opaque configuration parameters useful for the actual proxy software.
+service mesh proxy service, to define opaque configuration parameters useful for the actual proxy software.
 For Envoy there are some supported [gateway options](/consul/docs/connect/proxies/envoy#gateway-options) as well as
 [escape-hatch overrides](/consul/docs/connect/proxies/envoy#escape-hatch-overrides).
 
diff --git a/website/content/docs/connect/index.mdx b/website/content/docs/connect/index.mdx
index 7c7235569d3e..6bdc9989f52b 100644
--- a/website/content/docs/connect/index.mdx
+++ b/website/content/docs/connect/index.mdx
@@ -7,15 +7,20 @@ description: >-
 
 # Consul service mesh
 
-Consul Service Mesh provides service-to-service connection authorization and
-encryption using mutual Transport Layer Security (TLS). Consul Connect is used interchangeably
-with the name Consul Service Mesh and is what this document will use to refer to for Service Mesh functionality within Consul. 
+Consul service mesh provides service-to-service connection authorization and
+encryption using mutual Transport Layer Security (TLS).
+
 Applications can use [sidecar proxies](/consul/docs/connect/proxies) in a service mesh configuration to
-establish TLS connections for inbound and outbound connections without being aware of Connect at all. 
-Applications may also [natively integrate with Connect](/consul/docs/connect/native) for optimal performance and security. 
-Connect can help you secure your services and provide data about service-to-service communications.
+establish TLS connections for inbound and outbound connections without being aware of the service mesh at all. 
+Applications may also [natively integrate with Consul service mesh](/consul/docs/connect/native) for optimal performance and security. 
+Consul service mesh can help you secure your services and provide data about service-to-service communications.
+
+The noun _connect_ is used throughout this documentation to refer to the connect
+subsystem that provides Consul's service mesh capabilities.
+Where you encounter the _noun_ connect, it is usually functionality specific to
+service mesh.
 
-Review the video below to learn more about Consul Connect from HashiCorp's co-founder Armon.
+Review the video below to learn more about Consul service mesh from HashiCorp's co-founder Armon.
 
 <iframe
   src="https://www.youtube.com/embed/8T8t4-hQY74"
@@ -59,11 +64,10 @@ Complete the following tutorials try Consul service mesh in different environmen
 
 - The [Secure Service-to-Service Communication tutorial](/consul/tutorials/developer-mesh/service-mesh-with-envoy-proxy?utm_source=docs)
   is a simple walk through of connecting two services on your local machine
-  using Consul Connect's built-in proxy and configuring your first intention. The guide also includes an introduction to
-  using Envoy as the Connect sidecar proxy.
+  and configuring your first intention.
 
 - The [Kubernetes tutorial](/consul/tutorials/kubernetes/kubernetes-minikube?utm_source=docs)
-  walks you through configuring Consul Connect in Kubernetes using the Helm
+  walks you through configuring Consul service mesh in Kubernetes using the Helm
   chart, and using intentions. You can run the guide on Minikube or an existing
   Kubernetes cluster.
 
diff --git a/website/content/docs/connect/intentions/index.mdx b/website/content/docs/connect/intentions/index.mdx
index 301344c64ec0..9cb0f36ee1b3 100644
--- a/website/content/docs/connect/intentions/index.mdx
+++ b/website/content/docs/connect/intentions/index.mdx
@@ -87,5 +87,5 @@ intentions should be consulted for each incoming connection/request to
 determine if it should be accepted or rejected.
 
 The default intention behavior is defined by the [`default_policy`](/consul/docs/agent/config/config-files#acl_default_policy) configuration.
-If the configuration is set `allow`, then all service mesh Connect connections will be allowed by default.
+If the configuration is set `allow`, then all service-to-service connections in the mesh will be allowed by default.
 If is set to `deny`, then all connections or requests will be denied by default.
\ No newline at end of file
diff --git a/website/content/docs/connect/intentions/legacy.mdx b/website/content/docs/connect/intentions/legacy.mdx
index b79d34a543ae..df9ca5c66365 100644
--- a/website/content/docs/connect/intentions/legacy.mdx
+++ b/website/content/docs/connect/intentions/legacy.mdx
@@ -10,8 +10,7 @@ description: >-
 ~> **1.8.x and earlier:** This document only applies in Consul versions 1.8.x
 and before. If you are using version 1.9.0 or later, refer to the [current intentions documentation](/consul/docs/connect/intentions).
 
-Intentions define access control for services via Connect and are used
-to control which services may establish connections. Intentions can be
+Intentions define access control for service-to-service connections in the service mesh. Intentions can be
 managed via the API, CLI, or UI.
 
 Intentions are enforced by the [proxy](/consul/docs/connect/proxies)
@@ -23,8 +22,8 @@ connection must be terminated.
 
 The default intention behavior is defined by the default [ACL
 policy](/consul/docs/agent/config/config-files#acl_default_policy). If the default ACL policy is
-"allow all", then all Connect connections are allowed by default. If the
-default ACL policy is "deny all", then all Connect connections are denied by
+"allow all", then all service-to-service connections in the mesh are allowed by default. If the
+default ACL policy is "deny all", then all service-to-service connections are denied by
 default.
 
 ## Intention Basics
@@ -130,7 +129,7 @@ of the intention, not the source.
 
 Intention permissions are by default implicitly granted at `read` level
 when granting `service:read` or `service:write`. This is because a
-service registered that wants to use Connect needs `intentions:read`
+service registered that wants to use service mesh needs `intentions:read`
 for its own service name in order to know whether or not to authorize
 connections. The following ACL policy will implicitly grant `intentions:read`
 (note _read_) for service `web`.
@@ -152,7 +151,7 @@ service "web" {
 }
 ```
 
-Note that `intentions:read` is required for a token that a Connect-enabled
+Note that `intentions:read` is required for a token that a mesh-enabled
 service uses to register itself or its proxy. If the token used does not
 have `intentions:read` then the agent will be unable to resolve intentions
 for the service and so will not be able to authorize any incoming connections.
@@ -173,7 +172,7 @@ The intentions for services registered with a Consul agent are cached
 locally on that agent. They are then updated via a background blocking query
 against the Consul servers.
 
-Connect connection attempts require only local agent
+Service mesh connection attempts require only local agent
 communication for authorization and generally only impose microseconds
 of latency to the connection. All actions in the data path of connections
 require only local data to ensure minimal performance overhead.
diff --git a/website/content/docs/connect/l7-traffic/discovery-chain.mdx b/website/content/docs/connect/l7-traffic/discovery-chain.mdx
index a41353125e89..ae7582509c99 100644
--- a/website/content/docs/connect/l7-traffic/discovery-chain.mdx
+++ b/website/content/docs/connect/l7-traffic/discovery-chain.mdx
@@ -10,7 +10,7 @@ description: >-
 -> **1.6.0+:** This feature is available in Consul versions 1.6.0 and newer.
 
 ~> This topic is part of a [low-level API](/consul/api-docs/discovery-chain)
-primarily targeted at developers building external [Connect proxy
+primarily targeted at developers building external [Consul service mesh proxy
 integrations](/consul/docs/connect/proxies/integrate).
 
 The service discovery process can be modeled as a "discovery chain" which
@@ -21,7 +21,7 @@ the discovery chain a user can control how proxy upstreams are ultimately
 resolved to specific instances for load balancing.
 
 -> **Note:** The discovery chain is currently only used to discover
-[Connect](/consul/docs/connect) proxy upstreams.
+[service mesh](/consul/docs/connect) proxy upstreams.
 
 ## Configuration
 
@@ -69,7 +69,7 @@ various configuration entries interact in more complex ways. For example:
 
 To correctly interpret a collection of configuration entries as a valid
 discovery chain, we first compile them into a form more directly usable by the
-layers responsible for configuring Connect sidecar proxies.
+layers responsible for configuring service mesh sidecar proxies.
 
 You can interact with the compiler directly using the [discovery-chain
 API](/consul/api-docs/discovery-chain).
@@ -100,7 +100,7 @@ The response is a single wrapped `CompiledDiscoveryChain` field:
 The chain encodes a digraph of [nodes](#discoverygraphnode) and
 [targets](#discoverytarget). Nodes are the compiled representation of various
 discovery chain stages and targets are instructions on how to use the [health
-API](/consul/api-docs/health#list-nodes-for-connect-capable-service) to retrieve
+API](/consul/api-docs/health#list-nodes-for-mesh-capable-service) to retrieve
 relevant service instance lists.
 
 You should traverse the nodes starting with [`StartNode`](#startnode). The
@@ -228,7 +228,7 @@ A single node in the compiled discovery chain.
     be considered healthy.
 
 - `MeshGateway` `(MeshGatewayConfig)` - The [mesh gateway
-  configuration](/consul/docs/connect/gateways/mesh-gateway#connect-proxy-configuration)
+  configuration](/consul/docs/connect/gateways/mesh-gateway#service-mesh-proxy-configuration)
   to use when connecting to this target's service instances.
 
   - `Mode` `(string: "")` - One of `none`, `local`, or `remote`.
diff --git a/website/content/docs/connect/l7-traffic/index.mdx b/website/content/docs/connect/l7-traffic/index.mdx
index c15c3656edc7..9f5fe8da2b5a 100644
--- a/website/content/docs/connect/l7-traffic/index.mdx
+++ b/website/content/docs/connect/l7-traffic/index.mdx
@@ -12,7 +12,7 @@ description: >-
 Layer 7 traffic management allows operators to divide L7 traffic between
 different
 [subsets](/consul/docs/connect/config-entries/service-resolver#service-subsets) of
-service instances when using Connect.
+service instances when using service mesh.
 
 There are many ways you may wish to carve up a single datacenter's pool of
 services beyond simply returning all healthy instances for load balancing.
@@ -28,7 +28,7 @@ and some [Envoy proxy escape hatches](/consul/docs/connect/proxies/envoy#escape-
 
 ## Stages
 
-Connect proxy upstreams are discovered using a series of stages: routing,
+Service mesh proxy upstreams are discovered using a series of stages: routing,
 splitting, and resolution. These stages represent different ways of managing L7
 traffic.
 
diff --git a/website/content/docs/connect/native/go.mdx b/website/content/docs/connect/native/go.mdx
index 4c47bc315dd8..df9080f17f74 100644
--- a/website/content/docs/connect/native/go.mdx
+++ b/website/content/docs/connect/native/go.mdx
@@ -7,26 +7,29 @@ description: >-
 
 # Service Mesh Native Integration for Go Applications
 
--> **Note:** When calling `ConnectAuthorize()` on incoming connections this library
-will return _deny_ if `Permissions` are defined on the matching intention.
-The method is currently only suited for networking layer 4 (e.g. TCP) integration.
-
-We provide a library that makes it drop-in simple to integrate Connect
+We provide a library that makes it drop-in simple to integrate Consul service mesh
 with most [Go](https://golang.org/) applications. This page shows examples
-of integrating this library for accepting or establishing Connect-based
-connections. For most Go applications, Connect can be natively integrated
+of integrating this library for accepting or establishing mesh-based
+connections. For most Go applications, Consul service mesh can be natively integrated
 in just a single line of code excluding imports and struct initialization.
 
 In addition to this, please read and understand the
-[overview of Connect-Native integrations](/consul/docs/connect/native).
-In particular, after integrating applications with Connect, they must declare
-that they accept Connect-based connections via their service definitions.
+[overview of service mesh native integrations](/consul/docs/connect/native).
+In particular, after natively integrating applications with Consul service mesh,
+they must declare that they accept mesh-based connections via their service definitions.
+
+The noun _connect_ is used throughout this documentation and the Go API
+to refer to the connect subsystem that provides Consul's service mesh capabilities.
 
 ## Accepting Connections
 
+-> **Note:** When calling `ConnectAuthorize()` on incoming connections this library
+will return _deny_ if `Permissions` are defined on the matching intention.
+The method is currently only suited for networking layer 4 (e.g. TCP) integration.
+
 Any server that supports TLS (HTTP, gRPC, net/rpc, etc.) can begin
-accepting Connect-based connections in just a few lines of code. For most
-existing applications, converting the server to accept Connect-based
+accepting mesh-based connections in just a few lines of code. For most
+existing applications, converting the server to accept mesh-based
 connections will require only a one-line change excluding imports and
 structure initialization.
 
@@ -55,7 +58,7 @@ func main() {
   svc, _ := connect.NewService("my-service", client)
   defer svc.Close()
 
-  // Creating an HTTP server that serves via Connect
+  // Creating an HTTP server that serves via service mesh
   server := &http.Server{
     Addr:      ":8080",
     TLSConfig: svc.ServerTLSConfig(),
@@ -106,7 +109,7 @@ func main() {
   svc, _ := connect.NewService("my-service", client)
   defer svc.Close()
 
-  // Creating an HTTP server that serves via Connect
+  // Creating an HTTP server that serves via service mesh
   listener, _ := tls.Listen("tcp", ":8080", svc.ServerTLSConfig())
   defer listener.Close()
 
@@ -117,9 +120,9 @@ func main() {
 
 ## HTTP Clients
 
-For Go applications that need to Connect to HTTP-based upstream dependencies,
+For Go applications that need to connect to HTTP-based upstream dependencies,
 the Go library can construct an `*http.Client` that automatically establishes
-Connect-based connections as long as Consul-based service discovery is used.
+mesh-based connections as long as Consul-based service discovery is used.
 
 Example, followed by more details:
 
@@ -152,7 +155,7 @@ section above. If your application is both a client and server, both the
 API client and service structure can be shared and reused.
 
 Next, we call `svc.HTTPClient()` to return a specially configured
-`*http.Client`. This client will automatically established Connect-based
+`*http.Client`. This client will automatically established mesh-based
 connections using Consul service discovery.
 
 Finally, we perform an HTTP `GET` request to a hypothetical userinfo service.
@@ -189,7 +192,7 @@ the following specific limitations:
 ## Raw TLS Connection
 
 For a raw `net.Conn` TLS connection, the `svc.Dial` function can be used.
-This will establish a connection to the desired service via Connect and
+This will establish a connection to the desired service via the service mesh and
 return the `net.Conn`. This connection can then be used as desired.
 
 Example:
diff --git a/website/content/docs/connect/native/index.mdx b/website/content/docs/connect/native/index.mdx
index 6dee2160465a..e8cc421af8ac 100644
--- a/website/content/docs/connect/native/index.mdx
+++ b/website/content/docs/connect/native/index.mdx
@@ -2,18 +2,18 @@
 layout: docs
 page_title: Service Mesh Native App Integration - Overview
 description: >-
-  When using sidecar proxies is not possible, applications can natively integrate with Consul service mesh, but have reduced access to service mesh features. Learn how “Connect-Native” apps use mTLS to authenticate with Consul and how to add integrations to service registrations.
+  When using sidecar proxies is not possible, applications can natively integrate with Consul service mesh, but have reduced access to service mesh features. Learn how "mesh-native" or "connect-native" apps use mTLS to authenticate with Consul and how to add integrations to service registrations.
 ---
 
 # Service Mesh Native App Integration Overview
 
-~> **Note:** The Native App Integration does not support many of the Connect service
+~> **Note:** The Native App Integration does not support many of the Consul's service
 mesh features, and is not under active development.
 The [Envoy proxy](/consul/docs/connect/proxies/envoy) should be used for most production
 environments.
 
-Applications can natively integrate with the Connect API to support accepting
-and establishing connections to other Connect services without the overhead of a
+Applications can natively integrate with Consul's service mesh API to support accepting
+and establishing connections to other mesh services without the overhead of a
 [proxy sidecar](/consul/docs/connect/proxies). This option is especially useful
 for applications that may be experiencing performance issues with the proxy
 sidecar deployment. This page will cover the high-level overview of
@@ -21,20 +21,23 @@ integration, registering the service, etc. For language-specific examples, see
 the sidebar navigation to the left. It is also required if your service uses
 relies on a dynamic set of upstream services.
 
-Connect is just basic mutual TLS. This means that almost any application
-can easily integrate with Connect. There is no custom protocol in use;
-any language that supports TLS can accept and establish Connect-based
+Service mesh traffic is just basic mutual TLS. This means that almost any application
+can easily integrate with Consul service mesh. There is no custom protocol in use;
+any language that supports TLS can accept and establish mesh-based
 connections.
 
 We currently provide an easy-to-use [Go integration](/consul/docs/connect/native/go)
 to assist with the getting the proper certificates, verifying connections,
 etc. We plan to add helper libraries for other languages in the future.
 However, without library support, it is still possible for any major language
-to integrate with Connect.
+to integrate with Consul service mesh.
+
+The noun _connect_ is used throughout this documentation to refer to the connect
+subsystem that provides Consul's service mesh capabilities.
 
 ## Overview
 
-The primary work involved in natively integrating with Connect is
+The primary work involved in natively integrating with service mesh is
 [acquiring the proper TLS certificate](/consul/api-docs/agent/connect#service-leaf-certificate),
 [verifying TLS certificates](/consul/api-docs/agent/connect#certificate-authority-ca-roots),
 and [authorizing inbound connections or requests](/consul/api-docs/connect/intentions#list-matching-intentions).
@@ -55,7 +58,7 @@ Details on the steps are below:
 - **Service discovery** - This is normal service discovery using Consul,
   a static IP, or any other mechanism. If you're using Consul DNS, the
   [`<service>.connect`](/consul/docs/services/discovery/dns-static-lookups#service-mesh-enabled-service-lookups)
-  syntax to find Connect-capable endpoints for a service. After service
+  syntax to find mesh-capable endpoints for a service. After service
   discovery, choose one address from the list of **service addresses**.
 
 - **Mutual TLS** - As a client, connect to the discovered service address
@@ -64,7 +67,7 @@ Details on the steps are below:
   as the client certificate. Verify the remote certificate against the
   [public CA roots](/consul/api-docs/agent/connect#certificate-authority-ca-roots).
   As a client, if the connection is established then you've established
-  a Connect-based connection and there are no further steps!
+  a mesh-based connection and there are no further steps!
 
 - **Authorization** - As a server accepting connections, verify the client
   certificate against the [public CA
@@ -102,8 +105,8 @@ so that new connections are not disrupted. This can be done through
 Consul blocking queries (HTTP long polling) or through periodic polling.
 
 The API calls for
-[acquiring a leaf TLS certificate](/consul/api-docs/agent/connect#service-leaf-certificate)
-and [reading CA roots](/consul/api-docs/agent/connect#certificate-authority-ca-roots)
+[acquiring a service mesh TLS certificate](/consul/api-docs/agent/connect#service-leaf-certificate)
+and [reading service mesh CA roots](/consul/api-docs/agent/connect#certificate-authority-ca-roots)
 both support
 [blocking queries](/consul/api-docs/features/blocking). By using blocking
 queries, an application can efficiently wait for an updated value. For example,
@@ -121,7 +124,7 @@ certificate endpoints frequently, such as multiple times per minute.
 The overhead for the blocking queries (long or periodic polling) is minimal.
 The API calls are to the local agent and the local agent uses locally
 cached data multiplexed over a single TCP connection to the Consul leader.
-Even if a single machine has 1,000 Connect-enabled services all blocking
+Even if a single machine has 1,000 mesh-enabled services all blocking
 on certificate updates, this translates to only one TCP connection to the
 Consul server.
 
@@ -131,9 +134,9 @@ and locally caching the certificates.
 
 ## Service registration
 
-Connect-native applications must tell Consul that they support Connect
+Mesh-native applications must tell Consul that they support service mesh
 natively. This enables the service to be returned as part of service
-discovery for service mesh-capable services used by other Connect-native applications
+discovery for service mesh-capable services used by other mesh-native applications
 and client [proxies](/consul/docs/connect/proxies).
 
 You can enable native service mesh support directly in the [service definition](/consul/docs/services/configuration/services-configuration-reference#connect) by configuring the `connect` block. In the following example, the `redis` service is configured to support service mesh natively:
@@ -150,6 +153,6 @@ You can enable native service mesh support directly in the [service definition](
 }
 ```
 
-Services that support Connect natively are still returned through the standard
-service discovery mechanisms in addition to the Connect-only service discovery
+Services that support service mesh natively are still returned through the standard
+service discovery mechanisms in addition to the mesh-only service discovery
 mechanisms.
diff --git a/website/content/docs/connect/nomad.mdx b/website/content/docs/connect/nomad.mdx
index cd4849fbaf13..cc3a7c9034df 100644
--- a/website/content/docs/connect/nomad.mdx
+++ b/website/content/docs/connect/nomad.mdx
@@ -7,20 +7,20 @@ description: >-
 
 # Consul and Nomad Integration
 
-Consul Connect can be used with [Nomad](https://www.nomadproject.io/) to provide
+Consul service mesh can be used with [Nomad](https://www.nomadproject.io/) to provide
 secure service-to-service communication between Nomad jobs and task groups.
 Nomad is a simple, flexible scheduler and workload orchestrator. The ability to
 use the [dynamic port](/nomad/docs/job-specification/network#dynamic-ports)
-feature of Nomad makes Connect reduces operational complexity.
+feature of Nomad with Consul service mesh reduces operational complexity.
 
 For more information
-about using Consul Connect with Nomad, select one of the following resources.
+about using Consul service mesh with Nomad, select one of the following resources.
 
-For a step-by-step guide on using Consul Connect with Nomad:
+For a step-by-step guide on using Consul service mesh with Nomad:
 
-- [Nomad Consul Connect Guide](/nomad/docs/integrations/consul-connect)
+- [Nomad with Consul service mesh Guide](/nomad/docs/integrations/consul-connect)
 
-For reference information about configuring Nomad jobs to use Consul Connect:
+For reference information about configuring Nomad jobs to use Consul service mesh:
 
 - [Nomad Job Specification - `connect`](/nomad/docs/job-specification/connect)
 - [Nomad Job Specification - `sidecar_service`](/nomad/docs/job-specification/sidecar_service)
diff --git a/website/content/docs/connect/observability/index.mdx b/website/content/docs/connect/observability/index.mdx
index 23dfd81b19ee..35db2edd4b49 100644
--- a/website/content/docs/connect/observability/index.mdx
+++ b/website/content/docs/connect/observability/index.mdx
@@ -7,7 +7,7 @@ description: >-
 
 # Service Mesh Observability Overview
 
-In order to take advantage of Connect's L7 observability features you will need
+In order to take advantage of the service mesh's L7 observability features you will need
 to:
 
 - Deploy sidecar proxies that are capable of emitting metrics with each of your
@@ -39,7 +39,7 @@ config {
 }
 ```
 
-Find other possible metrics syncs in the [Connect Envoy documentation](/consul/docs/connect/proxies/envoy#bootstrap-configuration).
+Find other possible metrics syncs in the [Envoy documentation](/consul/docs/connect/proxies/envoy#bootstrap-configuration).
 
 ### Service protocol
 
diff --git a/website/content/docs/connect/observability/ui-visualization.mdx b/website/content/docs/connect/observability/ui-visualization.mdx
index b1a6f2a18083..8e109e74b159 100644
--- a/website/content/docs/connect/observability/ui-visualization.mdx
+++ b/website/content/docs/connect/observability/ui-visualization.mdx
@@ -14,8 +14,7 @@ show a service's immediate connectivity at a glance. It is not intended as a
 replacement for dedicated monitoring solutions, but rather as a quick overview
 of the state of a service and its connections within the Service Mesh.
 
-The topology visualization requires services to be using [Consul
-Connect](/consul/docs/connect) via [side-car proxies](/consul/docs/connect/proxies).
+The topology visualization requires services to be using [service mesh](/consul/docs/connect) via [sidecar proxies](/consul/docs/connect/proxies).
 
 The visualization may optionally be configured to include a link to an external
 per-service dashboard. This is designed to provide convenient deep links to your
@@ -718,7 +717,7 @@ Currently there are some limitations to this feature.
   access likely only has metrics for the local datacenter and a full solution
   would need additional proxying or exposing remote Prometheus servers on the
   network in remote datacenters. Later we may support an easy way to set this up
-  via Consul Connect but initially we don't attempt to fetch metrics in the UI
+  via Consul service mesh but initially we don't attempt to fetch metrics in the UI
   if you are browsing a remote datacenter.
 
 - **Built-in provider requires metrics proxy** Initially the built-in
diff --git a/website/content/docs/connect/proxies/built-in.mdx b/website/content/docs/connect/proxies/built-in.mdx
index 87f6fb4292fa..c393d4648a89 100644
--- a/website/content/docs/connect/proxies/built-in.mdx
+++ b/website/content/docs/connect/proxies/built-in.mdx
@@ -8,11 +8,11 @@ description: >-
 # Built-in Proxy Configuration for Service Mesh
 
 ~> **Note:** The built-in proxy is not supported for production deployments. It does not
-support many of the Connect service mesh features, and is not under active development.
+support many of Consul's service mesh features, and is not under active development.
 The [Envoy proxy](/consul/docs/connect/proxies/envoy) should be used for production deployments.
 
 Consul comes with a built-in L4 proxy for testing and development with Consul
-Connect service mesh.
+service mesh.
 
 ## Proxy Config Key Reference
 
@@ -61,7 +61,7 @@ All fields are optional with a reasonable default.
   that the proxy should use to connect to the local application instance. By default
   it assumes `127.0.0.1` as the address and takes the port from the service definition's
   `port` field. Note that allowing the application to listen on any non-loopback
-  address may expose it externally and bypass Connect's access enforcement. It may
+  address may expose it externally and bypass the service mesh's access enforcement. It may
   be useful though to allow non-standard loopback addresses or where an alternative
   known-private IP is available for example when using internal networking between
   containers.
diff --git a/website/content/docs/connect/proxies/envoy.mdx b/website/content/docs/connect/proxies/envoy.mdx
index 53f6d816ad6e..ec2ae96ca0f6 100644
--- a/website/content/docs/connect/proxies/envoy.mdx
+++ b/website/content/docs/connect/proxies/envoy.mdx
@@ -7,7 +7,7 @@ description: >-
 
 # Envoy Proxy Configuration for Service Mesh
 
-Consul Connect has first class support for using
+Consul service mesh has first class support for using
 [Envoy](https://www.envoyproxy.io) as a proxy. Consul configures Envoy by
 optionally exposing a gRPC service on the local agent that serves [Envoy's xDS
 configuration
@@ -55,7 +55,7 @@ The Consul dataplane component was introduced in Consul v1.14 as a way to manage
 ## Getting Started
 
 To get started with Envoy and see a working example you can follow the [Using
-Envoy with Connect](/consul/tutorials/developer-mesh/service-mesh-with-envoy-proxy?utm_source=docs) tutorial.
+Envoy with Consul service mesh](/consul/tutorials/developer-mesh/service-mesh-with-envoy-proxy?utm_source=docs) tutorial.
 
 ## Configuration
 
@@ -68,7 +68,7 @@ identity (node id) and the location of its local Consul agent from which it
 discovers all of its dynamic configuration. See [Bootstrap
 Configuration](#bootstrap-configuration) for more details.
 
-The dynamic configuration Consul Connect provides to each Envoy instance includes:
+The dynamic configuration Consul service mesh provides to each Envoy instance includes:
 
 - TLS certificates and keys to enable mutual authentication and keep certificates
   rotating.
@@ -79,11 +79,11 @@ The dynamic configuration Consul Connect provides to each Envoy instance include
 - Configuration to [expose specific HTTP paths](/consul/docs/connect/registration/service-registration#expose-paths-configuration-reference).
 
 For more information on the parts of the Envoy proxy runtime configuration
-that are currently controllable via Consul Connect see [Dynamic
+that are currently controllable via Consul service mesh, refer to [Dynamic
 Configuration](#dynamic-configuration).
 
 We plan to enable more and more of Envoy's features through
-Connect's first-class configuration over time, however some advanced users will
+Consul service mesh's first-class configuration over time, however some advanced users will
 need additional control to configure Envoy in specific ways. To enable this, we
 provide several ["escape hatch"](#advanced-configuration) options that allow
 users to provide low-level raw Envoy config syntax for some sub-components in each
@@ -287,11 +287,11 @@ the [global `proxy-defaults` configuration
 entry](/consul/docs/connect/config-entries/proxy-defaults) to act as
 defaults that are inherited by all services.
 
-- `protocol` - The protocol the service speaks. Connect's Envoy integration
+- `protocol` - The protocol the service speaks. Consul service mesh's Envoy integration
   currently supports the following `protocol` values:
 
   - `tcp` - Unless otherwise specified this is the default, which causes Envoy
-    to proxy at L4. This provides all the security benefits of Connect's mTLS
+    to proxy at L4. This provides all the security benefits of the service mesh's mTLS
     and works for any TCP-based protocol. Load-balancing and metrics are
     available at the connection level.
   - `http` - This specifies that the service speaks HTTP/1.x. Envoy will setup an
@@ -504,13 +504,13 @@ manually code the entire configuration in protobuf JSON.
 
 ~> **Advanced Topic!** This section covers options that allow users to take almost
 complete control of Envoy's configuration. We provide these options so users can
-experiment or take advantage of features not yet fully supported in Consul Connect. We
+experiment or take advantage of features not yet fully supported in Consul service mesh. We
 plan to retain this ability in the future, but it should still be considered
 experimental because it requires in-depth knowledge of Envoy's configuration format.
 Users should consider Envoy version compatibility when using these features because they can configure Envoy in ways that
 are outside of Consul's control. Incorrect configuration could prevent all
 proxies in your mesh from functioning correctly, or bypass the security
-guarantees Connect is designed to enforce.
+guarantees Consul service mesh is designed to enforce.
 
 ### Configuration Formatting
 
@@ -648,7 +648,7 @@ definition](/consul/docs/connect/registration/service-registration) or
 - `envoy_extra_static_listeners_json` - Similar to
   `envoy_extra_static_clusters_json` but appends one or more [Envoy listeners](https://www.envoyproxy.io/docs/envoy/v1.17.2/api-v3/config/listener/v3/listener.proto) to the array of [static
   listener](https://www.envoyproxy.io/docs/envoy/v1.17.2/api-v3/config/bootstrap/v3/bootstrap.proto#envoy-v3-api-field-config-bootstrap-v3-bootstrap-staticresources-listeners) definitions.
-  Can be used to setup limited access that bypasses Connect mTLS or
+  Can be used to setup limited access that bypasses the service mesh's mTLS or
   authorization for health checks or metrics.
 
   <CodeBlockConfig heading="Example envoy_extra_static_listeners_json">
@@ -807,11 +807,11 @@ definition](/consul/docs/connect/registration/service-registration) or
 
   - Every `FilterChain` added to the listener will have its `TlsContext`
     overridden by the Connect TLS certificates and validation context. This
-    means there is no way to override Connect's mutual TLS for the public
+    means there is no way to override the service mesh's mutual TLS for the public
     listener.
   - Every `FilterChain` will have the `envoy.filters.{network|http}.rbac` filter
     prepended to the filters array to ensure that all inbound connections are
-    authorized by Connect. Before Consul 1.9.0 `envoy.ext_authz` was inserted instead.
+    authorized by the service mesh. Before Consul 1.9.0 `envoy.ext_authz` was inserted instead.
 
   <CodeTabs heading="Example envoy_public_listener_json" tabs={[ "HTTP", "TCP" ]}>
 
@@ -999,8 +999,8 @@ warning.
   following exceptions:
 
   - Every `FilterChain` added to the listener will have its `TlsContext`
-    overridden by the Connect TLS certificates and validation context. This
-    means there is no way to override Connect's mutual TLS for the public
+    overridden by the service mesh TLS certificates and validation context. This
+    means there is no way to override the service mesh's mutual TLS for the public
     listener.
 
   <CodeTabs heading="Example upstream envoy_listener_json">
diff --git a/website/content/docs/connect/proxies/index.mdx b/website/content/docs/connect/proxies/index.mdx
index f47aad3f5dc7..ff344e56d2d2 100644
--- a/website/content/docs/connect/proxies/index.mdx
+++ b/website/content/docs/connect/proxies/index.mdx
@@ -12,7 +12,7 @@ per-service proxy sidecar transparently handles inbound and outbound service
 connections, automatically wrapping and verifying TLS connections. Consul
 ships with a built-in L4 proxy and has first class support for Envoy. You
 can plug other proxies into your environment as well. This section describes how to
-configure Envoy or the built-in proxy using Connect, and how to integrate the
+configure Envoy or the built-in proxy using Consul service mesh, and how to integrate the
 proxy of your choice.
 
 To ensure that services only allow external connections established through
diff --git a/website/content/docs/connect/proxies/integrate.mdx b/website/content/docs/connect/proxies/integrate.mdx
index 24b9208af61a..1ad9f4b91156 100644
--- a/website/content/docs/connect/proxies/integrate.mdx
+++ b/website/content/docs/connect/proxies/integrate.mdx
@@ -11,17 +11,20 @@ This topic describes the process and API endpoints you can use to extend proxies
 
 ## Overview
 
-You can extend any proxy to support Connect. Consul ships with a built-in
+You can extend any proxy to support Consul service mesh. Consul ships with a built-in
 proxy suitable for an out-of-the-box development experience, but you may require a more robust proxy solution for production environments.
 
 The proxy you integrate must be able to accept inbound connections and/or establish outbound connections identified as a particular service. In some cases, either ability may be acceptable, but both are generally required to support for full sidecar functionality.
 
 Sidecar proxies may support L4 or L7 network functionality. L4 integration is simpler and adequate for securing all traffic. L4 treats all traffic as TCP, however, so advanced routing or metrics features are not supported.
 
-Full L7 support is built on top of L4 support. An L7 proxy integration supports most or all of the L7 traffic routing features in Connect by dynamically configuring routing, retries, and other L7 features. The built-in proxy only supports L4, while [Envoy](/consul/docs/connect/proxies/envoy) supports the full L7 feature set.
+Full L7 support is built on top of L4 support. An L7 proxy integration supports most or all of the L7 traffic routing features in Consul service mesh by dynamically configuring routing, retries, and other L7 features. The built-in proxy only supports L4, while [Envoy](/consul/docs/connect/proxies/envoy) supports the full L7 feature set.
 
 Areas where the integration approach differs between L4 and L7 are identified in this topic.
 
+The noun _connect_ is used throughout this documentation to refer to the connect
+subsystem that provides Consul's service mesh capabilities.
+
 ## Accepting Inbound Connections
 
 The proxy must accept TLS connections on some port to accept inbound connections.
@@ -38,7 +41,7 @@ $ curl http://<host-ip>:8500/v1/agent/connect/ca/leaf/<service-name>
 
 </CodeBlockConfig>
 
-The client certificate from the inbound connection must be validated against the Connect CA root certificates. Call the [`/v1/agent/connect/ca/roots`] endpoint to obtain the root certificates from the Connect CA, e.g.:
+The client certificate from the inbound connection must be validated against the service mesh CA root certificates. Call the [`/v1/agent/connect/ca/roots`] endpoint to obtain the root certificates from the service mesh CA, e.g.:
 
 <CodeBlockConfig language="shell-session">
 
@@ -103,7 +106,7 @@ leaf certificate.
 
 ## Establishing Outbound Connections
 
-For outbound connections, the proxy should communicate with a Connect-capable
+For outbound connections, the proxy should communicate with a mesh-capable
 endpoint for a service and provide a client certificate from the
 [`/v1/agent/connect/ca/leaf/`] API endpoint. The proxy must use the root certificate obtained from the [`/v1/agent/connect/ca/roots`] endpoint to verify the certificate served from the destination endpoint.
 
@@ -126,7 +129,7 @@ fetching the discovery chain so that L7 features, such as HTTP routing rules, ar
 not returned.
 
 For each [target](/consul/docs/connect/l7-traffic/discovery-chain#targets) in the resulting
-discovery chain, a list of healthy, Connect-capable endpoints may be fetched
+discovery chain, a list of healthy, mesh-capable endpoints may be fetched
 from the [`/v1/health/connect/:service_id`] API endpoint as described in the [Service
 Discovery](#service-discovery) section.
 
@@ -138,7 +141,7 @@ documentation for details about supported configuration parameters.
 
 ### Service Discovery
 
-Proxies can use Consul's [service discovery API](/consul/api-docs/health#list-service-instances-for-connect-enabled-service) to return all available, Connect-capable endpoints for a given service. This endpoint supports a `cached` query parameter, which uses [agent caching](/consul/api-docs/features/caching) to improve
+Proxies can use Consul's [service discovery API](/consul/api-docs/health#list-service-instances-for-mesh-enabled-service) to return all available, mesh-capable endpoints for a given service. This endpoint supports a `cached` query parameter, which uses [agent caching](/consul/api-docs/features/caching) to improve
 performance. The API package provides a [`UseCache`] query option to leverage caching.
 In addition to performance improvements, using the cache makes the mesh more resilient to Consul server outages. This is because the mesh "fails static" with the last known set of service instances still used, rather than errors on new connections.
 
diff --git a/website/content/docs/connect/registration/service-registration.mdx b/website/content/docs/connect/registration/service-registration.mdx
index 666f739fa17c..57050476dcf4 100644
--- a/website/content/docs/connect/registration/service-registration.mdx
+++ b/website/content/docs/connect/registration/service-registration.mdx
@@ -7,7 +7,7 @@ description: >-
 
 # Register a Service Mesh Proxy Outside of a Service Registration
 
-This topic describes how to declare a proxy as a `connect-proxy` in service definitions. The `kind` must be declared and information about the service they represent must be provided to function as a Consul service mesh proxy.
+This topic describes how to declare a service mesh proxy in a service definition. The `kind` must be declared and information about the service they represent must be provided to function as a Consul service mesh proxy.
 
 
 ## Configuration
@@ -53,7 +53,7 @@ You can specify several additional parameters to configure the proxy to meet you
 
 ### Example
 
-In the following example, a proxy named `redis-proxy` is registered as a service mesh proxy. It proxies to the `redis` service and is available at port `8181`. As a result, any service mesh clients searching for a Connect-capable endpoint for `redis` will find this proxy.
+In the following example, a proxy named `redis-proxy` is registered as a service mesh proxy. It proxies to the `redis` service and is available at port `8181`. As a result, any service mesh clients searching for a mesh-capable endpoint for `redis` will find this proxy.
 
 <CodeTabs heading="Minimal example of a service mesh proxy">
 
@@ -378,7 +378,7 @@ The following examples show all possible mesh gateway configurations.
 The following examples show possible configurations to expose HTTP paths through Envoy.
 
 Exposing paths through Envoy enables a service to protect itself by only listening on localhost, while still allowing
-non-Connect-enabled applications to contact an HTTP endpoint.
+non-mesh-enabled applications to contact an HTTP endpoint.
 Some examples include: exposing a `/metrics` path for Prometheus or `/healthz` for kubelet liveness checks.
  
 Note that the examples in this topic use snake case, which is a convention that separates words with underscores, because the format is supported in configuration files and API registrations.
diff --git a/website/content/docs/connect/registration/sidecar-service.mdx b/website/content/docs/connect/registration/sidecar-service.mdx
index cfda3b22ab79..46e14869c31e 100644
--- a/website/content/docs/connect/registration/sidecar-service.mdx
+++ b/website/content/docs/connect/registration/sidecar-service.mdx
@@ -149,7 +149,7 @@ The following fields are not supported in the `connect.sidecar_service` block:
   service.
 - `connect.sidecar_service` - Service definitions can't be nested recursively.
 - `connect.native` - Currently the `kind` is fixed to `connect-proxy` and it's
-  an error to register a `connect-proxy` that is also Connect-native.
+  an error to register a `connect-proxy` that is also service mesh-native.
 
 ## Lifecycle
 
diff --git a/website/content/docs/connect/security.mdx b/website/content/docs/connect/security.mdx
index 31fa331da63a..42ce8d0d1e49 100644
--- a/website/content/docs/connect/security.mdx
+++ b/website/content/docs/connect/security.mdx
@@ -7,15 +7,15 @@ description: >-
 
 # Best Practices for Service Mesh Security
 
-Connect enables secure service-to-service communication over mutual TLS. This
+Consul service mesh enables secure service-to-service communication over mutual TLS. This
 provides both in-transit data encryption as well as authorization. This page
-will document how to secure Connect. To try Connect locally, complete the
+will document how to secure the service mesh. To try service mesh locally, complete the
 [Getting Started guide](/consul/tutorials/kubernetes-deploy/service-mesh?utm_source=docs) or for a full security model reference,
 see the dedicated [Consul security model](/consul/docs/security) page. When
-setting up Connect in production, review this [tutorial](/consul/tutorials/developer-mesh/service-mesh-production-checklist?utm_source=consul.io&utm_medium=docs).
+setting up service mesh in production, review this [tutorial](/consul/tutorials/developer-mesh/service-mesh-production-checklist?utm_source=consul.io&utm_medium=docs).
 
-Connect will function in any Consul configuration. However, unless the checklist
-below is satisfied, Connect is not providing the security guarantees it was
+Consul service mesh will function in any Consul configuration. However, unless the checklist
+below is satisfied, the service mesh is not providing the security guarantees it was
 built for. The checklist below can be incrementally adopted towards full
 security if you prefer to operate in less secure models initially.
 
@@ -49,7 +49,7 @@ TCP and UDP encryption must be enabled to prevent plaintext communication
 between Consul agents. At a minimum, `verify_outgoing` should be enabled
 to verify server authenticity with each server having a unique TLS certificate.
 `verify_incoming` provides additional agent verification, but doesn't directly
-affect Connect since requests must also always contain a valid ACL token.
+affect service mesh since requests must also always contain a valid ACL token.
 Clients calling Consul APIs should be forced over encrypted connections.
 
 See the [Consul agent encryption page](/consul/docs/security/encryption) to
@@ -72,7 +72,7 @@ general, the blast radius of unauthorized access for client agent directories
 is much smaller than servers. However, both must be protected against
 unauthorized access.
 
-### Prevent Non-Connect Traffic to Services
+### Prevent Non-Mesh Traffic to Services
 
 For services that are using
 [proxies](/consul/docs/connect/proxies)
@@ -85,16 +85,16 @@ network namespacing techniques provided by the underlying operating system.
 For scenarios where multiple services are running on the same machine
 without isolation, these services must all be trusted. We call this the
 **trusted multi-tenancy** deployment model. Any service could theoretically
-connect to any other service via the loopback listener, bypassing Connect
+connect to any other service via the loopback listener, bypassing the service mesh
 completely. In this scenario, all services must be trusted _or_ isolation
 mechanisms must be used.
 
 For developer or operator access to a service, we recommend
-using a local Connect proxy. This is documented in the
+using a local service mesh proxy. This is documented in the
 [development and debugging guide](/consul/docs/connect/dev).
 
 **If non-proxy traffic can communicate with the service**, this traffic
-will not be encrypted or authorized via Connect.
+will not be encrypted or authorized via service mesh.
 
 ### Restrict Access to Envoy's Administration Interface
 
diff --git a/website/content/docs/connect/transparent-proxy.mdx b/website/content/docs/connect/transparent-proxy.mdx
index cf0b56c96e47..59a00e65077e 100644
--- a/website/content/docs/connect/transparent-proxy.mdx
+++ b/website/content/docs/connect/transparent-proxy.mdx
@@ -276,7 +276,7 @@ spec:
 Additional services can query the [KubeDNS](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/) at `sample-app.default.svc.cluster.local` to reach `sample-app`. If ACLs are enabled and configured with default `deny` policies, the configuration also requires a [`ServiceIntention`](/consul/docs/connect/config-entries/service-intentions) to allow it to talk to `sample-app`.
 
 ### Headless Services
-For services that are not addressed using a virtual cluster IP, you must configure the upstream service using the [DialedDirectly](/consul/docs/connect/config-entries/service-defaults#dialeddirectly) option. Then, use DNS to discover individual instance addresses and dial them through the transparent proxy. When this mode is enabled on the upstream, services present connect certificates for mTLS and intentions are enforced at the destination.
+For services that are not addressed using a virtual cluster IP, you must configure the upstream service using the [DialedDirectly](/consul/docs/connect/config-entries/service-defaults#dialeddirectly) option. Then, use DNS to discover individual instance addresses and dial them through the transparent proxy. When this mode is enabled on the upstream, services present service mesh certificates for mTLS and intentions are enforced at the destination.
 
 Note that when dialing individual instances, Consul ignores the HTTP routing rules configured with configuration entries. The transparent proxy acts as a TCP proxy to the original destination IP address.
 
diff --git a/website/content/docs/ecs/index.mdx b/website/content/docs/ecs/index.mdx
index 20c7b2729672..4ec719bcac9b 100644
--- a/website/content/docs/ecs/index.mdx
+++ b/website/content/docs/ecs/index.mdx
@@ -22,7 +22,7 @@ traffic policy, and more. You can also connect service meshes so that services d
 Consul on ECS follows an [architecture](/consul/docs/architecture) similar to other platforms, but each ECS task is a
 Consul node. An ECS task runs the user application container(s), as well as a Consul client container for control plane
 communication and an [Envoy](https://envoyproxy.io/) sidecar proxy container to facilitate data plane communication for
-[Consul Connect](/consul/docs/connect).
+[Consul service mesh](/consul/docs/connect).
 
 For a detailed architecture overview, see the [Architecture](/consul/docs/ecs/architecture) page.
 
diff --git a/website/content/docs/ecs/manual/install.mdx b/website/content/docs/ecs/manual/install.mdx
index dddb9b310e50..ffe7c8058498 100644
--- a/website/content/docs/ecs/manual/install.mdx
+++ b/website/content/docs/ecs/manual/install.mdx
@@ -127,7 +127,7 @@ See the [ECS Task Definition](https://docs.aws.amazon.com/AmazonECS/latest/devel
 
 ## `sidecar-proxy` container
 
-The `sidecar-proxy` container runs [Envoy proxy](/consul/docs/connect/proxies/envoy) for Consul Connect. In most cases, the container should contain the following parameters and values.
+The `sidecar-proxy` container runs [Envoy proxy](/consul/docs/connect/proxies/envoy) for Consul service mesh. In most cases, the container should contain the following parameters and values.
 
 The `mountPoints` list must be set as shown in the following example. This will mount the shared `consul_data` volume into the
 `sidecar-proxy` container at the path `/consul`. This volume is where the `consul-ecs-mesh-init` container copies the `envoy-bootstrap.json`
diff --git a/website/content/docs/guides/index.mdx b/website/content/docs/guides/index.mdx
index 02427c8b44b7..24f96d794a01 100644
--- a/website/content/docs/guides/index.mdx
+++ b/website/content/docs/guides/index.mdx
@@ -33,6 +33,6 @@ Tracks include:
 - Day 1: Kubernetes Production Deployment
 - Maintenance and Monitoring Operations
 - Service Discovery and Consul DNS
-- Service Segmentation and Consul Connect
+- Service Segmentation and Consul Service Mesh
 - Service Configuration and Consul KV
 - Cloud and Load Balancer Integrations
diff --git a/website/content/docs/install/performance.mdx b/website/content/docs/install/performance.mdx
index 7ab46b2d36eb..778f4ad66989 100644
--- a/website/content/docs/install/performance.mdx
+++ b/website/content/docs/install/performance.mdx
@@ -172,9 +172,9 @@ To prevent any CPU spikes from a misconfigured client, RPC requests to the serve
 
 In addition, two [performance indicators](/consul/docs/agent/telemetry) &mdash; `consul.runtime.alloc_bytes` and `consul.runtime.heap_objects` &mdash; can help diagnose if the current sizing is not adequately meeting the load.
 
-## Connect Certificate Signing CPU Limits
+## Service Mesh Certificate Signing CPU Limits
 
-If you enable [Connect](/consul/docs/connect), the leader server will need
+If you enable [service mesh](/consul/docs/connect), the leader server will need
 to perform public key signing operations for every service instance in the
 cluster. Typically these operations are fast on modern hardware, however when
 the CA is changed or its key rotated, the leader will face an influx of
@@ -194,11 +194,11 @@ operations could impact the server's normal work. To limit that, Consul since
 
 By default we set a limit of 50 per second which is reasonable on modest
 hardware but may be too low and impact rotation times if more than 1500 service
-instances are using Connect in the cluster. `csr_max_per_second` is likely best
+instances are using service mesh in the cluster. `csr_max_per_second` is likely best
 if you have fewer than four cores available since a whole core being used by
 signing is likely to impact the server stability if it's all or a large portion
 of the cores available. The downside is that you need to capacity plan: how many
-service instances will need Connect certificates? What CSR rate can your server
+service instances will need service mesh certificates? What CSR rate can your server
 tolerate without impacting stability? How fast do you want CA rotations to
 process?
 
diff --git a/website/content/docs/integrate/download-tools.mdx b/website/content/docs/integrate/download-tools.mdx
index b348e82a66da..71ad08504a1c 100644
--- a/website/content/docs/integrate/download-tools.mdx
+++ b/website/content/docs/integrate/download-tools.mdx
@@ -47,7 +47,7 @@ These Consul tools are created and managed by the amazing members of the Consul
 - [fabio](https://github.com/eBay/fabio) - Fast, zero-conf, consul-aware load-balancing HTTP/HTTPS router
 - [files-to-consul-kv](https://github.com/bitsofinfo/files-to-consul-kv) - Ultra simple, configuration free CLI tool for syncing a directory structure of key-value files to Consul KV using the transactions API. Docker image available. Integrates easily into any CI/CD workflow.
 - [file2consul](https://github.com/joeatbayes/file2consul) - Update Consul values from git or files. Config loader with support for multiple environments. Provides variable expansion, interpolation, inheritance with overrides and ability to update multiple consul servers. Reduces cost of maintaining larger configuration sets between environments by reducing restatement and manual editing of similar or predictably changing config properties. MIT license, Written in GO.
-- [Flightpath](https://docs.flightpath.xyz/) - An xDS server that can configure Envoy to act as an Edge proxy for Consul Connect enabled services
+- [Flightpath](https://docs.flightpath.xyz/) - An xDS server that can configure Envoy to act as an Edge proxy for Consul service mesh enabled services
 - [git2consul](https://github.com/ryanbreen/git2consul) - Mirror the contents of a Git repository into Consul KVs
 - [gobetween](https://github.com/yyyar/gobetween) - Modern & minimalistic load balancer and reverse-proxy for the ☁️ Cloud era.
 - [Gonsul](https://github.com/miniclip/gonsul) - A Git to Consul standalone tool made in Go. Updates Consul KV from a repo with multiple strategies.
diff --git a/website/content/docs/integrate/partnerships.mdx b/website/content/docs/integrate/partnerships.mdx
index 9f2334af7916..5aca93da318a 100644
--- a/website/content/docs/integrate/partnerships.mdx
+++ b/website/content/docs/integrate/partnerships.mdx
@@ -27,7 +27,7 @@ By leveraging Consul's RESTful HTTP API system, prospective partners are able to
 
 </ImageConfig>
 
-**Data Plane**: These integrations extend Consul's certificate management, secure ACL configuration, observability metrics and logging, and service discovery that allows for dynamic service mapping APM and logging tools, extend sidecar proxies to support Consul connect, and extend API gateways to allow Consul to route incoming traffic to the proxies for Connect-enabled services.
+**Data Plane**: These integrations extend Consul's certificate management, secure ACL configuration, observability metrics and logging, and service discovery that allows for dynamic service mapping APM and logging tools, extend sidecar proxies to support Consul service mesh, and extend API gateways to allow Consul to route incoming traffic to the proxies for mesh-enabled services.
 
 **Control Plane**: Consul has a client-server architecture and is the control plane for the service mesh.
 
diff --git a/website/content/docs/k8s/annotations-and-labels.mdx b/website/content/docs/k8s/annotations-and-labels.mdx
index f28f6dd5fa64..eea3e620c1e8 100644
--- a/website/content/docs/k8s/annotations-and-labels.mdx
+++ b/website/content/docs/k8s/annotations-and-labels.mdx
@@ -2,7 +2,7 @@
 layout: docs
 page_title: Annotations and Labels
 description: >-
-  Annotations and labels configure Consul sidecar properties and injection behavior when scheduling Kubernetes clusters. Learn about the annotations and labels that enable Consul’s service mesh and secure upstream communication on k8s in this reference guide.
+  Annotations and labels configure service mesh sidecar properties and injection behavior when scheduling Kubernetes clusters. Learn about the annotations and labels that enable Consul’s service mesh and secure upstream communication on k8s in this reference guide.
 ---
 
 # Annotations and Labels
@@ -15,6 +15,9 @@ This allows the user to configure natively configure Consul on select Kubernetes
 - [Annotations](#annotations)
 - [Labels](#labels)
 
+The noun _connect_ is used throughout this documentation to refer to the connect
+subsystem that provides Consul's service mesh capabilities.
+
 ## Annotations
 
 The following Kubernetes resource annotations could be used on a pod to control connect-inject behavior:
@@ -69,7 +72,7 @@ The following Kubernetes resource annotations could be used on a pod to control
   public listener will listen on a dynamic port.
 
 - `consul.hashicorp.com/connect-service-upstreams` - The list of upstream
-  services that this pod needs to connect to via Connect along with a static
+  services that this pod needs to connect to via the service mesh along with a static
   local port to listen for those connections. When transparent proxy is enabled,
   this annotation is optional. There are a few formats this annotation can take:
 
@@ -236,8 +239,8 @@ The following Kubernetes resource annotations could be used on a pod to control
 - `consul.hashicorp.com/prometheus-key-file` - Local filesystem path to a private key file for Envoy to use
   when serving TLS on the Prometheus metrics endpoint. Only applicable when `envoy_prometheus_bind_addr`
   is set in proxy config.
-- `consul.hashicorp.com/service-metrics-port` - Set the port where the Connect service exposes metrics.
-- `consul.hashicorp.com/service-metrics-path` - Set the path where the Connect service exposes metrics.
+- `consul.hashicorp.com/service-metrics-port` - Set the port where the mesh service exposes metrics.
+- `consul.hashicorp.com/service-metrics-path` - Set the path where the mesh service exposes metrics.
 - `consul.hashicorp.com/connect-inject-mount-volume` - Comma separated list of container names to mount the connect-inject volume into. The volume will be mounted at `/consul/connect-inject`. The connect-inject volume contains Consul internals data needed by the other sidecar containers, for example the `consul` binary, and the Pod's Consul ACL token. This data can be valuable for advanced use-cases, such as making requests to the Consul API from within application containers.
 - `consul.hashicorp.com/consul-sidecar-user-volume` - JSON objects as specified by the [Volume pod spec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#volume-v1-core), that define volumes to add to the Envoy sidecar.
   ```yaml
diff --git a/website/content/docs/k8s/connect/connect-ca-provider.mdx b/website/content/docs/k8s/connect/connect-ca-provider.mdx
index 1699da1dab12..cdab172bcc21 100644
--- a/website/content/docs/k8s/connect/connect-ca-provider.mdx
+++ b/website/content/docs/k8s/connect/connect-ca-provider.mdx
@@ -1,13 +1,13 @@
 ---
 layout: docs
-page_title: Configure Certificate Authority (CA) for Consul on Kubernetes
+page_title: Configure Service Mesh Certificate Authority (CA) for Consul on Kubernetes
 description: >-
   Consul includes a built-in CA, but when bootstrapping a cluster on k8s, you can configure your service mesh to use a custom certificate provider instead. Learn how to configure Vault as an external CA in primary and secondary datacenters and manually rotate Vault tokens.
 ---
 
-#  Configure Certificate Authority for Consul on Kubernetes
+#  Configure Service Mesh Certificate Authority for Consul on Kubernetes
 
-If `connect` is enabled, the built-in Consul certificate authority (CA) is automatically enabled for the service mesh CA. You can use different CA providers with Consul service mesh. Refer to [Connect Certificate Management](/consul/docs/connect/ca) for supported providers. 
+If `connect` is enabled, the built-in Consul CA provider is automatically enabled for the service mesh certificate authority (CA). You can use different CA providers with Consul service mesh. Refer to [Service Mesh Certificate Management](/consul/docs/connect/ca) for supported providers.
 
 ## Overview
 
@@ -21,20 +21,20 @@ To configure an external CA provider using the Consul Helm chart, complete the f
 
 To configure the Vault service mesh provider, refer to [Vault as the Service Mesh Certificate Provider on Kubernetes](/consul/docs/k8s/deployment-configurations/vault/data-integration/connect-ca).
 
-## Configuring Vault as a Connect CA (Consul K8s 0.37.0 and earlier)
+## Configuring Vault as a Service Mesh CA (Consul K8s 0.37.0 and earlier)
 
 
-If you use Vault 1.11.0+ as Consul's Connect CA, versions of Consul released before Dec 13, 2022 will develop an issue with Consul control plane or service mesh communication ([GH-15525](https://github.com/hashicorp/consul/pull/15525)). Use or upgrade to a [Consul version that includes the fix](https://support.hashicorp.com/hc/en-us/articles/11308460105491#01GMC24E6PPGXMRX8DMT4HZYTW) to avoid this problem.
+If you use Vault 1.11.0+ as Consul's service mesh CA, versions of Consul released before Dec 13, 2022 will develop an issue with Consul control plane or service mesh communication ([GH-15525](https://github.com/hashicorp/consul/pull/15525)). Use or upgrade to a [Consul version that includes the fix](https://support.hashicorp.com/hc/en-us/articles/11308460105491#01GMC24E6PPGXMRX8DMT4HZYTW) to avoid this problem.
 
-The following instructions are only valid for Consul K8s CLI 0.37.0 and prior. It describes how to configure Vault as the Connect CA. You can configure other providers during initial bootstrap of the cluster by providing the appropriate [`ca_config`] and [`ca_provider`] values for your provider.
+The following instructions are only valid for Consul K8s CLI 0.37.0 and prior. It describes how to configure Vault as the service mesh CA. You can configure other providers during initial bootstrap of the cluster by providing the appropriate [`ca_config`] and [`ca_provider`] values for your provider.
 
--> **Auto-renewal:** If using Vault as your Connect CA, we strongly recommend Consul 1.8.5 or later, which includes support for token auto-renewal. If the Vault token is [renewable](/vault/api-docs/auth/token#renewable), then Consul automatically renews the token periodically. Otherwise, you must [manually rotate](#manually-rotating-vault-tokens) the Vault token before it expires.
+-> **Auto-renewal:** If using Vault as your service mesh CA, we strongly recommend Consul 1.8.5 or later, which includes support for token auto-renewal. If the Vault token is [renewable](/vault/api-docs/auth/token#renewable), then Consul automatically renews the token periodically. Otherwise, you must [manually rotate](#manually-rotating-vault-tokens) the Vault token before it expires.
 
 ### Primary Datacenter
 
-To configure Vault as a CA provider for Consul Connect,
+To configure Vault as a CA provider for Consul service mesh,
 first, create a provider configuration JSON file.
-Please refer to [Vault as a Connect CA](/consul/docs/connect/ca/vault) for the configuration options.
+Please refer to [Vault as a service mesh CA](/consul/docs/connect/ca/vault) for the configuration options.
 You will need to provide a Vault token to the `token` property.
 Please refer to [these docs](/consul/docs/connect/ca/vault#token) for the permissions that the token needs to have.
 This token should be [renewable](/vault/api-docs/auth/token#renewable).
@@ -142,7 +142,7 @@ $ kubectl exec consul-server-0 -- curl --silent http://localhost:8500/v1/connect
 
 ### Secondary Datacenters
 
-To configure Vault as the Connect CA in secondary datacenters, you need to make sure that the Root CA is the same,
+To configure Vault as the service mesh CA in secondary datacenters, you need to make sure that the Root CA is the same,
 but the intermediate is different for each datacenter. In the `connect` configuration for a secondary datacenter,
 you can specify a `intermediate_pki_path` that is, for example, prefixed with the datacenter
 for which this configuration is intended.
diff --git a/website/content/docs/k8s/connect/index.mdx b/website/content/docs/k8s/connect/index.mdx
index 00e5c8e9383e..7f1dd71c8e8c 100644
--- a/website/content/docs/k8s/connect/index.mdx
+++ b/website/content/docs/k8s/connect/index.mdx
@@ -7,10 +7,15 @@ description: >-
 
 # How does Consul Service Mesh Work on Kubernetes?
 
-[Consul Service Mesh](/consul/docs/connect) is a feature built into to Consul that enables
+[Consul service mesh](/consul/docs/connect) is a feature built into to Consul that enables
 automatic service-to-service authorization and connection encryption across
 your Consul services. Consul Service Mesh can be used with Kubernetes to secure pod
-communication with other pods and external Kubernetes services. _Consul Connect_ refers to the component in Consul that enables service mesh functionality. We sometimes use Connect to mean Consul service mesh throughout the documentation.
+communication with other pods and external Kubernetes services.
+
+The noun _connect_ is used throughout this documentation to refer to the connect
+subsystem that provides Consul's service mesh capabilities.
+Where you encounter the _noun_ connect, it is usually functionality specific to
+service mesh.
 
 Consul can automatically inject the sidecar running Envoy into pods in
 your cluster, making configuration for Kubernetes automatic.
@@ -76,7 +81,7 @@ spec:
       serviceAccountName: static-server
 ```
 
-The only change for Connect is the addition of the
+The only change for service mesh is the addition of the
 `consul.hashicorp.com/connect-inject` annotation. This enables injection
 for the Pod in this Deployment. The injector can also be
 [configured](/consul/docs/k8s/connect#installation-and-configuration)
@@ -89,12 +94,12 @@ the _pod specification template_ as shown above.
 
 This will start a sidecar proxy that listens on port `20000` registered
 with Consul and proxies valid inbound connections to port 8080 in the pod.
-To establish a connection to the pod using Connect, a client must use another Connect
-proxy. The client Connect proxy will use Consul service discovery to find
+To establish a connection to the pod using service mesh, a client must use another mesh
+proxy. The client mesh proxy will use Consul service discovery to find
 all available upstream proxies and their public ports.
 
 In the example above, the server is listening on `:8080`.
-By default, the Consul Service Mesh runs in [transparent proxy](/consul/docs/connect/transparent-proxy) mode.
+By default, the Consul service mesh runs in [transparent proxy](/consul/docs/connect/transparent-proxy) mode.
 This means that even though the server binds to all interfaces,
 the inbound and outbound connections will automatically go through to the sidecar proxy.
 It also allows you to use Kubernetes DNS like you normally would without the
@@ -108,12 +113,12 @@ The service name registered in Consul will be set to the name of the Kubernetes
 associated with the Pod. This can be customized with the `consul.hashicorp.com/connect-service`
 annotation. If using ACLs, this name must be the same as the Pod's `ServiceAccount` name.
 
-### Connecting to Connect-Enabled Services
+### Connecting to Mesh-Enabled Services
 
 The example Deployment specification below configures a Deployment that is capable
 of establishing connections to our previous example "static-server" service. The
 connection to this static text service happens over an authorized and encrypted
-connection via Connect.
+connection via service mesh.
 
 -> **Note:** As of consul-k8s `v0.26.0` and Consul Helm `v0.32.0`, having a Kubernetes
 Service is **required** to run services on the Consul Service Mesh.
@@ -173,7 +178,7 @@ the injector will also set environment variables `<NAME>_CONNECT_SERVICE_HOST`
 and `<NAME>_CONNECT_SERVICE_PORT` in every container in the Pod for every defined
 upstream. This is analogous to the standard Kubernetes service environment variables, but
 point instead to the correct local proxy port to establish connections via
-Connect.
+service mesh.
 
 You can verify access to the static text server using `kubectl exec`.
 Because transparent proxy is enabled by default,
@@ -327,7 +332,7 @@ spec:
 ```
 
 After deploying the `web` application, you can test service mesh connections by deploying the `static-client`
-application with the configuration in the [previous section](#connecting-to-connect-enabled-services) and add the
+application with the configuration in the [previous section](#connecting-to-mesh-enabled-services) and add the
 following annotation to the pod template on `static-client`:
 ```yaml
 consul.hashicorp.com/connect-service-upstreams: "web:1234,web-admin:2234"
@@ -366,15 +371,15 @@ the Pod. So the upstream configuration can use the individual service names to r
 
 ## Installation and Configuration
 
-The Connect sidecar proxy is injected via a
+The service mesh sidecar proxy is injected via a
 [mutating admission webhook](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#admission-webhooks)
-provided by the
+call the connect injector provided by the
 [consul-k8s project](https://github.com/hashicorp/consul-k8s).
 This enables the automatic pod mutation shown in the usage section above.
 Installation of the mutating admission webhook is automated using the
 [Helm chart](/consul/docs/k8s/installation/install).
 
-To install the Connect injector, enable the Connect injection feature using
+To install the connect injector, enable the connect injection feature using
 [Helm values](/consul/docs/k8s/helm#configuration-values) and
 upgrade the installation using `helm upgrade` for existing installs or
 `helm install` for a fresh install.
@@ -395,7 +400,7 @@ To verify the installation, run the
 ["Accepting Inbound Connections"](/consul/docs/k8s/connect#accepting-inbound-connections)
 example from the "Usage" section above. After running this example, run
 `kubectl get pod static-server --output yaml`. In the raw YAML output, you should
-see injected Connect containers and an annotation
+see connect injected containers and an annotation
 `consul.hashicorp.com/connect-inject-status` set to `injected`. This
 confirms that injection is working properly.
 
diff --git a/website/content/docs/k8s/connect/ingress-gateways.mdx b/website/content/docs/k8s/connect/ingress-gateways.mdx
index b971484ecc10..8deab0e03750 100644
--- a/website/content/docs/k8s/connect/ingress-gateways.mdx
+++ b/website/content/docs/k8s/connect/ingress-gateways.mdx
@@ -11,7 +11,7 @@ description: >-
 
 ~> This topic requires familiarity with [Ingress Gateways](/consul/docs/connect/gateways/ingress-gateway).
 
-This page describes how to enable external access to Connect Service Mesh services running inside Kubernetes using Consul ingress gateways.
+This page describes how to enable external access through Consul ingress gateways to mesh services running inside Kubernetes.
 See [Ingress Gateways](/consul/docs/connect/gateways/ingress-gateway) for more information on use-cases and how it works.
 
 Adding an ingress gateway is a multi-step process that consists of the following steps:
diff --git a/website/content/docs/k8s/connect/observability/metrics.mdx b/website/content/docs/k8s/connect/observability/metrics.mdx
index c8db578268f9..167f2c7613c7 100644
--- a/website/content/docs/k8s/connect/observability/metrics.mdx
+++ b/website/content/docs/k8s/connect/observability/metrics.mdx
@@ -10,14 +10,14 @@ description: >-
 Consul on Kubernetes integrates with Prometheus and Grafana to provide metrics for Consul service mesh. The metrics
 available are:
 
-- Connect service metrics
-- Sidecar proxy metrics
+- Mesh service metrics
+- Mesh sidecar proxy metrics
 - Consul agent metrics
 - Ingress, terminating, and mesh gateway metrics
 
 Specific sidecar proxy metrics can also be seen in the Consul UI Topology Visualization view. This section documents how to enable each of these.
 
-## Connect Service and Sidecar Metrics with Metrics Merging
+## Mesh Service and Sidecar Metrics with Metrics Merging
 
 Prometheus annotations are used to instruct Prometheus to scrape metrics from Pods. Prometheus annotations only support
 scraping from one endpoint on a Pod, so Consul on Kubernetes supports metrics merging whereby service metrics and
@@ -30,7 +30,7 @@ The diagram below illustrates how the metrics integration works when merging is
 [![Metrics Merging Architecture](/img/metrics-arch.png)](/img/metrics-arch.png)
 -->
 
-Connect service metrics can be configured with the Helm values nested under [`connectInject.metrics`](/consul/docs/k8s/helm#v-connectinject-metrics).
+Metrics for services in the mesh can be configured with the Helm values nested under [`connectInject.metrics`](/consul/docs/k8s/helm#v-connectinject-metrics).
 
 Metrics and metrics merging can be enabled by default for all connect-injected Pods with the following Helm values:
 
diff --git a/website/content/docs/k8s/crds/upgrade-to-crds.mdx b/website/content/docs/k8s/crds/upgrade-to-crds.mdx
index 755b50f203a5..0c09102a33e3 100644
--- a/website/content/docs/k8s/crds/upgrade-to-crds.mdx
+++ b/website/content/docs/k8s/crds/upgrade-to-crds.mdx
@@ -14,7 +14,7 @@ you utilize the following:
 - [`connectInject.centralConfig.defaultProtocol`](#default-protocol)
 - [`connectInject.centralConfig.proxyDefaults`](#proxy-defaults)
 - [`meshGateway.globalMode`](#mesh-gateway-mode)
-- [Connect annotation `consul.hashicorp.com/connect-service-protocol`](#connect-service-protocol-annotation)
+- [connect annotation `consul.hashicorp.com/connect-service-protocol`](#connect-service-protocol-annotation)
 
 ## Central Config Enabled
 
@@ -133,7 +133,7 @@ installation.
 
 ## connect-service-protocol Annotation
 
-If any of your Connect services had the `consul.hashicorp.com/connect-service-protocol`
+If any of your mesh services had the `consul.hashicorp.com/connect-service-protocol`
 annotation set, e.g.
 
 ```yaml
diff --git a/website/content/docs/k8s/deployment-configurations/multi-cluster/kubernetes.mdx b/website/content/docs/k8s/deployment-configurations/multi-cluster/kubernetes.mdx
index 46aa7979e595..e407c7bedea9 100644
--- a/website/content/docs/k8s/deployment-configurations/multi-cluster/kubernetes.mdx
+++ b/website/content/docs/k8s/deployment-configurations/multi-cluster/kubernetes.mdx
@@ -22,7 +22,7 @@ Consul treats each Kubernetes cluster as a separate Consul datacenter.
 In order to federate clusters, one cluster must be designated the
 primary datacenter. This datacenter will be
 responsible for creating the certificate authority that signs the TLS certificates
-Connect uses to encrypt and authorize traffic. It also handles validating global ACL tokens. All other clusters
+that Consul service mesh uses to encrypt and authorize traffic. It also handles validating global ACL tokens. All other clusters
 that are federated are considered secondaries.
 
 #### First Time Installation
diff --git a/website/content/docs/k8s/deployment-configurations/servers-outside-kubernetes.mdx b/website/content/docs/k8s/deployment-configurations/servers-outside-kubernetes.mdx
index 8050e4d01b68..4827b0767aa7 100644
--- a/website/content/docs/k8s/deployment-configurations/servers-outside-kubernetes.mdx
+++ b/website/content/docs/k8s/deployment-configurations/servers-outside-kubernetes.mdx
@@ -109,7 +109,7 @@ The bootstrap token requires the following minimal permissions:
 - `agent:read` if using WAN federation over mesh gateways
 
 Next, configure external servers. The Helm chart will use this configuration to talk to the Consul server's API
-to create policies, tokens, and an auth method. If you are [enabling Consul Connect](/consul/docs/k8s/connect),
+to create policies, tokens, and an auth method. If you are [enabling Consul service mesh](/consul/docs/k8s/connect),
 `k8sAuthMethodHost` should be set to the address of your Kubernetes API server
 so that the Consul servers can validate a Kubernetes service account token when using the [Kubernetes auth method](/consul/docs/security/acl/auth-methods/kubernetes)
 with `consul login`.
diff --git a/website/content/docs/k8s/deployment-configurations/vault/data-integration/connect-ca.mdx b/website/content/docs/k8s/deployment-configurations/vault/data-integration/connect-ca.mdx
index 9cc6af4136d5..7550eb444200 100644
--- a/website/content/docs/k8s/deployment-configurations/vault/data-integration/connect-ca.mdx
+++ b/website/content/docs/k8s/deployment-configurations/vault/data-integration/connect-ca.mdx
@@ -10,10 +10,10 @@ description: >-
 This topic describes how to configure the Consul Helm chart to use TLS certificates issued by Vault for Consul service mesh communication.
 
 -> **Note:** This feature requires Consul 1.11 or higher. As of v1.11,
-Consul allows using Kubernetes auth methods to configure Connect CA.
+Consul allows using Kubernetes auth methods to configure the service mesh CA.
 This allows for automatic token rotation once the renewal is no longer possible.
 
-~> **Compatibility note:** If you use Vault 1.11.0+ as Consul's Connect CA, versions of Consul released before Dec 13, 2022 will develop an issue with Consul control plane or service mesh communication ([GH-15525](https://github.com/hashicorp/consul/pull/15525)). Use or upgrade to a [Consul version that includes the fix](https://support.hashicorp.com/hc/en-us/articles/11308460105491#01GMC24E6PPGXMRX8DMT4HZYTW) to avoid this problem.
+~> **Compatibility note:** If you use Vault 1.11.0+ as Consul's service mesh CA, versions of Consul released before Dec 13, 2022 will develop an issue with Consul control plane or service mesh communication ([GH-15525](https://github.com/hashicorp/consul/pull/15525)). Use or upgrade to a [Consul version that includes the fix](https://support.hashicorp.com/hc/en-us/articles/11308460105491#01GMC24E6PPGXMRX8DMT4HZYTW) to avoid this problem.
 
 ## Overview
 
@@ -46,7 +46,7 @@ Next, you will create Kubernetes auth roles for the Consul servers:
 $ vault write auth/kubernetes/role/consul-server \
     bound_service_account_names=<Consul server service account> \
     bound_service_account_namespaces=<Consul installation namespace> \
-    policies=<Connect CA policy> \
+    policies=<service mesh CA policy> \
     ttl=1h
 ```
 
@@ -58,7 +58,7 @@ $ helm template --release-name ${RELEASE_NAME} --show-only templates/server-serv
 ```
 
 ## Update Consul on Kubernetes Helm chart
-Now you can configure the Consul Helm chart to use Vault as the Connect CA provider:
+Now you can configure the Consul Helm chart to use Vault as the service mesh (connect) CA provider:
 
 <CodeBlockConfig filename="values.yaml">
 
@@ -83,7 +83,7 @@ global:
 The `address` you provide to the `connectCA` configuration can be a Kubernetes DNS
 address if the Vault cluster is running the same Kubernetes cluster.
 The `rootPKIPath` and `intermediatePKIPath` should be the same as the ones
-defined in your Connect CA policy. Behind the scenes, Consul will authenticate to Vault using a Kubernetes
+defined in your service mesh CA policy. Behind the scenes, Consul will authenticate to Vault using a Kubernetes
 service account using the [Kubernetes auth method](/vault/docs/auth/kubernetes) and will use the Vault token for any API calls to Vault. If the Vault token can not be renewed, Consul will re-authenticate to
 generate a new Vault token.
 
@@ -95,7 +95,7 @@ $ kubectl create secret generic vault-ca --from-file vault.ca=/path/to/your/vaul
 
 ### Secondary Datacenters
 
-To configure Vault as the Connect CA in secondary datacenters, you need to make sure that the Root CA path is the same,
+To configure Vault as the service mesh (connect) CA in secondary datacenters, you need to make sure that the Root CA path is the same,
 but the intermediate is different for each datacenter. In the `connectCA` Helm configuration for a secondary datacenter,
 you can specify a `intermediatePKIPath` that is, for example, prefixed with the datacenter
 for which this configuration is intended (e.g. `dc2/connect-intermediate`).
diff --git a/website/content/docs/k8s/deployment-configurations/vault/wan-federation.mdx b/website/content/docs/k8s/deployment-configurations/vault/wan-federation.mdx
index a243269f54ac..d7e37333abb4 100644
--- a/website/content/docs/k8s/deployment-configurations/vault/wan-federation.mdx
+++ b/website/content/docs/k8s/deployment-configurations/vault/wan-federation.mdx
@@ -626,7 +626,7 @@ Repeat the following steps for each datacenter in the cluster:
 
 1. Configure and install Consul in the secondary datacenter (dc2).
 
-    -> **Note**:  To configure Vault as the Connect CA in secondary datacenters, you need to make sure that the Root CA path is the same. The intermediate path is different for each datacenter. In the `connectCA` Helm configuration for a secondary datacenter, you can specify a `intermediatePKIPath` that is, for example, prefixed with the datacenter for which this configuration is intended (e.g. `dc2/connect-intermediate`).
+    -> **Note**:  To configure Vault as the service mesh (connect) CA in secondary datacenters, you need to make sure that the Root CA path is the same. The intermediate path is different for each datacenter. In the `connectCA` Helm configuration for a secondary datacenter, you can specify a `intermediatePKIPath` that is, for example, prefixed with the datacenter for which this configuration is intended (e.g. `dc2/connect-intermediate`).
 
     <CodeBlockConfig filename="consul-dc2.yaml" linenumbers highlight="4,5,6,7,8,9,10,11,12,13,14,15,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,37,38">
 
diff --git a/website/content/docs/k8s/helm.mdx b/website/content/docs/k8s/helm.mdx
index 91ed197128bf..6a1f5c197a6f 100644
--- a/website/content/docs/k8s/helm.mdx
+++ b/website/content/docs/k8s/helm.mdx
@@ -211,7 +211,7 @@ Use these links to navigate to a particular top-level stanza.
 
         - `secretKey` ((#v-global-secretsbackend-vault-ca-secretkey)) (`string: ""`) - The key within the Kubernetes or Vault secret that holds the Vault CA certificate.
 
-      - `connectCA` ((#v-global-secretsbackend-vault-connectca)) - Configuration for the Vault Connect CA provider.
+      - `connectCA` ((#v-global-secretsbackend-vault-connectca)) - Configuration for the Vault service mesh CA provider.
         The provider will be configured to use the Vault Kubernetes auth method
         and therefore requires the role provided by `global.secretsBackend.vault.consulServerRole`
         to have permissions to the root and intermediate PKI paths.
@@ -223,13 +223,13 @@ Use these links to navigate to a particular top-level stanza.
         - `authMethodPath` ((#v-global-secretsbackend-vault-connectca-authmethodpath)) (`string: kubernetes`) - The mount path of the Kubernetes auth method in Vault.
 
         - `rootPKIPath` ((#v-global-secretsbackend-vault-connectca-rootpkipath)) (`string: ""`) - The path to a PKI secrets engine for the root certificate.
-          For more details, please refer to [Vault Connect CA configuration](/consul/docs/connect/ca/vault#rootpkipath).
+          For more details, please refer to [Vault service mesh CA configuration](/consul/docs/connect/ca/vault#rootpkipath).
 
         - `intermediatePKIPath` ((#v-global-secretsbackend-vault-connectca-intermediatepkipath)) (`string: ""`) - The path to a PKI secrets engine for the generated intermediate certificate.
-          For more details, please refer to [Vault Connect CA configuration](/consul/docs/connect/ca/vault#intermediatepkipath).
+          For more details, please refer to [Vault service mesh CA configuration](/consul/docs/connect/ca/vault#intermediatepkipath).
 
-        - `additionalConfig` ((#v-global-secretsbackend-vault-connectca-additionalconfig)) (`string: {}`) - Additional Connect CA configuration in JSON format.
-          Please refer to [Vault Connect CA configuration](/consul/docs/connect/ca/vault#configuration)
+        - `additionalConfig` ((#v-global-secretsbackend-vault-connectca-additionalconfig)) (`string: {}`) - Additional service mesh CA configuration in JSON format.
+          Please refer to [Vault service mesh CA configuration](/consul/docs/connect/ca/vault#configuration)
           for all configuration options available for that provider.
 
           Example:
@@ -250,14 +250,14 @@ Use these links to navigate to a particular top-level stanza.
 
         - `caCert` ((#v-global-secretsbackend-vault-connectinject-cacert)) - Configuration to the Vault Secret that Kubernetes uses on
           Kubernetes pod creation, deletion, and update, to get CA certificates
-          used issued from vault to send webhooks to the ConnectInject.
+          used issued from vault to send webhooks to the connect inject.
 
           - `secretName` ((#v-global-secretsbackend-vault-connectinject-cacert-secretname)) (`string: null`) - The Vault secret path that contains the CA certificate for
-            Connect Inject webhooks.
+            connect inject webhooks.
 
         - `tlsCert` ((#v-global-secretsbackend-vault-connectinject-tlscert)) - Configuration to the Vault Secret that Kubernetes uses on
           Kubernetes pod creation, deletion, and update, to get TLS certificates
-          used issued from vault to send webhooks to the ConnectInject.
+          used issued from vault to send webhooks to the connect inject.
 
           - `secretName` ((#v-global-secretsbackend-vault-connectinject-tlscert-secretname)) (`string: null`) - The Vault secret path that issues TLS certificates for connect
             inject webhooks.
@@ -672,10 +672,10 @@ Use these links to navigate to a particular top-level stanza.
     contains best practices and recommendations for selecting suitable
     hardware sizes for your Consul servers.
 
-  - `connect` ((#v-server-connect)) (`boolean: true`) - This will enable/disable [Connect](/consul/docs/connect). Setting this to true
+  - `connect` ((#v-server-connect)) (`boolean: true`) - This will enable/disable [service mesh](/consul/docs/connect). Setting this to true
     _will not_ automatically secure pod communication, this
     setting will only enable usage of the feature. Consul will automatically initialize
-    a new CA and set of certificates. Additional Connect settings can be configured
+    a new CA and set of certificates. Additional service mesh settings can be configured
     by setting the `server.extraConfig` value.
 
   - `serviceAccount` ((#v-server-serviceaccount))
@@ -1027,7 +1027,7 @@ Use these links to navigate to a particular top-level stanza.
 
   - `grpc` ((#v-client-grpc)) (`boolean: true`) - If true, agents will enable their GRPC listener on
     port 8502 and expose it to the host. This will use slightly more resources, but is
-    required for Connect.
+    required for service mesh.
 
   - `nodeMeta` ((#v-client-nodemeta)) - nodeMeta specifies an arbitrary metadata key/value pair to associate with the node
     (refer to [`-node-meta`](/consul/docs/agent/config/cli-flags#_node_meta))
@@ -1228,7 +1228,7 @@ Use these links to navigate to a particular top-level stanza.
 
   - `enabled` ((#v-dns-enabled)) (`boolean: -`)
 
-  - `enableRedirection` ((#v-dns-enableredirection)) (`boolean: -`) - If true, services using Consul Connect will use Consul DNS
+  - `enableRedirection` ((#v-dns-enableredirection)) (`boolean: -`) - If true, services using Consul service mesh will use Consul DNS
     for default DNS resolution. The DNS lookups fall back to the nameserver IPs
     listed in /etc/resolv.conf if not found in Consul.
 
@@ -1538,9 +1538,9 @@ Use these links to navigate to a particular top-level stanza.
 
 ### connectInject ((#h-connectinject))
 
-- `connectInject` ((#v-connectinject)) - Configures the automatic Connect sidecar injector.
+- `connectInject` ((#v-connectinject)) - Configures the automatic service mesh sidecar injector.
 
-  - `enabled` ((#v-connectinject-enabled)) (`boolean: true`) - True if you want to enable connect injection. Set to "-" to inherit from
+  - `enabled` ((#v-connectinject-enabled)) (`boolean: true`) - True if you want to enable service mesh sidecar injection. Set to "-" to inherit from
     global.enabled.
 
   - `replicas` ((#v-connectinject-replicas)) (`integer: 1`) - The number of deployment replicas.
@@ -1550,13 +1550,13 @@ Use these links to navigate to a particular top-level stanza.
   - `default` ((#v-connectinject-default)) (`boolean: false`) - If true, the injector will inject the
     Connect sidecar into all pods by default. Otherwise, pods must specify the
     [injection annotation](/consul/docs/k8s/connect#consul-hashicorp-com-connect-inject)
-    to opt-in to Connect injection. If this is true, pods can use the same annotation
+    to opt-in to service mesh sidecar injection. If this is true, pods can use the same annotation
     to explicitly opt-out of injection.
 
   - `transparentProxy` ((#v-connectinject-transparentproxy)) - Configures Transparent Proxy for Consul Service mesh services.
     Using this feature requires Consul 1.10.0-beta1+.
 
-    - `defaultEnabled` ((#v-connectinject-transparentproxy-defaultenabled)) (`boolean: true`) - If true, then all Consul Service mesh will run with transparent proxy enabled by default,
+    - `defaultEnabled` ((#v-connectinject-transparentproxy-defaultenabled)) (`boolean: true`) - If true, then all Consul service mesh will run with transparent proxy enabled by default,
       i.e. we enforce that all traffic within the pod will go through the proxy.
       This value is overridable via the "consul.hashicorp.com/transparent-proxy" pod annotation.
 
@@ -1651,7 +1651,7 @@ Use these links to navigate to a particular top-level stanza.
         persistent: true
       ```
 
-  - `metrics` ((#v-connectinject-metrics)) - Configures metrics for Consul Connect services. All values are overridable
+  - `metrics` ((#v-connectinject-metrics)) - Configures metrics for services in the Consul service mesh. All values are overridable
     via annotations on a per-pod basis.
 
     - `defaultEnabled` ((#v-connectinject-metrics-defaultenabled)) (`string: -`) - If true, the connect-injector will automatically
@@ -1660,14 +1660,14 @@ Use these links to navigate to a particular top-level stanza.
       metrics will depend on whether metrics merging is enabled:
         - If metrics merging is enabled:
           the consul-dataplane will run a merged metrics server
-          combining Envoy sidecar and Connect service metrics,
+          combining Envoy sidecar and mesh service metrics,
           i.e. if your service exposes its own Prometheus metrics.
         - If metrics merging is disabled:
           the listener will just expose Envoy sidecar metrics.
       This will inherit from `global.metrics.enabled`.
 
     - `defaultEnableMerging` ((#v-connectinject-metrics-defaultenablemerging)) (`boolean: false`) - Configures the consul-dataplane to run a merged metrics server
-      to combine and serve both Envoy and Connect service metrics.
+      to combine and serve both Envoy and mesh service metrics.
       This feature is available only in Consul v1.10.0 or greater.
 
     - `defaultMergedMetricsPort` ((#v-connectinject-metrics-defaultmergedmetricsport)) (`integer: 20100`) - Configures the port at which the consul-dataplane will listen on to return
@@ -1768,13 +1768,13 @@ Use these links to navigate to a particular top-level stanza.
         namespace-label: label-value
     ```
 
-  - `k8sAllowNamespaces` ((#v-connectinject-k8sallownamespaces)) (`array<string>: ["*"]`) - List of k8s namespaces to allow Connect sidecar
+  - `k8sAllowNamespaces` ((#v-connectinject-k8sallownamespaces)) (`array<string>: ["*"]`) - List of k8s namespaces to allow service mesh sidecar
     injection in. If a k8s namespace is not included or is listed in `k8sDenyNamespaces`,
     pods in that k8s namespace will not be injected even if they are explicitly
     annotated. Use `["*"]` to automatically allow all k8s namespaces.
 
     For example, `["namespace1", "namespace2"]` will only allow pods in the k8s
-    namespaces `namespace1` and `namespace2` to have Connect sidecars injected
+    namespaces `namespace1` and `namespace2` to have service mesh sidecars injected
     and registered with Consul. All other k8s namespaces will be ignored.
 
     To deny all namespaces, set this to `[]`.
@@ -1783,7 +1783,7 @@ Use these links to navigate to a particular top-level stanza.
     `namespaceSelector` takes precedence over both since it is applied first.
     `kube-system` and `kube-public` are never injected, even if included here.
 
-  - `k8sDenyNamespaces` ((#v-connectinject-k8sdenynamespaces)) (`array<string>: []`) - List of k8s namespaces that should not allow Connect
+  - `k8sDenyNamespaces` ((#v-connectinject-k8sdenynamespaces)) (`array<string>: []`) - List of k8s namespaces that should not allow service mesh
     sidecar injection. This list takes precedence over `k8sAllowNamespaces`.
     `*` is not supported because then nothing would be allowed to be injected.
 
@@ -1848,7 +1848,7 @@ Use these links to navigate to a particular top-level stanza.
     auth method for Connect inject, set this to the name of your auth method.
 
   - `aclInjectToken` ((#v-connectinject-aclinjecttoken)) - Refers to a Kubernetes secret that you have created that contains
-    an ACL token for your Consul cluster which allows the Connect injector the correct
+    an ACL token for your Consul cluster which allows the connect injector the correct
     permissions. This is only needed if Consul namespaces <EnterpriseAlert inline /> and ACLs
     are enabled on the Consul cluster and you are not setting
     `global.acls.manageSystemACLs` to `true`.
@@ -1892,7 +1892,7 @@ Use these links to navigate to a particular top-level stanza.
 
         - `cpu` ((#v-connectinject-sidecarproxy-resources-limits-cpu)) (`string: null`) - Recommended production default: 100m
 
-  - `initContainer` ((#v-connectinject-initcontainer)) (`map`) - The resource settings for the Connect injected init container. If null, the resources
+  - `initContainer` ((#v-connectinject-initcontainer)) (`map`) - The resource settings for the connect injected init container. If null, the resources
     won't be set for the initContainer. The defaults are optimized for developer instances of 
     Kubernetes, however they should be tweaked with the recommended defaults as shown below to speed up service registration times.
 
@@ -1912,10 +1912,10 @@ Use these links to navigate to a particular top-level stanza.
 
 ### meshGateway ((#h-meshgateway))
 
-- `meshGateway` ((#v-meshgateway)) - [Mesh Gateways](/consul/docs/connect/gateways/mesh-gateway) enable Consul Connect to work across Consul datacenters.
+- `meshGateway` ((#v-meshgateway)) - [Mesh Gateways](/consul/docs/connect/gateways/mesh-gateway) enable Consul service mesh to work across Consul datacenters.
 
   - `enabled` ((#v-meshgateway-enabled)) (`boolean: false`) - If [mesh gateways](/consul/docs/connect/gateways/mesh-gateway) are enabled, a Deployment will be created that runs
-    gateways and Consul Connect will be configured to use gateways.
+    gateways and Consul service mesh will be configured to use gateways.
     This setting is required for [cluster peering](/consul/docs/k8s/connect/cluster-peering/tech-specs).
     Requirements: consul 1.6.0+ if using `global.acls.manageSystemACLs``.
 
@@ -2477,7 +2477,7 @@ ui:
     type: LoadBalancer
 ```
 
-The below `values.yaml` results in a three server Consul Enterprise cluster with 100GB of storage and automatic Connect injection.
+The below `values.yaml` results in a three server Consul Enterprise cluster with 100GB of storage and automatic connect injection.
 
 Note, this would require a secret that contains the enterprise license key.
 
diff --git a/website/content/docs/k8s/operations/tls-on-existing-cluster.mdx b/website/content/docs/k8s/operations/tls-on-existing-cluster.mdx
index ee656f243899..32b89d326cd1 100644
--- a/website/content/docs/k8s/operations/tls-on-existing-cluster.mdx
+++ b/website/content/docs/k8s/operations/tls-on-existing-cluster.mdx
@@ -13,7 +13,7 @@ you may want to configure TLS in a way that minimizes downtime to your applicati
 Consul already supports rolling out TLS on an existing cluster without downtime.
 However, depending on your Kubernetes use case, your upgrade procedure may be different.
 
-## Gradual TLS Rollout without Consul Connect
+## Gradual TLS Rollout without Consul Service Mesh
 
 If you do not use a service mesh, follow this process.
 
@@ -39,7 +39,7 @@ If you do not use a service mesh, follow this process.
 1. Repeat steps 1 and 2, turning on TLS verification by setting `global.tls.verify`
    to `true`.
 
-## Gradual TLS Rollout with Consul Connect
+## Gradual TLS Rollout with Consul Service Mesh
 
 Because the sidecar Envoy proxies need to talk to the Consul client agent regularly
 for service discovery, we can't enable TLS on the clients without also re-injecting a
@@ -75,12 +75,12 @@ applications to it.
 
 1. Run `helm upgrade` with the above config file.
 
-1. At this point, all components (e.g., Consul Connect webhook and sync catalog) should be running
+1. At this point, all components (e.g., Consul service mesh webhook and sync catalog) should be running
    on the new node pool.
 
-1. Redeploy all your Connect-enabled applications.
+1. Redeploy all your mesh-enabled applications.
    One way to trigger a redeploy is to run `kubectl drain` on the nodes in the old pool.
-   Now that the Connect webhook is TLS-aware, it adds TLS configuration to
+   Now that the service mesh webhook is TLS-aware, it adds TLS configuration to
    the sidecar proxy. Also, Kubernetes should schedule these applications on the new node pool.
 
 1. Perform a rolling upgrade of the servers described in
diff --git a/website/content/docs/lambda/invocation.mdx b/website/content/docs/lambda/invocation.mdx
index ebb12571ec21..cdfe774ef649 100644
--- a/website/content/docs/lambda/invocation.mdx
+++ b/website/content/docs/lambda/invocation.mdx
@@ -11,7 +11,7 @@ This topic describes how to invoke AWS Lambda functions from the Consul service
 
 ## Overview
 
-You can invoke Lambda functions from the Consul service mesh through terminating gateways (recommended) or directly from connect proxies.
+You can invoke Lambda functions from the Consul service mesh through terminating gateways (recommended) or directly from service mesh proxies.
 
 
 ### Terminating Gateway
@@ -30,13 +30,13 @@ The following diagram shows the invocation procedure:
 
 </ImageConfig>
 
-1. Make an HTTP request to the local Connect proxy.
-1. The Connect proxy forwards the request to the terminating gateway.
+1. Make an HTTP request to the local service mesh proxy.
+1. The service mesh proxy forwards the request to the terminating gateway.
 1. The terminating gateway invokes the function.
 
-### Connect Proxy
+### Service Mesh Proxy
 
-You can invoke Lambda functions directly from a service's Connect proxy.
+You can invoke Lambda functions directly from a service's mesh sidecar proxy.
 This method has the following limitations:
 - Intentions are unsupported. Consul enforces intentions by validating the client certificates presented when a connection is received. Lambda does not support client certificate validation, which prevents Consul from supporting intentions using this method.
 - Transparent proxies are unsupported. This is because Lambda services are not
@@ -50,12 +50,12 @@ The following diagram shows the invocation procedure:
 
 <ImageConfig width={400}>
 
-![Connect Proxy to Lambda](/img/connect_proxy_to_lambda.svg)
+![Service Mesh Proxy to Lambda](/img/connect_proxy_to_lambda.svg)
 
 </ImageConfig>
 
-1. Make an HTTP request to the local Connect proxy.
-2. The Connect proxy invokes the Lambda.
+1. Make an HTTP request to the local service mesh proxy.
+2. The service mesh proxy invokes the Lambda.
 
 ## Invoke a Lambda Function
 Before you can invoke a Lambda function, register the service used to invoke
diff --git a/website/content/docs/release-notes/consul/v1_11_x.mdx b/website/content/docs/release-notes/consul/v1_11_x.mdx
index ae8a72cca6a2..3334c6fbde7f 100644
--- a/website/content/docs/release-notes/consul/v1_11_x.mdx
+++ b/website/content/docs/release-notes/consul/v1_11_x.mdx
@@ -17,7 +17,7 @@ description: >-
 
 - **TLS Certificates for Ingress Gateways via an SDS source**: Ingress Gateways can now be configured to retrieve TLS certificates from an external SDS Service and load the TLS certificates for Ingress listeners. This configuration is set using the `ingress-gateway` configuration entry via the [SDS](/consul/docs/connect/config-entries/ingress-gateway#sds) stanza within the Ingress Gateway TLS configuration.
 
-- **Vault Auth Method support for Connect CA Vault Provider**: Consul now supports configuring the Connect CA Vault provider to use auth methods for authentication to Vault. Consul supports using any non-deprecated auth method that is available in Vault v1.8.5, including AppRole, AliCloud, AWS, Azure, Cloud Foundry, GitHub, Google Cloud, JWT/OIDC, Kerberos, Kubernetes, LDAP, Oracle Cloud Infrastructure, Okta, Radius, TLS Certificates, and Username & Password. The Vault Auth Method for Connect CA Provider is utilized by default for the [Vault Secrets Backend](/consul/docs/k8s/deployment-configurations/vault) feature on Consul on Kubernetes. Utilizing a Vault Auth method would no longer require a Vault token to be managed or provisioned ahead of time to be used for authentication to Vault.
+- **Vault Auth Method support for service mesh CA Vault Provider**: Consul now supports configuring the service mesh CA Vault provider to use auth methods for authentication to Vault. Consul supports using any non-deprecated auth method that is available in Vault v1.8.5, including AppRole, AliCloud, AWS, Azure, Cloud Foundry, GitHub, Google Cloud, JWT/OIDC, Kerberos, Kubernetes, LDAP, Oracle Cloud Infrastructure, Okta, Radius, TLS Certificates, and Username & Password. The Vault Auth Method for service mesh CA Provider is utilized by default for the [Vault Secrets Backend](/consul/docs/k8s/deployment-configurations/vault) feature on Consul on Kubernetes. Utilizing a Vault Auth method would no longer require a Vault token to be managed or provisioned ahead of time to be used for authentication to Vault.
 
 ## What's Changed
 
diff --git a/website/content/docs/security/acl/acl-rules.mdx b/website/content/docs/security/acl/acl-rules.mdx
index a09ffd2fc253..280c07750368 100644
--- a/website/content/docs/security/acl/acl-rules.mdx
+++ b/website/content/docs/security/acl/acl-rules.mdx
@@ -34,7 +34,7 @@ The following resources are not covered by ACL policies:
 
 - The [Status API](/consul/api-docs/status) is used by servers when bootstrapping and exposes basic IP and port information about the servers, and does not allow modification of any state.
 - The datacenter listing operation of the [Catalog API](/consul/api-docs/catalog#list-datacenters) similarly exposes the names of known Consul datacenters, and does not allow modification of any state.
-- The [connect CA roots endpoint](/consul/api-docs/connect/ca#list-ca-root-certificates) exposes just the public TLS certificate which other systems can use to verify the TLS connection with Consul.
+- The [service mesh CA roots endpoint](/consul/api-docs/connect/ca#list-ca-root-certificates) exposes just the public TLS certificate which other systems can use to verify the TLS connection with Consul.
 
 -> **Consul Enterprise Namespace** - In addition to directly-linked policies, roles, and service identities, Consul Enterprise enables ACL policies and roles to be defined in the [Namespaces definition](/consul/docs/enterprise/namespaces#namespace-definition) (Consul Enterprise 1.7.0+).
 
diff --git a/website/content/docs/security/acl/auth-methods/index.mdx b/website/content/docs/security/acl/auth-methods/index.mdx
index c865589a8536..c26cb05d21f2 100644
--- a/website/content/docs/security/acl/auth-methods/index.mdx
+++ b/website/content/docs/security/acl/auth-methods/index.mdx
@@ -27,8 +27,8 @@ integrations allow for these credentials to be used to create ACL tokens with
 properly-scoped policies without additional operator intervention.
 
 In Consul 1.5.0 the focus is around simplifying the creation of tokens with the
-privileges necessary to participate in a [Connect](/consul/docs/connect)
-service mesh with minimal operator intervention.
+privileges necessary to participate in a [service mesh](/consul/docs/connect)
+with minimal operator intervention.
 
 ## Supported Types
 
diff --git a/website/content/docs/security/security-models/core.mdx b/website/content/docs/security/security-models/core.mdx
index 270cdd6526b1..92a5c1ac91c2 100644
--- a/website/content/docs/security/security-models/core.mdx
+++ b/website/content/docs/security/security-models/core.mdx
@@ -102,21 +102,21 @@ environment and adapt these configurations accordingly.
     `server.<datacenter>.<domain>` hostname for outgoing TLS connections. The default configuration does not verify the
     hostname of the certificate, only that it is signed by a trusted CA. This setting is critical to prevent a
     compromised client agent from being restarted as a server and having all cluster state including all ACL tokens and
-    Connect CA root keys replicated to it. This setting was introduced in 0.5.1. From version 0.5.1 to 1.4.0 we
+    service mesh CA root keys replicated to it. This setting was introduced in 0.5.1. From version 0.5.1 to 1.4.0 we
     documented that `verify_server_hostname` being true implied verify_outgoing however due to a bug this was not the
     case so setting only `verify_server_hostname` results in plaintext communication between client and server. See
     [CVE-2018-19653](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19653) for more details. This is fixed
     in 1.4.1.
 
   - [`auto_encrypt`](/consul/docs/agent/config/config-files#auto_encrypt) - Enables automated TLS certificate distribution for client
-    agent RPC communication using the Connect CA. Using this configuration a [`ca_file`](/consul/docs/agent/config/config-files#tls_defaults_ca_file)
+    agent RPC communication using the service mesh CA. Using this configuration a [`ca_file`](/consul/docs/agent/config/config-files#tls_defaults_ca_file)
     and ACL token would still need to be distributed to client agents.
 
     - [`allow_tls`](/consul/docs/agent/config/config-files#allow_tls) - By default this is false, and should be set to true on server
-      agents to allow certificates to be automatically generated and distributed from the Connect CA to client agents.
+      agents to allow certificates to be automatically generated and distributed from the service mesh CA to client agents.
 
     - [`tls`](/consul/docs/agent/config/config-files#tls) - By default this is false, and should be set to true on client agents to
-      automatically request a client TLS certificate from the server's Connect CA.
+      automatically request a client TLS certificate from the server's service mesh CA.
 
     **Example Server Agent TLS Configuration**
 
@@ -321,7 +321,7 @@ The following are parts of the core Consul threat model:
   This requires transport encryption to be enabled on the cluster and covers both TCP and UDP traffic.
 
 - **Consul agent-to-CA communication** - Communication between the Consul server and the configured certificate
-  authority provider for Connect is always encrypted.
+  authority provider for service mesh is always encrypted.
 
 - **Tampering of data in transit** - Any tampering should be detectable and cause Consul to avoid processing
   the request.
@@ -338,13 +338,13 @@ The following are parts of the core Consul threat model:
 - **Denial of Service against a node** - DoS attacks against a node should not compromise the security stance of
   the software.
 
-- **Connect-based Service-to-Service communication** - Communications between two Connect-enabled services (natively or
-  by proxy) should be secure from eavesdropping and provide authentication. This is achieved via mutual TLS.
+- **Communication between mesh services** - Communications between two mesh-enabled services (natively or
+  by sidecar proxy) should be secure from eavesdropping and provide authentication. This is achieved via mutual TLS.
 
 The following are not part of the threat model for server agents:
 
 - **Access (read or write) to the Consul data directory** - All Consul servers, including non-leaders, persist the full
-  set of Consul state to this directory. The data includes all KV, service registrations, ACL tokens, Connect CA
+  set of Consul state to this directory. The data includes all KV, service registrations, ACL tokens, service mesh CA
   configuration, and more. Any read or write to this directory allows an attacker to access and tamper with that data.
 
 - **Access (read or write) to the Consul configuration directory** - Consul configuration can enable or disable the ACL
@@ -353,14 +353,14 @@ The following are not part of the threat model for server agents:
 
 - **Memory access to a running Consul server agent** - If an attacker is able to inspect the memory state of a running
   Consul server agent the confidentiality of almost all Consul data may be compromised. If you're using an external
-  Connect CA, the root private key material is never available to the Consul process and can be considered safe. Service
-  Connect TLS certificates should be considered compromised; they are never persisted by server agents but do exist
+  service mesh CA, the root private key material is never available to the Consul process and can be considered safe. Service
+  service mesh TLS certificates should be considered compromised; they are never persisted by server agents but do exist
   in-memory during at least the duration of a Sign request.
 
 The following are not part of the threat model for client agents:
 
 - **Access (read or write) to the Consul data directory** - Consul clients will use the data directory to cache local
-  state. This includes local services, associated ACL tokens, Connect TLS certificates, and more. Read or write access
+  state. This includes local services, associated ACL tokens, service mesh TLS certificates, and more. Read or write access
   to this directory will allow an attacker to access this data. This data is typically a smaller subset of the full data
   of the cluster.
 - **Access (read or write) to the Consul configuration directory** - Consul client configuration files contain the
@@ -371,18 +371,18 @@ The following are not part of the threat model for client agents:
 
 - **Memory access to a running Consul client agent** - The blast radius of this is much smaller than a server agent but
   the confidentiality of a subset of data can still be compromised. Particularly, any data requested against the agent's
-  API including services, KV, and Connect information may be compromised. If a particular set of data on the server was
+  API including services, KV, and service mesh information may be compromised. If a particular set of data on the server was
   never requested by the agent, it never enters the agent's memory since replication only exists between servers. An
   attacker could also potentially extract ACL tokens used for service registration on this agent, since the tokens must
   be stored in-memory alongside the registered service.
 
-- **Network access to a local Connect proxy or service** - Communications between a service and a Connect-aware proxy
+- **Network access to a local service mesh proxy or service** - Communications between a service and a mesh-aware proxy
   are generally unencrypted and must happen over a trusted network. This is typically a loopback device. This requires
   that other processes on the same machine are trusted, or more complex isolation mechanisms are used such as network
-  namespaces. This also requires that external processes cannot communicate to the Connect service or proxy (except on
-  the inbound port). Therefore, non-native Connect applications should only bind to non-public addresses.
+  namespaces. This also requires that external processes cannot communicate to the mesh service or sidecar proxy (except on
+  the inbound port). Therefore, non-native service mesh applications should only bind to non-public addresses.
 
-- **Improperly Implemented Connect proxy or service** - A Connect proxy or natively integrated service must correctly
+- **Improperly Implemented service mesh proxy or service** - A service mesh proxy or natively integrated service must correctly
   serve a valid leaf certificate, verify the inbound TLS client certificate, and call the Consul agent-local authorized
   endpoint. If any of this isn't performed correctly, the proxy or service may allow unauthenticated or unauthorized
   connections.
diff --git a/website/content/docs/security/security-models/nia.mdx b/website/content/docs/security/security-models/nia.mdx
index d6b312a42063..0e6de4982b14 100644
--- a/website/content/docs/security/security-models/nia.mdx
+++ b/website/content/docs/security/security-models/nia.mdx
@@ -76,7 +76,7 @@ security concerns accordingly.
 - **Run without Root** - The NIA daemon does not require root or other administrative privileges to operate.
 
 - **Protect NIA Daemon API Endpoint** - Any network endpoints provided by, or exposed to the NIA Daemon should be
-  protected using Consul Connect and appropriate firewall rules.
+  protected using Consul service mesh and appropriate firewall rules.
 
 - **Use a centralized logging solution** - Export log entries within [syslog](https://en.wikipedia.org/wiki/Syslog)
   generated from `consul-terraform-sync` to a centralized logging solution.
diff --git a/website/content/docs/services/services.mdx b/website/content/docs/services/services.mdx
index b24562e64e32..38c1d5183e5f 100644
--- a/website/content/docs/services/services.mdx
+++ b/website/content/docs/services/services.mdx
@@ -6,7 +6,7 @@ description: >-
 ---
 
 # Services overview
-This topic provides overview information about services and how to make them discoverable in Consul when your network operates on virtual machines. If service mesh is enabled in your network, refer to the topics in [Consul Service Mesh](/consul/docs/connect/). If your network is running in Kubernetes, refer to the topics in [Consul on Kubernetes](/consul/docs/k8s). 
+This topic provides overview information about services and how to make them discoverable in Consul when your network operates on virtual machines. If service mesh is enabled in your network, refer to the topics in [Consul service mesh](/consul/docs/connect/). If your network is running in Kubernetes, refer to the topics in [Consul on Kubernetes](/consul/docs/k8s). 
 
 ## Introduction
 A _service_ is an entity in your network that performs a specialized operation or set of related operations. In many contexts, a service is software that you want to make available to users or other programs with access to your network. Services can also refer to native Consul functionality, such as _service mesh proxies_ and _gateways_, that enable you to establish connections between different parts of your network. 
diff --git a/website/content/docs/upgrading/upgrade-specific.mdx b/website/content/docs/upgrading/upgrade-specific.mdx
index 7c8285340208..38230034dd2b 100644
--- a/website/content/docs/upgrading/upgrade-specific.mdx
+++ b/website/content/docs/upgrading/upgrade-specific.mdx
@@ -157,13 +157,13 @@ In Consul v1.15 and higher:
 ## Consul 1.14.x
 
 ### Service Mesh Compatibility
-Prior to Consul 1.14, cluster peering or Consul connect were disabled by default.
+Prior to Consul 1.14, cluster peering and Consul service mesh were disabled by default.
 A breaking change was made in Consul 1.14 that:
 - [Cluster Peering is enabled by default.](/consul/docs/connect/cluster-peering)
   Cluster peering and WAN federation can coexist,
   so there is no need to disable cluster peering to upgrade existing WAN federated datacenters.
   To disable cluster peering nonetheless, set [`peering.enabled`](/consul/docs/agent/config/config-files#peering_enabled) to `false`.
-- [Consul Connect is enabled by default.](/consul/docs/connect)
+- [Consul service mesh is enabled by default.](/consul/docs/connect)
   To disable, set [`connect.enabled`](/consul/docs/agent/config/config-files#connect_enabled) to `false`.
 
 The changes to Consul service mesh in version 1.14 are incompatible with Nomad 1.4.3 and
@@ -228,7 +228,7 @@ Consul 1.13.0 contains a bug that prevents Consul server agents from restoring
 saved state on startup if the state
 
 1. was generated before Consul 1.13 (such as during an upgrade), and
-2. contained any Connect proxy registrations.
+2. contained any service mesh proxy registrations.
 
 This bug is fixed in Consul versions 1.13.1 and newer.
 
@@ -770,7 +770,7 @@ registrations](/consul/docs/connect/registration/sidecar-service).
 
 There are two major features in Consul 1.4.0 that may impact upgrades: a [new
 ACL system](#acl-upgrade) and [multi-datacenter support for
-Connect](#connect-multi-datacenter) in the Enterprise version.
+service mesh](#multi-datacenter-service-mesh) in the Enterprise version.
 
 ### ACL Upgrade
 
@@ -851,13 +851,13 @@ as soon as possible after upgrade, as well as updating any integrations to work
 with the the new ACL [Token](/consul/api-docs/acl/tokens) and
 [Policy](/consul/api-docs/acl/policies) APIs.
 
-### Connect Multi-datacenter
+### Multi-datacenter service mesh
 
 This only applies to users upgrading from an older version of Consul Enterprise to Consul Enterprise 1.4.0 (all license types).
 
-In addition, this upgrade will only affect clusters where [Connect is enabled](/consul/docs/connect/configuration) on your servers before the migration.
+In addition, this upgrade will only affect clusters where [service mesh is enabled](/consul/docs/connect/configuration) on your servers before the migration.
 
-Connect multi-datacenter uses the same primary/secondary approach as ACLs and
+Multi-datacenter service mesh uses the same primary/secondary approach as ACLs and
 will use the same [primary_datacenter](#primary-datacenter). When a secondary
 datacenter server restarts with 1.4.0 it will detect it is not the primary and
 begin an automatic bootstrap of multi-datacenter CA federation.
@@ -866,11 +866,11 @@ Datacenters can be upgraded in either order; secondary datacenters will not
 switch into multi-datacenter mode until all servers in both the secondary and
 primary datacenter are detected to be running at least Consul 1.4.0. Secondary
 datacenters monitor this periodically (every few minutes) and will
-automatically upgrade Connect to use a federated Certificate Authority when
+automatically upgrade service mesh to use a federated Certificate Authority when
 they do.
 
 In general, migrating a Consul cluster from OSS to Enterprise will update the
-CA to be federated automatically and without impact on Connect traffic. When
+CA to be federated automatically and without impact on service mesh traffic. When
 upgrading Consul Enterprise 1.3.x to Consul Enterprise 1.4.0 upgrades the CA
 upgrade is seamless, however depending on the size of the cluster, _new_
 connection attempts in the secondary datacenter might fail for a short window
@@ -879,15 +879,12 @@ authorization endpoint validating originating cluster in a way that was not
 fully forwards compatible with migrating between cluster trust domains. That
 issue is fixed in 1.4.0 as part of General Availability.
 
-Once migrated (typically a few seconds). Connect will use the primary
+Once migrated (typically a few seconds). The service mesh will use the primary
 datacenter's Certificate Authority as the root of trust for all other
 datacenters. CA migration or root key changes in the primary will now rotate
 automatically and without loss of connectivity throughout all datacenters and
 workloads.
 
-For more information see [Connect
-Multi-datacenter](/consul/docs/enterprise).
-
 ## Consul 1.3.0
 
 This version added support for multiple tag filters in service discovery
diff --git a/website/public/img/connect_proxy_to_lambda.svg b/website/public/img/connect_proxy_to_lambda.svg
index 1ba7a277937c..85c0b7d36843 100644
--- a/website/public/img/connect_proxy_to_lambda.svg
+++ b/website/public/img/connect_proxy_to_lambda.svg
@@ -13,4 +13,4 @@
       }
     </style>
   </defs>
-  <rect x="0" y="0" width="560" height="280" fill="#ffffff"></rect><g stroke-linecap="round" transform="translate(10 30) rotate(0 90 40)"><path d="M0 0 C59.55 0, 119.1 0, 180 0 M0 0 C42.4 0, 84.81 0, 180 0 M180 0 C180 31.86, 180 63.72, 180 80 M180 0 C180 18.33, 180 36.66, 180 80 M180 80 C135.24 80, 90.48 80, 0 80 M180 80 C117.05 80, 54.09 80, 0 80 M0 80 C0 61.71, 0 43.41, 0 0 M0 80 C0 50.9, 0 21.8, 0 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(15 61.5) rotate(0 85 8.5)"><text x="85" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="middle" style="white-space: pre;" direction="ltr">Lambda</text></g><g stroke-linecap="round" transform="translate(350 30) rotate(0 90 40)"><path d="M0 0 C50.63 0, 101.26 0, 180 0 M0 0 C62.98 0, 125.97 0, 180 0 M180 0 C180 29.58, 180 59.16, 180 80 M180 0 C180 16.8, 180 33.59, 180 80 M180 80 C130.53 80, 81.06 80, 0 80 M180 80 C133.55 80, 87.1 80, 0 80 M0 80 C0 63.12, 0 46.25, 0 0 M0 80 C0 62.7, 0 45.39, 0 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(355 61.5) rotate(0 85 8.5)"><text x="85" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="middle" style="white-space: pre;" direction="ltr">Connect Proxy</text></g><g stroke-linecap="round" transform="translate(350 170) rotate(0 90 40)"><path d="M0 0 C37.79 0, 75.58 0, 180 0 M0 0 C49.47 0, 98.94 0, 180 0 M180 0 C180 20.64, 180 41.29, 180 80 M180 0 C180 16.88, 180 33.75, 180 80 M180 80 C141.07 80, 102.13 80, 0 80 M180 80 C129.1 80, 78.2 80, 0 80 M0 80 C0 61.81, 0 43.62, 0 0 M0 80 C0 48.92, 0 17.84, 0 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(355 201.5) rotate(0 85 8.5)"><text x="85" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="middle" style="white-space: pre;" direction="ltr">Service</text></g><g stroke-linecap="round" transform="translate(330 10) rotate(0 110 130)"><path d="M0 0 C74.7 0, 149.4 0, 220 0 M0 0 C50.75 0, 101.49 0, 220 0 M220 0 C220 87.57, 220 175.14, 220 260 M220 0 C220 53.74, 220 107.48, 220 260 M220 260 C144.14 260, 68.29 260, 0 260 M220 260 C152.15 260, 84.29 260, 0 260 M0 260 C0 198.84, 0 137.67, 0 0 M0 260 C0 163.23, 0 66.46, 0 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g stroke-linecap="round"><g transform="translate(450 170) rotate(0 0 -30)"><path d="M0 0 C0 -10, 0 -50, 0 -60 M0 0 C0 -10, 0 -50, 0 -60" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(450 170) rotate(0 0 -30)"><path d="M10.26 -31.81 C7.02 -40.7, 3.79 -49.6, 0 -60 M10.26 -31.81 C7.78 -38.63, 5.3 -45.44, 0 -60" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(450 170) rotate(0 0 -30)"><path d="M-10.26 -31.81 C-7.02 -40.7, -3.79 -49.6, 0 -60 M-10.26 -31.81 C-7.78 -38.63, -5.3 -45.44, 0 -60" stroke="#000000" stroke-width="1" fill="none"></path></g></g><g stroke-linecap="round"><g transform="translate(350 70) rotate(0 -80 0)"><path d="M0 0 C-60.65 0, -121.3 0, -160 0 M0 0 C-51.61 0, -103.22 0, -160 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(350 70) rotate(0 -80 0)"><path d="M-131.81 -10.26 C-142.5 -6.37, -153.18 -2.48, -160 0 M-131.81 -10.26 C-140.9 -6.95, -150 -3.64, -160 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(350 70) rotate(0 -80 0)"><path d="M-131.81 10.26 C-142.5 6.37, -153.18 2.48, -160 0 M-131.81 10.26 C-140.9 6.95, -150 3.64, -160 0" stroke="#000000" stroke-width="1" fill="none"></path></g></g><g transform="translate(472.8076349537894 133.68057374010323) rotate(0 5 8.5)"><text x="0" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="start" style="white-space: pre;" direction="ltr">1</text></g><g transform="translate(268.90132808335125 38.78078312115713) rotate(0 5 8.5)"><text x="0" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="start" style="white-space: pre;" direction="ltr">2</text></g></svg>
\ No newline at end of file
+  <rect x="0" y="0" width="560" height="280" fill="#ffffff"></rect><g stroke-linecap="round" transform="translate(10 30) rotate(0 90 40)"><path d="M0 0 C59.55 0, 119.1 0, 180 0 M0 0 C42.4 0, 84.81 0, 180 0 M180 0 C180 31.86, 180 63.72, 180 80 M180 0 C180 18.33, 180 36.66, 180 80 M180 80 C135.24 80, 90.48 80, 0 80 M180 80 C117.05 80, 54.09 80, 0 80 M0 80 C0 61.71, 0 43.41, 0 0 M0 80 C0 50.9, 0 21.8, 0 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(15 61.5) rotate(0 85 8.5)"><text x="85" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="middle" style="white-space: pre;" direction="ltr">Lambda</text></g><g stroke-linecap="round" transform="translate(350 30) rotate(0 90 40)"><path d="M0 0 C50.63 0, 101.26 0, 180 0 M0 0 C62.98 0, 125.97 0, 180 0 M180 0 C180 29.58, 180 59.16, 180 80 M180 0 C180 16.8, 180 33.59, 180 80 M180 80 C130.53 80, 81.06 80, 0 80 M180 80 C133.55 80, 87.1 80, 0 80 M0 80 C0 63.12, 0 46.25, 0 0 M0 80 C0 62.7, 0 45.39, 0 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(355 61.5) rotate(0 85 8.5)"><text x="85" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="middle" style="white-space: pre;" direction="ltr">Mesh Sidecar Proxy</text></g><g stroke-linecap="round" transform="translate(350 170) rotate(0 90 40)"><path d="M0 0 C37.79 0, 75.58 0, 180 0 M0 0 C49.47 0, 98.94 0, 180 0 M180 0 C180 20.64, 180 41.29, 180 80 M180 0 C180 16.88, 180 33.75, 180 80 M180 80 C141.07 80, 102.13 80, 0 80 M180 80 C129.1 80, 78.2 80, 0 80 M0 80 C0 61.81, 0 43.62, 0 0 M0 80 C0 48.92, 0 17.84, 0 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(355 201.5) rotate(0 85 8.5)"><text x="85" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="middle" style="white-space: pre;" direction="ltr">Service</text></g><g stroke-linecap="round" transform="translate(330 10) rotate(0 110 130)"><path d="M0 0 C74.7 0, 149.4 0, 220 0 M0 0 C50.75 0, 101.49 0, 220 0 M220 0 C220 87.57, 220 175.14, 220 260 M220 0 C220 53.74, 220 107.48, 220 260 M220 260 C144.14 260, 68.29 260, 0 260 M220 260 C152.15 260, 84.29 260, 0 260 M0 260 C0 198.84, 0 137.67, 0 0 M0 260 C0 163.23, 0 66.46, 0 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g stroke-linecap="round"><g transform="translate(450 170) rotate(0 0 -30)"><path d="M0 0 C0 -10, 0 -50, 0 -60 M0 0 C0 -10, 0 -50, 0 -60" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(450 170) rotate(0 0 -30)"><path d="M10.26 -31.81 C7.02 -40.7, 3.79 -49.6, 0 -60 M10.26 -31.81 C7.78 -38.63, 5.3 -45.44, 0 -60" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(450 170) rotate(0 0 -30)"><path d="M-10.26 -31.81 C-7.02 -40.7, -3.79 -49.6, 0 -60 M-10.26 -31.81 C-7.78 -38.63, -5.3 -45.44, 0 -60" stroke="#000000" stroke-width="1" fill="none"></path></g></g><g stroke-linecap="round"><g transform="translate(350 70) rotate(0 -80 0)"><path d="M0 0 C-60.65 0, -121.3 0, -160 0 M0 0 C-51.61 0, -103.22 0, -160 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(350 70) rotate(0 -80 0)"><path d="M-131.81 -10.26 C-142.5 -6.37, -153.18 -2.48, -160 0 M-131.81 -10.26 C-140.9 -6.95, -150 -3.64, -160 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(350 70) rotate(0 -80 0)"><path d="M-131.81 10.26 C-142.5 6.37, -153.18 2.48, -160 0 M-131.81 10.26 C-140.9 6.95, -150 3.64, -160 0" stroke="#000000" stroke-width="1" fill="none"></path></g></g><g transform="translate(472.8076349537894 133.68057374010323) rotate(0 5 8.5)"><text x="0" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="start" style="white-space: pre;" direction="ltr">1</text></g><g transform="translate(268.90132808335125 38.78078312115713) rotate(0 5 8.5)"><text x="0" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="start" style="white-space: pre;" direction="ltr">2</text></g></svg>
\ No newline at end of file
diff --git a/website/public/img/terminating_gateway_to_lambda.svg b/website/public/img/terminating_gateway_to_lambda.svg
index fbd414b258ee..fd8c5b619579 100644
--- a/website/public/img/terminating_gateway_to_lambda.svg
+++ b/website/public/img/terminating_gateway_to_lambda.svg
@@ -13,4 +13,4 @@
       }
     </style>
   </defs>
-  <rect x="0" y="0" width="900" height="280" fill="#ffffff"></rect><g stroke-linecap="round" transform="translate(350 30) rotate(0 90 40)"><path d="M0 0 C70.2 0, 140.4 0, 180 0 M0 0 C36.45 0, 72.91 0, 180 0 M180 0 C180 20.64, 180 41.27, 180 80 M180 0 C180 18.95, 180 37.9, 180 80 M180 80 C120.1 80, 60.2 80, 0 80 M180 80 C122.36 80, 64.72 80, 0 80 M0 80 C0 57.38, 0 34.75, 0 0 M0 80 C0 55.34, 0 30.69, 0 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(355 53) rotate(0 85 17)"><text x="85" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="middle" style="white-space: pre;" direction="ltr">Terminating</text><text x="85" y="30" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="middle" style="white-space: pre;" direction="ltr">Gateway</text></g><g stroke-linecap="round" transform="translate(690 30) rotate(0 90 40)"><path d="M0 0 C42.64 0, 85.28 0, 180 0 M0 0 C43.33 0, 86.66 0, 180 0 M180 0 C180 29.12, 180 58.23, 180 80 M180 0 C180 29.64, 180 59.27, 180 80 M180 80 C134.85 80, 89.71 80, 0 80 M180 80 C112.6 80, 45.21 80, 0 80 M0 80 C0 48.06, 0 16.12, 0 0 M0 80 C0 63.39, 0 46.78, 0 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(695 61.5) rotate(0 85 8.5)"><text x="85" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="middle" style="white-space: pre;" direction="ltr">Connect Proxy</text></g><g stroke-linecap="round" transform="translate(690 170) rotate(0 90 40)"><path d="M0 0 C44.43 0, 88.86 0, 180 0 M0 0 C56.71 0, 113.43 0, 180 0 M180 0 C180 30.87, 180 61.75, 180 80 M180 0 C180 27.24, 180 54.49, 180 80 M180 80 C143.88 80, 107.76 80, 0 80 M180 80 C125.82 80, 71.65 80, 0 80 M0 80 C0 51.64, 0 23.27, 0 0 M0 80 C0 58.2, 0 36.39, 0 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(695 201.5) rotate(0 85 8.5)"><text x="85" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="middle" style="white-space: pre;" direction="ltr">Service</text></g><g stroke-linecap="round" transform="translate(670 10) rotate(0 110 130)"><path d="M0 0 C68.4 0, 136.81 0, 220 0 M0 0 C55.12 0, 110.24 0, 220 0 M220 0 C220 75.75, 220 151.5, 220 260 M220 0 C220 75.67, 220 151.33, 220 260 M220 260 C173.64 260, 127.27 260, 0 260 M220 260 C169.79 260, 119.58 260, 0 260 M0 260 C0 176.21, 0 92.43, 0 0 M0 260 C0 160.84, 0 61.67, 0 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g stroke-linecap="round"><g transform="translate(790 170) rotate(0 0 -30)"><path d="M0 0 C0 -10, 0 -50, 0 -60 M0 0 C0 -10, 0 -50, 0 -60" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(790 170) rotate(0 0 -30)"><path d="M10.26 -31.81 C7.58 -39.17, 4.9 -46.53, 0 -60 M10.26 -31.81 C6.23 -42.87, 2.21 -53.94, 0 -60" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(790 170) rotate(0 0 -30)"><path d="M-10.26 -31.81 C-7.58 -39.17, -4.9 -46.53, 0 -60 M-10.26 -31.81 C-6.23 -42.87, -2.21 -53.94, 0 -60" stroke="#000000" stroke-width="1" fill="none"></path></g></g><g stroke-linecap="round"><g transform="translate(690 70) rotate(0 -80 0)"><path d="M0 0 C-49.94 0, -99.88 0, -160 0 M0 0 C-42.59 0, -85.18 0, -160 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(690 70) rotate(0 -80 0)"><path d="M-131.81 -10.26 C-140.61 -7.06, -149.41 -3.86, -160 0 M-131.81 -10.26 C-139.31 -7.53, -146.82 -4.8, -160 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(690 70) rotate(0 -80 0)"><path d="M-131.81 10.26 C-140.61 7.06, -149.41 3.86, -160 0 M-131.81 10.26 C-139.31 7.53, -146.82 4.8, -160 0" stroke="#000000" stroke-width="1" fill="none"></path></g></g><g transform="translate(812.8076349537894 133.68057374010277) rotate(0 5 8.5)"><text x="0" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="start" style="white-space: pre;" direction="ltr">1</text></g><g transform="translate(610 50) rotate(0 5 8.5)"><text x="0" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="start" style="white-space: pre;" direction="ltr">2</text></g><g stroke-linecap="round"><g transform="translate(350 70) rotate(0 -80 0)"><path d="M0 0 C-41.37 0, -82.74 0, -160 0 M0 0 C-48.4 0, -96.8 0, -160 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(350 70) rotate(0 -80 0)"><path d="M-131.81 -10.26 C-139.1 -7.61, -146.39 -4.95, -160 0 M-131.81 -10.26 C-140.34 -7.16, -148.86 -4.05, -160 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(350 70) rotate(0 -80 0)"><path d="M-131.81 10.26 C-139.1 7.61, -146.39 4.95, -160 0 M-131.81 10.26 C-140.34 7.16, -148.86 4.05, -160 0" stroke="#000000" stroke-width="1" fill="none"></path></g></g><g stroke-linecap="round" transform="translate(10 30) rotate(0 90 40)"><path d="M0 0 C67.4 0, 134.79 0, 180 0 M0 0 C71.87 0, 143.74 0, 180 0 M180 0 C180 16.61, 180 33.22, 180 80 M180 0 C180 26.86, 180 53.73, 180 80 M180 80 C114.97 80, 49.94 80, 0 80 M180 80 C141.35 80, 102.7 80, 0 80 M0 80 C0 63.22, 0 46.44, 0 0 M0 80 C0 54.29, 0 28.59, 0 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(15 61.5) rotate(0 85 8.5)"><text x="85" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="middle" style="white-space: pre;" direction="ltr">Lambda</text></g><g transform="translate(270 50) rotate(0 5 8.5)"><text x="0" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="start" style="white-space: pre;" direction="ltr">3</text></g></svg>
\ No newline at end of file
+  <rect x="0" y="0" width="900" height="280" fill="#ffffff"></rect><g stroke-linecap="round" transform="translate(350 30) rotate(0 90 40)"><path d="M0 0 C70.2 0, 140.4 0, 180 0 M0 0 C36.45 0, 72.91 0, 180 0 M180 0 C180 20.64, 180 41.27, 180 80 M180 0 C180 18.95, 180 37.9, 180 80 M180 80 C120.1 80, 60.2 80, 0 80 M180 80 C122.36 80, 64.72 80, 0 80 M0 80 C0 57.38, 0 34.75, 0 0 M0 80 C0 55.34, 0 30.69, 0 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(355 53) rotate(0 85 17)"><text x="85" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="middle" style="white-space: pre;" direction="ltr">Terminating</text><text x="85" y="30" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="middle" style="white-space: pre;" direction="ltr">Gateway</text></g><g stroke-linecap="round" transform="translate(690 30) rotate(0 90 40)"><path d="M0 0 C42.64 0, 85.28 0, 180 0 M0 0 C43.33 0, 86.66 0, 180 0 M180 0 C180 29.12, 180 58.23, 180 80 M180 0 C180 29.64, 180 59.27, 180 80 M180 80 C134.85 80, 89.71 80, 0 80 M180 80 C112.6 80, 45.21 80, 0 80 M0 80 C0 48.06, 0 16.12, 0 0 M0 80 C0 63.39, 0 46.78, 0 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(695 61.5) rotate(0 85 8.5)"><text x="85" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="middle" style="white-space: pre;" direction="ltr">Mesh Sidecar Proxy</text></g><g stroke-linecap="round" transform="translate(690 170) rotate(0 90 40)"><path d="M0 0 C44.43 0, 88.86 0, 180 0 M0 0 C56.71 0, 113.43 0, 180 0 M180 0 C180 30.87, 180 61.75, 180 80 M180 0 C180 27.24, 180 54.49, 180 80 M180 80 C143.88 80, 107.76 80, 0 80 M180 80 C125.82 80, 71.65 80, 0 80 M0 80 C0 51.64, 0 23.27, 0 0 M0 80 C0 58.2, 0 36.39, 0 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(695 201.5) rotate(0 85 8.5)"><text x="85" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="middle" style="white-space: pre;" direction="ltr">Service</text></g><g stroke-linecap="round" transform="translate(670 10) rotate(0 110 130)"><path d="M0 0 C68.4 0, 136.81 0, 220 0 M0 0 C55.12 0, 110.24 0, 220 0 M220 0 C220 75.75, 220 151.5, 220 260 M220 0 C220 75.67, 220 151.33, 220 260 M220 260 C173.64 260, 127.27 260, 0 260 M220 260 C169.79 260, 119.58 260, 0 260 M0 260 C0 176.21, 0 92.43, 0 0 M0 260 C0 160.84, 0 61.67, 0 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g stroke-linecap="round"><g transform="translate(790 170) rotate(0 0 -30)"><path d="M0 0 C0 -10, 0 -50, 0 -60 M0 0 C0 -10, 0 -50, 0 -60" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(790 170) rotate(0 0 -30)"><path d="M10.26 -31.81 C7.58 -39.17, 4.9 -46.53, 0 -60 M10.26 -31.81 C6.23 -42.87, 2.21 -53.94, 0 -60" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(790 170) rotate(0 0 -30)"><path d="M-10.26 -31.81 C-7.58 -39.17, -4.9 -46.53, 0 -60 M-10.26 -31.81 C-6.23 -42.87, -2.21 -53.94, 0 -60" stroke="#000000" stroke-width="1" fill="none"></path></g></g><g stroke-linecap="round"><g transform="translate(690 70) rotate(0 -80 0)"><path d="M0 0 C-49.94 0, -99.88 0, -160 0 M0 0 C-42.59 0, -85.18 0, -160 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(690 70) rotate(0 -80 0)"><path d="M-131.81 -10.26 C-140.61 -7.06, -149.41 -3.86, -160 0 M-131.81 -10.26 C-139.31 -7.53, -146.82 -4.8, -160 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(690 70) rotate(0 -80 0)"><path d="M-131.81 10.26 C-140.61 7.06, -149.41 3.86, -160 0 M-131.81 10.26 C-139.31 7.53, -146.82 4.8, -160 0" stroke="#000000" stroke-width="1" fill="none"></path></g></g><g transform="translate(812.8076349537894 133.68057374010277) rotate(0 5 8.5)"><text x="0" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="start" style="white-space: pre;" direction="ltr">1</text></g><g transform="translate(610 50) rotate(0 5 8.5)"><text x="0" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="start" style="white-space: pre;" direction="ltr">2</text></g><g stroke-linecap="round"><g transform="translate(350 70) rotate(0 -80 0)"><path d="M0 0 C-41.37 0, -82.74 0, -160 0 M0 0 C-48.4 0, -96.8 0, -160 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(350 70) rotate(0 -80 0)"><path d="M-131.81 -10.26 C-139.1 -7.61, -146.39 -4.95, -160 0 M-131.81 -10.26 C-140.34 -7.16, -148.86 -4.05, -160 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(350 70) rotate(0 -80 0)"><path d="M-131.81 10.26 C-139.1 7.61, -146.39 4.95, -160 0 M-131.81 10.26 C-140.34 7.16, -148.86 4.05, -160 0" stroke="#000000" stroke-width="1" fill="none"></path></g></g><g stroke-linecap="round" transform="translate(10 30) rotate(0 90 40)"><path d="M0 0 C67.4 0, 134.79 0, 180 0 M0 0 C71.87 0, 143.74 0, 180 0 M180 0 C180 16.61, 180 33.22, 180 80 M180 0 C180 26.86, 180 53.73, 180 80 M180 80 C114.97 80, 49.94 80, 0 80 M180 80 C141.35 80, 102.7 80, 0 80 M0 80 C0 63.22, 0 46.44, 0 0 M0 80 C0 54.29, 0 28.59, 0 0" stroke="#000000" stroke-width="1" fill="none"></path></g><g transform="translate(15 61.5) rotate(0 85 8.5)"><text x="85" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="middle" style="white-space: pre;" direction="ltr">Lambda</text></g><g transform="translate(270 50) rotate(0 5 8.5)"><text x="0" y="13" font-family="Helvetica, Segoe UI Emoji" font-size="16px" fill="#000000" text-anchor="start" style="white-space: pre;" direction="ltr">3</text></g></svg>
\ No newline at end of file

From 83ad0dfa744bac268a0fb22515327f7dbd12f081 Mon Sep 17 00:00:00 2001
From: cskh <hui.kang@hashicorp.com>
Date: Mon, 8 May 2023 12:02:31 -0400
Subject: [PATCH 46/92] Upgrade test target image (#17226)

* upgrade test: add targetimage name as parameter to upgrade function

- the image name of latest version and target version could be
  different. Add the parameter of targetImage to the upgrade
  function

* fix a bug of expected error
---
 .../consul-container/libs/cluster/cluster.go         |  3 ++-
 .../libs/topology/peering_topology.go                |  3 +++
 .../consul-container/libs/utils/version.go           |  7 +++++++
 .../peering/rotate_server_and_ca_then_fail_test.go   |  2 +-
 .../consul-container/test/upgrade/acl_node_test.go   |  3 ++-
 .../consul-container/test/upgrade/basic_test.go      |  8 ++++----
 .../test/upgrade/fullstopupgrade_test.go             |  6 +++---
 .../test/upgrade/ingress_gateway_grpc_test.go        |  7 ++++---
 .../test/upgrade/ingress_gateway_sds_test.go         |  7 ++++---
 .../test/upgrade/ingress_gateway_test.go             |  7 ++++---
 .../resolver_default_subset_test.go                  |  7 ++++---
 .../test/upgrade/peering_control_plane_mgw_test.go   |  6 +++---
 .../test/upgrade/peering_http_test.go                | 12 ++++++------
 13 files changed, 47 insertions(+), 31 deletions(-)

diff --git a/test/integration/consul-container/libs/cluster/cluster.go b/test/integration/consul-container/libs/cluster/cluster.go
index 98eb2419daaf..e5f6537c166e 100644
--- a/test/integration/consul-container/libs/cluster/cluster.go
+++ b/test/integration/consul-container/libs/cluster/cluster.go
@@ -304,7 +304,7 @@ func (c *Cluster) Remove(n Agent) error {
 // helpers below.
 //
 // This lets us have tests that assert that an upgrade will fail.
-func (c *Cluster) StandardUpgrade(t *testing.T, ctx context.Context, targetVersion string) error {
+func (c *Cluster) StandardUpgrade(t *testing.T, ctx context.Context, targetImage string, targetVersion string) error {
 	var err error
 	// We take a snapshot, but note that we currently do nothing with it.
 	if c.ACLEnabled {
@@ -348,6 +348,7 @@ func (c *Cluster) StandardUpgrade(t *testing.T, ctx context.Context, targetVersi
 
 	upgradeFn := func(agent Agent, clientFactory func() (*api.Client, error)) error {
 		config := agent.GetConfig()
+		config.Image = targetImage
 		config.Version = targetVersion
 
 		if agent.IsServer() {
diff --git a/test/integration/consul-container/libs/topology/peering_topology.go b/test/integration/consul-container/libs/topology/peering_topology.go
index 6e579db18cbe..87c2743f3d3d 100644
--- a/test/integration/consul-container/libs/topology/peering_topology.go
+++ b/test/integration/consul-container/libs/topology/peering_topology.go
@@ -44,6 +44,7 @@ type BuiltCluster struct {
 // It returns objects of the accepting cluster, dialing cluster, staticServerSvc, and staticClientSvcSidecar
 func BasicPeeringTwoClustersSetup(
 	t *testing.T,
+	consulImage string,
 	consulVersion string,
 	peeringThroughMeshgateway bool,
 ) (*BuiltCluster, *BuiltCluster) {
@@ -52,6 +53,7 @@ func BasicPeeringTwoClustersSetup(
 		NumClients: 1,
 		BuildOpts: &libcluster.BuildOptions{
 			Datacenter:           "dc1",
+			ConsulImageName:      consulImage,
 			ConsulVersion:        consulVersion,
 			InjectAutoEncryption: true,
 		},
@@ -63,6 +65,7 @@ func BasicPeeringTwoClustersSetup(
 		NumClients: 1,
 		BuildOpts: &libcluster.BuildOptions{
 			Datacenter:           "dc2",
+			ConsulImageName:      consulImage,
 			ConsulVersion:        consulVersion,
 			InjectAutoEncryption: true,
 		},
diff --git a/test/integration/consul-container/libs/utils/version.go b/test/integration/consul-container/libs/utils/version.go
index 4d1ae5af0928..705b09a90ead 100644
--- a/test/integration/consul-container/libs/utils/version.go
+++ b/test/integration/consul-container/libs/utils/version.go
@@ -47,6 +47,13 @@ func GetTargetImageName() string {
 	return targetImageName
 }
 
+func GetLatestImageName() string {
+	if Debug {
+		return LatestImageName + "-dbg"
+	}
+	return LatestImageName
+}
+
 func DockerImage(image, version string) string {
 	v := image + ":" + version
 	if image == DefaultImageNameENT && isSemVer(version) {
diff --git a/test/integration/consul-container/test/peering/rotate_server_and_ca_then_fail_test.go b/test/integration/consul-container/test/peering/rotate_server_and_ca_then_fail_test.go
index 9a150d969632..ccf5b206ce6d 100644
--- a/test/integration/consul-container/test/peering/rotate_server_and_ca_then_fail_test.go
+++ b/test/integration/consul-container/test/peering/rotate_server_and_ca_then_fail_test.go
@@ -53,7 +53,7 @@ import (
 func TestPeering_RotateServerAndCAThenFail_(t *testing.T) {
 	t.Parallel()
 
-	accepting, dialing := libtopology.BasicPeeringTwoClustersSetup(t, utils.TargetVersion, false)
+	accepting, dialing := libtopology.BasicPeeringTwoClustersSetup(t, utils.GetTargetImageName(), utils.TargetVersion, false)
 	var (
 		acceptingCluster     = accepting.Cluster
 		dialingCluster       = dialing.Cluster
diff --git a/test/integration/consul-container/test/upgrade/acl_node_test.go b/test/integration/consul-container/test/upgrade/acl_node_test.go
index 52b0728b52cb..94886a4e27a4 100644
--- a/test/integration/consul-container/test/upgrade/acl_node_test.go
+++ b/test/integration/consul-container/test/upgrade/acl_node_test.go
@@ -27,6 +27,7 @@ func TestACL_NodeToken(t *testing.T) {
 		NumClients: 1,
 		BuildOpts: &libcluster.BuildOptions{
 			Datacenter:           "dc1",
+			ConsulImageName:      utils.GetLatestImageName(),
 			ConsulVersion:        utils.LatestVersion,
 			InjectAutoEncryption: false,
 			ACLEnabled:           true,
@@ -38,7 +39,7 @@ func TestACL_NodeToken(t *testing.T) {
 		cluster.Agents[1].GetAgentName())
 	require.NoError(t, err)
 
-	err = cluster.StandardUpgrade(t, context.Background(), utils.TargetVersion)
+	err = cluster.StandardUpgrade(t, context.Background(), utils.GetTargetImageName(), utils.TargetVersion)
 	require.NoError(t, err)
 
 	// Post upgrade validation: agent token can be used to query the node
diff --git a/test/integration/consul-container/test/upgrade/basic_test.go b/test/integration/consul-container/test/upgrade/basic_test.go
index e94227dbdc08..e9483f111693 100644
--- a/test/integration/consul-container/test/upgrade/basic_test.go
+++ b/test/integration/consul-container/test/upgrade/basic_test.go
@@ -22,8 +22,8 @@ func TestBasic(t *testing.T) {
 	t.Parallel()
 
 	configCtx := libcluster.NewBuildContext(t, libcluster.BuildOptions{
-		ConsulImageName: utils.GetTargetImageName(),
-		ConsulVersion:   utils.TargetVersion,
+		ConsulImageName: utils.GetLatestImageName(),
+		ConsulVersion:   utils.LatestVersion,
 	})
 
 	const numServers = 1
@@ -32,7 +32,7 @@ func TestBasic(t *testing.T) {
 		Bootstrap(numServers).
 		ToAgentConfig(t)
 	t.Logf("Cluster config:\n%s", serverConf.JSON)
-	require.Equal(t, utils.TargetVersion, serverConf.Version) // TODO: remove
+	require.Equal(t, utils.LatestVersion, serverConf.Version) // TODO: remove
 
 	cluster, err := libcluster.NewN(t, *serverConf, numServers)
 	require.NoError(t, err)
@@ -53,7 +53,7 @@ func TestBasic(t *testing.T) {
 
 	// upgrade the cluster to the Target version
 	t.Logf("initiating standard upgrade to version=%q", utils.TargetVersion)
-	err = cluster.StandardUpgrade(t, context.Background(), utils.TargetVersion)
+	err = cluster.StandardUpgrade(t, context.Background(), utils.GetTargetImageName(), utils.TargetVersion)
 
 	require.NoError(t, err)
 	libcluster.WaitForLeader(t, cluster, client)
diff --git a/test/integration/consul-container/test/upgrade/fullstopupgrade_test.go b/test/integration/consul-container/test/upgrade/fullstopupgrade_test.go
index dfe6e1a13510..51ad8ea745d9 100644
--- a/test/integration/consul-container/test/upgrade/fullstopupgrade_test.go
+++ b/test/integration/consul-container/test/upgrade/fullstopupgrade_test.go
@@ -51,7 +51,7 @@ func TestStandardUpgradeToTarget_fromLatest(t *testing.T) {
 
 	run := func(t *testing.T, tc testcase) {
 		configCtx := libcluster.NewBuildContext(t, libcluster.BuildOptions{
-			ConsulImageName: utils.GetTargetImageName(),
+			ConsulImageName: utils.GetLatestImageName(),
 			ConsulVersion:   tc.oldVersion,
 		})
 
@@ -107,7 +107,7 @@ func TestStandardUpgradeToTarget_fromLatest(t *testing.T) {
 
 		// upgrade the cluster to the Target version
 		t.Logf("initiating standard upgrade to version=%q", tc.targetVersion)
-		err = cluster.StandardUpgrade(t, context.Background(), tc.targetVersion)
+		err = cluster.StandardUpgrade(t, context.Background(), utils.GetTargetImageName(), tc.targetVersion)
 
 		if !tc.expectErr {
 			require.NoError(t, err)
@@ -122,7 +122,7 @@ func TestStandardUpgradeToTarget_fromLatest(t *testing.T) {
 				require.Equal(r, serviceName, service[0].ServiceName)
 			})
 		} else {
-			require.Error(t, fmt.Errorf("context deadline exceeded"))
+			require.ErrorContains(t, err, "context deadline exceeded")
 		}
 	}
 
diff --git a/test/integration/consul-container/test/upgrade/ingress_gateway_grpc_test.go b/test/integration/consul-container/test/upgrade/ingress_gateway_grpc_test.go
index e7d3ff02d0e0..873eabcf0e4f 100644
--- a/test/integration/consul-container/test/upgrade/ingress_gateway_grpc_test.go
+++ b/test/integration/consul-container/test/upgrade/ingress_gateway_grpc_test.go
@@ -25,8 +25,9 @@ func TestIngressGateway_GRPC_UpgradeToTarget_fromLatest(t *testing.T) {
 		NumServers: 1,
 		NumClients: 1,
 		BuildOpts: &libcluster.BuildOptions{
-			Datacenter:    "dc1",
-			ConsulVersion: utils.LatestVersion,
+			Datacenter:      "dc1",
+			ConsulImageName: utils.GetLatestImageName(),
+			ConsulVersion:   utils.LatestVersion,
 		},
 		ApplyDefaultProxySettings: true,
 	})
@@ -117,7 +118,7 @@ func TestIngressGateway_GRPC_UpgradeToTarget_fromLatest(t *testing.T) {
 	}
 
 	t.Logf("Upgrade to version %s", utils.TargetVersion)
-	err = cluster.StandardUpgrade(t, context.Background(), utils.TargetVersion)
+	err = cluster.StandardUpgrade(t, context.Background(), utils.GetTargetImageName(), utils.TargetVersion)
 	require.NoError(t, err)
 	require.NoError(t, igw.Restart())
 
diff --git a/test/integration/consul-container/test/upgrade/ingress_gateway_sds_test.go b/test/integration/consul-container/test/upgrade/ingress_gateway_sds_test.go
index 3eec4a4771e0..52ee91bac8fc 100644
--- a/test/integration/consul-container/test/upgrade/ingress_gateway_sds_test.go
+++ b/test/integration/consul-container/test/upgrade/ingress_gateway_sds_test.go
@@ -41,8 +41,9 @@ func TestIngressGateway_SDS_UpgradeToTarget_fromLatest(t *testing.T) {
 		NumServers: 1,
 		NumClients: 2,
 		BuildOpts: &libcluster.BuildOptions{
-			Datacenter:    "dc1",
-			ConsulVersion: utils.LatestVersion,
+			Datacenter:      "dc1",
+			ConsulImageName: utils.GetLatestImageName(),
+			ConsulVersion:   utils.LatestVersion,
 		},
 		ApplyDefaultProxySettings: true,
 	})
@@ -274,7 +275,7 @@ func TestIngressGateway_SDS_UpgradeToTarget_fromLatest(t *testing.T) {
 
 	// Upgrade the cluster to utils.TargetVersion
 	t.Logf("Upgrade to version %s", utils.TargetVersion)
-	err = cluster.StandardUpgrade(t, context.Background(), utils.TargetVersion)
+	err = cluster.StandardUpgrade(t, context.Background(), utils.GetTargetImageName(), utils.TargetVersion)
 	require.NoError(t, err)
 	require.NoError(t, igw.Restart())
 
diff --git a/test/integration/consul-container/test/upgrade/ingress_gateway_test.go b/test/integration/consul-container/test/upgrade/ingress_gateway_test.go
index 56852a52ee6a..c0acfeb775b5 100644
--- a/test/integration/consul-container/test/upgrade/ingress_gateway_test.go
+++ b/test/integration/consul-container/test/upgrade/ingress_gateway_test.go
@@ -49,8 +49,9 @@ func TestIngressGateway_UpgradeToTarget_fromLatest(t *testing.T) {
 		NumServers: 1,
 		NumClients: 2,
 		BuildOpts: &libcluster.BuildOptions{
-			Datacenter:    "dc1",
-			ConsulVersion: utils.LatestVersion,
+			Datacenter:      "dc1",
+			ConsulImageName: utils.GetLatestImageName(),
+			ConsulVersion:   utils.LatestVersion,
 		},
 		ApplyDefaultProxySettings: true,
 	})
@@ -481,7 +482,7 @@ func TestIngressGateway_UpgradeToTarget_fromLatest(t *testing.T) {
 
 	// Upgrade the cluster to utils.utils.TargetVersion
 	t.Logf("Upgrade to version %s", utils.TargetVersion)
-	err = cluster.StandardUpgrade(t, context.Background(), utils.TargetVersion)
+	err = cluster.StandardUpgrade(t, context.Background(), utils.GetTargetImageName(), utils.TargetVersion)
 	require.NoError(t, err)
 	require.NoError(t, igw.Restart())
 
diff --git a/test/integration/consul-container/test/upgrade/l7_traffic_management/resolver_default_subset_test.go b/test/integration/consul-container/test/upgrade/l7_traffic_management/resolver_default_subset_test.go
index d2c99a3ce718..d264366fb675 100644
--- a/test/integration/consul-container/test/upgrade/l7_traffic_management/resolver_default_subset_test.go
+++ b/test/integration/consul-container/test/upgrade/l7_traffic_management/resolver_default_subset_test.go
@@ -99,7 +99,7 @@ func TestTrafficManagement_ResolveDefaultSubset(t *testing.T) {
 	assertionFn()
 
 	// Upgrade cluster, restart sidecars then begin service traffic validation
-	require.NoError(t, cluster.StandardUpgrade(t, context.Background(), utils.TargetVersion))
+	require.NoError(t, cluster.StandardUpgrade(t, context.Background(), utils.GetTargetImageName(), utils.TargetVersion))
 	require.NoError(t, staticClientProxy.Restart())
 	require.NoError(t, staticServerProxy.Restart())
 	require.NoError(t, serverConnectProxyV1.Restart())
@@ -198,7 +198,7 @@ func TestTrafficManagement_ResolverDefaultOnlyPassing(t *testing.T) {
 	assertionFn()
 
 	// Upgrade cluster, restart sidecars then begin service traffic validation
-	require.NoError(t, cluster.StandardUpgrade(t, context.Background(), utils.TargetVersion))
+	require.NoError(t, cluster.StandardUpgrade(t, context.Background(), utils.GetTargetImageName(), utils.TargetVersion))
 	require.NoError(t, staticClientProxy.Restart())
 	require.NoError(t, staticServerProxy.Restart())
 	require.NoError(t, serverConnectProxyV1.Restart())
@@ -307,7 +307,7 @@ func TestTrafficManagement_ResolverSubsetRedirect(t *testing.T) {
 	assertionFn()
 
 	// Upgrade cluster, restart sidecars then begin service traffic validation
-	require.NoError(t, cluster.StandardUpgrade(t, context.Background(), utils.TargetVersion))
+	require.NoError(t, cluster.StandardUpgrade(t, context.Background(), utils.GetTargetImageName(), utils.TargetVersion))
 	require.NoError(t, staticClientProxy.Restart())
 	require.NoError(t, staticServerProxy.Restart())
 	require.NoErrorf(t, server2ConnectProxy.Restart(), "%s", server2ConnectProxy.GetName())
@@ -320,6 +320,7 @@ func TestTrafficManagement_ResolverSubsetRedirect(t *testing.T) {
 
 func setup(t *testing.T) (*libcluster.Cluster, libservice.Service, libservice.Service) {
 	buildOpts := &libcluster.BuildOptions{
+		ConsulImageName:      utils.GetLatestImageName(),
 		ConsulVersion:        utils.LatestVersion,
 		Datacenter:           "dc1",
 		InjectAutoEncryption: true,
diff --git a/test/integration/consul-container/test/upgrade/peering_control_plane_mgw_test.go b/test/integration/consul-container/test/upgrade/peering_control_plane_mgw_test.go
index e341c347a5c8..4e9355657fa5 100644
--- a/test/integration/consul-container/test/upgrade/peering_control_plane_mgw_test.go
+++ b/test/integration/consul-container/test/upgrade/peering_control_plane_mgw_test.go
@@ -27,7 +27,7 @@ import (
 func TestPeering_ControlPlaneMGW(t *testing.T) {
 	t.Parallel()
 
-	accepting, dialing := libtopology.BasicPeeringTwoClustersSetup(t, utils.LatestVersion, true)
+	accepting, dialing := libtopology.BasicPeeringTwoClustersSetup(t, utils.GetLatestImageName(), utils.LatestVersion, true)
 	var (
 		acceptingCluster = accepting.Cluster
 		dialingCluster   = dialing.Cluster
@@ -51,11 +51,11 @@ func TestPeering_ControlPlaneMGW(t *testing.T) {
 		"upstream_cx_total", 1)
 
 	// Upgrade the accepting cluster and assert peering is still ACTIVE
-	require.NoError(t, acceptingCluster.StandardUpgrade(t, context.Background(), utils.TargetVersion))
+	require.NoError(t, acceptingCluster.StandardUpgrade(t, context.Background(), utils.GetTargetImageName(), utils.TargetVersion))
 	libassert.PeeringStatus(t, acceptingClient, libtopology.AcceptingPeerName, api.PeeringStateActive)
 	libassert.PeeringStatus(t, dialingClient, libtopology.DialingPeerName, api.PeeringStateActive)
 
-	require.NoError(t, dialingCluster.StandardUpgrade(t, context.Background(), utils.TargetVersion))
+	require.NoError(t, dialingCluster.StandardUpgrade(t, context.Background(), utils.GetTargetImageName(), utils.TargetVersion))
 	libassert.PeeringStatus(t, acceptingClient, libtopology.AcceptingPeerName, api.PeeringStateActive)
 	libassert.PeeringStatus(t, dialingClient, libtopology.DialingPeerName, api.PeeringStateActive)
 
diff --git a/test/integration/consul-container/test/upgrade/peering_http_test.go b/test/integration/consul-container/test/upgrade/peering_http_test.go
index 76e38ca679f8..e1cffe4700c1 100644
--- a/test/integration/consul-container/test/upgrade/peering_http_test.go
+++ b/test/integration/consul-container/test/upgrade/peering_http_test.go
@@ -20,14 +20,14 @@ import (
 
 func TestPeering_Basic(t *testing.T) {
 	t.Parallel()
-	accepting, dialing := libtopology.BasicPeeringTwoClustersSetup(t, utils.LatestVersion, false)
+	accepting, dialing := libtopology.BasicPeeringTwoClustersSetup(t, utils.GetLatestImageName(), utils.LatestVersion, false)
 	peeringUpgrade(t, accepting, dialing, utils.TargetVersion)
 	peeringPostUpgradeValidation(t, dialing)
 }
 
 func TestPeering_HTTPRouter(t *testing.T) {
 	t.Parallel()
-	accepting, dialing := libtopology.BasicPeeringTwoClustersSetup(t, utils.LatestVersion, false)
+	accepting, dialing := libtopology.BasicPeeringTwoClustersSetup(t, utils.GetLatestImageName(), utils.LatestVersion, false)
 	acceptingCluster := accepting.Cluster
 
 	// Create a second static-server at the client agent of accepting cluster and
@@ -90,7 +90,7 @@ func TestPeering_HTTPRouter(t *testing.T) {
 func TestPeering_HTTPResolverAndFailover(t *testing.T) {
 	t.Parallel()
 
-	accepting, dialing := libtopology.BasicPeeringTwoClustersSetup(t, utils.LatestVersion, false)
+	accepting, dialing := libtopology.BasicPeeringTwoClustersSetup(t, utils.GetLatestImageName(), utils.LatestVersion, false)
 	dialingCluster := dialing.Cluster
 
 	require.NoError(t, dialingCluster.ConfigEntryWrite(&api.ProxyConfigEntry{
@@ -183,7 +183,7 @@ func TestPeering_HTTPResolverAndFailover(t *testing.T) {
 func TestPeering_HTTPResolverAndSplitter(t *testing.T) {
 	t.Parallel()
 
-	accepting, dialing := libtopology.BasicPeeringTwoClustersSetup(t, utils.LatestVersion, false)
+	accepting, dialing := libtopology.BasicPeeringTwoClustersSetup(t, utils.GetLatestImageName(), utils.LatestVersion, false)
 	dialingCluster := dialing.Cluster
 
 	require.NoError(t, dialingCluster.ConfigEntryWrite(&api.ProxyConfigEntry{
@@ -295,11 +295,11 @@ func peeringUpgrade(t *testing.T, accepting, dialing *libtopology.BuiltCluster,
 	_, staticClientPort := dialing.Container.GetAddr()
 
 	// Upgrade the accepting cluster and assert peering is still ACTIVE
-	require.NoError(t, accepting.Cluster.StandardUpgrade(t, context.Background(), targetVersion))
+	require.NoError(t, accepting.Cluster.StandardUpgrade(t, context.Background(), utils.GetTargetImageName(), targetVersion))
 	libassert.PeeringStatus(t, acceptingClient, libtopology.AcceptingPeerName, api.PeeringStateActive)
 	libassert.PeeringStatus(t, dialingClient, libtopology.DialingPeerName, api.PeeringStateActive)
 
-	require.NoError(t, dialing.Cluster.StandardUpgrade(t, context.Background(), targetVersion))
+	require.NoError(t, dialing.Cluster.StandardUpgrade(t, context.Background(), utils.GetTargetImageName(), targetVersion))
 	libassert.PeeringStatus(t, acceptingClient, libtopology.AcceptingPeerName, api.PeeringStateActive)
 	libassert.PeeringStatus(t, dialingClient, libtopology.DialingPeerName, api.PeeringStateActive)
 

From db253b63958aa65a7d9d3679ee8b3f69a7ef6c1f Mon Sep 17 00:00:00 2001
From: cskh <hui.kang@hashicorp.com>
Date: Mon, 8 May 2023 13:15:38 -0400
Subject: [PATCH 47/92] upgrade test: use docker.mirror.hashicorp.services to
 avoid docker login (#17186)

* upgrade test: use docker.mirror.hashicorp.services to avoid docker login

* upgrade tests: remove docker login

Signed-off-by: Dan Bond <danbond@protonmail.com>

---------

Signed-off-by: Dan Bond <danbond@protonmail.com>
Co-authored-by: Dan Bond <danbond@protonmail.com>
---
 .github/workflows/test-integrations.yml | 32 +------------------------
 1 file changed, 1 insertion(+), 31 deletions(-)

diff --git a/.github/workflows/test-integrations.yml b/.github/workflows/test-integrations.yml
index 452e3e87e1a5..33d1ccc9e207 100644
--- a/.github/workflows/test-integrations.yml
+++ b/.github/workflows/test-integrations.yml
@@ -324,7 +324,7 @@ jobs:
               ${{ matrix.test-cases }} \
               --target-image ${{ env.CONSUL_LATEST_IMAGE_NAME }} \
               --target-version local \
-              --latest-image ${{ env.CONSUL_LATEST_IMAGE_NAME }} \
+              --latest-image docker.mirror.hashicorp.services/${{ env.CONSUL_LATEST_IMAGE_NAME }} \
               --latest-version latest
             ls -lrt
         env:
@@ -376,9 +376,6 @@ jobs:
   
   upgrade-integration-test:
     runs-on: ${{ fromJSON(needs.setup.outputs.compute-xl) }}
-    permissions:
-      id-token: write # NOTE: this permission is explicitly required for Vault auth.
-      contents: read
     needs:
       - setup
       - dev-build
@@ -397,33 +394,6 @@ jobs:
           go-version-file: 'go.mod'
       - run: go env
 
-      # NOTE: ENT specific step as we store secrets in Vault.
-      - name: Authenticate to Vault
-        if: ${{ endsWith(github.repository, '-enterprise') }}
-        id: vault-auth
-        run: vault-auth
-
-      # NOTE: ENT specific step as we store secrets in Vault.
-      - name: Fetch Secrets
-        if: ${{ endsWith(github.repository, '-enterprise') }}
-        id: secrets
-        uses: hashicorp/vault-action@v2.5.0
-        with:
-          url: ${{ steps.vault-auth.outputs.addr }}
-          caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
-          token: ${{ steps.vault-auth.outputs.token }}
-          secrets: |
-              kv/data/github/${{ github.repository }}/dockerhub username | DOCKERHUB_USERNAME;
-              kv/data/github/${{ github.repository }}/dockerhub token | DOCKERHUB_TOKEN;
-
-      # NOTE: conditional specific logic as we store secrets in Vault in ENT and use GHA secrets in OSS.
-      - name: Login to Docker Hub
-        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # pin@v2.1.0
-        with:
-          username: ${{ endsWith(github.repository, '-enterprise') && steps.secrets.outputs.DOCKERHUB_USERNAME || secrets.DOCKERHUB_USERNAME }}
-          password: ${{ endsWith(github.repository, '-enterprise') && steps.secrets.outputs.DOCKERHUB_TOKEN || secrets.DOCKERHUB_TOKEN }}
-
-
       # Get go binary from workspace
       - name: fetch binary
         uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2

From 991a002fccce7433fc78c27fc127e3baeedb2534 Mon Sep 17 00:00:00 2001
From: Semir Patel <semir.patel@hashicorp.com>
Date: Mon, 8 May 2023 12:26:19 -0500
Subject: [PATCH 48/92] resource: List resources by owner (#17190)

---
 .../services/resource/list_by_owner.go        |  70 +++
 .../services/resource/list_by_owner_test.go   | 174 ++++++
 .../services/resource/mock_Backend.go         |  12 +-
 .../rate_limit_mappings.gen.go                |   1 +
 internal/storage/conformance/conformance.go   |  20 +-
 internal/storage/inmem/backend.go             |   6 +-
 internal/storage/inmem/store.go               |  11 +-
 internal/storage/raft/backend.go              |   6 +-
 internal/storage/storage.go                   |  16 +-
 proto-public/pbresource/resource.pb.binary.go |  20 +
 proto-public/pbresource/resource.pb.go        | 505 +++++++++++-------
 proto-public/pbresource/resource.proto        |  21 +
 proto-public/pbresource/resource_grpc.pb.go   |  42 ++
 13 files changed, 688 insertions(+), 216 deletions(-)
 create mode 100644 agent/grpc-external/services/resource/list_by_owner.go
 create mode 100644 agent/grpc-external/services/resource/list_by_owner_test.go

diff --git a/agent/grpc-external/services/resource/list_by_owner.go b/agent/grpc-external/services/resource/list_by_owner.go
new file mode 100644
index 000000000000..2cc203e72c30
--- /dev/null
+++ b/agent/grpc-external/services/resource/list_by_owner.go
@@ -0,0 +1,70 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package resource
+
+import (
+	"context"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/hashicorp/consul/acl"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+)
+
+func (s *Server) ListByOwner(ctx context.Context, req *pbresource.ListByOwnerRequest) (*pbresource.ListByOwnerResponse, error) {
+	if err := validateListByOwnerRequest(req); err != nil {
+		return nil, err
+	}
+
+	_, err := s.resolveType(req.Owner.Type)
+	if err != nil {
+		return nil, err
+	}
+
+	children, err := s.Backend.ListByOwner(ctx, req.Owner)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "failed list by owner: %v", err)
+	}
+
+	authz, err := s.getAuthorizer(tokenFromContext(ctx))
+	if err != nil {
+		return nil, err
+	}
+
+	result := make([]*pbresource.Resource, 0)
+	for _, child := range children {
+		reg, err := s.resolveType(child.Id.Type)
+		if err != nil {
+			return nil, err
+		}
+
+		// ACL filter
+		err = reg.ACLs.Read(authz, child.Id)
+		switch {
+		case acl.IsErrPermissionDenied(err):
+			continue
+		case err != nil:
+			return nil, status.Errorf(codes.Internal, "failed read acl: %v", err)
+		}
+
+		result = append(result, child)
+	}
+	return &pbresource.ListByOwnerResponse{Resources: result}, nil
+}
+
+func validateListByOwnerRequest(req *pbresource.ListByOwnerRequest) error {
+	if req.Owner == nil {
+		return status.Errorf(codes.InvalidArgument, "owner is required")
+	}
+
+	if err := validateId(req.Owner, "owner"); err != nil {
+		return err
+	}
+
+	if req.Owner.Uid == "" {
+		return status.Errorf(codes.InvalidArgument, "owner uid is required")
+	}
+	return nil
+}
diff --git a/agent/grpc-external/services/resource/list_by_owner_test.go b/agent/grpc-external/services/resource/list_by_owner_test.go
new file mode 100644
index 000000000000..19fe799caf08
--- /dev/null
+++ b/agent/grpc-external/services/resource/list_by_owner_test.go
@@ -0,0 +1,174 @@
+// // Copyright (c) HashiCorp, Inc.
+// // SPDX-License-Identifier: MPL-2.0
+
+package resource
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/consul/acl"
+	"github.com/hashicorp/consul/internal/resource/demo"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/hashicorp/consul/proto/private/prototest"
+
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+func TestListByOwner_InputValidation(t *testing.T) {
+	server := testServer(t)
+	client := testClient(t, server)
+
+	demo.RegisterTypes(server.Registry)
+
+	testCases := map[string]func(*pbresource.ListByOwnerRequest){
+		"no owner":   func(req *pbresource.ListByOwnerRequest) { req.Owner = nil },
+		"no type":    func(req *pbresource.ListByOwnerRequest) { req.Owner.Type = nil },
+		"no tenancy": func(req *pbresource.ListByOwnerRequest) { req.Owner.Tenancy = nil },
+		"no name":    func(req *pbresource.ListByOwnerRequest) { req.Owner.Name = "" },
+		"no uid":     func(req *pbresource.ListByOwnerRequest) { req.Owner.Uid = "" },
+		// clone necessary to not pollute DefaultTenancy
+		"tenancy partition not default": func(req *pbresource.ListByOwnerRequest) {
+			req.Owner.Tenancy = clone(req.Owner.Tenancy)
+			req.Owner.Tenancy.Partition = ""
+		},
+		"tenancy namespace not default": func(req *pbresource.ListByOwnerRequest) {
+			req.Owner.Tenancy = clone(req.Owner.Tenancy)
+			req.Owner.Tenancy.Namespace = ""
+		},
+		"tenancy peername not local": func(req *pbresource.ListByOwnerRequest) {
+			req.Owner.Tenancy = clone(req.Owner.Tenancy)
+			req.Owner.Tenancy.PeerName = ""
+		},
+	}
+	for desc, modFn := range testCases {
+		t.Run(desc, func(t *testing.T) {
+			res, err := demo.GenerateV2Artist()
+			require.NoError(t, err)
+
+			req := &pbresource.ListByOwnerRequest{Owner: res.Id}
+			modFn(req)
+
+			_, err = client.ListByOwner(testContext(t), req)
+			require.Error(t, err)
+			require.Equal(t, codes.InvalidArgument.String(), status.Code(err).String())
+		})
+	}
+}
+
+func TestListByOwner_TypeNotRegistered(t *testing.T) {
+	server := testServer(t)
+	client := testClient(t, server)
+
+	_, err := client.ListByOwner(context.Background(), &pbresource.ListByOwnerRequest{
+		Owner: &pbresource.ID{
+			Type:    demo.TypeV2Artist,
+			Tenancy: demo.TenancyDefault,
+			Uid:     "bogus",
+			Name:    "bogus",
+		},
+	})
+	require.Error(t, err)
+	require.Equal(t, codes.InvalidArgument.String(), status.Code(err).String())
+	require.Contains(t, err.Error(), "resource type demo.v2.artist not registered")
+}
+
+func TestListByOwner_Empty(t *testing.T) {
+	server := testServer(t)
+	demo.RegisterTypes(server.Registry)
+	client := testClient(t, server)
+
+	res, err := demo.GenerateV2Artist()
+	require.NoError(t, err)
+
+	rsp1, err := client.Write(testContext(t), &pbresource.WriteRequest{Resource: res})
+	require.NoError(t, err)
+
+	rsp2, err := client.ListByOwner(testContext(t), &pbresource.ListByOwnerRequest{Owner: rsp1.Resource.Id})
+	require.NoError(t, err)
+	require.Empty(t, rsp2.Resources)
+}
+
+func TestListByOwner_Many(t *testing.T) {
+	server := testServer(t)
+	demo.RegisterTypes(server.Registry)
+	client := testClient(t, server)
+
+	res, err := demo.GenerateV2Artist()
+	require.NoError(t, err)
+
+	rsp1, err := client.Write(testContext(t), &pbresource.WriteRequest{Resource: res})
+	artist := rsp1.Resource
+	require.NoError(t, err)
+
+	albums := make([]*pbresource.Resource, 10)
+	for i := 0; i < len(albums); i++ {
+		album, err := demo.GenerateV2Album(artist.Id)
+		require.NoError(t, err)
+
+		// Prevent test flakes if the generated names collide.
+		album.Id.Name = fmt.Sprintf("%s-%d", artist.Id.Name, i)
+
+		rsp2, err := client.Write(testContext(t), &pbresource.WriteRequest{Resource: album})
+		require.NoError(t, err)
+		albums[i] = rsp2.Resource
+	}
+
+	rsp3, err := client.ListByOwner(testContext(t), &pbresource.ListByOwnerRequest{
+		Owner: artist.Id,
+	})
+	require.NoError(t, err)
+	prototest.AssertElementsMatch(t, albums, rsp3.Resources)
+}
+
+func TestListByOwner_ACL_PerTypeDenied(t *testing.T) {
+	authz := AuthorizerFrom(t, `key_prefix "resource/demo.v2.album/" { policy = "deny" }`)
+	_, rsp, err := roundTripListByOwner(t, authz)
+
+	// verify resource filtered out, hence no results
+	require.NoError(t, err)
+	require.Empty(t, rsp.Resources)
+}
+
+func TestListByOwner_ACL_PerTypeAllowed(t *testing.T) {
+	authz := AuthorizerFrom(t, `key_prefix "resource/demo.v2.album/" { policy = "read" }`)
+	album, rsp, err := roundTripListByOwner(t, authz)
+
+	// verify resource not filtered out
+	require.NoError(t, err)
+	require.Len(t, rsp.Resources, 1)
+	prototest.AssertDeepEqual(t, album, rsp.Resources[0])
+}
+
+// roundtrip a ListByOwner which attempts to return a single resource
+func roundTripListByOwner(t *testing.T, authz acl.Authorizer) (*pbresource.Resource, *pbresource.ListByOwnerResponse, error) {
+	server := testServer(t)
+	client := testClient(t, server)
+	demo.RegisterTypes(server.Registry)
+
+	artist, err := demo.GenerateV2Artist()
+	require.NoError(t, err)
+
+	rsp1, err := client.Write(testContext(t), &pbresource.WriteRequest{Resource: artist})
+	artist = rsp1.Resource
+	require.NoError(t, err)
+
+	album, err := demo.GenerateV2Album(artist.Id)
+	require.NoError(t, err)
+
+	rsp2, err := client.Write(testContext(t), &pbresource.WriteRequest{Resource: album})
+	album = rsp2.Resource
+	require.NoError(t, err)
+
+	mockACLResolver := &MockACLResolver{}
+	mockACLResolver.On("ResolveTokenAndDefaultMeta", mock.Anything, mock.Anything, mock.Anything).
+		Return(authz, nil)
+	server.ACLResolver = mockACLResolver
+
+	rsp3, err := client.ListByOwner(testContext(t), &pbresource.ListByOwnerRequest{Owner: artist.Id})
+	return album, rsp3, err
+}
diff --git a/agent/grpc-external/services/resource/mock_Backend.go b/agent/grpc-external/services/resource/mock_Backend.go
index eb133455d173..fbc88a592bb4 100644
--- a/agent/grpc-external/services/resource/mock_Backend.go
+++ b/agent/grpc-external/services/resource/mock_Backend.go
@@ -56,20 +56,20 @@ func (_m *MockBackend) List(ctx context.Context, consistency storage.ReadConsist
 	return r0, r1
 }
 
-// OwnerReferences provides a mock function with given fields: ctx, id
-func (_m *MockBackend) OwnerReferences(ctx context.Context, id *pbresource.ID) ([]*pbresource.ID, error) {
+// ListByOwner provides a mock function with given fields: ctx, id
+func (_m *MockBackend) ListByOwner(ctx context.Context, id *pbresource.ID) ([]*pbresource.Resource, error) {
 	ret := _m.Called(ctx, id)
 
-	var r0 []*pbresource.ID
+	var r0 []*pbresource.Resource
 	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, *pbresource.ID) ([]*pbresource.ID, error)); ok {
+	if rf, ok := ret.Get(0).(func(context.Context, *pbresource.ID) ([]*pbresource.Resource, error)); ok {
 		return rf(ctx, id)
 	}
-	if rf, ok := ret.Get(0).(func(context.Context, *pbresource.ID) []*pbresource.ID); ok {
+	if rf, ok := ret.Get(0).(func(context.Context, *pbresource.ID) []*pbresource.Resource); ok {
 		r0 = rf(ctx, id)
 	} else {
 		if ret.Get(0) != nil {
-			r0 = ret.Get(0).([]*pbresource.ID)
+			r0 = ret.Get(0).([]*pbresource.Resource)
 		}
 	}
 
diff --git a/agent/grpc-middleware/rate_limit_mappings.gen.go b/agent/grpc-middleware/rate_limit_mappings.gen.go
index 4d08ca0e75a8..fc73aa9d9cf2 100644
--- a/agent/grpc-middleware/rate_limit_mappings.gen.go
+++ b/agent/grpc-middleware/rate_limit_mappings.gen.go
@@ -28,6 +28,7 @@ var rpcRateLimitSpecs = map[string]rate.OperationSpec{
 	"/hashicorp.consul.internal.storage.raft.ForwardingService/Write":            {Type: rate.OperationTypeExempt, Category: rate.OperationCategoryResource},
 	"/hashicorp.consul.resource.ResourceService/Delete":                          {Type: rate.OperationTypeWrite, Category: rate.OperationCategoryResource},
 	"/hashicorp.consul.resource.ResourceService/List":                            {Type: rate.OperationTypeRead, Category: rate.OperationCategoryResource},
+	"/hashicorp.consul.resource.ResourceService/ListByOwner":                     {Type: rate.OperationTypeRead, Category: rate.OperationCategoryResource},
 	"/hashicorp.consul.resource.ResourceService/Read":                            {Type: rate.OperationTypeRead, Category: rate.OperationCategoryResource},
 	"/hashicorp.consul.resource.ResourceService/WatchList":                       {Type: rate.OperationTypeRead, Category: rate.OperationCategoryResource},
 	"/hashicorp.consul.resource.ResourceService/Write":                           {Type: rate.OperationTypeWrite, Category: rate.OperationCategoryResource},
diff --git a/internal/storage/conformance/conformance.go b/internal/storage/conformance/conformance.go
index d2b5d3e6df9f..22356a88a9c1 100644
--- a/internal/storage/conformance/conformance.go
+++ b/internal/storage/conformance/conformance.go
@@ -39,7 +39,7 @@ func Test(t *testing.T, opts TestOptions) {
 	t.Run("Read", func(t *testing.T) { testRead(t, opts) })
 	t.Run("CAS Write", func(t *testing.T) { testCASWrite(t, opts) })
 	t.Run("CAS Delete", func(t *testing.T) { testCASDelete(t, opts) })
-	t.Run("OwnerReferences", func(t *testing.T) { testOwnerReferences(t, opts) })
+	t.Run("ListByOwner", func(t *testing.T) { testListByOwner(t, opts) })
 
 	testListWatch(t, opts)
 }
@@ -518,7 +518,7 @@ func testListWatch(t *testing.T, opts TestOptions) {
 	})
 }
 
-func testOwnerReferences(t *testing.T, opts TestOptions) {
+func testListByOwner(t *testing.T, opts TestOptions) {
 	backend := opts.NewBackend(t)
 	ctx := testContext(t)
 
@@ -555,9 +555,9 @@ func testOwnerReferences(t *testing.T, opts TestOptions) {
 	require.NoError(t, err)
 
 	eventually(t, func(t testingT) {
-		refs, err := backend.OwnerReferences(ctx, owner.Id)
+		res, err := backend.ListByOwner(ctx, owner.Id)
 		require.NoError(t, err)
-		prototest.AssertElementsMatch(t, refs, []*pbresource.ID{r1.Id, r2.Id})
+		prototest.AssertElementsMatch(t, res, []*pbresource.Resource{r1, r2})
 	})
 
 	t.Run("references are anchored to a specific uid", func(t *testing.T) {
@@ -565,9 +565,9 @@ func testOwnerReferences(t *testing.T, opts TestOptions) {
 		id.Uid = "different"
 
 		eventually(t, func(t testingT) {
-			refs, err := backend.OwnerReferences(ctx, id)
+			res, err := backend.ListByOwner(ctx, id)
 			require.NoError(t, err)
-			require.Empty(t, refs)
+			require.Empty(t, res)
 		})
 	})
 
@@ -575,9 +575,9 @@ func testOwnerReferences(t *testing.T, opts TestOptions) {
 		require.NoError(t, backend.DeleteCAS(ctx, owner.Id, owner.Version))
 
 		eventually(t, func(t testingT) {
-			refs, err := backend.OwnerReferences(ctx, owner.Id)
+			res, err := backend.ListByOwner(ctx, owner.Id)
 			require.NoError(t, err)
-			prototest.AssertElementsMatch(t, refs, []*pbresource.ID{r1.Id, r2.Id})
+			prototest.AssertElementsMatch(t, res, []*pbresource.Resource{r1, r2})
 		})
 	})
 
@@ -585,9 +585,9 @@ func testOwnerReferences(t *testing.T, opts TestOptions) {
 		require.NoError(t, backend.DeleteCAS(ctx, r2.Id, r2.Version))
 
 		eventually(t, func(t testingT) {
-			refs, err := backend.OwnerReferences(ctx, owner.Id)
+			res, err := backend.ListByOwner(ctx, owner.Id)
 			require.NoError(t, err)
-			prototest.AssertElementsMatch(t, refs, []*pbresource.ID{r1.Id})
+			prototest.AssertElementsMatch(t, res, []*pbresource.Resource{r1})
 		})
 	})
 }
diff --git a/internal/storage/inmem/backend.go b/internal/storage/inmem/backend.go
index 83e67d8928af..fc22aa5ace81 100644
--- a/internal/storage/inmem/backend.go
+++ b/internal/storage/inmem/backend.go
@@ -70,7 +70,7 @@ func (b *Backend) WatchList(_ context.Context, resType storage.UnversionedType,
 	return b.store.WatchList(resType, tenancy, namePrefix)
 }
 
-// OwnerReferences implements the storage.Backend interface.
-func (b *Backend) OwnerReferences(_ context.Context, id *pbresource.ID) ([]*pbresource.ID, error) {
-	return b.store.OwnerReferences(id)
+// ListByOwner implements the storage.Backend interface.
+func (b *Backend) ListByOwner(_ context.Context, id *pbresource.ID) ([]*pbresource.Resource, error) {
+	return b.store.ListByOwner(id)
 }
diff --git a/internal/storage/inmem/store.go b/internal/storage/inmem/store.go
index 4778ed153cba..5c50b1c138a3 100644
--- a/internal/storage/inmem/store.go
+++ b/internal/storage/inmem/store.go
@@ -259,11 +259,10 @@ func (s *Store) WatchList(typ storage.UnversionedType, ten *pbresource.Tenancy,
 	}, nil
 }
 
-// OwnerReferences returns the IDs of resources owned by the resource with the
-// given ID.
+// ListByOwner returns resources owned by the resource with the given ID.
 //
 // For more information, see the storage.Backend documentation.
-func (s *Store) OwnerReferences(id *pbresource.ID) ([]*pbresource.ID, error) {
+func (s *Store) ListByOwner(id *pbresource.ID) ([]*pbresource.Resource, error) {
 	tx := s.txn(false)
 	defer tx.Abort()
 
@@ -272,11 +271,11 @@ func (s *Store) OwnerReferences(id *pbresource.ID) ([]*pbresource.ID, error) {
 		return nil, err
 	}
 
-	var refs []*pbresource.ID
+	var res []*pbresource.Resource
 	for v := iter.Next(); v != nil; v = iter.Next() {
-		refs = append(refs, v.(*pbresource.Resource).Id)
+		res = append(res, v.(*pbresource.Resource))
 	}
-	return refs, nil
+	return res, nil
 }
 
 func (s *Store) txn(write bool) *memdb.Txn {
diff --git a/internal/storage/raft/backend.go b/internal/storage/raft/backend.go
index f6afa4e4fd02..387e35973c71 100644
--- a/internal/storage/raft/backend.go
+++ b/internal/storage/raft/backend.go
@@ -217,9 +217,9 @@ func (b *Backend) WatchList(_ context.Context, resType storage.UnversionedType,
 	return b.store.WatchList(resType, tenancy, namePrefix)
 }
 
-// OwnerReferences implements the storage.Backend interface.
-func (b *Backend) OwnerReferences(_ context.Context, id *pbresource.ID) ([]*pbresource.ID, error) {
-	return b.store.OwnerReferences(id)
+// ListByOwner implements the storage.Backend interface.
+func (b *Backend) ListByOwner(_ context.Context, id *pbresource.ID) ([]*pbresource.Resource, error) {
+	return b.store.ListByOwner(id)
 }
 
 // Apply is called by the FSM with the bytes of a Raft log entry, with Consul's
diff --git a/internal/storage/storage.go b/internal/storage/storage.go
index dc1e72c7fa5f..24a763e39547 100644
--- a/internal/storage/storage.go
+++ b/internal/storage/storage.go
@@ -244,33 +244,33 @@ type Backend interface {
 	// events about writes that they then cannot read. In other words, it is *not*
 	// linearizable.
 	//
-	// There's a similar guarantee between WatchList and OwnerReferences, see the
-	// OwnerReferences docs for more information.
+	// There's a similar guarantee between WatchList and ListByOwner, see the
+	// ListByOwner docs for more information.
 	//
 	// See List docs for details about Tenancy Wildcard and GroupVersion.
 	//
 	// [monotonic reads]: https://jepsen.io/consistency/models/monotonic-reads
 	WatchList(ctx context.Context, resType UnversionedType, tenancy *pbresource.Tenancy, namePrefix string) (Watch, error)
 
-	// OwnerReferences returns the IDs of resources owned by the resource with the
-	// given ID. It is typically used to implement cascading deletion.
+	// ListByOwner returns resources owned by the resource with the given ID. It
+	// is typically used to implement cascading deletion.
 	//
 	// # Consistency
 	//
-	// OwnerReferences may return stale results, but guarnantees [monotonic reads]
+	// ListByOwner may return stale results, but guarantees [monotonic reads]
 	// with events received from WatchList. In practice, this means that if you
 	// learn that a resource has been deleted through a watch event, the results
-	// you receive from OwnerReferences will contain all references that existed
+	// you receive from ListByOwner will represent all references that existed
 	// at the time the owner was deleted. It doesn't make any guarantees about
 	// references that are created *after* the owner was deleted, though, so you
 	// must either prevent that from happening (e.g. by performing a consistent
 	// read of the owner in the write-path, which has its own ordering/correctness
-	// challenges), or by calling OwnerReferences after the expected window of
+	// challenges), or by calling ListByOwner after the expected window of
 	// inconsistency (e.g. deferring cascading deletion, or doing a second pass
 	// an hour later).
 	//
 	// [montonic reads]: https://jepsen.io/consistency/models/monotonic-reads
-	OwnerReferences(ctx context.Context, id *pbresource.ID) ([]*pbresource.ID, error)
+	ListByOwner(ctx context.Context, id *pbresource.ID) ([]*pbresource.Resource, error)
 }
 
 // Watch represents a watch on a given set of resources. Call Next to get the
diff --git a/proto-public/pbresource/resource.pb.binary.go b/proto-public/pbresource/resource.pb.binary.go
index 4f6c4a382fa1..0548452feb75 100644
--- a/proto-public/pbresource/resource.pb.binary.go
+++ b/proto-public/pbresource/resource.pb.binary.go
@@ -127,6 +127,26 @@ func (msg *ListResponse) UnmarshalBinary(b []byte) error {
 	return proto.Unmarshal(b, msg)
 }
 
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *ListByOwnerRequest) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *ListByOwnerRequest) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *ListByOwnerResponse) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *ListByOwnerResponse) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
 // MarshalBinary implements encoding.BinaryMarshaler
 func (msg *WriteRequest) MarshalBinary() ([]byte, error) {
 	return proto.Marshal(msg)
diff --git a/proto-public/pbresource/resource.pb.go b/proto-public/pbresource/resource.pb.go
index 397d423440c5..d05a2b8f972b 100644
--- a/proto-public/pbresource/resource.pb.go
+++ b/proto-public/pbresource/resource.pb.go
@@ -133,7 +133,7 @@ func (x WatchEvent_Operation) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use WatchEvent_Operation.Descriptor instead.
 func (WatchEvent_Operation) EnumDescriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{19, 0}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{21, 0}
 }
 
 // Type describes a resource's type. It follows the GVK (Group Version Kind)
@@ -988,6 +988,103 @@ func (x *ListResponse) GetResources() []*Resource {
 	return nil
 }
 
+// ListByOwnerRequest contains the parameters to the ListByOwner endpoint.
+type ListByOwnerRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Owner *ID `protobuf:"bytes,1,opt,name=owner,proto3" json:"owner,omitempty"`
+}
+
+func (x *ListByOwnerRequest) Reset() {
+	*x = ListByOwnerRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbresource_resource_proto_msgTypes[12]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListByOwnerRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListByOwnerRequest) ProtoMessage() {}
+
+func (x *ListByOwnerRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_pbresource_resource_proto_msgTypes[12]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListByOwnerRequest.ProtoReflect.Descriptor instead.
+func (*ListByOwnerRequest) Descriptor() ([]byte, []int) {
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *ListByOwnerRequest) GetOwner() *ID {
+	if x != nil {
+		return x.Owner
+	}
+	return nil
+}
+
+// ListByOwnerResponse contains the results of calling the ListByOwner endpoint.
+type ListByOwnerResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Resources that were listed.
+	Resources []*Resource `protobuf:"bytes,1,rep,name=resources,proto3" json:"resources,omitempty"`
+}
+
+func (x *ListByOwnerResponse) Reset() {
+	*x = ListByOwnerResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbresource_resource_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListByOwnerResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListByOwnerResponse) ProtoMessage() {}
+
+func (x *ListByOwnerResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_pbresource_resource_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListByOwnerResponse.ProtoReflect.Descriptor instead.
+func (*ListByOwnerResponse) Descriptor() ([]byte, []int) {
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *ListByOwnerResponse) GetResources() []*Resource {
+	if x != nil {
+		return x.Resources
+	}
+	return nil
+}
+
 // WriteRequest contains the parameters to the Write endpoint.
 type WriteRequest struct {
 	state         protoimpl.MessageState
@@ -1001,7 +1098,7 @@ type WriteRequest struct {
 func (x *WriteRequest) Reset() {
 	*x = WriteRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[12]
+		mi := &file_pbresource_resource_proto_msgTypes[14]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1014,7 +1111,7 @@ func (x *WriteRequest) String() string {
 func (*WriteRequest) ProtoMessage() {}
 
 func (x *WriteRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[12]
+	mi := &file_pbresource_resource_proto_msgTypes[14]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1027,7 +1124,7 @@ func (x *WriteRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WriteRequest.ProtoReflect.Descriptor instead.
 func (*WriteRequest) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{12}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *WriteRequest) GetResource() *Resource {
@@ -1050,7 +1147,7 @@ type WriteResponse struct {
 func (x *WriteResponse) Reset() {
 	*x = WriteResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[13]
+		mi := &file_pbresource_resource_proto_msgTypes[15]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1063,7 +1160,7 @@ func (x *WriteResponse) String() string {
 func (*WriteResponse) ProtoMessage() {}
 
 func (x *WriteResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[13]
+	mi := &file_pbresource_resource_proto_msgTypes[15]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1076,7 +1173,7 @@ func (x *WriteResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WriteResponse.ProtoReflect.Descriptor instead.
 func (*WriteResponse) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{13}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *WriteResponse) GetResource() *Resource {
@@ -1113,7 +1210,7 @@ type WriteStatusRequest struct {
 func (x *WriteStatusRequest) Reset() {
 	*x = WriteStatusRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[14]
+		mi := &file_pbresource_resource_proto_msgTypes[16]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1126,7 +1223,7 @@ func (x *WriteStatusRequest) String() string {
 func (*WriteStatusRequest) ProtoMessage() {}
 
 func (x *WriteStatusRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[14]
+	mi := &file_pbresource_resource_proto_msgTypes[16]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1139,7 +1236,7 @@ func (x *WriteStatusRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WriteStatusRequest.ProtoReflect.Descriptor instead.
 func (*WriteStatusRequest) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{14}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *WriteStatusRequest) GetId() *ID {
@@ -1183,7 +1280,7 @@ type WriteStatusResponse struct {
 func (x *WriteStatusResponse) Reset() {
 	*x = WriteStatusResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[15]
+		mi := &file_pbresource_resource_proto_msgTypes[17]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1196,7 +1293,7 @@ func (x *WriteStatusResponse) String() string {
 func (*WriteStatusResponse) ProtoMessage() {}
 
 func (x *WriteStatusResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[15]
+	mi := &file_pbresource_resource_proto_msgTypes[17]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1209,7 +1306,7 @@ func (x *WriteStatusResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WriteStatusResponse.ProtoReflect.Descriptor instead.
 func (*WriteStatusResponse) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{15}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *WriteStatusResponse) GetResource() *Resource {
@@ -1236,7 +1333,7 @@ type DeleteRequest struct {
 func (x *DeleteRequest) Reset() {
 	*x = DeleteRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[16]
+		mi := &file_pbresource_resource_proto_msgTypes[18]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1249,7 +1346,7 @@ func (x *DeleteRequest) String() string {
 func (*DeleteRequest) ProtoMessage() {}
 
 func (x *DeleteRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[16]
+	mi := &file_pbresource_resource_proto_msgTypes[18]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1262,7 +1359,7 @@ func (x *DeleteRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteRequest.ProtoReflect.Descriptor instead.
 func (*DeleteRequest) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{16}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *DeleteRequest) GetId() *ID {
@@ -1289,7 +1386,7 @@ type DeleteResponse struct {
 func (x *DeleteResponse) Reset() {
 	*x = DeleteResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[17]
+		mi := &file_pbresource_resource_proto_msgTypes[19]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1302,7 +1399,7 @@ func (x *DeleteResponse) String() string {
 func (*DeleteResponse) ProtoMessage() {}
 
 func (x *DeleteResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[17]
+	mi := &file_pbresource_resource_proto_msgTypes[19]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1315,7 +1412,7 @@ func (x *DeleteResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteResponse.ProtoReflect.Descriptor instead.
 func (*DeleteResponse) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{17}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{19}
 }
 
 // WatchListRequest contains the parameters to the WatchList endpoint.
@@ -1337,7 +1434,7 @@ type WatchListRequest struct {
 func (x *WatchListRequest) Reset() {
 	*x = WatchListRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[18]
+		mi := &file_pbresource_resource_proto_msgTypes[20]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1350,7 +1447,7 @@ func (x *WatchListRequest) String() string {
 func (*WatchListRequest) ProtoMessage() {}
 
 func (x *WatchListRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[18]
+	mi := &file_pbresource_resource_proto_msgTypes[20]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1363,7 +1460,7 @@ func (x *WatchListRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WatchListRequest.ProtoReflect.Descriptor instead.
 func (*WatchListRequest) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{18}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *WatchListRequest) GetType() *Type {
@@ -1402,7 +1499,7 @@ type WatchEvent struct {
 func (x *WatchEvent) Reset() {
 	*x = WatchEvent{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_pbresource_resource_proto_msgTypes[19]
+		mi := &file_pbresource_resource_proto_msgTypes[21]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1415,7 +1512,7 @@ func (x *WatchEvent) String() string {
 func (*WatchEvent) ProtoMessage() {}
 
 func (x *WatchEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_pbresource_resource_proto_msgTypes[19]
+	mi := &file_pbresource_resource_proto_msgTypes[21]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1428,7 +1525,7 @@ func (x *WatchEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WatchEvent.ProtoReflect.Descriptor instead.
 func (*WatchEvent) Descriptor() ([]byte, []int) {
-	return file_pbresource_resource_proto_rawDescGZIP(), []int{19}
+	return file_pbresource_resource_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *WatchEvent) GetOperation() WatchEvent_Operation {
@@ -1574,122 +1671,140 @@ var file_pbresource_resource_proto_rawDesc = []byte{
 	0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
 	0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f,
 	0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x09, 0x72,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x22, 0x4f, 0x0a, 0x0c, 0x57, 0x72, 0x69, 0x74,
-	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73,
-	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52,
-	0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x50, 0x0a, 0x0d, 0x57, 0x72, 0x69,
-	0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68,
-	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0xaa, 0x01, 0x0a, 0x12,
-	0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d,
-	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
-	0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x02, 0x69,
-	0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x10, 0x0a, 0x03, 0x6b,
-	0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x39, 0x0a,
-	0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x22, 0x49, 0x0a, 0x12, 0x4c, 0x69, 0x73, 0x74,
+	0x42, 0x79, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x33,
+	0x0a, 0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e,
 	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
-	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x56, 0x0a, 0x13, 0x57, 0x72, 0x69, 0x74,
-	0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x05, 0x6f, 0x77,
+	0x6e, 0x65, 0x72, 0x22, 0x58, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x42, 0x79, 0x4f, 0x77, 0x6e,
+	0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x41, 0x0a, 0x09, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e,
+	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x22, 0x4f, 0x0a,
+	0x0c, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x3f, 0x0a,
+	0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x50,
+	0x0a, 0x0d, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
 	0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
 	0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
 	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65,
 	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x22, 0x58, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x12, 0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e,
-	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
-	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x02, 0x69, 0x64,
-	0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x10, 0x0a, 0x0e, 0x44, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xa6, 0x01, 0x0a,
-	0x10, 0x57, 0x61, 0x74, 0x63, 0x68, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x12, 0x33, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x1f, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
-	0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x54, 0x79, 0x70, 0x65,
-	0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x3c, 0x0a, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e, 0x63,
-	0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
-	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x2e, 0x54, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x52, 0x07, 0x74, 0x65, 0x6e,
-	0x61, 0x6e, 0x63, 0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x72, 0x65,
-	0x66, 0x69, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x61, 0x6d, 0x65, 0x50,
-	0x72, 0x65, 0x66, 0x69, 0x78, 0x22, 0xf0, 0x01, 0x0a, 0x0a, 0x57, 0x61, 0x74, 0x63, 0x68, 0x45,
-	0x76, 0x65, 0x6e, 0x74, 0x12, 0x4d, 0x0a, 0x09, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2f, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
-	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x2e, 0x57, 0x61, 0x74, 0x63, 0x68, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x2e, 0x4f,
-	0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
-	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x22, 0x52, 0x0a, 0x09, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x12, 0x19, 0x0a, 0x15, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55,
-	0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x14, 0x0a, 0x10,
-	0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x50, 0x53, 0x45, 0x52, 0x54,
-	0x10, 0x01, 0x12, 0x14, 0x0a, 0x10, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f,
-	0x44, 0x45, 0x4c, 0x45, 0x54, 0x45, 0x10, 0x02, 0x32, 0x8b, 0x05, 0x0a, 0x0f, 0x52, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x61, 0x0a, 0x04,
-	0x52, 0x65, 0x61, 0x64, 0x12, 0x26, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x22, 0xaa, 0x01, 0x0a, 0x12, 0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
+	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e,
+	0x49, 0x44, 0x52, 0x02, 0x69, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f,
+	0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
+	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
+	0x65, 0x79, 0x12, 0x39, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x21, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x53,
+	0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x56, 0x0a,
+	0x13, 0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x58, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49,
+	0x44, 0x52, 0x02, 0x69, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22,
+	0x10, 0x0a, 0x0e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0xa6, 0x01, 0x0a, 0x10, 0x57, 0x61, 0x74, 0x63, 0x68, 0x4c, 0x69, 0x73, 0x74, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x33, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
 	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x2e, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x27, 0x2e, 0x68,
+	0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x3c, 0x0a, 0x07, 0x74,
+	0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x54, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79,
+	0x52, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d,
+	0x65, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a,
+	0x6e, 0x61, 0x6d, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x22, 0xf0, 0x01, 0x0a, 0x0a, 0x57,
+	0x61, 0x74, 0x63, 0x68, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x4d, 0x0a, 0x09, 0x6f, 0x70, 0x65,
+	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2f, 0x2e, 0x68,
 	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x02, 0x10, 0x0b, 0x12,
-	0x64, 0x0a, 0x05, 0x57, 0x72, 0x69, 0x74, 0x65, 0x12, 0x27, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x61, 0x74, 0x63, 0x68, 0x45, 0x76,
+	0x65, 0x6e, 0x74, 0x2e, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09, 0x6f,
+	0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52,
+	0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x52, 0x0a, 0x09, 0x4f, 0x70, 0x65,
+	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x19, 0x0a, 0x15, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54,
+	0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10,
+	0x00, 0x12, 0x14, 0x0a, 0x10, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55,
+	0x50, 0x53, 0x45, 0x52, 0x54, 0x10, 0x01, 0x12, 0x14, 0x0a, 0x10, 0x4f, 0x50, 0x45, 0x52, 0x41,
+	0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x44, 0x45, 0x4c, 0x45, 0x54, 0x45, 0x10, 0x02, 0x32, 0x83, 0x06,
+	0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x12, 0x61, 0x0a, 0x04, 0x52, 0x65, 0x61, 0x64, 0x12, 0x26, 0x2e, 0x68, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x27, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65,
+	0x61, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04,
+	0x08, 0x02, 0x10, 0x0b, 0x12, 0x64, 0x0a, 0x05, 0x57, 0x72, 0x69, 0x74, 0x65, 0x12, 0x27, 0x2e,
+	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x2e, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x03, 0x10, 0x0b, 0x12, 0x76, 0x0a, 0x0b, 0x57, 0x72,
+	0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x2d, 0x2e, 0x68, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2e, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
 	0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x28, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
-	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x72,
-	0x69, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04,
-	0x04, 0x08, 0x03, 0x10, 0x0b, 0x12, 0x76, 0x0a, 0x0b, 0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x74,
-	0x61, 0x74, 0x75, 0x73, 0x12, 0x2d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x03,
+	0x10, 0x0b, 0x12, 0x61, 0x0a, 0x04, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x26, 0x2e, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x27, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x4c,
+	0x69, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04,
+	0x04, 0x08, 0x02, 0x10, 0x0b, 0x12, 0x76, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x42, 0x79, 0x4f,
+	0x77, 0x6e, 0x65, 0x72, 0x12, 0x2d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
 	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x2e, 0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x71, 0x75,
+	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x42, 0x79, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75,
 	0x65, 0x73, 0x74, 0x1a, 0x2e, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
 	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e,
-	0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x03, 0x10, 0x0b, 0x12, 0x61, 0x0a,
-	0x04, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x26, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
-	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x27, 0x2e,
-	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
-	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x02, 0x10, 0x0b,
-	0x12, 0x67, 0x0a, 0x06, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x28, 0x2e, 0x68, 0x61, 0x73,
-	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x29, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
-	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
-	0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x03, 0x10, 0x0b, 0x12, 0x6b, 0x0a, 0x09, 0x57, 0x61, 0x74,
-	0x63, 0x68, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x2b, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
-	0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x2e, 0x57, 0x61, 0x74, 0x63, 0x68, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
+	0x4c, 0x69, 0x73, 0x74, 0x42, 0x79, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x02, 0x10, 0x0b, 0x12, 0x67, 0x0a,
+	0x06, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x28, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x29, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86,
+	0x04, 0x04, 0x08, 0x03, 0x10, 0x0b, 0x12, 0x6b, 0x0a, 0x09, 0x57, 0x61, 0x74, 0x63, 0x68, 0x4c,
+	0x69, 0x73, 0x74, 0x12, 0x2b, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
 	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e,
-	0x57, 0x61, 0x74, 0x63, 0x68, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04,
-	0x08, 0x02, 0x10, 0x0b, 0x30, 0x01, 0x42, 0xe9, 0x01, 0x0a, 0x1d, 0x63, 0x6f, 0x6d, 0x2e, 0x68,
-	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x42, 0x0d, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x33, 0x67, 0x69, 0x74, 0x68, 0x75,
-	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f,
-	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62,
-	0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0xa2, 0x02,
-	0x03, 0x48, 0x43, 0x52, 0xaa, 0x02, 0x19, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
-	0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0xca, 0x02, 0x19, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e,
-	0x73, 0x75, 0x6c, 0x5c, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0xe2, 0x02, 0x25, 0x48,
-	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c,
-	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x1b, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
-	0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x57, 0x61, 0x74, 0x63, 0x68, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x25, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x61, 0x74,
+	0x63, 0x68, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x02, 0x10,
+	0x0b, 0x30, 0x01, 0x42, 0xe9, 0x01, 0x0a, 0x1d, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x42, 0x0d, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50,
+	0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x33, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63,
+	0x2f, 0x70, 0x62, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0xa2, 0x02, 0x03, 0x48, 0x43,
+	0x52, 0xaa, 0x02, 0x19, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0xca, 0x02, 0x19,
+	0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x5c, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0xe2, 0x02, 0x25, 0x48, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0xea, 0x02, 0x1b, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -1705,7 +1820,7 @@ func file_pbresource_resource_proto_rawDescGZIP() []byte {
 }
 
 var file_pbresource_resource_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
-var file_pbresource_resource_proto_msgTypes = make([]protoimpl.MessageInfo, 22)
+var file_pbresource_resource_proto_msgTypes = make([]protoimpl.MessageInfo, 24)
 var file_pbresource_resource_proto_goTypes = []interface{}{
 	(Condition_State)(0),        // 0: hashicorp.consul.resource.Condition.State
 	(WatchEvent_Operation)(0),   // 1: hashicorp.consul.resource.WatchEvent.Operation
@@ -1721,26 +1836,28 @@ var file_pbresource_resource_proto_goTypes = []interface{}{
 	(*ReadResponse)(nil),        // 11: hashicorp.consul.resource.ReadResponse
 	(*ListRequest)(nil),         // 12: hashicorp.consul.resource.ListRequest
 	(*ListResponse)(nil),        // 13: hashicorp.consul.resource.ListResponse
-	(*WriteRequest)(nil),        // 14: hashicorp.consul.resource.WriteRequest
-	(*WriteResponse)(nil),       // 15: hashicorp.consul.resource.WriteResponse
-	(*WriteStatusRequest)(nil),  // 16: hashicorp.consul.resource.WriteStatusRequest
-	(*WriteStatusResponse)(nil), // 17: hashicorp.consul.resource.WriteStatusResponse
-	(*DeleteRequest)(nil),       // 18: hashicorp.consul.resource.DeleteRequest
-	(*DeleteResponse)(nil),      // 19: hashicorp.consul.resource.DeleteResponse
-	(*WatchListRequest)(nil),    // 20: hashicorp.consul.resource.WatchListRequest
-	(*WatchEvent)(nil),          // 21: hashicorp.consul.resource.WatchEvent
-	nil,                         // 22: hashicorp.consul.resource.Resource.MetadataEntry
-	nil,                         // 23: hashicorp.consul.resource.Resource.StatusEntry
-	(*anypb.Any)(nil),           // 24: google.protobuf.Any
+	(*ListByOwnerRequest)(nil),  // 14: hashicorp.consul.resource.ListByOwnerRequest
+	(*ListByOwnerResponse)(nil), // 15: hashicorp.consul.resource.ListByOwnerResponse
+	(*WriteRequest)(nil),        // 16: hashicorp.consul.resource.WriteRequest
+	(*WriteResponse)(nil),       // 17: hashicorp.consul.resource.WriteResponse
+	(*WriteStatusRequest)(nil),  // 18: hashicorp.consul.resource.WriteStatusRequest
+	(*WriteStatusResponse)(nil), // 19: hashicorp.consul.resource.WriteStatusResponse
+	(*DeleteRequest)(nil),       // 20: hashicorp.consul.resource.DeleteRequest
+	(*DeleteResponse)(nil),      // 21: hashicorp.consul.resource.DeleteResponse
+	(*WatchListRequest)(nil),    // 22: hashicorp.consul.resource.WatchListRequest
+	(*WatchEvent)(nil),          // 23: hashicorp.consul.resource.WatchEvent
+	nil,                         // 24: hashicorp.consul.resource.Resource.MetadataEntry
+	nil,                         // 25: hashicorp.consul.resource.Resource.StatusEntry
+	(*anypb.Any)(nil),           // 26: google.protobuf.Any
 }
 var file_pbresource_resource_proto_depIdxs = []int32{
 	2,  // 0: hashicorp.consul.resource.ID.type:type_name -> hashicorp.consul.resource.Type
 	3,  // 1: hashicorp.consul.resource.ID.tenancy:type_name -> hashicorp.consul.resource.Tenancy
 	4,  // 2: hashicorp.consul.resource.Resource.id:type_name -> hashicorp.consul.resource.ID
 	4,  // 3: hashicorp.consul.resource.Resource.owner:type_name -> hashicorp.consul.resource.ID
-	22, // 4: hashicorp.consul.resource.Resource.metadata:type_name -> hashicorp.consul.resource.Resource.MetadataEntry
-	23, // 5: hashicorp.consul.resource.Resource.status:type_name -> hashicorp.consul.resource.Resource.StatusEntry
-	24, // 6: hashicorp.consul.resource.Resource.data:type_name -> google.protobuf.Any
+	24, // 4: hashicorp.consul.resource.Resource.metadata:type_name -> hashicorp.consul.resource.Resource.MetadataEntry
+	25, // 5: hashicorp.consul.resource.Resource.status:type_name -> hashicorp.consul.resource.Resource.StatusEntry
+	26, // 6: hashicorp.consul.resource.Resource.data:type_name -> google.protobuf.Any
 	7,  // 7: hashicorp.consul.resource.Status.conditions:type_name -> hashicorp.consul.resource.Condition
 	0,  // 8: hashicorp.consul.resource.Condition.state:type_name -> hashicorp.consul.resource.Condition.State
 	8,  // 9: hashicorp.consul.resource.Condition.resource:type_name -> hashicorp.consul.resource.Reference
@@ -1752,34 +1869,38 @@ var file_pbresource_resource_proto_depIdxs = []int32{
 	2,  // 15: hashicorp.consul.resource.ListRequest.type:type_name -> hashicorp.consul.resource.Type
 	3,  // 16: hashicorp.consul.resource.ListRequest.tenancy:type_name -> hashicorp.consul.resource.Tenancy
 	5,  // 17: hashicorp.consul.resource.ListResponse.resources:type_name -> hashicorp.consul.resource.Resource
-	5,  // 18: hashicorp.consul.resource.WriteRequest.resource:type_name -> hashicorp.consul.resource.Resource
-	5,  // 19: hashicorp.consul.resource.WriteResponse.resource:type_name -> hashicorp.consul.resource.Resource
-	4,  // 20: hashicorp.consul.resource.WriteStatusRequest.id:type_name -> hashicorp.consul.resource.ID
-	6,  // 21: hashicorp.consul.resource.WriteStatusRequest.status:type_name -> hashicorp.consul.resource.Status
-	5,  // 22: hashicorp.consul.resource.WriteStatusResponse.resource:type_name -> hashicorp.consul.resource.Resource
-	4,  // 23: hashicorp.consul.resource.DeleteRequest.id:type_name -> hashicorp.consul.resource.ID
-	2,  // 24: hashicorp.consul.resource.WatchListRequest.type:type_name -> hashicorp.consul.resource.Type
-	3,  // 25: hashicorp.consul.resource.WatchListRequest.tenancy:type_name -> hashicorp.consul.resource.Tenancy
-	1,  // 26: hashicorp.consul.resource.WatchEvent.operation:type_name -> hashicorp.consul.resource.WatchEvent.Operation
-	5,  // 27: hashicorp.consul.resource.WatchEvent.resource:type_name -> hashicorp.consul.resource.Resource
-	6,  // 28: hashicorp.consul.resource.Resource.StatusEntry.value:type_name -> hashicorp.consul.resource.Status
-	10, // 29: hashicorp.consul.resource.ResourceService.Read:input_type -> hashicorp.consul.resource.ReadRequest
-	14, // 30: hashicorp.consul.resource.ResourceService.Write:input_type -> hashicorp.consul.resource.WriteRequest
-	16, // 31: hashicorp.consul.resource.ResourceService.WriteStatus:input_type -> hashicorp.consul.resource.WriteStatusRequest
-	12, // 32: hashicorp.consul.resource.ResourceService.List:input_type -> hashicorp.consul.resource.ListRequest
-	18, // 33: hashicorp.consul.resource.ResourceService.Delete:input_type -> hashicorp.consul.resource.DeleteRequest
-	20, // 34: hashicorp.consul.resource.ResourceService.WatchList:input_type -> hashicorp.consul.resource.WatchListRequest
-	11, // 35: hashicorp.consul.resource.ResourceService.Read:output_type -> hashicorp.consul.resource.ReadResponse
-	15, // 36: hashicorp.consul.resource.ResourceService.Write:output_type -> hashicorp.consul.resource.WriteResponse
-	17, // 37: hashicorp.consul.resource.ResourceService.WriteStatus:output_type -> hashicorp.consul.resource.WriteStatusResponse
-	13, // 38: hashicorp.consul.resource.ResourceService.List:output_type -> hashicorp.consul.resource.ListResponse
-	19, // 39: hashicorp.consul.resource.ResourceService.Delete:output_type -> hashicorp.consul.resource.DeleteResponse
-	21, // 40: hashicorp.consul.resource.ResourceService.WatchList:output_type -> hashicorp.consul.resource.WatchEvent
-	35, // [35:41] is the sub-list for method output_type
-	29, // [29:35] is the sub-list for method input_type
-	29, // [29:29] is the sub-list for extension type_name
-	29, // [29:29] is the sub-list for extension extendee
-	0,  // [0:29] is the sub-list for field type_name
+	4,  // 18: hashicorp.consul.resource.ListByOwnerRequest.owner:type_name -> hashicorp.consul.resource.ID
+	5,  // 19: hashicorp.consul.resource.ListByOwnerResponse.resources:type_name -> hashicorp.consul.resource.Resource
+	5,  // 20: hashicorp.consul.resource.WriteRequest.resource:type_name -> hashicorp.consul.resource.Resource
+	5,  // 21: hashicorp.consul.resource.WriteResponse.resource:type_name -> hashicorp.consul.resource.Resource
+	4,  // 22: hashicorp.consul.resource.WriteStatusRequest.id:type_name -> hashicorp.consul.resource.ID
+	6,  // 23: hashicorp.consul.resource.WriteStatusRequest.status:type_name -> hashicorp.consul.resource.Status
+	5,  // 24: hashicorp.consul.resource.WriteStatusResponse.resource:type_name -> hashicorp.consul.resource.Resource
+	4,  // 25: hashicorp.consul.resource.DeleteRequest.id:type_name -> hashicorp.consul.resource.ID
+	2,  // 26: hashicorp.consul.resource.WatchListRequest.type:type_name -> hashicorp.consul.resource.Type
+	3,  // 27: hashicorp.consul.resource.WatchListRequest.tenancy:type_name -> hashicorp.consul.resource.Tenancy
+	1,  // 28: hashicorp.consul.resource.WatchEvent.operation:type_name -> hashicorp.consul.resource.WatchEvent.Operation
+	5,  // 29: hashicorp.consul.resource.WatchEvent.resource:type_name -> hashicorp.consul.resource.Resource
+	6,  // 30: hashicorp.consul.resource.Resource.StatusEntry.value:type_name -> hashicorp.consul.resource.Status
+	10, // 31: hashicorp.consul.resource.ResourceService.Read:input_type -> hashicorp.consul.resource.ReadRequest
+	16, // 32: hashicorp.consul.resource.ResourceService.Write:input_type -> hashicorp.consul.resource.WriteRequest
+	18, // 33: hashicorp.consul.resource.ResourceService.WriteStatus:input_type -> hashicorp.consul.resource.WriteStatusRequest
+	12, // 34: hashicorp.consul.resource.ResourceService.List:input_type -> hashicorp.consul.resource.ListRequest
+	14, // 35: hashicorp.consul.resource.ResourceService.ListByOwner:input_type -> hashicorp.consul.resource.ListByOwnerRequest
+	20, // 36: hashicorp.consul.resource.ResourceService.Delete:input_type -> hashicorp.consul.resource.DeleteRequest
+	22, // 37: hashicorp.consul.resource.ResourceService.WatchList:input_type -> hashicorp.consul.resource.WatchListRequest
+	11, // 38: hashicorp.consul.resource.ResourceService.Read:output_type -> hashicorp.consul.resource.ReadResponse
+	17, // 39: hashicorp.consul.resource.ResourceService.Write:output_type -> hashicorp.consul.resource.WriteResponse
+	19, // 40: hashicorp.consul.resource.ResourceService.WriteStatus:output_type -> hashicorp.consul.resource.WriteStatusResponse
+	13, // 41: hashicorp.consul.resource.ResourceService.List:output_type -> hashicorp.consul.resource.ListResponse
+	15, // 42: hashicorp.consul.resource.ResourceService.ListByOwner:output_type -> hashicorp.consul.resource.ListByOwnerResponse
+	21, // 43: hashicorp.consul.resource.ResourceService.Delete:output_type -> hashicorp.consul.resource.DeleteResponse
+	23, // 44: hashicorp.consul.resource.ResourceService.WatchList:output_type -> hashicorp.consul.resource.WatchEvent
+	38, // [38:45] is the sub-list for method output_type
+	31, // [31:38] is the sub-list for method input_type
+	31, // [31:31] is the sub-list for extension type_name
+	31, // [31:31] is the sub-list for extension extendee
+	0,  // [0:31] is the sub-list for field type_name
 }
 
 func init() { file_pbresource_resource_proto_init() }
@@ -1933,7 +2054,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WriteRequest); i {
+			switch v := v.(*ListByOwnerRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1945,7 +2066,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WriteResponse); i {
+			switch v := v.(*ListByOwnerResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1957,7 +2078,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WriteStatusRequest); i {
+			switch v := v.(*WriteRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1969,7 +2090,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WriteStatusResponse); i {
+			switch v := v.(*WriteResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1981,7 +2102,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeleteRequest); i {
+			switch v := v.(*WriteStatusRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1993,7 +2114,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeleteResponse); i {
+			switch v := v.(*WriteStatusResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2005,7 +2126,7 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WatchListRequest); i {
+			switch v := v.(*DeleteRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2017,6 +2138,30 @@ func file_pbresource_resource_proto_init() {
 			}
 		}
 		file_pbresource_resource_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DeleteResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbresource_resource_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WatchListRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbresource_resource_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*WatchEvent); i {
 			case 0:
 				return &v.state
@@ -2035,7 +2180,7 @@ func file_pbresource_resource_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_pbresource_resource_proto_rawDesc,
 			NumEnums:      2,
-			NumMessages:   22,
+			NumMessages:   24,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/proto-public/pbresource/resource.proto b/proto-public/pbresource/resource.proto
index b5609bbc11a6..b3f7a039cd75 100644
--- a/proto-public/pbresource/resource.proto
+++ b/proto-public/pbresource/resource.proto
@@ -289,6 +289,16 @@ service ResourceService {
     };
   }
 
+  // List resources of a given owner.
+  //
+  // Results are eventually consistent (see ResourceService docs for more info).
+  rpc ListByOwner(ListByOwnerRequest) returns (ListByOwnerResponse) {
+    option (hashicorp.consul.internal.ratelimit.spec) = {
+      operation_type: OPERATION_TYPE_READ,
+      operation_category: OPERATION_CATEGORY_RESOURCE
+    };
+  }
+
   // Delete a resource by ID.
   //
   // Deleting a non-existent resource will return a successful response for
@@ -361,6 +371,17 @@ message ListResponse {
   repeated Resource resources = 1;
 }
 
+// ListByOwnerRequest contains the parameters to the ListByOwner endpoint.
+message ListByOwnerRequest {
+  ID owner = 1;
+}
+
+// ListByOwnerResponse contains the results of calling the ListByOwner endpoint.
+message ListByOwnerResponse {
+  // Resources that were listed.
+  repeated Resource resources = 1;
+}
+
 // WriteRequest contains the parameters to the Write endpoint.
 message WriteRequest {
   // Resource to write.
diff --git a/proto-public/pbresource/resource_grpc.pb.go b/proto-public/pbresource/resource_grpc.pb.go
index 59ecbcb0debe..af51fba75bdd 100644
--- a/proto-public/pbresource/resource_grpc.pb.go
+++ b/proto-public/pbresource/resource_grpc.pb.go
@@ -68,6 +68,10 @@ type ResourceServiceClient interface {
 	//
 	// Results are eventually consistent (see ResourceService docs for more info).
 	List(ctx context.Context, in *ListRequest, opts ...grpc.CallOption) (*ListResponse, error)
+	// List resources of a given owner.
+	//
+	// Results are eventually consistent (see ResourceService docs for more info).
+	ListByOwner(ctx context.Context, in *ListByOwnerRequest, opts ...grpc.CallOption) (*ListByOwnerResponse, error)
 	// Delete a resource by ID.
 	//
 	// Deleting a non-existent resource will return a successful response for
@@ -141,6 +145,15 @@ func (c *resourceServiceClient) List(ctx context.Context, in *ListRequest, opts
 	return out, nil
 }
 
+func (c *resourceServiceClient) ListByOwner(ctx context.Context, in *ListByOwnerRequest, opts ...grpc.CallOption) (*ListByOwnerResponse, error) {
+	out := new(ListByOwnerResponse)
+	err := c.cc.Invoke(ctx, "/hashicorp.consul.resource.ResourceService/ListByOwner", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *resourceServiceClient) Delete(ctx context.Context, in *DeleteRequest, opts ...grpc.CallOption) (*DeleteResponse, error) {
 	out := new(DeleteResponse)
 	err := c.cc.Invoke(ctx, "/hashicorp.consul.resource.ResourceService/Delete", in, out, opts...)
@@ -232,6 +245,10 @@ type ResourceServiceServer interface {
 	//
 	// Results are eventually consistent (see ResourceService docs for more info).
 	List(context.Context, *ListRequest) (*ListResponse, error)
+	// List resources of a given owner.
+	//
+	// Results are eventually consistent (see ResourceService docs for more info).
+	ListByOwner(context.Context, *ListByOwnerRequest) (*ListByOwnerResponse, error)
 	// Delete a resource by ID.
 	//
 	// Deleting a non-existent resource will return a successful response for
@@ -277,6 +294,9 @@ func (UnimplementedResourceServiceServer) WriteStatus(context.Context, *WriteSta
 func (UnimplementedResourceServiceServer) List(context.Context, *ListRequest) (*ListResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method List not implemented")
 }
+func (UnimplementedResourceServiceServer) ListByOwner(context.Context, *ListByOwnerRequest) (*ListByOwnerResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListByOwner not implemented")
+}
 func (UnimplementedResourceServiceServer) Delete(context.Context, *DeleteRequest) (*DeleteResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Delete not implemented")
 }
@@ -367,6 +387,24 @@ func _ResourceService_List_Handler(srv interface{}, ctx context.Context, dec fun
 	return interceptor(ctx, in, info, handler)
 }
 
+func _ResourceService_ListByOwner_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListByOwnerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ResourceServiceServer).ListByOwner(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/hashicorp.consul.resource.ResourceService/ListByOwner",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ResourceServiceServer).ListByOwner(ctx, req.(*ListByOwnerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _ResourceService_Delete_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(DeleteRequest)
 	if err := dec(in); err != nil {
@@ -429,6 +467,10 @@ var ResourceService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "List",
 			Handler:    _ResourceService_List_Handler,
 		},
+		{
+			MethodName: "ListByOwner",
+			Handler:    _ResourceService_ListByOwner_Handler,
+		},
 		{
 			MethodName: "Delete",
 			Handler:    _ResourceService_Delete_Handler,

From f908ad82d0393541f86f058d6a312c6065f4db4f Mon Sep 17 00:00:00 2001
From: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>
Date: Mon, 8 May 2023 13:30:48 -0400
Subject: [PATCH 49/92] docs: correct misspelling (#17229)

---
 website/content/docs/connect/dev.mdx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/website/content/docs/connect/dev.mdx b/website/content/docs/connect/dev.mdx
index 6a4eddec5ccb..e31a2f423a61 100644
--- a/website/content/docs/connect/dev.mdx
+++ b/website/content/docs/connect/dev.mdx
@@ -13,7 +13,7 @@ a mutual TLS connection to the service. The
 [`consul connect proxy` command](/consul/commands/connect/proxy) can be used
 for this task on any machine with access to a Consul agent (local or remote).
 
-Restricting access to services only via servoce ,esj ensures that the only way to
+Restricting access to services only via service mesh ensures that the only way to
 connect to a service is through valid authorization of the
 [intentions](/consul/docs/connect/intentions). This can extend to developers
 and operators, too.

From 6fa104409eca2b2a12101273b16816e13733a125 Mon Sep 17 00:00:00 2001
From: John Murret <john.murret@hashicorp.com>
Date: Mon, 8 May 2023 11:57:11 -0600
Subject: [PATCH 50/92] security: update go version to 1.20.4 (#17240)

* update go version to 1.20.3

* add changelog

* rename changelog file to remove underscore

* update to use 1.20.4

* update change log entry to reflect 1.20.4
---
 .changelog/17240.txt                     | 12 ++++++++++++
 .github/workflows/build.yml              | 20 ++++++++++----------
 build-support/docker/Build-Go.dockerfile |  2 +-
 3 files changed, 23 insertions(+), 11 deletions(-)
 create mode 100644 .changelog/17240.txt

diff --git a/.changelog/17240.txt b/.changelog/17240.txt
new file mode 100644
index 000000000000..59d120f747ba
--- /dev/null
+++ b/.changelog/17240.txt
@@ -0,0 +1,12 @@
+```release-note:security
+Upgrade to use Go 1.20.4.
+This resolves vulnerabilities [CVE-2023-24537](https://github.com/advisories/GHSA-9f7g-gqwh-jpf5)(`go/scanner`),
+[CVE-2023-24538](https://github.com/advisories/GHSA-v4m2-x4rp-hv22)(`html/template`),
+[CVE-2023-24534](https://github.com/advisories/GHSA-8v5j-pwr7-w5f8)(`net/textproto`) and
+[CVE-2023-24536](https://github.com/advisories/GHSA-9f7g-gqwh-jpf5)(`mime/multipart`).
+Also, `golang.org/x/net` has been updated to v0.7.0 to resolve CVEs [CVE-2022-41721
+](https://github.com/advisories/GHSA-fxg5-wq6x-vr4w
+), [CVE-2022-27664](https://github.com/advisories/GHSA-69cg-p879-7622) and [CVE-2022-41723
+](https://github.com/advisories/GHSA-vvpx-j8f3-3w6h
+.)
+```
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e67a3a55ae37..8f017a3f8939 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -82,15 +82,15 @@ jobs:
     strategy:
       matrix:
         include:
-          - {go: "1.20.1", goos: "linux", goarch: "386"}
-          - {go: "1.20.1", goos: "linux", goarch: "amd64"}
-          - {go: "1.20.1", goos: "linux", goarch: "arm"}
-          - {go: "1.20.1", goos: "linux", goarch: "arm64"}
-          - {go: "1.20.1", goos: "freebsd", goarch: "386"}
-          - {go: "1.20.1", goos: "freebsd", goarch: "amd64"}
-          - {go: "1.20.1", goos: "windows", goarch: "386"}
-          - {go: "1.20.1", goos: "windows", goarch: "amd64"}
-          - {go: "1.20.1", goos: "solaris", goarch: "amd64"}
+          - {go: "1.20.4", goos: "linux", goarch: "386"}
+          - {go: "1.20.4", goos: "linux", goarch: "amd64"}
+          - {go: "1.20.4", goos: "linux", goarch: "arm"}
+          - {go: "1.20.4", goos: "linux", goarch: "arm64"}
+          - {go: "1.20.4", goos: "freebsd", goarch: "386"}
+          - {go: "1.20.4", goos: "freebsd", goarch: "amd64"}
+          - {go: "1.20.4", goos: "windows", goarch: "386"}
+          - {go: "1.20.4", goos: "windows", goarch: "amd64"}
+          - {go: "1.20.4", goos: "solaris", goarch: "amd64"}
       fail-fast: true
 
     name: Go ${{ matrix.go }} ${{ matrix.goos }} ${{ matrix.goarch }} build
@@ -179,7 +179,7 @@ jobs:
       matrix:
         goos: [ darwin ]
         goarch: [ "amd64", "arm64" ]
-        go: [ "1.20.1" ]
+        go: [ "1.20.4" ]
       fail-fast: true
 
     name: Go ${{ matrix.go }} ${{ matrix.goos }} ${{ matrix.goarch }} build
diff --git a/build-support/docker/Build-Go.dockerfile b/build-support/docker/Build-Go.dockerfile
index 1fad3b7e799a..8ab8e8cb9a99 100644
--- a/build-support/docker/Build-Go.dockerfile
+++ b/build-support/docker/Build-Go.dockerfile
@@ -1,7 +1,7 @@
 # Copyright (c) HashiCorp, Inc.
 # SPDX-License-Identifier: MPL-2.0
 
-ARG GOLANG_VERSION=1.20.1
+ARG GOLANG_VERSION=1.20.4
 FROM golang:${GOLANG_VERSION}
 
 WORKDIR /consul

From 50ef6a697ec4a81a364c442f035a9a2b7c2a676a Mon Sep 17 00:00:00 2001
From: Derek Menteer <105233703+hashi-derek@users.noreply.github.com>
Date: Mon, 8 May 2023 13:13:25 -0500
Subject: [PATCH 51/92] Fix issue with peer stream node cleanup. (#17235)

Fix issue with peer stream node cleanup.

This commit encompasses a few problems that are closely related due to their
proximity in the code.

1. The peerstream utilizes node IDs in several locations to determine which
nodes / services / checks should be cleaned up or created. While VM deployments
with agents will likely always have a node ID, agentless uses synthetic nodes
and does not populate the field. This means that for consul-k8s deployments, all
services were likely bundled together into the same synthetic node in some code
paths (but not all), resulting in strange behavior. The Node.Node field should
be used instead as a unique identifier, as it should always be populated.

2. The peerstream cleanup process for unused nodes uses an incorrect query for
node deregistration. This query is NOT namespace aware and results in the node
(and corresponding services) being deregistered prematurely whenever it has zero
default-namespace services and 1+ non-default-namespace services registered on
it. This issue is tricky to find due to the incorrect logic mentioned in #1,
combined with the fact that the affected services must be co-located on the same
node as the currently deregistering service for this to be encountered.

3. The stream tracker did not understand differences between services in
different namespaces and could therefore report incorrect numbers. It was
updated to utilize the full service name to avoid conflicts and return proper
results.
---
 .changelog/17235.txt                          |   3 +
 .../services/peerstream/replication.go        |  39 ++-
 .../services/peerstream/server.go             |   2 +-
 .../services/peerstream/stream_test.go        | 320 ++++++++++--------
 .../services/peerstream/stream_tracker.go     |   5 +-
 5 files changed, 201 insertions(+), 168 deletions(-)
 create mode 100644 .changelog/17235.txt

diff --git a/.changelog/17235.txt b/.changelog/17235.txt
new file mode 100644
index 000000000000..3356b715ef31
--- /dev/null
+++ b/.changelog/17235.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+peering: Fix issue where peer streams could incorrectly deregister services in various scenarios.
+```
diff --git a/agent/grpc-external/services/peerstream/replication.go b/agent/grpc-external/services/peerstream/replication.go
index 8f1491dadbfa..29d8db9dc6b2 100644
--- a/agent/grpc-external/services/peerstream/replication.go
+++ b/agent/grpc-external/services/peerstream/replication.go
@@ -13,6 +13,7 @@ import (
 	newproto "google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/anypb"
 
+	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/agent/cache"
 	"github.com/hashicorp/consul/agent/consul/state"
 	"github.com/hashicorp/consul/agent/structs"
@@ -341,7 +342,7 @@ func (s *Server) handleUpdateService(
 	for _, nodeSnap := range snap.Nodes {
 		// First register the node - skip the unchanged ones
 		changed := true
-		if storedNode, ok := storedNodesMap[nodeSnap.Node.ID]; ok {
+		if storedNode, ok := storedNodesMap[nodeSnap.Node.Node]; ok {
 			if storedNode.IsSame(nodeSnap.Node) {
 				changed = false
 			}
@@ -357,7 +358,7 @@ func (s *Server) handleUpdateService(
 		// Then register all services on that node - skip the unchanged ones
 		for _, svcSnap := range nodeSnap.Services {
 			changed = true
-			if storedSvcInst, ok := storedSvcInstMap[makeNodeSvcInstID(nodeSnap.Node.ID, svcSnap.Service.ID)]; ok {
+			if storedSvcInst, ok := storedSvcInstMap[makeNodeSvcInstID(nodeSnap.Node.Node, svcSnap.Service.ID)]; ok {
 				if storedSvcInst.IsSame(svcSnap.Service) {
 					changed = false
 				}
@@ -377,7 +378,7 @@ func (s *Server) handleUpdateService(
 		for _, svcSnap := range nodeSnap.Services {
 			for _, c := range svcSnap.Checks {
 				changed := true
-				if chk, ok := storedChecksMap[makeNodeCheckID(nodeSnap.Node.ID, svcSnap.Service.ID, c.CheckID)]; ok {
+				if chk, ok := storedChecksMap[makeNodeCheckID(nodeSnap.Node.Node, svcSnap.Service.ID, c.CheckID)]; ok {
 					if chk.IsSame(c) {
 						changed = false
 					}
@@ -515,8 +516,10 @@ func (s *Server) handleUpdateService(
 
 	// Delete any nodes that do not have any other services registered on them.
 	for node := range unusedNodes {
-		nodeMeta := structs.NodeEnterpriseMetaInPartition(sn.PartitionOrDefault())
-		_, ns, err := s.GetStore().NodeServices(nil, node, nodeMeta, peerName)
+		// The wildcard is used here so that all services, regardless of namespace are returned
+		// by the following query. Without this, the node might accidentally be cleaned up early.
+		wildcardNSMeta := acl.NewEnterpriseMetaWithPartition(sn.PartitionOrDefault(), acl.WildcardName)
+		_, ns, err := s.GetStore().NodeServiceList(nil, node, &wildcardNSMeta, peerName)
 		if err != nil {
 			return fmt.Errorf("failed to query services on node: %w", err)
 		}
@@ -529,10 +532,10 @@ func (s *Server) handleUpdateService(
 		err = s.Backend.CatalogDeregister(&structs.DeregisterRequest{
 			Node:           node,
 			PeerName:       peerName,
-			EnterpriseMeta: *nodeMeta,
+			EnterpriseMeta: *structs.NodeEnterpriseMetaInPartition(sn.PartitionOrDefault()),
 		})
 		if err != nil {
-			ident := fmt.Sprintf("partition:%s/peer:%s/node:%s", nodeMeta.PartitionOrDefault(), peerName, node)
+			ident := fmt.Sprintf("partition:%s/peer:%s/node:%s", sn.PartitionOrDefault(), peerName, node)
 			return fmt.Errorf("failed to deregister node %q: %w", ident, err)
 		}
 	}
@@ -635,31 +638,35 @@ type nodeCheckIdentity struct {
 	checkID   string
 }
 
-func makeNodeSvcInstID(nodeID types.NodeID, serviceID string) nodeSvcInstIdentity {
+func makeNodeSvcInstID(node string, serviceID string) nodeSvcInstIdentity {
 	return nodeSvcInstIdentity{
-		nodeID:    string(nodeID),
+		nodeID:    node,
 		serviceID: serviceID,
 	}
 }
 
-func makeNodeCheckID(nodeID types.NodeID, serviceID string, checkID types.CheckID) nodeCheckIdentity {
+func makeNodeCheckID(node string, serviceID string, checkID types.CheckID) nodeCheckIdentity {
 	return nodeCheckIdentity{
 		serviceID: serviceID,
 		checkID:   string(checkID),
-		nodeID:    string(nodeID),
+		nodeID:    node,
 	}
 }
 
-func buildStoredMap(storedInstances structs.CheckServiceNodes) (map[types.NodeID]*structs.Node, map[nodeSvcInstIdentity]*structs.NodeService, map[nodeCheckIdentity]*structs.HealthCheck) {
-	nodesMap := map[types.NodeID]*structs.Node{}
+func buildStoredMap(storedInstances structs.CheckServiceNodes) (
+	map[string]*structs.Node,
+	map[nodeSvcInstIdentity]*structs.NodeService,
+	map[nodeCheckIdentity]*structs.HealthCheck,
+) {
+	nodesMap := map[string]*structs.Node{}
 	svcInstMap := map[nodeSvcInstIdentity]*structs.NodeService{}
 	checksMap := map[nodeCheckIdentity]*structs.HealthCheck{}
 
 	for _, csn := range storedInstances {
-		nodesMap[csn.Node.ID] = csn.Node
-		svcInstMap[makeNodeSvcInstID(csn.Node.ID, csn.Service.ID)] = csn.Service
+		nodesMap[csn.Node.Node] = csn.Node
+		svcInstMap[makeNodeSvcInstID(csn.Node.Node, csn.Service.ID)] = csn.Service
 		for _, chk := range csn.Checks {
-			checksMap[makeNodeCheckID(csn.Node.ID, csn.Service.ID, chk.CheckID)] = chk
+			checksMap[makeNodeCheckID(csn.Node.Node, csn.Service.ID, chk.CheckID)] = chk
 		}
 	}
 	return nodesMap, svcInstMap, checksMap
diff --git a/agent/grpc-external/services/peerstream/server.go b/agent/grpc-external/services/peerstream/server.go
index e0dd4d759dfe..58e436bd1f5c 100644
--- a/agent/grpc-external/services/peerstream/server.go
+++ b/agent/grpc-external/services/peerstream/server.go
@@ -122,7 +122,7 @@ type StateStore interface {
 	ExportedServicesForPeer(ws memdb.WatchSet, peerID, dc string) (uint64, *structs.ExportedServiceList, error)
 	ServiceDump(ws memdb.WatchSet, kind structs.ServiceKind, useKind bool, entMeta *acl.EnterpriseMeta, peerName string) (uint64, structs.CheckServiceNodes, error)
 	CheckServiceNodes(ws memdb.WatchSet, serviceName string, entMeta *acl.EnterpriseMeta, peerName string) (uint64, structs.CheckServiceNodes, error)
-	NodeServices(ws memdb.WatchSet, nodeNameOrID string, entMeta *acl.EnterpriseMeta, peerName string) (uint64, *structs.NodeServices, error)
+	NodeServiceList(ws memdb.WatchSet, nodeNameOrID string, entMeta *acl.EnterpriseMeta, peerName string) (uint64, *structs.NodeServiceList, error)
 	CAConfig(ws memdb.WatchSet) (uint64, *structs.CAConfiguration, error)
 	TrustBundleListByService(ws memdb.WatchSet, service, dc string, entMeta acl.EnterpriseMeta) (uint64, []*pbpeering.PeeringTrustBundle, error)
 	ServiceList(ws memdb.WatchSet, entMeta *acl.EnterpriseMeta, peerName string) (uint64, structs.ServiceList, error)
diff --git a/agent/grpc-external/services/peerstream/stream_test.go b/agent/grpc-external/services/peerstream/stream_test.go
index 140ae947dc5b..0a7d6812ab4b 100644
--- a/agent/grpc-external/services/peerstream/stream_test.go
+++ b/agent/grpc-external/services/peerstream/stream_test.go
@@ -1594,7 +1594,11 @@ func Test_ExportedServicesCount(t *testing.T) {
 	mst, err := srv.Tracker.Connected(peerID)
 	require.NoError(t, err)
 
-	services := []string{"web", "api", "mongo"}
+	services := []string{
+		structs.NewServiceName("web", nil).String(),
+		structs.NewServiceName("api", nil).String(),
+		structs.NewServiceName("mongo", nil).String(),
+	}
 	update := cache.UpdateEvent{
 		CorrelationID: subExportedServiceList,
 		Result: &pbpeerstream.ExportedServiceList{
@@ -1938,36 +1942,30 @@ func expectReplEvents(t *testing.T, client *MockClient, checkFns ...func(t *test
 	}
 }
 
-func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
-	srv, store := newTestServer(t, func(c *Config) {
-		backend := c.Backend.(*testStreamBackend)
-		backend.leader = func() bool {
-			return false
-		}
-	})
-
-	type testCase struct {
-		name             string
-		seed             []*structs.RegisterRequest
-		input            *pbpeerstream.ExportedService
-		expect           map[string]structs.CheckServiceNodes
-		exportedServices []string
-	}
-
-	peerName := "billing"
-	peerID := "1fabcd52-1d46-49b0-b1d8-71559aee47f5"
-	remoteMeta := pbcommon.NewEnterpriseMetaFromStructs(*structs.DefaultEnterpriseMetaInPartition("billing-ap"))
-
-	// "api" service is imported from the billing-ap partition, corresponding to the billing peer.
-	// Locally it is stored to the default partition.
-	defaultMeta := *acl.DefaultEnterpriseMeta()
-	apiSN := structs.NewServiceName("api", &defaultMeta)
+type PeeringProcessResponse_testCase struct {
+	name             string
+	seed             []*structs.RegisterRequest
+	inputServiceName structs.ServiceName
+	input            *pbpeerstream.ExportedService
+	expect           map[structs.ServiceName]structs.CheckServiceNodes
+	exportedServices []string
+}
 
+func processResponse_ExportedServiceUpdates(
+	t *testing.T,
+	srv *testServer,
+	store *state.Store,
+	localEntMeta acl.EnterpriseMeta,
+	peerName string,
+	tests []PeeringProcessResponse_testCase,
+) {
 	// create a peering in the state store
+	peerID := "1fabcd52-1d46-49b0-b1d8-71559aee47f5"
 	require.NoError(t, store.PeeringWrite(31, &pbpeering.PeeringWriteRequest{
 		Peering: &pbpeering.Peering{
-			ID:   peerID,
-			Name: peerName,
+			ID:        peerID,
+			Name:      peerName,
+			Partition: localEntMeta.PartitionOrDefault(),
 		},
 	}))
 
@@ -1975,7 +1973,7 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 	mst, err := srv.Tracker.Connected(peerID)
 	require.NoError(t, err)
 
-	run := func(t *testing.T, tc testCase) {
+	run := func(t *testing.T, tc PeeringProcessResponse_testCase) {
 		// Seed the local catalog with some data to reconcile against.
 		// and increment the tracker's imported services count
 		var serviceNames []structs.ServiceName
@@ -1989,14 +1987,14 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 
 		in := &pbpeerstream.ReplicationMessage_Response{
 			ResourceURL: pbpeerstream.TypeURLExportedService,
-			ResourceID:  apiSN.String(),
+			ResourceID:  tc.inputServiceName.String(),
 			Nonce:       "1",
 			Operation:   pbpeerstream.Operation_OPERATION_UPSERT,
 			Resource:    makeAnyPB(t, tc.input),
 		}
 
 		// Simulate an update arriving for billing/api.
-		_, err = srv.processResponse(peerName, acl.DefaultPartitionName, mst, in)
+		_, err = srv.processResponse(peerName, localEntMeta.PartitionOrDefault(), mst, in)
 		require.NoError(t, err)
 
 		if len(tc.exportedServices) > 0 {
@@ -2009,63 +2007,81 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 			}
 
 			// Simulate an update arriving for billing/api.
-			_, err = srv.processResponse(peerName, acl.DefaultPartitionName, mst, resp)
+			_, err = srv.processResponse(peerName, localEntMeta.PartitionOrDefault(), mst, resp)
 			require.NoError(t, err)
 			// Test the count and contents separately to ensure the count code path is hit.
 			require.Equal(t, mst.GetImportedServicesCount(), len(tc.exportedServices))
 			require.ElementsMatch(t, mst.ImportedServices, tc.exportedServices)
 		}
 
-		_, allServices, err := srv.GetStore().ServiceList(nil, &defaultMeta, peerName)
+		wildcardNS := acl.NewEnterpriseMetaWithPartition(localEntMeta.PartitionOrDefault(), acl.WildcardName)
+		_, allServices, err := srv.GetStore().ServiceList(nil, &wildcardNS, peerName)
 		require.NoError(t, err)
 
 		// This ensures that only services specified under tc.expect are stored. It includes
 		// all exported services plus their sidecar proxies.
 		for _, svc := range allServices {
-			_, ok := tc.expect[svc.Name]
+			_, ok := tc.expect[svc]
 			require.True(t, ok)
 		}
 
 		for svc, expect := range tc.expect {
-			t.Run(svc, func(t *testing.T) {
-				_, got, err := srv.GetStore().CheckServiceNodes(nil, svc, &defaultMeta, peerName)
+			t.Run(svc.String(), func(t *testing.T) {
+				_, got, err := srv.GetStore().CheckServiceNodes(nil, svc.Name, &svc.EnterpriseMeta, peerName)
 				require.NoError(t, err)
 				requireEqualInstances(t, expect, got)
 			})
 		}
 	}
 
-	tt := []testCase{
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			run(t, tc)
+		})
+	}
+}
+
+func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
+	peerName := "billing"
+	localEntMeta := *acl.DefaultEnterpriseMeta()
+
+	remoteMeta := *structs.DefaultEnterpriseMetaInPartition("billing-ap")
+	pbRemoteMeta := pbcommon.NewEnterpriseMetaFromStructs(remoteMeta)
+
+	apiLocalSN := structs.NewServiceName("api", &localEntMeta)
+	redisLocalSN := structs.NewServiceName("redis", &localEntMeta)
+	tests := []PeeringProcessResponse_testCase{
 		{
 			name:             "upsert two service instances to the same node",
-			exportedServices: []string{"api"},
+			exportedServices: []string{apiLocalSN.String()},
+			inputServiceName: structs.NewServiceName("api", &remoteMeta),
 			input: &pbpeerstream.ExportedService{
 				Nodes: []*pbservice.CheckServiceNode{
 					{
 						Node: &pbservice.Node{
 							ID:        "af913374-68ea-41e5-82e8-6ffd3dffc461",
 							Node:      "node-foo",
-							Partition: remoteMeta.Partition,
+							Partition: pbRemoteMeta.Partition,
 							PeerName:  peerName,
 						},
 						Service: &pbservice.NodeService{
 							ID:             "api-1",
 							Service:        "api",
-							EnterpriseMeta: remoteMeta,
+							EnterpriseMeta: pbRemoteMeta,
 							PeerName:       peerName,
 						},
 						Checks: []*pbservice.HealthCheck{
 							{
 								CheckID:        "node-foo-check",
 								Node:           "node-foo",
-								EnterpriseMeta: remoteMeta,
+								EnterpriseMeta: pbRemoteMeta,
 								PeerName:       peerName,
 							},
 							{
 								CheckID:        "api-1-check",
 								ServiceID:      "api-1",
 								Node:           "node-foo",
-								EnterpriseMeta: remoteMeta,
+								EnterpriseMeta: pbRemoteMeta,
 								PeerName:       peerName,
 							},
 						},
@@ -2074,42 +2090,42 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 						Node: &pbservice.Node{
 							ID:        "af913374-68ea-41e5-82e8-6ffd3dffc461",
 							Node:      "node-foo",
-							Partition: remoteMeta.Partition,
+							Partition: pbRemoteMeta.Partition,
 							PeerName:  peerName,
 						},
 						Service: &pbservice.NodeService{
 							ID:             "api-2",
 							Service:        "api",
-							EnterpriseMeta: remoteMeta,
+							EnterpriseMeta: pbRemoteMeta,
 							PeerName:       peerName,
 						},
 						Checks: []*pbservice.HealthCheck{
 							{
 								CheckID:        "node-foo-check",
 								Node:           "node-foo",
-								EnterpriseMeta: remoteMeta,
+								EnterpriseMeta: pbRemoteMeta,
 								PeerName:       peerName,
 							},
 							{
 								CheckID:        "api-2-check",
 								ServiceID:      "api-2",
 								Node:           "node-foo",
-								EnterpriseMeta: remoteMeta,
+								EnterpriseMeta: pbRemoteMeta,
 								PeerName:       peerName,
 							},
 						},
 					},
 				},
 			},
-			expect: map[string]structs.CheckServiceNodes{
-				"api": {
+			expect: map[structs.ServiceName]structs.CheckServiceNodes{
+				structs.NewServiceName("api", &localEntMeta): {
 					{
 						Node: &structs.Node{
 							ID:   "af913374-68ea-41e5-82e8-6ffd3dffc461",
 							Node: "node-foo",
 
 							// The remote billing-ap partition is overwritten for all resources with the local default.
-							Partition: defaultMeta.PartitionOrEmpty(),
+							Partition: localEntMeta.PartitionOrEmpty(),
 
 							// The name of the peer "billing" is attached as well.
 							PeerName: peerName,
@@ -2117,21 +2133,21 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 						Service: &structs.NodeService{
 							ID:             "api-1",
 							Service:        "api",
-							EnterpriseMeta: defaultMeta,
+							EnterpriseMeta: localEntMeta,
 							PeerName:       peerName,
 						},
 						Checks: []*structs.HealthCheck{
 							{
 								CheckID:        "node-foo-check",
 								Node:           "node-foo",
-								EnterpriseMeta: defaultMeta,
+								EnterpriseMeta: localEntMeta,
 								PeerName:       peerName,
 							},
 							{
 								CheckID:        "api-1-check",
 								ServiceID:      "api-1",
 								Node:           "node-foo",
-								EnterpriseMeta: defaultMeta,
+								EnterpriseMeta: localEntMeta,
 								PeerName:       peerName,
 							},
 						},
@@ -2140,27 +2156,27 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 						Node: &structs.Node{
 							ID:        "af913374-68ea-41e5-82e8-6ffd3dffc461",
 							Node:      "node-foo",
-							Partition: defaultMeta.PartitionOrEmpty(),
+							Partition: localEntMeta.PartitionOrEmpty(),
 							PeerName:  peerName,
 						},
 						Service: &structs.NodeService{
 							ID:             "api-2",
 							Service:        "api",
-							EnterpriseMeta: defaultMeta,
+							EnterpriseMeta: localEntMeta,
 							PeerName:       peerName,
 						},
 						Checks: []*structs.HealthCheck{
 							{
 								CheckID:        "node-foo-check",
 								Node:           "node-foo",
-								EnterpriseMeta: defaultMeta,
+								EnterpriseMeta: localEntMeta,
 								PeerName:       peerName,
 							},
 							{
 								CheckID:        "api-2-check",
 								ServiceID:      "api-2",
 								Node:           "node-foo",
-								EnterpriseMeta: defaultMeta,
+								EnterpriseMeta: localEntMeta,
 								PeerName:       peerName,
 							},
 						},
@@ -2170,7 +2186,7 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 		},
 		{
 			name:             "deleting a service with an empty exported service event",
-			exportedServices: []string{"api"},
+			exportedServices: []string{apiLocalSN.String()},
 			seed: []*structs.RegisterRequest{
 				{
 					ID:       types.NodeID("af913374-68ea-41e5-82e8-6ffd3dffc461"),
@@ -2179,7 +2195,7 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 					Service: &structs.NodeService{
 						ID:             "api-2",
 						Service:        "api",
-						EnterpriseMeta: defaultMeta,
+						EnterpriseMeta: localEntMeta,
 						PeerName:       peerName,
 					},
 					Checks: structs.HealthChecks{
@@ -2197,41 +2213,43 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 					},
 				},
 			},
-			input: &pbpeerstream.ExportedService{},
-			expect: map[string]structs.CheckServiceNodes{
-				"api": {},
+			inputServiceName: structs.NewServiceName("api", &remoteMeta),
+			input:            &pbpeerstream.ExportedService{},
+			expect: map[structs.ServiceName]structs.CheckServiceNodes{
+				structs.NewServiceName("api", &localEntMeta): {},
 			},
 		},
 		{
 			name:             "upsert two service instances to different nodes",
-			exportedServices: []string{"api"},
+			exportedServices: []string{apiLocalSN.String()},
+			inputServiceName: structs.NewServiceName("api", &remoteMeta),
 			input: &pbpeerstream.ExportedService{
 				Nodes: []*pbservice.CheckServiceNode{
 					{
 						Node: &pbservice.Node{
 							ID:        "af913374-68ea-41e5-82e8-6ffd3dffc461",
 							Node:      "node-foo",
-							Partition: remoteMeta.Partition,
+							Partition: pbRemoteMeta.Partition,
 							PeerName:  peerName,
 						},
 						Service: &pbservice.NodeService{
 							ID:             "api-1",
 							Service:        "api",
-							EnterpriseMeta: remoteMeta,
+							EnterpriseMeta: pbRemoteMeta,
 							PeerName:       peerName,
 						},
 						Checks: []*pbservice.HealthCheck{
 							{
 								CheckID:        "node-foo-check",
 								Node:           "node-foo",
-								EnterpriseMeta: remoteMeta,
+								EnterpriseMeta: pbRemoteMeta,
 								PeerName:       peerName,
 							},
 							{
 								CheckID:        "api-1-check",
 								ServiceID:      "api-1",
 								Node:           "node-foo",
-								EnterpriseMeta: remoteMeta,
+								EnterpriseMeta: pbRemoteMeta,
 								PeerName:       peerName,
 							},
 						},
@@ -2240,60 +2258,60 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 						Node: &pbservice.Node{
 							ID:        "c0f97de9-4e1b-4e80-a1c6-cd8725835ab2",
 							Node:      "node-bar",
-							Partition: remoteMeta.Partition,
+							Partition: pbRemoteMeta.Partition,
 							PeerName:  peerName,
 						},
 						Service: &pbservice.NodeService{
 							ID:             "api-2",
 							Service:        "api",
-							EnterpriseMeta: remoteMeta,
+							EnterpriseMeta: pbRemoteMeta,
 							PeerName:       peerName,
 						},
 						Checks: []*pbservice.HealthCheck{
 							{
 								CheckID:        "node-bar-check",
 								Node:           "node-bar",
-								EnterpriseMeta: remoteMeta,
+								EnterpriseMeta: pbRemoteMeta,
 								PeerName:       peerName,
 							},
 							{
 								CheckID:        "api-2-check",
 								ServiceID:      "api-2",
 								Node:           "node-bar",
-								EnterpriseMeta: remoteMeta,
+								EnterpriseMeta: pbRemoteMeta,
 								PeerName:       peerName,
 							},
 						},
 					},
 				},
 			},
-			expect: map[string]structs.CheckServiceNodes{
-				"api": {
+			expect: map[structs.ServiceName]structs.CheckServiceNodes{
+				structs.NewServiceName("api", &localEntMeta): {
 					{
 						Node: &structs.Node{
 							ID:        "c0f97de9-4e1b-4e80-a1c6-cd8725835ab2",
 							Node:      "node-bar",
-							Partition: defaultMeta.PartitionOrEmpty(),
+							Partition: localEntMeta.PartitionOrEmpty(),
 							PeerName:  peerName,
 						},
 						Service: &structs.NodeService{
 							ID:             "api-2",
 							Service:        "api",
-							EnterpriseMeta: defaultMeta,
+							EnterpriseMeta: localEntMeta,
 							PeerName:       peerName,
 						},
 						Checks: []*structs.HealthCheck{
 							{
 								CheckID:        "node-bar-check",
 								Node:           "node-bar",
-								EnterpriseMeta: defaultMeta,
+								EnterpriseMeta: localEntMeta,
 								PeerName:       peerName,
 							},
 							{
 								CheckID:        "api-2-check",
 								ServiceID:      "api-2",
 								Node:           "node-bar",
-								EnterpriseMeta: defaultMeta,
+								EnterpriseMeta: localEntMeta,
 								PeerName:       peerName,
 							},
 						},
@@ -2304,7 +2322,7 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 							Node: "node-foo",
 
 							// The remote billing-ap partition is overwritten for all resources with the local default.
-							Partition: defaultMeta.PartitionOrEmpty(),
+							Partition: localEntMeta.PartitionOrEmpty(),
 
 							// The name of the peer "billing" is attached as well.
 							PeerName: peerName,
@@ -2312,21 +2330,21 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 						Service: &structs.NodeService{
 							ID:             "api-1",
 							Service:        "api",
-							EnterpriseMeta: defaultMeta,
+							EnterpriseMeta: localEntMeta,
 							PeerName:       peerName,
 						},
 						Checks: []*structs.HealthCheck{
 							{
 								CheckID:        "node-foo-check",
 								Node:           "node-foo",
-								EnterpriseMeta: defaultMeta,
+								EnterpriseMeta: localEntMeta,
 								PeerName:       peerName,
 							},
 							{
 								CheckID:        "api-1-check",
 								ServiceID:      "api-1",
 								Node:           "node-foo",
-								EnterpriseMeta: defaultMeta,
+								EnterpriseMeta: localEntMeta,
 								PeerName:       peerName,
 							},
 						},
@@ -2336,7 +2354,7 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 		},
 		{
 			name:             "deleting one service name from a node does not delete other service names",
-			exportedServices: []string{"api", "redis"},
+			exportedServices: []string{apiLocalSN.String(), redisLocalSN.String()},
 			seed: []*structs.RegisterRequest{
 				{
 					ID:       types.NodeID("af913374-68ea-41e5-82e8-6ffd3dffc461"),
@@ -2345,7 +2363,7 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 					Service: &structs.NodeService{
 						ID:             "redis-2",
 						Service:        "redis",
-						EnterpriseMeta: defaultMeta,
+						EnterpriseMeta: localEntMeta,
 						PeerName:       peerName,
 					},
 					Checks: structs.HealthChecks{
@@ -2369,7 +2387,7 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 					Service: &structs.NodeService{
 						ID:             "api-1",
 						Service:        "api",
-						EnterpriseMeta: defaultMeta,
+						EnterpriseMeta: localEntMeta,
 						PeerName:       peerName,
 					},
 					Checks: structs.HealthChecks{
@@ -2387,37 +2405,38 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 					},
 				},
 			},
+			inputServiceName: structs.NewServiceName("api", &remoteMeta),
 			// Nil input is for the "api" service.
 			input: &pbpeerstream.ExportedService{},
-			expect: map[string]structs.CheckServiceNodes{
-				"api": {},
+			expect: map[structs.ServiceName]structs.CheckServiceNodes{
+				structs.NewServiceName("api", &localEntMeta): {},
 				// Existing redis service was not affected by deletion.
-				"redis": {
+				structs.NewServiceName("redis", &localEntMeta): {
 					{
 						Node: &structs.Node{
 							ID:        "af913374-68ea-41e5-82e8-6ffd3dffc461",
 							Node:      "node-foo",
-							Partition: defaultMeta.PartitionOrEmpty(),
+							Partition: localEntMeta.PartitionOrEmpty(),
 							PeerName:  peerName,
 						},
 						Service: &structs.NodeService{
 							ID:             "redis-2",
 							Service:        "redis",
-							EnterpriseMeta: defaultMeta,
+							EnterpriseMeta: localEntMeta,
 							PeerName:       peerName,
 						},
 						Checks: []*structs.HealthCheck{
 							{
 								CheckID:        "node-foo-check",
 								Node:           "node-foo",
-								EnterpriseMeta: defaultMeta,
+								EnterpriseMeta: localEntMeta,
 								PeerName:       peerName,
 							},
 							{
 								CheckID:        "redis-2-check",
 								ServiceID:      "redis-2",
 								Node:           "node-foo",
-								EnterpriseMeta: defaultMeta,
+								EnterpriseMeta: localEntMeta,
 								PeerName:       peerName,
 							},
 						},
@@ -2435,7 +2454,7 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 					Service: &structs.NodeService{
 						ID:             "redis-2",
 						Service:        "redis",
-						EnterpriseMeta: defaultMeta,
+						EnterpriseMeta: localEntMeta,
 						PeerName:       peerName,
 					},
 					Checks: structs.HealthChecks{
@@ -2459,7 +2478,7 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 					Service: &structs.NodeService{
 						ID:             "redis-2-sidecar-proxy",
 						Service:        "redis-sidecar-proxy",
-						EnterpriseMeta: defaultMeta,
+						EnterpriseMeta: localEntMeta,
 						PeerName:       peerName,
 					},
 					Checks: structs.HealthChecks{
@@ -2483,7 +2502,7 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 					Service: &structs.NodeService{
 						ID:             "api-1",
 						Service:        "api",
-						EnterpriseMeta: defaultMeta,
+						EnterpriseMeta: localEntMeta,
 						PeerName:       peerName,
 					},
 					Checks: structs.HealthChecks{
@@ -2507,7 +2526,7 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 					Service: &structs.NodeService{
 						ID:             "api-1-sidecar-proxy",
 						Service:        "api-sidecar-proxy",
-						EnterpriseMeta: defaultMeta,
+						EnterpriseMeta: localEntMeta,
 						PeerName:       peerName,
 					},
 					Checks: structs.HealthChecks{
@@ -2526,68 +2545,69 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 					},
 				},
 			},
+			inputServiceName: structs.NewServiceName("api", &remoteMeta),
 			// Nil input is for the "api" service.
 			input:            &pbpeerstream.ExportedService{},
-			exportedServices: []string{"redis"},
-			expect: map[string]structs.CheckServiceNodes{
+			exportedServices: []string{redisLocalSN.String()},
+			expect: map[structs.ServiceName]structs.CheckServiceNodes{
 				// Existing redis service was not affected by deletion.
-				"redis": {
+				structs.NewServiceName("redis", &localEntMeta): {
 					{
 						Node: &structs.Node{
 							ID:        "af913374-68ea-41e5-82e8-6ffd3dffc461",
 							Node:      "node-foo",
-							Partition: defaultMeta.PartitionOrEmpty(),
+							Partition: localEntMeta.PartitionOrEmpty(),
 							PeerName:  peerName,
 						},
 						Service: &structs.NodeService{
 							ID:             "redis-2",
 							Service:        "redis",
-							EnterpriseMeta: defaultMeta,
+							EnterpriseMeta: localEntMeta,
 							PeerName:       peerName,
 						},
 						Checks: []*structs.HealthCheck{
 							{
 								CheckID:        "node-foo-check",
 								Node:           "node-foo",
-								EnterpriseMeta: defaultMeta,
+								EnterpriseMeta: localEntMeta,
 								PeerName:       peerName,
 							},
 							{
 								CheckID:        "redis-2-check",
 								ServiceID:      "redis-2",
 								Node:           "node-foo",
-								EnterpriseMeta: defaultMeta,
+								EnterpriseMeta: localEntMeta,
 								PeerName:       peerName,
 							},
 						},
 					},
 				},
-				"redis-sidecar-proxy": {
+				structs.NewServiceName("redis-sidecar-proxy", &localEntMeta): {
 					{
 						Node: &structs.Node{
 							ID:        "af913374-68ea-41e5-82e8-6ffd3dffc461",
 							Node:      "node-foo",
-							Partition: defaultMeta.PartitionOrEmpty(),
+							Partition: localEntMeta.PartitionOrEmpty(),
 							PeerName:  peerName,
 						},
 						Service: &structs.NodeService{
 							ID:             "redis-2-sidecar-proxy",
 							Service:        "redis-sidecar-proxy",
-							EnterpriseMeta: defaultMeta,
+							EnterpriseMeta: localEntMeta,
 							PeerName:       peerName,
 						},
 						Checks: []*structs.HealthCheck{
 							{
 								CheckID:        "node-foo-check",
 								Node:           "node-foo",
-								EnterpriseMeta: defaultMeta,
+								EnterpriseMeta: localEntMeta,
 								PeerName:       peerName,
 							},
 							{
 								CheckID:        "redis-2-sidecar-proxy-check",
 								ServiceID:      "redis-2-sidecar-proxy",
 								Node:           "node-foo",
-								EnterpriseMeta: defaultMeta,
+								EnterpriseMeta: localEntMeta,
 								PeerName:       peerName,
 							},
 						},
@@ -2597,7 +2617,7 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 		},
 		{
 			name:             "service checks are cleaned up when not present in a response",
-			exportedServices: []string{"api"},
+			exportedServices: []string{apiLocalSN.String()},
 			seed: []*structs.RegisterRequest{
 				{
 					ID:       types.NodeID("af913374-68ea-41e5-82e8-6ffd3dffc461"),
@@ -2606,7 +2626,7 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 					Service: &structs.NodeService{
 						ID:             "api-1",
 						Service:        "api",
-						EnterpriseMeta: defaultMeta,
+						EnterpriseMeta: localEntMeta,
 						PeerName:       peerName,
 					},
 					Checks: structs.HealthChecks{
@@ -2624,19 +2644,20 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 					},
 				},
 			},
+			inputServiceName: structs.NewServiceName("api", &remoteMeta),
 			input: &pbpeerstream.ExportedService{
 				Nodes: []*pbservice.CheckServiceNode{
 					{
 						Node: &pbservice.Node{
 							ID:        "af913374-68ea-41e5-82e8-6ffd3dffc461",
 							Node:      "node-foo",
-							Partition: remoteMeta.Partition,
+							Partition: pbRemoteMeta.Partition,
 							PeerName:  peerName,
 						},
 						Service: &pbservice.NodeService{
 							ID:             "api-1",
 							Service:        "api",
-							EnterpriseMeta: remoteMeta,
+							EnterpriseMeta: pbRemoteMeta,
 							PeerName:       peerName,
 						},
 						Checks: []*pbservice.HealthCheck{
@@ -2645,20 +2666,20 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 					},
 				},
 			},
-			expect: map[string]structs.CheckServiceNodes{
+			expect: map[structs.ServiceName]structs.CheckServiceNodes{
 				// Service check should be gone
-				"api": {
+				structs.NewServiceName("api", &localEntMeta): {
 					{
 						Node: &structs.Node{
 							ID:        "af913374-68ea-41e5-82e8-6ffd3dffc461",
 							Node:      "node-foo",
-							Partition: defaultMeta.PartitionOrEmpty(),
+							Partition: localEntMeta.PartitionOrEmpty(),
 							PeerName:  peerName,
 						},
 						Service: &structs.NodeService{
 							ID:             "api-1",
 							Service:        "api",
-							EnterpriseMeta: defaultMeta,
+							EnterpriseMeta: localEntMeta,
 							PeerName:       peerName,
 						},
 						Checks: []*structs.HealthCheck{},
@@ -2668,7 +2689,7 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 		},
 		{
 			name:             "node checks are cleaned up when not present in a response",
-			exportedServices: []string{"api", "redis"},
+			exportedServices: []string{apiLocalSN.String(), redisLocalSN.String()},
 			seed: []*structs.RegisterRequest{
 				{
 					ID:       types.NodeID("af913374-68ea-41e5-82e8-6ffd3dffc461"),
@@ -2677,7 +2698,7 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 					Service: &structs.NodeService{
 						ID:             "redis-2",
 						Service:        "redis",
-						EnterpriseMeta: defaultMeta,
+						EnterpriseMeta: localEntMeta,
 						PeerName:       peerName,
 					},
 					Checks: structs.HealthChecks{
@@ -2701,7 +2722,7 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 					Service: &structs.NodeService{
 						ID:             "api-1",
 						Service:        "api",
-						EnterpriseMeta: defaultMeta,
+						EnterpriseMeta: localEntMeta,
 						PeerName:       peerName,
 					},
 					Checks: structs.HealthChecks{
@@ -2719,19 +2740,20 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 					},
 				},
 			},
+			inputServiceName: structs.NewServiceName("api", &remoteMeta),
 			input: &pbpeerstream.ExportedService{
 				Nodes: []*pbservice.CheckServiceNode{
 					{
 						Node: &pbservice.Node{
 							ID:        "af913374-68ea-41e5-82e8-6ffd3dffc461",
 							Node:      "node-foo",
-							Partition: remoteMeta.Partition,
+							Partition: pbRemoteMeta.Partition,
 							PeerName:  peerName,
 						},
 						Service: &pbservice.NodeService{
 							ID:             "api-1",
 							Service:        "api",
-							EnterpriseMeta: remoteMeta,
+							EnterpriseMeta: pbRemoteMeta,
 							PeerName:       peerName,
 						},
 						Checks: []*pbservice.HealthCheck{
@@ -2740,27 +2762,27 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 								CheckID:        "api-1-check",
 								ServiceID:      "api-1",
 								Node:           "node-foo",
-								EnterpriseMeta: remoteMeta,
+								EnterpriseMeta: pbRemoteMeta,
 								PeerName:       peerName,
 							},
 						},
 					},
 				},
 			},
-			expect: map[string]structs.CheckServiceNodes{
+			expect: map[structs.ServiceName]structs.CheckServiceNodes{
 				// Node check should be gone
-				"api": {
+				structs.NewServiceName("api", &localEntMeta): {
 					{
 						Node: &structs.Node{
 							ID:        "af913374-68ea-41e5-82e8-6ffd3dffc461",
 							Node:      "node-foo",
-							Partition: defaultMeta.PartitionOrEmpty(),
+							Partition: localEntMeta.PartitionOrEmpty(),
 							PeerName:  peerName,
 						},
 						Service: &structs.NodeService{
 							ID:             "api-1",
 							Service:        "api",
-							EnterpriseMeta: defaultMeta,
+							EnterpriseMeta: localEntMeta,
 							PeerName:       peerName,
 						},
 						Checks: []*structs.HealthCheck{
@@ -2768,24 +2790,24 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 								CheckID:        "api-1-check",
 								ServiceID:      "api-1",
 								Node:           "node-foo",
-								EnterpriseMeta: defaultMeta,
+								EnterpriseMeta: localEntMeta,
 								PeerName:       peerName,
 							},
 						},
 					},
 				},
-				"redis": {
+				structs.NewServiceName("redis", &localEntMeta): {
 					{
 						Node: &structs.Node{
 							ID:        "af913374-68ea-41e5-82e8-6ffd3dffc461",
 							Node:      "node-foo",
-							Partition: defaultMeta.PartitionOrEmpty(),
+							Partition: localEntMeta.PartitionOrEmpty(),
 							PeerName:  peerName,
 						},
 						Service: &structs.NodeService{
 							ID:             "redis-2",
 							Service:        "redis",
-							EnterpriseMeta: defaultMeta,
+							EnterpriseMeta: localEntMeta,
 							PeerName:       peerName,
 						},
 						Checks: []*structs.HealthCheck{
@@ -2793,7 +2815,7 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 								CheckID:        "redis-2-check",
 								ServiceID:      "redis-2",
 								Node:           "node-foo",
-								EnterpriseMeta: defaultMeta,
+								EnterpriseMeta: localEntMeta,
 								PeerName:       peerName,
 							},
 						},
@@ -2803,7 +2825,7 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 		},
 		{
 			name:             "replacing a service instance on a node cleans up the old instance",
-			exportedServices: []string{"api", "redis"},
+			exportedServices: []string{apiLocalSN.String(), redisLocalSN.String()},
 			seed: []*structs.RegisterRequest{
 				{
 					ID:       types.NodeID("af913374-68ea-41e5-82e8-6ffd3dffc461"),
@@ -2812,7 +2834,7 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 					Service: &structs.NodeService{
 						ID:             "redis-2",
 						Service:        "redis",
-						EnterpriseMeta: defaultMeta,
+						EnterpriseMeta: localEntMeta,
 						PeerName:       peerName,
 					},
 					Checks: structs.HealthChecks{
@@ -2836,7 +2858,7 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 					Service: &structs.NodeService{
 						ID:             "api-1",
 						Service:        "api",
-						EnterpriseMeta: defaultMeta,
+						EnterpriseMeta: localEntMeta,
 						PeerName:       peerName,
 					},
 					Checks: structs.HealthChecks{
@@ -2854,20 +2876,21 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 					},
 				},
 			},
+			inputServiceName: structs.NewServiceName("api", &remoteMeta),
 			input: &pbpeerstream.ExportedService{
 				Nodes: []*pbservice.CheckServiceNode{
 					{
 						Node: &pbservice.Node{
 							ID:        "af913374-68ea-41e5-82e8-6ffd3dffc461",
 							Node:      "node-foo",
-							Partition: remoteMeta.Partition,
+							Partition: pbRemoteMeta.Partition,
 							PeerName:  peerName,
 						},
 						// New service ID and checks for the api service.
 						Service: &pbservice.NodeService{
 							ID:             "new-api-v2",
 							Service:        "api",
-							EnterpriseMeta: remoteMeta,
+							EnterpriseMeta: pbRemoteMeta,
 							PeerName:       peerName,
 						},
 						Checks: []*pbservice.HealthCheck{
@@ -2886,19 +2909,19 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 					},
 				},
 			},
-			expect: map[string]structs.CheckServiceNodes{
-				"api": {
+			expect: map[structs.ServiceName]structs.CheckServiceNodes{
+				structs.NewServiceName("api", &localEntMeta): {
 					{
 						Node: &structs.Node{
 							ID:        "af913374-68ea-41e5-82e8-6ffd3dffc461",
 							Node:      "node-foo",
-							Partition: defaultMeta.PartitionOrEmpty(),
+							Partition: localEntMeta.PartitionOrEmpty(),
 							PeerName:  peerName,
 						},
 						Service: &structs.NodeService{
 							ID:             "new-api-v2",
 							Service:        "api",
-							EnterpriseMeta: defaultMeta,
+							EnterpriseMeta: localEntMeta,
 							PeerName:       peerName,
 						},
 						Checks: []*structs.HealthCheck{
@@ -2911,24 +2934,24 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 								CheckID:        "new-api-v2-check",
 								ServiceID:      "new-api-v2",
 								Node:           "node-foo",
-								EnterpriseMeta: defaultMeta,
+								EnterpriseMeta: localEntMeta,
 								PeerName:       peerName,
 							},
 						},
 					},
 				},
-				"redis": {
+				structs.NewServiceName("redis", &localEntMeta): {
 					{
 						Node: &structs.Node{
 							ID:        "af913374-68ea-41e5-82e8-6ffd3dffc461",
 							Node:      "node-foo",
-							Partition: defaultMeta.PartitionOrEmpty(),
+							Partition: localEntMeta.PartitionOrEmpty(),
 							PeerName:  peerName,
 						},
 						Service: &structs.NodeService{
 							ID:             "redis-2",
 							Service:        "redis",
-							EnterpriseMeta: defaultMeta,
+							EnterpriseMeta: localEntMeta,
 							PeerName:       peerName,
 						},
 						Checks: []*structs.HealthCheck{
@@ -2941,7 +2964,7 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 								CheckID:        "redis-2-check",
 								ServiceID:      "redis-2",
 								Node:           "node-foo",
-								EnterpriseMeta: defaultMeta,
+								EnterpriseMeta: localEntMeta,
 								PeerName:       peerName,
 							},
 						},
@@ -2950,12 +2973,13 @@ func Test_processResponse_ExportedServiceUpdates(t *testing.T) {
 			},
 		},
 	}
-
-	for _, tc := range tt {
-		t.Run(tc.name, func(t *testing.T) {
-			run(t, tc)
-		})
-	}
+	srv, store := newTestServer(t, func(c *Config) {
+		backend := c.Backend.(*testStreamBackend)
+		backend.leader = func() bool {
+			return false
+		}
+	})
+	processResponse_ExportedServiceUpdates(t, srv, store, localEntMeta, peerName, tests)
 }
 
 // TestLogTraceProto tests that all PB trace log helpers redact the
diff --git a/agent/grpc-external/services/peerstream/stream_tracker.go b/agent/grpc-external/services/peerstream/stream_tracker.go
index a93457b92546..abb5a003a399 100644
--- a/agent/grpc-external/services/peerstream/stream_tracker.go
+++ b/agent/grpc-external/services/peerstream/stream_tracker.go
@@ -372,9 +372,8 @@ func (s *MutableStatus) SetImportedServices(serviceNames []structs.ServiceName)
 	defer s.mu.Unlock()
 
 	s.ImportedServices = make([]string, len(serviceNames))
-
 	for i, sn := range serviceNames {
-		s.ImportedServices[i] = sn.Name
+		s.ImportedServices[i] = sn.String()
 	}
 }
 
@@ -392,7 +391,7 @@ func (s *MutableStatus) SetExportedServices(serviceNames []structs.ServiceName)
 	s.ExportedServices = make([]string, len(serviceNames))
 
 	for i, sn := range serviceNames {
-		s.ExportedServices[i] = sn.Name
+		s.ExportedServices[i] = sn.String()
 	}
 }
 

From 34915670f2de96767dade33c062ec4b5902fd436 Mon Sep 17 00:00:00 2001
From: Matt Keeler <mkeeler@users.noreply.github.com>
Date: Mon, 8 May 2023 15:36:35 -0400
Subject: [PATCH 52/92] Register new catalog & mesh protobuf types with the
 resource registry (#17225)

---
 agent/consul/server.go                        | 15 +++++--
 internal/catalog/exports.go                   | 45 +++++++++++++++++++
 internal/catalog/internal/types/dns_policy.go | 32 +++++++++++++
 .../catalog/internal/types/health_checks.go   | 32 +++++++++++++
 .../catalog/internal/types/health_status.go   | 32 +++++++++++++
 internal/catalog/internal/types/node.go       | 32 +++++++++++++
 internal/catalog/internal/types/service.go    | 32 +++++++++++++
 .../internal/types/service_endpoints.go       | 32 +++++++++++++
 internal/catalog/internal/types/types.go      | 25 +++++++++++
 internal/catalog/internal/types/types_test.go | 45 +++++++++++++++++++
 .../catalog/internal/types/virtual_ips.go     | 32 +++++++++++++
 internal/catalog/internal/types/workload.go   | 32 +++++++++++++
 internal/mesh/exports.go                      | 33 ++++++++++++++
 .../internal/types/proxy_configuration.go     | 32 +++++++++++++
 internal/mesh/internal/types/types.go         | 19 ++++++++
 internal/mesh/internal/types/types_test.go    | 39 ++++++++++++++++
 internal/mesh/internal/types/upstreams.go     | 32 +++++++++++++
 17 files changed, 538 insertions(+), 3 deletions(-)
 create mode 100644 internal/catalog/exports.go
 create mode 100644 internal/catalog/internal/types/dns_policy.go
 create mode 100644 internal/catalog/internal/types/health_checks.go
 create mode 100644 internal/catalog/internal/types/health_status.go
 create mode 100644 internal/catalog/internal/types/node.go
 create mode 100644 internal/catalog/internal/types/service.go
 create mode 100644 internal/catalog/internal/types/service_endpoints.go
 create mode 100644 internal/catalog/internal/types/types.go
 create mode 100644 internal/catalog/internal/types/types_test.go
 create mode 100644 internal/catalog/internal/types/virtual_ips.go
 create mode 100644 internal/catalog/internal/types/workload.go
 create mode 100644 internal/mesh/exports.go
 create mode 100644 internal/mesh/internal/types/proxy_configuration.go
 create mode 100644 internal/mesh/internal/types/types.go
 create mode 100644 internal/mesh/internal/types/types_test.go
 create mode 100644 internal/mesh/internal/types/upstreams.go

diff --git a/agent/consul/server.go b/agent/consul/server.go
index 1f3476c92a3e..3ec392daae69 100644
--- a/agent/consul/server.go
+++ b/agent/consul/server.go
@@ -68,7 +68,9 @@ import (
 	"github.com/hashicorp/consul/agent/rpc/peering"
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/agent/token"
+	"github.com/hashicorp/consul/internal/catalog"
 	"github.com/hashicorp/consul/internal/controller"
+	"github.com/hashicorp/consul/internal/mesh"
 	"github.com/hashicorp/consul/internal/resource"
 	"github.com/hashicorp/consul/internal/resource/demo"
 	raftstorage "github.com/hashicorp/consul/internal/storage/raft"
@@ -830,13 +832,20 @@ func NewServer(config *Config, flat Deps, externalGRPCServer *grpc.Server, incom
 		return nil, err
 	}
 
+	s.registerResources()
+	go s.controllerManager.Run(&lib.StopChannelContext{StopCh: shutdownCh})
+
+	return s, nil
+}
+
+func (s *Server) registerResources() {
+	catalog.RegisterTypes(s.typeRegistry)
+	mesh.RegisterTypes(s.typeRegistry)
+
 	if s.config.DevMode {
 		demo.RegisterTypes(s.typeRegistry)
 		demo.RegisterControllers(s.controllerManager)
 	}
-	go s.controllerManager.Run(&lib.StopChannelContext{StopCh: shutdownCh})
-
-	return s, nil
 }
 
 func newGRPCHandlerFromConfig(deps Deps, config *Config, s *Server) connHandler {
diff --git a/internal/catalog/exports.go b/internal/catalog/exports.go
new file mode 100644
index 000000000000..4f3ddb6a9d8d
--- /dev/null
+++ b/internal/catalog/exports.go
@@ -0,0 +1,45 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package catalog
+
+import (
+	"github.com/hashicorp/consul/internal/catalog/internal/types"
+	"github.com/hashicorp/consul/internal/resource"
+)
+
+var (
+	// API Group Information
+
+	APIGroup        = types.GroupName
+	VersionV1Alpha1 = types.VersionV1Alpha1
+	CurrentVersion  = types.CurrentVersion
+
+	// Resource Kind Names.
+
+	WorkloadKind         = types.WorkloadKind
+	ServiceKind          = types.ServiceKind
+	ServiceEndpointsKind = types.ServiceEndpointsKind
+	VirtualIPsKind       = types.VirtualIPsKind
+	NodeKind             = types.NodeKind
+	HealthStatusKind     = types.HealthStatusKind
+	HealthChecksKind     = types.HealthChecksKind
+	DNSPolicyKind        = types.DNSPolicyKind
+
+	// Resource Types for the v1alpha1 version.
+
+	WorkloadV1Alpha1Type         = types.WorkloadV1Alpha1Type
+	ServiceV1Alpha1Type          = types.ServiceV1Alpha1Type
+	ServiceEndpointsV1Alpha1Type = types.ServiceEndpointsV1Alpha1Type
+	VirtualIPsV1Alpha1Type       = types.VirtualIPsV1Alpha1Type
+	NodeV1Alpha1Type             = types.NodeV1Alpha1Type
+	HealthStatusV1Alpha1Type     = types.HealthStatusV1Alpha1Type
+	HealthChecksV1Alpha1Type     = types.HealthChecksV1Alpha1Type
+	DNSPolicyV1Alpha1Type        = types.DNSPolicyV1Alpha1Type
+)
+
+// RegisterTypes adds all resource types within the "catalog" API group
+// to the given type registry
+func RegisterTypes(r resource.Registry) {
+	types.Register(r)
+}
diff --git a/internal/catalog/internal/types/dns_policy.go b/internal/catalog/internal/types/dns_policy.go
new file mode 100644
index 000000000000..d1d03759010a
--- /dev/null
+++ b/internal/catalog/internal/types/dns_policy.go
@@ -0,0 +1,32 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"github.com/hashicorp/consul/internal/resource"
+	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+)
+
+const (
+	DNSPolicyKind = "DNSPolicy"
+)
+
+var (
+	DNSPolicyV1Alpha1Type = &pbresource.Type{
+		Group:        GroupName,
+		GroupVersion: VersionV1Alpha1,
+		Kind:         DNSPolicyKind,
+	}
+
+	DNSPolicyType = DNSPolicyV1Alpha1Type
+)
+
+func RegisterDNSPolicy(r resource.Registry) {
+	r.Register(resource.Registration{
+		Type:     DNSPolicyV1Alpha1Type,
+		Proto:    &pbcatalog.DNSPolicy{},
+		Validate: nil,
+	})
+}
diff --git a/internal/catalog/internal/types/health_checks.go b/internal/catalog/internal/types/health_checks.go
new file mode 100644
index 000000000000..e11708898154
--- /dev/null
+++ b/internal/catalog/internal/types/health_checks.go
@@ -0,0 +1,32 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"github.com/hashicorp/consul/internal/resource"
+	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+)
+
+const (
+	HealthChecksKind = "HealthChecks"
+)
+
+var (
+	HealthChecksV1Alpha1Type = &pbresource.Type{
+		Group:        GroupName,
+		GroupVersion: VersionV1Alpha1,
+		Kind:         HealthChecksKind,
+	}
+
+	HealthChecksType = HealthChecksV1Alpha1Type
+)
+
+func RegisterHealthChecks(r resource.Registry) {
+	r.Register(resource.Registration{
+		Type:     HealthChecksV1Alpha1Type,
+		Proto:    &pbcatalog.HealthChecks{},
+		Validate: nil,
+	})
+}
diff --git a/internal/catalog/internal/types/health_status.go b/internal/catalog/internal/types/health_status.go
new file mode 100644
index 000000000000..b85c8036d8b8
--- /dev/null
+++ b/internal/catalog/internal/types/health_status.go
@@ -0,0 +1,32 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"github.com/hashicorp/consul/internal/resource"
+	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+)
+
+const (
+	HealthStatusKind = "HealthStatus"
+)
+
+var (
+	HealthStatusV1Alpha1Type = &pbresource.Type{
+		Group:        GroupName,
+		GroupVersion: VersionV1Alpha1,
+		Kind:         HealthStatusKind,
+	}
+
+	HealthStatusType = HealthStatusV1Alpha1Type
+)
+
+func RegisterHealthStatus(r resource.Registry) {
+	r.Register(resource.Registration{
+		Type:     HealthStatusV1Alpha1Type,
+		Proto:    &pbcatalog.HealthStatus{},
+		Validate: nil,
+	})
+}
diff --git a/internal/catalog/internal/types/node.go b/internal/catalog/internal/types/node.go
new file mode 100644
index 000000000000..09d8cca1ae17
--- /dev/null
+++ b/internal/catalog/internal/types/node.go
@@ -0,0 +1,32 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"github.com/hashicorp/consul/internal/resource"
+	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+)
+
+const (
+	NodeKind = "Node"
+)
+
+var (
+	NodeV1Alpha1Type = &pbresource.Type{
+		Group:        GroupName,
+		GroupVersion: VersionV1Alpha1,
+		Kind:         NodeKind,
+	}
+
+	NodeType = NodeV1Alpha1Type
+)
+
+func RegisterNode(r resource.Registry) {
+	r.Register(resource.Registration{
+		Type:     NodeV1Alpha1Type,
+		Proto:    &pbcatalog.Node{},
+		Validate: nil,
+	})
+}
diff --git a/internal/catalog/internal/types/service.go b/internal/catalog/internal/types/service.go
new file mode 100644
index 000000000000..78486128d2a1
--- /dev/null
+++ b/internal/catalog/internal/types/service.go
@@ -0,0 +1,32 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"github.com/hashicorp/consul/internal/resource"
+	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+)
+
+const (
+	ServiceKind = "Service"
+)
+
+var (
+	ServiceV1Alpha1Type = &pbresource.Type{
+		Group:        GroupName,
+		GroupVersion: VersionV1Alpha1,
+		Kind:         ServiceKind,
+	}
+
+	ServiceType = ServiceV1Alpha1Type
+)
+
+func RegisterService(r resource.Registry) {
+	r.Register(resource.Registration{
+		Type:     ServiceV1Alpha1Type,
+		Proto:    &pbcatalog.Service{},
+		Validate: nil,
+	})
+}
diff --git a/internal/catalog/internal/types/service_endpoints.go b/internal/catalog/internal/types/service_endpoints.go
new file mode 100644
index 000000000000..bef9ca27eeea
--- /dev/null
+++ b/internal/catalog/internal/types/service_endpoints.go
@@ -0,0 +1,32 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"github.com/hashicorp/consul/internal/resource"
+	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+)
+
+const (
+	ServiceEndpointsKind = "ServiceEndpoints"
+)
+
+var (
+	ServiceEndpointsV1Alpha1Type = &pbresource.Type{
+		Group:        GroupName,
+		GroupVersion: VersionV1Alpha1,
+		Kind:         ServiceEndpointsKind,
+	}
+
+	ServiceEndpointsType = ServiceEndpointsV1Alpha1Type
+)
+
+func RegisterServiceEndpoints(r resource.Registry) {
+	r.Register(resource.Registration{
+		Type:     ServiceEndpointsV1Alpha1Type,
+		Proto:    &pbcatalog.ServiceEndpoints{},
+		Validate: nil,
+	})
+}
diff --git a/internal/catalog/internal/types/types.go b/internal/catalog/internal/types/types.go
new file mode 100644
index 000000000000..6ab3730bb293
--- /dev/null
+++ b/internal/catalog/internal/types/types.go
@@ -0,0 +1,25 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"github.com/hashicorp/consul/internal/resource"
+)
+
+const (
+	GroupName       = "catalog"
+	VersionV1Alpha1 = "v1alpha1"
+	CurrentVersion  = VersionV1Alpha1
+)
+
+func Register(r resource.Registry) {
+	RegisterWorkload(r)
+	RegisterService(r)
+	RegisterServiceEndpoints(r)
+	RegisterNode(r)
+	RegisterHealthStatus(r)
+	RegisterHealthChecks(r)
+	RegisterDNSPolicy(r)
+	RegisterVirtualIPs(r)
+}
diff --git a/internal/catalog/internal/types/types_test.go b/internal/catalog/internal/types/types_test.go
new file mode 100644
index 000000000000..d40fc42dd07c
--- /dev/null
+++ b/internal/catalog/internal/types/types_test.go
@@ -0,0 +1,45 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"testing"
+
+	"github.com/hashicorp/consul/internal/resource"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/stretchr/testify/require"
+)
+
+func TestTypeRegistration(t *testing.T) {
+	// This test will ensure that all the required types have been registered
+	// It is not trying to determine whether the settings for the registrations
+	// are correct as that would amount more or less to hardcoding structs
+	// from types.go a second time here.
+	requiredKinds := []string{
+		WorkloadKind,
+		ServiceKind,
+		ServiceEndpointsKind,
+		VirtualIPsKind,
+		NodeKind,
+		HealthStatusKind,
+		HealthChecksKind,
+		DNSPolicyKind,
+	}
+
+	r := resource.NewRegistry()
+	Register(r)
+
+	for _, kind := range requiredKinds {
+		t.Run(kind, func(t *testing.T) {
+			registration, ok := r.Resolve(&pbresource.Type{
+				Group:        GroupName,
+				GroupVersion: CurrentVersion,
+				Kind:         kind,
+			})
+
+			require.True(t, ok, "Resource kind %s has not been registered to the type registry", kind)
+			require.NotNil(t, registration, "Registration for %s was found but is nil", kind)
+		})
+	}
+}
diff --git a/internal/catalog/internal/types/virtual_ips.go b/internal/catalog/internal/types/virtual_ips.go
new file mode 100644
index 000000000000..4a114fc800b3
--- /dev/null
+++ b/internal/catalog/internal/types/virtual_ips.go
@@ -0,0 +1,32 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"github.com/hashicorp/consul/internal/resource"
+	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+)
+
+const (
+	VirtualIPsKind = "VirtualIPs"
+)
+
+var (
+	VirtualIPsV1Alpha1Type = &pbresource.Type{
+		Group:        GroupName,
+		GroupVersion: VersionV1Alpha1,
+		Kind:         VirtualIPsKind,
+	}
+
+	VirtualIPsType = VirtualIPsV1Alpha1Type
+)
+
+func RegisterVirtualIPs(r resource.Registry) {
+	r.Register(resource.Registration{
+		Type:     VirtualIPsV1Alpha1Type,
+		Proto:    &pbcatalog.VirtualIPs{},
+		Validate: nil,
+	})
+}
diff --git a/internal/catalog/internal/types/workload.go b/internal/catalog/internal/types/workload.go
new file mode 100644
index 000000000000..0fa742a53294
--- /dev/null
+++ b/internal/catalog/internal/types/workload.go
@@ -0,0 +1,32 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"github.com/hashicorp/consul/internal/resource"
+	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+)
+
+const (
+	WorkloadKind = "Workload"
+)
+
+var (
+	WorkloadV1Alpha1Type = &pbresource.Type{
+		Group:        GroupName,
+		GroupVersion: VersionV1Alpha1,
+		Kind:         WorkloadKind,
+	}
+
+	WorkloadType = WorkloadV1Alpha1Type
+)
+
+func RegisterWorkload(r resource.Registry) {
+	r.Register(resource.Registration{
+		Type:     WorkloadV1Alpha1Type,
+		Proto:    &pbcatalog.Workload{},
+		Validate: nil,
+	})
+}
diff --git a/internal/mesh/exports.go b/internal/mesh/exports.go
new file mode 100644
index 000000000000..753c10a7ba93
--- /dev/null
+++ b/internal/mesh/exports.go
@@ -0,0 +1,33 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package mesh
+
+import (
+	"github.com/hashicorp/consul/internal/mesh/internal/types"
+	"github.com/hashicorp/consul/internal/resource"
+)
+
+var (
+	// API Group Information
+
+	APIGroup        = types.GroupName
+	VersionV1Alpha1 = types.VersionV1Alpha1
+	CurrentVersion  = types.CurrentVersion
+
+	// Resource Kind Names.
+
+	ProxyConfigurationKind = types.ProxyConfigurationKind
+	UpstreamsKind          = types.UpstreamsKind
+
+	// Resource Types for the v1alpha1 version.
+
+	ProxyConfigurationV1Alpha1Type = types.ProxyConfigurationV1Alpha1Type
+	UpstreamsV1Alpha1Type          = types.UpstreamsV1Alpha1Type
+)
+
+// RegisterTypes adds all resource types within the "catalog" API group
+// to the given type registry
+func RegisterTypes(r resource.Registry) {
+	types.Register(r)
+}
diff --git a/internal/mesh/internal/types/proxy_configuration.go b/internal/mesh/internal/types/proxy_configuration.go
new file mode 100644
index 000000000000..9205dc81b132
--- /dev/null
+++ b/internal/mesh/internal/types/proxy_configuration.go
@@ -0,0 +1,32 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"github.com/hashicorp/consul/internal/resource"
+	pbmesh "github.com/hashicorp/consul/proto-public/pbmesh/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+)
+
+const (
+	ProxyConfigurationKind = "ProxyConfiguration"
+)
+
+var (
+	ProxyConfigurationV1Alpha1Type = &pbresource.Type{
+		Group:        GroupName,
+		GroupVersion: CurrentVersion,
+		Kind:         ProxyConfigurationKind,
+	}
+
+	ProxyConfigurationType = ProxyConfigurationV1Alpha1Type
+)
+
+func RegisterProxyConfiguration(r resource.Registry) {
+	r.Register(resource.Registration{
+		Type:     ProxyConfigurationV1Alpha1Type,
+		Proto:    &pbmesh.ProxyConfiguration{},
+		Validate: nil,
+	})
+}
diff --git a/internal/mesh/internal/types/types.go b/internal/mesh/internal/types/types.go
new file mode 100644
index 000000000000..3eeb69bd101c
--- /dev/null
+++ b/internal/mesh/internal/types/types.go
@@ -0,0 +1,19 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"github.com/hashicorp/consul/internal/resource"
+)
+
+const (
+	GroupName       = "mesh"
+	VersionV1Alpha1 = "v1alpha1"
+	CurrentVersion  = VersionV1Alpha1
+)
+
+func Register(r resource.Registry) {
+	RegisterProxyConfiguration(r)
+	RegisterUpstreams(r)
+}
diff --git a/internal/mesh/internal/types/types_test.go b/internal/mesh/internal/types/types_test.go
new file mode 100644
index 000000000000..4324e8707830
--- /dev/null
+++ b/internal/mesh/internal/types/types_test.go
@@ -0,0 +1,39 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"testing"
+
+	"github.com/hashicorp/consul/internal/resource"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/stretchr/testify/require"
+)
+
+func TestTypeRegistration(t *testing.T) {
+	// This test will ensure that all the required types have been registered
+	// It is not trying to determine whether the settings for the registrations
+	// are correct as that would amount more or less to hardcoding structs
+	// from types.go a second time here.
+	requiredKinds := []string{
+		ProxyConfigurationKind,
+		UpstreamsKind,
+	}
+
+	r := resource.NewRegistry()
+	Register(r)
+
+	for _, kind := range requiredKinds {
+		t.Run(kind, func(t *testing.T) {
+			registration, ok := r.Resolve(&pbresource.Type{
+				Group:        GroupName,
+				GroupVersion: CurrentVersion,
+				Kind:         kind,
+			})
+
+			require.True(t, ok, "Resource kind %s has not been registered to the type registry", kind)
+			require.NotNil(t, registration, "Registration for %s was found but is nil", kind)
+		})
+	}
+}
diff --git a/internal/mesh/internal/types/upstreams.go b/internal/mesh/internal/types/upstreams.go
new file mode 100644
index 000000000000..54fd14b098d5
--- /dev/null
+++ b/internal/mesh/internal/types/upstreams.go
@@ -0,0 +1,32 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"github.com/hashicorp/consul/internal/resource"
+	pbmesh "github.com/hashicorp/consul/proto-public/pbmesh/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+)
+
+const (
+	UpstreamsKind = "Upstreams"
+)
+
+var (
+	UpstreamsV1Alpha1Type = &pbresource.Type{
+		Group:        GroupName,
+		GroupVersion: CurrentVersion,
+		Kind:         UpstreamsKind,
+	}
+
+	UpstreamsType = UpstreamsV1Alpha1Type
+)
+
+func RegisterUpstreams(r resource.Registry) {
+	r.Register(resource.Registration{
+		Type:     UpstreamsV1Alpha1Type,
+		Proto:    &pbmesh.Upstreams{},
+		Validate: nil,
+	})
+}

From 861a8151d50377315c6c391833fef85b71b54d18 Mon Sep 17 00:00:00 2001
From: John Murret <john.murret@hashicorp.com>
Date: Mon, 8 May 2023 14:26:16 -0600
Subject: [PATCH 53/92] ci: remove test splitting for compatibility tests
 (#17166)

* remove test splitting from compatibility-integration-tests

* enable on push

* remove ipv6 loopback fix

* re-add ipv6 loopback fix

* remove test splitting from upgrade-integration-tests

* remove test splitting from upgrade-integration-tests

* put test splitting back in for upgrade tests

* upgrade-integration tests-o
ne runner no retries
---
 .github/workflows/test-integrations.yml | 45 ++-----------------------
 1 file changed, 2 insertions(+), 43 deletions(-)

diff --git a/.github/workflows/test-integrations.yml b/.github/workflows/test-integrations.yml
index 33d1ccc9e207..3615e1554805 100644
--- a/.github/workflows/test-integrations.yml
+++ b/.github/workflows/test-integrations.yml
@@ -237,47 +237,11 @@ jobs:
           name: ${{ env.TEST_RESULTS_ARTIFACT_NAME }}
           path: ${{ env.TEST_RESULTS_DIR }}
 
-  generate-compatibility-job-matrices:
-    needs: [setup]
-    runs-on: ${{ fromJSON(needs.setup.outputs.compute-small) }}
-    name: Generate Compatibility Job Matrices
-    outputs:
-      compatibility-matrix: ${{ steps.set-matrix.outputs.compatibility-matrix }}
-    steps:
-      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
-      - name: Generate Compatibility Job Matrix
-        id: set-matrix
-        env:
-          TOTAL_RUNNERS: 6
-          JQ_SLICER: '[ inputs ] | [_nwise(length / $runnercount | floor)]'
-        run: |
-          cd ./test/integration/consul-container
-          NUM_RUNNERS=$TOTAL_RUNNERS
-          NUM_DIRS=$(find ./test -mindepth 1 -maxdepth 2 -type d | wc -l)
-
-          if [ "$NUM_DIRS" -lt "$NUM_RUNNERS" ]; then
-            echo "TOTAL_RUNNERS is larger than the number of tests/packages to split."
-            NUM_RUNNERS=$((NUM_DIRS-1))
-          fi
-          # fix issue where test splitting calculation generates 1 more split than TOTAL_RUNNERS.
-          NUM_RUNNERS=$((NUM_RUNNERS-1))
-          {
-            echo -n "compatibility-matrix="
-            find ./test -maxdepth 2 -type d -print0 | xargs -0 -n 1 \
-              | grep -v util | grep -v upgrade \
-              | jq --raw-input --argjson runnercount "$NUM_RUNNERS" "$JQ_SLICER" \
-              | jq --compact-output 'map(join(" "))'
-          } >> "$GITHUB_OUTPUT"
   compatibility-integration-test:
     runs-on: ${{ fromJSON(needs.setup.outputs.compute-xl) }}
     needs:
       - setup
       - dev-build
-      - generate-compatibility-job-matrices
-    strategy:
-      fail-fast: false
-      matrix:
-        test-cases: ${{ fromJSON(needs.generate-compatibility-job-matrices.outputs.compatibility-matrix) }}
     steps:
       - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
       - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
@@ -307,12 +271,9 @@ jobs:
             mkdir -p "/tmp/test-results"
             cd ./test/integration/consul-container
             docker run --rm ${{ env.CONSUL_LATEST_IMAGE_NAME }}:local consul version
-            echo "Running $(sed 's,|, ,g' <<< "${{ matrix.test-cases }}" |wc -w) subtests"
-            # shellcheck disable=SC2001
-            sed 's, ,\n,g' <<< "${{ matrix.test-cases }}"
             go run gotest.tools/gotestsum@v${{env.GOTESTSUM_VERSION}} \
               --raw-command \
-              --format=short-verbose \
+              --format=standard-verbose \
               --debug \
               --rerun-fails=3 \
               -- \
@@ -321,7 +282,7 @@ jobs:
               -tags "${{ env.GOTAGS }}" \
               -timeout=30m \
               -json \
-              ${{ matrix.test-cases }} \
+              `go list ./... | grep -v upgrade` \
               --target-image ${{ env.CONSUL_LATEST_IMAGE_NAME }} \
               --target-version local \
               --latest-image docker.mirror.hashicorp.services/${{ env.CONSUL_LATEST_IMAGE_NAME }} \
@@ -422,7 +383,6 @@ jobs:
             --raw-command \
             --format=short-verbose \
             --debug \
-            --rerun-fails=3 \
             --packages="./..." \
             -- \
             go test \
@@ -456,7 +416,6 @@ jobs:
     - vault-integration-test
     - generate-envoy-job-matrices
     - envoy-integration-test
-    - generate-compatibility-job-matrices
     - compatibility-integration-test
     - generate-upgrade-job-matrices
     - upgrade-integration-test

From 5e4b736b7020ee2ccb2b6582b4d4e1514f70da25 Mon Sep 17 00:00:00 2001
From: Dan Stough <dan.stough@hashicorp.com>
Date: Mon, 8 May 2023 16:30:45 -0400
Subject: [PATCH 54/92] chore(ci): fix backport assistant branch creation race
 (#17249)

---
 .github/workflows/backport-assistant.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/backport-assistant.yml b/.github/workflows/backport-assistant.yml
index d4e2b2d4c762..547ab28b7287 100644
--- a/.github/workflows/backport-assistant.yml
+++ b/.github/workflows/backport-assistant.yml
@@ -19,7 +19,7 @@ jobs:
   backport:
     if: github.event.pull_request.merged
     runs-on: ubuntu-latest
-    container: hashicorpdev/backport-assistant:0.3.0
+    container: hashicorpdev/backport-assistant:0.3.3
     steps:
       - name: Run Backport Assistant for release branches
         run: |

From 6e1bc57469ab8cbbd009d6cd56fbe41ce3937a70 Mon Sep 17 00:00:00 2001
From: Dan Upton <daniel@floppy.co>
Date: Tue, 9 May 2023 15:25:55 +0100
Subject: [PATCH 55/92] Controller Runtime

---
 agent/consul/server.go                    |  19 +-
 internal/controller/api.go                | 188 +++++++++++++++
 internal/controller/api_test.go           | 268 ++++++++++++++++++++++
 internal/controller/controller.go         | 167 +++++++++++++-
 internal/controller/doc.go                |  10 +
 internal/controller/lease.go              |   5 +
 internal/controller/manager.go            |  30 ++-
 internal/resource/demo/controller.go      | 176 +++++++++++++-
 internal/resource/demo/controller_test.go | 102 ++++++++
 internal/resource/demo/demo.go            |   4 +
 10 files changed, 952 insertions(+), 17 deletions(-)
 create mode 100644 internal/controller/api_test.go
 create mode 100644 internal/controller/doc.go
 create mode 100644 internal/resource/demo/controller_test.go

diff --git a/agent/consul/server.go b/agent/consul/server.go
index 3ec392daae69..73df01e858e3 100644
--- a/agent/consul/server.go
+++ b/agent/consul/server.go
@@ -507,7 +507,6 @@ func NewServer(config *Config, flat Deps, externalGRPCServer *grpc.Server, incom
 		incomingRPCLimiter:      incomingRPCLimiter,
 		routineManager:          routine.NewManager(logger.Named(logging.ConsulServer)),
 		typeRegistry:            resource.NewRegistry(),
-		controllerManager:       controller.NewManager(logger.Named(logging.ControllerRuntime)),
 	}
 	incomingRPCLimiter.Register(s)
 
@@ -783,6 +782,17 @@ func NewServer(config *Config, flat Deps, externalGRPCServer *grpc.Server, incom
 	// to enable RPC forwarding.
 	s.grpcHandler = newGRPCHandlerFromConfig(flat, config, s)
 	s.grpcLeaderForwarder = flat.LeaderForwarder
+
+	if err := s.setupInternalResourceService(logger); err != nil {
+		return nil, err
+	}
+	s.controllerManager = controller.NewManager(
+		s.internalResourceServiceClient,
+		logger.Named(logging.ControllerRuntime),
+	)
+	s.registerResources()
+	go s.controllerManager.Run(&lib.StopChannelContext{StopCh: shutdownCh})
+
 	go s.trackLeaderChanges()
 
 	s.xdsCapacityController = xdscapacity.NewController(xdscapacity.Config{
@@ -792,10 +802,6 @@ func NewServer(config *Config, flat Deps, externalGRPCServer *grpc.Server, incom
 	})
 	go s.xdsCapacityController.Run(&lib.StopChannelContext{StopCh: s.shutdownCh})
 
-	if err := s.setupInternalResourceService(logger); err != nil {
-		return nil, err
-	}
-
 	// Initialize Autopilot. This must happen before starting leadership monitoring
 	// as establishing leadership could attempt to use autopilot and cause a panic.
 	s.initAutopilot(config)
@@ -832,9 +838,6 @@ func NewServer(config *Config, flat Deps, externalGRPCServer *grpc.Server, incom
 		return nil, err
 	}
 
-	s.registerResources()
-	go s.controllerManager.Run(&lib.StopChannelContext{StopCh: shutdownCh})
-
 	return s, nil
 }
 
diff --git a/internal/controller/api.go b/internal/controller/api.go
index 8545d339a7d6..d258eb40d6d8 100644
--- a/internal/controller/api.go
+++ b/internal/controller/api.go
@@ -1,6 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package controller
 
 import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/hashicorp/go-hclog"
+
+	"github.com/hashicorp/consul/internal/resource"
 	"github.com/hashicorp/consul/proto-public/pbresource"
 )
 
@@ -9,6 +20,86 @@ func ForType(managedType *pbresource.Type) Controller {
 	return Controller{managedType: managedType}
 }
 
+// WithReconciler changes the controller's reconciler.
+func (c Controller) WithReconciler(reconciler Reconciler) Controller {
+	if reconciler == nil {
+		panic("reconciler must not be nil")
+	}
+
+	c.reconciler = reconciler
+	return c
+}
+
+// WithWatch adds a watch on the given type/dependency to the controller. mapper
+// will be called to determine which resources must be reconciled as a result of
+// a watched resource changing.
+func (c Controller) WithWatch(watchedType *pbresource.Type, mapper DependencyMapper) Controller {
+	if watchedType == nil {
+		panic("watchedType must not be nil")
+	}
+
+	if mapper == nil {
+		panic("mapper must not be nil")
+	}
+
+	c.watches = append(c.watches, watch{watchedType, mapper})
+	return c
+}
+
+// WithLogger changes the controller's logger.
+func (c Controller) WithLogger(logger hclog.Logger) Controller {
+	if logger == nil {
+		panic("logger must not be nil")
+	}
+
+	c.logger = logger
+	return c
+}
+
+// WithBackoff changes the base and maximum backoff values for the controller's
+// retry rate limiter.
+func (c Controller) WithBackoff(base, max time.Duration) Controller {
+	c.baseBackoff = base
+	c.maxBackoff = max
+	return c
+}
+
+// WithPlacement changes where and how many replicas of the controller will run.
+// In the majority of cases, the default placement (one leader elected instance
+// per cluster) is the most appropriate and you shouldn't need to override it.
+func (c Controller) WithPlacement(placement Placement) Controller {
+	c.placement = placement
+	return c
+}
+
+// String returns a textual description of the controller, useful for debugging.
+func (c Controller) String() string {
+	watchedTypes := make([]string, len(c.watches))
+	for idx, w := range c.watches {
+		watchedTypes[idx] = fmt.Sprintf("%q", resource.ToGVK(w.watchedType))
+	}
+	base, max := c.backoff()
+	return fmt.Sprintf(
+		"<Controller managed_type=%q, watched_types=[%s], backoff=<base=%q, max=%q>, placement=%q>",
+		resource.ToGVK(c.managedType),
+		strings.Join(watchedTypes, ", "),
+		base, max,
+		c.placement,
+	)
+}
+
+func (c Controller) backoff() (time.Duration, time.Duration) {
+	base := c.baseBackoff
+	if base == 0 {
+		base = 5 * time.Millisecond
+	}
+	max := c.maxBackoff
+	if max == 0 {
+		max = 1000 * time.Second
+	}
+	return base, max
+}
+
 // Controller runs a reconciliation loop to respond to changes in resources and
 // their dependencies. It is heavily inspired by Kubernetes' controller pattern:
 // https://kubernetes.io/docs/concepts/architecture/controller/
@@ -17,4 +108,101 @@ func ForType(managedType *pbresource.Type) Controller {
 // a controller, and then pass it to a Manager to be executed.
 type Controller struct {
 	managedType *pbresource.Type
+	reconciler  Reconciler
+	logger      hclog.Logger
+	watches     []watch
+	baseBackoff time.Duration
+	maxBackoff  time.Duration
+	placement   Placement
+}
+
+type watch struct {
+	watchedType *pbresource.Type
+	mapper      DependencyMapper
+}
+
+// Request represents a request to reconcile the resource with the given ID.
+type Request struct {
+	// ID of the resource that needs to be reconciled.
+	ID *pbresource.ID
+}
+
+// Runtime contains the dependencies required by reconcilers.
+type Runtime struct {
+	Client pbresource.ResourceServiceClient
+	Logger hclog.Logger
+}
+
+// Reconciler implements the business logic of a controller.
+type Reconciler interface {
+	// Reconcile the resource identified by req.ID.
+	Reconcile(ctx context.Context, rt Runtime, req Request) error
+}
+
+// DependencyMapper is called when a dependency watched via WithWatch is changed
+// to determine which of the controller's managed resources need to be reconciled.
+type DependencyMapper func(
+	ctx context.Context,
+	rt Runtime,
+	res *pbresource.Resource,
+) ([]Request, error)
+
+// MapOwner implements a DependencyMapper that returns the updated resource's owner.
+func MapOwner(_ context.Context, _ Runtime, res *pbresource.Resource) ([]Request, error) {
+	var reqs []Request
+	if res.Owner != nil {
+		reqs = append(reqs, Request{ID: res.Owner})
+	}
+	return reqs, nil
+}
+
+// Placement determines where and how many replicas of the controller will run.
+type Placement int
+
+const (
+	// PlacementSingleton ensures there is a single, leader-elected, instance of
+	// the controller running in the cluster at any time. It's the default and is
+	// suitable for most use-cases.
+	PlacementSingleton Placement = iota
+
+	// PlacementEachServer ensures there is a replica of the controller running on
+	// each server in the cluster. It is useful for cases where the controller is
+	// responsible for applying some configuration resource to the server whenever
+	// it changes (e.g. rate-limit configuration). Generally, controllers in this
+	// placement mode should not modify resources.
+	PlacementEachServer
+)
+
+// String satisfies the fmt.Stringer interface.
+func (p Placement) String() string {
+	switch p {
+	case PlacementSingleton:
+		return "singleton"
+	case PlacementEachServer:
+		return "each-server"
+	}
+	panic(fmt.Sprintf("unknown placement %d", p))
+}
+
+// RequeueAfterError is an error that allows a Reconciler to override the
+// exponential backoff behavior of the Controller, rather than applying
+// the backoff algorithm, returning a RequeueAfterError will cause the
+// Controller to reschedule the Request at a given time in the future.
+type RequeueAfterError time.Duration
+
+// Error implements the error interface.
+func (r RequeueAfterError) Error() string {
+	return fmt.Sprintf("requeue at %s", time.Duration(r))
+}
+
+// RequeueAfter constructs a RequeueAfterError with the given duration
+// setting.
+func RequeueAfter(after time.Duration) error {
+	return RequeueAfterError(after)
+}
+
+// RequeueNow constructs a RequeueAfterError that reschedules the Request
+// immediately.
+func RequeueNow() error {
+	return RequeueAfterError(0)
 }
diff --git a/internal/controller/api_test.go b/internal/controller/api_test.go
new file mode 100644
index 000000000000..2006664b20fb
--- /dev/null
+++ b/internal/controller/api_test.go
@@ -0,0 +1,268 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package controller_test
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	svctest "github.com/hashicorp/consul/agent/grpc-external/services/resource/testing"
+	"github.com/hashicorp/consul/internal/controller"
+	"github.com/hashicorp/consul/internal/resource/demo"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/hashicorp/consul/proto/private/prototest"
+	"github.com/hashicorp/consul/sdk/testutil"
+)
+
+func TestController_API(t *testing.T) {
+	t.Parallel()
+
+	rec := newTestReconciler()
+	client := svctest.RunResourceService(t, demo.RegisterTypes)
+
+	ctrl := controller.
+		ForType(demo.TypeV2Artist).
+		WithWatch(demo.TypeV2Album, controller.MapOwner).
+		WithBackoff(10*time.Millisecond, 100*time.Millisecond).
+		WithReconciler(rec)
+
+	mgr := controller.NewManager(client, testutil.Logger(t))
+	mgr.Register(ctrl)
+	mgr.SetRaftLeader(true)
+	go mgr.Run(testContext(t))
+
+	t.Run("managed resource type", func(t *testing.T) {
+		res, err := demo.GenerateV2Artist()
+		require.NoError(t, err)
+
+		rsp, err := client.Write(testContext(t), &pbresource.WriteRequest{Resource: res})
+		require.NoError(t, err)
+
+		req := rec.wait(t)
+		prototest.AssertDeepEqual(t, rsp.Resource.Id, req.ID)
+	})
+
+	t.Run("watched resource type", func(t *testing.T) {
+		res, err := demo.GenerateV2Artist()
+		require.NoError(t, err)
+
+		rsp, err := client.Write(testContext(t), &pbresource.WriteRequest{Resource: res})
+		require.NoError(t, err)
+
+		req := rec.wait(t)
+		prototest.AssertDeepEqual(t, rsp.Resource.Id, req.ID)
+
+		rec.expectNoRequest(t, 500*time.Millisecond)
+
+		album, err := demo.GenerateV2Album(rsp.Resource.Id)
+		require.NoError(t, err)
+
+		_, err = client.Write(testContext(t), &pbresource.WriteRequest{Resource: album})
+		require.NoError(t, err)
+
+		req = rec.wait(t)
+		prototest.AssertDeepEqual(t, rsp.Resource.Id, req.ID)
+	})
+
+	t.Run("error retries", func(t *testing.T) {
+		rec.failNext(errors.New("KABOOM"))
+
+		res, err := demo.GenerateV2Artist()
+		require.NoError(t, err)
+
+		rsp, err := client.Write(testContext(t), &pbresource.WriteRequest{Resource: res})
+		require.NoError(t, err)
+
+		req := rec.wait(t)
+		prototest.AssertDeepEqual(t, rsp.Resource.Id, req.ID)
+
+		// Reconciler should be called with the same request again.
+		req = rec.wait(t)
+		prototest.AssertDeepEqual(t, rsp.Resource.Id, req.ID)
+	})
+
+	t.Run("panic retries", func(t *testing.T) {
+		rec.panicNext("KABOOM")
+
+		res, err := demo.GenerateV2Artist()
+		require.NoError(t, err)
+
+		rsp, err := client.Write(testContext(t), &pbresource.WriteRequest{Resource: res})
+		require.NoError(t, err)
+
+		req := rec.wait(t)
+		prototest.AssertDeepEqual(t, rsp.Resource.Id, req.ID)
+
+		// Reconciler should be called with the same request again.
+		req = rec.wait(t)
+		prototest.AssertDeepEqual(t, rsp.Resource.Id, req.ID)
+	})
+
+	t.Run("defer", func(t *testing.T) {
+		rec.failNext(controller.RequeueAfter(1 * time.Second))
+
+		res, err := demo.GenerateV2Artist()
+		require.NoError(t, err)
+
+		rsp, err := client.Write(testContext(t), &pbresource.WriteRequest{Resource: res})
+		require.NoError(t, err)
+
+		req := rec.wait(t)
+		prototest.AssertDeepEqual(t, rsp.Resource.Id, req.ID)
+
+		rec.expectNoRequest(t, 750*time.Millisecond)
+
+		req = rec.wait(t)
+		prototest.AssertDeepEqual(t, rsp.Resource.Id, req.ID)
+	})
+}
+
+func TestController_Placement(t *testing.T) {
+	t.Parallel()
+
+	t.Run("singleton", func(t *testing.T) {
+		rec := newTestReconciler()
+		client := svctest.RunResourceService(t, demo.RegisterTypes)
+
+		ctrl := controller.
+			ForType(demo.TypeV2Artist).
+			WithWatch(demo.TypeV2Album, controller.MapOwner).
+			WithPlacement(controller.PlacementSingleton).
+			WithReconciler(rec)
+
+		mgr := controller.NewManager(client, testutil.Logger(t))
+		mgr.Register(ctrl)
+		go mgr.Run(testContext(t))
+
+		res, err := demo.GenerateV2Artist()
+		require.NoError(t, err)
+
+		// Reconciler should not be called until we're the Raft leader.
+		_, err = client.Write(testContext(t), &pbresource.WriteRequest{Resource: res})
+		require.NoError(t, err)
+		rec.expectNoRequest(t, 500*time.Millisecond)
+
+		// Become the leader and check the reconciler is called.
+		mgr.SetRaftLeader(true)
+		_ = rec.wait(t)
+
+		// Should not be called after losing leadership.
+		mgr.SetRaftLeader(false)
+		_, err = client.Write(testContext(t), &pbresource.WriteRequest{Resource: res})
+		require.NoError(t, err)
+		rec.expectNoRequest(t, 500*time.Millisecond)
+	})
+
+	t.Run("each server", func(t *testing.T) {
+		rec := newTestReconciler()
+		client := svctest.RunResourceService(t, demo.RegisterTypes)
+
+		ctrl := controller.
+			ForType(demo.TypeV2Artist).
+			WithWatch(demo.TypeV2Album, controller.MapOwner).
+			WithPlacement(controller.PlacementEachServer).
+			WithReconciler(rec)
+
+		mgr := controller.NewManager(client, testutil.Logger(t))
+		mgr.Register(ctrl)
+		go mgr.Run(testContext(t))
+
+		res, err := demo.GenerateV2Artist()
+		require.NoError(t, err)
+
+		// Reconciler should be called even though we're not the Raft leader.
+		_, err = client.Write(testContext(t), &pbresource.WriteRequest{Resource: res})
+		require.NoError(t, err)
+		_ = rec.wait(t)
+	})
+}
+
+func TestController_String(t *testing.T) {
+	ctrl := controller.
+		ForType(demo.TypeV2Artist).
+		WithWatch(demo.TypeV2Album, controller.MapOwner).
+		WithBackoff(5*time.Second, 1*time.Hour).
+		WithPlacement(controller.PlacementEachServer)
+
+	require.Equal(t,
+		`<Controller managed_type="demo.v2.artist", watched_types=["demo.v2.album"], backoff=<base="5s", max="1h0m0s">, placement="each-server">`,
+		ctrl.String(),
+	)
+}
+
+func TestController_NoReconciler(t *testing.T) {
+	client := svctest.RunResourceService(t, demo.RegisterTypes)
+	mgr := controller.NewManager(client, testutil.Logger(t))
+
+	ctrl := controller.ForType(demo.TypeV2Artist)
+	require.PanicsWithValue(t,
+		`cannot register controller without a reconciler <Controller managed_type="demo.v2.artist", watched_types=[], backoff=<base="5ms", max="16m40s">, placement="singleton">`,
+		func() { mgr.Register(ctrl) })
+}
+
+func newTestReconciler() *testReconciler {
+	return &testReconciler{
+		calls:  make(chan controller.Request),
+		errors: make(chan error, 1),
+		panics: make(chan any, 1),
+	}
+}
+
+type testReconciler struct {
+	calls  chan controller.Request
+	errors chan error
+	panics chan any
+}
+
+func (r *testReconciler) Reconcile(_ context.Context, _ controller.Runtime, req controller.Request) error {
+	r.calls <- req
+
+	select {
+	case err := <-r.errors:
+		return err
+	case p := <-r.panics:
+		panic(p)
+	default:
+		return nil
+	}
+}
+
+func (r *testReconciler) failNext(err error) { r.errors <- err }
+func (r *testReconciler) panicNext(p any)    { r.panics <- p }
+
+func (r *testReconciler) expectNoRequest(t *testing.T, duration time.Duration) {
+	t.Helper()
+
+	started := time.Now()
+	select {
+	case req := <-r.calls:
+		t.Fatalf("expected no request for %s, but got: %s after %s", duration, req.ID, time.Since(started))
+	case <-time.After(duration):
+	}
+}
+
+func (r *testReconciler) wait(t *testing.T) controller.Request {
+	t.Helper()
+
+	var req controller.Request
+	select {
+	case req = <-r.calls:
+	case <-time.After(500 * time.Millisecond):
+		t.Fatal("Reconcile was not called after 500ms")
+	}
+	return req
+}
+
+func testContext(t *testing.T) context.Context {
+	t.Helper()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	return ctx
+}
diff --git a/internal/controller/controller.go b/internal/controller/controller.go
index 11933b39facc..d99ca26f0d3f 100644
--- a/internal/controller/controller.go
+++ b/internal/controller/controller.go
@@ -1,15 +1,29 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package controller
 
 import (
 	"context"
+	"errors"
+	"fmt"
+	"time"
 
 	"github.com/hashicorp/go-hclog"
+	"golang.org/x/sync/errgroup"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/hashicorp/consul/agent/consul/controller/queue"
+	"github.com/hashicorp/consul/internal/resource"
+	"github.com/hashicorp/consul/internal/storage"
+	"github.com/hashicorp/consul/proto-public/pbresource"
 )
 
 // controllerRunner contains the actual implementation of running a controller
 // including creating watches, calling the reconciler, handling retries, etc.
 type controllerRunner struct {
 	ctrl   Controller
+	client pbresource.ResourceServiceClient
 	logger hclog.Logger
 }
 
@@ -17,6 +31,155 @@ func (c *controllerRunner) run(ctx context.Context) error {
 	c.logger.Debug("controller running")
 	defer c.logger.Debug("controller stopping")
 
-	<-ctx.Done()
-	return ctx.Err()
+	group, groupCtx := errgroup.WithContext(ctx)
+	recQueue := runQueue[Request](groupCtx, c.ctrl)
+
+	// Managed Type Events → Reconciliation Queue
+	group.Go(func() error {
+		return c.watch(groupCtx, c.ctrl.managedType, func(res *pbresource.Resource) {
+			recQueue.Add(Request{ID: res.Id})
+		})
+	})
+
+	for _, watch := range c.ctrl.watches {
+		watch := watch
+		mapQueue := runQueue[*pbresource.Resource](groupCtx, c.ctrl)
+
+		// Watched Type Events → Mapper Queue
+		group.Go(func() error {
+			return c.watch(groupCtx, watch.watchedType, mapQueue.Add)
+		})
+
+		// Mapper Queue → Mapper → Reconciliation Queue
+		group.Go(func() error {
+			return c.runMapper(groupCtx, watch, mapQueue, recQueue)
+		})
+	}
+
+	// Reconciliation Queue → Reconciler
+	group.Go(func() error {
+		return c.runReconciler(groupCtx, recQueue)
+	})
+
+	return group.Wait()
+}
+
+func runQueue[T queue.ItemType](ctx context.Context, ctrl Controller) queue.WorkQueue[T] {
+	base, max := ctrl.backoff()
+	return queue.RunWorkQueue[T](ctx, base, max)
+}
+
+func (c *controllerRunner) watch(ctx context.Context, typ *pbresource.Type, add func(*pbresource.Resource)) error {
+	watch, err := c.client.WatchList(ctx, &pbresource.WatchListRequest{
+		Type: typ,
+		Tenancy: &pbresource.Tenancy{
+			Partition: storage.Wildcard,
+			PeerName:  storage.Wildcard,
+			Namespace: storage.Wildcard,
+		},
+	})
+	if err != nil {
+		c.logger.Error("failed to create watch", "error", err)
+		return err
+	}
+
+	for {
+		event, err := watch.Recv()
+		if err != nil {
+			c.logger.Warn("error received from watch", "error", err)
+			return err
+		}
+		add(event.Resource)
+	}
+}
+
+func (c *controllerRunner) runMapper(
+	ctx context.Context,
+	w watch,
+	from queue.WorkQueue[*pbresource.Resource],
+	to queue.WorkQueue[Request],
+) error {
+	logger := c.logger.With("watched_resource_type", resource.ToGVK(w.watchedType))
+
+	for {
+		res, shutdown := from.Get()
+		if shutdown {
+			return nil
+		}
+
+		var reqs []Request
+		err := c.handlePanic(func() error {
+			var err error
+			reqs, err = w.mapper(ctx, c.runtime(), res)
+			return err
+		})
+		if err != nil {
+			from.AddRateLimited(res)
+			from.Done(res)
+			continue
+		}
+
+		for _, r := range reqs {
+			if !proto.Equal(r.ID.Type, c.ctrl.managedType) {
+				logger.Error("dependency mapper returned request for a resource of the wrong type",
+					"type_expected", resource.ToGVK(c.ctrl.managedType),
+					"type_got", resource.ToGVK(r.ID.Type),
+				)
+				continue
+			}
+			to.Add(r)
+		}
+
+		from.Forget(res)
+		from.Done(res)
+	}
+}
+
+func (c *controllerRunner) runReconciler(ctx context.Context, queue queue.WorkQueue[Request]) error {
+	for {
+		req, shutdown := queue.Get()
+		if shutdown {
+			return nil
+		}
+
+		c.logger.Trace("handling request", "request", req)
+		err := c.handlePanic(func() error {
+			return c.ctrl.reconciler.Reconcile(ctx, c.runtime(), req)
+		})
+		if err == nil {
+			queue.Forget(req)
+		} else {
+			var requeueAfter RequeueAfterError
+			if errors.As(err, &requeueAfter) {
+				queue.Forget(req)
+				queue.AddAfter(req, time.Duration(requeueAfter))
+			} else {
+				queue.AddRateLimited(req)
+			}
+		}
+		queue.Done(req)
+	}
+}
+
+func (c *controllerRunner) handlePanic(fn func() error) (err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			stack := hclog.Stacktrace()
+			c.logger.Error("controller panic",
+				"panic", r,
+				"stack", stack,
+			)
+			err = fmt.Errorf("panic [recovered]: %v", r)
+			return
+		}
+	}()
+
+	return fn()
+}
+
+func (c *controllerRunner) runtime() Runtime {
+	return Runtime{
+		Client: c.client,
+		Logger: c.logger,
+	}
 }
diff --git a/internal/controller/doc.go b/internal/controller/doc.go
new file mode 100644
index 000000000000..28953791525c
--- /dev/null
+++ b/internal/controller/doc.go
@@ -0,0 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Package controller provides an API for implementing control loops on top of
+// Consul resources. It is heavily inspired by [Kubebuilder] and the Kubernetes
+// [controller runtime].
+//
+// [Kubebuilder]: https://github.com/kubernetes-sigs/kubebuilder
+// [controller runtime]: https://github.com/kubernetes-sigs/controller-runtime
+package controller
diff --git a/internal/controller/lease.go b/internal/controller/lease.go
index 33e284a69c7c..2cb00d133019 100644
--- a/internal/controller/lease.go
+++ b/internal/controller/lease.go
@@ -22,3 +22,8 @@ type raftLease struct {
 
 func (l *raftLease) Held() bool               { return l.m.raftLeader.Load() }
 func (l *raftLease) Changed() <-chan struct{} { return l.ch }
+
+type eternalLease struct{}
+
+func (eternalLease) Held() bool               { return true }
+func (eternalLease) Changed() <-chan struct{} { return nil }
diff --git a/internal/controller/manager.go b/internal/controller/manager.go
index 90b9f2994bae..92c5829c581e 100644
--- a/internal/controller/manager.go
+++ b/internal/controller/manager.go
@@ -2,16 +2,19 @@ package controller
 
 import (
 	"context"
+	"fmt"
 	"sync"
 	"sync/atomic"
 
 	"github.com/hashicorp/go-hclog"
 
 	"github.com/hashicorp/consul/internal/resource"
+	"github.com/hashicorp/consul/proto-public/pbresource"
 )
 
 // Manager is responsible for scheduling the execution of controllers.
 type Manager struct {
+	client pbresource.ResourceServiceClient
 	logger hclog.Logger
 
 	raftLeader atomic.Bool
@@ -24,8 +27,11 @@ type Manager struct {
 
 // NewManager creates a Manager. logger will be used by the Manager, and as the
 // base logger for controllers when one is not specified using WithLogger.
-func NewManager(logger hclog.Logger) *Manager {
-	return &Manager{logger: logger}
+func NewManager(client pbresource.ResourceServiceClient, logger hclog.Logger) *Manager {
+	return &Manager{
+		client: client,
+		logger: logger,
+	}
 }
 
 // Register the given controller to be executed by the Manager. Cannot be called
@@ -38,6 +44,10 @@ func (m *Manager) Register(ctrl Controller) {
 		panic("cannot register additional controllers after calling Run")
 	}
 
+	if ctrl.reconciler == nil {
+		panic(fmt.Sprintf("cannot register controller without a reconciler %s", ctrl))
+	}
+
 	m.controllers = append(m.controllers, ctrl)
 }
 
@@ -53,11 +63,17 @@ func (m *Manager) Run(ctx context.Context) {
 	m.running = true
 
 	for _, desc := range m.controllers {
+		logger := desc.logger
+		if logger == nil {
+			logger = m.logger.With("managed_type", resource.ToGVK(desc.managedType))
+		}
+
 		runner := &controllerRunner{
 			ctrl:   desc,
-			logger: m.logger.With("managed_type", resource.ToGVK(desc.managedType)),
+			client: m.client,
+			logger: logger,
 		}
-		go newSupervisor(runner.run, m.newLeaseLocked()).run(ctx)
+		go newSupervisor(runner.run, m.newLeaseLocked(desc)).run(ctx)
 	}
 }
 
@@ -82,7 +98,11 @@ func (m *Manager) SetRaftLeader(leader bool) {
 	}
 }
 
-func (m *Manager) newLeaseLocked() Lease {
+func (m *Manager) newLeaseLocked(ctrl Controller) Lease {
+	if ctrl.placement == PlacementEachServer {
+		return eternalLease{}
+	}
+
 	ch := make(chan struct{}, 1)
 	m.leaseChans = append(m.leaseChans, ch)
 	return &raftLease{m: m, ch: ch}
diff --git a/internal/resource/demo/controller.go b/internal/resource/demo/controller.go
index f2172f0f852c..11de1c5057ee 100644
--- a/internal/resource/demo/controller.go
+++ b/internal/resource/demo/controller.go
@@ -1,6 +1,25 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package demo
 
-import "github.com/hashicorp/consul/internal/controller"
+import (
+	"context"
+	"fmt"
+	"math/rand"
+
+	"github.com/oklog/ulid/v2"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/hashicorp/consul/internal/controller"
+	"github.com/hashicorp/consul/internal/resource"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	pbdemov2 "github.com/hashicorp/consul/proto/private/pbdemo/v2"
+)
+
+const statusKeyArtistController = "consul.io/artist-controller"
 
 // RegisterControllers registers controllers for the demo types. Should only be
 // called in dev mode.
@@ -9,5 +28,158 @@ func RegisterControllers(mgr *controller.Manager) {
 }
 
 func artistController() controller.Controller {
-	return controller.ForType(TypeV2Artist)
+	return controller.ForType(TypeV2Artist).
+		WithWatch(TypeV2Album, controller.MapOwner).
+		WithReconciler(&artistReconciler{})
+}
+
+type artistReconciler struct{}
+
+func (r *artistReconciler) Reconcile(ctx context.Context, rt controller.Runtime, req controller.Request) error {
+	rsp, err := rt.Client.Read(ctx, &pbresource.ReadRequest{Id: req.ID})
+	switch {
+	case status.Code(err) == codes.NotFound:
+		return nil
+	case err != nil:
+		return err
+	}
+	res := rsp.Resource
+
+	var artist pbdemov2.Artist
+	if err := res.Data.UnmarshalTo(&artist); err != nil {
+		return err
+	}
+	conditions := []*pbresource.Condition{
+		{
+			Type:    "Accepted",
+			State:   pbresource.Condition_STATE_TRUE,
+			Reason:  "Accepted",
+			Message: fmt.Sprintf("Artist '%s' accepted", artist.Name),
+		},
+	}
+
+	numAlbums := 3
+	if artist.Genre == pbdemov2.Genre_GENRE_BLUES {
+		numAlbums = 10
+	}
+
+	desiredAlbums, err := generateV2AlbumsDeterministic(res.Id, numAlbums)
+	if err != nil {
+		return err
+	}
+
+	actualAlbums, err := rt.Client.List(ctx, &pbresource.ListRequest{
+		Type:       TypeV2Album,
+		Tenancy:    res.Id.Tenancy,
+		NamePrefix: fmt.Sprintf("%s/", res.Id.Name),
+	})
+	if err != nil {
+		return err
+	}
+
+	writes, deletions, err := diffAlbums(desiredAlbums, actualAlbums.Resources)
+	if err != nil {
+		return err
+	}
+	for _, w := range writes {
+		if _, err := rt.Client.Write(ctx, &pbresource.WriteRequest{Resource: w}); err != nil {
+			return err
+		}
+	}
+	for _, d := range deletions {
+		if _, err := rt.Client.Delete(ctx, &pbresource.DeleteRequest{Id: d}); err != nil {
+			return err
+		}
+	}
+
+	for _, want := range desiredAlbums {
+		var album pbdemov2.Album
+		if err := want.Data.UnmarshalTo(&album); err != nil {
+			return err
+		}
+		conditions = append(conditions, &pbresource.Condition{
+			Type:     "AlbumCreated",
+			State:    pbresource.Condition_STATE_TRUE,
+			Reason:   "AlbumCreated",
+			Message:  fmt.Sprintf("Album '%s' created for artist '%s'", album.Title, artist.Name),
+			Resource: resource.Reference(want.Id, ""),
+		})
+	}
+
+	newStatus := &pbresource.Status{
+		ObservedGeneration: res.Generation,
+		Conditions:         conditions,
+	}
+
+	if proto.Equal(res.Status[statusKeyArtistController], newStatus) {
+		return nil
+	}
+
+	_, err = rt.Client.WriteStatus(ctx, &pbresource.WriteStatusRequest{
+		Id:     res.Id,
+		Key:    statusKeyArtistController,
+		Status: newStatus,
+	})
+	return err
+}
+
+func diffAlbums(want, have []*pbresource.Resource) ([]*pbresource.Resource, []*pbresource.ID, error) {
+	haveMap := make(map[string]*pbresource.Resource, len(have))
+	for _, r := range have {
+		haveMap[r.Id.Name] = r
+	}
+
+	wantMap := make(map[string]struct{}, len(want))
+	for _, r := range want {
+		wantMap[r.Id.Name] = struct{}{}
+	}
+
+	writes := make([]*pbresource.Resource, 0)
+	for _, w := range want {
+		h, ok := haveMap[w.Id.Name]
+		if ok {
+			var wd, hd pbdemov2.Album
+			if err := w.Data.UnmarshalTo(&wd); err != nil {
+				return nil, nil, err
+			}
+			if err := h.Data.UnmarshalTo(&hd); err != nil {
+				return nil, nil, err
+			}
+			if proto.Equal(&wd, &hd) {
+				continue
+			}
+		}
+
+		writes = append(writes, w)
+	}
+
+	deletions := make([]*pbresource.ID, 0)
+	for _, h := range have {
+		if _, ok := wantMap[h.Id.Name]; ok {
+			continue
+		}
+		deletions = append(deletions, h.Id)
+	}
+
+	return writes, deletions, nil
+}
+
+func generateV2AlbumsDeterministic(artistID *pbresource.ID, count int) ([]*pbresource.Resource, error) {
+	uid, err := ulid.Parse(artistID.Uid)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse Uid: %w", err)
+	}
+	rand := rand.New(rand.NewSource(int64(uid.Time())))
+
+	albums := make([]*pbresource.Resource, count)
+	for i := 0; i < count; i++ {
+		album, err := generateV2Album(artistID, rand)
+		if err != nil {
+			return nil, err
+		}
+		// Add suffix to avoid collisions.
+		album.Id.Name = fmt.Sprintf("%s-%d", album.Id.Name, i)
+		albums[i] = album
+	}
+	return albums, nil
 }
diff --git a/internal/resource/demo/controller_test.go b/internal/resource/demo/controller_test.go
new file mode 100644
index 000000000000..8d4ee79c73e0
--- /dev/null
+++ b/internal/resource/demo/controller_test.go
@@ -0,0 +1,102 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package demo
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	svctest "github.com/hashicorp/consul/agent/grpc-external/services/resource/testing"
+	"github.com/hashicorp/consul/internal/controller"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	pbdemov2 "github.com/hashicorp/consul/proto/private/pbdemo/v2"
+	"github.com/hashicorp/consul/sdk/testutil"
+)
+
+func TestArtistReconciler(t *testing.T) {
+	client := svctest.RunResourceService(t, RegisterTypes)
+
+	// Seed the database with an artist.
+	res, err := GenerateV2Artist()
+	require.NoError(t, err)
+
+	// Set the genre to BLUES to ensure there are 10 albums.
+	var artist pbdemov2.Artist
+	require.NoError(t, res.Data.UnmarshalTo(&artist))
+	artist.Genre = pbdemov2.Genre_GENRE_BLUES
+	require.NoError(t, res.Data.MarshalFrom(&artist))
+
+	ctx := testutil.TestContext(t)
+	writeRsp, err := client.Write(ctx, &pbresource.WriteRequest{Resource: res})
+	require.NoError(t, err)
+
+	// Call the reconciler for that artist.
+	var rec artistReconciler
+	runtime := controller.Runtime{
+		Client: client,
+		Logger: testutil.Logger(t),
+	}
+	req := controller.Request{
+		ID: writeRsp.Resource.Id,
+	}
+	require.NoError(t, rec.Reconcile(ctx, runtime, req))
+
+	// Check the status was updated.
+	readRsp, err := client.Read(ctx, &pbresource.ReadRequest{Id: writeRsp.Resource.Id})
+	require.NoError(t, err)
+	require.Contains(t, readRsp.Resource.Status, "consul.io/artist-controller")
+
+	status := readRsp.Resource.Status["consul.io/artist-controller"]
+	require.Equal(t, writeRsp.Resource.Generation, status.ObservedGeneration)
+	require.Len(t, status.Conditions, 11)
+	require.Equal(t, "Accepted", status.Conditions[0].Type)
+	require.Equal(t, "AlbumCreated", status.Conditions[1].Type)
+
+	// Check the albums were created.
+	listRsp, err := client.List(ctx, &pbresource.ListRequest{
+		Type:    TypeV2Album,
+		Tenancy: readRsp.Resource.Id.Tenancy,
+	})
+	require.NoError(t, err)
+	require.Len(t, listRsp.Resources, 10)
+
+	// Delete an album.
+	_, err = client.Delete(ctx, &pbresource.DeleteRequest{Id: listRsp.Resources[0].Id})
+	require.NoError(t, err)
+
+	// Call the reconciler again.
+	require.NoError(t, rec.Reconcile(ctx, runtime, req))
+
+	// Check the album was recreated.
+	listRsp, err = client.List(ctx, &pbresource.ListRequest{
+		Type:    TypeV2Album,
+		Tenancy: readRsp.Resource.Id.Tenancy,
+	})
+	require.NoError(t, err)
+	require.Len(t, listRsp.Resources, 10)
+
+	// Set the genre to DISCO.
+	readRsp, err = client.Read(ctx, &pbresource.ReadRequest{Id: writeRsp.Resource.Id})
+	require.NoError(t, err)
+
+	res = readRsp.Resource
+	require.NoError(t, res.Data.UnmarshalTo(&artist))
+	artist.Genre = pbdemov2.Genre_GENRE_DISCO
+	require.NoError(t, res.Data.MarshalFrom(&artist))
+
+	_, err = client.Write(ctx, &pbresource.WriteRequest{Resource: res})
+	require.NoError(t, err)
+
+	// Call the reconciler again.
+	require.NoError(t, rec.Reconcile(ctx, runtime, req))
+
+	// Check there are only 3 albums now.
+	listRsp, err = client.List(ctx, &pbresource.ListRequest{
+		Type:    TypeV2Album,
+		Tenancy: readRsp.Resource.Id.Tenancy,
+	})
+	require.NoError(t, err)
+	require.Len(t, listRsp.Resources, 3)
+}
diff --git a/internal/resource/demo/demo.go b/internal/resource/demo/demo.go
index fde9272aeb02..842b75739bc4 100644
--- a/internal/resource/demo/demo.go
+++ b/internal/resource/demo/demo.go
@@ -204,6 +204,10 @@ func GenerateV2Artist() (*pbresource.Resource, error) {
 // GenerateV2Album generates a random Album resource, owned by the Artist with
 // the given ID.
 func GenerateV2Album(artistID *pbresource.ID) (*pbresource.Resource, error) {
+	return generateV2Album(artistID, rand.New(rand.NewSource(time.Now().UnixNano())))
+}
+
+func generateV2Album(artistID *pbresource.ID, rand *rand.Rand) (*pbresource.Resource, error) {
 	adjective := adjectives[rand.Intn(len(adjectives))]
 	noun := nouns[rand.Intn(len(nouns))]
 

From 5f079eb05b3f43b59bfce182547ebcccda2e61f8 Mon Sep 17 00:00:00 2001
From: Dan Bond <danbond@protonmail.com>
Date: Tue, 9 May 2023 09:44:31 -0700
Subject: [PATCH 56/92] Revert "ci: remove test splitting for compatibility
 tests (#17166)" (#17262)

This reverts commit 861a8151d50377315c6c391833fef85b71b54d18.
---
 .github/workflows/test-integrations.yml | 45 +++++++++++++++++++++++--
 1 file changed, 43 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test-integrations.yml b/.github/workflows/test-integrations.yml
index 3615e1554805..33d1ccc9e207 100644
--- a/.github/workflows/test-integrations.yml
+++ b/.github/workflows/test-integrations.yml
@@ -237,11 +237,47 @@ jobs:
           name: ${{ env.TEST_RESULTS_ARTIFACT_NAME }}
           path: ${{ env.TEST_RESULTS_DIR }}
 
+  generate-compatibility-job-matrices:
+    needs: [setup]
+    runs-on: ${{ fromJSON(needs.setup.outputs.compute-small) }}
+    name: Generate Compatibility Job Matrices
+    outputs:
+      compatibility-matrix: ${{ steps.set-matrix.outputs.compatibility-matrix }}
+    steps:
+      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
+      - name: Generate Compatibility Job Matrix
+        id: set-matrix
+        env:
+          TOTAL_RUNNERS: 6
+          JQ_SLICER: '[ inputs ] | [_nwise(length / $runnercount | floor)]'
+        run: |
+          cd ./test/integration/consul-container
+          NUM_RUNNERS=$TOTAL_RUNNERS
+          NUM_DIRS=$(find ./test -mindepth 1 -maxdepth 2 -type d | wc -l)
+
+          if [ "$NUM_DIRS" -lt "$NUM_RUNNERS" ]; then
+            echo "TOTAL_RUNNERS is larger than the number of tests/packages to split."
+            NUM_RUNNERS=$((NUM_DIRS-1))
+          fi
+          # fix issue where test splitting calculation generates 1 more split than TOTAL_RUNNERS.
+          NUM_RUNNERS=$((NUM_RUNNERS-1))
+          {
+            echo -n "compatibility-matrix="
+            find ./test -maxdepth 2 -type d -print0 | xargs -0 -n 1 \
+              | grep -v util | grep -v upgrade \
+              | jq --raw-input --argjson runnercount "$NUM_RUNNERS" "$JQ_SLICER" \
+              | jq --compact-output 'map(join(" "))'
+          } >> "$GITHUB_OUTPUT"
   compatibility-integration-test:
     runs-on: ${{ fromJSON(needs.setup.outputs.compute-xl) }}
     needs:
       - setup
       - dev-build
+      - generate-compatibility-job-matrices
+    strategy:
+      fail-fast: false
+      matrix:
+        test-cases: ${{ fromJSON(needs.generate-compatibility-job-matrices.outputs.compatibility-matrix) }}
     steps:
       - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
       - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
@@ -271,9 +307,12 @@ jobs:
             mkdir -p "/tmp/test-results"
             cd ./test/integration/consul-container
             docker run --rm ${{ env.CONSUL_LATEST_IMAGE_NAME }}:local consul version
+            echo "Running $(sed 's,|, ,g' <<< "${{ matrix.test-cases }}" |wc -w) subtests"
+            # shellcheck disable=SC2001
+            sed 's, ,\n,g' <<< "${{ matrix.test-cases }}"
             go run gotest.tools/gotestsum@v${{env.GOTESTSUM_VERSION}} \
               --raw-command \
-              --format=standard-verbose \
+              --format=short-verbose \
               --debug \
               --rerun-fails=3 \
               -- \
@@ -282,7 +321,7 @@ jobs:
               -tags "${{ env.GOTAGS }}" \
               -timeout=30m \
               -json \
-              `go list ./... | grep -v upgrade` \
+              ${{ matrix.test-cases }} \
               --target-image ${{ env.CONSUL_LATEST_IMAGE_NAME }} \
               --target-version local \
               --latest-image docker.mirror.hashicorp.services/${{ env.CONSUL_LATEST_IMAGE_NAME }} \
@@ -383,6 +422,7 @@ jobs:
             --raw-command \
             --format=short-verbose \
             --debug \
+            --rerun-fails=3 \
             --packages="./..." \
             -- \
             go test \
@@ -416,6 +456,7 @@ jobs:
     - vault-integration-test
     - generate-envoy-job-matrices
     - envoy-integration-test
+    - generate-compatibility-job-matrices
     - compatibility-integration-test
     - generate-upgrade-job-matrices
     - upgrade-integration-test

From 972998203ea7056d93de38a27525ba57eaae46c7 Mon Sep 17 00:00:00 2001
From: Dan Upton <daniel@floppy.co>
Date: Tue, 9 May 2023 18:14:20 +0100
Subject: [PATCH 57/92] controller: deduplicate items in queue (#17168)

---
 agent/consul/controller/queue/defer.go     | 12 +++-----
 agent/consul/controller/queue/queue.go     | 27 ++++++++--------
 agent/consul/controller/queue/rate.go      | 12 +++-----
 agent/consul/controller/queue/rate_test.go |  2 ++
 agent/consul/controller/queue_test.go      |  2 --
 agent/consul/controller/reconciler.go      | 12 ++++++++
 internal/controller/api.go                 | 13 ++++++++
 internal/controller/controller.go          | 36 ++++++++++++++++------
 8 files changed, 79 insertions(+), 37 deletions(-)

diff --git a/agent/consul/controller/queue/defer.go b/agent/consul/controller/queue/defer.go
index d6e261288f58..01666219c291 100644
--- a/agent/consul/controller/queue/defer.go
+++ b/agent/consul/controller/queue/defer.go
@@ -41,7 +41,7 @@ type deferredRequest[T ItemType] struct {
 // future processing
 type deferQueue[T ItemType] struct {
 	heap    *deferHeap[T]
-	entries map[T]*deferredRequest[T]
+	entries map[string]*deferredRequest[T]
 
 	addChannel     chan *deferredRequest[T]
 	heartbeat      *time.Ticker
@@ -55,7 +55,7 @@ func NewDeferQueue[T ItemType](tick time.Duration) DeferQueue[T] {
 
 	return &deferQueue[T]{
 		heap:       dHeap,
-		entries:    make(map[T]*deferredRequest[T]),
+		entries:    make(map[string]*deferredRequest[T]),
 		addChannel: make(chan *deferredRequest[T]),
 		heartbeat:  time.NewTicker(tick),
 	}
@@ -78,7 +78,7 @@ func (q *deferQueue[T]) Defer(ctx context.Context, item T, until time.Time) {
 
 // deferEntry adds a deferred request to the priority queue
 func (q *deferQueue[T]) deferEntry(entry *deferredRequest[T]) {
-	existing, exists := q.entries[entry.item]
+	existing, exists := q.entries[entry.item.Key()]
 	if exists {
 		// insert or update the item deferral time
 		if existing.enqueueAt.After(entry.enqueueAt) {
@@ -90,7 +90,7 @@ func (q *deferQueue[T]) deferEntry(entry *deferredRequest[T]) {
 	}
 
 	heap.Push(q.heap, entry)
-	q.entries[entry.item] = entry
+	q.entries[entry.item.Key()] = entry
 }
 
 // readyRequest returns a pointer to the next ready Request or
@@ -108,7 +108,7 @@ func (q *deferQueue[T]) readyRequest() *T {
 	}
 
 	entry = heap.Pop(q.heap).(*deferredRequest[T])
-	delete(q.entries, entry.item)
+	delete(q.entries, entry.item.Key())
 	return &entry.item
 }
 
@@ -182,8 +182,6 @@ func (q *deferQueue[T]) Process(ctx context.Context, callback func(item T)) {
 	}
 }
 
-var _ heap.Interface = &deferHeap[string]{}
-
 // deferHeap implements heap.Interface
 type deferHeap[T ItemType] []*deferredRequest[T]
 
diff --git a/agent/consul/controller/queue/queue.go b/agent/consul/controller/queue/queue.go
index fd712b40a4c0..6d9f0a657125 100644
--- a/agent/consul/controller/queue/queue.go
+++ b/agent/consul/controller/queue/queue.go
@@ -13,7 +13,10 @@ import (
 // https://github.com/kubernetes/client-go/blob/release-1.25/util/workqueue/queue.go
 
 // ItemType is the type constraint for items in the WorkQueue.
-type ItemType comparable
+type ItemType interface {
+	// Key returns a string that will be used to de-duplicate items in the queue.
+	Key() string
+}
 
 // WorkQueue is an interface for a work queue with semantics to help with
 // retries and rate limiting.
@@ -43,9 +46,9 @@ type queue[T ItemType] struct {
 
 	// dirty holds the working set of all Requests, whether they are being
 	// processed or not
-	dirty map[T]struct{}
+	dirty map[string]struct{}
 	// processing holds the set of current requests being processed
-	processing map[T]struct{}
+	processing map[string]struct{}
 
 	// deferred is an internal priority queue that tracks deferred
 	// Requests
@@ -66,8 +69,8 @@ type queue[T ItemType] struct {
 func RunWorkQueue[T ItemType](ctx context.Context, baseBackoff, maxBackoff time.Duration) WorkQueue[T] {
 	q := &queue[T]{
 		ratelimiter: NewRateLimiter[T](baseBackoff, maxBackoff),
-		dirty:       make(map[T]struct{}),
-		processing:  make(map[T]struct{}),
+		dirty:       make(map[string]struct{}),
+		processing:  make(map[string]struct{}),
 		cond:        sync.NewCond(&sync.Mutex{}),
 		deferred:    NewDeferQueue[T](500 * time.Millisecond),
 		ctx:         ctx,
@@ -115,8 +118,8 @@ func (q *queue[T]) Get() (item T, shutdown bool) {
 
 	item, q.queue = q.queue[0], q.queue[1:]
 
-	q.processing[item] = struct{}{}
-	delete(q.dirty, item)
+	q.processing[item.Key()] = struct{}{}
+	delete(q.dirty, item.Key())
 
 	return item, false
 }
@@ -129,12 +132,12 @@ func (q *queue[T]) Add(item T) {
 	if q.shuttingDown() {
 		return
 	}
-	if _, ok := q.dirty[item]; ok {
+	if _, ok := q.dirty[item.Key()]; ok {
 		return
 	}
 
-	q.dirty[item] = struct{}{}
-	if _, ok := q.processing[item]; ok {
+	q.dirty[item.Key()] = struct{}{}
+	if _, ok := q.processing[item.Key()]; ok {
 		return
 	}
 
@@ -175,8 +178,8 @@ func (q *queue[T]) Done(item T) {
 	q.cond.L.Lock()
 	defer q.cond.L.Unlock()
 
-	delete(q.processing, item)
-	if _, ok := q.dirty[item]; ok {
+	delete(q.processing, item.Key())
+	if _, ok := q.dirty[item.Key()]; ok {
 		q.queue = append(q.queue, item)
 		q.cond.Signal()
 	}
diff --git a/agent/consul/controller/queue/rate.go b/agent/consul/controller/queue/rate.go
index f4f0dc5ad9a0..471601f85a27 100644
--- a/agent/consul/controller/queue/rate.go
+++ b/agent/consul/controller/queue/rate.go
@@ -22,10 +22,8 @@ type Limiter[T ItemType] interface {
 	Forget(request T)
 }
 
-var _ Limiter[string] = &ratelimiter[string]{}
-
 type ratelimiter[T ItemType] struct {
-	failures map[T]int
+	failures map[string]int
 	base     time.Duration
 	max      time.Duration
 	mutex    sync.RWMutex
@@ -35,7 +33,7 @@ type ratelimiter[T ItemType] struct {
 // backoff.
 func NewRateLimiter[T ItemType](base, max time.Duration) Limiter[T] {
 	return &ratelimiter[T]{
-		failures: make(map[T]int),
+		failures: make(map[string]int),
 		base:     base,
 		max:      max,
 	}
@@ -47,8 +45,8 @@ func (r *ratelimiter[T]) NextRetry(request T) time.Duration {
 	r.mutex.RLock()
 	defer r.mutex.RUnlock()
 
-	exponent := r.failures[request]
-	r.failures[request] = r.failures[request] + 1
+	exponent := r.failures[request.Key()]
+	r.failures[request.Key()] = r.failures[request.Key()] + 1
 
 	backoff := float64(r.base.Nanoseconds()) * math.Pow(2, float64(exponent))
 	// make sure we don't overflow time.Duration
@@ -69,5 +67,5 @@ func (r *ratelimiter[T]) Forget(request T) {
 	r.mutex.Lock()
 	defer r.mutex.Unlock()
 
-	delete(r.failures, request)
+	delete(r.failures, request.Key())
 }
diff --git a/agent/consul/controller/queue/rate_test.go b/agent/consul/controller/queue/rate_test.go
index f44df15e1b4d..40dc540138e2 100644
--- a/agent/consul/controller/queue/rate_test.go
+++ b/agent/consul/controller/queue/rate_test.go
@@ -12,6 +12,8 @@ import (
 
 type Request struct{ Kind string }
 
+func (r Request) Key() string { return r.Kind }
+
 func TestRateLimiter_Backoff(t *testing.T) {
 	t.Parallel()
 
diff --git a/agent/consul/controller/queue_test.go b/agent/consul/controller/queue_test.go
index 867dfeff134b..11e1bc82b762 100644
--- a/agent/consul/controller/queue_test.go
+++ b/agent/consul/controller/queue_test.go
@@ -10,8 +10,6 @@ import (
 	"github.com/hashicorp/consul/agent/consul/controller/queue"
 )
 
-var _ queue.WorkQueue[string] = &countingWorkQueue[string]{}
-
 type countingWorkQueue[T queue.ItemType] struct {
 	getCounter            uint64
 	addCounter            uint64
diff --git a/agent/consul/controller/reconciler.go b/agent/consul/controller/reconciler.go
index ce0c6e97a3a9..dc4222508b57 100644
--- a/agent/consul/controller/reconciler.go
+++ b/agent/consul/controller/reconciler.go
@@ -20,6 +20,18 @@ type Request struct {
 	Meta *acl.EnterpriseMeta
 }
 
+// Key satisfies the queue.ItemType interface. It returns a string which will be
+// used to de-duplicate requests in the queue.
+func (r Request) Key() string {
+	return fmt.Sprintf(
+		`kind=%q,name=%q,part=%q,ns=%q`,
+		r.Kind,
+		r.Name,
+		r.Meta.PartitionOrDefault(),
+		r.Meta.NamespaceOrDefault(),
+	)
+}
+
 // RequeueAfterError is an error that allows a Reconciler to override the
 // exponential backoff behavior of the Controller, rather than applying
 // the backoff algorithm, returning a RequeueAfterError will cause the
diff --git a/internal/controller/api.go b/internal/controller/api.go
index d258eb40d6d8..7a2e89be4641 100644
--- a/internal/controller/api.go
+++ b/internal/controller/api.go
@@ -127,6 +127,19 @@ type Request struct {
 	ID *pbresource.ID
 }
 
+// Key satisfies the queue.ItemType interface. It returns a string which will be
+// used to de-duplicate requests in the queue.
+func (r Request) Key() string {
+	return fmt.Sprintf(
+		"part=%q,peer=%q,ns=%q,name=%q,uid=%q",
+		r.ID.Tenancy.Partition,
+		r.ID.Tenancy.PeerName,
+		r.ID.Tenancy.Namespace,
+		r.ID.Name,
+		r.ID.Uid,
+	)
+}
+
 // Runtime contains the dependencies required by reconcilers.
 type Runtime struct {
 	Client pbresource.ResourceServiceClient
diff --git a/internal/controller/controller.go b/internal/controller/controller.go
index d99ca26f0d3f..296ff5faf4f5 100644
--- a/internal/controller/controller.go
+++ b/internal/controller/controller.go
@@ -43,11 +43,13 @@ func (c *controllerRunner) run(ctx context.Context) error {
 
 	for _, watch := range c.ctrl.watches {
 		watch := watch
-		mapQueue := runQueue[*pbresource.Resource](groupCtx, c.ctrl)
+		mapQueue := runQueue[mapperRequest](groupCtx, c.ctrl)
 
 		// Watched Type Events → Mapper Queue
 		group.Go(func() error {
-			return c.watch(groupCtx, watch.watchedType, mapQueue.Add)
+			return c.watch(groupCtx, watch.watchedType, func(res *pbresource.Resource) {
+				mapQueue.Add(mapperRequest{res: res})
+			})
 		})
 
 		// Mapper Queue → Mapper → Reconciliation Queue
@@ -96,13 +98,13 @@ func (c *controllerRunner) watch(ctx context.Context, typ *pbresource.Type, add
 func (c *controllerRunner) runMapper(
 	ctx context.Context,
 	w watch,
-	from queue.WorkQueue[*pbresource.Resource],
+	from queue.WorkQueue[mapperRequest],
 	to queue.WorkQueue[Request],
 ) error {
 	logger := c.logger.With("watched_resource_type", resource.ToGVK(w.watchedType))
 
 	for {
-		res, shutdown := from.Get()
+		item, shutdown := from.Get()
 		if shutdown {
 			return nil
 		}
@@ -110,12 +112,12 @@ func (c *controllerRunner) runMapper(
 		var reqs []Request
 		err := c.handlePanic(func() error {
 			var err error
-			reqs, err = w.mapper(ctx, c.runtime(), res)
+			reqs, err = w.mapper(ctx, c.runtime(), item.res)
 			return err
 		})
 		if err != nil {
-			from.AddRateLimited(res)
-			from.Done(res)
+			from.AddRateLimited(item)
+			from.Done(item)
 			continue
 		}
 
@@ -130,8 +132,8 @@ func (c *controllerRunner) runMapper(
 			to.Add(r)
 		}
 
-		from.Forget(res)
-		from.Done(res)
+		from.Forget(item)
+		from.Done(item)
 	}
 }
 
@@ -183,3 +185,19 @@ func (c *controllerRunner) runtime() Runtime {
 		Logger: c.logger,
 	}
 }
+
+type mapperRequest struct{ res *pbresource.Resource }
+
+// Key satisfies the queue.ItemType interface. It returns a string which will be
+// used to de-duplicate requests in the queue.
+func (i mapperRequest) Key() string {
+	return fmt.Sprintf(
+		"type=%q,part=%q,peer=%q,ns=%q,name=%q,uid=%q",
+		resource.ToGVK(i.res.Id.Type),
+		i.res.Id.Tenancy.Partition,
+		i.res.Id.Tenancy.PeerName,
+		i.res.Id.Tenancy.Namespace,
+		i.res.Id.Name,
+		i.res.Id.Uid,
+	)
+}

From 4f6da20fe51c3d58dd4ec503c95512727169ffff Mon Sep 17 00:00:00 2001
From: Derek Menteer <105233703+hashi-derek@users.noreply.github.com>
Date: Tue, 9 May 2023 12:37:58 -0500
Subject: [PATCH 58/92] Fix multiple issues related to proxycfg health queries.
 (#17241)

Fix multiple issues related to proxycfg health queries.

1. The datacenter was not being provided to a proxycfg query, which resulted in
bypassing agentless query optimizations and using the normal API instead.

2. The health rpc endpoint would return a zero index when insufficient ACLs were
detected. This would result in the agent cache performing an infinite loop of
queries in rapid succession without backoff.
---
 .changelog/17241.txt                 |  3 +++
 agent/consul/health_endpoint.go      | 37 ++++++++++++++--------------
 agent/consul/health_endpoint_test.go |  1 +
 agent/proxycfg/state_test.go         |  2 +-
 agent/proxycfg/upstreams.go          | 24 +++++++++---------
 5 files changed, 37 insertions(+), 30 deletions(-)
 create mode 100644 .changelog/17241.txt

diff --git a/.changelog/17241.txt b/.changelog/17241.txt
new file mode 100644
index 000000000000..0369710928ed
--- /dev/null
+++ b/.changelog/17241.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+connect: Fix multiple inefficient behaviors when querying service health.
+```
diff --git a/agent/consul/health_endpoint.go b/agent/consul/health_endpoint.go
index abf17adbaeb1..6913136d3844 100644
--- a/agent/consul/health_endpoint.go
+++ b/agent/consul/health_endpoint.go
@@ -214,28 +214,10 @@ func (h *Health) ServiceNodes(args *structs.ServiceSpecificRequest, reply *struc
 		f = h.serviceNodesDefault
 	}
 
-	authzContext := acl.AuthorizerContext{
-		Peer: args.PeerName,
-	}
-	authz, err := h.srv.ResolveTokenAndDefaultMeta(args.Token, &args.EnterpriseMeta, &authzContext)
-	if err != nil {
-		return err
-	}
-
 	if err := h.srv.validateEnterpriseRequest(&args.EnterpriseMeta, false); err != nil {
 		return err
 	}
 
-	// If we're doing a connect or ingress query, we need read access to the service
-	// we're trying to find proxies for, so check that.
-	if args.Connect || args.Ingress {
-		// TODO(acl-error-enhancements) Look for ways to percolate this information up to give any feedback to the user.
-		if authz.ServiceRead(args.ServiceName, &authzContext) != acl.Allow {
-			// Just return nil, which will return an empty response (tested)
-			return nil
-		}
-	}
-
 	filter, err := bexpr.CreateFilter(args.Filter, nil, reply.Nodes)
 	if err != nil {
 		return err
@@ -257,6 +239,25 @@ func (h *Health) ServiceNodes(args *structs.ServiceSpecificRequest, reply *struc
 				return err
 			}
 
+			authzContext := acl.AuthorizerContext{
+				Peer: args.PeerName,
+			}
+			authz, err := h.srv.ResolveTokenAndDefaultMeta(args.Token, &args.EnterpriseMeta, &authzContext)
+			if err != nil {
+				return err
+			}
+
+			// If we're doing a connect or ingress query, we need read access to the service
+			// we're trying to find proxies for, so check that.
+			if args.Connect || args.Ingress {
+				// TODO(acl-error-enhancements) Look for ways to percolate this information up to give any feedback to the user.
+				if authz.ServiceRead(args.ServiceName, &authzContext) != acl.Allow {
+					// Return the index here so that the agent cache does not infinitely loop.
+					reply.Index = index
+					return nil
+				}
+			}
+
 			resolvedNodes := nodes
 			if args.MergeCentralConfig {
 				for _, node := range resolvedNodes {
diff --git a/agent/consul/health_endpoint_test.go b/agent/consul/health_endpoint_test.go
index 4b492081c930..1981332d86b4 100644
--- a/agent/consul/health_endpoint_test.go
+++ b/agent/consul/health_endpoint_test.go
@@ -1127,6 +1127,7 @@ node "foo" {
 	var resp structs.IndexedCheckServiceNodes
 	assert.Nil(t, msgpackrpc.CallWithCodec(codec, "Health.ServiceNodes", &req, &resp))
 	assert.Len(t, resp.Nodes, 0)
+	assert.Greater(t, resp.Index, uint64(0))
 
 	// List w/ token. This should work since we're requesting "foo", but should
 	// also only contain the proxies with names that adhere to our ACL.
diff --git a/agent/proxycfg/state_test.go b/agent/proxycfg/state_test.go
index aa11dc43f542..792367b473be 100644
--- a/agent/proxycfg/state_test.go
+++ b/agent/proxycfg/state_test.go
@@ -795,7 +795,7 @@ func TestState_WatchesAndUpdates(t *testing.T) {
 				fmt.Sprintf("upstream-target:api-failover-remote.default.default.dc2:%s-failover-remote?dc=dc2", apiUID.String()): genVerifyServiceSpecificRequest("api-failover-remote", "", "dc2", true),
 				fmt.Sprintf("upstream-target:api-failover-local.default.default.dc2:%s-failover-local?dc=dc2", apiUID.String()):   genVerifyServiceSpecificRequest("api-failover-local", "", "dc2", true),
 				fmt.Sprintf("upstream-target:api-failover-direct.default.default.dc2:%s-failover-direct?dc=dc2", apiUID.String()): genVerifyServiceSpecificRequest("api-failover-direct", "", "dc2", true),
-				upstreamPeerWatchIDPrefix + fmt.Sprintf("%s-failover-to-peer?peer=cluster-01", apiUID.String()):                   genVerifyServiceSpecificPeeredRequest("api-failover-to-peer", "", "", "cluster-01", true),
+				upstreamPeerWatchIDPrefix + fmt.Sprintf("%s-failover-to-peer?peer=cluster-01", apiUID.String()):                   genVerifyServiceSpecificPeeredRequest("api-failover-to-peer", "", "dc1", "cluster-01", true),
 				fmt.Sprintf("mesh-gateway:dc2:%s-failover-remote?dc=dc2", apiUID.String()):                                        genVerifyGatewayWatch("dc2"),
 				fmt.Sprintf("mesh-gateway:dc1:%s-failover-local?dc=dc2", apiUID.String()):                                         genVerifyGatewayWatch("dc1"),
 			},
diff --git a/agent/proxycfg/upstreams.go b/agent/proxycfg/upstreams.go
index d7fee4a3fcc1..5e42072fac32 100644
--- a/agent/proxycfg/upstreams.go
+++ b/agent/proxycfg/upstreams.go
@@ -316,8 +316,19 @@ func (s *handlerUpstreams) resetWatchesFromChain(
 			watchedChainEndpoints = true
 		}
 
-		opts := targetWatchOpts{upstreamID: uid}
-		opts.fromChainTarget(target)
+		opts := targetWatchOpts{
+			upstreamID: uid,
+			chainID:    target.ID,
+			service:    target.Service,
+			filter:     target.Subset.Filter,
+			datacenter: target.Datacenter,
+			peer:       target.Peer,
+			entMeta:    target.GetEnterpriseMetadata(),
+		}
+		// Peering targets do not set the datacenter field, so we should default it here.
+		if opts.datacenter == "" {
+			opts.datacenter = s.source.Datacenter
+		}
 
 		err := s.watchUpstreamTarget(ctx, snap, opts)
 		if err != nil {
@@ -435,15 +446,6 @@ type targetWatchOpts struct {
 	entMeta    *acl.EnterpriseMeta
 }
 
-func (o *targetWatchOpts) fromChainTarget(t *structs.DiscoveryTarget) {
-	o.chainID = t.ID
-	o.service = t.Service
-	o.filter = t.Subset.Filter
-	o.datacenter = t.Datacenter
-	o.peer = t.Peer
-	o.entMeta = t.GetEnterpriseMetadata()
-}
-
 func (s *handlerUpstreams) watchUpstreamTarget(ctx context.Context, snap *ConfigSnapshotUpstreams, opts targetWatchOpts) error {
 	s.logger.Trace("initializing watch of target",
 		"upstream", opts.upstreamID,

From d53a1d4a27ba22071ac472a05a174008afb81fbb Mon Sep 17 00:00:00 2001
From: Dan Upton <daniel@floppy.co>
Date: Tue, 9 May 2023 19:02:24 +0100
Subject: [PATCH 59/92] resource: add helpers for more efficiently comparing
 IDs etc (#17224)

---
 .../grpc-external/services/resource/delete.go |   3 +-
 .../grpc-external/services/resource/write.go  |   5 +-
 internal/controller/controller.go             |   3 +-
 internal/resource/demo/controller.go          |   2 +-
 internal/resource/equality.go                 | 150 +++++
 internal/resource/equality_test.go            | 629 ++++++++++++++++++
 internal/resource/status.go                   |  46 --
 internal/resource/status_test.go              | 129 ----
 8 files changed, 784 insertions(+), 183 deletions(-)
 create mode 100644 internal/resource/equality.go
 create mode 100644 internal/resource/equality_test.go
 delete mode 100644 internal/resource/status.go
 delete mode 100644 internal/resource/status_test.go

diff --git a/agent/grpc-external/services/resource/delete.go b/agent/grpc-external/services/resource/delete.go
index f15fafa5931e..b3045b3d6d29 100644
--- a/agent/grpc-external/services/resource/delete.go
+++ b/agent/grpc-external/services/resource/delete.go
@@ -12,7 +12,6 @@ import (
 	"github.com/oklog/ulid/v2"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
-	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/anypb"
 
 	"github.com/hashicorp/consul/acl"
@@ -95,7 +94,7 @@ func (s *Server) Delete(ctx context.Context, req *pbresource.DeleteRequest) (*pb
 // still be deleted from the system by the reaper controller.
 func (s *Server) maybeCreateTombstone(ctx context.Context, deleteId *pbresource.ID) error {
 	// Don't create a tombstone when the resource being deleted is itself a tombstone.
-	if proto.Equal(resource.TypeV1Tombstone, deleteId.Type) {
+	if resource.EqualType(resource.TypeV1Tombstone, deleteId.Type) {
 		return nil
 	}
 
diff --git a/agent/grpc-external/services/resource/write.go b/agent/grpc-external/services/resource/write.go
index ad17e61c51d9..d50ca1dd8bcd 100644
--- a/agent/grpc-external/services/resource/write.go
+++ b/agent/grpc-external/services/resource/write.go
@@ -12,7 +12,6 @@ import (
 	"github.com/oklog/ulid/v2"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
-	"google.golang.org/protobuf/proto"
 
 	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/internal/resource"
@@ -176,14 +175,14 @@ func (s *Server) Write(ctx context.Context, req *pbresource.WriteRequest) (*pbre
 			}
 
 			// Owner can only be set on creation. Enforce immutability.
-			if !proto.Equal(input.Owner, existing.Owner) {
+			if !resource.EqualID(input.Owner, existing.Owner) {
 				return status.Errorf(codes.InvalidArgument, "owner cannot be changed")
 			}
 
 			// Carry over status and prevent updates
 			if input.Status == nil {
 				input.Status = existing.Status
-			} else if !resource.EqualStatus(input.Status, existing.Status) {
+			} else if !resource.EqualStatusMap(input.Status, existing.Status) {
 				return errUseWriteStatus
 			}
 
diff --git a/internal/controller/controller.go b/internal/controller/controller.go
index 296ff5faf4f5..54d5c57386a3 100644
--- a/internal/controller/controller.go
+++ b/internal/controller/controller.go
@@ -11,7 +11,6 @@ import (
 
 	"github.com/hashicorp/go-hclog"
 	"golang.org/x/sync/errgroup"
-	"google.golang.org/protobuf/proto"
 
 	"github.com/hashicorp/consul/agent/consul/controller/queue"
 	"github.com/hashicorp/consul/internal/resource"
@@ -122,7 +121,7 @@ func (c *controllerRunner) runMapper(
 		}
 
 		for _, r := range reqs {
-			if !proto.Equal(r.ID.Type, c.ctrl.managedType) {
+			if !resource.EqualType(r.ID.Type, c.ctrl.managedType) {
 				logger.Error("dependency mapper returned request for a resource of the wrong type",
 					"type_expected", resource.ToGVK(c.ctrl.managedType),
 					"type_got", resource.ToGVK(r.ID.Type),
diff --git a/internal/resource/demo/controller.go b/internal/resource/demo/controller.go
index 11de1c5057ee..db935ec065ba 100644
--- a/internal/resource/demo/controller.go
+++ b/internal/resource/demo/controller.go
@@ -111,7 +111,7 @@ func (r *artistReconciler) Reconcile(ctx context.Context, rt controller.Runtime,
 		Conditions:         conditions,
 	}
 
-	if proto.Equal(res.Status[statusKeyArtistController], newStatus) {
+	if resource.EqualStatus(res.Status[statusKeyArtistController], newStatus) {
 		return nil
 	}
 
diff --git a/internal/resource/equality.go b/internal/resource/equality.go
new file mode 100644
index 000000000000..100d4c7c95e2
--- /dev/null
+++ b/internal/resource/equality.go
@@ -0,0 +1,150 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package resource
+
+import "github.com/hashicorp/consul/proto-public/pbresource"
+
+// EqualType compares two resource types for equality without reflection.
+func EqualType(a, b *pbresource.Type) bool {
+	if a == b {
+		return true
+	}
+
+	if a == nil || b == nil {
+		return false
+	}
+
+	return a.Group == b.Group &&
+		a.GroupVersion == b.GroupVersion &&
+		a.Kind == b.Kind
+}
+
+// EqualType compares two resource tenancies for equality without reflection.
+func EqualTenancy(a, b *pbresource.Tenancy) bool {
+	if a == b {
+		return true
+	}
+
+	if a == nil || b == nil {
+		return false
+	}
+
+	return a.Partition == b.Partition &&
+		a.PeerName == b.PeerName &&
+		a.Namespace == b.Namespace
+}
+
+// EqualType compares two resource IDs for equality without reflection.
+func EqualID(a, b *pbresource.ID) bool {
+	if a == b {
+		return true
+	}
+
+	if a == nil || b == nil {
+		return false
+	}
+
+	return EqualType(a.Type, b.Type) &&
+		EqualTenancy(a.Tenancy, b.Tenancy) &&
+		a.Name == b.Name &&
+		a.Uid == b.Uid
+}
+
+// EqualStatus compares two statuses for equality without reflection.
+func EqualStatus(a, b *pbresource.Status) bool {
+	if a == b {
+		return true
+	}
+
+	if a == nil || b == nil {
+		return false
+	}
+
+	if a.ObservedGeneration != b.ObservedGeneration {
+		return false
+	}
+
+	if len(a.Conditions) != len(b.Conditions) {
+		return false
+	}
+
+	for i, ac := range a.Conditions {
+		bc := b.Conditions[i]
+
+		if !EqualCondition(ac, bc) {
+			return false
+		}
+	}
+
+	return true
+}
+
+// EqualCondition compares two conditions for equality without reflection.
+func EqualCondition(a, b *pbresource.Condition) bool {
+	if a == b {
+		return true
+	}
+
+	if a == nil || b == nil {
+		return false
+	}
+
+	return a.Type == b.Type &&
+		a.State == b.State &&
+		a.Reason == b.Reason &&
+		a.Message == b.Message &&
+		EqualReference(a.Resource, b.Resource)
+}
+
+// EqualReference compares two references for equality without reflection.
+func EqualReference(a, b *pbresource.Reference) bool {
+	if a == b {
+		return true
+	}
+
+	if a == nil || b == nil {
+		return false
+	}
+
+	return EqualType(a.Type, b.Type) &&
+		EqualTenancy(a.Tenancy, b.Tenancy) &&
+		a.Name == b.Name &&
+		a.Section == b.Section
+}
+
+// EqualStatusMap compares two status maps for equality without reflection.
+func EqualStatusMap(a, b map[string]*pbresource.Status) bool {
+	if len(a) != len(b) {
+		return false
+	}
+
+	compared := make(map[string]struct{})
+	for k, av := range a {
+		bv, ok := b[k]
+		if !ok {
+			return false
+		}
+		if !EqualStatus(av, bv) {
+			return false
+		}
+		compared[k] = struct{}{}
+	}
+
+	for k, bv := range b {
+		if _, skip := compared[k]; skip {
+			continue
+		}
+
+		av, ok := a[k]
+		if !ok {
+			return false
+		}
+
+		if !EqualStatus(av, bv) {
+			return false
+		}
+	}
+
+	return true
+}
diff --git a/internal/resource/equality_test.go b/internal/resource/equality_test.go
new file mode 100644
index 000000000000..45af9ea1801b
--- /dev/null
+++ b/internal/resource/equality_test.go
@@ -0,0 +1,629 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package resource_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/oklog/ulid/v2"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/hashicorp/consul/internal/resource"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+)
+
+func TestEqualType(t *testing.T) {
+	t.Run("same pointer", func(t *testing.T) {
+		typ := &pbresource.Type{
+			Group:        "foo",
+			GroupVersion: "v1",
+			Kind:         "bar",
+		}
+		require.True(t, resource.EqualType(typ, typ))
+	})
+
+	t.Run("equal", func(t *testing.T) {
+		a := &pbresource.Type{
+			Group:        "foo",
+			GroupVersion: "v1",
+			Kind:         "bar",
+		}
+		b := clone(a)
+		require.True(t, resource.EqualType(a, b))
+	})
+
+	t.Run("nil", func(t *testing.T) {
+		a := &pbresource.Type{
+			Group:        "foo",
+			GroupVersion: "v1",
+			Kind:         "bar",
+		}
+		require.False(t, resource.EqualType(a, nil))
+		require.False(t, resource.EqualType(nil, a))
+	})
+
+	t.Run("different Group", func(t *testing.T) {
+		a := &pbresource.Type{
+			Group:        "foo",
+			GroupVersion: "v1",
+			Kind:         "bar",
+		}
+		b := clone(a)
+		b.Group = "bar"
+		require.False(t, resource.EqualType(a, b))
+	})
+
+	t.Run("different GroupVersion", func(t *testing.T) {
+		a := &pbresource.Type{
+			Group:        "foo",
+			GroupVersion: "v1",
+			Kind:         "bar",
+		}
+		b := clone(a)
+		b.GroupVersion = "v2"
+		require.False(t, resource.EqualType(a, b))
+	})
+
+	t.Run("different Kind", func(t *testing.T) {
+		a := &pbresource.Type{
+			Group:        "foo",
+			GroupVersion: "v1",
+			Kind:         "bar",
+		}
+		b := clone(a)
+		b.Kind = "baz"
+		require.False(t, resource.EqualType(a, b))
+	})
+}
+
+func TestEqualTenancy(t *testing.T) {
+	t.Run("same pointer", func(t *testing.T) {
+		ten := &pbresource.Tenancy{
+			Partition: "foo",
+			PeerName:  "bar",
+			Namespace: "baz",
+		}
+		require.True(t, resource.EqualTenancy(ten, ten))
+	})
+
+	t.Run("equal", func(t *testing.T) {
+		a := &pbresource.Tenancy{
+			Partition: "foo",
+			PeerName:  "bar",
+			Namespace: "baz",
+		}
+		b := clone(a)
+		require.True(t, resource.EqualTenancy(a, b))
+	})
+
+	t.Run("nil", func(t *testing.T) {
+		a := &pbresource.Tenancy{
+			Partition: "foo",
+			PeerName:  "bar",
+			Namespace: "baz",
+		}
+		require.False(t, resource.EqualTenancy(a, nil))
+		require.False(t, resource.EqualTenancy(nil, a))
+	})
+
+	t.Run("different Partition", func(t *testing.T) {
+		a := &pbresource.Tenancy{
+			Partition: "foo",
+			PeerName:  "bar",
+			Namespace: "baz",
+		}
+		b := clone(a)
+		b.Partition = "qux"
+		require.False(t, resource.EqualTenancy(a, b))
+	})
+
+	t.Run("different PeerName", func(t *testing.T) {
+		a := &pbresource.Tenancy{
+			Partition: "foo",
+			PeerName:  "bar",
+			Namespace: "baz",
+		}
+		b := clone(a)
+		b.PeerName = "qux"
+		require.False(t, resource.EqualTenancy(a, b))
+	})
+
+	t.Run("different Namespace", func(t *testing.T) {
+		a := &pbresource.Tenancy{
+			Partition: "foo",
+			PeerName:  "bar",
+			Namespace: "baz",
+		}
+		b := clone(a)
+		b.Namespace = "qux"
+		require.False(t, resource.EqualTenancy(a, b))
+	})
+}
+
+func TestEqualID(t *testing.T) {
+	t.Run("same pointer", func(t *testing.T) {
+		id := &pbresource.ID{
+			Type: &pbresource.Type{
+				Group:        "demo",
+				GroupVersion: "v2",
+				Kind:         "artist",
+			},
+			Tenancy: &pbresource.Tenancy{
+				Partition: "foo",
+				PeerName:  "bar",
+				Namespace: "baz",
+			},
+			Name: "qux",
+			Uid:  ulid.Make().String(),
+		}
+		require.True(t, resource.EqualID(id, id))
+	})
+
+	t.Run("equal", func(t *testing.T) {
+		a := &pbresource.ID{
+			Type: &pbresource.Type{
+				Group:        "demo",
+				GroupVersion: "v2",
+				Kind:         "artist",
+			},
+			Tenancy: &pbresource.Tenancy{
+				Partition: "foo",
+				PeerName:  "bar",
+				Namespace: "baz",
+			},
+			Name: "qux",
+			Uid:  ulid.Make().String(),
+		}
+		b := clone(a)
+		require.True(t, resource.EqualID(a, b))
+	})
+
+	t.Run("nil", func(t *testing.T) {
+		a := &pbresource.ID{
+			Type: &pbresource.Type{
+				Group:        "demo",
+				GroupVersion: "v2",
+				Kind:         "artist",
+			},
+			Tenancy: &pbresource.Tenancy{
+				Partition: "foo",
+				PeerName:  "bar",
+				Namespace: "baz",
+			},
+			Name: "qux",
+			Uid:  ulid.Make().String(),
+		}
+		require.False(t, resource.EqualID(a, nil))
+		require.False(t, resource.EqualID(nil, a))
+	})
+
+	t.Run("different type", func(t *testing.T) {
+		a := &pbresource.ID{
+			Type: &pbresource.Type{
+				Group:        "demo",
+				GroupVersion: "v2",
+				Kind:         "artist",
+			},
+			Tenancy: &pbresource.Tenancy{
+				Partition: "foo",
+				PeerName:  "bar",
+				Namespace: "baz",
+			},
+			Name: "qux",
+			Uid:  ulid.Make().String(),
+		}
+		b := clone(a)
+		b.Type.Kind = "album"
+		require.False(t, resource.EqualID(a, b))
+	})
+
+	t.Run("different tenancy", func(t *testing.T) {
+		a := &pbresource.ID{
+			Type: &pbresource.Type{
+				Group:        "demo",
+				GroupVersion: "v2",
+				Kind:         "artist",
+			},
+			Tenancy: &pbresource.Tenancy{
+				Partition: "foo",
+				PeerName:  "bar",
+				Namespace: "baz",
+			},
+			Name: "qux",
+			Uid:  ulid.Make().String(),
+		}
+		b := clone(a)
+		b.Tenancy.Namespace = "qux"
+		require.False(t, resource.EqualID(a, b))
+	})
+
+	t.Run("different name", func(t *testing.T) {
+		a := &pbresource.ID{
+			Type: &pbresource.Type{
+				Group:        "demo",
+				GroupVersion: "v2",
+				Kind:         "artist",
+			},
+			Tenancy: &pbresource.Tenancy{
+				Partition: "foo",
+				PeerName:  "bar",
+				Namespace: "baz",
+			},
+			Name: "qux",
+			Uid:  ulid.Make().String(),
+		}
+		b := clone(a)
+		b.Name = "boom"
+		require.False(t, resource.EqualID(a, b))
+	})
+
+	t.Run("different uid", func(t *testing.T) {
+		a := &pbresource.ID{
+			Type: &pbresource.Type{
+				Group:        "demo",
+				GroupVersion: "v2",
+				Kind:         "artist",
+			},
+			Tenancy: &pbresource.Tenancy{
+				Partition: "foo",
+				PeerName:  "bar",
+				Namespace: "baz",
+			},
+			Name: "qux",
+			Uid:  ulid.Make().String(),
+		}
+		b := clone(a)
+		b.Uid = ulid.Make().String()
+		require.False(t, resource.EqualID(a, b))
+	})
+}
+
+func TestEqualStatus(t *testing.T) {
+	orig := &pbresource.Status{
+		ObservedGeneration: ulid.Make().String(),
+		Conditions: []*pbresource.Condition{
+			{
+				Type:    "FooType",
+				State:   pbresource.Condition_STATE_TRUE,
+				Reason:  "FooReason",
+				Message: "Foo is true",
+				Resource: &pbresource.Reference{
+					Type: &pbresource.Type{
+						Group:        "foo-group",
+						GroupVersion: "foo-group-version",
+						Kind:         "foo-kind",
+					},
+					Tenancy: &pbresource.Tenancy{
+						Partition: "foo-partition",
+						PeerName:  "foo-peer-name",
+						Namespace: "foo-namespace",
+					},
+					Name:    "foo-name",
+					Section: "foo-section",
+				},
+			},
+		},
+	}
+
+	// Equal cases.
+	t.Run("same pointer", func(t *testing.T) {
+		require.True(t, resource.EqualStatus(orig, orig))
+	})
+
+	t.Run("equal", func(t *testing.T) {
+		require.True(t, resource.EqualStatus(orig, clone(orig)))
+	})
+
+	// Not equal cases.
+	t.Run("nil", func(t *testing.T) {
+		require.False(t, resource.EqualStatus(orig, nil))
+		require.False(t, resource.EqualStatus(nil, orig))
+	})
+
+	testCases := map[string]func(*pbresource.Status){
+		"different ObservedGeneration": func(s *pbresource.Status) {
+			s.ObservedGeneration = ""
+		},
+		"different Conditions": func(s *pbresource.Status) {
+			s.Conditions = append(s.Conditions, s.Conditions...)
+		},
+		"nil Condition": func(s *pbresource.Status) {
+			s.Conditions[0] = nil
+		},
+		"different Condition.Type": func(s *pbresource.Status) {
+			s.Conditions[0].Type = "BarType"
+		},
+		"different Condition.State": func(s *pbresource.Status) {
+			s.Conditions[0].State = pbresource.Condition_STATE_FALSE
+		},
+		"different Condition.Reason": func(s *pbresource.Status) {
+			s.Conditions[0].Reason = "BarReason"
+		},
+		"different Condition.Message": func(s *pbresource.Status) {
+			s.Conditions[0].Reason = "Bar if false"
+		},
+		"different Condition.Resource": func(s *pbresource.Status) {
+			s.Conditions[0].Resource = nil
+		},
+		"different Condition.Resource.Type": func(s *pbresource.Status) {
+			s.Conditions[0].Resource.Type.Group = "bar-group"
+		},
+		"different Condition.Resource.Tenancy": func(s *pbresource.Status) {
+			s.Conditions[0].Resource.Tenancy.Partition = "bar-partition"
+		},
+		"different Condition.Resource.Name": func(s *pbresource.Status) {
+			s.Conditions[0].Resource.Name = "bar-name"
+		},
+		"different Condition.Resource.Section": func(s *pbresource.Status) {
+			s.Conditions[0].Resource.Section = "bar-section"
+		},
+	}
+	for desc, modFn := range testCases {
+		t.Run(desc, func(t *testing.T) {
+			a, b := clone(orig), clone(orig)
+			modFn(b)
+
+			require.False(t, resource.EqualStatus(a, b))
+			require.False(t, resource.EqualStatus(b, a))
+		})
+	}
+}
+
+func TestEqualStatusMap(t *testing.T) {
+	generation := ulid.Make().String()
+
+	for idx, tc := range []struct {
+		a, b  map[string]*pbresource.Status
+		equal bool
+	}{
+		{nil, nil, true},
+		{nil, map[string]*pbresource.Status{}, true},
+		{
+			map[string]*pbresource.Status{
+				"consul.io/some-controller": {
+					ObservedGeneration: generation,
+					Conditions: []*pbresource.Condition{
+						{
+							Type:    "Foo",
+							State:   pbresource.Condition_STATE_TRUE,
+							Reason:  "Bar",
+							Message: "Foo is true because of Bar",
+						},
+					},
+				},
+			},
+			map[string]*pbresource.Status{
+				"consul.io/some-controller": {
+					ObservedGeneration: generation,
+					Conditions: []*pbresource.Condition{
+						{
+							Type:    "Foo",
+							State:   pbresource.Condition_STATE_TRUE,
+							Reason:  "Bar",
+							Message: "Foo is true because of Bar",
+						},
+					},
+				},
+			},
+			true,
+		},
+		{
+			map[string]*pbresource.Status{
+				"consul.io/some-controller": {
+					ObservedGeneration: generation,
+					Conditions: []*pbresource.Condition{
+						{
+							Type:    "Foo",
+							State:   pbresource.Condition_STATE_TRUE,
+							Reason:  "Bar",
+							Message: "Foo is true because of Bar",
+						},
+					},
+				},
+			},
+			map[string]*pbresource.Status{
+				"consul.io/some-controller": {
+					ObservedGeneration: generation,
+					Conditions: []*pbresource.Condition{
+						{
+							Type:    "Foo",
+							State:   pbresource.Condition_STATE_FALSE,
+							Reason:  "Bar",
+							Message: "Foo is false because of Bar",
+						},
+					},
+				},
+			},
+			false,
+		},
+		{
+			map[string]*pbresource.Status{
+				"consul.io/some-controller": {
+					ObservedGeneration: generation,
+					Conditions: []*pbresource.Condition{
+						{
+							Type:    "Foo",
+							State:   pbresource.Condition_STATE_TRUE,
+							Reason:  "Bar",
+							Message: "Foo is true because of Bar",
+						},
+					},
+				},
+			},
+			map[string]*pbresource.Status{
+				"consul.io/some-controller": {
+					ObservedGeneration: generation,
+					Conditions: []*pbresource.Condition{
+						{
+							Type:    "Foo",
+							State:   pbresource.Condition_STATE_TRUE,
+							Reason:  "Bar",
+							Message: "Foo is true because of Bar",
+						},
+					},
+				},
+				"consul.io/other-controller": {
+					ObservedGeneration: generation,
+					Conditions: []*pbresource.Condition{
+						{
+							Type:    "Foo",
+							State:   pbresource.Condition_STATE_TRUE,
+							Reason:  "Bar",
+							Message: "Foo is true because of Bar",
+						},
+					},
+				},
+			},
+			false,
+		},
+	} {
+		t.Run(fmt.Sprintf("%d", idx), func(t *testing.T) {
+			require.Equal(t, tc.equal, resource.EqualStatusMap(tc.a, tc.b))
+			require.Equal(t, tc.equal, resource.EqualStatusMap(tc.b, tc.a))
+		})
+	}
+}
+
+func BenchmarkEqualType(b *testing.B) {
+	// cpu: Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz
+	// BenchmarkEqualType/ours-16      161532109                7.309 ns/op          0 B/op           0 allocs/op
+	// BenchmarkEqualType/reflection-16                 1584954               748.4 ns/op           160 B/op          9 allocs/op
+	typeA := &pbresource.Type{
+		Group:        "foo",
+		GroupVersion: "v1",
+		Kind:         "bar",
+	}
+	typeB := &pbresource.Type{
+		Group:        "foo",
+		GroupVersion: "v1",
+		Kind:         "baz",
+	}
+	b.ResetTimer()
+
+	b.Run("ours", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			_ = resource.EqualType(typeA, typeB)
+		}
+	})
+
+	b.Run("reflection", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			_ = proto.Equal(typeA, typeB)
+		}
+	})
+}
+
+func BenchmarkEqualTenancy(b *testing.B) {
+	// cpu: Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz
+	// BenchmarkEqualTenancy/ours-16                   159998534                7.426 ns/op           0 B/op          0 allocs/op
+	// BenchmarkEqualTenancy/reflection-16              2283500               550.3 ns/op           128 B/op          7 allocs/op
+	tenA := &pbresource.Tenancy{
+		Partition: "foo",
+		PeerName:  "bar",
+		Namespace: "baz",
+	}
+	tenB := &pbresource.Tenancy{
+		Partition: "foo",
+		PeerName:  "bar",
+		Namespace: "qux",
+	}
+	b.ResetTimer()
+
+	b.Run("ours", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			_ = resource.EqualTenancy(tenA, tenB)
+		}
+	})
+
+	b.Run("reflection", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			_ = proto.Equal(tenA, tenB)
+		}
+	})
+}
+
+func BenchmarkEqualID(b *testing.B) {
+	// cpu: Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz
+	// BenchmarkEqualID/ours-16                        57818125                21.40 ns/op            0 B/op          0 allocs/op
+	// BenchmarkEqualID/reflection-16                   3596365               330.1 ns/op            96 B/op          5 allocs/op
+	idA := &pbresource.ID{
+		Type: &pbresource.Type{
+			Group:        "demo",
+			GroupVersion: "v2",
+			Kind:         "artist",
+		},
+		Tenancy: &pbresource.Tenancy{
+			Partition: "foo",
+			PeerName:  "bar",
+			Namespace: "baz",
+		},
+		Name: "qux",
+		Uid:  ulid.Make().String(),
+	}
+	idB := clone(idA)
+	idB.Uid = ulid.Make().String()
+	b.ResetTimer()
+
+	b.Run("ours", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			_ = resource.EqualID(idA, idB)
+		}
+	})
+
+	b.Run("reflection", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			_ = proto.Equal(idA, idB)
+		}
+	})
+}
+
+func BenchmarkEqualStatus(b *testing.B) {
+	// 	cpu: Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz
+	// BenchmarkEqualStatus/ours-16                    38648232                30.75 ns/op            0 B/op          0 allocs/op
+	// BenchmarkEqualStatus/reflection-16                237694              5267 ns/op             944 B/op         51 allocs/op
+	statusA := &pbresource.Status{
+		ObservedGeneration: ulid.Make().String(),
+		Conditions: []*pbresource.Condition{
+			{
+				Type:    "FooType",
+				State:   pbresource.Condition_STATE_TRUE,
+				Reason:  "FooReason",
+				Message: "Foo is true",
+				Resource: &pbresource.Reference{
+					Type: &pbresource.Type{
+						Group:        "foo-group",
+						GroupVersion: "foo-group-version",
+						Kind:         "foo-kind",
+					},
+					Tenancy: &pbresource.Tenancy{
+						Partition: "foo-partition",
+						PeerName:  "foo-peer-name",
+						Namespace: "foo-namespace",
+					},
+					Name:    "foo-name",
+					Section: "foo-section",
+				},
+			},
+		},
+	}
+	statusB := clone(statusA)
+	statusB.Conditions[0].Resource.Section = "bar-section"
+	b.ResetTimer()
+
+	b.Run("ours", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			_ = resource.EqualStatus(statusA, statusB)
+		}
+	})
+
+	b.Run("reflection", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			_ = proto.Equal(statusA, statusB)
+		}
+	})
+}
+
+func clone[T proto.Message](v T) T { return proto.Clone(v).(T) }
diff --git a/internal/resource/status.go b/internal/resource/status.go
deleted file mode 100644
index 89979b9f6080..000000000000
--- a/internal/resource/status.go
+++ /dev/null
@@ -1,46 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package resource
-
-import (
-	"google.golang.org/protobuf/proto"
-
-	"github.com/hashicorp/consul/proto-public/pbresource"
-)
-
-// EqualStatus compares two status maps for equality.
-func EqualStatus(a, b map[string]*pbresource.Status) bool {
-	if len(a) != len(b) {
-		return false
-	}
-
-	compared := make(map[string]struct{})
-	for k, av := range a {
-		bv, ok := b[k]
-		if !ok {
-			return false
-		}
-		if !proto.Equal(av, bv) {
-			return false
-		}
-		compared[k] = struct{}{}
-	}
-
-	for k, bv := range b {
-		if _, skip := compared[k]; skip {
-			continue
-		}
-
-		av, ok := a[k]
-		if !ok {
-			return false
-		}
-
-		if !proto.Equal(av, bv) {
-			return false
-		}
-	}
-
-	return true
-}
diff --git a/internal/resource/status_test.go b/internal/resource/status_test.go
deleted file mode 100644
index 39d69ff03f2f..000000000000
--- a/internal/resource/status_test.go
+++ /dev/null
@@ -1,129 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package resource
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/oklog/ulid/v2"
-	"github.com/stretchr/testify/require"
-
-	"github.com/hashicorp/consul/proto-public/pbresource"
-)
-
-func TestEqualStatus(t *testing.T) {
-	generation := ulid.Make().String()
-
-	for idx, tc := range []struct {
-		a, b  map[string]*pbresource.Status
-		equal bool
-	}{
-		{nil, nil, true},
-		{nil, map[string]*pbresource.Status{}, true},
-		{
-			map[string]*pbresource.Status{
-				"consul.io/some-controller": {
-					ObservedGeneration: generation,
-					Conditions: []*pbresource.Condition{
-						{
-							Type:    "Foo",
-							State:   pbresource.Condition_STATE_TRUE,
-							Reason:  "Bar",
-							Message: "Foo is true because of Bar",
-						},
-					},
-				},
-			},
-			map[string]*pbresource.Status{
-				"consul.io/some-controller": {
-					ObservedGeneration: generation,
-					Conditions: []*pbresource.Condition{
-						{
-							Type:    "Foo",
-							State:   pbresource.Condition_STATE_TRUE,
-							Reason:  "Bar",
-							Message: "Foo is true because of Bar",
-						},
-					},
-				},
-			},
-			true,
-		},
-		{
-			map[string]*pbresource.Status{
-				"consul.io/some-controller": {
-					ObservedGeneration: generation,
-					Conditions: []*pbresource.Condition{
-						{
-							Type:    "Foo",
-							State:   pbresource.Condition_STATE_TRUE,
-							Reason:  "Bar",
-							Message: "Foo is true because of Bar",
-						},
-					},
-				},
-			},
-			map[string]*pbresource.Status{
-				"consul.io/some-controller": {
-					ObservedGeneration: generation,
-					Conditions: []*pbresource.Condition{
-						{
-							Type:    "Foo",
-							State:   pbresource.Condition_STATE_FALSE,
-							Reason:  "Bar",
-							Message: "Foo is false because of Bar",
-						},
-					},
-				},
-			},
-			false,
-		},
-		{
-			map[string]*pbresource.Status{
-				"consul.io/some-controller": {
-					ObservedGeneration: generation,
-					Conditions: []*pbresource.Condition{
-						{
-							Type:    "Foo",
-							State:   pbresource.Condition_STATE_TRUE,
-							Reason:  "Bar",
-							Message: "Foo is true because of Bar",
-						},
-					},
-				},
-			},
-			map[string]*pbresource.Status{
-				"consul.io/some-controller": {
-					ObservedGeneration: generation,
-					Conditions: []*pbresource.Condition{
-						{
-							Type:    "Foo",
-							State:   pbresource.Condition_STATE_TRUE,
-							Reason:  "Bar",
-							Message: "Foo is true because of Bar",
-						},
-					},
-				},
-				"consul.io/other-controller": {
-					ObservedGeneration: generation,
-					Conditions: []*pbresource.Condition{
-						{
-							Type:    "Foo",
-							State:   pbresource.Condition_STATE_TRUE,
-							Reason:  "Bar",
-							Message: "Foo is true because of Bar",
-						},
-					},
-				},
-			},
-			false,
-		},
-	} {
-		t.Run(fmt.Sprintf("%d", idx), func(t *testing.T) {
-			require.Equal(t, tc.equal, EqualStatus(tc.a, tc.b))
-			require.Equal(t, tc.equal, EqualStatus(tc.b, tc.a))
-		})
-	}
-}

From 7c3e9cd86211e8e513198ce00c5f5644cbc54844 Mon Sep 17 00:00:00 2001
From: Freddy <freddygv@users.noreply.github.com>
Date: Tue, 9 May 2023 12:20:26 -0600
Subject: [PATCH 60/92] Hash namespace+proxy ID when creating socket path
 (#17204)

UNIX domain socket paths are limited to 104-108 characters, depending on
the OS. This limit was quite easy to exceed when testing the feature on
Kubernetes, due to how proxy IDs encode the Pod ID eg:
metrics-collector-59467bcb9b-fkkzl-hcp-metrics-collector-sidecar-proxy

To ensure we stay under that character limit this commit makes a
couple changes:
- Use a b64 encoded SHA1 hash of the namespace + proxy ID to create a
  short and deterministic socket file name.
- Add validation to proxy registrations and proxy-defaults to enforce a
  limit on the socket directory length.
---
 agent/proxycfg/connect_proxy.go               |  12 +-
 agent/proxycfg/state_test.go                  |   2 +-
 agent/structs/config_entry.go                 |  15 ++
 agent/structs/config_entry_test.go            |  39 ++++
 agent/structs/structs.go                      |   4 +
 agent/structs/structs_test.go                 |  10 +
 .../listeners/hcp-metrics.latest.golden       | 204 +++++++++---------
 command/connect/envoy/bootstrap_config.go     |  26 ++-
 .../connect/envoy/bootstrap_config_test.go    |   4 +-
 .../connect/envoy/testdata/hcp-metrics.golden |   2 +-
 10 files changed, 205 insertions(+), 113 deletions(-)

diff --git a/agent/proxycfg/connect_proxy.go b/agent/proxycfg/connect_proxy.go
index f9c46103a094..873f942ba407 100644
--- a/agent/proxycfg/connect_proxy.go
+++ b/agent/proxycfg/connect_proxy.go
@@ -5,6 +5,8 @@ package proxycfg
 
 import (
 	"context"
+	"crypto/sha1"
+	"encoding/base64"
 	"fmt"
 	"path"
 	"strings"
@@ -660,8 +662,14 @@ func (s *handlerConnectProxy) maybeInitializeHCPMetricsWatches(ctx context.Conte
 
 	// The path includes the proxy ID so that when multiple proxies are on the same host
 	// they each have a distinct path to send their metrics.
-	sock := fmt.Sprintf("%s_%s.sock", s.proxyID.NamespaceOrDefault(), s.proxyID.ID)
-	path := path.Join(hcpCfg.HCPMetricsBindSocketDir, sock)
+	id := s.proxyID.NamespaceOrDefault() + "_" + s.proxyID.ID
+
+	// UNIX domain sockets paths have a max length of 108, so we take a hash of the compound ID
+	// to limit the length of the socket path.
+	h := sha1.New()
+	h.Write([]byte(id))
+	hash := base64.RawURLEncoding.EncodeToString(h.Sum(nil))
+	path := path.Join(hcpCfg.HCPMetricsBindSocketDir, hash+".sock")
 
 	upstream := structs.Upstream{
 		DestinationNamespace: acl.DefaultNamespaceName,
diff --git a/agent/proxycfg/state_test.go b/agent/proxycfg/state_test.go
index 792367b473be..f8760a5e11a3 100644
--- a/agent/proxycfg/state_test.go
+++ b/agent/proxycfg/state_test.go
@@ -3722,7 +3722,7 @@ func TestState_WatchesAndUpdates(t *testing.T) {
 							DestinationNamespace: "default",
 							DestinationPartition: "default",
 							DestinationName:      apimod.HCPMetricsCollectorName,
-							LocalBindSocketPath:  "/tmp/consul/hcp-metrics/default_web-sidecar-proxy.sock",
+							LocalBindSocketPath:  "/tmp/consul/hcp-metrics/gqmuzdHCUPAEY5mbF8vgkZCNI14.sock",
 							Config: map[string]interface{}{
 								"protocol": "grpc",
 							},
diff --git a/agent/structs/config_entry.go b/agent/structs/config_entry.go
index dd6671268e0d..c18a8013b6d4 100644
--- a/agent/structs/config_entry.go
+++ b/agent/structs/config_entry.go
@@ -468,6 +468,10 @@ func (e *ProxyConfigEntry) Validate() error {
 		return err
 	}
 
+	if err := validateOpaqueProxyConfig(e.Config); err != nil {
+		return fmt.Errorf("Config: %w", err)
+	}
+
 	if err := envoyextensions.ValidateExtensions(e.EnvoyExtensions.ToAPI()); err != nil {
 		return err
 	}
@@ -1329,6 +1333,17 @@ func (c *ConfigEntryResponse) UnmarshalBinary(data []byte) error {
 	return nil
 }
 
+func validateOpaqueProxyConfig(config map[string]interface{}) error {
+	// This max is chosen to stay under the 104 character limit on OpenBSD, FreeBSD, MacOS.
+	// It assumes the socket's filename is fixed at 32 characters.
+	const maxSocketDirLen = 70
+
+	if path, _ := config["envoy_hcp_metrics_bind_socket_dir"].(string); len(path) > maxSocketDirLen {
+		return fmt.Errorf("envoy_hcp_metrics_bind_socket_dir length %d exceeds max %d", len(path), maxSocketDirLen)
+	}
+	return nil
+}
+
 func validateConfigEntryMeta(meta map[string]string) error {
 	var err error
 	if len(meta) > metaMaxKeyPairs {
diff --git a/agent/structs/config_entry_test.go b/agent/structs/config_entry_test.go
index b7fad39a37a5..9143dc05d993 100644
--- a/agent/structs/config_entry_test.go
+++ b/agent/structs/config_entry_test.go
@@ -3261,6 +3261,15 @@ func TestProxyConfigEntry(t *testing.T) {
 				EnterpriseMeta: *acl.DefaultEnterpriseMeta(),
 			},
 		},
+		"proxy config entry has invalid opaque config": {
+			entry: &ProxyConfigEntry{
+				Name: "global",
+				Config: map[string]interface{}{
+					"envoy_hcp_metrics_bind_socket_dir": "/Consul/is/a/networking/platform/that/enables/securing/your/networking/",
+				},
+			},
+			validateErr: "Config: envoy_hcp_metrics_bind_socket_dir length 71 exceeds max",
+		},
 		"proxy config has invalid failover policy": {
 			entry: &ProxyConfigEntry{
 				Name:           "global",
@@ -3445,3 +3454,33 @@ func uintPointer(v uint32) *uint32 {
 func durationPointer(d time.Duration) *time.Duration {
 	return &d
 }
+
+func TestValidateOpaqueConfigMap(t *testing.T) {
+	tt := map[string]struct {
+		input     map[string]interface{}
+		expectErr string
+	}{
+		"hcp metrics socket dir is valid": {
+			input: map[string]interface{}{
+				"envoy_hcp_metrics_bind_socket_dir": "/etc/consul.d/hcp"},
+			expectErr: "",
+		},
+		"hcp metrics socket dir is too long": {
+			input: map[string]interface{}{
+				"envoy_hcp_metrics_bind_socket_dir": "/Consul/is/a/networking/platform/that/enables/securing/your/networking/",
+			},
+			expectErr: "envoy_hcp_metrics_bind_socket_dir length 71 exceeds max 70",
+		},
+	}
+
+	for name, tc := range tt {
+		t.Run(name, func(t *testing.T) {
+			err := validateOpaqueProxyConfig(tc.input)
+			if tc.expectErr != "" {
+				require.ErrorContains(t, err, tc.expectErr)
+				return
+			}
+			require.NoError(t, err)
+		})
+	}
+}
diff --git a/agent/structs/structs.go b/agent/structs/structs.go
index 3e12999e7baf..1771b18be03b 100644
--- a/agent/structs/structs.go
+++ b/agent/structs/structs.go
@@ -1508,6 +1508,10 @@ func (s *NodeService) ValidateForAgent() error {
 				"A Proxy cannot also be Connect Native, only typical services"))
 		}
 
+		if err := validateOpaqueProxyConfig(s.Proxy.Config); err != nil {
+			result = multierror.Append(result, fmt.Errorf("Proxy.Config: %w", err))
+		}
+
 		// ensure we don't have multiple upstreams for the same service
 		var (
 			upstreamKeys = make(map[UpstreamKey]struct{})
diff --git a/agent/structs/structs_test.go b/agent/structs/structs_test.go
index 49861f86c29c..6d887da9ac77 100644
--- a/agent/structs/structs_test.go
+++ b/agent/structs/structs_test.go
@@ -826,6 +826,16 @@ func TestStructs_NodeService_ValidateConnectProxy(t *testing.T) {
 			"",
 		},
 
+		{
+			"connect-proxy: invalid opaque config",
+			func(x *NodeService) {
+				x.Proxy.Config = map[string]interface{}{
+					"envoy_hcp_metrics_bind_socket_dir": "/Consul/is/a/networking/platform/that/enables/securing/your/networking/",
+				}
+			},
+			"Proxy.Config: envoy_hcp_metrics_bind_socket_dir length 71 exceeds max",
+		},
+
 		{
 			"connect-proxy: no Proxy.DestinationServiceName",
 			func(x *NodeService) { x.Proxy.DestinationServiceName = "" },
diff --git a/agent/xds/testdata/listeners/hcp-metrics.latest.golden b/agent/xds/testdata/listeners/hcp-metrics.latest.golden
index d89036a935cb..c1e0d04734a3 100644
--- a/agent/xds/testdata/listeners/hcp-metrics.latest.golden
+++ b/agent/xds/testdata/listeners/hcp-metrics.latest.golden
@@ -1,184 +1,184 @@
 {
-  "versionInfo": "00000001",
-  "resources": [
+  "versionInfo":  "00000001",
+  "resources":  [
     {
-      "@type": "type.googleapis.com/envoy.config.listener.v3.Listener",
-      "name": "db:127.0.0.1:9191",
-      "address": {
-        "socketAddress": {
-          "address": "127.0.0.1",
-          "portValue": 9191
+      "@type":  "type.googleapis.com/envoy.config.listener.v3.Listener",
+      "name":  "db:127.0.0.1:9191",
+      "address":  {
+        "socketAddress":  {
+          "address":  "127.0.0.1",
+          "portValue":  9191
         }
       },
-      "filterChains": [
+      "filterChains":  [
         {
-          "filters": [
+          "filters":  [
             {
-              "name": "envoy.filters.network.tcp_proxy",
-              "typedConfig": {
-                "@type": "type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy",
-                "statPrefix": "upstream.db.default.default.dc1",
-                "cluster": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
+              "name":  "envoy.filters.network.tcp_proxy",
+              "typedConfig":  {
+                "@type":  "type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy",
+                "statPrefix":  "upstream.db.default.default.dc1",
+                "cluster":  "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
               }
             }
           ]
         }
       ],
-      "trafficDirection": "OUTBOUND"
+      "trafficDirection":  "OUTBOUND"
     },
     {
-      "@type": "type.googleapis.com/envoy.config.listener.v3.Listener",
-      "name": "hcp-metrics-collector:/tmp/consul/hcp-metrics/default_web-sidecar-proxy.sock",
-      "address": {
-        "pipe": {
-          "path": "/tmp/consul/hcp-metrics/default_web-sidecar-proxy.sock"
+      "@type":  "type.googleapis.com/envoy.config.listener.v3.Listener",
+      "name":  "hcp-metrics-collector:/tmp/consul/hcp-metrics/gqmuzdHCUPAEY5mbF8vgkZCNI14.sock",
+      "address":  {
+        "pipe":  {
+          "path":  "/tmp/consul/hcp-metrics/gqmuzdHCUPAEY5mbF8vgkZCNI14.sock"
         }
       },
-      "filterChains": [
+      "filterChains":  [
         {
-          "filters": [
+          "filters":  [
             {
-              "name": "envoy.filters.network.http_connection_manager",
-              "typedConfig": {
-                "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
-                "statPrefix": "upstream.hcp-metrics-collector.default.default.dc1",
-                "routeConfig": {
-                  "name": "hcp-metrics-collector",
-                  "virtualHosts": [
+              "name":  "envoy.filters.network.http_connection_manager",
+              "typedConfig":  {
+                "@type":  "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
+                "statPrefix":  "upstream.hcp-metrics-collector.default.default.dc1",
+                "routeConfig":  {
+                  "name":  "hcp-metrics-collector",
+                  "virtualHosts":  [
                     {
-                      "name": "hcp-metrics-collector.default.default.dc1",
-                      "domains": [
+                      "name":  "hcp-metrics-collector.default.default.dc1",
+                      "domains":  [
                         "*"
                       ],
-                      "routes": [
+                      "routes":  [
                         {
-                          "match": {
-                            "prefix": "/"
+                          "match":  {
+                            "prefix":  "/"
                           },
-                          "route": {
-                            "cluster": "hcp-metrics-collector.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
+                          "route":  {
+                            "cluster":  "hcp-metrics-collector.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
                           }
                         }
                       ]
                     }
                   ]
                 },
-                "httpFilters": [
+                "httpFilters":  [
                   {
-                    "name": "envoy.filters.http.grpc_stats",
-                    "typedConfig": {
-                      "@type": "type.googleapis.com/envoy.extensions.filters.http.grpc_stats.v3.FilterConfig",
-                      "statsForAllMethods": true
+                    "name":  "envoy.filters.http.grpc_stats",
+                    "typedConfig":  {
+                      "@type":  "type.googleapis.com/envoy.extensions.filters.http.grpc_stats.v3.FilterConfig",
+                      "statsForAllMethods":  true
                     }
                   },
                   {
-                    "name": "envoy.filters.http.grpc_http1_bridge",
-                    "typedConfig": {
-                      "@type": "type.googleapis.com/envoy.extensions.filters.http.grpc_http1_bridge.v3.Config"
+                    "name":  "envoy.filters.http.grpc_http1_bridge",
+                    "typedConfig":  {
+                      "@type":  "type.googleapis.com/envoy.extensions.filters.http.grpc_http1_bridge.v3.Config"
                     }
                   },
                   {
-                    "name": "envoy.filters.http.router",
-                    "typedConfig": {
-                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    "name":  "envoy.filters.http.router",
+                    "typedConfig":  {
+                      "@type":  "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
                     }
                   }
                 ],
-                "tracing": {
-                  "randomSampling": {}
+                "tracing":  {
+                  "randomSampling":  {}
                 },
-                "http2ProtocolOptions": {}
+                "http2ProtocolOptions":  {}
               }
             }
           ]
         }
       ],
-      "trafficDirection": "OUTBOUND"
+      "trafficDirection":  "OUTBOUND"
     },
     {
-      "@type": "type.googleapis.com/envoy.config.listener.v3.Listener",
-      "name": "prepared_query:geo-cache:127.10.10.10:8181",
-      "address": {
-        "socketAddress": {
-          "address": "127.10.10.10",
-          "portValue": 8181
+      "@type":  "type.googleapis.com/envoy.config.listener.v3.Listener",
+      "name":  "prepared_query:geo-cache:127.10.10.10:8181",
+      "address":  {
+        "socketAddress":  {
+          "address":  "127.10.10.10",
+          "portValue":  8181
         }
       },
-      "filterChains": [
+      "filterChains":  [
         {
-          "filters": [
+          "filters":  [
             {
-              "name": "envoy.filters.network.tcp_proxy",
-              "typedConfig": {
-                "@type": "type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy",
-                "statPrefix": "upstream.prepared_query_geo-cache",
-                "cluster": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
+              "name":  "envoy.filters.network.tcp_proxy",
+              "typedConfig":  {
+                "@type":  "type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy",
+                "statPrefix":  "upstream.prepared_query_geo-cache",
+                "cluster":  "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
               }
             }
           ]
         }
       ],
-      "trafficDirection": "OUTBOUND"
+      "trafficDirection":  "OUTBOUND"
     },
     {
-      "@type": "type.googleapis.com/envoy.config.listener.v3.Listener",
-      "name": "public_listener:0.0.0.0:9999",
-      "address": {
-        "socketAddress": {
-          "address": "0.0.0.0",
-          "portValue": 9999
+      "@type":  "type.googleapis.com/envoy.config.listener.v3.Listener",
+      "name":  "public_listener:0.0.0.0:9999",
+      "address":  {
+        "socketAddress":  {
+          "address":  "0.0.0.0",
+          "portValue":  9999
         }
       },
-      "filterChains": [
+      "filterChains":  [
         {
-          "filters": [
+          "filters":  [
             {
-              "name": "envoy.filters.network.rbac",
-              "typedConfig": {
-                "@type": "type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC",
-                "rules": {},
-                "statPrefix": "connect_authz"
+              "name":  "envoy.filters.network.rbac",
+              "typedConfig":  {
+                "@type":  "type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC",
+                "rules":  {},
+                "statPrefix":  "connect_authz"
               }
             },
             {
-              "name": "envoy.filters.network.tcp_proxy",
-              "typedConfig": {
-                "@type": "type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy",
-                "statPrefix": "public_listener",
-                "cluster": "local_app"
+              "name":  "envoy.filters.network.tcp_proxy",
+              "typedConfig":  {
+                "@type":  "type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy",
+                "statPrefix":  "public_listener",
+                "cluster":  "local_app"
               }
             }
           ],
-          "transportSocket": {
-            "name": "tls",
-            "typedConfig": {
-              "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext",
-              "commonTlsContext": {
-                "tlsParams": {},
-                "tlsCertificates": [
+          "transportSocket":  {
+            "name":  "tls",
+            "typedConfig":  {
+              "@type":  "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext",
+              "commonTlsContext":  {
+                "tlsParams":  {},
+                "tlsCertificates":  [
                   {
-                    "certificateChain": {
-                      "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
+                    "certificateChain":  {
+                      "inlineString":  "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
                     },
-                    "privateKey": {
-                      "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
+                    "privateKey":  {
+                      "inlineString":  "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
                     }
                   }
                 ],
-                "validationContext": {
-                  "trustedCa": {
-                    "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
+                "validationContext":  {
+                  "trustedCa":  {
+                    "inlineString":  "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
                   }
                 }
               },
-              "requireClientCertificate": true
+              "requireClientCertificate":  true
             }
           }
         }
       ],
-      "trafficDirection": "INBOUND"
+      "trafficDirection":  "INBOUND"
     }
   ],
-  "typeUrl": "type.googleapis.com/envoy.config.listener.v3.Listener",
-  "nonce": "00000001"
+  "typeUrl":  "type.googleapis.com/envoy.config.listener.v3.Listener",
+  "nonce":  "00000001"
 }
\ No newline at end of file
diff --git a/command/connect/envoy/bootstrap_config.go b/command/connect/envoy/bootstrap_config.go
index 337e1cf5db66..8ace2c37aa87 100644
--- a/command/connect/envoy/bootstrap_config.go
+++ b/command/connect/envoy/bootstrap_config.go
@@ -5,6 +5,8 @@ package envoy
 
 import (
 	"bytes"
+	"crypto/sha1"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"net"
@@ -14,7 +16,6 @@ import (
 	"strings"
 	"text/template"
 
-	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/api"
 )
 
@@ -811,13 +812,28 @@ func (c *BootstrapConfig) generateListenerConfig(args *BootstrapTplArgs, bindAdd
 	return nil
 }
 
-// appendHCPMetricsConfig generates config to enable a socket at path: <hcpMetricsBindSocketDir>/<namespace>_<proxy_id>.sock
-// or <hcpMetricsBindSocketDir>/<proxy_id>.sock, if namespace is empty.
+// appendHCPMetricsConfig generates config to enable a socket at path: <hcpMetricsBindSocketDir>/<hash of compound proxy ID>.sock
+// We take the hash of the compound proxy ID for a few reasons:
+//
+//   - The proxy ID is included because this socket path must be unique per proxy. Each Envoy proxy will ship
+//     its metrics to HCP using its own loopback listener at this path.
+//
+//   - The hash is needed because UNIX domain socket paths must be less than 104 characters. By using a b64 encoded
+//     SHA1 hash we end up with 27 chars for the name, 5 chars for the extension, and the remainder is saved for
+//     the configurable socket dir. The length of the directory's path is validated on writes to avoid going over.
 func appendHCPMetricsConfig(args *BootstrapTplArgs, hcpMetricsBindSocketDir string) {
 	// Normalize namespace to "default". This ensures we match the namespace behaviour in proxycfg package,
 	// where a dynamic listener will be created at the same socket path via xDS.
-	sock := fmt.Sprintf("%s_%s.sock", acl.NamespaceOrDefault(args.Namespace), args.ProxyID)
-	path := path.Join(hcpMetricsBindSocketDir, sock)
+	ns := args.Namespace
+	if ns == "" {
+		ns = "default"
+	}
+	id := ns + "_" + args.ProxyID
+
+	h := sha1.New()
+	h.Write([]byte(id))
+	hash := base64.RawURLEncoding.EncodeToString(h.Sum(nil))
+	path := path.Join(hcpMetricsBindSocketDir, hash+".sock")
 
 	if args.StatsSinksJSON != "" {
 		args.StatsSinksJSON += ",\n"
diff --git a/command/connect/envoy/bootstrap_config_test.go b/command/connect/envoy/bootstrap_config_test.go
index d9d10803c1d6..a43814c729a8 100644
--- a/command/connect/envoy/bootstrap_config_test.go
+++ b/command/connect/envoy/bootstrap_config_test.go
@@ -556,7 +556,7 @@ const (
 			  "endpoint": {
 				"address": {
 				  "pipe": {
-					"path": "/tmp/consul/hcp-metrics/default_web-sidecar-proxy.sock"
+					"path": "/tmp/consul/hcp-metrics/gqmuzdHCUPAEY5mbF8vgkZCNI14.sock"
 				  }
 				}
 			  }
@@ -654,7 +654,7 @@ func TestBootstrapConfig_ConfigureArgs(t *testing.T) {
 							  "endpoint": {
 								"address": {
 								  "pipe": {
-									"path": "/tmp/consul/hcp-metrics/default_web-sidecar-proxy.sock"
+									"path": "/tmp/consul/hcp-metrics/gqmuzdHCUPAEY5mbF8vgkZCNI14.sock"
 								  }
 								}
 							  }
diff --git a/command/connect/envoy/testdata/hcp-metrics.golden b/command/connect/envoy/testdata/hcp-metrics.golden
index 563d662e4436..0739ab531dac 100644
--- a/command/connect/envoy/testdata/hcp-metrics.golden
+++ b/command/connect/envoy/testdata/hcp-metrics.golden
@@ -67,7 +67,7 @@
                   "endpoint": {
                     "address": {
                       "pipe": {
-                        "path": "/tmp/consul/hcp-metrics/default_test-proxy.sock"
+                        "path": "/tmp/consul/hcp-metrics/k3bWnyJyKvjUYXrBdOX2nXzSSCQ.sock"
                       }
                     }
                   }

From 0f23def80c22afefc5cdccdb2d2a7f34a950c7da Mon Sep 17 00:00:00 2001
From: Freddy <freddygv@users.noreply.github.com>
Date: Tue, 9 May 2023 12:28:34 -0600
Subject: [PATCH 61/92] Post a PR comment if the backport runner fails (#17197)

---
 .github/workflows/backport-assistant.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.github/workflows/backport-assistant.yml b/.github/workflows/backport-assistant.yml
index 547ab28b7287..10acd19e7ea7 100644
--- a/.github/workflows/backport-assistant.yml
+++ b/.github/workflows/backport-assistant.yml
@@ -28,3 +28,16 @@ jobs:
           BACKPORT_LABEL_REGEXP: "backport/(?P<target>\\d+\\.\\d+)"
           BACKPORT_TARGET_TEMPLATE: "release/{{.target}}.x"
           GITHUB_TOKEN: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+  handle-failure:
+    needs:
+      - backport
+    if: always() && needs.backport.result == 'failure'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Comment on PR
+        run: |
+          github_message="Backport failed @${{ github.event.sender.login }}. Run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          curl -s -H "Authorization: token ${{ secrets.PR_COMMENT_TOKEN }}" \
+            -X POST \
+            -d "{ \"body\": \"${github_message}\"}" \
+            "https://api.github.com/repos/${GITHUB_REPOSITORY}/pull/${{ github.event.pull_request.number }}/comments"
\ No newline at end of file

From 40eefaba180075473cb459f8af1aab0dfdddf92e Mon Sep 17 00:00:00 2001
From: Semir Patel <semir.patel@hashicorp.com>
Date: Tue, 9 May 2023 13:57:40 -0500
Subject: [PATCH 62/92] Reaper controller for cascading deletes of owner
 resources (#17256)

---
 agent/consul/server.go                        |   2 +
 .../services/resource/write_status.go         |  10 +-
 .../services/resource/write_status_test.go    |   3 +
 internal/resource/reaper/controller.go        | 148 +++++
 internal/resource/reaper/controller_test.go   | 193 ++++++
 proto-public/pbresource/resource.pb.go        | 626 +++++++++---------
 proto-public/pbresource/resource.proto        |  12 +
 proto-public/pbresource/resource_grpc.pb.go   |  16 +
 8 files changed, 705 insertions(+), 305 deletions(-)
 create mode 100644 internal/resource/reaper/controller.go
 create mode 100644 internal/resource/reaper/controller_test.go

diff --git a/agent/consul/server.go b/agent/consul/server.go
index 73df01e858e3..5ea0da7446d1 100644
--- a/agent/consul/server.go
+++ b/agent/consul/server.go
@@ -73,6 +73,7 @@ import (
 	"github.com/hashicorp/consul/internal/mesh"
 	"github.com/hashicorp/consul/internal/resource"
 	"github.com/hashicorp/consul/internal/resource/demo"
+	"github.com/hashicorp/consul/internal/resource/reaper"
 	raftstorage "github.com/hashicorp/consul/internal/storage/raft"
 	"github.com/hashicorp/consul/lib"
 	"github.com/hashicorp/consul/lib/routine"
@@ -844,6 +845,7 @@ func NewServer(config *Config, flat Deps, externalGRPCServer *grpc.Server, incom
 func (s *Server) registerResources() {
 	catalog.RegisterTypes(s.typeRegistry)
 	mesh.RegisterTypes(s.typeRegistry)
+	reaper.RegisterControllers(s.controllerManager)
 
 	if s.config.DevMode {
 		demo.RegisterTypes(s.typeRegistry)
diff --git a/agent/grpc-external/services/resource/write_status.go b/agent/grpc-external/services/resource/write_status.go
index ec7c0da2f36e..205918e1dc2b 100644
--- a/agent/grpc-external/services/resource/write_status.go
+++ b/agent/grpc-external/services/resource/write_status.go
@@ -10,6 +10,7 @@ import (
 
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/oklog/ulid/v2"
 
@@ -76,7 +77,10 @@ func (s *Server) WriteStatus(ctx context.Context, req *pbresource.WriteStatusReq
 		if resource.Status == nil {
 			resource.Status = make(map[string]*pbresource.Status)
 		}
-		resource.Status[req.Key] = req.Status
+
+		status := clone(req.Status)
+		status.UpdatedAt = timestamppb.Now()
+		resource.Status[req.Key] = status
 
 		result, err = s.Backend.WriteCAS(ctx, resource)
 		return err
@@ -142,6 +146,10 @@ func validateWriteStatusRequest(req *pbresource.WriteStatusRequest) error {
 		return status.Errorf(codes.InvalidArgument, "%s is required", field)
 	}
 
+	if req.Status.UpdatedAt != nil {
+		return status.Error(codes.InvalidArgument, "status.updated_at is automatically set and cannot be provided")
+	}
+
 	if _, err := ulid.ParseStrict(req.Status.ObservedGeneration); err != nil {
 		return status.Error(codes.InvalidArgument, "status.observed_generation is not valid")
 	}
diff --git a/agent/grpc-external/services/resource/write_status_test.go b/agent/grpc-external/services/resource/write_status_test.go
index c5cc301c1ed9..f65c7918ff79 100644
--- a/agent/grpc-external/services/resource/write_status_test.go
+++ b/agent/grpc-external/services/resource/write_status_test.go
@@ -12,6 +12,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/hashicorp/consul/acl/resolver"
 	"github.com/hashicorp/consul/internal/resource"
@@ -85,6 +86,7 @@ func TestWriteStatus_InputValidation(t *testing.T) {
 		"no reference type":       func(req *pbresource.WriteStatusRequest) { req.Status.Conditions[0].Resource.Type = nil },
 		"no reference tenancy":    func(req *pbresource.WriteStatusRequest) { req.Status.Conditions[0].Resource.Tenancy = nil },
 		"no reference name":       func(req *pbresource.WriteStatusRequest) { req.Status.Conditions[0].Resource.Name = "" },
+		"updated at provided":     func(req *pbresource.WriteStatusRequest) { req.Status.UpdatedAt = timestamppb.Now() },
 	}
 	for desc, modFn := range testCases {
 		t.Run(desc, func(t *testing.T) {
@@ -140,6 +142,7 @@ func TestWriteStatus_Success(t *testing.T) {
 			require.NotEqual(t, rsp.Resource.Version, res.Version, "version should have changed")
 			require.Contains(t, rsp.Resource.Status, "consul.io/other-controller")
 			require.Contains(t, rsp.Resource.Status, "consul.io/artist-controller")
+			require.NotNil(t, rsp.Resource.Status["consul.io/artist-controller"].UpdatedAt)
 		})
 	}
 }
diff --git a/internal/resource/reaper/controller.go b/internal/resource/reaper/controller.go
new file mode 100644
index 000000000000..7a7789f986a0
--- /dev/null
+++ b/internal/resource/reaper/controller.go
@@ -0,0 +1,148 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package reaper
+
+import (
+	"context"
+	"time"
+
+	"github.com/hashicorp/consul/internal/controller"
+	"github.com/hashicorp/consul/internal/resource"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+const (
+	statusKeyReaperController       = "consul.io/reaper-controller"
+	secondPassDelay                 = 30 * time.Second
+	conditionTypeFirstPassCompleted = "FirstPassCompleted"
+)
+
+// RegisterControllers registers controllers for the tombstone type.
+func RegisterControllers(mgr *controller.Manager) {
+	mgr.Register(reaperController())
+}
+
+func reaperController() controller.Controller {
+	return controller.ForType(resource.TypeV1Tombstone).
+		WithReconciler(newReconciler())
+}
+
+func newReconciler() *tombstoneReconciler {
+	return &tombstoneReconciler{
+		timeNow: time.Now,
+	}
+}
+
+type tombstoneReconciler struct {
+	// Testing shim
+	timeNow func() time.Time
+}
+
+// Deletes all owned (child) resources of an owner (parent) resource.
+//
+// The reconciliation for tombstones is split into two passes.
+// The first pass attempts to delete child resources created before the owner resource was deleted.
+// The second pass is run after a reasonable delay to delete child resources that may have been
+// created during or after the completion of the first pass.
+func (r *tombstoneReconciler) Reconcile(ctx context.Context, rt controller.Runtime, req controller.Request) error {
+	rsp, err := rt.Client.Read(ctx, &pbresource.ReadRequest{Id: req.ID})
+	switch {
+	case status.Code(err) == codes.NotFound:
+		// tombstone not found. nothing to do
+		return nil
+	case err != nil:
+		// retry later
+		return err
+	}
+	res := rsp.Resource
+
+	var tombstone pbresource.Tombstone
+	if err := res.Data.UnmarshalTo(&tombstone); err != nil {
+		return err
+	}
+
+	firstPassCompletedOnEntry := isFirstPassCompleted(res)
+
+	// Corner case:
+	// Check secondPassDelay has elasped since first pass in cases where queued
+	// reconciliation requests are lost between the first and second pass
+	// (e.g. controller relocated to a different server due to raft leadership
+	// change).
+	if firstPassCompletedOnEntry && !r.secondPassDelayElapsed(res.Status[statusKeyReaperController]) {
+		return controller.RequeueAfter(secondPassDelay)
+	}
+
+	// Retrieve owner's children
+	listRsp, err := rt.Client.ListByOwner(ctx, &pbresource.ListByOwnerRequest{Owner: tombstone.Owner})
+	if err != nil {
+		return err
+	}
+
+	// Attempt to delete each child
+	for _, child := range listRsp.Resources {
+		_, err := rt.Client.Delete(ctx, &pbresource.DeleteRequest{Id: child.Id})
+		if err != nil {
+			return err
+		}
+	}
+
+	if firstPassCompletedOnEntry {
+		// we just did the second pass -> delete tombstone
+		_, err := rt.Client.Delete(ctx, &pbresource.DeleteRequest{Id: res.Id})
+		if err != nil {
+			// tombstone deletion failed, just retry
+			return err
+		}
+		// tombstone delete succeeded and reconciliation complete
+		return nil
+	} else {
+		// we just did the first pass -> queue up the second pass
+		_, err = rt.Client.WriteStatus(ctx, &pbresource.WriteStatusRequest{
+			Id:  res.Id,
+			Key: statusKeyReaperController,
+			Status: &pbresource.Status{
+				ObservedGeneration: res.Generation,
+				Conditions: []*pbresource.Condition{
+					{
+						Type:    conditionTypeFirstPassCompleted,
+						State:   pbresource.Condition_STATE_TRUE,
+						Reason:  "Success",
+						Message: "First pass of child resource deletion completed",
+					},
+				},
+			},
+		})
+		if err != nil {
+			return err
+		}
+		return controller.RequeueAfter(secondPassDelay)
+	}
+}
+
+func (r *tombstoneReconciler) secondPassDelayElapsed(status *pbresource.Status) bool {
+	firstPassTime := status.UpdatedAt.AsTime()
+	return firstPassTime.Add(secondPassDelay).Before(r.timeNow())
+}
+
+func isFirstPassCompleted(res *pbresource.Resource) bool {
+	if res.Status == nil {
+		return false
+	}
+
+	status, ok := res.Status[statusKeyReaperController]
+	if !ok {
+		return false
+	}
+
+	// First time through, first and second pass ahead of us
+	if len(status.Conditions) == 0 {
+		return false
+	}
+
+	// Single condition "FirstPassCompleted"
+	condition := status.Conditions[0]
+	return condition.State == pbresource.Condition_STATE_TRUE
+}
diff --git a/internal/resource/reaper/controller_test.go b/internal/resource/reaper/controller_test.go
new file mode 100644
index 000000000000..9e6f0f3d5a07
--- /dev/null
+++ b/internal/resource/reaper/controller_test.go
@@ -0,0 +1,193 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package reaper
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	svctest "github.com/hashicorp/consul/agent/grpc-external/services/resource/testing"
+	"github.com/hashicorp/consul/internal/controller"
+	"github.com/hashicorp/consul/internal/resource"
+	"github.com/hashicorp/consul/internal/resource/demo"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/hashicorp/consul/sdk/testutil"
+)
+
+func TestReconcile_ResourceWithNoChildren(t *testing.T) {
+	client := svctest.RunResourceService(t, demo.RegisterTypes)
+
+	// Seed the database with an artist.
+	res, err := demo.GenerateV2Artist()
+	require.NoError(t, err)
+	ctx := testutil.TestContext(t)
+	writeRsp, err := client.Write(ctx, &pbresource.WriteRequest{Resource: res})
+	require.NoError(t, err)
+
+	// Delete the artist to create a tombstone
+	_, err = client.Delete(ctx, &pbresource.DeleteRequest{Id: writeRsp.Resource.Id})
+	require.NoError(t, err)
+
+	// Retrieve tombstone
+	listRsp, err := client.List(ctx, &pbresource.ListRequest{
+		Type:    resource.TypeV1Tombstone,
+		Tenancy: writeRsp.Resource.Id.Tenancy,
+	})
+	require.NoError(t, err)
+	require.Len(t, listRsp.Resources, 1)
+	tombstone := listRsp.Resources[0]
+
+	// Verify reconcile does first pass and queues up for a second pass
+	rec := newReconciler()
+	runtime := controller.Runtime{
+		Client: client,
+		Logger: testutil.Logger(t),
+	}
+	req := controller.Request{ID: tombstone.Id}
+	require.ErrorIs(t, controller.RequeueAfterError(secondPassDelay), rec.Reconcile(ctx, runtime, req))
+
+	// Verify condition FirstPassCompleted is true
+	readRsp, err := client.Read(ctx, &pbresource.ReadRequest{Id: tombstone.Id})
+	require.NoError(t, err)
+	tombstone = readRsp.Resource
+	condition := tombstone.Status[statusKeyReaperController].Conditions[0]
+	require.Equal(t, conditionTypeFirstPassCompleted, condition.Type)
+	require.Equal(t, pbresource.Condition_STATE_TRUE, condition.State)
+
+	// Verify reconcile does second pass and tombstone is deleted
+	// Fake out time so elapsed time > secondPassDelay
+	rec.timeNow = func() time.Time { return time.Now().Add(secondPassDelay + time.Second) }
+	require.NoError(t, rec.Reconcile(ctx, runtime, req))
+	_, err = client.Read(ctx, &pbresource.ReadRequest{Id: tombstone.Id})
+	require.Error(t, err)
+	require.Equal(t, codes.NotFound.String(), status.Code(err).String())
+
+	// Reconcile again to verify no-op on an already deleted tombstone
+	require.NoError(t, rec.Reconcile(ctx, runtime, req))
+}
+
+func TestReconcile_ResourceWithChildren(t *testing.T) {
+	client := svctest.RunResourceService(t, demo.RegisterTypes)
+
+	// Seed the database with an artist
+	res, err := demo.GenerateV2Artist()
+	require.NoError(t, err)
+	ctx := testutil.TestContext(t)
+	writeRsp, err := client.Write(ctx, &pbresource.WriteRequest{Resource: res})
+	require.NoError(t, err)
+	artist := writeRsp.Resource
+
+	// Create 3 albums owned by the artist
+	numAlbums := 3
+	for i := 0; i < numAlbums; i++ {
+		res, err = demo.GenerateV2Album(artist.Id)
+		require.NoError(t, err)
+		_, err := client.Write(ctx, &pbresource.WriteRequest{Resource: res})
+		require.NoError(t, err)
+	}
+
+	// Delete the artist to create a tombstone
+	_, err = client.Delete(ctx, &pbresource.DeleteRequest{Id: writeRsp.Resource.Id})
+	require.NoError(t, err)
+
+	// Retrieve the tombstone
+	listRsp, err := client.List(ctx, &pbresource.ListRequest{
+		Type:    resource.TypeV1Tombstone,
+		Tenancy: writeRsp.Resource.Id.Tenancy,
+	})
+	require.NoError(t, err)
+	require.Len(t, listRsp.Resources, 1)
+	tombstone := listRsp.Resources[0]
+
+	// Verify reconcile does first pass delete and queues up for a second pass
+	rec := newReconciler()
+	runtime := controller.Runtime{
+		Client: client,
+		Logger: testutil.Logger(t),
+	}
+	req := controller.Request{ID: tombstone.Id}
+	require.ErrorIs(t, controller.RequeueAfterError(secondPassDelay), rec.Reconcile(ctx, runtime, req))
+
+	// Verify 3 albums deleted
+	listRsp, err = client.List(ctx, &pbresource.ListRequest{
+		Type:    demo.TypeV2Album,
+		Tenancy: artist.Id.Tenancy,
+	})
+	require.NoError(t, err)
+	require.Empty(t, listRsp.Resources)
+
+	// Verify condition FirstPassCompleted is true
+	readRsp, err := client.Read(ctx, &pbresource.ReadRequest{Id: tombstone.Id})
+	require.NoError(t, err)
+	tombstone = readRsp.Resource
+	condition := tombstone.Status[statusKeyReaperController].Conditions[0]
+	require.Equal(t, conditionTypeFirstPassCompleted, condition.Type)
+	require.Equal(t, pbresource.Condition_STATE_TRUE, condition.State)
+
+	// Verify reconcile does second pass
+	// Fake out time so elapsed time > secondPassDelay
+	rec.timeNow = func() time.Time { return time.Now().Add(secondPassDelay + time.Second) }
+	require.NoError(t, rec.Reconcile(ctx, runtime, req))
+
+	// Verify artist tombstone deleted
+	_, err = client.Read(ctx, &pbresource.ReadRequest{Id: tombstone.Id})
+	require.Error(t, err)
+	require.Equal(t, codes.NotFound.String(), status.Code(err).String())
+
+	// Verify tombstones for 3 albums created
+	listRsp, err = client.List(ctx, &pbresource.ListRequest{
+		Type:    resource.TypeV1Tombstone,
+		Tenancy: artist.Id.Tenancy,
+	})
+	require.NoError(t, err)
+	require.Len(t, listRsp.Resources, numAlbums)
+}
+
+func TestReconcile_RequeueWithDelayWhenSecondPassDelayNotElapsed(t *testing.T) {
+	client := svctest.RunResourceService(t, demo.RegisterTypes)
+
+	// Seed the database with an artist.
+	res, err := demo.GenerateV2Artist()
+	require.NoError(t, err)
+	ctx := testutil.TestContext(t)
+	writeRsp, err := client.Write(ctx, &pbresource.WriteRequest{Resource: res})
+	require.NoError(t, err)
+
+	// Delete the artist to create a tombstone
+	_, err = client.Delete(ctx, &pbresource.DeleteRequest{Id: writeRsp.Resource.Id})
+	require.NoError(t, err)
+
+	// Retrieve tombstone
+	listRsp, err := client.List(ctx, &pbresource.ListRequest{
+		Type:    resource.TypeV1Tombstone,
+		Tenancy: writeRsp.Resource.Id.Tenancy,
+	})
+	require.NoError(t, err)
+	require.Len(t, listRsp.Resources, 1)
+	tombstone := listRsp.Resources[0]
+
+	// Verify reconcile does first pass and queues up for a second pass
+	rec := newReconciler()
+	runtime := controller.Runtime{
+		Client: client,
+		Logger: testutil.Logger(t),
+	}
+	req := controller.Request{ID: tombstone.Id}
+	require.ErrorIs(t, controller.RequeueAfterError(secondPassDelay), rec.Reconcile(ctx, runtime, req))
+
+	// Verify condition FirstPassCompleted is true
+	readRsp, err := client.Read(ctx, &pbresource.ReadRequest{Id: tombstone.Id})
+	require.NoError(t, err)
+	tombstone = readRsp.Resource
+	condition := tombstone.Status[statusKeyReaperController].Conditions[0]
+	require.Equal(t, conditionTypeFirstPassCompleted, condition.Type)
+	require.Equal(t, pbresource.Condition_STATE_TRUE, condition.State)
+
+	// Verify requeued for second pass since secondPassDelay time has not elapsed
+	require.ErrorIs(t, controller.RequeueAfterError(secondPassDelay), rec.Reconcile(ctx, runtime, req))
+}
diff --git a/proto-public/pbresource/resource.pb.go b/proto-public/pbresource/resource.pb.go
index d05a2b8f972b..76bf1be45c56 100644
--- a/proto-public/pbresource/resource.pb.go
+++ b/proto-public/pbresource/resource.pb.go
@@ -14,6 +14,7 @@ import (
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	anypb "google.golang.org/protobuf/types/known/anypb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
 )
@@ -505,6 +506,8 @@ type Status struct {
 	// Conditions contains a set of discreet observations about the resource in
 	// relation to the current state of the system (e.g. it is semantically valid).
 	Conditions []*Condition `protobuf:"bytes,2,rep,name=conditions,proto3" json:"conditions,omitempty"`
+	// UpdatedAt is the time at which the status was last written.
+	UpdatedAt *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
 }
 
 func (x *Status) Reset() {
@@ -553,6 +556,13 @@ func (x *Status) GetConditions() []*Condition {
 	return nil
 }
 
+func (x *Status) GetUpdatedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.UpdatedAt
+	}
+	return nil
+}
+
 // Condition represents a discreet observation about a resource in relation to
 // the current state of the system.
 //
@@ -1552,259 +1562,265 @@ var file_pbresource_resource_proto_rawDesc = []byte{
 	0x6f, 0x6e, 0x73, 0x2f, 0x72, 0x61, 0x74, 0x65, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x2f, 0x72, 0x61,
 	0x74, 0x65, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x19, 0x67,
 	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x61,
-	0x6e, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x55, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65,
-	0x12, 0x14, 0x0a, 0x05, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x05, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x23, 0x0a, 0x0d, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f,
-	0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x67,
-	0x72, 0x6f, 0x75, 0x70, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x6b,
-	0x69, 0x6e, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x22,
-	0x62, 0x0a, 0x07, 0x54, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x12, 0x1c, 0x0a, 0x09, 0x70, 0x61,
-	0x72, 0x74, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x70,
-	0x61, 0x72, 0x74, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1c, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65,
-	0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6e, 0x61, 0x6d,
-	0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x6e,
-	0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x65, 0x65, 0x72, 0x4e,
-	0x61, 0x6d, 0x65, 0x22, 0x9d, 0x01, 0x0a, 0x02, 0x49, 0x44, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x69,
-	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04,
-	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
-	0x12, 0x33, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f,
-	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
-	0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52,
-	0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x3c, 0x0a, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
-	0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x2e, 0x54, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x52, 0x07, 0x74, 0x65, 0x6e, 0x61,
-	0x6e, 0x63, 0x79, 0x22, 0x85, 0x04, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x12, 0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68,
-	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x02, 0x69, 0x64, 0x12,
-	0x33, 0x0a, 0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d,
-	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
-	0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x05, 0x6f,
-	0x77, 0x6e, 0x65, 0x72, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1e,
-	0x0a, 0x0a, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0a, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x4d,
-	0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x31, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
-	0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e,
-	0x74, 0x72, 0x79, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x47, 0x0a,
-	0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e,
-	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
-	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x06,
-	0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x28, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x18, 0x07,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61,
-	0x1a, 0x3b, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72,
-	0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
-	0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x5c, 0x0a,
-	0x0b, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03,
-	0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x37,
-	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e,
-	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
-	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x7f, 0x0a, 0x06, 0x53,
-	0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x2f, 0x0a, 0x13, 0x6f, 0x62, 0x73, 0x65, 0x72, 0x76, 0x65,
-	0x64, 0x5f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x12, 0x6f, 0x62, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x47, 0x65, 0x6e, 0x65,
-	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x44, 0x0a, 0x0a, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x68, 0x61, 0x73,
-	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e,
-	0x52, 0x0a, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0x92, 0x02, 0x0a,
-	0x09, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79,
-	0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x40,
-	0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2a, 0x2e,
-	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
-	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74,
-	0x69, 0x6f, 0x6e, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65,
-	0x12, 0x16, 0x0a, 0x06, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x06, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x12, 0x18, 0x0a, 0x07, 0x6d, 0x65, 0x73, 0x73,
-	0x61, 0x67, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61,
-	0x67, 0x65, 0x12, 0x40, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x05,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
-	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x2e, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x22, 0x3b, 0x0a, 0x05, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x11, 0x0a,
-	0x0d, 0x53, 0x54, 0x41, 0x54, 0x45, 0x5f, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00,
-	0x12, 0x0e, 0x0a, 0x0a, 0x53, 0x54, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x52, 0x55, 0x45, 0x10, 0x01,
-	0x12, 0x0f, 0x0a, 0x0b, 0x53, 0x54, 0x41, 0x54, 0x45, 0x5f, 0x46, 0x41, 0x4c, 0x53, 0x45, 0x10,
-	0x02, 0x22, 0xac, 0x01, 0x0a, 0x09, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x12,
-	0x33, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e,
-	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
-	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04,
-	0x74, 0x79, 0x70, 0x65, 0x12, 0x3c, 0x0a, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
-	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x2e, 0x54, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x52, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e,
-	0x63, 0x79, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x65, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x22, 0x40, 0x0a, 0x09, 0x54, 0x6f, 0x6d, 0x62, 0x73, 0x74, 0x6f, 0x6e, 0x65, 0x12, 0x33, 0x0a,
-	0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68,
-	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x05, 0x6f, 0x77, 0x6e,
-	0x65, 0x72, 0x22, 0x3c, 0x0a, 0x0b, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x12, 0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e,
-	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
-	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x02, 0x69, 0x64,
-	0x22, 0x4f, 0x0a, 0x0c, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
-	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x22, 0xa1, 0x01, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x12, 0x33, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x6e, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74,
+	0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x55, 0x0a, 0x04, 0x54, 0x79, 0x70,
+	0x65, 0x12, 0x14, 0x0a, 0x05, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x05, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x23, 0x0a, 0x0d, 0x67, 0x72, 0x6f, 0x75, 0x70,
+	0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c,
+	0x67, 0x72, 0x6f, 0x75, 0x70, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04,
+	0x6b, 0x69, 0x6e, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6b, 0x69, 0x6e, 0x64,
+	0x22, 0x62, 0x0a, 0x07, 0x54, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x12, 0x1c, 0x0a, 0x09, 0x70,
+	0x61, 0x72, 0x74, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
+	0x70, 0x61, 0x72, 0x74, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1c, 0x0a, 0x09, 0x6e, 0x61, 0x6d,
+	0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6e, 0x61,
+	0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x65, 0x65, 0x72, 0x5f,
+	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x65, 0x65, 0x72,
+	0x4e, 0x61, 0x6d, 0x65, 0x22, 0x9d, 0x01, 0x0a, 0x02, 0x49, 0x44, 0x12, 0x10, 0x0a, 0x03, 0x75,
+	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x69, 0x64, 0x12, 0x12, 0x0a,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x12, 0x33, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32,
 	0x1f, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
 	0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x54, 0x79, 0x70, 0x65,
 	0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x3c, 0x0a, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e, 0x63,
-	0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
 	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75,
 	0x72, 0x63, 0x65, 0x2e, 0x54, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x52, 0x07, 0x74, 0x65, 0x6e,
-	0x61, 0x6e, 0x63, 0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x72, 0x65,
-	0x66, 0x69, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x61, 0x6d, 0x65, 0x50,
-	0x72, 0x65, 0x66, 0x69, 0x78, 0x22, 0x51, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x41, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
-	0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x09, 0x72,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x22, 0x49, 0x0a, 0x12, 0x4c, 0x69, 0x73, 0x74,
-	0x42, 0x79, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x33,
-	0x0a, 0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e,
-	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
-	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x05, 0x6f, 0x77,
-	0x6e, 0x65, 0x72, 0x22, 0x58, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x42, 0x79, 0x4f, 0x77, 0x6e,
-	0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x41, 0x0a, 0x09, 0x72, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e,
+	0x61, 0x6e, 0x63, 0x79, 0x22, 0x85, 0x04, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x12, 0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e,
 	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
-	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x22, 0x4f, 0x0a,
-	0x0c, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x3f, 0x0a,
+	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x02, 0x69, 0x64,
+	0x12, 0x33, 0x0a, 0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x05,
+	0x6f, 0x77, 0x6e, 0x65, 0x72, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
+	0x1e, 0x0a, 0x0a, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0a, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x4d, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x05, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x31, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45,
+	0x6e, 0x74, 0x72, 0x79, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x47,
+	0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f,
+	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
+	0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x28, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x18,
+	0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x04, 0x64, 0x61, 0x74,
+	0x61, 0x1a, 0x3b, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74,
+	0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x5c,
+	0x0a, 0x0b, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
+	0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
+	0x37, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21,
+	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xba, 0x01, 0x0a,
+	0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x2f, 0x0a, 0x13, 0x6f, 0x62, 0x73, 0x65, 0x72,
+	0x76, 0x65, 0x64, 0x5f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x6f, 0x62, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x47, 0x65,
+	0x6e, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x44, 0x0a, 0x0a, 0x63, 0x6f, 0x6e, 0x64,
+	0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x0a, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x39,
+	0x0a, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09,
+	0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x22, 0x92, 0x02, 0x0a, 0x09, 0x43, 0x6f,
+	0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x40, 0x0a, 0x05, 0x73,
+	0x74, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2a, 0x2e, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e,
+	0x2e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x12, 0x16, 0x0a,
+	0x06, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x72,
+	0x65, 0x61, 0x73, 0x6f, 0x6e, 0x12, 0x18, 0x0a, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12,
+	0x40, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x24, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65,
+	0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x22, 0x3b, 0x0a, 0x05, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x11, 0x0a, 0x0d, 0x53, 0x54,
+	0x41, 0x54, 0x45, 0x5f, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x0e, 0x0a,
+	0x0a, 0x53, 0x54, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x52, 0x55, 0x45, 0x10, 0x01, 0x12, 0x0f, 0x0a,
+	0x0b, 0x53, 0x54, 0x41, 0x54, 0x45, 0x5f, 0x46, 0x41, 0x4c, 0x53, 0x45, 0x10, 0x02, 0x22, 0xac,
+	0x01, 0x0a, 0x09, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x12, 0x33, 0x0a, 0x04,
+	0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70,
+	0x65, 0x12, 0x3c, 0x0a, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x22, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x54,
+	0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x52, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x12,
+	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x40, 0x0a,
+	0x09, 0x54, 0x6f, 0x6d, 0x62, 0x73, 0x74, 0x6f, 0x6e, 0x65, 0x12, 0x33, 0x0a, 0x05, 0x6f, 0x77,
+	0x6e, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x22,
+	0x3c, 0x0a, 0x0b, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2d,
+	0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x02, 0x69, 0x64, 0x22, 0x4f, 0x0a,
+	0x0c, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a,
 	0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
 	0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
 	0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x50,
-	0x0a, 0x0d, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
-	0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
-	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x22, 0xaa, 0x01, 0x0a, 0x12, 0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
-	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e,
-	0x49, 0x44, 0x52, 0x02, 0x69, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f,
-	0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
-	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
-	0x65, 0x79, 0x12, 0x39, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x04, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x21, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
-	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x53,
-	0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x56, 0x0a,
-	0x13, 0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
-	0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x58, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
-	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49,
-	0x44, 0x52, 0x02, 0x69, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22,
-	0x10, 0x0a, 0x0e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x22, 0xa6, 0x01, 0x0a, 0x10, 0x57, 0x61, 0x74, 0x63, 0x68, 0x4c, 0x69, 0x73, 0x74, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x33, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
-	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x3c, 0x0a, 0x07, 0x74,
-	0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x68,
-	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x54, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79,
-	0x52, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d,
-	0x65, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a,
-	0x6e, 0x61, 0x6d, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x22, 0xf0, 0x01, 0x0a, 0x0a, 0x57,
-	0x61, 0x74, 0x63, 0x68, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x4d, 0x0a, 0x09, 0x6f, 0x70, 0x65,
-	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2f, 0x2e, 0x68,
+	0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0xa1,
+	0x01, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x33,
+	0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x68,
 	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x61, 0x74, 0x63, 0x68, 0x45, 0x76,
-	0x65, 0x6e, 0x74, 0x2e, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09, 0x6f,
-	0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74,
+	0x79, 0x70, 0x65, 0x12, 0x3c, 0x0a, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x2e, 0x54, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x52, 0x07, 0x74, 0x65, 0x6e, 0x61, 0x6e, 0x63,
+	0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x72, 0x65, 0x66,
+	0x69, 0x78, 0x22, 0x51, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x41, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18,
+	0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x73, 0x22, 0x49, 0x0a, 0x12, 0x4c, 0x69, 0x73, 0x74, 0x42, 0x79, 0x4f,
+	0x77, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x33, 0x0a, 0x05, 0x6f,
+	0x77, 0x6e, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72,
+	0x22, 0x58, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x42, 0x79, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x41, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73,
 	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65,
 	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52,
-	0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x52, 0x0a, 0x09, 0x4f, 0x70, 0x65,
-	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x19, 0x0a, 0x15, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54,
-	0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10,
-	0x00, 0x12, 0x14, 0x0a, 0x10, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55,
-	0x50, 0x53, 0x45, 0x52, 0x54, 0x10, 0x01, 0x12, 0x14, 0x0a, 0x10, 0x4f, 0x50, 0x45, 0x52, 0x41,
-	0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x44, 0x45, 0x4c, 0x45, 0x54, 0x45, 0x10, 0x02, 0x32, 0x83, 0x06,
-	0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x12, 0x61, 0x0a, 0x04, 0x52, 0x65, 0x61, 0x64, 0x12, 0x26, 0x2e, 0x68, 0x61, 0x73, 0x68,
+	0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x22, 0x4f, 0x0a, 0x0c, 0x57, 0x72,
+	0x69, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x50, 0x0a, 0x0d, 0x57,
+	0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a, 0x08,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23,
+	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0xaa, 0x01,
+	0x0a, 0x12, 0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52,
+	0x02, 0x69, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x10, 0x0a,
+	0x03, 0x6b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
+	0x39, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x21, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x53, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x56, 0x0a, 0x13, 0x57, 0x72,
+	0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
+	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e,
+	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x22, 0x58, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x02,
+	0x69, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x10, 0x0a, 0x0e,
+	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xa6,
+	0x01, 0x0a, 0x10, 0x57, 0x61, 0x74, 0x63, 0x68, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x33, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x1f, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x54, 0x79,
+	0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x3c, 0x0a, 0x07, 0x74, 0x65, 0x6e, 0x61,
+	0x6e, 0x63, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x68, 0x61, 0x73, 0x68,
 	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x27, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
-	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65,
-	0x61, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04,
-	0x08, 0x02, 0x10, 0x0b, 0x12, 0x64, 0x0a, 0x05, 0x57, 0x72, 0x69, 0x74, 0x65, 0x12, 0x27, 0x2e,
-	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
-	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
-	0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x2e, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x03, 0x10, 0x0b, 0x12, 0x76, 0x0a, 0x0b, 0x57, 0x72,
-	0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x2d, 0x2e, 0x68, 0x61, 0x73, 0x68,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x54, 0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x52, 0x07, 0x74,
+	0x65, 0x6e, 0x61, 0x6e, 0x63, 0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70,
+	0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x61, 0x6d,
+	0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x22, 0xf0, 0x01, 0x0a, 0x0a, 0x57, 0x61, 0x74, 0x63,
+	0x68, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x4d, 0x0a, 0x09, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2f, 0x2e, 0x68, 0x61, 0x73, 0x68,
 	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75,
-	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2e, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
-	0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x03,
-	0x10, 0x0b, 0x12, 0x61, 0x0a, 0x04, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x26, 0x2e, 0x68, 0x61, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x61, 0x74, 0x63, 0x68, 0x45, 0x76, 0x65, 0x6e, 0x74,
+	0x2e, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09, 0x6f, 0x70, 0x65, 0x72,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3f, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x52, 0x0a, 0x09, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x12, 0x19, 0x0a, 0x15, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x49, 0x4f, 0x4e,
+	0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x14,
+	0x0a, 0x10, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x50, 0x53, 0x45,
+	0x52, 0x54, 0x10, 0x01, 0x12, 0x14, 0x0a, 0x10, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x49, 0x4f,
+	0x4e, 0x5f, 0x44, 0x45, 0x4c, 0x45, 0x54, 0x45, 0x10, 0x02, 0x32, 0x83, 0x06, 0x0a, 0x0f, 0x52,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x61,
+	0x0a, 0x04, 0x52, 0x65, 0x61, 0x64, 0x12, 0x26, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x2e, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x27,
+	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x61, 0x64, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x02, 0x10,
+	0x0b, 0x12, 0x64, 0x0a, 0x05, 0x57, 0x72, 0x69, 0x74, 0x65, 0x12, 0x27, 0x2e, 0x68, 0x61, 0x73,
 	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x27, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
-	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x4c,
-	0x69, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04,
-	0x04, 0x08, 0x02, 0x10, 0x0b, 0x12, 0x76, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x42, 0x79, 0x4f,
-	0x77, 0x6e, 0x65, 0x72, 0x12, 0x2d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
-	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x42, 0x79, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x2e, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
 	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e,
-	0x4c, 0x69, 0x73, 0x74, 0x42, 0x79, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x02, 0x10, 0x0b, 0x12, 0x67, 0x0a,
-	0x06, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x28, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x57, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2,
+	0x86, 0x04, 0x04, 0x08, 0x03, 0x10, 0x0b, 0x12, 0x76, 0x0a, 0x0b, 0x57, 0x72, 0x69, 0x74, 0x65,
+	0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x2d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x2e, 0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2e, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x2e, 0x57, 0x72, 0x69, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x03, 0x10, 0x0b, 0x12,
+	0x61, 0x0a, 0x04, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x26, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
 	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x29, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
-	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x44, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86,
-	0x04, 0x04, 0x08, 0x03, 0x10, 0x0b, 0x12, 0x6b, 0x0a, 0x09, 0x57, 0x61, 0x74, 0x63, 0x68, 0x4c,
-	0x69, 0x73, 0x74, 0x12, 0x2b, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
-	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e,
-	0x57, 0x61, 0x74, 0x63, 0x68, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x25, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
+	0x72, 0x63, 0x65, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x27, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x4c, 0x69, 0x73, 0x74,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x02,
+	0x10, 0x0b, 0x12, 0x76, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x42, 0x79, 0x4f, 0x77, 0x6e, 0x65,
+	0x72, 0x12, 0x2d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x4c, 0x69,
+	0x73, 0x74, 0x42, 0x79, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x2e, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x4c, 0x69, 0x73,
+	0x74, 0x42, 0x79, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x02, 0x10, 0x0b, 0x12, 0x67, 0x0a, 0x06, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x12, 0x28, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x29,
+	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74,
+	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08,
+	0x03, 0x10, 0x0b, 0x12, 0x6b, 0x0a, 0x09, 0x57, 0x61, 0x74, 0x63, 0x68, 0x4c, 0x69, 0x73, 0x74,
+	0x12, 0x2b, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
 	0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x61, 0x74,
-	0x63, 0x68, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x02, 0x10,
-	0x0b, 0x30, 0x01, 0x42, 0xe9, 0x01, 0x0a, 0x1d, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68,
-	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x42, 0x0d, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50,
-	0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x33, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
-	0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e,
-	0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63,
-	0x2f, 0x70, 0x62, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0xa2, 0x02, 0x03, 0x48, 0x43,
-	0x52, 0xaa, 0x02, 0x19, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f,
-	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0xca, 0x02, 0x19,
-	0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
-	0x5c, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0xe2, 0x02, 0x25, 0x48, 0x61, 0x73, 0x68,
-	0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x52, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0xea, 0x02, 0x1b, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43,
-	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x62,
-	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x63, 0x68, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e,
+	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x57, 0x61, 0x74, 0x63, 0x68, 0x45,
+	0x76, 0x65, 0x6e, 0x74, 0x22, 0x08, 0xe2, 0x86, 0x04, 0x04, 0x08, 0x02, 0x10, 0x0b, 0x30, 0x01,
+	0x42, 0xe9, 0x01, 0x0a, 0x1d, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x42, 0x0d, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x72, 0x6f, 0x74,
+	0x6f, 0x50, 0x01, 0x5a, 0x33, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
+	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0xa2, 0x02, 0x03, 0x48, 0x43, 0x52, 0xaa, 0x02,
+	0x19, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0xca, 0x02, 0x19, 0x48, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x52, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0xe2, 0x02, 0x25, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02,
+	0x1b, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x3a, 0x3a, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -1822,33 +1838,34 @@ func file_pbresource_resource_proto_rawDescGZIP() []byte {
 var file_pbresource_resource_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
 var file_pbresource_resource_proto_msgTypes = make([]protoimpl.MessageInfo, 24)
 var file_pbresource_resource_proto_goTypes = []interface{}{
-	(Condition_State)(0),        // 0: hashicorp.consul.resource.Condition.State
-	(WatchEvent_Operation)(0),   // 1: hashicorp.consul.resource.WatchEvent.Operation
-	(*Type)(nil),                // 2: hashicorp.consul.resource.Type
-	(*Tenancy)(nil),             // 3: hashicorp.consul.resource.Tenancy
-	(*ID)(nil),                  // 4: hashicorp.consul.resource.ID
-	(*Resource)(nil),            // 5: hashicorp.consul.resource.Resource
-	(*Status)(nil),              // 6: hashicorp.consul.resource.Status
-	(*Condition)(nil),           // 7: hashicorp.consul.resource.Condition
-	(*Reference)(nil),           // 8: hashicorp.consul.resource.Reference
-	(*Tombstone)(nil),           // 9: hashicorp.consul.resource.Tombstone
-	(*ReadRequest)(nil),         // 10: hashicorp.consul.resource.ReadRequest
-	(*ReadResponse)(nil),        // 11: hashicorp.consul.resource.ReadResponse
-	(*ListRequest)(nil),         // 12: hashicorp.consul.resource.ListRequest
-	(*ListResponse)(nil),        // 13: hashicorp.consul.resource.ListResponse
-	(*ListByOwnerRequest)(nil),  // 14: hashicorp.consul.resource.ListByOwnerRequest
-	(*ListByOwnerResponse)(nil), // 15: hashicorp.consul.resource.ListByOwnerResponse
-	(*WriteRequest)(nil),        // 16: hashicorp.consul.resource.WriteRequest
-	(*WriteResponse)(nil),       // 17: hashicorp.consul.resource.WriteResponse
-	(*WriteStatusRequest)(nil),  // 18: hashicorp.consul.resource.WriteStatusRequest
-	(*WriteStatusResponse)(nil), // 19: hashicorp.consul.resource.WriteStatusResponse
-	(*DeleteRequest)(nil),       // 20: hashicorp.consul.resource.DeleteRequest
-	(*DeleteResponse)(nil),      // 21: hashicorp.consul.resource.DeleteResponse
-	(*WatchListRequest)(nil),    // 22: hashicorp.consul.resource.WatchListRequest
-	(*WatchEvent)(nil),          // 23: hashicorp.consul.resource.WatchEvent
-	nil,                         // 24: hashicorp.consul.resource.Resource.MetadataEntry
-	nil,                         // 25: hashicorp.consul.resource.Resource.StatusEntry
-	(*anypb.Any)(nil),           // 26: google.protobuf.Any
+	(Condition_State)(0),          // 0: hashicorp.consul.resource.Condition.State
+	(WatchEvent_Operation)(0),     // 1: hashicorp.consul.resource.WatchEvent.Operation
+	(*Type)(nil),                  // 2: hashicorp.consul.resource.Type
+	(*Tenancy)(nil),               // 3: hashicorp.consul.resource.Tenancy
+	(*ID)(nil),                    // 4: hashicorp.consul.resource.ID
+	(*Resource)(nil),              // 5: hashicorp.consul.resource.Resource
+	(*Status)(nil),                // 6: hashicorp.consul.resource.Status
+	(*Condition)(nil),             // 7: hashicorp.consul.resource.Condition
+	(*Reference)(nil),             // 8: hashicorp.consul.resource.Reference
+	(*Tombstone)(nil),             // 9: hashicorp.consul.resource.Tombstone
+	(*ReadRequest)(nil),           // 10: hashicorp.consul.resource.ReadRequest
+	(*ReadResponse)(nil),          // 11: hashicorp.consul.resource.ReadResponse
+	(*ListRequest)(nil),           // 12: hashicorp.consul.resource.ListRequest
+	(*ListResponse)(nil),          // 13: hashicorp.consul.resource.ListResponse
+	(*ListByOwnerRequest)(nil),    // 14: hashicorp.consul.resource.ListByOwnerRequest
+	(*ListByOwnerResponse)(nil),   // 15: hashicorp.consul.resource.ListByOwnerResponse
+	(*WriteRequest)(nil),          // 16: hashicorp.consul.resource.WriteRequest
+	(*WriteResponse)(nil),         // 17: hashicorp.consul.resource.WriteResponse
+	(*WriteStatusRequest)(nil),    // 18: hashicorp.consul.resource.WriteStatusRequest
+	(*WriteStatusResponse)(nil),   // 19: hashicorp.consul.resource.WriteStatusResponse
+	(*DeleteRequest)(nil),         // 20: hashicorp.consul.resource.DeleteRequest
+	(*DeleteResponse)(nil),        // 21: hashicorp.consul.resource.DeleteResponse
+	(*WatchListRequest)(nil),      // 22: hashicorp.consul.resource.WatchListRequest
+	(*WatchEvent)(nil),            // 23: hashicorp.consul.resource.WatchEvent
+	nil,                           // 24: hashicorp.consul.resource.Resource.MetadataEntry
+	nil,                           // 25: hashicorp.consul.resource.Resource.StatusEntry
+	(*anypb.Any)(nil),             // 26: google.protobuf.Any
+	(*timestamppb.Timestamp)(nil), // 27: google.protobuf.Timestamp
 }
 var file_pbresource_resource_proto_depIdxs = []int32{
 	2,  // 0: hashicorp.consul.resource.ID.type:type_name -> hashicorp.consul.resource.Type
@@ -1859,48 +1876,49 @@ var file_pbresource_resource_proto_depIdxs = []int32{
 	25, // 5: hashicorp.consul.resource.Resource.status:type_name -> hashicorp.consul.resource.Resource.StatusEntry
 	26, // 6: hashicorp.consul.resource.Resource.data:type_name -> google.protobuf.Any
 	7,  // 7: hashicorp.consul.resource.Status.conditions:type_name -> hashicorp.consul.resource.Condition
-	0,  // 8: hashicorp.consul.resource.Condition.state:type_name -> hashicorp.consul.resource.Condition.State
-	8,  // 9: hashicorp.consul.resource.Condition.resource:type_name -> hashicorp.consul.resource.Reference
-	2,  // 10: hashicorp.consul.resource.Reference.type:type_name -> hashicorp.consul.resource.Type
-	3,  // 11: hashicorp.consul.resource.Reference.tenancy:type_name -> hashicorp.consul.resource.Tenancy
-	4,  // 12: hashicorp.consul.resource.Tombstone.owner:type_name -> hashicorp.consul.resource.ID
-	4,  // 13: hashicorp.consul.resource.ReadRequest.id:type_name -> hashicorp.consul.resource.ID
-	5,  // 14: hashicorp.consul.resource.ReadResponse.resource:type_name -> hashicorp.consul.resource.Resource
-	2,  // 15: hashicorp.consul.resource.ListRequest.type:type_name -> hashicorp.consul.resource.Type
-	3,  // 16: hashicorp.consul.resource.ListRequest.tenancy:type_name -> hashicorp.consul.resource.Tenancy
-	5,  // 17: hashicorp.consul.resource.ListResponse.resources:type_name -> hashicorp.consul.resource.Resource
-	4,  // 18: hashicorp.consul.resource.ListByOwnerRequest.owner:type_name -> hashicorp.consul.resource.ID
-	5,  // 19: hashicorp.consul.resource.ListByOwnerResponse.resources:type_name -> hashicorp.consul.resource.Resource
-	5,  // 20: hashicorp.consul.resource.WriteRequest.resource:type_name -> hashicorp.consul.resource.Resource
-	5,  // 21: hashicorp.consul.resource.WriteResponse.resource:type_name -> hashicorp.consul.resource.Resource
-	4,  // 22: hashicorp.consul.resource.WriteStatusRequest.id:type_name -> hashicorp.consul.resource.ID
-	6,  // 23: hashicorp.consul.resource.WriteStatusRequest.status:type_name -> hashicorp.consul.resource.Status
-	5,  // 24: hashicorp.consul.resource.WriteStatusResponse.resource:type_name -> hashicorp.consul.resource.Resource
-	4,  // 25: hashicorp.consul.resource.DeleteRequest.id:type_name -> hashicorp.consul.resource.ID
-	2,  // 26: hashicorp.consul.resource.WatchListRequest.type:type_name -> hashicorp.consul.resource.Type
-	3,  // 27: hashicorp.consul.resource.WatchListRequest.tenancy:type_name -> hashicorp.consul.resource.Tenancy
-	1,  // 28: hashicorp.consul.resource.WatchEvent.operation:type_name -> hashicorp.consul.resource.WatchEvent.Operation
-	5,  // 29: hashicorp.consul.resource.WatchEvent.resource:type_name -> hashicorp.consul.resource.Resource
-	6,  // 30: hashicorp.consul.resource.Resource.StatusEntry.value:type_name -> hashicorp.consul.resource.Status
-	10, // 31: hashicorp.consul.resource.ResourceService.Read:input_type -> hashicorp.consul.resource.ReadRequest
-	16, // 32: hashicorp.consul.resource.ResourceService.Write:input_type -> hashicorp.consul.resource.WriteRequest
-	18, // 33: hashicorp.consul.resource.ResourceService.WriteStatus:input_type -> hashicorp.consul.resource.WriteStatusRequest
-	12, // 34: hashicorp.consul.resource.ResourceService.List:input_type -> hashicorp.consul.resource.ListRequest
-	14, // 35: hashicorp.consul.resource.ResourceService.ListByOwner:input_type -> hashicorp.consul.resource.ListByOwnerRequest
-	20, // 36: hashicorp.consul.resource.ResourceService.Delete:input_type -> hashicorp.consul.resource.DeleteRequest
-	22, // 37: hashicorp.consul.resource.ResourceService.WatchList:input_type -> hashicorp.consul.resource.WatchListRequest
-	11, // 38: hashicorp.consul.resource.ResourceService.Read:output_type -> hashicorp.consul.resource.ReadResponse
-	17, // 39: hashicorp.consul.resource.ResourceService.Write:output_type -> hashicorp.consul.resource.WriteResponse
-	19, // 40: hashicorp.consul.resource.ResourceService.WriteStatus:output_type -> hashicorp.consul.resource.WriteStatusResponse
-	13, // 41: hashicorp.consul.resource.ResourceService.List:output_type -> hashicorp.consul.resource.ListResponse
-	15, // 42: hashicorp.consul.resource.ResourceService.ListByOwner:output_type -> hashicorp.consul.resource.ListByOwnerResponse
-	21, // 43: hashicorp.consul.resource.ResourceService.Delete:output_type -> hashicorp.consul.resource.DeleteResponse
-	23, // 44: hashicorp.consul.resource.ResourceService.WatchList:output_type -> hashicorp.consul.resource.WatchEvent
-	38, // [38:45] is the sub-list for method output_type
-	31, // [31:38] is the sub-list for method input_type
-	31, // [31:31] is the sub-list for extension type_name
-	31, // [31:31] is the sub-list for extension extendee
-	0,  // [0:31] is the sub-list for field type_name
+	27, // 8: hashicorp.consul.resource.Status.updated_at:type_name -> google.protobuf.Timestamp
+	0,  // 9: hashicorp.consul.resource.Condition.state:type_name -> hashicorp.consul.resource.Condition.State
+	8,  // 10: hashicorp.consul.resource.Condition.resource:type_name -> hashicorp.consul.resource.Reference
+	2,  // 11: hashicorp.consul.resource.Reference.type:type_name -> hashicorp.consul.resource.Type
+	3,  // 12: hashicorp.consul.resource.Reference.tenancy:type_name -> hashicorp.consul.resource.Tenancy
+	4,  // 13: hashicorp.consul.resource.Tombstone.owner:type_name -> hashicorp.consul.resource.ID
+	4,  // 14: hashicorp.consul.resource.ReadRequest.id:type_name -> hashicorp.consul.resource.ID
+	5,  // 15: hashicorp.consul.resource.ReadResponse.resource:type_name -> hashicorp.consul.resource.Resource
+	2,  // 16: hashicorp.consul.resource.ListRequest.type:type_name -> hashicorp.consul.resource.Type
+	3,  // 17: hashicorp.consul.resource.ListRequest.tenancy:type_name -> hashicorp.consul.resource.Tenancy
+	5,  // 18: hashicorp.consul.resource.ListResponse.resources:type_name -> hashicorp.consul.resource.Resource
+	4,  // 19: hashicorp.consul.resource.ListByOwnerRequest.owner:type_name -> hashicorp.consul.resource.ID
+	5,  // 20: hashicorp.consul.resource.ListByOwnerResponse.resources:type_name -> hashicorp.consul.resource.Resource
+	5,  // 21: hashicorp.consul.resource.WriteRequest.resource:type_name -> hashicorp.consul.resource.Resource
+	5,  // 22: hashicorp.consul.resource.WriteResponse.resource:type_name -> hashicorp.consul.resource.Resource
+	4,  // 23: hashicorp.consul.resource.WriteStatusRequest.id:type_name -> hashicorp.consul.resource.ID
+	6,  // 24: hashicorp.consul.resource.WriteStatusRequest.status:type_name -> hashicorp.consul.resource.Status
+	5,  // 25: hashicorp.consul.resource.WriteStatusResponse.resource:type_name -> hashicorp.consul.resource.Resource
+	4,  // 26: hashicorp.consul.resource.DeleteRequest.id:type_name -> hashicorp.consul.resource.ID
+	2,  // 27: hashicorp.consul.resource.WatchListRequest.type:type_name -> hashicorp.consul.resource.Type
+	3,  // 28: hashicorp.consul.resource.WatchListRequest.tenancy:type_name -> hashicorp.consul.resource.Tenancy
+	1,  // 29: hashicorp.consul.resource.WatchEvent.operation:type_name -> hashicorp.consul.resource.WatchEvent.Operation
+	5,  // 30: hashicorp.consul.resource.WatchEvent.resource:type_name -> hashicorp.consul.resource.Resource
+	6,  // 31: hashicorp.consul.resource.Resource.StatusEntry.value:type_name -> hashicorp.consul.resource.Status
+	10, // 32: hashicorp.consul.resource.ResourceService.Read:input_type -> hashicorp.consul.resource.ReadRequest
+	16, // 33: hashicorp.consul.resource.ResourceService.Write:input_type -> hashicorp.consul.resource.WriteRequest
+	18, // 34: hashicorp.consul.resource.ResourceService.WriteStatus:input_type -> hashicorp.consul.resource.WriteStatusRequest
+	12, // 35: hashicorp.consul.resource.ResourceService.List:input_type -> hashicorp.consul.resource.ListRequest
+	14, // 36: hashicorp.consul.resource.ResourceService.ListByOwner:input_type -> hashicorp.consul.resource.ListByOwnerRequest
+	20, // 37: hashicorp.consul.resource.ResourceService.Delete:input_type -> hashicorp.consul.resource.DeleteRequest
+	22, // 38: hashicorp.consul.resource.ResourceService.WatchList:input_type -> hashicorp.consul.resource.WatchListRequest
+	11, // 39: hashicorp.consul.resource.ResourceService.Read:output_type -> hashicorp.consul.resource.ReadResponse
+	17, // 40: hashicorp.consul.resource.ResourceService.Write:output_type -> hashicorp.consul.resource.WriteResponse
+	19, // 41: hashicorp.consul.resource.ResourceService.WriteStatus:output_type -> hashicorp.consul.resource.WriteStatusResponse
+	13, // 42: hashicorp.consul.resource.ResourceService.List:output_type -> hashicorp.consul.resource.ListResponse
+	15, // 43: hashicorp.consul.resource.ResourceService.ListByOwner:output_type -> hashicorp.consul.resource.ListByOwnerResponse
+	21, // 44: hashicorp.consul.resource.ResourceService.Delete:output_type -> hashicorp.consul.resource.DeleteResponse
+	23, // 45: hashicorp.consul.resource.ResourceService.WatchList:output_type -> hashicorp.consul.resource.WatchEvent
+	39, // [39:46] is the sub-list for method output_type
+	32, // [32:39] is the sub-list for method input_type
+	32, // [32:32] is the sub-list for extension type_name
+	32, // [32:32] is the sub-list for extension extendee
+	0,  // [0:32] is the sub-list for field type_name
 }
 
 func init() { file_pbresource_resource_proto_init() }
diff --git a/proto-public/pbresource/resource.proto b/proto-public/pbresource/resource.proto
index b3f7a039cd75..038f96c7a5bd 100644
--- a/proto-public/pbresource/resource.proto
+++ b/proto-public/pbresource/resource.proto
@@ -7,6 +7,7 @@ package hashicorp.consul.resource;
 
 import "annotations/ratelimit/ratelimit.proto";
 import "google/protobuf/any.proto";
+import "google/protobuf/timestamp.proto";
 
 // Type describes a resource's type. It follows the GVK (Group Version Kind)
 // [pattern](https://book.kubebuilder.io/cronjob-tutorial/gvks.html) established
@@ -124,6 +125,9 @@ message Status {
   // Conditions contains a set of discreet observations about the resource in
   // relation to the current state of the system (e.g. it is semantically valid).
   repeated Condition conditions = 2;
+
+  // UpdatedAt is the time at which the status was last written.
+  google.protobuf.Timestamp updated_at = 3;
 }
 
 // Condition represents a discreet observation about a resource in relation to
@@ -224,6 +228,14 @@ service ResourceService {
   // By default, reads are eventually consistent, but you can opt-in to strong
   // consistency via the x-consul-consistency-mode metadata (see ResourceService
   // docs for more info).
+  //
+  // Errors with NotFound if the resource is not found.
+  //
+  // Errors with InvalidArgument if the request fails validation or the resource
+  // is stored as a type with a different GroupVersion than was requested.
+  //
+  // Errors with PermissionDenied if the caller is not authorized to read
+  // the resource.
   rpc Read(ReadRequest) returns (ReadResponse) {
     option (hashicorp.consul.internal.ratelimit.spec) = {
       operation_type: OPERATION_TYPE_READ,
diff --git a/proto-public/pbresource/resource_grpc.pb.go b/proto-public/pbresource/resource_grpc.pb.go
index af51fba75bdd..d15b677a270e 100644
--- a/proto-public/pbresource/resource_grpc.pb.go
+++ b/proto-public/pbresource/resource_grpc.pb.go
@@ -27,6 +27,14 @@ type ResourceServiceClient interface {
 	// By default, reads are eventually consistent, but you can opt-in to strong
 	// consistency via the x-consul-consistency-mode metadata (see ResourceService
 	// docs for more info).
+	//
+	// Errors with NotFound if the resource is not found.
+	//
+	// Errors with InvalidArgument if the request fails validation or the resource
+	// is stored as a type with a different GroupVersion than was requested.
+	//
+	// Errors with PermissionDenied if the caller is not authorized to read
+	// the resource.
 	Read(ctx context.Context, in *ReadRequest, opts ...grpc.CallOption) (*ReadResponse, error)
 	// Write a resource.
 	//
@@ -204,6 +212,14 @@ type ResourceServiceServer interface {
 	// By default, reads are eventually consistent, but you can opt-in to strong
 	// consistency via the x-consul-consistency-mode metadata (see ResourceService
 	// docs for more info).
+	//
+	// Errors with NotFound if the resource is not found.
+	//
+	// Errors with InvalidArgument if the request fails validation or the resource
+	// is stored as a type with a different GroupVersion than was requested.
+	//
+	// Errors with PermissionDenied if the caller is not authorized to read
+	// the resource.
 	Read(context.Context, *ReadRequest) (*ReadResponse, error)
 	// Write a resource.
 	//

From 48f7d99305d9c13d40fec88cb40bde496996699c Mon Sep 17 00:00:00 2001
From: cskh <hui.kang@hashicorp.com>
Date: Tue, 9 May 2023 15:28:52 -0400
Subject: [PATCH 63/92] snapshot: some improvments to the snapshot process
 (#17236)

* snapshot: some improvments to the snapshot process

Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
Co-authored-by: Chris S. Kim <ckim@hashicorp.com>
---
 .changelog/17236.txt                       | 3 +++
 agent/consul/server.go                     | 2 +-
 snapshot/snapshot.go                       | 3 ++-
 website/content/commands/snapshot/save.mdx | 4 +++-
 4 files changed, 9 insertions(+), 3 deletions(-)
 create mode 100644 .changelog/17236.txt

diff --git a/.changelog/17236.txt b/.changelog/17236.txt
new file mode 100644
index 000000000000..c824bb7ed782
--- /dev/null
+++ b/.changelog/17236.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+logging: change snapshot log header from `agent.server.snapshot` to `agent.server.raft.snapshot`
+```
diff --git a/agent/consul/server.go b/agent/consul/server.go
index 5ea0da7446d1..52236e8b5d00 100644
--- a/agent/consul/server.go
+++ b/agent/consul/server.go
@@ -1056,7 +1056,7 @@ func (s *Server) setupRaft() error {
 		log = cacheStore
 
 		// Create the snapshot store.
-		snapshots, err := raft.NewFileSnapshotStoreWithLogger(path, snapshotsRetained, s.logger.Named("snapshot"))
+		snapshots, err := raft.NewFileSnapshotStoreWithLogger(path, snapshotsRetained, s.logger.Named("raft.snapshot"))
 		if err != nil {
 			return err
 		}
diff --git a/snapshot/snapshot.go b/snapshot/snapshot.go
index fbe8660f0f2a..a1deee9153dc 100644
--- a/snapshot/snapshot.go
+++ b/snapshot/snapshot.go
@@ -53,6 +53,7 @@ func New(logger hclog.Logger, r *raft.Raft) (*Snapshot, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to create snapshot file: %v", err)
 	}
+	logger.Debug("creating temporary file of snapshot", "path", archive.Name())
 
 	// If anything goes wrong after this point, we will attempt to clean up
 	// the temp file. The happy path will disarm this.
@@ -112,7 +113,7 @@ func (s *Snapshot) Read(p []byte) (n int, err error) {
 }
 
 // Close closes the snapshot and removes any temporary storage associated with
-// it. You must arrange to call this whenever NewSnapshot() has been called
+// it. You must arrange to call this whenever New() has been called
 // successfully. This is safe to call on a nil snapshot.
 func (s *Snapshot) Close() error {
 	if s == nil {
diff --git a/website/content/commands/snapshot/save.mdx b/website/content/commands/snapshot/save.mdx
index 63b0fbe48f3d..18ffc50150ab 100644
--- a/website/content/commands/snapshot/save.mdx
+++ b/website/content/commands/snapshot/save.mdx
@@ -20,7 +20,8 @@ If ACLs are enabled, a management token must be supplied in order to perform
 a snapshot save.
 
 -> Note that saving a snapshot involves the server process writing the snapshot to a
-temporary file on-disk before sending that file to the CLI client. The default location
+temporary file on-disk before sending that file to the CLI client. Upon successful completion,
+Consul removes the temporary file. The default location of the temporary file
 can vary depending on operating system, but typically is `/tmp`. You can get more detailed
 information on default locations in the Go documentation for [os.TempDir](https://golang.org/pkg/os/#TempDir).
 If you need to change this location, you can do so by setting the `TMPDIR` environment
@@ -28,6 +29,7 @@ variable for the Consul server processes. Keep in mind that setting the environm
 the CLI client attempting to perform a snapshot save will have no effect. It _must_ be set in
 the context of the server process. If you're using Systemd to manage your Consul server
 processes, then adding `Environment=TMPDIR=/path/to/dir` to your Consul unit file will work.
+As a result of the Raft snapshot, Consul also saves one snapshot file at `data_dir/raft/snapshots`.
 
 The table below shows this command's [required ACLs](/consul/api-docs/api-structure#authentication). Configuration of
 [blocking queries](/consul/api-docs/features/blocking) and [agent caching](/consul/api-docs/features/caching)

From 5ecab506a6748670ddb95405924eac9cdc50f02b Mon Sep 17 00:00:00 2001
From: Derek Menteer <105233703+hashi-derek@users.noreply.github.com>
Date: Tue, 9 May 2023 16:36:29 -0500
Subject: [PATCH 64/92] Fix ent bug caused by #17241. (#17278)

Fix ent bug caused by #17241

All tests passed in OSS, but not ENT. This is a patch to resolve
the problem for both.
---
 agent/consul/health_endpoint.go | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/agent/consul/health_endpoint.go b/agent/consul/health_endpoint.go
index 6913136d3844..945b3b2eb82a 100644
--- a/agent/consul/health_endpoint.go
+++ b/agent/consul/health_endpoint.go
@@ -214,6 +214,14 @@ func (h *Health) ServiceNodes(args *structs.ServiceSpecificRequest, reply *struc
 		f = h.serviceNodesDefault
 	}
 
+	authzContext := acl.AuthorizerContext{
+		Peer: args.PeerName,
+	}
+	authz, err := h.srv.ResolveTokenAndDefaultMeta(args.Token, &args.EnterpriseMeta, &authzContext)
+	if err != nil {
+		return err
+	}
+
 	if err := h.srv.validateEnterpriseRequest(&args.EnterpriseMeta, false); err != nil {
 		return err
 	}
@@ -239,14 +247,6 @@ func (h *Health) ServiceNodes(args *structs.ServiceSpecificRequest, reply *struc
 				return err
 			}
 
-			authzContext := acl.AuthorizerContext{
-				Peer: args.PeerName,
-			}
-			authz, err := h.srv.ResolveTokenAndDefaultMeta(args.Token, &args.EnterpriseMeta, &authzContext)
-			if err != nil {
-				return err
-			}
-
 			// If we're doing a connect or ingress query, we need read access to the service
 			// we're trying to find proxies for, so check that.
 			if args.Connect || args.Ingress {

From 6c24a66f73db1d261f4d25c49438b2fa2338f4aa Mon Sep 17 00:00:00 2001
From: Dan Upton <daniel@floppy.co>
Date: Wed, 10 May 2023 10:37:54 +0100
Subject: [PATCH 65/92] resource: optionally compare timestamps in
 `EqualStatus` (#17275)

---
 internal/resource/demo/controller.go |  2 +-
 internal/resource/equality.go        | 13 +++++++++---
 internal/resource/equality_test.go   | 30 +++++++++++++++++++++-------
 3 files changed, 34 insertions(+), 11 deletions(-)

diff --git a/internal/resource/demo/controller.go b/internal/resource/demo/controller.go
index db935ec065ba..11afc3bac5e6 100644
--- a/internal/resource/demo/controller.go
+++ b/internal/resource/demo/controller.go
@@ -111,7 +111,7 @@ func (r *artistReconciler) Reconcile(ctx context.Context, rt controller.Runtime,
 		Conditions:         conditions,
 	}
 
-	if resource.EqualStatus(res.Status[statusKeyArtistController], newStatus) {
+	if resource.EqualStatus(res.Status[statusKeyArtistController], newStatus, false) {
 		return nil
 	}
 
diff --git a/internal/resource/equality.go b/internal/resource/equality.go
index 100d4c7c95e2..c7c880cddc9e 100644
--- a/internal/resource/equality.go
+++ b/internal/resource/equality.go
@@ -52,7 +52,10 @@ func EqualID(a, b *pbresource.ID) bool {
 }
 
 // EqualStatus compares two statuses for equality without reflection.
-func EqualStatus(a, b *pbresource.Status) bool {
+//
+// Pass true for compareUpdatedAt to compare the UpdatedAt timestamps, which you
+// generally *don't* want when dirty checking the status in a controller.
+func EqualStatus(a, b *pbresource.Status, compareUpdatedAt bool) bool {
 	if a == b {
 		return true
 	}
@@ -65,6 +68,10 @@ func EqualStatus(a, b *pbresource.Status) bool {
 		return false
 	}
 
+	if compareUpdatedAt && !a.UpdatedAt.AsTime().Equal(b.UpdatedAt.AsTime()) {
+		return false
+	}
+
 	if len(a.Conditions) != len(b.Conditions) {
 		return false
 	}
@@ -125,7 +132,7 @@ func EqualStatusMap(a, b map[string]*pbresource.Status) bool {
 		if !ok {
 			return false
 		}
-		if !EqualStatus(av, bv) {
+		if !EqualStatus(av, bv, true) {
 			return false
 		}
 		compared[k] = struct{}{}
@@ -141,7 +148,7 @@ func EqualStatusMap(a, b map[string]*pbresource.Status) bool {
 			return false
 		}
 
-		if !EqualStatus(av, bv) {
+		if !EqualStatus(av, bv, true) {
 			return false
 		}
 	}
diff --git a/internal/resource/equality_test.go b/internal/resource/equality_test.go
index 45af9ea1801b..4fb7cb666b3a 100644
--- a/internal/resource/equality_test.go
+++ b/internal/resource/equality_test.go
@@ -6,10 +6,12 @@ package resource_test
 import (
 	"fmt"
 	"testing"
+	"time"
 
 	"github.com/oklog/ulid/v2"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/hashicorp/consul/internal/resource"
 	"github.com/hashicorp/consul/proto-public/pbresource"
@@ -310,17 +312,17 @@ func TestEqualStatus(t *testing.T) {
 
 	// Equal cases.
 	t.Run("same pointer", func(t *testing.T) {
-		require.True(t, resource.EqualStatus(orig, orig))
+		require.True(t, resource.EqualStatus(orig, orig, true))
 	})
 
 	t.Run("equal", func(t *testing.T) {
-		require.True(t, resource.EqualStatus(orig, clone(orig)))
+		require.True(t, resource.EqualStatus(orig, clone(orig), true))
 	})
 
 	// Not equal cases.
 	t.Run("nil", func(t *testing.T) {
-		require.False(t, resource.EqualStatus(orig, nil))
-		require.False(t, resource.EqualStatus(nil, orig))
+		require.False(t, resource.EqualStatus(orig, nil, true))
+		require.False(t, resource.EqualStatus(nil, orig, true))
 	})
 
 	testCases := map[string]func(*pbresource.Status){
@@ -366,10 +368,24 @@ func TestEqualStatus(t *testing.T) {
 			a, b := clone(orig), clone(orig)
 			modFn(b)
 
-			require.False(t, resource.EqualStatus(a, b))
-			require.False(t, resource.EqualStatus(b, a))
+			require.False(t, resource.EqualStatus(a, b, true))
+			require.False(t, resource.EqualStatus(b, a, true))
 		})
 	}
+
+	t.Run("compareUpdatedAt = true", func(t *testing.T) {
+		a, b := clone(orig), clone(orig)
+		b.UpdatedAt = timestamppb.New(b.UpdatedAt.AsTime().Add(1 * time.Minute))
+		require.False(t, resource.EqualStatus(a, b, true))
+		require.False(t, resource.EqualStatus(b, a, true))
+	})
+
+	t.Run("compareUpdatedAt = false", func(t *testing.T) {
+		a, b := clone(orig), clone(orig)
+		b.UpdatedAt = timestamppb.New(b.UpdatedAt.AsTime().Add(1 * time.Minute))
+		require.True(t, resource.EqualStatus(a, b, false))
+		require.True(t, resource.EqualStatus(b, a, false))
+	})
 }
 
 func TestEqualStatusMap(t *testing.T) {
@@ -615,7 +631,7 @@ func BenchmarkEqualStatus(b *testing.B) {
 
 	b.Run("ours", func(b *testing.B) {
 		for i := 0; i < b.N; i++ {
-			_ = resource.EqualStatus(statusA, statusB)
+			_ = resource.EqualStatus(statusA, statusB, true)
 		}
 	})
 

From 5030101cdb0611160b38e633f4eecf64cd205966 Mon Sep 17 00:00:00 2001
From: Dan Upton <daniel@floppy.co>
Date: Wed, 10 May 2023 10:38:48 +0100
Subject: [PATCH 66/92] resource: add missing validation to the `List` and
 `WatchList` endpoints (#17213)

---
 agent/grpc-external/services/resource/list.go | 17 +++++++++++
 .../services/resource/list_test.go            | 25 +++++++++++++++++
 .../grpc-external/services/resource/watch.go  | 17 +++++++++++
 .../services/resource/watch_test.go           | 28 +++++++++++++++++++
 4 files changed, 87 insertions(+)

diff --git a/agent/grpc-external/services/resource/list.go b/agent/grpc-external/services/resource/list.go
index 65cc37a2691c..77269e74688f 100644
--- a/agent/grpc-external/services/resource/list.go
+++ b/agent/grpc-external/services/resource/list.go
@@ -15,6 +15,10 @@ import (
 )
 
 func (s *Server) List(ctx context.Context, req *pbresource.ListRequest) (*pbresource.ListResponse, error) {
+	if err := validateListRequest(req); err != nil {
+		return nil, err
+	}
+
 	// check type
 	reg, err := s.resolveType(req.Type)
 	if err != nil {
@@ -65,3 +69,16 @@ func (s *Server) List(ctx context.Context, req *pbresource.ListRequest) (*pbreso
 	}
 	return &pbresource.ListResponse{Resources: result}, nil
 }
+
+func validateListRequest(req *pbresource.ListRequest) error {
+	var field string
+	switch {
+	case req.Type == nil:
+		field = "type"
+	case req.Tenancy == nil:
+		field = "tenancy"
+	default:
+		return nil
+	}
+	return status.Errorf(codes.InvalidArgument, "%s is required", field)
+}
diff --git a/agent/grpc-external/services/resource/list_test.go b/agent/grpc-external/services/resource/list_test.go
index b476c82aef7b..7128d5e3167c 100644
--- a/agent/grpc-external/services/resource/list_test.go
+++ b/agent/grpc-external/services/resource/list_test.go
@@ -22,6 +22,31 @@ import (
 	"google.golang.org/grpc/status"
 )
 
+func TestList_InputValidation(t *testing.T) {
+	server := testServer(t)
+	client := testClient(t, server)
+
+	demo.RegisterTypes(server.Registry)
+
+	testCases := map[string]func(*pbresource.ListRequest){
+		"no type":    func(req *pbresource.ListRequest) { req.Type = nil },
+		"no tenancy": func(req *pbresource.ListRequest) { req.Tenancy = nil },
+	}
+	for desc, modFn := range testCases {
+		t.Run(desc, func(t *testing.T) {
+			req := &pbresource.ListRequest{
+				Type:    demo.TypeV2Album,
+				Tenancy: demo.TenancyDefault,
+			}
+			modFn(req)
+
+			_, err := client.List(testContext(t), req)
+			require.Error(t, err)
+			require.Equal(t, codes.InvalidArgument.String(), status.Code(err).String())
+		})
+	}
+}
+
 func TestList_TypeNotFound(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)
diff --git a/agent/grpc-external/services/resource/watch.go b/agent/grpc-external/services/resource/watch.go
index 77ffe19b0908..2fd943a6c946 100644
--- a/agent/grpc-external/services/resource/watch.go
+++ b/agent/grpc-external/services/resource/watch.go
@@ -13,6 +13,10 @@ import (
 )
 
 func (s *Server) WatchList(req *pbresource.WatchListRequest, stream pbresource.ResourceService_WatchListServer) error {
+	if err := validateWatchListRequest(req); err != nil {
+		return err
+	}
+
 	// check type exists
 	reg, err := s.resolveType(req.Type)
 	if err != nil {
@@ -70,3 +74,16 @@ func (s *Server) WatchList(req *pbresource.WatchListRequest, stream pbresource.R
 		}
 	}
 }
+
+func validateWatchListRequest(req *pbresource.WatchListRequest) error {
+	var field string
+	switch {
+	case req.Type == nil:
+		field = "type"
+	case req.Tenancy == nil:
+		field = "tenancy"
+	default:
+		return nil
+	}
+	return status.Errorf(codes.InvalidArgument, "%s is required", field)
+}
diff --git a/agent/grpc-external/services/resource/watch_test.go b/agent/grpc-external/services/resource/watch_test.go
index b62dc8a4079f..687fe0d0679f 100644
--- a/agent/grpc-external/services/resource/watch_test.go
+++ b/agent/grpc-external/services/resource/watch_test.go
@@ -22,6 +22,34 @@ import (
 	"google.golang.org/grpc/status"
 )
 
+func TestWatchList_InputValidation(t *testing.T) {
+	server := testServer(t)
+	client := testClient(t, server)
+
+	demo.RegisterTypes(server.Registry)
+
+	testCases := map[string]func(*pbresource.WatchListRequest){
+		"no type":    func(req *pbresource.WatchListRequest) { req.Type = nil },
+		"no tenancy": func(req *pbresource.WatchListRequest) { req.Tenancy = nil },
+	}
+	for desc, modFn := range testCases {
+		t.Run(desc, func(t *testing.T) {
+			req := &pbresource.WatchListRequest{
+				Type:    demo.TypeV2Album,
+				Tenancy: demo.TenancyDefault,
+			}
+			modFn(req)
+
+			stream, err := client.WatchList(testContext(t), req)
+			require.NoError(t, err)
+
+			_, err = stream.Recv()
+			require.Error(t, err)
+			require.Equal(t, codes.InvalidArgument.String(), status.Code(err).String())
+		})
+	}
+}
+
 func TestWatchList_TypeNotFound(t *testing.T) {
 	t.Parallel()
 

From e9986e37745959eea29bd7fc1e1f087090dc5446 Mon Sep 17 00:00:00 2001
From: John Murret <john.murret@hashicorp.com>
Date: Wed, 10 May 2023 14:49:18 -0600
Subject: [PATCH 67/92] ci:upload test results to datadog (#17206)

* WIP

* ci:upload test results to datadog

* fix use of envvar in expression

* getting correct permission in reusable-unit.yml

* getting correct permission in reusable-unit.yml

* fixing DATADOG_API_KEY envvar expresssion

* pass datadog-api-key

* removing type from datadog-api-key
---
 .github/workflows/go-tests.yml            |  42 ++++++-
 .github/workflows/reusable-unit-split.yml |  33 +++++
 .github/workflows/reusable-unit.yml       |  33 +++++
 .github/workflows/test-integrations.yml   | 146 +++++++++++++++++++++-
 4 files changed, 247 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/go-tests.yml b/.github/workflows/go-tests.yml
index d15b874ef671..787f92560ec1 100644
--- a/.github/workflows/go-tests.yml
+++ b/.github/workflows/go-tests.yml
@@ -21,7 +21,6 @@ permissions:
 
 env:
   TEST_RESULTS: /tmp/test-results
-  GOTESTSUM_VERSION: 1.8.2
 
 jobs:
   setup:
@@ -215,6 +214,7 @@ jobs:
   #   secrets:
   #     elevated-github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
   #     consul-license: ${{secrets.CONSUL_LICENSE}}
+  #     datadog-api-key: "${{ !endsWith(github.repository, '-enterprise') && secrets.DATADOG_API_KEY || '' }}"
 
   go-test-oss:
     needs: 
@@ -227,9 +227,13 @@ jobs:
       runs-on: ${{ needs.setup.outputs.compute-xl }}
       repository-name: ${{ github.repository }}
       go-tags: ""
+    permissions:
+      id-token: write # NOTE: this permission is explicitly required for Vault auth.
+      contents: read    
     secrets:
       elevated-github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
       consul-license: ${{secrets.CONSUL_LICENSE}}
+      datadog-api-key: "${{ !endsWith(github.repository, '-enterprise') && secrets.DATADOG_API_KEY || '' }}"
 
   go-test-enterprise:
     if: ${{ endsWith(github.repository, '-enterprise') }}
@@ -243,9 +247,13 @@ jobs:
       runs-on: ${{ needs.setup.outputs.compute-xl }}
       repository-name: ${{ github.repository }}
       go-tags: "${{ github.event.repository.name == 'consul-enterprise' && 'consulent consulprem consuldev' || '' }}"
+    permissions:
+      id-token: write # NOTE: this permission is explicitly required for Vault auth.
+      contents: read    
     secrets:
       elevated-github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
       consul-license: ${{secrets.CONSUL_LICENSE}}
+      datadog-api-key: "${{ !endsWith(github.repository, '-enterprise') && secrets.DATADOG_API_KEY || '' }}"
 
   go-test-race:
     needs: 
@@ -259,9 +267,13 @@ jobs:
       runs-on: ${{ needs.setup.outputs.compute-xl }}
       repository-name: ${{ github.repository }}
       go-tags: "${{ github.event.repository.name == 'consul-enterprise' && 'consulent consulprem consuldev' || '' }}"
+    permissions:
+      id-token: write # NOTE: this permission is explicitly required for Vault auth.
+      contents: read    
     secrets:
       elevated-github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
       consul-license: ${{secrets.CONSUL_LICENSE}}
+      datadog-api-key: "${{ !endsWith(github.repository, '-enterprise') && secrets.DATADOG_API_KEY || '' }}"
 
   go-test-32bit:
     needs: 
@@ -275,9 +287,13 @@ jobs:
       runs-on: ${{ needs.setup.outputs.compute-xl }}
       repository-name: ${{ github.repository }}
       go-tags: "${{ github.event.repository.name == 'consul-enterprise' && 'consulent consulprem consuldev' || '' }}"
+    permissions:
+      id-token: write # NOTE: this permission is explicitly required for Vault auth.
+      contents: read    
     secrets:
       elevated-github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
       consul-license: ${{secrets.CONSUL_LICENSE}}
+      datadog-api-key: "${{ !endsWith(github.repository, '-enterprise') && secrets.DATADOG_API_KEY || '' }}"
 
   go-test-envoyextensions:
     needs:
@@ -289,9 +305,13 @@ jobs:
       runs-on: ${{ needs.setup.outputs.compute-xl }}
       repository-name: ${{ github.repository }}
       go-tags: "${{ github.event.repository.name == 'consul-enterprise' && 'consulent consulprem consuldev' || '' }}"
+    permissions:
+      id-token: write # NOTE: this permission is explicitly required for Vault auth.
+      contents: read    
     secrets:
       elevated-github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
       consul-license: ${{secrets.CONSUL_LICENSE}}
+      datadog-api-key: "${{ !endsWith(github.repository, '-enterprise') && secrets.DATADOG_API_KEY || '' }}"
 
   go-test-troubleshoot:
     needs:
@@ -303,9 +323,13 @@ jobs:
       runs-on: ${{ needs.setup.outputs.compute-xl }}
       repository-name: ${{ github.repository }}
       go-tags: "${{ github.event.repository.name == 'consul-enterprise' && 'consulent consulprem consuldev' || '' }}"
+    permissions:
+      id-token: write # NOTE: this permission is explicitly required for Vault auth.
+      contents: read    
     secrets:
       elevated-github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
       consul-license: ${{secrets.CONSUL_LICENSE}}
+      datadog-api-key: "${{ !endsWith(github.repository, '-enterprise') && secrets.DATADOG_API_KEY || '' }}"
 
   go-test-api-1-19:
     needs: 
@@ -317,9 +341,13 @@ jobs:
       runs-on: ${{ needs.setup.outputs.compute-xl }}
       repository-name: ${{ github.repository }}
       go-tags: "${{ github.event.repository.name == 'consul-enterprise' && 'consulent consulprem consuldev' || '' }}"
+    permissions:
+      id-token: write # NOTE: this permission is explicitly required for Vault auth.
+      contents: read    
     secrets:
       elevated-github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
       consul-license: ${{secrets.CONSUL_LICENSE}}
+      datadog-api-key: "${{ !endsWith(github.repository, '-enterprise') && secrets.DATADOG_API_KEY || '' }}"
 
   go-test-api-1-20:
     needs: 
@@ -331,9 +359,13 @@ jobs:
       runs-on: ${{ needs.setup.outputs.compute-xl }}
       repository-name: ${{ github.repository }}
       go-tags: "${{ github.event.repository.name == 'consul-enterprise' && 'consulent consulprem consuldev' || '' }}"
+    permissions:
+      id-token: write # NOTE: this permission is explicitly required for Vault auth.
+      contents: read    
     secrets:
       elevated-github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
       consul-license: ${{secrets.CONSUL_LICENSE}}
+      datadog-api-key: "${{ !endsWith(github.repository, '-enterprise') && secrets.DATADOG_API_KEY || '' }}"
 
   go-test-sdk-1-19:
     needs: 
@@ -345,9 +377,13 @@ jobs:
       runs-on: ${{ needs.setup.outputs.compute-xl }}
       repository-name: ${{ github.repository }}
       go-tags: "${{ github.event.repository.name == 'consul-enterprise' && 'consulent consulprem consuldev' || '' }}"
+    permissions:
+      id-token: write # NOTE: this permission is explicitly required for Vault auth.
+      contents: read    
     secrets:
       elevated-github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
       consul-license: ${{secrets.CONSUL_LICENSE}}
+      datadog-api-key: "${{ !endsWith(github.repository, '-enterprise') && secrets.DATADOG_API_KEY || '' }}"
 
   go-test-sdk-1-20:
     needs: 
@@ -359,9 +395,13 @@ jobs:
       runs-on: ${{ needs.setup.outputs.compute-xl }}
       repository-name: ${{ github.repository }}
       go-tags: "${{ github.event.repository.name == 'consul-enterprise' && 'consulent consulprem consuldev' || '' }}"
+    permissions:
+      id-token: write # NOTE: this permission is explicitly required for Vault auth.
+      contents: read    
     secrets:
       elevated-github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
       consul-license: ${{secrets.CONSUL_LICENSE}}
+      datadog-api-key: "${{ !endsWith(github.repository, '-enterprise') && secrets.DATADOG_API_KEY || '' }}"
 
   noop:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/reusable-unit-split.yml b/.github/workflows/reusable-unit-split.yml
index 0131582b0bef..f8088f4a8040 100644
--- a/.github/workflows/reusable-unit-split.yml
+++ b/.github/workflows/reusable-unit-split.yml
@@ -42,6 +42,8 @@ on:
         required: true
       consul-license:
         required: true
+      datadog-api-key:
+        required: true
 env:
   TEST_RESULTS: /tmp/test-results
   GOTESTSUM_VERSION: 1.8.2
@@ -49,6 +51,7 @@ env:
   TOTAL_RUNNERS: ${{inputs.runner-count}}
   CONSUL_LICENSE: ${{secrets.consul-license}}
   GOTAGS: ${{ inputs.go-tags}}
+  DATADOG_API_KEY: ${{secrets.datadog-api-key}}
   
 jobs:
   set-test-package-matrix:
@@ -128,6 +131,36 @@ jobs:
           -tags="${{env.GOTAGS}}" -p 2 \
           ${GO_TEST_FLAGS-} \
           -cover -coverprofile=coverage.txt
+
+      # NOTE: ENT specific step as we store secrets in Vault.
+      - name: Authenticate to Vault
+        if: ${{ endsWith(github.repository, '-enterprise') }}
+        id: vault-auth
+        run: vault-auth
+
+      # NOTE: ENT specific step as we store secrets in Vault.
+      - name: Fetch Secrets
+        if: ${{ endsWith(github.repository, '-enterprise') }}
+        id: secrets
+        uses: hashicorp/vault-action@v2.5.0
+        with:
+          url: ${{ steps.vault-auth.outputs.addr }}
+          caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
+          token: ${{ steps.vault-auth.outputs.token }}
+          secrets: |
+              kv/data/github/${{ github.repository }}/datadog apikey | DATADOG_API_KEY;
+
+      - name: prepare datadog-ci
+        if: ${{ !endsWith(github.repository, '-enterprise') }}
+        run: |
+          curl -L --fail "https://github.com/DataDog/datadog-ci/releases/latest/download/datadog-ci_linux-x64" --output "/usr/local/bin/datadog-ci"
+          chmod +x /usr/local/bin/datadog-ci
+
+      - name: upload coverage
+        env:
+          DD_ENV: ci
+        run: datadog-ci junit upload --service "$GITHUB_REPOSITORY" ${{env.TEST_RESULTS}}/gotestsum-report.xml
+
       - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # pin@v3.1.2
         with:
           name: test-results
diff --git a/.github/workflows/reusable-unit.yml b/.github/workflows/reusable-unit.yml
index fde340bd5edc..5fd47339e12f 100644
--- a/.github/workflows/reusable-unit.yml
+++ b/.github/workflows/reusable-unit.yml
@@ -38,12 +38,15 @@ on:
         required: true
       consul-license:
         required: true
+      datadog-api-key:
+        required: true
 env:
   TEST_RESULTS: /tmp/test-results
   GOTESTSUM_VERSION: 1.8.2
   GOARCH: ${{inputs.go-arch}}
   CONSUL_LICENSE: ${{secrets.consul-license}}
   GOTAGS: ${{ inputs.go-tags}}
+  DATADOG_API_KEY: ${{secrets.datadog-api-key}}
   
 jobs:
   go-test:
@@ -96,6 +99,36 @@ jobs:
               -tags="${{env.GOTAGS}}" \
               ${GO_TEST_FLAGS-} \
               -cover -coverprofile=coverage.txt
+
+      # NOTE: ENT specific step as we store secrets in Vault.
+      - name: Authenticate to Vault
+        if: ${{ endsWith(github.repository, '-enterprise') }}
+        id: vault-auth
+        run: vault-auth
+
+      # NOTE: ENT specific step as we store secrets in Vault.
+      - name: Fetch Secrets
+        if: ${{ endsWith(github.repository, '-enterprise') }}
+        id: secrets
+        uses: hashicorp/vault-action@v2.5.0
+        with:
+          url: ${{ steps.vault-auth.outputs.addr }}
+          caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
+          token: ${{ steps.vault-auth.outputs.token }}
+          secrets: |
+              kv/data/github/${{ github.repository }}/datadog apikey | DATADOG_API_KEY;
+
+      - name: prepare datadog-ci
+        if: ${{ !endsWith(github.repository, '-enterprise') }}
+        run: |
+          curl -L --fail "https://github.com/DataDog/datadog-ci/releases/latest/download/datadog-ci_linux-x64" --output "/usr/local/bin/datadog-ci"
+          chmod +x /usr/local/bin/datadog-ci
+
+      - name: upload coverage
+        env:
+          DD_ENV: ci
+        run: datadog-ci junit upload --service "$GITHUB_REPOSITORY" ${{env.TEST_RESULTS}}/gotestsum-report.xml
+
       - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # pin@v3.1.2
         with:
           name: test-results
diff --git a/.github/workflows/test-integrations.yml b/.github/workflows/test-integrations.yml
index 33d1ccc9e207..460749fc971a 100644
--- a/.github/workflows/test-integrations.yml
+++ b/.github/workflows/test-integrations.yml
@@ -54,6 +54,9 @@ jobs:
     needs:
       - setup
       - dev-build
+    permissions:
+      id-token: write # NOTE: this permission is explicitly required for Vault auth.
+      contents: read
     strategy:
       matrix:
         nomad-version: ['v1.3.3', 'v1.2.10', 'v1.1.16']
@@ -92,12 +95,45 @@ jobs:
             --packages="./command/agent/consul" \
             --junitfile $TEST_RESULTS_DIR/results.xml -- \
             -run TestConsul
+      
+      # NOTE: ENT specific step as we store secrets in Vault.
+      - name: Authenticate to Vault
+        if: ${{ endsWith(github.repository, '-enterprise') }}
+        id: vault-auth
+        run: vault-auth
+
+      # NOTE: ENT specific step as we store secrets in Vault.
+      - name: Fetch Secrets
+        if: ${{ endsWith(github.repository, '-enterprise') }}
+        id: secrets
+        uses: hashicorp/vault-action@v2.5.0
+        with:
+          url: ${{ steps.vault-auth.outputs.addr }}
+          caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
+          token: ${{ steps.vault-auth.outputs.token }}
+          secrets: |
+              kv/data/github/${{ github.repository }}/datadog apikey | DATADOG_API_KEY;
+
+      - name: prepare datadog-ci
+        if: ${{ !endsWith(github.repository, '-enterprise') }}
+        run: |
+          curl -L --fail "https://github.com/DataDog/datadog-ci/releases/latest/download/datadog-ci_linux-x64" --output "/usr/local/bin/datadog-ci"
+          chmod +x /usr/local/bin/datadog-ci
+
+      - name: upload coverage
+        env:
+          DATADOG_API_KEY: "${{ endsWith(github.repository, '-enterprise') && env.DATADOG_API_KEY || secrets.DATADOG_API_KEY }}"
+          DD_ENV: ci
+        run: datadog-ci junit upload --service "$GITHUB_REPOSITORY" $TEST_RESULTS_DIR/results.xml
 
   vault-integration-test:
     runs-on: ${{ fromJSON(needs.setup.outputs.compute-large) }}
     needs:
       - setup
       - dev-build
+    permissions:
+      id-token: write # NOTE: this permission is explicitly required for Vault auth.
+      contents: read
     strategy:
       matrix:
         vault-version: ["1.13.1", "1.12.5", "1.11.9", "1.10.11"]
@@ -139,6 +175,48 @@ jobs:
             --junitfile "${{ env.TEST_RESULTS_DIR }}/gotestsum-report-agent.xml" \
             -- -tags "${{ env.GOTAGS }}" -cover -coverprofile=coverage-agent.txt -run Vault ./agent
 
+      # NOTE: ENT specific step as we store secrets in Vault.
+      - name: Authenticate to Vault
+        if: ${{ endsWith(github.repository, '-enterprise') }}
+        id: vault-auth
+        run: vault-auth
+
+      # NOTE: ENT specific step as we store secrets in Vault.
+      - name: Fetch Secrets
+        if: ${{ endsWith(github.repository, '-enterprise') }}
+        id: secrets
+        uses: hashicorp/vault-action@v2.5.0
+        with:
+          url: ${{ steps.vault-auth.outputs.addr }}
+          caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
+          token: ${{ steps.vault-auth.outputs.token }}
+          secrets: |
+              kv/data/github/${{ github.repository }}/datadog apikey | DATADOG_API_KEY;
+
+      - name: prepare datadog-ci
+        if: ${{ !endsWith(github.repository, '-enterprise') }}
+        run: |
+          curl -L --fail "https://github.com/DataDog/datadog-ci/releases/latest/download/datadog-ci_linux-x64" --output "/usr/local/bin/datadog-ci"
+          chmod +x /usr/local/bin/datadog-ci
+
+      - name: upload coverage
+        env:
+          DATADOG_API_KEY: "${{ endsWith(github.repository, '-enterprise') && env.DATADOG_API_KEY || secrets.DATADOG_API_KEY }}"
+          DD_ENV: ci
+        run: datadog-ci junit upload --service "$GITHUB_REPOSITORY" "${{ env.TEST_RESULTS_DIR }}/gotestsum-report.xml"
+
+      - name: upload leader coverage
+        env:
+          DATADOG_API_KEY: "${{ endsWith(github.repository, '-enterprise') && env.DATADOG_API_KEY || secrets.DATADOG_API_KEY }}"
+          DD_ENV: ci
+        run: datadog-ci junit upload --service "$GITHUB_REPOSITORY" "${{ env.TEST_RESULTS_DIR }}/gotestsum-report-leader.xml"
+
+      - name: upload agent coverage
+        env:
+          DATADOG_API_KEY: "${{ endsWith(github.repository, '-enterprise') && env.DATADOG_API_KEY || secrets.DATADOG_API_KEY }}"
+          DD_ENV: ci
+        run: datadog-ci junit upload --service "$GITHUB_REPOSITORY" "${{ env.TEST_RESULTS_DIR }}/gotestsum-report-agent.xml"
+
   generate-envoy-job-matrices:
     needs: [setup]
     runs-on: ${{ fromJSON(needs.setup.outputs.compute-small) }}
@@ -181,6 +259,9 @@ jobs:
       - setup
       - generate-envoy-job-matrices
       - dev-build
+    permissions:
+      id-token: write # NOTE: this permission is explicitly required for Vault auth.
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -232,10 +313,35 @@ jobs:
               --packages=./test/integration/connect/envoy \
               -- -timeout=30m -tags integration -run="TestEnvoy/(${{ matrix.test-cases }})"
 
-      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+      # NOTE: ENT specific step as we store secrets in Vault.
+      - name: Authenticate to Vault
+        if: ${{ endsWith(github.repository, '-enterprise') }}
+        id: vault-auth
+        run: vault-auth
+
+      # NOTE: ENT specific step as we store secrets in Vault.
+      - name: Fetch Secrets
+        if: ${{ endsWith(github.repository, '-enterprise') }}
+        id: secrets
+        uses: hashicorp/vault-action@v2.5.0
         with:
-          name: ${{ env.TEST_RESULTS_ARTIFACT_NAME }}
-          path: ${{ env.TEST_RESULTS_DIR }}
+          url: ${{ steps.vault-auth.outputs.addr }}
+          caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
+          token: ${{ steps.vault-auth.outputs.token }}
+          secrets: |
+              kv/data/github/${{ github.repository }}/datadog apikey | DATADOG_API_KEY;
+
+      - name: prepare datadog-ci
+        if: ${{ !endsWith(github.repository, '-enterprise') }}
+        run: |
+          curl -L --fail "https://github.com/DataDog/datadog-ci/releases/latest/download/datadog-ci_linux-x64" --output "/usr/local/bin/datadog-ci"
+          chmod +x /usr/local/bin/datadog-ci
+
+      - name: upload coverage
+        env:
+          DATADOG_API_KEY: "${{ endsWith(github.repository, '-enterprise') && env.DATADOG_API_KEY || secrets.DATADOG_API_KEY }}"
+          DD_ENV: ci
+        run: datadog-ci junit upload --service "$GITHUB_REPOSITORY" $TEST_RESULTS_DIR/results.xml
 
   generate-compatibility-job-matrices:
     needs: [setup]
@@ -274,6 +380,9 @@ jobs:
       - setup
       - dev-build
       - generate-compatibility-job-matrices
+    permissions:
+      id-token: write # NOTE: this permission is explicitly required for Vault auth.
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -335,10 +444,35 @@ jobs:
           # tput complains if this isn't set to something.
           TERM: ansi
 
-      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+      # NOTE: ENT specific step as we store secrets in Vault.
+      - name: Authenticate to Vault
+        if: ${{ endsWith(github.repository, '-enterprise') }}
+        id: vault-auth
+        run: vault-auth
+
+      # NOTE: ENT specific step as we store secrets in Vault.
+      - name: Fetch Secrets
+        if: ${{ endsWith(github.repository, '-enterprise') }}
+        id: secrets
+        uses: hashicorp/vault-action@v2.5.0
         with:
-          name: ${{ env.TEST_RESULTS_ARTIFACT_NAME }}
-          path: ${{ env.TEST_RESULTS_DIR }}
+          url: ${{ steps.vault-auth.outputs.addr }}
+          caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
+          token: ${{ steps.vault-auth.outputs.token }}
+          secrets: |
+              kv/data/github/${{ github.repository }}/datadog apikey | DATADOG_API_KEY;
+
+      - name: prepare datadog-ci
+        if: ${{ !endsWith(github.repository, '-enterprise') }}
+        run: |
+          curl -L --fail "https://github.com/DataDog/datadog-ci/releases/latest/download/datadog-ci_linux-x64" --output "/usr/local/bin/datadog-ci"
+          chmod +x /usr/local/bin/datadog-ci
+
+      - name: upload coverage
+        env:
+          DATADOG_API_KEY: "${{ endsWith(github.repository, '-enterprise') && env.DATADOG_API_KEY || secrets.DATADOG_API_KEY }}"
+          DD_ENV: ci
+        run: datadog-ci junit upload --service "$GITHUB_REPOSITORY" $TEST_RESULTS_DIR/results.xml
 
   generate-upgrade-job-matrices:
     needs: [setup]

From 0ee95df4e062790541c39d9bc0259e6f10974e15 Mon Sep 17 00:00:00 2001
From: "R.B. Boyer" <4903+rboyer@users.noreply.github.com>
Date: Thu, 11 May 2023 10:36:41 -0500
Subject: [PATCH 68/92] proto: clear out old ratelimit.tmp files before making
 new ones (#17292)

---
 build-support/scripts/protobuf.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/build-support/scripts/protobuf.sh b/build-support/scripts/protobuf.sh
index 0fe2bbecb29e..420d66d6a11b 100755
--- a/build-support/scripts/protobuf.sh
+++ b/build-support/scripts/protobuf.sh
@@ -45,6 +45,9 @@ function main {
         esac
     done
 
+    # clear old ratelimit.tmp files
+    find . -name .ratelimit.tmp -delete
+
     local mods=$(find . -name 'buf.gen.yaml' -exec dirname {} \; | sort)
     for mod in $mods
     do

From cd80ea18ff2393b31eb689dbf6118a110d3390de Mon Sep 17 00:00:00 2001
From: "R.B. Boyer" <4903+rboyer@users.noreply.github.com>
Date: Thu, 11 May 2023 11:08:57 -0500
Subject: [PATCH 69/92] grpc: ensure grpc resolver correctly uses lan/wan
 addresses on servers (#17270)

The grpc resolver implementation is fed from changes to the
router.Router. Within the router there is a map of various areas storing
the addressing information for servers in those areas. All map entries
are of the WAN variety except a single special entry for the LAN.

Addressing information in the LAN "area" are local addresses intended
for use when making a client-to-server or server-to-server request.

The client agent correctly updates this LAN area when receiving lan serf
events, so by extension the grpc resolver works fine in that scenario.

The server agent only initially populates a single entry in the LAN area
(for itself) on startup, and then never mutates that area map again.
For normal RPCs a different structure is used for LAN routing.

Additionally when selecting a server to contact in the local datacenter
it will randomly select addresses from either the LAN or WAN addressed
entries in the map.

Unfortunately this means that the grpc resolver stack as it exists on
server agents is either broken or only accidentally functions by having
servers dial each other over the WAN-accessible address. If the operator
disables the serf wan port completely likely this incidental functioning
would break.

This PR enforces that local requests for servers (both for stale reads
or leader forwarded requests) exclusively use the LAN "area" information
and also fixes it so that servers keep that area up to date in the
router.

A test for the grpc resolver logic was added, as well as a higher level
full-stack test to ensure the externally perceived bug does not return.
---
 .changelog/17270.txt                          |   3 +
 agent/consul/client_test.go                   |  10 +-
 agent/consul/server_serf.go                   |   4 +
 agent/consul/subscribe_backend_test.go        |   5 +-
 agent/grpc-internal/client_test.go            |  80 +++++--
 agent/grpc-internal/handler_test.go           |   4 +-
 agent/grpc-internal/resolver/resolver.go      |  71 ++++++-
 agent/grpc-internal/resolver/resolver_test.go | 195 ++++++++++++++++++
 agent/peering_endpoint_test.go                | 190 +++++++++++++++++
 agent/rpc/peering/service_test.go             |  14 +-
 agent/setup.go                                |   7 +
 11 files changed, 552 insertions(+), 31 deletions(-)
 create mode 100644 .changelog/17270.txt
 create mode 100644 agent/grpc-internal/resolver/resolver_test.go

diff --git a/.changelog/17270.txt b/.changelog/17270.txt
new file mode 100644
index 000000000000..b9bd52888e4c
--- /dev/null
+++ b/.changelog/17270.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+grpc: ensure grpc resolver correctly uses lan/wan addresses on servers
+```
diff --git a/agent/consul/client_test.go b/agent/consul/client_test.go
index 419867a4eba0..3f7542d09032 100644
--- a/agent/consul/client_test.go
+++ b/agent/consul/client_test.go
@@ -504,11 +504,15 @@ func newClient(t *testing.T, config *Config) *Client {
 	return client
 }
 
-func newTestResolverConfig(t *testing.T, suffix string) resolver.Config {
+func newTestResolverConfig(t *testing.T, suffix string, dc, agentType string) resolver.Config {
 	n := t.Name()
 	s := strings.Replace(n, "/", "", -1)
 	s = strings.Replace(s, "_", "", -1)
-	return resolver.Config{Authority: strings.ToLower(s) + "-" + suffix}
+	return resolver.Config{
+		Datacenter: dc,
+		AgentType:  agentType,
+		Authority:  strings.ToLower(s) + "-" + suffix,
+	}
 }
 
 func newDefaultDeps(t *testing.T, c *Config) Deps {
@@ -523,7 +527,7 @@ func newDefaultDeps(t *testing.T, c *Config) Deps {
 	tls, err := tlsutil.NewConfigurator(c.TLSConfig, logger)
 	require.NoError(t, err, "failed to create tls configuration")
 
-	resolverBuilder := resolver.NewServerResolverBuilder(newTestResolverConfig(t, c.NodeName+"-"+c.Datacenter))
+	resolverBuilder := resolver.NewServerResolverBuilder(newTestResolverConfig(t, c.NodeName+"-"+c.Datacenter, c.Datacenter, "server"))
 	resolver.Register(resolverBuilder)
 	t.Cleanup(func() {
 		resolver.Deregister(resolverBuilder.Authority())
diff --git a/agent/consul/server_serf.go b/agent/consul/server_serf.go
index bb17235b14de..1dc6c25b1cce 100644
--- a/agent/consul/server_serf.go
+++ b/agent/consul/server_serf.go
@@ -23,6 +23,7 @@ import (
 	"github.com/hashicorp/consul/lib"
 	libserf "github.com/hashicorp/consul/lib/serf"
 	"github.com/hashicorp/consul/logging"
+	"github.com/hashicorp/consul/types"
 )
 
 const (
@@ -359,6 +360,7 @@ func (s *Server) lanNodeJoin(me serf.MemberEvent) {
 
 		// Update server lookup
 		s.serverLookup.AddServer(serverMeta)
+		s.router.AddServer(types.AreaLAN, serverMeta)
 
 		// If we're still expecting to bootstrap, may need to handle this.
 		if s.config.BootstrapExpect != 0 {
@@ -380,6 +382,7 @@ func (s *Server) lanNodeUpdate(me serf.MemberEvent) {
 
 		// Update server lookup
 		s.serverLookup.AddServer(serverMeta)
+		s.router.AddServer(types.AreaLAN, serverMeta)
 	}
 }
 
@@ -518,5 +521,6 @@ func (s *Server) lanNodeFailed(me serf.MemberEvent) {
 
 		// Update id to address map
 		s.serverLookup.RemoveServer(serverMeta)
+		s.router.RemoveServer(types.AreaLAN, serverMeta)
 	}
 }
diff --git a/agent/consul/subscribe_backend_test.go b/agent/consul/subscribe_backend_test.go
index 01c818451860..833f049c9728 100644
--- a/agent/consul/subscribe_backend_test.go
+++ b/agent/consul/subscribe_backend_test.go
@@ -382,7 +382,10 @@ func newClientWithGRPCPlumbing(t *testing.T, ops ...func(*Config)) (*Client, *re
 	}
 
 	resolverBuilder := resolver.NewServerResolverBuilder(newTestResolverConfig(t,
-		"client."+config.Datacenter+"."+string(config.NodeID)))
+		"client."+config.Datacenter+"."+string(config.NodeID),
+		config.Datacenter,
+		"client",
+	))
 
 	resolver.Register(resolverBuilder)
 	t.Cleanup(func() {
diff --git a/agent/grpc-internal/client_test.go b/agent/grpc-internal/client_test.go
index ad6906a958f8..a3b99e78ad1b 100644
--- a/agent/grpc-internal/client_test.go
+++ b/agent/grpc-internal/client_test.go
@@ -38,8 +38,8 @@ func TestNewDialer_WithTLSWrapper(t *testing.T) {
 	require.NoError(t, err)
 	t.Cleanup(logError(t, lis.Close))
 
-	builder := resolver.NewServerResolverBuilder(newConfig(t))
-	builder.AddServer(types.AreaWAN, &metadata.Server{
+	builder := resolver.NewServerResolverBuilder(newConfig(t, "dc1", "server"))
+	builder.AddServer(types.AreaLAN, &metadata.Server{
 		Name:       "server-1",
 		ID:         "ID1",
 		Datacenter: "dc1",
@@ -89,7 +89,7 @@ func TestNewDialer_WithALPNWrapper(t *testing.T) {
 		p.Wait()
 	}()
 
-	builder := resolver.NewServerResolverBuilder(newConfig(t))
+	builder := resolver.NewServerResolverBuilder(newConfig(t, "dc1", "server"))
 	builder.AddServer(types.AreaWAN, &metadata.Server{
 		Name:       "server-1",
 		ID:         "ID1",
@@ -144,7 +144,7 @@ func TestNewDialer_WithALPNWrapper(t *testing.T) {
 func TestNewDialer_IntegrationWithTLSEnabledHandler(t *testing.T) {
 	// if this test is failing because of expired certificates
 	// use the procedure in test/CA-GENERATION.md
-	res := resolver.NewServerResolverBuilder(newConfig(t))
+	res := resolver.NewServerResolverBuilder(newConfig(t, "dc1", "server"))
 	bb := balancer.NewBuilder(res.Authority(), testutil.Logger(t))
 	registerWithGRPC(t, res, bb)
 
@@ -162,9 +162,17 @@ func TestNewDialer_IntegrationWithTLSEnabledHandler(t *testing.T) {
 	srv := newSimpleTestServer(t, "server-1", "dc1", tlsConf)
 
 	md := srv.Metadata()
-	res.AddServer(types.AreaWAN, md)
+	res.AddServer(types.AreaLAN, md)
 	t.Cleanup(srv.shutdown)
 
+	{
+		// Put a duplicate instance of this on the WAN that will
+		// fail if we accidentally use it.
+		srv := newPanicTestServer(t, hclog.Default(), "server-1", "dc1", nil)
+		res.AddServer(types.AreaWAN, srv.Metadata())
+		t.Cleanup(srv.shutdown)
+	}
+
 	pool := NewClientConnPool(ClientConnPoolConfig{
 		Servers:               res,
 		TLSWrapper:            TLSWrapper(tlsConf.OutgoingRPCWrapper()),
@@ -192,7 +200,7 @@ func TestNewDialer_IntegrationWithTLSEnabledHandler_viaMeshGateway(t *testing.T)
 	// use the procedure in test/CA-GENERATION.md
 	gwAddr := ipaddr.FormatAddressPort("127.0.0.1", freeport.GetOne(t))
 
-	res := resolver.NewServerResolverBuilder(newConfig(t))
+	res := resolver.NewServerResolverBuilder(newConfig(t, "dc2", "server"))
 	bb := balancer.NewBuilder(res.Authority(), testutil.Logger(t))
 	registerWithGRPC(t, res, bb)
 
@@ -268,7 +276,7 @@ func TestNewDialer_IntegrationWithTLSEnabledHandler_viaMeshGateway(t *testing.T)
 
 func TestClientConnPool_IntegrationWithGRPCResolver_Failover(t *testing.T) {
 	count := 4
-	res := resolver.NewServerResolverBuilder(newConfig(t))
+	res := resolver.NewServerResolverBuilder(newConfig(t, "dc1", "server"))
 	bb := balancer.NewBuilder(res.Authority(), testutil.Logger(t))
 	registerWithGRPC(t, res, bb)
 	pool := NewClientConnPool(ClientConnPoolConfig{
@@ -280,9 +288,18 @@ func TestClientConnPool_IntegrationWithGRPCResolver_Failover(t *testing.T) {
 
 	for i := 0; i < count; i++ {
 		name := fmt.Sprintf("server-%d", i)
-		srv := newSimpleTestServer(t, name, "dc1", nil)
-		res.AddServer(types.AreaWAN, srv.Metadata())
-		t.Cleanup(srv.shutdown)
+		{
+			srv := newSimpleTestServer(t, name, "dc1", nil)
+			res.AddServer(types.AreaLAN, srv.Metadata())
+			t.Cleanup(srv.shutdown)
+		}
+		{
+			// Put a duplicate instance of this on the WAN that will
+			// fail if we accidentally use it.
+			srv := newPanicTestServer(t, hclog.Default(), name, "dc1", nil)
+			res.AddServer(types.AreaWAN, srv.Metadata())
+			t.Cleanup(srv.shutdown)
+		}
 	}
 
 	conn, err := pool.ClientConn("dc1")
@@ -295,7 +312,7 @@ func TestClientConnPool_IntegrationWithGRPCResolver_Failover(t *testing.T) {
 	first, err := client.Something(ctx, &testservice.Req{})
 	require.NoError(t, err)
 
-	res.RemoveServer(types.AreaWAN, &metadata.Server{ID: first.ServerName, Datacenter: "dc1"})
+	res.RemoveServer(types.AreaLAN, &metadata.Server{ID: first.ServerName, Datacenter: "dc1"})
 
 	resp, err := client.Something(ctx, &testservice.Req{})
 	require.NoError(t, err)
@@ -304,7 +321,7 @@ func TestClientConnPool_IntegrationWithGRPCResolver_Failover(t *testing.T) {
 
 func TestClientConnPool_ForwardToLeader_Failover(t *testing.T) {
 	count := 3
-	res := resolver.NewServerResolverBuilder(newConfig(t))
+	res := resolver.NewServerResolverBuilder(newConfig(t, "dc1", "server"))
 	bb := balancer.NewBuilder(res.Authority(), testutil.Logger(t))
 	registerWithGRPC(t, res, bb)
 	pool := NewClientConnPool(ClientConnPoolConfig{
@@ -317,10 +334,19 @@ func TestClientConnPool_ForwardToLeader_Failover(t *testing.T) {
 	var servers []testServer
 	for i := 0; i < count; i++ {
 		name := fmt.Sprintf("server-%d", i)
-		srv := newSimpleTestServer(t, name, "dc1", nil)
-		res.AddServer(types.AreaWAN, srv.Metadata())
-		servers = append(servers, srv)
-		t.Cleanup(srv.shutdown)
+		{
+			srv := newSimpleTestServer(t, name, "dc1", nil)
+			res.AddServer(types.AreaLAN, srv.Metadata())
+			servers = append(servers, srv)
+			t.Cleanup(srv.shutdown)
+		}
+		{
+			// Put a duplicate instance of this on the WAN that will
+			// fail if we accidentally use it.
+			srv := newPanicTestServer(t, hclog.Default(), name, "dc1", nil)
+			res.AddServer(types.AreaWAN, srv.Metadata())
+			t.Cleanup(srv.shutdown)
+		}
 	}
 
 	// Set the leader address to the first server.
@@ -347,19 +373,24 @@ func TestClientConnPool_ForwardToLeader_Failover(t *testing.T) {
 	require.Equal(t, resp.ServerName, servers[1].name)
 }
 
-func newConfig(t *testing.T) resolver.Config {
+func newConfig(t *testing.T, dc, agentType string) resolver.Config {
 	n := t.Name()
 	s := strings.Replace(n, "/", "", -1)
 	s = strings.Replace(s, "_", "", -1)
-	return resolver.Config{Authority: strings.ToLower(s)}
+	return resolver.Config{
+		Datacenter: dc,
+		AgentType:  agentType,
+		Authority:  strings.ToLower(s),
+	}
 }
 
 func TestClientConnPool_IntegrationWithGRPCResolver_MultiDC(t *testing.T) {
 	dcs := []string{"dc1", "dc2", "dc3"}
 
-	res := resolver.NewServerResolverBuilder(newConfig(t))
+	res := resolver.NewServerResolverBuilder(newConfig(t, "dc1", "server"))
 	bb := balancer.NewBuilder(res.Authority(), testutil.Logger(t))
 	registerWithGRPC(t, res, bb)
+
 	pool := NewClientConnPool(ClientConnPoolConfig{
 		Servers:               res,
 		UseTLSForDC:           useTLSForDcAlwaysTrue,
@@ -370,7 +401,16 @@ func TestClientConnPool_IntegrationWithGRPCResolver_MultiDC(t *testing.T) {
 	for _, dc := range dcs {
 		name := "server-0-" + dc
 		srv := newSimpleTestServer(t, name, dc, nil)
-		res.AddServer(types.AreaWAN, srv.Metadata())
+		if dc == "dc1" {
+			res.AddServer(types.AreaLAN, srv.Metadata())
+			// Put a duplicate instance of this on the WAN that will
+			// fail if we accidentally use it.
+			srvBad := newPanicTestServer(t, hclog.Default(), name, dc, nil)
+			res.AddServer(types.AreaWAN, srvBad.Metadata())
+			t.Cleanup(srvBad.shutdown)
+		} else {
+			res.AddServer(types.AreaWAN, srv.Metadata())
+		}
 		t.Cleanup(srv.shutdown)
 	}
 
diff --git a/agent/grpc-internal/handler_test.go b/agent/grpc-internal/handler_test.go
index e39f93be39a7..80c026113d1f 100644
--- a/agent/grpc-internal/handler_test.go
+++ b/agent/grpc-internal/handler_test.go
@@ -31,12 +31,12 @@ func TestHandler_PanicRecoveryInterceptor(t *testing.T) {
 		Output: &buf,
 	})
 
-	res := resolver.NewServerResolverBuilder(newConfig(t))
+	res := resolver.NewServerResolverBuilder(newConfig(t, "dc1", "server"))
 	bb := balancer.NewBuilder(res.Authority(), testutil.Logger(t))
 	registerWithGRPC(t, res, bb)
 
 	srv := newPanicTestServer(t, logger, "server-1", "dc1", nil)
-	res.AddServer(types.AreaWAN, srv.Metadata())
+	res.AddServer(types.AreaLAN, srv.Metadata())
 	t.Cleanup(srv.shutdown)
 
 	pool := NewClientConnPool(ClientConnPoolConfig{
diff --git a/agent/grpc-internal/resolver/resolver.go b/agent/grpc-internal/resolver/resolver.go
index f4d1e95ea022..bb2224ee0844 100644
--- a/agent/grpc-internal/resolver/resolver.go
+++ b/agent/grpc-internal/resolver/resolver.go
@@ -18,25 +18,45 @@ import (
 // ServerResolvers updated when changes occur.
 type ServerResolverBuilder struct {
 	cfg Config
+
 	// leaderResolver is used to track the address of the leader in the local DC.
 	leaderResolver leaderResolver
+
 	// servers is an index of Servers by area and Server.ID. The map contains server IDs
 	// for all datacenters.
 	servers map[types.AreaID]map[string]*metadata.Server
+
 	// resolvers is an index of connections to the serverResolver which manages
 	// addresses of servers for that connection.
+	//
+	// this is only applicable for non-leader conn types
 	resolvers map[resolver.ClientConn]*serverResolver
+
 	// lock for all stateful fields (excludes config which is immutable).
 	lock sync.RWMutex
 }
 
 type Config struct {
+	// Datacenter is the datacenter of this agent.
+	Datacenter string
+
+	// AgentType is either 'server' or 'client' and is required.
+	AgentType string
+
 	// Authority used to query the server. Defaults to "". Used to support
 	// parallel testing because gRPC registers resolvers globally.
 	Authority string
 }
 
 func NewServerResolverBuilder(cfg Config) *ServerResolverBuilder {
+	if cfg.Datacenter == "" {
+		panic("ServerResolverBuilder needs Config.Datacenter to be nonempty")
+	}
+	switch cfg.AgentType {
+	case "server", "client":
+	default:
+		panic("ServerResolverBuilder needs Config.AgentType to be either server or client")
+	}
 	return &ServerResolverBuilder{
 		cfg:       cfg,
 		servers:   make(map[types.AreaID]map[string]*metadata.Server),
@@ -56,6 +76,7 @@ func (s *ServerResolverBuilder) ServerForGlobalAddr(globalAddr string) (*metadat
 			}
 		}
 	}
+
 	return nil, fmt.Errorf("failed to find Consul server for global address %q", globalAddr)
 }
 
@@ -67,12 +88,12 @@ func (s *ServerResolverBuilder) Build(target resolver.Target, cc resolver.Client
 
 	// If there's already a resolver for this connection, return it.
 	// TODO(streaming): how would this happen since we already cache connections in ClientConnPool?
-	if resolver, ok := s.resolvers[cc]; ok {
-		return resolver, nil
-	}
 	if cc == s.leaderResolver.clientConn {
 		return s.leaderResolver, nil
 	}
+	if resolver, ok := s.resolvers[cc]; ok {
+		return resolver, nil
+	}
 
 	//nolint:staticcheck
 	serverType, datacenter, err := parseEndpoint(target.Endpoint)
@@ -119,6 +140,10 @@ func (s *ServerResolverBuilder) Authority() string {
 
 // AddServer updates the resolvers' states to include the new server's address.
 func (s *ServerResolverBuilder) AddServer(areaID types.AreaID, server *metadata.Server) {
+	if s.shouldIgnoreServer(areaID, server) {
+		return
+	}
+
 	s.lock.Lock()
 	defer s.lock.Unlock()
 
@@ -155,6 +180,10 @@ func DCPrefix(datacenter, suffix string) string {
 
 // RemoveServer updates the resolvers' states with the given server removed.
 func (s *ServerResolverBuilder) RemoveServer(areaID types.AreaID, server *metadata.Server) {
+	if s.shouldIgnoreServer(areaID, server) {
+		return
+	}
+
 	s.lock.Lock()
 	defer s.lock.Unlock()
 
@@ -176,14 +205,48 @@ func (s *ServerResolverBuilder) RemoveServer(areaID types.AreaID, server *metada
 	}
 }
 
+// shouldIgnoreServer is used to contextually decide if a particular kind of
+// server should be accepted into a given area.
+//
+// On client agents it's pretty easy: clients only participate in the standard
+// LAN, so we only accept servers from the LAN.
+//
+// On server agents it's a little less obvious. This resolver is ultimately
+// used to have servers dial other servers. If a server is going to cross
+// between datacenters (using traditional federation) then we want to use the
+// WAN addresses for them, but if a server is going to dial a sibling server in
+// the same datacenter we want it to use the LAN addresses always. To achieve
+// that here we simply never allow WAN servers for our current datacenter to be
+// added into the resolver, letting only the LAN instances through.
+func (s *ServerResolverBuilder) shouldIgnoreServer(areaID types.AreaID, server *metadata.Server) bool {
+	if s.cfg.AgentType == "client" && areaID != types.AreaLAN {
+		return true
+	}
+
+	if s.cfg.AgentType == "server" &&
+		server.Datacenter == s.cfg.Datacenter &&
+		areaID != types.AreaLAN {
+		return true
+	}
+
+	return false
+}
+
 // getDCAddrs returns a list of the server addresses for the given datacenter.
 // This method requires that lock is held for reads.
 func (s *ServerResolverBuilder) getDCAddrs(dc string) []resolver.Address {
+	lanRequest := (s.cfg.Datacenter == dc)
+
 	var (
 		addrs         []resolver.Address
 		keptServerIDs = make(map[string]struct{})
 	)
-	for _, areaServers := range s.servers {
+	for areaID, areaServers := range s.servers {
+		if (areaID == types.AreaLAN) != lanRequest {
+			// LAN requests only look at LAN data. WAN requests only look at
+			// WAN data.
+			continue
+		}
 		for _, server := range areaServers {
 			if server.Datacenter != dc {
 				continue
diff --git a/agent/grpc-internal/resolver/resolver_test.go b/agent/grpc-internal/resolver/resolver_test.go
new file mode 100644
index 000000000000..ab6e403d7dee
--- /dev/null
+++ b/agent/grpc-internal/resolver/resolver_test.go
@@ -0,0 +1,195 @@
+package resolver
+
+import (
+	"fmt"
+	"net"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/resolver"
+	"google.golang.org/grpc/serviceconfig"
+
+	"github.com/hashicorp/consul/agent/metadata"
+	"github.com/hashicorp/consul/types"
+)
+
+func TestServerResolverBuilder(t *testing.T) {
+	const agentDC = "dc1"
+
+	type testcase struct {
+		name       string
+		agentType  string // server/client
+		serverType string // server/leader
+		requestDC  string
+		expectLAN  bool
+	}
+
+	run := func(t *testing.T, tc testcase) {
+		rs := NewServerResolverBuilder(newConfig(t, agentDC, tc.agentType))
+
+		endpoint := ""
+		if tc.serverType == "leader" {
+			endpoint = "leader.local"
+		} else {
+			endpoint = tc.serverType + "." + tc.requestDC
+		}
+
+		cc := &fakeClientConn{}
+		_, err := rs.Build(resolver.Target{
+			Scheme:    "consul",
+			Authority: rs.Authority(),
+			Endpoint:  endpoint,
+		}, cc, resolver.BuildOptions{})
+		require.NoError(t, err)
+
+		for i := 0; i < 3; i++ {
+			dc := fmt.Sprintf("dc%d", i+1)
+			for j := 0; j < 3; j++ {
+				wanIP := fmt.Sprintf("127.1.%d.%d", i+1, j+10)
+				name := fmt.Sprintf("%s-server-%d", dc, j+1)
+				wanMeta := newServerMeta(name, dc, wanIP, true)
+
+				if tc.agentType == "server" {
+					rs.AddServer(types.AreaWAN, wanMeta)
+				}
+
+				if dc == agentDC {
+					// register LAN/WAN pairs for the same instances
+					lanIP := fmt.Sprintf("127.0.%d.%d", i+1, j+10)
+					lanMeta := newServerMeta(name, dc, lanIP, false)
+					rs.AddServer(types.AreaLAN, lanMeta)
+
+					if j == 0 {
+						rs.UpdateLeaderAddr(dc, lanIP)
+					}
+				}
+			}
+		}
+
+		if tc.serverType == "leader" {
+			assert.Len(t, cc.state.Addresses, 1)
+		} else {
+			assert.Len(t, cc.state.Addresses, 3)
+		}
+
+		for _, addr := range cc.state.Addresses {
+			addrPrefix := tc.requestDC + "-"
+			if tc.expectLAN {
+				addrPrefix += "127.0."
+			} else {
+				addrPrefix += "127.1."
+			}
+			assert.True(t, strings.HasPrefix(addr.Addr, addrPrefix),
+				"%q does not start with %q (returned WAN for LAN request)", addr.Addr, addrPrefix)
+
+			if tc.expectLAN {
+				assert.False(t, strings.Contains(addr.ServerName, ".dc"),
+					"%q ends with datacenter suffix (returned WAN for LAN request)", addr.ServerName)
+			} else {
+				assert.True(t, strings.HasSuffix(addr.ServerName, "."+tc.requestDC),
+					"%q does not end with %q", addr.ServerName, "."+tc.requestDC)
+			}
+		}
+	}
+
+	cases := []testcase{
+		{
+			name:       "server requesting local servers",
+			agentType:  "server",
+			serverType: "server",
+			requestDC:  agentDC,
+			expectLAN:  true,
+		},
+		{
+			name:       "server requesting remote servers in dc2",
+			agentType:  "server",
+			serverType: "server",
+			requestDC:  "dc2",
+			expectLAN:  false,
+		},
+		{
+			name:       "server requesting remote servers in dc3",
+			agentType:  "server",
+			serverType: "server",
+			requestDC:  "dc3",
+			expectLAN:  false,
+		},
+		// ---------------
+		{
+			name:       "server requesting local leader",
+			agentType:  "server",
+			serverType: "leader",
+			requestDC:  agentDC,
+			expectLAN:  true,
+		},
+		// ---------------
+		{
+			name:       "client requesting local server",
+			agentType:  "client",
+			serverType: "server",
+			requestDC:  agentDC,
+			expectLAN:  true,
+		},
+		{
+			name:       "client requesting local leader",
+			agentType:  "client",
+			serverType: "leader",
+			requestDC:  agentDC,
+			expectLAN:  true,
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			run(t, tc)
+		})
+	}
+}
+
+func newServerMeta(name, dc, ip string, wan bool) *metadata.Server {
+	fullname := name
+	if wan {
+		fullname = name + "." + dc
+	}
+	return &metadata.Server{
+		ID:         name,
+		Name:       fullname,
+		ShortName:  name,
+		Datacenter: dc,
+		Addr:       &net.IPAddr{IP: net.ParseIP(ip)},
+		UseTLS:     false,
+	}
+}
+
+func newConfig(t *testing.T, dc, agentType string) Config {
+	n := t.Name()
+	s := strings.Replace(n, "/", "", -1)
+	s = strings.Replace(s, "_", "", -1)
+	return Config{
+		Datacenter: dc,
+		AgentType:  agentType,
+		Authority:  strings.ToLower(s),
+	}
+}
+
+// fakeClientConn implements resolver.ClientConn for tests
+type fakeClientConn struct {
+	state resolver.State
+}
+
+var _ resolver.ClientConn = (*fakeClientConn)(nil)
+
+func (f *fakeClientConn) UpdateState(state resolver.State) error {
+	f.state = state
+	return nil
+}
+
+func (*fakeClientConn) ReportError(error)                       {}
+func (*fakeClientConn) NewAddress(addresses []resolver.Address) {}
+func (*fakeClientConn) NewServiceConfig(serviceConfig string)   {}
+func (*fakeClientConn) ParseServiceConfig(serviceConfigJSON string) *serviceconfig.ParseResult {
+	return nil
+}
diff --git a/agent/peering_endpoint_test.go b/agent/peering_endpoint_test.go
index 1a5ad4b35249..99d6cb6c36c9 100644
--- a/agent/peering_endpoint_test.go
+++ b/agent/peering_endpoint_test.go
@@ -4,6 +4,7 @@
 package agent
 
 import (
+	"bufio"
 	"bytes"
 	"context"
 	"encoding/base64"
@@ -12,19 +13,208 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"strconv"
 	"testing"
 	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	gpeer "google.golang.org/grpc/peer"
 
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/api"
 	"github.com/hashicorp/consul/proto/private/pbpeering"
+	"github.com/hashicorp/consul/sdk/testutil"
 	"github.com/hashicorp/consul/sdk/testutil/retry"
 	"github.com/hashicorp/consul/testrpc"
 )
 
+func TestHTTP_Peering_Integration(t *testing.T) {
+	// This is a full-stack integration test of the gRPC (internal) stack. We
+	// use peering CRUD b/c that is one of the few endpoints exposed over gRPC
+	// (internal).
+
+	if testing.Short() {
+		t.Skip("too slow for testing.Short")
+	}
+
+	// We advertise a wan address we are not using, so that incidental attempts
+	// to use it will loudly fail.
+	const ip = "192.0.2.2"
+
+	connectivityConfig := `
+ports { serf_wan = -1 }
+bind_addr = "0.0.0.0"
+client_addr = "0.0.0.0"
+advertise_addr = "127.0.0.1"
+advertise_addr_wan = "` + ip + `" `
+
+	var (
+		buf1, buf2, buf3 bytes.Buffer
+		testLog          = testutil.NewLogBuffer(t)
+
+		log1 = io.MultiWriter(testLog, &buf1)
+		log2 = io.MultiWriter(testLog, &buf2)
+		log3 = io.MultiWriter(testLog, &buf3)
+	)
+
+	a1 := StartTestAgent(t, TestAgent{LogOutput: log1, HCL: `
+		server = true
+		bootstrap = false
+		bootstrap_expect = 3
+	` + connectivityConfig})
+	t.Cleanup(func() { a1.Shutdown() })
+
+	a2 := StartTestAgent(t, TestAgent{LogOutput: log2, HCL: `
+		server = true
+		bootstrap = false
+		bootstrap_expect = 3
+	` + connectivityConfig})
+	t.Cleanup(func() { a2.Shutdown() })
+
+	a3 := StartTestAgent(t, TestAgent{LogOutput: log3, HCL: `
+		server = true
+		bootstrap = false
+		bootstrap_expect = 3
+	` + connectivityConfig})
+	t.Cleanup(func() { a3.Shutdown() })
+
+	{ // join a2 to a1
+		addr := fmt.Sprintf("127.0.0.1:%d", a2.Config.SerfPortLAN)
+		_, err := a1.JoinLAN([]string{addr}, nil)
+		require.NoError(t, err)
+	}
+	{ // join a3 to a1
+		addr := fmt.Sprintf("127.0.0.1:%d", a3.Config.SerfPortLAN)
+		_, err := a1.JoinLAN([]string{addr}, nil)
+		require.NoError(t, err)
+	}
+
+	testrpc.WaitForLeader(t, a1.RPC, "dc1")
+	testrpc.WaitForActiveCARoot(t, a1.RPC, "dc1", nil)
+
+	testrpc.WaitForTestAgent(t, a1.RPC, "dc1")
+	testrpc.WaitForTestAgent(t, a2.RPC, "dc1")
+	testrpc.WaitForTestAgent(t, a3.RPC, "dc1")
+
+	retry.Run(t, func(r *retry.R) {
+		require.Len(r, a1.LANMembersInAgentPartition(), 3)
+		require.Len(r, a2.LANMembersInAgentPartition(), 3)
+		require.Len(r, a3.LANMembersInAgentPartition(), 3)
+	})
+
+	type testcase struct {
+		agent     *TestAgent
+		peerName  string
+		prevCount int
+	}
+
+	checkPeeringList := func(t *testing.T, a *TestAgent, expect int) {
+		req, err := http.NewRequest("GET", "/v1/peerings", nil)
+		require.NoError(t, err)
+
+		resp := httptest.NewRecorder()
+		a.srv.h.ServeHTTP(resp, req)
+		require.Equal(t, http.StatusOK, resp.Code)
+
+		var apiResp []*api.Peering
+		require.NoError(t, json.NewDecoder(resp.Body).Decode(&apiResp))
+
+		require.Len(t, apiResp, expect)
+	}
+
+	testConn := func(t *testing.T, conn *grpc.ClientConn, peers map[string]int) {
+		rpcClientPeering := pbpeering.NewPeeringServiceClient(conn)
+
+		peer := &gpeer.Peer{}
+		_, err := rpcClientPeering.PeeringList(
+			context.Background(),
+			&pbpeering.PeeringListRequest{},
+			grpc.Peer(peer),
+		)
+		require.NoError(t, err)
+
+		peers[peer.Addr.String()]++
+	}
+
+	var (
+		standardPeers = make(map[string]int)
+		leaderPeers   = make(map[string]int)
+	)
+	runOnce := func(t *testing.T, tc testcase) {
+		conn, err := tc.agent.baseDeps.GRPCConnPool.ClientConn("dc1")
+		require.NoError(t, err)
+		testConn(t, conn, standardPeers)
+
+		leaderConn, err := tc.agent.baseDeps.GRPCConnPool.ClientConnLeader()
+		require.NoError(t, err)
+		testConn(t, leaderConn, leaderPeers)
+
+		checkPeeringList(t, tc.agent, tc.prevCount)
+
+		body := &pbpeering.GenerateTokenRequest{
+			PeerName: tc.peerName,
+		}
+
+		bodyBytes, err := json.Marshal(body)
+		require.NoError(t, err)
+
+		req, err := http.NewRequest("POST", "/v1/peering/token", bytes.NewReader(bodyBytes))
+		require.NoError(t, err)
+
+		resp := httptest.NewRecorder()
+		tc.agent.srv.h.ServeHTTP(resp, req)
+		require.Equal(t, http.StatusOK, resp.Code, "expected 200, got %d: %v", resp.Code, resp.Body.String())
+
+		var r pbpeering.GenerateTokenResponse
+		require.NoError(t, json.NewDecoder(resp.Body).Decode(&r))
+
+		checkPeeringList(t, tc.agent, tc.prevCount+1)
+	}
+
+	// Try the procedure on all agents to force N-1 of them to leader-forward.
+	cases := []testcase{
+		{agent: a1, peerName: "peer-1", prevCount: 0},
+		{agent: a2, peerName: "peer-2", prevCount: 1},
+		{agent: a3, peerName: "peer-3", prevCount: 2},
+	}
+
+	for i, tc := range cases {
+		tc := tc
+		testutil.RunStep(t, "server-"+strconv.Itoa(i+1), func(t *testing.T) {
+			runOnce(t, tc)
+		})
+	}
+
+	testutil.RunStep(t, "ensure we got the right mixture of responses", func(t *testing.T) {
+		assert.Len(t, standardPeers, 3)
+
+		// Each server talks to a single leader.
+		assert.Len(t, leaderPeers, 1)
+		for p, n := range leaderPeers {
+			assert.Equal(t, 3, n, "peer %q expected 3 uses", p)
+		}
+	})
+
+	testutil.RunStep(t, "no server experienced the server resolution error", func(t *testing.T) {
+		// Check them all for the bad error
+		const grpcError = `failed to find Consul server for global address`
+
+		var buf bytes.Buffer
+		buf.ReadFrom(&buf1)
+		buf.ReadFrom(&buf2)
+		buf.ReadFrom(&buf3)
+
+		scan := bufio.NewScanner(&buf)
+		for scan.Scan() {
+			line := scan.Text()
+			require.NotContains(t, line, grpcError)
+		}
+		require.NoError(t, scan.Err())
+	})
+}
+
 func TestHTTP_Peering_GenerateToken(t *testing.T) {
 	if testing.Short() {
 		t.Skip("too slow for testing.Short")
diff --git a/agent/rpc/peering/service_test.go b/agent/rpc/peering/service_test.go
index 3830cbdfacdc..405fe1a73734 100644
--- a/agent/rpc/peering/service_test.go
+++ b/agent/rpc/peering/service_test.go
@@ -11,6 +11,7 @@ import (
 	"net"
 	"os"
 	"path"
+	"strings"
 	"testing"
 	"time"
 
@@ -1669,6 +1670,17 @@ type testingServer struct {
 	PublicGRPCAddr string
 }
 
+func newConfig(t *testing.T, dc, agentType string) resolver.Config {
+	n := t.Name()
+	s := strings.Replace(n, "/", "", -1)
+	s = strings.Replace(s, "_", "", -1)
+	return resolver.Config{
+		Datacenter: dc,
+		AgentType:  agentType,
+		Authority:  strings.ToLower(s),
+	}
+}
+
 // TODO(peering): remove duplication between this and agent/consul tests
 func newDefaultDeps(t *testing.T, c *consul.Config) consul.Deps {
 	t.Helper()
@@ -1683,7 +1695,7 @@ func newDefaultDeps(t *testing.T, c *consul.Config) consul.Deps {
 	require.NoError(t, err, "failed to create tls configuration")
 
 	r := router.NewRouter(logger, c.Datacenter, fmt.Sprintf("%s.%s", c.NodeName, c.Datacenter), nil)
-	builder := resolver.NewServerResolverBuilder(resolver.Config{})
+	builder := resolver.NewServerResolverBuilder(newConfig(t, c.Datacenter, "client"))
 	resolver.Register(builder)
 
 	connPool := &pool.ConnPool{
diff --git a/agent/setup.go b/agent/setup.go
index 07ab3852de8c..a4520e3cfcbd 100644
--- a/agent/setup.go
+++ b/agent/setup.go
@@ -120,7 +120,14 @@ func NewBaseDeps(configLoader ConfigLoader, logOut io.Writer, providedLogger hcl
 	d.ViewStore = submatview.NewStore(d.Logger.Named("viewstore"))
 	d.ConnPool = newConnPool(cfg, d.Logger, d.TLSConfigurator)
 
+	agentType := "client"
+	if cfg.ServerMode {
+		agentType = "server"
+	}
+
 	resolverBuilder := resolver.NewServerResolverBuilder(resolver.Config{
+		AgentType:  agentType,
+		Datacenter: cfg.Datacenter,
 		// Set the authority to something sufficiently unique so any usage in
 		// tests would be self-isolating in the global resolver map, while also
 		// not incurring a huge penalty for non-test code.

From 30eee13cb97cd78bf3f74b747c17a1ea814c544a Mon Sep 17 00:00:00 2001
From: Tu Nguyen <im2nguyen@users.noreply.github.com>
Date: Thu, 11 May 2023 11:55:23 -0700
Subject: [PATCH 70/92] Update consul-k8s install command so it is valid
 (#17310)

---
 website/content/docs/k8s/installation/install-cli.mdx | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/website/content/docs/k8s/installation/install-cli.mdx b/website/content/docs/k8s/installation/install-cli.mdx
index a628ede95737..d9d613516c4e 100644
--- a/website/content/docs/k8s/installation/install-cli.mdx
+++ b/website/content/docs/k8s/installation/install-cli.mdx
@@ -128,20 +128,20 @@ Complete the following instructions to install a specific version of the CLI so
 1. Download the appropriate version of Consul K8s CLI using the following `curl` command. Set the `$VERSION` environment variable to the appropriate version for your deployment.
 
    ```shell-session
-   $ export VERSION=1.0 && \
+   $ export VERSION=1.1.1 && \
        curl --location "https://releases.hashicorp.com/consul-k8s/${VERSION}/consul-k8s_${VERSION}_darwin_amd64.zip" --output consul-k8s-cli.zip
    ```
 
 1. Unzip the zip file output to extract the `consul-k8s` CLI binary. This overwrites existing files and also creates a `.consul-k8s` subdirectory in your `$HOME` folder.
 
    ```shell-session
-   $ unzip -o consul-k8s-cli.zip -d ~/.consul-k8s
+   $ unzip -o consul-k8s-cli.zip -d ~/consul-k8s
    ```
 
 1. Add the path to your directory. In order to persist the `$PATH` across sessions, dd it to your shellrc (i.e. shell run commands) file for the shell used by your terminal.
 
    ```shell-session
-   $ export PATH=$PATH:$HOME/.consul-k8s/
+   $ export PATH=$PATH:$HOME/consul-k8s
    ```
 
 1. (Optional) Issue the `consul-k8s version` command to verify the installation.

From c61e994fc0cb5db8df6b316b4396274345f20406 Mon Sep 17 00:00:00 2001
From: cskh <hui.kang@hashicorp.com>
Date: Thu, 11 May 2023 18:49:49 -0400
Subject: [PATCH 71/92] Container test: fix container test slow image build
 (#17316)

Container integ test: fix container test slow image build
---
 .github/workflows/test-integrations.yml       |   16 +-
 GNUmakefile                                   |    4 +
 .../assets/Dockerfile-consul-envoy            |    0
 .../service => }/assets/tproxy-startup.sh     |    0
 test/integration/consul-container/go.mod      |   56 +-
 test/integration/consul-container/go.sum      | 1065 +----------------
 .../consul-container/libs/cluster/app.go      |    3 +-
 .../consul-container/libs/service/common.go   |   66 +-
 .../consul-container/libs/service/connect.go  |   22 +-
 .../consul-container/libs/service/examples.go |    7 +-
 .../consul-container/libs/service/gateway.go  |   31 +-
 .../consul-container/libs/utils/version.go    |   15 +
 .../consul-container/test/upgrade/README.md   |    1 +
 .../test/upgrade/{ => basic}/basic_test.go    |    0
 .../{ => basic}/fullstopupgrade_test.go       |    0
 .../upgrade/{ => basic}/healthcheck_test.go   |    0
 .../resolver_default_subset_test.go           |    6 +-
 .../peering_control_plane_mgw_test.go         |    0
 .../{ => peering}/peering_http_test.go        |    0
 19 files changed, 153 insertions(+), 1139 deletions(-)
 rename test/integration/consul-container/{libs/service => }/assets/Dockerfile-consul-envoy (100%)
 rename test/integration/consul-container/{libs/service => }/assets/tproxy-startup.sh (100%)
 rename test/integration/consul-container/test/upgrade/{ => basic}/basic_test.go (100%)
 rename test/integration/consul-container/test/upgrade/{ => basic}/fullstopupgrade_test.go (100%)
 rename test/integration/consul-container/test/upgrade/{ => basic}/healthcheck_test.go (100%)
 rename test/integration/consul-container/test/upgrade/{ => peering}/peering_control_plane_mgw_test.go (100%)
 rename test/integration/consul-container/test/upgrade/{ => peering}/peering_http_test.go (100%)

diff --git a/.github/workflows/test-integrations.yml b/.github/workflows/test-integrations.yml
index 460749fc971a..ccafc68a6968 100644
--- a/.github/workflows/test-integrations.yml
+++ b/.github/workflows/test-integrations.yml
@@ -374,6 +374,7 @@ jobs:
               | jq --raw-input --argjson runnercount "$NUM_RUNNERS" "$JQ_SLICER" \
               | jq --compact-output 'map(join(" "))'
           } >> "$GITHUB_OUTPUT"
+
   compatibility-integration-test:
     runs-on: ${{ fromJSON(needs.setup.outputs.compute-xl) }}
     needs:
@@ -387,6 +388,8 @@ jobs:
       fail-fast: false
       matrix:
         test-cases: ${{ fromJSON(needs.generate-compatibility-job-matrices.outputs.compatibility-matrix) }}
+    env:
+      ENVOY_VERSION: "1.25.4"
     steps:
       - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
       - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
@@ -405,6 +408,8 @@ jobs:
 
       - name: Build consul:local image
         run: docker build -t ${{ env.CONSUL_LATEST_IMAGE_NAME }}:local -f ./build-support/docker/Consul-Dev.dockerfile .
+      - name: Build consul-envoy:target-version image
+        run: docker build -t consul-envoy:target-version --build-arg CONSUL_IMAGE=${{ env.CONSUL_LATEST_IMAGE_NAME }}:local --build-arg ENVOY_VERSION=${{ env.ENVOY_VERSION }} -f ./test/integration/consul-container/assets/Dockerfile-consul-envoy ./test/integration/consul-container/assets
       - name: Configure GH workaround for ipv6 loopback
         if: ${{ !endsWith(github.repository, '-enterprise') }}
         run: |
@@ -520,7 +525,8 @@ jobs:
         consul-version: [ "1.14", "1.15"]
         test-cases: ${{ fromJSON(needs.generate-upgrade-job-matrices.outputs.upgrade-matrix) }}
     env:
-      CONSUL_VERSION: ${{ matrix.consul-version }}
+      CONSUL_LATEST_VERSION: ${{ matrix.consul-version }}
+      ENVOY_VERSION: "1.24.6"
     steps:
       - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
       - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
@@ -538,6 +544,10 @@ jobs:
         run: chmod +x consul
       - name: Build consul:local image
         run: docker build -t ${{ env.CONSUL_LATEST_IMAGE_NAME }}:local -f ./build-support/docker/Consul-Dev.dockerfile .
+      - name: Build consul-envoy:latest-version image
+        run: docker build -t consul-envoy:latest-version --build-arg CONSUL_IMAGE=docker.mirror.hashicorp.services/${{ env.CONSUL_LATEST_IMAGE_NAME }}:${{ env.CONSUL_LATEST_VERSION }} --build-arg ENVOY_VERSION=${{ env.ENVOY_VERSION }} -f ./test/integration/consul-container/assets/Dockerfile-consul-envoy ./test/integration/consul-container/assets
+      - name: Build consul-envoy:target-version image
+        run: docker build -t consul-envoy:target-version --build-arg CONSUL_IMAGE=${{ env.CONSUL_LATEST_IMAGE_NAME }}:local --build-arg ENVOY_VERSION=${{ env.ENVOY_VERSION }} -f ./test/integration/consul-container/assets/Dockerfile-consul-envoy ./test/integration/consul-container/assets
       - name: Configure GH workaround for ipv6 loopback
         if: ${{ !endsWith(github.repository, '-enterprise') }}
         run: |
@@ -567,8 +577,8 @@ jobs:
             -run "${{ matrix.test-cases }}" \
             --target-image ${{ env.CONSUL_LATEST_IMAGE_NAME }} \
             --target-version local \
-            --latest-image ${{ env.CONSUL_LATEST_IMAGE_NAME }} \
-            --latest-version "${{ env.CONSUL_VERSION }}"
+            --latest-image docker.mirror.hashicorp.services/${{ env.CONSUL_LATEST_IMAGE_NAME }} \
+            --latest-version "${{ env.CONSUL_LATEST_VERSION }}"
           ls -lrt
         env:
           # this is needed because of incompatibility between RYUK container and GHA
diff --git a/GNUmakefile b/GNUmakefile
index 6fd0379dd48a..734c875abc56 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -61,6 +61,7 @@ GO_BUILD_TAG?=consul-build-go
 UI_BUILD_TAG?=consul-build-ui
 BUILD_CONTAINER_NAME?=consul-builder
 CONSUL_IMAGE_VERSION?=latest
+ENVOY_VERSION?='1.25.4'
 
 ################
 # CI Variables #
@@ -459,10 +460,13 @@ else
 		--latest-version latest
 endif
 
+# NOTE: Use DOCKER_BUILDKIT=0, if docker build fails to resolve consul:local base image
 .PHONY: test-compat-integ-setup
 test-compat-integ-setup: dev-docker
 	@docker tag consul-dev:latest $(CONSUL_COMPAT_TEST_IMAGE):local
 	@docker run --rm -t $(CONSUL_COMPAT_TEST_IMAGE):local consul version
+	@#  'consul-envoy:target-version' is needed by compatibility integ test
+	@docker build -t consul-envoy:target-version --build-arg CONSUL_IMAGE=$(CONSUL_COMPAT_TEST_IMAGE):local --build-arg ENVOY_VERSION=${ENVOY_VERSION} -f ./test/integration/consul-container/assets/Dockerfile-consul-envoy ./test/integration/consul-container/assets
 
 .PHONY: test-metrics-integ
 test-metrics-integ: test-compat-integ-setup
diff --git a/test/integration/consul-container/libs/service/assets/Dockerfile-consul-envoy b/test/integration/consul-container/assets/Dockerfile-consul-envoy
similarity index 100%
rename from test/integration/consul-container/libs/service/assets/Dockerfile-consul-envoy
rename to test/integration/consul-container/assets/Dockerfile-consul-envoy
diff --git a/test/integration/consul-container/libs/service/assets/tproxy-startup.sh b/test/integration/consul-container/assets/tproxy-startup.sh
similarity index 100%
rename from test/integration/consul-container/libs/service/assets/tproxy-startup.sh
rename to test/integration/consul-container/assets/tproxy-startup.sh
diff --git a/test/integration/consul-container/go.mod b/test/integration/consul-container/go.mod
index 59c6d252eea9..93d63b81678e 100644
--- a/test/integration/consul-container/go.mod
+++ b/test/integration/consul-container/go.mod
@@ -5,7 +5,7 @@ go 1.20
 require (
 	fortio.org/fortio v1.54.0
 	github.com/avast/retry-go v3.0.0+incompatible
-	github.com/docker/docker v20.10.22+incompatible
+	github.com/docker/docker v23.0.6+incompatible
 	github.com/docker/go-connections v0.4.0
 	github.com/hashicorp/consul/api v1.20.0
 	github.com/hashicorp/consul/envoyextensions v0.1.2
@@ -19,11 +19,11 @@ require (
 	github.com/mitchellh/copystructure v1.2.0
 	github.com/otiai10/copy v1.10.0
 	github.com/pkg/errors v0.9.1
-	github.com/stretchr/testify v1.8.1
+	github.com/stretchr/testify v1.8.2
 	github.com/teris-io/shortid v0.0.0-20220617161101-71ec9f2aa569
-	github.com/testcontainers/testcontainers-go v0.15.0
-	golang.org/x/mod v0.8.0
-	google.golang.org/grpc v1.53.0
+	github.com/testcontainers/testcontainers-go v0.20.1
+	golang.org/x/mod v0.10.0
+	google.golang.org/grpc v1.55.0
 )
 
 require (
@@ -32,21 +32,19 @@ require (
 	fortio.org/sets v1.0.2 // indirect
 	fortio.org/version v1.0.2 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
-	github.com/Microsoft/go-winio v0.6.0 // indirect
-	github.com/Microsoft/hcsshim v0.9.7 // indirect
+	github.com/Microsoft/go-winio v0.6.1 // indirect
 	github.com/armon/go-metrics v0.4.1 // indirect
-	github.com/cenkalti/backoff/v4 v4.2.0 // indirect
-	github.com/cncf/xds/go v0.0.0-20230105202645-06c439db220b // indirect
-	github.com/containerd/cgroups v1.0.4 // indirect
-	github.com/containerd/containerd v1.6.19 // indirect
+	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
+	github.com/cncf/xds/go v0.0.0-20230310173818-32f1caf87195 // indirect
+	github.com/containerd/containerd v1.7.1 // indirect
+	github.com/cpuguy83/dockercfg v0.3.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/docker/distribution v2.8.1+incompatible // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/envoyproxy/go-control-plane v0.10.3 // indirect
-	github.com/envoyproxy/protoc-gen-validate v0.9.1 // indirect
+	github.com/envoyproxy/go-control-plane v0.11.0 // indirect
+	github.com/envoyproxy/protoc-gen-validate v0.10.0 // indirect
 	github.com/fatih/color v1.14.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/btree v1.0.0 // indirect
 	github.com/google/uuid v1.3.0 // indirect
@@ -58,33 +56,35 @@ require (
 	github.com/hashicorp/go-sockaddr v1.0.2 // indirect
 	github.com/hashicorp/golang-lru v0.5.4 // indirect
 	github.com/hashicorp/memberlist v0.5.0 // indirect
+	github.com/imdario/mergo v0.3.15 // indirect
 	github.com/itchyny/timefmt-go v0.1.4 // indirect
-	github.com/magiconair/properties v1.8.6 // indirect
+	github.com/klauspost/compress v1.16.5 // indirect
+	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.17 // indirect
 	github.com/miekg/dns v1.1.41 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/mapstructure v1.4.3 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/moby/sys/mount v0.3.3 // indirect
-	github.com/moby/sys/mountinfo v0.6.2 // indirect
-	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
+	github.com/moby/patternmatcher v0.5.0 // indirect
+	github.com/moby/sys/sequential v0.5.0 // indirect
+	github.com/moby/term v0.5.0 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.0.3-0.20211202183452-c5a74bcca799 // indirect
-	github.com/opencontainers/runc v1.1.4 // indirect
+	github.com/opencontainers/image-spec v1.1.0-rc3 // indirect
+	github.com/opencontainers/runc v1.1.7 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect
-	github.com/sirupsen/logrus v1.8.1 // indirect
-	go.opencensus.io v0.23.0 // indirect
+	github.com/sirupsen/logrus v1.9.0 // indirect
 	golang.org/x/exp v0.0.0-20230321023759-10a507213a29 // indirect
-	golang.org/x/net v0.8.0 // indirect
-	golang.org/x/sys v0.6.0 // indirect
-	golang.org/x/text v0.8.0 // indirect
-	golang.org/x/tools v0.6.0 // indirect
-	google.golang.org/genproto v0.0.0-20230223222841-637eb2293923 // indirect
-	google.golang.org/protobuf v1.28.1 // indirect
+	golang.org/x/net v0.10.0 // indirect
+	golang.org/x/sys v0.8.0 // indirect
+	golang.org/x/text v0.9.0 // indirect
+	golang.org/x/tools v0.9.1 // indirect
+	google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect
+	google.golang.org/protobuf v1.30.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
+	gotest.tools/v3 v3.4.0 // indirect
 )
 
 replace github.com/hashicorp/consul/api => ../../../api
diff --git a/test/integration/consul-container/go.sum b/test/integration/consul-container/go.sum
index 0f6c95e286ec..be214724ea32 100644
--- a/test/integration/consul-container/go.sum
+++ b/test/integration/consul-container/go.sum
@@ -1,37 +1,4 @@
-bazil.org/fuse v0.0.0-20160811212531-371fbbdaa898/go.mod h1:Xbm+BRKSBEpa4q4hTSxohYNQpsxXPbPry4JJWOB3LB8=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
-cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
-cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
-cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
-cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
-cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
-cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
-cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc=
-cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
-cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
-cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
-cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
-cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
-cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
-cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
-cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
-cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
-cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
-cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
-cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
-cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
-cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
-cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
-cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
-cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
-cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
-cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
-cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 fortio.org/assert v1.1.4 h1:Za1RaG+OjsTMpQS3J3UCvTF6wc4+IOHCz+jAOU37Y4o=
 fortio.org/dflag v1.5.2 h1:F9XVRj4Qr2IbJP7BMj7XZc9wB0Q/RZ61Ool+4YPVad8=
 fortio.org/dflag v1.5.2/go.mod h1:ppb/A8u+KKg+qUUYZNYuvRnXuVb8IsdHb/XGzsmjkN8=
@@ -43,429 +10,94 @@ fortio.org/sets v1.0.2 h1:gSWZFg9rgzl1zJfI/93lDJKBFw8WZ3Uxe3oQ5uDM4T4=
 fortio.org/sets v1.0.2/go.mod h1:xVjulHr0FhlmReSymI+AhDtQ4FgjiazQ3JmuNpYFMs8=
 fortio.org/version v1.0.2 h1:8NwxdX58aoeKx7T5xAPO0xlUu1Hpk42nRz5s6e6eKZ0=
 fortio.org/version v1.0.2/go.mod h1:2JQp9Ax+tm6QKiGuzR5nJY63kFeANcgrZ0osoQFDVm0=
-github.com/Azure/azure-sdk-for-go v16.2.1+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
-github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
-github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
-github.com/Azure/go-autorest v10.8.1+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
-github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
-github.com/Azure/go-autorest/autorest v0.11.1/go.mod h1:JFgpikqFJ/MleTTxwepExTKnFUKKszPS8UavbQYUMuw=
-github.com/Azure/go-autorest/autorest/adal v0.9.0/go.mod h1:/c022QCutn2P7uY+/oQWWNcK9YU+MH96NgK+jErpbcg=
-github.com/Azure/go-autorest/autorest/adal v0.9.5/go.mod h1:B7KF7jKIeC9Mct5spmyCB/A8CG/sEz1vwIRGv/bbw7A=
-github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSYnokU+TrmwEsOqdt8Y6sso74=
-github.com/Azure/go-autorest/autorest/mocks v0.4.0/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
-github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
-github.com/Azure/go-autorest/logger v0.2.0/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8=
-github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
-github.com/Microsoft/go-winio v0.4.11/go.mod h1:VhR8bwka0BXejwEJY73c50VrPtXAaKcyvVC4A4RozmA=
-github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
-github.com/Microsoft/go-winio v0.4.15-0.20190919025122-fc70bd9a86b5/go.mod h1:tTuCMEN+UleMWgg9dVx4Hu52b1bJo+59jBh3ajtinzw=
-github.com/Microsoft/go-winio v0.4.16-0.20201130162521-d1ffc52c7331/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=
-github.com/Microsoft/go-winio v0.4.16/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=
-github.com/Microsoft/go-winio v0.4.17-0.20210211115548-6eac466e5fa3/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
-github.com/Microsoft/go-winio v0.4.17-0.20210324224401-5516f17a5958/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
-github.com/Microsoft/go-winio v0.4.17/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
-github.com/Microsoft/go-winio v0.6.0 h1:slsWYD/zyx7lCXoZVlvQrj0hPTM1HI4+v1sIda2yDvg=
-github.com/Microsoft/go-winio v0.6.0/go.mod h1:cTAf44im0RAYeL23bpB+fzCyDH2MJiz2BO69KH/soAE=
-github.com/Microsoft/hcsshim v0.8.6/go.mod h1:Op3hHsoHPAvb6lceZHDtd9OkTew38wNoXnJs8iY7rUg=
-github.com/Microsoft/hcsshim v0.8.7-0.20190325164909-8abdbb8205e4/go.mod h1:Op3hHsoHPAvb6lceZHDtd9OkTew38wNoXnJs8iY7rUg=
-github.com/Microsoft/hcsshim v0.8.7/go.mod h1:OHd7sQqRFrYd3RmSgbgji+ctCwkbq2wbEYNSzOYtcBQ=
-github.com/Microsoft/hcsshim v0.8.9/go.mod h1:5692vkUqntj1idxauYlpoINNKeqCiG6Sg38RRsjT5y8=
-github.com/Microsoft/hcsshim v0.8.14/go.mod h1:NtVKoYxQuTLx6gEq0L96c9Ju4JbRJ4nY2ow3VK6a9Lg=
-github.com/Microsoft/hcsshim v0.8.15/go.mod h1:x38A4YbHbdxJtc0sF6oIz+RG0npwSCAvn69iY6URG00=
-github.com/Microsoft/hcsshim v0.8.16/go.mod h1:o5/SZqmR7x9JNKsW3pu+nqHm0MF8vbA+VxGOoXdC600=
-github.com/Microsoft/hcsshim v0.8.21/go.mod h1:+w2gRZ5ReXQhFOrvSQeNfhrYB/dg3oDwTOcER2fw4I4=
-github.com/Microsoft/hcsshim v0.9.7 h1:mKNHW/Xvv1aFH87Jb6ERDzXTJTLPlmzfZ28VBFD/bfg=
-github.com/Microsoft/hcsshim v0.9.7/go.mod h1:7pLA8lDk46WKDWlVsENo92gC0XFa8rbKfyFRBqxEbCc=
-github.com/Microsoft/hcsshim/test v0.0.0-20201218223536-d3e5debf77da/go.mod h1:5hlzMzRKMLyo42nCZ9oml8AdTlq/0cvIaBv6tK1RehU=
-github.com/Microsoft/hcsshim/test v0.0.0-20210227013316-43a75bb4edd3/go.mod h1:mw7qgWloBUl75W/gVH3cQszUg1+gUITj7D6NY7ywVnY=
-github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
-github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
-github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
-github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
-github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
-github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
+github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
+github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
+github.com/Microsoft/hcsshim v0.10.0-rc.8 h1:YSZVvlIIDD1UxQpJp0h+dnpLUw+TrY0cx8obKsp3bek=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/alexflint/go-filemutex v0.0.0-20171022225611-72bdc8eae2ae/go.mod h1:CgnQgUtFrFz9mxFNtED3jI5tLDjKlOM+oUF/sTk6ps0=
-github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
 github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
-github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
 github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
 github.com/armon/go-metrics v0.4.1 h1:hR91U9KYmb6bLBYLQjyM+3j+rcd/UhE+G78SFnF8gJA=
 github.com/armon/go-metrics v0.4.1/go.mod h1:E6amYzXo6aW1tqzoZGT755KkbgrJsSdpwZ+3JqfkOG4=
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/avast/retry-go v3.0.0+incompatible h1:4SOWQ7Qs+oroOTQOYnAHqelpCO0biHSxpiH9JdtuBj0=
 github.com/avast/retry-go v3.0.0+incompatible/go.mod h1:XtSnn+n/sHqQIpZ10K1qAevBhOOCWBLXXy3hyiqqBrY=
-github.com/aws/aws-sdk-go v1.15.11/go.mod h1:mFuSZ37Z9YOHbQEwBWztmVzqXrEkub65tZoCYDt7FT0=
-github.com/beorn7/perks v0.0.0-20160804104726-4c0e84591b9a/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/bitly/go-simplejson v0.5.0/go.mod h1:cXHtHw4XUPsvGaxgjIAn8PhEWG9NfngEKAMDJEczWVA=
-github.com/bits-and-blooms/bitset v1.2.0/go.mod h1:gIdJ4wp64HaoK2YrL1Q5/N7Y16edYb8uY+O0FJTyyDA=
-github.com/blang/semver v3.1.0+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
-github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
-github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
-github.com/bshuster-repo/logrus-logstash-hook v0.4.1/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
-github.com/buger/jsonparser v0.0.0-20180808090653-f4dd9f5a6b44/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
-github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd/go.mod h1:2oa8nejYd4cQ/b0hMIopN0lCRxU0bueqREvZLWFrtK8=
-github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
-github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
-github.com/cenkalti/backoff/v4 v4.1.1/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
-github.com/cenkalti/backoff/v4 v4.2.0 h1:HN5dHm3WBOgndBH6E8V0q2jIYIR3s9yglV8k/+MN3u4=
-github.com/cenkalti/backoff/v4 v4.2.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
+github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
-github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
-github.com/checkpoint-restore/go-criu/v4 v4.1.0/go.mod h1:xUQBLp4RLc5zJtWY++yjOoMoB5lihDt7fai+75m+rGw=
-github.com/checkpoint-restore/go-criu/v5 v5.0.0/go.mod h1:cfwC0EG7HMUenopBsUf9d89JlCLQIfgVcNsNN0t6T2M=
-github.com/checkpoint-restore/go-criu/v5 v5.3.0/go.mod h1:E/eQpaFtUKGOOSEBZgmKAcn+zUUwWxqcaKZlF54wK8E=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/cilium/ebpf v0.0.0-20200110133405-4032b1d8aae3/go.mod h1:MA5e5Lr8slmEg9bt0VpxxWqJlO4iwu3FBdHUzV7wQVg=
-github.com/cilium/ebpf v0.0.0-20200702112145-1c8d4c9ef775/go.mod h1:7cR51M8ViRLIdUjrmSXlK9pkrsDlLHbO8jiB8X8JnOc=
-github.com/cilium/ebpf v0.2.0/go.mod h1:To2CFviqOWL/M0gIMsvSMlqe7em/l1ALkX1PyjrX2Qs=
-github.com/cilium/ebpf v0.4.0/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
-github.com/cilium/ebpf v0.6.2/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
-github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2usCA=
 github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
 github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
-github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20220314180256-7f1daf1720fc/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20230105202645-06c439db220b h1:ACGZRIr7HsgBKHsueQ1yM4WaVaXh21ynwqsF8M8tXhA=
-github.com/cncf/xds/go v0.0.0-20230105202645-06c439db220b/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8=
-github.com/containerd/aufs v0.0.0-20200908144142-dab0cbea06f4/go.mod h1:nukgQABAEopAHvB6j7cnP5zJ+/3aVcE7hCYqvIwAHyE=
-github.com/containerd/aufs v0.0.0-20201003224125-76a6863f2989/go.mod h1:AkGGQs9NM2vtYHaUen+NljV0/baGCAPELGm2q9ZXpWU=
-github.com/containerd/aufs v0.0.0-20210316121734-20793ff83c97/go.mod h1:kL5kd6KM5TzQjR79jljyi4olc1Vrx6XBlcyj3gNv2PU=
-github.com/containerd/aufs v1.0.0/go.mod h1:kL5kd6KM5TzQjR79jljyi4olc1Vrx6XBlcyj3gNv2PU=
-github.com/containerd/btrfs v0.0.0-20201111183144-404b9149801e/go.mod h1:jg2QkJcsabfHugurUvvPhS3E08Oxiuh5W/g1ybB4e0E=
-github.com/containerd/btrfs v0.0.0-20210316141732-918d888fb676/go.mod h1:zMcX3qkXTAi9GI50+0HOeuV8LU2ryCE/V2vG/ZBiTss=
-github.com/containerd/btrfs v1.0.0/go.mod h1:zMcX3qkXTAi9GI50+0HOeuV8LU2ryCE/V2vG/ZBiTss=
-github.com/containerd/cgroups v0.0.0-20190717030353-c4b9ac5c7601/go.mod h1:X9rLEHIqSf/wfK8NsPqxJmeZgW4pcfzdXITDrUSJ6uI=
-github.com/containerd/cgroups v0.0.0-20190919134610-bf292b21730f/go.mod h1:OApqhQ4XNSNC13gXIwDjhOQxjWa/NxkwZXJ1EvqT0ko=
-github.com/containerd/cgroups v0.0.0-20200531161412-0dbf7f05ba59/go.mod h1:pA0z1pT8KYB3TCXK/ocprsh7MAkoW8bZVzPdih9snmM=
-github.com/containerd/cgroups v0.0.0-20200710171044-318312a37340/go.mod h1:s5q4SojHctfxANBDvMeIaIovkq29IP48TKAxnhYRxvo=
-github.com/containerd/cgroups v0.0.0-20200824123100-0b889c03f102/go.mod h1:s5q4SojHctfxANBDvMeIaIovkq29IP48TKAxnhYRxvo=
-github.com/containerd/cgroups v0.0.0-20210114181951-8a68de567b68/go.mod h1:ZJeTFisyysqgcCdecO57Dj79RfL0LNeGiFUqLYQRYLE=
-github.com/containerd/cgroups v1.0.1/go.mod h1:0SJrPIenamHDcZhEcJMNBB85rHcUsw4f25ZfBiPYRkU=
-github.com/containerd/cgroups v1.0.4 h1:jN/mbWBEaz+T1pi5OFtnkQ+8qnmEbAr1Oo1FRm5B0dA=
-github.com/containerd/cgroups v1.0.4/go.mod h1:nLNQtsF7Sl2HxNebu77i1R0oDlhiTG+kO4JTrUzo6IA=
-github.com/containerd/console v0.0.0-20180822173158-c12b1e7919c1/go.mod h1:Tj/on1eG8kiEhd0+fhSDzsPAFESxzBBvdyEgyryXffw=
-github.com/containerd/console v0.0.0-20181022165439-0650fd9eeb50/go.mod h1:Tj/on1eG8kiEhd0+fhSDzsPAFESxzBBvdyEgyryXffw=
-github.com/containerd/console v0.0.0-20191206165004-02ecf6a7291e/go.mod h1:8Pf4gM6VEbTNRIT26AyyU7hxdQU3MvAvxVI0sc00XBE=
-github.com/containerd/console v1.0.1/go.mod h1:XUsP6YE/mKtz6bxc+I8UiKKTP04qjQL4qcS3XoQ5xkw=
-github.com/containerd/console v1.0.2/go.mod h1:ytZPjGgY2oeTkAONYafi2kSj0aYggsf8acV1PGKCbzQ=
-github.com/containerd/console v1.0.3/go.mod h1:7LqA/THxQ86k76b8c/EMSiaJ3h1eZkMkXar0TQ1gf3U=
-github.com/containerd/containerd v1.2.10/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.3.0-beta.2.0.20190828155532-0293cbd26c69/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.3.0/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.3.1-0.20191213020239-082f7e3aed57/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.3.2/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.4.0-beta.2.0.20200729163537-40b22ef07410/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.4.1/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.4.3/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.5.0-beta.1/go.mod h1:5HfvG1V2FsKesEGQ17k5/T7V960Tmcumvqn8Mc+pCYQ=
-github.com/containerd/containerd v1.5.0-beta.3/go.mod h1:/wr9AVtEM7x9c+n0+stptlo/uBBoBORwEx6ardVcmKU=
-github.com/containerd/containerd v1.5.0-beta.4/go.mod h1:GmdgZd2zA2GYIBZ0w09ZvgqEq8EfBp/m3lcVZIvPHhI=
-github.com/containerd/containerd v1.5.0-rc.0/go.mod h1:V/IXoMqNGgBlabz3tHD2TWDoTJseu1FGOKuoA4nNb2s=
-github.com/containerd/containerd v1.5.1/go.mod h1:0DOxVqwDy2iZvrZp2JUx/E+hS0UNTVn7dJnIOwtYR4g=
-github.com/containerd/containerd v1.5.7/go.mod h1:gyvv6+ugqY25TiXxcZC3L5yOeYgEw0QMhscqVp1AR9c=
-github.com/containerd/containerd v1.6.19 h1:F0qgQPrG0P2JPgwpxWxYavrVeXAG0ezUIB9Z/4FTUAU=
-github.com/containerd/containerd v1.6.19/go.mod h1:HZCDMn4v/Xl2579/MvtOC2M206i+JJ6VxFWU/NetrGY=
-github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
-github.com/containerd/continuity v0.0.0-20190815185530-f2a389ac0a02/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
-github.com/containerd/continuity v0.0.0-20191127005431-f65d91d395eb/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
-github.com/containerd/continuity v0.0.0-20200710164510-efbc4488d8fe/go.mod h1:cECdGN1O8G9bgKTlLhuPJimka6Xb/Gg7vYzCTNVxhvo=
-github.com/containerd/continuity v0.0.0-20201208142359-180525291bb7/go.mod h1:kR3BEg7bDFaEddKm54WSmrol1fKWDU1nKYkgrcgZT7Y=
-github.com/containerd/continuity v0.0.0-20210208174643-50096c924a4e/go.mod h1:EXlVlkqNba9rJe3j7w3Xa924itAMLgZH4UD/Q4PExuQ=
-github.com/containerd/continuity v0.1.0/go.mod h1:ICJu0PwR54nI0yPEnJ6jcS+J7CZAUXrLh8lPo2knzsM=
+github.com/cncf/xds/go v0.0.0-20230310173818-32f1caf87195 h1:58f1tJ1ra+zFINPlwLWvQsR9CzAKt2e+EWV2yX9oXQ4=
+github.com/cncf/xds/go v0.0.0-20230310173818-32f1caf87195/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/containerd/containerd v1.7.1 h1:k8DbDkSOwt5rgxQ3uCI4WMKIJxIndSCBUaGm5oRn+Go=
+github.com/containerd/containerd v1.7.1/go.mod h1:gA+nJUADRBm98QS5j5RPROnt0POQSMK+r7P7EGMC/Qc=
 github.com/containerd/continuity v0.3.0 h1:nisirsYROK15TAMVukJOUyGJjz4BNQJBVsNvAXZJ/eg=
-github.com/containerd/fifo v0.0.0-20180307165137-3d5202aec260/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=
-github.com/containerd/fifo v0.0.0-20190226154929-a9fb20d87448/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=
-github.com/containerd/fifo v0.0.0-20200410184934-f15a3290365b/go.mod h1:jPQ2IAeZRCYxpS/Cm1495vGFww6ecHmMk1YJH2Q5ln0=
-github.com/containerd/fifo v0.0.0-20201026212402-0724c46b320c/go.mod h1:jPQ2IAeZRCYxpS/Cm1495vGFww6ecHmMk1YJH2Q5ln0=
-github.com/containerd/fifo v0.0.0-20210316144830-115abcc95a1d/go.mod h1:ocF/ME1SX5b1AOlWi9r677YJmCPSwwWnQ9O123vzpE4=
-github.com/containerd/fifo v1.0.0/go.mod h1:ocF/ME1SX5b1AOlWi9r677YJmCPSwwWnQ9O123vzpE4=
-github.com/containerd/go-cni v1.0.1/go.mod h1:+vUpYxKvAF72G9i1WoDOiPGRtQpqsNW/ZHtSlv++smU=
-github.com/containerd/go-cni v1.0.2/go.mod h1:nrNABBHzu0ZwCug9Ije8hL2xBCYh/pjfMb1aZGrrohk=
-github.com/containerd/go-runc v0.0.0-20180907222934-5a6d9f37cfa3/go.mod h1:IV7qH3hrUgRmyYrtgEeGWJfWbgcHL9CSRruz2Vqcph0=
-github.com/containerd/go-runc v0.0.0-20190911050354-e029b79d8cda/go.mod h1:IV7qH3hrUgRmyYrtgEeGWJfWbgcHL9CSRruz2Vqcph0=
-github.com/containerd/go-runc v0.0.0-20200220073739-7016d3ce2328/go.mod h1:PpyHrqVs8FTi9vpyHwPwiNEGaACDxT/N/pLcvMSRA9g=
-github.com/containerd/go-runc v0.0.0-20201020171139-16b287bc67d0/go.mod h1:cNU0ZbCgCQVZK4lgG3P+9tn9/PaJNmoDXPpoJhDR+Ok=
-github.com/containerd/go-runc v1.0.0/go.mod h1:cNU0ZbCgCQVZK4lgG3P+9tn9/PaJNmoDXPpoJhDR+Ok=
-github.com/containerd/imgcrypt v1.0.1/go.mod h1:mdd8cEPW7TPgNG4FpuP3sGBiQ7Yi/zak9TYCG3juvb0=
-github.com/containerd/imgcrypt v1.0.4-0.20210301171431-0ae5c75f59ba/go.mod h1:6TNsg0ctmizkrOgXRNQjAPFWpMYRWuiB6dSF4Pfa5SA=
-github.com/containerd/imgcrypt v1.1.1-0.20210312161619-7ed62a527887/go.mod h1:5AZJNI6sLHJljKuI9IHnw1pWqo/F0nGDOuR9zgTs7ow=
-github.com/containerd/imgcrypt v1.1.1/go.mod h1:xpLnwiQmEUJPvQoAapeb2SNCxz7Xr6PJrXQb0Dpc4ms=
-github.com/containerd/nri v0.0.0-20201007170849-eb1350a75164/go.mod h1:+2wGSDGFYfE5+So4M5syatU0N0f0LbWpuqyMi4/BE8c=
-github.com/containerd/nri v0.0.0-20210316161719-dbaa18c31c14/go.mod h1:lmxnXF6oMkbqs39FiCt1s0R2HSMhcLel9vNL3m4AaeY=
-github.com/containerd/nri v0.1.0/go.mod h1:lmxnXF6oMkbqs39FiCt1s0R2HSMhcLel9vNL3m4AaeY=
-github.com/containerd/stargz-snapshotter/estargz v0.4.1/go.mod h1:x7Q9dg9QYb4+ELgxmo4gBUeJB0tl5dqH1Sdz0nJU1QM=
-github.com/containerd/ttrpc v0.0.0-20190828154514-0e0f228740de/go.mod h1:PvCDdDGpgqzQIzDW1TphrGLssLDZp2GuS+X5DkEJB8o=
-github.com/containerd/ttrpc v0.0.0-20190828172938-92c8520ef9f8/go.mod h1:PvCDdDGpgqzQIzDW1TphrGLssLDZp2GuS+X5DkEJB8o=
-github.com/containerd/ttrpc v0.0.0-20191028202541-4f1b8fe65a5c/go.mod h1:LPm1u0xBw8r8NOKoOdNMeVHSawSsltak+Ihv+etqsE8=
-github.com/containerd/ttrpc v1.0.1/go.mod h1:UAxOpgT9ziI0gJrmKvgcZivgxOp8iFPSk8httJEt98Y=
-github.com/containerd/ttrpc v1.0.2/go.mod h1:UAxOpgT9ziI0gJrmKvgcZivgxOp8iFPSk8httJEt98Y=
-github.com/containerd/ttrpc v1.1.0/go.mod h1:XX4ZTnoOId4HklF4edwc4DcqskFZuvXB1Evzy5KFQpQ=
-github.com/containerd/typeurl v0.0.0-20180627222232-a93fcdb778cd/go.mod h1:Cm3kwCdlkCfMSHURc+r6fwoGH6/F1hH3S4sg0rLFWPc=
-github.com/containerd/typeurl v0.0.0-20190911142611-5eb25027c9fd/go.mod h1:GeKYzf2pQcqv7tJ0AoCuuhtnqhva5LNU3U+OyKxxJpk=
-github.com/containerd/typeurl v1.0.1/go.mod h1:TB1hUtrpaiO88KEK56ijojHS1+NeF0izUACaJW2mdXg=
-github.com/containerd/typeurl v1.0.2/go.mod h1:9trJWW2sRlGub4wZJRTW83VtbOLS6hwcDZXTn6oPz9s=
-github.com/containerd/zfs v0.0.0-20200918131355-0a33824f23a2/go.mod h1:8IgZOBdv8fAgXddBT4dBXJPtxyRsejFIpXoklgxgEjw=
-github.com/containerd/zfs v0.0.0-20210301145711-11e8f1707f62/go.mod h1:A9zfAbMlQwE+/is6hi0Xw8ktpL+6glmqZYtevJgaB8Y=
-github.com/containerd/zfs v0.0.0-20210315114300-dde8f0fda960/go.mod h1:m+m51S1DvAP6r3FcmYCp54bQ34pyOwTieQDNRIRHsFY=
-github.com/containerd/zfs v0.0.0-20210324211415-d5c4544f0433/go.mod h1:m+m51S1DvAP6r3FcmYCp54bQ34pyOwTieQDNRIRHsFY=
-github.com/containerd/zfs v1.0.0/go.mod h1:m+m51S1DvAP6r3FcmYCp54bQ34pyOwTieQDNRIRHsFY=
-github.com/containernetworking/cni v0.7.1/go.mod h1:LGwApLUm2FpoOfxTDEeq8T9ipbpZ61X79hmU3w8FmsY=
-github.com/containernetworking/cni v0.8.0/go.mod h1:LGwApLUm2FpoOfxTDEeq8T9ipbpZ61X79hmU3w8FmsY=
-github.com/containernetworking/cni v0.8.1/go.mod h1:LGwApLUm2FpoOfxTDEeq8T9ipbpZ61X79hmU3w8FmsY=
-github.com/containernetworking/plugins v0.8.6/go.mod h1:qnw5mN19D8fIwkqW7oHHYDHVlzhJpcY6TQxn/fUyDDM=
-github.com/containernetworking/plugins v0.9.1/go.mod h1:xP/idU2ldlzN6m4p5LmGiwRDjeJr6FLK6vuiUwoH7P8=
-github.com/containers/ocicrypt v1.0.1/go.mod h1:MeJDzk1RJHv89LjsH0Sp5KTY3ZYkjXO/C+bKAeWFIrc=
-github.com/containers/ocicrypt v1.1.0/go.mod h1:b8AOe0YR67uU8OqfVNcznfFpAzu3rdgUV4GP9qXPfu4=
-github.com/containers/ocicrypt v1.1.1/go.mod h1:Dm55fwWm1YZAjYRaJ94z2mfZikIyIN4B0oB3dj3jFxY=
-github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
-github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
-github.com/coreos/go-iptables v0.4.5/go.mod h1:/mVI274lEDI2ns62jHCDnCyBF9Iwsmekav8Dbxlm1MU=
-github.com/coreos/go-iptables v0.5.0/go.mod h1:/mVI274lEDI2ns62jHCDnCyBF9Iwsmekav8Dbxlm1MU=
-github.com/coreos/go-oidc v2.1.0+incompatible/go.mod h1:CgnwVTmzoESiwO9qyAFEMiHoZ1nMCKZlZ9V6mm3/LKc=
-github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
-github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
-github.com/coreos/go-systemd v0.0.0-20161114122254-48702e0da86b/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
-github.com/coreos/go-systemd v0.0.0-20180511133405-39ca1b05acc7/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
-github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
-github.com/coreos/go-systemd/v22 v22.0.0/go.mod h1:xO0FLkIi5MaZafQlIrOotqXZ90ih+1atmu1JpKERPPk=
-github.com/coreos/go-systemd/v22 v22.1.0/go.mod h1:xO0FLkIi5MaZafQlIrOotqXZ90ih+1atmu1JpKERPPk=
-github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/coreos/pkg v0.0.0-20160727233714-3ac0863d7acf/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
-github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
-github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
-github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
-github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/creack/pty v1.1.11 h1:07n33Z8lZxZ2qwegKbObQohDhXDQxiMMz1NOUGYlesw=
-github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4=
-github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
-github.com/d2g/dhcp4 v0.0.0-20170904100407-a1d1b6c41b1c/go.mod h1:Ct2BUK8SB0YC1SMSibvLzxjeJLnrYEVLULFNiHY9YfQ=
-github.com/d2g/dhcp4client v1.0.0/go.mod h1:j0hNfjhrt2SxUOw55nL0ATM/z4Yt3t2Kd1mW34z5W5s=
-github.com/d2g/dhcp4server v0.0.0-20181031114812-7d4a0a7f59a5/go.mod h1:Eo87+Kg/IX2hfWJfwxMzLyuSZyxSoAug2nGa1G2QAi8=
-github.com/d2g/hardwareaddr v0.0.0-20190221164911-e7d9fbe030e4/go.mod h1:bMl4RjIciD2oAxI7DmWRx6gbeqrkoLqv3MV0vzNad+I=
+github.com/cpuguy83/dockercfg v0.3.1 h1:/FpZ+JaygUR/lZP2NlFI2DVfrOEMAIKP5wWEJdoYe9E=
+github.com/cpuguy83/dockercfg v0.3.1/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc=
+github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/denverdino/aliyungo v0.0.0-20190125010748-a747050bb1ba/go.mod h1:dV8lFg6daOBZbT6/BDGIz6Y3WFGn8juu6G+CQ6LHtl0=
-github.com/dgrijalva/jwt-go v0.0.0-20170104182250-a601269ab70c/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
-github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
-github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
-github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
-github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
-github.com/docker/cli v0.0.0-20191017083524-a8ff7f821017/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TTO4EOBfRPhZXAeF1Vu+W3hHZ8eLp8PgKVZlcvtFY=
-github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.8.1+incompatible h1:Q50tZOPR6T/hjNsyc9g8/syEs6bk8XXApsHjKukMl68=
 github.com/docker/distribution v2.8.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v1.4.2-0.20190924003213-a8608b5b67c7/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v20.10.22+incompatible h1:6jX4yB+NtcbldT90k7vBSaWJDB3i+zkVJT9BEK8kQkk=
-github.com/docker/docker v20.10.22+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
+github.com/docker/docker v23.0.6+incompatible h1:aBD4np894vatVX99UTx/GyOUOK4uEcROwA3+bQhEcoU=
+github.com/docker/docker v23.0.6+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
-github.com/docker/go-events v0.0.0-20170721190031-9461782956ad/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
-github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
-github.com/docker/go-metrics v0.0.0-20180209012529-399ea8c73916/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
-github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
-github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
-github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
-github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
-github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
-github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
-github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
-github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
-github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
-github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
-github.com/envoyproxy/go-control-plane v0.10.3 h1:xdCVXxEe0Y3FQith+0cj2irwZudqGYvecuLB1HtdexY=
-github.com/envoyproxy/go-control-plane v0.10.3/go.mod h1:fJJn/j26vwOu972OllsvAgJJM//w9BV6Fxbg2LuVd34=
+github.com/envoyproxy/go-control-plane v0.11.0 h1:jtLewhRR2vMRNnq2ZZUoCjUlgut+Y0+sDDWPOfwOi1o=
+github.com/envoyproxy/go-control-plane v0.11.0/go.mod h1:VnHyVMpzcLvCFt9yUz1UnCwHLhwx1WguiVDV7pTG/tI=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/envoyproxy/protoc-gen-validate v0.6.7/go.mod h1:dyJXwwfPK2VSqiB9Klm1J6romD608Ba7Hij42vrOBCo=
-github.com/envoyproxy/protoc-gen-validate v0.9.1 h1:PS7VIOgmSVhWUEeZwTe7z7zouA22Cr590PzXKbZHOVY=
-github.com/envoyproxy/protoc-gen-validate v0.9.1/go.mod h1:OKNgG7TCp5pF4d6XftA0++PMirau2/yoOwVac3AbF2w=
-github.com/evanphx/json-patch v4.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/envoyproxy/protoc-gen-validate v0.10.0 h1:oIfnZFdC0YhpNNEX+SuIqko4cqqVZeN9IGTrhZje83Y=
+github.com/envoyproxy/protoc-gen-validate v0.10.0/go.mod h1:DRjgyB0I43LtJapqN6NiRwroiAU2PaFuvk/vjgh61ss=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
 github.com/fatih/color v1.14.1 h1:qfhVLaG5s+nCROl1zJsZRxFeYrHLqWroPOQ8BWiNb4w=
 github.com/fatih/color v1.14.1/go.mod h1:2oHN61fhTpgcxD3TSWCgKDiH1+x4OiDVVGH8WlgGZGg=
-github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
-github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
-github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
-github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa/go.mod h1:KnogPXtdwXqoenmZCw6S+25EAm2MkxbG0deNDu4cbSA=
-github.com/garyburd/redigo v0.0.0-20150301180006-535138d7bcd7/go.mod h1:NR3MbYisc3/PwhQ00EMzDiPmrwpPxAn5GI05/YaO1SY=
-github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-ini/ini v1.25.4/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
-github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
-github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
-github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+35s3my2LFTysnkMfxsJBAMHj/DoqoB9knIWoYG/Vk0=
-github.com/go-openapi/jsonpointer v0.19.2/go.mod h1:3akKfEdA7DF1sugOqz1dVQHBcuDBPKZGEoHC/NkiQRg=
-github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1:W3Z9FmVs9qj+KR4zFKmDPGiLdk1D9Rlm7cyMvf57TTg=
-github.com/go-openapi/jsonreference v0.19.2/go.mod h1:jMjeRr2HHw6nAVajTXJ4eiUwohSTlpa0o73RUL1owJc=
-github.com/go-openapi/jsonreference v0.19.3/go.mod h1:rjx6GuL8TTa9VaixXglHmQmIL98+wF9xc8zWvFonSJ8=
-github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc=
-github.com/go-openapi/spec v0.19.3/go.mod h1:FpwSN1ksY1eteniUU7X0N/BgJ7a4WvBFVA8Lj9mJglo=
-github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dpr1UfpPtxFw+EFuQ41HhCWZfha5jSVRG7C7I=
-github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
-github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
-github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI=
-github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/godbus/dbus v0.0.0-20151105175453-c7fdd8b5cd55/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
-github.com/godbus/dbus v0.0.0-20180201030542-885f9cc04c9c/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
-github.com/godbus/dbus v0.0.0-20190422162347-ade71ed3457e/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
-github.com/godbus/dbus/v5 v5.0.3/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/godbus/dbus/v5 v5.0.6/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/gogo/googleapis v1.2.0/go.mod h1:Njal3psf3qN6dwBtQfUmBZh2ybovJ0tlu3o/AC7HYjU=
-github.com/gogo/googleapis v1.4.0/go.mod h1:5YRNX2z1oM5gXdAkurHa942MDgEJyk02w4OecKY87+c=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
-github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
-github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
-github.com/gogo/protobuf v1.3.0/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
-github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=
-github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
-github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
-github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
 github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0 h1:0udJVsspx3VBr5FwtLhQQtuAsVc79tTq0ocGIPAU6qo=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-containerregistry v0.5.1/go.mod h1:Ct15B4yir3PLOP5jsy0GNeYVaIZs/MK/Jz5any1wFW0=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
-github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
-github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/googleapis/gnostic v0.4.1/go.mod h1:LRhVm6pbyptWbWbuZ38d1eyptfvIytN3ir6b65WBswg=
-github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
-github.com/gorilla/handlers v0.0.0-20150720190736-60c7bfde3e33/go.mod h1:Qkdc/uu4tH4g6mTK6auzZ766c4CA0Ng8+o/OAirnOIQ=
-github.com/gorilla/mux v1.7.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
-github.com/gorilla/mux v1.7.3/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
-github.com/gorilla/websocket v0.0.0-20170926233335-4201258b820c/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
-github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
-github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
-github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
-github.com/grpc-ecosystem/go-grpc-middleware v1.0.1-0.20190118093823-f849b5445de4/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
-github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
-github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
-github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4ZsPv9hVvWI6+ch50m39Pf2Ks=
-github.com/hashicorp/errwrap v0.0.0-20141028054710-7554cd9344ce/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -480,7 +112,6 @@ github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjh
 github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
 github.com/hashicorp/go-msgpack v1.1.5 h1:9byZdVjKTe5mce63pRVNP1L7UAmdHOTEMGehn6KvJWs=
 github.com/hashicorp/go-msgpack v1.1.5/go.mod h1:gWVc3sv/wbDmR3rQsj1CAktEZzoz1YNK9NfGLXJ69/4=
-github.com/hashicorp/go-multierror v0.0.0-20161216184304-ed905158d874/go.mod h1:JMRHfdO9jKNzS/+BTlxCjKNQHg/jZAft8U7LloJvN7I=
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
 github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
@@ -499,71 +130,36 @@ github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/b
 github.com/hashicorp/go-version v1.2.1 h1:zEfKbn2+PDgroKdiOzqiE8rsmLqU2uwi5PB5pBJ3TkI=
 github.com/hashicorp/go-version v1.2.1/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
 github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
 github.com/hashicorp/mdns v1.0.4/go.mod h1:mtBihi+LeNXGtG8L9dX59gAEa12BDtBQSp4v/YAJqrc=
 github.com/hashicorp/memberlist v0.5.0 h1:EtYPN8DpAURiapus508I4n9CzHs2W+8NZGbmmR/prTM=
 github.com/hashicorp/memberlist v0.5.0/go.mod h1:yvyXLpo0QaGE59Y7hDTsTzDD25JYBZ4mHgHUZ8lrOI0=
 github.com/hashicorp/serf v0.10.1 h1:Z1H2J60yRKvfDYAOZLd2MU0ND4AH/WDz7xYHDWQsIPY=
 github.com/hashicorp/serf v0.10.1/go.mod h1:yL2t6BqATOLGc5HF7qbFkTfXoPIY0WZdWHfEvMqbG+4=
-github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
-github.com/iancoleman/strcase v0.2.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho=
-github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
-github.com/imdario/mergo v0.3.8/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
-github.com/imdario/mergo v0.3.10/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+github.com/imdario/mergo v0.3.15 h1:M8XP7IuFNsqUx6VPK2P9OSmsYsI/YFaGil0uD21V3dM=
+github.com/imdario/mergo v0.3.15/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/itchyny/gojq v0.12.9 h1:biKpbKwMxVYhCU1d6mR7qMr3f0Hn9F5k5YykCVb3gmM=
 github.com/itchyny/gojq v0.12.9/go.mod h1:T4Ip7AETUXeGpD+436m+UEl3m3tokRgajd5pRfsR5oE=
 github.com/itchyny/timefmt-go v0.1.4 h1:hFEfWVdwsEi+CY8xY2FtgWHGQaBaC3JeHd+cve0ynVM=
 github.com/itchyny/timefmt-go v0.1.4/go.mod h1:nEP7L+2YmAbT2kZ2HfSs1d8Xtw9LY8D2stDBckWakZ8=
-github.com/j-keck/arping v0.0.0-20160618110441-2cf9dc699c56/go.mod h1:ymszkNOg6tORTn+6F6j+Jc8TOr5osrynvN6ivFWZ2GA=
-github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
-github.com/jmespath/go-jmespath v0.0.0-20160803190731-bd40a432e4c7/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
-github.com/joefitzgerald/rainbow-reporter v0.1.0/go.mod h1:481CNgqmVHQZzdIbN52CupLJyoVwB10FQ/IQlF1pdL8=
-github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
-github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
-github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
-github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
-github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
-github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.11.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
-github.com/klauspost/compress v1.11.13/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
+github.com/klauspost/compress v1.16.5 h1:IFV2oUNUzZaz+XyusxpLzpzS8Pt5rh0Z16For/djlyI=
+github.com/klauspost/compress v1.16.5/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/linuxkit/virtsock v0.0.0-20201010232012-f8cee7dfc7a3/go.mod h1:3r6x7q95whyfWQpmGZTu3gk3v2YkMi05HEzl7Tf7YEo=
-github.com/lyft/protoc-gen-star v0.6.0/go.mod h1:TGAoBVkt8w7MPG72TrKIu85MIdXwDuzJYeZuUPFPNwA=
-github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
-github.com/magiconair/properties v1.8.6 h1:5ibWZ6iY0NctNGWo87LalDlEZ6R41TqbbDamhfG/Qzo=
-github.com/magiconair/properties v1.8.6/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
-github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
-github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
-github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
-github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7ldAVICs=
-github.com/marstr/guid v1.1.0/go.mod h1:74gB1z2wpxxInTG6yaqA7KrtM0NZ+RbrcqDvYHefzho=
+github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
+github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
@@ -572,7 +168,6 @@ github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
@@ -580,17 +175,10 @@ github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27k
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng=
 github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
-github.com/mattn/go-shellwords v1.0.3/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
-github.com/mattn/go-shellwords v1.0.6/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
-github.com/maxbrunsfeld/counterfeiter/v6 v6.2.2/go.mod h1:eD9eIE7cdwcMi9rYluz88Jz2VyhSmden33/aXg4oVIY=
 github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
 github.com/miekg/dns v1.1.41 h1:WMszZWJG0XmzbK9FEmzH2TVcqYzFesusSIB41b8KHxY=
 github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
-github.com/miekg/pkcs11 v1.0.3/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
-github.com/mistifyio/go-zfs v2.1.2-0.20190413222219-f784269be439+incompatible/go.mod h1:8AuVvqP/mXw1px98n46wfvcGfQ4ci2FwoAjKYxuo3Z4=
 github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
 github.com/mitchellh/cli v1.1.0/go.mod h1:xcISNoH86gajksDmfB23e/pu+B+GeFRMYmoHXxx3xhI=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
@@ -599,728 +187,205 @@ github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
 github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.4.3 h1:OVowDSCllw/YjdLkam3/sm7wEtOy59d8ndGgCcyj8cs=
 github.com/mitchellh/mapstructure v1.4.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/mitchellh/osext v0.0.0-20151018003038-5e2d6d41470f/go.mod h1:OkQIRizQZAeMln+1tSwduZz7+Af5oFlKirV/MSYes2A=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
-github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
-github.com/moby/sys/mount v0.3.3 h1:fX1SVkXFJ47XWDoeFW4Sq7PdQJnV2QIDZAqjNqgEjUs=
-github.com/moby/sys/mount v0.3.3/go.mod h1:PBaEorSNTLG5t/+4EgukEQVlAvVEc6ZjTySwKdqp5K0=
-github.com/moby/sys/mountinfo v0.4.0/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
-github.com/moby/sys/mountinfo v0.4.1/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
-github.com/moby/sys/mountinfo v0.5.0/go.mod h1:3bMD3Rg+zkqx8MRYPi7Pyb0Ie97QEBmdxbhnCLlSvSU=
-github.com/moby/sys/mountinfo v0.6.2 h1:BzJjoreD5BMFNmD9Rus6gdd1pLuecOFPt8wC+Vygl78=
-github.com/moby/sys/mountinfo v0.6.2/go.mod h1:IJb6JQeOklcdMU9F5xQ8ZALD+CUr5VlGpwtX+VE0rpI=
-github.com/moby/sys/symlink v0.1.0/go.mod h1:GGDODQmbFOjFsXvfLVn3+ZRxkch54RkSiGqsZeMYowQ=
-github.com/moby/term v0.0.0-20200312100748-672ec06f55cd/go.mod h1:DdlQx2hp0Ss5/fLikoLlEeIYiATotOjgB//nb973jeo=
-github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 h1:dcztxKSvZ4Id8iPpHERQBbIJfabdt4wUm5qy3wOL2Zc=
-github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6/go.mod h1:E2VnQOmVuvZB6UYnnDB0qG5Nq/1tD9acaOpo6xmt0Kw=
+github.com/moby/patternmatcher v0.5.0 h1:YCZgJOeULcxLw1Q+sVR636pmS7sPEn1Qo2iAN6M7DBo=
+github.com/moby/patternmatcher v0.5.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
+github.com/moby/sys/sequential v0.5.0 h1:OPvI35Lzn9K04PBbCLW0g4LcFAJgHsvXsRyewg5lXtc=
+github.com/moby/sys/sequential v0.5.0/go.mod h1:tH2cOOs5V9MlPiXcQzRC+eEyab644PWKGRYaaV5ZZlo=
+github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
+github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
-github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
-github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
-github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
-github.com/ncw/swift v1.0.47/go.mod h1:23YIA4yWVnGwv2dQlN4bB7egfYX6YLn0Yo/S6zZO/ZM=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
-github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
-github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
-github.com/olekukonko/tablewriter v0.0.0-20170122224234-a0225b3f23b5/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
-github.com/onsi/ginkgo v0.0.0-20151202141238-7f8ab55aaf3b/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.8.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.10.3/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.11.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.12.0/go.mod h1:oUhWkIvk5aDxtKvDDuw8gItl8pKl42LzjC9KZE0HfGg=
-github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
-github.com/onsi/gomega v0.0.0-20151007035656-2152b45fa28a/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
-github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
-github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
-github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
-github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
-github.com/onsi/gomega v1.9.0/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=
-github.com/onsi/gomega v1.10.3/go.mod h1:V9xEwhxec5O8UDM77eCW8vLymOMltsqPVYWrpDsH8xc=
-github.com/opencontainers/go-digest v0.0.0-20170106003457-a6d0ee40d420/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
-github.com/opencontainers/go-digest v0.0.0-20180430190053-c9281466c8b2/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
-github.com/opencontainers/go-digest v1.0.0-rc1/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
-github.com/opencontainers/go-digest v1.0.0-rc1.0.20180430190053-c9281466c8b2/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.0.0/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
-github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
-github.com/opencontainers/image-spec v1.0.3-0.20211202183452-c5a74bcca799 h1:rc3tiVYb5z54aKaDfakKn0dDjIyPpTtszkjuMzyt7ec=
-github.com/opencontainers/image-spec v1.0.3-0.20211202183452-c5a74bcca799/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
-github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
-github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
-github.com/opencontainers/runc v1.0.0-rc8.0.20190926000215-3e425f80a8c9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
-github.com/opencontainers/runc v1.0.0-rc9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
-github.com/opencontainers/runc v1.0.0-rc93/go.mod h1:3NOsor4w32B2tC0Zbl8Knk4Wg84SM2ImC1fxBuqJ/H0=
-github.com/opencontainers/runc v1.0.2/go.mod h1:aTaHFFwQXuA71CiyxOdFFIorAoemI04suvGRQFzWTD0=
-github.com/opencontainers/runc v1.1.4 h1:nRCz/8sKg6K6jgYAFLDlXzPeITBZJyX28DBVhWD+5dg=
-github.com/opencontainers/runc v1.1.4/go.mod h1:1J5XiS+vdZ3wCyZybsuxXZWGrgSr8fFJHLXuG2PsnNg=
-github.com/opencontainers/runtime-spec v0.1.2-0.20190507144316-5b71a03e2700/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-spec v1.0.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-spec v1.0.2-0.20190207185410-29686dbc5559/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-spec v1.0.2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-spec v1.0.3-0.20200929063507-e6143ca7d51d/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-tools v0.0.0-20181011054405-1d69bd0f9c39/go.mod h1:r3f7wjNzSs2extwzU3Y+6pKfobzPh+kKFJ3ofN+3nfs=
-github.com/opencontainers/selinux v1.6.0/go.mod h1:VVGKuOLlE7v4PJyT6h7mNWvq1rzqiriPsEqVhc+svHE=
-github.com/opencontainers/selinux v1.8.0/go.mod h1:RScLhm78qiWa2gbVCcGkC7tCGdgk3ogry1nUQF8Evvo=
-github.com/opencontainers/selinux v1.8.2/go.mod h1:MUIHuUEvKB1wtJjQdOyYRgOnLD2xAPP8dBsCoU0KuF8=
-github.com/opencontainers/selinux v1.10.0/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI=
+github.com/opencontainers/image-spec v1.1.0-rc3 h1:fzg1mXZFj8YdPeNkRXMg+zb88BFV0Ys52cJydRwBkb8=
+github.com/opencontainers/image-spec v1.1.0-rc3/go.mod h1:X4pATf0uXsnn3g5aiGIsVnJBR4mxhKzfwmvK/B2NTm8=
+github.com/opencontainers/runc v1.1.7 h1:y2EZDS8sNng4Ksf0GUYNhKbTShZJPJg1FiXJNH/uoCk=
+github.com/opencontainers/runc v1.1.7/go.mod h1:CbUumNnWCuTGFukNXahoo/RFBZvDAgRh/smNYNOhA50=
 github.com/otiai10/copy v1.10.0 h1:znyI7l134wNg/wDktoVQPxPkgvhDfGCYUasey+h0rDQ=
 github.com/otiai10/copy v1.10.0/go.mod h1:rSaLseMUsZFFbsFGc7wCJnnkTAvdc5L6VWxPE4308Ww=
 github.com/otiai10/mint v1.5.1 h1:XaPLeE+9vGbuyEHem1JNk3bYc7KKqyI/na0/mLd/Kks=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pascaldekloe/goe v0.1.0 h1:cBOtyMzM9HTpWjXfbbunk26uA6nG3a8n06Wieeh0MwY=
 github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
-github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
-github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrapLU/GW4pbc=
-github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/errors v0.8.1-0.20171018195549-f15c970de5b7/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
 github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
-github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021/go.mod h1:prYjPmNq4d1NPVmpShWobRqXY3q7Vp+80DqgxxUrUIA=
-github.com/prometheus/client_golang v0.0.0-20180209125602-c332b6f63c06/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
-github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
-github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
 github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
-github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
-github.com/prometheus/client_model v0.0.0-20171117100541-99fa1f4be8e5/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/common v0.0.0-20180110214958-89604d197083/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
-github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
-github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
-github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
 github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8bs7vj7HSQ4=
-github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
-github.com/prometheus/procfs v0.0.0-20180125133057-cb4147076ac7/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
-github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
-github.com/prometheus/procfs v0.0.0-20190522114515-bc1a522cf7b1/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
-github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
-github.com/prometheus/procfs v0.0.5/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
 github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
-github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
-github.com/prometheus/procfs v0.2.0/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
-github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
-github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
-github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
-github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/rogpeppe/go-internal v1.8.1 h1:geMPLpDpQOgVyCg5z5GoRwLHepNdb71NXb67XFkP+Eg=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/safchain/ethtool v0.0.0-20190326074333-42ed695e3de8/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
-github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
-github.com/sclevine/spec v1.2.0/go.mod h1:W4J29eT/Kzv7/b9IWLB055Z+qvVC9vt0Arko24q7p+U=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 h1:nn5Wsu0esKSJiIVhscUtVbo7ada43DJhG55ua/hjS5I=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
-github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
-github.com/seccomp/libseccomp-golang v0.9.2-0.20220502022130-f33da4d89646/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
-github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
-github.com/sirupsen/logrus v1.0.4-0.20170822132746-89742aefa4b2/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
-github.com/sirupsen/logrus v1.0.6/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
-github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
-github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
-github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
-github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
-github.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
-github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
-github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
-github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
-github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
-github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4=
-github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
-github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cobra v0.0.2-0.20171109065643-2da4a54c5cee/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
-github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
-github.com/spf13/cobra v1.0.0/go.mod h1:/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE=
-github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
-github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/pflag v1.0.1-0.20171106142849-4c012f6dcd95/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/pflag v1.0.1/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/yZzE=
-github.com/stefanberger/go-pkcs11uri v0.0.0-20201008174630-78d3cae3a980/go.mod h1:AO3tvPzVZ/ayst6UlUKUv6rcPQInYe3IknH3jYhAKu8=
-github.com/stretchr/objx v0.0.0-20180129172003-8a3f7159479f/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
+github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v0.0.0-20180303142811-b89eecf5ca5d/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
-github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
-github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
-github.com/tchap/go-patricia v2.2.6+incompatible/go.mod h1:bmLyhP68RS6kStMGxByiQ23RP/odRBOTVjwp2cDyi6I=
+github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
+github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/teris-io/shortid v0.0.0-20220617161101-71ec9f2aa569 h1:xzABM9let0HLLqFypcxvLmlvEciCHL7+Lv+4vwZqecI=
 github.com/teris-io/shortid v0.0.0-20220617161101-71ec9f2aa569/go.mod h1:2Ly+NIftZN4de9zRmENdYbvPQeaVIYKWpLFStLFEBgI=
-github.com/testcontainers/testcontainers-go v0.15.0 h1:3Ex7PUGFv0b2bBsdOv6R42+SK2qoZnWBd21LvZYhUtQ=
-github.com/testcontainers/testcontainers-go v0.15.0/go.mod h1:PkohMRH2X8Hib0IWtifVexDfLPVT+tb5E9hsf7cW12w=
-github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
-github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
+github.com/testcontainers/testcontainers-go v0.20.1 h1:mK15UPJ8c5P+NsQKmkqzs/jMdJt6JMs5vlw2y4j92c0=
+github.com/testcontainers/testcontainers-go v0.20.1/go.mod h1:zb+NOlCQBkZ7RQp4QI+YMIHyO2CQ/qsXzNF5eLJ24SY=
 github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
-github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
-github.com/urfave/cli v0.0.0-20171014202726-7bc6a0acffa5/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
-github.com/urfave/cli v1.20.0/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
-github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
-github.com/urfave/cli v1.22.2/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
-github.com/vishvananda/netlink v0.0.0-20181108222139-023a6dafdcdf/go.mod h1:+SR5DhBJrl6ZM7CoCKvpw5BKroDKQ+PJqOg65H/2ktk=
-github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
-github.com/vishvananda/netlink v1.1.1-0.20201029203352-d40f9887b852/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
-github.com/vishvananda/netns v0.0.0-20180720170159-13995c7128cc/go.mod h1:ZjcWmFBXmLKZu9Nxj3WKYEafiSqer2rnvPr0en9UNpI=
-github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
-github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
-github.com/willf/bitset v1.1.11-0.20200630133818-d5bec3311243/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
-github.com/willf/bitset v1.1.11/go.mod h1:83CECat5yLh5zVOf4P1ErAgKA5UDvKtgyUABdr3+MjI=
-github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
-github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
-github.com/xeipuuv/gojsonschema v0.0.0-20180618132009-1d523034197f/go.mod h1:5yf86TLmAcydyeJq5YvxkGPE2fm/u4myDekKRoLuqhs=
-github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
-github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
-github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43/go.mod h1:aX5oPXxHm3bOH+xeAttToC8pqch2ScQN/JoXYupl6xs=
-github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50/go.mod h1:NUSPSUX/bi6SeDMUh6brw0nXpxHnc96TguQh0+r/ssA=
-github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f/go.mod h1:GlGEuHIJweS1mbCqG+7vt2nvWLzLLnRHbXz5JKd/Qbg=
-go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
-go.etcd.io/bbolt v1.3.3/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
-go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
-go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4=
-go.etcd.io/etcd v0.5.0-alpha.5.0.20200910180754-dd1b699fc489/go.mod h1:yVHk9ub3CSBatqGNg7GRmsnfLWtoW60w4eDYfh7vHDg=
-go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk=
-go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
-go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
-go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.23.0 h1:gqCw0LfLxScz8irSi8exQc7fyQ0fKQU/qnC/X8+V/1M=
-go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
-go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v0.15.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
-go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
-go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
-go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
-go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
-golang.org/x/crypto v0.0.0-20171113213409-9f005a07e0d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20181009213950-7c1a557ab941/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
-golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
-golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
-golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
-golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
 golang.org/x/exp v0.0.0-20230321023759-10a507213a29 h1:ooxPy7fPvB4kwsA2h+iBNHkAbp/4JxTSwCmvdjEYmug=
 golang.org/x/exp v0.0.0-20230321023759-10a507213a29/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
-golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
-golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
-golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
-golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
-golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
-golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
-golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
-golang.org/x/mod v0.8.0 h1:LUYupSeNrTNCGzR/hVBk2NHZO4hXcVaW1k4Qx7rjPx8=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk=
+golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181011144130-49bb7cea24b1/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190522155817-f3200d17e092/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190619014844-b5b0513f8c1b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20201006153459-a7d1128ccaa0/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210410081132-afb366fc7cd1/go.mod h1:9tjilg8BloeKEkVJvy7fQ90B1CfIiPueXVOjqfkSzI8=
-golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210825183410-e898025ed96a/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.8.0 h1:Zrh2ngAOFYneWTAIAPethzeaQLuHwhuBkuV6ZiRnUaQ=
-golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
+golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
+golang.org/x/sync v0.2.0 h1:PUR+T4wwASmuSTYdKjYHI5TD22Wy5ogLU5qZCOLxBrI=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190514135907-3a4b5fb9f71f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190522044717-8097e1b27ff5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190602015325-4c4f7f33c9ed/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190616124812-15dcb6c0061f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190626221950-04f50cda93cb/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190801041406-cbf593c0f2f3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190812073006-9eafafc0a87e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191022100944-742c48ecaeb7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191115151921-52ab43148777/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191210023423-ac6580df4449/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200120151820-655fe14d7479/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200124204421-9fbb57f87de9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200622214017-ed371f2e16b4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200728102440-3e129f6d46b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200817155316-9781c653f443/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200916030750-2334cc1a136f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200922070232-aee5d888a860/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200923182605-d9f96fdee20d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201112073958-5cba982894dd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201117170446-d9b008d0a637/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201202213521-69691e467435/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210303074136-134d130e1a04/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210324051608-47abb6519492/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210426230700-d19ff857e887/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210816183151-1e6c022a8912/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210906170528-6f6e22806c34/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.8.0 h1:57P1ETyNKtuIjB4SRd15iJxuhj8Gc416Y78H3qgMh68=
-golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac h1:7zkz7BUtwNFFqcowJ+RIgu2MaV/MapERkDIy+mwPyjs=
-golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 h1:vVKdlvoWBphwdxWKrFZEuM0kGgGLxUOYcY4U/2Vjg44=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190424220101-1e8e1cfdf96b/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190614205625-5aca471b1d59/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190624222133-a101b041ded4/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190706070813-72ffa07ba3db/go.mod h1:jcCCGcm9btYwXyDqrUWc6MKQKKGJCWEQ3AfLSRIbEuI=
-golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190907020128-2ca718005c18/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
-golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200505023115-26f46d2f7ef8/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200616133436-c1934b75d054/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200916195026-c9a70fc28ce3/go.mod h1:z6u4i615ZeAfBE4XtMziQW1fSVJXACjjbWkB/mvPzlU=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.6.0 h1:BOw41kyTf3PuCW1pVQf8+Cyg8pMlkYB1oo9iJ6D/lKM=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
+golang.org/x/tools v0.9.1 h1:8WMNJAz3zrtPmnYC7ISf5dEn3MT0gY7jBJfw27yrrLo=
+golang.org/x/tools v0.9.1/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.0.0-20160322025152-9bf6e6e569ff/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
-google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
-google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
-google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
-google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
-google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/cloud v0.0.0-20151119220103-975617b05ea8/go.mod h1:0H1ncTHf11KCFhTc/+EFRbzSCOZx+VUbRMk55Yv5MYk=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190522204451-c2c4e71fbf69/go.mod h1:z3L6/3dTEVtUr6QSP8miRzeRqwQOioJ9I66odjN4I7s=
-google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
-google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200117163144-32f20d992d24/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
-google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20200527145253-8367513e4ece/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
-google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
-google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201110150050-8816d57aaa9a/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220329172620-7be39ac1afc7/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20230223222841-637eb2293923 h1:znp6mq/drrY+6khTAlJUDNFFcDGV2ENLYKpMq8SyCds=
-google.golang.org/genproto v0.0.0-20230223222841-637eb2293923/go.mod h1:3Dl5ZL0q0isWJt+FVcfpQyirqemEuLAK/iFvg1UP1Hw=
-google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
+google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 h1:KpwkzHKEF7B9Zxg18WzOa7djJ+Ha5DzthMyZYQfEn2A=
+google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1/go.mod h1:nKE/iIaLqn2bQwXBg8f1g2Ylh6r5MN5CmZvuzZCgsCU=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
-google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
-google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.23.1/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.24.0/go.mod h1:XDChyiUovWa60DnaeDeZmSW86xtLtjtZbwvSiRnRtcA=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
-google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
-google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
-google.golang.org/grpc v1.53.0 h1:LAv2ds7cmFV/XTS3XG1NneeENYrXGmorPxsBbptIjNc=
-google.golang.org/grpc v1.53.0/go.mod h1:OnIrk0ipVdj4N5d9IUoFUx72/VlD7+jUsHwZgwSMQpw=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
+google.golang.org/grpc v1.55.0 h1:3Oj82/tFSCeUrRTg/5E/7d/W5A1tj6Ky1ABAuZuv5ag=
+google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGONTY8=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
-google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
+google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
+google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20141024133853-64131543e789/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
-gopkg.in/gemnasium/logrus-airbrake-hook.v2 v2.1.2/go.mod h1:Xk6kEKp8OKb+X14hQBKWaSkCsqBpgog8nAV2xsGOxlo=
-gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
-gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
-gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
-gopkg.in/square/go-jose.v2 v2.2.2/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
-gopkg.in/square/go-jose.v2 v2.3.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
-gopkg.in/square/go-jose.v2 v2.5.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
-gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
-gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
-gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
-gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=
-gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
 gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
+gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
-honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-k8s.io/api v0.20.1/go.mod h1:KqwcCVogGxQY3nBlRpwt+wpAMF/KjaCc7RpywacvqUo=
-k8s.io/api v0.20.4/go.mod h1:++lNL1AJMkDymriNniQsWRkMDzRaX2Y/POTUi8yvqYQ=
-k8s.io/api v0.20.6/go.mod h1:X9e8Qag6JV/bL5G6bU8sdVRltWKmdHsFUGS3eVndqE8=
-k8s.io/apimachinery v0.20.1/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU=
-k8s.io/apimachinery v0.20.4/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU=
-k8s.io/apimachinery v0.20.6/go.mod h1:ejZXtW1Ra6V1O5H8xPBGz+T3+4gfkTCeExAHKU57MAc=
-k8s.io/apiserver v0.20.1/go.mod h1:ro5QHeQkgMS7ZGpvf4tSMx6bBOgPfE+f52KwvXfScaU=
-k8s.io/apiserver v0.20.4/go.mod h1:Mc80thBKOyy7tbvFtB4kJv1kbdD0eIH8k8vianJcbFM=
-k8s.io/apiserver v0.20.6/go.mod h1:QIJXNt6i6JB+0YQRNcS0hdRHJlMhflFmsBDeSgT1r8Q=
-k8s.io/client-go v0.20.1/go.mod h1:/zcHdt1TeWSd5HoUe6elJmHSQ6uLLgp4bIJHVEuy+/Y=
-k8s.io/client-go v0.20.4/go.mod h1:LiMv25ND1gLUdBeYxBIwKpkSC5IsozMMmOOeSJboP+k=
-k8s.io/client-go v0.20.6/go.mod h1:nNQMnOvEUEsOzRRFIIkdmYOjAZrC8bgq0ExboWSU1I0=
-k8s.io/code-generator v0.19.7/go.mod h1:lwEq3YnLYb/7uVXLorOJfxg+cUu2oihFhHZ0n9NIla0=
-k8s.io/component-base v0.20.1/go.mod h1:guxkoJnNoh8LNrbtiQOlyp2Y2XFCZQmrcg2n/DeYNLk=
-k8s.io/component-base v0.20.4/go.mod h1:t4p9EdiagbVCJKrQ1RsA5/V4rFQNDfRlevJajlGwgjI=
-k8s.io/component-base v0.20.6/go.mod h1:6f1MPBAeI+mvuts3sIdtpjljHWBQ2cIy38oBIWMYnrM=
-k8s.io/cri-api v0.17.3/go.mod h1:X1sbHmuXhwaHs9xxYffLqJogVsnI+f6cPRcgPel7ywM=
-k8s.io/cri-api v0.20.1/go.mod h1:2JRbKt+BFLTjtrILYVqQK5jqhI+XNdF6UiGMgczeBCI=
-k8s.io/cri-api v0.20.4/go.mod h1:2JRbKt+BFLTjtrILYVqQK5jqhI+XNdF6UiGMgczeBCI=
-k8s.io/cri-api v0.20.6/go.mod h1:ew44AjNXwyn1s0U4xCKGodU7J1HzBeZ1MpGrpa5r8Yc=
-k8s.io/gengo v0.0.0-20200413195148-3a45101e95ac/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
-k8s.io/gengo v0.0.0-20200428234225-8167cfdcfc14/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
-k8s.io/gengo v0.0.0-20201113003025-83324d819ded/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
-k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
-k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
-k8s.io/klog/v2 v2.4.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
-k8s.io/kube-openapi v0.0.0-20200805222855-6aeccd4b50c6/go.mod h1:UuqjUnNftUyPE5H64/qeyjQoUZhGpeFDVdxjTeEVN2o=
-k8s.io/kube-openapi v0.0.0-20201113171705-d219536bb9fd/go.mod h1:WOJ3KddDSol4tAGcJo0Tvi+dK12EcqSLqcWsryKMpfM=
-k8s.io/kubernetes v1.13.0/go.mod h1:ocZa8+6APFNC2tX1DZASIbocyYT5jHzqFVsY5aoB7Jk=
-k8s.io/utils v0.0.0-20201110183641-67b214c5f920/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
-rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
-rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.14/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.15/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
-sigs.k8s.io/structured-merge-diff/v4 v4.0.1/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
-sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
-sigs.k8s.io/structured-merge-diff/v4 v4.0.3/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
-sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
-sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
diff --git a/test/integration/consul-container/libs/cluster/app.go b/test/integration/consul-container/libs/cluster/app.go
index 25414c3f0ce7..f434fcff135b 100644
--- a/test/integration/consul-container/libs/cluster/app.go
+++ b/test/integration/consul-container/libs/cluster/app.go
@@ -62,8 +62,9 @@ func LaunchContainerOnNode(
 		ContainerRequest: req,
 		Started:          true,
 	})
+	fmt.Printf("creating container with image: %s(%s)\n", req.Name, req.Image)
 	if err != nil {
-		return nil, fmt.Errorf("creating container: %w", err)
+		return nil, fmt.Errorf("creating container: %s(%s), %w", req.Name, req.Image, err)
 	}
 	deferClean.Add(func() {
 		_ = container.Terminate(ctx)
diff --git a/test/integration/consul-container/libs/service/common.go b/test/integration/consul-container/libs/service/common.go
index 9b71f4fbd8c0..add9f1395d24 100644
--- a/test/integration/consul-container/libs/service/common.go
+++ b/test/integration/consul-container/libs/service/common.go
@@ -4,74 +4,10 @@
 package service
 
 import (
-	"archive/tar"
-	"bytes"
 	_ "embed"
-	"os"
-
-	"github.com/testcontainers/testcontainers-go"
 )
 
 const (
-	envoyEnvKey   = "ENVOY_VERSION"
-	envoyLogLevel = "debug"
-	envoyVersion  = "1.23.1"
-
+	envoyLogLevel        = "debug"
 	hashicorpDockerProxy = "docker.mirror.hashicorp.services"
 )
-
-//go:embed assets/Dockerfile-consul-envoy
-var consulEnvoyDockerfile []byte
-
-//go:embed assets/tproxy-startup.sh
-var tproxyStartupScript []byte
-
-// getDevContainerDockerfile returns the necessary context to build a combined consul and
-// envoy image for running "consul connect envoy ..."
-func getDevContainerDockerfile() (testcontainers.FromDockerfile, error) {
-	var buf bytes.Buffer
-	tw := tar.NewWriter(&buf)
-
-	hdr := &tar.Header{
-		Name: "Dockerfile",
-		Mode: 0600,
-		Size: int64(len(consulEnvoyDockerfile)),
-	}
-	if err := tw.WriteHeader(hdr); err != nil {
-		return testcontainers.FromDockerfile{}, err
-	}
-
-	if _, err := tw.Write(consulEnvoyDockerfile); err != nil {
-		return testcontainers.FromDockerfile{}, err
-	}
-
-	hdr = &tar.Header{
-		Name: "tproxy-startup.sh",
-		Mode: 0600,
-		Size: int64(len(tproxyStartupScript)),
-	}
-	if err := tw.WriteHeader(hdr); err != nil {
-		return testcontainers.FromDockerfile{}, err
-	}
-
-	if _, err := tw.Write(tproxyStartupScript); err != nil {
-		return testcontainers.FromDockerfile{}, err
-	}
-
-	if err := tw.Close(); err != nil {
-		return testcontainers.FromDockerfile{}, err
-	}
-	reader := bytes.NewReader(buf.Bytes())
-	fromDockerfile := testcontainers.FromDockerfile{
-		ContextArchive: reader,
-	}
-
-	return fromDockerfile, nil
-}
-
-func getEnvoyVersion() string {
-	if version, ok := os.LookupEnv(envoyEnvKey); ok && version != "" {
-		return version
-	}
-	return envoyVersion
-}
diff --git a/test/integration/consul-container/libs/service/connect.go b/test/integration/consul-container/libs/service/connect.go
index d172204b5df5..006ca804a988 100644
--- a/test/integration/consul-container/libs/service/connect.go
+++ b/test/integration/consul-container/libs/service/connect.go
@@ -167,29 +167,19 @@ func NewConnectService(ctx context.Context, sidecarCfg SidecarConfig, serviceBin
 	namePrefix := fmt.Sprintf("%s-service-connect-%s", node.GetDatacenter(), sidecarCfg.Name)
 	containerName := utils.RandName(namePrefix)
 
-	envoyVersion := getEnvoyVersion()
 	agentConfig := node.GetConfig()
-	buildargs := map[string]*string{
-		"ENVOY_VERSION": utils.StringToPointer(envoyVersion),
-		"CONSUL_IMAGE":  utils.StringToPointer(agentConfig.DockerImage()),
-	}
-
-	dockerfileCtx, err := getDevContainerDockerfile()
-	if err != nil {
-		return nil, err
-	}
-	dockerfileCtx.BuildArgs = buildargs
-
 	internalAdminPort, err := node.ClaimAdminPort()
 	if err != nil {
 		return nil, err
 	}
 
+	fmt.Println("agent image name", agentConfig.DockerImage())
+	imageVersion := utils.SideCarVersion(agentConfig.DockerImage())
 	req := testcontainers.ContainerRequest{
-		FromDockerfile: dockerfileCtx,
-		WaitingFor:     wait.ForLog("").WithStartupTimeout(10 * time.Second),
-		AutoRemove:     false,
-		Name:           containerName,
+		Image:      fmt.Sprintf("consul-envoy:%s", imageVersion),
+		WaitingFor: wait.ForLog("").WithStartupTimeout(100 * time.Second),
+		AutoRemove: false,
+		Name:       containerName,
 		Cmd: []string{
 			"consul", "connect", "envoy",
 			"-sidecar-for", sidecarCfg.ServiceID,
diff --git a/test/integration/consul-container/libs/service/examples.go b/test/integration/consul-container/libs/service/examples.go
index 186a2dc9db8c..85505c5dccc5 100644
--- a/test/integration/consul-container/libs/service/examples.go
+++ b/test/integration/consul-container/libs/service/examples.go
@@ -15,7 +15,6 @@ import (
 
 	"github.com/hashicorp/consul/api"
 
-	"github.com/hashicorp/consul/test/integration/consul-container/libs/cluster"
 	libcluster "github.com/hashicorp/consul/test/integration/consul-container/libs/cluster"
 	"github.com/hashicorp/consul/test/integration/consul-container/libs/utils"
 )
@@ -120,7 +119,7 @@ func (g exampleContainer) Stop() error {
 }
 
 func (c exampleContainer) Terminate() error {
-	return cluster.TerminateContainer(c.ctx, c.container, true)
+	return libcluster.TerminateContainer(c.ctx, c.container, true)
 }
 
 func (c exampleContainer) GetStatus() (string, error) {
@@ -153,14 +152,14 @@ func NewExampleService(ctx context.Context, name string, httpPort int, grpcPort
 
 	req := testcontainers.ContainerRequest{
 		Image:      hashicorpDockerProxy + "/fortio/fortio",
-		WaitingFor: wait.ForLog("").WithStartupTimeout(10 * time.Second),
+		WaitingFor: wait.ForLog("").WithStartupTimeout(60 * time.Second),
 		AutoRemove: false,
 		Name:       containerName,
 		Cmd:        command,
 		Env:        map[string]string{"FORTIO_NAME": name},
 	}
 
-	info, err := cluster.LaunchContainerOnNode(ctx, node, req, []string{httpPortStr, grpcPortStr})
+	info, err := libcluster.LaunchContainerOnNode(ctx, node, req, []string{httpPortStr, grpcPortStr})
 	if err != nil {
 		return nil, err
 	}
diff --git a/test/integration/consul-container/libs/service/gateway.go b/test/integration/consul-container/libs/service/gateway.go
index 09b74be24366..fda7b7a92693 100644
--- a/test/integration/consul-container/libs/service/gateway.go
+++ b/test/integration/consul-container/libs/service/gateway.go
@@ -16,7 +16,6 @@ import (
 
 	"github.com/hashicorp/consul/api"
 
-	"github.com/hashicorp/consul/test/integration/consul-container/libs/cluster"
 	libcluster "github.com/hashicorp/consul/test/integration/consul-container/libs/cluster"
 	"github.com/hashicorp/consul/test/integration/consul-container/libs/utils"
 )
@@ -102,7 +101,7 @@ func (g gatewayContainer) Stop() error {
 }
 
 func (c gatewayContainer) Terminate() error {
-	return cluster.TerminateContainer(c.ctx, c.container, true)
+	return libcluster.TerminateContainer(c.ctx, c.container, true)
 }
 
 func (g gatewayContainer) GetAdminAddr() (string, int) {
@@ -161,19 +160,7 @@ func NewGatewayServiceReg(ctx context.Context, gwCfg GatewayConfig, node libclus
 	namePrefix := fmt.Sprintf("%s-service-gateway-%s", node.GetDatacenter(), gwCfg.Name)
 	containerName := utils.RandName(namePrefix)
 
-	envoyVersion := getEnvoyVersion()
 	agentConfig := node.GetConfig()
-	buildargs := map[string]*string{
-		"ENVOY_VERSION": utils.StringToPointer(envoyVersion),
-		"CONSUL_IMAGE":  utils.StringToPointer(agentConfig.DockerImage()),
-	}
-
-	dockerfileCtx, err := getDevContainerDockerfile()
-	if err != nil {
-		return nil, err
-	}
-	dockerfileCtx.BuildArgs = buildargs
-
 	adminPort, err := node.ClaimAdminPort()
 	if err != nil {
 		return nil, err
@@ -194,13 +181,15 @@ func NewGatewayServiceReg(ctx context.Context, gwCfg GatewayConfig, node libclus
 		"--log-level", envoyLogLevel,
 	}
 
+	fmt.Println("agent image name", agentConfig.DockerImage())
+	imageVersion := utils.SideCarVersion(agentConfig.DockerImage())
 	req := testcontainers.ContainerRequest{
-		FromDockerfile: dockerfileCtx,
-		WaitingFor:     wait.ForLog("").WithStartupTimeout(10 * time.Second),
-		AutoRemove:     false,
-		Name:           containerName,
-		Env:            make(map[string]string),
-		Cmd:            append(cmd, envoyArgs...),
+		Image:      fmt.Sprintf("consul-envoy:%s", imageVersion),
+		WaitingFor: wait.ForLog("").WithStartupTimeout(100 * time.Second),
+		AutoRemove: false,
+		Name:       containerName,
+		Env:        make(map[string]string),
+		Cmd:        append(cmd, envoyArgs...),
 	}
 
 	nodeInfo := node.GetInfo()
@@ -240,7 +229,7 @@ func NewGatewayServiceReg(ctx context.Context, gwCfg GatewayConfig, node libclus
 		extraPorts = append(extraPorts, strconv.Itoa(port))
 	}
 
-	info, err := cluster.LaunchContainerOnNode(ctx, node, req, append(
+	info, err := libcluster.LaunchContainerOnNode(ctx, node, req, append(
 		extraPorts,
 		portStr,
 		adminPortStr,
diff --git a/test/integration/consul-container/libs/utils/version.go b/test/integration/consul-container/libs/utils/version.go
index 705b09a90ead..6a41c5b92e9a 100644
--- a/test/integration/consul-container/libs/utils/version.go
+++ b/test/integration/consul-container/libs/utils/version.go
@@ -5,6 +5,7 @@ package utils
 
 import (
 	"flag"
+	"strings"
 
 	"github.com/hashicorp/go-version"
 )
@@ -81,3 +82,17 @@ func VersionLT(a, b string) bool {
 	bv := version.Must(version.NewVersion(b))
 	return av.LessThan(bv)
 }
+
+// SideCarVersion returns version based on the agent
+// version in the test: if agent has local, the sidecar
+// version is target-version; otherwise use "latest-version"
+func SideCarVersion(agentVersion string) string {
+	imageVersion := ""
+	if strings.Contains(agentVersion, "local") {
+		imageVersion = "target-version"
+	} else {
+		imageVersion = "latest-version"
+	}
+
+	return imageVersion
+}
diff --git a/test/integration/consul-container/test/upgrade/README.md b/test/integration/consul-container/test/upgrade/README.md
index ed275f557238..479e680c1708 100644
--- a/test/integration/consul-container/test/upgrade/README.md
+++ b/test/integration/consul-container/test/upgrade/README.md
@@ -49,6 +49,7 @@ To run the upgrade test, the following tools are required:
 
 ### Running Upgrade integration tests
 - run `make dev-docker`
+- build a consul-envoy container image `cd test/integration/consul-container docker build -t consul-envoy:latest-version --build-arg CONSUL_IMAGE=docker.mirror.hashicorp.services/consul:1.15  --build-arg ENVOY_VERSION=1.24.6  -f ./assets/Dockerfile-consul-envoy ./assets`
 - run the single test `go test -v -timeout 30m -run ^TestACL_Upgrade_Node_Token$ ./.../upgrade/`
 - run all upgrade tests `go test -v -timeout 30m -run ./.../upgrade`
 
diff --git a/test/integration/consul-container/test/upgrade/basic_test.go b/test/integration/consul-container/test/upgrade/basic/basic_test.go
similarity index 100%
rename from test/integration/consul-container/test/upgrade/basic_test.go
rename to test/integration/consul-container/test/upgrade/basic/basic_test.go
diff --git a/test/integration/consul-container/test/upgrade/fullstopupgrade_test.go b/test/integration/consul-container/test/upgrade/basic/fullstopupgrade_test.go
similarity index 100%
rename from test/integration/consul-container/test/upgrade/fullstopupgrade_test.go
rename to test/integration/consul-container/test/upgrade/basic/fullstopupgrade_test.go
diff --git a/test/integration/consul-container/test/upgrade/healthcheck_test.go b/test/integration/consul-container/test/upgrade/basic/healthcheck_test.go
similarity index 100%
rename from test/integration/consul-container/test/upgrade/healthcheck_test.go
rename to test/integration/consul-container/test/upgrade/basic/healthcheck_test.go
diff --git a/test/integration/consul-container/test/upgrade/l7_traffic_management/resolver_default_subset_test.go b/test/integration/consul-container/test/upgrade/l7_traffic_management/resolver_default_subset_test.go
index d264366fb675..9a25cccfd282 100644
--- a/test/integration/consul-container/test/upgrade/l7_traffic_management/resolver_default_subset_test.go
+++ b/test/integration/consul-container/test/upgrade/l7_traffic_management/resolver_default_subset_test.go
@@ -21,7 +21,7 @@ import (
 // Test resolver directs traffic to default subset
 // - Create 2 additional static-server instances: one in V1 subset and the other in V2 subset
 // - resolver directs traffic to the default subset, which is V2.
-func TestTrafficManagement_ResolveDefaultSubset(t *testing.T) {
+func TestTrafficManagement_ResolverDefaultSubset(t *testing.T) {
 	t.Parallel()
 
 	cluster, staticServerProxy, staticClientProxy := setup(t)
@@ -113,6 +113,8 @@ func TestTrafficManagement_ResolveDefaultSubset(t *testing.T) {
 // - Create one addtional static-server with checks and V1 subset
 // - resolver directs traffic to "test" service
 func TestTrafficManagement_ResolverDefaultOnlyPassing(t *testing.T) {
+	t.Parallel()
+
 	cluster, staticServerProxy, staticClientProxy := setup(t)
 	node := cluster.Agents[0]
 
@@ -211,6 +213,8 @@ func TestTrafficManagement_ResolverDefaultOnlyPassing(t *testing.T) {
 // - Create 3 static-server-2 server instances: one in V1, one in V2, one without any version
 // - service2Resolver directs traffic to static-server-2-v2V
 func TestTrafficManagement_ResolverSubsetRedirect(t *testing.T) {
+	t.Parallel()
+
 	cluster, staticServerProxy, staticClientProxy := setup(t)
 
 	node := cluster.Agents[0]
diff --git a/test/integration/consul-container/test/upgrade/peering_control_plane_mgw_test.go b/test/integration/consul-container/test/upgrade/peering/peering_control_plane_mgw_test.go
similarity index 100%
rename from test/integration/consul-container/test/upgrade/peering_control_plane_mgw_test.go
rename to test/integration/consul-container/test/upgrade/peering/peering_control_plane_mgw_test.go
diff --git a/test/integration/consul-container/test/upgrade/peering_http_test.go b/test/integration/consul-container/test/upgrade/peering/peering_http_test.go
similarity index 100%
rename from test/integration/consul-container/test/upgrade/peering_http_test.go
rename to test/integration/consul-container/test/upgrade/peering/peering_http_test.go

From bd0eb07ed3caf5d1e327589783d0bbbbbd058f6a Mon Sep 17 00:00:00 2001
From: Kyle Havlovitz <kylehav@gmail.com>
Date: Thu, 11 May 2023 17:38:52 -0700
Subject: [PATCH 72/92] Add /v1/internal/service-virtual-ip for manually
 setting service VIPs (#17294)

---
 agent/catalog_endpoint.go              |  31 +++++++
 agent/catalog_endpoint_test.go         |  64 ++++++++++++++
 agent/consul/fsm/commands_oss.go       |   8 +-
 agent/consul/internal_endpoint.go      |  52 +++++++++++
 agent/consul/internal_endpoint_test.go | 106 +++++++++++++++++++++++
 agent/consul/state/catalog.go          |  29 +++++--
 agent/consul/state/catalog_test.go     |  34 ++++----
 agent/http_register.go                 |   1 +
 agent/structs/catalog.go               |  12 +++
 api/internal.go                        |  64 ++++++++++++++
 api/internal_test.go                   | 114 +++++++++++++++++++++++++
 11 files changed, 489 insertions(+), 26 deletions(-)
 create mode 100644 api/internal.go
 create mode 100644 api/internal_test.go

diff --git a/agent/catalog_endpoint.go b/agent/catalog_endpoint.go
index 4fbee8460ad3..ad72c4b47f35 100644
--- a/agent/catalog_endpoint.go
+++ b/agent/catalog_endpoint.go
@@ -573,3 +573,34 @@ RETRY_ONCE:
 		s.nodeMetricsLabels())
 	return out.Services, nil
 }
+
+func (s *HTTPHandlers) AssignManualServiceVIPs(resp http.ResponseWriter, req *http.Request) (interface{}, error) {
+	metrics.IncrCounterWithLabels([]string{"client", "api", "service_virtual_ips"}, 1,
+		s.nodeMetricsLabels())
+
+	var args structs.AssignServiceManualVIPsRequest
+	if err := s.parseEntMetaNoWildcard(req, &args.EnterpriseMeta); err != nil {
+		return nil, err
+	}
+
+	if err := s.rewordUnknownEnterpriseFieldError(decodeBody(req.Body, &args)); err != nil {
+		return nil, HTTPError{StatusCode: http.StatusBadRequest, Reason: fmt.Sprintf("Request decode failed: %v", err)}
+	}
+
+	// Setup the default DC if not provided
+	if args.Datacenter == "" {
+		args.Datacenter = s.agent.config.Datacenter
+	}
+	s.parseToken(req, &args.Token)
+
+	// Forward to the servers
+	var out structs.AssignServiceManualVIPsResponse
+	if err := s.agent.RPC(req.Context(), "Internal.AssignManualServiceVIPs", &args, &out); err != nil {
+		metrics.IncrCounterWithLabels([]string{"client", "rpc", "error", "service_virtual_ips"}, 1,
+			s.nodeMetricsLabels())
+		return nil, err
+	}
+	metrics.IncrCounterWithLabels([]string{"client", "api", "success", "service_virtual_ips"}, 1,
+		s.nodeMetricsLabels())
+	return out, nil
+}
diff --git a/agent/catalog_endpoint_test.go b/agent/catalog_endpoint_test.go
index b18d23a5be8a..da65097dbb58 100644
--- a/agent/catalog_endpoint_test.go
+++ b/agent/catalog_endpoint_test.go
@@ -2028,3 +2028,67 @@ func TestCatalog_GatewayServices_Ingress(t *testing.T) {
 		require.Equal(r, expect, gatewayServices)
 	})
 }
+
+func TestCatalogRegister_AssignManualServiceVIPs(t *testing.T) {
+	if testing.Short() {
+		t.Skip("too slow for testing.Short")
+	}
+
+	t.Parallel()
+	a := NewTestAgent(t, "")
+	defer a.Shutdown()
+
+	testrpc.WaitForTestAgent(t, a.RPC, "dc1")
+
+	for _, service := range []string{"api", "web"} {
+		req := structs.ConfigEntryRequest{
+			Datacenter: "dc1",
+			Entry: &structs.ServiceResolverConfigEntry{
+				Kind: structs.ServiceResolver,
+				Name: service,
+			},
+		}
+		var out bool
+		require.NoError(t, a.RPC(context.Background(), "ConfigEntry.Apply", &req, &out))
+	}
+
+	assignVIPs := func(req structs.AssignServiceManualVIPsRequest, expect structs.AssignServiceManualVIPsResponse) {
+		httpReq, _ := http.NewRequest("PUT", "/v1/internal/service-virtual-ip", jsonReader(req))
+		resp := httptest.NewRecorder()
+		obj, err := a.srv.AssignManualServiceVIPs(resp, httpReq)
+		require.NoError(t, err)
+
+		result, ok := obj.(structs.AssignServiceManualVIPsResponse)
+		require.True(t, ok)
+		require.Equal(t, expect, result)
+	}
+
+	// Assign some manual IPs to the service
+	assignVIPs(structs.AssignServiceManualVIPsRequest{
+		Service:    "api",
+		ManualVIPs: []string{"1.1.1.1", "2.2.2.2", "3.3.3.3"},
+	}, structs.AssignServiceManualVIPsResponse{
+		Found: true,
+	})
+
+	// Assign some manual IPs to the new service, reassigning one from the existing service.
+	assignVIPs(structs.AssignServiceManualVIPsRequest{
+		Service:    "web",
+		ManualVIPs: []string{"2.2.2.2", "4.4.4.4"},
+	}, structs.AssignServiceManualVIPsResponse{
+		Found: true,
+		UnassignedFrom: []structs.PeeredServiceName{
+			{
+				ServiceName: structs.ServiceName{Name: "api", EnterpriseMeta: *acl.DefaultEnterpriseMeta()},
+			},
+		},
+	})
+
+	// Assign some manual IPs a non-existent service, should be a no-op.
+	assignVIPs(structs.AssignServiceManualVIPsRequest{
+		Service:    "nope",
+		ManualVIPs: []string{"1.1.1.1", "2.2.2.2", "3.3.3.3", "4.4.4.4"},
+	}, structs.AssignServiceManualVIPsResponse{
+		Found: false,
+	})
+}
diff --git a/agent/consul/fsm/commands_oss.go b/agent/consul/fsm/commands_oss.go
index 6f0497c149ee..e9f9f66e3361 100644
--- a/agent/consul/fsm/commands_oss.go
+++ b/agent/consul/fsm/commands_oss.go
@@ -794,9 +794,13 @@ func (c *FSM) applyManualVirtualIPs(buf []byte, index uint64) interface{} {
 		panic(fmt.Errorf("failed to decode request: %v", err))
 	}
 
-	if err := c.state.AssignManualVirtualIPs(index, req.Service, req.ManualIPs); err != nil {
+	found, unassignedFrom, err := c.state.AssignManualServiceVIPs(index, req.Service, req.ManualIPs)
+	if err != nil {
 		c.logger.Warn("AssignManualVirtualIPs failed", "error", err)
 		return err
 	}
-	return nil
+	return structs.AssignServiceManualVIPsResponse{
+		Found:          found,
+		UnassignedFrom: unassignedFrom,
+	}
 }
diff --git a/agent/consul/internal_endpoint.go b/agent/consul/internal_endpoint.go
index 6a3efbc3daf0..bfe12864d6ad 100644
--- a/agent/consul/internal_endpoint.go
+++ b/agent/consul/internal_endpoint.go
@@ -5,6 +5,7 @@ package consul
 
 import (
 	"fmt"
+	"net"
 
 	"github.com/hashicorp/go-bexpr"
 	"github.com/hashicorp/go-hclog"
@@ -17,6 +18,8 @@ import (
 	"github.com/hashicorp/consul/agent/structs"
 )
 
+const MaximumManualVIPsPerService = 8
+
 // Internal endpoint is used to query the miscellaneous info that
 // does not necessarily fit into the other systems. It is also
 // used to hold undocumented APIs that users should not rely on.
@@ -741,6 +744,55 @@ func (m *Internal) PeeredUpstreams(args *structs.PartitionSpecificRequest, reply
 		})
 }
 
+// AssignManualServiceVIPs allows for assigning virtual IPs to a service manually, so that they can
+// be returned along with discovery chain information for use by transparent proxies.
+func (m *Internal) AssignManualServiceVIPs(args *structs.AssignServiceManualVIPsRequest, reply *structs.AssignServiceManualVIPsResponse) error {
+	if done, err := m.srv.ForwardRPC("Internal.AssignManualServiceVIPs", args, reply); done {
+		return err
+	}
+
+	var authzCtx acl.AuthorizerContext
+	authz, err := m.srv.ResolveTokenAndDefaultMeta(args.Token, &args.EnterpriseMeta, &authzCtx)
+	if err != nil {
+		return err
+	}
+	if err := authz.ToAllowAuthorizer().MeshWriteAllowed(&authzCtx); err != nil {
+		return err
+	}
+
+	if err := m.srv.validateEnterpriseRequest(&args.EnterpriseMeta, true); err != nil {
+		return err
+	}
+
+	if len(args.ManualVIPs) > MaximumManualVIPsPerService {
+		return fmt.Errorf("cannot associate more than %d manual virtual IPs with the same service", MaximumManualVIPsPerService)
+	}
+
+	for _, ip := range args.ManualVIPs {
+		parsedIP := net.ParseIP(ip)
+		if parsedIP == nil || parsedIP.To4() == nil {
+			return fmt.Errorf("%q is not a valid IPv4 address", parsedIP.String())
+		}
+	}
+
+	req := state.ServiceVirtualIP{
+		Service: structs.PeeredServiceName{
+			ServiceName: structs.NewServiceName(args.Service, &args.EnterpriseMeta),
+		},
+		ManualIPs: args.ManualVIPs,
+	}
+	resp, err := m.srv.raftApplyMsgpack(structs.UpdateVirtualIPRequestType, req)
+	if err != nil {
+		return err
+	}
+	typedResp, ok := resp.(structs.AssignServiceManualVIPsResponse)
+	if !ok {
+		return fmt.Errorf("unexpected type %T for AssignManualServiceVIPs", resp)
+	}
+	*reply = typedResp
+	return nil
+}
+
 // EventFire is a bit of an odd endpoint, but it allows for a cross-DC RPC
 // call to fire an event. The primary use case is to enable user events being
 // triggered in a remote DC.
diff --git a/agent/consul/internal_endpoint_test.go b/agent/consul/internal_endpoint_test.go
index eafddb612f74..d7da66244336 100644
--- a/agent/consul/internal_endpoint_test.go
+++ b/agent/consul/internal_endpoint_test.go
@@ -3621,3 +3621,109 @@ func testUUID() string {
 		buf[8:10],
 		buf[10:16])
 }
+
+func TestInternal_AssignManualServiceVIPs(t *testing.T) {
+	if testing.Short() {
+		t.Skip("too slow for testing.Short")
+	}
+	t.Parallel()
+
+	dir1, s1 := testServer(t)
+	defer os.RemoveAll(dir1)
+	defer s1.Shutdown()
+	codec := rpcClient(t, s1)
+	defer codec.Close()
+
+	testrpc.WaitForLeader(t, s1.RPC, "dc1")
+
+	// Set up web service with no manual IPs, and an existing service with manual IPs set.
+	registerReq := structs.RegisterRequest{
+		Datacenter: "dc1",
+		Node:       "foo",
+		Address:    "127.0.0.1",
+		Service: &structs.NodeService{
+			ID:      "web",
+			Service: "web",
+			Port:    8888,
+			Connect: structs.ServiceConnect{Native: true},
+		},
+	}
+	var out struct{}
+	require.NoError(t, msgpackrpc.CallWithCodec(codec, "Catalog.Register", &registerReq, &out))
+
+	registerReq2 := structs.RegisterRequest{
+		Datacenter: "dc1",
+		Node:       "foo",
+		Address:    "127.0.0.1",
+		Service: &structs.NodeService{
+			ID:      "existing",
+			Service: "existing",
+			Port:    9999,
+			Connect: structs.ServiceConnect{Native: true},
+		},
+	}
+	require.NoError(t, msgpackrpc.CallWithCodec(codec, "Catalog.Register", &registerReq2, &out))
+
+	req := structs.AssignServiceManualVIPsRequest{
+		Service:    "existing",
+		ManualVIPs: []string{"8.8.8.8", "9.9.9.9"},
+	}
+	var resp structs.AssignServiceManualVIPsResponse
+	require.NoError(t, msgpackrpc.CallWithCodec(codec, "Internal.AssignManualServiceVIPs", req, &resp))
+
+	type testcase struct {
+		name      string
+		req       structs.AssignServiceManualVIPsRequest
+		expect    structs.AssignServiceManualVIPsResponse
+		expectErr string
+	}
+	run := func(t *testing.T, tc testcase) {
+		var resp structs.AssignServiceManualVIPsResponse
+		err := msgpackrpc.CallWithCodec(codec, "Internal.AssignManualServiceVIPs", tc.req, &resp)
+		if tc.expectErr != "" {
+			require.Error(t, err)
+			require.Contains(t, err.Error(), tc.expectErr)
+			return
+		}
+		require.Equal(t, tc.expect, resp)
+	}
+	tcs := []testcase{
+		{
+			name: "successful manual ip assignment",
+			req: structs.AssignServiceManualVIPsRequest{
+				Service:    "web",
+				ManualVIPs: []string{"1.1.1.1", "2.2.2.2"},
+			},
+			expect: structs.AssignServiceManualVIPsResponse{Found: true},
+		},
+		{
+			name: "reassign existing ip",
+			req: structs.AssignServiceManualVIPsRequest{
+				Service:    "web",
+				ManualVIPs: []string{"8.8.8.8"},
+			},
+			expect: structs.AssignServiceManualVIPsResponse{
+				Found: true,
+				UnassignedFrom: []structs.PeeredServiceName{
+					{
+						ServiceName: structs.ServiceNameFromString("existing"),
+					},
+				},
+			},
+		},
+		{
+			name: "invalid ip",
+			req: structs.AssignServiceManualVIPsRequest{
+				Service:    "web",
+				ManualVIPs: []string{"3.3.3.3", "invalid"},
+			},
+			expect:    structs.AssignServiceManualVIPsResponse{},
+			expectErr: "not a valid",
+		},
+	}
+	for _, tc := range tcs {
+		t.Run(tc.name, func(t *testing.T) {
+			run(t, tc)
+		})
+	}
+}
diff --git a/agent/consul/state/catalog.go b/agent/consul/state/catalog.go
index 65bf8d70624b..5f91ce69b097 100644
--- a/agent/consul/state/catalog.go
+++ b/agent/consul/state/catalog.go
@@ -18,6 +18,7 @@ import (
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/api"
 	"github.com/hashicorp/consul/lib"
+	"github.com/hashicorp/consul/lib/maps"
 	"github.com/hashicorp/consul/types"
 )
 
@@ -1090,7 +1091,14 @@ func assignServiceVirtualIP(tx WriteTxn, idx uint64, psn structs.PeeredServiceNa
 	return result.String(), nil
 }
 
-func (s *Store) AssignManualVirtualIPs(idx uint64, psn structs.PeeredServiceName, ips []string) error {
+// AssignManualServiceVIPs attempts to associate a list of manual virtual IP addresses with a given service name.
+// Any IP addresses given will be removed from other services in the same partition. This is done to ensure
+// that a manual VIP can only exist once for a given partition.
+// This function returns:
+// - a bool indicating whether the given service exists.
+// - a list of service names that had ip addresses removed from them.
+// - an error indicating success or failure of the call.
+func (s *Store) AssignManualServiceVIPs(idx uint64, psn structs.PeeredServiceName, ips []string) (bool, []structs.PeeredServiceName, error) {
 	tx := s.db.WriteTxn(idx)
 	defer tx.Abort()
 
@@ -1099,10 +1107,11 @@ func (s *Store) AssignManualVirtualIPs(idx uint64, psn structs.PeeredServiceName
 	for _, ip := range ips {
 		assignedIPs[ip] = struct{}{}
 	}
+	modifiedEntries := make(map[structs.PeeredServiceName]struct{})
 	for ip := range assignedIPs {
 		entry, err := tx.First(tableServiceVirtualIPs, indexManualVIPs, psn.ServiceName.PartitionOrDefault(), ip)
 		if err != nil {
-			return fmt.Errorf("failed service virtual IP lookup: %s", err)
+			return false, nil, fmt.Errorf("failed service virtual IP lookup: %s", err)
 		}
 
 		if entry == nil {
@@ -1126,17 +1135,18 @@ func (s *Store) AssignManualVirtualIPs(idx uint64, psn structs.PeeredServiceName
 		newEntry.ManualIPs = filteredIPs
 		newEntry.ModifyIndex = idx
 		if err := tx.Insert(tableServiceVirtualIPs, newEntry); err != nil {
-			return fmt.Errorf("failed inserting service virtual IP entry: %s", err)
+			return false, nil, fmt.Errorf("failed inserting service virtual IP entry: %s", err)
 		}
+		modifiedEntries[newEntry.Service] = struct{}{}
 	}
 
 	entry, err := tx.First(tableServiceVirtualIPs, indexID, psn)
 	if err != nil {
-		return fmt.Errorf("failed service virtual IP lookup: %s", err)
+		return false, nil, fmt.Errorf("failed service virtual IP lookup: %s", err)
 	}
 
 	if entry == nil {
-		return nil
+		return false, nil, nil
 	}
 
 	newEntry := entry.(ServiceVirtualIP)
@@ -1144,13 +1154,16 @@ func (s *Store) AssignManualVirtualIPs(idx uint64, psn structs.PeeredServiceName
 	newEntry.ModifyIndex = idx
 
 	if err := tx.Insert(tableServiceVirtualIPs, newEntry); err != nil {
-		return fmt.Errorf("failed inserting service virtual IP entry: %s", err)
+		return false, nil, fmt.Errorf("failed inserting service virtual IP entry: %s", err)
 	}
 	if err := updateVirtualIPMaxIndexes(tx, idx, psn.ServiceName.PartitionOrDefault(), psn.Peer); err != nil {
-		return err
+		return false, nil, err
+	}
+	if err = tx.Commit(); err != nil {
+		return false, nil, err
 	}
 
-	return tx.Commit()
+	return true, maps.SliceOfKeys(modifiedEntries), nil
 }
 
 func updateVirtualIPMaxIndexes(txn WriteTxn, idx uint64, partition, peerName string) error {
diff --git a/agent/consul/state/catalog_test.go b/agent/consul/state/catalog_test.go
index 27d11f21c019..0de535c3b4b3 100644
--- a/agent/consul/state/catalog_test.go
+++ b/agent/consul/state/catalog_test.go
@@ -1964,8 +1964,11 @@ func TestStateStore_AssignManualVirtualIPs(t *testing.T) {
 	setVirtualIPFlags(t, s)
 
 	// Attempt to assign manual virtual IPs to a service that doesn't exist - should be a no-op.
-	psn := structs.PeeredServiceName{ServiceName: structs.ServiceName{Name: "foo"}}
-	require.NoError(t, s.AssignManualVirtualIPs(0, psn, []string{"7.7.7.7", "8.8.8.8"}))
+	psn := structs.PeeredServiceName{ServiceName: structs.ServiceName{Name: "foo", EnterpriseMeta: *acl.DefaultEnterpriseMeta()}}
+	found, svcs, err := s.AssignManualServiceVIPs(0, psn, []string{"7.7.7.7", "8.8.8.8"})
+	require.NoError(t, err)
+	require.False(t, found)
+	require.Empty(t, svcs)
 	serviceVIP, err := s.ServiceManualVIPs(psn)
 	require.NoError(t, err)
 	require.Nil(t, serviceVIP)
@@ -1997,24 +2000,20 @@ func TestStateStore_AssignManualVirtualIPs(t *testing.T) {
 	require.Empty(t, serviceVIP.ManualIPs)
 
 	// Attempt to assign manual virtual IPs again.
-	require.NoError(t, s.AssignManualVirtualIPs(2, psn, []string{"7.7.7.7", "8.8.8.8"}))
+	found, svcs, err = s.AssignManualServiceVIPs(2, psn, []string{"7.7.7.7", "8.8.8.8"})
+	require.NoError(t, err)
+	require.True(t, found)
+	require.Empty(t, svcs)
 	serviceVIP, err = s.ServiceManualVIPs(psn)
 	require.NoError(t, err)
 	require.Equal(t, "0.0.0.1", serviceVIP.IP.String())
 	require.Equal(t, serviceVIP.ManualIPs, []string{"7.7.7.7", "8.8.8.8"})
 
-	// Register another service
-	ns2 := &structs.NodeService{
-		ID:             "bar",
-		Service:        "bar",
-		Address:        "2.2.2.2",
-		Port:           2222,
-		Connect:        structs.ServiceConnect{Native: true},
-		EnterpriseMeta: *entMeta,
-	}
-
-	// Service successfully registers into the state store.
-	require.NoError(t, s.EnsureService(3, "node1", ns2))
+	// Register another service via config entry.
+	s.EnsureConfigEntry(3, &structs.ServiceResolverConfigEntry{
+		Kind: structs.ServiceResolver,
+		Name: "bar",
+	})
 
 	psn2 := structs.PeeredServiceName{ServiceName: structs.ServiceName{Name: "bar"}}
 	vip, err = s.VirtualIPForService(psn2)
@@ -2023,7 +2022,10 @@ func TestStateStore_AssignManualVirtualIPs(t *testing.T) {
 
 	// Attempt to assign manual virtual IPs for bar, with one IP overlapping with foo.
 	// This should cause the ip to be removed from foo's list of manual IPs.
-	require.NoError(t, s.AssignManualVirtualIPs(4, psn2, []string{"7.7.7.7", "9.9.9.9"}))
+	found, svcs, err = s.AssignManualServiceVIPs(4, psn2, []string{"7.7.7.7", "9.9.9.9"})
+	require.NoError(t, err)
+	require.True(t, found)
+	require.ElementsMatch(t, svcs, []structs.PeeredServiceName{psn})
 
 	serviceVIP, err = s.ServiceManualVIPs(psn)
 	require.NoError(t, err)
diff --git a/agent/http_register.go b/agent/http_register.go
index df3998472d47..595a83ef5205 100644
--- a/agent/http_register.go
+++ b/agent/http_register.go
@@ -100,6 +100,7 @@ func init() {
 	registerEndpoint("/v1/internal/ui/gateway-intentions/", []string{"GET"}, (*HTTPHandlers).UIGatewayIntentions)
 	registerEndpoint("/v1/internal/ui/service-topology/", []string{"GET"}, (*HTTPHandlers).UIServiceTopology)
 	registerEndpoint("/v1/internal/acl/authorize", []string{"POST"}, (*HTTPHandlers).ACLAuthorize)
+	registerEndpoint("/v1/internal/service-virtual-ip", []string{"PUT"}, (*HTTPHandlers).AssignManualServiceVIPs)
 	registerEndpoint("/v1/kv/", []string{"GET", "PUT", "DELETE"}, (*HTTPHandlers).KVSEndpoint)
 	registerEndpoint("/v1/operator/raft/configuration", []string{"GET"}, (*HTTPHandlers).OperatorRaftConfiguration)
 	registerEndpoint("/v1/operator/raft/transfer-leader", []string{"POST"}, (*HTTPHandlers).OperatorRaftTransferLeader)
diff --git a/agent/structs/catalog.go b/agent/structs/catalog.go
index eb000d3a9713..f11af9f87801 100644
--- a/agent/structs/catalog.go
+++ b/agent/structs/catalog.go
@@ -59,3 +59,15 @@ func (h *HealthSummary) Add(status string) {
 		h.Critical++
 	}
 }
+
+type AssignServiceManualVIPsRequest struct {
+	Service    string
+	ManualVIPs []string
+
+	DCSpecificRequest
+}
+
+type AssignServiceManualVIPsResponse struct {
+	Found          bool
+	UnassignedFrom []PeeredServiceName
+}
diff --git a/api/internal.go b/api/internal.go
new file mode 100644
index 000000000000..dee161a65eb2
--- /dev/null
+++ b/api/internal.go
@@ -0,0 +1,64 @@
+package api
+
+import "context"
+
+// Internal can be used to query endpoints that are intended for
+// Hashicorp internal-use only.
+type Internal struct {
+	c *Client
+}
+
+// Internal returns a handle to endpoints that are for internal
+// Hashicorp usage only. There is not guarantee that these will
+// be backwards-compatible or supported, so usage of these is
+// not encouraged.
+func (c *Client) Internal() *Internal {
+	return &Internal{c}
+}
+
+type AssignServiceManualVIPsRequest struct {
+	Service    string
+	ManualVIPs []string
+}
+
+type AssignServiceManualVIPsResponse struct {
+	ServiceFound   bool `json:"Found"`
+	UnassignedFrom []PeeredServiceName
+}
+
+type PeeredServiceName struct {
+	ServiceName CompoundServiceName
+	Peer        string
+}
+
+func (i *Internal) AssignServiceVirtualIP(
+	ctx context.Context,
+	service string,
+	manualVIPs []string,
+	wo *WriteOptions,
+) (*AssignServiceManualVIPsResponse, *QueryMeta, error) {
+	req := i.c.newRequest("PUT", "/v1/internal/service-virtual-ip")
+	req.setWriteOptions(wo)
+	req.ctx = ctx
+	req.obj = AssignServiceManualVIPsRequest{
+		Service:    service,
+		ManualVIPs: manualVIPs,
+	}
+	rtt, resp, err := i.c.doRequest(req)
+	if err != nil {
+		return nil, nil, err
+	}
+	defer closeResponseBody(resp)
+	if err := requireOK(resp); err != nil {
+		return nil, nil, err
+	}
+
+	qm := &QueryMeta{RequestTime: rtt}
+	parseQueryMeta(resp, qm)
+
+	var out AssignServiceManualVIPsResponse
+	if err := decodeBody(resp, &out); err != nil {
+		return nil, nil, err
+	}
+	return &out, qm, nil
+}
diff --git a/api/internal_test.go b/api/internal_test.go
new file mode 100644
index 000000000000..ce088f1787d1
--- /dev/null
+++ b/api/internal_test.go
@@ -0,0 +1,114 @@
+package api
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestAPI_Internal_AssignServiceVirtualIP(t *testing.T) {
+	t.Parallel()
+	doTest_Internal_AssignServiceVirtualIP(t, &WriteOptions{
+		Namespace: defaultNamespace,
+		Partition: defaultPartition,
+	})
+}
+
+func doTest_Internal_AssignServiceVirtualIP(t *testing.T, writeOpts *WriteOptions) {
+	c, s := makeClient(t)
+	defer s.Stop()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
+	defer cancel()
+
+	if writeOpts.Partition != "" {
+		_, _, err := c.Partitions().Create(ctx, &Partition{Name: writeOpts.Partition}, nil)
+		require.NoError(t, err)
+	}
+	if writeOpts.Namespace != "" {
+		_, _, err := c.Namespaces().Create(&Namespace{Name: writeOpts.Namespace, Partition: writeOpts.Partition}, nil)
+		require.NoError(t, err)
+	}
+
+	// Create resolvers that we can attach VIPs to.
+	for _, name := range []string{"one", "two", "three"} {
+		ok, _, err := c.ConfigEntries().Set(&ServiceResolverConfigEntry{
+			Kind:      ServiceResolver,
+			Name:      name,
+			Namespace: writeOpts.Namespace,
+			Partition: writeOpts.Partition,
+		}, writeOpts)
+		require.NoError(t, err)
+		require.True(t, ok)
+	}
+
+	tests := []struct {
+		tName                string
+		svcName              string
+		vips                 []string
+		expectFound          bool
+		expectUnassignedFrom []PeeredServiceName
+	}{
+		{
+			tName:                "missing service is no-op",
+			svcName:              "missing",
+			vips:                 []string{"1.1.1.1", "2.2.2.2"},
+			expectFound:          false,
+			expectUnassignedFrom: nil,
+		},
+		{
+			tName:                "set vips for one",
+			svcName:              "one",
+			vips:                 []string{"1.1.1.1", "2.2.2.2", "3.3.3.3"},
+			expectFound:          true,
+			expectUnassignedFrom: nil,
+		},
+		{
+			tName:       "move vip to two",
+			svcName:     "two",
+			vips:        []string{"2.2.2.2"},
+			expectFound: true,
+			expectUnassignedFrom: []PeeredServiceName{
+				{ServiceName: CompoundServiceName{Name: "one", Namespace: writeOpts.Namespace, Partition: writeOpts.Partition}},
+			},
+		},
+		{
+			tName:       "move vip to three",
+			svcName:     "three",
+			vips:        []string{"3.3.3.3"},
+			expectFound: true,
+			expectUnassignedFrom: []PeeredServiceName{
+				{ServiceName: CompoundServiceName{Name: "one", Namespace: writeOpts.Namespace, Partition: writeOpts.Partition}},
+			},
+		},
+		{
+			tName:                "no-op try move vips to missing",
+			svcName:              "missing",
+			vips:                 []string{"1.1.1.1", "2.2.2.2", "3.3.3.3"},
+			expectFound:          false,
+			expectUnassignedFrom: nil,
+		},
+		{
+			tName:       "move all vips back to one",
+			svcName:     "one",
+			vips:        []string{"1.1.1.1", "2.2.2.2", "3.3.3.3", "4.4.4.4"},
+			expectFound: true,
+			expectUnassignedFrom: []PeeredServiceName{
+				{ServiceName: CompoundServiceName{Name: "two", Namespace: writeOpts.Namespace, Partition: writeOpts.Partition}},
+				{ServiceName: CompoundServiceName{Name: "three", Namespace: writeOpts.Namespace, Partition: writeOpts.Partition}},
+			},
+		},
+	}
+
+	internal := c.Internal()
+	for _, tc := range tests {
+		t.Run(tc.tName, func(t *testing.T) {
+			resp, _, err := internal.AssignServiceVirtualIP(ctx, tc.svcName, tc.vips, writeOpts)
+			require.NoError(t, err)
+			require.Equal(t, tc.expectFound, resp.ServiceFound)
+			require.ElementsMatch(t, tc.expectUnassignedFrom, resp.UnassignedFrom)
+		})
+	}
+}

From 81d83325240efae0cefab4e5db7f9ab2f07ca0b0 Mon Sep 17 00:00:00 2001
From: Kyle Havlovitz <kylehav@gmail.com>
Date: Thu, 11 May 2023 19:28:16 -0700
Subject: [PATCH 73/92] Attach service virtual IP info to compiled discovery
 chain (#17295)

* Add v1/internal/service-virtual-ip for manually setting service VIPs

* Attach service virtual IP info to compiled discovery chain

* Separate auto-assigned and manual VIPs in response
---
 agent/consul/discovery_chain_endpoint_test.go |  2 +
 agent/consul/discoverychain/compile.go        | 14 +++++
 agent/consul/state/catalog.go                 | 10 ++--
 agent/consul/state/catalog_schema.go          |  8 +++
 agent/consul/state/config_entry.go            | 16 ++++++
 agent/consul/state/config_entry_test.go       | 51 +++++++++++++++++++
 agent/discovery_chain_endpoint_test.go        |  4 ++
 agent/structs/discovery_chain.go              |  4 ++
 agent/structs/structs.deepcopy.go             |  8 +++
 9 files changed, 112 insertions(+), 5 deletions(-)

diff --git a/agent/consul/discovery_chain_endpoint_test.go b/agent/consul/discovery_chain_endpoint_test.go
index 8379f86b71dc..b0197f00d493 100644
--- a/agent/consul/discovery_chain_endpoint_test.go
+++ b/agent/consul/discovery_chain_endpoint_test.go
@@ -261,6 +261,8 @@ func TestDiscoveryChainEndpoint_Get(t *testing.T) {
 						33*time.Second,
 					),
 				},
+				AutoVirtualIPs:   []string{"240.0.0.1"},
+				ManualVirtualIPs: []string{},
 			},
 		}
 		require.Equal(t, expect, resp)
diff --git a/agent/consul/discoverychain/compile.go b/agent/consul/discoverychain/compile.go
index 3be5a4aaa490..634ab4a6ff76 100644
--- a/agent/consul/discoverychain/compile.go
+++ b/agent/consul/discoverychain/compile.go
@@ -44,6 +44,11 @@ type CompileRequest struct {
 	OverrideConnectTimeout time.Duration
 
 	Entries *configentry.DiscoveryChainSet
+
+	// AutoVirtualIPs and ManualVirtualIPs are lists of IPs associated with
+	// the service.
+	AutoVirtualIPs   []string
+	ManualVirtualIPs []string
 }
 
 // Compile assembles a discovery chain in the form of a graph of nodes using
@@ -98,6 +103,8 @@ func Compile(req CompileRequest) (*structs.CompiledDiscoveryChain, error) {
 		overrideProtocol:       req.OverrideProtocol,
 		overrideConnectTimeout: req.OverrideConnectTimeout,
 		entries:                entries,
+		autoVirtualIPs:         req.AutoVirtualIPs,
+		manualVirtualIPs:       req.ManualVirtualIPs,
 
 		resolvers:     make(map[structs.ServiceID]*structs.ServiceResolverConfigEntry),
 		splitterNodes: make(map[string]*structs.DiscoveryGraphNode),
@@ -139,6 +146,11 @@ type compiler struct {
 	// This is an INPUT field.
 	entries *configentry.DiscoveryChainSet
 
+	// autoVirtualIPs and manualVirtualIPs are lists of IPs associated with
+	// the service.
+	autoVirtualIPs   []string
+	manualVirtualIPs []string
+
 	// resolvers is initially seeded by copying the provided entries.Resolvers
 	// map and default resolvers are added as they are needed.
 	resolvers map[structs.ServiceID]*structs.ServiceResolverConfigEntry
@@ -352,6 +364,8 @@ func (c *compiler) compile() (*structs.CompiledDiscoveryChain, error) {
 		StartNode:         c.startNode,
 		Nodes:             c.nodes,
 		Targets:           c.loadedTargets,
+		AutoVirtualIPs:    c.autoVirtualIPs,
+		ManualVirtualIPs:  c.manualVirtualIPs,
 	}, nil
 }
 
diff --git a/agent/consul/state/catalog.go b/agent/consul/state/catalog.go
index 5f91ce69b097..e35ed5452405 100644
--- a/agent/consul/state/catalog.go
+++ b/agent/consul/state/catalog.go
@@ -3045,11 +3045,7 @@ func (s *Store) VirtualIPForService(psn structs.PeeredServiceName) (string, erro
 		return "", nil
 	}
 
-	result, err := addIPOffset(startingVirtualIP, vip.(ServiceVirtualIP).IP)
-	if err != nil {
-		return "", err
-	}
-	return result.String(), nil
+	return vip.(ServiceVirtualIP).IPWithOffset()
 }
 
 func (s *Store) ServiceVirtualIPs() (uint64, []ServiceVirtualIP, error) {
@@ -3080,6 +3076,10 @@ func (s *Store) ServiceManualVIPs(psn structs.PeeredServiceName) (*ServiceVirtua
 	tx := s.db.Txn(false)
 	defer tx.Abort()
 
+	return serviceVIPsTxn(tx, psn)
+}
+
+func serviceVIPsTxn(tx ReadTxn, psn structs.PeeredServiceName) (*ServiceVirtualIP, error) {
 	vip, err := tx.First(tableServiceVirtualIPs, indexID, psn)
 	if err != nil {
 		return nil, fmt.Errorf("failed service virtual IP lookup: %s", err)
diff --git a/agent/consul/state/catalog_schema.go b/agent/consul/state/catalog_schema.go
index c4f7bb8b0315..8702cc2e0cf5 100644
--- a/agent/consul/state/catalog_schema.go
+++ b/agent/consul/state/catalog_schema.go
@@ -616,6 +616,14 @@ type ServiceVirtualIP struct {
 	structs.RaftIndex
 }
 
+func (s ServiceVirtualIP) IPWithOffset() (string, error) {
+	result, err := addIPOffset(startingVirtualIP, s.IP)
+	if err != nil {
+		return "", err
+	}
+	return result.String(), nil
+}
+
 // FreeVirtualIP is used to store a virtual IP freed up by a service deregistration.
 // It is also used to store free virtual IPs when a snapshot is created.
 type FreeVirtualIP struct {
diff --git a/agent/consul/state/config_entry.go b/agent/consul/state/config_entry.go
index 91792c725b2b..dfa8fcd2c6d1 100644
--- a/agent/consul/state/config_entry.go
+++ b/agent/consul/state/config_entry.go
@@ -1371,6 +1371,22 @@ func serviceDiscoveryChainTxn(
 	}
 	req.EvaluateInTrustDomain = signingID.Host()
 
+	psn := structs.PeeredServiceName{ServiceName: structs.NewServiceName(serviceName, entMeta)}
+	serviceVIPEntry, err := serviceVIPsTxn(tx, psn)
+	if err != nil {
+		return 0, nil, nil, err
+	}
+
+	if serviceVIPEntry != nil {
+		assignedIP, err := serviceVIPEntry.IPWithOffset()
+		if err != nil {
+			return 0, nil, nil, err
+		}
+		req.AutoVirtualIPs = []string{assignedIP}
+		req.ManualVirtualIPs = make([]string, len(serviceVIPEntry.ManualIPs))
+		copy(req.ManualVirtualIPs, serviceVIPEntry.ManualIPs)
+	}
+
 	// Then we compile it into something useful.
 	chain, err := discoverychain.Compile(req)
 	if err != nil {
diff --git a/agent/consul/state/config_entry_test.go b/agent/consul/state/config_entry_test.go
index 159d49c7ad55..c4874e294fab 100644
--- a/agent/consul/state/config_entry_test.go
+++ b/agent/consul/state/config_entry_test.go
@@ -9,9 +9,12 @@ import (
 	"time"
 
 	memdb "github.com/hashicorp/go-memdb"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/agent/configentry"
+	"github.com/hashicorp/consul/agent/consul/discoverychain"
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/proto/private/pbpeering"
 	"github.com/hashicorp/consul/proto/private/prototest"
@@ -3389,3 +3392,51 @@ func writeConfigAndBumpIndexForTest(s *Store, idx uint64, entry structs.ConfigEn
 	}
 	return idx, err
 }
+
+func TestStateStore_DiscoveryChain_AttachVirtualIPs(t *testing.T) {
+	s := testStateStore(t)
+	setVirtualIPFlags(t, s)
+
+	ca := &structs.CAConfiguration{
+		Provider: "consul",
+	}
+	err := s.CASetConfig(0, ca)
+	require.NoError(t, err)
+
+	// Attempt to assign manual virtual IPs to a service that doesn't exist - should be a no-op.
+	psn := structs.PeeredServiceName{ServiceName: structs.ServiceName{Name: "foo", EnterpriseMeta: *acl.DefaultEnterpriseMeta()}}
+
+	// Register a service via config entry.
+	s.EnsureConfigEntry(1, &structs.ServiceResolverConfigEntry{
+		Kind: structs.ServiceResolver,
+		Name: "foo",
+	})
+
+	vip, err := s.VirtualIPForService(psn)
+	require.NoError(t, err)
+	assert.Equal(t, "240.0.0.1", vip)
+
+	// Assign manual virtual IPs for foo
+	found, _, err := s.AssignManualServiceVIPs(2, psn, []string{"2.2.2.2", "3.3.3.3"})
+	require.NoError(t, err)
+	require.True(t, found)
+
+	serviceVIP, err := s.ServiceManualVIPs(psn)
+	require.NoError(t, err)
+	require.Equal(t, uint64(2), serviceVIP.ModifyIndex)
+	require.Equal(t, "0.0.0.1", serviceVIP.IP.String())
+	require.Equal(t, []string{"2.2.2.2", "3.3.3.3"}, serviceVIP.ManualIPs)
+
+	req := discoverychain.CompileRequest{
+		ServiceName:          "foo",
+		EvaluateInNamespace:  psn.ServiceName.NamespaceOrDefault(),
+		EvaluateInPartition:  psn.ServiceName.PartitionOrDefault(),
+		EvaluateInDatacenter: "dc1",
+	}
+	idx, chain, _, err := s.ServiceDiscoveryChain(nil, "foo", structs.DefaultEnterpriseMetaInDefaultPartition(), req)
+	require.NoError(t, err)
+	require.Equal(t, uint64(1), idx)
+	require.Equal(t, []string{"240.0.0.1"}, chain.AutoVirtualIPs)
+	require.Equal(t, []string{"2.2.2.2", "3.3.3.3"}, chain.ManualVirtualIPs)
+
+}
diff --git a/agent/discovery_chain_endpoint_test.go b/agent/discovery_chain_endpoint_test.go
index 38e871dd8675..ed42ca0aede8 100644
--- a/agent/discovery_chain_endpoint_test.go
+++ b/agent/discovery_chain_endpoint_test.go
@@ -285,6 +285,8 @@ func TestDiscoveryChainRead(t *testing.T) {
 						33*time.Second,
 					),
 				},
+				AutoVirtualIPs:   []string{"240.0.0.1"},
+				ManualVirtualIPs: []string{},
 			}
 			if !reflect.DeepEqual(expect, value.Chain) {
 				r.Fatalf("should be equal: expected=%+v, got=%+v", expect, value.Chain)
@@ -333,6 +335,8 @@ func TestDiscoveryChainRead(t *testing.T) {
 			expectTarget_DC1.ID: expectTarget_DC1,
 			expectTarget_DC2.ID: expectTarget_DC2,
 		},
+		AutoVirtualIPs:   []string{"240.0.0.1"},
+		ManualVirtualIPs: []string{},
 	}
 
 	require.True(t, t.Run("POST: read modified chain with overrides (camel case)", func(t *testing.T) {
diff --git a/agent/structs/discovery_chain.go b/agent/structs/discovery_chain.go
index a924a25f13f7..edbc7384a383 100644
--- a/agent/structs/discovery_chain.go
+++ b/agent/structs/discovery_chain.go
@@ -57,6 +57,10 @@ type CompiledDiscoveryChain struct {
 
 	// Targets is a list of all targets used in this chain.
 	Targets map[string]*DiscoveryTarget `json:",omitempty"`
+
+	// VirtualIPs is a list of virtual IPs associated with the service.
+	AutoVirtualIPs   []string
+	ManualVirtualIPs []string
 }
 
 // ID returns an ID that encodes the service, namespace, partition, and datacenter.
diff --git a/agent/structs/structs.deepcopy.go b/agent/structs/structs.deepcopy.go
index a72557fef749..59a5c7224952 100644
--- a/agent/structs/structs.deepcopy.go
+++ b/agent/structs/structs.deepcopy.go
@@ -133,6 +133,14 @@ func (o *CompiledDiscoveryChain) DeepCopy() *CompiledDiscoveryChain {
 			cp.Targets[k2] = cp_Targets_v2
 		}
 	}
+	if o.AutoVirtualIPs != nil {
+		cp.AutoVirtualIPs = make([]string, len(o.AutoVirtualIPs))
+		copy(cp.AutoVirtualIPs, o.AutoVirtualIPs)
+	}
+	if o.ManualVirtualIPs != nil {
+		cp.ManualVirtualIPs = make([]string, len(o.ManualVirtualIPs))
+		copy(cp.ManualVirtualIPs, o.ManualVirtualIPs)
+	}
 	return &cp
 }
 

From 456156ebec0a943e689e9748a01a786c8f5bfed8 Mon Sep 17 00:00:00 2001
From: Matt Keeler <mkeeler@users.noreply.github.com>
Date: Fri, 12 May 2023 09:24:55 -0400
Subject: [PATCH 74/92] Add type validations for the catalog resources (#17211)

Also adding some common resource validation error types to the internal/resource package.
---
 internal/catalog/internal/types/dns_policy.go |  59 +-
 .../catalog/internal/types/dns_policy_test.go | 162 +++++
 internal/catalog/internal/types/errors.go     |  62 ++
 .../catalog/internal/types/errors_test.go     |  70 +++
 .../catalog/internal/types/health_checks.go   |  68 +-
 .../internal/types/health_checks_test.go      | 197 ++++++
 .../catalog/internal/types/health_status.go   |  50 +-
 .../internal/types/health_status_test.go      | 215 +++++++
 internal/catalog/internal/types/node.go       |  59 +-
 internal/catalog/internal/types/node_test.go  | 128 ++++
 internal/catalog/internal/types/service.go    |  89 ++-
 .../internal/types/service_endpoints.go       |  87 +++
 .../internal/types/service_endpoints_test.go  | 184 ++++++
 .../catalog/internal/types/service_test.go    | 200 ++++++
 .../errDNSPassingWeightOutOfRange.golden      |   1 +
 .../errDNSWarningWeightOutOfRange.golden      |   1 +
 .../testdata/errInvalidNodeHostFormat.golden  |   1 +
 .../testdata/errInvalidPhysicalPort.golden    |   1 +
 .../testdata/errInvalidPortReference.golden   |   1 +
 .../testdata/errInvalidVirtualPort.golden     |   1 +
 .../errInvalidWorkloadHostFormat.golden       |   1 +
 .../testdata/errLocalityZoneNoRegion.golden   |   1 +
 .../types/testdata/errNotDNSLabel.golden      |   1 +
 .../types/testdata/errNotIPAddress.golden     |   1 +
 .../types/testdata/errTooMuchMesh.golden      |   1 +
 .../testdata/errUnixSocketMultiport.golden    |   1 +
 .../testdata/errVirtualPortReused.golden      |   1 +
 internal/catalog/internal/types/validators.go | 209 ++++++
 .../catalog/internal/types/validators_test.go | 595 ++++++++++++++++++
 .../catalog/internal/types/virtual_ips.go     |  26 +-
 .../internal/types/virtual_ips_test.go        |  82 +++
 internal/catalog/internal/types/workload.go   | 118 +++-
 .../catalog/internal/types/workload_test.go   | 281 +++++++++
 internal/resource/errors.go                   | 114 ++++
 internal/resource/errors_test.go              | 124 ++++
 .../resource/testdata/ErrDataParse.golden     |   1 +
 internal/resource/testdata/ErrEmpty.golden    |   1 +
 .../resource/testdata/ErrInvalidField.golden  |   1 +
 .../testdata/ErrInvalidListElement.golden     |   1 +
 .../resource/testdata/ErrInvalidMapKey.golden |   1 +
 .../testdata/ErrInvalidMapValue.golden        |   1 +
 .../testdata/ErrInvalidReferenceType.golden   |   1 +
 internal/resource/testdata/ErrMissing.golden  |   1 +
 .../resource/testdata/ErrOwnerInvalid.golden  |   1 +
 .../ErrReferenceTenancyNotEqual.golden        |   1 +
 45 files changed, 3195 insertions(+), 7 deletions(-)
 create mode 100644 internal/catalog/internal/types/dns_policy_test.go
 create mode 100644 internal/catalog/internal/types/errors.go
 create mode 100644 internal/catalog/internal/types/errors_test.go
 create mode 100644 internal/catalog/internal/types/health_checks_test.go
 create mode 100644 internal/catalog/internal/types/health_status_test.go
 create mode 100644 internal/catalog/internal/types/node_test.go
 create mode 100644 internal/catalog/internal/types/service_endpoints_test.go
 create mode 100644 internal/catalog/internal/types/service_test.go
 create mode 100644 internal/catalog/internal/types/testdata/errDNSPassingWeightOutOfRange.golden
 create mode 100644 internal/catalog/internal/types/testdata/errDNSWarningWeightOutOfRange.golden
 create mode 100644 internal/catalog/internal/types/testdata/errInvalidNodeHostFormat.golden
 create mode 100644 internal/catalog/internal/types/testdata/errInvalidPhysicalPort.golden
 create mode 100644 internal/catalog/internal/types/testdata/errInvalidPortReference.golden
 create mode 100644 internal/catalog/internal/types/testdata/errInvalidVirtualPort.golden
 create mode 100644 internal/catalog/internal/types/testdata/errInvalidWorkloadHostFormat.golden
 create mode 100644 internal/catalog/internal/types/testdata/errLocalityZoneNoRegion.golden
 create mode 100644 internal/catalog/internal/types/testdata/errNotDNSLabel.golden
 create mode 100644 internal/catalog/internal/types/testdata/errNotIPAddress.golden
 create mode 100644 internal/catalog/internal/types/testdata/errTooMuchMesh.golden
 create mode 100644 internal/catalog/internal/types/testdata/errUnixSocketMultiport.golden
 create mode 100644 internal/catalog/internal/types/testdata/errVirtualPortReused.golden
 create mode 100644 internal/catalog/internal/types/validators.go
 create mode 100644 internal/catalog/internal/types/validators_test.go
 create mode 100644 internal/catalog/internal/types/virtual_ips_test.go
 create mode 100644 internal/catalog/internal/types/workload_test.go
 create mode 100644 internal/resource/errors.go
 create mode 100644 internal/resource/errors_test.go
 create mode 100644 internal/resource/testdata/ErrDataParse.golden
 create mode 100644 internal/resource/testdata/ErrEmpty.golden
 create mode 100644 internal/resource/testdata/ErrInvalidField.golden
 create mode 100644 internal/resource/testdata/ErrInvalidListElement.golden
 create mode 100644 internal/resource/testdata/ErrInvalidMapKey.golden
 create mode 100644 internal/resource/testdata/ErrInvalidMapValue.golden
 create mode 100644 internal/resource/testdata/ErrInvalidReferenceType.golden
 create mode 100644 internal/resource/testdata/ErrMissing.golden
 create mode 100644 internal/resource/testdata/ErrOwnerInvalid.golden
 create mode 100644 internal/resource/testdata/ErrReferenceTenancyNotEqual.golden

diff --git a/internal/catalog/internal/types/dns_policy.go b/internal/catalog/internal/types/dns_policy.go
index d1d03759010a..4c3456027667 100644
--- a/internal/catalog/internal/types/dns_policy.go
+++ b/internal/catalog/internal/types/dns_policy.go
@@ -4,9 +4,12 @@
 package types
 
 import (
+	"math"
+
 	"github.com/hashicorp/consul/internal/resource"
 	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
 	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/hashicorp/go-multierror"
 )
 
 const (
@@ -27,6 +30,60 @@ func RegisterDNSPolicy(r resource.Registry) {
 	r.Register(resource.Registration{
 		Type:     DNSPolicyV1Alpha1Type,
 		Proto:    &pbcatalog.DNSPolicy{},
-		Validate: nil,
+		Validate: ValidateDNSPolicy,
 	})
 }
+
+func ValidateDNSPolicy(res *pbresource.Resource) error {
+	var policy pbcatalog.DNSPolicy
+
+	if err := res.Data.UnmarshalTo(&policy); err != nil {
+		return resource.NewErrDataParse(&policy, err)
+	}
+
+	var err error
+	// Ensure that this resource isn't useless and is attempting to
+	// select at least one workload.
+	if selErr := validateSelector(policy.Workloads, false); selErr != nil {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "workloads",
+			Wrapped: selErr,
+		})
+	}
+
+	// Validate the weights
+	if weightErr := validateDNSPolicyWeights(policy.Weights); weightErr != nil {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "weights",
+			Wrapped: weightErr,
+		})
+	}
+
+	return err
+}
+
+func validateDNSPolicyWeights(weights *pbcatalog.Weights) error {
+	// Non nil weights are required
+	if weights == nil {
+		return resource.ErrMissing
+	}
+
+	var err error
+	if weights.Passing < 1 || weights.Passing > math.MaxUint16 {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "passing",
+			Wrapped: errDNSPassingWeightOutOfRange,
+		})
+	}
+
+	// Each weight is an unsigned integer so we don't need to
+	// check for negative weights.
+	if weights.Warning > math.MaxUint16 {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "warning",
+			Wrapped: errDNSWarningWeightOutOfRange,
+		})
+	}
+
+	return err
+}
diff --git a/internal/catalog/internal/types/dns_policy_test.go b/internal/catalog/internal/types/dns_policy_test.go
new file mode 100644
index 000000000000..b4c2da3c78aa
--- /dev/null
+++ b/internal/catalog/internal/types/dns_policy_test.go
@@ -0,0 +1,162 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/consul/internal/resource"
+	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+func createDNSPolicyResource(t *testing.T, data protoreflect.ProtoMessage) *pbresource.Resource {
+	res := &pbresource.Resource{
+		Id: &pbresource.ID{
+			Type: DNSPolicyType,
+			Tenancy: &pbresource.Tenancy{
+				Partition: "default",
+				Namespace: "default",
+				PeerName:  "local",
+			},
+			Name: "test-policy",
+		},
+	}
+
+	var err error
+	res.Data, err = anypb.New(data)
+	require.NoError(t, err)
+	return res
+}
+
+func TestValidateDNSPolicy_Ok(t *testing.T) {
+	data := &pbcatalog.DNSPolicy{
+		Workloads: &pbcatalog.WorkloadSelector{
+			Prefixes: []string{""},
+		},
+		Weights: &pbcatalog.Weights{
+			Passing: 3,
+			Warning: 0,
+		},
+	}
+
+	res := createDNSPolicyResource(t, data)
+
+	err := ValidateDNSPolicy(res)
+	require.NoError(t, err)
+}
+
+func TestValidateDNSPolicy_ParseError(t *testing.T) {
+	// Any type other than the DNSPolicy type would work
+	// to cause the error we are expecting
+	data := &pbcatalog.IP{Address: "198.18.0.1"}
+
+	res := createDNSPolicyResource(t, data)
+
+	err := ValidateDNSPolicy(res)
+	require.Error(t, err)
+	require.ErrorAs(t, err, &resource.ErrDataParse{})
+}
+
+func TestValidateDNSPolicy_MissingWeights(t *testing.T) {
+	data := &pbcatalog.DNSPolicy{
+		Workloads: &pbcatalog.WorkloadSelector{
+			Prefixes: []string{""},
+		},
+	}
+
+	res := createDNSPolicyResource(t, data)
+
+	err := ValidateDNSPolicy(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidField{
+		Name:    "weights",
+		Wrapped: resource.ErrMissing,
+	}
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
+
+func TestValidateDNSPolicy_InvalidPassingWeight(t *testing.T) {
+	for _, weight := range []uint32{0, 1000000} {
+		t.Run(fmt.Sprintf("%d", weight), func(t *testing.T) {
+			data := &pbcatalog.DNSPolicy{
+				Workloads: &pbcatalog.WorkloadSelector{
+					Prefixes: []string{""},
+				},
+				Weights: &pbcatalog.Weights{
+					Passing: weight,
+				},
+			}
+
+			res := createDNSPolicyResource(t, data)
+
+			err := ValidateDNSPolicy(res)
+			require.Error(t, err)
+			expected := resource.ErrInvalidField{
+				Name:    "passing",
+				Wrapped: errDNSPassingWeightOutOfRange,
+			}
+			var actual resource.ErrInvalidField
+			require.ErrorAs(t, err, &actual)
+			require.Equal(t, "weights", actual.Name)
+			err = actual.Unwrap()
+			require.ErrorAs(t, err, &actual)
+			require.Equal(t, expected, actual)
+		})
+	}
+}
+
+func TestValidateDNSPolicy_InvalidWarningWeight(t *testing.T) {
+	data := &pbcatalog.DNSPolicy{
+		Workloads: &pbcatalog.WorkloadSelector{
+			Prefixes: []string{""},
+		},
+		Weights: &pbcatalog.Weights{
+			Passing: 1,
+			Warning: 1000000,
+		},
+	}
+
+	res := createDNSPolicyResource(t, data)
+
+	err := ValidateDNSPolicy(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidField{
+		Name:    "warning",
+		Wrapped: errDNSWarningWeightOutOfRange,
+	}
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, "weights", actual.Name)
+	err = actual.Unwrap()
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
+
+func TestValidateDNSPolicy_EmptySelector(t *testing.T) {
+	data := &pbcatalog.DNSPolicy{
+		Weights: &pbcatalog.Weights{
+			Passing: 10,
+			Warning: 3,
+		},
+	}
+
+	res := createDNSPolicyResource(t, data)
+
+	err := ValidateDNSPolicy(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidField{
+		Name:    "workloads",
+		Wrapped: resource.ErrEmpty,
+	}
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
diff --git a/internal/catalog/internal/types/errors.go b/internal/catalog/internal/types/errors.go
new file mode 100644
index 000000000000..39a7131ae0ba
--- /dev/null
+++ b/internal/catalog/internal/types/errors.go
@@ -0,0 +1,62 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"errors"
+	"fmt"
+)
+
+var (
+	errNotDNSLabel                = errors.New(fmt.Sprintf("value must match regex: %s", dnsLabelRegex))
+	errNotIPAddress               = errors.New("value is not a valid IP address")
+	errUnixSocketMultiport        = errors.New("Unix socket address references more than one port")
+	errInvalidPhysicalPort        = errors.New("port number is outside the range 1 to 65535")
+	errInvalidVirtualPort         = errors.New("port number is outside the range 0 to 65535")
+	errDNSWarningWeightOutOfRange = errors.New("DNS warning weight is outside the range 0 to 65535")
+	errDNSPassingWeightOutOfRange = errors.New("DNS passing weight is outside of the range 1 to 65535")
+	errLocalityZoneNoRegion       = errors.New("locality region cannot be empty if the zone is set")
+	errInvalidHealth              = errors.New("health status must be one of: passing, warning, critical or maintenance")
+)
+
+type errInvalidWorkloadHostFormat struct {
+	Host string
+}
+
+func (err errInvalidWorkloadHostFormat) Error() string {
+	return fmt.Sprintf("%q is not an IP address, Unix socket path or a DNS name.", err.Host)
+}
+
+type errInvalidNodeHostFormat struct {
+	Host string
+}
+
+func (err errInvalidNodeHostFormat) Error() string {
+	return fmt.Sprintf("%q is not an IP address or a DNS name.", err.Host)
+}
+
+type errInvalidPortReference struct {
+	Name string
+}
+
+func (err errInvalidPortReference) Error() string {
+	return fmt.Sprintf("port with name %q has not been defined", err.Name)
+}
+
+type errVirtualPortReused struct {
+	Index int
+	Value uint32
+}
+
+func (err errVirtualPortReused) Error() string {
+	return fmt.Sprintf("virtual port %d was previously assigned at index %d", err.Value, err.Index)
+}
+
+type errTooMuchMesh struct {
+	Ports []string
+}
+
+func (err errTooMuchMesh) Error() string {
+	return fmt.Sprintf("protocol \"mesh\" was specified in more than 1 port: %+v", err.Ports)
+}
diff --git a/internal/catalog/internal/types/errors_test.go b/internal/catalog/internal/types/errors_test.go
new file mode 100644
index 000000000000..d8249549d530
--- /dev/null
+++ b/internal/catalog/internal/types/errors_test.go
@@ -0,0 +1,70 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"flag"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// update allows golden files to be updated based on the current output.
+var update = flag.Bool("update", false, "update golden files")
+
+func goldenError(t *testing.T, name string, actual string) {
+	t.Helper()
+
+	fpath := filepath.Join("testdata", name+".golden")
+
+	if *update {
+		require.NoError(t, os.WriteFile(fpath, []byte(actual), 0644))
+	} else {
+		expected, err := os.ReadFile(fpath)
+		require.NoError(t, err)
+		require.Equal(t, string(expected), actual)
+	}
+}
+
+func TestErrorStrings(t *testing.T) {
+	type testCase struct {
+		err      error
+		expected string
+	}
+
+	cases := map[string]error{
+		"errInvalidWorkloadHostFormat": errInvalidWorkloadHostFormat{
+			Host: "-foo-bar-",
+		},
+		"errInvalidNodeHostFormat": errInvalidNodeHostFormat{
+			Host: "unix:///node.sock",
+		},
+		"errInvalidPortReference": errInvalidPortReference{
+			Name: "http",
+		},
+		"errVirtualPortReused": errVirtualPortReused{
+			Index: 3,
+			Value: 8080,
+		},
+		"errTooMuchMesh": errTooMuchMesh{
+			Ports: []string{"http", "grpc"},
+		},
+		"errNotDNSLabel":                errNotDNSLabel,
+		"errNotIPAddress":               errNotIPAddress,
+		"errUnixSocketMultiport":        errUnixSocketMultiport,
+		"errInvalidPhysicalPort":        errInvalidPhysicalPort,
+		"errInvalidVirtualPort":         errInvalidVirtualPort,
+		"errDNSWarningWeightOutOfRange": errDNSWarningWeightOutOfRange,
+		"errDNSPassingWeightOutOfRange": errDNSPassingWeightOutOfRange,
+		"errLocalityZoneNoRegion":       errLocalityZoneNoRegion,
+	}
+
+	for name, err := range cases {
+		t.Run(name, func(t *testing.T) {
+			goldenError(t, name, err.Error())
+		})
+	}
+}
diff --git a/internal/catalog/internal/types/health_checks.go b/internal/catalog/internal/types/health_checks.go
index e11708898154..7df200ec28eb 100644
--- a/internal/catalog/internal/types/health_checks.go
+++ b/internal/catalog/internal/types/health_checks.go
@@ -7,6 +7,7 @@ import (
 	"github.com/hashicorp/consul/internal/resource"
 	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
 	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/hashicorp/go-multierror"
 )
 
 const (
@@ -27,6 +28,71 @@ func RegisterHealthChecks(r resource.Registry) {
 	r.Register(resource.Registration{
 		Type:     HealthChecksV1Alpha1Type,
 		Proto:    &pbcatalog.HealthChecks{},
-		Validate: nil,
+		Validate: ValidateHealthChecks,
 	})
 }
+
+func ValidateHealthChecks(res *pbresource.Resource) error {
+	var checks pbcatalog.HealthChecks
+
+	if err := res.Data.UnmarshalTo(&checks); err != nil {
+		return resource.NewErrDataParse(&checks, err)
+	}
+
+	var err error
+
+	// Validate the workload selector
+	if selErr := validateSelector(checks.Workloads, false); selErr != nil {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "workloads",
+			Wrapped: selErr,
+		})
+	}
+
+	// Validate each check
+	for idx, check := range checks.HealthChecks {
+		if checkErr := validateCheck(check); checkErr != nil {
+			err = multierror.Append(err, resource.ErrInvalidListElement{
+				Name:    "checks",
+				Index:   idx,
+				Wrapped: checkErr,
+			})
+		}
+	}
+
+	return err
+}
+
+func validateCheck(check *pbcatalog.HealthCheck) error {
+	var err error
+	// Validate the check name
+	if check.Name == "" {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "name",
+			Wrapped: resource.ErrMissing,
+		})
+	} else if !isValidDNSLabel(check.Name) {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "name",
+			Wrapped: errNotDNSLabel,
+		})
+	}
+
+	// Validate the definition
+	if check.Definition == nil {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "definition",
+			Wrapped: resource.ErrMissing,
+		})
+	}
+
+	// In theory it would be nice to validate the individual check definition.
+	// However whether a check is valid will be up for interpretation by
+	// the check executor. The executor may default some addressing,
+	// allow for templating etc. Therefore we cannot really know at admission
+	// time whether the check will be executable. Therefore it is expected
+	// that check executors will update the status of the resource to note
+	// whether it was valid for that executor.
+
+	return err
+}
diff --git a/internal/catalog/internal/types/health_checks_test.go b/internal/catalog/internal/types/health_checks_test.go
new file mode 100644
index 000000000000..12c13d3c1a22
--- /dev/null
+++ b/internal/catalog/internal/types/health_checks_test.go
@@ -0,0 +1,197 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"testing"
+	"time"
+
+	"github.com/hashicorp/consul/internal/resource"
+	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/types/known/anypb"
+	"google.golang.org/protobuf/types/known/durationpb"
+)
+
+func createHealthChecksResource(t *testing.T, data protoreflect.ProtoMessage) *pbresource.Resource {
+	res := &pbresource.Resource{
+		Id: &pbresource.ID{
+			Type: HealthChecksType,
+			Tenancy: &pbresource.Tenancy{
+				Partition: "default",
+				Namespace: "default",
+				PeerName:  "local",
+			},
+			Name: "test-checks",
+		},
+	}
+
+	var err error
+	res.Data, err = anypb.New(data)
+	require.NoError(t, err)
+	return res
+}
+
+func TestValidateHealthChecks_Ok(t *testing.T) {
+	data := &pbcatalog.HealthChecks{
+		Workloads: &pbcatalog.WorkloadSelector{
+			Prefixes: []string{""},
+		},
+		HealthChecks: []*pbcatalog.HealthCheck{
+			{
+				Name: "test-check",
+				Definition: &pbcatalog.HealthCheck_Tcp{
+					Tcp: &pbcatalog.TCPCheck{
+						Address: "198.18.0.1",
+					},
+				},
+				Interval: durationpb.New(30 * time.Second),
+				Timeout:  durationpb.New(15 * time.Second),
+			},
+		},
+	}
+
+	res := createHealthChecksResource(t, data)
+
+	err := ValidateHealthChecks(res)
+	require.NoError(t, err)
+}
+
+func TestValidateHealthChecks_ParseError(t *testing.T) {
+	// Any type other than the HealthChecks type would work
+	// to cause the error we are expecting
+	data := &pbcatalog.IP{Address: "198.18.0.1"}
+
+	res := createHealthChecksResource(t, data)
+
+	err := ValidateHealthChecks(res)
+	require.Error(t, err)
+	require.ErrorAs(t, err, &resource.ErrDataParse{})
+}
+
+func TestValidateHealthChecks_InvalidCheckName(t *testing.T) {
+	genData := func(name string) *pbcatalog.HealthChecks {
+		return &pbcatalog.HealthChecks{
+			Workloads: &pbcatalog.WorkloadSelector{
+				Prefixes: []string{""},
+			},
+			HealthChecks: []*pbcatalog.HealthCheck{
+				{
+					Name: name,
+					Definition: &pbcatalog.HealthCheck_Tcp{
+						Tcp: &pbcatalog.TCPCheck{
+							Address: "198.18.0.1",
+						},
+					},
+					Interval: durationpb.New(30 * time.Second),
+					Timeout:  durationpb.New(15 * time.Second),
+				},
+			},
+		}
+	}
+
+	type testCase struct {
+		name        string
+		err         bool
+		expectedErr resource.ErrInvalidField
+	}
+
+	// These checks are not exhaustive of the classes of names which
+	// would be accepted or rejected. The tests for the isValidDNSLabel
+	// function have more thorough testing. Here we just ensure that
+	// we can get the errNotDNSLabel error to indicate that calling
+	// that function returned false and was emitted by ValidateHealthChecks
+	cases := map[string]testCase{
+		"basic": {
+			name: "foo-check",
+		},
+		"missing-name": {
+			err: true,
+			expectedErr: resource.ErrInvalidField{
+				Name:    "name",
+				Wrapped: resource.ErrEmpty,
+			},
+		},
+		"invalid-dns-label": {
+			name: "UPPERCASE",
+			err:  true,
+			expectedErr: resource.ErrInvalidField{
+				Name:    "name",
+				Wrapped: errNotDNSLabel,
+			},
+		},
+	}
+
+	for name, tcase := range cases {
+		t.Run(name, func(t *testing.T) {
+			data := genData(tcase.name)
+			err := ValidateHealthChecks(createHealthChecksResource(t, data))
+
+			if tcase.err {
+				require.Error(t, err)
+
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestValidateHealthChecks_MissingDefinition(t *testing.T) {
+	data := &pbcatalog.HealthChecks{
+		Workloads: &pbcatalog.WorkloadSelector{
+			Prefixes: []string{""},
+		},
+		HealthChecks: []*pbcatalog.HealthCheck{
+			{
+				Name:     "test-check",
+				Interval: durationpb.New(30 * time.Second),
+				Timeout:  durationpb.New(15 * time.Second),
+			},
+		},
+	}
+
+	res := createHealthChecksResource(t, data)
+
+	err := ValidateHealthChecks(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidField{
+		Name:    "definition",
+		Wrapped: resource.ErrMissing,
+	}
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
+
+func TestValidateHealthChecks_EmptySelector(t *testing.T) {
+	data := &pbcatalog.HealthChecks{
+		HealthChecks: []*pbcatalog.HealthCheck{
+			{
+				Name: "test-check",
+				Definition: &pbcatalog.HealthCheck_Tcp{
+					Tcp: &pbcatalog.TCPCheck{
+						Address: "198.18.0.1",
+					},
+				},
+				Interval: durationpb.New(30 * time.Second),
+				Timeout:  durationpb.New(15 * time.Second),
+			},
+		},
+	}
+
+	res := createHealthChecksResource(t, data)
+
+	err := ValidateHealthChecks(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidField{
+		Name:    "workloads",
+		Wrapped: resource.ErrEmpty,
+	}
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
diff --git a/internal/catalog/internal/types/health_status.go b/internal/catalog/internal/types/health_status.go
index b85c8036d8b8..0dc73f632080 100644
--- a/internal/catalog/internal/types/health_status.go
+++ b/internal/catalog/internal/types/health_status.go
@@ -7,6 +7,7 @@ import (
 	"github.com/hashicorp/consul/internal/resource"
 	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
 	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/hashicorp/go-multierror"
 )
 
 const (
@@ -27,6 +28,53 @@ func RegisterHealthStatus(r resource.Registry) {
 	r.Register(resource.Registration{
 		Type:     HealthStatusV1Alpha1Type,
 		Proto:    &pbcatalog.HealthStatus{},
-		Validate: nil,
+		Validate: ValidateHealthStatus,
 	})
 }
+
+func ValidateHealthStatus(res *pbresource.Resource) error {
+	var hs pbcatalog.HealthStatus
+
+	if err := res.Data.UnmarshalTo(&hs); err != nil {
+		return resource.NewErrDataParse(&hs, err)
+	}
+
+	var err error
+
+	// Should we allow empty types? I think for now it will be safest to require
+	// the type field is set and we can relax this restriction in the future
+	// if we deem it desirable.
+	if hs.Type == "" {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "type",
+			Wrapped: resource.ErrMissing,
+		})
+	}
+
+	switch hs.Status {
+	case pbcatalog.Health_HEALTH_PASSING,
+		pbcatalog.Health_HEALTH_WARNING,
+		pbcatalog.Health_HEALTH_CRITICAL,
+		pbcatalog.Health_HEALTH_MAINTENANCE:
+	default:
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "status",
+			Wrapped: errInvalidHealth,
+		})
+	}
+
+	// Ensure that the HealthStatus' owner is a type that we want to allow. The
+	// owner is currently the resource that this HealthStatus applies to. If we
+	// change this to be a parent reference within the HealthStatus.Data then
+	// we could allow for other owners.
+	if res.Owner == nil {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "owner",
+			Wrapped: resource.ErrMissing,
+		})
+	} else if !resource.EqualType(res.Owner.Type, WorkloadType) && !resource.EqualType(res.Owner.Type, NodeType) {
+		err = multierror.Append(err, resource.ErrOwnerInvalid{ResourceType: res.Id.Type, OwnerType: res.Owner.Type})
+	}
+
+	return err
+}
diff --git a/internal/catalog/internal/types/health_status_test.go b/internal/catalog/internal/types/health_status_test.go
new file mode 100644
index 000000000000..5fa9eaa5af1e
--- /dev/null
+++ b/internal/catalog/internal/types/health_status_test.go
@@ -0,0 +1,215 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"testing"
+
+	"github.com/hashicorp/consul/internal/resource"
+	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+var (
+	defaultHealthStatusOwnerTenancy = &pbresource.Tenancy{
+		Partition: "default",
+		Namespace: "default",
+		PeerName:  "local",
+	}
+
+	defaultHealthStatusOwner = &pbresource.ID{
+		Type:    WorkloadType,
+		Tenancy: defaultHealthStatusOwnerTenancy,
+		Name:    "foo",
+	}
+)
+
+func createHealthStatusResource(t *testing.T, data protoreflect.ProtoMessage, owner *pbresource.ID) *pbresource.Resource {
+	res := &pbresource.Resource{
+		Id: &pbresource.ID{
+			Type: HealthStatusType,
+			Tenancy: &pbresource.Tenancy{
+				Partition: "default",
+				Namespace: "default",
+				PeerName:  "local",
+			},
+			Name: "test-status",
+		},
+		Owner: owner,
+	}
+
+	var err error
+	res.Data, err = anypb.New(data)
+	require.NoError(t, err)
+	return res
+}
+
+func TestValidateHealthStatus_Ok(t *testing.T) {
+	data := &pbcatalog.HealthStatus{
+		Type:        "tcp",
+		Status:      pbcatalog.Health_HEALTH_PASSING,
+		Description: "Doesn't matter as this is user settable",
+		Output:      "Health check executors are free to use this field",
+	}
+
+	type testCase struct {
+		owner *pbresource.ID
+	}
+
+	cases := map[string]testCase{
+		"workload-owned": {
+			owner: &pbresource.ID{
+				Type:    WorkloadType,
+				Tenancy: defaultHealthStatusOwnerTenancy,
+				Name:    "foo-workload",
+			},
+		},
+		"node-owned": {
+			owner: &pbresource.ID{
+				Type:    NodeType,
+				Tenancy: defaultHealthStatusOwnerTenancy,
+				Name:    "bar-node",
+			},
+		},
+	}
+
+	for name, tcase := range cases {
+		t.Run(name, func(t *testing.T) {
+			res := createHealthStatusResource(t, data, tcase.owner)
+			err := ValidateHealthStatus(res)
+			require.NoError(t, err)
+		})
+	}
+}
+
+func TestValidateHealthStatus_ParseError(t *testing.T) {
+	// Any type other than the HealthStatus type would work
+	// to cause the error we are expecting
+	data := &pbcatalog.IP{Address: "198.18.0.1"}
+
+	res := createHealthStatusResource(t, data, defaultHealthStatusOwner)
+
+	err := ValidateHealthStatus(res)
+	require.Error(t, err)
+	require.ErrorAs(t, err, &resource.ErrDataParse{})
+}
+
+func TestValidateHealthStatus_InvalidHealth(t *testing.T) {
+	// while this is a valid enum value it is not allowed to be used
+	// as the Status field.
+	data := &pbcatalog.HealthStatus{
+		Type:   "tcp",
+		Status: pbcatalog.Health_HEALTH_ANY,
+	}
+
+	res := createHealthStatusResource(t, data, defaultHealthStatusOwner)
+
+	err := ValidateHealthStatus(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidField{
+		Name:    "status",
+		Wrapped: errInvalidHealth,
+	}
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
+
+func TestValidateHealthStatus_MissingType(t *testing.T) {
+	data := &pbcatalog.HealthStatus{
+		Status: pbcatalog.Health_HEALTH_PASSING,
+	}
+
+	res := createHealthStatusResource(t, data, defaultHealthStatusOwner)
+
+	err := ValidateHealthStatus(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidField{
+		Name:    "type",
+		Wrapped: resource.ErrMissing,
+	}
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
+
+func TestValidateHealthStatus_MissingOwner(t *testing.T) {
+	data := &pbcatalog.HealthStatus{
+		Type:   "tcp",
+		Status: pbcatalog.Health_HEALTH_PASSING,
+	}
+
+	res := createHealthStatusResource(t, data, nil)
+
+	err := ValidateHealthStatus(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidField{
+		Name:    "owner",
+		Wrapped: resource.ErrMissing,
+	}
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
+
+func TestValidateHealthStatus_InvalidOwner(t *testing.T) {
+	data := &pbcatalog.HealthStatus{
+		Type:   "tcp",
+		Status: pbcatalog.Health_HEALTH_PASSING,
+	}
+
+	type testCase struct {
+		owner *pbresource.ID
+	}
+
+	cases := map[string]testCase{
+		"group-mismatch": {
+			owner: &pbresource.ID{
+				Type: &pbresource.Type{
+					Group:        "fake",
+					GroupVersion: CurrentVersion,
+					Kind:         WorkloadKind,
+				},
+				Tenancy: defaultHealthStatusOwnerTenancy,
+				Name:    "baz",
+			},
+		},
+		"group-version-mismatch": {
+			owner: &pbresource.ID{
+				Type: &pbresource.Type{
+					Group:        GroupName,
+					GroupVersion: "v99",
+					Kind:         WorkloadKind,
+				},
+				Tenancy: defaultHealthStatusOwnerTenancy,
+				Name:    "baz",
+			},
+		},
+		"kind-mismatch": {
+			owner: &pbresource.ID{
+				Type:    ServiceType,
+				Tenancy: defaultHealthStatusOwnerTenancy,
+				Name:    "baz",
+			},
+		},
+	}
+
+	for name, tcase := range cases {
+		t.Run(name, func(t *testing.T) {
+			res := createHealthStatusResource(t, data, tcase.owner)
+			err := ValidateHealthStatus(res)
+			require.Error(t, err)
+			expected := resource.ErrOwnerInvalid{
+				ResourceType: HealthStatusType,
+				OwnerType:    tcase.owner.Type,
+			}
+			var actual resource.ErrOwnerInvalid
+			require.ErrorAs(t, err, &actual)
+			require.Equal(t, expected, actual)
+		})
+	}
+}
diff --git a/internal/catalog/internal/types/node.go b/internal/catalog/internal/types/node.go
index 09d8cca1ae17..0d2c795abaa5 100644
--- a/internal/catalog/internal/types/node.go
+++ b/internal/catalog/internal/types/node.go
@@ -7,6 +7,7 @@ import (
 	"github.com/hashicorp/consul/internal/resource"
 	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
 	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/hashicorp/go-multierror"
 )
 
 const (
@@ -27,6 +28,62 @@ func RegisterNode(r resource.Registry) {
 	r.Register(resource.Registration{
 		Type:     NodeV1Alpha1Type,
 		Proto:    &pbcatalog.Node{},
-		Validate: nil,
+		Validate: ValidateNode,
 	})
 }
+
+func ValidateNode(res *pbresource.Resource) error {
+	var node pbcatalog.Node
+
+	if err := res.Data.UnmarshalTo(&node); err != nil {
+		return resource.NewErrDataParse(&node, err)
+	}
+
+	var err error
+	// Validate that the node has at least 1 address
+	if len(node.Addresses) < 1 {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "addresses",
+			Wrapped: resource.ErrEmpty,
+		})
+	}
+
+	// Validate each node address
+	for idx, addr := range node.Addresses {
+		if addrErr := validateNodeAddress(addr); addrErr != nil {
+			err = multierror.Append(err, resource.ErrInvalidListElement{
+				Name:    "addresses",
+				Index:   idx,
+				Wrapped: addrErr,
+			})
+		}
+	}
+
+	return err
+}
+
+// Validates a single node address
+func validateNodeAddress(addr *pbcatalog.NodeAddress) error {
+	// Currently the only field needing validation is the Host field. If that
+	// changes then this func should get updated to use a multierror.Append
+	// to collect the errors and return the overall set.
+
+	// Check that the host is empty
+	if addr.Host == "" {
+		return resource.ErrInvalidField{
+			Name:    "host",
+			Wrapped: resource.ErrMissing,
+		}
+	}
+
+	// Check if the host represents an IP address or a DNS name. Unix socket paths
+	// are not allowed for Node addresses unlike workload addresses.
+	if !isValidIPAddress(addr.Host) && !isValidDNSName(addr.Host) {
+		return resource.ErrInvalidField{
+			Name:    "host",
+			Wrapped: errInvalidNodeHostFormat{Host: addr.Host},
+		}
+	}
+
+	return nil
+}
diff --git a/internal/catalog/internal/types/node_test.go b/internal/catalog/internal/types/node_test.go
new file mode 100644
index 000000000000..93e5ecea329a
--- /dev/null
+++ b/internal/catalog/internal/types/node_test.go
@@ -0,0 +1,128 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"testing"
+
+	"github.com/hashicorp/consul/internal/resource"
+	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+func createNodeResource(t *testing.T, data protoreflect.ProtoMessage) *pbresource.Resource {
+	res := &pbresource.Resource{
+		Id: &pbresource.ID{
+			Type: NodeType,
+			Tenancy: &pbresource.Tenancy{
+				Partition: "default",
+				Namespace: "default",
+				PeerName:  "local",
+			},
+			Name: "test-node",
+		},
+	}
+
+	var err error
+	res.Data, err = anypb.New(data)
+	require.NoError(t, err)
+	return res
+}
+
+func TestValidateNode_Ok(t *testing.T) {
+	data := &pbcatalog.Node{
+		Addresses: []*pbcatalog.NodeAddress{
+			{
+				Host: "198.18.0.1",
+			},
+			{
+				Host: "fe80::316a:ed5b:f62c:7321",
+			},
+			{
+				Host:     "foo.node.example.com",
+				External: true,
+			},
+		},
+	}
+
+	res := createNodeResource(t, data)
+
+	err := ValidateNode(res)
+	require.NoError(t, err)
+}
+
+func TestValidateNode_ParseError(t *testing.T) {
+	// Any type other than the Node type would work
+	// to cause the error we are expecting
+	data := &pbcatalog.IP{Address: "198.18.0.1"}
+
+	res := createNodeResource(t, data)
+
+	err := ValidateNode(res)
+	require.Error(t, err)
+	require.ErrorAs(t, err, &resource.ErrDataParse{})
+}
+
+func TestValidateNode_EmptyAddresses(t *testing.T) {
+	data := &pbcatalog.Node{}
+
+	res := createNodeResource(t, data)
+
+	err := ValidateNode(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidField{
+		Name:    "addresses",
+		Wrapped: resource.ErrEmpty,
+	}
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
+
+func TestValidateNode_InvalidAddress(t *testing.T) {
+	data := &pbcatalog.Node{
+		Addresses: []*pbcatalog.NodeAddress{
+			{
+				Host: "unix:///node.sock",
+			},
+		},
+	}
+
+	res := createNodeResource(t, data)
+
+	err := ValidateNode(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidField{
+		Name:    "host",
+		Wrapped: errInvalidNodeHostFormat{Host: "unix:///node.sock"},
+	}
+
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
+
+func TestValidateNode_AddressMissingHost(t *testing.T) {
+	data := &pbcatalog.Node{
+		Addresses: []*pbcatalog.NodeAddress{
+			{},
+		},
+	}
+
+	res := createNodeResource(t, data)
+
+	err := ValidateNode(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidField{
+		Name:    "host",
+		Wrapped: resource.ErrMissing,
+	}
+
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
diff --git a/internal/catalog/internal/types/service.go b/internal/catalog/internal/types/service.go
index 78486128d2a1..f4da3cd8e4b6 100644
--- a/internal/catalog/internal/types/service.go
+++ b/internal/catalog/internal/types/service.go
@@ -4,9 +4,12 @@
 package types
 
 import (
+	"math"
+
 	"github.com/hashicorp/consul/internal/resource"
 	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
 	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/hashicorp/go-multierror"
 )
 
 const (
@@ -27,6 +30,90 @@ func RegisterService(r resource.Registry) {
 	r.Register(resource.Registration{
 		Type:     ServiceV1Alpha1Type,
 		Proto:    &pbcatalog.Service{},
-		Validate: nil,
+		Validate: ValidateService,
 	})
 }
+
+func ValidateService(res *pbresource.Resource) error {
+	var service pbcatalog.Service
+
+	if err := res.Data.UnmarshalTo(&service); err != nil {
+		return resource.NewErrDataParse(&service, err)
+	}
+
+	var err error
+
+	// Validate the workload selector. We are allowing selectors with no
+	// selection criteria as it will allow for users to manually manage
+	// ServiceEndpoints objects for this service such as when desiring to
+	// configure endpoint information for external services that are not
+	// registered as workloads
+	if selErr := validateSelector(service.Workloads, true); selErr != nil {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "workloads",
+			Wrapped: selErr,
+		})
+	}
+
+	usedVirtualPorts := make(map[uint32]int)
+
+	// Validate each port
+	for idx, port := range service.Ports {
+		if usedIdx, found := usedVirtualPorts[port.VirtualPort]; found {
+			err = multierror.Append(err, resource.ErrInvalidListElement{
+				Name:  "ports",
+				Index: idx,
+				Wrapped: resource.ErrInvalidField{
+					Name: "virtual_port",
+					Wrapped: errVirtualPortReused{
+						Index: usedIdx,
+						Value: port.VirtualPort,
+					},
+				},
+			})
+		} else {
+			usedVirtualPorts[port.VirtualPort] = idx
+		}
+
+		// validate the target port
+		if nameErr := validatePortName(port.TargetPort); nameErr != nil {
+			err = multierror.Append(err, resource.ErrInvalidListElement{
+				Name:  "ports",
+				Index: idx,
+				Wrapped: resource.ErrInvalidField{
+					Name:    "target_port",
+					Wrapped: nameErr,
+				},
+			})
+		}
+
+		// validate the virtual port is within the allowed range - 0 is allowed
+		// to signify that no virtual port should be used and the port will not
+		// be available for transparent proxying within the mesh.
+		if port.VirtualPort > math.MaxUint16 {
+			err = multierror.Append(err, resource.ErrInvalidListElement{
+				Name:  "ports",
+				Index: idx,
+				Wrapped: resource.ErrInvalidField{
+					Name:    "virtual_port",
+					Wrapped: errInvalidVirtualPort,
+				},
+			})
+		}
+
+		// basic protobuf deserialization should enforce that only known variants of the protocol field are set.
+	}
+
+	// Validate that the Virtual IPs are all IP addresses
+	for idx, vip := range service.VirtualIps {
+		if vipErr := validateIPAddress(vip); vipErr != nil {
+			err = multierror.Append(err, resource.ErrInvalidListElement{
+				Name:    "virtual_ips",
+				Index:   idx,
+				Wrapped: vipErr,
+			})
+		}
+	}
+
+	return err
+}
diff --git a/internal/catalog/internal/types/service_endpoints.go b/internal/catalog/internal/types/service_endpoints.go
index bef9ca27eeea..9a2ce37230c1 100644
--- a/internal/catalog/internal/types/service_endpoints.go
+++ b/internal/catalog/internal/types/service_endpoints.go
@@ -4,9 +4,12 @@
 package types
 
 import (
+	"math"
+
 	"github.com/hashicorp/consul/internal/resource"
 	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
 	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/hashicorp/go-multierror"
 )
 
 const (
@@ -30,3 +33,87 @@ func RegisterServiceEndpoints(r resource.Registry) {
 		Validate: nil,
 	})
 }
+
+func ValidateServiceEndpoints(res *pbresource.Resource) error {
+	var svcEndpoints pbcatalog.ServiceEndpoints
+
+	if err := res.Data.UnmarshalTo(&svcEndpoints); err != nil {
+		return resource.NewErrDataParse(&svcEndpoints, err)
+	}
+
+	var err error
+	for idx, endpoint := range svcEndpoints.Endpoints {
+		if endpointErr := validateEndpoint(endpoint, res); endpointErr != nil {
+			err = multierror.Append(err, resource.ErrInvalidListElement{
+				Name:    "endpoints",
+				Index:   idx,
+				Wrapped: endpointErr,
+			})
+		}
+	}
+
+	return err
+}
+
+func validateEndpoint(endpoint *pbcatalog.Endpoint, res *pbresource.Resource) error {
+	var err error
+
+	// Validate the target ref if not nil. When it is nil we are assuming that
+	// the endpoints are being managed for an external service that has no
+	// corresponding workloads that Consul has knowledge of.
+	if endpoint.TargetRef != nil {
+		// Validate the target reference
+		if refErr := validateReference(WorkloadType, res.Id.GetTenancy(), endpoint.TargetRef); refErr != nil {
+			err = multierror.Append(err, resource.ErrInvalidField{
+				Name:    "target_ref",
+				Wrapped: refErr,
+			})
+		}
+	}
+
+	// Validate the endpoint Addresses
+	for addrIdx, addr := range endpoint.Addresses {
+		if addrErr := validateWorkloadAddress(addr, endpoint.Ports); addrErr != nil {
+			err = multierror.Append(err, resource.ErrInvalidListElement{
+				Name:    "addresses",
+				Index:   addrIdx,
+				Wrapped: addrErr,
+			})
+		}
+	}
+
+	// Ensure that the endpoint has at least 1 port.
+	if len(endpoint.Ports) < 1 {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "ports",
+			Wrapped: resource.ErrEmpty,
+		})
+	}
+
+	// Validate the endpoints ports
+	for portName, port := range endpoint.Ports {
+		// Port names must be DNS labels
+		if portNameErr := validatePortName(portName); portNameErr != nil {
+			err = multierror.Append(err, resource.ErrInvalidMapKey{
+				Map:     "ports",
+				Key:     portName,
+				Wrapped: portNameErr,
+			})
+		}
+
+		// As the physical port is the real port the endpoint will be bound to
+		// it must be in the standard 1-65535 range.
+		if port.Port < 1 || port.Port > math.MaxUint16 {
+			err = multierror.Append(err, resource.ErrInvalidMapValue{
+				Map: "ports",
+				Key: portName,
+				Wrapped: resource.ErrInvalidField{
+					Name:    "phsical_port",
+					Wrapped: errInvalidPhysicalPort,
+				},
+			})
+		}
+	}
+
+	return err
+}
diff --git a/internal/catalog/internal/types/service_endpoints_test.go b/internal/catalog/internal/types/service_endpoints_test.go
new file mode 100644
index 000000000000..bd902d624683
--- /dev/null
+++ b/internal/catalog/internal/types/service_endpoints_test.go
@@ -0,0 +1,184 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"testing"
+
+	"github.com/hashicorp/consul/internal/resource"
+	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+var (
+	defaultEndpointTenancy = &pbresource.Tenancy{
+		Partition: "default",
+		Namespace: "default",
+		PeerName:  "local",
+	}
+)
+
+func createServiceEndpointsResource(t *testing.T, data protoreflect.ProtoMessage) *pbresource.Resource {
+	res := &pbresource.Resource{
+		Id: &pbresource.ID{
+			Type:    ServiceEndpointsType,
+			Tenancy: defaultEndpointTenancy,
+			Name:    "test-service",
+		},
+	}
+
+	var err error
+	res.Data, err = anypb.New(data)
+	require.NoError(t, err)
+	return res
+}
+
+func TestValidateServiceEndpoints_Ok(t *testing.T) {
+	data := &pbcatalog.ServiceEndpoints{
+		Endpoints: []*pbcatalog.Endpoint{
+			{
+				TargetRef: &pbresource.ID{
+					Type:    WorkloadType,
+					Tenancy: defaultEndpointTenancy,
+					Name:    "foo",
+				},
+				Addresses: []*pbcatalog.WorkloadAddress{
+					{
+						Host: "198.18.0.1",
+					},
+				},
+				Ports: map[string]*pbcatalog.WorkloadPort{
+					"foo": {
+						Port:     8443,
+						Protocol: pbcatalog.Protocol_PROTOCOL_MESH,
+					},
+				},
+				HealthStatus: pbcatalog.Health_HEALTH_PASSING,
+			},
+		},
+	}
+
+	res := createServiceEndpointsResource(t, data)
+
+	err := ValidateServiceEndpoints(res)
+	require.NoError(t, err)
+}
+
+func TestValidateServiceEndpoints_ParseError(t *testing.T) {
+	// Any type other than the ServiceEndpoints type would work
+	// to cause the error we are expecting
+	data := &pbcatalog.IP{Address: "198.18.0.1"}
+
+	res := createServiceEndpointsResource(t, data)
+
+	err := ValidateServiceEndpoints(res)
+	require.Error(t, err)
+	require.ErrorAs(t, err, &resource.ErrDataParse{})
+}
+
+func TestValidateServiceEndpoints_EndpointInvalid(t *testing.T) {
+	genData := func() *pbcatalog.Endpoint {
+		return &pbcatalog.Endpoint{
+			TargetRef: &pbresource.ID{
+				Type:    WorkloadType,
+				Tenancy: defaultEndpointTenancy,
+				Name:    "foo",
+			},
+			Addresses: []*pbcatalog.WorkloadAddress{
+				{
+					Host:  "198.18.0.1",
+					Ports: []string{"foo"},
+				},
+			},
+			Ports: map[string]*pbcatalog.WorkloadPort{
+				"foo": {
+					Port: 42,
+				},
+			},
+			HealthStatus: pbcatalog.Health_HEALTH_PASSING,
+		}
+	}
+
+	type testCase struct {
+		modify      func(*pbcatalog.Endpoint)
+		validateErr func(t *testing.T, err error)
+	}
+
+	cases := map[string]testCase{
+		"invalid-target": {
+			modify: func(endpoint *pbcatalog.Endpoint) {
+				endpoint.TargetRef.Type = NodeType
+			},
+			validateErr: func(t *testing.T, err error) {
+				require.ErrorIs(t, err, resource.ErrInvalidReferenceType{AllowedType: WorkloadType})
+			},
+		},
+		"invalid-address": {
+			modify: func(endpoint *pbcatalog.Endpoint) {
+				endpoint.Addresses[0].Ports = []string{"bar"}
+			},
+			validateErr: func(t *testing.T, err error) {
+				require.ErrorIs(t, err, errInvalidPortReference{Name: "bar"})
+			},
+		},
+		"no-ports": {
+			modify: func(endpoint *pbcatalog.Endpoint) {
+				endpoint.Ports = nil
+			},
+			validateErr: func(t *testing.T, err error) {
+				require.ErrorIs(t, err, resource.ErrEmpty)
+			},
+		},
+		"invalid-port-name": {
+			modify: func(endpoint *pbcatalog.Endpoint) {
+				endpoint.Ports[""] = &pbcatalog.WorkloadPort{
+					Port: 42,
+				}
+			},
+			validateErr: func(t *testing.T, err error) {
+				var mapErr resource.ErrInvalidMapKey
+				require.ErrorAs(t, err, &mapErr)
+				require.Equal(t, "ports", mapErr.Map)
+				require.Equal(t, "", mapErr.Key)
+				require.Equal(t, resource.ErrEmpty, mapErr.Wrapped)
+			},
+		},
+		"port-0": {
+			modify: func(endpoint *pbcatalog.Endpoint) {
+				endpoint.Ports["foo"].Port = 0
+			},
+			validateErr: func(t *testing.T, err error) {
+				require.ErrorIs(t, err, errInvalidPhysicalPort)
+			},
+		},
+		"port-out-of-range": {
+			modify: func(endpoint *pbcatalog.Endpoint) {
+				endpoint.Ports["foo"].Port = 65536
+			},
+			validateErr: func(t *testing.T, err error) {
+				require.ErrorIs(t, err, errInvalidPhysicalPort)
+			},
+		},
+	}
+
+	for name, tcase := range cases {
+		t.Run(name, func(t *testing.T) {
+			data := genData()
+			tcase.modify(data)
+
+			res := createServiceEndpointsResource(t, &pbcatalog.ServiceEndpoints{
+				Endpoints: []*pbcatalog.Endpoint{
+					data,
+				},
+			})
+
+			err := ValidateServiceEndpoints(res)
+			require.Error(t, err)
+			tcase.validateErr(t, err)
+		})
+	}
+}
diff --git a/internal/catalog/internal/types/service_test.go b/internal/catalog/internal/types/service_test.go
new file mode 100644
index 000000000000..241a49939dee
--- /dev/null
+++ b/internal/catalog/internal/types/service_test.go
@@ -0,0 +1,200 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"testing"
+
+	"github.com/hashicorp/consul/internal/resource"
+	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+func createServiceResource(t *testing.T, data protoreflect.ProtoMessage) *pbresource.Resource {
+	res := &pbresource.Resource{
+		Id: &pbresource.ID{
+			Type: ServiceType,
+			Tenancy: &pbresource.Tenancy{
+				Partition: "default",
+				Namespace: "default",
+				PeerName:  "local",
+			},
+			Name: "test-policy",
+		},
+	}
+
+	var err error
+	res.Data, err = anypb.New(data)
+	require.NoError(t, err)
+	return res
+}
+
+func TestValidateService_Ok(t *testing.T) {
+	data := &pbcatalog.Service{
+		Workloads: &pbcatalog.WorkloadSelector{
+			Names:    []string{"foo", "bar"},
+			Prefixes: []string{"abc-"},
+		},
+		Ports: []*pbcatalog.ServicePort{
+			{
+				TargetPort:  "http-internal",
+				VirtualPort: 42,
+				Protocol:    pbcatalog.Protocol_PROTOCOL_HTTP,
+			},
+		},
+		VirtualIps: []string{"198.18.0.1"},
+	}
+
+	res := createServiceResource(t, data)
+
+	err := ValidateService(res)
+	require.NoError(t, err)
+}
+
+func TestValidateService_ParseError(t *testing.T) {
+	// Any type other than the Service type would work
+	// to cause the error we are expecting
+	data := &pbcatalog.IP{Address: "198.18.0.1"}
+
+	res := createServiceResource(t, data)
+
+	err := ValidateService(res)
+	require.Error(t, err)
+	require.ErrorAs(t, err, &resource.ErrDataParse{})
+}
+
+func TestValidateService_EmptySelector(t *testing.T) {
+	data := &pbcatalog.Service{
+		Ports: []*pbcatalog.ServicePort{
+			{
+				TargetPort: "http-internal",
+				Protocol:   pbcatalog.Protocol_PROTOCOL_HTTP,
+			},
+		},
+	}
+
+	res := createServiceResource(t, data)
+
+	err := ValidateService(res)
+	require.NoError(t, err)
+}
+
+func TestValidateService_InvalidSelector(t *testing.T) {
+	data := &pbcatalog.Service{
+		Workloads: &pbcatalog.WorkloadSelector{
+			Names: []string{""},
+		},
+		Ports: []*pbcatalog.ServicePort{
+			{
+				TargetPort: "http-internal",
+				Protocol:   pbcatalog.Protocol_PROTOCOL_HTTP,
+			},
+		},
+	}
+
+	res := createServiceResource(t, data)
+
+	err := ValidateService(res)
+	expected := resource.ErrInvalidListElement{
+		Name:    "names",
+		Index:   0,
+		Wrapped: resource.ErrEmpty,
+	}
+
+	var actual resource.ErrInvalidListElement
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
+
+func TestValidateService_InvalidTargetPort(t *testing.T) {
+	data := &pbcatalog.Service{
+		Workloads: &pbcatalog.WorkloadSelector{
+			Prefixes: []string{""},
+		},
+		Ports: []*pbcatalog.ServicePort{
+			{
+				TargetPort: "",
+			},
+		},
+	}
+
+	res := createServiceResource(t, data)
+
+	err := ValidateService(res)
+	require.Error(t, err)
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, "target_port", actual.Name)
+	require.Equal(t, resource.ErrEmpty, actual.Wrapped)
+}
+
+func TestValidateService_VirtualPortReused(t *testing.T) {
+	data := &pbcatalog.Service{
+		Workloads: &pbcatalog.WorkloadSelector{
+			Prefixes: []string{""},
+		},
+		Ports: []*pbcatalog.ServicePort{
+			{
+				VirtualPort: 42,
+				TargetPort:  "foo",
+			},
+			{
+				VirtualPort: 42,
+				TargetPort:  "bar",
+			},
+		},
+	}
+
+	res := createServiceResource(t, data)
+
+	err := ValidateService(res)
+	require.Error(t, err)
+	var actual errVirtualPortReused
+	require.ErrorAs(t, err, &actual)
+	require.EqualValues(t, 0, actual.Index)
+	require.EqualValues(t, 42, actual.Value)
+}
+
+func TestValidateService_VirtualPortInvalid(t *testing.T) {
+	data := &pbcatalog.Service{
+		Workloads: &pbcatalog.WorkloadSelector{
+			Prefixes: []string{""},
+		},
+		Ports: []*pbcatalog.ServicePort{
+			{
+				VirtualPort: 100000,
+				TargetPort:  "foo",
+			},
+		},
+	}
+
+	res := createServiceResource(t, data)
+
+	err := ValidateService(res)
+	require.Error(t, err)
+	require.ErrorIs(t, err, errInvalidVirtualPort)
+}
+
+func TestValidateService_InvalidVIP(t *testing.T) {
+	data := &pbcatalog.Service{
+		Workloads: &pbcatalog.WorkloadSelector{
+			Prefixes: []string{""},
+		},
+		Ports: []*pbcatalog.ServicePort{
+			{
+				TargetPort: "foo",
+			},
+		},
+		VirtualIps: []string{"foo"},
+	}
+
+	res := createServiceResource(t, data)
+
+	err := ValidateService(res)
+	require.Error(t, err)
+	require.ErrorIs(t, err, errNotIPAddress)
+}
diff --git a/internal/catalog/internal/types/testdata/errDNSPassingWeightOutOfRange.golden b/internal/catalog/internal/types/testdata/errDNSPassingWeightOutOfRange.golden
new file mode 100644
index 000000000000..c364e6a17571
--- /dev/null
+++ b/internal/catalog/internal/types/testdata/errDNSPassingWeightOutOfRange.golden
@@ -0,0 +1 @@
+DNS passing weight is outside of the range 1 to 65535
\ No newline at end of file
diff --git a/internal/catalog/internal/types/testdata/errDNSWarningWeightOutOfRange.golden b/internal/catalog/internal/types/testdata/errDNSWarningWeightOutOfRange.golden
new file mode 100644
index 000000000000..0457e418b45c
--- /dev/null
+++ b/internal/catalog/internal/types/testdata/errDNSWarningWeightOutOfRange.golden
@@ -0,0 +1 @@
+DNS warning weight is outside the range 0 to 65535
\ No newline at end of file
diff --git a/internal/catalog/internal/types/testdata/errInvalidNodeHostFormat.golden b/internal/catalog/internal/types/testdata/errInvalidNodeHostFormat.golden
new file mode 100644
index 000000000000..6eb2e24ebdf4
--- /dev/null
+++ b/internal/catalog/internal/types/testdata/errInvalidNodeHostFormat.golden
@@ -0,0 +1 @@
+"unix:///node.sock" is not an IP address or a DNS name.
\ No newline at end of file
diff --git a/internal/catalog/internal/types/testdata/errInvalidPhysicalPort.golden b/internal/catalog/internal/types/testdata/errInvalidPhysicalPort.golden
new file mode 100644
index 000000000000..eb971cb8a399
--- /dev/null
+++ b/internal/catalog/internal/types/testdata/errInvalidPhysicalPort.golden
@@ -0,0 +1 @@
+port number is outside the range 1 to 65535
\ No newline at end of file
diff --git a/internal/catalog/internal/types/testdata/errInvalidPortReference.golden b/internal/catalog/internal/types/testdata/errInvalidPortReference.golden
new file mode 100644
index 000000000000..3a165011c512
--- /dev/null
+++ b/internal/catalog/internal/types/testdata/errInvalidPortReference.golden
@@ -0,0 +1 @@
+port with name "http" has not been defined
\ No newline at end of file
diff --git a/internal/catalog/internal/types/testdata/errInvalidVirtualPort.golden b/internal/catalog/internal/types/testdata/errInvalidVirtualPort.golden
new file mode 100644
index 000000000000..2cabd9cb28a0
--- /dev/null
+++ b/internal/catalog/internal/types/testdata/errInvalidVirtualPort.golden
@@ -0,0 +1 @@
+port number is outside the range 0 to 65535
\ No newline at end of file
diff --git a/internal/catalog/internal/types/testdata/errInvalidWorkloadHostFormat.golden b/internal/catalog/internal/types/testdata/errInvalidWorkloadHostFormat.golden
new file mode 100644
index 000000000000..eb57dc2ef03c
--- /dev/null
+++ b/internal/catalog/internal/types/testdata/errInvalidWorkloadHostFormat.golden
@@ -0,0 +1 @@
+"-foo-bar-" is not an IP address, Unix socket path or a DNS name.
\ No newline at end of file
diff --git a/internal/catalog/internal/types/testdata/errLocalityZoneNoRegion.golden b/internal/catalog/internal/types/testdata/errLocalityZoneNoRegion.golden
new file mode 100644
index 000000000000..9a6ec59d0861
--- /dev/null
+++ b/internal/catalog/internal/types/testdata/errLocalityZoneNoRegion.golden
@@ -0,0 +1 @@
+locality region cannot be empty if the zone is set
\ No newline at end of file
diff --git a/internal/catalog/internal/types/testdata/errNotDNSLabel.golden b/internal/catalog/internal/types/testdata/errNotDNSLabel.golden
new file mode 100644
index 000000000000..a5866fbbf0f2
--- /dev/null
+++ b/internal/catalog/internal/types/testdata/errNotDNSLabel.golden
@@ -0,0 +1 @@
+value must match regex: ^[a-z0-9]([a-z0-9\-_]*[a-z0-9])?$
\ No newline at end of file
diff --git a/internal/catalog/internal/types/testdata/errNotIPAddress.golden b/internal/catalog/internal/types/testdata/errNotIPAddress.golden
new file mode 100644
index 000000000000..db33684367df
--- /dev/null
+++ b/internal/catalog/internal/types/testdata/errNotIPAddress.golden
@@ -0,0 +1 @@
+value is not a valid IP address
\ No newline at end of file
diff --git a/internal/catalog/internal/types/testdata/errTooMuchMesh.golden b/internal/catalog/internal/types/testdata/errTooMuchMesh.golden
new file mode 100644
index 000000000000..48ce0969d82d
--- /dev/null
+++ b/internal/catalog/internal/types/testdata/errTooMuchMesh.golden
@@ -0,0 +1 @@
+protocol "mesh" was specified in more than 1 port: [http grpc]
\ No newline at end of file
diff --git a/internal/catalog/internal/types/testdata/errUnixSocketMultiport.golden b/internal/catalog/internal/types/testdata/errUnixSocketMultiport.golden
new file mode 100644
index 000000000000..c28c2f069509
--- /dev/null
+++ b/internal/catalog/internal/types/testdata/errUnixSocketMultiport.golden
@@ -0,0 +1 @@
+Unix socket address references more than one port
\ No newline at end of file
diff --git a/internal/catalog/internal/types/testdata/errVirtualPortReused.golden b/internal/catalog/internal/types/testdata/errVirtualPortReused.golden
new file mode 100644
index 000000000000..5a8c8b799b08
--- /dev/null
+++ b/internal/catalog/internal/types/testdata/errVirtualPortReused.golden
@@ -0,0 +1 @@
+virtual port 8080 was previously assigned at index 3
\ No newline at end of file
diff --git a/internal/catalog/internal/types/validators.go b/internal/catalog/internal/types/validators.go
new file mode 100644
index 000000000000..e9fc08562784
--- /dev/null
+++ b/internal/catalog/internal/types/validators.go
@@ -0,0 +1,209 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"net"
+	"regexp"
+	"strings"
+
+	"github.com/hashicorp/consul/internal/resource"
+	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/hashicorp/go-multierror"
+	"google.golang.org/protobuf/proto"
+)
+
+const (
+	// 108 characters is the max size that Linux (and probably other OSes) will
+	// allow for the length of the Unix socket path.
+	maxUnixSocketPathLen = 108
+)
+
+var (
+	dnsLabelRegex   = `^[a-z0-9]([a-z0-9\-_]*[a-z0-9])?$`
+	dnsLabelMatcher = regexp.MustCompile(dnsLabelRegex)
+)
+
+func isValidIPAddress(host string) bool {
+	return net.ParseIP(host) != nil
+}
+
+func isValidDNSName(host string) bool {
+	if len(host) > 256 {
+		return false
+	}
+
+	labels := strings.Split(host, ".")
+	for _, label := range labels {
+		if !isValidDNSLabel(label) {
+			return false
+		}
+	}
+
+	return true
+}
+
+func isValidDNSLabel(label string) bool {
+	if len(label) > 64 {
+		return false
+	}
+
+	return dnsLabelMatcher.Match([]byte(label))
+}
+
+func isValidUnixSocketPath(host string) bool {
+	if len(host) > maxUnixSocketPathLen || !strings.HasPrefix(host, "unix://") || strings.Contains(host, "\000") {
+		return false
+	}
+
+	return true
+}
+
+func validateWorkloadHost(host string) error {
+	// Check that the host is empty
+	if host == "" {
+		return errInvalidWorkloadHostFormat{Host: host}
+	}
+
+	// Check if the host represents an IP address, unix socket path or a DNS name
+	if !isValidIPAddress(host) && !isValidUnixSocketPath(host) && !isValidDNSName(host) {
+		return errInvalidWorkloadHostFormat{Host: host}
+	}
+
+	return nil
+}
+
+func validateSelector(sel *pbcatalog.WorkloadSelector, allowEmpty bool) error {
+	if sel == nil {
+		if allowEmpty {
+			return nil
+		}
+
+		return resource.ErrEmpty
+	}
+
+	if len(sel.Names) == 0 && len(sel.Prefixes) == 0 {
+		if allowEmpty {
+			return nil
+		}
+
+		return resource.ErrEmpty
+	}
+
+	var err error
+
+	// Validate that all the exact match names are non-empty. This is
+	// mostly for the sake of not admitting values that should always
+	// be meaningless and never actually cause selection of a workload.
+	// This is because workloads must have non-empty names.
+	for idx, name := range sel.Names {
+		if name == "" {
+			err = multierror.Append(err, resource.ErrInvalidListElement{
+				Name:    "names",
+				Index:   idx,
+				Wrapped: resource.ErrEmpty,
+			})
+		}
+	}
+
+	return err
+}
+
+func validateIPAddress(ip string) error {
+	if ip == "" {
+		return resource.ErrEmpty
+	}
+
+	if !isValidIPAddress(ip) {
+		return errNotIPAddress
+	}
+
+	return nil
+}
+
+func validatePortName(name string) error {
+	if name == "" {
+		return resource.ErrEmpty
+	}
+
+	if !isValidDNSLabel(name) {
+		return errNotDNSLabel
+	}
+
+	return nil
+}
+
+// validateWorkloadAddress will validate the WorkloadAddress type. This involves validating
+// the Host within the workload address and the ports references. For ports references we
+// ensure that values in the addresses ports array are present in the set of map keys.
+// Additionally for UNIX socket addresses we ensure that they specify only 1 port either
+// explicitly in their ports references or implicitly by omitting the references and there
+// only being 1 value in the ports map.
+func validateWorkloadAddress(addr *pbcatalog.WorkloadAddress, ports map[string]*pbcatalog.WorkloadPort) error {
+	var err error
+
+	if hostErr := validateWorkloadHost(addr.Host); hostErr != nil {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "host",
+			Wrapped: hostErr,
+		})
+	}
+
+	// Ensure that unix sockets reference exactly 1 port. They may also indirectly reference 1 port
+	// by the workload having only a single port and omitting any explicit port assignment.
+	if isValidUnixSocketPath(addr.Host) &&
+		(len(addr.Ports) > 1 || (len(addr.Ports) == 0 && len(ports) > 1)) {
+		err = multierror.Append(err, errUnixSocketMultiport)
+	}
+
+	// Check that all referenced ports exist
+	for idx, port := range addr.Ports {
+		_, found := ports[port]
+		if !found {
+			err = multierror.Append(err, resource.ErrInvalidListElement{
+				Name:    "ports",
+				Index:   idx,
+				Wrapped: errInvalidPortReference{Name: port},
+			})
+		}
+	}
+	return err
+}
+
+func validateReferenceType(allowed *pbresource.Type, check *pbresource.Type) error {
+	if allowed.Group == check.Group &&
+		allowed.GroupVersion == check.GroupVersion &&
+		allowed.Kind == check.Kind {
+		return nil
+	}
+
+	return resource.ErrInvalidReferenceType{
+		AllowedType: allowed,
+	}
+}
+
+func validateReferenceTenancy(allowed *pbresource.Tenancy, check *pbresource.Tenancy) error {
+	if proto.Equal(allowed, check) {
+		return nil
+	}
+
+	return resource.ErrReferenceTenancyNotEqual
+}
+
+func validateReference(allowedType *pbresource.Type, allowedTenancy *pbresource.Tenancy, check *pbresource.ID) error {
+	var err error
+
+	// Validate the references type is the allowed type.
+	if typeErr := validateReferenceType(allowedType, check.GetType()); typeErr != nil {
+		err = multierror.Append(err, typeErr)
+	}
+
+	// Validate the references tenancy matches the allowed tenancy.
+	if tenancyErr := validateReferenceTenancy(allowedTenancy, check.GetTenancy()); tenancyErr != nil {
+		err = multierror.Append(err, tenancyErr)
+	}
+
+	return err
+}
diff --git a/internal/catalog/internal/types/validators_test.go b/internal/catalog/internal/types/validators_test.go
new file mode 100644
index 000000000000..cd3a12c5c074
--- /dev/null
+++ b/internal/catalog/internal/types/validators_test.go
@@ -0,0 +1,595 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/consul/internal/resource"
+	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/hashicorp/go-multierror"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIsValidDNSLabel(t *testing.T) {
+	type testCase struct {
+		name  string
+		valid bool
+	}
+
+	cases := map[string]testCase{
+		"min-length": {
+			name:  "a",
+			valid: true,
+		},
+		"max-length": {
+			name:  strings.Repeat("a1b2c3d4", 8),
+			valid: true,
+		},
+		"underscores": {
+			name:  "has_underscores",
+			valid: true,
+		},
+		"hyphenated": {
+			name:  "has-hyphen3",
+			valid: true,
+		},
+		"uppercase-not-allowed": {
+			name:  "UPPERCASE",
+			valid: false,
+		},
+		"numeric-start": {
+			name:  "1abc",
+			valid: true,
+		},
+		"underscore-start-not-allowed": {
+			name:  "_abc",
+			valid: false,
+		},
+		"hyphen-start-not-allowed": {
+			name:  "-abc",
+			valid: false,
+		},
+		"underscore-end-not-allowed": {
+			name:  "abc_",
+			valid: false,
+		},
+		"hyphen-end-not-allowed": {
+			name:  "abc-",
+			valid: false,
+		},
+		"unicode-not allowed": {
+			name:  "abc∑",
+			valid: false,
+		},
+		"too-long": {
+			name:  strings.Repeat("aaaaaaaaa", 8),
+			valid: false,
+		},
+		"missing-name": {
+			name:  "",
+			valid: false,
+		},
+	}
+
+	for name, tcase := range cases {
+		t.Run(name, func(t *testing.T) {
+			require.Equal(t, tcase.valid, isValidDNSLabel(tcase.name))
+		})
+	}
+}
+
+func TestIsValidDNSName(t *testing.T) {
+	// TestIsValidDNSLabel tests all of the individual label matching
+	// criteria. This test therefore is more limited to just the extra
+	// validations that IsValidDNSName does. Mainly that it ensures
+	// the overall length is less than 256 and that generally is made
+	// up of DNS labels joined with '.'
+
+	type testCase struct {
+		name  string
+		valid bool
+	}
+
+	cases := map[string]testCase{
+		"valid": {
+			name:  "foo-something.example3.com",
+			valid: true,
+		},
+		"exceeds-max-length": {
+			name:  strings.Repeat("aaaa.aaaa", 29),
+			valid: false,
+		},
+		"invalid-label": {
+			name:  "foo._bar.com",
+			valid: false,
+		},
+	}
+
+	for name, tcase := range cases {
+		t.Run(name, func(t *testing.T) {
+			require.Equal(t, tcase.valid, isValidDNSName(tcase.name))
+		})
+	}
+}
+
+func TestIsValidIPAddress(t *testing.T) {
+	type testCase struct {
+		name  string
+		valid bool
+	}
+
+	cases := map[string]testCase{
+		"ipv4": {
+			name:  "192.168.1.2",
+			valid: true,
+		},
+		"ipv6": {
+			name:  "2001:db8::1",
+			valid: true,
+		},
+		"ipv4-mapped-ipv6": {
+			name:  "::ffff:192.0.2.128",
+			valid: true,
+		},
+		"invalid": {
+			name:  "foo",
+			valid: false,
+		},
+	}
+
+	for name, tcase := range cases {
+		t.Run(name, func(t *testing.T) {
+			require.Equal(t, tcase.valid, isValidIPAddress(tcase.name))
+		})
+	}
+}
+
+func TestIsValidUnixSocketPath(t *testing.T) {
+	type testCase struct {
+		name  string
+		valid bool
+	}
+
+	cases := map[string]testCase{
+		"valid": {
+			name:  "unix:///foo/bar.sock",
+			valid: true,
+		},
+		"missing-prefix": {
+			name:  "/foo/bar.sock",
+			valid: false,
+		},
+		"too-long": {
+			name:  fmt.Sprintf("unix://%s/bar.sock", strings.Repeat("/aaaaaaaaaa", 11)),
+			valid: false,
+		},
+		"nul-in-name": {
+			name:  "unix:///foo/bar\000sock",
+			valid: false,
+		},
+	}
+
+	for name, tcase := range cases {
+		t.Run(name, func(t *testing.T) {
+			require.Equal(t, tcase.valid, isValidUnixSocketPath(tcase.name))
+		})
+	}
+}
+
+func TestValidateHost(t *testing.T) {
+	type testCase struct {
+		name  string
+		valid bool
+	}
+
+	cases := map[string]testCase{
+		"ip-address": {
+			name:  "198.18.0.1",
+			valid: true,
+		},
+		"unix-socket": {
+			name:  "unix:///foo.sock",
+			valid: true,
+		},
+		"dns-name": {
+			name:  "foo.com",
+			valid: true,
+		},
+		"host-empty": {
+			name:  "",
+			valid: false,
+		},
+		"host-invalid": {
+			name:  "unix:///foo/bar\000sock",
+			valid: false,
+		},
+	}
+
+	for name, tcase := range cases {
+		t.Run(name, func(t *testing.T) {
+			err := validateWorkloadHost(tcase.name)
+			if tcase.valid {
+				require.NoError(t, err)
+			} else {
+				require.Error(t, err)
+				require.Equal(t, errInvalidWorkloadHostFormat{Host: tcase.name}, err)
+			}
+		})
+	}
+}
+
+func TestValidateSelector(t *testing.T) {
+	type testCase struct {
+		selector   *pbcatalog.WorkloadSelector
+		allowEmpty bool
+		err        error
+	}
+
+	cases := map[string]testCase{
+		"nil-disallowed": {
+			selector:   nil,
+			allowEmpty: false,
+			err:        resource.ErrEmpty,
+		},
+		"nil-allowed": {
+			selector:   nil,
+			allowEmpty: true,
+			err:        nil,
+		},
+		"empty-allowed": {
+			selector:   &pbcatalog.WorkloadSelector{},
+			allowEmpty: true,
+			err:        nil,
+		},
+		"empty-disallowed": {
+			selector:   &pbcatalog.WorkloadSelector{},
+			allowEmpty: false,
+			err:        resource.ErrEmpty,
+		},
+		"ok": {
+			selector: &pbcatalog.WorkloadSelector{
+				Names:    []string{"foo", "bar"},
+				Prefixes: []string{"foo", "bar"},
+			},
+			allowEmpty: false,
+			err:        nil,
+		},
+		"empty-name": {
+			selector: &pbcatalog.WorkloadSelector{
+				Names:    []string{"", "bar", ""},
+				Prefixes: []string{"foo", "bar"},
+			},
+			allowEmpty: false,
+			err: &multierror.Error{
+				Errors: []error{
+					resource.ErrInvalidListElement{
+						Name:    "names",
+						Index:   0,
+						Wrapped: resource.ErrEmpty,
+					},
+					resource.ErrInvalidListElement{
+						Name:    "names",
+						Index:   2,
+						Wrapped: resource.ErrEmpty,
+					},
+				},
+			},
+		},
+	}
+
+	for name, tcase := range cases {
+		t.Run(name, func(t *testing.T) {
+			err := validateSelector(tcase.selector, tcase.allowEmpty)
+			if tcase.err == nil {
+				require.NoError(t, err)
+			} else {
+				require.Error(t, err)
+				require.Equal(t, tcase.err, err)
+			}
+		})
+	}
+}
+
+func TestValidateIPAddress(t *testing.T) {
+	// this test does not perform extensive validation of what constitutes
+	// an IP address. Instead that is handled in the test for the
+	// isValidIPAddress function
+
+	t.Run("empty", func(t *testing.T) {
+		require.Equal(t, resource.ErrEmpty, validateIPAddress(""))
+	})
+
+	t.Run("invalid", func(t *testing.T) {
+		require.Equal(t, errNotIPAddress, validateIPAddress("foo.com"))
+	})
+
+	t.Run("ok", func(t *testing.T) {
+		require.NoError(t, validateIPAddress("192.168.0.1"))
+	})
+}
+
+func TestValidatePortName(t *testing.T) {
+	// this test does not perform extensive validation of what constitutes
+	// a valid port name. In general the criteria is that it must not
+	// be empty and must be a valid DNS label. Therefore extensive testing
+	// of what it means to be a valid DNS label is performed within the
+	// test for the isValidDNSLabel function.
+
+	t.Run("empty", func(t *testing.T) {
+		require.Equal(t, resource.ErrEmpty, validatePortName(""))
+	})
+
+	t.Run("invalid", func(t *testing.T) {
+		require.Equal(t, errNotDNSLabel, validatePortName("foo.com"))
+	})
+
+	t.Run("ok", func(t *testing.T) {
+		require.NoError(t, validatePortName("http"))
+	})
+}
+
+func TestValidateWorkloadAddress(t *testing.T) {
+	type testCase struct {
+		addr        *pbcatalog.WorkloadAddress
+		ports       map[string]*pbcatalog.WorkloadPort
+		validateErr func(*testing.T, error)
+	}
+
+	cases := map[string]testCase{
+		"invalid-host": {
+			addr: &pbcatalog.WorkloadAddress{
+				Host: "-blarg",
+			},
+			ports: map[string]*pbcatalog.WorkloadPort{},
+			validateErr: func(t *testing.T, err error) {
+				var actual resource.ErrInvalidField
+				require.ErrorAs(t, err, &actual)
+				require.Equal(t, "host", actual.Name)
+			},
+		},
+		"unix-socket-multiport-explicit": {
+			addr: &pbcatalog.WorkloadAddress{
+				Host:  "unix:///foo.sock",
+				Ports: []string{"foo", "bar"},
+			},
+			ports: map[string]*pbcatalog.WorkloadPort{
+				"foo": {},
+				"bar": {},
+			},
+			validateErr: func(t *testing.T, err error) {
+				require.ErrorIs(t, err, errUnixSocketMultiport)
+			},
+		},
+		"unix-socket-multiport-implicit": {
+			addr: &pbcatalog.WorkloadAddress{
+				Host: "unix:///foo.sock",
+			},
+			ports: map[string]*pbcatalog.WorkloadPort{
+				"foo": {},
+				"bar": {},
+			},
+			validateErr: func(t *testing.T, err error) {
+				require.ErrorIs(t, err, errUnixSocketMultiport)
+			},
+		},
+
+		"unix-socket-singleport": {
+			addr: &pbcatalog.WorkloadAddress{
+				Host:  "unix:///foo.sock",
+				Ports: []string{"foo"},
+			},
+			ports: map[string]*pbcatalog.WorkloadPort{
+				"foo": {},
+				"bar": {},
+			},
+		},
+		"invalid-port-reference": {
+			addr: &pbcatalog.WorkloadAddress{
+				Host:  "198.18.0.1",
+				Ports: []string{"foo"},
+			},
+			ports: map[string]*pbcatalog.WorkloadPort{
+				"http": {},
+			},
+			validateErr: func(t *testing.T, err error) {
+				var actual errInvalidPortReference
+				require.ErrorAs(t, err, &actual)
+				require.Equal(t, "foo", actual.Name)
+			},
+		},
+		"ok": {
+			addr: &pbcatalog.WorkloadAddress{
+				Host:     "198.18.0.1",
+				Ports:    []string{"http", "grpc"},
+				External: true,
+			},
+			ports: map[string]*pbcatalog.WorkloadPort{
+				"http": {},
+				"grpc": {},
+			},
+		},
+	}
+
+	for name, tcase := range cases {
+		t.Run(name, func(t *testing.T) {
+			err := validateWorkloadAddress(tcase.addr, tcase.ports)
+			if tcase.validateErr != nil {
+				require.Error(t, err)
+				tcase.validateErr(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestValidateReferenceType(t *testing.T) {
+	allowedType := &pbresource.Type{
+		Group:        "foo",
+		GroupVersion: "v1",
+		Kind:         "Bar",
+	}
+
+	type testCase struct {
+		check *pbresource.Type
+		err   bool
+	}
+
+	cases := map[string]testCase{
+		"ok": {
+			check: allowedType,
+			err:   false,
+		},
+		"group-mismatch": {
+			check: &pbresource.Type{
+				Group:        "food",
+				GroupVersion: "v1",
+				Kind:         "Bar",
+			},
+			err: true,
+		},
+		"group-version-mismatch": {
+			check: &pbresource.Type{
+				Group:        "foo",
+				GroupVersion: "v2",
+				Kind:         "Bar",
+			},
+			err: true,
+		},
+		"kind-mismatch": {
+			check: &pbresource.Type{
+				Group:        "foo",
+				GroupVersion: "v1",
+				Kind:         "Baz",
+			},
+			err: true,
+		},
+	}
+
+	for name, tcase := range cases {
+		t.Run(name, func(t *testing.T) {
+			err := validateReferenceType(allowedType, tcase.check)
+			if tcase.err {
+				require.Equal(t, resource.ErrInvalidReferenceType{AllowedType: allowedType}, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestValidateReferenceTenancy(t *testing.T) {
+	allowedTenancy := &pbresource.Tenancy{
+		Partition: "default",
+		Namespace: "default",
+		PeerName:  "local",
+	}
+
+	type testCase struct {
+		check *pbresource.Tenancy
+		err   bool
+	}
+
+	cases := map[string]testCase{
+		"ok": {
+			check: allowedTenancy,
+			err:   false,
+		},
+		"partition-mismatch": {
+			check: &pbresource.Tenancy{
+				Partition: "food",
+				Namespace: "default",
+				PeerName:  "local",
+			},
+			err: true,
+		},
+		"group-version-mismatch": {
+			check: &pbresource.Tenancy{
+				Partition: "default",
+				Namespace: "v2",
+				PeerName:  "local",
+			},
+			err: true,
+		},
+		"kind-mismatch": {
+			check: &pbresource.Tenancy{
+				Partition: "default",
+				Namespace: "default",
+				PeerName:  "Baz",
+			},
+			err: true,
+		},
+	}
+
+	for name, tcase := range cases {
+		t.Run(name, func(t *testing.T) {
+			err := validateReferenceTenancy(allowedTenancy, tcase.check)
+			if tcase.err {
+				require.Equal(t, resource.ErrReferenceTenancyNotEqual, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestValidateReference(t *testing.T) {
+	allowedTenancy := &pbresource.Tenancy{
+		Partition: "default",
+		Namespace: "default",
+		PeerName:  "local",
+	}
+
+	allowedType := WorkloadType
+
+	type testCase struct {
+		check *pbresource.ID
+		err   error
+	}
+
+	cases := map[string]testCase{
+		"ok": {
+			check: &pbresource.ID{
+				Type:    allowedType,
+				Tenancy: allowedTenancy,
+				Name:    "foo",
+			},
+		},
+		"type-err": {
+			check: &pbresource.ID{
+				Type:    NodeType,
+				Tenancy: allowedTenancy,
+				Name:    "foo",
+			},
+			err: resource.ErrInvalidReferenceType{AllowedType: allowedType},
+		},
+		"tenancy-mismatch": {
+			check: &pbresource.ID{
+				Type: allowedType,
+				Tenancy: &pbresource.Tenancy{
+					Partition: "foo",
+					Namespace: "bar",
+					PeerName:  "baz",
+				},
+				Name: "foo",
+			},
+			err: resource.ErrReferenceTenancyNotEqual,
+		},
+	}
+
+	for name, tcase := range cases {
+		t.Run(name, func(t *testing.T) {
+			err := validateReference(allowedType, allowedTenancy, tcase.check)
+			if tcase.err != nil {
+				require.ErrorIs(t, err, tcase.err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
diff --git a/internal/catalog/internal/types/virtual_ips.go b/internal/catalog/internal/types/virtual_ips.go
index 4a114fc800b3..a27f08df0a77 100644
--- a/internal/catalog/internal/types/virtual_ips.go
+++ b/internal/catalog/internal/types/virtual_ips.go
@@ -7,6 +7,7 @@ import (
 	"github.com/hashicorp/consul/internal/resource"
 	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
 	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/hashicorp/go-multierror"
 )
 
 const (
@@ -27,6 +28,29 @@ func RegisterVirtualIPs(r resource.Registry) {
 	r.Register(resource.Registration{
 		Type:     VirtualIPsV1Alpha1Type,
 		Proto:    &pbcatalog.VirtualIPs{},
-		Validate: nil,
+		Validate: ValidateVirtualIPs,
 	})
 }
+
+func ValidateVirtualIPs(res *pbresource.Resource) error {
+	var vips pbcatalog.VirtualIPs
+
+	if err := res.Data.UnmarshalTo(&vips); err != nil {
+		return resource.NewErrDataParse(&vips, err)
+	}
+
+	var err error
+	for idx, ip := range vips.Ips {
+		if vipErr := validateIPAddress(ip.Address); vipErr != nil {
+			err = multierror.Append(err, resource.ErrInvalidListElement{
+				Name:  "ips",
+				Index: idx,
+				Wrapped: resource.ErrInvalidField{
+					Name:    "address",
+					Wrapped: vipErr,
+				},
+			})
+		}
+	}
+	return err
+}
diff --git a/internal/catalog/internal/types/virtual_ips_test.go b/internal/catalog/internal/types/virtual_ips_test.go
new file mode 100644
index 000000000000..76d55e7ecd74
--- /dev/null
+++ b/internal/catalog/internal/types/virtual_ips_test.go
@@ -0,0 +1,82 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"testing"
+
+	"github.com/hashicorp/consul/internal/resource"
+	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+func createVirtualIPsResource(t *testing.T, data protoreflect.ProtoMessage) *pbresource.Resource {
+	res := &pbresource.Resource{
+		Id: &pbresource.ID{
+			Type: VirtualIPsType,
+			Tenancy: &pbresource.Tenancy{
+				Partition: "default",
+				Namespace: "default",
+				PeerName:  "local",
+			},
+			Name: "test-vip",
+		},
+	}
+
+	var err error
+	res.Data, err = anypb.New(data)
+	require.NoError(t, err)
+	return res
+}
+
+func TestValidateVirtualIPs_Ok(t *testing.T) {
+	data := &pbcatalog.VirtualIPs{
+		Ips: []*pbcatalog.IP{
+			{
+				Address:   "::ffff:192.0.2.128",
+				Generated: true,
+			},
+			{
+				Address:   "10.0.1.42",
+				Generated: false,
+			},
+		},
+	}
+
+	res := createVirtualIPsResource(t, data)
+
+	err := ValidateVirtualIPs(res)
+	require.NoError(t, err)
+}
+
+func TestValidateVirtualIPs_ParseError(t *testing.T) {
+	// Any type other than the VirtualIPs type would work
+	// to cause the error we are expecting
+	data := &pbcatalog.IP{Address: "198.18.0.1"}
+
+	res := createVirtualIPsResource(t, data)
+
+	err := ValidateVirtualIPs(res)
+	require.Error(t, err)
+	require.ErrorAs(t, err, &resource.ErrDataParse{})
+}
+
+func TestValidateVirtualIPs_InvalidIP(t *testing.T) {
+	data := &pbcatalog.VirtualIPs{
+		Ips: []*pbcatalog.IP{
+			{
+				Address: "foo",
+			},
+		},
+	}
+
+	res := createVirtualIPsResource(t, data)
+
+	err := ValidateVirtualIPs(res)
+	require.Error(t, err)
+	require.ErrorIs(t, err, errNotIPAddress)
+}
diff --git a/internal/catalog/internal/types/workload.go b/internal/catalog/internal/types/workload.go
index 0fa742a53294..a0dc7142d1e0 100644
--- a/internal/catalog/internal/types/workload.go
+++ b/internal/catalog/internal/types/workload.go
@@ -4,9 +4,13 @@
 package types
 
 import (
+	"math"
+	"sort"
+
 	"github.com/hashicorp/consul/internal/resource"
 	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
 	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/hashicorp/go-multierror"
 )
 
 const (
@@ -27,6 +31,118 @@ func RegisterWorkload(r resource.Registry) {
 	r.Register(resource.Registration{
 		Type:     WorkloadV1Alpha1Type,
 		Proto:    &pbcatalog.Workload{},
-		Validate: nil,
+		Validate: ValidateWorkload,
 	})
 }
+
+func ValidateWorkload(res *pbresource.Resource) error {
+	var workload pbcatalog.Workload
+
+	if err := res.Data.UnmarshalTo(&workload); err != nil {
+		return resource.NewErrDataParse(&workload, err)
+	}
+
+	var err error
+
+	// Validate that the workload has at least one port
+	if len(workload.Ports) < 1 {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "ports",
+			Wrapped: resource.ErrEmpty,
+		})
+	}
+
+	var meshPorts []string
+
+	// Validate the Workload Ports
+	for portName, port := range workload.Ports {
+		if portNameErr := validatePortName(portName); portNameErr != nil {
+			err = multierror.Append(err, resource.ErrInvalidMapKey{
+				Map:     "ports",
+				Key:     portName,
+				Wrapped: portNameErr,
+			})
+		}
+
+		// disallow port 0 for now
+		if port.Port < 1 || port.Port > math.MaxUint16 {
+			err = multierror.Append(err, resource.ErrInvalidMapValue{
+				Map: "ports",
+				Key: portName,
+				Wrapped: resource.ErrInvalidField{
+					Name:    "port",
+					Wrapped: errInvalidPhysicalPort,
+				},
+			})
+		}
+
+		// Collect the list of mesh ports
+		if port.Protocol == pbcatalog.Protocol_PROTOCOL_MESH {
+			meshPorts = append(meshPorts, portName)
+		}
+	}
+
+	if len(meshPorts) > 1 {
+		sort.Strings(meshPorts)
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name: "ports",
+			Wrapped: errTooMuchMesh{
+				Ports: meshPorts,
+			},
+		})
+	}
+
+	// If the workload is mesh enabled then a valid identity must be provided.
+	// If not mesh enabled but a non-empty identity is provided then we still
+	// validate that its valid.
+	if len(meshPorts) > 0 && workload.Identity == "" {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "identity",
+			Wrapped: resource.ErrMissing,
+		})
+	} else if workload.Identity != "" && !isValidDNSLabel(workload.Identity) {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "identity",
+			Wrapped: errNotDNSLabel,
+		})
+	}
+
+	// Validate workload locality
+	if workload.Locality != nil && workload.Locality.Region == "" && workload.Locality.Zone != "" {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "locality",
+			Wrapped: errLocalityZoneNoRegion,
+		})
+	}
+
+	// Node associations are optional but if present the name should
+	// be a valid DNS label.
+	if workload.NodeName != "" {
+		if !isValidDNSLabel(workload.NodeName) {
+			err = multierror.Append(err, resource.ErrInvalidField{
+				Name:    "node_name",
+				Wrapped: errNotDNSLabel,
+			})
+		}
+	}
+
+	if len(workload.Addresses) < 1 {
+		err = multierror.Append(err, resource.ErrInvalidField{
+			Name:    "addresses",
+			Wrapped: resource.ErrEmpty,
+		})
+	}
+
+	// Validate Workload Addresses
+	for idx, addr := range workload.Addresses {
+		if addrErr := validateWorkloadAddress(addr, workload.Ports); addrErr != nil {
+			err = multierror.Append(err, resource.ErrInvalidListElement{
+				Name:    "addresses",
+				Index:   idx,
+				Wrapped: addrErr,
+			})
+		}
+	}
+
+	return err
+}
diff --git a/internal/catalog/internal/types/workload_test.go b/internal/catalog/internal/types/workload_test.go
new file mode 100644
index 000000000000..03662472f225
--- /dev/null
+++ b/internal/catalog/internal/types/workload_test.go
@@ -0,0 +1,281 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"testing"
+
+	"github.com/hashicorp/consul/internal/resource"
+	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+func createWorkloadResource(t *testing.T, data protoreflect.ProtoMessage) *pbresource.Resource {
+	res := &pbresource.Resource{
+		Id: &pbresource.ID{
+			Type: WorkloadType,
+			Tenancy: &pbresource.Tenancy{
+				Partition: "default",
+				Namespace: "default",
+				PeerName:  "local",
+			},
+			Name: "api-1234",
+		},
+	}
+
+	var err error
+	res.Data, err = anypb.New(data)
+	require.NoError(t, err)
+	return res
+}
+
+func validWorkload() *pbcatalog.Workload {
+	return &pbcatalog.Workload{
+		Addresses: []*pbcatalog.WorkloadAddress{
+			{
+				Host: "127.0.0.1",
+			},
+		},
+		Ports: map[string]*pbcatalog.WorkloadPort{
+			"http": {
+				Port:     8443,
+				Protocol: pbcatalog.Protocol_PROTOCOL_HTTP2,
+			},
+		},
+		NodeName: "foo",
+		Identity: "api",
+		Locality: &pbcatalog.Locality{
+			Region: "us-east-1",
+			Zone:   "1a",
+		},
+	}
+}
+
+func TestValidateWorkload_Ok(t *testing.T) {
+	res := createWorkloadResource(t, validWorkload())
+
+	err := ValidateWorkload(res)
+	require.NoError(t, err)
+}
+
+func TestValidateWorkload_ParseError(t *testing.T) {
+	// Any type other than the Workload type would work
+	// to cause the error we are expecting
+	data := &pbcatalog.IP{Address: "198.18.0.1"}
+
+	res := createWorkloadResource(t, data)
+
+	err := ValidateWorkload(res)
+	require.Error(t, err)
+	require.ErrorAs(t, err, &resource.ErrDataParse{})
+}
+
+func TestValidateWorkload_EmptyAddresses(t *testing.T) {
+	data := validWorkload()
+	data.Addresses = nil
+
+	res := createWorkloadResource(t, data)
+
+	err := ValidateWorkload(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidField{
+		Name:    "addresses",
+		Wrapped: resource.ErrEmpty,
+	}
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
+
+func TestValidateWorkload_InvalidAddress(t *testing.T) {
+	data := validWorkload()
+	data.Addresses[0].Host = "-not-a-host"
+
+	res := createWorkloadResource(t, data)
+
+	err := ValidateWorkload(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidField{
+		Name:    "host",
+		Wrapped: errInvalidWorkloadHostFormat{Host: "-not-a-host"},
+	}
+
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
+
+func TestValidateWorkload_MissingIdentity(t *testing.T) {
+	data := validWorkload()
+	data.Ports["mesh"] = &pbcatalog.WorkloadPort{
+		Port:     9090,
+		Protocol: pbcatalog.Protocol_PROTOCOL_MESH,
+	}
+	data.Identity = ""
+
+	res := createWorkloadResource(t, data)
+
+	err := ValidateWorkload(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidField{
+		Name:    "identity",
+		Wrapped: resource.ErrMissing,
+	}
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
+
+func TestValidateWorkload_InvalidIdentity(t *testing.T) {
+	data := validWorkload()
+	data.Identity = "/foiujd"
+
+	res := createWorkloadResource(t, data)
+
+	err := ValidateWorkload(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidField{
+		Name:    "identity",
+		Wrapped: errNotDNSLabel,
+	}
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
+
+func TestValidateWorkload_InvalidNodeName(t *testing.T) {
+	data := validWorkload()
+	data.NodeName = "/foiujd"
+
+	res := createWorkloadResource(t, data)
+
+	err := ValidateWorkload(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidField{
+		Name:    "node_name",
+		Wrapped: errNotDNSLabel,
+	}
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
+
+func TestValidateWorkload_NoPorts(t *testing.T) {
+	data := validWorkload()
+	data.Ports = nil
+
+	res := createWorkloadResource(t, data)
+
+	err := ValidateWorkload(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidField{
+		Name:    "ports",
+		Wrapped: resource.ErrEmpty,
+	}
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
+
+func TestValidateWorkload_TooMuchMesh(t *testing.T) {
+	data := validWorkload()
+	data.Ports["mesh1"] = &pbcatalog.WorkloadPort{
+		Port:     9090,
+		Protocol: pbcatalog.Protocol_PROTOCOL_MESH,
+	}
+	data.Ports["mesh2"] = &pbcatalog.WorkloadPort{
+		Port:     9091,
+		Protocol: pbcatalog.Protocol_PROTOCOL_MESH,
+	}
+
+	res := createWorkloadResource(t, data)
+
+	err := ValidateWorkload(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidField{
+		Name: "ports",
+		Wrapped: errTooMuchMesh{
+			Ports: []string{"mesh1", "mesh2"},
+		},
+	}
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
+
+func TestValidateWorkload_InvalidPortName(t *testing.T) {
+	data := validWorkload()
+	data.Ports[""] = &pbcatalog.WorkloadPort{
+		Port: 42,
+	}
+
+	res := createWorkloadResource(t, data)
+
+	err := ValidateWorkload(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidMapKey{
+		Map:     "ports",
+		Key:     "",
+		Wrapped: resource.ErrEmpty,
+	}
+	var actual resource.ErrInvalidMapKey
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
+
+func TestValidateWorkload_Port0(t *testing.T) {
+	data := validWorkload()
+	data.Ports["bar"] = &pbcatalog.WorkloadPort{Port: 0}
+
+	res := createWorkloadResource(t, data)
+
+	err := ValidateWorkload(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidField{
+		Name:    "port",
+		Wrapped: errInvalidPhysicalPort,
+	}
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
+
+func TestValidateWorkload_PortTooHigh(t *testing.T) {
+	data := validWorkload()
+	data.Ports["bar"] = &pbcatalog.WorkloadPort{Port: 65536}
+
+	res := createWorkloadResource(t, data)
+
+	err := ValidateWorkload(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidField{
+		Name:    "port",
+		Wrapped: errInvalidPhysicalPort,
+	}
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
+
+func TestValidateWorkload_Locality(t *testing.T) {
+	data := validWorkload()
+	data.Locality = &pbcatalog.Locality{
+		Zone: "1a",
+	}
+
+	res := createWorkloadResource(t, data)
+
+	err := ValidateWorkload(res)
+	require.Error(t, err)
+	expected := resource.ErrInvalidField{
+		Name:    "locality",
+		Wrapped: errLocalityZoneNoRegion,
+	}
+	var actual resource.ErrInvalidField
+	require.ErrorAs(t, err, &actual)
+	require.Equal(t, expected, actual)
+}
diff --git a/internal/resource/errors.go b/internal/resource/errors.go
new file mode 100644
index 000000000000..55fbb95d6ae9
--- /dev/null
+++ b/internal/resource/errors.go
@@ -0,0 +1,114 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package resource
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"google.golang.org/protobuf/reflect/protoreflect"
+)
+
+var (
+	ErrMissing                  = errors.New("missing required field")
+	ErrEmpty                    = errors.New("cannot be empty")
+	ErrReferenceTenancyNotEqual = errors.New("resource tenancy and reference tenancy differ")
+)
+
+type ErrDataParse struct {
+	TypeName string
+	Wrapped  error
+}
+
+func NewErrDataParse(msg protoreflect.ProtoMessage, err error) ErrDataParse {
+	return ErrDataParse{
+		TypeName: string(msg.ProtoReflect().Descriptor().FullName()),
+		Wrapped:  err,
+	}
+}
+
+func (err ErrDataParse) Error() string {
+	return fmt.Sprintf("error parsing resource data as type %q: %s", err.TypeName, err.Wrapped.Error())
+}
+
+func (err ErrDataParse) Unwrap() error {
+	return err.Wrapped
+}
+
+type ErrInvalidField struct {
+	Name    string
+	Wrapped error
+}
+
+func (err ErrInvalidField) Error() string {
+	return fmt.Sprintf("invalid %q field: %v", err.Name, err.Wrapped)
+}
+
+func (err ErrInvalidField) Unwrap() error {
+	return err.Wrapped
+}
+
+type ErrInvalidListElement struct {
+	Name    string
+	Index   int
+	Wrapped error
+}
+
+func (err ErrInvalidListElement) Error() string {
+	return fmt.Sprintf("invalid element at index %d of list %q: %v", err.Index, err.Name, err.Wrapped)
+}
+
+func (err ErrInvalidListElement) Unwrap() error {
+	return err.Wrapped
+}
+
+type ErrInvalidMapValue struct {
+	Map     string
+	Key     string
+	Wrapped error
+}
+
+func (err ErrInvalidMapValue) Error() string {
+	return fmt.Sprintf("invalid value of key %q within %s: %v", err.Key, err.Map, err.Wrapped)
+}
+
+func (err ErrInvalidMapValue) Unwrap() error {
+	return err.Wrapped
+}
+
+type ErrInvalidMapKey struct {
+	Map     string
+	Key     string
+	Wrapped error
+}
+
+func (err ErrInvalidMapKey) Error() string {
+	return fmt.Sprintf("map %s contains an invalid key - %q: %v", err.Map, err.Key, err.Wrapped)
+}
+
+func (err ErrInvalidMapKey) Unwrap() error {
+	return err.Wrapped
+}
+
+type ErrOwnerInvalid struct {
+	ResourceType *pbresource.Type
+	OwnerType    *pbresource.Type
+}
+
+func (err ErrOwnerInvalid) Error() string {
+	return fmt.Sprintf(
+		"resources of type %s cannot be owned by resources with type %s",
+		ToGVK(err.ResourceType),
+		ToGVK(err.OwnerType),
+	)
+}
+
+type ErrInvalidReferenceType struct {
+	AllowedType *pbresource.Type
+}
+
+func (err ErrInvalidReferenceType) Error() string {
+	return fmt.Sprintf("reference must have type %s", ToGVK(err.AllowedType))
+}
diff --git a/internal/resource/errors_test.go b/internal/resource/errors_test.go
new file mode 100644
index 000000000000..5705457d5992
--- /dev/null
+++ b/internal/resource/errors_test.go
@@ -0,0 +1,124 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package resource
+
+import (
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/stretchr/testify/require"
+)
+
+// update allows golden files to be updated based on the current output.
+var update = flag.Bool("update", false, "update golden files")
+
+func goldenError(t *testing.T, name string, actual string) {
+	t.Helper()
+
+	fpath := filepath.Join("testdata", name+".golden")
+
+	if *update {
+		require.NoError(t, os.WriteFile(fpath, []byte(actual), 0644))
+	} else {
+		expected, err := os.ReadFile(fpath)
+		require.NoError(t, err)
+		require.Equal(t, string(expected), actual)
+	}
+}
+
+func TestErrorStrings(t *testing.T) {
+	type testCase struct {
+		err      error
+		expected string
+	}
+
+	fakeWrappedErr := fmt.Errorf("fake test error")
+
+	cond := &pbresource.Condition{}
+
+	cases := map[string]error{
+		"ErrDataParse": NewErrDataParse(cond, fakeWrappedErr),
+		"ErrInvalidField": ErrInvalidField{
+			Name:    "host",
+			Wrapped: fakeWrappedErr,
+		},
+		"ErrInvalidListElement": ErrInvalidListElement{
+			Name:    "addresses",
+			Index:   42,
+			Wrapped: fakeWrappedErr,
+		},
+		"ErrInvalidMapKey": ErrInvalidMapKey{
+			Map:     "ports",
+			Key:     "http",
+			Wrapped: fakeWrappedErr,
+		},
+		"ErrInvalidMapValue": ErrInvalidMapValue{
+			Map:     "ports",
+			Key:     "http",
+			Wrapped: fakeWrappedErr,
+		},
+		"ErrOwnerInvalid": ErrOwnerInvalid{
+			ResourceType: &pbresource.Type{Group: "foo", GroupVersion: "v1", Kind: "bar"},
+			OwnerType:    &pbresource.Type{Group: "other", GroupVersion: "v2", Kind: "something"},
+		},
+		"ErrInvalidReferenceType": ErrInvalidReferenceType{
+			AllowedType: &pbresource.Type{Group: "foo", GroupVersion: "v1", Kind: "bar"},
+		},
+		"ErrMissing":                  ErrMissing,
+		"ErrEmpty":                    ErrEmpty,
+		"ErrReferenceTenancyNotEqual": ErrReferenceTenancyNotEqual,
+	}
+
+	for name, err := range cases {
+		t.Run(name, func(t *testing.T) {
+			goldenError(t, name, err.Error())
+		})
+	}
+}
+
+func TestErrorUnwrap(t *testing.T) {
+	type testCase struct {
+		err      error
+		expected string
+	}
+
+	fakeWrappedErr := fmt.Errorf("fake test error")
+
+	cases := map[string]error{
+		"ErrDataParse": ErrDataParse{
+			TypeName: "hashicorp.consul.catalog.v1alpha1.Service",
+			Wrapped:  fakeWrappedErr,
+		},
+		"ErrInvalidField": ErrInvalidField{
+			Name:    "host",
+			Wrapped: fakeWrappedErr,
+		},
+		"ErrInvalidListElement": ErrInvalidListElement{
+			Name:    "addresses",
+			Index:   42,
+			Wrapped: fakeWrappedErr,
+		},
+		"ErrInvalidMapKey": ErrInvalidMapKey{
+			Map:     "ports",
+			Key:     "http",
+			Wrapped: fakeWrappedErr,
+		},
+		"ErrInvalidMapValue": ErrInvalidMapValue{
+			Map:     "ports",
+			Key:     "http",
+			Wrapped: fakeWrappedErr,
+		},
+	}
+
+	for name, err := range cases {
+		t.Run(name, func(t *testing.T) {
+			require.Equal(t, fakeWrappedErr, errors.Unwrap(err))
+		})
+	}
+}
diff --git a/internal/resource/testdata/ErrDataParse.golden b/internal/resource/testdata/ErrDataParse.golden
new file mode 100644
index 000000000000..b980ddb94b14
--- /dev/null
+++ b/internal/resource/testdata/ErrDataParse.golden
@@ -0,0 +1 @@
+error parsing resource data as type "hashicorp.consul.resource.Condition": fake test error
\ No newline at end of file
diff --git a/internal/resource/testdata/ErrEmpty.golden b/internal/resource/testdata/ErrEmpty.golden
new file mode 100644
index 000000000000..96d45cf55bf7
--- /dev/null
+++ b/internal/resource/testdata/ErrEmpty.golden
@@ -0,0 +1 @@
+cannot be empty
\ No newline at end of file
diff --git a/internal/resource/testdata/ErrInvalidField.golden b/internal/resource/testdata/ErrInvalidField.golden
new file mode 100644
index 000000000000..9b213c55b0c9
--- /dev/null
+++ b/internal/resource/testdata/ErrInvalidField.golden
@@ -0,0 +1 @@
+invalid "host" field: fake test error
\ No newline at end of file
diff --git a/internal/resource/testdata/ErrInvalidListElement.golden b/internal/resource/testdata/ErrInvalidListElement.golden
new file mode 100644
index 000000000000..fa6530e677d4
--- /dev/null
+++ b/internal/resource/testdata/ErrInvalidListElement.golden
@@ -0,0 +1 @@
+invalid element at index 42 of list "addresses": fake test error
\ No newline at end of file
diff --git a/internal/resource/testdata/ErrInvalidMapKey.golden b/internal/resource/testdata/ErrInvalidMapKey.golden
new file mode 100644
index 000000000000..25b72c9d319b
--- /dev/null
+++ b/internal/resource/testdata/ErrInvalidMapKey.golden
@@ -0,0 +1 @@
+map ports contains an invalid key - "http": fake test error
\ No newline at end of file
diff --git a/internal/resource/testdata/ErrInvalidMapValue.golden b/internal/resource/testdata/ErrInvalidMapValue.golden
new file mode 100644
index 000000000000..359d4e69d853
--- /dev/null
+++ b/internal/resource/testdata/ErrInvalidMapValue.golden
@@ -0,0 +1 @@
+invalid value of key "http" within ports: fake test error
\ No newline at end of file
diff --git a/internal/resource/testdata/ErrInvalidReferenceType.golden b/internal/resource/testdata/ErrInvalidReferenceType.golden
new file mode 100644
index 000000000000..c8d57e1efbb0
--- /dev/null
+++ b/internal/resource/testdata/ErrInvalidReferenceType.golden
@@ -0,0 +1 @@
+reference must have type foo.v1.bar
\ No newline at end of file
diff --git a/internal/resource/testdata/ErrMissing.golden b/internal/resource/testdata/ErrMissing.golden
new file mode 100644
index 000000000000..dec5d632b434
--- /dev/null
+++ b/internal/resource/testdata/ErrMissing.golden
@@ -0,0 +1 @@
+missing required field
\ No newline at end of file
diff --git a/internal/resource/testdata/ErrOwnerInvalid.golden b/internal/resource/testdata/ErrOwnerInvalid.golden
new file mode 100644
index 000000000000..c0921c43232e
--- /dev/null
+++ b/internal/resource/testdata/ErrOwnerInvalid.golden
@@ -0,0 +1 @@
+resources of type foo.v1.bar cannot be owned by resources with type other.v2.something
\ No newline at end of file
diff --git a/internal/resource/testdata/ErrReferenceTenancyNotEqual.golden b/internal/resource/testdata/ErrReferenceTenancyNotEqual.golden
new file mode 100644
index 000000000000..be53478d6959
--- /dev/null
+++ b/internal/resource/testdata/ErrReferenceTenancyNotEqual.golden
@@ -0,0 +1 @@
+resource tenancy and reference tenancy differ
\ No newline at end of file

From b9102c295d1136941b59a58317fbdfe0500997c7 Mon Sep 17 00:00:00 2001
From: Chris Thain <32781396+cthain@users.noreply.github.com>
Date: Fri, 12 May 2023 09:52:50 -0700
Subject: [PATCH 75/92] Add Network Filter Support for Envoy Extensions
 (#17325)

---
 agent/xds/extensionruntime/runtime_config.go  |  11 +
 .../extensioncommon/list_envoy_extender.go    | 268 ++++++++++++++++++
 .../extensioncommon/runtime_config.go         |   3 +
 3 files changed, 282 insertions(+)
 create mode 100644 envoyextensions/extensioncommon/list_envoy_extender.go

diff --git a/agent/xds/extensionruntime/runtime_config.go b/agent/xds/extensionruntime/runtime_config.go
index 31f2ce64265e..455c32001ded 100644
--- a/agent/xds/extensionruntime/runtime_config.go
+++ b/agent/xds/extensionruntime/runtime_config.go
@@ -92,6 +92,7 @@ func GetRuntimeConfigurations(cfgSnap *proxycfg.ConfigSnapshot) map[api.Compound
 				Upstreams:      nil,
 				LocalUpstreams: upstreamMap,
 				Kind:           kind,
+				Protocol:       proxyConfigProtocol(cfgSnap.Proxy.Config),
 			}
 			extensionConfigurationsMap[localSvc] = append(extensionConfigurationsMap[localSvc], extCfg)
 		}
@@ -131,6 +132,7 @@ func GetRuntimeConfigurations(cfgSnap *proxycfg.ConfigSnapshot) map[api.Compound
 				Kind:           kind,
 				ServiceName:    svc,
 				Upstreams:      upstreamMap,
+				Protocol:       proxyConfigProtocol(cfgSnap.Proxy.Config),
 			}
 			extensionConfigurationsMap[svc] = append(extensionConfigurationsMap[svc], extCfg)
 		}
@@ -158,3 +160,12 @@ func upstreamIDToCompoundServiceName(uid proxycfg.UpstreamID) api.CompoundServic
 func convertEnvoyExtensions(structExtensions structs.EnvoyExtensions) []api.EnvoyExtension {
 	return structExtensions.ToAPI()
 }
+
+func proxyConfigProtocol(cfg map[string]any) string {
+	if p, exists := cfg["protocol"]; exists {
+		if protocol, ok := p.(string); ok {
+			return protocol
+		}
+	}
+	return ""
+}
diff --git a/envoyextensions/extensioncommon/list_envoy_extender.go b/envoyextensions/extensioncommon/list_envoy_extender.go
new file mode 100644
index 000000000000..6c491a5d0078
--- /dev/null
+++ b/envoyextensions/extensioncommon/list_envoy_extender.go
@@ -0,0 +1,268 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package extensioncommon
+
+import (
+	"fmt"
+	"strings"
+
+	envoy_cluster_v3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
+	envoy_listener_v3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
+	envoy_route_v3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	"github.com/hashicorp/go-multierror"
+
+	"github.com/hashicorp/consul/api"
+	"github.com/hashicorp/consul/envoyextensions/xdscommon"
+)
+
+type ClusterMap map[string]*envoy_cluster_v3.Cluster
+type ListenerMap map[string]*envoy_listener_v3.Listener
+type RouteMap map[string]*envoy_route_v3.RouteConfiguration
+
+// ListExtension is the interface that each user of ListEnvoyExtender must implement. It
+// is responsible for modifying the xDS structures based on only the state of the extension.
+type ListExtension interface {
+	// CanApply determines if the extension can mutate resources for the given runtime configuration.
+	CanApply(*RuntimeConfig) bool
+
+	// PatchRoutes patches routes to include the custom Envoy configuration
+	// required to integrate with the built in extension template.
+	PatchRoutes(*RuntimeConfig, RouteMap) (RouteMap, error)
+
+	// PatchClusters patches clusters to include the custom Envoy configuration
+	// required to integrate with the built in extension template.
+	PatchClusters(*RuntimeConfig, ClusterMap) (ClusterMap, error)
+
+	// PatchFilters patches Envoy filters to include the custom Envoy
+	// configuration required to integrate with the built in extension template.
+	PatchFilters(*RuntimeConfig, []*envoy_listener_v3.Filter) ([]*envoy_listener_v3.Filter, error)
+}
+
+var _ EnvoyExtender = (*ListEnvoyExtender)(nil)
+
+// ListEnvoyExtender provides convenience functions for iterating and applying modifications
+// to lists of Envoy resources.
+type ListEnvoyExtender struct {
+	Extension ListExtension
+}
+
+func (*ListEnvoyExtender) Validate(config *RuntimeConfig) error {
+	return nil
+}
+
+func (e *ListEnvoyExtender) Extend(resources *xdscommon.IndexedResources, config *RuntimeConfig) (*xdscommon.IndexedResources, error) {
+	var resultErr error
+
+	switch config.Kind {
+	case api.ServiceKindTerminatingGateway, api.ServiceKindConnectProxy:
+	default:
+		return resources, nil
+	}
+
+	if !e.Extension.CanApply(config) {
+		return resources, nil
+	}
+
+	clusters := make(ClusterMap)
+	routes := make(RouteMap)
+	listeners := make(ListenerMap)
+	isUpstream := config.IsUpstream()
+
+	for _, indexType := range []string{
+		xdscommon.ListenerType,
+		xdscommon.RouteType,
+		xdscommon.ClusterType,
+	} {
+		for nameOrSNI, msg := range resources.Index[indexType] {
+			switch resource := msg.(type) {
+			case *envoy_cluster_v3.Cluster:
+				// If the Envoy extension configuration is for an upstream service, the Cluster's
+				// name must match the upstream service's SNI.
+				if isUpstream && !config.MatchesUpstreamServiceSNI(nameOrSNI) {
+					continue
+				}
+
+				// If the extension's config is for an an inbound listener, the Cluster's name
+				// must be xdscommon.LocalAppClusterName.
+				if !isUpstream && nameOrSNI == xdscommon.LocalAppClusterName {
+					continue
+				}
+
+				clusters[nameOrSNI] = resource
+
+			case *envoy_listener_v3.Listener:
+				listeners[nameOrSNI] = resource
+
+			case *envoy_route_v3.RouteConfiguration:
+				// If the Envoy extension configuration is for an upstream service, the route's
+				// name must match the upstream service's Envoy ID.
+				matchesEnvoyID := config.EnvoyID() == nameOrSNI
+				if isUpstream && !config.MatchesUpstreamServiceSNI(nameOrSNI) && !matchesEnvoyID {
+					continue
+				}
+
+				// There aren't routes for inbound services.
+				if !isUpstream {
+					continue
+				}
+
+				routes[nameOrSNI] = resource
+
+			default:
+				resultErr = multierror.Append(resultErr, fmt.Errorf("unsupported type was skipped: %T", resource))
+			}
+		}
+	}
+
+	patchedClusters, err := e.Extension.PatchClusters(config, clusters)
+	if err == nil {
+		for nameOrSNI, cluster := range patchedClusters {
+			resources.Index[xdscommon.ClusterType][nameOrSNI] = cluster
+		}
+	} else {
+		resultErr = multierror.Append(resultErr, fmt.Errorf("error patching clusters: %w", err))
+	}
+
+	patchedListeners, err := e.patchListeners(config, listeners)
+	if err == nil {
+		for nameOrSNI, listener := range patchedListeners {
+			resources.Index[xdscommon.ListenerType][nameOrSNI] = listener
+		}
+	} else {
+		resultErr = multierror.Append(resultErr, fmt.Errorf("error patching listeners: %w", err))
+	}
+
+	patchedRoutes, err := e.Extension.PatchRoutes(config, routes)
+	if err == nil {
+		for nameOrSNI, route := range patchedRoutes {
+			resources.Index[xdscommon.RouteType][nameOrSNI] = route
+		}
+	} else {
+		resultErr = multierror.Append(resultErr, fmt.Errorf("error patching routes: %w", err))
+	}
+
+	return resources, resultErr
+}
+
+func (e ListEnvoyExtender) patchListeners(config *RuntimeConfig, m ListenerMap) (ListenerMap, error) {
+	switch config.Kind {
+	case api.ServiceKindTerminatingGateway:
+		return e.patchTerminatingGatewayListeners(config, m)
+	case api.ServiceKindConnectProxy:
+		return e.patchConnectProxyListeners(config, m)
+	}
+	return m, nil
+}
+
+func (e ListEnvoyExtender) patchTerminatingGatewayListeners(config *RuntimeConfig, l ListenerMap) (ListenerMap, error) {
+	// We don't support directly targeting terminating gateways with extensions.
+	if !config.IsUpstream() {
+		return l, nil
+	}
+
+	var resultErr error
+	for _, listener := range l {
+		for _, filterChain := range listener.FilterChains {
+			sni := getSNI(filterChain)
+
+			if sni == "" {
+				continue
+			}
+
+			// The filter chain's SNI must match the upstream service's SNI.
+			if !config.MatchesUpstreamServiceSNI(sni) {
+				continue
+			}
+
+			patchedFilters, err := e.Extension.PatchFilters(config, filterChain.Filters)
+			if err == nil {
+				filterChain.Filters = patchedFilters
+			} else {
+				resultErr = multierror.Append(resultErr, fmt.Errorf("error patching listener filters for %q: %w", sni, err))
+				continue
+			}
+		}
+	}
+
+	return l, resultErr
+}
+
+func (e ListEnvoyExtender) patchConnectProxyListeners(config *RuntimeConfig, l ListenerMap) (ListenerMap, error) {
+	var resultErr error
+
+	isUpstream := config.IsUpstream()
+	for nameOrSNI, listener := range l {
+		envoyID := ""
+		if id, _, found := strings.Cut(listener.Name, ":"); found {
+			envoyID = id
+		}
+
+		if isUpstream && envoyID == xdscommon.OutboundListenerName {
+			patchedListener, err := e.patchTProxyListener(config, listener)
+			if err == nil {
+				l[nameOrSNI] = patchedListener
+			} else {
+				resultErr = multierror.Append(resultErr, fmt.Errorf("error patching TProxy listener %q: %w", nameOrSNI, err))
+			}
+			continue
+		}
+
+		// If the Envoy extension configuration is for an upstream service, the listener's
+		// name must match the upstream service's EnvoyID or be the outbound listener.
+		if isUpstream && envoyID != config.EnvoyID() {
+			continue
+		}
+
+		// If the Envoy extension configuration is for inbound resources, the
+		// listener must be named xdscommon.PublicListenerName.
+		if config.IsLocal() && envoyID != xdscommon.PublicListenerName {
+			continue
+		}
+
+		patchedListener, err := e.patchConnectProxyListener(config, listener)
+		if err == nil {
+			l[nameOrSNI] = patchedListener
+		} else {
+			resultErr = multierror.Append(resultErr, fmt.Errorf("error patching connect proxy listener %q: %w", nameOrSNI, err))
+		}
+	}
+
+	return l, resultErr
+}
+
+func (e ListEnvoyExtender) patchConnectProxyListener(config *RuntimeConfig, l *envoy_listener_v3.Listener) (*envoy_listener_v3.Listener, error) {
+	var resultErr error
+
+	for _, filterChain := range l.FilterChains {
+		patchedFilters, err := e.Extension.PatchFilters(config, filterChain.Filters)
+		if err == nil {
+			filterChain.Filters = patchedFilters
+		} else {
+			resultErr = multierror.Append(resultErr, fmt.Errorf("error patching filters: %w", err))
+		}
+	}
+	return l, resultErr
+}
+
+func (e ListEnvoyExtender) patchTProxyListener(config *RuntimeConfig, l *envoy_listener_v3.Listener) (*envoy_listener_v3.Listener, error) {
+	var resultErr error
+
+	vip := config.Upstreams[config.ServiceName].VIP
+
+	for _, filterChain := range l.FilterChains {
+		match := filterChainTProxyMatch(vip, filterChain)
+		if !match {
+			continue
+		}
+
+		patchedFilters, err := e.Extension.PatchFilters(config, filterChain.Filters)
+		if err == nil {
+			filterChain.Filters = patchedFilters
+		} else {
+			resultErr = multierror.Append(resultErr, fmt.Errorf("error patching filters: %w", err))
+		}
+	}
+
+	return l, resultErr
+}
diff --git a/envoyextensions/extensioncommon/runtime_config.go b/envoyextensions/extensioncommon/runtime_config.go
index d36f389ac4f3..b9ab1b38c343 100644
--- a/envoyextensions/extensioncommon/runtime_config.go
+++ b/envoyextensions/extensioncommon/runtime_config.go
@@ -44,6 +44,9 @@ type RuntimeConfig struct {
 	// Kind is mode the local Envoy proxy is running in. For now, only connect proxy and
 	// terminating gateways are supported.
 	Kind api.ServiceKind
+
+	// Protocol is the protocol configured for the local service. It may be empty which implies tcp.
+	Protocol string
 }
 
 // IsLocal indicates if the extension configuration is for the proxy's local service.

From 2edfda998a8a3ca5db28459ad99df10eb5269991 Mon Sep 17 00:00:00 2001
From: cskh <hui.kang@hashicorp.com>
Date: Fri, 12 May 2023 13:03:30 -0400
Subject: [PATCH 76/92] consul-container: mitigate the drift from ent repo
 (#17323)

---
 .../consul-container/libs/utils/version.go    |  2 +-
 .../test/upgrade/basic/basic_test.go          | 27 +++----
 .../upgrade/basic/fullstopupgrade_test.go     | 32 ++++----
 .../test/upgrade/basic/healthcheck_test.go    |  4 +-
 .../consul-container/test/upgrade/common.go   | 81 +++++++++++++++++++
 .../test/upgrade/peering/peering_http_test.go | 76 +----------------
 6 files changed, 114 insertions(+), 108 deletions(-)
 create mode 100644 test/integration/consul-container/test/upgrade/common.go

diff --git a/test/integration/consul-container/libs/utils/version.go b/test/integration/consul-container/libs/utils/version.go
index 6a41c5b92e9a..04f872e24698 100644
--- a/test/integration/consul-container/libs/utils/version.go
+++ b/test/integration/consul-container/libs/utils/version.go
@@ -57,7 +57,7 @@ func GetLatestImageName() string {
 
 func DockerImage(image, version string) string {
 	v := image + ":" + version
-	if image == DefaultImageNameENT && isSemVer(version) {
+	if strings.Contains(image, DefaultImageNameENT) && isSemVer(version) {
 		// Enterprise versions get a suffix.
 		v += ImageVersionSuffixENT
 	}
diff --git a/test/integration/consul-container/test/upgrade/basic/basic_test.go b/test/integration/consul-container/test/upgrade/basic/basic_test.go
index e9483f111693..40406caebeef 100644
--- a/test/integration/consul-container/test/upgrade/basic/basic_test.go
+++ b/test/integration/consul-container/test/upgrade/basic/basic_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/hashicorp/consul/sdk/testutil/retry"
 	libcluster "github.com/hashicorp/consul/test/integration/consul-container/libs/cluster"
 	libservice "github.com/hashicorp/consul/test/integration/consul-container/libs/service"
+	"github.com/hashicorp/consul/test/integration/consul-container/libs/topology"
 	"github.com/hashicorp/consul/test/integration/consul-container/libs/utils"
 )
 
@@ -21,21 +22,19 @@ import (
 func TestBasic(t *testing.T) {
 	t.Parallel()
 
-	configCtx := libcluster.NewBuildContext(t, libcluster.BuildOptions{
-		ConsulImageName: utils.GetLatestImageName(),
-		ConsulVersion:   utils.LatestVersion,
-	})
-
 	const numServers = 1
+	buildOpts := &libcluster.BuildOptions{
+		ConsulImageName:      utils.GetLatestImageName(),
+		ConsulVersion:        utils.LatestVersion,
+		Datacenter:           "dc1",
+		InjectAutoEncryption: true,
+	}
 
-	serverConf := libcluster.NewConfigBuilder(configCtx).
-		Bootstrap(numServers).
-		ToAgentConfig(t)
-	t.Logf("Cluster config:\n%s", serverConf.JSON)
-	require.Equal(t, utils.LatestVersion, serverConf.Version) // TODO: remove
-
-	cluster, err := libcluster.NewN(t, *serverConf, numServers)
-	require.NoError(t, err)
+	cluster, _, _ := topology.NewCluster(t, &topology.ClusterConfig{
+		NumServers:                1,
+		BuildOpts:                 buildOpts,
+		ApplyDefaultProxySettings: true,
+	})
 
 	client := cluster.APIClient(0)
 
@@ -53,7 +52,7 @@ func TestBasic(t *testing.T) {
 
 	// upgrade the cluster to the Target version
 	t.Logf("initiating standard upgrade to version=%q", utils.TargetVersion)
-	err = cluster.StandardUpgrade(t, context.Background(), utils.GetTargetImageName(), utils.TargetVersion)
+	err := cluster.StandardUpgrade(t, context.Background(), utils.GetTargetImageName(), utils.TargetVersion)
 
 	require.NoError(t, err)
 	libcluster.WaitForLeader(t, cluster, client)
diff --git a/test/integration/consul-container/test/upgrade/basic/fullstopupgrade_test.go b/test/integration/consul-container/test/upgrade/basic/fullstopupgrade_test.go
index 51ad8ea745d9..e05155c63907 100644
--- a/test/integration/consul-container/test/upgrade/basic/fullstopupgrade_test.go
+++ b/test/integration/consul-container/test/upgrade/basic/fullstopupgrade_test.go
@@ -16,6 +16,7 @@ import (
 	"github.com/hashicorp/consul/sdk/testutil/retry"
 	libcluster "github.com/hashicorp/consul/test/integration/consul-container/libs/cluster"
 	libservice "github.com/hashicorp/consul/test/integration/consul-container/libs/service"
+	"github.com/hashicorp/consul/test/integration/consul-container/libs/topology"
 	"github.com/hashicorp/consul/test/integration/consul-container/libs/utils"
 )
 
@@ -50,24 +51,19 @@ func TestStandardUpgradeToTarget_fromLatest(t *testing.T) {
 	)
 
 	run := func(t *testing.T, tc testcase) {
-		configCtx := libcluster.NewBuildContext(t, libcluster.BuildOptions{
-			ConsulImageName: utils.GetLatestImageName(),
-			ConsulVersion:   tc.oldVersion,
-		})
-
-		const (
-			numServers = 1
-		)
-
-		serverConf := libcluster.NewConfigBuilder(configCtx).
-			Bootstrap(numServers).
-			ToAgentConfig(t)
-		t.Logf("Cluster config:\n%s", serverConf.JSON)
-		require.Equal(t, tc.oldVersion, serverConf.Version) // TODO: remove
-
-		cluster, err := libcluster.NewN(t, *serverConf, numServers)
-		require.NoError(t, err)
+		const numServers = 1
+		buildOpts := &libcluster.BuildOptions{
+			ConsulImageName:      utils.GetLatestImageName(),
+			ConsulVersion:        utils.LatestVersion,
+			Datacenter:           "dc1",
+			InjectAutoEncryption: true,
+		}
 
+		cluster, _, _ := topology.NewCluster(t, &topology.ClusterConfig{
+			NumServers:                numServers,
+			BuildOpts:                 buildOpts,
+			ApplyDefaultProxySettings: true,
+		})
 		client := cluster.APIClient(0)
 
 		libcluster.WaitForLeader(t, cluster, client)
@@ -80,7 +76,7 @@ func TestStandardUpgradeToTarget_fromLatest(t *testing.T) {
 		require.NoError(t, client.Agent().ServiceRegister(
 			&api.AgentServiceRegistration{Name: serviceName, Port: 9998},
 		))
-		err = goretry.Do(
+		err := goretry.Do(
 			func() error {
 				ch, errCh := libservice.ServiceHealthBlockingQuery(client, serviceName, index)
 				select {
diff --git a/test/integration/consul-container/test/upgrade/basic/healthcheck_test.go b/test/integration/consul-container/test/upgrade/basic/healthcheck_test.go
index 1a6116e095c5..fde78c182ea3 100644
--- a/test/integration/consul-container/test/upgrade/basic/healthcheck_test.go
+++ b/test/integration/consul-container/test/upgrade/basic/healthcheck_test.go
@@ -85,7 +85,7 @@ func TestMixedServersMajorityTargetGAClient(t *testing.T) {
 func testMixedServersGAClient(t *testing.T, majorityIsTarget bool) {
 	var (
 		latestOpts = libcluster.BuildOptions{
-			ConsulImageName: utils.LatestImageName,
+			ConsulImageName: utils.GetLatestImageName(),
 			ConsulVersion:   utils.LatestVersion,
 		}
 		targetOpts = libcluster.BuildOptions{
@@ -137,7 +137,7 @@ func testMixedServersGAClient(t *testing.T, majorityIsTarget bool) {
 	cluster, err := libcluster.New(t, configs)
 	require.NoError(t, err)
 
-	libservice.ClientsCreate(t, numClients, utils.LatestImageName, utils.LatestVersion, cluster)
+	libservice.ClientsCreate(t, numClients, utils.GetLatestImageName(), utils.LatestVersion, cluster)
 
 	client := cluster.APIClient(0)
 
diff --git a/test/integration/consul-container/test/upgrade/common.go b/test/integration/consul-container/test/upgrade/common.go
new file mode 100644
index 000000000000..44bdcca25180
--- /dev/null
+++ b/test/integration/consul-container/test/upgrade/common.go
@@ -0,0 +1,81 @@
+package upgrade
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/consul/api"
+	"github.com/hashicorp/consul/test/integration/consul-container/libs/cluster"
+	libservice "github.com/hashicorp/consul/test/integration/consul-container/libs/service"
+	"github.com/hashicorp/consul/test/integration/consul-container/libs/utils"
+)
+
+// CreateAndRegisterStaticClientSidecarWith2Upstreams creates a static-client that
+// has two upstreams connecting to destinationNames: local bind addresses are 5000
+// and 5001.
+// - crossCluster: true if upstream is in another cluster
+func CreateAndRegisterStaticClientSidecarWith2Upstreams(c *cluster.Cluster, destinationNames []string, crossCluster bool) (*libservice.ConnectContainer, error) {
+	// Do some trickery to ensure that partial completion is correctly torn
+	// down, but successful execution is not.
+	var deferClean utils.ResettableDefer
+	defer deferClean.Execute()
+
+	node := c.Servers()[0]
+	mgwMode := api.MeshGatewayModeLocal
+
+	// Register the static-client service and sidecar first to prevent race with sidecar
+	// trying to get xDS before it's ready
+	req := &api.AgentServiceRegistration{
+		Name: libservice.StaticClientServiceName,
+		Port: 8080,
+		Connect: &api.AgentServiceConnect{
+			SidecarService: &api.AgentServiceRegistration{
+				Proxy: &api.AgentServiceConnectProxyConfig{
+					Upstreams: []api.Upstream{
+						{
+							DestinationName:  destinationNames[0],
+							LocalBindAddress: "0.0.0.0",
+							LocalBindPort:    cluster.ServiceUpstreamLocalBindPort,
+						},
+						{
+							DestinationName:  destinationNames[1],
+							LocalBindAddress: "0.0.0.0",
+							LocalBindPort:    cluster.ServiceUpstreamLocalBindPort2,
+						},
+					},
+				},
+			},
+		},
+	}
+
+	if crossCluster {
+		for _, upstream := range req.Connect.SidecarService.Proxy.Upstreams {
+			upstream.MeshGateway = api.MeshGatewayConfig{
+				Mode: mgwMode,
+			}
+		}
+	}
+
+	if err := node.GetClient().Agent().ServiceRegister(req); err != nil {
+		return nil, err
+	}
+
+	// Create a service and proxy instance
+	sidecarCfg := libservice.SidecarConfig{
+		Name:      fmt.Sprintf("%s-sidecar", libservice.StaticClientServiceName),
+		ServiceID: libservice.StaticClientServiceName,
+	}
+
+	clientConnectProxy, err := libservice.NewConnectService(context.Background(), sidecarCfg, []int{cluster.ServiceUpstreamLocalBindPort, cluster.ServiceUpstreamLocalBindPort2}, node)
+	if err != nil {
+		return nil, err
+	}
+	deferClean.Add(func() {
+		_ = clientConnectProxy.Terminate()
+	})
+
+	// disable cleanup functions now that we have an object with a Terminate() function
+	deferClean.Reset()
+
+	return clientConnectProxy, nil
+}
diff --git a/test/integration/consul-container/test/upgrade/peering/peering_http_test.go b/test/integration/consul-container/test/upgrade/peering/peering_http_test.go
index e1cffe4700c1..86feccc8fda0 100644
--- a/test/integration/consul-container/test/upgrade/peering/peering_http_test.go
+++ b/test/integration/consul-container/test/upgrade/peering/peering_http_test.go
@@ -12,10 +12,10 @@ import (
 
 	"github.com/hashicorp/consul/api"
 	libassert "github.com/hashicorp/consul/test/integration/consul-container/libs/assert"
-	"github.com/hashicorp/consul/test/integration/consul-container/libs/cluster"
 	libservice "github.com/hashicorp/consul/test/integration/consul-container/libs/service"
 	libtopology "github.com/hashicorp/consul/test/integration/consul-container/libs/topology"
 	"github.com/hashicorp/consul/test/integration/consul-container/libs/utils"
+	"github.com/hashicorp/consul/test/integration/consul-container/test/upgrade"
 )
 
 func TestPeering_Basic(t *testing.T) {
@@ -101,7 +101,7 @@ func TestPeering_HTTPResolverAndFailover(t *testing.T) {
 		},
 	}))
 
-	clientConnectProxy, err := createAndRegisterStaticClientSidecarWith2Upstreams(dialingCluster,
+	clientConnectProxy, err := upgrade.CreateAndRegisterStaticClientSidecarWith2Upstreams(dialingCluster,
 		[]string{libservice.StaticServerServiceName, "peer-static-server"}, true,
 	)
 	require.NoErrorf(t, err, "error creating client connect proxy in cluster %s", dialingCluster.NetworkName)
@@ -194,7 +194,7 @@ func TestPeering_HTTPResolverAndSplitter(t *testing.T) {
 		},
 	}))
 
-	clientConnectProxy, err := createAndRegisterStaticClientSidecarWith2Upstreams(dialingCluster,
+	clientConnectProxy, err := upgrade.CreateAndRegisterStaticClientSidecarWith2Upstreams(dialingCluster,
 		[]string{"split-static-server", "peer-static-server"}, true,
 	)
 	require.NoErrorf(t, err, "creating client connect proxy in cluster %s", dialingCluster.NetworkName)
@@ -332,73 +332,3 @@ func peeringPostUpgradeValidation(t *testing.T, dialing *libtopology.BuiltCluste
 	libassert.HTTPServiceEchoes(t, "localhost", port, "")
 	libassert.AssertFortioName(t, fmt.Sprintf("http://localhost:%d", port), libservice.StaticServerServiceName, "")
 }
-
-// createAndRegisterStaticClientSidecarWith2Upstreams creates a static-client that
-// has two upstreams connecting to destinationNames: local bind addresses are 5000
-// and 5001.
-// - crossCluster: true if upstream is in another cluster
-func createAndRegisterStaticClientSidecarWith2Upstreams(c *cluster.Cluster, destinationNames []string, crossCluster bool) (*libservice.ConnectContainer, error) {
-	// Do some trickery to ensure that partial completion is correctly torn
-	// down, but successful execution is not.
-	var deferClean utils.ResettableDefer
-	defer deferClean.Execute()
-
-	node := c.Servers()[0]
-	mgwMode := api.MeshGatewayModeLocal
-
-	// Register the static-client service and sidecar first to prevent race with sidecar
-	// trying to get xDS before it's ready
-	req := &api.AgentServiceRegistration{
-		Name: libservice.StaticClientServiceName,
-		Port: 8080,
-		Connect: &api.AgentServiceConnect{
-			SidecarService: &api.AgentServiceRegistration{
-				Proxy: &api.AgentServiceConnectProxyConfig{
-					Upstreams: []api.Upstream{
-						{
-							DestinationName:  destinationNames[0],
-							LocalBindAddress: "0.0.0.0",
-							LocalBindPort:    cluster.ServiceUpstreamLocalBindPort,
-						},
-						{
-							DestinationName:  destinationNames[1],
-							LocalBindAddress: "0.0.0.0",
-							LocalBindPort:    cluster.ServiceUpstreamLocalBindPort2,
-						},
-					},
-				},
-			},
-		},
-	}
-
-	if crossCluster {
-		for _, upstream := range req.Connect.SidecarService.Proxy.Upstreams {
-			upstream.MeshGateway = api.MeshGatewayConfig{
-				Mode: mgwMode,
-			}
-		}
-	}
-
-	if err := node.GetClient().Agent().ServiceRegister(req); err != nil {
-		return nil, err
-	}
-
-	// Create a service and proxy instance
-	sidecarCfg := libservice.SidecarConfig{
-		Name:      fmt.Sprintf("%s-sidecar", libservice.StaticClientServiceName),
-		ServiceID: libservice.StaticClientServiceName,
-	}
-
-	clientConnectProxy, err := libservice.NewConnectService(context.Background(), sidecarCfg, []int{cluster.ServiceUpstreamLocalBindPort, cluster.ServiceUpstreamLocalBindPort2}, node)
-	if err != nil {
-		return nil, err
-	}
-	deferClean.Add(func() {
-		_ = clientConnectProxy.Terminate()
-	})
-
-	// disable cleanup functions now that we have an object with a Terminate() function
-	deferClean.Reset()
-
-	return clientConnectProxy, nil
-}

From 8bb16567cd92c76080f0cc48a6e5405bfd068fad Mon Sep 17 00:00:00 2001
From: Eric Haberkorn <erichaberkorn@gmail.com>
Date: Fri, 12 May 2023 16:49:42 -0400
Subject: [PATCH 77/92] sidecar-proxy refactor (#17328)

---
 agent/consul/state/config_entry_exported_services.go          | 1 +
 .../grpc-external/services/peerstream/subscription_manager.go | 2 +-
 agent/sidecar_service.go                                      | 4 ++--
 agent/structs/structs.go                                      | 2 ++
 4 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/agent/consul/state/config_entry_exported_services.go b/agent/consul/state/config_entry_exported_services.go
index 77b8ce78cf89..b758adc09eaf 100644
--- a/agent/consul/state/config_entry_exported_services.go
+++ b/agent/consul/state/config_entry_exported_services.go
@@ -33,6 +33,7 @@ func (e *SimplifiedExportedServices) ToPartitionMap() map[string]map[string][]st
 				}
 			}
 			resp[svc.Namespace][svc.Name] = consumers
+			resp[svc.Namespace][svc.Name+structs.SidecarProxySuffix] = consumers
 		}
 	}
 	return resp
diff --git a/agent/grpc-external/services/peerstream/subscription_manager.go b/agent/grpc-external/services/peerstream/subscription_manager.go
index 42a4d13925fd..4fcd27635b81 100644
--- a/agent/grpc-external/services/peerstream/subscription_manager.go
+++ b/agent/grpc-external/services/peerstream/subscription_manager.go
@@ -747,7 +747,7 @@ func (m *subscriptionManager) NotifyStandardService(
 //
 // This name was chosen to match existing "sidecar service" generation logic
 // and similar logic in the Service Identity synthetic ACL policies.
-const syntheticProxyNameSuffix = "-sidecar-proxy"
+const syntheticProxyNameSuffix = structs.SidecarProxySuffix
 
 func generateProxyNameForDiscoveryChain(sn structs.ServiceName) structs.ServiceName {
 	return structs.NewServiceName(sn.Name+syntheticProxyNameSuffix, &sn.EnterpriseMeta)
diff --git a/agent/sidecar_service.go b/agent/sidecar_service.go
index e0b1fe1d2b01..1769e549e361 100644
--- a/agent/sidecar_service.go
+++ b/agent/sidecar_service.go
@@ -13,7 +13,7 @@ import (
 	"github.com/hashicorp/consul/agent/structs"
 )
 
-const sidecarIDSuffix = "-sidecar-proxy"
+const sidecarIDSuffix = structs.SidecarProxySuffix
 
 func sidecarIDFromServiceID(serviceID string) string {
 	return serviceID + sidecarIDSuffix
@@ -96,7 +96,7 @@ func sidecarServiceFromNodeService(ns *structs.NodeService, token string) (*stru
 		sidecar.Kind = structs.ServiceKindConnectProxy
 	}
 	if sidecar.Service == "" {
-		sidecar.Service = ns.Service + "-sidecar-proxy"
+		sidecar.Service = ns.Service + structs.SidecarProxySuffix
 	}
 	if sidecar.Address == "" {
 		// Inherit address from the service if it's provided
diff --git a/agent/structs/structs.go b/agent/structs/structs.go
index 1771b18be03b..f36a5b77c4a9 100644
--- a/agent/structs/structs.go
+++ b/agent/structs/structs.go
@@ -1270,6 +1270,8 @@ func (a ServiceAddress) ToAPIServiceAddress() api.ServiceAddress {
 	return api.ServiceAddress{Address: a.Address, Port: a.Port}
 }
 
+const SidecarProxySuffix = "-sidecar-proxy"
+
 // NodeService is a service provided by a node
 type NodeService struct {
 	// Kind is the kind of service this is. Different kinds of services may

From 8dce0ba504222073ee98a9eeed558f26e116bf85 Mon Sep 17 00:00:00 2001
From: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
Date: Fri, 12 May 2023 15:07:29 -0700
Subject: [PATCH 78/92] docs: connect-service-upstreams annotation fixes
 (#17312)

* corrections

* fixes

* Update website/content/docs/k8s/annotations-and-labels.mdx

Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>

* Update website/content/docs/k8s/annotations-and-labels.mdx

Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>

* Update website/content/docs/k8s/annotations-and-labels.mdx

Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>

* Update website/content/docs/k8s/annotations-and-labels.mdx

Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>

* Update website/content/docs/k8s/annotations-and-labels.mdx

Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>

* Update website/content/docs/k8s/annotations-and-labels.mdx

Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>

* Update website/content/docs/k8s/annotations-and-labels.mdx

Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>

* Update website/content/docs/k8s/annotations-and-labels.mdx

Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>

* Switching order of labeled/unlabeled

---------

Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
---
 .../docs/k8s/annotations-and-labels.mdx       | 98 +++++++++++--------
 1 file changed, 55 insertions(+), 43 deletions(-)

diff --git a/website/content/docs/k8s/annotations-and-labels.mdx b/website/content/docs/k8s/annotations-and-labels.mdx
index eea3e620c1e8..547a82a6ccb3 100644
--- a/website/content/docs/k8s/annotations-and-labels.mdx
+++ b/website/content/docs/k8s/annotations-and-labels.mdx
@@ -74,83 +74,95 @@ The following Kubernetes resource annotations could be used on a pod to control
 - `consul.hashicorp.com/connect-service-upstreams` - The list of upstream
   services that this pod needs to connect to via the service mesh along with a static
   local port to listen for those connections. When transparent proxy is enabled,
-  this annotation is optional. There are a few formats this annotation can take:
-
-    - Unlabeled:
-       Use the unlabeled annotation format to specify a service name, Consul Enterprise namespaces and partitions, and
-       datacenters. To use [cluster peering](/consul/docs/k8s/connect/cluster-peering/tech-specs) with upstreams, use the following
-       labeled format.
-      - Service name: Place the service name at the beginning of the annotation to specify the upstream service. You can
-      also append the datacenter where the service is deployed (optional).
-        ```yaml
-        annotations:
-          "consul.hashicorp.com/connect-service-upstreams":"[service-name]:[port]:[optional datacenter]"
-        ```
-
-      - Namespace (requires Consul Enterprise 1.7+): Upstream services may be running in a different namespace. Place
-      the upstream namespace after the service name. For additional details about configuring the injector, refer to
+  this annotation is optional. This annotation can be either _labeled_ or _unlabeled_. We recommend the labeled format because it has a more consistent syntax and can be used to reference cluster peers as upstreams.
 
-      [Consul Enterprise Namespaces](#consul-enterprise-namespaces) .
-        ```yaml
-        annotations:
-          "consul.hashicorp.com/connect-service-upstreams":"[service-name].[service-namespace]:[port]:[optional datacenter]"
-        ```
-        If the namespace is not specified, the annotation defaults to the namespace of the source service.
-        If you are not using Consul Enterprise 1.7+, Consul interprets the value placed in the namespace position as part of the service name.
+ - **Labeled** (requires Consul on Kubernetes v0.45.0+):
 
-      - Admin partitions (requires Consul Enterprise 1.11+): Upstream services may be running in a different
-        partition. You must specify the namespace when specifying a partition. Place the partition name after the namespace. If you specify the name of the datacenter (optional), it must be the local datacenter. Communicating across partitions using this method is only supported within a
-        datacenter. For cross partition communication across datacenters, refer to [cluster
-        peering](/consul/docs/k8s/connect/cluster-peering/tech-specs).
-        ```yaml
-        annotations:
-          "consul.hashicorp.com/connect-service-upstreams":"[service-name].[service-namespace].[service-partition]:[port]:[optional datacenter]"
-        ```
-    - [Prepared queries](/consul/api-docs/query): Prepend the annotation
-      with `prepared_query` and place the name of the query at the beginning of the string.
-      ```yaml
-      annotations:
-        'consul.hashicorp.com/connect-service-upstreams': 'prepared_query:[query name]:[port]'
-      ```
+      The labeled annotation format allows you to reference any service as an upstream. You can specify a Consul Enterprise namespace. You can also specify an admin partition in the same datacenter, a cluster peer, or a WAN-federated datacenter.
 
-    - Labeled (requires Consul for Kubernetes v0.45.0+):
-      The labeled format is required when using the cluster peering feature and specifying an upstream in another
-      peer. You can specify a Consul Enterprise namespace, partition, or datacenter. The format supports only one peer, datacenter, or partition.
       - Service name: Place the service name at the beginning of the annotation followed by `.svc` to specify the upstream service.
+
         ```yaml
         annotations:
           "consul.hashicorp.com/connect-service-upstreams":"[service-name].svc:[port]"
         ```
+      
       - Peer or datacenter: Place the peer or datacenter after `svc.` followed by either `peer` or `dc` and the port number.
+        
         ```yaml
         annotations:
           "consul.hashicorp.com/connect-service-upstreams":"[service-name].svc.[service-peer].peer:[port]"
         ```
+        
         ```yaml
         annotations:
           "consul.hashicorp.com/connect-service-upstreams":"[service-name].svc.[service-dc].dc:[port]"
         ```
-      - Namespace (required Consul Enterprise): Place the namespace after `svc.` followed by `ns` and the port number.
+      
+      - Namespace (requires Consul Enterprise): Place the namespace after `svc.` followed by `ns` and the port number.
+        
         ```yaml
         annotations:
           "consul.hashicorp.com/connect-service-upstreams":"[service-name].svc.[service-namespace].ns:[port]"
         ```
-        When specifying a peer, datacenter, or admin partition when namespaces are enabled, you must
-        provide the namespace .
+        
+        When namespaces are enabled, you must include the namespace in the annotation before specifying a cluster peer, WAN-federated datacenter, or admin partition in the same datacenter.
+        
         ```yaml
         annotations:
           "consul.hashicorp.com/connect-service-upstreams":"[service-name].svc.[service-namespace].ns.[service-peer].peer:[port]"
         ```
+        
         ```yaml
         annotations:
           "consul.hashicorp.com/connect-service-upstreams":"[service-name].svc.[service-namespace].ns.[service-partition].ap:[port]"
         ```
+        
         ```yaml
         annotations:
           "consul.hashicorp.com/connect-service-upstreams":"[service-name].svc.[service-namespace].ns.[service-dc].dc:[port]"
         ```
 
-    - Multiple upstreams: Delimit multiple services or upstreams with commas. You can specify any of the unlabeled, labeled, or prepared query formats when using the supported versions for the formats.
+    - **Unlabeled**:
+       The unlabeled annotation format allows you to reference any service not in a cluster peer as an upstream. You can specify a Consul Enterprise namespace. You can also specify an admin partition in the same datacenter or a WAN-federated datacenter. Unlike the labeled annotation, you can also reference a prepared query as an upstream.
+
+      - Service name: Place the service name at the beginning of the annotation to specify the upstream service. You also have the option to append the WAN federated datacenter where the service is deployed.
+   
+        ```yaml
+        annotations:
+          "consul.hashicorp.com/connect-service-upstreams":"[service-name]:[port]:[optional datacenter]"
+        ```
+
+      - Namespace (requires Consul Enterprise 1.7+): Upstream services may be running in a different namespace. Place
+      the upstream namespace after the service name. For additional details about configuring the injector, refer to [Consul Enterprise namespaces](#consul-enterprise-namespaces) .
+        
+        ```yaml
+        annotations:
+          "consul.hashicorp.com/connect-service-upstreams":"[service-name].[service-namespace]:[port]:[optional datacenter]"
+        ```
+
+        If the namespace is not specified, the annotation defaults to the namespace of the source service.
+        Consul Enterprise v1.7 and older interprets the value placed in the namespace position as part of the service name.
+
+      - Admin partitions (requires Consul Enterprise 1.11+): Upstream services may be running in a different
+        partition. When specifying a partition, you must also specify a namespace. Place the partition name after the namespace. If you specify the name of the datacenter, it must be the local datacenter. Communicating across partitions using this method is only supported within a
+        datacenter. For cross partition communication across datacenters, [establish a cluster
+        peering connection](/consul/docs/k8s/connect/cluster-peering/usage/establish-peering) and set the upstream with a labeled annotation format.
+
+        ```yaml
+        annotations:
+          "consul.hashicorp.com/connect-service-upstreams":"[service-name].[service-namespace].[service-partition]:[port]:[optional datacenter]"
+        ```
+        
+      - Prepared queries: To reference a [prepared query](/consul/api-docs/query) in an upstream annotation, prepend the annotation
+        with `prepared_query` and then invoke the name of the query.
+
+        ```yaml
+        annotations:
+          'consul.hashicorp.com/connect-service-upstreams': 'prepared_query:[query name]:[port]'
+        ```
+        
+    - **Multiple upstreams**: Delimit multiple services or upstreams with commas. You can specify any of the unlabeled, labeled, or prepared query formats when using the supported versions for the formats.
 
       ```yaml
       annotations:

From b6097a99b865d271e4ad03ff4324c43fa17633d6 Mon Sep 17 00:00:00 2001
From: Hans Hasselberg <hans@hashicorp.com>
Date: Sat, 13 May 2023 05:01:56 +0200
Subject: [PATCH 79/92] Add new fields to HCP bootstrap config request and push
 state request

To support linking cluster, HCP needs to know the datacenter and if ACLs are enabled. Otherwise hosted Consul Core UI won't work properly.
---
 agent/consul/server.go |  3 +++
 agent/hcp/client.go    | 14 +++++++++++++-
 go.mod                 |  2 +-
 go.sum                 |  4 ++--
 4 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/agent/consul/server.go b/agent/consul/server.go
index 52236e8b5d00..d3c3044121b7 100644
--- a/agent/consul/server.go
+++ b/agent/consul/server.go
@@ -1995,6 +1995,7 @@ func (s *Server) hcpServerStatus(deps Deps) hcp.StatusCallback {
 		status.LanAddress = s.config.RPCAdvertise.IP.String()
 		status.GossipPort = s.config.SerfLANConfig.MemberlistConfig.AdvertisePort
 		status.RPCPort = s.config.RPCAddr.Port
+		status.Datacenter = s.config.Datacenter
 
 		tlsCert := s.tlsConfigurator.Cert()
 		if tlsCert != nil {
@@ -2036,6 +2037,8 @@ func (s *Server) hcpServerStatus(deps Deps) hcp.StatusCallback {
 			status.ScadaStatus = deps.HCP.Provider.SessionStatus()
 		}
 
+		status.ACL.Enabled = s.config.ACLsEnabled
+
 		return status, nil
 	}
 }
diff --git a/agent/hcp/client.go b/agent/hcp/client.go
index c28e1b9c7f08..bd6679a3312b 100644
--- a/agent/hcp/client.go
+++ b/agent/hcp/client.go
@@ -80,10 +80,12 @@ func httpClient(c config.CloudConfig) (*httptransport.Runtime, error) {
 }
 
 func (c *hcpClient) FetchBootstrap(ctx context.Context) (*BootstrapConfig, error) {
+	version := version.GetHumanVersion()
 	params := hcpgnm.NewAgentBootstrapConfigParamsWithContext(ctx).
 		WithID(c.resource.ID).
 		WithLocationOrganizationID(c.resource.Organization).
-		WithLocationProjectID(c.resource.Project)
+		WithLocationProjectID(c.resource.Project).
+		WithConsulVersion(&version)
 
 	resp, err := c.gnm.AgentBootstrapConfig(params, nil)
 	if err != nil {
@@ -132,10 +134,12 @@ type ServerStatus struct {
 	LanAddress string
 	GossipPort int
 	RPCPort    int
+	Datacenter string
 
 	Autopilot ServerAutopilot
 	Raft      ServerRaft
 	TLS       ServerTLSInfo
+	ACL       ServerACLInfo
 
 	ScadaStatus string
 }
@@ -155,6 +159,10 @@ type ServerRaft struct {
 	TimeSinceLastContact time.Duration
 }
 
+type ServerACLInfo struct {
+	Enabled bool
+}
+
 type ServerTLSInfo struct {
 	Enabled              bool
 	CertExpiry           time.Time
@@ -199,6 +207,10 @@ func serverStatusToHCP(s *ServerStatus) *gnmmod.HashicorpCloudGlobalNetworkManag
 		},
 		Version:     s.Version,
 		ScadaStatus: s.ScadaStatus,
+		ACL: &gnmmod.HashicorpCloudGlobalNetworkManager20220215ACLInfo{
+			Enabled: s.ACL.Enabled,
+		},
+		Datacenter: s.Datacenter,
 	}
 }
 
diff --git a/go.mod b/go.mod
index 333b699300f2..2b672b7de12a 100644
--- a/go.mod
+++ b/go.mod
@@ -61,7 +61,7 @@ require (
 	github.com/hashicorp/golang-lru v0.5.4
 	github.com/hashicorp/hcl v1.0.0
 	github.com/hashicorp/hcp-scada-provider v0.2.3
-	github.com/hashicorp/hcp-sdk-go v0.40.1-0.20230404193545-846aea419cd1
+	github.com/hashicorp/hcp-sdk-go v0.44.1-0.20230508124639-28da4c5b03f3
 	github.com/hashicorp/hil v0.0.0-20200423225030-a18a1cd20038
 	github.com/hashicorp/memberlist v0.5.0
 	github.com/hashicorp/raft v1.5.0
diff --git a/go.sum b/go.sum
index 2bb892bc9ca3..127c1350bfbe 100644
--- a/go.sum
+++ b/go.sum
@@ -604,8 +604,8 @@ github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hashicorp/hcp-scada-provider v0.2.3 h1:AarYR+/Pcv+cMvPdAlb92uOBmZfEH6ny4+DT+4NY2VQ=
 github.com/hashicorp/hcp-scada-provider v0.2.3/go.mod h1:ZFTgGwkzNv99PLQjTsulzaCplCzOTBh0IUQsPKzrQFo=
-github.com/hashicorp/hcp-sdk-go v0.40.1-0.20230404193545-846aea419cd1 h1:C1des4/oIeUqQJVUWypnZth19Kg+k01q+V59OVNMB+Q=
-github.com/hashicorp/hcp-sdk-go v0.40.1-0.20230404193545-846aea419cd1/go.mod h1:hZqky4HEzsKwvLOt4QJlZUrjeQmb4UCZUhDP2HyQFfc=
+github.com/hashicorp/hcp-sdk-go v0.44.1-0.20230508124639-28da4c5b03f3 h1:9QstZdsLIS6iPyYxQoyymRz8nBw9jMdEbGy29gtgzVQ=
+github.com/hashicorp/hcp-sdk-go v0.44.1-0.20230508124639-28da4c5b03f3/go.mod h1:hZqky4HEzsKwvLOt4QJlZUrjeQmb4UCZUhDP2HyQFfc=
 github.com/hashicorp/hil v0.0.0-20200423225030-a18a1cd20038 h1:n9J0rwVWXDpNd5iZnwY7w4WZyq53/rROeI7OVvLW8Ok=
 github.com/hashicorp/hil v0.0.0-20200423225030-a18a1cd20038/go.mod h1:n2TSygSNwsLJ76m8qFXTSc7beTb+auJxYdqrnoqwZWE=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=

From d90e7d8126fb5d832995fe1091837975be72ceb5 Mon Sep 17 00:00:00 2001
From: Krastin Krastev <krastin@hashicorp.com>
Date: Mon, 15 May 2023 10:59:30 +0300
Subject: [PATCH 80/92] docs: update names in references to renamed tutorials
 (#17261)

* docs: update names for tutorial references

* docs: update more names for tutorial references
---
 website/content/api-docs/operator/index.mdx                     | 2 +-
 website/content/commands/operator/index.mdx                     | 2 +-
 .../content/docs/architecture/improving-consul-resilience.mdx   | 2 +-
 website/content/docs/connect/cluster-peering/index.mdx          | 2 +-
 website/content/docs/nia/index.mdx                              | 2 +-
 website/content/docs/upgrading/instructions/general-process.mdx | 2 +-
 website/content/docs/upgrading/upgrade-specific.mdx             | 2 +-
 7 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/website/content/api-docs/operator/index.mdx b/website/content/api-docs/operator/index.mdx
index 3be515ac9ce7..283a5023623c 100644
--- a/website/content/api-docs/operator/index.mdx
+++ b/website/content/api-docs/operator/index.mdx
@@ -17,7 +17,7 @@ If ACLs are enabled then a token with operator privileges may be required in
 order to use this interface. Check the [ACL Rules documentation](/consul/docs/security/acl/acl-rules#operator-rules)
 for more information.
 
-Check the [Outage Recovery](/consul/tutorials/datacenter-operations/recovery-outage) tutorial for some examples of
+Check the [Disaster recovery for Consul clusters](/consul/tutorials/datacenter-operations/recovery-outage) tutorial for some examples of
 how these capabilities are used.
 
 Please choose a sub-section in the navigation for more information.
diff --git a/website/content/commands/operator/index.mdx b/website/content/commands/operator/index.mdx
index 060c42255880..7c9f3760ed6f 100644
--- a/website/content/commands/operator/index.mdx
+++ b/website/content/commands/operator/index.mdx
@@ -20,7 +20,7 @@ order to use this command. Requests are forwarded internally to the leader
 if required, so this can be run from any Consul node in a cluster. See the
 [ACL Guide](/consul/tutorials/security/access-control-setup-production) for more information.
 
-See the [Outage Recovery](/consul/tutorials/datacenter-operations/recovery-outage) guide for some examples of how
+See the [Disaster recovery for Consul clusters](/consul/tutorials/datacenter-operations/recovery-outage) guide for some examples of how
 this command is used. For an API to perform these operations programmatically,
 please see the documentation for the [Operator](/consul/api-docs/operator)
 endpoint.
diff --git a/website/content/docs/architecture/improving-consul-resilience.mdx b/website/content/docs/architecture/improving-consul-resilience.mdx
index 31050f52ae5c..bfcc9a8be478 100644
--- a/website/content/docs/architecture/improving-consul-resilience.mdx
+++ b/website/content/docs/architecture/improving-consul-resilience.mdx
@@ -31,7 +31,7 @@ Without a quorum, Consul experiences an outage:
 it cannot provide most of its capabilities because they rely on
 the availability of this state information.
 If Consul has an outage, normal operation can be restored by following the
-[outage recovery guide](/consul/tutorials/datacenter-operations/recovery-outage).
+[Disaster recovery for Consul clusters guide](/consul/tutorials/datacenter-operations/recovery-outage).
 
 If Consul is deployed with 3 servers, the quorum size is 2. The deployment can lose 1
 server and still maintain quorum, so it has a fault tolerance of 1.
diff --git a/website/content/docs/connect/cluster-peering/index.mdx b/website/content/docs/connect/cluster-peering/index.mdx
index f69f093330ef..9c42bf5dc274 100644
--- a/website/content/docs/connect/cluster-peering/index.mdx
+++ b/website/content/docs/connect/cluster-peering/index.mdx
@@ -53,7 +53,7 @@ The following resources are available to help you use Consul's cluster peering f
 
 ### Tutorials
 
-- To learn how to peer clusters and connect services across peers in AWS Elastic Kubernetes Service (EKS) and Google Kubernetes Engine (GKE) environments, complete the [Consul Cluster Peering on Kubernetes tutorial](/consul/tutorials/developer-mesh/cluster-peering).
+- To learn how to peer clusters and connect services across peers in AWS Elastic Kubernetes Service (EKS) and Google Kubernetes Engine (GKE) environments, complete the [Connect services between Consul datacenters with cluster peering tutorial](/consul/tutorials/developer-mesh/cluster-peering).
 
 ### Usage documentation
 
diff --git a/website/content/docs/nia/index.mdx b/website/content/docs/nia/index.mdx
index d24aaf2a5219..f5368f036fa0 100644
--- a/website/content/docs/nia/index.mdx
+++ b/website/content/docs/nia/index.mdx
@@ -11,7 +11,7 @@ Network Infrastructure Automation (NIA) enables dynamic updates to network infra
 
 CTS executes one or more automation tasks with the most recent service variable values from the Consul service catalog. Each task consists of a runbook automation written as a CTS compatible Terraform module using resources and data sources for the underlying network infrastructure. The `consul-terraform-sync` daemon runs on the same node as a Consul agent.
 
-CTS is available as an open source and enterprise distribution. Follow the [Network Infrastructure Automation introduction tutorial](/consul/tutorials/network-infrastructure-automation/consul-terraform-sync-intro?utm_source=docs) to get started with CTS OSS or read more about [CTS Enterprise](/consul/docs/nia/enterprise).
+CTS is available as an open source and enterprise distribution. Follow the [Automate your network configuration with Consul-Terraform-Sync tutorial](/consul/tutorials/network-infrastructure-automation/consul-terraform-sync-intro?utm_source=docs) to get started with CTS OSS or read more about [CTS Enterprise](/consul/docs/nia/enterprise).
 
 ## Use Cases
 
diff --git a/website/content/docs/upgrading/instructions/general-process.mdx b/website/content/docs/upgrading/instructions/general-process.mdx
index 373256cc5478..84da7327dc03 100644
--- a/website/content/docs/upgrading/instructions/general-process.mdx
+++ b/website/content/docs/upgrading/instructions/general-process.mdx
@@ -173,7 +173,7 @@ all of your servers attempting to kick off leadership elections endlessly withou
 reaching a quorum and electing a leader.
 
 Most of these problems can be solved by following the steps outlined in our
-[Outage Recovery](/consul/tutorials/datacenter-operations/recovery-outage) document.
+[Disaster recovery for Consul clusters](/consul/tutorials/datacenter-operations/recovery-outage) document.
 If you are still having trouble after trying the recovery steps outlined there,
 then the following options for further assistance are available:
 
diff --git a/website/content/docs/upgrading/upgrade-specific.mdx b/website/content/docs/upgrading/upgrade-specific.mdx
index 38230034dd2b..6a18a604be29 100644
--- a/website/content/docs/upgrading/upgrade-specific.mdx
+++ b/website/content/docs/upgrading/upgrade-specific.mdx
@@ -1408,7 +1408,7 @@ the file. Consul 0.7 also uses a new, automatically-created raft/peers.info file
 to avoid ingesting the `peers.json` file on the first start after upgrading (the
 `peers.json` file is simply deleted on the first start after upgrading).
 
-Please be sure to review the [Outage Recovery tutorial](/consul/tutorials/datacenter-operations/recovery-outage)
+Please be sure to review the [Disaster recovery for Consul clusters tutorial](/consul/tutorials/datacenter-operations/recovery-outage)
 before upgrading for more details.
 
 ## Consul 0.6.4

From f334fccb4f7d739a3f7918185da06d9131d5cc8c Mon Sep 17 00:00:00 2001
From: Jeremy Jacobson <jjacobson93@users.noreply.github.com>
Date: Mon, 15 May 2023 03:52:57 -0700
Subject: [PATCH 81/92] [release/1.15.3] Add cloud stanza documentation
 (#17311)

* [CC-4856] Add cloud stanza documentation

* Add environment variables to cloud descriptions
---
 website/content/docs/agent/config/config-files.mdx | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/website/content/docs/agent/config/config-files.mdx b/website/content/docs/agent/config/config-files.mdx
index e13cd6b4e369..b19991fe04db 100644
--- a/website/content/docs/agent/config/config-files.mdx
+++ b/website/content/docs/agent/config/config-files.mdx
@@ -1088,6 +1088,16 @@ Refer to the [formatting specification](https://golang.org/pkg/time/#ParseDurati
 
 - `bootstrap_expect` Equivalent to the [`-bootstrap-expect` command-line flag](/consul/docs/agent/config/cli-flags#_bootstrap_expect).
 
+## Self-managed HCP Parameters
+
+- `cloud` This object specifies settings for connecting self-managed clusters to HCP. This was added in Consul 1.14
+
+  - `client_id` The OAuth2 client ID for authentication with HCP. This can be overridden using the `HCP_CLIENT_ID` environment variable.
+
+  - `client_secret` The OAuth2 client secret for authentication with HCP. This can be overridden using the `HCP_CLIENT_SECRET` environment variable.
+
+  - `resource_id` The HCP resource identifier. This can be overridden using the `HCP_RESOURCE_ID` environment variable.
+
 ## Service Mesh Parameters ((#connect-parameters))
 
 The noun _connect_ is used throughout this documentation to refer to the connect

From 95f462d5f10571494760b7e64478846dc8741806 Mon Sep 17 00:00:00 2001
From: Dan Bond <danbond@protonmail.com>
Date: Mon, 15 May 2023 04:05:47 -0700
Subject: [PATCH 82/92] agent: prevent very old servers re-joining a cluster
 with stale data  (#17171)

* agent: configure server lastseen timestamp

Signed-off-by: Dan Bond <danbond@protonmail.com>

* use correct config

Signed-off-by: Dan Bond <danbond@protonmail.com>

* add comments

Signed-off-by: Dan Bond <danbond@protonmail.com>

* use default age in test golden data

Signed-off-by: Dan Bond <danbond@protonmail.com>

* add changelog

Signed-off-by: Dan Bond <danbond@protonmail.com>

* fix runtime test

Signed-off-by: Dan Bond <danbond@protonmail.com>

* agent: add server_metadata

Signed-off-by: Dan Bond <danbond@protonmail.com>

* update comments

Signed-off-by: Dan Bond <danbond@protonmail.com>

* correctly check if metadata file does not exist

Signed-off-by: Dan Bond <danbond@protonmail.com>

* follow instructions for adding new config

Signed-off-by: Dan Bond <danbond@protonmail.com>

* add comments

Signed-off-by: Dan Bond <danbond@protonmail.com>

* update comments

Signed-off-by: Dan Bond <danbond@protonmail.com>

* Update agent/agent.go

Co-authored-by: Dan Upton <daniel@floppy.co>

* agent/config: add validation for duration with min

Signed-off-by: Dan Bond <danbond@protonmail.com>

* docs: add new server_rejoin_age_max config definition

Signed-off-by: Dan Bond <danbond@protonmail.com>

* agent: add unit test for checking server last seen

Signed-off-by: Dan Bond <danbond@protonmail.com>

* agent: log continually for 60s before erroring

Signed-off-by: Dan Bond <danbond@protonmail.com>

* pr comments

Signed-off-by: Dan Bond <danbond@protonmail.com>

* remove unneeded todo

* agent: fix error message

Signed-off-by: Dan Bond <danbond@protonmail.com>

---------

Signed-off-by: Dan Bond <danbond@protonmail.com>
Co-authored-by: Dan Upton <daniel@floppy.co>
---
 .changelog/17171.txt                          |  3 +
 agent/agent.go                                | 96 +++++++++++++++++--
 agent/agent_test.go                           | 65 +++++++++++++
 agent/config/builder.go                       | 14 ++-
 agent/config/builder_test.go                  | 15 +++
 agent/config/config.go                        |  1 +
 agent/config/default.go                       |  1 +
 agent/config/runtime.go                       | 12 +++
 agent/config/runtime_test.go                  |  7 +-
 .../TestRuntimeConfig_Sanitize.golden         |  1 +
 agent/config/testdata/full-config.hcl         |  1 +
 agent/config/testdata/full-config.json        |  1 +
 agent/consul/config.go                        |  6 ++
 agent/consul/server_metadata.go               | 71 ++++++++++++++
 agent/consul/server_metadata_test.go          | 68 +++++++++++++
 .../docs/agent/config/config-files.mdx        | 69 ++++++-------
 16 files changed, 385 insertions(+), 46 deletions(-)
 create mode 100644 .changelog/17171.txt
 create mode 100644 agent/consul/server_metadata.go
 create mode 100644 agent/consul/server_metadata_test.go

diff --git a/.changelog/17171.txt b/.changelog/17171.txt
new file mode 100644
index 000000000000..882b63587932
--- /dev/null
+++ b/.changelog/17171.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+agent: add a configurable maximimum age (default: 7 days) to prevent servers re-joining a cluster with stale data 
+```
diff --git a/agent/agent.go b/agent/agent.go
index 65467dc7ea60..73906f853fcc 100644
--- a/agent/agent.go
+++ b/agent/agent.go
@@ -7,6 +7,7 @@ import (
 	"context"
 	"crypto/tls"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net"
@@ -22,8 +23,6 @@ import (
 
 	"github.com/armon/go-metrics"
 	"github.com/armon/go-metrics/prometheus"
-	"github.com/hashicorp/consul/agent/rpcclient"
-	"github.com/hashicorp/consul/agent/rpcclient/configentry"
 	"github.com/hashicorp/go-connlimit"
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-memdb"
@@ -50,12 +49,13 @@ import (
 	grpcDNS "github.com/hashicorp/consul/agent/grpc-external/services/dns"
 	middleware "github.com/hashicorp/consul/agent/grpc-middleware"
 	"github.com/hashicorp/consul/agent/hcp/scada"
-	libscada "github.com/hashicorp/consul/agent/hcp/scada"
 	"github.com/hashicorp/consul/agent/local"
 	"github.com/hashicorp/consul/agent/proxycfg"
 	proxycfgglue "github.com/hashicorp/consul/agent/proxycfg-glue"
 	catalogproxycfg "github.com/hashicorp/consul/agent/proxycfg-sources/catalog"
 	localproxycfg "github.com/hashicorp/consul/agent/proxycfg-sources/local"
+	"github.com/hashicorp/consul/agent/rpcclient"
+	"github.com/hashicorp/consul/agent/rpcclient/configentry"
 	"github.com/hashicorp/consul/agent/rpcclient/health"
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/agent/systemd"
@@ -575,11 +575,11 @@ func (a *Agent) Start(ctx context.Context) error {
 		return err
 	}
 
-	// copy over the existing node id, this cannot be
-	// changed while running anyways but this prevents
-	// breaking some existing behavior. then overwrite
-	// the configuration
+	// Copy over the existing node id. This cannot be
+	// changed while running, but this prevents
+	// breaking some existing behavior.
 	c.NodeID = a.config.NodeID
+	// Overwrite the configuration.
 	a.config = c
 
 	if err := a.tlsConfigurator.Update(a.config.TLS); err != nil {
@@ -625,6 +625,20 @@ func (a *Agent) Start(ctx context.Context) error {
 	if c.ServerMode {
 		serverLogger := a.baseDeps.Logger.NamedIntercept(logging.ConsulServer)
 
+		// Check for a last seen timestamp and exit if deemed stale before attempting to join
+		// Serf/Raft or listen for requests.
+		if err := a.checkServerLastSeen(consul.ReadServerMetadata); err != nil {
+			deadline := time.Now().Add(time.Minute)
+			for time.Now().Before(deadline) {
+				a.logger.Error("startup error", "error", err)
+				time.Sleep(10 * time.Second)
+			}
+			return err
+		}
+
+		// periodically write server metadata to disk.
+		go a.persistServerMetadata()
+
 		incomingRPCLimiter := consul.ConfiguredIncomingRPCLimiter(
 			&lib.StopChannelContext{StopCh: a.shutdownCh},
 			serverLogger,
@@ -661,7 +675,6 @@ func (a *Agent) Start(ctx context.Context) error {
 				return fmt.Errorf("failed to start server cert manager: %w", err)
 			}
 		}
-
 	} else {
 		a.externalGRPCServer = external.NewServer(
 			a.logger.Named("grpc.external"),
@@ -1094,7 +1107,7 @@ func (a *Agent) listenHTTP() ([]apiServer, error) {
 				MaxHeaderBytes: a.config.HTTPMaxHeaderBytes,
 			}
 
-			if libscada.IsCapability(l.Addr()) {
+			if scada.IsCapability(l.Addr()) {
 				// wrap in http2 server handler
 				httpServer.Handler = h2c.NewHandler(srv.handler(a.config.EnableDebug), &http2.Server{})
 			}
@@ -1521,6 +1534,8 @@ func newConsulConfig(runtimeCfg *config.RuntimeConfig, logger hclog.Logger) (*co
 
 	cfg.Reporting.License.Enabled = runtimeCfg.Reporting.License.Enabled
 
+	cfg.ServerRejoinAgeMax = runtimeCfg.ServerRejoinAgeMax
+
 	enterpriseConsulConfig(cfg, runtimeCfg)
 
 	return cfg, nil
@@ -4529,7 +4544,70 @@ func (a *Agent) proxyDataSources() proxycfg.DataSources {
 
 	a.fillEnterpriseProxyDataSources(&sources)
 	return sources
+}
+
+// persistServerMetadata periodically writes a server's metadata to a file
+// in the configured data directory.
+func (a *Agent) persistServerMetadata() {
+	file := filepath.Join(a.config.DataDir, consul.ServerMetadataFile)
+
+	// Create a timer with no initial tick to allow metadata to be written immediately.
+	t := time.NewTimer(0)
+	defer t.Stop()
+
+	for {
+		select {
+		case <-t.C:
+			// Reset the timer to the larger periodic interval.
+			t.Reset(1 * time.Hour)
+
+			f, err := consul.OpenServerMetadata(file)
+			if err != nil {
+				a.logger.Error("failed to open existing server metadata: %w", err)
+				continue
+			}
+
+			if err := consul.WriteServerMetadata(f); err != nil {
+				f.Close()
+				a.logger.Error("failed to write server metadata: %w", err)
+				continue
+			}
+
+			f.Close()
+		case <-a.shutdownCh:
+			return
+		}
+	}
+}
 
+// checkServerLastSeen is a safety check that only occurs once of startup to prevent old servers
+// with stale data from rejoining an existing cluster.
+//
+// It attempts to read a server's metadata file and check the last seen Unix timestamp against a
+// configurable max age. If the metadata file does not exist, we treat this as an initial startup
+// and return no error.
+//
+// Example: if the server recorded a last seen timestamp of now-7d, and we configure a max age
+// of 3d, then we should prevent the server from rejoining.
+func (a *Agent) checkServerLastSeen(readFn consul.ServerMetadataReadFunc) error {
+	filename := filepath.Join(a.config.DataDir, consul.ServerMetadataFile)
+
+	// Read server metadata file.
+	md, err := readFn(filename)
+	if err != nil {
+		// Return early if it doesn't exist as this likely indicates the server is starting for the first time.
+		if errors.Is(err, os.ErrNotExist) {
+			return nil
+		}
+		return fmt.Errorf("error reading server metadata: %w", err)
+	}
+
+	maxAge := a.config.ServerRejoinAgeMax
+	if md.IsLastSeenStale(maxAge) {
+		return fmt.Errorf("refusing to rejoin cluster because server has been offline for more than the configured server_rejoin_age_max (%s) - consider wiping your data dir", maxAge)
+	}
+
+	return nil
 }
 
 func listenerPortKey(svcID structs.ServiceID, checkID structs.CheckID) string {
diff --git a/agent/agent_test.go b/agent/agent_test.go
index a0f688f5f59e..b2f0ea32e317 100644
--- a/agent/agent_test.go
+++ b/agent/agent_test.go
@@ -12,6 +12,7 @@ import (
 	"crypto/x509"
 	"encoding/base64"
 	"encoding/json"
+	"errors"
 	"fmt"
 	mathrand "math/rand"
 	"net"
@@ -6204,6 +6205,70 @@ cloud {
 	require.NoError(t, err)
 }
 
+func TestAgent_checkServerLastSeen(t *testing.T) {
+	bd := BaseDeps{
+		Deps: consul.Deps{
+			Logger:       hclog.NewInterceptLogger(nil),
+			Tokens:       new(token.Store),
+			GRPCConnPool: &fakeGRPCConnPool{},
+		},
+		RuntimeConfig: &config.RuntimeConfig{},
+		Cache:         cache.New(cache.Options{}),
+	}
+	agent, err := New(bd)
+	require.NoError(t, err)
+
+	// Test that an ErrNotExist OS error is treated as ok.
+	t.Run("TestReadErrNotExist", func(t *testing.T) {
+		readFn := func(filename string) (*consul.ServerMetadata, error) {
+			return nil, os.ErrNotExist
+		}
+
+		err := agent.checkServerLastSeen(readFn)
+		require.NoError(t, err)
+	})
+
+	// Test that an error reading server metadata is treated as an error.
+	t.Run("TestReadErr", func(t *testing.T) {
+		expected := errors.New("read error")
+		readFn := func(filename string) (*consul.ServerMetadata, error) {
+			return nil, expected
+		}
+
+		err := agent.checkServerLastSeen(readFn)
+		require.ErrorIs(t, err, expected)
+	})
+
+	// Test that a server with a 7d old last seen timestamp is treated as an error.
+	t.Run("TestIsLastSeenStaleErr", func(t *testing.T) {
+		agent.config.ServerRejoinAgeMax = time.Hour
+
+		readFn := func(filename string) (*consul.ServerMetadata, error) {
+			return &consul.ServerMetadata{
+				LastSeenUnix: time.Now().Add(-24 * 7 * time.Hour).Unix(),
+			}, nil
+		}
+
+		err := agent.checkServerLastSeen(readFn)
+		require.Error(t, err)
+		require.ErrorContains(t, err, "refusing to rejoin cluster because server has been offline for more than the configured server_rejoin_age_max")
+	})
+
+	// Test that a server with a 6h old last seen timestamp is not treated as an error.
+	t.Run("TestNoErr", func(t *testing.T) {
+		agent.config.ServerRejoinAgeMax = 24 * 7 * time.Hour
+
+		readFn := func(filename string) (*consul.ServerMetadata, error) {
+			return &consul.ServerMetadata{
+				LastSeenUnix: time.Now().Add(-6 * time.Hour).Unix(),
+			}, nil
+		}
+
+		err := agent.checkServerLastSeen(readFn)
+		require.NoError(t, err)
+	})
+}
+
 func getExpectedCaPoolByFile(t *testing.T) *x509.CertPool {
 	pool := x509.NewCertPool()
 	data, err := os.ReadFile("../test/ca/root.cer")
diff --git a/agent/config/builder.go b/agent/config/builder.go
index 513d5931c7b5..87ee229406a7 100644
--- a/agent/config/builder.go
+++ b/agent/config/builder.go
@@ -28,8 +28,6 @@ import (
 	"github.com/hashicorp/memberlist"
 	"golang.org/x/time/rate"
 
-	hcpconfig "github.com/hashicorp/consul/agent/hcp/config"
-
 	"github.com/hashicorp/consul/agent/cache"
 	"github.com/hashicorp/consul/agent/checks"
 	"github.com/hashicorp/consul/agent/connect/ca"
@@ -37,6 +35,7 @@ import (
 	"github.com/hashicorp/consul/agent/consul/authmethod/ssoauth"
 	consulrate "github.com/hashicorp/consul/agent/consul/rate"
 	"github.com/hashicorp/consul/agent/dns"
+	hcpconfig "github.com/hashicorp/consul/agent/hcp/config"
 	"github.com/hashicorp/consul/agent/rpc/middleware"
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/agent/token"
@@ -1090,6 +1089,7 @@ func (b *builder) build() (rt RuntimeConfig, err error) {
 		ServerMode:                        serverMode,
 		ServerName:                        stringVal(c.ServerName),
 		ServerPort:                        serverPort,
+		ServerRejoinAgeMax:                b.durationValWithDefaultMin("server_rejoin_age_max", c.ServerRejoinAgeMax, 24*7*time.Hour, 6*time.Hour),
 		Services:                          services,
 		SessionTTLMin:                     b.durationVal("session_ttl_min", c.SessionTTLMin),
 		SkipLeaveOnInt:                    skipLeaveOnInt,
@@ -1952,6 +1952,16 @@ func (b *builder) durationValWithDefault(name string, v *string, defaultVal time
 	return d
 }
 
+// durationValWithDefaultMin is equivalent to durationValWithDefault, but enforces a minimum duration.
+func (b *builder) durationValWithDefaultMin(name string, v *string, defaultVal, minVal time.Duration) (d time.Duration) {
+	d = b.durationValWithDefault(name, v, defaultVal)
+	if d < minVal {
+		b.err = multierror.Append(b.err, fmt.Errorf("%s: duration '%s' cannot be less than: %s", name, *v, minVal))
+	}
+
+	return d
+}
+
 func (b *builder) durationVal(name string, v *string) (d time.Duration) {
 	return b.durationValWithDefault(name, v, 0)
 }
diff --git a/agent/config/builder_test.go b/agent/config/builder_test.go
index 3fe6573ba0cd..28d5b2972c3d 100644
--- a/agent/config/builder_test.go
+++ b/agent/config/builder_test.go
@@ -311,6 +311,21 @@ func TestBuilder_DurationVal_InvalidDuration(t *testing.T) {
 	require.Contains(t, b.err.Error(), badDuration2)
 }
 
+func TestBuilder_DurationValWithDefaultMin(t *testing.T) {
+	b := builder{}
+
+	// Attempt to validate that a duration of 10 hours will not error when the min val is 1 hour.
+	dur := "10h0m0s"
+	b.durationValWithDefaultMin("field2", &dur, 24*7*time.Hour, time.Hour)
+	require.NoError(t, b.err)
+
+	// Attempt to validate that a duration of 1 min will error when the min val is 1 hour.
+	dur = "0h1m0s"
+	b.durationValWithDefaultMin("field1", &dur, 24*7*time.Hour, time.Hour)
+	require.Error(t, b.err)
+	require.Contains(t, b.err.Error(), "1 error")
+}
+
 func TestBuilder_ServiceVal_MultiError(t *testing.T) {
 	b := builder{}
 	b.serviceVal(&ServiceDefinition{
diff --git a/agent/config/config.go b/agent/config/config.go
index 4d41815550bf..a1f41452924b 100644
--- a/agent/config/config.go
+++ b/agent/config/config.go
@@ -228,6 +228,7 @@ type Config struct {
 	SerfBindAddrWAN                  *string             `mapstructure:"serf_wan" json:"serf_wan,omitempty"`
 	ServerMode                       *bool               `mapstructure:"server" json:"server,omitempty"`
 	ServerName                       *string             `mapstructure:"server_name" json:"server_name,omitempty"`
+	ServerRejoinAgeMax               *string             `mapstructure:"server_rejoin_age_max" json:"server_rejoin_age_max,omitempty"`
 	Service                          *ServiceDefinition  `mapstructure:"service" json:"-"`
 	Services                         []ServiceDefinition `mapstructure:"services" json:"-"`
 	SessionTTLMin                    *string             `mapstructure:"session_ttl_min" json:"session_ttl_min,omitempty"`
diff --git a/agent/config/default.go b/agent/config/default.go
index 4c88c2ac3d86..3af8d0867d4c 100644
--- a/agent/config/default.go
+++ b/agent/config/default.go
@@ -58,6 +58,7 @@ func DefaultSource() Source {
 		segment_limit = 64
 
 		server = false
+		server_rejoin_age_max = "168h"
 		syslog_facility = "LOCAL0"
 
 		tls = {
diff --git a/agent/config/runtime.go b/agent/config/runtime.go
index a8d6c62ebde9..dca9abe0e7f9 100644
--- a/agent/config/runtime.go
+++ b/agent/config/runtime.go
@@ -1358,6 +1358,18 @@ type RuntimeConfig struct {
 	// hcl: ports { server = int }
 	ServerPort int
 
+	// ServerRejoinAgeMax is used to specify the duration of time a server
+	// is allowed to be down/offline before a startup operation is refused.
+	//
+	// For example: if a server has been offline for 5 days, and this option
+	// is configured to 3 days, then any subsequent startup operation will fail
+	// and require an operator to manually intervene.
+	//
+	// The default is: 7 days
+	//
+	// hcl: server_rejoin_age_max = "duration"
+	ServerRejoinAgeMax time.Duration
+
 	// Services contains the provided service definitions:
 	//
 	// hcl: services = [
diff --git a/agent/config/runtime_test.go b/agent/config/runtime_test.go
index 8b8ee4f86a10..1064829cd3a1 100644
--- a/agent/config/runtime_test.go
+++ b/agent/config/runtime_test.go
@@ -25,13 +25,12 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/time/rate"
 
-	hcpconfig "github.com/hashicorp/consul/agent/hcp/config"
-
 	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/agent/cache"
 	"github.com/hashicorp/consul/agent/checks"
 	"github.com/hashicorp/consul/agent/consul"
 	consulrate "github.com/hashicorp/consul/agent/consul/rate"
+	hcpconfig "github.com/hashicorp/consul/agent/hcp/config"
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/agent/token"
 	"github.com/hashicorp/consul/lib"
@@ -6419,6 +6418,7 @@ func TestLoad_FullConfig(t *testing.T) {
 		SerfPortWAN:             8302,
 		ServerMode:              true,
 		ServerName:              "Oerr9n1G",
+		ServerRejoinAgeMax:      604800 * time.Second,
 		ServerPort:              3757,
 		Services: []*structs.ServiceDefinition{
 			{
@@ -7163,7 +7163,8 @@ func TestRuntimeConfig_Sanitize(t *testing.T) {
 				},
 			},
 		},
-		Locality: &Locality{Region: strPtr("us-west-1"), Zone: strPtr("us-west-1a")},
+		Locality:           &Locality{Region: strPtr("us-west-1"), Zone: strPtr("us-west-1a")},
+		ServerRejoinAgeMax: 24 * 7 * time.Hour,
 	}
 
 	b, err := json.MarshalIndent(rt.Sanitized(), "", "    ")
diff --git a/agent/config/testdata/TestRuntimeConfig_Sanitize.golden b/agent/config/testdata/TestRuntimeConfig_Sanitize.golden
index f2bd8f2f3ca5..c17636eef730 100644
--- a/agent/config/testdata/TestRuntimeConfig_Sanitize.golden
+++ b/agent/config/testdata/TestRuntimeConfig_Sanitize.golden
@@ -332,6 +332,7 @@
     "ServerMode": false,
     "ServerName": "",
     "ServerPort": 0,
+    "ServerRejoinAgeMax": "168h0m0s",
     "Services": [
         {
             "Address": "",
diff --git a/agent/config/testdata/full-config.hcl b/agent/config/testdata/full-config.hcl
index 718c879b2974..c29c334b9504 100644
--- a/agent/config/testdata/full-config.hcl
+++ b/agent/config/testdata/full-config.hcl
@@ -394,6 +394,7 @@ serf_lan = "99.43.63.15"
 serf_wan = "67.88.33.19"
 server = true
 server_name = "Oerr9n1G"
+server_rejoin_age_max = "604800s"
 service = {
     id = "dLOXpSCI"
     name = "o1ynPkp0"
diff --git a/agent/config/testdata/full-config.json b/agent/config/testdata/full-config.json
index f98bfe4dab2b..7640394a4fa0 100644
--- a/agent/config/testdata/full-config.json
+++ b/agent/config/testdata/full-config.json
@@ -453,6 +453,7 @@
   "serf_wan": "67.88.33.19",
   "server": true,
   "server_name": "Oerr9n1G",
+  "server_rejoin_age_max": "604800s",
   "service": {
     "id": "dLOXpSCI",
     "name": "o1ynPkp0",
diff --git a/agent/consul/config.go b/agent/consul/config.go
index e35fceb5560d..eef4bc4376f4 100644
--- a/agent/consul/config.go
+++ b/agent/consul/config.go
@@ -447,6 +447,10 @@ type Config struct {
 
 	// Embedded Consul Enterprise specific configuration
 	*EnterpriseConfig
+
+	// ServerRejoinAgeMax is used to specify the duration of time a server
+	// is allowed to be down/offline before a startup operation is refused.
+	ServerRejoinAgeMax time.Duration
 }
 
 func (c *Config) InPrimaryDatacenter() bool {
@@ -574,6 +578,8 @@ func DefaultConfig() *Config {
 		PeeringTestAllowPeerRegistrations: false,
 
 		EnterpriseConfig: DefaultEnterpriseConfig(),
+
+		ServerRejoinAgeMax: 24 * 7 * time.Hour,
 	}
 
 	// Increase our reap interval to 3 days instead of 24h.
diff --git a/agent/consul/server_metadata.go b/agent/consul/server_metadata.go
new file mode 100644
index 000000000000..742391e0b6a1
--- /dev/null
+++ b/agent/consul/server_metadata.go
@@ -0,0 +1,71 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package consul
+
+import (
+	"encoding/json"
+	"io"
+	"os"
+	"time"
+)
+
+// ServerMetadataFile is the name of the file on disk that server metadata
+// should be written to.
+const ServerMetadataFile = "server_metadata.json"
+
+// ServerMetadata represents specific metadata about a running server.
+type ServerMetadata struct {
+	// LastSeenUnix is the timestamp a server was last seen, in Unix format.
+	LastSeenUnix int64 `json:"last_seen_unix"`
+}
+
+// IsLastSeenStale checks whether the last seen timestamp is older than a given duration.
+func (md *ServerMetadata) IsLastSeenStale(d time.Duration) bool {
+	lastSeen := time.Unix(md.LastSeenUnix, 0)
+	maxAge := time.Now().Add(-d)
+
+	return lastSeen.Before(maxAge)
+}
+
+// OpenServerMetadata is a helper function for opening the server metadata file
+// with the correct permissions.
+func OpenServerMetadata(filename string) (io.WriteCloser, error) {
+	return os.OpenFile(filename, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
+}
+
+type ServerMetadataReadFunc func(filename string) (*ServerMetadata, error)
+
+// ReadServerMetadata is a helper function for reading the contents of a server
+// metadata file and unmarshaling the data from JSON.
+func ReadServerMetadata(filename string) (*ServerMetadata, error) {
+	b, err := os.ReadFile(filename)
+	if err != nil {
+		return nil, err
+	}
+
+	var md ServerMetadata
+	if err := json.Unmarshal(b, &md); err != nil {
+		return nil, err
+	}
+
+	return &md, nil
+}
+
+// WriteServerMetadata writes server metadata to a file in JSON format.
+func WriteServerMetadata(w io.Writer) error {
+	md := &ServerMetadata{
+		LastSeenUnix: time.Now().Unix(),
+	}
+
+	b, err := json.Marshal(md)
+	if err != nil {
+		return err
+	}
+
+	if _, err := w.Write(b); err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/agent/consul/server_metadata_test.go b/agent/consul/server_metadata_test.go
new file mode 100644
index 000000000000..d091bfdf3630
--- /dev/null
+++ b/agent/consul/server_metadata_test.go
@@ -0,0 +1,68 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package consul
+
+import (
+	"bytes"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+type mockServerMetadataWriter struct {
+	writeErr error
+}
+
+func (m *mockServerMetadataWriter) Write(p []byte) (n int, err error) {
+	if m.writeErr != nil {
+		return 0, m.writeErr
+	}
+
+	return 1, nil
+}
+
+func TestServerMetadata(t *testing.T) {
+	now := time.Now()
+
+	t.Run("TestIsLastSeenStaleTrue", func(t *testing.T) {
+		// Create a server that is 48 hours old.
+		md := &ServerMetadata{
+			LastSeenUnix: now.Add(-48 * time.Hour).Unix(),
+		}
+
+		stale := md.IsLastSeenStale(24 * time.Hour)
+		assert.True(t, stale)
+	})
+
+	t.Run("TestIsLastSeenStaleFalse", func(t *testing.T) {
+		// Create a server that is 1 hour old.
+		md := &ServerMetadata{
+			LastSeenUnix: now.Add(-1 * time.Hour).Unix(),
+		}
+
+		stale := md.IsLastSeenStale(24 * time.Hour)
+		assert.False(t, stale)
+	})
+}
+
+func TestWriteServerMetadata(t *testing.T) {
+	t.Run("TestWriteError", func(t *testing.T) {
+		m := &mockServerMetadataWriter{
+			writeErr: errors.New("write error"),
+		}
+
+		err := WriteServerMetadata(m)
+		assert.Error(t, err)
+	})
+
+	t.Run("TestOK", func(t *testing.T) {
+		b := new(bytes.Buffer)
+
+		err := WriteServerMetadata(b)
+		assert.NoError(t, err)
+		assert.True(t, b.Len() > 0)
+	})
+}
diff --git a/website/content/docs/agent/config/config-files.mdx b/website/content/docs/agent/config/config-files.mdx
index b19991fe04db..ee5e273be9b7 100644
--- a/website/content/docs/agent/config/config-files.mdx
+++ b/website/content/docs/agent/config/config-files.mdx
@@ -7,7 +7,7 @@ description: >-
 
 # Agents Configuration File Reference ((#configuration_files))
 
-This topic describes the parameters for configuring Consul agents. For information about how to start Consul agents, refer to [Starting the Consul Agent](/consul/docs/agent#starting-the-consul-agent). 
+This topic describes the parameters for configuring Consul agents. For information about how to start Consul agents, refer to [Starting the Consul Agent](/consul/docs/agent#starting-the-consul-agent).
 
 ## Overview
 
@@ -63,25 +63,25 @@ telemetry {
 
 </CodeTabs>
 
-### Time-to-live values 
+### Time-to-live values
 
 Consul uses the Go `time` package to parse all time-to-live (TTL) values used in Consul agent configuration files. Specify integer and float values as a string and include one or more of the following units of time:
 
 - `ns`
-- `us` 
-- `µs` 
+- `us`
+- `µs`
 - `ms`
-- `s` 
+- `s`
 - `m`
 - `h`
 
-Examples: 
+Examples:
 
-- `'300ms'` 
-- `'1.5h'` 
+- `'300ms'`
+- `'1.5h'`
 - `'2h45m'`
 
-Refer to the [formatting specification](https://golang.org/pkg/time/#ParseDuration) for additional information. 
+Refer to the [formatting specification](https://golang.org/pkg/time/#ParseDuration) for additional information.
 
 ## General parameters
 
@@ -549,9 +549,9 @@ Refer to the [formatting specification](https://golang.org/pkg/time/#ParseDurati
   - `https_handshake_timeout` - Configures the limit for how long the HTTPS server in both client and server agents will wait for a client to complete a TLS handshake. This should be kept conservative as it limits how many connections an unauthenticated attacker can open if `verify_incoming` is being using to authenticate clients (strongly recommended in production). Default value is `5s`.
   - `request_limits` - This object specifies configurations that limit the rate of RPC and gRPC requests on the Consul server. Limiting the rate of gRPC and RPC requests also limits HTTP requests to the Consul server.
     - `mode` - String value that specifies an action to take if the rate of requests exceeds the limit. You can specify the following values:
-      - `permissive`: The server continues to allow requests and records an error in the logs. 
-      - `enforcing`: The server stops accepting requests and records an error in the logs. 
-      - `disabled`: Limits are not enforced or tracked. This is the default value for `mode`.    
+      - `permissive`: The server continues to allow requests and records an error in the logs.
+      - `enforcing`: The server stops accepting requests and records an error in the logs.
+      - `disabled`: Limits are not enforced or tracked. This is the default value for `mode`.
     - `read_rate` - Integer value that specifies the number of read requests per second. Default is `100`.
     - `write_rate` - Integer value that specifies the number of write requests per second. Default is `100`.
   - `rpc_handshake_timeout` - Configures the limit for how long servers will wait after a client TCP connection is established before they complete the connection handshake. When TLS is used, the same timeout applies to the TLS handshake separately from the initial protocol negotiation. All Consul clients should perform this immediately on establishing a new connection. This should be kept conservative as it limits how many connections an unauthenticated attacker can open if `verify_incoming` is being using to authenticate clients (strongly recommended in production). When `verify_incoming` is true on servers, this limits how long the connection socket and associated goroutines will be held open before the client successfully authenticates. Default value is `5s`.
@@ -736,6 +736,11 @@ Refer to the [formatting specification](https://golang.org/pkg/time/#ParseDurati
 
 - `server` Equivalent to the [`-server` command-line flag](/consul/docs/agent/config/cli-flags#_server).
 
+- `server_rejoin_age_max` - controls the allowed maximum age of a stale server attempting to rejoin a cluster.
+  If a server is not running for this period, then it will refuse to start up again until an operator intervenes. This is to protect
+  clusters from instability caused by decommissioned servers accidentally being started again.
+  Note: the default value is 7d and the minimum value is 6h.
+
 - `non_voting_server` - **This field is deprecated in Consul 1.9.1. See the [`read_replica`](#read_replica) field instead.**
 
 - `read_replica` - Equivalent to the [`-read-replica` command-line flag](/consul/docs/agent/config/cli-flags#_read_replica).
@@ -924,7 +929,7 @@ Refer to the [formatting specification](https://golang.org/pkg/time/#ParseDurati
       [`acl.tokens.agent_recovery`](#acl_tokens_agent_recovery).**
 
     - `config_file_service_registration` ((#acl_tokens_config_file_service_registration)) - Specifies the ACL
-      token the agent uses to register services and checks from [service](/consul/docs/services/usage/define-services) and [check](/consul/docs/services/usage/checks) definitions 
+      token the agent uses to register services and checks from [service](/consul/docs/services/usage/define-services) and [check](/consul/docs/services/usage/checks) definitions
       specified in configuration files or fragments passed to the agent using the `-hcl`
       flag.
 
@@ -1626,12 +1631,12 @@ subsystem that provides Consul's service mesh capabilities.
 
   - `backend` ((#raft_logstore_backend)) Specifies which storage
     engine to use to persist logs. Valid options are `boltdb` or `wal`. Default
-    is `boltdb`. The `wal` option specifies an experimental backend that 
-    should be used with caution. Refer to 
-    [Experimental WAL LogStore backend](/consul/docs/agent/wal-logstore) 
+    is `boltdb`. The `wal` option specifies an experimental backend that
+    should be used with caution. Refer to
+    [Experimental WAL LogStore backend](/consul/docs/agent/wal-logstore)
     for more information.
 
-  - `disable_log_cache` ((#raft_logstore_disable_log_cache)) Disables the in-memory cache for recent logs. We recommend using it for performance testing purposes, as no significant improvement has been measured when the cache is disabled. While the in-memory log cache theoretically prevents disk reads for recent logs, recent logs are also stored in the OS page cache, which does not slow either the `boltdb` or `wal` backend's ability to read them. 
+  - `disable_log_cache` ((#raft_logstore_disable_log_cache)) Disables the in-memory cache for recent logs. We recommend using it for performance testing purposes, as no significant improvement has been measured when the cache is disabled. While the in-memory log cache theoretically prevents disk reads for recent logs, recent logs are also stored in the OS page cache, which does not slow either the `boltdb` or `wal` backend's ability to read them.
 
   - `verification` ((#raft_logstore_verification)) This is a nested object that
     allows configuring the online verification of the LogStore. Verification
@@ -1652,43 +1657,43 @@ subsystem that provides Consul's service mesh capabilities.
     on that server. The only correct response is to stop the server, remove its
     data directory, and restart so it can be caught back up with a correct
     server again. Please report verification failures including details about
-    your hardware and workload via GitHub issues. Refer to 
-    [Experimental WAL LogStore backend](/consul/docs/agent/wal-logstore) 
+    your hardware and workload via GitHub issues. Refer to
+    [Experimental WAL LogStore backend](/consul/docs/agent/wal-logstore)
     for more information.
 
     - `enabled` ((#raft_logstore_verification_enabled)) - Set to `true` to
-    allow this Consul server to write and verify log verification checkpoints 
+    allow this Consul server to write and verify log verification checkpoints
     when elected leader.
 
-    - `interval` ((#raft_logstore_verification_interval)) - Specifies the time 
-      interval between checkpoints. There is no default value. You must 
-      configure the `interval` and set [`enabled`](#raft_logstore_verification_enabled) 
-      to `true` to correctly enable intervals. We recommend using an interval 
-      between `30s` and `5m`. The performance overhead is insignificant when the 
+    - `interval` ((#raft_logstore_verification_interval)) - Specifies the time
+      interval between checkpoints. There is no default value. You must
+      configure the `interval` and set [`enabled`](#raft_logstore_verification_enabled)
+      to `true` to correctly enable intervals. We recommend using an interval
+      between `30s` and `5m`. The performance overhead is insignificant when the
       interval is set to `5m` or less.
 
-  - `boltdb` ((#raft_logstore_boltdb)) - Object that configures options for 
+  - `boltdb` ((#raft_logstore_boltdb)) - Object that configures options for
     Raft's `boltdb` backend. It has no effect if the `backend` is not `boltdb`.
 
-    - `no_freelist_sync` ((#raft_logstore_boltdb_no_freelist_sync)) - Set to 
+    - `no_freelist_sync` ((#raft_logstore_boltdb_no_freelist_sync)) - Set to
     `true` to disable storing BoltDB's freelist to disk within the
     `raft.db` file. Disabling freelist syncs reduces the disk IO required
     for write operations, but could potentially increase start up time
     because Consul must scan the database to find free space
     within the file.
 
-  - - `wal` ((#raft_logstore_wal)) - Object that configures the `wal` backend. 
-    Refer to [Experimental WAL LogStore backend](/consul/docs/agent/wal-logstore) 
+  - - `wal` ((#raft_logstore_wal)) - Object that configures the `wal` backend.
+    Refer to [Experimental WAL LogStore backend](/consul/docs/agent/wal-logstore)
     for more information.
 
-    - `segment_size_mb` ((#raft_logstore_wal_segment_size_mb)) - Integer value 
+    - `segment_size_mb` ((#raft_logstore_wal_segment_size_mb)) - Integer value
       that represents the target size in MB for each segment file before
       rolling to a new segment. The default value is `64` and is suitable for
-      most deployments. While a smaller value may use less disk space because you 
+      most deployments. While a smaller value may use less disk space because you
       can reclaim space by deleting old segments sooner, the smaller segment that results
       may affect performance because safely rotating to a new file more
       frequently can impact tail latencies. Larger values are unlikely
-      to improve performance significantly. We recommend using this 
+      to improve performance significantly. We recommend using this
       configuration for performance testing purposes.
 
 - `raft_protocol` ((#raft_protocol)) Equivalent to the [`-raft-protocol`

From 879b7754598b157ad6019b24f4de190eb251ffa2 Mon Sep 17 00:00:00 2001
From: Dan Upton <daniel@floppy.co>
Date: Mon, 15 May 2023 12:34:36 +0100
Subject: [PATCH 83/92] docs: initial documentation for the new State Store
 (#17315)

---
 docs/README.md                           |   1 +
 docs/persistence/README.md               |   5 +
 docs/resources/README.md                 | 111 +++++++++++++++++++++++
 docs/resources/architecture-overview.png | Bin 0 -> 125060 bytes
 docs/resources/raft-backend.png          | Bin 0 -> 307481 bytes
 internal/storage/raft/backend.go         |   3 +
 proto-public/pbresource/resource.pb.go   |   2 +
 proto-public/pbresource/resource.proto   |   1 +
 8 files changed, 123 insertions(+)
 create mode 100644 docs/resources/README.md
 create mode 100644 docs/resources/architecture-overview.png
 create mode 100644 docs/resources/raft-backend.png

diff --git a/docs/README.md b/docs/README.md
index 4a7523fd14bf..d3483710b33b 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -25,6 +25,7 @@ be found in the public [user documentation].
 1. [Agent Configuration](./config)
 1. [RPC](./rpc)
 1. [Cluster Persistence](./persistence)
+1. [Resources and Controllers](./resources)
 1. [Client Agent](./client-agent)
 1. [Service Discovery](./service-discovery)
 1. [Service Mesh (Connect)](./service-mesh)
diff --git a/docs/persistence/README.md b/docs/persistence/README.md
index bb907d7d133d..f705539fa576 100644
--- a/docs/persistence/README.md
+++ b/docs/persistence/README.md
@@ -1,5 +1,10 @@
 # Cluster Persistence
 
+> **Note**
+> While the content of this document is still accurate, it doesn't cover the new
+> generic resource-oriented storage layer introduced in Consul 1.16. Please see
+> [Resources](../resources) for more information.
+
 The cluser persistence subsystem runs entirely in Server Agents. It handles both read and
 write requests from the [RPC] subsystem. See the [Consul Architecture Guide] for an
 introduction to the Consul deployment architecture and the [Consensus Protocol] used by
diff --git a/docs/resources/README.md b/docs/resources/README.md
new file mode 100644
index 000000000000..1356da207982
--- /dev/null
+++ b/docs/resources/README.md
@@ -0,0 +1,111 @@
+# Resources
+
+Consul 1.16 introduced a set of [generic APIs] for managing resources, and a
+[controller runtime] for building functionality on top of them.
+
+[generic APIs]: ../../proto-public/pbresource/resource.proto
+[controller runtime]: ../../internal/controller
+
+Previously, adding features to Consul involved making changes at every layer of
+the stack, including: HTTP handlers, RPC handlers, MemDB tables, Raft
+operations, and CLI commands.
+
+This architecture made sense when the product was maintained by a small core
+group who could keep the entire system in their heads, but presented significant
+collaboration, ownership, and onboarding challenges when our contributor base
+expanded to many engineers, across several teams, and the product grew in
+complexity.
+
+In the new model, teams can work with much greater autonomy by building on top
+of a shared platform and own their resource types and controllers.
+
+## Architecture Overview
+
+![architecture diagram](./architecture-overview.png)
+
+<sup>[source](https://whimsical.com/state-store-v2-UKE6SaEPXNc4UrZBrZj4Kg)</sup>
+
+Our resource-oriented architecture comprises the following components:
+
+#### Resource Service
+
+[Resource Service](../../proto-public/pbresource/resource.proto) is a gRPC
+service that contains the shared logic for creating, reading, updating,
+deleting, and watching resources. It will be consumed by controllers, our
+Kubernetes integration, the CLI, and mapped to an HTTP+JSON API.
+
+#### Type Registry
+
+[Type Registry](../../internal/resource/registry.go) is where teams register
+their resource types, along with hooks for performing structural validation,
+authorization, etc.
+
+#### Storage Backend
+
+[Storage Backend](../../internal/storage/storage.go) is an abstraction over
+low-level storage primitives. Today, there are two implementations (Raft and
+an in-memory backend for tests) but in the future, we envisage external storage
+systems such as the Kubernetes API or an RDBMS could be supported which would
+reduce operational complexity for our customers.
+
+#### Controllers
+
+[Controllers](../../internal/controller/api.go) implement Consul's business
+logic using asynchronous control loops that respond to changes in resources.
+
+## Raft Storage Backend
+
+Our [Raft Storage Backend](../../internal/storage/raft/backend.go) integrates
+with the existing Raft machinery (e.g. FSM) used by the [old state store]. It
+also transparently forwards writes and strongly consistent reads to the leader
+over gRPC.
+
+There's quite a lot going on here, so to dig into the details, let's take a look
+at how a write operation is handled.
+
+[old state store]: ../persistence/
+
+![raft storage backend diagram](./raft-backend.png)
+
+<sup>[source](https://whimsical.com/state-store-v2-UKE6SaEPXNc4UrZBrZj4Kg)</sup>
+
+#### Steps 1 & 2
+
+User calls the resource service's `Write` endpoint, on a Raft follower, which
+in-turn calls the storage backend's `WriteCAS` method.
+
+#### Steps 3 & 4
+
+The storage backend determines that the current server is a Raft follower, and
+forwards the operation to the leader via a gRPC [forwarding service] listening
+on the multiplexed RPC port ([`ports.server`]).
+
+[forwarding service]: ../../proto/private/pbstorage/raft.proto
+[`ports.server`]: https://developer.hashicorp.com/consul/docs/agent/config/config-files#server_rpc_port
+
+#### Step 5
+
+The leader's storage backend serializes the operation to protobuf and applies it
+to the Raft log. As we need to share the Raft log with the old state store, we go
+through the [`consul.raftHandle`](../../agent/consul/raft_handle.go) and
+[`consul.Server`](../../agent/consul/server/server.go) which applies a msgpack
+envelope and type byte prefix.
+
+#### Step 6
+
+Raft consensus happens! Once the log has been committed, it is applied to the
+[FSM](../../agent/consul/fsm/fsm.go) which calls the storage backend's `Apply`
+method to apply the protobuf-encoded operation to the [`inmem.Store`].
+
+[`inmem.Store`]: ../../internal/storage/inmem/store.go
+
+#### Steps 7, 8, 9
+
+At this point, the operation is complete. The forwarding service returns a
+successful response, as does the follower's storage backend, and the user
+gets a successful response too.
+
+#### Steps 10 & 11
+
+Asynchronously, the log is replicated to followers and applied to their storage
+backends.
diff --git a/docs/resources/architecture-overview.png b/docs/resources/architecture-overview.png
new file mode 100644
index 0000000000000000000000000000000000000000..656844393e1c8ad7b41217adbad23886187139c1
GIT binary patch
literal 125060
zcmeEuc_7ql`}bHQDH6(Fin2|TkhPqs6v~>hg%BZR9fm1d(5PfdSz2hZWnX4236ov2
zFJl?|GGlBrmND-==RD7O&hxy#!}ELpe*dXyn(uvI-|N2C&vo6`6GMGn&fNmLArJ`X
zrHj8^hd|heArQuAY^>lL>fpsF@E3#kb=~uj>=vPE2t*8W>9=#n{?>DYyAslFy^`ES
zpPv+({!KgP?Kv&4{nze`9jw}Ouufi;Fc+n&pgK#Q4?+|4&7B;b{Ax}rT)wV*;mYH8
zkHs$Exj!b8`*!+`y-9F4yv$(b^UQAI=NKIM%@FBJ#uo#1;u5ZvsBzuIiiSuoQWQKx
z4%@}R$jrtirWFd=@q=NU)@z9M4Qp1O|LW&pN#y-dNHRa;jw}Cj_k+k#2#&4I^89~6
z%^%M&FJM^zOY*fstJs*C7j!}=_W#$fEEYPc_)p??erX*su}~$()A3wlhE~Yr<m4HB
z=QE7Vth~;yuJ5&Xd?n*cT9BN}&(aTTi6w=8wK^;Lo~^@3>v&FbAK}6d4>unb3+=u#
zSir}4=m1wqqpi`)-)s*uAl0DUJH6>MeJuzyDdrk8+shNr&iKdsTD~e)dILcoW^QMl
zYezk}y2H-Q7AAmd6IG8vW|!k9%|Ge)WIvormoR)=WqVWgFlP5nEBzf-xGD>1@0c%C
zW?bPtc-%IAwRGKd#+{k%01NBxp0r@pk)5Q+*@uAvV;aI@u8EXlU*6XjyD=#hdsBds
zxq)j+v_P8NdTXG;a3?;ry<}wczuIdWdBo5L`L^1(wzZc%r$XIRiSax8p29|}>B)y2
z<D7n?DUv&hL$eHcpQgdWGmJi52W5hk3>UKR&Dn}}zjY`UYinnG5I)NqSV4KiWvy4~
zAd|d<);;9ns#;nU)3U8$y#3v;zGRX}vuJXuRB*hf!971Xs}p3vzn?B_gw^_7yNz?X
z?<Q-^{W~7L3z^bq%PGS-if>OXa$-MMm1{P_f)iP`drv{6)pUzrJ+{%NMA9*P1DnvX
z<ZR{YtpGU5Z$9K}E|ap1m4}bWhl}BCZ(<xKkf^V+G*tGEda=gGRn_Q6Gd4)Q$#}ck
zFI+y_QYxtXt6Zr(a*^c)m$i`ZEf0tRTTYO+*$#$CYnF{|xKKYQ>!nsFbNfT$3wtO2
z=(0=~vLZJF;|jOG1NNgGQQS{N*Hsd;o`B}qL3GB9fbgdT8z~|m?%u;!rI!p1?q6?{
zv@_j!@vv)V0_X(vD`vLmpm$CDI`abS?$Kiksu4v&Han8J1jtl0fM$hhSusD{J#>ua
z0F(dV;Gp~(N#T7K+{$Xki-(c<i)7oNhDw)ckbOaMF)^3PnkIfb2EBX4q!o8%2b25^
z3Pe6=MX!)qK<=3@8J$cZBrNu@bLN;aFtbHnv7JBcrvtkL@%V~&j_GAt&~coT+Cc$+
zRE9#Vx8Tk!%rjDLnxSR`B)Jnu)|7kKvQMUe)P>|^CwVF`cJf|i^#9pq%GS;6SFJ~A
z(|l|elwIbhB)9{gxqdtXt81)(xXk#9`#9^u<sp7;|8k;V_(Hk{!p?EVl#PLLoIO*8
zf=arHK7bzXWyn#3y=UKE7*Yd(F;Dy$Z+bp;g7G#g<*IL$o^Pcd&Hz68A+dXmm6@$W
z$9CmhF~4txp6@qlLg?hdzCQEUu{&toqO@3O{1EQ*8?8YW*0YE+C*GATS&=BcfW_w_
z9_ulZ-Q_w;N3~MVGG^?>xH&DjcklI2JB%6ITYJ))<nH?|1BJe^gF_Ot0k&psCf<ep
zw6Sd}#F|vvzF@WZ24bxZ8=qj7;+x_ejup~|^>F7L4Kfob<EhF>7+~H>BD8@-2%WiF
z&n$54q&Xz#-Y(22DSuFXP##}zBw+Go1DJ`oRSirbg7a?k+9KN0p=O8k8h2o^7#R>+
z>hYF^>r;xBe5l!a#lZ?`LZD=*StX)`2WheU1N-nXGW6lXT&P*2d&27-SeqvWSlik1
zDN>7-<>Bt(SdnuuigMswX#6)3sV7<%$fKd%d~V^w3w<w&i>yQ?b=wJndK3Gr^rT&c
zb`Y@B?}2<N_;x0;b!es1Ncr`$>qLYZ#oN#CC<A7Ut?!jVlEs6|S1yHWsWY1jExg8w
zJO5%{c#$}F-z>VNWTz0w0XSx;-k>1|at{aF@U0S+%i@MifZYPAi7$3|<wW3KbEYj^
z&M~`)Ka&cL7gF#4Wxos4S5TEnS2RiRjY>bRVoAC094hr{L_U+X6>Q9Lr?X}No9{V&
zj-7cC1RU{?<UT*wS^>)N#p$-h4r=af4IZ7C&x+;#^aZfYMCGcE*b+G8S02w9cM=9B
z@Vi6K_xH1nodf*XXLVg1Im6C2Y|`4kleuccfJdAAVbbD;CP*(vf2%>O=TRwZ9iL6I
zzBvFrH4tMTE-Wm(pbOU>35LPpbbGkz-wnHdb<vY_ZQYY9<s-Sni;1-<gEy<|MJpgJ
z0a4>$tRjvX=7LwO4U^cxK_U5olXXQ(z>XkYfZaCH{wc(~C=M8#V*UB$4(BT%37ow$
z+)v_}G}zv<P%jtgFBeeQww)BVjS=ufw#`BBs39kK)a7{M11$tN#Km9IvHQ2DSPKt+
zC*VYEVfH!($jtCP5vNrPR^#PK+#%Ltw$K9d$dY*H3G<i3VxeZ77reQCL<24%0@JSV
zz+vY%;CJ}B!B<+@V0*7lx!V1o%)x4Q=Xtg_)S+4&bg!)yBl}!SkuIiho%b@Xaf6t^
zAjkOf4irD-0cZ23T$SfXEZ9D~FU_2h7bv006=%ks=%s53pL5=^{huC!M->k=pA*vr
zTw0rsy}W~{r+R|lJ<a!XVk`ymQKJd^fL^K{SS^D6>h|#z1EVa^$Zp1~MZYn20;$S)
z_)djwOc$t&X8H9KI~g&$t?*nWToE$^+n2h;+p!yiSkg@XE&C1*C6xuR)grY%?qaF{
zc(l{-^e*Hk;Q9DRGpS?SQ;e(w+M?KkOJX0p49GN_zb=D}U}0X6k~qz<1HA>IfUO*-
zd-t;&YXiy!A|}M1i2^QdE?-XD!GisNW&Quk`fuv%{GZC2uZUf5o+mXVwwULCR(HHI
z7olQ=w%be~+~NJ4_>eBMQMji&sIizXPzDv3xa;hvuLA*nzTSx@mw`p8s*<%P#aB=!
zf@fC~C{?BXqtuT%k@={BgYQ-0tQgXwk1%PZaiVTjSXGni<N@P#5~{dea{;m3=sg<F
zn-o6V8a!V|X$r{DRg34y03N_hT~C2~2b;aL8_?|Gkrkz70@UkEL+`VC!Una6(p1@u
zdJ5}*R8G^#FT&muy}{@GasF~|tR<-_?-~gOZ6XFwc=KmPaTr)?&b@iSsXXt^0e3w+
z`ROUCn;$AlvXskA270(6)BM{GrnDJEw%wTW!c&YUyudU`ISoqcRr`rn+|j>5PSVJg
z-dc&tsj0{>BA4nza%AcT_VQIVy3HQgDS!7l02UK3f^q-I2Xr9N#csN=H)Kt|Wfd>q
z>I8y6ZMM7CbHn4w37#^$wLVnI^jmgPQoqE?jj5lJMKzT{qp{8&{nP^Rs13)sv0SJb
zDlT^?^YH~7Y*t^utb}1Y*z=X`ApyjEQq1U5chgjs^S3BrQlUYGkb<P&{I&5xgXpKx
z!KFm~fcocO>wkW&eFU+7m<aoRoq56Kv8&6!N#Xx}gw6uMprzkV3+MWj1$J@^c2$HM
z7##4egcTL#lli)XR?~Vsaw@P5aX8Ih7NSQ*rNY;EA?=Oscp2#2OS2%h;m$9x-b6D9
z6h;Mpe*4`V=;`R|;A_0dCLrLqvX6b<9q7CEsbqmTK}M<1{&-3%j+YT#?eoB$Rgpl=
zqm+cp<#qg4mk&Whm1Jy;_5e>AamIpqhg~}8PP?uuU9wFEaB*#Jta)E_v}S3LuLmh5
zgczYrEEJToh=N#O2r4Z#hd`CGt{>lF#nXmhMI^=js+a*-F<_>PV3AX9e?4dmt{NS4
zRm3c4eO%ctC5u;92a<E7V!%?Z9fI43Sk3UiIW3**`HNs5>775tdZ16`i$YzrFpoVp
z>WQa4wx(o^T9Pa8J~w4va2GMB?xD~0#Y=B{4su<jXK$tr%8asd;6p2a6|a)PlaTfL
z0^Dd0)c{&skzZ_9a1eNMikCMDB(otKwT<5S6_^8OZw~Y*kA+^ybsoX=_z?qs_V&Jt
zZ|}Uctxh51=#k@-Gq9t`2D;Bwx>K`<=7sN|v~wE4J*Y92LGly&{nxIY0I?Zqd}7p#
z$-mn=#7J#zV-jqt#+MjI;+t2{+^cSTZLX4t3$VPOxV=ehy9XG2wfj295ko;Bn0+N(
zfn7P9b}m8VlV~P?&5Z#LdH7|s3&p%u8IPe#{PBWS8>8bxPdEjY#vOwLpv%Kl@)LV&
zZ)ce|no2~yYnt01tQSD$;%8S+Bx_MYd@<u>)vS69J#-8`%qyz2sR^ygtOv2iY4@&D
z5Vij7t=&Zw#R_>kH@#Mn7G=rUAv3xv0gRCYXQ2>dAqcTDV(++37BT_-dL6I|xHPm;
z55<3WvT=5NaV2N|)AxNSrQ{&XC;@e;Up`W(?PKz0`pS2N3q=?e=__;JdHV4xzy$yV
zppi|3LhIgqR+TEt5O<ayZEUU`XI*$f)7c!nWj5v*+-yFzS(-n(sbItZEB%Ul-S`cj
z?HP3H1Yl5o(eVhaRluOU?wHfOR$Cb-NFmuNU8>7{n(z~=NrmdoX%A4`e;$am+}tkB
z4HFDyF|ViOww`-e-<5EbsL~l6f^aC8j8SPWka0b{ZOo?S2xRS4zd$(mk2qkHiq@YO
zCAzw&9H1@r9V-8xv)R<>Nx{K>S!)a{|4Y!_+}z4%XX~3U3&N&~-1_aP51-~D@ag82
z2%}8tAdGyMN6&%Qa*EeIAD^e6s*2wP2MYPNA;inNF6>~7pIHN=RUZ4C*}?*RNSUvk
z{zfA8N;{GHXiD)i(fQE>=0EL#ZqT_M%evr|-?oRp%xfjlpF(mPeTz*&`OGT4w3-$)
zP}e}Ix_I_>mu{<a;6U0z{GV2Q>V=jb_%NPNH7GxI7PmrP3XBYy^%NYftZ=RU8o5@>
z#ACNPMNnQFZoZcH`Nqgu2F%U1L_5GR-@X!`{-X12#1XK2T8<1f<EwY8@-dWUkl~H)
zgI9Lgei|^p9d_taY8v>k*t<nYew<J1$K|?c>k=6ei}BF9f!nIAR)+g4HkL9Rc{M_Y
z2i!<zL<{amay?zD)__Gh;a(YhRnlge8u%3diPDlK+%A0Dsr&x%mdg|7C;iC!2`isF
zthNvN+vstA)=#I5qyI>9IbRRY*chNfD5PcF1{4Q(4Vr%6XgAtJP<IKOOZ!Qxpq0b1
z7>6pGa`*+zc+Vi#X7{jSW~@(nF2vfZw6W}lnVH|f-9|T3mAFBA1!3P1c{M>L*ky*q
zx>GWG78s&?`a0as0rc3vg87WQTeK3D%<>!q)mTl;6W2hrB>K<4%aXr!-b}`(n_Efq
zw1yn5^Q8v<h44bf8dmSUJvj|7bPnG2To7NNt@M%A;xrt7^l;TEzMxfhu6$BO*Db2D
zq68y;#%QRgDi3H{!>G%TVKf1*?7lv4^_igV)9|5WtXc_M!;ZiHRO#{d_JO$_IM+1q
zQxRH?botphc6aGJ9&aEArLi>}4f6Z3If!kQ*iH2VCp0neUa5}eKSX$z1hFo?zXBYs
zndszYV&1LUqLLYOcWr~B>!T!>%3!{l@X3n9XI1?~FR9O6VBH}fu6hOz&svO`?E^4S
zdbKa7&s7FG2W?LCPM`PxCF#qH`V6qlSsKVZ@4e121-M}6@!3;9JqTq`gm*XfJ8t$z
z?XKEVr#GkOl$o{{6M7{HVok3k6=1*zZwzx>HX+J`>gW}O?~d7JX}BMQrufW`R`YaW
zUy=ryPyx41oGcf*Idt|c5{$ZPQ!3p|h%1u_#5oyQ{|(BLs)2<lZLK<1Jh?x-6J+KY
z$+yZK%huuD*hnZ;aMd^7`W~VwMb)*(b4MO503Li7JajHp>o*V>cQ@M3t`_+RTy?@=
z$`rcX??fMpDYI+o$WBlShTkht>bA&obO29?d%KRA^cNE!SJE0xzQ=u~JYyQYuV5hP
z`vw5t+p_&6U;u7GM~4d}=%A*TIu7J$v3Joa87^P3gtyrP+k_9TruR5~8@P!*w5|OG
z;-w8FCm@_l?Ahh2z5bsQ_8e(D4TxKF8_ywPl-$u9e%f-wz}G%4PJ!zn_&<AXAGJ9A
z1}vxeQ$to{CRq1Yx%P~>p%qZ3nZPdZA_5_q(zOpE0F|*iGv+oF@a;w}O@m|RMk0Ls
zj3ad#ykKH>8sBfJX8>)5o{G}QOpt@zDpZ)B2^@VjIodbtA>g$z`d~GZqeVk~FidCr
z1w*Ss!8+Cl|0%W(T*!1fh!Y~6Q#MiNKOH;%K+a*HN1pU~A4dADuFphBuIcuCM6%NJ
zI5wOc``A^$0S{p#D6#=iEw$8G-APuXIB$-|sXmk$mz~6D>{Y#cjjzFkX?ut4MR&-J
zMJE!qsK7eUco0y`0^qCei`1C`_-v6I$zy2!W+triW*fV(HcZ$xe_N4hD+4c_)eo1J
zG^9J)8<wm*Kgz)e0?gdJDu-C2<PKXzpW|2XZJMIsqb&!7A`5qKf6}Mv@EgOF`z5hx
zuynv&Vj_E#r540v%=bo_*Z53faciN*KYIa4g(0+az#Z?i=t2(#`pWdd5pfNsJCwA%
z=(y!;(-SYX>;VG=W{Cvm84$&pd64=BiK?1g7u1#pA|K#}$Lyn{x|1k<eZ01gJCIBV
zQF)ZQ+u4jkdXkfvIC11zFc8i;@^QED?xE#=|KaD7tip(8?ngB$A5&iXp2cskh+3&Y
z+*=!w5Tr5S!Jo==^;bj5N(&rc>_>BNV-fbMsvs39CH++6DB8b0fgRTXS*RZO3u3Kw
zo)VJ#*k3}yD_7hw%_$+i#o`~n_7E(<1oJgLC0EQ}y&-F3wY{nMQ2^dJz5l&3V=rC4
z^`XY+Q$@hiD~8#v>dA=Ja0<akX>VYDufj*HC}uKi<wV_1-kNT@u67wV9yX-I#1{35
z@mgoV`Q-J+KQ}J4>ztu<du-XZ=}8(Sa;0omp><9bx^B<Jwnea_ENwsJUl#s!Bp^Hg
z-YGk}oJZSG>ry#pggOtUP<zsv^KGSfh$)5X`to?*lz9<Aj`5R(&q-QqV2knBx7H#m
z*CuoJ-N4xdt!v+qvvJ#jdzpX?N7(z5jJ<U1)Kt@0JGBd}RLGZ2+yqQq@m1RPJS_lP
zn&T7bmc}ea58ofR)-rnmh$S8!$9dx`aA7OIT()J+4;0wnH}LI###i*R^F8<h-P9Sd
zzlo&VR2ZXw>=OC6n#96c`|%mYpS?f16+Rk7KH;e|(eUJG`RdkRWL{)va%Zqe-LW-6
zBu4V8^EnnhiNCjE&V1lF9j8C|aDAey$y4N212KEB*&)}9;p1$>Pldjs(W>qh!IuU$
zhV66hb<I+qNT5Xdb2P_GlsAW|x`+otR;51uT@-8%BHxg7TM~0dUxn}^?@P#X{ScN@
zX^0P2<UZ?d1%ts3xA{-p#$q)%CgK!7e%tO01n3PFQ+rD^k#Fc2@P}&+M-7hwI;GAz
zItVaeo+}<<AF>K)_8~Q7NI!ZrTq4eo6*N#qI4ITsG!ayCdqUeN^x&1!m`>=fnU)le
zDO(o|33ieR7=C^eOGJ|~{;jaqLp%7}yd&VmV)Z{g(5eG+bqXgo&iyG5Fevt%pjr|H
z_d{Tz5k`zahmh}%j5@>@mF7FueA|FV$ij;2@CNFF8C}`4NfhD9lta7b(BvQPFJm%v
z1ghYq@mroN<ZPnV_|}HZW9_{?N`3wP_}Fo2eEpE7jWSLtKnOlITCMLdvK@OC>9ob`
ze~!_5KsS*CkYY(gC%~Sw54tJ7K;oH*J-OmrBN;=F9r!V0o?AC^`thH7QwD=z1GF}L
zcx!8-yt>9Ft~f5_y^xhWfHHh4DL!h;lwaYo6<Z(d@iq3S9{bML%H_*y3sW(kI6?gr
z%u8z9$?Vt#;QgRU*Cmmx!2c_jFt{6}wg4&eVa*}UgJ^dbViCA&c=wQT$=#97Qc^{6
z<?X6V+2vd52Q?9Q-XPimO42lS&f_KX`dL-gM!64?N6OG;@863DA9ur|vZv<ej&E3h
zw>k-Etqj8VnU@B--CWn)=-BnXJj<;F#<{j8-0%0><flbhj++fdMG?fI%90v%`TO#@
z0NwWfh+)fZaw0<>z`De*i7&O5=+4~6AnS3JA)vi^Wu2=^x-vxx7icEa>$5r6kGrQc
z@}t8`bf3n$!$4p+H5c){?qUT>0^36<zKeJhSnbMz?OhGA-1ucv*M3XdZe*a`Zm4{+
zcAl(ZuAHb?>bpF3&9jO7(SiF2CiUb1LhVIVlU2EUFflv0Uh$Dgi4BHO(_I(lX%C0O
z3LV{oW*;dXm<XQj{fNaaO)S4!^xLN?Qj7}@DJU+)V&%$@pY@%;s03INpS|gxX;u98
zZnWmwRIPmA^6<IZZ&5Lci2O0X+?(Ii&ktUzS{SCTo|sFIpVLr&IgVSJtP>_{w86f=
z=~WmVP|$w@Qjz1yu=UGPf(mCemI)lIJpoYms|e~)$N`w&ooMaVex;V6LH6?EOQ_Cr
zQkN>elQ)9{cgcgCTx=#3vOK~ha^cOuZ1#}4(0kRh_-3baIe?D!+W`|5?kWlFg@^Kd
znDSiJh4G4-sBQX>euM%QV@*tDW()whRHJr$$Hmk@a2B2UP1RR`Wc!V5Xi`nowwCk5
zIWz<7!{vi#Ugk-ZZlw>^Fh#4WOeuN<QtLfCMs|_cHZ?=2{kb>s>4%Bl3tJmC{jI^;
zDf0U?Nmn*0lf`=it@iIlPhpg57$W)j>eR@ijifBm&CCUomhLQ$GOKD|&lG(?gVq~u
z)ramMxX9#B+xjjz+RGouH}P8CTL(jSo2)6xwZ9IJ6S=9{c7cd!>;=HvW}XcB#z`ed
z{nrBY=x?Nq9+&co7TBbyyugRY*guTH9+DIll*IT>{w&?6zG`gghtGP@6*BNV694q0
z@X+Lv=K7i}=?72ifn+^YkF1EBrO;`Yj!%?d(N-_|YP9~|?;z)ZrM&f#U+VC)+d!VL
z6zh62e*p-hnNRye{o|o#8Z^I<%}D?CQhpBpt)HS8C5fn^@&^NV^J7^DB2?cuC(El_
z2l!mTP#QAA8)LY-BsCYZ6O?aS67Nx&{2z&Y^|<o-tV*1$O(#t66lEV20Y9u}8npS{
zEC&T#4!`eB)zLO4ds;Bx0pCIROfUcLZ^dIJT?Q4jBzZ))od3$+;qtG`v6Q+(&G{^)
z&)zvVesQSQHTS#v%2=K(ZrvN4R#D%A7+NDicN-i-<774bX$h6xnH1_0wAS80)2xRR
z%AONEp-n_xd#}ss@~R|CQ1xuG|HN8PL4aP+X1ia_>U=+5&&=AW#BpojhUfH!N%HOa
z?k%b=X(l3;rJF{1PUiI`^q0B8Hh)zjGL*FZh7lb2P&&QU8-w-+I$mn-i~clK=;Hu*
z^ITHS>Ckw!SIm%@70Fo`@TZui&HUYHk-%+&?J)yj0z=e|<dF}-NhpR5US&Uh1q1>&
zmlaC^La~;ahAyH$(hRb>p;|=uUAfD#<KeF*uyG<AiQfY`O2$`@d2Xoh<J$^qLu`O#
zd>+@FeLA!|#HmblYtD=`Wu)piraB+?9{&=Lk_y5E_peema;&W={`A}(EvKB(YNvE(
zKxlB#N<N^y1~)k?T&3r}Ijc%|+8?*+-llWqjk1Py$f&$0<?ycMLrW_jw69!RS48-2
z{M}RVUc?I82xZ)ZAQePN5a0VWUtcqq+@}%elw5?x)FN$4*WtN=&1Kc1dePXyGB?*v
zyjkT9f5g^6FJQHYTo8SqC;f41h7`(}y$w%}Dk%X6m+-OPN)qKgkNoxV3M$$<@EURQ
zGLt{kyq)s#D1&V{=|IQhmSnGsA@9&-`u)ByVuti?vA|2+lN!JXsFK--gU3b>DmmVp
zxm2+*E^QB7#KrTsQnrTC<Prk0(#z*2xzItktTl*IUY-JdSocDB_QiV}J<)pip!)2f
zdi+<AG139T5qvg*K&g(;mI<qPv8Lfwf8l#q-(!gNb=UouG1J9<Sm{Qy13|2TN3n|%
z*d;zu+N_@0ZvbX$dZjL|LCG%O<D%ld-a+|JE)U+<h(fJW3{ognspTN2(jBdX5oLn5
zI6n&UV?~4gNARkIfRpq%Y6O4u=&P_}F<6r!w48NdK)}si-!(VJl9%{wl<KnsLbg8d
zTg4Th4khm*2I!3(x8Apn&QH+6dz6L+3o;S7-Oe{XoNNyC8o1H?rxH*iSY(%0xnDG;
z-iEq&=~%7R;QFKQ5e%5mMiRWJi?YG@$jdcD!KB4%BdVXFp05>ryfe1^dyE*ahMmW*
zuH%yD)VYn7hu8=v0p2QUtJXdr!O^r^jrd-E>j-ReVA0($cM|EXU*)mY#6pEs(}F9g
zS4pby*0#P#Xr+bnUf)rQCuv&K-+(A|q4C@KXSK-s=ehNJ@7I%6>OCt((GHW@KD9}t
z7xo^sWjryu$cq0!3RFaPfEF7&cRyap=(U>028qm%YQ8Fx#(<$M*YEpH7Y<*8Uf!;A
z(E$`mp)qdP4j|{~<)<7;sUwDZKyoZ*x<cFmKbk9Pzievp21K>RmG|+M2Y-Fkzod96
zPkfM8HWyLdqrI<33AdiEuv$WxAzFz-D=;$a#22P}p2o6%yA0jxhgw^+MXc-_&ax~&
zQ$c;7f-PGSWX<#h28V=NY9$OFf^slm+Rw*828$63`JgtGSN%&@PD8mx9Y0o0KwM}X
zS-?h#2-8UK`N?|)Tk`Hzv=8ppTtoU@fWd0`p)~!QKSm#rqd8gv2St|lni(vvX|6B8
z?W;?2!`}iXR8p27wOhLH`Fj9COCMklUhT(k?RTbUfbUg@x0q)@J;}_5XfbpZk`pvy
z1A>_WD*6!ze+6|w>A-o9+oBhUO#HG@k+{t|bvg7RS`(GlXj)^dIvgtq3`iRf_dc~v
zf3=P3cJqAq;7qGZ`7>^~b~rHxrE)}HbGoNGMUTnf1A+hSS@U++>St1&&Cnq|5&sVh
zmR<+ky^gvs(n|!JLpi}23#3a}j0AWlq2TCu6s*wKDrn^kk+*JM-6N-jQoXcWlwUSR
znDAn7lNAn}%?WEb<!yP2oMb3@W70;7`CtszQ&*TzSXek*+&KpOXlSD=LD4>th_R`d
zNi@&*4IW|Zv$xLQKu~9A=B6GS87P<eeN+XIxeensNS+tH+ScE7;*C}?O9N;HRPDV-
zzK3o4sGsHWoS+j5dURhvtl=>DVTTuU?VVlLi=K;<4w0W8<H%IaY>UGZUm^gX*P;y6
zmMksd)T`kf<UzPK$fzgxDA(@`S<Of|i3ob*JNonaTy>n<79mf1H}+ji!kJ?lUZili
zB{_sP56ksjimRr0`ML?-*@gLL8XwlTH9q4?R<>RVPs^!M%BJ2P$@{)fMXW`0sX)W%
z_u!JpK-0!Q8)QO9g?b9#XONY<kTX_ALAQda{hCriGk@TAXz$6YcjHadMtC|D-tklh
zwCY`1C)<>sE%F!=!PlWqgiV~e(<j6vYy+?LLmYrsmgOxBRg4|)UA3ag3T2;Uz>I_i
z{e64)GaH~;o2&ZcpbZd+n3=nhc-vj@)x+Y{FDz`sv8|={8z{=7kTspd7vt4%UM;iu
zuT1<aucr8m2e^Naj!GTk3ml3I#-4}aOtWvmD3lkGEs-qV<eBp9(>+Qdgt?OCcS>Z0
zdr4c5Ed$1(xC~@jwVNvWtLDz~=5a#di9$~j)y@E?N84Npfd;7|20$}H_GFBvB(`FU
z7_#PgI4VvJv^}5kcyd%NK@Fuc+NM0a%wzNov9zHnEmR6`@YJoX#|j@(#iN5o&8)qx
zWP)!6jMOU_sA{0py-50v9+raj+~|7zyCodgE<(4TWcA17;KQcb7Ce%e)yEn<d!2e|
zTbh;Qt0m-b*mbqw8ImscGgh>7va~&k+s3=+96foOURvvP?XG>XA^Jo?UnSdM*boBk
z)T<TyTf?p;2huvP-ZK|?KGA!csm+7WwZ!R}-e(&soMZTDQ^E4_E(dIWfVX4q+g&ms
z=`5-PQIepvY1VX7$!Ve04q{5QD`K&+dh!JxW}r%#x>)U7|1+mpwp6pM%=h6sjx?cE
z2Lj*K7I{nOJE;(yn;wF{vI38*7TO@@i=ixn44YEWW|<cGX9&T=KmEt*hxj#$L3ry=
zhP4pNyZI};OpYG@K9)-vrsBii^JBZ*`spAQF+aN<V!dDIith(K5l{q2d0U5g-Sn$+
z=q~vtLRMe)AGo{ZR-U5oONA+i=#M1y-Zqk`jWBV=C+`wDF{f;{Ff;eqAb4T0+&fNW
z-)o^>_`tPDeCmabn)K$^_z}tEC%S%FL<-nXP+vu(@D?r5EXPXJrgSDz!+`cE+ENH#
zH#gAvm2wfaLIp)*!u(CUVoEC2uH#b+s8Yp`wrq$<g`Lr3dR1QtaQF>cYR2E^w14Iw
zVt+P`{sX4-DTxL7|Ff9E;cQBa4?Vur)<4<iez)7w&;BSnpL6x1Z>^p$RysK9XsF-P
zyxu4ZE+Ujyaa4`+Tu&})+DL+oLI>9~c{U1@_iz{qROzwuN4Lsa`?t&IJo#mC*0C+%
zj7P5pTgtI>Wv8S4-h?;`eI??8A8t)Od<}mP#?<_rc?sw9tv9#zerb7%NQ+l$K!w)|
z*={A#C)@x;)Q%Wh68|1^ul<`Fq*jkZUI5Ybzw+kZoNFK!6pf}U<o^~~Kn4MDeLUae
zi-e&c(wG60oIEv6kel0VAN(b(kaD(=;8S*(fw7Z&il@reBl>97uZr1VU=QQeB8VFy
zmPt}g*JXkFKi88ujIp6k5K2IGGSE+5x+P9%D6p;`TgMGjTrB5{!Epq7Y|DJH%Dx<1
z%0~-XO#HrAW=^ELVwR>`8(HaJ>t{z@e+r*VHr))$+pt_zTwMT8aj7-Xil`owv_dbK
z<=$EQqCS&w#>We@_Vi=z{nC6g#d1Fmy@Y%8ZrL^Hltyn70jZlT6GfZD4h>Bn@8plG
z*blOcr{%6^*LuY9K9Uu_=EF`l<^sh76-TXaRD5ZrM(|6J)o4w>>>9={!7T_=5io-J
zevqQwJBq9r6<_mcw^sOAd%;6PT0;L|_hi|K%r2>td&Lz<6k4`?0{2KH@)%iND5Hz8
zXO0)HdV4giWH|Ge9WlUrePFaq(BtVN5%`ydp(agQ$F4^!r?#ok{;R|Dv@u8@-fp_<
zrxNH;ie%0-C(DA=<kkBg_3~*Mra4bmS5fo|=apA#o;^?CM@HB9ZRpupZ5RmPR--<H
z1`w4wAMr!aIueA`(T?-$2f?MArZ@7z(c;D%t*?b1y$-{dq0x3D_f_N_mxr<San`Se
zY7>Q+RDBjd<aNaic&zj#DHatLW1DVI3q_KxfrkMBz+uOhgf1uD%IE$j_{0^#GrvO}
z?O`N&r<_;tFsTgBecsyz_b?Em^;542Bd@R@(DqLw#ze;ykHv3=NBhl(cJrvyoBdCj
zRNAp|U4(vJtQyjR&GoIw)q)!esv~KYk<VA?kZOFv#x`4UiM6=^hGlhm&K@&FRv9v2
z?AV~b;iMPh&L1_s-3xr?H4?M#!_Y4w$g{hb?}0A54eIH>{yq+DOC1E;x~h5K6u|ME
z0^hR!o2zyoKn$*jbO851R9V(VwP6F)?0fteU<SMGQ=aq+lZVB%#GDu#(Ws}Z+FQ4K
zAlA31^Z^I1g4Q(O5M$kKBq3A_0gV1)ziKScCv+9?fFGW<i#tc6M`VMi8kB>Y;%BWt
z3W7@!uc{vOYj7{|+gS8a<=DFlV};JWZnE@u?}m}|0bKm5d))<uz#OkrwyP>5O+iPU
zYiA2g3CYd2=RlQS`iVh?oCQxma*LMra?RAot&<WfYG?1GOT!>Y9kxsl)zd}73pqde
z+*FzTkBy+)+dzR?yi8#czI*uTKuhf3TAAOY*MlHSX`OulL3S_#c%eT0yRbHTG#qY^
z>uL;JxGpVt5%e!#qPS1@7}Peg=<b7W-npJ8?kw1y;YE}QHOua4Aqf`Wi7cEwQy1sf
zZx6}^x$iUJ4m_n1fB%YN{ESJ$^Pm|k;oxBJp%@8N<Rv_I;+^}2Gp0bza<>TjVt$OZ
zT-MVYTZb_Y;O>chLA{)Ry}LhDGsvguP~lO>r-)O1WnJU$gS#c#G8xr{W9(~JAB>K>
zVQU6z<L3revP(9s>Ph)&*cQGAe$*kQjB5&+dXSt=xopdPjW{_QtF7?uZkjm@AaBP=
z)ZAB5NOV-^yZ%RaRAQ{wuibm@?Qy$(Fz4>_9Rq_rMO=%$a|~Hsb%+?$@7;}I&bWt5
zugyQn$jNt{vuTC1V}77nF2L2pb!e@kTs<I<Y>#a{Qxd?7vxelTRqaX%s=#nWZC4O*
zL5lCS?CF@zFZrXA>8*&2<GJX)$L+9lv2>8x9vtU^YQ2SZ;wL4pPj{^w%bR3M7?JJv
zH#ZCv+FE?v+~5z1f!_lF<Iv~n>K!1g2|E`faQ8FBI&hgkJ}ato_Dp(Z)y2P!ejvzn
z{sdLHMbn#8pQpQTBgH|LUhviH47P$yx-K)PDc$WJwCZ8WX(bi>B(|!f4~5TJtRA~H
z;&Wh1FtJ}4BONyTf)*P#|6-818~c+GD0d>ChOKRXw42)L8Q`uM212T`c<lOB*l2IO
z^}K?ALk&s(c6CX@N%t#JBAu_?kG%i;uz=a?#8*%RxigTb*p=CTaQ2KlA^#zjzv&4H
zuQTao6_Nc%k7cud>Is(X#QVjw$NPXdF{e>1xt&4n=TtbjsWZ-g6y3+UJXPsxMMU{C
zg%Mf%*0O1P1MAhphz+w>-|KJ;r^VQ;&&-&Y`UVq+j|LUrB{bdR7u@CwZJRM;YbEAL
zmwQhKI{gp`sxZC35?!A183_ZAJfoZ#uBFFLzaGf79yaeg9~wUw)=l#c*TfR;B?&KB
z%p7yb<=hY4dSudx@-5v)3DqG^zqw4jlVC^HZg=U>_`Ss5_&C5ZH0_wt{tCVG+m<J?
zB)<ky>-<TvvE>{oC*AMN72EpGo--$X1vdHne$bdurNww#+rPfB96cDzOp0iYuMoXl
zb~^K;I5XQGnP)=cssrz7a=zs^%i8fyyVxdrsqV_XcS1nlkyVID@I-CT&(1+rO525{
z_xbtagSFe${7=VLt<I~C<~qf%W`E9qufBKC<D5~}PrEOm#%w06o6qHZ33(bEPx^96
zFV6LHOI+cGm0m@VOxZccU{utgkEz@368EpsF<$dQ-Kps&BSnn<(_ErKi)$K8(aLvk
zmT^2ivQ1^}GDD@NOGA-q@HKkvPVq3Zi+f7+jr3OO02%%`Hf+g4_t$0ij*GTtKeB0a
z59Y&^29|0A)|uB_jLUA*d$QwO+V>ewzlr+$JqjX1heQi6f0TxOgjnA~WJ`deDqt;p
zhnDKZN=U`{IR;SGtFlG+a4v6ZVOu1|*@rqyE-5AeUJ8E^O>I{>^!GC5%u6RfR^O~h
zp8?abX?ZnNtJ2nr@l?mpf;3xH^2*}jHf1F8{5>WX!g@4Mg{x(&RB1lw)KS;eqPHf|
z4e?Qg<+p$K0{o9E)h5M=2<ebY%D$5X9MxKBA_Qs02smNJEI?QiW9Rx*S#@`$Y(&F`
z7BT4g0m#qv*d`>lrT+Ne8V{`uHVXAx#=WvUpWVYI6O*7j`Z6<X-%q)DZ?K+oRF$FX
zNUW*DB)V?-qlF)Dm7e7Eu21ydum8Jo`XAp|T&N;OTcrJp%`$@IoYFMo5jz=LWvknG
z)~l;AT+5e*m7|9pcdOWG+*l$sUcd2wdtzF)T*!i(=mNYJkC>r4vfyo50sf2Gt5+`c
zdr|sb|NG?*GBBuuOY>_yT$o0i)`uD95D(?INhxF|V|o+S--b<DM~2C|S?$veT_-}#
zUZrHPa~(IbP1Q<%X8r2%L!M7swyAfMs;pR2RZ5M4BEJ9MA43CZvX|y*y31%nzg>39
zSwEepO0WC)zog}VqV1riEw!#W_vWv-o;)`=y{cVAoT|PMs-?rM<KtVC@bkUh+|)IB
zPhh=IBkq_;fs3ZQ-(O<mI(Vgu;A<_&yeMg_i`iVcQxd_l@Q|l(E#QwvzrQ<dCJxL(
zLxg!gf=7gr+3Uzjx5Y5?uia4*8K4{a_xo^rj{ZJjK<F0z?(?%VwqV%6ij;y;7J%K_
z>v#X&llONKNRLq}jd<uFH@IO$cd+Kya_KGAr3nxul9`pGlf6Hnoa;ySA2SE$Rx{r;
zfF*CUZ@c7_^jEL>b@TNZ7a3-@F=Ja?=52ZVnGf7%DH{+RN?3Jt;x*zBc_9C&NXYVY
z^I~@^HjXID%Cl*Xn1!yf`WXDM_P$8_XmvS#O*|*PTYNeZmQ{je^u3+pswh2s>=`c-
zS>c!-EGO-1i2bA4?U*>AY8$ID$JbMG3#PVIEggK(Q9tQ`!bkn6OFVV83D>+ht)a|$
zN51-Opv)^hy)(`8HB2*m+dgJeS8>u3QNjxEu6qktZT#F<0f3mTLT=fC3(bcYko$s_
z<@{&+6Yb?yY%b7Jtx7{$))r$8#NrvL4}8bBRN^Duf4*Z`XjcR#?e`fF|FeKsxg&wj
z)1x|Z_95XsqUCSQYz~&gbjQFx(wuPW#6)xQnRj2jLAUuPjckM8+8_x3d}q~R$*5Zi
zF4#b6L>tBKcV0z_|Cp-)b-HTe{)^+!u?mXn#xXJg*0B-?v~0^C|A|^Nd;ElKxq(nY
z>zf31w^K(LnNP_r%*^<ZYP`{YId4E10$gSew@FeXBsqzw(=nS~@k8JLsVmWT1dY7!
zmuA0fqr_9%(}^+b@JaI$_teSAR`!u`TH)c)`0Pi(MsDLVd^yzCn<7E5j0Row`(Ov`
zb)(P!77AJ%ithA_=!vWad&Ghu*>eiPp=0brVDwk@oqJ5i;OE6HG9wdV!$Uc1h<m<g
zRm+pD^aU&Q>eOlI9BgKhs{O<#$#+?<Zod_D<{OibXxVBZ0d|nEU%E*2KqK1Vaky^q
z@%2Z9u!Tf?nmC{`dM7HEY1Hb^y24?PAfN+eb7D(!-8irY$)Rf;0EklB+I&b^yhT%c
zS6lX}ltp8!-T?c`DdpEdWK+)!YhP{ly-D;KejGZ$qtH#YzcLeW+P+g7thB{A+rKw*
zJZ4MT5vrEXRU;@96>q83#$EJVJ{<+lR@#Xw&@rjV^&>~Ck#%8fA_SokH{j!hQ2n@=
z$SwrmWGC^501wveF<SAj5fPKM+TaS;B{t|@be>YEWLW(B3C?R@K>Vq(gRuY&Fq55H
zVwH@tKqTAJh><I^-IK-MQaP`xK3s|!oiz*2cU*eyU#!))Ft|hxk>!gn+at`tsKWDa
z10>!kdOY(261j412kl^BP|IOuT;p}_h2T_izUL6=^u<ID%cTdR-J2rrT=L)+O+dx6
z+pKoV;~VpO&wvqAK#mV$>k__Kc1VUQ8FE2y#JzW3`e_O5YcRO)KIw4a@2V7E0RYgN
zf&4SK?WSM7d02u@7m*5z-*bX>0YDP=i#$#`u<o)x{_(xcY{n+3AA`LzRVj7O9v(yB
z?)jE(yMz*7b%s>PRSDoku;5nuHZg&1F__?E#)RCYqg%y(QaNuy0>J6%cQxr>V<!rs
zKZM!1K0T@G(<Vd}y@23su|Fl0_^UE5aeO%oGMBR;2HGx4K!ZdbBfvIh2EdKVa-#rF
z@NbvLXxEu72FxhRul^%IIg*IG?E?eB_d|RA#0(X{tN?yDxA41Go|2d`N9qIr+DRAF
z$4@foy*;S^_PhY}(2Gviq+D)z{_xhd)OlA?=?obLOkRo3>5_w0(!n-+Mpi0@c&lHp
zQ=W*IJ&I)Ga>i68J|OlSD$>j4NETiY7|I!u0{NA`^W@}CrVGq*aS{6+^?z9o*v=mN
z^CqKzugjH0yi<(u0?4*rkbfmBpMY`DuZewTF%`WBzX^;kKW22VKkDt(=J--1&@hW5
z|Mh95%>hi|@~5c1JfI8Do<7Rr^Vk0vW#Qz?@C8g8Dy;g#<k5c!(+_Uo+-8Hm`f#vL
zTHl!;(^0^A=s4h~)qg4fbbf-G(M!Wa!XTQ<ssliXw1$~Lg<dk91R`hzv_#?{*7foQ
z;liZL)qZJj!LPl-XX&>hl8XQ6Q~#em5Cl00;#X@<=HI7t<oPlBpLl!f>=kgU?&%=_
zX_PTpg9#mkWI_UI>_o3cDCiKpDEmA91&3`s!?po)F>!~Y1*A|G(D+}f*Y#C^G#xY6
zdBi?^D?`2(0<aA`N_NRC;A&A|x&Wg%??rHq6LR$F7fRQs*DXPXsO850E2}`2Sp9y{
zg6DD%0~9uI#EHzK*Un%CyuMYgdbmE{;5R~-(6h3y48hgRu7{i;8`XvWKZ%0A{ko{;
zYvZmEGP*hijTQ%GJKeUHpqY+28LeYr;?1$IqoG5~BIjO%BfR3ykI8#Hdlncl;lG{_
zvTOfw>PBdnMQJCv9b)@2w34`R**PpUr}C+xp8-fOj18*D`#{@KBWODcn0|SdeU9Fk
zy=VfQ?0%{D-$Cc=FHm8hTRwk`d4@iRVBh%qpf+G#;a`LRIl;Toxb^$23NYb_q0%@f
z+bN@UV%8(0k})#{f;8n`plW;jSwM11H(Y(1fz6N4tNc?iRG(e~`3Wj{ei{tc@$F0B
z&nV6Za&$e^8#j-k0HJv?-8KoO#qapXrLKs#U{|}pny6;UXRG|Q+gQbvXT02WJoGjV
zB|cwbx|EN*$9TIkJ6$-Qko|ksqm{+nj<9*=Yne53+QSV5vMzWRQ^plKs`**wfAzB5
z2WR-#5xqld!SsgbFXAUVppDcc<!9@%PDSQaX0_j*JqnWlHbH*M*4t9+!=S^i(;(wE
zy=L%|3Z&s5_T)CWxcPhYE1iUlM_yC{V0nwhU!+oNi-mQgHiR}AzOXptDlJBzWJ3)(
zr_lp#qHl+5J`1*M?z=Gy66dNa#)=T<EVG9YYuA;2m)Cm0K;P12S-5`w*1ZI<kpKus
zlB_?4fvGB>d-$zoB^(q<@&Pq}s@O9RBoeWv+19#QYqEP}96j_!QY+O9`4$nNVK@v%
zRCz5qzWLTY<T&?55hRhecNvB>3ve0Qkero3_u6IvG{on{|K&_iNQQQI4)WGhz(AM8
zB$iJAP5oU@7Mbk+b9Tt7o74NAZ{07I87%`Bnf0);f6*2Y8EDVnHQO98yoqU#<(L>J
z`=o+98mxR5;Wc+W2Mj|bM~N3P4G-57ReFXB`Exvf%j(_-T=Js$@W!Lf<u6^ayN5e1
zdN!F|=s-ie>7RDuqdc(b)8UudI_MJ-L>gAm;I{Eu*T2fv+5s>WtXtDx$sA%ZESC~&
zrpUl3&VNwGwp$Z~0%Fk83@+S{`Pb8zZ9-mue%%Eo;UPy@f@mi(*YZ&SWA19PFp~z2
zJ!x}!e_D5ad%8k##BzP2k6BWGIqSC%?AZ0!fNW9n*+e|;0Sjr}vj101Wo<?R$h5?{
zon2?kT|QL}+NMZb%Y-TI-<&9|>mHhzPKyP0SS&V_D0*F9aaIiUIL~ML6y67`H^>2e
zEv#V*)VJqO>p-BY<%aCYKtNEZb}51k#NO%O7;VF-O<k-!ea~!@GV4b@L+GiH7a{iY
zx%%B{?6xz}11~4Qeq~yScUSRKRE&;6)IJfv%Oi4^N<j0LlO#r9Wb$60SLGH0Zx&sr
zE{&~I5X553vKWafZs<I4Q?^alb}^x-$73^H*>NJSgc7A4Olup<0dFti@pW9WkWTL^
zF#i7=dcRZEQZgkD<&TjKYBe#N#%g(PMiqRYEPz$(xM540B9SDQ_D0#S4u(WSa9W4e
z(8Haj=MI%x_2pEO)k$_i<6Fu8cFmunjI;O9ah6ZvRo{&KYOpAj@=O&=MaU<XyQ~uj
zsv5O;bPTJtXeT|t@-VI&Xm;rL*7vlBd{wyLZh2jouGBq$5&J^~=pGQ*y_XD_oqm!{
z$gbY_tNhdN!!>Mz3dcR!zXp#WQyxLY8JNC^x`dOfpt6pjHw#R`V2;z~wxk4-=gO1G
zJtZ8;T-Fa>#~}OTmsZF;L&4W5a!l$*^m&alho6Nl$iXLrhBP~v&<x;YT_J%DFo~hp
zym@<$5hFwR^FZTRPmvpJ#BF1BKD>CWbSx_)BV!>h$TH9k4u_A>u=N`)EiJfW6bf}v
z(Z!h9KlSrHhp1#L|9Ah|*~_#yUWXobg76i3Ec-8#{BT2$iS8LLAN$9In%cQ0dTPf1
zZ_+H@Msr%*qUE6}{6FHMrLtSC>1Ip$C+UN8K*gDMb90VTl`F}QAa&9BovD84uN>B_
z0;bsg?FcG$qB**@J2}xB+c5Au&L$wcuxnR#1UU)um?$bR_*h`T29m@2NjxEsLKeE@
zdpJOk@gA(`4!A^p<^b-D`@q51N*)Bx!DIF=)Qjf>0TW~~PenB~B(5YF`s-=vpAW2W
z<w^4>%*JlQLCl;MWCH&9?*&kl@jF$>X0sbt@4hNpiLWbh-KYzaxk9f9{dinOO2XqC
zC6jpFsEqz;plmdp#AU4`V1_@{u(rO@OVku4=YW4jTrr>*#%}Cac3GdGRQL0*ZynaV
z`uVynKvM6^cqiHoXP3YRyRu;R^L>T62<p0dzT?$QSaCL2P2&s*2(G?5bu9hrYg7Le
z=A{Vq1h00$jjZxlGeEd{ul^a{CDrXA^Y8Kn_hWLv{TTXn)K0^u79ns<fpnMiPn1zi
zl#yw^;+J4qzt7wqfPN>#zYA+VEmSR<w7>ZUcr<`TrTd~#Hp!IqB=ivH{%Q~^Ud*2{
z*HN(vfv(pzm=_m*M0J+((i5W77Ibx|;A$0uXl+wE9m89U{)$?{4h>@)S)<&!^#tDx
z&{1oWVOrY|E6t(WKfd-nj38l<ETrJr^!T&U$2ySw?M9Cs!}jp`;aZl~^DNN7K(zd?
z&SwLh&mNmi{?VVmj41KL*sWD;ug%Ndz!*I{hdlPt(vWh&yr6L2^QEPH5Xe}+)pdUQ
z04!KCbtP8uOHBd2u=ng1G9|?MAyG7MAeFmIB2?*o$tgKK-%`E%e)aNsjd8M(W;Vfv
zUw>ICXx2p?;`#N_Ao@nWBQH)eL?2a9i1zhC%K@ij^cSb|ojQ&b1};DvxPU)q9px(k
z$5UnvUhN-fG7z5%t-e9O-I|S{bJ4TdDxP}b^D`hNhj^SLAEWg(Di<1as@)Ixerq&;
zG-IP*Y7^308e~F^yr)YyW6mX2oT6_C8;>6Py<G?WNhU)D%J%y)dZ@UozNN6Td$(n5
zDliLvhq6`^ls)a5UMWbf_POR<)ZnYhz)1rgPfPoYj_>HL@}MUzA*qz;sTX80!OpXK
zzS}9}niO4H>OfSC6P8Tk2UG0IL3WsH7;b-C4;PWv|M`gh)l4syaRgPJ9HD5EU3Kqw
zUhhJtAZ))7MHkyXopJ^F2#-wd!cqTtA$hc2ZG``HTKsMXwdlv5_&VP6{@#-<vO;Fk
zkImLH&I6J`Son|h>A!HWc~Ha6Llw)QrGqrpn{1^zbc_K5EVVKTmE!nU+UF&c1%>B@
z(a|YxL%emf{1t*z%6(C?x+*4I$H}wA0JH3@YOAZ~==vMLQ?f-h3ZgwLPEY#;CWx?H
zZ#Y~}HommrKHd;Z+FWYoz;TYoF_T_!;V=P9fqpf5m+qKr(tQV%{V!_zkH&Vxec*or
zk9QMAfQn}RHCuJCu}y_&kxF{cb3uF8+`9>W^>F(AKI3oz^BJTb1Y;G;r3YDZK=SCR
zg!$kF{%<9Rk2iK>#SD_eXLV8%=w=@D8S?@lm8ua71AHsBV~RHLEr(Sig4LFq6vFY2
z>JRxZ`hJ6z+`W0z3?pw}cVKH{^csC|&1L9+()#p^!>_JY|B23PKXH7XRd3wn%kn>7
zODpjZrbn5fmRJ}N>+k;-Wd<XWz7?~TAbo`pKd6Sp{VCgE#7A+`Lb^HvsnH={fJ$vP
z=gF|73-?e^XPK0l?OD2T|9DVkAeS_^@ks6TmnH$0g$8CpTMB(hLT}zJ(pZc^9WaJc
zDPO}KFCtnl`c}gVoUe_TTO7tLCV~{KUGFc7NRR$5<h~f6Jv;h6zWM3As;|b<9|MFm
zHkHI}HhT+7-0Q<|Eae+7S4iI!STzW#8LFdSVCgl5e)<voX1=TE=#x@B7tg)MxBu#{
zrN|HVGF`uR0a#aF(k%i#Ns;CLYk2L31Pyfj5BwgmER>a%;m6QGw+2l*0mO6xKqTaT
z{Llem;b6ZiL4fjPYO_Hj2QxA0&x5GyG|<)1Fy0IbaL7$|OTT)DA<eNIx9_GhV3f?y
zXH33xJ>1ap<?CvzJ@&c58><Zxt|J+fO|N)%3EkDY^6FG=tMDz%Ugm}Cb^v7mH}7`b
zbn%~qi)82iIk?E-?NF)P_049o(=zJS$#m6<jovhQr<v>nHuas*%!9lkh?Pu#Fs4Ae
zrPQ_#MbQ+s=G$mlY&KlAJ|>=X@%Q_&nCk!_Hv21p?f?^WgQRAlT_@!W2Gs%U-9OKO
z!~6s$Rd(ZWrad>`y)PH<dx3ZE@8_tTo1vLnf;>h?(BkF|@wIjO{L3=>{L5!XfKihh
zkKUZ|c$^1DrQ&{#5hYA>tcA&gel~Z21dQ>N=7~KM(tRDaP!}y~a5RlBw8#HbXlpMw
za1P4`1l|b(Q=-;o#v%+Vh3Y}8o@jlGpXlafDQSVj{<>^X%8h>fmsX4r54MjT%4@!t
zm3??T_0p}E0A|?>1nEx@UaJU9$b=jX`8;UEHt3`4*V;m^-|PQzAXvMIKaDQ54u)W6
zB6Xs~+m~P)!%Xb+4JWd)kMPEWeB_&>>Dv$BjLU}wwQ2S<QZH})ek=J$YE?8ed2Hj+
zp4GJW7oa&ut|VY-!hhl0E_|n%jquvh>^a_ps=jxGynY-G7r!lh;WZ(g?#WMpQ~tMn
z?|?K&!^rJlTKrozn<ByNDmee*8aey%k~R8fRe11{QVgC$^9^pJbeab}3WZu8!ittG
z*$59%J9;RhL$A3r&fHr@t-W6|#Xe$HX*dH9lo9}w??9a`C>Q`iR+ayL#;KGg`1HoN
zXfWUP+blO|`_VJe1yKVF=*4%~^%}&Mhd~R>{)le?N{TvDP@Si<NH<I8@5O^5<zgQh
zFF{(#`&8U;T(>~$XXeLx%{`VCK>-87<U#S*RVGZkWz4^(e&xW`JmFza`@I+G<sP75
z|CUW(%RK4^@c<@?(#Aho69Xk`Tt36za12@cO@z2Hw6rdyzJagwm!D{zf?t_$?@aRC
zqFJ`7)><3+));7#?N(EbPagrcmpk{?>Jgy8S^uHH&zT`$1nPY97Ze0}hkijnANur*
z%Tb#UmIZ-MSu&X4_m8{WHW_H}4p)5p!Tnxv-yG}Rs;-pBZmF26wI8E8_w~Eo>RfNw
zb$V{7b@}0c1~tb`Ur2;@5Au*wa*}x~{cX<^8Lcb*je<s~IXWAJ=7n_`ceoks%>w_%
zvW8#%EExS@`PD@$ls-DCWOU+0c?x>1Qe89#tMc#+JST2ZdViJlkW8Z)*k%^>SJ37T
z#|KWxJs(N*(7f9H)sADDt*h_oeOkypyTK?{ShPBt%vOq8MOAYfxG{lNtCt?TFniAA
zMjU%OHcNz6s4Pq$HIZpF{@r(<LyDGryd#R9>WROsw;!~z3_s))1Z6o7k>1*D0b^S%
zO4xJkxo+LN3z5gSIlQY7qK(HJf%w6bg~b%=YM+SN=Fdj?n@z)qODD~uB8sW=n>g34
zS+r>lELxBPeSj!%u-oh`c3MT1Pvk={ctxL%&g$>CGj=j4kPLxMKUV>V*;M%9-F+aa
zq`%e}e-wc}v(Te=%#<UF&~T>(dZ*e`V^COl#eWdk->~`JH!(#;>i7MC9}05SH6FfL
zu?70Q9`{|KJE3y$uo|$!XnK3??Em5IJ)@%BmbFo70TEP^faDAkTR}i1gV;!vEU8gR
zB1wr&ZbU>;auN|xqGZXb2_|xooP&~clO^BzHm-g4*?aACzcJ2t?~gUsu)Bfz&RO-;
zQ%_aR9v>>PndFw)y{(!k>2AJ{xFG*mF92ovBU!(;c(H~~1hdKY=Y3`<u%4g6#GttN
zuYO7^h<0mXpPZEO@!lydygj!v>|1$lMs3kE%Jw)q_ijJA)$vZXXVTF(ahqT4R(Z5!
z6XW)8DNGOMi^n=f_r{Y#&zhaNu#-DDKt5jX;yALgIe=Q9)+~6k*e>vUJFY~Ex^0Xp
zU&c%OT>(m4wa_2Qg|r1%$v#x*4FW;{g6E&pfMFQ>*;7E<9G21r8!`yW*)5i)bh^E`
zEfC2vT2Yxewpx{(n96FdKU`_u9<{w)IJl`y{7ik0ML;Kw=rS>z;vKS2UJt<J$mOIx
zo(C_97Bb$yxQNH9L?x$8miC;EHFZZ#G~Ragc-&J=7<@-Uk<;u_l<<yp?D%1u<xJF$
z<m&B}LicqhB3YI)d@`(Ki;Q*=`$Sy0-J?el-(S(Rfb6u5@V&k<ta%H4`a;;K+c=}V
zAQ8(%1v*uY3~T(fu$UH>DD_gVu85oFgVJ+K?AW+52Xlqbr=W!Gis_)>!j8@MRFY0J
zo6x<Po=+@dm4*6DzlZi%bvK5ph^Jba)g#&@h!d{PYRpFsOP5_;`K?i-DX4$Ux=Xvk
zdlu=^>?*$h!;*KBvrWg6o@K%!#-S8}sB=Ov;B_!^8_J!6k)coFv)mKIqr^Lf*Rk@B
zf)V_S8xLPnVk08^qiSL;5vrn@dP5$3uu%XHA2YJv(X&K^vNSJq7#DOKb%}k=EQ2H_
zIdjw=XETN0mt(*l$l&;5srLAYow@Z4J9ti2Ay}fyofuIC@Pt>1P}@^%7jLuSIUtN=
z+mCl|8kE^#fwv|V>8cx%9bXzm@m2l&+_~OhMW}Mfbfe6q=CCtYOTTyVT0gIQ|B-tR
zzkwe0icjZN2?lq;ZNuI>Q!hL+jWtZFZe_JlGDpTY-z^qlN29Ik+xn11s1+f9^lS)a
zF3TxAB3bYRpW@N<c<;-~^!N7mQ_I{Yt{dV@Ryip<lcCWG`0}tsCK38`gdBI?=gaX7
zxNPzxehkHxsVZ8mA1Kzf=!jmT0h@&$#n-8u+&@$0WKO{dOFSzQ4w`$La?8eeEi5dA
zTo!bS<mRXp-xn2Wk9lpVi36T9-N+vLEQAC`gc4-2ro@+wea~<A9BrlXfDF6Tq<A?3
z1sj_`BhsQ<n;T0r#&~hE_)tS|hz+saIpaa@A-R+$794A__$p<uHSx#v!CrN6=c-LK
z#<Lb9op){L>pr3-L50ww=2hq@E3@=RgGYS(=3lqv4Jy)<nB3FkkJj`mgtuqa2L)-E
zioUw!Tx&fC&am}yTkl7(JB{oU6_Ypla9abcV2SG<+bNcb!36DOfAB93u#HwoN2=(i
z4H`VS{@?>7^uY>FG&<JkDDEvIUdQVkVwBjZbENISC%KRt3zsuLe!N2e0(rr2WyRj0
z)HW{XZh?He#HytD-dqan<kM5IL=vSTe7p|M%PR4#6N8bL@FhJR$%8l&(Pf1nl<Y%4
z8q++Ia90f-aoY0W5nOVs4zp{M6QA_u4hT(F>(LAiuHMQD7Rs)Xu#Y71xhgky*W{Pi
z_UF@vQ&r5vbY-LKYTwtlD<6n&p{aR(B;9kIjyeTHs;_}ECBCGa5;=C{Nir4wA5(Cp
zyh45o96&oyC-4DR3fa0MVR%JQ^VIGuaPzV4RXF&d-w1fQMc`PqEd*_KOOF7f_=>to
z1zyduG27u5qN?~s*er8>G)p&oYC6_5CM4uS#d<RzIo3G&W}VYn;(vcky}EdVae+N#
z^5O>bh#(Eaa!uigS-x&#zeB!L30B6-K4nQfP1t^zJwJ{v=C`!V$c2husUI48D&Ic4
zWdLov?g(wtIpDVs!1KI&NN{4)kVUHEpZX_529MRMl9w#xe#AC0&1=+30zUZPvFZF-
zlu8VLctivR;>)n-YIRy+q1MyS?+4#YFQt7MUFgl8j@Czpg9#QT7Z(v2l6W6L11JB#
zo9<maxR89Vaz;bD&)&?Mrk~7qTM2O1c;~Cf9{H+*$1dJFReK9egPtB4_{2AnMh0y0
zZWo`+^zZsO?Q+G5Sx>weYFr#iQh$A;dE1J{A?E9BiNxgNK^5@l#zx-Ud=8wK4wfjP
zUi=hb6y(Eo_Ao9Ou%l6N&Kuxg>cFX7XE^mW<0O5_v5wIKGXda(VMgHPis_`xL2_(s
z<1J#;4S7w?aMgqxy4xd88nj~e@1kO3<IgWeA`Q3l($W;ie2=}|7jw%}Gc%hE#9_!s
z^w8tN|NU`);$w{R1}^Wbu13W(WrvSTYEoV}DkczEUv~P%j7R^dXV8R&BtL<|WpgQ3
z-7YGWxj-A{=cniG&E_U;%Gob-<%VRbGD_oM$B>67NP1?QCbXw{H8Cdy_R-EQX@t|`
zT3(R1@IsYEerAHuhtdY=AJV}@cpXMB0ba*y{BO@Zm<lVO5)~73gJNu?!YP5>x}~|f
zl?(eYKQWQX+RiQ-=#Y&Ps~GlpQ9Fw0HF+Aa56~ZOBKdbi4oB~dhT27wGX3~<&1U&r
z<Gjopj$i?QPLDtdLA`y+nqv8y?S{`ORx;jRk;blH&;rb!hkFhpjvJHyPsexK?ZP6r
zZGs<_R*PJoJu;Wq`Hs1HEp)s}x5mdZrALP&zst(>7KVx(mRPp_5<M%J1d!@_C-F(3
zI)ztt_6^Y~aO|^DbHF4d&H})Si#7fO(z>N@Adr@|2QN>@_@-MT>V(<jmFl`XVSebI
zo}TLzW3Oq28OS?Usn&D~wb#@`<4kJ2Du76-4(|L2tV7hP*vYU>R7?e+XDOo6+JGzF
zJ_o{c1(70!MqL&54dZ%+b}53O>UWy*?zV~9*VSc_T<v0cWHS3bU)1r#3a8t;<%bc+
z1_Bn}J9U@knO&V}8t;$4p|<yI|0yw@ZFTK}Ux@|cj?a33=lXyR)onTT?8O*~nsPa1
zGv0a5WhMV&fH^9B?e9o|@e30CZy#Oa9h!ztQxP*XWEdx66T|*1^I3-5{revVQ{DTr
z^Yb;py&h?~xoV;gWBh!2IgfeAzf-Qtt0>f|2sD9k<<2@$fp1|g3}BkVA4Duc`S5SV
zD8$N`piISMr{8Y|?np=pZd1x6U2f^438Z;4+ECWavrnqi^s2hX!zkfkc?(a|-q|AG
zDQD?%|6socMX(|~_$P35^#RO%t2;5d@bDcms+T_1mNwy-(n5}fa--#gE#a~z#09%j
z(#lXa`MM3gLIB*;l>b|{GD?K{5Kcl&{4V8ThDMU0cDiafP>Ymq-+npwq~!Z|e_v92
z>X#<f9-f|z^LZ&L3WkP;@7OK%^N|AQ&!5*sv~dN|;lWG1{)1`oO_(_KiHdK8{q7p#
z<5QlFh_4T%`S4)$w5buCiql(xIwlM4w(b)7wV{Qn$SVHe_fr9$&kKt*yTe_?yL-$2
z4P%Mr4%uGEnCDUTAD(ys<4udT%0uk0wfTmvBz{9k_^x%&-hSC|H2dwDI7B-3AU1;|
zZuBR_t(2dF6d)fdV4&-)Dub^&ae=J*;0h%KobiBf4n_rUet!y>kq{Lg-0}InD{~AQ
zMy95#BfOKqDCCiIqOUHCRd0GW-HEQs%M-M=w|6y{pjs`pAH88)QiURCpGb>A08GUE
zJ89J-#};d(-p#13F~1+_wf!xfm1KX-KV^E`iZJxOH`Zp+yz5P3`6*Ems%D;JVex}O
z3+`)88KKNK(&;^pT^6tJHW*E-cY9~JHLvCk%%#)Y3Eez}2Uob~bZsfPY>cx_!0xP7
z?bL{{`O@4FgQ8VOF~lODD*XxNWLLOxyd`cUog1HJ!W4l2QJXg=Iv$D%0}9YK9oz<p
z9`6popd~vKO(PM{gplyqe2Dl4DoalG-uWLtHj-~_>N-&EIJ(b2DKs2a=d4;;S;1!e
z<bE05+genND=sZnPE87b)JlZPBv<%*Sk%RHI4qSH-#X)8_%5XAH+XEv*Ty?ozG%lb
zMzgOZeP$NE9-Wqen(*E-K0IVI-8+1LErWUV@lR@T51-<xlu4;=!vOY~wxljvn$!@N
zu@1t}CaJ?Z>fO~)`;vdSgRk4{=|T$|voDI?OPiDydr>dP42wTMBEz10-%0QnNG=lL
zK(a3_91VDkBnu!9XKpt?c)`_SijU#vdXWk3-CeND9m(dYS1;mA3cs1Bz&@}d#fNEW
zYW~z|(xz22MFi7vPESvVyvblg&h?eD8fc7nr`W3r9{SvIh@SWG@L=dvUk!84ShbFp
zkkWFUZBOXx>EQs~iI456*1G_Bq}>93`*(p<hd^?9=N017w3~)rAPwbe<3Rfg%mB4~
z(R%sZvtdS|43j+RT+Q^*Me4&CGZ%&MhiMqjmgX;Z3)!AiiP>UGit`f%r5e=+D@q<8
z7MB#_r(6BwEiApuF4AmEIFvc#Pl;*tG}>v9>W%IX1p+uBedYTu&pQrld6Nh=*1X8L
zBg32B&zZ-&`*|`XtlBkcIaiTBhY+vh6rIUmM)fHK{qhuGz$SEOi9qUe8d#NkSStVX
zhqz?m!P7TTKtd}5f8$raMW-NFC+r``g9k@m<L%3Qm_dOwFo*-e_IYS_?@m@$);rS%
zWz-OS{lZJv5BdpwS~c3A)kDK{GXd0m4PV(TsjeP%*X4nCLs9n`ppfhGfI>ERSpq}n
z0P9LLe#Ul{9IN9hv0K@s={VY!G{$kJZRLgGd%c|fy=503fj#}CL5?#k)KcxUzWVTv
z8sW?HiWjbX%E#iLW&_}iXcGo`<H}JNVW)oH2sxm&jQgssUdJgKO@-6h6c@awKJT~u
zJhKw{GIQgRDn16IO!FB^`5=f1L*sU$!4)E5VK+ej&=cog5eQ`k9W4@1OQ0N5NfmOi
zs?&HK{P}|yv8rt6ZhP`hTc=4@Z|>JLF1WIb^Y(FYiFuP@NAA$sf}|{h=HHUSmoL#7
z-pr^1t-NYa><fe3TW<Znxo+m=jf<fjI!)(ELtIO+`H7vEXBldol!p64&<AsVorNF}
z>rXyR88@!Eec=tQz<R}s>epiMfGYILe1slL^S;g54*V*YT52|Cn{PKTSSsdJoP*)P
zV>jdI|2T`EGdV67=u%920#08B{P2c$X=Hvc4np7Y2|y-+3J0u{rid2+XpH_afn<^H
zbPaS^;<A5>1?JvnAKvX9HvO#g!M-FEzn|2X>bJf9(hIQU^@ZlH$HOw-_x)SruWj18
z=c>C+rj&pXb4&g4=7H#LS7xw~wQ9$wjhd<tcUO$HICqXE3SML&x{;NS1AF?<$>?<v
zbg>8k!|Qt5`BpB`{U??CQCiyB$v6?aLa(Ww$=sJ>`hI}^1WDqucH9xF<7hMThH%|o
zV6~<o9PDy-uk=|%#_ZG(qX!){<`y_Z8(PM@q_9K-B%sdaoQnbI*w=S9Xa9~1IFdJo
zl%jJ+jQNe?{k1MF#m>8o3W4Np!-ZGhx3;l#=6#M0zcaE$WzRz1E>!j7e0W51Prb4Q
zawuILpu3Bu=nm-VPdS)}hjN`OxN<4#m5fj2>%7cTcUs!e^LX&d7jb_K@RT1v8SaD%
z!!Ch)`SB$YV4+StjGa$$@&voQx)qd}x`VU<?w~DZI|1Ygcf~s4$(S5)L_+eNNg&Vt
zH%7-oL1gX^5=7C<R&F6l$J-iRePeNtyS|c+AVMTj$4i73gSJGd7|v&p|AK@oY`8c>
z`ym|!)d?qn2-4%HuC|Clc~(In^r_#Gz)Hk6K)M*C4=~lf$%A!*ll|f$h}kMYju4bH
z7y|iQ;x`bDBT3l&WJSS2Sok}-&Y}*OkE8U*jAI^mEo3S0_B3e3{!0F}L}=Lw)<Dha
zf9D@-ILXmzC)3%%8qA<IsQbK2`}<hO2TP<aGp{DYMvw;`0m0|rpqL<BmW3WzQlXr9
zl@q^diQdZYBIQ?gk1w5p%}1W?E%x`Q+kjM|DMa*-$YOSqfL*n}0q{YZ3yq$goN6$r
zgwP;V3Li?*lE5#-#JS;17Gc;X;-0AVk>J5;Kg@Of9juX^#V?ct$3`DjB!SRy$Uj)`
zt9mZ=+_mf36UQS1=GOl|7a-GMnuO9DGcNTSc-bMjdp%Cr=Fzr)(Y;&vk|YtbL^v!2
zXZ-pN4i3d0ES-Z+JPe#TX{2;(gc>B3EwMtDcm$-A*)|MN0jEm}3N)z&3^_WacHRx1
z+6+>8pPqgz53{Z;zVI=HW$Hg@B61vLjf4PbZSS-nG1!NE=;cKvUEjFKbNNTDGPWP&
zCiz}Ph9|NOTK^;;LXMu#ApwDk1N@k3S6giXZaurPR&389*uDTPW&Zuc@k_ur#5M6&
zf!ZCDk?7HEd&=WG=M|p=RK>x1%k-zO7yQHigHrWRwj$;<a@?q0xOAxdRlR0srDz)5
ze$}Xk7JmnrWgs?=?k`|1{sXMfll*}FGDE<sS!lwK1J+p>zZzuJC};!EMDnshP77(K
zGDmBn>I9NfAu&KtR8~>300pzyjSd-8sPZ39I_FOg2q+irzhtHVv}0`y+5L7=5-Yyf
z=BFAMpL}8{UuC*I?4F4SON=dSGW_F7N1Qlk-gT?}<Oq!R9ax391bq7%<jn3*xIb}0
z+uH<~IHy%qr~nzZwXoEz;er7MRdDUvwZ>QQnmHv@IP&S>$D?IkO-<G!%eIILr`hHw
z4UDs1ZPDP@Asuh2ll+T@@K1Z_=5(;-(9sxw>@H({%Cvk_l1G3?eW;!9JaC?f+kJSz
zlK}i-|LC&gp3i#~PQfgJYqgfUm&D?NZ+4ZR3lw}WB|@m<Mg+mOZk^}vpMhyPIjWEp
zn_qiWX*-57xN+k~E8(Vf{+BQEnYp<x&#FL$?xo)6VYhK_;FT+9pk@9mt-lHLvn2yW
zfpB`Ht-#03f5dgwG?MU2da0qH)M{($GMJ{v>)?wsXFPEXzXSI7R6+gr0~~&`cV^n(
za%C_b<4r2!XlQ-;JP~k}H(;5ek<3=}5DS&uCWA5)Uy$x@SdM{cvrb2Wy#*Mjx3_n4
zt<P+Nn>pwrD)ioWonKnIMnAw^4FoD3UEQYNYm*kBA|+(q#la&e=voeP)Ny=(tp@*^
ztiHg94MN2Cd~-#@WOznQV^`Uj8r`?>GppQz%;gSUuE>YLO#}D~2~Rvp)`#NvXSn@K
zVy}bptByYr8p4LJaTM^`TXhgLJAf_hdY%5pKMwJN1}2CNO=tkO8f%q+cAlL8^MgoA
zN=lsyL&c|e9noD{TzuWl&8=*ZgK3e92tO5rG1f86$;=D~Ekn&wJlZ!ylg^ufbb=Eo
zss9r)mpM7RxHXxON(wHDiEx}Z2b0l`?U@ZK_ciZ#mF|uJ^h_#3Ed6x~oY-GoWz(x2
zM>dTx-e#5Q*OZ~rJdq39hVP(fiKTcz2keOKF$g>b<ZNf({C$o@jPgBPG)=3l^k_U)
zU0toNC>gybYB$6IN`#RK5^l;yM)7l2K9$5EpEk45t?W**YzU^G)v2ZzwtO8G6?IOo
zb7+Wnf4M9PbnG-}ym{Rp1mqN;mjAah07&4%&V&6MeE)7=oG#wA5!}ehpS#SM_jGs8
zn!B+zGt#)Et>G3CYWI!E0|>+bT1?6K-Gn9P@n0fpyic+n^Oba{V@qBQQa}4q*1*PO
zSpX3YZ6mu~_xFdi^=43FrTpu>vA#Yx(CeR^(fXMO5V|kl6mC>z@51{l^988!3xfNs
zl65yQ&LFX&T8s+RtLk2G<sHj()(81=BWg`>8c0b~O0P(01fvdj#>Z9e3YAg=A9@I!
z>A%%;{^3Iw5;K31oyrR{*wZ`V>=%YKHcf|7%Ru8Wyk!8Ackp<!EHXsrxF-Viu6Wj8
z6JPXis5A_Nj%}7$AQ*c8CV)^gg_{&t{+@E=K60B37Hc+gsOAJcM=l{+j8Y!XBU$zz
zXmy0N@iYP?seTtLCmtDEV8X&O5T9=Coww|?$kzwrD0^?_W15JSV&3;mSF<HI7k~Zw
z^$d?Ea%RR7fiVIC*~S)UtT7vc+1q)WI=n#`xSA@{e>_gx4hDzXGI?s5?czoBrqa;q
zojACYrJBnqH!~ejq!nUbke@_|2`QL8zNE?4n<2W2O$;eF0S=Nmzbl`HJW>I&QJ(+7
zMqg12L~yFaC;>f7`={Mdv2{CnHgD2=cy<%9{N~n{_^*T@6z|mh)e_$KE-o(Oz!!JI
zB!;OrijxzRUBk<WT|SuF1V}_L$#<DpSfqVrA57~#cCK#L%s!omtR4y{cX`K`kD&nM
zrOpImkof<q3H}#@92RM)HTBj`G+uw8ET{JN4)?}vdxRAD?^p7-<8`hyIj4b3{~Q_t
zakD3oRMgQj=FdoY9M$?(TAcMNt^n6SAC?9jv>pKc>rVH=6dce;8u=;WvMgob>^#XB
zTacH=lq%uDuRU#k#5-;+f;mgc^-NJR_gt)MJxTBft;A;Q4_T=2-nC7e+^`J0Vn^et
zY#&DVDud|y)T@h(=LiG6a#t1g%3tL;(`2D$Z<UgKPu99`W0TE3CIX^crOV>GX1B_*
zAK;0(oc!%TX!y5;^uL(fa{OdT*%5oF^p;n%pRT?x5SW>qteW1uU5MHr?!v?Ch*2dw
zb7J0gruaZBih6x?ZwK6b8<j$8L`D;ZGw^(=hDWTY{5C<vQ6WX-zkUE^CL7Az2GCFX
z^#D^ytLHN{1eD5xHxX!>w|$Q^wX}ZeeC;+0eUO`#<(Ty=IySZ{i!Ams@8OtQ_Qdxw
zaP*#gS!MBj9AlX`Gs=kFKIALp57lpKvEB)g%eBpjK79N3EyJ2U=!{hFtwlXy19}Dh
z{|Lo{?c#lQBmBOYo%<;h#Qt(|qV7+1^rBimHalkW!(%m5cvCA2zqt1X35c2!p+v0$
z2XIb(3O2?WmW8Ha19QL};<Lq+&(T+*;uEH-_AV{pX5s(@<ILhi*>Nm>{c88Oa{vnN
zO#vIY)&8R%@SWB|At2;RBsbdvLv9DxcJq0tW(T1R71d3*l=RD})?1U?)ZtX8O5TF^
z;++DsM(su`d&yTf`+32aivuAhh7Z8gzbSV(c)CK4Ew#0an(d)pcl)as0O_Tsmp95%
zJ-TwFt0da@g<%GNudS+!@(;0tfQl1lIqt5j9~z;N;8b~$h9<yD7<wixW$Iv7fK=DP
z;s=Pr@o^d2zp-KwNP;A!TGqjIr##xy`>Dz|Ilq=?C<0&an>4k<=p=Vfn(LN!6T5i?
zev<%4RR$2a*$sTtH4hj}fpZ!^{Tl({B%EXtqvGl5rnmQ*B378bRoPAjivKwST!18F
zyJLL!at6Po*37c#sC&!JQvgt9aK4oQDBD6SX5=drIcBFBKMz4a$N^<IZKHlrMyHJj
zAG0-N%}-ALlKDC#|APd_bmof;-E|-w+T|m@-WucGj$@+99w*Jx$#9$M_qdru?Cg>K
zn8rhQFb@bkKo*KHnbTFoD2aW2#t*cEp8x1qEV_8BHGxS{J9>Fdw;s0sA%jpR50><e
z_3<2@XOm{2AXvK_#1b1R0O{xVYmc-B>Mw`pv$NoU>R`aCs5w|qv$9OY$*E<aV=q4i
zny*evcNS_dOFnUocQSxO(k|s!Ld^mr#oA_dW4=p>QiY&ix%Qy?_$x2npXwG>jYi)k
zqSu66ASsXfKe~n%71sWDFLPQ|1~>hOtAAV_EDKsMS)eS-rLcTsA3PXS)oJjWYz&n1
zo^?)C^+(5YzhqN|pq?7IeG$u9S|WfJ=N^gTOGY;8RKDV#oxjUEFUT>twYhnHb<i2I
z<MTj$LUj&t<F8a4%O&Mp+i%&7K<_L`SgeEZA$rC-=F!WQnSYC+`6#b><Tc|c!TMT~
zYE+2eq2|ZNX>O4wYZ5~tu@7eux9T?TX&F$Qpc1rHbjDeosMsc58efp0cN<tf0WYZm
z8@6q}wPGe$*W!KQ1@tl58i*3ds-{tMg9F6K=h{(WTlLH|;9yyfe&|>_xZ(aYU`R6*
z%bef{X>K*Ski*8L^z&omwnpRpGq}8Jm9%Ys#HCyrfa_Yg8enNnyy(t2ES`JO?Bbyt
zvwi!?eczEzx6(6Ha}H|feO-HbhNqLwTvM-7tdd598p5iAZ|rn-p9k|fzGo-a0G&S?
zorZs5#G!`4?YA6|EM@{f0XtcR(k-MqqL2+A6aFIwDrn>RLa$lYKx{h*R00GHz`D(!
zCCh-aS1?Vkw>$_hPA_lO(bEodBlE-ZNAzfzrUF*;)h~wz+j2SV9AQbhn--q4S%t?Y
z4RFK?+6GnK1HXLLUxxsrW>nggbhJ*?@FRpliXFGAKMMp<K|sKkRQ20TOHXfR6Tn0W
zYJM$hCiN<A`(J=4PlAi`8vB&ouAg2(HvSuu+r*0gMo0m>{&1NRLQIuwu(8Gg=>z37
zW2c4zEK7&4LrE0%_xv%@!Z^(6{?sB@%M4>cJKISWQr-(sBYVpGmlb7Nw$*#XF)D7m
zSjru{Ezx(^@&$GAG&06Veq8RT-h7*5SdH}X@a$$F{|e#4AEyHkRDk~|>sFIRlBC3f
z9TclWtDy=!iwjswrtpR%Y2+*%WSDOFHlTTeB@9Y-#N5vOjg*$TmRzC%Ie}m&5sKaH
z6<SQl=fjvi0cNvxW>pi2uP}k?f<<}w*3QxGVvpe+#ie7GRS{3@Wg8)4@CQ%UB&0Zz
zmgdkL*-`Um9qYMT6aUU}BwS%H4l0fEOlF*hww8CI;7l^n3B|t&J;*<mLH<P=f{P%F
zx6c9;Y2~EDb1=6h$KI-k_t4|Pr5HwE3u)nXv@sO>q3s}tXdznrvxWn?iSKC+E#pat
zvHRbtFE*Z`VPf@c8x^o;#!(q5A45n&CL(_iWAbE;K>r^}L|T)IHc60=87GrtlLuXQ
zsFmKoH+_od*4oWFv9(F9<dCG)L=>90yd-#O?NULudNjhfR>?|3uDJngsZ!U?Zu`pr
zkm7ONxOtUq91YdB%Dqpr#)X37#|(JzSuiZh0R3(}=k&k4M;7prW@Y86FQEy7y(zpD
z5x6Ke@B-Q{EpCu7-4KTF;OMryJK~clwEZtZBIxeq24HoX3iQAj6#`|iiAd2m<iEMU
z7@oso`}>1m;f9@)6kCDTrjjL^eRg~i+(>w=zFtf-eYOh2KxD&a<NO)XmiaTKjRRR@
ztY=Yf3I!uaw$Yffg1ewRdcoJ{U@TY5Q1bDm$z8;9)M&li`T6XKp^amnNSR}&r~@nS
z0^2doxnf$ALB2Ds3y)_cZS6g~QnML$8ndY!S4mRLzo)Z-qKcBYOQ>-Dk?@V_*Zyy(
z%QX5LEA38C!bhrfLq@#k%4Lv}hOVWgm#nRryOzGK{ospU&)-o7S5K$4@9(RxMs>XV
z!EvS|WF=pI_!kY|^fXmk;Ukssuk6lh*^92%6J3;wyzYgTmPZWbGv$Z71P84DXo>#m
zGh|gu%lK2$xbhQEkfJTdQ*BYTF)LGK?y=9zvJkhlMQZ=jSrf<K7}wpo`)xus>D>2^
z_4T5fPs1;KOE;E2{=B@tBi1~fv>MaYvKrgG@I3iSQuhVhn8+O)wJQ8LXZF+qfLDt5
zuI=E1b~TOEaPV~(IDcIaK^x&YETo=wTnW@ru9SwX5zeDW2fcj>U|gsg`G3j}>FMb$
zI+GRGN1Qt1&dcVP<3F;onGWL13rh*PLHws}?<VCjfYBD?_Cu}-0TW#|n$hd5=Qf2K
z#G3Mt^diYVDeKqP*haSItcE-)`qL&5sMZ=PU7;8<oGp;0rh<@_KCXIlzd)e#6mPTl
zF@}%_KL2VsHCLEL|H!l&Q~F5u(rdTOMkuOv4Ny2s|Ea1zj8n6yJ6$6rHFEeg#jVjF
zuKRrdTgYF11vebVk5`p7X$3h-&Yv+GOBLK5rJ@hisW(C`M?G_zNAa#5PV+5(RcNU9
zY%>_1YE^hUseafKKfRtd9;&hzKf7pU9~sI(=lj|yF)K!qwEu>gPShqS#M{IeC1t5!
zpLuG)==e3jD7EmK&sYRuWB?%%$^hMZu@7uTksv2Nr2K;I#S-9&!Nz<%+oLH%rCX^;
zaX>(2NCzS53pO;m;rR=Wdl0oZBZXeVLXCzFGe7|0&mS&xh>drsF-Y`Uzg>hkM-^KK
zny04=TLdE&NTn|R+ujRKRIo1UJln6Y{Mc;i>s_H$<1&kdjfKJo*cz6^FHg)rNsAr1
zh8#1Dzx(#p>)9~z<@JqMWlHxSzfVR^r9Frvw#+oP2hndb^CIe3O|E)T$5A>Gi7Mka
zh{ewG?pPC4H1frvGk#4<>1PN|NFBOXc&)`ut(#nqIq6mWA!IHP4g=p;m*t$fo|X&B
zS-Eknd8$yy7>7yyAGt!7h1~BaKIY54J0TM5_cZZ3mMx$TyNWaw323|gA(DLlKape?
z(1+{@M3k1=qb>O0r~CecESo`WcYxRk`p;rPmv+DVv@%pm5ob4qWN73}L<m}}Zo3;;
z;sK9Gl(iqGvd~;9y2#;Og<5;a$B1-9e%`3z6a!*!@ddF*?fw#1=78>@t)+J?{uy;i
zm%OSZW=@&kEpM>-3Jpa}<wk*<+d&8Whguc0yP7}QtxN7pUR4dnNbO`$ricbGWq9;3
z*=d<}v#aPw-{_r}k6x8OuT73^->*{_H+QYNNcdemNH4o)elJ>K&cjLVrI%x;tccun
z#^Rf6l?|DW{R0$XwY8e8Vp7y5CRkIMy8?>j@;~?N0@MkrH4YuU$|J@yNerhbnFr=y
z8<~vpO=g`5J>{y6m!F*>tA6}B^>T>E)Y6ygVe`Fm`&p$i?(xgaZ1P8w5;mz>{FRO-
zl0fcIl?u@Zkz!sTEYLL5d0TGEWhYkjo0QLWr`pKT(AVhML@I%51)yR|RG4#~1bRO&
zwlJkSdR+rnW~nXwO!~-jI!}ztTPUjT7Ms1G0xhHgAg~L>ePX|Wi}#Eb?8MMf4uU)(
z*6!C}94QD1MZ_pl>EG|KiHJ0{z-##z`}1R!;Gb=Ej<>V&@?s#FILDyq-K5o4G@m%0
zDG7>zV6V2+nCu1DdtWm42@89DmWh`m+ZDl8Q&n>99W~l33{>=$I)eMXR-)%`KWo<S
zAGvz>?CS1nE|X(xmaCTLV(KCn;`S3#FPCanT6*u|Wl#E7)9>gBr*A}WQv2GO^k8Is
z9v6=ssp|f&2Iv`mEMCT%)wUo1YKpyIBgms87fr)QzrbQxo&WKZDeS7RYVB{I%+|Oc
zoW0X)p~lra0h;SFI~SA#*ZOiMle|W!K3&NW8n@uS$sA2@_yUlGZPY!fqwO7iyVn%Q
zdwVzY4(yx>YT;fFtGw1fGHSLyAdqZpuuB@gVqPud`BBg3IP`Ohb^dktDzAlsxdNe`
zs_P};<X9;3JAmlCaf``-;Dng7j1w&l46=zG{_N1auR&+ZJ)3mMnv#aoly7~U2bl94
z((OCMWLww&zWky~fC*&wx!c^*Vli1CyuLl`&;lCZ)6y*FUYc79|4z|=@}!`rzrV%4
zYMD#esy!+>nQiby6i*+Ig&|EH@}1pE%`lZC96pa`%B2a|zNb-Xk-fOgIm1mvi_9J;
zkj&lOPSd8J)auK!&Cla^k<QLv2}k6;r2e_-T?Rwi_ExTX*=Bpqp?{CxJD9KFtvK@Q
z{P||{_wd;gsh_4cTM~>K@Z5UWas58h%#rk@(TY@MAJp;0b)btet`<1t1!s+jMF<Rh
z628ps<ED&y5ie7H`@-ANtLBZ)#3<9+YIP>hTsBDr+q{OE#71D`m*|~ew_^%mW9Mn?
z!&7ESnfMsqrdCL?AiQlJq1uHnJPLR4HeXcwVUYueA?tq#efka{h+qA}hd)$TQhnkG
zkr-vMnjiD!%lp=N5d~@IgYbGjQ7E^6{iGWRci5`{vzfVN+PnUK%SAXQg6Tw>*U)d{
z<1M}iQ59OY(G3<`M;4cr;d(B4hk}`;48iy;KNz140~3<s>n2uKAe|!itOHwaW%O!u
z`=-91vLCIQx9s~*AMXaW5C+gO^NZW4Y*wLnie8m9hF6hNWnIG)lQ!h5J>0*iTNHcb
z7X8iRJ>bv-S+=|ty}IX_a_Qo*(MCa2In3wv^7rQzjiyd}o~tiEj?D;+Pbz)?T|8ZM
z4C=&Fue878<HSCZ;PhL4cY$^-;AW)SU_ZQYg3o`gK9BR7<qZN%V?k7Wd)!>*_DaEe
z-K*%Ip{Bc?Ss&92U`UMFBLzm##{LXjP#V~39czlL9K<)M-v{iT;VR`_B>*m8Qpx`0
znRN*Ky}dn7G9&eodxy9-R=kIm06S^`&z#*CAS3t>qBX9v0A%>Cfq^-lFE$S!hAj`5
zNx13j$Kpy0=Li)86scChOfNenx4LuIcyx4hfPN4<*09T)dm<Cn-#ezfRn@co5^fZ$
zr*oU-(&qG#aK*z~5|rC<KjEOA{6V0{(po0`Xf=y9`sWDH{yj>S^Gqf02Cw`wb5nvc
z(w;{mCBsRKk`MIwGOZOwsw+K7rY7>$NOtyr1=39)q_}d8u!R>U(&MdWX_vMrHl(^b
zXEAB)w^vdOV%X;x*oQksQ0lq$^gLHB73y9YZ)AiFv+BPqmI5f-tRK30-lPCQgdj$N
zR=M>h7aNL@tzMbFrtz2yFTRjix-{m)={?M!aQVWk7=b<~z%%6j5_tXps+N}y8}lcX
zzAPdlqChyexabs;JX&fOZwo}T@U_iFsKlYsF_HP$Qg~KBUzTNpp*y?F#Ka`wHKRmd
z_-a;mwqj^faCLFS#L@mL97yeL`2jPR4ad)-bZT2V)my$=XFiRMOWif8tD0Td5-O7R
zAyChKoleyy->-y^0d2$VVp5`;^ykD3dV`z|<J9vLmhr@I{QB7KkXWrI?e*B{%YAC3
zgd&|0;Wu4Cr$nsmB85qBOCqOk0!71d)=4+yUjNYi%8NNw5|mUmf#aQL?|*}~)Rus+
zL;*X;Ra&6e<ue2L5(^uP){mc?pJfuE#xYJglAG(YB2xI0ViNJ9WQ|N9*;^{G#FaUr
z*e8UjgT$~FW9dt@z{v%HldsP7nOop$b(CG3eo#_-4A5d-CU8v;5}@^SZQX|L%EWt@
zH!t-zH-DyVVng&~p?Jpvcz@0Jdt|@w2SuRK(Xku1g*is7)2e>tMkFh{@&1gCiuy*7
z#}F0HH14_H#NFa|hUsC<rKGL(Xmm#J>WyJTMGhaT%SqFT)0Hf;RFX7dTDDKov5a`D
z`o7uWrc(A?6W;SZx5QUZpN1iA5V9c$Gd+)Ej>iG1&AI=q0@pl0*(ETcNNi<aW|9sN
zy54P0jF1oC=cmH(bR>c^Z?5e3cjaBzXXdn?*RH_EWGzXE3A5=c+eDUG?oop0jxUts
zKcNG7L~kf?ohPc+-K1bwgu%NqR=#sXe-C}Sd_$wC$>2igd9ApsX3tgQMcc&Hb+fBE
zD~pAYK$v~F1;RyoSrE!&v7dLUq^xYVcmA#6clGJ7165gB%A0*VuY!UoggS%Jyuu3w
z)!BNv6jD#OyHw!ODWTFs{8yzHr}^+g7u=+WN3HJ)>SDW2U9}_v$4G?o^-5Q^e{p@m
zxidpl<wFZ)^v;_Ro|NXjcdc97FByLK&i~{`K3R9&?I~CzD5{YTCm^@$=9xHL-Xh*z
zuygr&eG}D3$~?m6#N~S1PSF8nCsoa+e^@F#BG?T}RKMtszkJfM>7e|Zes*OR(L{PA
z#C5P+G;YF9m3BI3OTLbN0`Q+B8Bf})Rlr6HTjB>H83#%U8qeW6RN=xE_jG_PISk&$
zB#i6mTR~}nO0>{2Bp0JVCr+Z+`lTvjsBI(*UG}h(&7jcyCBDC0#+PA`2w04iKM4V1
z>v%EU$m3Wa=DyBOa%!y3H*GnMacy!nheN~cr2wCV<skP;(OkofvS!yk(85dSlb@5*
zn(0hKfz^@ik!}(+$zbXL#c#`ug@m!aL?$&)FzCQG!FjrT(P^9r<y|e+)!E0^rLiRu
z>*;TK!4Jlh`!P!P6B&~=$X$R5!ndyvb02x;zRqKiT(}nPd`quH!m>kjca6a4m#Zn5
zxoO|)OvPHwU&QJdYP+k!O&S<YM_62R*ZL`WzF7e1n{pa@O1--+ZbbR(u*nqBVyB@W
zAmck9n9V_^xpW@S;naB;lDAgD+J+ri8hw$x>R)!4s*H2bzxHcR<Go^{$>XORG*3U@
zlZ6rN(M3I#t=px2S(BgtAu0A-&6giWC))ei(CHjPNFs!WBJ6KZ>q~$g_EIE9eIVc5
ze@N8{W{+22pulw_(V$0sw%S|>`S4tBM8+4B)MqpitDD}{TX&6e88Y&}j^5Clb2?1a
zsGaTioH#yBSQFw#LrwjBynn$ZeBDH;p5!*l-n{C^kh7ZMVLqs-mf8;fYINHx$%8|}
zZ7H)i`-JA9U`eptq8v=;v&yPH0GkkWnX~RoW9P|dkJlp@gKrqe$n3{^xc?k2d>kob
zT8*^qbt9c$Pml?X-aj^>^^r+{jqS=Lu{h*1UiU|aHuRb~PMQqA^>;jQOMfQg$Ub3G
z`RTTx%vGP>8!n}!znkw7)Y-HTaaq+feBO^U4UVOWjlJR2r@zy9XlerIR8+8V$mK${
zpN};EKI2zdBfMBOotWK^5I7Ca;S3DvaXeyCyhI6>DeYwWmtMqjh#R)SY|i?T1H)Yf
zZ*Ta7Xd8Th)GavGmttrDWr7jx^;na|lrkvYtkY@Kkp!puu72$OrBl;wl>O5>KoXei
z_w#NXHiZv2J<F8l)j?69Q&6vw#5?^k;-y=-5K`$2ebe}d=OH7YCB`u%?))h4==_r^
zI-4cXk!O46rtb;~UVeU={*B?c!5x-;ZD6wtdm6ijcwrkeZIMAi#FKB7`EF?vbi6@2
zBY;GE7FB>KklqY-0dpl*O0GAmNTz-`sJ`+zF72?3+SMiu-ue*;VoUpzl5F~*sr^}z
zbD2>)!?pS?!J&Q68{Ud#s@PXMrd*`Cplo?EUU=WQ#|xNwd&T`^pj8df9)k|t>9<8?
z-$%n=nPx>fjEjgK7_i~3ewBGQl_NHY0;%>%+|#2>+?YfxMZuG#b;w@Zxs8QOOsixl
zmMPTH*IkcrVCvpPP<@rXcN4(Gt!JU_f7$<Cd7S+hakxJN)sQJF5WO(U`t|-IP$k?#
zQUH|w0k|lGeb-C3_$J3X5y#4)UiXSo^LuI7YnmH*C0SX#Ue4J}lM4a0**%j_dR-pb
z+sA-F|2(u0sJ{+U4@A30Um%!3lmFoy37$i0?<&+l1DgLc!_!K1@fQ{r%olnx>#u@6
zy)+sY0+d@y>;t~x1dM66*Ah0NaQK-ZkHA9g(-)Jfz8Dlpww5NIWEdtauSdR}dOv!@
z+)FL=VM%#eKUGTy6CGn-vnXhlJXqVHPtD4KzpEO^a@><syqyGOG}lbQ)o8K4sAt*T
zid>Sw;`JS}DWgdh`ja*6paH2s-_d^fI;7l8Upjjw98F`?tMUEop_QwWnqtyLf-~Rc
z0cA)}mlvP*<w7jG<bHHpLgorN8JFdZ>Tz^nOlFiq!u!2Vk?`&YMSY5!b@VJ#0S=G4
zcQUxxrvd6<yjtn5LM<YY@J*(I+jTQ$C_Pa6f31-9>)>M=X*X9nwl3*Q#fWlDTHoic
z*8Ro@hr8JWi=P`rSx?`PQr8Qp9H>f5<K!O$Ay5J_o$d$#LSE(D1}sspcJbk899{H_
zKEvlv=DX6=<CO9aINyVB7aX)=?zeJp$m`klFT+IeqO1qNS%Wj6GkRKx9s10!$F99z
z^h&G+<Oa&t@$tmdON-pfHdgnPW^~@a+NoiBmDRh<tCDiuy1yLR>p02ouZtbA4FE}$
z1_sG$T9GUGXlRhK@|~G+$<VmOVvxl~$QRc8oD^7SQpa()+u!lQ#}vJt{cal3XAMu-
zC#)xvq;&Xdj}ayG{Oa+4C01eEM5xnBpseS>NoNR(^&MT`$f!?p*;6o{lWsUIc~vtg
zFrJn<LmqBL^X}6kQ5G7X7?!LnP7K4Fwc^+-vhzNFh~e0#dOgO56U#RGnC^){2QmWW
zB_|c$+96=y(=9r6uf*bg;CWw6mU5Gk*4CNqOY_;p?t3Ln_p=e-7Iv0D7&ZLJSIhfR
zP`YqAAS9<(KYA7n{G`}Ztpci{`-x<f_m?#R#++&;;(Oppqi-TL)>+u4q)gdC!#UuC
z4w?0|L@v4^`WU|$oXr>E>ZbvUA<r5_giiK8>L`?%L7+@VSchr9le?_(iD!u-=Ui|v
zr{iZhSGn@g8PbR0koeRbbcU}^(Y41+Z|hR;&3+f=ao$%<d1qfe1_<J@e-q>yhAW0b
z&ZFUL4+&~rh6xohH(_HjjB?`hl^@t9i!1GSTlD(^1D*LMti8s|r7D$8+0+}B24@(y
z=-r<=d=!9<ojQvzsb6bhZ4M=;uOby5{)HRmC;hS&^(qR`rr!q(w|%Yz`}+>Gx9WIs
zO?=)S&<jJc3XOwc<v|=o)9f`|Ta)e<mw#%KYM#-%w7LJeu|wW88{8S#JKg9CdJLM~
zGWAMS0<M7IT`Y+Ng{E<rQjyTc1!FJ->m(?oe?<91=mS7zVN)eJzbGw&j(6jEiAV}8
zlTVsfUWJ+Mn<j<vyWEtIQd&v{jZFDxkDMQrw|zZ!NN_r^!7LU4vbb1As+4T_VP$?b
zCmi*_OJBopWLq_QWY641hpLKRaD)xf5em+ZUy5yOrs0wKn#vl1RxX>{k*37d=4qpd
z88<MQ;yxFxY%qF<1N3VP71gM0zw6@M$Z&1mth66IZt4DNW(<bKE9TxXYMR}M!Aktq
z3s6sNckBtiP`tKmU&btYcW0HJvCJbW$j(rA#Y{}~oC^BbZI^5I;UFq@W+reaG`wFg
z`k9O#^^S4E-8y<fqzM>j)oX4G?Z0^&{o%9j1<daOuH7GaxmuT=wAz{5@?JVxJv@!*
zeYF4G)F}1}_jr}V>yeEP&GuPdWER?bvc#oqmf?foC87%lHp?c*d+eL=vdP12JHU>F
zZ>weky+|d1+76<S5ZC+^eKNFRBl;5b!hQk`<cV#AO+L1`v6rRUm$c9a2V{X`KIc!B
zAp|Yj>4RioTEXck#93bi(@5-oLofAV#xE14V&OP$Z7{B&#lARCj50jT%c$ZLVI$Ag
z#c1P&wn%^(aBcFAO<sQ9m|sF0N9h|LnMtu=P3wh4QY;?)xy`2C^{x$6+wxBqG;>$&
zc&Vf3f}S2~>5k13`A6Q$aP9L<c5!ex-~42pDTjCG>ju5~ePYK1qeSmRHu^G}=Absk
zu2F54Dz&+oCbLS;_cFQH%8NY`m_V$_YTh$%{fP9}Os>iqHRRwcz4)>@;>OI)zzys!
z?OJNg1(2FqKOo{u0RdDfDE9MTTLXFoaCH!sru%dtQfh;@C8OKP;q_3v!=GkmSr#~`
zZB1JYMGyv~V=ros5S9|7EVBzTKpXv|3TzI#zkisWG1st-=SVZi{>pr3kq5p&tQ*lB
zd9laE-1)TUj<<I&pT+l2SNL7S3_~8-<3%?=k8ET*nd$h%Hjx0>uoKr?l^?q*L5=L-
zZxt{fKpIJ?fmPcdk6k@MNlY2(U2>3dx&w!evwEi?j4NZV^L+gV)j(Oi!ScHry3)g;
z-WbrF@n5CvogB1S*Mghj*h%<62(FU-C`{a6Dhi#;o~PpHkBC_Rjc|V(GN0iCG~Kx6
zedHz1{!xir+X-Vl{fR}o>93bV3>zVB^ot_p7sS^E^2$(Oo7^a>c(Cf*K_AVaRdfGe
zUv(<Dr1LOOT!i9kZpnIrUftw66J9PlBN}_lF<S2-73NF$xu3%|V8yX}U=nI7YrGFZ
z0M!Ny8=`Q$<Jk6c%>FT>K$_3;*Wsy@z~H5hp9k!U-_}5(xd8tE!E*Zt``D_bI(y@^
zzOohCf_7XxJGBz}<qfo~qGCWRxXbWnIKVjuX3$n$WxVC(U{+x4HTnCoOO^SP*7zRI
zGH-i-{5BFbuK1@N8=$oU$;A2UPB)l9f!kfC1p`+Q`#9ytaFTsHzPXYPDk|$S;B#Z?
zg6w{{Mk%2PVnT>*-;)BEzo>0~kp-4WE(!**{%h{TQ@swF@l6Vj^3qaZ3qfVTm}1?|
zene-mjVTFcO~iF7K%ZVjwun)+?5r@d=jZa$ibicnf6^9|_;7oZ$WV~zGWg}&e$3$1
zcdsty0BHnT8E9O@>32KZczmD_SV#k`d*k(nH6c_JKuTM@xeK{nYA9Im-rb>V6rc-0
zl<r?kivV1PFC|i9yEG5gLlb-1A68&gWJBNgraVMAQc+W>JQ-}{s0nXP$_G8#>mp8U
zU}VrCmoMC{kE&(ZMrCT*<-3;Q2)qc)i-QsfRB~yJ8;GtY;aGnS)wqfD2umPweEKY#
zBn}(Fx{XhK%lJbYaII5*m!V+z;y(q$Au!8VyFa=LZo*-@N{>c9ISan5T2ruUNl1M2
zhXU)=Q*;KtWUf#D;Mk3OFE1fM+cu<obm|MPQV`+83Ol6tU)0c<5)fz^B6<AoeOM#&
zS$ct<ZOAFIl!1~ar|rWkSA5CinZ)QnY!h=6M>aRQF5D9Uoi?RVi^MBupH?$SC};^C
zq2PoT?F@ccMNCto9voeZ0uWUskA6=&g0|PUxO(k{>l3FcuwO_NHQr1qgVTp0Z)A<1
zu$XCYm?549-_PKwE?$&k+O*c4_cB~R9ialydCno(IthR&m`D}9Ur;-}r(W@2DPJA(
z<glxEIfMXmBEhb0&v4O%pWHbR&NBmjFw7IYT+t!N#U@)PoC0Ra`C4M(v8&#zo`v_n
z5}w=%QeJ+yU3`{7{BW~dF*F&}?&^eLNC$_|k7%)o1-Bp@a4A^V(9qj=3<B$kz>5?O
zRYxP%H7WR0i4%v<`=MuJE-tf7KpoR#jqKS<!N9mcFU<Lq$Om0ug1ZGm!s)gS$o5CU
z!z{IHl%@#d5+n(g)-zCo1dV~XPO*+^g6;)MJ8SFk{go;WQ2Y?xkej3B`ZSy9d82oA
zd(6{;SgT@$CXpOxoZls=u;m8|vMLr?FT^5LvL~owgKb{}%XEM&Q^4#SiC;J<1Jl#W
zc+7%=F6N+>Uh^LrgxX04LGyo<K_vFq)JPjtx#o^Iwg?oOH&JZ(&GB@nt3?)dNE?M*
z|3#FUlk@C_3M`QfyXWDVR+MYN_MItqG4xS7qGN%)*!YO`J>tiLW-)uk=I_CXb>*}8
znNMe*v%?bUl|lQ88?Y#M?%14f5Mb=&JcQchphO2<eX@0)8@J7I{{marrY6XS+q!8s
z?N;c6EIVLF9h3Z3Z=ylNP8MkNUtg(OZ3fr*1V6KS;kdUs@3@ee(R@Z4i<g<1d6nUN
z(&##}uKSpFe&u0g;z}O5#T~nWG?mz(8pmDG6Gs;2y*-H7bm5=@c}O=HDDDV~A;ZGJ
z!r<oNBB@ZLukM55KnMk)bGvn7g28bdK(MWI1*ceQb-8K{XM%<C?3Pf=(LECI(?&w!
zW7na+(W0s<BfUIh9u3L0X9pWe$5CqWqQPEwm|x$~)8q17DhT8^F26&~e;4g#6}Ew)
z!4~hCAQsjA(-3Z*&2EN(<M^I%e){<|T`Zve?2PprhvZnvqzBYQC&)o01I=!j^%)5N
zS)}L5Hm)w8)&r$EbKpkE8QR(Ib2#?p)qJG@Y6ntc1{SheP;AWs{%5X0;vga_+Ps)w
zE2trJSS)#burW_Nkdo5+=IYl>RK~9aCYfv@CjA9`u$POE92lQ$Nqh%d2QJzqut?$j
z1Q%_-E#BEx=akI*3590`mI*l6qN8T9Y(^H)bfAulCeS{ToGcM;o+tv2{!h`?wF9R`
z7D;5>gq(y0;zmM>qGgkyBRIBJ@2gR@M+pW@AFTr=7Aokz8#}x1Rm`KEe!XiHDgaci
z)>P@}>(A~6Inw(eNg%ceS!O`u$S-qOQ_9Pi!@3|-B=HVr9sETOhVgzm5usiIkSSYl
zdISyQIyJn+O<+Q2J#gYMe-<+U4X(Firg(XAktMJ2I|d3sj?k!M*@3W#1Pp1}=<4Fq
z6hy^0wOlqH11#)D^cs*pg@og#QwV{4+MJ;5=DA!F3q~;zpqoW;e3p*Z4?~RwLVIdi
zhNn6H+<Cui6z_?Vj&DF86Ky99h6G~gY?^H$HFTfVNJKKY5ehQGQ!vq!OLJ`7FBbrJ
zE(OP5BqCh#vIU}$vGK-N`5=Hc1_0gSLMS9G1J+jl{FW}cL)%-Cb+Az_;ChisBKN(;
zv9YmMb=%K#yn~sxWf11%^ZxAZ>0ud5yDH|+H?g&~t%S&?%RIFH_W2IkC2_y5Al|e0
z&T!+uM2oFU)q^|DxWVb}MhQGnqXEX`9B$6=SA=uCjf0yOi~2WUyth#w`rO-!)^B#W
z7@{h82~_aW=w<L+wjE&xUSQ^IL~FUXyBiXEAfTQ_Ryd|P>Ew=qDRw27>wLpBG&C*H
z#1W{jh1g~^w5h+nb{kyD%mQj`diC#C<)(8%7C6Q$HEOckp7dKv3C)Z8$_?7W{Nocj
z<?dYqf8Un$f9)qrRw=-nAp!vga0*=(^=9>W9D1{K3%zz70q<(_xkD&SO-0oN>EuAQ
zYPa$BuI}mWZF+On>|IrIvOKu^<a49*6BQOXn5%OI7a1vqH!MH3KI5kfj1yRAkfs*d
z#Oozg4mnn+`ZO&w%oXbD;bXoT2??2lKU@D%4l$3xC0Mb8@2=bcG)N7+J=U5%pM`7l
zPA{Iv`A;qI!D+W63dK<HE$*0wod+JOcG}vJ?9<lKl2q8uMR2ds_1Zooi|Uw|n0MDz
z3<uRi!S`ah=DemCYp>8P&d$mrt~E6=S=Ol_adb4(6VpKwqY~@{k|~&I@NGHo+|}X#
zZb4Q0Jhr<WAaYPr6KfdMgK2<hfA*)3_}PiMlA-HfoD4^@*SDVn=S~W-xGVEt`3L`Q
zI>_67d3iayv{V#PZUZjAKyLN(&dm4k(N%68g1eop9UMr@`j4RLwEPeGTb|Onw=$j@
z&xvf71UZ$IlxP_m@`Ae(pbl4^{O+BtzWgn3Z$^<vQ5%UhS#KJmjbQG$TI^stC)2)@
zO2{C%2VK^{f=U<r>xz8cWZ4D$14ZEKrn{CUr-5}2oc)sy5uyBWJ3brGS_J0QSfKJr
zq1wpGE^f#FT!KSn9t5y9y>Z6X7`mWM!@@Osq1X^<WtFi(SLx~DaWk}}7c9wjPYOAe
z-JZhDw~z}%PT7FVPuNH2!wWsK?`D*N!a+blfV!vPKG9SH8nGp@FG^1So%_8mHb}W;
z_bZ%GgBO-4{R~{3X1=t}K41wLS|Y_AJop_lBHxX>WG{Yu^ozxOa1c^ZnToHMR1>`)
z2q7`;ALM{S8?G0OB+lwQMDD<w7V+hy8@LGe=N2xq#*4t6Rm0ns%c1+5I+n;To%O>|
zVBamcE$6Zw>eP~O9)c@HT~rO|1x1{8h8<++<qO!KKZWrK<bx{Bj}R39OBh~9#7#0n
z{6gpk5ta9G^}N6|^wRwA{k4!Q94ABEU()G;0o#CgYt)a!zW?0-^@b(VAX<iKDjIA@
z)tp-9tV%7QOM1&a;!ZQyXH}fell|aD0aKiK0R<UXG`bcLj9tF*99Q%y7?T9vpDYFs
zelop|33KlQhG`xT&Z_j~uv8Lmw&&!=y;FXwz~x#l4vvHXC^b52z2Fy4)<}<+UzULY
z8b6{?uVZTzw1C-;ly_#isJ*!&$EE)6p{{Dhxm%%{{2z#sI>f*iD%ioL27^%7s`pIm
zn-fNgM~>q-fFE3O#F2=x#tLB=cyt-?=tnKPkNHIZW|$02FBkIqLMs5}Mg_5{LW`Ev
zl9Jx61VaM@9#HTu;Y~L_qd<k3J6BGD-P=#A&F>ILR^-=e)C<b6^;?_!fLI$Q8-=DJ
zdJ)v*VO~-5+@8^}_JT>cDZRRi7}3<p&1}Nre?=DSlhOLLv(jI|a%-Rfl<mxIl7p+N
z{Au09g3)G4jdYjBvl56UiH3L*3tciSiyxS3fw*9bOU9YCcz9+;1|mk#<dL*2p(o&H
zH5BIvg|934oX=%@$)rHf&)=M1Cwx%=hJ0Qp#E;JpE>-)#A(p5SU{YT^JcVa-b}9hf
z-`U6SEhW__->P^I>S+YSpi>VPQk~l0iED%S8(F%ceL8DG(MqC|lzh`W*8>ca5Tg#e
z;AUeIBO1d2CGtR<DQ!ct5fo-GB)lR9Ed?7od)`&xuDtQ|#DG7%T2k>OSL&g@cNMtP
zKV~XUa;3;A3N9!VUxRWb;X5kN!PSc#<e+eJ8rDYwe&MU6UJ;u<B?Se4xn|+<w7fj^
zboGR{yD$GA(*8Os>h}v9Mx~TcIz;Jiq(M@pk?uxPLOKSiK@sWhlvYAwXogad1_9}A
zknV=}9{hcu_gUwh|Bh>xe<;J6+4sJ$y{~J>=fEcLe-+PXrP=)&Wj`?>)ELU{U6A*v
z+v`M(3NJV{pYg=w{Q4x3kA8$!Xnt8NL#Kl47?B<?*f9_o&@evsy1lLTztMF|?Ej)N
z_rIK`$5rbwC8(m)AhKM`5pTsi71m|;=#D@Q0AxE5@(MPS0V4``7f*+Me&hD7>zx{1
zBVG~xgJlk^R0QL|ud`%MQb6$NzB)gI3B1YZl_Y|<O14wH+SGuD)>dH}<wD0Awp_S5
z&YUyMQ=WmjGF<<_Sv35lQ&=vtk@<))=#2M+O8~sZ(lrNg^e@Z4Yb)D&iulmq5Qa-n
zPV~A{o#1d<9RL>h{M*1sgx3j!zmm1JR&bEru^>J^L$me6cuuucQM;&^n8<1dTGXvC
z3+F-QfVU%B=67J>LW$oYPK9<?-+2>S5G8UG?Vj}53b*ymxzaHhF2$sY_@eo^->YE<
zmkgZnI|5~n$4CRQ))uP&`&e`TIJ<X^qRulwGw*|2YYkn`qQ1j_iphIyh|LTVnBbGC
zLE~i<0U=}34Z!q&jI4zPnMo%fnwd}<qM9c~{v<^YKHE<6aS{jEw^(5I3HYEqq<?IP
zv%QBiTJ?H2Nl8u|1ehMw6fF0|?=v^bn7JkrEum4nG<m{cx`;7wqXID>!kUzf`afXv
zfA}vS<W3_D1WZK)k*mg9^BKk60o!8%a)b!7%m*+Xu4MdU9`8T1jbcJB#7RL!9~zrl
zihNxrZ;Y#glvi9aNn%TGA6<@|QLX6yaC@|>w6m?>m}cSJ_w*hWCHhzInye#CQen^L
z+>U|2?*%{bQ&z}_{r{@~!;g3@B+<=7p;gEkAs#IAQX$VLKKu|tgrfM@-O?lGHfQiB
z0)sgC*^&scV@}+Wt>hux-g`5WyJ?;N8>_D}=6jFTkrWJKWFv;(l*KV6GcM+4V@TX@
zZW!+u&VDMKlOhv;>bYen3lH@<=4KpS#X;b1Cr{D;<ON9jzxaM^*m?n6>@`BWK^?gw
zAHLINdFQGuUQ9SRC%-P{h_Of&UJef@ADS4>Y<~K&6JgypY5?{V@5-0k$Ci&hW@BR(
z@r6uwJu3z%T)2f7z7OK<ReVU6ql&^q21dUI&N^66fW%2_ZS~s#!Px02cOOr7QgQ@D
zWW`583req1Ue30NR@!7lL{z30&Gf;2X>gf)rLf#kK-B}A5cR$h3X%`c6<^1|g>}K1
zM+sunmMD0N;~k7cg8zM!Jn|Mj@J;Lx0gZU$Dyie{n?y~0tCDiQ-XO40GAu_$xe#W(
z_`9>6$j&b6yabzCZml`%xIW(({$Uu`Ebb7p#Z%5}Z8n3_m+n(h{Y~HZ_=?}t*Ft|t
zteRKQP8#g0*pgdt>~DBi0<Ze^GhwgdNk>j%U(|jMX1b8E!7xYSY!ye*;S?_^pdhgQ
zkH*vZe624o`x4D?#F=2RA?Tp@5fAk8a7(w?fQI5m&G$kd_|3Yk=C=sYQ9r2Z>Be6N
zv!@OAfzAGJYl<+9z}Yb_Y#f;SJ;QV8>hvVGM}1k5AhBFtR{r8wk%6|#GmR#!9#6eT
z4v7II=Y>noSH)HO&=zR`Fb=4D>;DbyK>7ZWPun3GDsW{f5cbJ2x1iRzYb5UUP$uOp
z*wxLu#U39S`7_Jf3~^7LKDJSxJ~3nYpr%gjDmFDeP0OC{^Zi$zsy(`h@A>Ow6+SBS
zJm+_l6SS0#ZdG;;yNY@GN|PCl4pmpD!N&`ArL|U#B8R@VN~T@Mxtup+_G)^Bjz1uN
zwux!`Q<`<y%vOh>-x&Kk<v4X&+0WCw6Sbi)i3TfDP{*cF#=_1S6&{vlVS;X+hPWQz
z;YB%$@9UrQVEbcGMX@8dW}7lI7j=%hY7OwDK@0ppe`;tFyOxq%5f%;OUme4XUy9x;
zRuXRY43Mbg6=0eba!$V?p`O}MZcJNx>(N+%ZrY6fhE(a|5dC?=0%D>|Opdqbzgv;^
z&zJTUTMvLQ{ZlkY;pBgo&o@1gcC$a)t~5t{=jlF|vDanqseX9v)v5hGgI%f>DRtMl
zXlgk|_*(x>54v4~a55(3iKVS}Cfn5t<|e%YD!f(k6I7rRtblUy8>hqHbNw}$qUwAV
z{kgN(I+h0?<Yv-k+)StyFA=U$Q=kuMas~1SaD|+}6kCKh2}mK%G|svGH(4MkYkk<!
zd#>r!s+^UpU@ZZ5D;NmNm8KeOejHw+NAf+0M5ZZJ`<$ctLx%Jx??gTOx9<c%=xaE9
z1r`qfyEC=4ciCv2nZn%`-e>^h<2ZK%0lvh0`QaQ1?TN1wI|;13E-zN1JyOzhm_6K&
zy5SdU6OB!h#IKoS4;K9kb>CYb!<HQM@H|kOPF5xs%<PPH$2dr)n-aopxcqgHln+ZU
zsSbvwl}ngolFbydPeQBfZo|_L`aTQj!e8P6lN<qEu>!c`w8PW_D*Sixe``~$ae$q+
zWl3?7b!knipar)%3uLdRhST||UZaAHl?jx;Oaa0zDALVa=S1lM=f^kNvg$9j*z?Q%
z3Qhb*-dl_Nm=2eIzN@7fHC$9ri*=4(*gav%YC_Wp<X&qdy%ik)k_3=D-^JgXN!ns!
zpc3JLsBz?Y)XfBP1aU0LoKT&S7~I26@ERb3^H3iv`98<2+bj~FGx)l>^}I}LSH4wn
zn9vQg0bu;c!Ypbn!_Cr@m!EeT3?$y^s@RJ<g!GcBli3fCOmRLixXl;|1!In{agb-J
zu)xsUb+sGq{KnR0e<mv<xr>e-$_ucAQ|bOk2`vnegb2}r47bs(;AoR8&H%R)>~u9z
zk?&^7qk48$T6EybY>hKj5+JbG(JDa%m&M~e@?G9^d?DTa-rD#f%F7m7)T74}=Gt~d
z4P~!MJg@A?xIjwX)p<}yf{-JrLyP|pPe2f)NFNl01oeLn6_#eA!M!+A7+gBy18M@a
z3Wr17x;RRbNYts=3$eg@s}Jrz86nVuXzc{l<>VsEPm!dfr^Huhq8nS~r%d$Va791=
z=kLUIM0>m+m<c+1x;iKra%}H^+KUEDb_MX?AAJHVQ^z^yg@zO}U8}3)jUANjt+|9z
zAEK{E!=&;ofTaKE{bf$*Qw(J}NeY3dI|NSEY$Ll@<;FUB<fz#ZVKZ)8?{W<i*KNZy
zx;@;NqnNnCk}ggcJJSDEOz!z_{Yzvj5-BY~$prpy?&5WaJV<1KuN$2$+N+gs>gW>v
zJt56M&}BK7`wYroqm?wq1CIH|m@hQr@8{*gJan9%ISa=3)_Yybu*K&+cc`G>fOO}U
zu=;$`24l#)zZy7_SiHhGAAP<opDT^7;di6MniFc$8vFf+qPg322#My&x=uWOYXH$x
z+K%o@sP<!~C{=o-iNOWmNP7LE8;WtUmrDD;5TOx>7j`5mehAybG!hcKf@LUKU{*>z
znXcN(sBk=5^LyyaVG>~W55@H&ue4@ND56?hN@R_a`r(yAfLP(uiX95qJ{8jS3pt$%
zRwl<LY(irBvN9Dn0+mOvsI<~TPhZ_%^YCuNtK9b$H4i}-ibMs8CoNr>LPaP!y(&H2
zeE0LOVEl9G$22q4|C4rKko|`nVF7peD1g6s1WI66h*p!*<j7|G*foT^BsTHt%VR#c
zxskekZZb#NxT&WSn&_|JpH4$ih-snbrg~-;-_E~H#)MnpD^p|OyjEY^mC9eQ)8zR>
zaKg*<TO9Fyx}znHlERZr_VgZSgW~^s0S-PkJ46fc(-Fg0|HOAHi-`>4!T(HL_RefB
zmyr@VpNNfc+uD^AK6o%%_r|Km;Pi~x^W=K;tDw?^S)74$=i6_Tn(MNL&m)YUYgs90
z!keoUnhwWT13Gr3vE5r=R5|ar=H%tunUGmbjgPYK^1D7aOM@AQv!$tTxau}lDSWT@
z@cA*<$x`IAQu|!U-aU_2A+Yu<S*@j4&D9y@qgSIbe={)|kY~5ol--<(>WOchKiSz+
z=%GuamD#4j6Xf1`K7-FyW`57gD^k9>n#8W#pD6i$GRp;H1<{0JbE`btP)M`sd4KF~
zm0;cWIt2@3J<*=hT#-D7sB0yvhriL)s#2YGS9PsyWV#`<aagd_(?Z@FbEzVOOPwp7
zmmhs@UoBb8$yxMs-Zthd`W~5oH1JYu{An}&^~WB?^w2b|pHclQdnH^MbH{qW+c}J-
z<+2ST)#CWBnD}?j$0$!%GL4hy^Q2H1BQ~1EmTHRBX1Ft~fgjds<g?6wq7nKVg|hq`
z%`1}W8F0Xb93E6>d8$ZMxQ^2G(A4l#O)16#x@0nBYGgD#8VU^q0!P+`4d_10YJ1b}
zd($UCe3wSW*DMb`^@W>Rxv4D+(;m5Y|J!Rx_ws*nSAvT9Uz@=H_qgPy71Hi*X8J~u
zSk`97n0sec<U9UZ4TWZIMz%-oPbEJUU6=YfbjlbD+7x^LjT)3&^I1-}Jnvo%cbaO)
z)Ea=#u}~&yMmzS3!)s^oGAcu+I0rK5%vh$=f4GhnDMl>Euh(Dxu&(gBo-c1I-_{7Q
z+5U?&P!PX`ebaSN`}3RK$*`f?f}`WnxQVFP_>sJ3%dm~ZfZv;hxb2u)d`;!69p<H#
zBhjKCL-UUN%!vf{ddX#rsUcw=M$bg_$&Fbz)7^S(RIS+$K$|FeqyDF>t6sSUh~`$q
z*1+cSdHg$7v$}Apm0{N12`U9G>7I<N){M(5wr?Ed;~q~uzCJghQF3tj8x?u`M)9Sp
zQ*)Pvb594O!ZY*8U!<~Vf69qIy`d&TDpdnYE9yri48nC=6-;E7dYh~y|FQAr%!!IB
z)eNtFKHWO^k4Ns2@R*#9-6`+&vF4)38inQknZgQUkZC+6?AIKqA_O)^{!nt%1DzHa
z3Y99rgbms#*&oBCrha?4LaZ_a`J4~JQ2jM9+G5uiF+9q*qjuHk6)(LJ4a&+BG+O_0
zZv206JFbj?jQ@L*`9im)VS_eyIVgEBCZ$_?4)Qj~&Q{ToO^#vS?f9ezi3@o)UM3=b
zfGokF32S@GD{&{vLHxM}ei%`4%(e?yCu4iP?#rjNB3hFuuS<FP^NA`c%gM$52ElTG
zXU;VCN~HqbJh@oTOI~pdY%Nmm&sr*%f5`WXuo$qIh>(<58jRC<zyy;X1%<n&Sz_8n
zYL@078Z?+W*ZP`+-By&#Z5f08uoq_rgWk&TzC29=H?k7J$MrE75Iy?++0cBcF59`w
zDdM`N_<U;heEiVv;LO^0;jrp)R!y<V+j5IOC8CD$BDf%xf|$4hulP5R4t&G-e^-KJ
z{JHghP0v|LL@I6{M!PT)?sV&o?)0j~?7<5vKZI=UuoFavoI&?2Eua8P>7<S^tBeU<
zM~N!gAaTp3Cs781D+`*6jJiA5|C5-ZpZ;a_SOjviKw>@y8C<clsul`ZBnK=#Y$ih4
zXeT{Qw!xM1{%CXPnEYTdg?~*e`E9N3ZI=aib%n}z@pmtE$n?klunSz}v~E=U$|%Rx
zYU$!ft%(V+%D-3h{9ARr-9ODDwULx1Z<|%84EM~l8y_Smk_YXzls)<@pEOJQ_X_}Z
zU|%Z2Tv6r}=sL}OTx@!JqzN;3^;FSoxR5Nm$1(HlnV*}k3U;#A4jE%ndEj>vt*Wj(
z52+se_tV7@1RLTTdX>*-nzd?#HU%C3{;mS4aR%Hp|BoiN7NgzHR%~<g6pf!>jjm+`
zdo;nC*7K1|8qRPzGlk<2!oA8}&de!>My{^WC5N>z)@U^K?jIeAfve}8>_rw62`?tt
zkD4gf-p?>Er5m$+?nvb8*?cN&ZY7iXx`;hSnL>y4f$~$r^U8EB6b**xF}a4w7|L{h
z>c5R8C8GU$niW%i&UIvBIU?S4CHz;%;$T9XNB^e}cv8wy(p(2;<^tLN)A}9XD!Hbo
z1w(J(I!1H9sUw?)x5&!97vZYe@kbg#ScdO4_8#~(I?L)UVnDWMd=3)FJi4n#DGHvi
zka}s#kkc1g3td_D<mK_C4Av+YCc;j>MWnon^u1Xt)Y{nEP897(e11tkI-p-(qM&pu
z9`VIZ|Gy0_zY-<YuYF`Lmr+APLYFH)$#ice561{Zyanq(@Hw8mYWcquXnNez?DVNq
zDzK?+Ik3esevgJW`@qot;Aim!;`t7Sv%UB43T=QMTK>z2le^Gz0CLYVfNXjDD!=~u
zU4$1|*{nuR*YdS}yAiE_+h}O-=XqJiJ!@;6L7wn8P?&;G>&cLrY~)3I2osV5>-+1a
z!sLaV=X|RLa}M#WySkKBqQDHsM({zr92!od{puPi?b6AT?`?R?8ucL_)|mz0lSqx!
zMY8@L%7n)&&_oQ5EXk1EI7?~JzaW>1yk^J5)?yB2oCghH;^Ho*f`lv1z2U5Zvf6W(
zzac_yzM8e^-(C~3&evW06gc^8_=jhATr<@78>_G?H_y>@v&|lVRPX3{aQfKbqt^bg
zjc@eW97pCxP;Ay_UpR_PxwH{W?5xWmuT0$4p{?+;FqaH7BN*V2^*ZC>k-YrO5wFOp
zq@wtYKVk0HtHI#*57gvIy+)cw7H7qinL0f*hgYsdaKL&Z`$Sj9Sf$$ge&=m^F2Z<n
zmL)`ybt7Ni+-{|#K?t>{0yCNDaA^clKQw?pud)c`6;_I{-174LKC!rEA?K-po_u8X
zPin=2giQD!2+;9@ZpS9dV$)|PW+uA2dsl_VjtzMmWOh#jCOGRnjeDw(2cIa>5AtjN
z*dJNfnGh`TklrRA^lCQ#RiA*g+sJ82%cEd4tFvpxdvTMUBR@Yo^|`_IAtr=l!PE->
zHxUvhq#pBuz$;`r6S)>6Yu$vj6;W!WYy2|CaaH)RLvJn5DZv-$ns0tuG^#B0?$vUM
zT8Vy-a1Tz&_+1vf&l{O=FO2e)M}|btVNDqp<U?~*F2$yrJVT&RNN6Xafc>a-&_TSs
zVhPlW-FHUxG>ln4&8<j1AKf?OF{8yugD=n1ZE>(>(2`vz*v{NXtfudI{&5p~3gPFJ
z8u>3Fhc%wJNp^*l9oo`4nCGM$MmNXE#M_D$y8X{TrhqLxJ5dMgn!?R-B{{wBPbrE6
z)!Gl1d84bocL~cFie+mdDR24wh};jE*!^Swvd#S_{d}S%pqC++--Y1Aw79yBTseue
zUSeeARA*3jbLVrCr=&EjqP7_w8PL<dcjXn%^^3Ddmx}?}CM*H<hRUOHC#IaRbRC#+
zBRZV#nYiuT^vu|^K9-z}DyV?>Dsy{d=<Yy4ePTkAj@24L4Col?Rh%ABq9p&!bZ$43
zf5IM`6@I|8qS}%JEjaNS(Z06PDhXS-ZfK|!K@&-IEa$;k54ndXV)*G}Dm4;*8N(N?
zYW1ne068e?w2VZFMnQGvrTedB*_Ikqrup*(acxE<e5$*bBMuTfGI-}{*%}+21oEfQ
zduZ?<L=IL3BL`P`&_o%{PAME$wqSd{&>S_5Aazn@bI8;EZDuJ9WpFGLyYe>Ga>W&6
z33KXbPJ>xPQ;+5@v`0tu%GA1FuWsE4zP}AsEq|-cS87lg)uIPyC7IzD(;=r1MN6I~
zv3U8knSCyEWxAo@Ph3R~GX{ip=UYhkpeN}BH_T<wuHNTc|8p#(IZh>sxNEmOYp}ZL
z^67c{fv5`X0rmK{XJNvh<4|_(y?sjU+|txvfeW9V;&V#{$P`+CVht1~PcB?TOkN;Q
zYO)79_2uOHzBC}v#VYA(ND;0qB*UiON=}6dSD$|KcG{aiPknsdC}NwL2Q6?d=-mwR
zqTflZdnXhf=;hbX=|7#N$K}mmk$rTNLfZu~?Glob&Mq$L{PEVFaL<5XkNCSzq#5Iq
zVUr)(m-Ln>F+<e?X`)01;QRO-?hHtVcwe9eMUIX<z_=&qDrHMER7gvBUm#ZSB&UuY
zY6+wPQ8FPcjHr8eFQ@~?TfBSVi1;lH(otnwlE871^4MogRwb-~YWT`qji84wdgR|Q
z$bEBa&;F`HBiVgrL6N0_sR1w0YMDB9ZGs#t|9BLZ`Oer5k6u^GTFYhgY|zP|A=+4e
zRIkO$?HG;itb-pVJ*Q#pIS1Lxvyf11e<s=|QO3-~$2~;x-B6Y;wFG(zg5iom&p@B#
z-`uw8G2r?gZU@!$VZIfUsfx)`yDzdo=_AfKKR|Gz@Pj3NPOXI?FL25S(o1)vTTRpI
zpa0NL)P_jFLWN*4t&Z6OwUSIf`z`LpXgGA-w*4z^z^7##>_?aqu_15NJZzB$o}10f
z0MyaeCosHWZM*Pg6LvJzYSMoFc2_Kw1lDikvGbmIv6R`$pU_NC3lrpbYSPjQNXl`U
z+cz72?gJLghu3Z_k7CzWu^`zG%W=8-wyzZvxehrm!vgl+Mo^-OjG@90NlH!n7malT
zM^|<w#vTxI5(i$|Q~J+GT^$VDSY<&A5(qD&p*QF%EyKpIYiYsVAVQ4`5Rre+(o&9v
zQ5y`6F_2m4S9BB#U%()|j}$pz@Y7hG;ttkC<e`~Zq9J3pv9^el^JEt>2m&V;34YgM
zj!FFjlU_zM;ocwrQax@$o<Qv=i!1_KDP|p2{LzYUczYp%sHT@o=N3Eyw}~N_YmDPF
zy|&lgZ)AVs4_&@$5@POYvMO!+nlk*zUIjVQgFQTH5B|`-AHWx5KTSW~<iuw3`gQX4
zK~2$4QAkL%C+SWcDx5uXR6;TuUT5%5-B;+d=I0p0CzkB<e9lpg%C8OhX&x8t7KKn@
zVeL+=td(E2xJ}fnzIk!hjI{E*$%gBx=kV<P5;XW!iqt|~hDGj9>GyglnwJ3qYrDzj
z<r|0VTXxwN%8qz6>1g)dWQubyC$xjSI5yWyNse({OvuaC&EsSrqye=Q81bIH173Im
zyZoQ$W^~=_fv78TQFj*x6^50FU+&o<F6haEq&soYd}&Zeuw|Pm@o{p5>x&g*Ul7y0
zwRDF+9oSh;xaUoQY!B=#fdvAN-dCrG7`2fIv?^bIeIwH{hbq$Te&ZqINrON$u+2r@
zv+0Xb8DAA5%wYaX%K`X@$q3&0iD&0Tsbu9G_{}vr{zSL0Uu}IHhEf>eP+HU)Tj~=e
zWpk;^!|1Dul+=iV#a6TvH2624o)qrV<f%>v<%PX=*9}|HgfKAKzCRm<`ImZ}`Niew
z5+AO+LW{7UD3&OBr$*6ksZBQ%6C$#Vnemy28BV0dps(4%i;y#tcK12*oUAtATK|oI
z5W9cG?Kz>YF!+0dqIXvx3-a@c)Z$2!Mcx8uu}Eaz<#KjrO5F%1q-#THeQ$wFo%GEn
zf0G4o#$PSHK4*TPIC-`Pg_hLcEKii(`{ojPq=hq!G4>nTCii<tak*{ZylW0~Gi-rf
z-L7Je<(6ev3Y~5Q9G+S4mvS7g&o!bv87<j35bQw$<_U=WDA!VehzEq?Bp@EBC_tO9
zv=u_GWhKN>&lI$-+dc^IbATmmdw;~dMotdx32UGH1F0H}uh&~3q|}@a9NYZ^tbK-P
zfMC!~@ayXOdoyL;dfuqDxNJ+qg>yyTk3>Y>XO3^spq&rKU{m;g<MaHH$90^s*6@4n
z;RlH_yU))zL!8sI?F#Au$h#|l3pNRTZU3@m@;x_^Rcu96QUaQ4jAkWQUv_S>n>^`W
zz-y-5mxGeh649i;jR^3~Ty>0$>5&|UUybD1d6Q1mCGB5YXujy~NAjI?d!#FWlJt=j
zJc6aq^yl7nt^8227ry=C$wWb3X@M(ixUk+T*82}RxC}UH4Z(+9$+!=tSn<iA4}=q9
ze(7RCMprcFjQlWQ?gpCeKPzHIksJnR>0H0+J+z=X04tTId>)mS*1d%V9vk_JXM}7Q
zY$rabPBYn^NF8@u4YX78z<`X#Eb4D^zNto$PVmSe-NR&<uk*&k8oWn6AMD&{lX|Ax
zK~DSNi+A!>GtQrgsvQ~7@+%ZUi!_Hwo-Q9dJ^*0@8~y8bUely+fFd&8ycn{LpJ(C!
z8_vTx=7rwpA9!v~HMEZacb9E>i%RB$y=*0UEu$WKPXbB#)@cPB{Kt_D6glI@bg_rr
z`tEGlO#vE7CO&D;eZg5Q2pn&PwCfKh#4EFqKAu6;hmYX8xzf1WZ8o6$tM>P=mG(<D
zxA7Lt!!+|F?E0wU%3-mq)9x&fJO(rq?ukFu#Un3VN!OQa(Z6lBiD{!Zhgl9sP7*D!
z4V2K$0}@7nY;?FGV~7<K+E|4SF|;M_kokGQ^FS{V*GPmJn@^sEYg_URYStwF=@rQV
z53!#8pjulc@t)-Q<baH3Ts_vCofTuwTFA>4{K{Lp>6WvJ{kJ+zOsmtXx+&^yrMo1I
zQBiTs`UQp~j^11>TJN`0oALKs8Qh$6hXQBl=a0W?lI`O3MYdo0#XNJX;-=jk8X(*Q
zo_f`n>kMT@Hi{p|d^}mo8WIp#m^R}iAc_v*X}X{YO(-4p&hVV;l}J{j=ZjpE7{E`0
z?U8sN|1=n;akJ6tuo^ZVhJQ(Ez<+}O0du8?rrKMG*IEbX`n~H59i1C1n!I*_cN2ly
zvlqWNnnFle1IIB}Ub~!b%#!v!8T-uXw<?P?VBI<H56(;*b?Z7Nv-#>&Q?ix=Ly*yA
z_f<Hj_?F-tpH~#r3*)h7i~8mCipw}yZUei!XwCR#H&-14!M{Q)iIKp;?l1O|$KJy@
z%K+dw*CC-S{QKaFy%*VNc>I~jRL;ZMDF}vNx@$(40$m8f#1xH##e0JC-6N10G)A*G
z+_ym!=_z)a5UN|}T@qJ65!__xwy^gp4%FaRmy-uau4w=C<7eR&D}DT-kz`xvjc#}%
zn#Zp!_hgZ**K#ccrU|%}z3=vC>EO9kA&tL_9!d*@$6SDfE}<fGooN;C(6i7QZ%>R=
z6)(MTEi@_9uIa<TEu7}vU<F+%?yj_thrH9}h{7k+E<?@S(_%D{O||y5?^aof9}k*N
z9_!BGs4~=^uHDMvugUym{bC!wIOLc&RJ@SoKYpU~=$o>s9)G>Bw?Vl<Ns3OLLQ7~k
zW^3uGR(ygh9Zb*V3l!X_KEshA8PNHdWufl+c1E%X-@Rk~MT^%#o<N!NwshZ`p4jPA
zjnJL}?m|zRB7bWE`}x&A5z>0dzA3ILN$MtQzTXv*<&EGRZ<+jxPH~#R@UfhI_-|+J
zkWZhNZseApSx?J0Y~H}l>5V)$Q4&uz8>IQXk5(1FYH%5ExqHSSKl}pKz6T+b2iKPr
zS-yE(`!dDKy-gQf$}~Kci%*4<V`+VTr*h!thB3_xdG+fxD`O12t%<p$N2KVx_>OdQ
z`#jkmW~xymcLWOaWttfxvauo}8{a|q+9){eVq~L<Ad_NvO(9)XFn)3*hghfr^SOm#
z33KRca~j&@It$CS6z)dd8bC%QWuwk^P?Z=gP3E;3iBL|ClXNO0dJ;z?3|@BxIlPl%
z-}KFn+mJ2t)kB5fx-kV`POVuzej>cddy?L04IBGfMr8*nOVKFQ0*9}b9<|9fmF}`w
zPAk^D_0?@cYfxLR1(u=E8GPL&5)9KKooGAzMf7uTBM7rLE+%|%E;B~Hq5eSNV-fOf
z?W!sy|MOKbfp1u1yw1$Nq@uc~u9e3;h=<hjUsF=6po~T}ap!Gg#`cODY(1AC_`cN@
zdU&fJWkMjcdAa}l2dbS&0!s-i_fHIJjn0hKlONrOI`zsKGlObRh^|K|<XV>$`X}d!
zEB*?9?9Nf>TTH6|`#~{5maD}O#O0m?FD38moj`@N9S6^EMye-}Ym|}PUB$sjWC}D9
z?VIn8d8J^%q{)ENSL23y*5Sgx3P=ND`Mx=f3(Fhu*QGd$8748c;|7fLAdiJFP02iJ
z<%yh*l-U1WZli}L!ln4ym2lPj9Eqjlz44D6=-P$PGCDX>9DK(UEMKc#FGt(76ma{o
zk*p>Z(;Ah_=;j?z!x#XdSL@x*8@Gkf+gxw|IuHRdfbL5=bP^x7>YH$VPO2*G;Sm0Z
z<{ro}wOnhlLEIGwEMrZ1knK#jQp69d2wG$3Or#MUop?!*_Y%jrHhAShEOobwky6*o
zsu-!?+0KvcZHYgbX8Bi8T~}^Cnbq+cWN=I{jfS}N_uJ}JaAFjEw@eA(ak16OVp<Iw
z;JjuwBC#;B+N}+li!8|2G!Xp79~oo8K;W~JnR!q3;7<j(-t{AF5jgDKUybDYe!UY<
z`_NfoX`j8d-2tww>%PebA3YKfz4gsy2xt;58r*58c#Z4uTXB)&+|=>++6<;LzcR<R
zN?NwmHN=)VD&zMX4+KP=-{)iUr+!46$K6B{3;TUNd~0wcT|v0lHeY%x9}soJrY~!9
zuP~nF!^KKSr%sSqqB{7Y*eg5dMZTUG_~IsMvoU|L%PK?v+1s_DT9{j<9XVKY+iqm>
zteeL63lkpe&g{Ug!N*PwMjeqU*u%fm-6~A8e&+kSc7iE1eI={DI-!v?{Xk=2h<!r2
zZGh=f6&$_oIlQmIHj@}|e49`8Tm*f_R%(8>noCX2bWr!3222<YK2f7By%ci3f-ZGt
z`L5Z<)Rl|=Dav1|B=cczyz^6?tx$w-CEor}5o(EsYO_4Y^r^3svGc6!EONFfm^osa
z7j@p1L`Ch+#5uvn$0rP!l79Gdkj7J2duE~@n*wa{Ka{t+br{-)I3AGiq&5BSU6Df?
zxcF{vX}Ne1UnJ;#BzUqVZvGQ8d8ll%4xQyM1vzHy?&FUkD?MEo7FJeEy%R3u)h;;L
z6w$XIL;QW}mr4>dPu{;~p7$gdBB2B7flP}gQi})<Y;R8~8oG-v*lqH|xa@+1!(gHY
zHH>b4!s~?Py2W^-uE(m(VfV>DEuj&w?DTv<uSFgIpiP$y!{@!Q?VIsPL~Js8Q%fpB
z3!Jn8L#4$<K-FxZVC7t22Tervy;kQty;P<V7WrzHDo+BIS3$O;+m@EtdQBd$PY#ql
zG^9TsRQqgi_ZUfw@_mRuPLt10U8j`~o$c-BiU*V!yZurgIRoP39r{*eq_I*#HXc=k
z%iqmij4zgf&LVqYt((h<cNTmmSVCPSZeyUg3qIp_^Ugrg!75&c>X;t452+?k@lj*L
z9_L1t%gD8;cPp*gMUGl{jm$<8ooYy}tY5{1jgszsKtU;68T^Y5!)GVomO=L)U=#lg
z5_yZ6Y3BJ67DH4l#&)5friWr^B0wH9eiDzeg#mH1(ReYS^iGw{;Ck+oB{8mkL$QTm
z<z-E&@#0@Dk)cd5vsLz9zQx5|TPaQKBQxi9=IaDj{d~evwlgGZYUkETy%v4`HCBz%
z!mBjg%uEt?<8YEWi1PjQNTNd(Zs{8~51bd5Fn|EOZ~B!1JcK~?kR)DPPK?d^73syL
z1Idk-!11I<ldHVZxH5%gg;R%bX-y)X;29_ouTI!1x5b7NiGMPq{ig%@L$93iA_9bc
zrFr``2NB4^qvTzu4zTJP7w8w6I_qy30gwHp*+Q_7PdYD&p`vO!63>vE-msQYuK!)D
z)8pk2n7ur`tyI^5@otGtY_fv2c(%ySmr`XKdQtJvjJiy{*6#PSNXH5$dbiFhj;-c~
zQqqF3XO_w>1Sk}LH85kR+GKS%ipL1HJ|O$ouEV!Jo}h~C&o+GQ$<a<n*UZA3n3cqM
zQ`F{G_{)Z9Ptv_P(XSCY$Hv{4OhV|CE}X?}li;4#%FN2B&9cq<iv<I+=oUS*Q-Bd~
z;S-O|=-Yd8F&TR1dCE62WwR@Dtd^xC@-2kTH>X)V{Nvi80zs(QA>*$u`MOCI_S|7F
zKc%SnHNI1~0x09E2JML6tQnWIIW8fx1%h7XLD#;G&($VJ;528@rZ&Ah3|ybC{#1|<
zx0(mFqT~YP)Ii)A1Cl@RNWk7?{p=Dq(^2Vp@8z(O#IAk1`DYjKs4pDv^FEwsejD=E
z8I;Xe_Y|Lwy5R7}gVR*U2$=y#Cn6&eeve9v<XY*LhaeB7Cd+)U8NIh|r%uty5}ZjQ
z`Z8)l%Sx|aZQ9iR_|$1@?IyEtT#02BuooDQU$nR!ZB<>pX+CepxrL)j;ZVGSTzM|%
z=aTYrPxJpHZ~_>pgg7#Kc0$v3Dg<uQ*!=A5Vpw{Zklui`zM$Hsgu9e-Gfn6NLbqj_
z-^bR$|Cdi@B+twT(m%_$Cj6Vgo}ComJFSfFSXx|f!h*9|eEjXHzxG93yhT(`XTQ|p
z#sR*SDFt=2=osu_pg@EMVR1li)s+Nyen}%bH7_$?`78*@3J&4vZci@zR~6JFPFMp9
zcYkTA5#oK~t#x$34;ZKK-U~@c%lPO{*~xRR+i%QIGaiSbY)&7Ffx~?~=eNUfbH+*3
zb7I_4f2$eWUCS`jEBzTKa%yI_OgcJgsHA{;P~*Q|0NxN1RSrWY`C;FqOQK#Fet%kf
z$AM3tbDR8<6j{I((@yJR;~1B1hh{+!oT|HnKUj?rzg>i2t!*i>p-A>rDUO$T#Ueh1
zDf79HiYIUQBXw`%vZR9^Av>WrmoNeCozJzQt2&{dB&~I+1@x+8+CS{ALJ!`OlYEEp
zQ@;$kJZ(n9z`aznX%>z0!-+7I@A#cuuyrsknwNjnSbpKioner|X{3XVzv8rOOJb&u
zse2^X*V&qz*+0L@RUTC9mU%)q-L?%=77ov8b_cP3qH|~33)j|fE|5FV^f&yCA@6tN
z9vIeaN;-0ePwx)yp8a%f@bBNasAzQzyHismeW@EvdK&t5GathEc4gw;^!0bWcq{9B
zqHaYpl8Br!K2^HOzYt7PAU8$EV@G9_au8)V1(Lr<skc8+)Qw_Rlf{mOjy5OSNwI61
zl#vEX1cgWeq7x&_>uweMo%=ESGRhnJQR3BASG86ZcX5G?C4)AKOa&*AhC(X2yYHQE
z7mJpgM#`v5!(uNTm`9c-*elMgOE6~Kns{(^g!Mt04uV6aO>>7vd&0=Nnr8mxA63d#
zQJx|x%l$CRH}^64r&Ig1MKl1d=NU1`eSd`{7I+jPR2@!nmX`rV`qfM}ahOsoNh+vl
z_ZabcULPcN#^vP^VPHRt&mlsdsN2-V&5q6)Ep!&tYyXt<*6|)kf#t&QPp(^G%}CUK
zp7rq@6k+^M3tx?!zJAO7`^${EHY#o9#KJ>Nmw@I~+FKdUJhLQ}{cbp<y%X29NR!MW
z^ua50uF&R$;B+hd@i<?%OUs#OS+&}VEP=_3Pl(B&B?Uu!r{8!LCobCD+tUB)!33Wq
zaN5KSNeV5K?_1|LEN(N5I_UF}v9o?kl^kk&I+34r<s>q~>M=U&Ii>kXW}90|rAabq
z0~?EUZ+G}grgan!B*q(I>CPTvj9bxWs(XF}dt&KAPp#}Ngo{+Zv+ZQ^DyjN5WTbr{
zHTI4CQwiTa&JX`<wmk2fe|xjMsT(Bjh24BruN3kkFJxs9?u0Tt7SE#ftgq+~hp}86
zyq%S5x%i{Z0sY0VM}M<lZ4y5gaDJ9eqc9%69pQKKX0Spt|5Qq7n31CPDeI_xOTs(h
za_gQsS@`=$*++lR246k%{i7l&BPH*G5xkY@^We2{jos)t-A8tVYD{7G-Jf#}CrQ6T
z7%G|{ZOjp*PgS|U@8B?M`rsLwxU|>YK`mdOA>#9kS9*&YJeT%Qp(+u<uZJ>?lYCqK
zE4E;_J1vT$FizCT7+eme_u{pYm{usX=Dd`=cCCCZ*RvVo@Z@>*yN$SS!oncUU{vgv
z0(6TTiSHo&+d%7n+^#`>4-(zHF!IYEuNo=okOox0aov0v@o-w~&Y=F{0iNIv(}vr#
zFQxmOJnHtysAEWrM}QwDITH1P=2^295o})d$MBllZ$xk$wqmPe1wiZrRGNa_Gl-YR
zoyZF(r@u8)j+1YUNqAQy;?VK89gv<7`~besvHJn(c9u7aAqD?O+JTrpxM7%Y+@CE-
z67>rX_}le>(QK$Tntz?b@68jfk~zA@n-kUn6A(1=ONEb~(s$X&_ZDeHw0C>*yqm4)
zugvGw3bJ)*x+1Liuqk-lU+S9_dMe(Ns(+LYnR4_#=woZhGH#p~j>Tn~oQV|q$nLk>
zE&M8#xU;wWM>YBFIJwu_I38rtzYAUCD=R1WOe4<{>(w)d=tA3qIL&^M-(vt2I$FwO
zovtK}RyFd@K!!hiy=?2vb7>VkP<TF<<!oof1|I?57|J__C^=Do(P|>Fu-g3WE&l;r
z|NFF#&o+@XY|^wNM(d}O1TlFQNZGzjf44zg{W$LVmF4C6&a1p2-Ab+Fx{3d4glTxP
zWV2XRG7n#xn0#5ZlJpgGmHyqZ`%hUHkTwVhY)KrUtVasgZxY@aeOfB>@L{nr^6*9C
z$Ig+{n_qWiE_k$ikUB}2T8ZVBIjFJzFEa6#9E}J#GD?uotf8zM=?u-G!YiK&JafJB
z32Kf<Q>HSwSW5h=TM{DavN9PC0pdVzsh8V!5Y8+_^<pv^s@-Tqme6-DPn<r|d>zq|
z;b-X9)^ss{`@6}_CG{o&IRn<!CbsH#$rVD}#VTjZJTLUr*7x=kBW2t8!biLM(4o4%
zhKZ(~x3dGYK8jpL85F2+VaoUNF?gTGYkhp0a+&*=3!$fL)#*uB>o9!mXlhm2<Q*2i
zVt!vxJ%}+C2cNx$z%jwUBQ2QG=k}V3y!Pkzrprt4&ja|iaWlwLPkb3JR|;c-7~Nah
zAQ|CkR;L_DqF4}{%*Hw)A;Ig(OLXC*OpgU8KJXUsYG!cEQR36^-QYsi!GK(aeH|#f
zGxG*d!ZZ=U_9l?64|{mS8->{ij4>gz5ix$>wQKC~dQ)*3S*wy<d7jE}TFjd|6SGKt
z{_>(OyW*5H-#qJ*@oFO4Zx%hH8yzGLq}1}?cU2vbGXz_ENga}Jxbk3HHCk?xgq-%n
z@5W|PYOiNIa>q7Dz6aMC`vuL<n;6tWNKxz?^jSn%&5K8{nq|VIn6;^Q^YUg|wogSl
zj-L*dGBQl_PxBTqQR`QOUe=pbf#E^3aft3HJnPykOW`v=Zp?Ia&h4A+Uwsu}UKTxZ
zKPEqkC!Ls2#G#5rm%lqW8w@HU3k`s+ab2#_k9(}6YxSlE7si|AEyyDq{j9H2yo_Kn
zdN>yI-E1}T&}muc2FA<q9J87I8ZV2QnxCvW6?V^I;0)ii^i+{7w7$yb%gZ`$+;-Ff
zV|ak4f|l%xbNl=#d&>M2sl!xn&I6>~)&k>Jhh_(^ZN+ft>D3a>xH+r`#NHouhYZmU
zGx_2cYn6<Y&l`TC`D7v+y})o50j6g_jzGP~m8IK6Knjs3+wg~`ZKjMaP=Q06!|TLg
z^Ix9aG$&PRvp>VqnrjbW_4*8rMin_c)H<<Jir5hHUYWIuN{v}1e{1mRuI~N?3_UVY
zM8p`wlTST=gN0aZkc&D@J=A+(uqBw%<0UA?lOam+1gs8Q8a;;~9T1>dy0wi9M*r3A
zRhTVXcBU_9`1GIp^X)s27Z4z8(}B)dLp#zQ@E&;QhvbtVvAEf(YF@j;4tvMNo<sUL
zN=+!hLZ7`TytG(`S!S=6x3veW%=FuZ0Ee~3Kasqg%blWLRk1lF=IkhP@S|(wvu`sI
zxotz?H_Uv0uE=J5n0j<^^lc!^cz~nAcN94zYS;JT?<>iKpr~VlA>+Yp&*a_SKE0OB
znG%A0Wgo4Ccy<sVJVcLp19IQm!^Hh?`kn}sO*mLu5?60uJt#>Pcp)2PK*;M+&9=g7
z-qgo>s8Eq|31mQm2@I)(moCD!ZsA+-QPRCXvoEL*8?XQJtWRczPg2`&%lw~oM-TbC
z`Fya*wBB~*mJHxrJjilx)m%S=`%QmrLo%R7Xd-+AM$}EAejM~SaOX?fjL+>vAcow9
z5&syNc<-h5FcK1f-rK$da(WRT1FXBs`~UBZW?)#AS>#YV>|twSjv2Ll-*X#n2lJ&t
zDXa3$-tZqNpBd?q$nin+`T3>xjlvDf{LE|Rjxyn$j;>)VI(d{!*NzI!&AigjkG4LJ
zWqM6>NL3-v{v3d_SV$85n9imYi|ziQr<9Qv6VjBk6UV(0PBx8GDt7qQ&c_zX;eWzG
zA<aAX`FDE!BzX$$<6$#EG1&2T3^}^c=M;a`Dy;zHXl$@u;!cHazG#6FqO}XnFwgtk
z>}<ZBZPPOO^J92~3sn2)f8BssU{7trj+Df+8`RbA7ixT!da=Cv0XaiI$^{>P4+9BQ
zLX5wM7-xqVSL)rUjc^lWjFa{JzMzvd_=AEPMl(Or<7?%6pD`lwmQoSt%VHct4Fin|
zQ4+nyI0xcSxv?_7J3#Lk%lB8^eZV=_<A8If-~S~uHH7G4Sj#av->)cH`Y{M|cjEp2
zIIvrl8XfbY1kjBaOD#;Mx_G_o_y!}D2XdmJP9V1MC>0w_e2Yedd*q9S-iS6#ithOT
zl;Jv1ntJVO3S}y~=!rB=mWNH++MvO)uchVG(i^utR{7Xq^CRC?AB9@^aOeZgVXAhE
zF^*YNO;eT~O(d_bFE)3k)}MIhzJiO`dr-n~>3FPZtK(6@aoXT^{4&+f=RIP<71BWO
zD|2SM=`Y_I0?|k%kxHqK1QS5<lLyI5Tvmm}pTw<AfcYgKWdsV4f9a6NY;IS|+LG44
z#%%<k%e8c(hOx{iw>6}Z#iC}$rhc^b7{5)ll#akTRYF*dZeAZ*RUH1g1=<4lOT&X~
z4(Q*S{Jg^9O+p%|;o>g+E_Dz1Q{=c43Hae(G@vs<XaC^HzDmRoC_~R#(lQZ_d?W{o
z4Pr}bzYRB3Tl8xn#2=79rcsn=e0z)<T=)QcvVg~GX{pq=Y-4}BWA}^O;V<ltLZZFD
zRehWvS?P)+-sw-Kdu#{x2|90y4_{_`Z=4(}nEQZwvrnpDe0-E!<(s?8zK`D|mU~0Z
zmKf?cYwP?|$|ftCod%cUnWkXv(&Q8Gn?(zQdT%t{i3zni^?i(r;t%hM_Sj&AEKW5X
zFNANWlvN5W`A7-&>&_QfSOt9-dD|K%VYg97O-U}tKX&m5h&GO9>tQHpA|6A_2H?vU
zqSxvnb6yy)Jl`!OHe&=hn~7hmXUnP(cFv1zFinDb#4)dX^K6c-DRo8Ig?Mr+&5lkH
z@`L28mf;_t&LjxBx-lHadDk})9Zx6X551NBc}nsEQGOdZby~s(h6_WK-}X&cyU1-3
z<+np~NkIX`o7WS8vtIworxG4cg%;4s5G{KrC+n{BEn<UMsGDN>_SPr~psP}WCK!FP
zu*g#F@Ksu?7;CL3ECjC2f~9~|3J@|0(6ffiirz^ppr`aUT`e$PRXQgBJ>1Z2ftlw>
z|4&MKVs$z#Bvc1kY`4axhxBc4$n5+K;QFZnbCv<?%y+(Y3V{!5K=VbzSL-!Z>^*0f
zJT?(7nW;KnabZwfTK_Cz+Q+WuPSC?$ISMdL*pgK5x-CL@P^m>0Iiqg6c!Sg~`dSID
zgrs~)J}>((%eX`hfHE!%_pm`$dp#_fmBaEuSyMk3;c9D_wN8lg<}X@cB?#Bya>PGZ
z<EBYVy>m4MU@>1a^{Djo1}GzU<uSQi!NX|WB4Y1T3{a_iE?FSmqA<`YG2D;B`&ptC
z*+|~ziL~N-Tt?+grwu#c5rGlS%H1M5-%LG=jrJP13;?*NVL(jx@_K^TMV>XgI%Mvo
z@6T=yG_)0cNoSrXilgcPU$geLgj@?xGehvb?1x77-@iRXsI_=5;QI$c>E?qgOtX7+
zBqWTa;rh)Qe76-N@He0n4uf1k4K%Fd?wQliIfyy{hu$PezYT>Un=Go_8N&ai{FgS5
zVXz30`DunGv)-ZAua_a+YaOF^D!%7<Eg~gD0f27R@<sRE`9QOW+1$bs`lCluu)wOp
zT;F$npYOn|fK=c?45HGW1=2Gf*Rw7ASujDdwPpAEY%X@Z>J-{{&N#<)KXOLA>y63?
zI>Z#Y2fq>#4x)TTH4PIw@#$4c-5=>1H=4J2y}Nj*yV}4KZ>G2wQldf;O;3aSnCZqC
z&2fEhDd}ckdx#W>(YjX5cB5a#EdBPI!WxK?lwX@9%ay&EnM@LJ2`n6MC?Wv2D0&%D
zqA0`|C)i`-nO{hF7zNNLMrNugBb6Lcd6t@&?-S44VyLB`OU@JS5$|ir2h*EpP6CtY
z>#8m4hg(&IdlfL3C~rnIk#_>n9N>lEMTQr2=KlP{hh@?|GH`4hzS2j1=|gw+QY@}z
z0X8T{*ued&ZD;Q4On-t}kFO-sep}!AdD308l;T$*(1-&?eW(olXyMgY$UQ&eJy6Co
zX85d&a<<=t^SknmXoJ5d>%6YKjz<_ppcO@<@}b3GD0IxL4YiFijVC<^5T>)E^l#|c
z*wsQ~8P}g3r<P@M$Bvoi-%VCLIu+l~uIyMqxty<Bqex7b0vk3fE^%}7^W@T+yl)@%
zm5*^pA!iWVkbx#i6)NNt-yjL3QVAWQBve;9iEt<*e?Pui{X<HDyl5zhHUL!APbSjR
z48R27(!d*FQ1FVtKnG=$A_M9fG_?E46?Ez?!)qmX`t1J)1r?l{*$8k+f<fXHYo2Jb
z=2&%%2C=D5PY_m|-rcIYfTVPA6tXQ22=<h!(v7`Xiaa}bt7N)Y>y--&smK{Ng5Y~h
z-v(?|wZp_@AUa8=j_hdgOUCe@uVNXQP8tBqE(2^k|I{=)r_6LmAfL@iFNFeCMAf%i
zGm?7fMBI0i$aV9N(!QXrfc-Dp0j2m^fM|>rbK!NDcw{2Z8k0+@oT8sz_;_{p=Sa1{
z5^#1Y#Ggdo?sBld850Ra&aiYP16`qC;-R!i0~M$x8_m%@4<ULlT*xrip-`}qBkB}O
z3pn%W#4dPT5|z&Mhbi>OiY+{%4vIsD*pjQd`vslQL~iSlsU*j{b|8dGM8G6=m=1pk
zc?rh?&NmUg*J}o%oxrKg9W)D+FBT#Ihyei5_&$trK3H8!CSD>EyF|57zWDDe8w66T
zhbJPOShl4UVYwnl@LU;CQkJX7r<al1807Rz3dIpiWlr~-4r+zm1V14BIOT9emj-l<
zquI{Z>%G4`kt`>d2bY<9t!w9`AzrTbkvO-z^zE2fe!G(&$MXHcf@>aq?rgK10aJ~J
z%1SR%jeh2qG+uY}JpSE~x;T;PwN1{ZTc`D2S+3>3^ja-bw7FDLHs~F{DBs*0<))+i
z;PIz#|LU=ckWGzomJ4tFt)dg*IevFl?$+=}20dnzxbG!+OqltS0nuK6Ml-a5(o?IR
z(zK$+$oEM$YPrBuG!ciPRXt#eG7f*ns3e}bVDS<(5o+YP=cE41h$|#N?;PG&VO$(y
zoS|nWh$jQP%46|swfSx0GKG&InF->ZHN7INoZ_q%^DAmCOX&>%lst4qcJ~nS;>8PW
z&|)wUbmhGsts<DNac6#JE%!Sn`V>Jve3-!{UyXI!{f)_<`bXPM<&Je0{;nWEM9DL9
zAoux_s15rcG0X>xDtg^upx#F-MCOQbKH3;01=LLKR@timSBLR6mCw86WHw>pr!{k@
zf|4iPE|;r00)y2SJgLV!zRRR`=U$2bh=tT}U{FL@9ELdwr}2wK|C+8}krdDGUB7pK
zv2@=J?=dcPiBZW6Ftq(H0a&gtr`S2J{Zla&ekB~Bj6_*jk5pL5FI+0;=Q!J;S(ggf
zPq)>Gvqw1*JAm55+<;*~jo6jJ6XBKCuE*1*1<VRx&OFmu`+z&uvyze~*Ltt8+=%)j
z7x`VzSpHq3^t-ntja}_I16nlyE_mT-f6Fe;JZl{Nq@exUWk4TpaFStC>3WjLgtwr_
zZ=>D+{SSEb%>T%u0;1(AAT(XBWe>r)#R5d2_klrqC6;ji7kOR*{BwF)f{3|RX=ly_
z;G8c&<EgTEIj}AtD1+C?eVkk$ma5Z8TB*O&R4OGS%)qhBwwxh;rFft`<8M&CX4zPA
zX?{^vE1&=7K_uDFpy1os{I5oQ*jP=Ms8TOq<&7aKSvNV1a>k*>Z&}y+Dx(W#llSSH
z(qS!@!pAmaynWUa|Fu%&l{BABFY)W{9f9r=uTz4nT9a>EA|)w&fw+B=mUS~;I5d3h
zeXDSJ<XOO;TR$o{n+~6zsJ_~pHajm@LqQZ8d45e7D4+J{v$@GnAi74hSBZSAd`>7*
z1gz)(mLZ=OK($Q*(h%Q*2)Pj86y~lLzlddv%O{S@7|`n3i3*3_QzzB41TCLwwX~=B
z&nlpa>9iGdEAd|x8#kFxKP=b*OCerV-KyS))fyl8nVvE2!m?rqf_kBAsYN+=Sxl;q
zlO`~<8IS_4w$8p0?X@wpYO-0y?8!^ZOo~?Cg(9;#>YWTkEUH9Mw)nKBj`LV(Vn(z-
z9sy;`K0yK9dZ^zSS(U984C99~R^md{22bwT=cCPF0i!gUO^<~k3s-X9QA@k{?sA4V
z0~Nu&@70Zb35rG?oS!(VK6m@2&zYkbn$PcZ3?2?))EFp}ks6YIyX67NkSFS)6<bLA
zBLf;W=>0Dv>l8+nA3o;Gr8M%?t1B*Tl&ZpnAVMEAj$(DHlX4N1apy<e=baa0*zeMQ
z%@B|SdG7<u8mI|7UZ9{3wyKhX3MX8WZk`hO#kmZbC*~OXW6<ouajk?jP^AOA%V-f@
zfS>^SvI2JX`H86|3<3zWTmR1EtUGgIAEbRmmHko%8Wya!f*NS%gJX%YI74RBr*gE8
z!RGBT1ZA_@5^kFTxmXlb3%GJ+%<!oo=*i-2+NU7q(9a|N<DlRxSyz!)zFH%`w|-bE
zcZd)U9t-@ap8mQX6&oAcVGJR+<-ejnzBOwXi3<x(*k1bG+(A{*x;^P7@!rsU1W{T|
zy|!FiPC|u8Hl6iL^YeI6j28$~G~aTlGYI7|RP+ZQOA<Iw{Y9HAT0Pj~DNX5~4q=d=
z3c;^A(E}7BSF~ww`Qu|@?<hrW>i)*tiP!CHP#W9$GNeW>XGh~B3NF<r4NEn7=r~xg
z<jtdGSkgtmOhrsn|H;=%k17wTAg6Mo?kww{7mvlh;&jKcY(y;q!oGi0<RE0h-fzgq
zLF^Q7I#^-->f!oG-wJoV5{Xk5AS@&%<*XP{60I1|P>fnho$up6!w0}99YTEimjhU8
zS}Nx7Unlt)EuuaWTzJQeofdo2LDIPX89_DLUiK(~IM8eBYBNl>t;buTt9GaPBy@u2
zTJYw_nc%0EI#f3PAJ)D)sOs)}msCPRQa}L-X%OiU5a|{Kq?MFzIDoWDcQ+zPcQ?{~
zknWJ?(B0g9c;D~uj~g@h&hO4Rj01<m=j^@Kv!3<rwbn)fDQU2XnqiHA=fSJtkrDYU
zGufD6+nSvtV%DYZgFBleWBxz_1|MbiKRNHXu*HLj*jsIl-1__bTXWA*uAR3yTLX!>
zj0hZFR7?qE#>1{VWV`$O#S(@=tICI(CCG+p8^QiD0oLv}6bwZ0wBIPZ1*y<K0DZO#
zrt}0*JEq`w>k07C>xD83_nX-0y(`oE>UbfmSwvtQ2WX!O_gQrn+ShjO7R9bL3{8y5
z_7*)VmbF*R_~mc-xrU0(-B3_bWtQ(bkZCLQ4cwhSLcmfzq7dys1_2#fbNK$7FTCmD
zu}Nwqio@F$(DoPo8~;Z387w{N#-1AdM$uzjq*QtmB7!G|mmHKYmDDulatofw2G@4R
zH=ang<RGP<6C3c=@^udmdeh4%xlX8D`u078*Xe=fOa<IUELY<oXsrd|z$AQ=gGzR2
zi>=}x`7MarSqyL<Pb6^G2CAYDmNN*u`!gWfcW46hpDtcy4OMHoMKi?2Rf^y5(I0EX
zGjP~1f;0`d$VjLB-cLY<UW?9Bpik0?Acj=~&uYmBuIWO^LrjgB2CpGK!nHvbq67rz
z;ZQ9N{DH!~KEXu}xg1V(P$V6UuLnxT;T6B2L^eq6_WMsd1=u?7th6`U*RLoBAHza(
zR2u_-f#!n-q^0$b@QCt~8En>ftdzD8mH*B1fmmZD`a2}tOC3&^FpOC<IKXN<5aC++
z!8cM$L>)ZeCgW3Vo}aYHIKa}{;{;Bay{X>3`An`tdLq-l_}=W56OC^BSg-?>wRZ|j
zRwT&lY@WD0A|b|TlEZ$v3MGSz+GgSWF~L3rp09#`@8QQVq%lAEm0LL8*VKS!M1U?`
zm~VjOp$h(ZLts)+gclT8)R7BX&3{e+v?K4Ir{yJh9+DUD6HyQv(IG(sC*tMt!wNsv
zSJtR#nehE0i~i;tJS;u^(lEllErK+T((2=L@a716L$wJ{6xr7T!Dw}D(bf3DTC!lE
zGxm;znnLKp+v^5Z;^RW4DTl#X?euB3a>}NK$rbQt4kXZ!xboh&`Xj#PeC?Tl80LJR
zpxjre-;y|EKyFFYQ}b+q2dMM@?N^EPvVw23Jble$ynPI?=(@lA#T_KT3J)T+?)>BD
z|91VfEg4@wN1k73l+4hFu*dzN0EebE!V^?NEFG(*PnCGlgY%U!M@XyRNPSFaL`dM{
zi+4Xn)17HX-kh4s>wHo=63B`?L{k@CaUvtzl<k#`D+O*TXeET%ZqpcjqV~|6oH<$)
z(ow3GPz4W3@ILikSQeB6kK%`T_1P5zB7_7rl5W8QAF>vaDjQgd5<Kg2Roj+Ex)lNc
z6Bdgwv55i5q8?Bxd~b##pWqS`?;qBFq*Q-pO*JCTVqLHH;G|A;Qs*svq!Vg`lDZj6
zw1D2R(~dvL@pYc{`E8FzK;2B85;%(*)NAnJ3-UA~(RB28oXdxl+RXBJ@cQ`r%3qBh
zUK>3S)bWc?x-V`CgO|p!S6I2nk^QF@Kqw_1DOK^n-WHD@7c47kYu9hMmjjGhXJkL6
z`%f&lJ^RPaLjFxiF&=^!cLtObA&OYjelFx#ys<rCE(r4Yj)Iad3Soc$h{-Cdar?6!
zUR{BfMRK}rwk{nmpplI?os|3){uVndaf6=*E;x7-?4DK1i2eBVUb-Tf!PoB7lCto-
z$f~Jg;bob+JDF6yiY=e{)gzgqzyeRMxPepG;NX&Uka;J=TC>C~<_~ZbQe{M9DNK|(
zMITk}mcH59dNNcVWl?j_GzuRt^4>csH~d*c(;Dagn@%c@FjVdphe_#l;Oqo_O8Vrh
zb5dnjiOiUxdtISkAoWBsDV@!1t~$B{vkId9%vt0(!I{NkC*h>~N#tK4vAYS<N{In~
zDLLT^vOS9V<*^$(c6YoX#zj<=m318g=db}Dl)uo_u4M7%x&}zI)y|(BU6v%<dlIVM
z2}Oj%^&&B_stfTame_9)p~B0(Dumd;sWBvzU1acvu)xQxLr3KiMbd@$QZdEX`VYdL
zMnk0L***RJPXiY3Y%mdGOE*#~N#`N!%^%LXigx4i0BXouT45*pQ|B#JB<PrR=tDCu
zhl?f@R1`{qxZY@W->l`1+2@O!=MazP$`SPSmnH{{af5uHMk%A&RFrLl@0UDoznlYZ
z(dY1I@xYgvdIKKUMB62=^$jR~Tk_{nlt!w9^KG6VixN^TOyJYFpmGrZAptMv$3&|J
z>HzqZ=}d5#B*gYh0_pv^uh&HO7o#sDzmnP|qVb;9x>V-1#4sxp^duy7clW4`E$C)<
zhbv_o8WDXM3PfiKglUj;_m;9YXr=Ge8rhUC;;Kk1tA9Xe&7IOngyKJa;*a<Hhg7c|
z+e<Buui`0}8IC<=cv0_?)R&>M>$9y=rg+YC>_@X14!Zz#!*;4E@rgO-^(~!`7`t7b
zh5((Bp=>^3f)J67wMy{&>CX2IanT(sh5L}?tUsW7kL%Xpb8WIv?M?wuKeJh3rdh-U
zpXke*6!S=t=ODu_#(kJ3$rcS>Mc7+HeEC+Th3Qz`3*jFGe+n?qBpC)M;{HR#Vl^=W
z?&Bv^sAhMSV#o9QLHdhkasHhZorQmB>IeV;X9?wMBuu*PV5H7gqSC1p3t+ic{-xdb
zIKs|Rp&}KP;~<V9@JS5+Ii3>M^-%JZ@;S@clD2*-Pf`V!(LN?7cI=uobg=U`EC6B)
zU2u~985povphg^JKFU!T5g!qXNESDvvsWIQ@`txBdh=$1EmgH2ujbbbB>@gL`^m*d
zw{EgjZ73a#`%T-1vVYA<9WItIZ^Og1XLHu&vA89=rjr=%Or1YID7{3oj+yE29r*nR
zCJk91vMLaAo_>!1{JqdZIx6EgVo3nTqde@(FSxa(T1M)t|4KN;jy#!y?VC?{e<p}Y
z>)1-QBrEy5%`kAJfy2D<OeJs=7NYgjd@3;KDfuUT#>4%c8oS3~d(**p%0<gTYC1#v
z;|U7cFAVzA%%7&NcRXMjsuoSoRRq}TdR_H?Yp*xOPO<^Bx6jhs-j)iKDk6<&I9DR+
z`l-ne{ZLiOuD|Er>jX>!_cTEdj)!rdP*DZ%f|(Rmd4XFoJ+)n9kQU*AZ}kg;Su}LW
zHvs9yAJ?e(frzVUg1F@L&we_H1I#aKU9#Z-JjWAvzf(2$TXj-Z)MUS~`=hYkS&O!<
zF^NJO=MzDV0bP9kk*>Slj--c9Q#%Gat)qXm`v#L+d<8tz`{z$BZq^_}83cKaF0rY6
z-glM@ndhg;r;S6ka;PJ2`g^58&E@rbZOC2Hcyqa<h80@nO5^JOItOoGNEPoixsrtZ
zl##(pIcfJR))PNFx%jIFwTpRKF3(ecGqC(^@@)K#R#Qehtd|w}4<%#gr{J$Eya&Z6
zlaS|cMtHJuA3y9+i|NEzD!WM(Ph2Y_UkMdBHK<SBP_D`#7-?orlblgr-QKlsr^w&;
zl%LKp7RwwpnT@S<y6`XXp?eS#_m^g6M6=H$x>K{*dQX86xYQfxeLLAjPB~FTMP$xr
zSnsG8u{QoZ#@ZTHsx<#U2p<1!FnOZWf<HW&>hbfrOm$)s?mSV~9i736vTtlnwXyry
z?=Q<O3SSOEujQ?1FrH5&lYF<%xW-9p-ULC|s8xY$A|KsdNA#SQ#ibi)=&Gts=)zg*
zXq=IoLy4Q(ag`ytP7b+Q?MI)rrX?(baX)dS{+WWs)d-HCg1nQ|7Sr<MR8Ok69kjIN
z<*dhbxfR;ifA4tm_H%DoJO_{?i#RxynDNvmD(2{Ax;|mT*R7mKM>=CLeY2nA!=vM^
zd8CNYX9rHiY$m~iC!oAmG2&#fArz%S`OmwJk-}&Ced}>~PE}0zD>s;P=nhBxeMJB}
z*BnLnUj$W`0QW7nX-~+eL7W31lbxhwLrt?t2wv0RlMu8K4D2@r_3I3%U;)4TZ(F-x
z+W_do4Q5^pDELTGz3~-<XguNw)S}%(KB>X}aNQtm79SARyI+-~FPVwAGFUWznWqUm
z$;b7>_|%cfo?&Q~Vq|Y2lcFiBFM!YXY5MlruUF{<`Z7NO>^{-VCG91^;uxTn`8D5U
zRLE?V5e>UVtbWc*+1!vv&sR@<K!r_1D;hm&sanR|>U$)+5{N!spzC#BK`^B~4{{0V
z1ws==Dr&li$c&u{y{qK%3Zik2L0OI4y8@d0<&by#GtMlJ&7mDX4I?r(-v9Dpew&2b
zmB*Sw8$wL7DQ3*yS9P^T>%Z-JkjwDmcY*qa%rCp<HMQ`5$Ji+ZmI;EX#anrW)}nUV
zUyuS}&j)|GOa@Y%;axr&cSM~OJm`KWR6p4>l(9x`o?NYyTGT<t9jfohICUAPn9kL;
z_+{CT{&teTH7fmF?~16PHOs^Wl&a+&1>HgY<=iuHk{DRvyjDrKIF|bk^)-Lxn}hv^
z=C(2J`z<uvETg!Oq{JXJ-V!Pvnf|wpe?y}M-%q}$m(xg~+(I157nhVEGv0E?x6N&T
z@W)))t>`ema&oOkoB~&KQ{fp}`*-5FOLzNgT-~~urGe|e&2V6u+#DsS&?y&Tf6>^d
zE)ix|3b{-x<i7IEHWdgiRF)-mrWU{qQ6G#7(9MwBNNxK0m{3z}t9ti~;0p^KHZ3T)
zleC+L{uPF16$sfX+GW-q;>oJfsa!md3%$wICk><UH73MPD_08S9!=If?TU=bWS_YL
zx@5TC)7M_PSJi#vgv!f+*~>&GK<vF*`OTUP1Y&c&_;y_RS>l-1@UC>8dOo$@UNF71
z&RQE30Ik007ez;P9k@omEJ@v$@$t4QuF{5-+phTzg^+{IIjxshE6ru>qPK#aHp$10
z_Agja3)TDfN;vL)jgF1$;8ctP1CpA))yQW(E7#?x2aRBvta71tu$s{xc>x+s7#2-M
z2mUWoX%GYcZ*xIFGwZ$9G2A06<)UdTtzxI@zV?qoR<&s~47)kb*eKK<d7hC!m)7V~
zi5xPu^oZs8v)4Zq5ZOTUDidqIVmO8+@e(7TKp)~!)%Y*1u~^HcAn_fWdms%9cs-%T
zN-QDBu!w$8ddXJ)yljlmEUkLW$D1%;N+-Hq{3z+KT$ger<*VC-q;M=n?54N;*<dQf
zTmAgM_(5_m3wO>>pgR|Rt55t9srnXqEbDrEi3Jj+_8|@v#>|55vp=2tHCvM0w&+tQ
zPqIfi0{g%A)gQ-QG6eim9JTc6f^kM%HaOZ43-On!b60a97N;K&1=Sw84KqB!aRfp3
zd5Lba)B3#chpQ{@Xa+*xH7r<$?adeV=`qWH`e<WbUEQl;o&dqtDQqi*{=Wp}uaqxn
zGR|=J-mTyZ8~V_U!3!<OKPR9nO6iYz^sq%SUOpvr5NP!|lx<TGu9&H);v-8=oUt?O
zex`geCA-NpWVk9=-^P9R^m|^1tkj;m_H{}@F*w3ADd;D=___Y_efi{1dKQ@6bh)5d
z{qX9`=C>4^v{~EEu{SKV-Hj7P>3iRe%t~f<IP&bUX5ST7<sKIs1!%b;r(T#a8K>}4
zxy_`&*A;d$!}e>q-E7+Xwpv;PUw$<{?uNc^+Qg;#o6-k^DT{<h4C6L07UAI)%lS~b
ztpnd3E?efEtrINJQN^NK-e(gSGAYaV$2k9vR2X!UM}(3*Z&F0Mqy^NaxpZkzs)Y@%
z5%iTDD$#s|AIs~8wo1YKSAzMWa{rL@Sn%D-%r6UyK?tB`bgwxY#%-r{@|V^y>uuL{
z?E_D3L317i^tW^}ds)Ut`p~gHrz`F-24A3V{5ty<|Ja<i;byp2II$}_HiY;ll7qvB
z@8$*TtQ<#=a&t1DcS=AU!9?k7SUIz6MnyjTg{c*m+V$6blFi|XRDykOU8$BD7V{Kc
zi#`iuQw@!rT8pX?_Sk1)E+5}Tj?Ur@E88-j)Xnit$Fj1aa~zm5d^S)O9n0z{<d^g#
zVmIo9Y5zjfjAINUeH;<VY`V)R^I$^r^k+duiNIcbrPq4k(7EQ%@%Z<RMGkp5VcWlF
z9v;cOio?Y08Wj4OdA4m7?C{STBk!)LhC_%AnNb^jhK`y`?^pMFk9=S3K8^VfR){M)
zc)|}}?a=uw$}0hU0}QjKL@b8$N!3~HV3aQk02!cfTd>Z(zz-=z)+6D+DuVPKp2EHS
z;R6zEC{k)90$m3CPjR|O`S0a1g2Rvbi*z!d&_@(17#5C97jO)sKR0(j`^~K!JAA!v
zo%v~HO%?Zwg9mnFQ4{Vp^GwQWj|b-U&Xz0lKxcyGcXQ7~X7Ou=MV4UUP(SDEC4#vh
zhz9SdXhugByS+v69J1zA8(DvGo9*=C=I(VQ@eCcSUy-12$(ylD8MeDMyF5HD#-&Tz
zx_IrmRDXw^q-%fn%>G3SAHRy+=XcvMVTmoO-H%7A!bwdYjke~q8Z3H)Nyih`AKZ5<
z1{?;***-VS4dkb@kMpO3iz)4H`TohBJm*nU1K}!EGF+nw4rgD;_A=?Ov7Mly1Y~>p
zHJr^bf>5a2G0-8^vJP1Hg&@kT7Y_L05uyXD^u0}jTRVW7iJvD*y(s?utG?&mjG@N<
z*Nv*xVV9(j;$Of1-S;X@^!?1T7!W`z9@9QiSpNe^MA=8iYe4*Fw;$&(J@X~H(r^|c
z$FC}?7J$|dOdH5)%Wt~F>@tA@EXFLh#`_14!zyDbuvVe=gHycrPa%-v3}>;g4Gzkj
zn<c*gG&DSTGeq?(_;~Poq-%d;aNt+*oO@R?y3OEVMQNAPXs~~DU8PPVLiUJqN%q2%
zXh!AH<GSv@>dVBda^L=4ojwvA#YWIspkf%p2PT~ubcWR5pCRhOArEsaRWAxDb)Cc>
z6>pyatVk+Vp9}D20^qO99hBa!Al=Yi3gl5t0#!ET)=2jP6T-bH3gxYS8-(z&{SkzU
zO0R0m=N3TzZ@vWAXFC)0Ccn#>of%|e6FK7eg0?TnazEIueVwxc($i43s1aufYe<=R
zn;fms&$mG`tM3Mo<NnD&Xa)>w)8Jyx%G#LI#5oZA9#!yWcN@PbOH4=tC*rcDOnglE
zj<Gizj|#VMmSXakf37{tnix+L_GO8)G?K}Z7AF~NF4nd&ea(^rQj88076I9})q1u5
z&zp<i2b;dxi{}8u_}02u8QeEyN#_WUEKR(w2xP90B6Q1}qGIj&wVFW;F?ZQ=8zv!h
zhIeG7aE1uS0X>2PoY(CN0(Be#{WDy2z~s6K1M^Mpp4j@)e1wnAn8*5m@kK^Xl6^5T
zvD|^io33udYIe_}-xS2qX%uFUZWIQsdGAaye`dQ>vp0x{klIg7{$+V<vEi|SYWeH3
zdTAv5@20D%ZIvFKSHeV8I$zu8H>|iBt_S{YZ~+IQ_<EQZ@=`W3J1dI<xOh)KyTX9*
zJ6)(j51I~e5q|g1j>e|n<e#Cv$6&J}jRpAxP$r$xt=C@>%B{bw4!fK4yAvoG$>I~7
zo6^M7b_3?i@`||bD3lL>F*!xG{h;~Ha@L2StCCagh60On`Y8(y(kVLy6Bu0CU~xXQ
z>ugim1KJpYhQT0c>W#NuF1im7_hOSz-TFkP*Sbrmwl|6(JeAGvw$la6CJtN;!Y-9=
z1N>FJ=I_AB8eC{jx(6?SU#GwvIR<w?i@*~u<W&FOYRkHxfL|+nMQ6S`_+`{1_uSv{
zLwz?*x=Y#4t^lb~;P-@Bsh(aj%b)_A43t88aVAYQD{Ruj_@K=GM@c(hA3Rv<ZYjm}
z42+G43dxf->A7?tYCx7yD|+6@?a{}7?X(m;psmlQuei3RfVj7g-T0@;!Nqh}psL8X
zTR*#s5EJ`1oWRbpWiN2X>=2e7iUpxz|5kkF`bnczTE&=`YbP6I(z$Y|xiIr9=f$I+
zS6Rh#E^x;+J2mI?+hCKz_#{_>$ulyvJ(0GfuxxST(>bHQ5M@?VI}Grhsp7i1_}=6$
z?iv@-;maoy04(gTf%yMN@`avjp}z2^j2W_ARnXCiiT+Aq{BRUNGo?%|Bf74$da>U+
z8E04IIX=W<!kBE{n%gv}iSX}B$2%uL$+X$YsgM(Jdx2Uczn3OeYZZA5s)axD$4C38
zVrX0xTrn8!)fXEhH%z8~<2(b=VaRa~FUg%{WAdS;Y)q7{bGFyn$HMQBDi3?p-HHNc
zPE9^yp0aYotIv2k7^1tEN5g!xM`sdKZn4T45QB~>l^T<o2TAs5Kp7~&WlNiGBs@~2
zu-_zmAG|PY|Kx9=czkC-z0KYN*|XSE!l_5u+-59Vk}ru020(JvpMa3P)-qrqvm7^g
zLs;)&1HqZ+tC-p492|F+Y?$kj#llfM{^7Nbp4XY8axc2sE)S%@38BavxG016`X&^N
zu3DJ1F`-$6C$uJC&xOD_j}|aTdnN@138Xr3I;42^{O^O;a4r5}x}6L>+XX!U@PNzv
z1GJJq0eMnH>EJP8TC5LuK5@6tI3?qQ{Ce!jMkh`_^m2u#ozU#i=S)1rbA289`jz~z
zq<7*t=xpvz<%erbws_j!R+55af4+HvYaH%mVd@xn7C_lKW*nkoLI@Macgt}H6D8t+
z@@mH?BW0@hOu+wycrd=KM?OzYJ$6o!+4U;6a`GcB@wmT#`!A3^n#?$@BJIvqJ&qf;
zPIriS`DMBce_F#Z2R{W=855#ov_>E<XGUhPU3}Z9T<J##!rbqi8d6A;hkY)={t`_6
zkNb_X>4NAYzJ8pMmb1`2L7M8iLXr&jS*{XE*tk_NTy(FNbhdJmZgu-<OD312*0q+T
zx&I;61}}*<^&35=cF||v#E$6BOtTZE+7G%eI`#sw$zKOyL~bjg8VjZowX8r8PrSwB
zAG+ff`$iNILU<Hl5uEGPOOUUz03?fvv&<JStw_ZXq4JbBhNSoDtq0y0a&STiN-Sx>
zvWtIwunA7hDZT%4ON)4eUDL(<e*tDdl3F&9bUXI-C&%3~nK4t9(MJh&9*7uzw9i7n
z=zE1Z4{9fs@}%B%FbtQMNBC+pz*1_Xy36RqIQlG1|Gri~JJRcQbg1agFsTiwoO|#?
z*D!dXsePJiIZ4?b-uLR6`$l$FtGvmqf$Aukp2OVgx3@R%s3%;KD0`4+D*D3B=ITY%
zN_N#rF|Hp}%dxbtV@eR5EdAOJP#?CQc5vkSrH=#?c%f?_>peI{KCst3U&FOqpr$_V
zzEH`uQT{2RjbXGvZwO+3L0-}&%Yx&425L;KGCETg?`^!)VDNt`0RZg^p*YTxNTG0Y
zbn|~CM>Vo7S4Vqulg{V7qHo{+Dfnc`nX9LDWLj~JAbe7k%~=daOZ|h`_wf)qACg9N
z7kF+@jQixtSN^f(m+%=>m}VE(9~}@CTM`$3R5Q0}iE1)x7N)W-KLIBo!fse^zm@1K
zTws*KDsN^E!0}XB6V=glYpA<Y)(7-#`*?wd3TLt=K9BBS&6Ch^-8Q4C*=>17!%78n
zVrh-jf~&DW|JJ-B<ma!Vrp(7*rPiYgmhKify&fvGC{W?fR#6#(RcCRpKVJVZVj0dH
zmD<=N<}y?2S>*VEe|-MK<7Vp_C*KdynAqrqPmJnUT^;3tZL_vr?d@hLyj)kT8kzK`
zr)1PH##j7-{h^_W(<hju*3JjYZLR+%Mz-tVhzt~2%tGwf;VYqp3&I+PsA97L!{R0n
z_bdrIFT5o8J~^UUgjZl-e7En#F)F!p$T5vXWKlj4Nz2Ek6LexFz;RdU9L<)vkn693
z`Lx}dZhF^TmD|-M;(gva+wjWYn4_uum{j#7B?&Xwr5ULxdv)M$G+fNVGJLJ-qL5Ce
zmc+l5;=PEm+PuKoS?%{XEXwZ-c`h5T-9tae1=rWnP6gMmAKCdgC!euxU2)5HwB0=I
zdOOzYF&==FnuZ$P^-dg&@t9Ad@MO{|Rvo$A7;lQnd;P(A_z?LE1|(7G>L%T6uhGAx
zj!SO6f1tbl_iyKXe*1(Ozl`IW=gJFr<Vk^Keql*XtnM?E(X|FOc`i>Kd!=f;emV<(
z%i9z5+kY_qP4$RWUER8M3ddMRc3kI}7O8C|Yr^6*3e%7-o057-a2T6H^6zkEca2SM
zi-}5N`XDroik?dGx?85<JM}X8yGDgSTedku28@ObsnHVaYgDjauFN!{piyK=8<*cQ
zDziIWvJyODsqF`TdTNbyAa((o@4`Jko<`9d!w?Ygb7fU|Y*(aj{UJD>_B?+2-K^sX
zg(t$Ypm&%enOwN&0}4pMU-X%&nf9FF4ksAlYm5VSj#sUoYpH&SM{DuTuyTFNs2+x$
z^8r<H!u-XKO78MOG>u@xGS2n#NAidiE6wHc8kVBizaH%u#9eoO>!;VK&y)GgsPGq|
z&s>>$y?Zngo}8_dewnDM&yCLid{s=FarRx$P$lrD9VdaZ@pQEm8REF$lzq)2;2&%b
z9k>3j|NFU2n6^bjI6}maA%5<)!3@LQV4`P#e#oJANTxoizS=ShUMM3H^=FbY2O=kV
z(HvT#Y^-Cv3mXd)CdchuP*~`;V_mYq?qpnHUAkunBda^k<V?JgnvgBd7W37gO%iPl
zz<-?{vSmL!RC<U3AxAPFGQF?yAmN<+r^%fl9Mp6mA&qX@fKxWC;Gmg07mjDoe}K-9
z{;L$oo0)-Q2Lf~~aj%sAW7L$i<vDnfoExtl5y0RWumia$M%gnX<+27lsSSD+odnR%
zy13<M3g;cu^j}I}-06K{b7e$Sm6^HA+B{trx7}M`&E)%5GSM^`;$u0jUvcg(ew2Oa
zvClM(*;f4VLy}?jfc5J?S+F-7H=4AYtA3X{9Vt4N;`~`yoJo<*(04nL2mM1#+;jX*
zN+h|PE)>aMbIv`N1&=VD!VnKz+kse(kRZDe>IJSg`u7+zseCL)6a6)Rg~WTqud-kQ
z5ZvThpR;nNm_u)IpBu@nrSR|&U%7>;JDyH5oKfYONapTss?T?wun5TOsek$MD&xvQ
zjVtV@!qkL{&F6OaoRhXIG#2%`mLpp01z#0tGxfm8#}nq3F$$ZNwZB_i3laPC>ZtQ!
zt0)mVGa19>INfW47qc@`Q%l!z7y3$KuowPrJJNAy(Mbsb_GtqWe-BRr4OmEwbQ^rA
ztMlWKbmkvDd;-@`px>;nQhh(%b#W)5f(c3nQhTg9?@J40gUm0k(|Hh~S;)lc<@AzF
zWtAX%r36J7bSjYtGv7FB5+jOS)t(oOu|EC=^bAUx7ITtKTw0-T4(oYO$BP{J9O!k(
z#gTn&*>Ap^rdq1AQZms=o_L5!J};S5%X$Gs_qL_X{13LL(de3=DF0InAZuc0%Kk9L
zTudxO?;CG46KSY<!X|HG^4Ay>#W&Ggsv}?H$8sG|(OA9FT4I8ecmWFl)TO3hY`~R@
zN!K^$$$K{P0KDhVdEKZ9>+#qO^o9usV71Gkxl{Gzmjs;ie;-LKiz6!H@F)tqff)*b
zr=^|S(!pUDTt^A^ReHwF{9Vftxw&(Z!-*!|8mne#2xz+Z%>EmZ7#rvH%PGWcW3q}C
zl%C?Q_N~zlyfceqrTgm(H4*(nL=ZWrg0m2`Os8nD^If>aWk%ttux&4=g-Eeg&E8;X
zj#^fkKsB^>Rt(s7l87BCux&@UZ7&-ZPqa2uy|i2^)N@7taOr@=7*obJ8giE-h~2(!
zV)hs>A-re1(t2F-Z<Okv;Tf{*REdC>6CNUa8(%>%Ao8RR{pDrSo?{C|rCpQ;gK}B;
z^H5wJK7ZR%Jw!Dyar?&@2Xlx9f#4sY7gjf4U?enQ5*~&-1#2}^k7|ssTc=czb9p;9
z3Z^6-t*i@OkgLZQRcZtwr7~WBYXUt5P#r`!q|^`WFX?f261gP&#^v8z0}%9UWn9et
z-Wv*EzjVN5$&0_yBHoj$hPU^jj2EupL2Fc6ICQlqEHCkKgpcw@LYg^Op9hn0E0r$n
zx<6#!O_j_#OZ{T=>X)a*9ff1F@DA$n?s(5;;`X8rd`tS0@*_lk0LonaQGIdpLMhm_
z+K00TR;?q^Y}`w$im&1`w5(d2{Jd<6kMZqQ%Y;$siB!DlEk7a0%k@9ys52#FpD`d-
z9j5+0pt6WcZZ<OsjDv6Cu&#FV8~;3&nVL6eet`&1vs6E0>d+~oK|oF;mizdIK;wa=
zWX9*pYtMnWl*m9b$y=4}q`JMAtOFW>%G6gsA>|JO-P^VG73^h&?XeSxqx+C_HR>Mp
zc<#hrYW5n{YE0p_COKj<KK2eDW=9L{Wpe&JHR#TbsZLbPx}SoMhAweqw1DJoN20X7
zDRLL^tN-g@BABmL_HdrpRaA(X65)B4zT6$=BPbI)edVn7wZM|CVRD?w9XS3E7F>Ym
z#V)(#ym<Tl`QrteByCsD>Xqm$X%xVoKt&;Z@hJgo2qPA~eJ8MY)Uay*;o4aN^rKeJ
zCO<VaF`=eYzfLf4O+g~x!-b0z1PWlOuQ_%>2^!%9mZwDrvSMR_>j=CH;qBE~*`_tP
z$R^3Aqah(jlW$yur)kd!zBP}M`yxa>-ER#KB^~j`wZ6yH$fv@ngI2Ve;T-)KF1Ns?
zgsH04iK+%$4Dq)Xp6p2}$Q57so42>xi=-hn3u8W(lV+TtcNH{+83Ntx@e8Zr0h9*X
z#Q;m5Ts<=Px+;5DB$j58Y_D|!^B>!b=!nqA-TMzJ-|aLKXR&5j6w>SESE@qJ71|$l
z6DtljoRAb1-l>c^6m=VYa?GQ)+QNVJm`#9z#7|<r*o;Lo<?F`}R)>~>I)e>2d_{#b
z+YVUfh>9<9nYSx9JapbI{SH7w!;Y+@v7QN0VQXR{`-?%Hon-j18A#Gl`yZ-cVCI-?
zr<nfX<R=B5jMXDh0h;|`3JeVNLa~68;H(mwbols-|D}+uGr(NJ_=Rg&ycZZ3b?048
z&o`5AF8MxR89f`C+))?eslV`py6o*urSW4KF@m^8Fowr%>xY|CvlUBb=C4mvc_$w#
zJ>Y${*q|Ps9Xm&~LIo6P(oYI9qHlm)rNKvXX;UMs)XAECM68sye7}#wgn-WdWL^0~
zozCq((KF$uE2QbMrcWGeHlp;M9^q*^du`IhL#0KQ%|6LMs{_}!+cW>8@_`EktuY|_
z*)fdKZ_|n_-@W4R-R-QrMgZ;5zjwWx0n)_9IkF!8C45?Y^Vshbc4&alq7g&kja!!i
zx5lz|BU5ElO6XAFDuLe|uPa^`1?2Z;bP;&N)^3Hucbnh*GHdOJIc#heX{Iy@_LDPA
z9vZhCZ9G$AS`3gUV89FXel76hyKm&FrjRf|j?eyld?0g9gG<%f-eVBvdu$>7Wd8(i
zvrm#i`0{-?G<eFeNJ3W>q+am*s8}(MTf5jv{`z>#4-FkXRu^=4|85L>?FR-fMCv9T
zE*j4AS!HgggF^P!Jz?=VO)kS5_-vMvm-%M2op0981b}~?JzqnV7SRJPMkq*rR4uW1
zM-&tNLi0vnP$sTBR^B3o0eU!Kn^LqK;2pqCcHtt6GOwL1yw{nV{f>&cYw5eaomcQS
z!q*4un(A*<p03M*!`kyQ`@=PR$$E#^XpMS(Y;9Lc&G|Lu=8<{1N%B3=2fTSYuTn|O
zl1xjMF)yaj+<2rr?n0vCKB-iOr#WYMt*;}l9T1>Hv|8|!=*h{y>!!@4tDRgo*E92E
zuRc5nD%kHBV1O!Yi|8J<#jnwy*C%LQSA<1WY_bi+G10$5a$H|G$?L1JLI3^u@dd5E
zy`AmH#gy)We!H6Q@Fp_)aU!>u)i;e+afNRY741J`j){P6(XP>Xyx-1>gyc0YPnIED
zPvmramjt5)lR8~ko01biajPdB-WMj#_!468?m(j<rfKN?$^A0C`u_R}V+x3Lwtp{I
zWUW7fAr8ae)d%jdV+@X>=HeG>AQu>yVNICuj?y^I>d!vbCJihCIbi&Hjx|oh#jr}J
z_wSTMxL1k)C$&WFa^KdbmuQT;+fViA5_d3<KWpKx_Jn@d@4vcmuj7_#`+l?Zt9r+1
z!0oha_`{8&u5shPQ6Mmh5C)ynMygjN_?;{JTsiI3(JI~ihVzkGg3ltQk+*_$i@D0x
zgQf-CfRn4%i1<kLapqqT?k)A+mU!%mKfl(nM%cbraKdLE*E&A}6;+2T7M+xfn21oh
zU-mO=pJy5(u;^KYTfl)q@YULm4yetLZ($NJ<&+5{q5rno>Wpb)I*2#$iOCuIA)54$
zBB`hCIF$-_Lypx&Ru0tj1fLbEw`79_W*Ub;fBpD;!fU!qZ9pNhwtDS3`R3mp0Wv#g
zH5gy)LZ`~4-oEjsarW@S8>sMq``}gC*YFdvyO6@zDAS9(Jy4||zV-wV47`^@K%egn
z`!S3Tq90w6&cm>nUZ~T~(1WxFj<MY}J;?HFX3Z)Y*Sp1WuCk_ar1^g*V+AAo3UI;Y
z)F3!Fg4gY0glZY4z^;`&*0{2QorEm{+aLCUJ_q!r-I#ZAwr3_6S-r7>DPFx<uZ)s5
z56oz#y^@A#(Zi0L8Qt^@$J{(!9(i0her<c}e<D-|L&}Seg|a;WGkt%~=ygrM?#OhE
zc|ktTPXfhi&R}dyJ%NBi&}M7Yls7?M&Ifi>+}3vw>Hb2g1XNPzO4F~FAfVLVTl;h0
z1I=ay$79$u`I|Q`%J%aM%|#|9KfFvbXZ|)e-fu$w@wKo2_N)Yk(lv}D{P>D{05P9q
z4<AKRGO@YT)@I{18jA`ZSJM}jM2?$&zNaai9ZRH|s14Kh#*~@w=S}1eep`8_2^<P7
z&Y6KO9=|FjtWl~(!ZoO0kteB*`_~$;cM%=zrpLHnzpvd<Gu;PZ!aQpea?mH<A`cLx
z7Ckdf?k7AdKoxzU2KS|0LGbUR^-}`zjD$uB0kmV^bp@Zv)nJ9qJ7>=gcnUi|p1<6;
z-@MTwi~aHW57qDl*q1Op53gTXFp`H4oG<UT=N`rrsMd8JSigG2x6bV2Q^bepgZLP=
z|FQjt<=s5<kMgiYouj<`B0dvwc7#BZM&ox%C^S-o37_H<Qm>N9>weW|yVcdz)o&%|
zc`lexBqylQT{k7p=*;aUV_@R8EQ^UCAgZIHEgJb<1)5BEUkQ(Gt4-9m5xHzePR?x&
zy3{m&;mBXR-J`?Nr6b1HV{r@3ohuZZQ&62#<2w9MQl=y^H$8QEInNQ>lfI+xJa%<9
z8GHD5<+9B=0(%tO33_8$T47G^c2$0kkg5}M<X0F`j;(D_T{{+vpgV1-Axt@kFh9JS
zzfwD~5D_Tj<E+8<;MoJ2^tUr=ufE)Q4_7(%?boF=cq<~XDP;%mbl|m=Q?&H;LF0CG
zJwF`El4&+IlOLGmPCvOK?PK+jjtd>WDxKECkG?CFGEP;sC-d3Sb(g|O<Su%)zG0tb
zHupVKM*w{>#sNmts5)c~8*f)7<L)VzyyY`~gamQQC)sw|e6SC3-<ZEpe*b}z`ui@E
zd)55#d=Km)5@dHQC<5HODvX4(f34DIQPAFV#D>^l(LM4I361h&DgvV5k(secC(8ad
zz01O{vNC0-r|;deBV`ALRR;MlYBKTNEN3CLYisodX`ZKpvcq|+<H8O^5$6c=HR}`+
zy06WIXU;r2`ddQ5I|;~Cyg~3TK*w$A!(Q#v<BZT+_-y2OdT`<?HS+z({sbA%dSAME
zou;tcK2+8SI&XycY?`b>Ct=pDQ#pU&oPx9`23lR(bi1MFDOEn4cspuv*{aWXkUHr$
zo>sM>IaRNiP(hE?6J{@KIO`m;y6#dbee<r~G8`7F^|*Y|5V2v-)iU<?jCG{bK)&H_
z8I{XjwsJyk%_M)-J87x;Ml)~DsXB@JK=4^*R*Q7%5E~{IZj_7%FQ}dIGfYr`w)Or!
zJvGi#nwirr1q3z`N9c*N0TP6&Y{e5Q>!`Xl<PhZRC*@17Q?PksJ2zLh8?>jaP+j3k
zvFS3wr6%AQ%s;;Qb6HO@E|wa*1Y6H$#<$FP*idUO3!k-*i8XS!Iy6G!=IVpHx^-^2
zDRtx>p<$l11G#-F=Ypr#n8kr-T11Qi-Ph(_$RCp7!|<EJG!{?OWM=p6tW2F>WGzfq
z6B4d-o{a>Y=K3cZ-1ec@9&aoyM{$PPWh!+&cJ;g+kRc614tLs<ZWGT8_vh>RTyI1W
zpf|4UR7hy?Y~a7wq{jBBDEno((t2p%R`+J$Ko{jrDEs|6u(d<GDWh&F^RhS{NL8}X
zWqf9o=kgA^-I%<yrtlqP78BU?j>!%DwQhMDcrCKD?a;>}l=;A_%Gz>UO}pk)$^7g0
z`m<i8TWi!DK|L(#J>42oxQ2*%pivLR#}3DNLRRbIv?eZ^F27?O<tnAQ(oDbG3pAPe
zYE4MyGV63`M^d-k8Q)>S42{Fz-K96<Y3zRcZEad|$0v^7E4$U}EV+rZEJ5acXn@dV
zscDU+xbfx>R#$QOTW9&EC|N2EB*+xs!mCYM;F&r&!c2rQr2=%uuY|g&a2>qY1`@k#
z=_qzKkR6;_FfXT~AU6kyg4r^^9`1`KarX_=Z9SO9(5j4n&{!w4oKh9nkTE^M-fKF=
zQS5iOeq4GpDM{O0VeDssuG&}eI9vK;{Fy<}Om&21S`pR@wIXen5yf-a;U9mIAxZ1~
zabtTPPiBPJ^knKB!XLb@m)SgREKJ#J4av)2J!{rxGU8ZkfBF^yYU=3gs9lFBs7q1j
z>9In*(zm*vvbAx7j3{^p>+lDz*#vh@^Y{Tm;7z|?xIgzoK)NNO^je2r;<a#O7yYSD
zZ`|KjS-Iv=km0{r*K?D#YFPGwt?PNdR3qhKtZaJWWuh<#OJYD2^c;;)rTiF-fY`7d
z%}9Vp^2Jj9-4C7<rD_w^YE#v)4XqA|J%?%s`5%v(b5FU;agrO~pUzjksBms?7SQ;_
z<JdPHBw0}Qf>c;7BV~swWZAj5e)H?<t1ofW>AGJK6n8An*5bcqSZR>m`Qwm~m!G*_
zbVV?YAklcm5vePX;<xmnGo?^{)cTmTtFyB4_#yu#LJC5v<(dc=jhDJT=ClLFDkf21
zKL@Mq*~@(QpU<vj!UT${npm$aop=$5Z#J&}-Y8F&)t(fRWNR~P#WE}M8h=4xn+qs(
zb&F)agyK75Q+ve~8NQss2lt}xhLCcHHz&LJ{G7l+**`93;}AnYyg@-*+*HSBGZ908
z%DQ(-ARwaj<57B<s5Nd6#sY+A*qhn$Xjv+=9r?8{7Rq}}S-ZI<8>O&ydUZ>uD0r85
za+DiIC*|R><2Hb@-%xDAZ7hPoMizMNjet}IoM`Ho%+&s#Vr5L&uW_1X=Pg~<FufAq
z>xDM!ZD!et@omv;By+|ZBA2J`l5`1;6~;WVQKvd|alzWO<~*x?9(M(eMmuxaY?uq!
z+=uba8B*Bwg;6Jt8FPCXbOIY&(;q*6iDwf67yqn>*o_1P2tQGCmw-C^S*;$9e&aH)
zxB?$UozZz`7;CZdbdV;2%h_Z1g%}hKMQ*Xg_bh6sYKf=<k;zRVP8Naf20?e~c)@6w
z%UNn{dV0celPLF!MO|uH$GHSs)&Vwqx*i%kE{R<|T|j<U%G?0^^Ytws_M)nK-&R0c
zPpiOPT!|hMWK)eherE)0@!)dk=E$%b_zUvGU1<cUyQ_p4g0~k2ZVTq;r6}ek1oCxo
z10w($9YheNvii*=5unMgDYtQbt6+xHBgGn>neoH<K1C_t$Vh(7oV>iqHbo(Ik2DUp
z>vG-Kbv+=y1en5qr*48r1qpJSL!B?u@&vrs6w{b&R8p^{ftKd8Jgos%J*_ABv1D!?
zqMOrot!76p=R}8-nZ`@S0@ZoZ)t$^a_I=Yh#Yt=fWMjKhXD}aq5_jvJ9V@?`ig&IR
zg*zM`;?OU{qtgj{;X2&iA#?>LiR};fS$QFq$u2F^ne=y%q7b?B(zWsG*E6c!`Ejgr
znBfSzn%aD($yNx~J!LV6*JOLPWYfv-eHDCZ(yLg7&sKhBmXy2*-&w)>0`O*-#K5!g
z0I^|;_(nF*a+bg0Mx#siXUe4pa)Jlu^n3juhb+paU$U58&iOR%R0on?CJ0_OUS+O`
zd!#Yt8&3bo{$`C#c0+IRNA9xe*z2S)4~uMdf*LB#YoUqQuw{lGV;MVeMAYk}b;qPd
z#3oxufCNc+&&S&ZV#e~x54Uv*UES2{li=mdPi@~r^@K~1Q{7JVX~126VE|$7MqiOJ
z+1lL*ZCzkZJxLV81<VTN5k9b~55FxG;t*2h>9G=DpP$>?El?|JaPVzTwypLCL5n%c
z&z-WLI%fvgZp_9zq3m<ge<u0`yaLnT0eHnJ+$*YO#$Mez6^Er((=^o24HQ>nP>`Ze
zik}_bY(KCY_uVP9ZglAo1$R+&s?oE(>)xrK!dltRF;E_0x?I0HS)g%F)x3Ic`2}Hb
zxJ|7m0C|FT=dg1^vj=uJL34fNG{Cspm`|L^(SX|`8^lBx0t_-&npvkwM(FNTGC{!l
z$9uK0#@DtAFJ!XO&ZW{l({x|yZ#1zp*&RL*LKLJ(A<)p4kwYl1)BJ@kFr~Ja!X_Y@
zi1W;_lIyjXdZm?bf8*sTzj<*{LF8fWk@!tgq2$rcS;U}$*+LCN5})Lnj=N;*Znew4
zF@uH1Q5VtH!4>L+zZnHUz(vdC!+d6!?GFAOQL?_wFSk@Pvd_Itk{E}u{&AX=kt~;y
zPP<)(F2n0fZ-i8V6MX`(8*yMaJjXaj#&~Nz=)nEb{9V)l@{NHzag<x-8p|WF#e@q9
z>oqteJheHOX2-wmo67DTdXAi>9#(YN<s*LhXZ?=u?iSj{ZaMF9z`i+EDBFJqa8G4I
z&R7(I4gYnhID&Tt*qAK&*kiA}@a}MPbL%tLrTwv2Ct-LO5X}KgQ^~!0g<Byz)&2uQ
zRhP2$c&qWVB0;;XhAVf23tOuJr<#D!3u858zV)T)Azgl^N#`qhJLqN)GDQ7plT0XC
zxS*GFAFOaChRqxa!a}Cr^YBh?Z#*-fho~EIVywxF&#_zcV&+G_3hO5w4Ub9gL#dSv
z4<h$^ol1^HmY-1z3OuXnLY9j(UfE9b{(|~vrw0speTOL`*QkfsjplcE0dpOLdKF@+
zo;R=S2MV41wuMEUW<6&3yZBs?(*QHS_U83M&>gUU-vPXGM%vRpYps#I<_+oT?$YN1
z$EfBQ;af+=6oX}Ci1`b7B1f$mISQ2hSA>r`4-}9fFB*itY=7f1>gb(>vDFh=PGuxi
zSk5UYa+xyACvsxk%@o*Dn@(4hMiUUv>_{{v90q+kpHi=yktE%%(Xr-R@$%Mi0fdXq
z(gPdrLthcd>E2X$MZuhrAjxk542rzG=UcmgL*>Dqoe5Kg37-Y-NK<efeym;UmEEeK
z14g0*`;M|-!HN_0w#5_9t+YmDQ!UI<cb&F$txz{d>CaMX-#<8J$>&%kgjPhHdFIs?
z!mJv(`>LCHN~Uw>wnmE_|Ad)>Hh`5ohmxi&Bnx)|%hJm5!9vDNl|Gq#%WG_i=WD~t
z<SM;Gt)bhatnpX7Go4Gz^_98dJgka)L=^|iSkpyvyRQvQdu#8?(!~_&s+|T5LO(Ec
z?UpwU+M?_$E6e;sY#5~;LIPp6>~YJL!IHkqZODNs%kHRwq_kfZSABY?aPocf!*big
z`2rl%Bd`_MNL@Cb)JS<)^1e=qlApski;FNB<@<`D%O6-VP$dH1(gI3Hb~ERChi~ev
z^5FyJ&6O3k!0`@C%5=5#)w$Ti9EAByPGku6ckIYp_o|+0cy6P?K$`*<wgrTD)PhBZ
zSlG&C3Wz$mAnM@Cfk1IvAb==XzNM+EN*kx^79@ARKN5{EY_pG0yZoIgt0pH$K?@1O
za1s0&kYoQ>?9wRL)L;YaE5F#<sa$}R5M3bU%ZQ-q2W{uOmyUf?FkQ2h{dnn#fjFWN
zed`2nXP1bl7kdh7S7Og!*XIY~wCB$4jj}>|$W3mm8?Rqxzo5(!^@Qpf-VuF{5DIJh
zsd7Hvu=T^~PZDI{OAoZzv-3dWU#?{pAAz8|)r;REYbl0#hhFon1vXym`;`5Qr>Rop
z7r&=;){FQ+%BoEWA$$y`;(JY8#=p(FnW8g%UstPsqs9H@Nafy?sa6*sp<WZUxLp(m
zyt=}<@}wWFRB@ZKN+K_tt9lJ{-*swDRzOf}wBo&~Y0K0YNfd_29NQeiQ7Ed{_7M^q
ziVkp~A*k2niGa&3tydS=A@EHVFN9QKm;wT{p)PO2+FJ2kY1i}EG@;qXHU-sTbM(#a
zmo0R=$$jLkl9HE8NS-O|vZ4GZUtlItokC2{rYpH{s24e2coFa8d#zG0R>65_prYOf
zX1e*2QiW`@b%9D`-Hfi`%5Sf(I|m&-M$2`+HMpA2;e`IR*2;H^s9!(M!gGvMnh6TT
zS<Kbh8I4CpN3w<W9U9q;T7LA~t$Al9z;~n7AhCCz{lazN57VmuYuK(av4)t7c<NJo
z6FQBOvQyNd8c$~bsUEiBSg_K=|FzO2Eo3!a3a@O!QdFq;?@>f%T!b6YY!KUL==P%j
zhVB&DTXrz*NsWCEIZ1WHa&?R{zS=ddoZ?+2POzUEVDAEaXQjB9JLpseVQ+?EWW^WS
zRApIz=QU>(mU1;?m1gy}9<iY)g}*yM@@aCJ8(lF4z+l5HL|~;#l3oBN!~smK17h_*
z!$c8`0+Xm`&wi~ZHW0&fI<wSa3!tu}1siIvlOMa=RKG_)h#3l~D7ZGNVB4H(^F^uN
z7VR*S^%>w>n5pws)@zqZ9v9g}aQ}Q*7}Xpm(?B-Ihf^JAZ9F!gcY4^S-gAI{sg78$
z-ef_==K1G+k$}~=<2_|^j&DHrxLiVgSRBiNljBA<ov-(qWzR#eo~$kFCkVy9k;M#C
zn!*=Z?^!)EPT5dMW4^AG9>sN6J%i0lsDH!SBcBi*9rTIt!$5Cx+HCz=zxKFA)?Mho
z)|{|~%yuz-zYw-9c#jj%P>cO(+!lK_FZIcSfMfU7H!vEN-}QQ7f^@6Waq0jI<~@e%
zEG-?4V&nvlIUk>hTEKh}bY&z+SCm?Sn6X*D);oDXF%`+kz#9AMYKMB}Z1+=s<A{V4
z5=7u^kGk#qwt+d?{kl(OWIcwX1Mu@Od@9WrxELZh_#6dSgfbqkkZ1t3zAa$N$M_Dc
z^y6rPDph(2++O4UX3$OdW;aK7I$U2GVP?6_1ZMiae%bU*kULkS9}26l+?G_4UENdc
zu(Egi<3F}EQ+8_BEY5A+6GsvhwDJv_*n1_+Rd(rqSsY{_3JE}h<Q>FQs|8M178?Y~
zBs3OCb>0ot3|{NjTl_fAF_G^f%I|#YZY}w)9#ukkaMH8z(X3UJgQ+S53`i)+S>lI7
z?Q5^>Z7u5kpgL6bXVb|gZb*<^s0sKI@_9+vTl?WYP_0=X?g@+VJC`)y)I{;@qc2|U
z&GvT&qAk`Ex0rkGel~SqvB|f{@A9O=+;eSLBXOH|ONq8pCmYhSxoRt0yMY!Mpf678
zXTA$XxyEhLDuE;jUQG*BeH}eIm6oJPJee7ILE6xSp!?~K_fy`_ic`6s6k11WA;}FM
zfIcQooPTEtBKzvxsi%>8?mBgj>e_(t<u$8UUmJdlJ&E?wQnKJ3Udu>BjvNjm3T}4<
zSmvj{U1wPk1;a2~_R$O}0Td$(Vgu503@0ttv0MJ@!sd+54P(P*<3$=-4bCS%t~gg7
zPRM+)-=~1|G&?m_m?_8X*C<J?j9v+JS6tBM{xZ1H-r+p!c9G4r&Yn(Li$vX5c64pQ
zPFgutiOn*LJzf{?H>EVW<#B3s;ukQC!?IgOXNu&e^@`I3h-^l!d9FwqhuF|G;}G}b
zYM14VsA=RswE!V9=FYU0)Ej{0gY?GGcj7xjsvCGI+iS{iEM|8f^*eLHaZJalE)Ex2
zL!3kHmM9E`C5cbnqj}K`2KdqMtGO}L4j@6~<%u4GQ7(PMt4u0or!!UA!GfP{dYz`s
z!kN7$GHt2(j8~LQXY#}~-}2oP3>JL@GU2*)k5>%_)%(}ZU(UouAsR)7KU=91*zFu@
zCeVZK!Z~jD+L*&coa=xVH&RG7KiG9|>DK0*8}N)w9oTw9By^_+W#0}ayN9--4Df^1
zagz)YWeW}H4Y$$<FrUBs*wzt#bteUNsFv<Hj`?G+yG9!{ipaOP^R2a;O6CpJEa}nw
zCf8WlWNOg}>r}jJ6<C-IraK?*yH@3gPszgeitY1dT(++}hJTs<wfWfFV_~`9=Yw|v
zGq4mdY#Utu>J3}D_MPy@z<c2aSUig~0$b%{mTS835QO=)Ll!$IHMC=KyAg){3bHr%
z)cc;~rBa(MP=GW(1wmK3T4DGqVy56I*KUk7!Q+c%`ru%|_}&~HZE;D-FH^@#IWm{;
z@2zvEo+lurK6^90BGYn=FwY~b5G9@FnG$Id_pB<)_rYFFnGQEufo{11xyNZ`JgY#Z
zH4`0$d(O{K_jbJQKb_-y$!YnVg52f<WU#NV&oJ9r@0HoDm10$9x=5AvwDKj7HABpg
z@aqPrEHJ|U#r49;YmX-$$rYAEFK1U;a2BHVCW@Tgwu09)09q55Vm;}--wR}nK7z+0
z2;NWO3yzrgKnFNOI+`3Jq953tr>(Y6kkEKR9=6_J*z_|`l&Z~YLm#zow8*~xRL&hU
z9;Ro?V$f{$boUbacA~rXVWBi%t^Df6Ve7j5N>5l~Pv_w^|Be=SQDocMB&7*Ojf6~K
z9_(6B$jf=Ar*CZiw_O`kA>L{BCBOCLRxpsg1DN&HDT_VF!~hP_n}*wD@2=YQbgK?G
zo4d$_E%7+TW|^A{O$r(Bog9WytL*til&Pd~fu}3?DSN7gG=;X9>)mv<N$herQk-cC
zi!Fm;&-A2STAG_*ivd6YN;s6gx)^8s=6pwaxb`h1WGqJY)lRsIWnpz2YPM8<8+O_B
zU=x4|PD_bi1G3|7#u-6}@-eHE^Dv_&ov>emtQx*fCggOMp=72vkX>P`D6EAWi~MGf
zz1OrZs9bMu4_z>g)~3`a`3I$ca?_Es?kEUM^E+(fv-KSk&&%ZJv#RS-4t(F%G56@f
zDl^@(UMiNoI*Ukk)-kxTSS7<ZJn)5Pj(KKuT9FzFYVhyNwX7h_cgiQNZmM_nOgoZo
zoxllMvd#JL)F;gc^L~dj|AW1^jEk~s`$m~zkdlxP=@bPiK|w;m07ObjsR5LfQo05P
zR1iVBTR=LL8fnA;LAs<ty1Rzj>m0rA>)HF=&-;7#m;LGa=s3)ItRw$Nt#fS)<oL4K
z-9>f)NgbppaN$LKR&=&Ok&uZSmDs<W<+fF}HtkElo1&1+xBeCt&?>+`oGEop(~zH$
z_evvsxq|sI$C_Zg(c0D6?NP;(e%Gd`W9^r>OLA;7j!In0mGw$wkq1w-Tb^)`sV;Qs
z2n?>Ob!TOA-=#Z^tFv?drM8ne|J-iv#6jgWL8dOg(!22N!35dxlb%i~fPH8C_+mv|
zHjhBnCzke|J&16!M&M&?KX+vOxrWxep-;}OYXe+|ISCGtod5{>AY*!wqI|CKGRYc}
zF0VcEJK62YFoTW?eXe>t0l}H{EBTwI*!0J`brrI_cig)xtlm4>>$A7rUpft1k76F^
zF>Wv6&@Ib*&{8q2WTkkos=O$SoS&DuO(xQP|M(Hy&AV7=Nr@}05HDp>UoPHycerJF
z66ZVP;~lR-bt2ivut<EjRPUWyuZ^}S52fKx5ATT2WoEq3v0NgLVo4%e3{BcBS%){`
z`Wh@WBj4BwF)NolC~}B<^PlMzV^YF-of~K7H+DWe$<(mQDDyl;ebJ-8d4P(q=Xw5U
zSEiaQBBN^ie)YInVrwJj#j(lGW@eKp-{mN^02X#;#-T(E$wczz452gjN^@)EIFOp0
z{<x|5LeSn!#`~S|O12e(=V(!2on<_)&Qm{!c&irFeU%vSw!s<jwkWb%m<=YS6GxBm
zO@gc%s(Yekg~5L%F%lt^fRFvK*!I*KQ9|F)8k36)$!1Ea-ng1eI)O6TMB$@a`4sON
z+rg3@?e-se9^DTE?$43iq8>Wo)axL9Taj*KH|$)AV^IHOYQ9h$$*Y;o$!p*xO=Y<y
z>bptnc?Co2d*m=xe7C&umc=lpqpnXcF)y_ytA7wO^Q<sLWqsS+N{F76o?=y7L!~iw
z);aDE%M|MJe4#E=v}R+lz9NgKHr(wdeDzXCJz`x7te0|tB18)4xoy=T#N$DXPWsTz
z11|!nb9@zl3&180fTSE@zQ!QXkZRZJ+5)&F)s6rx0Xc94X&ggC;`&DH=9k`uofwy2
z6SZb@%vfyJkt!SyvF@dDB0<W-bD3zZ`TU^4Mu!oKYmF}<wuhjJa9vuz;@<DQAA&8d
zks<HjW@>!--f#CjT=8PHv$YqV{des3l20}oKlL>0lkYPIxRwMh-=?$rP*-vr8{%2i
zK6F}rXe?gf7#g=$T=<Klqy0c7s{na!)xvl<#6dGQMLo&LQU9=c3Y$CL{6!@Do0t8g
zfTGQP<Y7R4_AdSMaet}0wpP4`qr{#(un@7;s*uI$15gVq>N7<`ifRV{$xQ!1{uuFu
z`^An=M5Y1&t2o~A0N(r>u%!3CavBIPfL}TY<xGjK0P~a*gYj`30r!bL#w$)wS3f!I
zZB?(Rl(Kp+;c9v560`H`V%`NVJn%O<*|I+$pA1<jR6ag5Y#b-m(ow>QrIMc}wkkN`
zslDwzczY?5JR5H7x+*LivfM3_)pim&7B${q7;*qr<457zqa>nTcScEezss!fWN*JF
z8$ce7&TVe8mKNMepgI3TkW)44DCbZ{%|OaX^|W5mxk}6A`x?2lwjNFFBN+|M_R7g@
zkMmHw<Pi<e&sGYb({>}DsOqfKI3)+{?mfT|h4lpTB^*PtzM1Ml3<-f4a^Y9TDqskr
z;{%cDEuib?DHq@{#4<R3slA*M;s|00g_bGV0w`%I=>+eBKg5IIq7u4_7DM$L&`X|V
zc(gh-G~6`ZOU54LMg36`XOgdcvs>>J?uUL?`7)kZXIIW7w9u9$C<*|8sjxkTxTcF;
z*Y|{B5l8RHt1{m7A_Govw{ZNmaa$vC4&ITyFN?Iozo#&T-u5RwNQb8#Lt$fnDvXVo
z29@1;y`e|a%pRHL)nn-;Z%YpMbr!Gr_?$j0L6yc#u62xlQaz*Wb#rd@>;%+`*=uuV
z>B0r><SQ*BK$yNGP@gloF!m-$&DB#so@-VHhc@?SdW#3Qf{sWXJWF%|Xhz36To|PQ
z1@({5q0$6eRu-XrcA|E#%QRltR=%5rmWHPJRW|D-GREFj^O*n#31U28Z+B*>i%nKd
zvLBgzw3urTyW+jyxcfMfmNux$*1Ae^R-AZ(dE{NbRK-q3;Zr{&J|n&+FKKr3B2dYC
zI#4y3p<02}t*BIX@m{;Qv?NF&p;smP)CPqbijAB;zPPn?ouRuZ(x7To)nRX&N6~en
z+AO=aV015HCBmYb@>;Jp5Oc-*4b#V}DLz1^>bz&<fIUmmfr#%;>;QQ*ag+BN2!nIr
z0}_!J;7oTxCOZd*e+GROx&n{VAqL3n5#wY`#6<^$oNXslZFl@VGia#Jm4g1d&Fi(6
zRh+`RX5VtVb(2vny2GCZRFN9(WunDqJBnOC&TX$=n%f(@rFTB|rG0Cj9eZ_pjk334
zwL}f)D9=r7^Lof=BkJd)dU;J_{*y^AG{!b^cC*VjK;KZsu=Kt^YFk@*0I(zPg?K<R
z-=a2V@u9XB&v4C7L0>V+Ty9v3ho*Kw=J2m7Or*1eOYq{z9hMQ)2j_Wj)?hNvjsH@Q
zg(@Ncuk~0;8HK+=)jytnLJ6F>j_*p)ZMIyXFRCGIP$%SZpRNcbbI=6ofx8987KLRa
z>2=mNLu9<-oYqFV1bnZqBq8vKCg?TB%D6o~S4cKTAG?%?3~r3lnVB8TW}=jT*+*^L
zBOQl(?^4hrhac#&+umpJ_o?|<a=U_g&mcJq95JKX{>tf?J8OQi&Pm)wI@F%K@;LaI
z_wIhvWcC}9`?(6B@JAYQqYXQ_$UoD4noQRX7UVw3Jr7jAxs6zA!W?hb9?fA=OS;99
z=Rt0)mZ~=|M2(99PB~1DkS`yBWM5aw$Vt`UcqjfUWiyl)k9_LB0w>}ETF{j1EBgVe
z!{v_^RLBEeuz*9y#)JPLP$r#FIhj>BSk7mS5XdpxGT)qweCm2;OJgM&I{3lD*&M^x
zJDz95!;`B5>cgM9VgmLqaBx;sl;?*7v_SGhMSS{(mF`FbgG84d3es<ddh5eAJ5ZuJ
zcr5O+RA}4xX^TRp4?74f+q8qYc*xMZ#ia{#in5qAIM^Cs&6e^%V-Ac}Bp+FsQiv<H
zR2GpOL*;c3AfujAf%x_}c*rb2rcksilo^#;m?Gdjz^8|qS#-fb)0J-GH=)}CVjXVa
z6%zs~Vr*gR4P|&^hpAo{$B&Pcx}9wYssos2zYKTe5lBMTt8{S1*z`p#A$cUsR^sJc
z9f-~zq4~8tPq+Pg?QCV39lZ8qO2ZZ0wW7Vs9ddIThFA)RevB0kD_NPC1m6(_N;`h&
zI;=A!##fHj#?+3kuFRRCzQx3CfG!`I-SESdu{l}boH5u+3oK3L@j${eyDxsX<F7Ar
zEm_ptKe}>QcPiii^yZUkODoMsG^=Ytv`W))9p5bq?IpVJ0NZA9?le1(v+V`-o3o%}
zL-YxR{tiQXj65fLF6P=4TNnzc^Pt#!1q5XdRHe!${BLcWAHCQAGIS<3-Z4VJve?ii
zjQwzVwlxCBh^?7iHtIdri^mClBkC1(!}%c#n4lxGVP^i9ZywxpVLg4rCn#82H;|X<
z>*c!sQ9a6t(Y%zpL4!GGxZgidtDtE2VT2LeHv)qG6{8HF^UM)JC*Dw$%W`R1jJ|q&
zo^D!coSWZtF2**~HPZa5j0XGHleIcFUV|JKl{at9u&=2LMMe6H!;hseB$h{-w6HfR
zEkz_49s@U`M}D;4R<NU@-~rG~PX>9_&qkboH_U62f`YXx2x^r}EB%&;^^pj3CPWFC
zp%6UG+J21(-vNIywJpo`2xyC+mc6z<R8JCtfjS0=3)Ao{f_0>qqu<Zu`pXM`{^Vmy
zE~6%rMlmCbc!2eSY6J(HX&LXWGrmuL<L4c|K;C!Jqvq!HgTYEU#wCSVZy8-=oLH%9
z&%<QT<`>lz6?OJv=-80ez5JNgX0<Uzw|k)bo$ReO++|cF$SP=P$(&{9ez^6nN#97#
z2%|?H7gZZJqVpvrrv3f(lfk-L+bZj9lpQe5neTnQ$YiMKB2qr|6Quf-e<M~Eiwd6F
zK#PzdLLI^?pac#63nZ&Ge2=?n;b*{EMbhpmUtI!+Em6H6fHP}pDj^{DuS)hUU=Aum
zdjj<JTSP~z_j7KSD?O*e1HPhF<FgCiTGO47NYRUAUx=P&R|z~xy-y;%_d%n;a2-J4
zVXC}{)1%$Uk(;Rd-5-<BtZR-BoNSj%iOgZ*>KtqFSwKJR1Swbi1~28*I;oumN4k<i
zTm|G#eV~jbJErRjJD7;5D#<ejRFcXk>s|!6odRiQ(I_KeI^a8%jX&8Epdv^Cn=&CJ
zAK5FABc_nrDJd|jznVK4e~C%JR<FFX<%WJFj__E1R4q3C!}#Teaj6}C%j{4leif3S
z#z>=wb-E|pt3ir%n_t$aGHqWZd`JPqCd*_?nY^p#%W4_KqK~9#jlf!%jC;CQ1>ZqY
zbe@U?Op2DvK;xkR2+$nBFIPrsY4z)B{9~(!rTxXxpIK|d%Q^B!cX|ap7eDh`mVVFE
zQUFN?Z@^q6F3ITFD!B@g-arjZGUdaZ*8>oKFPY;Z9Jql-T9i2j<G};LS)U`>DEYuw
zKIe($7eYQc9(XvwELjKW$ga}c!J3-=WFvRA-8NDcloX$T6jb^Xfn&4%YNVdUowe*?
zulb}B9o_9YQc6shciWOTIEy9ME}8+QuP+I!d3tW)=zFB|_gZ@lYNlD>X5m_X*jU=0
zQ89)Rw6`U_k8epM^~B0BZd>xY>J>a@54G@~olIuyt<2gFv3aVvU7vaG!ua!oxE_No
znW*<iua8Vy2Z-u`?siH*v_DPDdn*Yj)Xu3tzi<Yew-ey06mx<f-A-W8k2u1Pa$OdD
zKsbLkP&N#hCP5{(;O1+{03SK`D}y8i1gZa+pIz-~phv6tY-0~f-|i9&4^(xfn4$0v
z!aQfqCy*LBF&;WKzG`Q3kBB<ok61q+Z5uV(R3AaZg{{boN318%(zf>AQF}c|uol<R
z6yRE*v<q6hP<AM6^}{dt4QAqX4_66=QQqijH}hqzOYIt8(iNW*?37b=TJ0>L>Y89!
zYmXz8BX-PiTx9}sNDBn8K!qfH#tPs@;mf1!6MqUq^dvCET_C;l|E=^uHlM_d!^1yw
z?IlERVqASHvrg^$*(K}uBKU?4w6lYZ<dZJ*Qf9MQU#V!`wU<eCiklzKGpB0Mz(2AN
zWp}X5UhRM6C{`2+qmEqjiw(j<I^8Scpov(u=O*XLnkpKq;I(1{VX4OX7k^J(<e|k;
zlAT!DfB|6mEP;c&2QE}p8gTjF0bITYbSqnty+n!(wBXLXmqZxQ0DI>Uy#r>HK=KDe
z_(6JUNo!Gi9|DC?qXP#7h$iA4U2Z_(Q6#%=;b)n()sq8<UtRs|kYUtpHWf%1LNTDb
z&ctf}a53g1?@MiZl8a2d9!;N=@!dc%xfvwt_A9d4XQaG0?;hCbjt;lvrOt4m_u4);
z-D~oHTTsq&u;97b*YbWxc+a|D{iJ_S&7nz9ra5@WnyTVvo>K9;7bk_Yr=fGAA<GFs
zs&mC2=2Z+hoFl9?=LXpr)HgKm=kF^Zo_J5ya?+tzJs}*AF*a!l(J!}TXCB5x!#r1c
z4=IKehRW>XH{)!?;;wt9NSzMp3(tiflvr-452`<8=L}$Gi%s$|uLww&Aq3jMl=hqm
z)br?!38m&-m;%v(;4|d{2FG?ykTXEQ12WVJ3-Ih&%>hL`z;^K+71yjT$(q_5_E|^A
zhd-RF+`JoZ34gK$Z?gX}G+F|(nfsx2+SPzFc^Q{>C1lALJHIVDj(y)L>G(Q8B_Kiv
ztEqOSzue?9{GCCK0L(HO+o+q<G8|ziGTxiqYUB6x(JNK=_qkT2dN}Mlrl7i9XS;tm
zIHD^!itUlc0Qwx3to7D#f{)iWn+*aKngSqzbYXH{dWDyANIQ6p{$e(jrD8=PHJk2e
zw%rw=2wvSV)FdH3(T5p}w6?FTZhseWmYKuVz~}wW@q-+_{sKeBld2CN9wdlbEt}p5
zc@Cw7Fopo&&mF<h+gEN-!Ki_0$3MD0n*=~~jWU5a3(oU(0D6Ar7DeI#1#?_XTve7~
z_ISDdbcD|<Zpc?<<?H#=2k#_ki-NqFjtAWi9KKO4>3dc@y;Qs=DV3!H;FK-nwWzfK
zRyy#~+j+sU*wEPi(Qj;YFe&H!UpxU{R~z@fE*s4(@)-3!Z|P`_1nJU!iP(N`BC5Qi
z7!bAcdip~=tI9KLy#X29`GK(_4miVZeREY5l3OyMYHit3To_hku*khSY=x(`lLdFv
zIX?DFQuF9bC>LJN(V#v<00s}JWsZ~usus^!tIBv|Lulw|XS_nrvfaiDEd_>UKnqlo
zSL_A*L?!se4y6W!6eaisCUFO<!Vp~mD5E1zJ@8*HbS#Y;6|L4MIzKvfMTYh1w>+tO
z__>6hQ$fGFO3piHh<~K)p+ro~o1p{#lkm5o^0rlp@^1-qNiJBO`{R?#+ubTb@%C2A
z;GFDWz2RKkMz5;Z-tlgv7v^at4H!!dt4N+cvULqJm-}{gg(YsIbVO>UI&Ljjv`0S4
z@)e1F{BH7y%+#Edl7c5bh(YuZxahLyam9fkg2$JkfXfL)%RtK+q`{7kl~YbMlp|cP
za$00lc>Cr!<7!{qY+It)Dl6$ssbGCBwVy_HM=qs-0Bdpm&09rv3#!(ykI$@L{IWZ)
zlW@(7ueQoHx+vM&HG@^mJHlY2c(|Zq+~=Aq!?nvlX13=&|7$xmC4c0sKY9)bOiB<&
z{h!bQ*%>qnDfQ&O92hNAuN3b2eFQ&1^(v;{c3Iq*_?hc4)oZ^LjM^0)ZgrMi4)0GY
zp>0^w9J*J>;G+Cfz%ASBz!y|z+03OYNhWfiP11b{iQs;<u)_DjxaZ8E$gKzKtj8|V
zq?l25DcABlW1>?j(VKaBWj0neprt4!vN+w(M?6t^vF!$gVh$j+E;dOAGoFt1MP0C(
z{n6>)7Ny=_<SUozLw_jQ*VrECbco)Zd27MavhbDFZJXYG;-f|5lWV;E(SqOWdFA9@
z5jTNB%O3UKVR1+a>FIrCp}f;{P}d0!MafV5Fr);m29GZFJ(TbeWddIv8*wl342UPo
z=xmh(2jOrrLROCIavR1~&%s&Y!GqdZsu0I-yVcD`*yRh<FN5rEI3DYPY$KB8ZK8jD
zGE~7`iuV0tnkvd%FxlJg>8b2?(L4oW$E~5LYc$Tozp|c7j$FLb+<QHLx>Ic|rsYA7
zY9y;a>!rp1s>O{ji!-1k<LaQUBe8=7o^J1Yr_~wYX9i(v*(AbrkQ2TMRAyDTTAT_d
zC01_z{r)9%_K=R2)(^!wB!@=U$x{`V#(cHFp__s_q4{<-cgEZ-9)CJCbXmUCA?@Yb
z{SIK=Jd)f)khKrJJ`a*LIq-A3Uo)>D&H{6?kPVM}+z(h|mK;S68Za<~7Z<Rrq{q0j
z3y4gr=2fmsyPJz?FADDv)}B`V9Qz<(qQlG}8sW3@q1tAk;C&egmev@Xa2{*z<^ZMh
z&DL8!vGx?w{Uou4gX#juWA5)%Wm3s*s(aXxEoi;G-F@7at)W`2pTWI((8*btjO~RP
zewU^lyCtys36x!?qgYUd#R{lR)&27y2R(8|;Y~L6K}p@EYRSVJ^4}jJk=%<FrJ+Bu
z7bibFWj11RirOiCB9qD%87tV{PqUyP0#27e`*mvJ1`a(v@45i_%=JH&I&l^-?-1fk
z?UZVVr{=uzdueJKJG@rv;raVy*sR0wG|FLfu^j1s5L0GP?0Fz#AC0->ePPun^`=X>
z!dmV1g-2lGCx+dE46rmfCIpOpgFdZPJ1N5NA_(!1cFfDK0~NkO4dqJ+%6m|?E2;F$
z-vH(;(L;RrHsYjB-=9L~R#m<CVSGl>ER#z~PFjKoXqACnWjiaw+es!zt>=8nlP&FT
zjFn?<K@oZJ&Y@PT83<)Ns>iE_XIegvRuE$j%vN~mv6K2$g3$+NAaH=@Fe}TSx-5kn
zA_f{%`2~p=|3?Ei$k+rEBJsuuQ<Y=tLk?oE4<6c8tCIh6O_hiouc<UZ`dIjR9e(K$
zwixp|u<f_WSJ^8{{!%^5?7II>*mPnnBDJ{a>|@}B3PX++rH?lmb;~_e_5&8rm)!|C
z`+;G#t~GV~^&N_car5?=Y^0Zp`4JdgJ+RH%*)lm?yF$ho^|D?XwSBd_+QM}&9AB6N
zR)eNVFylxI0?aey{VYZK3`Eit$@buMXzH(a@v{w%f!hF*Wb52qOnm#-#V<K!Jyoaz
zsE59;cG<s$WI<%LQo?WtK$~82`$f_6K$b(y5?{x%W7<vzhORx@vF_y8LX?;L$aZ+f
zdqtCnZnlRgA#L-5;)AqT0Wv`64@!$vb!KqxS;IC20&_n>dBeixIHD~D#B^t8ss_*P
z_}J;9Q)z8a!^7WCx=ZzA<9^hO+SQDBblia^q@zFqPtD$a_g(eka<J>z`+??5k@b0d
z`*-}w!zGLAg}s9Gob!jUEPEqfZ<)%*)1tQC`9dn%K5_#9T_)h19EqAth%WE~UFmGR
zx)KbchS}Gq&p41M4XR8Qs=m0wP`t*tvbo2p-C@f)Ll6JzdC66AT_ar+XIISuq{CX#
zi@V7(Vk(EKED7S*&2v`YCbW1Sz75Ng`_{iFcsfbyZnqk&oHd>QM4u+M86bJ0;)Oy2
z$LSh->5V?@BV}kNIf=Flj>9+4$)V}`&k&03r~=ao^+jNx27r}IoT@ikhr(6c_UC>~
zy=Rk=G2gT}whi{$*x9R~Yx$<D@y{%P)2w1s%edf;D_O?`v4&SzQ71k-yH__S@TV($
zknHw#dv!-s*x@DHM4N2s;mAyrTF7WX_oP7!kWu6ya^asAi*f@#_=F`*gbM=A=&Rs+
z!8}?wWZ$!No#vgAzq&oSrWJ5o9SpR+d%9zP`3MC7W3O0Gd<;$Rh;&6wUd!VB(FB(x
z?~KOkDLEGFim2A&CGFOT5|!@S=Nf~#a!YZkf}=HxF79hH%Gp!ZQ`84oyKuf{pm$9_
zDETKK#rS{D&+RQe6+>quvr#f;2_p_2FRo(Tn5B%>+}A@G7nP5)t$JqmOHUY1P7W-R
zxI9-YBAr%$AsM2gUVibUmcbgVdQRuYO=Wpui)d(R^~Uup9=`{@c5S=L!&?W~L!QaC
zy}_*P5o||mq3Fs`Sq#|JcvCgHQbRyGa~vuidn$cWu;W->ip-FIKUs`f=u#o6Kz39M
zuAH6&(=7Gh3n*cQKz*#V$hlw0wgdg1Ns5DA19HqZc^F59W8t5Eom@*GF7Z(MvAA?*
zg)ydu?oMdLJ-46jj}^R*LXJLoR3>MY-D-efua~}_0_mT`?c8-jNHM;Hs)$J4OJX{p
zvBy>NgzF5^G5721YL}F66HLyYd`xTK(>fGO^?W2zVITYKw-HKA4r|lH$rPrv?dHBL
z=`d=$rzgX3+7j7a?${)uB6vDixVih4;>-BBMX2F)m#4i7$#uIUuFBs=7+smulZ@xi
zcD74(4np!=Xu4pD())-qDB)7!i6i<?<Lw%l49M2K6-SOcqc$MBj8~!dPXWV173Fxn
zr|A9LnODAqfmMArs8B6^(N^8ly>L)$v?|KFUH=c1tQ3BTOMVP^$UqGr4?YA{N{YC2
z<0)Y^1wvVUicWZfh4^yQpC#?XJ|8Z}ubOCk(k?R!Zz7hKn%1gSc86@|B#yyIqVn>h
zFJj$b##{&id~lOE`oAj%|KD=J%9I7PD6{F^Y`YTc){5@hhtvRN#L~_r0^jevIk@?4
zGj-g%Wrt>-74`(emKwY|+<!d&mG>r;5Vn*A)-n{$b%mM(9ZUPYOyW6J!?67X(xJ=U
z;@(=yXb;1cy62ZQ`Hu<Dmew6NtPBJ#N}k-p6XY}>AP0k~4A=45(P&8d-T%)B{z(Hv
zY(v6O<9CV+#8r|dG(*H8)~y01aU36c3ly{R9h0QI6JD`d(5$dib3@#j=;-Lpp-&tA
zdzy)A-)q?j2nZ^;t1D{^yyK-cV)*pgm16m0OEw*rKJn}GPW!0U8lzP3I?m@-yalSQ
z&%o`E{_DC6NPJBp&mrb_8N|QWS{7|Mr|AL|e=vHp4&3qvqRHCQ_p`vW{GZGKbPRq3
znDejWE>Ts8H9$oMr)~%C91owkzY3PxM|%*CfN+_DGAocenkEJApIbkY6KxTsI4loT
zj-QPBPD3i7=tx&b`_<n@_bp(4bYJsI&4GOIVAbG%m+!lex8pFup7WD4|Jgc>X{E;v
znZ~xh=@bKcoK_5|M_EVy_z40+`rPs(P;weKZ;Rnnl^$S7Q_3daTvZAks3skYTRP>p
zuid+)7YU?(KGx+e@r0EQ757W9(bi2o@#;1^u~tClPQfo*<T3x(MKD>9CYhL-n^E%i
zuA82jQAB$8`s5dH^$!1he9U+{e$s7x{nk05>*(wh*ZkXBR3{i-F2;@;smm9iB;(jC
zK$3%pymhP1y3y~*FJT~1-{^{7G5r*hQywW&bwkBEM}N&HeaxiEz^#g|$H7b)S8ghb
z@`wDp1vtK!cIVmHCvyj4Ctx}m=|9f|br3G_rh$=jLnFqPWo#Kx8C3x=toT&hhj~lz
zU?TEIKf=CpS6JL;zw;$^%KBus!-kfao{Y7o9&Zzqr~!6+m4`o3EVi*RVR%4WTl<H2
ztbtiMDBOD=mx=?hVe_<`?jNN8`V7%ND8r-_xBPf)1A=cUv787b8C;qmlD+H#$J5f%
znv_Y>m_*T@fub)eo(E3!Zx=`sngnplp}}>5YM?F<ip=3EKHRPHL1Dcb7;Uxcv1qxP
zZDj16<?`8c?pqU>i}}!wCpPjtwPt<j)B2u%g{45T%yAl+rsti!TQPpfwsZ&pTCtC)
z0?1rcRIs=4e4_xL)Tz4gU`D_LZE1<?2CD$e7JX;w4<&4r_rO19qefN#6h=(5{-Z2Y
z-+nGb745Bb;ov~<)%i=Hc~zfa`UI$F$-6its|zTP3~UM1%1g%|MPF}F(J|sxVA5ku
z3p$$kByz$bbBfj9Z`BBuQ7_upUs<uvu)sL<J*9V=f8LJ)jeH%+Q9ZC#R><*_5S9uI
ze9PTemj(VD5PRdI-(_QUJhhvG`C_a2eYWG31h$lFI{ly&OY}(qOzzR44hNh0Ev8PL
zQ6(IW{FZX*FYx-U0~Qz8p~-b*QZz)bH*n)~m^bDXDPVaOTLk@x`7G2xCW_+)zmdJP
zQ=Z#y*O7>qGW`4T;rX(s<{<mwy_9q;W*xCIR1p(cEX^+`_py3{`T1t$=5WE_q)QW%
z%j+ZSpK`=>yWb_LXYv@=K6uBx#X}yg*vq(0(J%a}OFsMnV*=BSctPzE=hoF5wDIhh
z7!P=f((KH7Jo;q?vw!{qIg_ufGM=D}QEx!bj^R=6I}X+|b0NL}j)`3K4_HltezTS$
z@T-jAZX*qaGYSy+U(c4EYO;?#I+EhKd>Kr`9VHC-ALyU9wUXAK2OAv<D=W(lckt9g
z^{#^Uf{;E?$-$l0-Q|@t>*>Yg3ep(q;hr=ZoX@~Ve1B{AxOb-<mZ_&44q&O-Jqtpq
z>(!+vqVje7SWoM8F$4ENrt6y%ae+o&eQ(qKo`pAkaUJD)u{$=3)kB@x`g|$1RZeG&
z($N6aeq@f0f`U&RZ71x%-a2fZe?lH<>$wwlhV1@6lW0Kp1u%B{yZbtvs23Dpnsoo$
zE+#H;L6u8wC<y#T%_TR%*zMr?_YmC;^*}9-biqc!>cDl-7;u$QjgADbi%!THBCrSP
zs^as9;XAc~tlr#ohO~@DOQkAm3w;^+HUi@uJy{)L?_0Hdb!`B-`P#+dz5z^$l$(E}
z?t-*~ECdC@ZkH+}oT%;{aNq7Fck5H<FEl6bw8H)*fFZgm9}RkzO#kRNT(en5H?6u_
zO>}GO!;<mcNK|f8D4Ysn&zCI<&VRwA7m|F$PpPoDK>Y{%KY-Qv`6V!~Ee^v3vCi*e
zi_cXO@MF@hABu$xa-z}1;7H0j5uT30r}!?C18d9ZIV9==F_3nrqAbC>a#dab57oI!
zsCpp*Aan0os9Fl)x_;B*>fapVyX$ufiu;)H?P}-P-B<g>mJA=nsxq6NG=9@gv_Y(E
zT3|*G!=!e8FFAj&o13+sPCGtR8Ojs}VkkjoCm%H|8L>z@k(-)JabmVq&r8(lu>0&s
zzFu|@RU9dl?d1qq^5%QgS)e}f65Gk-_pE^R;XrPpUr=v~&V98|`*U?z)o}sIq*kjx
zSiS9I6dlwPdHW|<{lFPE@JW+l+!eKdUYr-L6J`{)zFXRbd8c&@*7Y+Ik42Z!u_z4>
zus({Q0#0eF=Joj;L3Hdg_V}w#e{0p|Q#M@j0M6A}#-)}blQnz3EX%-%Fh`1>KN=4y
z?-fEmw)TO#aCAOI#v#+dbI?eAck5WKXFAhSpkj#mh8y~5uHUC$+-_uF(cySy@5gr)
zXBq2<O$Mi-K{Ky4+RMNDU_VQmVUk^PdOBq6YZZ|0TchiH0W0;zBdDIfo%ZKSa<8Ng
zj`BB~dj!7)qfTuHew-YxMmnIbJ>v#IHJ(v{9W8qX?lN}wHCW+PIn6KQ-xqjsP8?`&
z4do+bdE)e5t(X~}TI{GwjnHFdACfqx2GW4FJZqN*eV1YU?q^sgpYwrQ5CA4}<9N`I
z$u6t?eUwn&*^xg;AgH$T662gbeQ!MkFXhrquE=GW)Xl{PK41o?kQo?FIcZzY)jIAF
zI&}@K>C~2LW);}QwF{L&V<eP92FBSjW)4&AE5TKDqDdp=3n1xwJ5=u5>rWUI!xue1
z*B%L=km)e;W~Neh$Ru7NW2p0zSaVCC_1#+k<^J+gn(4Xft2S&+0BSUslv*NcXz%TE
z`z2`Yi@NFC-(oxns*}@5jXAkU;Vx+<uK?}6d5<}yI4!z5tPtis#H48@%lR}gER3{{
zs&pgS2-(8!$~NJpBs|>?n0K+eb9l(Oc0W-}CbJy}0EkRgj0a5)TSXO^9xv^dZb)9V
zu%)tc`O0qz{B=V1**2gEe>dx95AnNey?qY0#%FTHZN1hS;W#CEN}#&%Q8|S1)7ysw
z1HBz70O)wCmfe<B0C7!1`;|ERgro0Wm{j@ny$fs-FX>L~b7Ow%S|~;?8leQfY=TYA
z25ilWX{%`H{ghrCpCT90hpg%HYj)|{`8})LCtVg7k)&~y4M9?CdL5PeU)I9w({xVr
z4A=Wdo`ur1>&{>2nZnin_GQyb6fRkLx5-`iNiKG&4H|+8ZYBtA>RsKGxQaC@CL)?R
z*RZuX^27i^Ndzu*sF~;;TD?!bayxMmd%U(*5JPWGvO<1K66d8~5LDPA*<D$Nx<4&h
zzxZL840@e9mGozQ3joS!<-L>)pf$5E*d&qQ?oyQkhGls5)N|p{iP3F07qrz2bQ7G{
z3zPGipu1|ToyT5=@$?<9<b=C{lz+z?v?8n~ZvC*|(DKV<^@Hdf+b+7(Yg+fm;x5ZM
z(wTkpSH+pIA5U7NYhvh)dlJi?f?l3)0XmB_jF<xAKW6A!8VEqFgYxGVCPoW5vP7Vi
zBfX+e3QRG+p(9u2N2U2T$HSNQSS<viva`g(;;n;zKH@5cjGgis7x>-mUH(`ZTMfs<
z`;kS(%=|adgy$Majk|P9>_H-OkQK#;fR!Q^J*hvFOv%-Tr@4IA@I`;?Nr~Q-8^53U
zJ3d0EyuCn9L?7YB_rS1IQ(M#KN)Tq5ml>O^x#j!Rbg#Nb%9^ldez^Vnxc1K_3LTUI
zOU!HudKD)1?HsFDs5iBY2b~mcqlQt3`_@e>VQ@!;-UrP*F&hWns7c)6m1&x-4R{$P
zF_Am9)rz5C{0EjjVvR~U9ky3pHzp-VUG8zC!S3|eahX{FN&Zg1*!>jkVm3`Lp88Tf
z2}%h|I}djHeK5%Sdh9ow11m%7_|n|)f-A)?PpX2Ukr1}9C%#!1-McfKGM0Zi)iTwp
zsXZw!cKkV=2<H4C9&n)nTj7tKVuI1+@E^d@yo7V;FDkfvCMCqrvpy*)p7nA5f*=0G
z`4Ow5Y(odU>vQEVS;G~6v%Y}5aQ*f-BoogMb!Aei3iwqUdhw9^2hK~3`{8q=>xl>Y
z<6lGTM^(~=ZeGGIk;|?lsE!}XrC^@~=M131375)EG^_9W<h;99d%_7Ck)RK}r{DJG
zoNR+FFe<yCB^hKM9?QTQb|8!%>Yk_~j=WJTU%6gG`&wWstJDY*<ok#MeApMn@`%6a
zru^-nMtc{DCUf661>jLVzZ+_Gfv!ic!PyrpJ+JI`E>1_x%L4T}VfsbiK80rO$+JFZ
z(=*$JXdYNi^OnVtQJ2CvT$-vX=;b=qN)nywH+$5&!P0O~!Yjyw5)(W|*4vVed?Q@o
zn5@1xFHmxrjOBcLw|abGmmwSvj5>H9LtexHfXvqN5AMgq?rR2y#g4~zNZa_UkSLVd
zhz15U$NyK?L5b&!9lQIWHPowt)t!@l7T+gu*-xjM5&1Hh;spQM=7+l-1nGi^t#m)v
zNecbGQ#sT=!|CUz)A)V+ltxE{;GW_LVgUEhMbJ5{w;j#XWs`>pI;t+N^y@bacrl+I
z>2F={_)MR~$Mgm$#l9@tZn?>__2-06!(O{)D%vU$<2^|&7DxhK>((t)AS;KOc?opQ
z84H7>1fff=p(I~F07oiI4v8QcU)ab6+!hdPX7&&UQt7|2hUUXotXH@(8f#s*Pnn_@
zxwBPBs(ij7sD*I;-sdFBPIcK=OH?<h3=w%QfsL*kl4*DA$T6V|=+U(@DT27DJFrN&
zTUW>Xs~x4!*`=1qjtep9P#<#c*K_Nplb|Lc+hFW_w|M5a(Nb=#XTN}}Xrrq{9RO9p
zL?(<hvOq@W4~@BGJ`hmr+4Y<=sINAl$Mw2P1SzAImX=!&N)`T>&9L{fC1U3yUcopp
zpMuDVUJjE~uUYCEbI<7e#s%HVRb2SC?4h&uHg4@A$rx~}D?C*DuNIhqmu`}OL&I#U
z=5%G~F2=VQl~T0uYTa-`%^eSnQ#Zf^Ww>&V?*y%rySX3itcEewij;&DQxF5sOuAlt
zLkVE*SfII;2-^vvK$p)!K5J6Irf>IMmmCJ#V%!xk3>G%EA!YI9w@V-eo8;UV+Rk-C
z-2nM-#=Jy`hYfZ_g4nmO=Gl<jgr_ccGK|dqr0HVT@(m&Ap&tT$oG0f?`oEcMuUJqc
zwm$9H@alT65<&wc8}?&OUd$w~l+wpKF=I939#{6AQeF%O_ET7hS_9o>Bjp;V7k?Zv
zUv4se-K@>la_fuAR=S-e<B7y)>!y9_T9-=@zn2`tHh`7>feBBtuPB$30y9-L6DNm~
z2vxS`fq}8y#OuP)=I%F}bFV>ty6FIzPzvcU;z_ysc*=vd^{*MyT^KNS>-A9?50*;w
zbwt=@iS|kQsM4>4_Dcj7^j5_4EDb^KEN_QC7qyd@KE(Khj*!%~Z$0l7DBC#BdL{n^
z7s5D!RZ{248jh?sKYchU`n;M`p)Pg4Jl#2%n*)j-Rt~(vWPqrTAYQZ5iIFNPU3r;3
zc4gdyzhlSq{5mw=O!@2~#A^WuhMP1nsf^a9X?)NG5uCV$*Qy{(=(|5*u)Vt<E=IC^
zq;J7*gUPt#9{<7!5pkreU6Q=6j*@Al@_D#GC(wV+2FK!#j~_9)fpumoZHx!u3P)Sc
zC3)0g6uWEq`9SWcM429=F_zg=^ApJtuPH_@N^w&S^}Gy$+=q&)To&-z(tulYQ@_nk
ztafT$+X0bi9Fgm?Y&io1EDspPxnNS9t=}`x5dlYoyGDy2vFyLzYf63GXLPhz{)i@0
zwxJ2$MfW=QWcVe8Hp+lEX4V%?46C`@kr)VH&%M22f`qTJB$=Is(rwGjlsklsJI7b$
zOH$>uqZVHfVRTgSLP5GZ$20}t=Q_|-g5ueQqF?QhQDx`f_XLcWeF95G8d>ud_4WQ!
zyVV1Mr2BU|@O0DaY=ex%Pk&-v22CuI4YXg?oy##|>mtkygu6OdsHv4?u#6Gy-)e}$
zLvC+be;sXS-2LIV?w!L7R1k=xS($BA=BLo)bq<&mxCi4{`x&%b5~c?R7r-{(*OP}H
z>3glzwLa}Tk`_?$)VK)ET3p;#=wB^z2|ZUNmcbqdRUQU=GX=qqJxZ&iL~b*ZhWiqY
zn<=Xj5}ERaExzc{l<9DTJE76$aBi?qcoUQ5fiIJiGH2GNDxdWNuw@$j-RL3}>QUG-
zK6owAs7qZ?=eY)OOU;xKXBCtzLze^i8u~h&qHF7{or=a+@_Hccf2IKG((1hg84?({
z`=^=24-91rek!+^A+o#@HvfBkb+62j2Grc<;5#cX>1v$}WghLgyFW^4g+>l()bi#A
zHDT_tf%MRi0XOW6J;D33x+HHHa}N@Vz#PXGVA3hTXIu8Rjvs}K#vR|?PX(?ST?h9D
zxtxw}G1v|2$!Ga_#@7jm?tO-wKD1oSHfS`tG2mVl<NKNNo)VjGL&$`oUhp+hgNCno
zDIA!?n%1oklb0^{Ku0s6`cO?;vRX_Hc`U~T9e)#?SHsQD1}M#8N7<PIpor*CvOj|z
zdf+{f4Qidv4rlJNSpyv?kylgz;v$7rvu+OC#s-OZUxMGF{cvcKJL+=F*>v=T8Wig2
zauJxEjdAfGZy+dCj94DK-IRYYNDq1!;104mVq5UBuQH(DES+xoNu@W1%dzfF;1!h`
zC<X>T=f!RHff;7Irf?!Revl|FkqAkHWRi-_*di!Up2+f|?7C{cgAhF(filH}T+Xue
z9w>4@CcXfgS0Iew!>Wsqmn*i6iHQTC@Szs#814=j=mRy^Fco%%KUbYAM_ugN5})I6
z8WriUTDyv2a*I+xPrR0(d5~-w@FwkqAPZ7Qi;)KNF-GoI;?a3Z3ktQC@=wHqwT91u
zDUR+e6)1^LO7KjgOxg5-S6Ox1(BlNd>c8?a{4*(nDJGo4jt<P2JqI<i2QV2!Bf_$m
zR)UGpC3Q^bzpF|F)Zk7wWdb66Q{LtcqF;1EJNTN1S28ccp?--tX6hc!75WhEFW|$W
zAbzx=|AQB34>XJ<q0>}Qc@7$!{&^md@_}<Ad&ydI>HS+Ga0EEwCn%X%*sa8g149BL
zg%rsj?hST^$ts3zvrTgUv|wb<6D*(j`j5KkCh5r=;_RS{_$$=!Lz97Lh=y6J7o$g)
z9I96)pqrT}*R>l~ol8eu#)|yAdcYH6i!Q93>x3Gn(&fh7|2zr!I!YmMSIao#W{vLJ
z3+kwg5D5Y#y?Z8T9#$GkU~Y52i_e0YG+9}2P=c~`-AAGWYr3+Tp!_7;KnasEFk-yD
za&Qf-Hz48MX!H|6OUS|vh~+p>0(7Vfo^@tDqV_rKDeAUc(hly?E{NYUO!sz8d{=J)
z2Lp=RNo(NJI~YP3V42uJq)_M#_GX;3MIVre0jwSr1TcOJg-Liw4`i9V>?Me&S}!X9
zatpBRf*@E366{Lc>l){LX>nxr0}ef1hhXvW8Qa4N)j3L_(x63nvMB`iK@rfJE?X<O
zAkLs(GHXf}I><dp?2Nj26x_g$@SXhcvME7!gisXwms3QSq2RLfYKcQ8Uoe=?(AlMF
z$`xWYQ4D%if8y?t90qepcZ3Y0g1ELL-n<WnntTAQC&kYzw3~N4E4UV*;n_|#$Uk9o
zm&7^YZXW%wblHs|u`pj8`u9L=#u^Qoc*qj5wW$}bKLCeTZBl5iLDeQWM;M<m9czOU
zO|!;biPe`1z$YPPy-~W{puhkc8Xb4MUii;qN7Ei()dDADBZYg{)V0Hv*s1_Zd@Wph
zFBNiJRwlaV|5Z0Jcoq;rje9EJYdS|8=W?;mU<jnLrNzpoyrJloS|lC0c&K~yv5F5D
zB@Nr<pkenDXwGVU$lTh@px#0$0=Iy72jS&`vVC1Q*TV(vxWwVXp`|AAKU{`*1u4ZM
z2}rZ^*V+!}I}NAn$C)J+PU8CRYx7yLn<YNQKi|uW`yOc0kSXQA*E-bduHECM_kI-m
zOoX;Bh<qac12s;ZM=?-3UI}7#thGt$A#jSz*sD-vWMhPTSJt)r%TZ$Yop<561thvk
zqqRnAJUqN-8@qKm;qs(WI+`tFJ?8q>mwB6G>uyR)>S>H6keS(_CSQlV_(yYLh$Ajz
zJv>3_XLQFqf*P^SnV5vu2!glAnjHOp5Pv30WDf-xXBxuu&8kmUmJsVyuhyNaXu<M5
z+)d!LN(juWA|3!`!wX9J9+83X24Xi%K?BmaY&f@((P0^vu2KJpT&vmfcj5f;x>3n{
zOS38^(&Wrw-_eCYyFgd4XHK9(!q#9&*2C%Pk|iautzS2Y{<0DLj6J-HaDBPXy?AKU
zM@f8AvOYPj08+8_d$Oo|&nDx3zpS2EU~1%q5MzcBy+61H01s5*NFRLcG2k6ov-0a=
z0^cTjjm{kyfbpn(Z#5{hDK9Xn9$Qp+wWdiF3U0TY=LdN_?@K!OGP^NNi88BI%kF=7
zu>N?faRgXSxrimjKDf-aRx7Sk=jNkdA04oRQ)jo!LKA864(mB~5vi&61RGSN5!xyb
zV+{c?1aN*`$NwD|hhYQ823K$SNu2l3EPy3pYcR#c^W#;#@H>z^Qc2?6P%Ay^rYPN~
zdy?g($n86?*7ZcKx!M@6M@9TjF9=lxBlQ!?X<kaN3PvAs=Yuy65s&ANRk_-5sxVx4
z>b(k+Qm|oy=3D+)*@PHW*v&ohKpsmS)jzm*;<_gvFH`+~yyc4rP64E7=0_agCpkWU
z@*@b8Pd_9VRRfBFWlsWs$O)~V0e_g;X(bT3w0G^ZCDe{WC^vjvT0%!(&X{R8D!JWX
zFdp@gl?hZ1#)!)-hwe#WtY_T7Ntt?{v;9K`8l8$zCYjLnt-iNzXT7hAI*qw{QN2PD
zMe`N^j~OfzUE?c^@fp!WmL3{L03g-wDzWT`GkceIZx6_8MnEuh`5sr8<zBVK!1}uf
z`=Rrnyyuv1ga7lp)cN5W*XbwcAW$^>oUd+vCFC@Ty>#pbh<_tAzuvhH1p5O_b&iz~
zSKPueXJ1Zs052uEK1BzU6218J;pxeieS5|CT_t8+=)P01x`{Y(w%6T1UltLoGpAi9
zvHFJ|J8$ZFT0nIU@C;3Zl!6UAl5+^?575l8o}%KFf<V!a@GAoak#emA4Zwo@iJWYD
z4D_zsCv4adPnap+BmCFfdQ%F4$upZhN!mIMnd;Sab(yFa*KyQYaz7irnb_#_uK2ba
z_a9EAnAhKi78AT62N)pN_Ds>mwSEeF^NuAsgr?5Y39Vp<p4oL|)#nySc}Whn>GNiK
zwVnr_!CjQ@j69z2Bi}|pFCK95$(e6*-33;;*PcFzpydGbZYG)3f1DPi6Fty&@vHGq
z6t5bq$6w{$aX9|=Rz;9t3wj1+=Yxr%YO#CX$U52vQo@a1eygbyy7;OA%)5&a!uevv
znFX{@8tPS*`k9-E=fZ(Muz<x2K)=jN6z76k!FPy3%YKJfd3#4~G|vCI7qmsu;$Nm@
zk<5F*Xx;H;u;a}FZsB5UeFKa2pxx^5<)Vr*KWqyZ`8yv?Bvkh+-SWP*vSP7?@!v=X
zJyC3+ox;+$5}eWfu6d#iMJ-U8H0~R2e_H8{$+*jiJ0_4)E(npY=dlOp%Dcd>bqaFF
zSoB{4Scm}u(eq?S%_~nEZ`I_0tD5#e=y!r&<pXk_aD?r^e1~=fJm_kgS6#zL!HXk7
zD_!lSDeH-TF{`F!eI9R(qn(ykn?MzQee(SA*LY~G-8c?lxi2KMjZT%`uCRFa|E~;*
zww$ZpXI|&Pq-vdx?eAq}#h~4B%52H^Y$thX5wX5lO$PcgJ4JDS*V6vChyQ@jGKYp{
zCwIYU?!W%R5yp%Uv78pg<wSREKYhLoG}VT_&1NZqGTxD<nLDKCm*6_1A5}?69=kT=
z3!<~R7tDx4^*bF%_0+r{UI0A<_(hP4JeUD5^(-3KfI78+>&E$LtAPO;kZpkV1@d1&
zK`c4~wg2V0G@Xz*T8B1|WL#Q+CJzi;Y;8r&K;R!qoI^phxwX|;JwZE7cQ2)i+1A_p
zhAG`?eKQjfiUz++!`AoYhrqu=UdK;o3#)A-hHe5zNrp2@@KnvS|C^_R_D?-1u<5O!
zUAN5IypTLG0T4STUNuBxiVMM@DZ$!ih5uT_%XN+|;1}iIKX$Ft5P4ncjB+m53@{SW
zRLrTGEq~!bc6EI?a7;M{P=W`00q_95K@F2~Z5>ot6vxX}f&!v3<RHkh%ojnMK(?tP
zw4~yOL`wqD(1M5E&|O1+f$<Nx1XA|m@Mn2c{pyNEpMYB*Xst;T$4i2*q<utV(XuOO
zod*vd*yE}3vs2Xos#I<b!a5jT<w5A1fI=U#ZAt&?z*-Uo?l)Zsl&kA1ss)DF!P)?`
zjLc>!Cf6E_W;~sVgN7;oJXKbkz^MlPo9w6{CaxV98-yu^R`C6B6AOJImFwGQuWd_5
z;iZi2n79D`utJzG*GyEqamQ1XW&!f!ME;PBKj)C--%ay|9+Ym51=REubN~D=;T#{v
zESR=j=W9f(UOnD7BEK5bn&_F<6ow<jn{L0Ue&7)%jlWrtX#9<+AXsvW#s|fIPf-Bq
z`cu1roNqvK*07emGJ_orp@K3v7$ORKvL+eWj&V9VdR_Imw=cx`uUn%)fa8^H!8~rb
z0i5tc#Gf51q8bx(9inAltu&g{)YM3PmbAOI)F%FTZs(4cR`km}>&C;y@~;i{mpnvt
z0dIkig(e`MZ8!)ygHZ>A`Z<s&L*mAV7%UnV$HN)s44u0L%dsE?B?<J@-G5hF!0FJe
z5DCA@ykwGe3!nwS^#HULE9Em%z3};gbBpzT0Vj*&i|a*|P-2w`B~}g4o-lH8NepBo
z*uIzakUdn904G|Q&$)HGK?Qo2gX3|qnHun6H!tZy|Nlpx`v$U2q?gAU_6`)AHX#nZ
zKqw!g!HNw`>V<c094|Cg0-{J~<Ba7HI0sRT9dr&>=(ktCP<`M+bf53s*vcrQ`wSBY
za~!dbkIz7C#_^g`=oa+jlJ*l#YsQYPGi@pp<{`Mp`a`zbTWC&7vUyQP?O319UEls@
zE5GFqZ&u_0#fYDFF@rF0!9sTcx%AEs)-hnD5_rRWiD0M{GJnx{Xr~<M@$(GK9s$JI
z%t$O>2u{W_hl|I5kH(QcML=Ue;rJA))Dz8f7!MI5Kp&gjt?Fo1hypMb8Vx$_@Bh*A
z$=fyk`&B>~xK0tshul2+(RKJoxP-U&-M8Do0c9Jh#QhhmBZRDO<4hglCHS8m3N9L;
z|F}GNUki#k4xj`eIM8Um)3H;nyYsjL5@{?v%h1Tv>f0|sN!rw$Le(#!P(2{DB(gtp
zz!?|hYyVQeLlU<O1K|Shc61-|-v0o5EV$88yEcv=h;QOOq{~P>urE>t?I*sc^5}T+
zkJ<erU;*NJH`q7EeF553P&5I=ssHDPdDNaVK#!$|dTW%O76FdOtI*XuKzM8c5V><<
zensbm<RJ$X{F$`#F6f}={NjTk%^wl7RiZ=a9@O}D&_jznY-vG|mO@E#cIz7Xf2j&3
z7X&Z4UV6#|$qu2>P`0#WtR1MuNqGfgMDINrz=nU6_75}M*wS#a^L)l3gd19wy$$P;
zW@7`$A=JnWqHh40wgbP7_NhUAB2)kYzwE{XX+^Ad@LRM1B)iNYvaLVR>mOb~a(MlR
z9Z3neCsh&s!{z@`ia*-+KS}|N>3@{se>}zicnT;s{Qnz16j>>4etl3}_1S!%=|pz_
z%}jc!!qV-;9rqjV$3g%#>!uQdVh|W{geFG!NU|}~VA338FeX)d%Mu!JgkDb+SyYUI
zwR2E5`=LWpS<Oszox;sPfWhq)|BYLCFp)nH)=Q-0qB-=3`wts3DTvJ5Q!W+P9-4Fu
zJK2oOtBQNPWNoEEMgl|v+R&a7A3)Ey`5ge^Ourd^mE#7r&zw)-fugf6rO*Oag0%HL
zDZ+~#ifVP}ok0#zy)Q`PgDOye;$=hppLhv|UYKyH6u1u~Qkrdl`m`=mu>P2b=k}>|
zt?AcJRB33YVyG%o1_bp?H)VjBgTXwxg=VFLv@UM6-T`?YhqB6Oz+?54WVv6V0VwhI
zo`&Jy$)W_+1|D2N?oZtNSCL%^^eWmTS8r~;H_MmOt;*D!Z6p6tRo>@9k<AR42ksvM
zOh8_cyfw@JD9TCY#qNmindLf-mg|W_4Y>Q!va}OHDhaR*NE~|y>}_zwZ0B=|K&6!t
zhzCPt6yL$!$q?QY28i4dj2M=^DMkLn0X*NAf54OUC2JJCaA^8RU^bo7X)+0y8VXCd
zmy<(zuo-#ZedQGi&+y#~g0U7o$QL9tWsYwO*^9uXp4x>u)^->}fw}wRL^o)KX7K&4
zTMx8O3D)xHS7>q>E;heAyk9R}o1|{(lZ2C6ncx*_Fn>b^vMj4dG!)s>&@u{gm1K7>
zUn$dd+%K4L|7hyI`)(IM{oWG?Lc^+=)@ZToVF-K4Ufuo}{=O2E+U7kYotAwJuh|!m
z(y<`R-WzImJ|Esq+Z!&^rE0hIoRYd6t4O;#r&RL{3`j5viy=lJK+K6DyC7H&bfs6m
z?2qsvP)vmWqX4XE>W)dOJ;|I0Au@$GOx6YJT3haeMW=DTQVV~kkl8j9a7$pI$Cmz0
z?c%(cHZyG9bD7O~4tjUZa02IJ+C;O@tj@J76<hL24?!cdA&P=%%==U$9xUPQ2+S@=
zhD2$%B_32v<1}b%Wuc)Fhv)!edTnhyfZI-*De4p(AAX>RDW|5-_aWEtDTp{7(N3uj
zWa!)?m!xYp5)f4M%zDQgjzJcNxi)d1eu*oSY}<e>COw=}oxW;&KYGN|dUesh`;bLE
zi^5<Jno=wh;=ADM0Ri&YehZgyGt>V|UImgG3RMKYzvg5$wQBLGZCiU(e*VRytPMdK
ztwF0Ixx`ax4c=F;u4}|g7v5j3y6S50VNqpV{aK=VML3zFi4%13sDZ_t?ylk^L-K5n
z_Dg5_UsAzep1&W3B=Ea;PENDsFnyi(jq!xqrE^3t1!`Y$gyFqYTzkV-NAmibZ)ajd
z&^0UKu$N(Yxfq)RpOo4`$x=_(wf3Lwt0^Lfi5*R9ziTzx52UHh+r>MQw)#C;TZ~w+
zb7_67l`TYr79EDxw@iPEzo?N3Lt7~CUk3a4kHCv3Q{+D9-Ff&z%15yw-_ZD818Ik-
zB^+6Ypco&&;yP}wK!vQOUbk7?BU%gjt;}nD=P=<OXd%5r2Tmz`ZI*(8H(CY}UxaMv
zkE5_eqXWq<ORO_K<GkSgBcwe}xvD6`cve!S$a8Mo%KhM=>}PUvbhP%{AEJ_6W_{rs
zenazT9i}Ms_~@0m8>_Jus)2&KSLbUnA`V^ghTr9ztRE*290wO(Ca``AV?0A7P<^7R
zTjsWYs=d5<Y-`p-HW28<hdUG9g1%o1Anh%9l~?|`g7?{En@1O6#V(&ux_ru;&oI(e
z1a9f*+rIrY|MLmhaSSf_8E;ti?&#MY9`|EfPifQqSC-G=V}1m>@w=a8i{B}IGySz5
z$5+1H5Kri=ed0PUTra|bL99eGQ|UV_No_m>BCd2%>Ky7_dl=-IAKzhh=ddb%>dxr7
z%NLD*@1F}7RzoACwjSRO{Ez2GFt8av#(zV8bY_Ie-)Iy4v9M%kS1Icib-0t>^hl(V
zplel+fa0LF@}#nR=y7dDa+AsCVDGt=>mS>fyiFt=1Q3l>LMXKH;#P4>FWu>NOXsPL
zxZu%KI^nV&U2R@I*2s41>0@7nR3yheU65Fx2hy<#)I_z=Pai13k*LQSUePFWn`mYi
zhoL?(<%RIMtSknN3#3JQN$70tr`mS<u3ugTCwB6#FspKml~IT|wEvj()*Q$Y`qjJE
zbvYvkIk3I!tT~!X2k#?_yWy>=g1S*53f?!@_dU84m#N}1!AIP<Q+l=9r8Cfpou{r`
z)V9#RQ9Ck2=hDhp9CONWI>9+?y6uY13h#;ET&*itU~%sZ@g+!<NU!DYcONbOj-kp{
zU<*U%;v+=NQS5s+w?BE^w7>Pu!}e4A<%2cWl?TsdhFys^Pk{EWJj^~KV(TROzuJ4x
zuqL;zT~xY=3W9>zKxrZZ3Ib9D6a?u~1nDSEy7ZoamEIwOG(kk9_Z~o{H)+yC4Uyh!
zNI3HeYc1dNed~SCx6ifz?0qeNc;y0;JadkAk9&+cCRpmZ54KAJ1Vy$|6qBo6$1DjE
zsdOS6bnJz9N4D^T*kXyvABNm(t`qD7!=GTG>_=twGoM*vD{_wN9VcofRlFck5R}Im
z0Jci~RjmB)1!>UU$S1l_0ZaQV(7!A+z<PN~#d1D(V?<b6cvUEn>q=0<4|XaB6Et<{
zMgWi0ys4GNDGQ6>=9Jf{t!)Qo{SdP{uVoBXCW}b;ugt*y3M+l5j4>w>t~;X!mh6)R
z;i7ZCICm9T=zV=Gf7?$96DHnzBWGC&QLT9DhK-LA{>AIHNh`Y+s$Ar(|J886R+Pk`
zwx+J>t8|<Vin9qzLg^+b8(#n_8L2?`t)i-8`ww;hX8x_4L@E+xJtZ+EqnU$WZTT&=
zU$BnP+A}E6hM6K9&FVzwYU>N!RMC6ICH}0DecQ61&EI*Si=Ir`%C@<w;@p<Rl?4ke
z*+QP7RjZDcZ(de9btBu`CV&bpS!+T>*BGj}W%;up+^0V)JRNnI|3WH2M$9gl{Hqqj
z?o74sluJM892$dXx&utcw&ufr0WWN$sPN!zWpNX=t3m*Ki$!C;?Oya=zo98QnxT8G
zQP+c9sY1j^FVo970ZB6E&d=>S_LIx_q-}KZ&ydzU^i!N65-uRbr6L{|Q8TJrVZJla
zGh|vmaZ?+1KRwkzG(uqFVX1H-zeBU|>sb5xe&jNBb;`?Yso>4stsDBfovUAaILoIR
zF3s}j?8+b-2Cc^E2lt2l^<KPRO3FRRVq|pR!AFU0KHiNbAt+?$#me>)#ioP(FOS~j
z(nNkNlvm@4T|F>RXtn9zJRW!Tadx|3v~j_~6Ptp$rguffqJkMw)8ubaZfx9etYdB)
zE@e$JAjvbryPfXY#*w<JT`JSPAZ<S58SB{H`U|lFo;e#^9!yV$?1#Gw`bq`)s7uJ%
zjzQXOaDupw6Oe&xz{c*2e@9+B3mI}E@8l1ctw<lCr2#>0Qxh>)8=Lb6F8Fan3!Dkq
zY|CNf8{IELT<J{nx5NX7&9+CnxZVcaMcZY)|7ACCab8b?)N{66BS&eG%{OaE(3ou?
znbIviag2wh|5stpViBc2-+E!2Ppbvi6OmNX6e6MA^5erz|H?fUWH0`utlC<wck~!m
zfO3(+SjTk3H6lgM%LApTBi*@*616Dbox3DF_fe1$dCxF5(L2Sd=2eVnjn@(hd?`Bp
zKpV+x)DJ#$8y+8ZSt?=6L;MZDxyf`Fh5FivI!P#X_p+*9PN%t<$#zn4)49}19J((Q
zy>#Fxe`(JuH>(h)w<Vgj%+g^kGu?6CbGp61H8(l0xBI5>OsP%x5UT%j%96*WlA)uw
zD!ldI>)30Orf>sKtXfpRn01lT&7~n&4Z^#JYWnK>p(_r1X}vpJR0x}2j6a^Go3j|6
z5vo-azrfepFdY;)<an{+rA=Is%LJo7A8yL`;*7^gTFvq=iAE46{CRg@)QkvA;BT<d
zsmz`W>ve6vn1G{vo)*&gJvYCGN3Wv6+eYbZuXM4)CZ{;;n-Z<V_f;EQ!all1)JjIP
zL)^l?*+eMU-`QZhhwuATgl>WPra%HwpqgpV_pe+$3p~T&2Epx#o~2D4m7;P<Xlo~*
zi8M^N1MbXdTafuK+?<>X_Jin!=Os5qv$i;HDtbZN<_zbW{5K2vts$pEl%MpyfI@x$
ztx}3JfHJ2cd%-^Ljjz{>-J7hL{x+K=S5fN4C+&A1tsy}BporBZJ3O<gBvmN#R4Xr{
zG5{-_1@AQBD^D`zXOv6tiD;fniXG_$7(vzOTKrEHVw5n#r73_**v8a`?f{d}ZSz!V
zr(*4A2cCLpLpR*sINsH$#>PzPyXe$T{aQUHO~U0^X8U8#V|VFRcy_&Ic|PPUkKLbT
zd$ws@%@4=0Rz-8Q?z?LXukY~0ZaZ60;Z~O76(}S+G5m!EUyou^`GQj$da5ms7pq*U
zxg#XNCZx!?Gm*L_6fc@_N66|)ni5tvC!v?cu4Z<B8)a7`YhNzzCBb495`b6~-F4ED
zS*l3WVvnE9N=f!UmwrhdcII{Uwp}|L-ApNVc`>?XM2XlSZHFA^{bS4d$GknL_G|D$
zs<T-<dHe}gm=8nARSeX!aTv<;)M~$zYlIOwiL7K-;l$4DHPH>3q_)R+9pkwY*|{7e
zWSD7Nt6VdOd@hgfSn?urJ~9!t8t7;k#$dNpN2+or0{Jo9ii4qp`C&dwg_cQ{6^&Fb
z8Z*Q%-oDX!FWK;w%I#wBAFm`_^^3mYqf#kc9(yWftyd%&tQS!YnHKj^s32PrN)-GZ
z62%HdbjY}}GMigBRm~|@3NwPw<=<ClZaPv&rfzF_yFpFrZBrR;+tN*VPTPlhnHofD
z{(E{<M5HNKXjq9<%%4}|P}nq~N28uz8pl)BLQNFZwg!zEv@Kpwu#RifXh=}H#f5$J
zm)lhu9v`CTE%wG#%I(76iei!bUOG9k(+l(Iqj3^79X>+%<Ze0jC&i3hudhEKMx7L8
zb1dw}2r0#jZsl2WdfflB7vQVMv$Y{Ib&-$l#)azUMiLW3X%YdIzrLL83Z=qX_py#A
zINMid6$O-TRm9AuZu2{!IF$>)ndi_+(kl5)uZ0g$BhKof5Ts<5TX`o%k1^}vE!Ou^
zdi(3TTZIMFw{VK<=kh!x)8^Mamx=EV_2=(9oIvq@O9ahFDG*}4tQo5Q8h~Dd2VwEh
zNVPw5TU#Q!^AGQm|B$OK#EM_Y+GvdLW}mnD1s(^kgYa50nB`rrzINe8$)ge!syHX(
z!P5L5ye6@u{b=cyhyO@Feo0(h-(YJph0SQwBaNJ{qLQstFVLlg`aFH44H6MW-~Y;T
zD8sYYH}F0}uG!8imjRK62yVVCTe4~Bx`oj$$7~^UJ1}h>0Ue1Ll)S!fO&ENuS;O{V
zQ&8TIr!}>3?4pE=z3r^VD7yjb@;8L5$ZWA#l45HU#j=?+B3Bze_1#C=OFv*coPx^y
z(nj24jB`!bm|RnxEPcp5ubrfzsvSjn<hz7u?o#EZPr9s*rfqiU2$GjWr>SRtRl9Uv
zypv+sKHrTz$DyyoDbe(ybwX1oq<P-E8D@5D=OXh?tJFbM>A||H6j$NC!?)>VLtN1Z
z(`Vo739!50?}5D%Xob^f27<4q7Gq!bzTLj{MIBE|Y?UjZwl%Uz0d(oP>yBJ)kM_)`
zk;yhoElZg#uV}cZL1k8cOk`AAYv-J-@@}@quwrMrO?9Y5Qxo5}rv<1tt9aJW`}VG*
zBP;+7=bbob_C8;&X`gl6!t;OuTimiG%1*U+%D_{YTOFqLuFUP1s!c)tPi3aJ9ZUG1
z=PlePW{X%OuB4XAHF=z8J!Y1fwD(xvcGr6%$SLjmt!726fEg^N-Mgvmrw~O4J;N;`
zyS{LHVcfm+n~8I0cE>zD92YmYw%%n`KG73IUB7(ZI--g3nZ!57#xp1?81_yJ+qe?;
zDobuv7(Mql`mv?VbnLf^N$tf;?#yiPD(CSaSe)W#x!1ckLvI;{G1FfMiMU2N_EAYb
zV_U_E38Z51hJ|3s0b=$Lrq}wi9a_~#DBb$bJCOgWlSh1y9(_09bBxbNnb?5Twt?@_
zyXThgvnqXiguR!V^+{;E_InK|XmhI43X}P<%kbG~&*f`+Pp2s=S<wu}@x1-T>yK;V
zIymy9&nxa&+G@f?VfnwZ+;_86`PmutRBunA7KJvN=%}gn<hSRB;|r>{U1WGf3cWCP
ztC9`zyana4dqpG?HM5dF>}TfGDk?1aQrQJ&gt8F^scym_QsKkw^LEo^R<g*SW7Y1E
zdm7u-a%yt;mhipy?ecOon7<no$c~(aQKmoRQ#G%{c8)ju8(0_FBE|*=lg88KVmX)|
zdHf_(vL2b%r7Yj9NF1pp)^#G=KS`r!Kc!#rTy=`v23ff|Q_vpsUPg%dW$$$Y&Q)^H
zd}smMQq&-AW9uJbua2|-MlVd10FIPi#zy#<-!;Jj1#u2APpz3~x#Yf-@fF_KOdrlE
z<hsR?;Ej8v86sMhcjD2AZQoWT52cP+;LaezsmU)oVaq5ZH2bSHzveM*dtw82?(RN;
zyw&t(^Pw3YRM838!o=&sjN+2bV&PFH?Ce|EUR{#suvg}*3ob=Hw*7+m39Lx#-W)Pr
z(Hha$??lT~-0s<Z>h;!p>%_3J3tBtjx<5#(5?t-V?`*puuUBnUE$K}ft$xBWNepJP
zl{(acyeM(A*Q!P~gS3hvQMuV!>oj}MY}SiCUt=@5(%K(sPgD4Z(FvPU^^|W<S`Rbb
z$N|2nWB2y@Hp00zu#->SDh+<VZy#lc)ych2Y#=asAy9G?Qm#jaTpcteK)Id-I*9+J
zTtr-Ciq?{3jGzItvt_tb{X?iksy?zjrzgW}%O8R|<KRLy*Obbd2p*n?tHlaz?PsXj
z<DKtm*$S3V+NA486d<@hEc?r<Ibb(QYHGKJPGw_wky{`AN6T|ZDTV_?->oYYon}fU
z;Y8^5T&~cwgY{@*>3JQ<FI0gHZ%~D9E~l!G(eJ8IVM2^)rVXvbk5e7YUnQ87n=cBT
z)*;XDa;!vrcRv^n(tGYPMVldpBYBb@M+JP*JBJ=7)4H!;>+<6m)TDJH<OXfh7fq|}
za<oHR8Qp^kF^-W@{urPr-+;Jn?&dS6Cq}z6cif;Jz0W>Ao8=->sSh5eu|qf`&s$@p
z!+X55+F^`|N+RW&?fd9Bef`}04ZfS@&*f#|e7g4C+5<KX@=^8P6wzC*2L_SHJNv2Y
zQM?Q1uO=2RHOs0y3_Fux$u{)fGWD>JozsU2_;A_IomTqQqm-M@6gsQ8Q~#cQ&ElRR
zj4IBj^x#Q$LHkMNf+3^U3eAGGp=DK&c5hxN9ZMN$bB!+P;eCd9q~*F7(IJLZ5Kk~T
z8`^67d{1nHrN!QOZY(5IBlI&4lJC3<u|e+=@tpB{D58}x3QD=l)mpu|stzU-|3TOJ
z20#hei{r_WK3X?>e=gB%9e2ZC_;F2i|Htet<P-T&Fhy*``a*?Ri+#E%$;n*gyO>NK
zPCfC4JMV5hew%%geSc{#1b_QkN<4ep89M{fl+D}Q#T2@<P2Rzi+GGtOoMZ0Q%f8ub
zqX`!>=XsW67!vJi_p4Zc&K6fMlrFuYj2(}Q&Fx)qUGgZSLpxa*BrtYWljV0!jlMj)
zcW|)1WZ*uIMB#a7vvF^w>qsEEe%_|_Tz#zg6W4GKN`YdcWv?@pC92-OL9lvNKQU*}
z$KXLlDpy;H!ONm0n3Qr|Rm%-7l0JS>a<b{N{#QHVL<7y?yrGyrrO2cZvE=76Li$K`
z#A@4tfy7XEY*R~d`^JU0_%B`&>Z@6{ORTwh!$HxHUjmij`y?VY+}24BdnYtAt~qEc
zn;v{;fZ|O>{QN17+f0e0aJ$@nv@OT_!jPyaHuJ^+g>}7u6o9cV!>MdSg+Q4Yw{yz!
zJSEk1*|c!g{RFI{l5RTPMpxy{TH044C;UsO;|n>jL{f|uyRi2SC=c~FKY<#XO5<6W
zQmF+Z?NlaClrY|sVYY^H>aRI0m`np7(yF-=!i2Magq%f^l=M%N<s}v}j=lEFA)~_D
z62?_L@;PaU0e&C0@FdU_)t}Z+!@ab?UCf##+NFR<x&zajWm6~)TKbq@is$7<B%U`Q
zPUH#p+^9q6CJ0qP(92ZMd47pr`02sgOQwp`fgSG<V|XXe-2Ev#<+nA6?;>}8w!-QY
zrW|XUS{Ag?<|2CLFQpG0`1Ya?<YZ$EXPPpDV;+f)7qg(MXPLu0_J!byemohsaH#-x
zSj&sM@$M)F!IreQY_cT7h+a^A8qrw47y9^#ur_>AwV-Y&)nqp9P4B*kpdRxflOY|$
zcg4rY0^EeKVg?hJUD{cHd0om%=SJrB(2m;5&cw<9B%&<o+upV!dn8s{Ff!apggZ71
zAKQ$J-|~!JA)=;^@JXlCigSw|!|$aV?9Siuwz;Qo>D2Aq!IzX~*3^R=v6;C~Rmg`=
zUR(S*$vCVcQKI1V(_<9SBbraIE7$gHt&i{?8}_N_omEp1Eo|sah>WI#t0Q5?97WA$
zx+1vqL!TBFIY*hggm1C4^gkc^)F~Do@jhqiJ$G()wH@d1{?-teMXW<tE&lcX@@TUM
zP!=b5BV2N>TTdtvLtAT0mHW_}&K6I*bkn&h&RI^w_*zQ0imb)ybqZm7)rn6d-JIMC
zwuaoDc6vCbsSuk;rPAk5RW09C$!{O6+2*DB=&eMY2saOrWL6~TOBNI6m@Lqj=NE**
z7ytqX2f78&fB1kNU%TDl+YeSl#qyN|hk9pECy3?iqO$VZ=8VqOQ+n@hR<l2j9v+c%
zO!A5kFI2uR(G$lWoZu#HOuKSTU(`_IBJ=EpZXwA$qq~|RjI0)RP$Jta*TJw2KNvG8
z-|iS<9bYVSRD+c#MJ`}4AwNHsO`YUT^1<}U<Yp8K#oIseJSdQT87)P}!z-SyVAg(i
zntV<D)Rur6^RFXy-f+0yC%B+GJ<pn;lvH_3X=!nb!?&35Ckni5-(s|N-ki{77iy~B
z&od3)ur&E_n9(-*+1mib`3PWu#GlST7s~lI)8NgrOz>-*`nnPAI=&`XE?eawzgP=-
z6pncM+p><wGIcP6T;`Ya;E4nfbIa-4U~B92gElH0!ntk@8&!UyM7bKn?cAl?`0O<t
zlPLdpeK#4zv#;-LpOi9k-OsuWlBJG*#*I;3d)gHIlB>CMbERE0{&8lRM2Z^YNR4af
zxS-eTcZyYQa&J7hnxjVC9?hm%Z(dk}1t(Lwc_dDLEOtQmi^nt`ghy1`Ueo`S%s(C-
zP-papf@zSwV!;kpIhkVXj*CWOLPdphyS-;Qlov$HB!6rP<N$K>HYDY9>2=Yqlwm%N
z)u3VjFCqK=g%O?X%=P)CYn(dmhBC4eTJM$`t5_kNf4U;CNSG|I@z>4@j9lzXixIV_
zX4jD4_<}y}1}2AYS1i0aX|en`!beDgtKy?dxeYFu&S9e&V9wQoJOi_m9!JkXyLA1?
zg8tl>Y~!=X--twh@LZ=uOzwfxry}Z;4y~g6j8XjExj2Dc74t#kz)wd=NVmQV5KMXN
zJ0b#@vM@0)fD!(Il^GLdv6oTbaWNMFjfK7A=dsxc9C}YCeJ5>BVd(tzX*%BJunC1B
z#SDY+d}I02YyjnOPZcxwjTq8#@Kxc_wT}1Rl<JU3{5`-M9Zz$(&r;}se7+*#&P1=E
zwkrw8<t#`Z2mJ~b<!h73!Lb;99(D$0d)k%6q_~LrzzCAj#y8PE>6nr2WX-`PPdOE)
z>^r*;<ZUZqMxfF`yP~Pb$&S&RyN!;d4n%C@u!bIJRAqeV3EcPB-Z;u1$Sq7g>gYRW
zKn{dc@<e@j2sr+wqkjcnBEY{+UCNU*>a5l^!Hg#4&M|r4V1t*X?IT8`zua0X6C8AM
zO#g;$BB594pInpjSxVD!a(}n3Qs_xu6_`8w%kYZqeD)@9sSWbcy_2FtAlxm7R<G42
zS@Dygehzb>ee#uwQRj0%p%dVqx|5qPx4UtLSElFH0DpnMP%+YJmP%LfQ)sGSp&);R
zxiRcRK7NpC4O_jVr~`wSZ<{{9Hk!JRx=uuXv@M{~D2+1W2%ymKtfqYgt-B$TXDPw(
zyf+aVTr`AwLGfH&2z8u~R(#gRhJ-o*Ngn8w%=qu@t`3jwXGd%b<qPvdg+D$j!6GAl
zTn}L*(&Y&Rm;wywR*Hh%nu|Nssyt8%9kVf|2-cGox$0ss<4f`d+`C%0x*a*YsF$4-
zO8oTP0}DwPYsMb5eq5I?m7}8!&$M;i$~Ggf@)Fh^mKJ16h}skiX+6d=S<sgE?z-sp
zpEV;^Fo^`p<<BG(Tjjl6L@KQl%BTC*f^eHx7~yIlNqS;f6NXnr+&8H5>wV6<{iGQC
z1DT^4Hg)QA4M4)1LZzz#tmA`c1zMo#M2G&8rsA+}B}HA>$1!5v`YI@4oYmJ`oS!TG
zg1)%Lb;H4=<>4z-3;|+phIVzdg>lnq7q@rYareD%_8#MEm>y~FNdEdhH_dcy_jSS$
zjJ8_w9Z_!Cx;A2*yYvh%r_-?Wowe!Ij)j+h8r4fB+H&QUea%INU$DtZ4ATQK9*}c6
z?WXR}IB(sR=zn79NP3p}1_yn#JS|kzsgnP)56v+>dsUM7lIv?-=B9N7X;s6B6fmx$
zqNUj0O{pC7M8(#SoV2H%A|DjQV>S0kuDK2?n$z@?es&msr5^wN>L})weIUBE+}mH3
z;MnS{h!YcK%^x28e1?&#alp}IFAiNBhILvfB*Lr_Z9BcgZ_Vq`&fC1lOI}&p6Pp4J
zK`%H7?xrf+Mt+b=aOdN#$<y5+5#848B&}jviit{Ep7&bVZq)UhhQs=<#l8DH%)w+n
zokd3_QIzFmw}KrfF3Np5Y|ly@OnbwA|FbH+UTGB&$;ib&JsJ?m4U$XSK4ipkD<2K5
z8ujKc%wBgAIj>)?MEB9j{oJUB=Y3n`Cs_lx3SN8bw@mD&NhI+d{dF;xyMyA~YpDkg
zW@9~rV;fY?+cO+pt#-r)86m65{T)m~_-VmGBV%);@qoYz^rqG^(QoV6MA+TRtcr?4
zy<DEu)YjQ)Azpvyid+P4Xy`sqP1o)<IKB#LYPxB)!Tdg{j8wR$V=J$%z+1>PEtd3U
ze3Eh7DI=fS_{SR8<ibdgfN+_y1|3>5N`_W+#@3g)(-2gp9H}2gg08|4*fxdo<YN(T
z9Hrtqa>=R^#9SNxQOwAgOLHSrlx=4v9j=JmZ9qJ5Z}`=rZ~)7yrqDR;s>RUpLdfE2
z={|PzYsnU%J<$CWqPSB-^!<YFVc7%4dc*hy1rd|)Ey{1@xq&uZO09`(;%<FEc57lW
zoFbljcLTFTT2;4qr-<nRR&{OIQC;2P8?(Y<j6<(<C6pQS#?B*Mo#A(q5)s+rKtl6V
zZI5V<ssl)ILm<_Yhju09ysjl-@)&_XAD06B=jn?(;=}{2mGrzl-J{$NLpM7RE4FVY
zI}C86y^ZP)t;OE0KTqm^v2#DW?E)&fYpCJZBuBV%&ms7EEO{U7ivp&1*U4i7227=j
zbzI-wDxDP(WYxBRoh4oA>H%9xk`-n?lfM+_Ad&v9CS7-W;2Q-GWg($H8dR9X6UgrZ
z%A{lm#pZzvct?)AtDiDGr(-$DUGzLh?Yf;Wb_;)JJnM#jU8LtdTU&Q@@s-4M6L7wP
zuSPudL&dPuwN~W$sw@|yy3<^jk=a^_o?o0estgPx$(#o-j#hQF46q*Pv1logA6=ld
z2-~KhU0LwwWdq&Oj=;n7bI`L#u^!r=bWR+p7;dMjdOE9;oElfGwN#$EFY=|{|0$>l
zntuHd$fh3k^3T*S!Z71I@&-seQpPzzY0??g15z5NOL@gRTbgChu(MlwYR!+MY|9GL
zO@`I6JRzdh+}jiVWa+Nd?>Lu#MGl*I_cuBZl}OlHPpEzITpGP1y1Z00xLE;Q092TY
z1f$V5{q;o4Wp9O~l}v8IGw}4exJyp}A;K7#y@t-Y#bTW1`DzTyknFuU7Q{mHtO!aW
zg9Rt{NXS6o%K6>xA?d@oQbuw8)Q^)Gs@&`Qabl75?pqmAViE$}hHV{9*D~wT6rvoa
z)xor6a*iS-s2vgpwAt5IyL7_=p3D#@Gnbx_xwrVAphg!#i#w-NvoPkq{jtdPcC(SA
znK}9+3k9ri8JH(1wXTkTH>OUTj)i|R`Pmla#DJdMEq6gK?QL$Og@ol`d+Wl6Cif9u
zk2)t>8yyQtVF$9!#Ij0RJ*1-BC7UjC!bb6tAJa*W3mFcxFjXh<T+QsqZS9)|F6>8s
zts_b}C7FxMMRb=>%jy3#FTJB<GKh{J7;)>XWvyZs^xQAF?_#fSh#=k@zEi!{P{UWQ
zz2tPhL{G8d(lC2PkunSv%8K+vg$J_8V)p5*=brLO8ma8OWIY0y1r>0}2#lp;0RdDv
z|HcQ_yNNZd;{xmsfW)@&@7&j~{PosyNy$9pJpAF4ZY}%8fZ?(|ER+}eVm;7kOi#hk
zoc%5;G@@X1J7HRMR93>Td-~QkJ;ZUI226#;`OOzx$FSV&Nn_l0NX^?+s0>VLYm>kQ
z*~MYEnP#XwDKEaS!fswwUrJXnucFIZ{?R=PcRKw-_2VMLD>W8LZ?<esHySU+XI(dl
ziasOrJ*_>~F9%-AOz9@|rom*=bP?yxsxt!+X-jcmI()%IZSFW+ME5C-?B%5P@%7g$
zL(8W$iBX@6ryM4=Uu){b^cyI*MvZmF<ZjqqZX4@Co>Y%?y!?;}6yE2itg(+C)E3@(
z5p{Ur6JpkxPeY`-)A(E3p{9iCbkE|Z9M9A2=I$BO&Is35s?O6cZotAR&FMRAwPy7q
zIb2%b-*0XFb@R|4;I^u^UQFkBmEV$E5yCQbNMbNUOMAF!40pkBB8t1X5Wasmkev0%
zT&>T^ucz(m4Z}T0RU%0^^vARv!jkp8ilh$qxX2rB`?c5iJNfZk)UfO!1$Dzc^Xk^+
z)P9MnvK*qqQyLXXJJolHkJAj$WfGX9K{`Wua9nogD3Gu6b;YZ4VHjRYw_tz0VoJAR
z7%wOG;+&UHTJesFj!cKhhyAR@dK<G`fqs{tT@<`A_o=ANwW$i*A7@;L(XDKF)$?c1
zHrjGrRNc8erZeUTa(={8=noG}Wd8`dhjA7z3LC$6WJ(3x+^SbN{^(02UL2$|9g3g%
zPsa=uwT<d)Ti66|@~+2?EsxoKH0^dLp&O~%@_YrrE4nM1W+PR6+oeNJpKmd>yY;eX
zz6sL-aNM}}_N2tY^iXK+V%LKo2BQBOT1|=5kS@GhWQ(LoGquuRe4o+;6VS>vZCeGn
ziI_|78+F~S;d^o$Yaos0&$KXiTGh0)I4#l7BR)3KScEo<%q+548{JKJhQiiTlsKmQ
zq_%z9S7mG5IeeZsRU}#UQhKw82#X|)5mnccF6SS~?t&(#2`FV26fv&LPcNbV+-YQ5
zHa~O8ePKCmIat1AA9WHS(gnZB7`_L@Aa?$hH-N;Aj*1T8AE<rB_==VdabnC+wbN((
zfm&fW^-sYbmkQgoh_;c&QFrxFG5o_>7tO~2eySb?kKS68C{+HOzKV-yjy_><6m&0`
zUDvvlU;&%V(C332%(59Ca-OymZLgLbq2>f9vx=RF8F(0}*qtOE)6BvKtpI)e5Y>!1
zy6hVRMw9U>3flizpKXa6%W$TH()G(J9&>6<)|+RNz4Z<4a^6Uu1$Fw@AI{<&LB$Yv
zR$c0MUO){c<G*URY0B79_eEpi<?zfbq}l9Av&A0=+w&G(C$XL8F-yrE>)AK2@qlVQ
z-6AV*@$4$d9NCOVum(<#-u|L3ukaSR!(x8P5I=vAX*+)!_tdboE{6LeF5wlp#N_7-
zw&$CH+xf=FB8T?%Dm8FLJqMsde=H|*Oy%O3rzlIQ-te8zsXWad)BZMO3VW6m*opg;
zZlL%)&s(jic=AHOh>`FU*Fh(X#8#ePmu|4!gC$v7mkfwpmKe=^B$K7Lhx|bZ&q4-+
zEKJDG{x#Ku&Ql=SlfM1`PWJwb&`L2V?sC>I`+^ovU2_%}%-_4Yzdde<%uUdkW64*;
zT*Kd%mv|~N-Bf}{KN@Ykt``<9G1C2B7v_@39VBR+=3zDVlD!lyguALD(UDmcESjSv
zI6AUBpoAFg3nd9GEk-gTNE(ZyaYq!fM-t&8Y(j?WyKzv7Z500VN^7W}g6!KSgk!-P
zzLL=$UGK!x(2p7%gu5?}{YbM1>3qsC3-!n8(9)AtIUUT~h2A<Q8-j8coctNcEsFhh
zCeGcS#XD?~%WM6c-OCfjdeKi)Y7F61(zb8D?r(+GY_=rXE^j(q#lE^Ki4~DnRDLa)
z0QC`lQSU1cq6V(f%P1dQ2>1sjBk2UO?p?l2qgd{?IOmi8{yd|64((;n9QqeJ`2p*m
z<+Wm~<5d1oVmR!>&D|{*{}Fem*sf0T<`y_gDG+9XYElv{5|GPFWnp*3m^f0xiU%}x
z*m&OCMTd1<zA`#`rAMNrsnX80g}pTTnv@t1pF^-4kNZ+<`QV6}bl*aHqh&z~PkLbo
zxqa7qXHq|6XR9G|_O9sKH@@x;{3F>0^!fSkrn_g13!Z;y0_|UGU0A&J*K5=miy)BI
z2isFS^by=7S@_IZQkrKjV1048lUK9g1UKn|k{Yu8X)3nPpFEpoD^jVOmOZjC4GJJl
z-j7Q`mqzRzE*2*5FizphT_cR06Nq!8)%ylmLBY{0mqobrR8%yP_-pUq`yzW4mkm0!
zszOV)J1Yj{SdVk9DlWfOwQ4kNxBH&P#>wX>qq!j^Y*UCa7uirld2D)KaKHE7x=7pb
zsYy9oNOcs#`wJbg$OI-?7SI<4Q703%0u&6)M4_Ujf7N`C5XB^;FC79Nqlb|DDZl&T
z-v{<s8sP)eAKEQ7)%pbowS_7R5wlEM_y<{f#EA#A&!stiHw6`&Jnaw%4{U0rbnlzj
zblUYRF2x{{)`iwTEUqnHycz3N9Vzx@I~!GFy$SG_KHM?KPqG*|j7MAp7aAjd`Y+gj
ziuqGhju4-L*xoMRP8-7UB%=TzfKSpX4#ETmOlvUu4&eHIp8^S#af}cXu*aY?^=y#q
z@bbGT(Brq5gj-sV)fPtos!zOjk2sOzlceZHLeYqaQ$Mhf4?TIw9n=2xyGVlR^O1ZT
zoPAI1SjZjg{I;b2fk8aUBf;^z-?aSvJ7A@2Usmz_dJf8^Rr)4pRyHoosQYXctK4vr
ztvv$m?Qx?INAH7G*em>@<WNRkd)#e=<Zvy=uhky$y(9F1kRUCX5BsnD*$eP@cv_6^
z3MTtFMtLc0;+rw;vTk`He4Rh=9Hkp73%67}e2IH4vRdcZNvx%<pb*y+mCz>3%tq7i
zEqjL6=7&(Ne664k*7|f3FS-~P1$h7wY=UPG8!S|GM0f48|7Jn8Vo|P5C^Onl2GZV}
zbNG2hz@_qs{D!`M$%jk;i(9HH8}Q(@YLIqN>izpH;P9z|UlBHHq(-$i?WVgMA|pw~
z?0&+whoBmv2r70or+f9z=#?pI1J(?byr<06_92^0Zx%9l+y|31#Kwd)bf2AmcJ-YW
z)lmOT{VUqb59MmVucpeI&TMZ2?ajr{=$-mYe`_TV;njJ!)Q7C#DU;>M&NAn5tlUL0
z0VKwOjDm*po?<5IjDP&@VFV!)RrHH5<vYzW-VSms^P~Z`YVnA&2es>F7fpDTZipIL
z&--Yj0y+g2Q-kzicT0aQ*tHj&;TSjVzT%1+VNnr_x1=X#nU}*3HRV0LN=kkPfDFH|
zSPp=H-EV%7{;jzuXb!t2No+}ZpqW_A57m5#h&^qC{sY8fm+sJI+>*$8B=YvV$r6LM
z`}$^4)vD#tuy0PaQ%0|VOueH-mt)uw^!w*ONS@vd&n{JIk$KPV(DCg}qjY3Da*vOz
z(9C3dFkNkJ%@IFEZ_7CkFA1)R4qJ3ply}wAH1mp!=C~x+{FSUd(&sVU-cIYI_hP$$
zHO&oZi&-MQt|}x!N&6r7^Ac3q&yUc^TrL0|8YNYPQvIk08a%QDJ-Aj`0G-!-cpZ>2
z+piAE7_p_xkRXJ~o*4?6k7N{&LiN`{?sM(kkv<IVWolf%;Xu+KaDY+Tg)nj8b1blL
zfmFaU668m9=XgAryAvk~GH~{z1)<l--SH7V7?OAT&~e_QfQAftcq2o;2WrCYy|qLC
zD2h}p@Wp+?sqDiqvE(>xZyTzA&rfK2+o1!`pQOdIeUi{v$imW442I5W0wb^v*0X83
zNPt*2PwTXy)%JiTyuWn0<t?OTjiG*#?!dxh8R+DH58e0ytRI5+LgO;y5d`70K?;az
zIBd)PlT!qnI`jSOs|ZqP0p|CnuR;Z_hj5~y{!JlFz)=k@sLQI@d2(k3B%oAdQT)HV
zZXaJgY$K+!V-0|KI%y3^jfl?^I-ETx739G4UjWbF=Kq?KjS}kh?tImx3N=t9;~@^i
zuH($9&zg`0S<Zi7oq)Qykeud(iKYZ&&wF^tV$h==oMr@e<@Xt)u1N*|J(@|R3{O1{
z)+&hu`_n%b&voTtHk3g3{q&#u1}v1<OT7bJhWdvo7=a#ns1u&MD*P&#LC8#_O7J7r
z|Iv@gGD3cRj|%XWHNslb$vV*ff61n6e9H^EmUceH|BDB>cPIf}Hx^YBuxjQMLMAit
zAI&U;57O;_4M0$jfG$S}wIR^86(ump=ub=bd3~s)r7JQiP0*^P2_7czKYEx8rqJHb
z@k(MVAa~_!Nd}>z66Fg_NT3Q6?;T`*8v)fJ8nT-RmJWyX+V9v6kX{=Rx{Cfjy#`UZ
z1!ACj4SlwpaqZ<-i2IH~edsm`x5d4HDtr|}2mSf@M~LZ<f#OIC$=KKP{#PIyICTb?
zKw>SqI~=&h#2qy?a7Y`J&BPp^KDj6N0y+S}f7u}lI<pRF;>G#B_m1~Tzd&y8^N@(W
z*A9g3?OGTK-hfbOzkZtF=#a04XzxQur>_t~o$m=kU-~}=!2FK^{9^z{A^${xe<HyD
z)e!)lMj{c}{6Hi!W+Z7g=!dV}M7t~$&xoi<oqU+X{S?G5A*98^vHYJ70_*qimjcoF
zblue?dJSH+`^O1j?4vEwH85YonYM{zeAO$9u51DU@Jt%c*6ktZB?vFE0K6pd0$p^p
z7hsmv)N`5$b&AsfZ!jN@4m}Kc(h7%ormLdyGc*;*s1U+4(!Bp?;Tg2Z$|j~_+FCGj
zR@Wnj?HPB~6ahUMAtcL*h_}}Yuiv$jQ9Q&5G7DG9z@$>P8;^-Eb;?#gWt6cX9RH${
zN_2!^&K3a5CA?-)X9*xS;NO8*1JM=!!Jv;l7R@FF4k-K9Tauv)1Q;r<KRz9ZjByiV
z_m{pmnO`<dOEsy052}}rTn0s;DINfI^A-cCV^!Vcp`MJ#tjUya>aqv#Fsb)%W|~50
zDlKaI`L4u6SIghf0%>!3{s)tzQFKt|^z46I=JdY|>DDgpv}C|t4?3$!vpakcx&eX-
zPsqinmhTW?_5gD-38}yISdi<>b{|9%nacb$zVd`~kUS${(;1?Fse=JDpG#|dQsHgu
z`KVuS40xeZn3&W{xqJw`o`b;a%^T^m$>dN1)R!C=Umy>_*%#93=YN4e-)B&F^SLY%
zLpVa^tAe@HuC~(G)|Rw%Zni-BS-s=dhdTX=<;P%bbZTc@lI~L#x)s`0>1MR~XzP!;
zXt`Rd#<68>K!+@>wWO{&f9YRN8-S`0&n$gSBe>VbXC%gV2YOw7)ptSiJG49^20_?$
zpb@sncj{B%>u<wOpBQ}B_ky(QS$*Wc4D2L@U>&-cL;~T3SbR^kJi}SN*8KJx$+hQT
zoEoH7BxEunaV*9SB^&K4bo1}Yct7z^%qHaz_#B`+0Z2Dq`UD`jZ1vj5s&_iQ?}#0t
z;hnW=zS$8{Cfzf`>t02-U{4rC!Jch-4ycZMfzJf@-WKJyhn`}SPL6^S3h9==Jy@G@
z;<FbAY?ZcXiE(9((rpj(Z5z(sDN$lTLRx+}YDR+$Sv{q@_H9&ivuNL1d^TjdvH^7h
zHpXO&?GNNj^HesbYVU)5Q!8mh@kxYtjX)eG)zm)I)E*~JP}XyY$_jBjvGyM{j)J3)
z&ikL$%6GlJL4uZ<E2Q=N7|acg+FtUgN)p4_J-X$B!I81T@-%a-S#6JmGkw*0b`H}S
z4yohOpB@u7O^`CHXoy&N{Ik>8g1E?hf)#ny{(|dn>`IXVNG(r|f-QSng^#KlY`^Yi
zCLN{*Hf5Ihe347bvXDL>_F|`O&$maVYh>>DZdk6aTNw=y#gFH}EuNqzB9mm!^U0W!
z_2v5RD*z~uT=uMZz<v-gI@ozZBK7kR(?nL*3nwhTCa{mABiFiPi%j^m-LdW3e49*M
ztywB>hv>;$4w<$vpOYu8v8k~IC~_`&u}hKCViVUzb)Qn|aEnm7nUR8q)Nfo&aAqy<
zO-ea8vsZ*Cts{=}5^@=^EZ9Al>Lz~fLb}XpZi0MSuGB;H!S93)bnK~v4$mwW%$L9I
z@U)Rci>^cu%<~n+y-II(4;8;HW#%PzZ>B>>nVvh~KC`?Al%Gf@|0KScpv@@$G$*U7
z;rebJ57&0P2Seztj)6*R6Kzp(Nbfi%cLp~R(r*}nC>UJ}*=VWKurucRN)WyjX^e77
zQ$_a`-G-rQt@qZ=>s?`G?=*uf6Kjgblmgk&&?L$)48IoIS{#aUGv7`hKYEtgXl^GQ
zTqRk@1{jah-)*T!h_5`gB>AF7f%Ie?8c}pph)HSZm_VB~J92C3&INke9)SemJ41Ih
zF@vWx-dZeCA-?BelMQu-eGCm>Lh;tX@tswypvqRA{?!BC#O+u!t$)u-WB*dufR2MR
zcr&w?uUcp0K7TmIcn75_YW%o!%u6(B%d>ZhW)4J6RZxAo*w>`SOL_s?TEB2@h^sh5
zEe}m>A`m&uKbRpEsK2<gTW7az?Iv=AC(bMV<+K9r%3e&`B33&icHQY<e+DV@a;F>`
ze&{24k?dH+R1E9L8IEpr<nmtRiKpI_?ggyExf+uRSkSJ}cQcudryeV1j4Kxb5s0&P
zy{n@vRs(Dx`~8;%gcSSKIPQaZhaQ=)4AnakSno529796q4q=MsACE@f>62c!x_8Fg
zuv=fIV3HMOL2J-VTE(Wyu^Tc>aAwNBlP2Z9lx`i0ZZ~J&pUQQM5i_gd$D$^1bqhNW
zML=9p_ravb+UI9zh{0_F=uM#kZePK7U%nvQ@xrGW+KUSp9b06eDs?jJ9~%Ok*oo6O
z%8AfuE{|<mfnC-r{HrSKi3t0&m{68exxPY72q>YQyZX>FMr3;}-y6=rG0`ElmO!60
zxIA}OIutR9t7AD`c^Q0=X`-<hQ@Oy4qbvI-4kwZMBmi%=7<4{OhS|@jc}n)~+_#&>
zkX;Jq#Qz?^Rm(@z1MCu+qBW_e&_%z0eYlh~yU@<iNdCmJ$Mk#w1Z$*un7qO48!3&@
zbrCEvX{cmV=#A0w(BxfKR&F{t@Ts57J9l&i|BysO88D6EXU2EW4*vLA{ZtG-uiQZf
z8QvSp75tAI9y~#k`eces5?{E;8MwHB1`GY`w6!<9cQc8;Y@G3iCG9J^?HxGsPXMVq
zJ<-v+Vz4T#FiNW6g25khMjDdl1?R0>sZW<3^rFq2TiGV+r@Y~vyb_huua?rx*ReCX
zQ<uE*qPW%SXK<I*CO+~3;wR!rXJZ(%u#z@WV$H|}NWV5n-Qa!(iW#SfVW6L6J+-e2
zoL%X!%1@v9Eg>GF^XDESMOFnod34`7VU!yjDU#6UyXj!hkKRH^+DF8T&gL+4+BGk@
zk|4%=Of3_ntE(<GyPBb7t0dkrGRT875Hpl3UblGJ1rdIj-1e^21@P%Uu0$xND&2ez
zVnM2b8!(eXJB=35?x}G_4k{`9;Wod}=6xV~6n|B#tSHMfb}*%;@>2m<B3bT*b8_yF
zMwOvKxZujvhn$=_8dnl{gmkaXDsw&BcXYkarQdosik<7|GPM%@^DjV#iKN%=6uOCf
zJT*zbOX`Mq@Pv$`iw-EL$IUdEqi$#Np6oYS=?~<(09Eblh&f~{33mIK)kuNFGEdnH
z-NAiV*DPc3g)tbioKhK?0--a3)6cV0)h*?8svR;uRuUQRYUzZgzj-v?8%^d0|7`vJ
z61300M>=I~{b;}!zwv3}gx2>S?0g=lPShD9L*kMkrrj^6Mc?v(sQv3B#JK($Gh~R~
zpL=Kk_MSW~riv3^9-N=jMv%<Jv9icnd0e&LQv>AbXfvXtrA6`FpN}k4-$maBV?W~_
z`CyC-WyD83*7r~JM;1Z`@`-8%Z{+dnDid)Xsr5ODW13PS$E2Xvs?);1mC$FCxI`ei
z#d*?-S)Q9;bReSOx{wuaQGpD4B17VrY;7lEe9{@7%!nHHHY~PbU)o>(APF#j7+B!T
z7pL-5R`!D*OJ+bfIE>Sd<9vsSd}nC#Z1z73r#v;_2Fw;Od(`jol*vTIf`ZBNY#q_>
zH<jh&imYmb>)9Y!5J*a{ki#YLxwg%fo~-|o28w9`vg0GZ4M35s<GrJD+SY~SyFT(j
zn`;Ub>Du{x3SvRZf!i>XNT5jaf1^mnM2~nfZ1Z>*GG9y@5rV-3Dz}7*kZI9MI}-2(
zAxvrDLb5%o6|bxs_tUve>p}slY0A(SxPvb!6Q%JB@yVW&?eh1zC~%pmGvv0a{GW1y
zz~%tT=c)hTxiRK=s5|o66{1{)U$;)lnPj$LrA(w0>Ort1Cl+I}@)`P=KD|5q(Kmev
zK!+&eDv4XB0~t=FWY$a)0Y(pkvS=yYWZr<wQX%^y=wGic^R*LKb6eXyMsrd2;~s>c
zZk|~Yi3Af#=5#%B=wp2Pw~2GHuOIPrK+)!weC@nr=R7R<3q`+xE_mHH4>RkJ>4rYC
zi(zHYVBERpSD>mC>B1?$mYwiBlP)oUxEGz0$$<9$a8dW@{dB;Hki9TF8f9ok>#d9<
zBqZ%;+)zw$T&P}f>A(xHQOCh$4J2g1nzWz?ZNFTLm2&(Zt0SY%Yza0hNNvgroB^9M
zmZbb`(Z^|?y&*rHutz@f3{3I`apSR1-I13sdumfw@joQJc)%nnnWMm2Tsf|!bu_U?
ziNWC-F!EE7p*|%_1D7=aI6ft-#57HF1n~4k;p&7PBK$YND@oFVKdVOamsI|;qdyk~
zg1914L+IDupr!H$wSl(Q8H|6%W*;AFqH_<$^9FuLhTre{>(w)2@b)<7rpp@P;Icj%
zVUYIy@c=$J;#<iJp_c{z+QHvz{{8CfX`}tCitWD=14*lXHN?dI7V-{FG7*|25Gt(v
z&0`<_%$J?UX#X?iiwpP8fVAVE#s6s_|49BHwf}8n|LxWPhs}4DIrtwrLJ=S*eOKcj
z`~MHl^Z#Dw=UXbiBds>8cyMYyxA+TdBqfu%k=B3M2>|FnAKlpcG`$!qKA)@1cM7p7
zn@t}*ry5EFm5)zFs{eNE16(Uz=7px<YF*r!$KGhPY3zrDElt0O-y>jthp^wTNa=SR
z@b`92X5#TvZ=H%-Klf=K_YyxDlmp5bUBTP}zuAwK%PWHz!<P75%r?`9X4kk^jlUb@
z|AG*|KbZN47jci7*JVTA$GwKD6Rp?TGP7=H?J|G1zYn;vYqa^lQ))^6qrVnhMW_-z
zdswT|-Z(Xdg$P>M$O)2=IRCC*|4q1x(`1g8Z~dBMyK9NM7mLvmmb)txeBrXx&~V((
zHvtGxpbo7(yorJk>3rFUd(2^%4clFjCd9voVf<|v^nIlHSn~~U<t>_{QGj?3J^wGC
zLxiY3zpV7_Uw`s9BJ_p%2KO6WJVDxW44h$W|CcjtlHs*r6I;!b;Qqf)Fa8-~{$&Gw
zB<ZNGS8AjO=~?Wu(<jdvK$%m@ckw@wz!734j=a1~S!81A!wL_Nw90f@pjthQ51;(a
z<NOutlVeFE{L7q*O69EhIHleewRTI1#AWRD3P8QHL=(5cRQ><v*#35lpubBl2Wn`w
zw4)9k1Npaq^<RJC>jP3BvR6~kwT%DucmMX=eP`%FMqNIoviP5n%YS=2G1z?unvie*
z3*Q8?8eNdC%!Ei36M9wtr_Xp4&>aSnw@>~yng78%pV<Oyh!e&4LSX)X@b`y*!u*f0
i{@SbmzrtEMAj%zo*hN%feDnzTCwE_2I_I9zi~k28Iu~C6

literal 0
HcmV?d00001

diff --git a/docs/resources/raft-backend.png b/docs/resources/raft-backend.png
new file mode 100644
index 0000000000000000000000000000000000000000..42499fa86a5a2f974010ccf1d992491419a3bfa9
GIT binary patch
literal 307481
zcmdSBXIK>37B*TmAjyn~iUb3qAfN&Q0u7@gA`%n?iS2*{$vH#AsHj8*1tcR%4k9@=
zDp8VTBy<x5BsH0CXz0GX8t2S-?(@xIzUR3=?w^r?s@iL>^{#h?y{ew6sVMAXKEez^
z&@RR6S8qcQ3;2<q$hZUilc%ow82m%ya9iOrl-+W45`uUj#jC$*xEjn1GPu6IQz1K#
z3T<AkeDAn-@7{d}*wo&$YtU8u9bXMzAzNux7*yQN>1~v+vG|;w%FeczPX2lF@+m9r
zUhIcx1HLfI((aSdGs!nY#lzf8kxSCj(f3<CTIM`knC9-s*{GNw(Un^N^bn#!&@t}i
zk@MNs556}UI~gHU!`K6g+q>cC(-U}jAj=cmUWR&C{c|74*6*NF+P{zw+(_p$`>(b{
zgE+i@FVynY@XV`iso>9t`#|qywyCwBxA0s+AgT`QoPD={yXvOixECs9*uI6}Tkc<%
zgCwp5ywmtMrlkSGt^O+wK)ySf02s`2U*7mvV331)x&D;~c%C1lp&8mK7=D}SUqOfw
z>Zkp8;JI*;2Z~9oxy}ElmA9u5ntLAqN&`M}egLN;`FC&d{woLpC))F`G_d#oH%@fn
ztZnx<S$|I?s&i+YEirLnAVoGUwNUC}=_a0Sp-vWci?|rA;&E%H)N)cTEE}Iq{30nU
z;7RT@;^MC3T<K*B8a}=~xcjs2g@jrZ1*li6g(E1N&D;m{d-jDOPpi0gtNUBa77qs%
z;n*Vdyp@NQa=g|Qb0@6Jc1jO+V-Mqq<W`n=*)=AG>W=u0NB{SWZqf|B7MULX`f&H5
zf?5UceDq8afr~Zj2{iwxSMTa}z;y2hfKbY#J1JCzCx{}zBW1#c1A1cJ7hmq;hop`3
zFP+*By3Sbx=duec*;@2vh};pHAx|W?*S=d?x>6(6?K>fM5v&HwguDIuB=6edCyM4F
zQBkQ`X@>~~LfdlV=iz|JbwbyVQKjkNIoAf+T3C4KtrDh3unav{_xmYxElspMOX4C#
zx_;Uh;(u7g&(DaD1LA6Rl_d?z=N6<%I^&!oT)(lz%Ul&>8uF&FPbiqWxJZ+VlYk0W
zxfeG$2?N~diuL%%IkD~|4u)$&jXUBnW5H#kb3M5Iih^EVUgwRj=^wSP@?Ln$ca*D4
zNVl|OYIF5Xqv2q!VD21OSq;)-c3%(H)k0LP=wRP$rKfiJ(CfMy>oV&(^pSAf^X>4+
z9ey52?;VRxAAGUeVFW7^ByMTp&%H54p#6yB<Q;E$%{k}!S->xbQTjDB?^;J{un`Ir
zn-)L##hnnX65!@wvgf61>*k(X8{rM5;iZ%Lq~s0*(YG6Olo3Mi1EnjSot@Pr-1?NS
zx;KS5AuzI9rWIKHBS&J5*o($h_(@Zmxi>E8^!F*0n_wykPdilHyp1hS=55DH^)G>u
zlEam9sT;kQDu;$#zm3Q*jIhQ@9&c^u4M-|XPM+UzL9h2;zg*IAf{BE*r+A%+Xsq#P
z=)S7u;xarPA~Q4eiK%Eaq=C+-P6|8gGRTfDU;gsxYwIO^s>FJI-Of%sEVpnFiR-S+
zyxac8taxn{Q95EeNZ4zl?s11#7^^!9J=O3y2S*u-B6e|;^@tLZD}?t~b_Z5C_ls#}
z>u|VaxxW8eSy_q1F8OKgTz-{5cpma3CNk8-d=nXsBWcNdD43RSiU|u4-L}P(rwhQY
z(`tegsNlbS;Kv>)q-#t7wOsC6jr6D;_sd$Sh>u5^Aw9aATzfbSv>9tog}~%fyT@D1
z_QHG_&Q+%=nxt0c^oC~WS)jN?eOZ6D(&(<7Uhgk+>=-ZWV?X*S62sbcHGp1<=O;0E
z{lgO|Pq*RG3FM~Y!lTc71U)w%qT;wY#BBsUJ=c{C_L62wNL4G8^0naNnK{a7&$xWm
z>}mAQ-B3I+CZ*PhYo$InQbu(<43TgWgmm8DFEUbtS>zF4L)xl8u`&`hZ4-pi_qdW6
zsUAmZa_v09eg5tHX`7N0LKTaNax+6;r?1jhv2xB0ERhdQU$hL4ii&cj^c$!%p2;yN
zI_ACJAHZDD93`1&tFvI>aW<r<eEIR?oLxvxqL+<_Q&T4T$NeE;&uN9W{%CG{{`nzA
z^rV#Rv$(jpUgOCT*QE>t>3Iz_RGgiC5$Rexooqt0vaKBA9s+EMRnCElx~0?XzGP^A
zqr_pPK|#j3`a`h9_ZPQh^N?i6wJy7*Sr_&`-V{npytrvS@G-IK5bqVzr=B?XrqR*j
zC!`oN$o0+Wpnct-T^lM#sMD@}K{e#_ZX^%cb@G)RNuN+NAelG15aOn>u^BJUj`+ka
zJz8)}SC<2|(GtRv!Y+(6)-GRo#kZ#^1D6UAxq7$Kk}nA?B#(>_sh-!j@f@pK0-U_I
zG*Me-K=HTNws+bVCK+k&MQ@q+{@n!Gfham%l*`oW*Xir(>zlmj0I9hW%=|J#XqeNq
z>COkG1-WNh)*5VBP*UslpGUOoIQ5CHFcyO&=-e=lEvj#Fa)fvH+RRC;yq&1k!jL+C
z%uEH>$&5djSY-+c%0n+_T(%OH9M;agN8a!qT6BnWzbU<t8zLm#6Wv<J-a@{0OCTnO
ze}jT`Uzh6#+77K@8MVssesIgnY+GR};Q+AMJGF~Dwm^8?cVUN*@cQ%}yGBmJfpoXI
zXcU`+N$Zi@-;xD)Eo`Es9TD^D!R~s}W05CVxK%|V>9&Q?^JroQuFg++*DWnA4jb2+
zh6Ri)33FMnp{{JU^z1rqDFeR9<*Y$5k9F}Z>hVO_UYq^nv*?{j-nFj}_Z+h04L@tJ
zHw4|3NZZN+skS9|32r01t9naM=fkI*N=r=>&Uqn5cR?t-*<E%kD@6yHy}JTXdr9~L
z((@4;jEDTjLaWw+O6LucIMKaNW2wO69p&@I%2H<gE(?0hRZ4eT_8t&1?XDwX*QY-9
z2vv-f7L&WBjA{c*BV{}^^9u{>vXvsLqYa$CJeQ1hS`9fK-&!Z6#9kMTS{Zr6t^^gE
z@$cGB@_XYf2tkInpZCF>?<-1Q%K>@YHm?)cD4S_&pYV+lHPfmxZV54!Pl>A~nBe5`
z?oT~f`*kJ5Z=v#!Lu^2@RZLvWVByA$d>=KUcoB{iXJ;jeR00-cN1{IsKdE(yC%^Tb
zICaUO{WljE7tghr_}#<q%O4r48|q{$<_ns4>5h8H%A)I+TD`xt*>#TY=2$G4BQF=V
zz0XRUFNlbn&y@J#v*{;|#?fXZ{cd4&bcy)+iKjj!(HxsDyp047?1|2&qqCEJive=0
zTxqKm-Eiaux3=ES+o{V{o2$Vm_MkPE$Cm77m5b{7R-&0vsC--Rn1#NGJx$|S5_cd@
zj~MZ3LeZ9(Rws>I#hJFIW@QP+WJkw*h?X{KjXK=wQJcH))N3_RGS8H)^5Tnybp{ng
zrQ+8jie2BC){xCrtkKX?PRvrrk10GCaihXUQf9m<O7cD%9HKBAo4k*6y1Kd!B0e$9
zVNm%lj@58>LMe4I9xh1=kv<#eG|)!d!wf~Zif{yPqrgZo0}0xjG|`jP{ArBu+zV*F
zyEd7KS4FdXc{RMoNXeR;n~y9<#O(E$%k>;;=q?N<j_>h4|8~Iw<$Zgmq+jT94lf_X
z$45hujoWy1Vq{X)`|@zdv%nr)tE^4s2_X_mmN~v9@)kR{E6L(X=R8Qa_Z8tP-pm(#
z&mZ~TIWo+J!4MaVmxdGOY+Lz04ymhN^1fbt7b@OZE%V<_ZOR2o>_S%Rm2!UcNQ$iN
zSvohuH;1CjW<|YqQ%)Qsix$}-1=HetN={0y5#CN9y{;3BFdt>DOJ&IJD=V}ghe2Lz
zKa=aJJv{jqgW4Q!|1mjv#?yO-m77D=qkWWNJ+9uhp+<jDf1zuRTz+o+7z6US!Nwn^
zyVG2n*OeE-aC&OQK8JYco6^Hi74|4SZ(OOxWmh1rF&6TUj?TOC6;;k*ts;0A+S!rf
z<E_ym-}@+QZ8>k=y%TiSFBHW(_67LA>)MXBe5ziuFhZ)5xinkbU1QGAFRbxX)_qf$
zE#$0Udh(!9q_|0Lv!GR5?DRAJ@Uz%7E0DFoFd2EwVptn^SV~6r#X{{_vzT2Mt*xIX
zhj;fHe+#`^YBns9(;c%7y!cct!xB)Aq;4lm`0E<EHbB+#>JP5}^{Z{Hc5fXxWD0th
z#&&9rzpnWe)Z59f;cL!q0uehfJNRLG+XjpOyhbe_q<L)`N2rY#-$hol=@~$Mg+FHS
z&$99O`jzp<oa<~<%KTr?Oug;9e%R@}g^5>FoTLZ<3Mb2Wi;DbZNP_KJEH%9QwzG(e
z7FL%w_ur6xzi&I7&A2!6c~$7+CBwPFaOEF;AK958)hIOvs!kG?5k-S#>B|p~yx7)$
zeKqKI%bMX7S583EXOQfy)G*M_l8JrKdqlTSY1<NAm%kS>reqi)&vI%Y0u-f_dRwTt
zA^f!+dw5Ugpy>S}d63!svF2ci&D1{cFdo>>ZhUnc1P(Op$M&OP<(h}7mS{n~g8KB=
zE0o;>9)w6K)A2{&LC~!p->T%#$sndLS_Swehx>kHZ;56l&6Z3rA28ZxSIht4-2(5%
z=X>Wr$g>!>jw$(9dfQ&18Dh#Uc}msf&5$Zu3vmS{kGiTM5<XYyBp>9lt^ABf4T}hB
zw#s!k`YiWiX}l?zcGUox_=f%$!6~I^<?rrGv=3#c_IX_M+6<gLQ=7UylphfMIv5sE
z#(h`(tM@g1tE28!Sb3CeapK=v1IY?Qg&tbF4io1euExe)4%}Am>{C@t-~NTd2!%vr
z>8YaJTc>Mxr#a^(a_++a!aWs7Q*74-C?_Dj3Xl3G7}z`y5f3V$`k~HOH@D-BJWGfN
zV`$L#!mw>!pRUN0#SV4dH_6_XX1>VtWNm~%wk4UVm$tZdAH4o)!_&&t|NWm1a$S4t
z0bf{>q_)z!SMUQOzZ_Xn-p&Sms^+(LFnf-A`}1SI`3BH^voG6g<EfqBx?8|RDUw=~
zX*`tE5r)z~emS}=ns^y4r?bXQGi0x;y|P6$w_y80um9)9f3m>aSCoB_&}QG^EiSov
z7gj&3P}SpYsh<(P9_WAmQN+(X06D?>_Zqvlm74so$53y7U$Ip;TsZl>o5g3RviA1+
z`~26oY*%B+#0oc(e9iY>pQe`+yZidYwy<l@x`kb9fefxK+xx@H=b<v>|9pa)yKnxY
zEGT49QYW^82ouZO6~w(y^u^D&r+sieto^w8{Xg$`X#i{gUCzMM|E0DqXi{%4jMxIc
zA8h#NiDv}1b!H(~!$`e5J5uoX<M3)~yI{km?htU;mf_T_w}9JdW!!azD$TWhu<|uu
zEUi`kz)wEI>)9+Xe}9uwB<}99)E3>UP&tpnJx}ZE?!0QHZ`Ik=eNA6qxwEJF>H2zU
zq@>Zcrp%m>zP_l;+o{p8_HG}rMJw)8*ZN0A1oA)EBr8C@*G^DF|Ka^q36f)`n-vta
zTpXPUS53h`gzvWnWtb4Har)eOrY&#+FCQysn_hVd+$C4ST#R`+{UtTvA511Uwq>a7
zjS53Qs;+*cg4{Ip`&C?baEsaW5B^8qN^6ladC2kRSWeKm6pA@A^Bb&|S0{$Zw<Rqe
zocgDYd^k(pheTtU+${C^PSocs6t4znn_1h0tOmFHc`JN~6gSm88!06PdWQPJdgjMr
z$RDR4K>0sv5Bvx5A>Ys~TMISVAAUr=@a+lM(HzqiQzFI-SIx{PpT_A4#qL(ezXRdr
ztj;;{gDug~_N}F`UVYPmDPG^u_xeY-ICpEy8(8&edbSG92e30%iN37tc&>OZBln$*
zeF@h7v}x0kP@efuYYs+jp1%#9&lLqcR3!?GaPvfE;y+T}A@wb)iR?VG#dM1>;Hn&3
zQY(@~3NIF2b5Xtc2S!S#IWvBr(!nOsIW<+~OUi|xd5?jHz^?npKkDf0mX2CJnP+TK
zq4Zf;N0X4U%KBjUz!AaO*pBm_Q${WEQc~f9I(wa*3epH!S76>aZBVuO&Q(D0AH|RK
z-cnEpCj4inDi6~|!VemC^WHw}Vco)ltChm>w?oF-l&zGl&gx3b9&CzM=b}%8<-T(Y
zz{r@zy7Zr5#4oqShxC>^)VG2&)g{l=6p9vJb+GU_^W^N>T}8;XhnGbOnN0)4Rcl7z
zg}chv$5s9z*71~Wxq4n1g9i1wJEvjI-2Un`VV~<}q3-B3apU|ze#m(b6R(*M_kVB7
zj6XkHaGHw#vq0>I3=8Xj6dScA_ShVo2+Tdc%&;F<X@upwIM*cmCD#*HlvmV@yU_Yp
z$}^>ox0+&QGBT%b?*uHtFJHA;v-$4!>W6>o?P}y~1<9$wD<;$p96mr@K&7IfLgb>A
zRn(VbUn=Lul-O%FO7a>jRp<eo^C$t$?86Id_vM=Z(}CQ%a_Y11No{%H{p&D;tBZ||
zcL(>j_e$RxG)>3p9~6H2cxl2U-J}LQIYAG&Y++6yNvQ;X+v%SwjMFMxim}7$?Bnrj
zWIOohEC8&e4^;QkxOq*&!t~CuthC+->nG(B`sfBw1E_SX)@b4Xa{!Yw{>f)EUWU$8
zzWE*Io9odv@y6WRjsPA;<biJw!lpxjEe@uprKJsh3$iiC3*&`H`_JnD9=JDxz++g8
z9C&|S<g|+~XvEtK-|~W=dd^>tw-OyqW$2>a)GO<s!vVHE#$H!J%hJ;9W?rNJv<1O9
zz^G;BHJi9F>v6dRN5m`QmD#)Qcwr+Z`C?3<)mwUS>!}lJK?GcbYf1R8PW<wr&wCrm
z%s-C6>#ZQP(UgnSe57+uY-_Z@x04zcHGdl{(aY@57h810h)G2~umVuZwN&iv>3Jug
z!wrCRGohDTEx;<miHi_1qWN|6odjPN{LE0fTtb&&|BL@VHcM7b=pC}jolUkmbq)TT
z@707}un{XQ>vU>D``>X<r`|%`DkvKtmtUIk!`r00r!KBcDEo(G)KMD5By-^EXLC*T
zb3x7e&3AXx7=Z{``M?$A&Lg@!DT1{M9Mtp#EVHF=5PXy9-5+~3S`~DH;OpDKq|r_)
zqOQwVl%ltlxZdE0y;Rg6Tb?DU(|4);N4oiXq^yhcSzS?#`MAX!I>wuN_v*L}6xM$)
z-2bo&*cK-a{v+-H>)Vetb)1yLNey9t`R<2P=WZ9f)a9_yn1Zmc1XdoV=bzo|r{+PG
zMnGRcW@;XC?%SE7LYLa)EakA-Wd0mfshL4jyhs`UgmpU|;{m>NeS2~~(|Ze?p_?J!
z9^g8h{fg9BJ*x)>NPr%r<}l8`T6u4MRF!Qa_9KcF(bDIi9s&NE#G*0sbIV?Yt$47L
z2~NK*sN-jw>!yNsy=a}_>rn18(A8CEEfdr|<Wx{_$Ku`y9i#L~wVC+TNgMHEuUyP<
z6t4v#q9H4s)cAb^Xijd0v6!OSsuO)?OVvMhu8~}2HjE`tTw|f#qiJ`^))>Dp@3<Ub
z#;#?u6*U8&!MnVIBcvP~GgS=7=p#{Y3X&Wy=xb~ifOdA^JC<?H3R(#0mO1diJUFD1
z*5i?wJTuKlQ---omin}5yy)i+=wY2MeUq%~C173qm*RnDpBwwW_=J(#fmUFKST;=D
zR=QMt<iwaY7Jq6XV?pY33><-Y@?d9<JT0f|VQM+hC)(DiFMj=A!-nK}Q%xCG03@(~
zbrGKPIzujRC)R~q%o%$(c`Iz_2ocL?SFQs288y~6i<mWg5Bw6(68@m`XQBijpyRT)
zLZRr>BAJ1L`0pls!eNxD72ro4ZSplL>GQ$Bd-f&sTkqaMnUZG)_|o4H1ed~Ek2wk-
zEWl2I_h#3;j@}j#iIaBlE+?msGFye(&J97fys-cfp;+-x50$+Z7BJ2!J&AE(?`rZ0
z7L#j7B`_zrFqtAM=<!50G$rfJJFz?9X;kA=ja6R^jD-7`h$DxfJ;?NSgv|`Y!DK%(
zi@AE@%q!~o*t05df@733==@B9vlvxQ{LXrTvSq+~IBx2*z(fwLzWSHZ{g(_I3&)@7
zO-1daYcW9E=oMS-0#v~m$Zy-5S+Y<mv)i9fdZa2AQT6$;Po6XLdy>*R4w5Z>CoZHr
z$?n`9(FMwou9LR)BXO?%FT@s#AFgKClWfGY-jz`6g+Bo%w@SZ*!N+Ci#%}UPVgKCI
zC81(b&8)%5O~q&$_?p1e?{NlYb&V>XD$?Wc6--zEbhul8ceod4a{Au$f*fm0;ET>K
zwbA%8zdhgywFe|DyUU3UVZq$12Zl1A_za?I^~iSOz3o``xw7grRil0m@Jh~mCGOh^
zwRo=?u(?qRdjGCk04o7RjUPJ9nc~#l^BA4?;r$dKsH&6ntNk7XVl@LU_8Y;b18ya#
z+Mg)dYDvDl4F|)~tdg_>nIlJZYdv1C$}`4PkmHJN`}>aTm|ymhD_|*i!7sWFvW5ip
z_4WC3-)DG&W{BU2ex(kCOt#jd{0P_6D{L3W-;8}9$Fw)~ps%>}hhr+}+C(-dN>+G*
zi0Us0NZsknNn7<f7K&+|7<Iv5&XI``83IP_CR8GmXNn<a8jaTQ#XoQODJ*-z9Z@)s
zra_DygHgNCVzRO>*w!I%Rn(x!urFuQI-m$g2r-N@zv3hJish(`k+mnOp*1Lq6H%qu
zE1r=80p}e|Ho!%NpfUNTQ#-zj07a%>9kNrB8VL}_7QMk^?tE}e{&h5tjptnVB&K2M
zF=cU$xY5)4%tJFf+ebSZ0h{}PfbCZ@srm_Ssr%;7@LAkD_=Xey+uqZ(aC;%plz)~p
zHa9WxfpmnKl!~uvR;5_B#e+i=ccNH%)T|HzQ&XeDs@@;3q)>wQB3jzd0Crc$JjA$L
zsSXq$lU<=b><f0xcJ{rkrt-%4vN4+jC2Q#21+iasDd#(^Lg8fG+|5imh4PrIL$X`V
za<Zj@ArpYRbD>q`;E>fKo_zh(PX?GFZA}ht<v^pa7ybNd&E|d_Y31z;Rv+pM7hIU^
zDhgWSZw7X}<~toCl{U|3`6k&UMb<d1fNF1V23#?c8&%PArb=DdiVpCL{!pm+*^Ee%
z&AXgeYro`5a$}4K9M)~X!Rn9cfbY1XatiA!5jPQPAK(prCFz}r$l6b8epBR6E!*Tk
zUmDcNYBM)MNxCq!-duCB$9g{^r-G2)+t(rUj7#r^kK8+!&a2h3!7{n?9GQxY5{<Bh
zUs@Mc5=QX7-ECT>G(n(O;mdrWn7E=OFhbV#RWhO~<geiT5m6IIj(&s=E410HLf?7s
zmj(-7bsaI`xq!LwQ>c45j=#~(Y3DD^S)94=a!Y#0`;;#a#RL&*=Qz4=zF~;i&!aYp
zP=ttmeDQk=#0qF>hA!_d21=u>3$Clu3yE_OBHFX+RjnIqcm>>*#1me?eCdl|udue0
zA3zJ(KDhbpmte|&_g*GsdyE*}%C16bCX9{Fa&O$Hw}?Cf<16sw{H(C2bl4m&8SYH1
zR%|5zTYVYBlydK-!XH2E`K@vd!XCI-^cNC;JQP<=X6XS!4#Pr5@m26lnNM>uLwp}`
zeNR4DJ-l4SbOk+Mq(=)N_^v;b(iaobs^6vlmm22_0{H(AY6K_cA1SA}`6w$-&?H%W
zGokh{_qxX4WX;MWi~JvCO&*Az3t;H6;!l3?Enm^Qes1!c<abe{YhIn*r`k#uy<@yv
z@3g&SEf$))bDPt5k`+vO@PXKo0ukb&0d8g${<9O1Z8%<d%@bugSSZ$=g*(I{ZW##5
z<b%T62g=TB?`Jq_E7ufxOWcdY@aPH5(i^<l<P=98TNKRgRrh>PLNP0(9Jc?e9kf{w
z2|;>{WaLo<m*=|8q7%(fX4ZRm5NV$W%k76+{>*7QzA3nG%|`K3Yq;|@g<I)Vji_M2
z#i9XskBzxKtwCA3MY9^M4{}_!V~BrDypoSiVq2(ja;Y5);@GNVK))QAWy&ZH)3N70
zZ3@kvOZ3Gtv{l;07)M9P+BJ0fIkN3X`4d8`G2ik=(o`jd4BWpco=1~6Cchn!4_?pW
za36{4T05?5L5=KE%zE=tk6&XbI==>9p66nKE69TjbVDbJ(Q}RLDs<j;81y9zbq#76
z@|MSTbwW1$Ptr|!|IBd<ST}fK(lwkK+{#h?A6&|^3S~v3-LN*JZvuolbAuyd>~EJZ
zzYI$$XffP@DYn!1G#VVN5$*DWeEAPtM^tHXZf>MzaJVDp&1i-mrOEEp6S_a<jV{5*
z_tfn{Z{(R-Tc7bi%Y?v8=+8Yp!L{_`O`oblQX}_F&>Ze%bZ}x2oOAl`C5~pWn~=%6
z`&fS8|4ZCc6GLnc<L-Z=<s+}gZ}j(QF>dTe(i9hobI)zOhitnn_p$;LSMm5#*5*Qt
z7yk^+oPP_=YE3VDEX|(c_1vC3?#|X{$8D^-7<EmFC8?Ydpc%TOZ?zE2MmcTbmVZnx
zfth}twyK~&>@m(TD<dl)s;}=;onpO99cBI57ePp`g%BY%S1y2b=#Ds*Uxr+HMtMrR
zimrZ?9Xl1!eUVV3KyH`m`urmvW_N+-bUu0Bl&s#G^XGph_UrJ}PsJMc@*#=%IaVmU
zKK9;iu<1j(JWP=3!p|)j&FvH1+Qc_TIHApCS{Wyed~}MgHNTkEigH>huv?YH38edF
z()olnlrLrrB#EK0AE)1Z6$6Q}6TtrlAt{dV)#m-FkGQBOpD`yM`H)ynr$DxnI8>q7
z#aag0jocqUW}?3K3F;N|RFcQ?-gwsrGU>~9vB%o|=90g%th{n=oeyNx^2{5<%k-}+
zDVpEkL>{2VLEvLlR@2C@0(R$Ar6?m+RUq#k1*Cf0sZ-R^t<Nl;OAeG5e}azGvULx&
zNmzAP9S>$+oT7_@x-50#Wk+S^1lC*gOwT|YFBq)-`};Ujy1Iwx7+<D<nKy~GUEQUn
zrMGCS8g{Nf#Ecz)geFLht=<dM#Y3tQH_aDtE2~AdVeyWgZ`UK!17rz=IATxuhK5rP
z3g}%UANK3T&7wE#b>FE9{gaLpj>E=&2t-#Q_n(Ib`lDkI1ALI)3#pH9!G-4v|4s;X
z*b_QiWzGj`+v_f?xwS=zV80I499rfOQI`Y%jHNI;R#W#ONCM&zufRwvkdpzqk$V^O
z`>0Ale9R1~Tf71ZoZw1QL6)Gm3z>WL1BPtXtGw8If{T^g9p}+#PaEr@BqXH&O*g#Y
zj6V={ObASm;04|yf5ng}m_N9odus`hR8=P!`7UxMawMo1VV1X!ac;Anz5^8}=88q>
z^xw{snQh@0gFL-IM-lP09v$QD+yI|E0G~OYBMY?XPs!PZLgp40Ny&w)iD(P+9b~0s
z-C#Z_VtUh9*T|@R8i$ma5nAh2KpuL+Wj|l#(7@3ezqt`H(o%-Urfs&rQySqwAv4ap
z^w$WukERrjefe-v9>m;)0eWvr`WgUEcv;T+FS_@s3P#lI@bOq`n8d9800m>2?7B8}
zpi}KJ0!N%t_?bNLL0ZGf;>Pga>$BnBMeY9HukQu>q)O{xH<&vFA-^Xm)D9A`;+D$7
zl4EaOC(rPyT2$2R_Ev5TCpJy>`&(s$)a}m6b2^X&6KVHu8osk*hajOIQsX$7Zh8^o
zb^Ow$GQXMB!SJ~wD5S-Nco4;N5;gincJ15yvbj1OMdf$FFSB-^*F8OFOXKVXlw@F8
z9#vfjkz)WY;+uK>7sK$JyMFI2WV?S=Ic~aff}5Gl4E2kHJ5t?!Um&W+$Ujq}bjm@9
z>O$JoUfW#<gR-<^rKOFemsKBWhB{Qd9>mOVOw^)1M>=xNSE6E*Bi=#tgPej3<X1f*
z1y|$vV5;Ij29QCB7#|PsegFHFOnuC;?kp5HX^!$#Vl^_!rOygoJoJWGlY^F;5!zTF
zv_9+WyI=5SI@eGa6|+{fNFIw@+^@b1_;VqcP3YeRr2NyZ!4C=f2ynKtauLo;K7a|P
zfxfngF?tOts{5y&^1V&(qh-~*zeLYQyW<qiP))$Wn!`3;>N91n*vC4ui}9u=NT@uq
zOa$wR6En8TkwDNTD<tekz@hIzUMY&aPO07{jxAU3cn5~8#49~D&+ES|ZysN*bfxfu
z5y>awJOHD|0QUDan*ACQ{{H5{xn>|G7(Xbd-?cS=>CX;;Pb7<R1PGf)>73%*#OK!G
zZ^;_f%FzRdv~HdldF7%nshsY|E0++nMfL^o2wQ<z1IFo=x-Q2Una^@vKhG9@*kaE>
z(FmDXoq`m%%rgo`@?)2Ri-Nmq@}+Uz9qguhJdm^?aR;v)I73y0BpM00CSjjnN_HQ)
zE~W#l5Po(x$P<MGIWK65j1F>dT6RgkJ_qaZ>PecRv(y?RCHWTAOQ4pUd+P(KK##K3
zq}2g3tB^%ME4q-KGI<xJ0gz9FWj6z`U0rOHg=eZY>$^Tv-ZXh&*9s-ZQ~6ZTiJvu|
z51<SPXnkYt=r_QkYIvZbvC7L+TW2&sjqG~^Ox$PZvx&h4_03rD;tVw3IV&VXJ!9~F
zNl)jaz`zEnxP6`s2CYsoDHMkttDhi^MB^^;Ws@dWJ|DENB9rP~gQyGUFU2b!2cIj2
zY_){~z>@V(!DPp^gEwCP0w{3Oil}1CdwJ?I2>55%_d*AuxJ6|X(2oH^!sF=kKSB{z
z4`xL-fy}|++Kw`Q%%wROJ2JQM(cGtbNC%Udf}Xez-S4N9SfGg6_S1pjWfw;9vdg^}
zFSiCE{=_dEFM!Rh#s?R`qa$zA(A=XLIx~3h5(s60PaiOY)AsB$P|Ub>2N+lzI|cOV
zC1Bsx)l>Uz!qcW2VX(FsQLQNK`Ei-;ZgoAFzTtTQi@cAH&c|xkufDFP16a7-og)Z5
zSNkBmrItnV9jc3HyoPtgV!%W*)Q#0EU&IS!Seix)(I9Go$m~fky`#(KDuj`1uUkWU
z0SieT#}eXPu3A~?uRl!bHPUrK#n}Ds;x97=hk&jVU_UYzR>{9AlnXX&?(TFR5TXwP
z>F9m(-m7+Pse&2tjv4ydkZ4NNx(vBqaWO4ltF*XansX1hq5;(v%P^LG`I5->1(Bqr
zJd0j>tVNE@Xj6#S$?>MwGAkVSLQhy)&jk=r$02FOYY`x-y#q_$DV<OL^=Q5W)}ht%
z4$y~{8>b2)QuJVJo}f!WEghQgQ`Sw&DC2YZ3gBE>mc)z2EUq_w6Nm(7TkNTisCoYE
zEa$?4s`sgGn_h{T5h0L~P_rxjaKY&H8r9z)vGuQyG+~&a6uC4OP~fY{LB-7MgD-#a
zw|hDOw<)i1AaU3W&(4GVF!^GpA$(0jDg6yL2>bQxp;^w)@y>T!1k`|KEOZL1O*L_v
zEluVp<nBe$0YZ&=MN&fIz(Dbo_-MGU4Yyr^?Aijz^7gn^i_ZEj?D5zN1T&lVtwhr)
zW`Kvc!r=X+$~3NDMDeLI1FBkOfW7>H01tE)(wi}8+nQCoStgf;sM6)oP0B5>>YI?l
zBEY(T2Io2{r&&;+BYbZFWRH>U!9d|YcFNj^eJ)*pI=P8?kAC?Zac_5BA$2hUxFJ7w
z8~{W}AaVCE@Ju}j&}pvyU<qy%eFv%m<1m<jWvUm@-8cyhW9y*nVfn55_8aYY;x~Ee
zd@u#WamDwh`<B&~K_jw;Q3K3Su@EAZDE4j}Lj&=_#WpHl-vUPE`Qo0Jcsbz(ONt$h
zZN{fGVKV#j8!*XH&EI|vBWlV(4PE(t<6s;Hw8<I4tCp(P3?)%OXpr5hC1}tLwPfS(
z7P;v%nTEHh0eq0_X~k=-W`ibuemn-1!G0JYB{-BdX0(Mkz+QP_q|&X=PBplwa&6Zw
z^{~uqg<SC@57i9|C8Vx=2CNKYSQ)2S5_kTpj3Yo9>DuPhY5|@j2Fj>-=J-<?ys$EC
zDuuc9iqbSXZdk<t?PI7Z^_*&cO5qvDtDyY~tOOSTPSf3Wb+T)(LGFCSx#y^T{cj5|
z_EZW_nKspb&%QMJ2i|OYvhn_`Kk$YsM|kLuz<dZU2>x>3bY-BbKFtA70GV@kRDOCk
z$E8JWO8V|+dC3pO+_Y%+^ZU_aEbugH1)5LC7rNGYQBE&pUjWAy+WV+F!J<G?e7xj|
z<v_k$^{nj(Q)|d$7WTkW{qd$a&Q|x@jxW|qSyqz)A$r~V&Q53G2`lY=;H}CpH`2m>
z5r<zMh;v)BT^jHwIKzSCsXC@Ha7#6}_n$U~T$PL*M2no?YPdZpZE%N(Beg3FK~65O
zb~K&_Z#JqV+y+GCiY_5xNh4wLYo7cbBTp!#tPfJW#6^ash0SR9+pptQ;8+v{qoH_e
z{MXr}jx&HiV%KY7{wSpKM_z%^9dNt>!kwVn7w~2h=%n}cy*x9Q$>4)2#<vug+ZiP{
zu_^h;P15o6LVCf32oHRTc+19&cG_7J$sIlzrz@&@d6(k9Y&gQ)ZGHd*yV^VArhhX6
z2n{L#5|f?c7lCa)@WMVClf{{#17DMB?t6QOk3+>8m{<EQ``93u<pnUqqzgqR%02e$
z-Cz$TWdQh}`%YVi=B0#Z{KN6~y*1`MU=tSszVb?})8T`u{}|qP21FiHms$7>*Y`F6
z28d$rt%pOXSKPdt@RDZeZM{=;;WbkiXGEIzZV1;`D2QAiYG%c92!W%;Mf#sxy|Ejj
zSU4b&E_a;qW3MQ&mY}(I{}y<?G$13{<d+@Re*lp<TuT)mYB-%mCBz3VF>Ta1S#^@`
z1}9`~4u<(^yA?I`z#!rh4izXhSL%`S8;TOuF<R2<eeFTO;R&+|%VKeFj8n5jPJ0Yc
z=KfTW;Fb)cG_!PAxz~uV!>}sge8u0Pg{;%r-K|`jlYfcWU{z9lU*1M%aPkRkMPOjP
zSB>!5)8A6eb1)h@p4ylJneX3}gYH5SM!K3M@HOCE{M~Mdu)13NaJooC#I0eR+~<)U
zoK=z?8f3}?%*CgsNOKQ#-exfba+*}3)9Nd0xf5{7fdHx(u)U@HYt!wE4uE)Ogn}Kc
z2mz|cedv4czt!PMVtRQAis}52n0UTVicUSn-qfJ~gCw$IeKqaqWgMs=edKuQK|B0L
z-Z2|J5E?3kw4y!+!nk4vF+Y2#M(o$d?P(=|s}FhysU^@^D%CXF8}Y-D9Gt!Io#Uh#
zS`BXL{rdI(Z^>#y>KQfx(>gKv(vPc4PpR!gygCRuqhGIEt#w&A*p2#O)41yyfz+wC
z;GxW@dmX=~aUb9pC(C$m?FG;Nq6zD;*it;@)0TyU5gq#=74y3liO1aSRrbdCbCx8R
z$zZ*4PU>w1NDyVt`QBiG8|bq;^l^Rc6z>Ow&fRZZfRq}~0B~NN&42LgLCH6eyF@hK
zJ`E4C7=y3}qS|V-hA-8s38;Ieh^l6**<54YfX9&t-@G0iE4#I>6ur!JC<OA&)N1HG
zsj+jmoqI4epi%SErpwf$m7CxU4MYX44)bV%|9A@g12|X)or<l4<>$Mo7PFkuxU<EP
zPb0G-+dnYoo8w?kIO~c(g2Us|s4~GI%rK-B9ASsj^Ph)i$QQ(<oE<z+<&^y?6qTTC
z1Gw!ClxVK!<nXIwP6B#}Q}Hqa$uEyCmH)o=<)*`(L*Mj+ku8v|x`l_R=p}lI=3T_B
zU4&}-XKjgX(9iDz=*E(xlhZ00H9p9_+W}D0jw_hJh6X5sUn4U?QjiMgi0S(7tXt_P
zRafA_58#~ol<Q}(AuzHDbME1R!W*z$zUFN3nue7o>Q@|HCemNYcDd!uSUz*Xp}o?*
zra;#F<zQ+j(4|r-$@z{t61mzF=P1?10koE`2Vnk1+-H)S#{a2LxdwniB^7Hq*w3gK
zk;seI8iplN^Fnk05}5uG7_>{di$RuNgbYgNk*IJ%^{;tCKzI#bz&2%=w?!5hXMNRy
z_sDpIC+^2#DZ$GFOn>)gKzk41b*8OE;dQjB{@h5?+8U@bhSyOk7PqqU?_O=;4^wq1
zMO*Y8Lf!Q+EsdQD0)d`A^*g+$OZ|jCu{8;jdkQ5vDUBUG$`aHHg&hB8sWA}c#@vlo
zYO~sUCLBLLv&5`o^<r{IxZ9pjN7avIgFc@>J--YLk&@=YHr9pV#!|y*T-)oTZ!_SK
z90-`w>bJj9H_+q_ki_Zf*dzgt;c2AWOB;(Zhi&T1&wBa^WP2Ig-n}onNKEUs_oa@_
zsnW8M_S%(6$7HaD^cxB7aQ{85zXexuhFuHUD^;ShH6`#F#DxAsKSA-+VE<itgSa%d
znc)mnu{ZUCuRRmQHv{TTCWOZUVOzV=bz*I4nLkEO3H*KM{!~BM$*K!C#`cVllEhbT
z&KPO|k$tKnfy_qx9{_p(ga!P=Z8lI}zEU@Z9}V7U0fmx3c4(`8_lj3dg=XkG!yIVR
zUDI;O{_s4->>|NYw2q{O-Rq^^iLnOo@booj0`Lg55yoKzxlPGgb(_YXmedIqJ+R>D
zNPFZj>oML0MC{uB=n@b~t_!dU3#8R-B7O_rTYaURB)t!7GidR5TUtIvrgh&E*V45S
zLK3Tja?>*eNzq?-f}nj7UeX4Gu?!-MyQS=^XkxIQdq(VhHJDrYEvUFD;)WYQAMgW-
zQI=Fs__<)IEg9-#0HutF-~0%E8F`Vq+XwxgaMc3-KFW5w2(rD6_5g!1W@bm{G}6;I
z`7{TQi05C_=!#JehkTdm)6YP9pmFb9<0pt0PMUoyY|z14WZjg4`L;~0x~|ZH5|Qzj
zHF^HAM3e)mN*H&QZoib_Qeim1ZqP_FY0Qb@j}f&#ot>)*<UAyw(1)mElDE)Ru<Yx$
zMD09b+Y(elB&8c%gtw-K0OYcthvUCS>vqDg_E1~k33sXcG$i;_2aV+J_0fM3gJP;g
ziwYI4s88o}yi%v3<be}mv;IDNenml`ySoWTXsaHRlt5{)pmgerGk%XvLk&uknPNih
z*Pa9yfKV-A#FDJ{%SP+VVdX}ArAl>yx@f4?MOqkpAn|8@=>Xcezm>nsy23~tmOn_2
zow0V2p+QJ7Ygj-Mc6$-nN{&b9O$>Z2`VRQJP({hFuW5k#jm{^-W3xF9wiQTY4}v$*
zz1!e?AM`IW<VqNPSYy7o7TBaMhWTL1@u-D}+Fc!`T06mz#u$@^15`{Qe|VtlFeW%7
zVd6+tAwM4__~A`;aQ|CSF~l$@!5QkGSb_2R*Q+<a>C}Ej_PPxMf;ae_)Auasx^ve{
zT`DtDGE(|ZTL17c`tm!giV_Kn*;u<P7FU=nCSjvop--2AV$8NC>Bj2`V;SZi`Gl)6
zUS6sLrMac!`uKqIxzKguGE-Tdw~}e?AKKu3R@S!H(*b;5W0hwFHUme)Yx;xrFPTs(
zy!K`3ubG)O*5ue&`=hX(ht>ki&q_H{O6*n}SC2%FPRbf^x>)`=>d^A4cSzL+C+mzl
zmvpWGojvumXv1EaS4D)?0kp!aFPsUbs_oC+@?Qs0<Bx+K8enJVY7o@?zr4nAtDn}+
zT7LtWF0s5Ug|F~pfxJuhB^CbilqAW@QhfH^uC8$GAJcHI^$=j6`_qqxF~g4T<R4Ql
zcWTJRXkBEbhq_SrMbncN+H4v7?LH;3SEJ*L6*^DiA|G-!%pp1Lx@BllikCl<grl{I
z<#{Q>-4|DG-uU6bhv(wsDzqK&avWP9nZ@X^_T=CX5enW_4jG5&9*B3vTGM{6Tq-ZH
ztMQ-m^jc{p$Xqb#={a~-({eIcy^<i87V+7258TychVAv2RsWe=&(ixWt$CiLh!y55
zc=UY#Bs5mp#BQU@j?+WCJT-Ymx{($lR|tSul!ICvx3O>cRMK60a+oh~S_qvW?rrPP
zvT1zbsk*Jz{;7&}9M|C`6Xb!WqZ_^Fp$)Pr{z#6jdxKmUA9|(oQ$snc*G*9<CNLrf
z+6YHwK0{}k$N!k;Em477rSc$K#X`MX4?&-(=Iy?}(>3GX>!5U$5WB$%{3>AtNJ8%;
z;2jpt17D;OEZ2>wYS=U3wdR@c>?m)c;PO38<0idKpNE58ODzeGM{J@3>LB{*fjeCc
zUY~>pzV;qjt9-`5-)L7M<$m1T-a{zc^Zg~2HsLz4Ls`j2gm?~|q|==5slf^_y9Ry1
z+(cgXjKY=bIcuvUu6WrH6jusYiR;i(ino`%sPj!veV3gOt~6Uj(`uUQHa@T~s@Fx)
z>*#yS@v6z(&0V3aPva@GuZ)$2pmHxaI-f?<4DiNfs}3k<|GvxgD*%s|y1$(TvG}<k
zwQ4y+y1q3X1m2(5-USy1*Hmq6@|{<&y0lhb5$63($o@G-%<3t(rOshp_e%lgmqlP+
zPyxZl6{D9e4v!~Wco=U`h*4b?3yo49MivUjo9#{CozZUko25w+)eLbZ({i^cb1u^(
z?H)Q$1ntvltLCI_tn_l<SoP+Hh55I7e#F~-8D@DRjs8O5ddjBj=jYd`co%XdnS-Rb
zwFR6?#TS645?J>?fYW#aNYN=XPaDqiwvt%U)fY(W1#*gXAC5vQDyB2D%?hTfLU=QC
z|4q|Y;b+=?4>M;hgW|0W4)^3+DwbJn0%PCP07Ty=eqC3=)Y8g2ATCbtluLVhawTz4
zzohtgFXLE~n1-4|Nk3GjZHlg6PTve^Q(1`xStQyE?b>)^WS^4h?oN;K8jjKO=%V=B
zde#;vfeGYc6S(|em;khCS|*kjUQP=?V;33}FetT*ziS|ya?&}B^S+U)=|<u2cl6#n
z&E7Aw2OLj#>Lf^=j_RuGdVqJ!<b@)FcxFMHzxW3h3))A<G0#y0{L0E1hYQ5cmsOt9
zDf35>Y8<BCl;nvoj!M|B<-t_IS-7b&SQqEi`m`tF3PjXb)jwz><@^m=SG6$<q*OYp
z-wHUlFMjxvipq&N+391`xm@ZX-CS(|blN7`;>4YW=XIDe)UE4v;IQEaiO_6#yNocT
zcgX^-8UL0N`CbJdLPEm7@-?J-SHPe^-&PEJzz&zavL^fKkZzO6+@7Yzors)S^N^*Y
z>}M=ROk@?3xDSF+1AMY&o_JBt;TYq<KADn5>3yzOl#oIOFG3o*BK6E{J^8=cY?iRP
zgw)Nhe6{ccZXc3^%H<_55eG+dJ(`1!9Zat(D_<4Dv9k|++aJHVlx#MK<=UZgId#sv
zPsncL7>nVz^3q6Ml&)F4wEL1*TU!TvkMvir_)^!=_rJHCj9gDP3a`yxGOf-$ya#n?
zA4inK<MUw(`w?DUB^e_`1;M8j!m_?$gqsskwln0dt|V0I!ENr*jk;KenzQ2Ud2@0}
z)=rH`jGf2|641;K>Z{X@D;LEs<?HY0^BnaTv}+O5btyIZfRu73Ha#4#BgN$^%@m{}
zr>40Ur=|nUW?Sk|c&i{))Q2;dJe+r1u!EP~+lE<Ayw)B396%)XM~~`iiS4vl$OQLN
z`V+&+E2UH9LW!l3VT;K*%Q`Q@V~l06NIXXOXzoPJ-O78{PC7T7(8i%~?FVpNiNPOh
zW()6K+o)S;9PL$T;`k81KP*GDu#TYx#oe>f?@LQEtqI3VjCt${w7{6f!~yqn52w~E
zfAh<&4*XmA;ENId90#JR^5<*NCUl^190;Mjr7x>?V4vGpcea;H?RCrJl0su8y}n{(
zC|U;iuG(&J6RYlHP{f;A&jo^aM4mZ4U%Vrp-CD<%;eKMR$7lnAM$h@?nmOwae-gAR
zx%@t#vc%~zJvkdthhD&biU?Did=g*bdHt*X+qSUhQy%Cd>l9mj531Budg;ZIg5af+
z)u(y*XCkQgy5--W$|n_West;|X^gPpV*hj%Q6=j!TWLq+%44W?TN3WBcG^?8=dk#$
zc=GPBb2GvQMW~~t{h7BWx_jF=gf~AveEfB0NZ~xqkg2r2f#)W#$1b{JRzeZQU0JWf
z{ztig7B7=6X1d(TuItP2=gx-&{o5|>bDy3NhHb;j9j=(hIOEgzsrn)9=Oh;%cB}@M
zlE2TNi_NsaKhqy?e)@XPlN5TNx|OU@cO#miPDQ7!(}({sV6AKXY$ECn_fa|(aLC?n
zwrGPwa#vI|pjK~?o7pSL_z>@K>UX^~5~)1TX6>O)t${O{HSD2cv~qY?YhcRRyIhJq
z#CbQR8>JdW1>&^@&AKCB#+7r$w77oD4MiLRCGiK)iHRFnJZZB7j6Gii)9sGVgqzuU
zb_QNO;gx_Ok>uP$@j@r$a&19fHQf$|^L10hWIw!X8wKfTIOU=;C>1=2#@~(DDUE9j
z3rX>`s;PQV(ZGuGXo!0eb5g1=Nfz38HZiNo$QiOq#90*8_K+`DqC}6_KtyF#og<Xh
z<ynm0D?0s<wMDNh<FCS1DSGIo+Rc$6eT6-g)uP!iD{Lw^D@~VHd-RRyefA6(n{15l
zBJE;oJ(VIu*{H3JEv{2nvVXdifiCB_*2R^m%Z`3?*<?p~YAFpLz;SXrn0D9RnUgtZ
z61bntX^jJ^!RD+K?=JekzBctA7Q1(qh7amLN=?KwsannTkpKB^<t(CWFT@pCUTkf0
zR1&Rt6zO7j^pcC+j7SD?NacJ$L1~5z-qI$pzn^0?xzMUDa$0Eof)%jlIY9vV$=nI|
zrM7S1*kbi%+S&#=WlFHimqMO833}P7UO|Qq&CNzHwGHqtM<1NG{jDi$wqgOeyOF-S
z>d`#hfa~~gOD7~Z36iEb?uG|h4Ms)uA|s(9yHCdqloqD(c{?bn59B7oiNiA)_U<~S
z5QDubM=NbR)g~9gg}ELr!9Cm+qQSimq-UkvW%sV+6QmvAEG2hii;b-m&c0S>R~>Ls
zDPMo4G_v5)dN`7tBK+-uZa?>>g;jqxs~2?l>XzU%Y@$qeG&|@DZHCB{`EjNOu9BXZ
zUMF(kvBCIFf*-N_&Mv84ul-cpCztl<??p+tg&f=D;}b)X<UEdjClM<qYVAm^f-wUF
z6p4wbtc4(fLWV>I7KkqeZ(v_bK5t_(TeX5IO*@ZtYDkV97u6Fi%AO9C-OPCRo*|Bq
zN)Lb(LuXIoZt!*;mK1QAvMBb7cvOvcv2YO0A3Oey1MJtVo~c7Ifmoa~$eyKtMU_O(
znV35$>^1Y%mgqOGr?(`h>$tL7W8@sq8G`k4{yk^6_s-q<A*QWn(ZPV~E(QObS^G~4
zQUlrx>;mtov#W5iP5SwDu-E%i3!(X777<J~a(ASR@M^4>@M@%_xN}B4o04ghzr2V^
zt@TR(Ly3nu{k<KBl}qA!qoxCuW%P5i%Vad23TifEt=jr@`&fBI^4bo7sZDLLP)ga^
zhd4PfCMd6}stVrvdn47uQKBd0zSIyO6z~c2S>|F9L0(Dgs*x!Y<kyy#(*Xs|UJLis
zQTZ!@!kw@2P5fm=oDU<XqdZ0)<J@>c!>mZ$c_y6){wSXvywW2iSs~6eU{LVE>h9Z#
zqtddKiz6}&aY~mzQC3odqzX1?o|V-pJ`p@hTsLYh<=e4K_U$H`3nQ%}W4}<<6Suy?
zMw|HkS!QQ2&5$AKy2>f!M3f(K{FM}#Y$RR(Jke@;bZ?pP0N15TFE1+R9W%y*sMg}~
z+50?N(`sXVJel~t=1LG4{^#@UWx*AqPxcUG$tCGBSmKh{=L<7;8$-ysf|bOc<|}=t
zXeLjpNfSk}TD&Px4#$yntR2qEyrG6^BJ=3}A(e55NvYk3_N%BMaG3H3KN_k*<T}CP
zFo!-l`~wtfKaR#NKP_1p)S8ibs|loaA$8`nLUBj5Dt>9kLcT9R$u&zokv_fE`R%Rv
zIi(!w>}$RUQY9fy!>rH&Mh0Sp$XBs)$Ticf$%BbSb}Tc8sy+L2x~sbc`s)T;ud@#j
zeIM>nNvZI5QYarb&2TY~>VoDcga!}DV(iQgIhETct(~M9jFxq^?UeSkx7uImT`R6N
z<A|`nU}8Uo#|BKXq#)*qhrs++1qc#Jgh6r-PpG=5DzW9u@1J`V6U5UBFySv$R+Vd2
zRKRqjV!x^&xkfo?;Wekq0id0VWzwGAx+IIZ;*-eb8GVN2{L#s3#d&cih#=cny0nm=
zlk*ghjYU5g3KQ-XH1Mom4f_Mcoig1HD`6-mI|cinh(rCM>MnxSjj{?xEoSZxy2C94
zI(~3s44UJJqJlGUJ}37M09I@2OBDRgnpzM%xcbec1y3#R_yE2E_b4TKc8JGB)dnR^
z4j?37`Z`3O8~A!ShuHSD!y@eCheHrvVVx+?G3ruuQMuPrH2wr3j&&lgvQ-X;uE-I?
zE=4<ya#<8Z^SPwffR6b0n<vLkN|0jm=D08F#q5lvdmL6}OED_$Kr^sAPd_PSh<Kt)
z__(C<N3-fi`#i}SBzVOe`V6}rV;^;dJ$I*!o?&PTu&MCO@og0@DdWXb(9=)EbU<pP
zw;D{lBaRi~B52-NLC_3oNIFr+ME~Rd;LU@`dQuTcct4oKIjuivbRPushCx>FydjU;
zYryKSO0rGl;d~dMDc}}=Wi!CZK}ZPelCHCRx8X&n)mrt+LPNbPyeXYX%2#^3`RqKy
zc;1y<SCzr%)A7Zv1K0abhJbDeWpmH;=m!tKxSRUw>a0)B#<QvR*{GB+M8136;Y{N8
z^4cf7j-}20kmzx@sDXGg8_+9Bu@r?dRPrQ5WsT~@zg+;nDLc@16lD9h*JX=x<^nrf
z1|?$#ab|VuUOnOyhEAjN4l3D_=J6%8DfE1NEV7h-fhU3Du2kpBYpq0AyY1S|iXz?f
zC?8|*2jha$p^zJ8Q~=$-ABS<ipQMX)oUige@c*U0P9?UCV#MtCI@BFOZp4f&EY=D7
zzjoTg=UI390t?NMOI*>#?7M9jM{b77&BeD$@Pu~UCxMS776H)o$EuFUX0|>EK^^7x
z!Y}&TwQO|MO3Z~X#9u5of?VG=RE&at#~7o7stSwBxX6pT@oqioX|x|cV_~N3W8xrq
z@gm22B$P-nozuy03*weIJ;ja90hy|H^Kv#g2Wq{o`WG-@H%U0;`>Y%-0O<v0!p+1~
zX=>N*OMjOM^=klZaK}4W$-)r)?T|XCq;I~l6N{|p03$J@$Kyh4N0|(F3k|9B&2Xh0
zMJ^xsmdl(8j_NPeea|1omD^!_C#}s|Y8+e`RZ@nRLQfp5c`e*)buT7FzxY@SCd=*Y
zcx;^TMQEV?709+`E9(if($yBhI{UfZyH^utUH#3>rh`m99ey;lgG4Ba-UsEf97?Pb
zDe4gmZ`;K!VaD^m(oo4IX0d{yR)oz;9ROS9|Mj+d0^`pO(q*24Hz-HlAoD<XGIfKm
z_`wF#1S|~T4eEjoS|%;z|J>ldxTr#~!Bs8W?^uVCfeymq+h0q^<A`++IdgM)L2$01
zZLJ_ZDBDRVB)|)f>#c217bNj<E1=gZeI--I9NK?p83mOq^6Q*-gjFy%3S%|E@%vk7
z-p0ntKV?SNrv5=KrW|AnULaGb?adAU{_;CI+gvz3T(`%mHpt?VUp{ARC5IqXZghQp
z2|OV_(9p4iVUPdehVw1^hUtdhgxh>M0=`LeI4k(S=1$(j)Tascnt)RpIVZq!pv6AX
zB5ncqCF<XTEa6myavS*hIym*0V5{|2p^~0$sl~Y$*jm<V@O{IFt$kt!9-X1S!`E1n
z4c6jljTT}`FZbVIhH&eN50l0dk3JA}UanQgRBk@%&-V=OM;myOIxBX>gjM1Bg!&}#
z##};>=Tcv=YqP3m-LOYfaD0U`?l)ZBK4B0J?)G<z+>iNBXDP>Pt}kn$3uATIMR1cn
z&=ePR5b|#MxHKvtjCDu|M&Sky#Fx9eCVg8eSO8r<`-Cj`V;91&Sm=G!fA9RY-LipR
z#nWC&H^+?<Wto`7ma)-1JnaF?$151`%BkJT)XGK9R2Z=37|td9;r|qIoS)|p=F=5Q
za}`Bu9oW8yk_{)rnqove?8jr);tH_t0k6HB*EU?L%hpPM<GDv8Fi}M3Lp%QN7=n>!
z2-GZ9bUyk8iP}5C|N8ip(KAA2WtEw`Y3TOWgNgR{*v;R^z(+vdV~^aOY`(cyB#UC#
zb0>TU+oGGd8&dL4RC(d~{=|sj;_HS+LMM%{?1QWc-6oRmr#5SU&)Y$n)z@_I5wI+G
z?x`MpV_nodIf;I-&n;WwaMH8VVdwf@&e|NOwF52eCzkM8zb}^&u7)~#p##40-WZ4G
zD_IrWXCDfNhPo$a6lI?k=Cn9?VSUi^NBJ_zF}g>Be&mhu$IZ#%Zzod1-i=B{2O*nO
zzBE-ff}@RGv&;=o4>2PmrvmH$!`@p*McH-#!vhA2ih+ovC?e7V(kUuPcem0V5<_Dv
zAPtfuO4lGAGYkeDL-!C;(lOLf^PU0k=Z^JT>-T=2@4MFf&;1W;oa=I~>+G}Rvp;*E
zbJF@`^nI0>i;fYQ6lr!1B|{2~l)dgl!0;sh{8Ix9h{oy@*Bofz=)o1I3<!}4am~{3
zKrSia#+qniAR}F^D=#6$r;gtQ>c)^BK%*-pc?&{&$FYGr{`BK?#h>#utj$bQoPbVO
zS4$gzG)goUqj{#G{#ch|NY6zGeaDxmv-Zh;yDM%J?oID7mOeX~39pB=xU782OzN$L
zoOl{@@&+JI&q;CSEhQ8oDn)a4-wL0s?FAo`MhW{~5m!-PtCyzn^<VG12;B|M6<Dqw
zfg|qbBpNRzmg{RR3eA_)wS4WXLJe`a@~6E{>}f4$wW8f}RMAK7{ZQUDYsw}!+Rx-?
zjY`~XF@Q0gR~U(`6&IE>GaGg39RDP>Hq5na-ej}v*L}uf(@=@Xq({3htYT*aZ*eUO
zeT9A_Ui-@)H_v?joRJ$NgtpK>_jotR!~;H9y#OL%2>A0)0RNGKm8^DMBq-SJLj|KN
zF^yv<+$d>w<^tsX!cLLb@e6P4z%{RV$A9RT_HIlhz1z=_@hf%`9COpduCjO|7PcE=
z^L5Q<#G1WMaJqqAeqQTtB|eHeKTQ`dlyGTsJI)MFV{JTVsI_BOj`5g_CtvFi-9>!h
zAqlW_lnXmY(grPg`|e#t)59leTC)f><b%XM4^{{U``Ny5#`Du^g%XUpDkjF3nu2df
zNs$8QHOn1Wu=gP|!HY(_g)7vZg@ZD-ZQlBGHOixtJ`TzK)swj>4zB;6grAjF`6-7z
z;<L@bPOG939}?~>TTx-|4Bx<4<DwLF-3%=3AB8<W@i^5r&$D8`@TZ!vcxcDcTkGAz
z7XhscBK|~U!2+B)_j+3Eo>0<lT%~*TC}zZMVoD-U-m_J<gb`vl1-rU4avhS3j!6Ei
z#u9Y*)PtHP90$>uq?z?|FahPD&T$9yk}TS29Zt%a9uRLn2gezLw(pT%fNaW}Wd}wd
zGb64^e{;XH9~iSe@kY~h<m!Dk?^c<YDb`UUfAj)yo==jyBul{(AtAjsttw$U68awE
z6cXXggPYD4=NL)w))|3$^lvXsiJPZsW4_hF{S92D=r_nA{6Tx2Eyt229qME<Lg7Qu
z{nphi*j96DbbW|L;PC*>3F|V=$fnxIAzM77D+$cPa?_*Q-{++t`@5<JPRjTVvq|i`
zcIITo`OW}VGe^S+=b%I3uim&OMr6`urf19m$&HR|`==mQ*i5GOVju;^TGRwp%)iV4
zQGoPE(<D5+PSDJ9b>PQD=9{v?{|l5nehNbJ>9Qvc8%YCjgInh`<$3S51iN}x>QkwH
zRr3!e4UpbXIMI6%qBWsd{^eaai|csZP%!$#37M%4A(D_#DJqDPf>LzHnfDDM{^=y|
z?@xVp*xL89GFK%UPNX;A|JHJh$287^L8u*4K&q`wt<{qmOKm$gBl4h!V^P(<8u{g2
zUu)Yy>#W`5cf;bQW$YNYTk_<*yKTl09k+vDQ)%W-k?RQ&zOAyDUfRg7DwvPM%U$*d
zrFTYO15V26jmhklzdJ8TpxyD@#L-I-3lYL_!&xLDA0SR<OFmj51hX7_1k~U?J58iC
zP=n%A7a+agte!spkIgNXRb|U(NkK*74#J*FJE0@=P67l|3qm&SoJ~)bRk-LzzL=CJ
z|ET1WbFw&o#81zG4#g&q5B1>ScusA2$}#(b?e}n+2bkN581>tZ#R%Y)igVR!*m8F|
zjAbSlCCI4YVgn_`23SYb+;^@kbkX6cG?EuRmcVW}j`0>ZIw<hLx@OcTS7vYO7Vifm
zMCSt%<(o_+ZhUH%Y0Y}-Ll4b!6tdRfMxj}f1rylM9~5X$JBlSu?Jl|fGzZ?RZsvLY
zQkbT9=Y1rVv1hKlbw#POSD1V6tK$`po%C>V`OCrKvEH$fSK{`%s9D&0@JZwzLGiKh
z`j%?_&9R4d^a<5Vslgu#`z&DsW$c_D#jKojy^}5IEG!Gp!o1;H<HvWGU|Zj|*xX^!
z^L2}-JW*XLa1bAm$?LEFbbE)N0wj)n-+tDb7(wz%hrSO}QKU;j@O=Sngy343%T5R?
zrwEfNsX!!9=n|j+5i}VoaL9CciOjXRm!)%8D`r`o(X}iw;)N?q1<wrW!^dehtAcOe
zU%}bVTgx`F2qm)dHVMB`f+3)vQYRk1O!ceqNmg0NfAY4_bH-Y?3U81PR|@ghEg|mA
zRU=ZRoTnFxWY<3ri<J<76_$|YWmAL=reWnOzI`dgn?*1OBb;P<O`hgI=l%$GL@?n$
zPI%kDj;-Rzz?_zP-*ga+$mt@%!UPRAZ(xt2XbnLks0Vim|1w|$396%Y9xVeoq*wpg
zVX#fS0m>09(T|h=@xu-m3tar<A^jXZmUILO2^~tTb@8em<KYXKd<MTuvr0t`BvznH
zfFr~@gs_`icJfgAf*|25P-m?bz4(`C4&Gt-#*s(R&qfOqyoD<W;HM!8L)^s#D*zE)
z8a#;qC+}S_Qj;RWY@R3}%!7{OxnJkN4NjoP%_KwP9rVWE<Z!C|;i1blDbs+t5kxc%
zya{l6WlyXQZ7m=m1U$(8hou$a85ZCfUS~{xn_4>!K_$SVvl^wW%h(5pukoKhPC-Wi
z#34(3o-h)y10LiS#Ll6<oiK9n4GmD8p*QGuf{<FlGd8Z&G!gND_vZU3KzJ4l_%2C}
zW%})3rwu&s%8^E5)O>pb!KDx6hput>eG1>v9P@*?P<j!TLXckqc*Z<Oz+r^&vXyis
zJWCx6P$W&Qh5YC>4&R0FJPu;5Hb>AgleUw43|zXyOmI2{6?FG)k8ZI8KG=>?{61kC
z`9a9<)rTB9+>PFV5yE&ffFp93OZ&il^csJtMS%X1D|46M&?NzvOq32|nybjG-lJRk
zZv#b=_IX8^M!PE@9F#${$ihxT=JSY<1n;K=G;<+Jj$8SUH~lT*vQs)jC??24%v=!}
z;r+qB0s!GnyPwTF(wqWSphzLxX9?5T&rVQaqTGKK_+JJ7SAqZa!2fz+B9nhT@V^k^
zUkLFpgaGj9Ukpq@=>KBi|D=fjCUJy}1|*IDCUJ+^=f6qZ5n}w8h4`J;|I0%BuULo~
zEl9aEcX+z_!zPMLEXI#gRT4)^x(?|ijX?4lHFFQCs0HN<x~{*z;iu~ELj(n)s0gIY
zQJ6Y<bl}q?B52?qm=j4e!1{pNRh$S+^N?o~R0He>V{=_9fehgQR8q+u>Lft4wS_>O
z>YK7$6zMeW=?{O<pZLtyn_%53xaP_zIfQH^jQ($r0Z+ZdctpKXnGO=jv!z3-uwSey
zF8VNFlpBFZ&C9nCgGUA05f~>7Ensl&(?R@D2_t-+gkfDcO`LVZWoErSKMLYx<vUCF
z&%v}Du}?*z;NgJ{hjhOnkB4~9A-U(23b-Aam=IaQ(DVR*Wovp@_=`&bZ4+cgF*aQe
z>oUBTQ`SV_55sS)v<im{4c#x(Bd$p)O0)dC(1?!voIa$DT8yNC7;k_&!X2WqhGAUp
zAuCrC4kSgV%YTbN8d-sH=DzIs^`nW%C6l;jL+)YYO5Ge;^LmC^hbN0s>c`8RAB@*(
zYv&9_4~Z%=3c=V9H<^`_!td8#nr#0PX_Vt>e=o{Te0m?PX4rfak}DtK_fOfLQaGyk
z)Yw@QN|EJ?hwNC{qIEB!0K_o%7!Wp`oSgE96(0iCU-b~MSg%<jKCQJk=yFow$}j!7
z^7WLKpUob!oN+ak_TEUT8dvu>K1KX@gKk1-skOZx{?^t%gux*4TX&TIC%QuhcCSgk
zrK*-;wv!jlx|btWBYNl#2F}n5x=8Ua^jqH5@qb{}{i*%UMF?348}c7iD??b)5huF9
z3|@qR2dD};<b6vLI{T2ZqXlJ-{&4dro#00Uu7GjtT@6t>8tk4NN%%KtS6^SQky|58
zg3O<z9l*XV+=k`VWh*69Lap4bu7Kr-ck|cZ9fqwx|46$3)-TxqNWZ}TAiEeuUvIi8
z2Qnz_kd{p&c8zs>grBK=Gb|)__YBkjhw}ZC1V0W4cR`(dBQpP-H_;P^bs;je9uFHq
zhTTA4PeWdNg?30B(XQYuQHbs5R7P;I#u;4Ph-vvNtIVJS<ocC#P5kKY!|6NxGtP2o
z<4&Hv5xNA{H3cxSpdQfe9ei*^r?%e$6e<l99pU18aso|j_BWdLD{w$$T47s9cmL_A
zPAMO$+V`TEmcuGZ$stdhGV)|S^l*Mad6~Fo@b>H};1Zk&BrcMv=&!{6DJ@V|DR_oB
zy8ACv>PdQN$+XEOW?Enjl9`A4M7BZy+5bq-ivi`{D=jNS(5DF?mwAr3zcS&H1wcN}
zDJFf7?*7v<zo{SD<Vr465y4AHaU9m)GPkboAJs5E0xK=xmlGyjqy;>=j$`BBsO4uA
z3=rB}hUKHXfxv#t`9kuM7QVLRh$GaGF4%yf9}l>Xtp9cG$RXN;S1M8MJgl<|f{R}A
z7Jn@^T*!qGjhUQ){=WM^FCMsZ`LOCDC~Di7OVDr?K+uD5FefIBKYF$mVah@x-V;Vy
zPmqf~&tKX5KocN561Ilj-*5V#cYcv^WU}MB@)iUK^+NB^W2!83?;I(oBsh}8#6IdN
zp+GGNxc!2Wh{HCDKk7OEs`8&TsQ*7z`SN=9`#*XC{#5J!aj>&T>diRp5W8-n*_T}7
z-OxlqXQ@x0y03*`%M~T}&lrt=dzt2*RM}Z<&1*gSC33PcvfjSgObjTB<a?m40}O;u
zlfe3W^}YXVl`43CtVTj1`KGZCzi_wri-YevCchK~<Y8<(FIUgTQ3G4~s10=MccV`t
zXxPzlEcx$kj_e!+wX)Dv=rho%vV4BWBS7+Vo#NzbMzV8_Lfj34Wg>u~jh&k%A~>aN
zf>VnA@12s!9Y{+nD&^pdlM#OS_yQuH`w6Ih0)N^cPvc1Nrw$hg{`B2{?@wQ!2#Ab`
zFl*P`zmMelH5y1f!K@S^3SAR)npU6!LpWsseCU`~F`-5|OmO6m5C2xo{U13jvNI68
z@RLfPl@XDY5z6&t$v}}MTFzLH#p#+jUUT4+7@UCT3e@koL=YaqJs>Gc{%eme!VcM6
zljmvxhaE~CjZHD3EKG*p`&%HdWfMX7#()+cEBnL*rfrN6OT5@@{%fD<t^?UlpC@T<
zjAZ^T$<@_W9*YHSvP2<u0v08v1g^cDf`bs|$`1Xg>VL2F-@zWW8}sCIV)yW5S3U?r
zv!7d{y9vLH2SeJY=^!QuFy~PF{(AueOb<dL-T+|g#GwAOz=@Xv99jA@=^l7eV8Nm4
zo&E1s51?!i%3(p^ja@G$qyX4KfNrG)ytfHvbOn695%cwb3qf2#E!T<jG4Ewi$|dw2
zTyZ~1fVAJF2=RvJZ~X)Rqj+OT4^g7qG|k+)u>V?x!Df9i-HRDw_b#XosFEZY1{pi`
z;jG^!%=B@bqrm@GPS?P4;xUF5PYTdfL4do_=H{vd9R~ZK1RQ%zS{{A~P>8Ud7r@jv
zP=Hsc_|`)3u>Zjjgin)|M?ty5=+;SsNfYD%(wKt&Hwxd%fV#M!B-jE0wa^h-1RmrQ
zRH&rvzqY~OD#QRV6iHxx4)|?3@Mih!Y(ei#0ukKYovEHIS^DMWb`oxCSFQ;$$e>|C
zCKqFp!Cqb_$ldRM&OQ%mCam$;YqI7gvE7@ToJy?P>|8G=&IG>rGnD*opyfwM%*12q
zgcbpPYy%Vn`oKo%$G!h-pSTbMgm+&(Mt0Hb(ZtWRJ@@2@c-GUhZwoiKRdJqO5<IS>
zN~q;_NMH*w?#Wt1<}LeF+X}f$lys3NZnN+`RJxfQ3oo^g3b&1wRg-%+e^J6}<epa)
zd_mXJCi~IGwYqmZ(1}$-V}ggwADR}pS?aauRk0gx88UqhwQ8KDi<J8a@8WDZaj<6_
z?z26hUHEh=o}HIN=VL&3zOG`WyA7N6#^Uu8YcuDuJ$I19;O7#Deg?n(+h~CvEFCp9
zB#M-nUM6_bVIXoK{W7seA0A+}79s>q7$J<ei1CVhl^*Nm+g6p>*3<Ro4T!ix?9*qn
z9?<JNCthjfF>&!*v3%+1AR@Y%p4w1uKR<=*37Rr+agkgW{L)cOhD<a45>eO9rg)GD
zDF~Ii1TxF2-!b92q;~?ZW8kpRPub77*lQsX(i`(9cZ3(eX-Hx=cPHiHL8K6pwahy!
z_V-B|KN2CCs#SUu0@c;jrutVWlJnOl8^14p4g6U7@f?u}<>hdue`qhm*!`oHo6<`J
z7ZC?Wa~dKu-R9AdeHtQ?s-gfoQ(OSTcCyOMI~mYpr^L)88#GHk)qpEXiK9hUN`Ev8
z|H*??H&(r_RD^y_)7RjdbL`BcxJ41#K_IJKQeaB1q{Y#PrW80gXD<WMfm;f$$0R1Q
z3y}G%#IPINdkNpquau(4qpAuK0uyBtQ`Pk_0deDl`nzv~LijKeT!LVWw}PU%T04R}
z{twOupH68UB?ppj)`ZzB2ls&%O^-#Z*gUYmO*3he3z#-5U>^6#cNQ32A=~I<-Zz=l
zoBK0wvlxH;sL^12yLmB>MwvdA45dWcI{B-Ig1AFfwXkr8f#phUpRE}7{8BX4u6twY
z3v#s_C)F(D;um+>jP#nOxlD@X<rKr~B$UIx&kWP>;0vH6vs(FumaTKW6G7?kT_0lH
zxSj!!^hZQuXdltaHDWt2hAqs1Dkuc|te_}UU24|?tCgzmT;AReT3xH#{fxBeMQLl#
z4rb*=ap_AdB`bt2ig+{+o=Y$vE{jACDpKzT0u>f(&Q3qzk*D|Dq?o{_6=ld(`;4HL
zUtK?;P70VNr?3FT`+w^4hu`^Gdaaor!N<Kh%FkA>eBL!7c#_ZcRlt)F+O|@%Z0aCR
z*>5xw*L6#e)jq6mz*CpS5Je-NGbdRnhHo&xe`WD(ea<tmG_ARLyVo$pEz`HxvhA*}
z`}#+8N!BLXcu<P-9oG$bp5ZOWT>Wv+V^@9yINr_wG;8Tkk`~WGLuiG(S|Hmi8<c5_
z=B+-@5(VQJCQvZeYyPVtXREW}!+4mf_|Qc_OYA>@2=dIg9dQ$cwCP9-hPjT&u-&Z_
zYy{s6HcAAUR*SOqRgiL#P5ivW2e2LJVRN$TZv`ihTdX{JZPb~m!}3JxNm+iZObnhP
z{&Z)~#0mPGz6VR$nxpG}Z{NO)nAD)4oW3Xd0)#WeKi}AllvdnDV{nt&iv6HT95aQh
zr(X#QkBDIH=$M1Os0O<Q_?<Q!0E)`i-1O<sS3LT3;c!*JfFMEi|6vD5ujkx?EQCpM
zD}wOCM-Y8V=_SaLQGTJ%U|}S83XWu}smC>g<nGr?P;6u4j|W1q2wIih1!{`7A(1aq
ze|$Xlsdi$m@og$LA}Zoiw~y4S%U97a5g#HRH_25b$|)5hl0`c@)C83iX_ZAOi|ykZ
zw}4j;x@3O#lkK!pER<yH)w7najC`>e{;!Xnp;NzbuGbSB@6eIxFROT-C`wKoVS?mp
z_x_F;4Xq=W$RkC^J3f54%JDr}#NTMGt`@h*CM2XA5fORJCPCe@k%c9~Q(X1u&z~-5
zzwRWpqt0pgXMyjSmFZFNL}i7jUzwQ!gFA}~4-WK-H5{sEE`FX3QVtF~Kz2Gdo=-h*
zZ2uJWFgI)?vh7C%-@a=Sx1;?<8(lPb%=ycg!0H>8=%mOGzplOw*)UEB5OH(9|0f&w
z7kR(2I^sAOy_yR=K^MFU5bW^)M$g^X_)fsi_=kJ|D>EiR6dr5$)ISaBd&k9E#I<ax
zV72juvD1F@yg0K?l@mAg%e^z!I=QKnp|a;)6XoQhqU*_;-=ty9hqB21D7BF)rqIu_
zG!^Ae+^S#ui*??SHe@?Z!*|`AGB?=Fwr16ZHq&;X731c~G{M-J#wY8poI<(>Le3A8
z4Zf(v(20Gpzb2pwXDsW@oyQ$C;9NVs+d>CQeNnpJ)+)KFGrJOG3#(B1wO}RRG?nBt
zUq6)f!lUv|Gn+j~dZmWak$sEba;11mU*hl*fpT_>`Jw??kK1WYlX=OicIQ?ob82dG
zYWL*<&!6SN22~2_%b4)bZ%Lm@_{pkgX?zU(AuU5=ADSq^R<yMo^E!5)$uc5xulIJ<
zNePby#@H(yrarzy&jxtx(eBOr=6>A$V$(V4Tz9Rm(=}^^HJ$h=mOe-Sv-b7*hGX(G
zO))RX*G#cwYWPvUML{>UldTEi6JE)P)U5T}#<gA3Pt_s}4u&p&M#hPyeIEJhWzCk@
z`2G|m;W)Ny__tb}DlU8e`h7#@d1-HleU+4!*Gm<K?=HXJ^1^5*BvoxSa1|YdF|lbi
zzw5CTTV&I`&3w$uBa#SNC7%^hTa@(eMWaOHnx?JjsDSOTq?h|F!>Ho^!z*0+OlM;A
z!x&{kWf$Xn(sVz|ry1r<ccz=Ge}+G7)@nkWkT=6+`-|H5s3UY#XFDp8>x<46-Ee)8
zk7<tm2+cY_-bP-$y@)&2axpSD?x{nc-pTc)_$Rlwrc|#ryp3cQTRyiis^1jD!W8M3
zcwJsQKc>Q;Ytv^Wb)2aa;e2d%qylN6fy|!arO-<fpFgi#>Jq|kR4v!*IQSEXkS<~E
zoLJlB`KT?RY^((va0T1m)B7}e?!UeG-Fzk5H_x4UUcez7UGL9K!|xdB-|KjHXSO#h
zX%ZdVhn-J&WniDn1y*>ME{1&}zvbOq3ANo>Zf#1tKYxY3Y7d7!fzYmWvtb+EUkPH@
zsg%0HZp4|P1lwGw(s#UiQ+xea1XF(wF-k%Sub93ks@`kg|I-?toE^<3*PI?QS(yV5
zo6}^|-*ny$Iv#*AGVT2bEV__&M4QRXIhbMqVwgQb3_EB^9XJf)q!atP@p?eOIRYwr
z?!W{QO|{{GmZ-8lks4j<zq!Q`mtg)3Z8T`$kmY=xJpuFiS@g1<4ht7tH{L#>evU7^
z%BE-Q%*UPhO52>X#(S^PL$=rQ`X0O@X-7vH>QA*jMD5Zp=kyw;`OdB-FL!%VF#E<V
zB6>Hd9>4G`g9)?bS@_KKXq}Mv*rc)XDP8z=-CCvi#l@ek!>g6#GHKY{^)aj1!f3On
z%}N8M%HGB&f{by@IgSb%QG4Afp$2MqcQ1UHyZ<uRanC!ZWdJqgc+Q7U<=(GqiX1BA
ztQwDbs!{zpHmtnxW`As6<)ha;6v6QazE&^;twOs}Y}FjvcoKDvD>CS3&{g|aEwH$}
z&`M3H?dW`naMp@<UY0TSvIV_Fl^BH`vL`?oQGB^giurf|$H%F4^oYiW@}1S4oXPGK
zmv@y^e0)8wBH5J{yiA(=_{-=Skhk>$01=b7BlBw59oFG9r+v-)TP78(#eS(0=LOyB
z`Z7S4LR<kuiSWovSaS`#EHm=>kG~uh&?pz+W@#j!Zdrm(k9$wW`ytKNV@I28mwgf^
zI+J}T#VdB+B@dLUmbJh4*}aeR@o7UTXR6GSz)`n*ShZU^V+X%)=(+KVqc)qwdG^aB
z#J-vvD}N<EVYWU5_mnCO6_-#;$8XA%V%6;>pjcGrScGt3OnXie>E$id0oeqvX0xNX
zuRQ4_+A#|y+hx%(!G(yKsQPT=rB>-~H{T;og<L(b!kH}y2vz57HtFMi<){V9e^^!p
zd#9;aX}N4J=ssCC^Sk%b%YVnBcy+aoV`wsc{Jgn-Z1F2R75{^!YQFu^SoV7r>r5aR
zaIiNMSm3_~15e=nFQQIB2#|sJh(;f4mHIvmn1jUK>EJgI;&G6g3Eth{rh#as^iYVA
z$gP&I4~=Pzxp%gm5tvL9Q#R~Wa6n}m)kOMPw_bvJe9vZI)V!m9;%2KTt3f<YYy9;b
ze}uQKz^U>Ckhz4B#I~Y4#iNK!{3B_Q&^*x!m%xlT7plJOAm`^_P#*sMC7K73EZuvy
z8EmOa;g1iDHhf?pMe_B7-D(b{C(ZP&lkU^1cw}TdJUB0=2^$YOXjv^a_dhl}_=M_M
z`9Ym1EQ0-<|BkemcIF(#Gnl^<+(68u65Z#RuPT#VRs3?*aJt5afyjhzqjzcweOm*R
z5qsHee{(R$2NR+pP7J;|CNuEJI=N~DrNi6SZL_m(Cp%+pJ`;bj7C5)-ZP_BinD&r-
z6vd2M-|^;I8frYKT=9YT-f?cJ(sh_@rG=1X7Wq5kT0PG=C@t@cO?b1=8sBcu4{^6d
zCr6edPf`nDvbm^@^_1xmyZrJgkKJ6CKBGfgoar4=Yr#()Vh^r4WYw`|<`EACibvM@
zja6(2eL#M4Aotrz@fJ0-!+ep?udptUy|3g-<u`xMWu{=BILYBhF<2PKoo12pkNo@M
zEdm6j31GB~EHD65KW2Ow?{TK5o`4Ug2DIs*5J@0e$j()Pb(WPB8%gPlsdfj%b!Odk
z5pI5aa!R+71;p8|#A<78(oVYZ=8^g+4IvE=gp1MSMvJ=D@1oGg?VijaIps{=iB6PN
zTGO+d4x5W$B$=x12{M=ecG}ti5mkI!ReDD|n==h-ST5wad4O@j?8O=R{+M|i-GhWj
zi>h|i&CEnZny-c*E1cfGm_=c%5g&V-@x<EXsuz4}{VgF~?6a)62r=?qc%v{>q}Y~`
z`e>O{GgbAATH)%X^X$s}%_p4AUT5$2=89|h<-Dg0kMs7BdyBxO8qTg633O+V*_5!%
zmfg#yf%dc_s9@$Y=igQCd(LDXSFR}mDYn`j<=l>&9}>KIM_wg5E4a}ty^5?ipACPW
z?A0<@Cf{v&K%eB@q74E2Anak<T9a#BF*j-_v*q~2cAu;usMdA^#gdW8wB?OUG`^<F
zEciL~x*Y`6t8Ho@Y2!Qq2Eh2eniLc`?T~I>xE#gIYUaOSM-b$}asbvlx+o)iRZ4L#
z!!N?k_HfqVEUCD-YsN%lJ8m}3?Y8i!ZK)F=Z6!}$$*gSc?dz&`J44l8m2jC$PlMla
z=(?ltdR!j|oOMNb>AOH7qSF2QtqPZ4Nk*_ymwicV%%`l&Y<fB|c?OJ;{_(REcb7(U
zauC};PQg72&p@_jM|3Ma9Jo|LcIUk;PPK9H!R}b*eUfu4!8GLL9N8zAefD1VUG>1Y
zATtwU@<f+I=ws6)dO|C&mpzOGn9IRFODip6M*64Ji7tFnbDs{Y3c|O~Ax_9UKhv)(
z+4&lR^90_v%%X(#5;^%3pA4xs-;<+rJ%&Tg@o%&BJHEYq*fU;Fg=#!FHjD32j(io{
z(7$DT-U^=Sx3jgt%Jhzs5ay%KOW^h7qHl8=`|qVsHhWxm@<TJCo8Txk?~d(Ad0^(w
z-Arwn&1<4Jv6P(Q+{TLQ)XOucpQOsAoe|i?8UXgNMd?4e(QhvZj=eluO5(~@zzXc6
z25d18=Hg)U)acNE7JCF1078;BzR>I}B<JF#h)ZH+NDH4e>H0?o3c=_h3z<Cq>x_Mz
zSR1(1H`b_x&0G;@4PkVAggMcfN<$`!GpVD=TeH(8YuzY;;dH){cFQ*xr7+H{_c#;A
z=}yYp_T?FvS0L;jLOpTDy3-Pcs%%sSB{AI9q*Maivo!FJ*2%xDbUU7Wyc{BrI=$NG
zD`Ni3xCk*#HwVmBRu_|*xXN;gW+qF14II2;ONS|p?0BG=gHE*8b?DM8Ys((8RKCR|
zw=5*llpa|h;&H_dHOLmQKVHYTHaz#xXd+vsWbm5xb?psv$7>VE3weiPIJt~V=6+I;
zqL;+@MrB0=n&oq1J*SuEJ1XkIidN0-vVC}@*=|;((fu5KH~`AFKIsl7OFFm2-mI?_
z;&>c}PQpDjwtehj*Xz)2`CX?wA6IVCZ&E^fRUMOz0=q>n+k^6^<{u<6@nWkD#Pi#)
zvZ)B+66CA6-(=22(G^9SrVnMttvt~!L}Ly~gN?Rmu{nwxVjc&GVV|w<fV859Z#h<(
zh7E7QOpRb!HBQU6j;o|Z=zW|%i&60#?JAOFPgTFTjjGiF8ZPncHVeV%tS(ElnsXiv
zZ5Z#6P)kL6=BcJACA=>;pXOZ2-1NrC#Q9;S`}x)1=8JrH&wD*9AOORiz3+X-mnq(~
zZf6dKz>yn96Q8MjvKzYL;$+3aMvHBUU=Jek^(b~7#PIU2O`@Mzl_zmeEf3V(2Rg@9
zG&yc*%q^}b?45nFv{jT4-)}{xx84!2HXVaNC#yve@pK?<&M#kbhsTHDCpjvLM{120
zd6uI`3`H9KVSbMuAMBqu)0mi?G?SH;jqdM1gHP!pg!y;Z%c%Cd^L)d7a2+%e0-S9*
z%Z?d)H<eMMP221f=f3%k-$*4Q8au^ux0#Uo|260f{>}g$5(-QRD$htL8Q+m0H3ch=
z1cQUVcmF2FQ%upc5Psfwl_e$U<*q_R#A>M;MY`Qem#0wj_^YvE%BCr<+h?i_&0k0f
zFw@4m^L9B_XfC>MpgK+|XVW}}Z|^hns;?KfBI=Iv>8|JZt?7E%)C|(WrcJ>a(*|4h
za75i1bBN9fxb5B@rEYtqkl3}m%M8A(8hr8Fq)L_sUFk0-J~@agd294ThbRQD&bQ23
zjQUaJG*(eLkRJFn3q$Q{N7HRT8mW}A`wtd=&SbD>2wf|8oHf8X)K7;keF3_&Iwa79
z=TJmN->Is|PKfhgXm8#g)NbF$&)tn8;dHPnhEBoK)_QlMjSP3rKuGi*`98G48YOKg
z-|+)rnXUJG#b4m21<3au;J({N%aWFZo_+WkBHcotl9^a@x!9-yb%Z}m9cD@9b|CJC
zh+@?hZH}U3*S#)q&cA)zU}LMf3}$}XCHo|Szd?ui3|S=zeN0S@xWQ3%_RhERYKKil
zZyanRVKSSh%aPP?BTgpOqwFl+R3RPW1X8rAD)eaVFRKmZOUukydjxCE&RkLGHamJh
z6vfcx50=9|)j}sM6`>_<avYX?_mRp3KJ1wFk~Q|*1b*f;@vax~IY<s{e>!$cAW^f%
z^QYzVPVN9m^Co+D>G@t&Ex%8gEKTY2ItPQo6?QF(HF6BN>-l_zoZlg~Q63@uLYM`S
zy>ZLQGKuM#a^qtspPCZL1$I{Xf8a?;$p=Skf#(T4>Yr<YU+2a{3htBE-n}Tv&<FUm
z*RKZUz^rR%z5(Z7u=yz2SfWy-GX<)K{JV@=JkJ!6W@+I~bG2a!J4Vd7C!E7qGm`sy
zIkCY>?lcYztV6pP2I!|xVv6UJMHm6tyEW7|?M}teLrTG44ZkzX3olJM3)wA_OK5-@
zo_w@%)-{*kJa@F+sqSGhtEN`9eHUiCp>GjIHDr0#6fWwn<JFQ(eagGkK0nJq-67LR
z-=>z5&%vWD>pNh;m;e*DW%J23)SL|BvA;;7>$>+y($=7BUT>n;%8lGLDa+UkqnGIH
zpCjqonl*v=)^BqGEUPz}&#P;nrMRGQiuxj?H|UQd-yy(U@rH|W(dm_~2>r-BU)LZ5
z^SAdYvl#(94whtd@w^h&^mOm+Kku{Yw$nmoJ;<`Jg{c<fjE#kPHCPU{q+rU7q0+)-
zw&ul{FSemiQ9IHTebo;5)_&)rw*BA>^NP>m5hTk>C{?Y+<zNBGc^a3J;H!Q)Xs9_^
z#q{Muy4}{BxaG{P5I-NxV_GZ2uE9l&zhpYdb^+DQ<bN>bOOAq9YZU08K=4Wgo(%9<
z#&8*)G;l;D8~R(H8(c@!m7gdFsmEFy8`|?+k~3T*&p_1=Bp=4lf(0(@dNX4=YWx-P
zN(7EVL^|~@h?^|Y7D@j=rQwID6ylV+c&RrCaIu8gtN{4{dwB=sAhdP0rZ!;lWe|ab
zDo_(9%KW1jz>*B&C@UDwWT5|9#gwr<$Aa5x<SY(blWfOaT;=Z-Fr%UNDOb?z_E4$f
zyVw{|>`7kM3@Ch@UbA?9(OWk1XBuKedlBH-*!weWO$S98Vy3Ov-0h>8WXN`CnJ0Yq
zFgHXi&6x>2bqAWMt2*ZM44Mi>2F`71JHYUm9Vnn)ws|JZ&!*n2u$mJ@Et}c3qtx7>
z8P+?-S=GDiECYUX4@!Lvw6YVO^;g<J;B(n|pgu9xU9Mwbgl?@_l#h+Q!qohzb^C_2
zj>saCw^3Hjb}sf4aj|u1n^=qx#O{{L{$3h~nNEms9b&`)C1td488_2sj-?D^!oaz!
zo0sbBj&$qR$1ZvORYms)kp7z=VAH=VefK^hb-`XX^jj(2*{ZEG7sziZM_L*|yS5#A
zhG9(8qoc38#9OY;EdZ`0^NxeNavj6cioRo*$ZNxyqS<jqnKXNNV4cVB<kNP~tF<!3
zWkb<}3bizl_FMxVf3WL3tyJ$L)N$$%FB(C2Oh3zlty0v_k8nIcxxOj{SJW?+AH6<1
zKE}Nq9CbyJdfQIKwauVnt79g3`C!`_5yc+9VKFIbn^0ls;!?OUP-e_;kGamK1&>Bu
z;f&U_MdFWL-FOeDi92=<VoCPcUvv)DS@|&1F2kqqxpLz|1*OA*qmQ*1)z&zTkv;EH
zv{oxkGqYp$f(MRjm)$5g6R_frrOTPPbPOby`h?5(g3;6EnP9gfN{Yy|e^z$F?)|Rp
zT=>6Lc6d()_?~d;$#fL3XFkTNDRAqf)Hi!ezhzgcxl$uHTX+vMHl&L6f^ZI&LRTuK
zdS}#Qy4XN$i&7OU@6Cg@BxE~=WY>oTsLR4_v%Bw(EN{=74LGfRSe;h^N9+t$=q~B*
zWf)hMAW7uM`vsLnD3r9WoAaVu`Q{p2V|S{lI*lbr+LFViB`p1)7oxWIeT_k~g6K#M
zS!Xq_&6%BGJBUG-=3;%)y+d(l#-{Ji{B*{dX~OSGlb4Vr?D2fX&Qnqshb3fZyng<A
ze?LKCw2D#Q<Dl+*=}0AVujkJHAqQRo=q84`2Z0xg=O5XUP>N+X+JkW;P+(7qpVgbg
zPX?3(CeD4?8g~CY?A&Dnvk!#{vc$Sob#8OILOeSPqj}cbE(R8QmQ*2pZK3m186jwZ
z9AVIH@rra~Wtguc$YH(C(OURy)$ZaW)6dQC+T}beU`51l{vw0yQfpvH_kLj+L-aj0
z6TBT!st%}*A+Vo?lf?{|1T|C0TwiPNK7dshd&<0gFue)jj1ot9>N%GQ!}Cqw(yH-S
zPW#i0fq)q)T+)dbYc=*R^H+xSFH%_e{?iMw9`zBXE?wybO|;>hhpls|__HrIb^sOb
z2K_(_YWNHU{^J+eJtXKyUE`clpBIKW_gN{Zd^PiAZTAc6_6>P#Glx-_kwJ1iI63sB
z#H~AIL8<dsS<sKD%gT~`i@ipCTmC#PGe^js@)>(|GM>+Y<9W7$nNQC~*)>stvl(LJ
z7a&?CDgravGoW;+=0E6(;-sP()+<UDRY%2Td2~`=6ZMd$KDZ1{2OJbsAKZ#cua&29
z-E*(MRpHoZfQGv*bNdq+_^Y^bE^|@VQgX)|^80>T5KLlV^CF9gfMTKI+GSV!_P%Z@
zw*E2m&=+&wpaaGH&q``g6lCRDZSz!m)iu(n+8o1revT<j_^bf7k_D1`McDD{rHYMe
znGn9Mr9oLE-_46$&n1u5_;VTE`o5%u;(+ckJ2s|maJKdChtC*AU-LWY!6Ne^D{f_@
zTz~@pqA`E^^JuvITzBDmJ`FevZ=o)`@YY{}DIquejUQ(IZ}>qt3{pUi`#epTs{Jy%
z?q+F{@bx^)?dlVr9(bA%cM)ags{&;^`d_PgGtAcV^9J~Hv{TEUavAGVQ?N0auT8}k
z;?6w!QttEVSs)dRrK+?kDacPiyh#xDyQpL-Qb*D%@(6ZzUZbocTi>uN*$Esvbv7nh
zK`tsN!*4dUcYc?RtuL%BJ{4awU$nUxfqPx}3LNHEx!!P37i^ZEwVHc(N&ibcVl)@I
zI``>2N$Th|30$sqfp?2Bq;GT&o}(vkWZm6l#qYN(jdPlyj`M{|Ocb?v^E`naPLNHm
z%D%!*Q3np}J(CpQd$h{{@bC}iAf6k88!oK{Rp(+Zes_!(F0ncOLj&xglBH9f+tF)J
zG}bb2?IcTw+nEqR+5y}L-?2oVMF?S_hs0In$pPWft$r-elg*c?q>p|{gKMq7%8-M4
z6-3(-jLA`>GaM`HpB=LO77p;oHD-SOx@tX`S^eXI3`w{6B>-mLzhEtr{`;&2J|d*Y
zZ#6Ajfq?}ODs{&L@)l`Fn*Qtw8Djw7rm$#zBpM?)Cv*5cBh#UKSc?W2$);Icf1BU^
zkfCQiixqQMFe+l)s;X;G_orQ4K^(kLr3{Oh?n3eTA#?B{bqH5d&Kyd=rT%)?38z7I
z=-Ny~V!X|s@DqrRZ|1i$))({h1MaowF6}x#G6yMYr%j!QQR}DApC0I@iH$A}vv09i
zUnp#x#Z?Vys%1%DSB{M8*2ubxbM=RN`i@pVg{sa!@*Wu|kUOZdc$+0Ig%Nap1f8x<
za(VJ9A;E3w(8O#t-G)22ygv8ZNVE)Bsh`xyc0dfePj3}6jlV$W?}c0g^z}z!<lg_;
zyn5-XQu}I5Pd4jwNpQrLInv#Z)D|fNEpd^NX?_Xxb<{&;4%e4an~1)65Ca_tO7D9a
zdk3v9{jLMzlNfkC@$<`J8wsVJ;toBCFFtG2%|?p3U{k6Q)?C7gb36TNNl@7rkULd>
zPy2v%c@V1HQz!r5wWt8owpr)q5Rvb5i4K0dO$xxN_Ex3VyV|LZVs)Y(eqI!14}TQ8
zkp5WO)9StC>wp(YbAP4pjGq<LdH16ZT1{vGkk1H-op?J_q`=H6EZw_B#Xg76nemY;
z)JWjz&B1{7mdUv$z7TXi44<=C>aQJB-EGjF*h!y6G<Mp)Qg&W#D!AHldtO_$Z2RQS
z<rZ=_nw_)U@z;bsw5a#@LNc^cJbz+;H1*k6Hg#i$L<J^JuK8dpbBfsvN33@C=4#iz
z*7blb-U#zHEIFO<<$RBkY&u2(iC?g`-ow7It6CNCE7&NVx8%7XzzbN3gpRe*qk1kr
zKgH@I3(?q*A2+Sr^E2*cO64zy_$Yn)#50OrHWnH_R%7fhp!xU-*7I2zH#g-$5@Uwt
z?7JQp4Bh#wic7TaNoP?TC*j(_`e2|EOkJ{Uj~GI_dPDbL*87s7@MG6!`#lO)G41z`
zO^$mnuh`f!LG~K^9Va)o#QAnq%cyenL!d37NYC$BNAr)UbxQCzaADSn5xN1=tewMN
zg<e$7FV#Q$n>oRP5ZZXD_|uRamHAHkV@L-gdLI9DLe<9BCGL9y0Z`mRDXdW4L8eI?
zLiZwW@jz#^D*R`M*@JvQVYc(L4+Yd=;|55hEnuhSPHItDwO)&?$L{yOAWv?09*h){
z#GzLiJ8SFne#8yoDv{gogE+&PxvXv0k>iuxv)l8N?AZAJ(kcTjo_#oD9~Fe&D5qLf
z5B`>WngF2JGge)02{qc%p9_k<Ou?Dt;RGKpb$Z|DL3O`lF38%uwAucQg{AK6LPF73
zd1W`n+`q9*gg<WZ&D?$k$m*h>ttM}E8<qQx(*k$vU%H<;ln4X-e&1G;j&6pS@YV+u
z#DU?AgBl`gue~}Jo&LEuFATIznGc1aR^7VwGqf4#Q>^ZTZkz1iefAfu9K$a`wCDve
z`(Xq!=Oc74u*$5VN82n#ZFg&aIpZB^XZ8AzQ(4AkrP?$i$7)2}7sJV!x%Om~L90|O
zs0w<w+INO_O|4SmXK=aht#fPJcnp&wO)uJAgjVpW&dCv<vIPmJ1}p5eKP-ZiZqO6S
z3ra?l2ld8x#CP2~by$o`gVBDDi1~ZE<xd~J-)G85eM7osk^361AD0IVoFu+EijzgX
z&iCfa39h}xlT<LV-A!*qwr2j#PzfhX$-r4j|I*?1_mBdb>;~$;Fg}N*XTuTNxg&BK
zut9GW4!ty^>x_t54_HQ|b~_#H-BWRkfOWbph-++4#yJXOpu+d`lwiO3D&*f?iJhg}
z_3|wRTsu{jTarS5wQPi%dYbFNJC`RLK}e}WiG@K{yzY9{>ImZobu*@flg}@2$I}<%
z5{Gn*O;nIu_c7x1zefe=Ndvv&7adBNyWTRdYHUA0PMfSJ8yQ!ic(+gJf3wANqU|fc
zXZNjEVszZxL6v|<M7_Mi!sjAxf9=4?R^Q1JHC%1-o)*9%xv5sJWj<TxJf7k99P0VA
zkeQIT;Ty=;kL;cnbD!@)k;W^HlxUJpy^RL2JF0%3?;=HwCi<w-$s+Ad!JzfEGZ+oJ
z61?WH%_DSbqMR@SL|DqfND?}j?p6V0rG9-Zmby49rH8An5ZdG8Ka5oLlPHiO;0<#u
zMOa;}d}G0!Tbj$gWk@^VSJMDDDpgp|vuy3=>R2la)7>%E2V4OQs6h8w(`6oX+jnOi
zVBpolM|`NEL}ZM~UE~9Z4*4Vs^JmB26<MM&V}BU)mgrh8W$SYg<+V8C8y@!LG!D30
znq%rXcs3JcKM}*N(E_mQMGE3lUdV8+tAvo-PO+uUi8GhO9u{@t8B;)mz@xGphZeOR
zevSmWzW4TGWn(d{ss<6D{~BF=Y^{Fp<=V(EXQM@1jhq{!@1ZhlQ^*woj#RO@E!pM#
zB+>C%J-%$&Y9A=lL9LDUiWb)A@ee~6-J&|RPdchN%l%t8hdDHl>6)@Mo;6kE$xq7U
zgdkpVE#ev$mMoWAx3b3RyrGbMy}S0e`;0Nl@%)t<KhID^8G3Iv{WQ;+OcNLp5Up~v
zVRl4pKlmsid=Z@M>+~Qh?jgac{l)1$_;}Poda+zphX-6>xIt*b!#=-I2de1b%LNs{
zVlq2|yQ6k50%tp(AZ>c)pzVzz_W5p%YRdJkLfjI}yYHwf&>j!f*uFc#QS%!T;}(7z
zxD=*7%66W2)cXvaP%>Zbe5uYx(g4m*R`9w#@9>R8=S#dI8_|^y-&w}RQj2gnCE(<f
z!0wb=>alkthq$sS@4zdeWgY0ztBcqNGR=cV&(kF7ml>3m=(6w3uRKI~OVtI6Bb&6t
z&&PW-^wt_nyk%iY9{PM9CX$erH4vXo#<R@55r=~0qlD6Z@lwyPxTw1=qrUm{eEHt#
zyV*@!b;@kdWZr(tl0gJ6DfYCC5fqKO|LhETL<-5#w<H;Lf#>Q~iL1~nH*8|T>5Y{o
zw$#fnY$4k}8jn}Zr(~EluJsVXxm>?rtKQSG(Sk=z?Gsu*5|aD27q<5CVqA;*X`{I?
z&~o_P5s8k%vMEcj`&N3ib)upn1#@O?h!ZX|Z<rN@2u&b}z3%(zBhKDWh-)0+cjgI8
z{r=);-e~-$mfgw<9DtX3dgNvHEg5qAlp%t-&Ey@C-U|b<<{On~{BMsI$un0x>E96Y
zvKy&XT=HM|2KKPb(Twgh_7bk&v}{WZ$BV9H(h9i`cP%Xqy^@W6Z~vShCTJe-!+r3L
zBMpZIn@2tw!B(DT`$hDNVUie}n~A-`5vyq{AUlHi()lYQD9u!C8O1-?B9*&$euY2C
z@&nb4N&8mNsQCi0fUWbdhA<h*ve?;CuU0;QPo~}I7^bk4>s2Qy*nRy#>;teIUOG2D
zusrA<n|<QU?jmE}S9LbZhKz(h3v2i^R=bZ4=}^>~uTBwTFM#!)h#7BL1mt0~vGC?a
zH(pzJ<>@;GOCV42u*+#qQ;&P+XYZaU7nYAwY%HWNc~6zJ<Au4IXlMx<jLcR*OYF*u
zA8Nwf;p3dZbfMCxI$kX3OXDizN@Vn>@1MZ((RnMl(LRC*gh68)5|jzm*d7gxRh~m>
z+wAG5Kuz+R*)9aB6n|laAbd8wbPv#81O8(LPnY}UsE@Diz9fr;o{4SDc1vIa&CJw&
z@T7T^Kj0=+A7XtUs6ljQGa2UHJVY6W+&%HHA68G!^;SQUMy{u7up9Tz&pQG7ST=hl
zuk!0QM!B9!VCZBa8!PBGQWo<JEq3U*IW!GN-~xTb4|dr{*%;lvJJr<(W8aLIH5FXf
z-lgrc0h>#1_IOA%oPi_B8`h=(<_V)YxjEyHGVi<rp>5wxA*>?%o7ul7FIbxi1))jX
z;#M&52UdqGd3BnlKSj0^%GF@W=1H!VA6R%(?&yq{FsoMao4vcvcJGt?gg0$*lUR5N
z|Ad6MakfS-=n<8Vfk%up(hF2;2aY$#TjEJDf%(6ZLhBl0$vg3+I2>=r_TI6{$kQ33
z{)_n!9?FJqd%k_I70#IKbfKLB;)hG(HfpvW$xMD~gBk9;ln0c_2`nrbFb~k+dV1X?
z$3Z_&c<K!5iY94Y^DyTzgo9fi$SG7)`hr6%%{M{o*<@vQNzu8uCDEj@)6jeZL+R|T
zoymH>&)%-3OZz+MiJnTX^>13E1=tT;-T(2Wfqq&H8kf1DJXrCNUVpVLv&L2_wDL4m
zD#1bgdn0q?CD21nwKia$l;%17k|tRDn#c`|1%9k2EgntCrO@Jo#nQ=!B@J-@x|4Ht
z12Xe`G0&inix3&v+?IF;Re`&f`HFfIYEW$Rkm8VBLgy6H!A)t`2w4Vtf-3wD6jTF;
zO_HaXni|APxT3ExHBEYAR{(5-dViOL+V0DtzR&hQxyHB5fCQDA4c;)!51tXZ+|94G
z>L_46yc3{^LTBVhdHK`H3OY#g#*CD1@wZ(Gx$>E5+cZhP(XxowRs%+u!TnuIqOsvj
zmtO8(hyI(|WXP`V$GwxzYWWJ*@K=Gwvfkqvajs@R)VZL3Sq|uZ@9C{e<aCQYqhg_=
zY^VcqG<Kjwdo!F_W;ki_XO$tJhWpY8=okFmCgxiz=C%`jci!jaD&|+2ad?a(4bILR
zaO%pBHY2}~`@Av>qGV&$-k9a|I7@Q_w>I6nvukXV-EG^`y1f@d2@3-?M;xu~^1-pr
zicz;ZkI3q6NgHDgjO7rDk}J~GL&DByYb$s;&B^CFyp#@pm3{ZT!L|oA#bA>7sw>Pl
z3*XB9WD`a|0}|?nUhNI%i4yHbO<(Uvc6M!Ln=sJriLQ>nO=#tf9TI_yGA0d{H1X68
z6wOR_Ig?Ko!BN=RVbCg9v0rC9RcH}Xlmv@I{>+J_$ms*!Nq&ioc?}%#{83eo754}o
zLCM!@?py=CD<3G|%o0{<{neOERBM`G5|<#QZ|HvZRpXpe(Y!4!-)}K7zZJf3h(k-q
zZBHl+l)8Gnv5YC%bupJ~+%Gfanre=TkUFs@uc1+#2)vN?sPGLlSE^xD##zLtstkO0
z_hsnBg!9_&UTu24_s{B~RNe3Eyg&30maT<6w=-w`o}$_h3e(qW76q<iMmEQa3h`s6
znD1BjYbjZ8KN<DwP#4(<rk9XS-{TQ6o9J-%1SSpEfYOVE>uv)wp{4GWc3`8#!3}t@
z7y83UnX%7pissm6_sZ`}I}*B8exFzO@fhDK1Gk58yCMJ0spB}O7Qu;Ksz}t84KCKN
z;()C?PbYrE_vDDx*^QBTF4@oWxbM>@i*86b@QzQmjBqxcT)OERMS4uLouz4)Sr+Ji
zt_XOr;g5+9gW`X0=KSufS~)L=oRH9v=ohIE24bAl{Dx5S?~^4cS1z#L(XVn+wbnxv
zXI@zQf}Jq~;X1h;KHy}Nqh_9_nB@||B^*jC=uy{&e)fHriG_)2443(eRnptOCny!<
z%7shYs&S>3Raty-)a<Y8_$GoLq1QB1?W&1g*jE$nM4<+LgGGjIOw1&AUy!~kWz#f@
zk}rPHIF7Y6?`oVNK;*7lfoC%vPE@B_IcKS6zPbE9BwEZ;sj-vswOP;V_n7*wFZIN6
z-h#!aOGj+ZDPfzyX73#n%w~0oD6{#tTmj|tOQVLY+6@PzP^k)mLi~PC;Zy6O8`^$&
z;EbC{yUMr%C!;P8R6mKe8>}?!M!8b3>Zr)YvR?1W(Q3P-=UzA#$7}iUMEH4HVRmMv
zn~wsCacNSxLbVhFs<%O{JJ+_47xt1flTWU6Jc)>pxS<I;<vQer;6nwvn+rqB&YZfR
z$}Jao(&SF^M8)viRNMABMm%9wdi3;Zu_c)%t7h2Ghe1}eqj^bSlTKT6UCO^{bAV*(
z866x}hPY<D!ZzJ+wKNUYGY4m4o9gk9mj6^)&Q6)UnHS&mM&y-6T+U#Sufs|;!zYET
zOQ1yF>xyen_9bDeorL9C7_{Lr+#15A4i-MC2f@=j<DqeS&RLgg%~~>NkRuf{Z)44y
z-SPg-iCKZ{ceTc+=izhq2<WIfyeU0Tgnj*TKU+3GtlDqfaYhThCD9tuVVq$cL8-%4
z>=J+2L83HNbdk>(bk}J*$Z)tfmoD;5#;p4{dhdjjr0!19`Q(rP`ZCdp&7MbAtC!)j
z^?i%Hm;5KGaNetG=)SqlJoL!5v|7ubQPw;MRV>NXr1ka9zdZ1<X`^D^Tg}mZqc%PV
zy*X&vqPlY>!OF~E&%EG)<XUJW9+}P#m%i-I)Z-p&)WcmH3#W#VU5$PP{6WC^z~NI6
zIHp+BqSf&B>C+j$y$rN~<M~wk?n+Ga(2IjDF5;R!D+2f)X99U3V(zQmU!dJ#4%yCR
zGKIbd_B-wD8w%}#6vWq-CV87}KcPI}FH;c*%|krnpTi?0jC)Z;+~BNO>F9TB(`Q1j
zcHyiR9^g#tXq&s5X(3v4VykOIg+8r20lPly$@-~oyvqtCL}O=sz+#vY>Guwg2%EWn
z7AP2EKIHA)mv+?D)Y6(Mo<G>{LCjTr(iVVD9#r{o{^}EQoob{sYF)!5UPDDAaD@kM
z$i~LT&UAhM&-)wC^P@x@sp4&Qz-qsc!A{8(GDwDEwrj$4XRawSVA^WRKL9Mjc@rZ|
z5KgRQ=CK-AO7_T#pqQCV`g{<VcJ_lnS40%JD(MLpPLRR9?$G=d>=GpM^z@M~R<3Vs
zMsh<EqY~M34hF)^0}xQG-0Y>=)Ca4dbREVt$Mq-*&rNk@`q4oTQq~bNj~_?07?vxL
z(FyI~7m`SxUhdfnSa$GAp`2Abarv@}%H>qq*c+PnthH2*fAQ!>As_FWa_OktBf1!U
z>-Hy|3m1>4k_)Fq8u8<?{1y?4`~#SQf!2jKff>&T40O5L1GW3}P9&G3`RG?O-M#Nz
zgDaK-Vus03r+1rri<~(()se47h&=0;kS@)>%3c&atUPKKsQqUT9`qXyGD2o1Bq5tN
zR4;uPkDDAH3p4&Po(Lg!64Vx0cdf#AWK8W|(-tOIy{0VUU6<ex>9to8J2k%?6D7Fy
zGg3Xxw+btdKtbo-sdx{x7WZf9y;X#Zx%L`fOGe&@kli)K|0I!zXcgIE3ggz7T)xzw
zp06O1fo#5sK6xPka$N4hsZ@yQ){uFj^^j6%cPl4^WM}6kWWo7uJB0W`fTYT41_%j-
z!1H^Ae?g8jK!{FB9({Z!Es0*fb}`_&7Cr1FD=UQgn$WEY2j7D31K_h_@KxTQy5Z{b
zwvo|E9M9n_mmPemhnwr3?-;T6y}v!2y7)GBBnF0eLYd0lIc~zYIPc)ELq;pS!2LYu
zwZScIqmhgUBFD#kZl0>4k5$pRD+!T?kOjS@&6j0>ytXy}&Isq4@n=L=uUE#j?4d_u
z=X$a$Z)*EwjD2E;)AC5(QZCOw9?Vs}Bc1GBacAjM1#g<v<7a*CJiNS2!orn5jO(B@
zHMfZb8O82@`t<qcjT_&FQmkiA1e%c6*a*)}XM6MorRhb>rL`%c&j}J2P}ZiO215rY
z4G~|5WTd7yTVk)st#v#xS|vL{)DPXy)^EniuuB`GE(9R;Zryzb<a7b-G+lG=eyij^
zqy~QF<E3`&uFUbVk1-ANUwtkHXtw{#yp7xTSC%yhS5~jy{X#hf^Dl#nrNhrL8}Ukc
zc`SZ(`+rz_>!>QX?tgT%*$9XtAs~X%A*rBriF7KRf>P4Gkp>G<Lb^c-k?z>EqI5_}
zcWk;l?|Q)V-uL~!-`^eM-f{mpW1O?k=Go6$YtGO7%+H)_EsA@SHvAExi#!VXh>7t(
z*-_F4%-d3OtqVQ<Ng+Sq>=UIE`fP<z!;TJn2x3<VeF%LXInL@B|G}vvz2o%$E6Tc2
z33YfVJG7kSvHx_TdxJL0s?=tfCdDQ`ySg7`<bE)juHMm~wsQ0M_jD)F3RvT<V-p4?
z#&`}NSN_urkR;O1FgHopIJ4to_P%1FV9<)o{J5l$&b*B6%s%b-u+gB<NHes^GtVZ$
zWVx?C?aAvyowM3MCv;o2`pX{rC2}UHgTsO$RB!QpSMx(bhwTA-ZPcR6%83ShM`(q!
zrJ#XJ)jWK`&Hw1uvtUYLM#tJyC5_|Ftm8_P%0IQUgYBuF!&}DlvnQ!4zb@10SZ^r^
z4#4wUgzkwbxgl$`ViU*e*l~n;CvfWKv{l;>Z~~lLa4Ebx-BPAzG7&E}^=~+JnVGm7
z1>ISW*pKoIaO%EnZT(Q7fnitz&@GipXeRofCY~*QVdCv5B@YrGbyAm6Atiwl&g1*D
zWg@5IbDm{wS%|(li#r+SN=ZM4r%N|d(scdsisvvJ6o~xlCrjP)foY#T;~k+PCyz<{
z+Vw@>66K=OtcX^_Hb59wj;@BkkJw(uE1M$z7#J8LB%Nq%YGR(Adt*RX>gq~*b<NHf
zGvlQok8}otM)L=m&4Qdl$#4JA!89{JF`F-thbDv(zrRDo4MPxs^~TK4#xcK+fiO&w
zAz~sxINZWt;J15|nwBnDUpd^h7uJbxVzsS73+25T$6k$RBmO#)rHJ0T_B86yd8u3>
zZ|(OJhvj`-w7ce2Dtcnu8)%2qHE*8gz_7LMF;%p|iR~2^SCP}-qun{Grv_Q=(fqn!
zYq{$WJU#T{*%HoT{+M*uoN!rf2bv_`M7nyTtfzJuhS;=E!-Vz+xJ`D|rxmNsJ~%D@
z79p6;S7_TL@WGqNjLZHwoT&S%B$2`nVc5#1P4pIqxI%B33Iq6=H5=9EeI!)*n8*jy
z{zM$M>)QMq1HvOQ2#>CFeh16;4-oyuq}jiC)C!tA@w262x4Auht}KnKeiXDkr9GI~
z%99I7`Kitjg{=A<sFtht@VU|RVr99Gc4t1x-Umy(&6aDPEKJI2;q!UOlUqZ1erh=?
z&8RKA?_YRKTASOQYlK``)NS1NwL#l$p^*JJz3ltouog)k5&6!hPsB`HMtR34oUUs<
zC=rsW-3_BuOFyK|kw?i3RMo-cvdVPzY1?a+yj^pfPIn@o;Zh5l{vb;F5(~AcZ{K9t
zr7UzRj<?n{To-bJXWvkm{=#1BD|sCN>>yJ;C%ZsXwAK%wiiE+2H(RqY1?JKC=3e)4
zKtsoGOJ1u;&9Q@@)=HUUoWjVmpTB<cb$TDq!nI2a?HmPn5^rN@wcG!Qe&%2r_6{U+
zIe`g@A$Nw6jLq`4-n2*87?0F6Z(>Km;CJD6cAAta2NKkJSQD<}>`|jf`0p$19HN88
zo<FbZ&D7R^w_V*kJ+tb)ZGLdt7}0?=yKl}$RdWz3pX3iDjI6VkC`&2)O1%aHZXJOg
z^6V0nQTI!7uFrY9ZfmC}Tuy3V-W-h>U6b?M%{?1n<$$@z&ZMs?N4?uw6o`vpfRRxR
z>+89M7PT1IukS|h_R={#8|Jwkx8*oR7-Dd>>dalb|C!Ex(MN~K6>364<jR|Ko2hM)
zHp3CCOGX3``G_V|K1Qw%rhiOU>}6|NYa;g4yql5>oP1W(UFsbG<O#3?_3je<f4Vp|
zK_X)N_>>T1Al~v}FzmP~fw%bpotVRLe`oNld9jwaoc`O)D23EjXF?Zwy3c=lrhCRh
z)x9fh0yZbYDQ16cb=)D2UmW({X765H{<^te{WghUCATMN)O|McC~-T3;1|}!E9F-j
z55wz(W`>4G8nQIe_gzmGuuB{zk1}}WiGBLg6-0S=kmg7?x?or3vkAuoQ}few%}T+<
za+lC}cVv%BXBNNpSWT-5n~NZ<GyXI{O(wvl;mOqc1J&CO6sjwCg^qI2C5|7x_O+jS
z4Xcyxs>5m~7r%hrTx7v)rry;9Id4`~3(P6+f{27uhoP&7*i91SyIiMS9a~Gm=68V0
zTs^z$pIf;`nzXa*iZ^qhImUd9-7pf9ETSTQE5qEp+p{iW2o;s&sy39+KXj*+RHj~T
zRXx=9d%=srV6L4Fba6i(+JlyamA>MNZY<2BHL$-)yS?L6Z}0sBn`Q^?!+Pb-`4bnp
z;M}MeC#^(2>M39&Tg#Xy_RMOA@(WL!%Gpcij!JmwC7txXPe0%MI50LfZuy***Mnr!
zu;y5D&Ts;8!Mr!W#%i=wH8O91kU#2Gid3M*=B%Hstg-Q=K?n)DrPCkfEn?B1&EZ+$
z{3*6COMod8eTfodVB~=*k^o#ZfxFKN%fgn->x^b!<c!RDc>{u#(y102$b{MegtqJ5
zn!EHrL51MA@<j;P*}^wgHo%$~0<XxM<S8?(sL{T%SrAro%N1|#(A#B{&ANlXbt%Kl
z*tGfmhKnpxDd-RS6!dz1?BG1WEth;vic`lPmvl#YR1^jF&#Vm5g;Bk1S>n%l2Mh!R
z^f0`k>vGL!?q}R(M5`&_acGj}v-I&ld@kY~d~(D-1|Bm?Xr;2T+sZY^rH*FPQ;qG@
zx#1$C0&WyimS&6?`$L4UjX#l5V3I1Fo^;On6Z!JDfg_l1U<`O<g_4^iekj6Dr{dO3
zT6gu;_}<{eJ4+dn4^(c~?haOX`UO;cS*LR46uPI*Q8D3R_KsEagu_K>-CL)$wKkFA
zUctS>iAsje0Y}cLmj=}vBdvL@WCotoLTDT5XFD~582hjL(`9?OW6M9a%XEGkDA$VG
z6T+>_+^9LhHfj2{RN{p-RajZr9&?r>wAJmj(wpylB7s}~E7&jT<x^6xv)8*w`+KMt
z?p{jb)7TQ8S7gpsqhxw|C}?1QQq9o}fJ<FM920`RNMUNK&I6t+%==NVYWq16hG+ZW
zP(-k{U10SB8RdljM?ip99fukgmx3?V_Cps#YeivruUmd5mM}_Q!Ks*Mdm}7;W-)G!
z{ays9B(}QuoOa&1Or;<~ix+jqri-L+K7HNX5tuDt(5q2l&^<OAX5AN5iWhnO?N=s<
z0QW^xLax+gSGIDLaMm1rF+MJfX$di6GVb|vt3za^Q?!53M(Zq5Cm^CWCxl8f2U(+0
zIm$@IKSx|T1z#^w{n{ePDU$q)&+Yh4K+UXIRI~-th_<arx@>o5d%SHe8ACBC<tkzV
znWNj(JIqx6Q^1u)5-4_Tjmq&3b4a(8LyorYZf@iKt1ji+{y`r?wQYshx;dD5HNmzN
z23;3=eqNMiUvh?8hFSsQ<DF~5)7h$BDMCn?2E~!*W^KBjgkuRZe7VYIniP%SOIBvh
z(3hp&^))tb$*%A*#j0I2Xc4^&&qry{7unMg*udAb);t*j%~9ijgG2wbv4y=qfZ4eL
zh3~gb$tT|3-IHM5pf9XvbHlx4>xk^Br@U!<!rF1oyb_38w<3M%^17ZYxi1o;@~uw|
zp6lO3zM@|lTsroe$#0chS=2pd<^bJ|UFx?h+&^fl1(N!#x$fhh6Vd{T-Yiz`v1rD7
z_wF&wg@Rpa^^F1j$ji51YICB@TH0;UZJqv_Y4;^lS|V7Q_Mbc=^ih0rl@S92N6Xho
z6u!>nSQC+2jh*e&Y!q~=2iUprR2l|E<UbRM!SGpZF1`Mbj0PeS2+)>h_xmxn$LC~t
zer6Vt+()W=T~BO8A8M7<Zgr8}$0&O#$}nSUV$zzl#8c5eJyn`BThrWcjt-|kZV^lh
zf8jp7-_@N{k2Q4kmj&|74Js-}ncZgF<{nGnm##TB&9DgqPVbe%D7T^Sw&r@wpj~VJ
zk*DFR=Cufn>dU-^?km;GlCs|u5ff#JaV!>ov#*Sfa)py6CX=OKSCq_@Fs-=|8l_hs
zgs^FctiAnaWVn{=aH9UGxIa^gcl_w3|M(+C??a3XgY-ywk0P8p7lj+F`W!Y{?bhg3
zPp*xcAIdEpe4xK2*di$)d+f-f%fWT4ez0Omv9S&iVUTCFwa{kL0H3=0U4}pu=OqB_
z`D7xiEK;-PB~IZLO8dI^_M!0}KMzh4!WvsAPCZLv0;-V7%L5T-nu>Jq@WW-N^CF0u
zlx5exYnodpdTx6yyxe%pU}~TT^E&=gnWmeL|J2017&hWE&#bt}ZoN1D%AaHutGswL
zP+b>cm?vlcLCWlYCg-CgXK5IZ<b!Agg4z%Zeu`7K<|Uwve@nyyOX0TTHX2G(2|2Hx
zuUZ6Hwa50{H~u|AJ?Dkg;AS45*Y5--FiA*!JZ~*ebCNYFh>DKdt-ANzM`_6x%Y9|{
zidKY)RGJgJ&V3&)Hn$lrk!B<#bT$L|`Ok)#wb1yG7=}lAm5P^ks*4o>jD#QeVRKqO
zw?!g@^n^E_$||;wFXztRD>k@B?*2<`B?lstua#>vtG%{!<7TTIJG!5CMn5nRIkR}?
z&u76jL7peX5kg2f#1GcS;;A~Trb7oSlXO9O=gPYvNtaj+>%C=B=IJ$-V|qJ-{`)JK
zpyGD}gYPcu$8YZlaCk9Z?!HRvSXt#4_Y*7Xp=kLmGTIWqp6zPTikDZFQKEgi!zL@@
zruHtd=85~-Uw;20&%k@{(ZNKRc1OSSQg7%W_gHvDmRFSEZRTUYA3*D+j~Ml!7q`dQ
z4~$9-an!xPcR8~QzAib6{bIUQs4}M5*2ODhORHvzY_LN3Eal$R^px?!apy>B!b!Wz
zU`0X_ao%N}j=)R1tF&ebT{kew<Cp5z0sK1S?9;)rykB?dZ@-=~Mr&bf-HFMpRS;bY
zkg9;VS)_po42TK};OMLYW2|Qa|CK9ayaoVHf#^m&+s3H_*cYlfo^U7Y^musfim8&f
z6bpTW;Pkigh>^qJ+ziiS6=530Y&BcU5WIe`mrj*Ne>C27eoN8nSzzd2wYQ)b47an-
zc-gmDJ6mA>Hc{T5S#k-v{8N_v!G=hV>;@{L#Awq|)i!F*?Eas_SV<U1tbuvu8L2|W
ziyH00L9YFqYa(BU*M7;v@<0+o2Xn91dU3-8KFJ7UeWhG|_;mdtSF#O!Pk|C$um;NT
zCT;t=CCDBF4;AFHLa5o(*j0}_v32&F^Lfr^O>ge(S=hG6ZoKn286{G@Y%`MY>#?ac
zY4Dh2MOP1|v7+W~i%*ATxTE<vYWwzbd%n%^ap4SW*;-Z{D&4@{z(r5sQli*%kN6Qj
zi*FK=k^<O0j+kQ`!IHj7%wTU3NPW2>f4MBV8IrQuzQ<~E_Pzd@R70f`5%HAC@i&?w
zgTp117Y)q4F;)Yb^jF}#EIzGNa_s-6$9izL#PKnQapLa@^eL{ApTE7xSj<E|W_KG{
zL1yS?ecg?;NI|qNQ?Bvce<C=HteE#OSIZ0P<<EJiCZk~I@7)0oN~#=t7YZ9Gc_fJP
zJifsm1%FodEdYu&tEX97u0t5*TawnZ9dQj78zTG1tT7L2x5o#)w->`yP%2nvN815c
z$U#P?GamfZT?HHo#TRv_KDV~Ix5RF%oHb3kENI9TIFf<4*8Fs;nQ=?xN~K);mxGu<
z1_729*QYt1rzy4@7Arl>;OGsICciEly3uR~pJaxy;yBjoGFI;0a;l7|>HIWr$mjd>
z4PS<O(Yq_v%PM)#(Q|WhovqSxI&P=ZbOE)<;^QLoqHHZx%fVp_4W{wtn<c&H8NsUa
zz3Gn=t1UMX+U3Tm>=QGi4A0B(Xh~Q{TT3X1r=Q!eCjFFd#Kf!8<M??gir+z?h7@ut
zELa)v1)`^XpG|1_0K@r;I41ESA>Fw<KWxHka`H9jnOw7{4trbz$BCQM<`IB8s|=Gz
zg&+aO0T_+%OM6f9zu68x+|BFkJuDm3iJ;;-iBDKCWte@Lh}QGoz4VhLwLA?;_p`V(
z)*0`$$}<p45^QfgP&;&5`DU#*dnW-T+Uguh)f?F$yz}>{h!XD!i6|y|eYV>hB&j{U
zqg;EKyH&-6@lvdlBl#r>WnPt_Dk+DqHcO$))0YxTSx?$spIYO)9F+f1+z|2J;`a~!
z=$t4R5z0cxIHGS6U!Zv<{0q1<5#3G=YXof@WNTFu=BRMDn(=S`6-V9o?w+p=W>MjL
z3mjiN5}*#ukc<0MOA$YI2+V8LS55l;W*n$Q-4ahp&~KT(wn&o28_>?21dFhbpGBWt
z%iPjQp!3evPcLyj3^__w_1m>ce@2R-rMQ~BidoFRyE-O$xVt<@Qt^R=MXrcD?qy$O
z60xSjQYk&E%Dy9JY~@t1xMvmQBVnAiJ0HBeq&zE~!yP+CiX=qO^(2w$bWA9++!Kd!
z)a@_D?i5<hu8FAL;x7*d8fPooOUmiD_sJqPI&rl3(-IjxpD=>{67&bt5PUU;%KSI5
zaTA`4fQH=a`F0#*ICZy%N+R8vNNh4A!{S)$^J*Uz78c1XT5RrU$_Fd0CVc1?cpD27
zdj6OSWwCCeBVZ90^&Y2ktK^WJ+_}}$;rQnrw52lKZey!w>{uo;yJ@_)WAsTROlT<w
zP0zt&022ZHQEJRdIl~?(OPrclmeUeyfx0Bo_htT`;~}>S&AqXMKVRylXJhYNLj{si
zP|y{PyFC>woA*naoh=i!H_u8nd9e3ty45zarIH(6Ui?I*Bs6R1Hcp*eGgdAYBp^&^
zkcFHu60E}W$9-@NZ^Db_I-&p<Y+dn)Y(LX`es;8!o_v**O^+p5_$YK(WZYvT1kls2
z6@G5qI#0i#P@_g=KD6tv315dL#s1i@jFSR{bcl)6>Z92({_%r1FP7IaRI*G@4faVy
zw?};FU`KC~8lZWNM+98=QLoAoM7FxLYRJjyoTlG+=@>xSt9!FIXGKx9es~_`6-X{3
zW<l{1q<lP8*@!og9zX`PvfA}7^8bQ7L!Aphvg&Yf1K}&C^X064h7Kw;^3CDNudKBW
zr?}oh#keN!Yh!Z`O8zO{wj*qQ!MCG|X>0c$!!6X*Qj4s=;npE5^=mxPSpETRN#0#X
z^>Zr@{bwYr&zEFjHQS+hCM{P}iV18zkKeW(*=T2cG;L@NmhWRZ*lB8N3;ohhvYE(#
zVxI9SdO|2FGLfd<wmhYmk2mP%+$L^)A`-@79rfaY&ycg$iin=wJWwXj@<ct<KRVt$
zc+aM_nW8BwCLNUUiOTDsKCATpWpKkWs47h4@JMaOz~K3vP4kbH5T~Ps`VC6V$4#$a
znSV?0?!&KJ4Vsyu<1+kNPLzI=*NQr+N_9UtaO!FsJxm#eex|+CnACAcBSTMC#M8C{
zw0LMKspmK3e<$^!_>;x{`p_wCAbMT}<Gi*|+Tg|@53*`4NPe|IN(U!>l5Ev%?hrnz
zinRhNtZxMrdP)>tAV9kPm!QS^p3}Aes4_fc_>A5Q1~NK(NdIeBR+vjodCmy`vusk$
z6}ZQ*t1fb;8XEouxs?|AdSjLAJ^rns+8<jozc9kGe##Foyxhc8ZZ6e#zt01RbZL%G
zQ@xAA?;%dT)1s=)pruum<U{X+)sIBCNM=2j)Z}6VqV1xPhp(fk!YtHT1P!v1`as~g
z<1DOD?O9c9IjSPKCJW<`XBJ7Z$Bfy1F)0Kx(vP{VE0w!Vso05|Zi+p>J<dU_y^JL$
z1Q43&Uj!@&2S>*=^ei0%`=~Q^^{@@<;k&ELnie<d@)DQ@ktnY!-}D40Om-L**pPf^
z@MQnmlHXdjzMKBgpfx^~2bcU)z}i;y&_OG+%^7<i+P_|B=%4N^S(-sbjejD1ge`X_
zA}pR({58((F4ja4S#c!zXQN5%yksGreIF{<Jbooc4T8@@(zE@n>{IvG(u-e!e!BVp
zp~ADN0n>OW>b4@Ap;z#VbUa}qLrDaZt-Pd+%qo|cDaoA_o7;yjziRWejV*m`1AcW+
zB!Sg{O>2rcEIH7YN>r)>`69i#&$d@0O3NR2Bbk0K8NXo+({H9hkjmK{Eelfuf@<g3
zON}MR{ib{5?n|$2(E57C>d6H}L3lxAR4COBtM13{o}JU2&4-G*BMq_qC*&EQZsa96
zGQmLkEk&isP2G%Qr%3e0NKP_heX8-dm$30N31+JvReIky#<i;T_kZU80$BKab+s#+
zMo+yP=^Q40KO1#UH97z}p%jc`oTO>q1pKS1?;9dta0-$FC_%)vhMU#wiJGg`KFu&^
zcGZwAmJCk6U85W>qdP?S0z<30?Uwu1?sv9GQ(|)Oc4l*X4M(&zi-d&4^#kcIS!~%#
zR~E;m-JGf=bmIFImU-fqM@n?Pv`}(miBI-7C|wk8az47WeKl<})-?A!k<XEHt%MGb
zXnj`I4uo^=ZzH83oYTWWsK7KZPf#`~Y=_U(WBygEYr6(C5^&`yIE#=+Q#ktSf8{`R
z%zpvxx~I|fJ}qo--XlbzW|hSnjzZz1o*yTKhJ-9|WhBEhEx7HL>C3`wMw4TNkjj&*
z#ZowR>AcxYKwJ*y8GFSb+OmC3r2lGr7%UquirkYhA1y@jG#K@ag{x<sA<28d=Qmj~
zwEXL^8kh6PT91<29sP;P2`8@?M7-3qYm2Rwff(M(PB|-Q6it+K|I_rZX|3wKqpIRV
z)vhBE-RZj0QTssmNT-UXWsgnBEjhB71leiIAje5K?BpP>Q%=t+d$&gLA#`Nb=2-Dr
z&(LwHX|>Sdk0pl1EpHd)a30C%OyxF8?gfl=AHCxnzq39DR8Bb@JnN(4T4@h<>W>Zb
zrSpLWfKz(=B#mnUk3S0h1baxoJ{YxSJajhJC6)aoCD!A?RyCK|dVhtt@sDtK{UNsK
z2ahsO_v~?31+aBs8b(1C&kC(ZYf^r$YZ~0svZ<-Db203j=;Iv^3l`-(AX7DA@ETt!
z%g4*_C?S7=QSKJe(p{;GouOIzwV%7!5i<z3{9x>pt=0npjoz;l(p=o)B4pf*FavH4
z20L&xCFm-sp)=28JGGCX6!z-2rZpw;*~&8@ldm31ch!dpL(*5?MmGTnTw;#_!NA7i
ze*L#5`)?TfN=dA9OBYlbqnfiYJVBMQZc4C$L%SgJjgxDC`*f=6(N@VuKaiAyg?RM=
z*(li)Fc{JJs^?u&dXy*d><x^Pg#3=<SlrjZu$Tyjq;_3q(c@!3X8-$wOpUA@Sb<f9
zJ`n-#TLY}|Dyy}_F3r+KwH)`}@xs@gHLpgty1VooW+oNAZS{_{1?Qdt5hk@q65X2b
zC7kv&;m3GMd076^pUgY9LPwukDR-9znYq!PtgPPpbXOPqkRNJ)%^LK5Pxu$#;n<2T
zvy1WITe5uO(HHddniA?^Cdt-|5!^bt>l&816OS#Y`dmy~Y`t@$!h7$poJ`S{2^6@G
zV;mqCl#~C&w^Zsck#^@vGno$_E98uSP|uoO=x^Ee@z8<Y=K&|v1Eq@w&!5_t#s@}u
zBUj?;6<=_ObaQ#!*B9UYt}Zi`jXFGvd7TlQGT&>K|L5z&>Wa<5qn_4f;wu>YjS*Rp
zh#el?nBRKTYE7Ky;%cyRLukhzZL)Ap)D=NNMaHBo>XuY&-P2;Ed$XL0KnA1yfIKkO
zJ$*M+YbNisD&zHeEyK3yomX5L=Q4}u;*9rkD{9>11H#HqmY6oh*zxSR_SMsJQQ2JW
zo$Bv&1RYk0S2VD!c;$G7kYB7`&LTLhUeQlr_;WjW7z0+KByAvz%NGDaKPwNm=?8+q
zzn98<?fwSUIlZejm+PXO*XW5GuJngKp`Ck=>msY;Hfj3EjK_wWQ^YMw{)a_7rJ$F}
zCcQEXJ)?}1ni?)O00fr#sI{7Tp3^z&%9&EXq@4@`z+cA@+fp!%&CNDYj~<AAVJj{$
z%uKUevM0*kb((fosjFnGHonA%b#?TD8NEEh^8fIGjZnEyUAB4^-vyp;!HXU>w=o*^
zSR*d9>=a>F>q<ziR{WXpY1P_b2n#CS{6jH)V9UJXa72g?(X%6idm2HvL?<bCyg7wv
ztUIh1>@O(`oqcFKLlzW`mZao{FEs?P6?OiTj`KK*x=Jf$Y1dElWq$vwnJif8mMO8v
z2-BUpyEGP3c}Mn-c^T}k3Vu$gacF|Y2u)THwL9LzPlp}Pxl^HvIfwFH_Bb4RN{l2{
z0@}VL`4GbGq)a0f+?R}^Wc8d*QQZg0KWam_P2RcL)Dil4(olkf<kYii#|;F2^B>H#
zIhmidn|+Cq`DA*Fn2^RyGn<8-RWpLp@6n$GKH4~?+b&)Pe+s^KlBjU=oTa!`c#A6Y
zB=V7_l5;D#65vF_^ga#mv3is3bje5tyE6u{2KOcy#ZH2Fu4glAW(ehkHUQL$?*7N3
zpI0>|W&bH=lb#o|&y&6DgT)quE#tEX{i1fVc2f`NQeFD-Z-;TPe7ea13kIb5-Oif!
z^W|HWdoApf(X|5q^aAV&FW4(dQXo`e8q+-AbmgCVE#Hnx2$7FlUjt4ko#;KfvH+>-
z+v!x{<pa@NTk3IBBqZ*(p7Z2o6u+HnQ>ztfPBT?Z3?9h1Nqud7nTA_erYET4=8P);
zS!LtB&wt=DthD0EAW^$BqL%SA=R;#`hV%Anx}!-4ue@+++Qap82?pD{?_P30;9b>H
zl8<l@0b-_7U+JlYS@`++Rf?pXpH%KgI#UWbX_Z=yPaZSBi=Kaxp_BIEzPXmcb0JV=
zHpG3SZ3ud9-Wu<WQy6aq*UGgos?Q!fc7%e>AB&7>P=>C>yZULNe7oDXyXyIAdpGe}
zc4R+K9^SwR+G&vvt-f>YM-WscB-`AKlq<Bg9;N<xZJEPSsqBF*dstl3lKt2qzTdLE
za>P}ppyqB&cVmrijbP8qHv?=&^lSvPB6{E3pPl_tWD4d#$S7Y8+Au2($JQ-%P8@Pr
zeB-3e)won(e!~s%iXFx(Zh1DyR+~3UO&&wueYkAez43!*_Hu3&)W|Ta<8=vg^vAD&
zn|%C#tZ_aYJK~g=cr(h60+>AW)&2GsUl*t%wSa0;@6at_FL9}H2XB9`1WpT9RU1kM
zpi?q*WGG5LbvvR%S^PFp$?Guh*s?r3&|LLij35Ffk$MaCGv{w5yoPP`=>EbWOQ|cN
z7}XW!0oB(1w_}d$RBvyw4o!S5(3BaM=j>`&6+I+PIwZTlI(R@E<D`Ge<d-=;Gz{dr
z89Eyy_3Tf~dx{krI`;+ZbL`?`BRP`1OCHx~<)^lxm~r>N-{Gwo#nsw4ItVV=?EISJ
zQ2*_VPW;l^ONm`71ti7ZD;{){HE&QT)DDAIPpYJHe_~ptvM>9mXpS@Vn#ftEgl@_0
z)pGM}rx*Q045I23>M6;77Ve|!uhU%0f^7OjEVB4Sc3K1rf3-82EwYd%Tw#Kkg4KR9
z?Pq&nV}VAp^dMgm!nwf!W4*Z;`Rl~bWWPb~oNn6&Jj!uK$2!l1;U9SKWX=rq)E+)|
z5FVjF3Y)gAekVJ+k4SoCCC^WznWM*6*`qSD>xo)n;7UDR5NQ++58>#~K79Iz($RY>
z6W$;x(Go0tNj8BGsECM(uG;Xb=AisR<6)mCL?)fyb`Cq8A58|oSBrGU;D34eSqNds
z9eSq|QXR-O5sskuC|d!@sV#j>F8@;@!ZEwxfs`Gr$;%_XxurR}JW)CivRc9EMkYH$
zS3@Hc39nPjeYMuB4FaNK^R9m7?EFU9L-PLj55td#CV%jBmwV}_GrNmf@0QXvui#gk
z1g1+&0AG=<cXN(!-@VO8&+4s92MR?MUtQhm-5l&Id5EaUSeJNg2uq0VK}|GQ%h|He
zDfeSrwiPIP$j96RT|1A55{Jd7ri~Joq-7huvq!1ZRaBe<71JjGp#{~5F$*L5B#5X5
z1mFY46HR<q1;%qZ;yh}m%*Sze^y?qW#<BDzgsF06hN@t?f`qs)zT3fJ=EvKj*%unk
zelRyILlR!5PMYedc9&Hiz2nE5Yb}YdXNw0yy{mOd)14cG`HV<KP4#;9IdarH4|c~J
zgJr0At>Mi{1K$B#v|_V7CtXICV)vmrJq78(ZWQ&&fA^rw(SJrCu*38D!9_a|0wZG2
z<JRZ?8yhEJv&AyDP=z=Q{!A9At!%9~HDrHDNbtF&vJdDVzB7nwe&tySk2SK#c=_v#
z=M*!~^YC^?=PBY;8@=RGU7Lqt?CDA}Q4Ef9Z3X49s)Jtp!KBs0s7w}{(R~TDQVmw+
zIw?XRB8<Hq?X5?<dN$-7>AQ2YvdWuQP+nwcBQIMRIY6Fn)Gol4>P75dTIprnm9pd=
z#antj-Cd@+a%t1%$fjejx8s|c*G@<(dhv*Lz=!n1gcmUwE5#RinDDhvgg${e7+uh~
z_T_<z8NB*3KHk%4|IX{3F+?#wTfr@&IPm{vbp%0(ZJ}C87=B}fm=cu12!Urw!FH?U
zUOWL?m3&&S3WM4PoRI;{aQBb9?16Qurs$SYvm~^~N>gjtyDd|`+Dn_vEU>JQ#dg=)
z-pTOCN5`(WjO|VsIjk$#6PV5toknxY%3(r>Q4EFKb+^k3=&X2Lv-{q1RoFX5ZK-OU
z(I+uk_l;!{kTXym23~g$G5F0sRIA&NqoYHc8=9fHcbh{!*{IkNVD$Z1-V}*p{ixtb
znYht|(=Cd#P%@qq5}BEw9892ZqTyBl7K|KYVBjXfRjA}#3*P^P;fBshi07lMr){Kg
z0%lRT%=g*G#E^fi;%<;nBDxIx=>`)K;9$OwL7y+kJLH!792_NKrFzY>H{b;8Vn8Wi
zc#edN?%ZGtBxV&zM=i|ULpd!}`6v&PVU!zk8MvSnhSV~?w6E0PI%^U3KAGauGyo}m
zP+sW@{p$}+zbu1pMS8W?{+SZ#%B&7BS7F9ola&v_BkSOZc=CE*;-H|>(As6vb0MR9
zwNjg5h;x-ktRq*g@8GnfH>~?vR}==i1NI#tofVto|GLIq<GLID!^kfo4~ih&?6Clb
zEtY}p@b{bl63(JSE=FpaO%LG@HNngCP7_}PlYq~0Kyk8h0{1^5euRS>T{J0AK=%;8
zT`^;pSFvN!NcEgqUQyO{683b5LeH^#TEVc9N+hOhx+kx-jVRMv)H6|br<g3z#<Vh2
z=~>6j-ti^C$$V?YY-q{A4L{-%uK&<dK`mRvFKlE~^S4%W=h>hloz{<We<CX|H^Op;
zEi11@mCEP$zy18h96$(#?oBX6Oa_?fsATH%Nz?J}TuEYZ!1{fjXUR~5E2x@~YY%QV
zzPqKPkzOdVszVx0Uwbo#8EAR5w9C)SGV%zY7Y$4Lt1o))l!z6woIbeAT`1LC_~xmx
zfn_#EAsA&9)8okHk2uT1(mKG?A*-i0ybYC5Xkl^bUQkz}kJ#M{?&4T|FESX|ktagR
z5yX{c@Ts4t|099#jQ%7hlEL3~@QKg%pUf?fJvCM0O&k=r5!j;4xOs~X8K<}@F=J<1
zVI^eWhN4@WZ)i_dPI%XGBTo4i8ABVXD5#YwvZ_UzjB@si=ZJc#xv?L$FcgDH#2UC~
z7cMbO7hllr=r|LQC(=E|!mlO!W3j2(QKlZneI?_-$1Tvrt+GQWJ6C>Az}5Z@q>>sf
zWuP$}J|iY%t*sq29_)D69jCaa45?H*U>OlJ-h_<%E}h-{yzF4SlUVEGcnWQg*ENMu
zAoNY@==65aj7_c4VPKbW1c3IM=qNG!?`8KV$p{Ck9vGXRPY?i)@C)F)%Zdwm*Msv3
z(si8mlK~y9G+?VV?!PMY+@J8_yu8BFtCsdPf3`+!MIz{8$kU{B2AqA0v-L`Px8xEP
zo0}tV-m~xE$>1OCb~<fj7+NCq$+PHHOEh;ZAhiS(4CTC|%u%p|Qz!Raslp?G`HAYS
zUoNmQ?ibm}RV|IL#d>#Du@^%1GbI|E4qK&OFeQ$yr&k@XjlcWJ_}&%L^mXwr4C$IJ
zNB4s>+gtH|q23XQHqdzh;zJtoK(S*jrHGfDWxkN?Oi`dO%{wTwTurVBbNg81hoG#|
zxeG9X;3lFa)O!@SR;KRD6HQYv#`84Z=lwZuWK%-_`G@|TgS1Cb(Q4Dd{A9jFGlD<-
zr@2@Fr^@Rg*@8h?NKtzFsP%aH=a1V*c{yc|$N@!>b+I02O|@{!<|(cm{Qw4QAwBJ<
zQ`$3?t1!k{@2xZMk<&2hd2nN8B(eB9%5Kuiwr6j^23^-hWKt$L%sx=5YO`;RY81JT
z!ww<fANfwq88O^C_RNn8Y{y5qX328!T%9`)Sr~rGDmaA~G!sL}DE6MHsjVYKHDkeH
z|K*2|$64L3tGprBjqtD=a67|t(qNs)5#8g8oWsZx%)6DC*y*MLaIm()V%k$SU5;4e
zmF{_lr80Hjvnc5PX*vI#bOA4iu06!iFEF2n5&YR5id{!(82%Aa7&Vad>42e9`F06?
zLx`*m$P4r~jTdmSGf8*EpM?x>^x2en?^So-`AJF{gF<aCg}hFFGl-X&z(}T^$FLC+
z!f_Hv;G;gGIgAX|vER^H79!+dT2h`-Lq@i~1X*%|<)098GM6YB-I_O9LFRFPT8b$8
z`D%kdz7NmA%>C104TxO=Y3IFcskkEp2HcQ?(1}iP9(_K^I5}yY*c^!bR#vyRg~af~
zVcA?1E;fmJk1N;DJ~o)jpYw@H#fhyz*Fv^Cc4yZ>xI8|*qj>7<Qq2*qs4a+z?bQ%)
z9$h_f!x{HU$$Um}zgx`7)XnOOO8t}E*KuPAciIyA2s@@>LEdP0ZZwoZO9EC7;xPO;
zl~5c2L*UXN!`EU&jMNBHX9{X|7Io(ak;sTU>|||Df*r!_9bvk$iCGD)NWRojmm+$8
zZhiMW9fj=dRbjp1E{%kBklwGTI28U0NiQDzLDz7bri+kpN(t`{%L3_&svaycqFDXU
zZNVubUV$GR?W}4cJnEKBF(fRgcvT{&R$J2#p>cgrXjpW3b|^AR20a$bo%Ff-^L4UU
z+|$&8o5%ZJPWu~mpB%Zq`^ESPYTKgF#fDt$4lHZ=>mC=6^f^H1!!dU9YT`CU?Pv_K
z;dXVu1u)&|&LSD%mD}vdYXk$@#J3;|;U{9=#O^b}txZc{jpiq^<Nx#N%RgaxUFKXD
zGYr-;ho+U9?Hp_TW`E#Er4snmr-jY{C%ysd;RDQ}KXDPhf8$KY@1t(j1eLtX=_QUR
zKsO&0tGXPcR7_WgRFW6|g67cC*yXyKnO$_3@xoa>yiETCUR}*kb?dxC*8(=ta?K?T
zp!ogKN2cw%^)wqfET~M=j~cjNjd0sIINnQ5YkG@kb|hdj6bCkc<QHIdZ^8I~gZ}n>
z%SR!T?SbtPFCeh|5m9G*Bsq2@xIRb&!w$07-n8wqbpF0aA)3UxK~X9@l871V!lG{d
zjJ&*=5UOp7F%vYk66?N2$YyEEbLqs>wEJCk>d<Mfmc%kd!tvie=aT-1v3&p=6OKtS
zq8~tYnYvgInh1SzP@9kFEfEt0cdqw<@b(H+HuzqABbUJjEMTJc@F~rM=Tq@?-xA!G
zI!`|Lb|LX8b5`J1sj&FjriiGs6WymH#ihLkJD2NNb{~14F;cDW_cI_ry8s^er{Kk-
zY&>YBJz%6az(_Z@S$NDf1(hwB22z!tC(=t%#0j3$%{MH*VKKDs%7Zgv7Kz7>KN-*H
zE4>yUeclAdeO<eM)cYe|t)#)4ex;J}oF)+}W&PSRoR^grkV^s_eK>#Ml79dtwR5Mn
zwm1yQgi(ZNH~%L#2Kv9ygeF{|%VZ5p(>3skkNY`!Ikt+92Fu_N&SnJ;<v`;D)8iN*
z@0Ew+RpNh&jK~turD|;nkHj;rSV3i+sjJX%wYaX@nZ7GNoa<4M*6KlD&LEHD#B*nb
z*(&qjLH!ar-P`{8;W=la;6MZ`S@VZSM=fn_WI!r!Yb@fPMbBV5EG;I{3-hK+ESJBR
z85EeXSUJf7gdfe|Se3ejiW$<^TH(qL3S<hB-CGMB)*slKFUGk91?M|Uu0E7(fSM}!
zU$n1Yq$i(`P9<H=*yT^v(YvEZh)r9=7BMwo?^ke{amzcx_9{lPZs77=!BdjEh{3*h
zfiMVi7rSVVOWhEQoA8Blm%F0$jEn%kroh!Tfa2=`&y2!DUfKz*L*H_j^}AV;kkbQF
zt+oRy)Jg`u7DIiek+RMQy>dHb2Ho{h^#KY%-7qw5JB}Eps=G_WuH=qOxEsj+h+;b}
zY-<Dl(P^zm*Lp27{N0{eYK!mo{owF$pQ@wHdpeb)=6AYl0!D-{vHdZ0Jj<e=6fHPJ
z&zx{Ar@yUv_qn<m_$`Gl^?y*-H{c4{i8{5+a@evG9LYzyxt8s!veWv@HwN(p^8Yt?
zd{Z8|$rXLU{Ap8WNo)7yplrUQb{S6j^`lSmU&V~(uWnAjDbNGq>*p|N8uB~R9+eqF
ztrwR}8i3V^gR@)gnAKa|923TJi>`d@ABcIWl=$doN5UlOkH}L^c@N_nSQV$R`j97Y
zmYP=W?oF1RDdGh5384?Gq+}}~73Irtq2=_oc){IB<aIJ1>9azKNO0(Y=Ci#kH(BMT
z)cn#%gFSD(_#2KZ{|U!=G%su&pm0no(}`&emj7=~`URW|JFqY3I&`9$;Btz#lj%OI
zX11p&qY%ZVg@`DQ5qzONPUf}W*Y`Qmuxw)kBnJNUk1&Y5K`0o2Gw<s45k@J6=c9I>
z;DNjZ^bY&YiuV|TaEs4l-vD|g+myhMERz)O9ycTns@%33)Oh`SZn$&iv6LGwGn8R5
z%w$eWAS2^Xc9_y$>ADO?s5}t(<2pu#p|#_^^@_tmdsJ#jOHfr=&QCIJ4Ni%JQT{D8
zZpBU}#dVdz+(1*MBwFjBaxFrqjOk39J<sMT+VaM~!Qua%e~EnqOTkm4vWh(GOC6`(
z%yV073fz-<`T?yxa@Q+T0!mZ}DiBsAM5#kd%5!U{x*rg29CcrG4NUPbSQdyR=OHsE
zpR0)wf=Ss6x7YhWxc${B;@PODk4pZO<(|r#GFY>BxjU~-s<3j59e5?aSAErP&o>gJ
z;?$_;jb+F{bmlo2F@#@bQOByu5lZ5>i@GI90AF9L_LEI0M_5;V7xiMTz0I%1I7u3j
z*)lViGlRNnX}py&Z8MCY;a&0VfRqwAh)QXC{C1(keLQd(a9x9j+<&k4fSha5QQo6b
zs+n2;L${g5<_0C7^C*!mR%aS!L8U}od6-Ha*M3l9xCa)z^aq^!FW8IC6Q5%}-}aKy
zB?thv!Gr=#F0z>?rUyUw5Z-<lOiB}E@i8je$Ye>E@)M_iQq)Oj1cR1G_m_01Ty1Ih
z+G3<~sSRfe1#kb*0qCz6TPvwmbNiE<_iH4=O^)N~_S<1MEOD6EMpY13)g<}QOS$=#
z3S*m$B}v)V+MU}h_JkoFJl<5Iw4RaeoL#4bJY=m+Qi=&{6sV$n6S6{CV$c9ude`kX
zH68GE%!?fDVm4ZaN4+DCvxaWpa?UCsrarf0R)YM&)Wra@gzh}mQxh^nR<#7mzhVEG
z<V7_sUk6T)2}L){^W}cZNqX~A5^&}97;aiXk!--HbGg@wh(Xp&%`aRKO8j=nS7Sv&
z_xQ0&Ua0%W+mAFom;kf?T<!d<q-Um8$y0CW1`Vt~ATUhyNN=(bZ(UuKGjbMtFEZK;
zRKP9n6%>}{Ephx@vmR%@mVHw4a~~vcUJLvZi@%sG(3GyOD&DKu3`1`92|MJ6Al?S%
zd`ZM^g2?v8I*Nm94f6{kHtAu4zYP59QAc@noivTo<EG1q_Ym0ET}D{(WE_9rdR{j8
z0Apa3qfU;1gYScvEtbR#&V`}-_@HplecNg^mP-%{^}ZKE#J3VjJxqvb!9obYQfmRV
z4L{4_oe39lht-{H#a3Cfe;mFm@JB{0gk}-x^6u5j4fmB!q*|2mva2utZ2UNMP`VGw
zgxSx%JnXM6IOyoJAFmc)H?Orr`fq@3l35Q$s>&;!1alHwUs^CtX`Y_wYEUUg&f`=%
zWoT>KShxkLefWSh-y529-ux+=r9Y->eY(J_5*C|uY*tcL;i|8d%bCRl`rei=|NeLB
z<-+w#Rnqid_Z?wv+J4_d1?lnMn?o8gU8r*!)P_Z}X?sawIPMZPFsmYd7Yq&#4A$#d
zQ=IU864FcjfAey2zl*^CMb*IcGBlSm=O!VQ%k-QaQcw*)zX6aZo(Qa?DeCSr@%vKg
zrcw;ekD(rY_dHwOT&+&17&dE81BzxR9XZzh{hq+>fXaJN(tkHf|6g#<l>{;-Ih#{d
zKS2fo`K;=xd$-DrIB)W1HG4;tzhb9-gNh&`>E0P#b6fk)9iG5Pub~BZ2Hfv|f?cV~
zYVLQX4PH*pvs&89v&=o9#?2~&{GpB(aZ2nHv99YxW|)p+Rb)<^pX>{>3VHA__HSe-
zpu33d?@3}7puyh-m&|~W_E6sct}nIW1C0H=owF7Liqi;i@0HA2E}485X*=9EA{tl)
z4g~&_Q`#>Uw*>YgO4Tg|xJ7_mZC!KHX1(i@<e50qy{tz@SoWeGQYTZ}86gd8oJS6(
zQDEx4%s|%vE$3=F@^+2kBwLj0CGhd<-uM1tRPI+oKm0=Ovs=ex1AT(yXwtITo=@(+
z_Bm~$Kzn$%7Z@*;dHBB7h$~T%1Q;;(zhOY;`~$5pud^_3Jg~9B;Fc>sI;f7RaqQWD
zILH22ky2OLH<+FW_5_?pi{=@&AuHPz2Pi^7i~#>43_MD&X}b=wzYySs^?EQKhXR7u
zV}xmEg6*knBv*YJt5?`~|LL>?vb%(iUL<!$`m>)^r~)NW@F0b290!*GT>cA^$s*2$
zoIt1MDNYmj7TGeo{vi2J(jDeZX6l(Neb1lIN@zr83wvqRfCJ5H2C5ZL=Y{pcbc4-I
z<UV3?%l`y-PUPP|P$udCIapT}`RyXB=*JJe7Vl{dXJ|Qp6Wzl^<5yrc0$r;WXg($V
zm|j}cS;36%0V~#+CAyo!W=TvbareUje=Hjf<?fj+X<wSj$)OlY)O0-_aeR-o*;mFh
zG1>I8O&6;qfOKuE?;t6a0@Hg*0@?`y8kPVAWvPAN(UfH4ILqt@yA($B{Niu=!L0PK
z-h-?_>zz+KBgvSj1}$wBnGXpCy<uxM0km%un#<_K3y1p3$x3`4fWa}((1tT@Ed)Ci
z{0lRTO3+?~l>JN+xjd!`A8LA7o%V3_$0%;AA4>`_OH%+#R$nddMit_)EenY0Xyh(h
zB}<ISdT0N}vTCe*0!|clwi0kv;LsOP)}$<QvCt^^5U-1hy`QJ0?XbBSk2-Y)S3agC
zvN$esCiXvh$17AnXj<=|(mj2Y*Oth#wFS8r)%u82-+wz-t_sN90FI<zS+<*@fl>G+
zftF352%KXk*zgJunxl?z7pEX&)Mo{mKBIeF3%`$3r=deX1HlI5PrMgK)UK~;iVZ%Z
zete!fVV0D>*TqMOE5gRgo&DHO7I?vZ5{~kC80D0tgpb7QX27=;pHhEKCwwfpc{*T}
z&;0Bj1CwrS`&l_60T6=^LzBCYr7CnCMwPOdsGg4K3-0ZVB{)pmwtmrjQ}^{$Q}%5W
zGg?qTsx6{DJ*b{3;G7Zb{TCxPoMur6g=3FBgB_g}SiD1fLW82uc}r@xIG_nXT@ste
zK_XIHdNwnzLO%g#1B271p7|?B-4*>iI0H>nD5OvmTnw%t_r10fLR=Phy3qe%vuDja
zLiRFf{3j)<7q9yXjSO6Lr17dQ%UZDc^Pyt=8gJ5BL3~T|pP?(}b`@1lrwkpzC!WVi
zeVd1oI~*qz3~J%FmAhddo^%Zzx#S#Zi;SVjyUz%}5#6F&;-r}L*y&5W#WlG{Wk@^+
z9v;Y^|KD-aK7wWCFl&sH1BRZ<)c4r}U#nLJ6}vh)2p~a+BOxK7$>qAs^1k~YVOD99
z;<*?2h~ap_g}_!p6R=efhJb_YAMChzZ27T#R*YH=F@YNA2vZzJy3xM@J5C6%QXBFE
z%Z_AqZDOJ%CY)@e;pWwBO*5Iz+|=*K=ot0I3!2uB0e2+b<NuV%7)Zn_x5Uz?-$B(T
z6Sh@zA~fTABf&?oMk@HB&=$mEOG*D1Y*W9CF~Aoo0p($j89|mu3IrU8sKem@=lq11
zn+Tjh8y_0W0d?y%O9#8Yy@oNss&N06Pa25xx|t)-;;eGYUml<u3GRH-td=bv-^41M
z(<<auG{^MKhsrQk<~#ojAcU8}?Q$QjoGyI=Xps8UJ<6UqzU<fn2BU__N<37fhRPcl
zS%7@ePp+gh(Ei|n^zvoGjyxXsQ_GSb+wb0&aRp(zCeJ=GU5tX->2JCruw(KSn(=@O
zm2<|8R)e4TZV{}?#68qwqg^ElhX(ZderzDfM}SF?4<96w<$13h9&^iGF6GS!lR5YM
ztdDYaOBB3>9exw($q>O!pe8t^=e(;ADBN0IJts-jY7ooOyknbNtF%D|=5-#L*KFC(
zS3u`pjU<C177oThZ0noszg*Fjaiaai$i^m@Z*%kPrP`=GknT~*ZRhId1b7r34BN(;
zkbfT0#sWKAZ?!lu*%=qv0%bCC@>|pdyTCl_Yko$`=RX2Rpyb&+;;*$(G!K9Lkk%T>
zA0I<gsiNHSVdi9Wv$n=SlpQ<d4LjK1Gcce6viSe?l>r&tU<5O4_zc(_DTheLKf1+h
zA6}?AcJhg3A(%nx2~IFW2t)6Ff)hoFx&Zikx+7T&Xt{NIQt00;#0OaqB1ud_?alpM
z18IR$OLou`sWFEDt<)~ZMo-qmo=aR<7xXglMQC%#e==_MmbfKApzN#sp*R3(BX2({
zFJ5?%?>aS@GCH{3%idTv=$D}SAV?p_A4qr;6W$Gj#e)_yXy@$$c?=`%&x;IGikgK>
zJok3DGT1#((i?QqEt7?r1FZtM9low17xO==uICwUx!eNk^y|3^{$qCg%COSm6(YiC
zWR;4Zfdp}*96WJ~y+?~#hn=pq+RIt$cSHV~9SlAPG>+2^urd3tt$5p&bNvSn6fNNF
zh95uHeP=Qx#dx_lhPk;BZ~OY14<Ym_2%owb#hWdkYDVP(v(L9|z~0i*gJ20QbRc^{
z;*usflA|Z<eQ^$h3e&x_+Mh3s9GT9GB99sDxa5sHWkX(P(4J9toN?a31``;*qvs8{
z+w?g!iGzo*t68c14WVzCFoe$+6-C-~8KNUl?U9BVMt00lm_Fq&ri17eg|*Ydyt&Z2
zvP155I#|@Y0Fte6B_yR<R;HyRVw0e{_(Z-w2R+CS5T776X}6<S3mV2;tUoc;ceaeb
z{fK!!@D|4PC2**LxBkRgl0VF9M6TEI1W>IY(GakLc)*WJ9~a1yoPYIvll+J%EzA$C
zL(K}=Nh0tAzfZ8`ruK;CHm5t~zuj3l&^eFl4zg~?$v9cP+M>&DIeNL*<LWTK-nE%{
zX&SQHyP(%DpXLTG5d6jJY{AI9=$vprL!~9GiL)Jtu|IZDGzG^dAt+sGc{w+~ybk(`
zQz!5_qFb_a2Xfp~$Z^>ufQgF#VpNCT15nhLM86%ut{2KgOW*UF`%AzhD8=D+raB*H
z=8WAl@1WTgsJU2llBbDU66*fklI3#gx)vIipt|b#?0j^`40ck}m$<eI<>jxYpfAPW
z@;S-53>EiTL7ktcbkQx>!1uaOV*;zgLu(^P`twvXi(ua)tf^4nx0MvUSE*ZWE##+A
zq1O;x=37U~!jthg&G-@KlL(#mvaW|`j0FuG++RLH0GcQF<02AUR%;VA?xPuaz9bLO
z(Y7Q={M&x5SrIZuV1Hs_oERlXYwE9$<Z@#B<gT7?8`83soCi!p3+m@D=<9bpxf~7~
zNq(mYE?Pl{8t$}^q*|mQGNK8X3c8*&FhW@Z2pn?M+^o_{X=$yK({~*9_wPipB_8!L
z4hL19*7kn84@{Ew&QQ^4a{sfP>iS8$#8yW>dR|^lO4r4#`U4SQxX0(74|0e6w;vQU
z|MC2b!kyjAT&%)#)esWK-s99QpDvl-ajfz2(MDouY(1&{wvQZ?11%q{SkSi!R1mau
zw5d<(E4mA;m$+sPBErw@_LC020;r|m1qUV@8sU9GACfR*ynN{xl6w_zOLfzBOUeq{
z%IX)SbH1VQRTSK-l&NbClMorc5zPj<R3`cmM0QGVT2MM7h3Mp$=V2^=Lyi#cJjz=F
zhTmBtcE06J2+DUcfI4{^7ZaIzolbdYMhNUBX)DCDd&uvlU-UFG=Xeyo7(h89z1W{I
z>nJJ!=5SKpa5R!WYNms~=%HAsdT30U-$nQ4LN`8Si!{)CYrY1U@cD1GwB*N;KEoLc
zZuEuI$ua#?C$(H(dlF(^BkHzs`5ru9GrGzm6?*$+5}lh+;mZz$<F*eFutPRL{qyhJ
zZzOYjLW?N?xSk*Q#%isAX4%`y7<00TS6twtO5GaWQWcf%?&{pObAGLlJl(u`<0=if
za~gD(dp^uKKNErMM==CApOhi6kNA8(&HD=+v?NBCw=DaU{eMbG-i*6@A-$9P24q_u
z7}evmXQ^t_y0GIxh1~}GzW<kC5vK=3&dkY3>3lf!uvabtbNzuJU)D+-*nQiM{8mb%
za#QkbmN7cf^Qk&$WBqs5LXQWz&AAeSCw@_b>~TlU{V8x(H40-mN7}m#>pcc>C2hT7
z^>L(^7@r^vr^^>nr?g=6)j5-Y3-O<C1F3%rJB~8kZ513{Rqx3Di3FNqWdOs9955iJ
zr8Bf0bmK(ZgZV^poNj1ppX^-<{`Cl)m-YS<K|Uo|-`0ruH&9@JHWml!U-=L6whqox
z$*)Dc9yfphi*Mf<imKFCAh3K$C<`561E$^3`r_Afs!f}2gH~M*@K9pBx}XugW(7e8
zEHb1)l(~gPrqxh!bH7b7FQM;Tdz`$u_^Va&UyN#ZfyRT?eEiQQ02B>ui9`4n4M8b*
zoBGmX2=&4Ba^Q)<?>#I4wsOJqmEW6Rfoy03d<8RTU>#!{3P4vmF)<*F0~EAWJfa!W
zKq1Hc0~i4W^gE%{{E(rgK^Ry7TV7kO1=&kze0<yHwP)}L7QLS?UA;NqQP)-p%SuJk
zuSEP3%?$;sSkX?1q2;o$fOAeLDNEBB?m>^a4eZrjVn!A7JUj6eS1^J;#Q<$5ly*Pg
zT>~Zv9QP$T4#+UHK;0pqBvT>iFT&(Af|yN+!IvF{Xoft48SM4Wm&GzHIkJ_?bidOb
zx3g@=XS_00l3e5Ph6AH=lp{x{glI>-^I6d#J)=lhF?hpxrHfwah#bLCxm2)4GJSE|
zSL`JuZmb=K-U24zTL>13qEh5P65?}C<&Ar(wl)!PAG`IXpYMT_-+)BX*R-MV3*W38
zx|lLu_x4Z1V0HBY{xe?p>3b{0Dy;6{Sm>OmP_mUbgb_`*jr;AEPoGkqTk!iP=5&PB
z?(|VaZL6*2pGt+TME~hF5$ibs>IeYpcAtE?DWS&`LwvUM#{W-722MBI8*eLCRk3^6
zUnIn9Jw%_8k>OU+-Dr#;A|gt4-I_ZzGbxhIZU&N>jLnK@-0WTn1w9@2Bb}sC1%amn
zQr=_RAhZ7w3f@pFG9neirk7BulvUv=?}cV%S#|$B_rDHi;o*0ydFu1f_%71N5CnF0
z$PLrF|4A)zbpN^`lK&I5bKjQ>SV`Ptm`3H<oUz%$(+as`b@*NBeS*jEd?MeS+aXW7
zh;F6V){faPKxuZ}3-B9K#Qzs-Zvj+Q+x-n65R~rjlm<cRZjlm@ZV~BDX_Zhqq)X{8
zrCX#01nKT>rR%*mdO!d7neYAPi@BXM<0$NN_F4H`zqPKl=_#N~e^5i^OYy&?K3qTY
zTK?#$BpRAmb(*HCs?l@|3|qU(vcItNR5Ak}ng0+w`DV?N{Oy}2mZy~eE)g`}L}hdr
z+|SEAcqhn_o{B)>VWs5O1IxMp5Y)cl`(4OCIK8@sfNu>MWFTq!0cjH9Md95>dNA?v
z$KJ;$tpc}!gKj|%n0V`e7+^@eM4x4o1&E|<YG<fGokhj)hypuG1qU}huUha5dWVEJ
zz&)6HTIisEd_V<}z@+@YYKs;_aGTdSXg<EeV_=YMe(XKKxvw99AqBF#(sYQBUjkKC
z{z*7h$4S(lK-6{M+bGh(*7mMFdrC+0T(8vyVNU*(aFut;CXvU}X?etV;K??Wk<KC1
z!>9>9VI?@d6$+CdSfE=t_}6a1EGPT1tx}a?p~KG{#ptA@O-(d`<QOp!A0OGxPM3C<
zqm~(-u7iM=0OVSR9Ncm%*AD=78JV>HOLsv7V>#dj-i^Y(=n<EN;~NY6j@^U+hC8H;
zd@)?%j)N$?fk+QQ-&AiF-^dFR=?YlJGp=>~?>KS{u>0-n<PRU{!0yda{XT-O2AMFD
zp^xHsnz_P4gX7luZs?vj-xmX`jbQLTAY2{aq0onv;m-$&0X6U6vC7x5BG;Qf1!es1
z-k*&)<QPFk`t=&an&JEOM%7c<>V+B^O`9UtJnzGl@jRuncCl`~<f#ELrQQ&srCUq!
z1(wn=D)wKktv~&1qy395D1+Z?Rtg1K!5<F5<_C;4Ot<C<%6CPv0Z?(4RgR%efZAdd
zVlUv~#^25Oj`TNM-ZKi{XZQ$MVL`YHr#yYX%;!t(FV#p8@BI@h$OI~%|6v}W<~FO!
zf01T?r(0Y1N};qwb}7IKdP86d5y-F~-(>+YLibR{^QTlBHF)>}6J#xr`R(~pTWV|h
zGe8yYdZXU!_QyaiXJV~CeaHP1UwzETa1F(2XeJQH?IICCpm_5H3{>RR5JSbNUp|zB
zbTR(5n*l~r_|1?W=A;$mhXd%$?SW6OaN*&<I08kNeiA~TNCD*Ukv9nKeGqd8hQd=7
z{;!zmydxe6p|#P8u1`?dr#<40|HjZArDiO;r<pS77C%0|Hhfq;VGTkT<1rF&8dSPe
z;57gHW*#GE$U5RA{}t=dQ-Uw6(=s#5l2dYxGb|ifu<x3zw37B-DZ}^=W*A9-tM7O9
zN!AcdItT$>#NTu2xQ*->w`MB-uiePx6)){k)*OrS&Sjx1Y_*KyZy=qM1Ys1Lc*TzB
z94eTRpm~OmMlZ1-i^~BVnYFd{zmwrs=wN2qx#x`+r8-r~JT}q8!_T%#j8M(eA|t8#
zl6g;({r)r0NQDO^5hM|tKnpn!v?7QnuJFIu*Gu4h+Z?U)C!i1o^J_k-L;y`9-2pN)
zek!F3WkcXITFJL{u#r_MaRr#GC;|*o4H*K2;$BWNG1VC9x}8PUG9isy<B$S_c=uRM
zAxIALGe&3?)fQAe`MH4fNviAlFS!R&OQHo+baIT%jJoV<4s8p2OAZS%E~rkQP=ms1
z2)gZCEY~q=@UQ5d>;>F-R5C4bJ`+u}+3jc2VI@CR0fcf+3TX^f6+aaN!{C)re7ViH
zVa1LAikSJj;O#X$3YK4(X}h&Y)mk8fgQ*tsZQp=4X+TWV#(;n}q>u6O$$uw7zGVay
z{EHAAKUDT%Fz@!lRt6q$a?f#@-}Uvgx4bOEgvP`Vfi^$m+?obdHI-NXA1CZDuWtcl
zYbh=*NEpUILVRe!k5T^A25?rmx7?5Q4!7j-Ujw<P0_#_h$EJsK5^E_!pvlaj7hrEK
z`e|YST>`%C9q4aXsKGnF_%D51ItUItWK)+qEUKUE5~4%;Mz8ULa6U2*FUB9tGMC*c
z<K9vlg+3SB&uTLE`rlFOWB3R4H##RltixQI^)T7?ju5aR0QL6##VSO8lz{EoP~d2V
z0tc(j|G3T5Sp+Vwhb!}++8iI8m4P)qkzlLg2e3jd?&J&6+&$p8A}w5UY7jg$iouJp
z0Ppb$S`hSQv)vj(5w~tBew%+Ep#EoI`<^(=b@w_sjXAn=w;56NrPXK=c2JvfaJm2}
z$!sRSaJK6ya3TXUSi)_mz_tk9cz_JOlQd)o6#s1o{L={Yl0gw&c?Z>U8m?9BHFrGR
z;+b$u21nwRT50zuQc72jPDC9r#()3rIP5@;h$p%%$ye^)^S#>fYW^ur*hPCXP11mT
z_f=L(3YqqoZH8ATOWG9+b8Pf7r8?Oap-qluXghPd!za7pp`i-ILNDKd%|U$1qDMbw
z92d@tpFColwH-n?G5ujG{5HkG9Ww|<=5ch(cwjUNJOrg{3j#1D#is~4f2HB)C;F!d
zypT+3f)p(Q!2v7;Bi9?3D>#0a%@5YI4HM5qxfPRnVo~s!6D*Zh_=zh~?Va@`UMamU
zhoo8qF+QLe_}|0MvOTU}_0Bl`m8?N2sdaPO%yOda?%+&%cq{e(*PGd>YSGK@{90Fa
zm8J{Zm`~7z%!l32+_qfTE(i_n(;BXZ)LIkuB4t&EF2<AhKBUTd3WcX&QF4?Dfw{D5
zwzGRb!M@wa7in)RiGEV}KJ{>|&yxDSxbxwG@6|esaJWs}U5ky447!&tU<44H{{5hx
zlhbzxZrqvvfRFmtIR4Jiexw6ttpQCQ-`WP$p@NzL?+8;jpe*(SI_}g0Z*Qv<{vs!J
zNIPwRyUK1(WTM%(IX}8kzrJcXU#;_*6Z1g#H~@>rg!6~2a3<iwY>;YRLdN%pA~CTl
zy@jn-=n(G`^Ex;XmZCgLcvfxBX5eF4;Ji28nk}S(?RR0|5O!aF&hd&U(Y{apwN6gm
z5)EuiM$?x3w(0`wfzd#9;Lin8>(denCuqhGx^J=Jd!cK-U)={wH$9K!rZ%n8+Nf)5
zYZtrJ49WY!u!Z*RcCw;B-vu~c+-2+J7mJvzoSdXh26j$Pl_YMfmj(Q>CojekYZ_Qu
zPC+~p1g=zs3R(FrKDFKf-8Bq1xEhm-s-ddBT7$Q?Gl#6T^9>pX)w#xJSYX7u$!b%r
z;y695AKA5jnWonB@boaz8YY|Scw<tre?h4)Lp0P}{d;Fn8a!0$K7*R7>5<{qa@dL4
z6HA?>QKcP(2K(a+Rj_G$N7xQ9B%ZrvR`;K1XvBTqTPE$~??jEw+-iw(-2Y*`=4@BD
zYMJPMW&Tr<{Qsv){ou=Jc{RCIl{Z-x-CcXTyQ3<t#*(;dM~ijkrKJ3s)-)($R6$_s
zq<<`xbtbY{A>{r599}Sjz|?BqozIY|KcxVU6qXIjWXBrR7R)*CLbT?F((;e*HFgoe
zhJjx1Xt=bND)0o)o31T=nX~mH!sP}HHu=yZumn=b;|-axtDc}+`$r$HqY}AED=?A_
z%f;W{M`{Up_kTFIBP^)8S6I3!>VkJevM&)Z4!cb))EX~x0K=H@79=75&6eB#6=ZZj
z{#F>a)3<dC))2VUJB%>1tW+FXC8ft4SeXpI+vA)QP2Tl`#^~?IvgB~{RkMSs%fHei
z)x(11>AUa1FM!@2pO>ZFeJCb)K`@D>ykhD<X@>wj?YM<TEj{V}=T+}aIN#s1OkB=l
z>8hw@K1(l&efp$!E`_VZ;|Dd-Mh!sM(QL=#A&MZ(Q?gsn=9a_jQ<r=RrrG?FfGz(W
z(7v_hkB|NkE85D?=ib_^7?dpPZeBlm@+5kB`Gwl`mytXbNs>qAMm@E$b6M6n$&mnc
zbsZ+d(?UMW2*ybhRv^FlFDTM926_ncG~2H4Lm#cCG1ER&d!CV5NzUV)u43f*;>C+6
z3ZV|aesLR)h%htvbT`a{1M5YO5n*A2=;I4rF)7nz@58yS)!YS+$xC+Db%C9p`OJ1w
zbe=7&8LrF~3%(fl6H(1}q>pa^{i-zqvgp)Uw!y){=hbU_tXq2vR$=3CHIaORu#5V0
zlt0zs{|A2e4i&5r)d2!RpewX!SNm&gtTg`ncLlXoa#B(jHk~gIR;GKLRJY;v(tZ<z
zy|Rp8*foJ0I??lAB1p4}1Wz<TC18trHOCqUwocVPj*oY((_(Kf%KgH>wyk=Ho>GMQ
zr-85LGjBi<O>=L^OjJFTBe)UuG=rmPuMAw^C~>zxS=7sVnuQlkIJUT}R8G^*#4a5|
z;1-N;5%nB#QsUE7MvPYO$9j8C_xtFqCT6<ntmcFU8lBDh&j$FxTJ|<2gKJ?Ql-vQs
zmQ+v7tR{5JF|j>%n<x%t_UXpGh}f;_Ct!7s-h(nTvlqYROWi_AtM{JotfmfCE=r?j
z+WeBayH?@8;vwX7u25&N>q|daBu*YyC7~tkbIux`dWnunArkju@Z-EuzT&EaPgfKh
z>gH%(;41nS37$!85$^(BMn;DH@;74Z*;>q-%N~Dw-+yKSJmo1w&5n!m^c$J$D(wPB
zNUM9nqR=+M(aoY)Q@eL+oL49}yw13?fBX)al$jbXJtB7974#Rqse3cWVG!q}pWBgZ
zekjfM3=AQy2fn)473SHQ4tXo9)K$x-M@4z9SwU2wng7l)Ti)pWjp@60@4TCa>*WQP
zd!qWxr~T2t5yfs+MJm7dQlJnXE+U!?>%;Z~LJB;g6nRXo!)xQG+8#ngcCni3snvWW
zt5@TNe{x0Hy;I<$N|ElXL)=F)tn@5rtUq&z?0w_Sez)4Tu)9>++i^itdHi^TweM-@
z-gQ;-IFgkDpW(}N=+xN5qc1oR=Rfpf%F@8$l+nWD`Ry<!>Y*S<!k`!5eK`7bN+y`#
zs=-2moFBqtKX`jbq?W-!BxDcFZ{O^LqWt=B?HwHh>*F!?o)u`B{t~N!;ZVVa;CzHx
zt6Y+$fGZGKpMWr1cN!}smIF(1$Jjj+l^BDg-M?%vlp;lebGm%@+C#ddxkOL09vo=C
zZaY6|*_LKO>qzExDWdb|*&Eihec0fO>1;8kYL{OAbM^UHljLFLT*P)@X+*V>?v1SS
z(`r+*Gp`#8^1*5=&$G&ewXDQBaisPR3`#pYYaLEX#9u3e76mUFCCc!F@{R@9x8(R-
zjxpb=b*1z22IGB?xDus|nIyvTtH&e>nDc37ti&E#-<HdCd4AtoE&DmYl$6ZkWqLeX
z_)NA9s@F(qQ0r!;8>NucR>_?g7TSg%)5x2@9lGc)%d@QdhV<a~kVuv|=s#XUpE`~l
z@E$3xr;}k=d7us>5H$-{4<_tn2qg>EP~6-?V|#I^joREf$ySe(8rL;fQL7fk3m#{-
zGu)%{HMslyZchx$Jq&C8R6PHJqinF1s0R-<Yx!Cpj<0>F?KP0=_Intjk!R2SF$s7&
zG3bRMC)T|ti_(Hot6pOcw15LcoPUAkNBdO*8=K(kjx@ZhWXnk3on3>vX1uCoL`Q0H
z4UZ&HPG43qE<GH$Vgwmb*M#}e_qy=>(AVY{mKe-O%k46_%)ZWMeBB-{Z*zvXL@n>A
zxc)gh(iQVi(DIQ5LrACT6N0wDy|oQz{1Hc%QQH#E&a<B#a<Pt;m@2WZJ=@ZU8<b-l
zZ}SvL-H@1Eu2p{`cHu~)$m5jdJx$qvS~1Iarl$Lnr{js9raX+tly&gscG<N@A#0Go
ze}=}daK{lNwIwEOKMupja30~i-I5CD9!NTm3d}YmJ*M*6V9Lq$2&7eeJQhkDKeOAz
zxkIApon%svkr9nz-Vk?1al&c6Te;vNCitaDt{dhGni?MyDmXt(`!d0Dt;6|9kR$z4
zv4F8MykF)5GKF3(4#<pWmyhAb9Zpa+mEh^-#}OD|g{-iUWP2@ps*Fq;a!)gdBUkB`
z?g?UpCW~!LMLjg|Ha3vWC%;-Mg8W1b9eC2nM<Pne?mI6$!PyA(-D1tr;rn~b%UQG)
z;Y6bPC0s0%sB-1vJ0y(9D&qO7JMZUwI?H34E&O#pn-eg9V9R#skHivuE~bpfqKfod
zymcJx8pa?OrdH3#AF*ubwA-*Odi<2>c=?)bzc<o=_L$Q5Don|nJ9{b6MYJ>YfYyaa
zQzA+={m}*W1EeDzmnei$nIp?5R()w~s6)AmZ{7Ap=fAELp4y&al8i)-aioS+WQP=1
z%-+MKlwV>HlG+{+Ee^F#e7JDkCVP5zYN1!}AfFjF315blELdp~{;WyF9mF;byXg`Y
zeC_SGCZ0TBXZjRPC`jG5TZj2WxciZr8XN;0?HwFCYDGDWw<0cF4l|@+qx~1(ku!gM
zR0^ZJ5>ruwHTnFil0mfMEZ-&9k!KysRt#&tzP?wFc?nO=)kz+R;NcBl7ELDXb&1#7
zN^L&pnaBE_H{Vdcr;=|dM=tC;@m2J<r^Wq1)-;KZ4u90D=fj5s^g)gd^dZ~5ton~y
zIsdAa^8`gx5%L$XbCJL=;FJYnz9yNonh1IP4%`8%ZRs<M9b+cFJK!zCaKT$FAus=i
zR7!;m%zyzdEv@7U1=UnN%$nKQ=Kb)^Anvfug!b<4(hj-`C$DT3D+zUc@dTY*xr6M8
za?jF5ts3{_I<B8viT)d!02K2txcDy`8-!MzG)rd0wruY#k7d-AMbhC?JZ!$85VfAo
z|NLE^!FLGjS-`aJCk?e){q&NZ2Onh_Qhj*$rr#zflP)qJTJqL7T(Bp(uBWc2d?<12
z-bB~>@;sHSeyG#5%xkvV-jzU<={Y8~LG^~nW63UcHCTz-lG^vQ-<5%A6a*CEws&L}
z7w2xeevOw|v-f-$!b>Nu+IcN_LeXV&Kb#~qE^Nz+>eAuHI5bf}b}0o1?i2*SAEqrx
z{QW82CQnOWa;sI>&$?Qov`BU;#rhxDn9L5BV_D-;hyw+Umh<{2kh+o0G{R{=G#fI{
zWrH!$%hK2%b=a7`Z?qdbUZ2Y}iLRlSHA89X7UzCt!d!c!3R9X*c_09JBIH83?^i1R
zQJDkMUr#)~r}+d@88Q^0v|-`z!)45Wc%rm;rBC3)p|rThDzOJ5SSNvin5;y}pbY)0
z9E}(ppWLal0Lv>s1vox}%)CvH^A?`OjjEY@4~#p!&Ro9sG$6OiN=wV(yW{qJ@=YDb
z#B_73O{~IVDcDlFxo<H0=nHB_rpdm=+fh|%1Bc-v4dOXPN)BGavy#EAR2k{nnvhA=
z4UXotj*q1b-QI4OWeC!!Rw!LLyB+7n^@~k6wE3@^ZOMO>dfp2wc`}y#^f%tuBV}Dp
z>KMbjsTMN;=G?WZ>s=ec^HbiQdK2oCq#oBUw#K0+6Mx;d!YLhKs$#*vdx}N$4y7`w
zyEFi)$+{o!-N4Kwm?Xw^0NCa13sBBBCE=jWJR^UgNbBgZS4X9qJS;poT&7*8Z<)D1
zkoh9mp>(Duj3D)*M{Pv2TT2(Fk(5~@&Is$=1N&{f7q+*-Q-xezaeV8<ymUW|S1&f4
zKD5QOy0O^3t~fb<vfB&*fw!i;HxOvI1jzmsMy5}p)B?R;f1v%i{EPNK@PP`>3X(Z7
zm=ubn0^3(~)YA9~aUSEqnVAu~pXVs4qPgCOuH;4nN_<OW0%45Xuvug~`vF1+WXX4I
z;M}Lb)Q;EgMW%dY$;GsM7ND3=+juX+XgDkJkjbW2L-!rG>}X0QI1p<+N!{7x?nNmi
zESxpQYda(TGrWAnJ>Y?E^QhT))0*G!I>ldsM7*p`9{c0q)cjWS(To1&Ad`CD%~&<X
zi74cN@9Z|ZMyGyhBr_jMsxQ|RUsycTbsbI91c}{#<s5zEiw?Z~0{mGP^T2udd?eO~
z!a=R3M>Wctzqe1pv!XVSlFdgdn=j9&>;f|#8g)EO$b}r?4Z}i8af+p2RjVj1lOvzQ
zc24|Xja8@P>{e$jGqMxo`7Kq`BO0msEGCZ1bYI28mswa(1Vd@(5fI91;9toCDCPkF
zL_|~-R&|i&bPj}1_c0O}cPye&RM7qpBdNe3CI#gBD8D0Ydk3eWp!kR*#n6WU!P)bH
zs7B7dqW1uTZ(UI0swW1rt#X6YdS+3qk^e^J2k}s@WI#psvg?(sQVYm9a;5TkOrgbv
zge0M#*nCUQZ3RS_3}tLf*}mE8iBR6Ks0^>CNZr|Kl3!DZ8~beCci*e}@*b1Y=RlVO
z>EeOqf-(tnk#b*Dy_8hy0zA#48NE2GfEs254auN!*$l3&pKBcZmn$p{o;Tu|8#&~j
zD+S-cNL)@y^*Tf4ii3xnMaXMmLDCcxiBH;Wa5YL{%G58^C1oX4)W0i!=iEKLS~PXu
zB{ZaV-zo@TRQXai`*h51R_2$|fx2BRQj729QT4M|0=o&^8&+N_g>`bCJx^&X!BFe3
zJ+?2~L&_8~?>5d3m$~?=xk=r+Jk=TurCnD1WhLPFnD~Q3<ly+y*b(RH8ciPwut0%G
zBSMrm3cy}05K}NdShL680s=pT?HIr4fe7FVP8{~?kT#4$|6r?38d@v@GV@U3(ilG*
zEPKc3WkW(u-l+r*Gdb`}V?h2>E*`afkh?to02JuL`woDsV|JJ_5kFCJ(l9USmq`AA
zVWx0q{9fa;28+8U)4zQEIdnQvD^Z)S?pBHv(o~Pdxu4kRyuN(pl>8_+Z{7Tv)qXbX
zbd~KSY)KaF!#U5+4^m#+x!7yZ?(Ocp-wwpjN~Tofn0QOIpju)6aAeE;r%9yHY}E*=
zO2a!J{-YL-=I0wpVKq*BujPI{1oM)njo8>xj7Jt;X@SQ(fgll+rnG%|C0}MdWxG+Q
z12Vq4nKFru{deXg-R@UE2>g^UT`9bqNEl9LnoaQ!SNijL<Bok)Xkb=*`Q4d88L!&v
z?yr0YYCtfu;h#v6+bFzDc?wf{627=94#y`#i|5xjk@~(`-SGyXS_)qo$ZV+~vt^vn
zWByxsj5GWxJf_wR<_m5?84*xPHx(>|)WQ8RmOs+>w+Pm$euc?`)7n>Kqd&XOV*F+x
z9LJl#EOGn$*5DocWa7;4(PKt3!M0>4o5ry8E-xrIp8rkD=oP;E`<$DVn>2=m>Mx|T
zhiYh<;LF}cJ#{@gIPR!5bY0l^Oqe&*kSWyBzH~9avGH0Z=H>IfR@$L63V`?{MfA(f
z+XYy)8^s0U`C}-<cV>|o7!G!S3c2oxhL)?XB~&tv;P^?leSNz6Iq-12?czi%-jxl#
z-?Zb6saCydyz>kR!n~T<jaca?ljXDBnHqS+!;Sccz1b7lw>&c|RZkG+b=~$d9qQ8@
zL$U98WH?O`yj)SLFV}(JKNIEn)a!>GysFyxM4B~?TP~9W(dgrzu{2+pYX;03FRB~;
z778VY#-ratmo#8{yLbPI+i;`|w{hEuR9PVRHdms6w5oI$POC>+0Zrn~EbV;(9b?P!
zFa%cRmWg&m3WFwlN7t&$7kqc1w}6SkB~0ByWwLn4q@7Ba;kXcuuK3p<T9YZI@N?+1
z>elg%a->>4(9S?9&FcWTUt8;On}e(>qR~!pK}N-%D6g$CC=7<MBzOph%K3cGjvn3h
zCTDrt@xB}?n^?|Wt>#b+k3!;=msU?tH=KqoN5xITAdVowF*{1chD44%Trj6km$?(9
zI|9#Yt!#lqqAO2lskxFJbgp#1UxL<G4$U0`m88iu;YmaH*=?WW`*G;i1!H&z_Ne{A
zJ<KI;*OT~(Ac&OCA$;5<Jiw1`wjRZrL!*q$qGYs0ZqY2A6Duq^a3UUUz88$wV>dMI
z_;MhSY@)*ai#m&}gSa*v9|e$mOjWjA*dKBG$Av+*Cl&*V8|nW+-0W~#j((Zg1Z4i}
zd5;4&jCpauY#s<6HLpBcCnnk*W9GYV<G!>X{DW$Q+iIL0_`v3>0VpX@TF#vwJim0_
zzBx;9=Jc-n!sl(2-1>rC)Ena}(3jS5t_D0-T{9!^QXn7R{@F7;=26>lK!z~A1RRUQ
z!J#M=RyU47k*fld<&f{ayNF9mNs7zm(%d8dPPm8m`HRxdqmHNJa%jX4rA3-w4zfOD
z)P1s-<cUEX_H*s}LrFe8EJSNX)Q+aKT)V9<flI(3ZzSzqUKLBhZg3k3Gt5eU-lS<W
z$d!#`Yo*$I04_9L#IPv`;Qv*6BC_#15_b0YzN0r6>AntYO`@A4MR%1W-1Bw60d+R5
z-5?o$*<~)>tKV2s`K)8wF1pPK19Zh=U(6fw*xSm@=nWqpzz$cC$BWi3KY^qUUM=E(
zA-*^-YCM4W^ZO8F&xDcH*FVQ1#}CNsLXtwp=DUBK!k3{<KE5#LHwqJbhgY$@wM=(a
z{kf1uPfs6i-Djkb`+K4juylJpC@k@w=<!412cX3blMw=wTD}-@r8A*ty`x=(C$@Uv
zNyd&_HbO4_&#kA+Wt&`A=UubplVyBTpTTJ%Bt5dCuG*etX#ah194D=Pa6UayA1M%9
zDwKxh6Y!yEM&sRgh7-Gh&!2bAzMjcznw-_KsiuQiZ!(vIf0x(nYE<80?k37vUlAm5
z6#|-KKK~!*KjYNxV@295A;^7NWK5d)nj4&=z{Y00+8{iX`nBBiTHh+(@|h9=AqYP|
zD&&1@-&FABK7&#4JKQ}c7hsOyH#;Pf+vavg;;dGWzsBJ$CzL_o47=-M+0_SP7A*~p
z%I42=$7#!07NhPWIeSOdV^$h|#CZ|@DPyq+rOj(94eH4adEOPqMGKR;HfDqo+&5rj
z-BJNWPiP5Whe`q2ivigSKCP&I_SX-}l>Z`{fyNefkYpqMIDvFy^kJh);%FH(nRqu`
zZCVnqQW5ZQ?VnJ=vtWD;hwMMH0n#Cdp$r2A9j)$*!D-EG|D%QL(=9vaO+kewtuOZC
z5Y@A5YfD1jZ&(w`eihWa_PhJDB~pvoP0c&oJF*)JRhtYe2UpYiBx}Bx8)l)2T)Me7
zYdn3N&y6@5QPUdD5kWP}uHT!|joEo(Jv6o3+SZvjRuJN)s0imiIZZ!a=3PxzZ&;17
zKGyiQU#LSVIYj>gqkFAb97Yhc!DWQdfAdN%Ej|y%$_&RK1ftU$^r^)$#u6rczfyzd
z*Bbiwx)uV6*pJOyy<Rydcq5@nf%?zXLHCilYBNDjSjb#`hGGDK?M;7Eh0F8z=?~kP
zN1_J)fQ4_U&F5O7#FLmiI-43&1m!$?lR<rgC&rWG#t<;-ceg}sK}I|V^_$6JUhA!r
zNWj)WsvLVH`V&Kx7N!(B3|W9mC?QlLOHqsRS26ZRe-z_7kKUFY1JKVS5N4RzVS>MX
zmKLG(0bW#ckQR_B1;NiF{S-l6Tx5HGi`k1r@2Lz9nvdty2R@ki=!)(&(Lnu#fDKKB
z?PxkZp31+U7tU^lDn=Gl`d6R}_nQK0SV%zu;5dKeU9#LA<elB(h08mawn`1KIrX9F
z`M{dv)(R@(JT5Y~cLjOEg5Jo4goJ0)qBpZ&_YdYQ9{|cg#CuoyHyM|XiBIO;6PY7s
z{3u#o4Tv-b_2~11o+A>QB54?bdc5?}ihodKzUbAm37??gQuQ1MAhdD?E@M$zXd>t7
zYud>r;CH91_$|FP5ECDsFI)v-o^I_~X*F0j_K(Z@=tWp-bM<;xw$FY=JTyLBr)G@g
zz!VY|LaX}80HXw+bVpWkSgQ~#m_?m2<jvV3%_CO4o7uXMBVFHb3nmOJuDY6R!%==C
z1b(<3xOWE99+9kEYr<~~WxY;Lwr#g?@qLm^5C-snN>P3+M8X<b^-!$=D$nR4q#uO>
zK9&C@kSl}_UOri{?=!%!#Nfl_Kt@0`>YP5)<GzJUeu_}t9AmMRbxS?r1GiFdWxS_y
z2up-7TOeD<6~OIHz*0G}GsvdJh7{n?shAv+ip)G0?8I<vBQDeYTj1yB4>Lw~y*lP}
z<#cv7rR_O*LNl{QdH3r@`~qIvLI=g)OqzB6zingz-MrATQ!n5R%GUO4o6+)!S%**u
z(FT)ZC0w;{Dr%G85KB~>V_7{hw<m}j>&*{?!^6b~s0|_cCmnSt1q1iss@~$3l9b>z
z-Ip`O6c3R(a!%s0p1R|<EBu4s*YSqn)b!nqS<W*U0lfFr?pvr9Q_G>P#6CQnr2nk)
z#U3t91gwujNc&R+etO8Evf|l^8KRhG=g0%r_M|w+FjU>r+RNRDnb9!haeiRXu4zW>
z5&yvX^uKW4*U&!THpxbSj1AZXGpHnmEW8iOED!S+rEVqa0wg*jT>!zH`EO2C%pZIN
zee(yUkk8y^qWQ7#4J$D#{|CzLXC#&8Z5Hm0*LY**^oPY0PgPsK8I(M~Ul%TX&$o3f
z<|VOyAr|-BH*d2c5`|{Axc+3Ys?#X-N#|q?PQy~chK@X<5oc#)<Wn?qUVMiBl(Alw
zvSbk-gu9_BREEkxfN!880i!V}i4`s+xcbP-JIBpO^!oS14u!;Gr=9g(^sXfS80T3$
zIIS<ZvE@@I6a^}rlRs8*4tFjsmLh3&2~zKaSTSJOByl8@bXZ07NV$ZJugs-#@G2b#
zeOn#o^NStJZq{4O+?}q%>`8=kzPBp8S#ap5TlQI6wN2dG-%md2**=p7l5OG@md6_0
zo14bB3HwN-iNd*w83>>ODSuLW@)`*lJ$~14<L7D4dNe-~vQ~6Uy03mmR^qP}CIw<a
z9QqLN7u`(xT*pVG)ejuMKH?wEiA7!5GO0Z|4z46E-}`}WA+ngPr{QIG=~T;1MdS}M
zJk1|hu#S4>aLYrK@d4f9`LQ)2^F#RodOe5*%2bmpCx=uyPI-%&o<TG$t{<iFtH8-V
z!5*VE1&X&G+=cYWzgG&!vI{;D-dxKvgkuQ^R$GL-vXRo-Bn^9X*82S7NpcI0x5MrE
zu&ThyDn#a@>l&Ch$`YP$(j@WouFLO0_rq;|OP(Dn!>Kw;>L++?*3LCnytXD?3EdTX
z$z_u7X#zNnhp7M<6|LG4q0%4HMCQ%k!k5^3V`{bk>p)H57yg?gz=!Uy8ETf<OIwc^
za+ZQZeDe!ApCwIr3LkB%-OmQ<4s_Cwd5U_u0&D`^dL0;B5mkMp#LG;_JqK!L)XcvF
z0|P#pe}ZQ;`0@ZiK1PE^46&c#jVn#0@dNSw3@d;@qEintsP!on$F9*2=`f$F;5=OI
zF}7z^snuL|n~feJ!8tCy;GqSqRDOCDOvr9iYdHTPe>S0&ni>n|s^@6x_mi279_Nri
zm%(}~L3a=L^)TZn6n%YB<C$t}tfTJAYXixo7d*v}pO8G;vWkG;kBPTCIN$L^myteP
z@hc3uE?6#TRrn-!%O<HY^2-t3SG&l0tb3tWlcR*lfXT}=RJe0*-|J|UPO7rFBvIgz
zWJgsPzVi9V=#~3*n``6M%x6=XlJYzAQM?Q(dV0>2-=t({7S&+}MN{vqWtB)%-kM!c
zcQxDNP>E>4+&!1kC<e4`k5e8#%74o$Jk{fnRy-a$R*#WL9z-6UD29UCqHJ(?{%8u*
z)$``bsx@Z=ITjJ84~bGLKSODjZQsBHpW&y;h7*ZSzDDEY-G>6lHu|W|XdA3mC3ZRe
zUpa2PuaAxozYcnb|8heQ5npSeGZOy`ZH&J1J%X%G3nFV!S_r0n$ddlXobR+^aN|M-
z*0;>_u@ux2n|O8zo0vr~a(Qnl<M|6Tl&?Hd0n2TFVlR7Klt^7LK!QUU<HX)gesPox
zo37pC=q`BWwB{E{J2UfqCHI4XL4!wFP(+%<GwY+nL#a3gA4WYY(UjDihhD0dG|UlB
zznASu@c(j)8|uXL%*;;~kA6?cZwvtTUUkJlMSJY0TC<Ur`Mh8C9@hS@@U)(O<U`LY
zx<2K1?U<L83&)N3qQ$nimfk85Kcq5D)3bM|N`W!E3ws`*7#kZuPVFJ|As+6Qj5dNR
zV}Rom;=+kYZx%PQ&%=oG;^%7Z?0uMDQ<Twso7@T?r?$%B>F{FiYIAMs`Fj3Fqv(5Z
z-3J?O6!>WtZ}NgN>#Ct*gZzt5)71(dMc=tWuJ3WF2aWztfnSWp$?v?A*X~WOg0tI#
z1-LBg0YhEFue2`D5{UHdW=U0Ei@)rvU*E;IKR%AWXqa?>4aC`TvD_uig}uhZ@oS@{
zIXDftnrl|2G9mjKi2QB<{wTS6O#5}DT0oX%?>$5#-F}KSCHN}kKi#vcbhnaQ(DMQ0
z0D$$on~W*{MwT)p5KIVK`^BNG(83JSn7rtq8vs_w^WF<x9Y^qAKR@k$xZGo`l|asI
zasQYi^vXli;qup%F<&C17(b7Gr*>l_cnBo?TWV$o85x-kMGC}u?C{U|HrClbY|UbE
z6gI#6li<r<bq_PZ7&^wZeouLKQ2p+|6ZTR7{(+yLWb@*|bZp1h?y;ZG3g4xeoLha#
zg;{eoeXvP@hu@#VY;`~H;oLQ3N)`%#X@%grCmKrpi*QT9b0}dUPrb3Am`&EC3D3_)
zz&k|<d0YsNe!z|iHsv*03-xSqo&uu;xI&sVDD|Iu3I{+D-8TZAbWmX3qJpru&>!qQ
zL-rtP2?uNBMW;e4ZFeJ}vO3GIg%`G#is6>`%VUVRUIu%WJZX2-60u8Kl340F!YR84
zciO(?=6=1ZpFx}hBs;F-i(syKgWl*(DXwWpvnfgC|AXXuJG)Xz|LB#4CJe)Kp9s5j
zHbJPrx6c#n_ery(X9St{Q~MQGDsk?cggnNEizBi(?1u3L#~%1y=mVFp=G6{q`55wW
zC=L#}ZNHFaJ**Oe<GW7-fAeS^<=eM}M`IFJFWZDY3Bs!I{1heP55uChVXj{;G<z5#
zX(w@B&%TveJQPLakLLSl7GTUJN3ZtztM6%C{c&*_4>eI*cv3}_(h#iE{G!*Yfh0wC
z^llLYBOtyL;L9??+LRzX0WpNg05q_Pr<wo&66xmxY^lhW;tyiB#USc)K>n^@fx<Fo
z7YmoA98WM(_)IG5D<T#SPOvD4e(U>(YuvCMy?O*`6nuL<bG=#v_$qeTg{U{8%GKDo
zIP_8F!q34DDz{Sq&(*n)yuKB}rp*OgRMpB)YbN3M-#UCgSh%Eb|J5V%<=)Up@%@ts
z6ts@Ma7nrY&AF&ga^x>8=kVC`z3l7f_>hQoFMcq<LU;x=tUC&KM2S-i&C<vi%e?B8
z1W{UK2DNj<xlmd#(;MI9U0ZFJ<zB>>S02_a;kaM^X3}w9H^pjsO}+*8>5wENO2Li4
zRO@^n<EM}H^zbqczDz$WE#x*Se+Jca4$S&E$N1hqzJv#SDUN2q;ntT9fuR*9-?`=L
zz~3@Xdhi*CdwFsX74QDo=zU4VpI6<zGx5U#X}kairpp5^A`Gb>34P6aF%ct{y?jkN
z43M-OX*+yaFr^NMW*&N-$DNZvrK%RzB9q6Ji1YBhIjs*3*<U%h1u4nwkC4g`ZY^(z
zf@di-?w}#JsO*W%d-RIPn5-p=pfs5VZ+*!GBwDH|3Ef*5>r8W6gOs^ejhs~l`08?~
zFKL75%3Ob8u<BMS8C?9h7JlG1hyosZ*6KZ&B|bw}jy?Ag2cI0>jklVv9XqvsuKjD<
z*M)@*V^vmJJip9L6D({B3^z<SKK}Q)4n5&zWe;lV8Q20Vq9#HRwuAn{QidBnWGIa!
zfaW~#NT*}eDaeW-Ly`u9tYY-R0DWmOcmjIhk@}badjtwk7YLF2Ot^R!qIp;R)ZNnr
z^f%0B^Vk79PfkjtSsL%hhSIWk=k39K{(^U@-KS%^r%Vv@T{TMyYsW0Tca3WT&!N|P
zRce;Nt<9iG$mi)!#oXmiuc8KDf9jr0(A$m7p6`u)B=R)jX^ub7q>K$5pRtRnROh_q
z42H~_QPFE^IIZ6gHOj{)rckBb*y02B{7qC~JTkKqW1!nAiV!&8`dKqt$b8dS`GiAl
z?7M5Y>_?Y1k$vCaS~~6vZ_dgr2g!zQhX?@p7^+om4>p>BUpnbLlh;^~oWGZ^{PXTn
zB(=AI^>`I(r*fKj%aq&DD;2q#b=iO)6>@jH^s2sy^Shi}x79fA)D7n<<m2RN7o+f4
z-(ZVU3R4e^O!cCk9j;0&ox40O^iX$qUnhJMhTLN2+w4c%oEF`2cyK7wOp%Hc8?q<r
z<&UoG+9N9O;bI%1ka(#u%QvTx8ekaS8O|_j?`(L<+nYcprQCLLjak0ac~$fKM6~9l
z#n6`eRJ}xt0?gqA<Z5nLQ_#6yo{gDWPt+2QT{kkVD1I-u-oRnh$a;{(Qxt>>TJ}HJ
zeBvdR2a@mE=<;w9M32d}eELgbeX2$y1nlg53-Ap!nCtw`092hrn3e>%PE{Ode>{XO
zh5@k95{{#ZzMa|_>4VFR5;NB#V%M(?^u2BjC>*m}1oc`MU^Nhbt%}c1^Fy2(n5j~J
zN@o=5SB%^;V9?y&%e&XtpC^p`>=vW-&2n|mQr|3gM~iKx@n;HYD7>JfF=&c1Y@Ysd
z4=zY~{X4x$vP{>H8Vo(vi<a&Y?qd%Hv<%5MtmAbigBy1uyNHz0`arZWD{9Hl9z&IR
zCzSSPE$%Ni2JhxGUjqd2Q10M)Mh4cwBKMo?YeMBF-LQmrkMkStCUEwxG%(Z7oZ7hc
zEw%N+-Oot&e1wC{Sa=xTCr`rLmtR@UFJBvGcY=j=ZVDAeDG4yL)f<HBI?|G=R2wm~
zEITbV4qB8Jxk-WUF>PtMgp<-`d0g5lp4Yy1v*PhhlFQO)yHn`J$=rdFuc~(^Y18Lw
zeGn^5`>gHD7x!diExF@LtF5PDvPvn@?S|guq`oTmXzv~Ya?UnjQk=HAb&rr;ZiYFI
z<?a4EB)tZ&_W4r@Jp(=~X4SLv^)H<FVK>gFj5*(RsK72;OUBL7%kT4A4_7$?u|6z?
z-x1`c(oY(`Z--EcXw>SnQQ)H0Y-*O_gmrlI8`&`P#X-j1DK@P-)o5RI@;6TRMMYBt
zNLgTn96CfSP06N*lM|5$WKn<O1Gz)4eIJx#U{Fx~egbzJ8h~A(0lVOdVOIJ8*~K#k
zC^%&OCpgGJ5krpNNFIK_v6BOfh%9NCe(HrUgBe5C;jz@}Z;OQm3Kp;X4VWP};o;$N
z{q0h+l3sl-&Y`Cdbp({*#?OZgF4xdy7><tDiG`BNpV>0_FGz@fe;q<m`&cj`@B5bM
ziXei1U5*3Oz!&U&HchT$J<v?Boemh2JwxxOznqYt-sB-8CK-#9TBxyXKNs*9_6iof
z>ZBHsnz(po16Q-36JY;Ko<aGj@3o0Lmv5!Y?tAVZ*nXKNkC@MAH+kTVG1J%4Rh;K6
z`8;bnGa`cD#Ds)Qhr`=P4@G;Ws^j>PpIyg#bsN91qMcvegjZH}Tka;g!PHeqT*_Fn
zDsz~MaQrEptRX*QeRI8L_?rapCW86=Xg&0}IGGp?3=$=CRhj?%?BwZeG4~|*l?2@Q
zu$HNO{I`q=HRmK!TtDgTr2*2axQq8a-%wvF3<+9mx$|xE?onyVmS|+t<R}x_Y~q1}
z9<^nX{}E5(Q7_>~v8D!rKG*FtWG4b2yQ2CI7d1qqo7_??GMwOddFG!NKXW3FGr#s1
zjfoX%&W2eRCayI=xsb}@*58#TF`nD~&6SVE0hUn1;t2w+GAcM0$l+)F|AWK83=<5Q
zF4m6?sYSx5(cuP}<_y&n37gNbN@4%dITw~P+-J9N4SKF{qUqn3CVE#A3G}#eDfmAp
z3OP}q%o6X1$#|l}jemPQXuMESV_78sW5ue5*DI;~rAKKY8*D92fGoc!eu#)=|0}*w
zQY~5(T)82l-R>tgShJu5g++mSWE+A(L-0jr&X&KTVe{Pz^j+rkv0YiX@o9yurx$c6
zEh;xN&EG^j=EdQ|r9Miv>fLA4ynLG-SS;A9?$P^!`E|Qf&J%Bt8-HZ!Yc_bD>3F2_
zy0Kg9RCXEZNrIM~cBLxfi~jYXi|Yvc?PcQWCQs$?rJa=kVO@>Zu})1|2<2&pZv%wO
ze7Mrb)_1nOM@Y3i>)#n&`*XiJx}Ce980gPrr=ZERx(KjcXaZZp-p6iel!P3_14)nW
zsx!CG1u4Ll=D@u6UW-n;Zk2LwGf>7$XQQk{-gmK_Zt%Vr6p<SFi;*ObSp~0m)nb;V
zO``3`7jL();64eQk~3|5uV;BM+quSwOa`T;^Dtc!lSCSrVdK@)YtPS2UgLoX+hJk{
z@ch~IiN7!(1IRtaKJNix?3PDBu}rY!Dz)+3Apr1yMSh@kWO)pqdkZ580It;1-v{*5
zO1Jr6SUJiLyBFZUxSL5BCuUM<l5>0@QBvgd@(Mm4->;Y>6#$qv`dALf@b~dArB=q*
zM6Kf)NSzNTr4SM2OND<ei@jbss8CRlLNF+r3vlZkXr1W2Ba$6LJ<^#yubU%fEj_tT
zG`-1<VvI>)#cEIrBO`z71|B@~{RTN@dM2_&L%rtZyV8{82Vx*8_$QEgT)+uAno8D9
zj?8cG<a2iPDM?~q4_}@XSHW1NW=?XSH!lj7)8401E$}M#t}*L=C$Y7<u|smSdq-mT
zoObz~4Z)x;aK8CwgjBNra~14zf2zGpB#$MfvGIAbOy|7EF9XNf#dE^h8kjBd4Q}o8
z=Tt=WDWr%-CfZd$j_8nD8ho`G&B#WXk+Kes;;u`cZ=WtL(xZ`K-(adYQA|>XZH~p&
zv*}i1Sn=*f8j==}v5<giEEY}H2<@28uibJ&=)uDN=9A?oMyH~|&7$Fy{0J^q>SGBd
zRj?F*X{`+!5iC@5hs=3x`X#mnPeZ&)#AlL-9$J5tAyq?|FC4S|*x9n+*!;S&{*z)z
zhX7LL%8X<^&(}V-<0)zd;bA<#-0wPm=@^u;LAEnRoOe%layVlFBR<&F2}7@STlqQx
zut4PW?sB3N5x>YaC6?(x9O729A&jH+X15e3At^DKKY$fB4Gfr4$ou`tYwDZ~V?mrU
zdH6*$$9`7g@8{5<B6~GFp)?fUW&Xfy=a{m8a)K5r$O)s-$o+4joS+Idf?X0py&BJu
zdE0}bN7AZ?d7TV8Aq4nq!-tK8GZnxHd*j=R4CetToOI4OT{vp-eIA{s<ax72?7@&+
z?jreOm*D1TKBK27kEhVP=G2{5EtdePVV_qdr8&z<Ul&Ygg?=sGrNz2lu9ca(L}mC|
zXzvr|r1HA8X2Jm}1ODyuF9{;{1|Jc<pV?6Zjnfr`1DbXZN$aX$)|N18_7LuMK`uAj
z*P%AaM40%vZ{Ll9ho5&UyI(CC8%J;KWGcgsyQ1(D1-|*RT_vZ7FLb{dar7;XIHbLC
z!(ADp8NkeCmx$6oFmzIa8+Q+89il;of3Rmr&`or&5(mD7y`M3fBWQ5Kyf^cno2}U7
zqx=;gUb{Kz+}XD)W2uu>QhO!jzdHbFFKs$Uz7;R|u6{Bo4>tX2jq1$#v&<2vmyuoA
zOHg5fw4hSujGU@PO-*e+Q(3CFpz*FyaI{@>kC0pe+pqnyd3#7RPWMP%2m=K}rccJO
z$LX}<6)oE4&lyIuox7mD{Jj6UNGo;uo8p9DN!d;d3%ex`bAS0>2ef8(^sY%$NQ*3m
z)3b~{zluve+`^yhdlTtdiMb<etN=zP_c&>2Grzz5hCyefjPPw>IpXjo?-m%uGV+{+
z(?f;QL4wk4<?z!DRrjCDApoiz?BV%@pr79oR4xnu7ena1A(m+S%J#a$vNH>2U74@)
zh*J%5e!C4~Vw6`nORBf;sI-qxOX|XWYAqsUMiy$^Z4<dZ?gt{0EKr7~hG8~uJ!#Kp
ziIpxvmRzo)>^J!K_Q0txmE;3TOU7hbUY^x@*N-Ch3g;UfrIH-=$DtS)?Wy8RE(HuB
zr{@SpD%mybvm^G7E>SsHxD>B_NnB&;7rlOUw$+=9zw)TA!;oB_!USU-v(yCZkq7|Z
zaiA`TNa~=&sex<zDm~gX4pRz!4mn>cQ51d-98JCGQZ0&nbz-M`&rD^*U<-_{Yz^lH
zB4;*pb!FL9Uqg7ku0)wekr9TPc)H$HeAfgZFdSXi-PqEbI$uE{A>rjQkT)|9M)f@(
z_;xeb&P|&BQppn&IXfEYRDOOrJaM>18P_kn@aAAlaRvsIs+`^^_WAe#z9KRz;Dhyg
z-dx68J;WNzmEZ(^hcDC4-)flnT);lA=B{6$Xh!d_7%XR?5PkLXfg7?QcqEvMW?8B*
zG;=yIu`&te2QmHI{7_h*Nfh>%M~sewCXf7kf81t+mD{?R3XBCDzIX(o1+Zn%iV&1p
zcb8f}k2zM-$Ums4;#50xr*Rt%eW`B$9JHBwpI>?@;QLAA>#Fqe?7nlqM#1dplUcu#
zeaWVz3nReyZcA?*Ce2)*RkshvO~^2@uPnJP2+4R;{w4e-{KwRZLw#w<H&g43ZZHDi
z5Rj6bZ{n0y@(g2lf{QrzwY2H-l()>*<Cb%Td5~OaI`<78>lPL?e9P_SSv)FvYp)oC
zLTRH*qxlM>aVuh~QMRppEC{d}=*H+{F}H1lH9IU^avOA(1+vFf(#TmLyX{&N<C6ax
z?|w-1kf~|&DvPsCrO@MYV6dj&ipRR`kdmjXyeVCjoIZqb<b5$4>|}F@B6X@AwPTVT
z=SkUl!46nu(;LVBUixz`k>0@WRS>7i_4Bj3NKIS~3Lenxz}+V>{Ibp1X)#wv3;-c(
zGX;-p#WO`Mvh!7I%V^LKx0|jD>Gxh_c{GqNf{ovEH8B4O=Sfp`Fn((V;=$RT@C!V4
z!`k~t#d_sJFO`YS`1(&R_*_;~oM*HU=P#5E#V>_c0rF80yHx0p9T_MZh$sSE=L7?-
zKu6pD#jS$D^3=6S2>kgWScAzjBT{*yTzM#<GlR}v5siY%%yx6BjM8cD>E8Of`9{*I
zsT&yT$T0bqJ~(tHlMFwS`ptJRZgdb$H{1Es3*w+Z1m!Fg+gaU%0)v(YfAJzAo6;LG
zFfc6lMiCoO*g|*#zU-*UNfF;q*ztvU>&Sun&7uY#E-{mOOqj<7hOx3C)oBkp0+~>_
z`JLF$+z9i4ZY?$u+eCcoz64)m`ke|LpPcNCm7)g`g7$U`X2mm7hT0@~5dSe6-0_XC
zl|uuOZ<E4Uu|kTL?8$fH1^q+X(>OM2^);7)Z3g)|hbvGXw5P(&nfr6n!RoV)rK5J_
zSBRqE_V(?zd<35FH)8+9a^3(<>`d*-=(}=Qe%TkA2{pcrGLN<VV_Dz*1QV##Pcw|z
zGw;xU5SL!^*7fy^sE$`^20-ygrJ)!7+-lgS$#~1Gz|I%Md1`OZkLsTT@2*k%>r?Lr
z)0%Xkjn}^llbP~|FLSNb+4(pb`^pXM$+Ome*xLvB$31FkRDK;Y2^s=D@CV|@H+k(i
zIv-UveZ%<}2fG}b(;Rd&_rjmsBm6Ga{hX4R%wzF)EuZtU=7vWJ*+ltKP`0BkH4f@0
zEwYXRUgacC%zM84?3LX20oOL!jLB8UKjDY49eN84@e_YRd|9duJbMsi1qyVxeByiE
zfIcV=Ku{5)$aF>SrQBwAtzamTcmG%X9)ANPyXbu~KNvFRej(C@lfWvH^EvWIgK!kT
zH;KDPP2v@*9-yz4KeZw!FvCJ%wG0^21<E}{h6>JT276bC%JD@%Ev&*}dge1iHD>RN
z=ZWx%Lbv)nNXY8Puet3VBW998gv<C^Ui-Y%f$v<`effLfbWGq^h)}&dmV6}f%;<7}
z902z94{obt`%L-@yEjJL*2_r`v<Nb34e!m*@!ZMUDuNX~Qe&Ftcn@EeVB@TSM$zoP
zRCZE|*H0AmnF>x*lhFND4Q)hJPxJHONv=ZvpU0rp@=2d`VRf}&P*E2~A@GqwhsW0F
z!SABIIODO|J3}tilfeaz$PxbV_La=|oZb=*>jmV$yGnC8ZF>~XejmHc(aKg89a=dd
z%zth+Z22*WyVB&K?s9VJO!RZDU6XjW*@lfPOW6!Vptcyy)<GRgzlDQX4^8%zu;<cf
zHzwQuivSI>((P^W+R8ayHt66h5c7VWpS-V-{I;!A>G7B%wx6`%ZDmIi2-adre;<F3
zU>zp*HNE>u+8jVpm7z{eP_+Jt0k9Z=@)L5Q{~Xz25(6{UC}OKvx6wTNHkuOw7E~Kl
zcw`U$sqBi8S{$~#@b}@A4G|L>w=el0woUzP+x8h97r&h$=6=cLs<a9cm3LLEepHDP
zH(zZHk^b;sbVRbl2qW!SU0w~QnTl_nm{PNK_WiDaaD7k>*22Jz)4I9h>0#fvta7TT
zki7B`^2LY8_@==M(!cYCj_e(La5^HO0nI(ataLW1kzM6zrn6UM*YG7r8u@ly3y7u<
zOs;X-w~~cT$(S`+O9u^gVY^d}xB^}i)AK|zX8oP7(<9`@Dovj`uz!N-mFp3IPZnu4
zDguzW{ew2@@>YgrsbS!6NIgaeY){a2-DCi#r+VX2S+JBGCHcd%i&3x1QBgqiC?<l_
z=}@cvau~<26g0|a&O0^D3?6wh_r$Rq+Z%wwtMfpuS#B%@kNw?92zZR@1tw_-YW(xP
z>c3SyS_k%<FId^_#s#n<A_Bo^KXO1)pGCo!k<+Eg-;&gbw}rPxnay~>-(<@QosKfC
zak`yhD!U6}^+?~F|KZsH8z-iUJe~w&9lfAtB#JOZNKkKOF$`DOKM0OLkM8M<zPg=P
z)8#UGA7N7hW6j|Atf6&@J=|wgBLn%ejoVwN#`H0R=6tMdXn1SoOJQtsGMe-Za7<3b
zF`V?>BX!X@QeneNe2(hf7()gSIAkPX1T<yG*yK3DR$=wMxlAzKJx^7Wm&_<F<tL?B
zLO$0d*eZkf??5ztcgRc0dWIh+^Y(g;u961=f3VL|yBhXmkmg5xrSXlxob{(F`&O@0
z;|;H{9B^jJ`;GnAj>1v9)}G4bWwqw*2{c1W%Cky-;M89%XI>WRRcr4y8@Ice&zXD#
zlkdoeOP`t38CP@TU|w@K)RWFT3<D<H`{Jh={cCsEMgVGtiuJl{hlwGr2PV<euHUnW
z`CJb}f9pJZb^U7KWeuO;R@l+2woxRE_gD4kh(_&Ge&pou{?c6LZ|(CTzlelNVlbT{
z34kl~`oEvf0K=#)w`FqVGx#b-SO|BJwA5mE2rm*E1~>BSf9Orc$@>HrSyC{bM=GUn
zUPY}<McK>ku<*WmV9Nta7`kTYm|~KXGD+|={NAoG(2S(8^W~>+=D82Mh+{!+)w*!6
zHKj}|on=l3Esdz^<g>R0tT4gzE3j?9EJzr~{r57Hj_Wo(M{!4P>|mLJVx~NPw2g!X
zgfOESN!-j)TO=lDzF1=G{eJcx6AeYGxWk5f^}$hc6p7PgaMP%syrtqDp~S!YAAV9`
zU3Gr3M*zA73{T60YT?UxGPfrx<_}`bR9UfaTKbRn?cI2LzCXPK22jfO?Y%Ub1BAY>
zjT9L5@XdIBG~YiQv3hh~5i)(;yBhW&Px(?bRJ;Dwy|`i>2180gYpSNa!g>x2@-uwg
z+=19B6_`c?`uO1MzlUyK^B~3lIdlUWoq%WLy&XaY3iyA=GZw;^X}O{K<#NF9pU>RO
zBw~bZ#dC(fF?suf;bRVr^?q`Wj`T9wPs6m6pQfY-9%JHXm9)q$v+XF<R&(L*O_r$e
z90uHJ@(c`k6Xl>+wTQU6#dbl(+&VyH0$)b7oXHllkR%c&WT5Z@uY`Ly5HQGRWQayf
z8)d-+U{1WVSbn<MfPeg|m)WsLPAjElQgN!>`pDxIMenM2h$?+Baq5_IP`FXg_TI8<
zOb425@uvEc?`X%jkE+ETBn}=f77_hBIvd{z;PbKMmcm=T{}*p>9TjEtwG9s=AR#3w
zjYyYDm!MLLfJirrfHcxQj3`KhfJjSsccUl>2na~GlyrB@du9fI&s*zxzrVh<ST2!K
z?|Yve*S>a~`c!BB?j|t*mZL4cIUZ>55=QAMi|_^=Jr$z(3)&h|$5i}m;e%9adJw}}
zd!Zn5j_AMfXdiSjWHC_o=poqG(aK)@jXDS5<~t|eg4mRNMv(ynT1g_DV$^<eUg@RD
z%cOGYx-mfx&CSJz4~xH~3uHB#oFD#37R>ijR`|suW~u26lry8SrHAl=bjPk9m{KSc
zt$Bh3{=ZNa$lKFoNQ(hq|7#oB(<CHbh~z|dul`Swg$KXowH0jt;7W4SH3c#(q?tYP
zF21D&16(CQY>}JwxHydn9FSAX{63X#RO|fR#BtZzn%Aga*y-+@qBdA}T_(uAVnhIY
zwBU|qaB`KTSYWzZRPNyZST9$XO+`LsLev%E<~{Zb7sAAei45B>!*;E(KVC9T?pC)$
zuxYl#uia$cRypsXUI$@xKsfK6^|^S*`P8`w1yMH7(EEoNBZ=0!B{rZ0`9dSi1yN?q
zDq2BK@@ldcG$=@ZG>Zl#&DwYs1#eG}ocYnkL&g<>(Bd&YbkSCMBijH&WaF#W6_3>Z
z_Js&RMb-(}7BL|6d?O-A=@Yd0<dXG81$!*;TmHQ0Y9sjd*-(k>M=Yfs6l#Cb+kD$}
z2pZ~>?!WhNj&J2vV!h9tP~8CyXG*?SzF3{h(e*ffv$qKe`BRk$hcmLbIr-iNh7wn0
z@hAm4xk|BtGwoAWA9r@SlYFIb2v<30TZg;`;R=&<*}2yCB%X<gjgyRsW(0qsEBfP(
z=iHFNn)n_+sMvE?lf*>37U`vyx<oefdIu=1lhTuS#oSMx5Z#)YHAy@_f74S2dND1y
zO3M8%%dCFZguGG6kX3PMsaPmK`TwxgFj^h~fom^_Jlx&I?)tyf6F+99(ap!VCW4mu
zQd7|evGGkYa^HW~{kDVy)Ss&Agr{MocR^?6j`ghb?(7<!XK!#|(AR`UdE%|zM{lRx
z8Toh&&R2fiE8!y6O1jO8t+ncc`9h{~ZKU-X)IN-)F|x{x+?^iOhT78Ox&->uvLO2Q
zgWPW55?5+=0x~+k2=T-1gTHn-O)hF5;F1oe0V*Bg5vi&+ads0KhMUJXR4ChFbhRRO
zpaE{o6x5QEj~$qH);%TSn(+X0O>G4@^ukSrLU)#O2)EoRF>O#bp#!2UvcNIELqS^a
z?fOU-)``>VtDX1htWR142bSg!uDTS&-cnnh%E<=%CgJ&7g>Nn91i5;Hd;k|=vi(ip
zC*sv&;lEyhiJI&5^z_t9SEiaCo>R~{)h%^K(&@pp^MtLnUs0`8ue}E|V#gjY)<e5_
zW}R(--ZrJJFA6F~u$dF)>Vb64;~Fg-K*%^+v$LGk9KBusqytJ`gZqf*CQrhcsX_XW
zPe~)rj&8~j|7$i|1`<MABw+`v9Kp(n>d|1t7-s@~L@o~B<4}DCV@SlPi0p1dP6o87
zrWa11FgGPJoCf#fw;w!%YPvJa$jGGq&fd?=VZORAm(7=uD*<iQA;s_{@x>Z=|DIjK
zhuoJ4{zdFP>X5Sz4ZhZXx(Uh7Kj$bT8aV5;5|wj8miA`mXR+BRDML-M(Nw=xV)-YC
zL>^K9(EH+zQ&dSPl|wR@17f~DPI4puw`StORyLn~xtdpHTa9!UUP~J`2$mrcG5RVP
z7$OH3<bmzQQ)B1nU60E;Ewm$AzHVxn3>-}ETpQv|2!DXJ6DN^A#|CTt`)K>HlEm-i
zvqh`NGZ?5f+imCr+D58xWVGD$OPTw?Y%Eiway>}lh&@}seieMF?+uUbIi<){BpVRV
z${{-&m`$f1mSLG_Oc<t0oSTs4D)BzNcYNY&XwX+>N*d*U!!id1qc-9<j+<Z7=R11>
zl}cc}ysw7ya=)-<_awHzU3MfWqc{$G|Gwqop?n4v=vZ%{qiO;B{oQ>OF-9<iuwxaF
z{?_Bt^05CuSsvB;;HvOZ#h2Lr{(P_u;(Ix(=uPaXVbB@d=(bO-lF}UAq^sq%Z{xqW
z9OBb$i-;rzg%7)a5mdLX)TB{Rf&{Kmg(dXh7Ni~SbFji=h}|$eV+c~={2o8iC^ZKJ
z!HOKl2yGk3=n&`v{mEvs>i=URQ^U*Ih&d|6;}8Q;wH*HG2Ycwpu$z!z+3X^9iqU`r
z-<;3ZJtUx@dMNh<EFHIE08|^3#Z?<M1xOh4{vPPJ!}2N_KaHhZ!{KEL#1uQc0k(2%
zJXVc<pOD6B3r>$^R-Kk$b@1!oVr&HjU}C~)Cy1Jw?j5=GJZQX|`**zDQM_@d_<ihC
zND-*jh*jDIzE(3^jR}(C)uV2#caa7iFa+1}uHk(x(^xHa+{CC2C5~_{(6cS+ow_15
zH(nb&zj|7AVQk;Dm|-@S_-@2?i_)>~RmEhvh2UM&odFRxhw|s+ypOh&wJSx6RO6np
z{HirjjOJ4t`&;v7@C$SM>(v8E3HKA)xVvW3ec^bi3aM|d&-Fz$#c<unKfpKJit|;?
zv7Y&bZZTc^rRN`vq-c!M6wTJbQvW4I6AFw{uZwC4MbWH)Ir9Q~MUqGVjF2Q<DY=n2
z!L?2EzV01_o_f(!q0!si`lS^02Mj{g)5GmoN6TJ5SpFlcx?0W&n#x_%yp_R39jO`j
zZEE3%bxz2A0A#$Mh**Ni<O0*)g&qW2*>CS?6pWP+w3B+t+J5b^i5Hd`Ukr_qD!!;q
zKA*c;M-Xz(IWeR}V+@vQu!eX0SIM@}gHchq@FsNo#D?)^dU^y?CEs1s_vaq3JVj8$
zN_uvS!F2juS{vSnt2z>iRU<Pm4f-=4fDW{XgL0Lb`HigVBx0ZGHSsr~{J#97IqhN3
z>no92EA7vW`VLY~lCFhm*)KeCo9|>b2=}7%g^hoEta%caR<HFHWSDhidxy>wG(sBb
zI#qCkh^8+~JGEN%gnvfMLgQ_)o#amZ1s5D$ud2vw2@W(roA@;$gJnuGTrO>!#Myy+
ziZgq--4JtRfAQgqvj-(#h?iq~$1rLfdUT?7w2M^supqi#Qm^zzaTVgFEmf6@EtCVS
zXIQ{&!2iZ2-UwrHt)rSQ#RYYq1c4mCA3qd81&;{qkC0P$B0IbLQhFnCG?LXhPX-R+
zK7f9)W7GAU;cUIh%<Q)?|Lp2kamQuCURtb>(9!vUSyM)K5vrzpO<>7FkMS^5I_u0t
z3T5VMikCixV|J*pGgWY9a8TICZ<FSHh6=qQ{n;u3U~2+Xx)Ju^;_oUwn9eub(HabY
z!rNOsxOt&Jq;DCIU$!uhgH=07g_7n#(E>3WbO+3+24+S$8K~Whe2;XLMp3%d$h=eO
z-DTbhPnWH~9FgJ?2a9S%YSyochzGm6?9jG0#ra=pKC^V$0z)8k`9718Vlfv%e&a3-
zEpKn^c8BTB4Lqjeuiz^)6FS2;+s5A@AvK!;gb3?*1~B7RS7ntupn3M9?tX%8%_c&j
zt_s%0Ip38uknzd-r5+~e3$H5V{v@o28YWr1Q}u2rEw9iu61v41O{8pViv!yu`y#v{
ztzInqB!q{XX<_N_JSNDmW+KI}N|c#nBqq((O1dTP?9RR)QfYw#?(yO5wMQ*txM1^2
zOwUjR;DwTF&o`!EzAlq<h}rHv+;r8#$Fh#CBl@1(p;A**hFb?a{o;q9;ifOkO6qtF
ziRxtM_^fS{5^v*X+(HkGX20|op+HqQh)_~3G#7SY{RfHP0=u;(LCO?0*)`bR_+K(j
zD0j<LAJn9Mc<S=-kgza{9R3VL`^jVVHG}$>LSV$)X)y;3B*5>Q@3dBF1V{AoH7e^f
zAqY<w_0GJ`qILAeK<7Bg70=~8oyOPVW_-F#Nt^vuSpMZ@A9VC>GVcI~(V>1OfuaM(
z4U<Jpz*BI6hRPAV4=o%Kz808kk03rLYglbhk^x9~kw0Vp^Am=Ytu}J}Wx#mk6<6uh
zMQhvF)>b-FdDy!h)5lf?^OL7URFbd7cnzCwrXYO2Jc;H$hzu?IG{6dI(aXX74gz^5
zq)u6Zo&nG_Sh@bF2gNS}tauGj%RjsCBZF6%BC;L1Rtq&SQYUJk@k&)yHAlO?c26Vs
z&(Z7iyJWl(d^#i`arN_X_KzwrZ~OG1&iics#zlh@77>HgV9ijS#g!0-J5SBSKy56x
zoBF2WVu;vl21%bFMXlm44YxV!XdVOF)!3fFz<Sf+dr#skpU!!KS<b#HcV@8qh(J}f
z54qFg?TF{n)Rj<|e99i_?+%Co5!clXZvk7%Q|G*UQ&XT9?W(?kK~#*WU$z7|U5;Lf
zTxRqF2~Ot&q^ni{mO^)TUBAKx*>38#S|m9F`%481^VyM@@;MG%oQSH8iL0QsY-bD^
zb6A4O@1HnXY|oE6u8ny<o%7hwi@9xc#y&n#k|>Cq!FZ`s=xIYxG$TQ))GKiZ&P$bw
zK#m_wFd@I2sX?)Kp8t9n<%3*S))@W@I)zlc+{SNFld^di73HSIHXZpC47RK>$h*?e
zKEde}KcxHm_6EMdSmH!8md_1={C&_v0-EWiFB)q1+dwDI7ZoXn)*pfV0!4N@$4PRT
z>7e)M_p1p)JLpvBx{QXA>ZH~wvEw>&_BQ2Ittpz{Q<HY8R5RNK?A+Ks`_8p|)-M{R
zTKMeU{FR;`6iD=Vb0kV22Q?sbi^<#^Xoo!LBOFoX?{yw$#PB5cl@CdHqh<~p{%n+|
zO~M_|Ke&Nl$~p>YYP<?7WR_y9B6qdZefKj?0Krs9U~8Zphxs81&Dcaq^3bB#>Vgj_
z*s583N0b9;Zpi#p9#kX`QHhBNFA&<lIaYvLBhx~YgedC|=stX$D3Ub^InFaG<C~_%
z5V5`M7+dhQb6;<vRtaH-Nj;dKdq)fKxHVyVu!-<M{^qDTC)A+uDsS@??1)P4$tT`s
z+o$!|X37Hk1k2|E(#RbEMY{TjyOy8CSu{(O-JT>=gLOgQgL;*kb3$`X0$9Xd2_wqD
z$z^lf3CaQB1ZL8)-P@2Z;@>KTlJ)B)@)$MhfoY#4%tY><n3ha_`*dfQ2!3C?#EHd6
z%uArp5E%}P_BY=Fa^@3BlG3C9>kc8%#JA=O(LzmJ-!fJM|LM4Torn%nI!}=^D;lpK
z{KF8DX@eGhk3MQNpPPwL59gci?0`wmnb{3nm+!_b&@C|b_bbDj&)xQN=2>ttPX>&<
zc`B;svbE>x6y9x0xM%1iY1#h-x&O<j(RB`w>_>KUp1pp$=SBF|+(qjv{o<@Ic;8M5
z>0<JUX!5RGJKP-k#fdBtcUIgI<3RcNs#x=$PoVOE2e56`n_KpHw~WQ$!09jvaO<x;
zEp(85+5MqouSb`s_reDQxp1wAf=3?$%5WOAUBAPY5NG&@^b#_hMhx>mA_-W6eO?}z
zYpb=FExLp!OMD-+65iVE7C%~=hLKQHhc(nXGP)Kevg_6`zJ-9{euWk%^h||N5+ACB
z?JEgz7HAqzKH$GxcxAkVl%V^YS_z~C6_C!|xjNuK9$g0C?UXQPwK6)k-n;t+*=de(
zT9?$}k`b7_r!3O1hl4JR*}3)5@UCbXFzx&cIIu*-?sXqYN97<@c9@})?f3(><m(vP
zAsU%JT%wvFb9z4id5XFe42<8DZmp8E2cC-K<I(q}Fb0aQ*9k6vL&1u=$Hn|0Kx|7U
zsE^X4_f&W<XlD~yKLl<@Be0us=sxhY&huXqb=Z+zw?YB8QJuXlFz_mlT$lVN$lFCO
z*B`j`i+ZE<18iOcoxtz(0wyo(L5vIFu$0{wX(N$|f5AKC+w-TQCh?seXW09C5}SSL
z{hB|<dd`j*y1Bbk>tBRmb=^81{>3yu`tt_=%+azohPJ|&1TF4g7DY0Ui`7oSid9kV
zFu~<jrdNIJO%BC1pMg?sR)<>&$v(9&A=9ge+8_5O{20zt=MGrd&B`s4eDJXKX_m)B
z(V;`f>@+Z4`~UANA{Xm%lv6(H64aa&dakE-jAYghWj2f3{`?-5nor%=;L-%?O;DS`
z)sW~p!oPjEVEJ8?Veso<jXY)}E0mw0HC@>Wt;!!rBc;FR!&ynQt07fk)i?5rL8ycd
z1QQ!Jt=IghO%>Lj?u#J+uKln5SxCnpL59{;WxUr1s4Z&az@36%yS`!AgIa*6&@u}w
z$fYLQ@eA_vjL7NP4YQ~JqHXjmMJ>B;U&*a97e2B-qtesj`(5v(T3BUPPUuFurP*Xy
zBYp38z7E0ndz^29iv8K@i>h%r_m_i#l59YDit)yWK@qRD4BGMbahhx*Tfcz%`Zl*k
zyq3c=hSXJG5-`FULu<ZW@F>SHGi^`o?%nGw`9rbAmDc(Ur1Iajn3PxUSqzvE^BOhs
zzFQt{ymI2a8u2?~%}y4mq@L>CCy7C*0UpxXvKvTTbqiUUJcT2b4*Av6cG<1m7S*$i
z8V-JdN|(4M#MV$9r{Ik_R6vodlYi+w^6iazz`vWHfcu{?87Sm^akpT+PEpr3CTIaH
zuo7rgl=9dSzD6Z_zv&~0W@j}%HyRon<{g=sQeREg@@<?-edq=Kb-`_5@tj|Netz4?
z<`k?YovoLcjJAM3`|StYufYI@WE2N5g26`W^LM{b!43)iMjuiTHi};>Df~*%{234&
z9PD%t%=97hhoo(HP0Rg{%#I*~Rq`p%=j{LdbmuTU{it-?<CW3i3;qbCtyOsu{!D_S
zWZ}qBE{T){1Ry9I@J{G2<GD*<Klf+}wJ{9brG>2bk=xR_`~&vUNMOGZ=O}|TYGO>U
zB!kG|0m@nl@5t_M{J06p$f?0A7Wxx2t1Ea6=1RG|?3~x(s*!G#<Z$80R5ucOe>RdY
zTSNq38-Gb-%E`wQfSU2>kL&B7|I6;>l;Q)yz9faN!c%v_pGkM+Hv5-&b>4x6nw`T!
z#o7?2LraFs4LaBJbHTpY22ZE6>%cz^j?3yngxHE+og$a}B}h|I#DsUL+pz~&45!^`
z^BU}(D8U{Nr;?&Oh23K{utQr<rmi)1nFKroujQVt@{gD{+)*`A=5oH7rS-QJ$;t}r
z7;g1}h`@S2;#0&Q6*dv^_KV){qqw$3MfQ%)@cMkNiOI=~U1ep&{_&<tms(lT4U}7~
zDx!4|0#g0RHuGl=x3?i~CbE@iW3<0jP|dO?`|zEkB?D+XYxzDt*G!|eCdnZ-cH@q+
z^82vYa!w&!FB0`h2wcCl(5WiZzlZa08hupZGXKvZeU?Q}c}>V6Pi^KCP(~1ze<t;6
zT=v%A0%s-^C!`GK_FAxUaY_$iP0OlZ+314YvgLSP88ozJ87SVaGHu$k{N=g8!)vMk
zVV}Ou0ilt7sfiw6NqF}u6v1qq2br)t5*G0}N&L-qxu4^{zq78>*VcBG%vCV>d%U~Y
zR&p^3kQtVr2^Z)$SPM+YR*ZR1O5b6CbRXW$<lW@HYPDCs^Vfb>kTWNH!uM@jq*9Ac
z`2qI9j=f)Yy?8@|1k0mO0bofda=w2;7Q9lJatlkSu$ST@TxEM=>w;Z;!to?G=oX&s
zdw=1ynLq_LhDSJ{8|6}Efrwert6&t(L+4QDYl<SWtmBf}RncsRf;0vY3Et;YbYq!<
zwEAA*2Qg;Ote*EDrYw}!GL_4l{h;<6tz3y0TTr{3dtJyH_j5W**?(Y0HLY8_<eF9W
z+J}#NV4o&;im=jVzxdvbApBUc7A;Ss$Tzc`jYj4-Y#x(V{5ZjBQXQiPED^GI9xTwj
z=qk?MW}PXN==ow}6#?>H88wqI&{?|pf`L4GXdv&kchdHE>Bz`PcAd&53A23G{X5U+
zje!}1tvdDqe?MzD;7Ksv`*pO^kw@@Vnu6Il2$I+{fV)sGo^Gv4Nw%%1!!$fFNpNo}
zd265I?rl@fQdKlRvc}T}2NK{`Xc27Wdj{Jfd8WaRnewOhnG<W|)(4pxg^UN+^q)Cd
z6aI5^K&G$J9^mKsLsVMz-wx^*Buc+i_sNM7!spEDd_~Sreshb@E@kE{V3>M06%31c
z{2LadWf|)qq$#!ku4_>XIH9(oLHvE*M%g8w8kf0`PK98DBxo*+zAuBDkC$*0a_Z(e
z7oJ}4{KsbeoRsyaHe(9qhpqX(honlORgea!o|j~uDO%YooJK}RCvG%K<!*cw`Rekv
z!zCL_pYHf%^!a27fqhY^a3Hujoz8sXVq<5iRaK4w4a99REvuOsm{4Yq8Wj7+!oWua
zCI{YD$7T~mC^d1Q6R{?*+jl{Qb{|Xt7!g}oMN6;Xy(@U(@BlOH{iAmZY)1K?h}iz4
zelsGMRGY}D9~Uxo!r!9oaZ&uuWqh&r2e>BT5jh(uL>gbgT*>YVle^)-7*PNEe)sh*
zcQX37jl~Re(k&(yZXl&FyZ>J*X9E`dMwz!iZjR$Wo;^xd@`#<PTZQP?`aG=DM5P0!
zA@^mN+f>>wko^f!;J!F8Mr}4gNUh;ZWP`w{b$H1yQUxStH-HDGbHpDlb0geIF|n>H
z-U-o=5_0_vhOuYCI*Di1cZ~KQ)>DLb6MQ+)d?K9!IdeCp{N1zprl5&KZ+%$(iER<D
zLR2SBt`hOQQmBREI!e37pZSYwff$g9*+0nRw@1+Vg;~!dlj%dHky8lG*Q9})P>T=F
zwAiSfC&*C22p2(vjKvF7KHrY+4>H;CDnbt!x3D5ZR7b_@exQb$ax=kuqkY^Dd0)De
zhvIqlwmvM~t&}3fmT1d$s02Izu2E8&i--qG8O+SDT?0K~%MC|rXDYN~FkKyL?t65o
z*sLdEBP0qhhv~~y!?y>$5F&L~?@bwsS^e8|B4(7TZ&9ElGBD%eNkHcZHd#d!v4Qf?
zx$wq_U#=rXmx<tcnow34of+V+iG5eAH-bQ4R>mDiv)-Uq@fTdIZ2LI4xU!?vq4T#d
zH|Mena-ZsvzyX_|pN~H!U&EMQ?HtrRHu4rHacr2z!mDtX;U<e#Jc>kN(-NWr^G_|*
zI5^wF52M0olQ{|npS1s_eUUgp>@V=%*XHN&-!~&@l!62*mX|=qa-bs++4?M91_%(a
z7*a==$`9@PBYfkL*yK@EDL^)~p)G8=XTO9@=;!yJm_{i!(@?+vlRMBdFc||a!Mg!Q
zx507^ycxRN-%g3(fGde>*eT4XNR#RNDt601B<>C940^oe-O%`YBi6wFwabtq_w(-)
zAWo*HK1c35sf89(ZOv2({z&4lpDK-d2pXGQIFajJ!`U#w{i|#)4WJOvOe+<ND0gL>
zd9AUJXqV!T@-`Z~HEE&PMOaoGw5CUbVM;2ad0(3AloJZAx*7b2F~RpUPT7%(#{KW>
zhlkk(WkCg*JUo*Ll5z8hi40sN{zqoEJwGLvrd*S=RTLdJMW=Vg*b?IgRBR6>=N$72
zbCunf^X<;$1L$BLh^32z-+p;Te{!9lpWNMpwzvn@G~6yc486_kLpHyZTi2kT$ztne
z(*G*-e61PNS3bYz9EZ_3UHZEVzrf=A-n>_hVl-VerCGe>c}jyTAu*wDJe1&uHYg7A
z7az>C2G}jgntZ$`xFP}L5DN!F3UPsv^FuMg_wXM$#E`I`>ipmq`rGVJ6SQ*XR<o^!
zJ3aggv4_>~8|p8xV08wwxk0zsv%d6V+{Ktt^_4#xs!Xx>T#z+ip3ynIcD;5#`PBKm
z+w}l({&ZOKV6R+kvrP1SI8+D%_8txMG4xL`oL4k=^KCT87S+usMwfpKg={?xmn>8)
zs;g>lW+oJUIxV^s!lV^SseA7vnt%U9&+bs)aYEIoU(`HN;_r!k@=+4+$&{cZ%x<US
zD~VCh(6#2qbhY9J$>ODi7hktjHJ@dSb?*EMG0zd*E=OF45Vqo(gL^c8u|;U96`h#4
zsx6oc6Jk9M==@Djlg_*F?uEoPC<gNNF)-IiwstQfAtjQ#@+?4J(!417^elL!^PxW=
z$07}JQ}>z(fj~*fM#?P{m5YpwSOV?OO<r<SsJXv}cLw2;2e&VrS0Bzl+;rWHJuKbW
zBuTt@9<a6qiG$qE|54nMIo)hXbg|fxJWeEOZ)EU#HqI~JV|GEy^Fg5%?CfCJ)uR9H
z_Bl+@?&87vZl=jqeUqDziQf}xy$o*izS$6|?R;@T=bdl&oz0jb6aD>pz1?Cjq!Cgz
zXHdG5VOzhG!zP#B(+yh5i+ZU&SW#BpW0?02{Qhv(+=i=iEuS{rG(Uc?FU|C^i!+wq
z``M|v(i+SBPIW_F>l#zf_+6yLs?0BPz^&<WY)>0c7xTn@h*%!u$qz@Ey1Kfy4^q&i
zhiShvjZp=cF`)FShI?k|oEgJ7);w_x+&PJXfMWXMLQah&C%}ciNGXN^DK1eZZV*ei
z=wR?cJx`7ZDpdxzq#jI-Via*SWZX6yB+tb3^?s6(a^)qo<=*GoO!*lY;`oj7(c<wr
zHQ(9x9ddGlYd&sPJ6-KbQwa6(reN36=QK)2c4brN#>p2u%?R3CmN$Whd5lXQuGUp1
zOMA^UdA{n&Tq0QEqrosPjuPMSmX>N*KEOD4SGjrbY(_^?Wpn)r>;8fG=IVhbEE9IN
znu#$yX}|AUF}&n@W6QPB#^z-0BH%C}$gcjva=qbvsNe@N&QHCHCyJT{gkKc=>EBR7
z==JD&h+|UDV<GlAvEqIY8L6SApW0H&it`S}ZvLLzhqe^v;qO!30GBnOL^ZG6(t9co
zZK+LQ@OS|9%^F-{^aL`JwXeW~{=hXZX~-vV&oLAyg!^`FiF$dvT~6Hh*=s!oTu&on
zvsZ$ylT*y^V$MXy$|J~q2qSPI=8&J6S1><xWVlFfDe&kur7dk1H?Le@ZyYzj%5gq-
z9P2!>y!0}|oD<SeSE^di;I!wPy>;&(cwE4HB^qP@B^P93Y%D9P$s3*wTOJH)ld{^J
z6g(_bX&v+ymfD?|-s|4wTRm3U#QoAMd7#L0JuqZ!@kKqR?zs5gm#-|Awl>xICEOZn
z>Ji0v2FW>p5Dlx`*+S}2Pyfwy9ZcdMfzq=Xcc@_}7@Wx@8+OX;t!qK#xjN1(n)j8x
zmVuI??CvWUN`+>&imuA}gO|U?2E+ilZNvnmVsPO%{I3@P{78gZ8Zr`>n+9AIj)HMQ
znQjvQbCVd>ujC(Z1oD%F=Vp~XVUc|&$z;4~GC3`8$!wW&=;-?dB4U~UZOyH?dBMDH
zf5YfNpzd_Zr9afMDWS|y>g;$EIH}qzZ)&WJ{z{Tmr<bb{NgX)#8YSRCJZ;YBdpw=z
zY!3Has}Y7N!-BC!BA<J#v3whq<Mnj+Ld%=e5uURP6<gtwe~6R3+d3Y9oAWC={Mu}Y
zGjb}j{i)S?QCL|aUx~L&%~(S%c*>|mrlW{g9RKGtjj4-!Ras@`FruyilnQB^rMzY&
zmW1yVW?7xB@v*B?BqPGJg@a!U<{NfsTX@7el3(f(W5ffrB5|_-0W!v;EKc5Wf!`7(
zPc~q1;-WTWp%AF(^^wNB`{rTO?DCDHqunEU4ly6e_Q~WSZbza!NWqNsIB!1I*j?oN
zb<gNT7gh`NT)D5IrIE!Ab2f>(SXwsUTZB#Z$>U3Do{!ua^NJ#<T=wU$T$ZDGb?`3s
zFhI|B%$94?r}gk^rDKQ2@Jgy6)9fSCw&m*PCQq5Xn0(DuUuNaMuxF*NtyVCE4FaLk
zfbdycHg}#fbvzmOSd2`u@_Kmw-X_}<epvC6uf}s+vblfNt}$t+YSLx&zLDggr#8*b
zD-7xDp(gF#gzL?R%U3u1=L6>kc;Kttq}o+^xl0|*suwx=x$2|w=abG?rB3-UjEBvW
zPDtKoNiWzYSbn`xo+f%Em~I<7nE!AgQpk7<ZEK7(Mra{kG}eMUK8fvhd?B}i8yn`U
zWJbnInJ2yw`){m?vp0RE$DpSgD!(k|%(A?_Kk*e5a;v#p+`*V3VI4(<!P~Hfc{6KA
z+ZtKdX@tFs`Lv{672)ZhizcyqTRBmCJ)R7E6Q?nJbQ!@tV%=KeRnrwOm+$iE?*&r$
zG-z+j=+CXJ3cU96<K*%u`r!7(oDZ_@P3t{E={#HA{QUH3t{o1Xg^OCyuJ4)Gt<YRf
zEm@twT?(HABWO#Hiue_2MhB?isdcV@@g`~Q>uhTK{I)#ik0%LJ5TuJi*_S^lDz4qO
z0=EJZzXw-O8ADt8^p8WRkw0$%w@bGuE7Qm_`$~Vr!a)#XA3SLBW=d^h!!UQJPPCdr
zzM}C`)@a?E*kbM6Mj}Z~rS9%A%Uva>O_gFAbujm*sG<8Tt^dQH=zTB)5D@P?A9$Wp
zf3!B>{5#dC#J1o*h11Vm^OfUR!*!0?VwHQJ<5%(+yHf2^pl@MUTi-EZu9+iPAZxq9
z@5g~Q6JvaB_8Y~;xLQWG3~oI`zQ7U|8n&EO@I#PK9E*B`CJI7fCKR$Eeha~vVf?)e
zj?tRpQsI9rUcZuWW9=;48;;KgN%X)wqh%z85L$}{<jomL?$q!moTew=Y1~_4Q;$fQ
zmTJ<Pc2jIm@=3<S$KUho>KP6jw-q#A<I*hZU&Al{g=pMzKuk}&uI`UHl!rbv6^Q>*
zQB`G;KS{V|@#jN%@2|*!gNrz#YRr#?mi<@pV{0^=!t&_!)N*$|q|xr1HPN8da(7oc
z7>6-}4&FH_H29X^%ryITyPgeFFIy30SK9*=jxSZySR1XH{%r6?qyXeGQ9$iw?lV@j
z3%HJ9tcd}ByOrBAWLjBgy|Wl`jrrG8z041P9)vu@ITDp-h5USWmnGr}t7rV<Ti4H(
zJX9_uXSPT^k_jgcO9x!^EV{ad`aX?WdRNStOd_`CuH0)rv`rb@*D`pKSMaMMs#93N
zFStcoQ>g0i<Z&?b?PrLG)>LYlA8raCx}shNVf9X&M4HhRYO1F+JRjVgSWif|ma8)t
z9TFp^Ey{wjArSqEp*~Ym0ENBC`irzO97Cj)&CF;qk)u&*1W?Brfz+C77?=<EkTFl{
zQ(esCIrmhC)mPY5;q3xG)}eSiuXTs}P^Q*bAh$vH=yPeVPJ5z5*3`*nJ+r|W;@F&_
zQ43g6e^W9(Nr}Pd%EpI?<1G`GD1)k4>Q~;po0}+ef%6KB$wS}*n0RcVeI8nL=`y(q
z(}|I7#G(5Ag*EXnNCyj{%<FwPmu~j09{Ln!4M{@?!Lw66MtO)PF_cje+spYvO8C`e
zQ^AqS!arp&C{N1q2On>zF5jl4n74Xhpd=P6w?Zv-^#`UebEORQ##-KBXuM-9kH>uA
zG{HE++;u{eGR3)$Rf&pHA;~F7x(ajZWX43Wy2>>F_-W<p%EboKE@<;IyNro(Qlz=F
zavhuU{_MLOeC(Nb`HnZ3@n~7UQ}9w{h+kt!Z8G3O<h}ZCdjTsiK-oy7!Pzx%^*pc{
zNnqt0-8aaYeSO{G{B1U$z4O`=>_oote2k^A0%r1F{?qX<l#TRE#EGBbdL8va8_!l~
zJl4Cb_jj!9aw;p82C|ihD)w2e%0q=BC?Shi;3eQ=+s}9mMyaZvn>tJIZlL9?V<0CG
z27#uNQMs=8<V{%xt5#hv92b8<Zb>fn{ibet&nqNQ1n58?E#NqDM{su_xF{DqBc^X_
zN!Sf=1t`!R8KCy^FVk)SrN72eVm>I+P2bG);2vfJq=b^}Pr6nM$~9>cfe!<tLIPWW
zNk%Os<_keCaXJdag#>t!@JnFQQshi|JBEsT!vf@q^_LAHBlyr=a9KQBbk|tW0CtEJ
z`3y>^XGpKzxgm)Bxo;E*u1SePL2?j`hftH9;Jv8j@w{8f<~iSA36h3?7tBr743v@3
zy~6OK0tLv*osinG3#ChX)VO^C1uD2m6D}QGw2l@HiT00cBp6q*cC5Mt&;3cs`8b?P
zPG%H0Hp22n@97x)IrrWwzmJ7}un`XQgNZMF$OHc<+!~)4!U{=T7nD0ie}IaV5j6LG
z@CV0xAMVI%U0}eqN>?zE{Gsb{kh+$dh01*l%|FP*!`_!vZWz3rF8q*^yKiSuDV5HM
z7kjZEtzn758Zrz(gt;wm?O^v~QYJ+P#%p|d;Dj-`f<wNzmtta!c!oYLZdRaA{~hSS
z#&qFkNDpSUG5gFCpHrNxZt+NUo(ZK}VP|C+;N-927idow98!3_s2O}EwA6X2>D_|e
zIV2@IpS@1w;+>|Lgkt|bvEi|NYF_X&&V%DJ7GOHCp~2!rH<2XL{R`nDrD8qckwJk9
z7MT9zjF6wu`w(~z-kIB2RlM#uDZKbkh&N{vN(IG&ebECpDEGLw7p*1%#nEQpT0F%c
z>>sjyZn_aOfB7hDQyv*FFu(HNULTv&s4z4b35bi@X3@x59LY%BlVwATpK<1+Z^~gf
zrtf6DNuDftttaS5vE=EyOpbIY86k<zFT{XG;A0Wy#O0{bm}zUr)w6`=7Cn`<D6PM8
z`)MsI>%pF}KxU!Z%q1^n(-(Pkg97ejP#&N?tzYolEMjTn-yqD}X8K1R(mRU_Y~@Pp
zSr?3H;Qr@$ZcASt54f83zdfFGvKo`Nu)JPAYE!O>rYdP4!v|5+Z8Fr~Q4Ust?*?`_
z1nQ4v=;_)tCN4%$O})OTKQfJC8`2w#Zb(9_aDN^x=XNqEY7fpgIJNH#=5VkkWbmM+
zPmBXc3+3VM?Q7ubZQ?B^B$zJ=H*LL4axeje7ol?XkcGf!Fb|58Kih>Q+|b8h+Him3
zT+8`b@qxtG*?>iq+P;j%zakI8XoaS58x@9A@bOP@cDqBXF5P*74JL7k>}QW@9>I-y
zZ)*-Vb?1t<wmiRVNPwj>xEC9BO6lY%?6dW1u$BQljlCMmhYM@*YM@cxGl24LWhdQd
zCbod5C{G)b;-%9(>t39%-->Rr4x2{F#JUH^2B4#8OhXuuiQ9>tX4b^P`DE{fB1D8s
z@tqurbW1?X9z#mOS6sn+8}lC{G3)Af2g#N=T9`$*-O+MMyM<O;_Cn&eAmDnuIMF!{
z5n7l2r@ZDiW68r~Dgy}%{wq9v-=0DVDq}b~c!O?5pcExipYs~PZNP%8t%vG&rS1Tc
z6!IAFqD|=M3Gh=in4Q%LsgITzEFW^D7N*J)02=6>ix;@O68$K5(Qwe-tW6)J2sm$L
zQ6agcz_bnJ6Nxc^3ncmU(*HdKdJZ)_8pg-ijg*A<|9LPttZ7<&C0OqOl{x&u%@hCv
zm21IAcrY2?D`Wfj5Q&YI54wOqY4WAK*niOC^-|?Czh)jqXqVyD3c#G8URW9T$Q_{o
z8Oi0y(gsh}@(C5L+9*f~(2y>|20X+lMV2?}h*^uD9{!x@_~`J!pgnrqB<6klL&-LE
zzg<*n=g{>Q14Omw@UWf?L+>T#*1~>$P7J+Em@*^+#lhr3azAm^DHKjOBL6nu5z?4^
zEc2q^+Vx9;_*0_sasK}UAA^o<KTFo-4F7%ai4LAPyx*F!`DGQi2F4ScFHv%K5(bD{
zE&uctzb5FFlilj2dkYopVn@0+vmqf%5g(NV#cN77Hl=qgwFF>~m0qz%!qJGxSOIOw
z{#zE<NR0(~2*^v?KXNaCyLmxg0`e65X!Dd(W?~+A{_yy-gqW>xpW09RX>Ytji}O2V
zwKVr<k=9e9p{8&LhjHd}3v7v}e`QhgDwk{V%YSk?9AY46CKiJ4^GZEtNl+#nFDal^
z$qpL4o?vWhL-y|Sm}=41V{g0kehP#j3_TPOtup0#h78!?ahUOlA@q^&@qx?1glf2B
z)wwSAD2HU^bLFxqezcrz53byrll@Sqp`)5R7SE}aB&2cd?yekS(s?At^5+hlrJx3y
z^~u_^xQc<9#{MgAt-l!|-W!<e>G^GEforet&AXGMxpyloA1w3o)z#DrE!48v>0RgK
zqsD8{F<yMz^kF2<TTRB|G8ul@L3d00a9^bQ-BH2MVQx3G-kkL{FYS%(j~N}N=depf
zycTZD%GKMJKFLzMbXX<wXn7y}WQak&QY{&hl@W<u4Q)ccGQfQ?0HUgHzvc(@!_5*s
z)5f0olG4FJUZc_nL>DI{l83|1L^|fLRa2|RU1+?wTh2AKw9NP2RxG(RH1%IPhh_z%
z6m?{e`xiYpzemQ$d901i_JM;BZEbD){D`FTn$Py_EG=vlb@Hp5H%rHt1g#L>>V}54
z`)<|~XwO?{Xhs$w{TD0mUUg|(@5KY-IsM7sd9}h)dGbD|Fb*rX<y;1KzTRo!tXuVU
z`@2SnN5a#m;)0derVckw`>HFxgC?tc2SeI^V(K4veU^zYHGl0on(;JnR6qhr=_1tm
z_6+K#GoYm-#{(G8-){wgTnKRz@7P{hSCgFTd>qx0k$iDpe)9dC$V`2@PoBQ${9u$n
z-P6JSwX9BQo4Uq)Sy#&`ieV7hvPcJ6o4xi-Yj~{Xa;Kb?{MMhY;=e=U8~u42`2%^S
zX=(cAi4J8#Q*NylMMQsY(x6RuhEbEq8zkQ;Ek|~1*?E%HIGFPb!uNi~X-#CxrWDYY
zA(m1;rGI_%Gv#-^+wx<BGe4u1&0d80kE+c?&%CN}2f3d1DUy8k{I<mgBQY7|NrL07
zM^oU|!?e!`fC@)&q41t#<<MWCf8YafRe-YS1(^r{_PYWVR+%=8!c#0L*t@vOFl3@4
zv5;TY+T>J17+=|3>{;%ucHc0WRp_@_Jx%@?if9_i<H(>w8tqKzAw^DQV{2!gk=wTE
z`IbM8_n^xt3+1cx<pHnBg!P1fCtKe5>=lSi{-mES(xcQx?o@BaeCXhvJZ@odYE4oJ
z6A|@+w!luNwVbC04>P@1Hpl3&$srrh;PEe_<Y~qKar@FW=p31LL-5OA<ZGm&PI58-
z3i`Fp!MEc48e|~!+{5a;eq0ChGw_;9njANT?eZ8LpIgZdcIcF=3~Q#~E-tGwlQ&Hr
ziG80djpW7eUOGo*&fR<b!~n9FN}HD{A}%%?Xb<BJT>%pyc6t^(;Ip$?SLmSvZCX5?
zR<j69nr?VGehDt8bQd{6J%KNRoofjD(5uU<wY8$g!MVK2eVNYVVtO-k(2f<ucoXqO
z3o);H{->`wW6<R(;B0H!Mg*L>k~Nd`-(EVSSu&Ke+KUWB(~;bU9Ev`5%Mkp!gw7{Q
zkQtev+I_$qMzFxU74w}2qj}1I*CEXGbakB<-6>B9ukP<lxcAE#cz@5l!0-5zG}o?~
zpHspZEIBe*fr_s#-Asev=*6L--Gv^WQ#ZNrn|3!m_tzLwXf$lv>Al|`OgV<DRz?;k
z*o>o1v%FI56(#a%*e9KWvh;oC6=H9kpQSgSX7gTr;Ty2!kAiFk;D3CDFe!dqzs`82
zg{KsEMg8?yr2`Y%hvK|dL3^NCy{jSMMqXkCc~nGp8p0jE3<>W*c;w20-vn+p7+P-0
z`ZwA?PG{|l(Liy-N!_Bpqd{jvBO4;gX`*z@EuCO+bd+hc{r$A#G~ZzV*vFj{MLr2F
ze)FC!Ed`2AYBhtRpl9MKhMz*8pCWmJ#L&3UN+4r=)AE5lAFxb!xdJ>^gnMasXuOn<
z#_o(gueTYDd$JNIb*4%rxg*8Ve!D2O31Ax`pOMQfYrLi`2N(VdM}4!pvMs4XOZloI
zq$akWM@Vx$?`N)L5;~;&`Wm3QfGR7(Tx4YX0sJapqH1-m_P`a&!2Pu30Om40J^~v6
z0ta{$wb|d#@qt4c$46?-gM6_4)o5n}@x#Z1!-E7z6ION&nfZ(QQ9CE;goqD>BX$g{
zZQ44TX=8Z~t1F$F_tEUQl@Ri1zVdGM{aHA9dCa-$Uu!vN>5eg@&R}@tde{rIZOLvJ
zhE7?%QD<<SJRn_ITGA7i8@~kJs~^d+n22w{{pSwVy9;a_#0;S=jT7s6ntBC7*#}NY
zsv3DdE|*xQNHl{QxDZAy6d$`}S=finOu+}zDHtIVmJg_b`{}~sO|HmwVP~*1h>@yY
za5-N`oSQr~FueT(A1Cvq=B!iHV|5)tc=FrO)639Ee35G?v^1mUDM6*i&|pmA8<0eq
zb3r7QcAv@4W;0K^L|JhD?Cl!*WdYuj_(yF^{Vt`Isfl9GDP3;sun|m6tLOZAXP1x5
zsuCwVJJnWgI3Rl6DGlOxPSmG~1)d>lj~Z-F>rwPGuO^;1hya}Mz$Lo0pmoPnQp;yp
zzSSeIf((7;{Gy}w&PW~AwIim4KYP^}2OdZr<YBC@RSjgF%uO39jUFU9stmg5VebxD
ziM`0Q92B9rWU6pvF1aic!`s*BFfea|fbt1qpV17V0@)X^G(8}#$#_1HK*4`v6(!YG
zno(%I^fCFkDFPe|5<U2Nh_1ZnTlMumR31I0b3NCG9Sx*h^|tNmwJs_*Pl;Rz;<uYR
zm7l|P7L1$z`<D)!d^tJfVo~Uhjr#Z`U+t{NoB-<s6%!XHTvZ_`&P&Fvp{w|V6JyC=
z=xS^C7PJfpfifwKjv7=?7o0V~r$b7OXWPY=-Y7mZM6`-(<)!+}s9^r+X7}IxUWEqz
zBmOZm1UNEk#w&>?8WPOaOus9yv?SQx*3nAx%vj{n&l})vl3ciTL;x99k6HFKXGra}
zzN;Zl=cU?N<#!F@isEki^xe<|EbwF==%DoT&wcPs8V5>30$TUd0hkA|1f(b>Q3G;)
zz^lPq==fdKy?s=%UFR439r^0icbE96eviVhu4OYfc`0<>EIRK~^0;^xi|xJPD889f
zoZ{qVi`V-(wxQuIt8hri3}H3jzN2qqA!O@0&EtBd<KF{l_>PPjB{&TS8(x*JPP)R0
zL`&Wo_`J2;rUu#G=Q8URa|c)M9sWv3qz5o~b1&@YCR16r`u=l)HrkJV`$`L74I!3u
zIjQvG2EH6(`Km~{NF}*_+t|5~x|onM6sCqunGg5={libF>TDXPDOjaV4e8N}8uEyW
z9?<#BkH#CsCHK+3Q0OPEAPS9v6dIth!~8IMw3FWg;u&G1t!DD|<%fpbH6+AT8XnH2
z{59%r7RjlKkGC{%+$ZPc=BC}M1uH04L&|%UL_fARdA%nTGnQIyyAj@AG39oetpACJ
z9Z++lco4h0a$?@AaAuII2*zaQaq}pj%Ac5Z1-XF#58j8@aHP4ypm%S~Mcxx8Z=S6z
z>0PC(JB}@=p|74p8h#pIHR_@0?98&CErkH|zbCAdcR1m$j+Wuala7}3!q*jt<Ck7C
z+=bj;3W{??K5{g>dp@;t+BB%dquW&WD5@QH(jAutZ80#I^q6bjt?c+2c)mYM4cXAt
z4=uH5qN^nVYJh~I6X-;x<aD<O2l)q5C{J^$BRqk2pwf)s53W4V2GI6Ls&662%qfGH
zcDUrW`s2X$>Pa~^TGx=rijO_+ZN7uqH7sa0?jOL^45dy()GF79^cJ29o)={)6{sLy
zv={H8bfiSy{cN$nN@8z#TSFF*)3>9gEw)?iqDvoH)=1u)6jPDd$RD#A?#=Ra?<p>~
zfE}Vrf5#tEA0nv?Vi|}Cc~dULKCjA#0ODC$6js=)dx^u~IQXapP~<DVe=5kWGl1tO
zg@o-<Li|9&50qXJD81gUY$Z_oTI8D?N*z6=H1PNyab+j@y0(T!X3)+KlV7v9un{UG
zj2>qgBtRd;6(|4P*aFYq4Jpw&?>>Dggk6L*B7Kq)QOLy9R8dz^BC}ob;qD!q6?Frb
z4)>sTQXkvi4scsInx7NZVRZuaR}KJ|Qu5ZT5=lnJ7$LM&l5}W3+xQ)t+$j7c7KA(y
z2VRt|_E6H%p^`Jk87=VKMxq-JAsAYi*5IvuVvR)2zu9jp^d#8SmG(%Tjx!rjj4avU
z;h55ZCJKkDD=kx>ToZ26RXwkgS3wec(zaOEgb>f`iXV9gt9v@n+8aElAp(ahT<U5D
zNqWDodHzSx_FroOxf_CJoviQl5u?Km&P#MjekLTY7RkWiAkhP~B^6MQs7?n^rpEM5
zztbCX9nOwFLJKi0F-~oAJdObw$gZU9Qt~m6P3dt~(`N5Ms1VlMGD%HfC$%^b&$(nn
zx`C>>I>91=tZmatPOcwS*y~8SjFOi~Le4Io!%xbuER@Ol1m@U>PT!n@sxGxc+5BTI
z2>N9xHppIRh};G(Fkfj8G%8T;{g{t(La5iFtrF~ZL+ShjZa^1(i|YDCEd5!&Wf7d~
zG*@v`k?64gl2uik;BTu94J~&1@Z&nEapCVKcM645dB-QU2bxl@%<E(M7T!+-s8zZp
zqD9h(Tj2MHW3!8`Y^l|-dY_H@=bIcY)3sY(O34y^t~8?!eV6WCB!TN~6^XR52uKaS
zVENY9&sm13n85!%@7qhHJ&V=)3lu>5Q8p-lg75nUr6V;gz&{lpr|AM4)Sn5vA)a@y
znSGbW(XIW@_msa?DU<2L({B9fhAQIwx7I7pU2aT9bp`M4T#ui)%^GWfJr;|Cp>X9J
zNr2R7g-T7-OPeUJonn9b_)#-yd%Zlss}3eBTPrkXe8rhneE($C?wY%Sl2WB@&7$S^
zIowsVj(<_A&Q$h3j*Oh~c}jBLo6;C~_+c%qp$Hk9OzC>1?#RExI&QMk9~?<bB5Yz`
zICt$K;Dt<(cWFgs9nn(?U%syIDf)O^U{g1c6{i^#HU*y4AJswxv`Yr?5sYh2AhQr9
zt8rNoir3LkZlynWtu+4fpz)})x$<SlvqJsa$6T6)zx6<Ax9rP)){`OfSVQae0a#;N
zBTOLqsn#6Bw^DIbqTyowfdinK0+OSRBCL2#8zab3M>eeZbOXkio@A=?uNNS5fWCe`
zFFjo12^JQXWQtK`ooe;eHh<$$KNm+aurl*kT|7e7Z4Jf5|2vwqa17VzJDGzr*pXdn
z>CjG%7v!+_#6wy$QvGJop_q2Us}JP+jKmoz+qqvPg=E&iCm5N5R@`{~`VJri*zLD7
zx+@;mCa9z~?uXUyO&DE#e0KiTvG+GCjor)rkZ3Z>yws}B6>24lB@`pmapN<fN#B2H
zSzF(&9IUBvet6NRVml~xv6<qx5-(wqR@CtGv@Hp)vS(vyJ5=2xA-oXfdpPAtMCZ9j
zG8FnxK}Y_b?4RR+ychL1;NikS7&C-1d4d#PM`BwY*~ls>c-otnegKD$${*BYA^{8q
zp|sx!a*ZDODlI(VRcyN{2SJj(2xSxg`HRw$)y&7F#nnq>li9$&!;~X`<i)O%^G4h>
zUd`9Y`eJS_Rht+Z6(f3g0cIl<$+Y#ONFT`>W?UEXD3@55^fvx9gq`~jn5cJZg^4^l
z-K^K@yuR6RYAAWyzJ&cB<o3L^1pBw~Wu9m~S(e6#d6W5<{aJEeT&2>?T<8l(jlrO0
z@F2FW3I+;CgX2g<`(M8VJ`d!1yg_p{KlbIP(VuvE3wR4=US9CSt5{}(PkwO_@F(Sa
z^#~5H#%LKS>KqPg>2q#AdQ$}p$>r6OwFq1{rOxj~)salj1VE-qLONol`=H%A*?clb
z<$N(tx6*R|b6uF|3eI}{Aw9>c_slTSs&KfJ;9tj8rMLnvzWQ%<cg8M5yk2zyI}T{0
z`@L3ONv-_&oPeoT<~?`~bSA{Y@BJ?mGQG@%tgmw*X@?(?C@mA!wRF17g#IEkp{WQ8
za7woSGTC)rholul?{#N`bHCMRLk+9E;>+`-;f^mP&{=Ftpso_xGD^{K-N%3~v*TGy
zuomsQc2wK`HBWRe`pBbqFNb$?xp_*>SIt}B@jQJ0k7Dt)lixk!*2Q*-4r$IN6*lM~
zUS+GJN(_x8xy)%_qK|_`=zbC>;Y2bNrCz`oM9@XYtHMTmNM;uk4P7Hv!<*1x?S}$z
z4s!bX;D>~G(JVX82<&<hHFqtoSl+rlJa3WB^k_lEQGla{n%??1w;>v%Y&VHTnL^ee
zfImQU%3BE=5D&?)9`Bme9Yao=I_6J@^|N8kCmx*~wYD1?dHFQrGmdr_OEw0t2PdM3
z861Dlj=6417A6?}?^Z9PQz}%mq=z;Y6tzHKBZ-AhuYINM(dR*E+w}JaI1d~Exj~hh
zahSmy9rq)^0nLQe)KFny(vsJ>pB%)iYyXkihask6f3s4ilFNqt%+|93GxVNxj{QgP
zz_%0K|C8I?I+w%~XqqUp6FBZRQTYoGpjQ&5BPU-tSy7d@OeZks9F6&n&)1Yz@8dHa
zq2}80ZppGWj=vyY_mU7Z&i_dMosn1+z7KQyfX9k`YRF-UF=I=fb4N(j!73Dx;OHz`
z8ht3`K}di03J|oc5ZdmT-W=4CB$C++Le?ai22SO7lc%E$#ukj49s5(#KqM1}PSZBS
z4~nQ$5_;tN6g@rbd&CfbqNT(dYI2?m>x*lF&Qr`duFl5-S$SS$)EkrWJs3N6r<54R
zhl_DRpa?<_C$0K9P^5PKfb5pVaS*wf_kn17Q3pQ05yCHDLt9&9rRs^0@f?~MvUbq;
zMFG+=&f6C>r@5BBJa-$r|L&{eLtMXc4(7pCW`*${n_Qax%v-eCCw<ZlLITJTd^e04
znVUs!5=Al+eY>7NPsxM#FGML;j~BcPPV2W{+<o;+{erFP4a6RMO&?iq0cunN%`$|1
zqJ5VlJcH@0)B~|$BEAQo<Xm+gdK+5EFcPJLFg%<@NOy{bOP=7YH!jf+g{Ky`)Qvrk
zA*U2oD-L{czGeje;*SA;MQDs}W}JtLNkv2U8cW^~OhAK6W48Zx&fs-;5-Y1yr;z(c
z^<9e_MEA~e=+9Hw<TQpeDN~B$R#g}@Xhv&B+b(NIH2Ho)K<)<cyk48M?Q)_ghdTxO
zl$8*BtAhJ<oLxaIq5p!g_+=0__sK=pL2sk%tfXUKM(@(?X#hLZbhiL-keejuG1=cK
z0+*_c_}``iLV^|tI!n2kl{UYy1O*4{TsAa1d&~Le1;|$BUz^0lzSpy{trI~tDJb<q
z*GIXZ<_?bOAfD+PT<KhUrVkqs(#?G(DLAoM>yTL$^kBK|e9hxQk@=G3`uP~cWCo>?
z$9Kww=SKHruF{pHASuzP&`Uz0N(&F5!xnpJVCOTNt#W>-Y>+O*&DlEdR=tm<^k;nE
z9<+~mpMySJ<~nUEke|z-J4AlKNFXSEo(c0+1pHuV?P2)xq=A8CGh6+KM)1owQr}4(
zNA)1-r%)}G;}9XPLc+XLlGF2rVxPkHloOlIRb{D#m+LjHRm@e-yRc-jj;W2bOcX^$
z^G$ND%+DV1L0d!<=*7yUjrAJSJiI@YeUPQjhgmw}=Vf3HWAaY07}124Zqg`=iASC6
zGdK4E@;64v0<io|Co#;GT|MF)^qc3~uZ6rv>d<wF@rtq>EMRX>YX7ju*xnT_`6AB&
znaF)n`HdCROsV}+m5syEZ@V5R#fi-J9XM{QLqzDqxhR775j&PU7oO|Wjyg+q-f^9X
zZ<@pqLI?U~8f3JFz(X*fG(vvl43O|D9}>7}RimnFlViszxepy#SJMEpu-BXUJQgUH
z>*HVPCo=cbvC?{U=l;G;L!W=$Od@~bH7LP59X*Yr&a&%Ph2<KbQqEUfPBqQ*X~$$+
z#Ng-qY~N#^=xD`W_js04U1Ww=W@MbQjO%U6@0k*Tm^x+n8{T^^+k3HH%XFu4X4BAf
zqv*=vv<eH$_o1|LlniLXrP_7P@g4%NgY*06m>fa-=8X~K6vSb@*uhVltNTW}`Z>)~
z4w=`}k1Tk33fIRDT6WdK)>HL*hOh_Pmz*YSsM8O$HIz>?{=){S0XCq0fUl;%=gU)6
z`=hibmTkjHS~4s_>DKk2_CG7Q7j465$`FzK17yz$O3F8Y&+8!$=>jfE2R?QNos={&
zH(zzl-Qt*Q3tM3bF`!-@t2{w+pKB}DYSj#I9S@h0ar$9;pZJC3_xS3Rio$DZuNof!
z4|wmwt@I<WQPx727JFoDHtrnt@25uDWo36)R}b+joYBG3<wb|;Eodsmk9>}SpW`Y-
z`&2eJ^wWpbTz^j4QIvfTylfbH{|0^Z=_Plmn8B0Y)&@~V1+ut$*?(@1iOl=nPbF+u
z!knF*bL;aJr#7cZeH*8vI(U;IYd?e1pJKituX)*THrC|zq(t^@!{LWNP{H4t0bbF$
z0mH7oi5(ZR5RngxEM<Pc=a1(0p0t>6M*I)<-ZQGnEod7K5tJf=A|L{S1(A-T^d=}s
zN2+vGiqfTb0v1$MP?}0rdN0yjP>xCwkQ${WN|R6p5=sbp_nn~U9G~wg>s#-icdh4-
zE9Y=$XYbjwXRf(sX5TqQhYy%7^0#w;X`pDTdcZjeUr_D-+<W_#Ai8TT&ER@;97$8w
zD1Y#aG>OrJpCU%uJDL<O=9M{oFGSd0vS?<21u1cV3|e0F(1SgBe~su`Oq{NeI}`jW
zZ%faGhRU|ZP}OV4B<VHxGr(e5_pR+7Az0ebN`H-?V}$$pI3w9p2im*##o9yW|Bk+G
z<nrk{|6YfqTrU(<opOr|G|Gs2*FN2Yv@>^)sk5<#pJe+h9qK|BQ0y`qcPBf&=)?PS
zL4>W(k3N0~r!0xHd;LirXOe4XHmFUxAM<zK`Qms#hfwFAd1wEHNhKpguPDRuOepyb
zSRT5#goDlteq9FgM`r0@{NL%`H}HDMi;7LuFO)Qm0Vvj$Qctl~%FQ{54k}Dj4lGCy
zwmrxYHmD@GvBxs412N2eKdxC1g+9+h|M2*^DN9C4B{99&!%kiUDL%x^AVdRx+oy+x
zXLfRuZ}9Qm2<Fy%08_Z+_By0Bk0>zo>*Hto*kVre+Y%uEXmxh_WPHO$s>}&<DAf^6
zuZ{dUE6ByunU?-NR(O86&L}<m%S1)Vv<e04Gt(j=<wBu76URbH8B62h<UfRmhI1J5
zJK<5tK>{`A%S#L>jy3sJ-}Xh&_B!m#8*C8E0<j6KlOMK5liPq^44Fx*%X7^u`qU57
zz-)9}`V!}JBtKQ;zFvwulU--Yn$@%KjYD0S!V=2QdoAdC%NyE5bnq6?JK_*vXK34<
zM;GD~)!^d0|7(@i7qrA^7&>4=<1w+5=a^g$RE##aKX=Se=&@XYdk{VSWxk@aGOWJ+
zeYL;z!A?MiuKA8~_972Y(DGU!wl?hfkC&3<KXC2;;*Og4!E6WN<bO(y!b%zSNH~9;
z$*^lehb`7OvYrTEX{V4&klyt@b4F6F4dJ)z`PYZpX&12Ajm6@HF>oabENyGqX4PCy
zk4jR3y&_Wi5Y2*R*q(u(2W>M9lM)j@Pux4LHtbz?T8V%%(-TI8nJ}As-D=8{kpRKc
zi-21`Q*acxsQz@;&rj|XPma=9euc6?Ld7-K0gIiEc%UTV%`^@pp83nOwD~WS?~6|6
z2~?%FoxI6FHsYYl@faus86V+vM@6o%-@SmiO2(jj`NacN8oLyTe~smkidkTIm8LPV
z#YF-fIlFzNqBw7hi3*eM_-vb^gssY8jflN<+Oxez?#+aE$Phi)0s{^3j94sokb$S6
zAWb+a2PJ3Ti@hBMV0s;VkCEQzym5c}(l%DiyFMzNCw{qATXQyIjS4n?NVCjp)2Zp#
z7dDl7#lb4Wd(^Y9r@~!A^R38>W3UM@z8k%zyRj%H&ZG`1SP{y*;R6KMtXup)4`TMV
zsx`#rke*!nYo~1Of(c}^O>Kfyqm>Bkoff6i<!<C6L}35ew^J%ViVoS0KRy`!G44M9
zW=qp)vAqo^!5&fLwL!JtReNzYibe~w15#=3Cr$}h4I-8hy<OHI=LD+i8TOFA$A`_>
zjJj?{%T|=XX<6n-mj{qt6Z5gJdZ7PZd3qg_F_LD3PN#4hd@slZJpq)JxVgB9jW?bQ
zEU7gr7+QZT`)c#pRdEHt-I&qVGOv#<(7d$V-*M6O)nZE)v2l^dgV+!jyeOrYw>8gX
zwApjaM{1eHUIkgo!3$3SXK}%wRX6WVg=}@ZX1;!BnT8vy4qz(DcqK+6ya#;uJ1CuB
zXt--$>Yw-WWx%1!T_+zuflQ4sJ!EQvt%|aB4(IH`kG@&UL;f7g+4^wZSp_NZ4(S|;
zXk6ZmXf_i*2OgOW^M`wwkL;vC5!_@5d!+M{dvlPAu`|3`K@YyLfTbhh?;?Uy4~(!M
zvR-j4`QU?mgYq7&h=joxXiu;j<}8m0eEF`)3F;9HEbVUHtrdDq6!IHfok(r&<{=VG
zFY>IsZyez~$ZEmgyzS<uX*q=c8rIn<Cvp^_EDpE7sG(Chne;{HM|J*r?$b?QQFr)2
zR0g?PW;LoYrF*wbIH1Z&@$%+6J?uQ)QZeoVdJMDJyj0?+(`^`r3RrfxS@)a&EJlTS
zI*kz8Ipw@s@M3C2<F^vRiHl+r1?Tj3Eik~=?u4V{>7)l@*&AmGii4rCX?)f%L1kSB
z%~1WgrteBzbC0%RfX34ggGNuXALx(PFHoH!nC50DzI|kXS%?gib7A;+q`do75XP4}
zkmd_o9eKcV7%WCzX}SW;_$|Yu0w>U>b!J_Ks~FTI6|)V<$-_0tgfrM07lx(n)5Gs7
zK=~W(7k+Wx<XM_9!!0ZWkZvd;b-SR6c}aH7KjQ?<1#M}#pW-8*9xMgnl#W^*`tC62
z=Db1m;8xQ~>f|%928RSXlA33&#0~1*blyH%A}P)5tV?5Cx`ic|t*zg=v%G4ECJM#%
zwWsf;-I{yLAL%+-Bev+C&i+za`C1sysGx^Wm?MdMw82XX#MNRk_x+qTbuzyH#5mt7
zi*V!X&(y#^`57B(nXKfrLrf*Y8^S(iNs>7RU)n;>K`SY0uIRPhw}VpG3(g@+R^l)|
zi!+=rM1bAIo{lFyD7xXYvDy>p`{}4LWj_(k%#ecF?UGJed^b<G5%>*VsnSdgTi8B(
zVT64*9;-dzCW*}f$zl)H^y6QP26e~Yt-mO$d#M>8e{iGrT>n~W*xkTDj*(N;3+n^p
zEn^|?zP(ZFk*z)^u8$y&k{*)Rgj1S^TEp<PaqN}OE@n{*G%`jS7KPUHf_}NzG@&|5
z=$xce`;!jE$rGUnsFwW_E^e%ex5QLuF>Qcz3%8xDwqCv1)YJoT9<iYp0#lGe7V_D8
z!M+Gd4ETM+6GLorQ9+v}4ZKU{$hx{9)wgNZ!*Vy?A%(*Lkm370l4=y>$S%!6YZMoM
zLz|UUBYTj8V7fc%f!6Wk9<ySh5_4Dd6tU^8SHwS$(3T<{7v?s%yS9@ylA%)NFZ}uz
zLz(3fk_7rUHLsss$ud7T_?=#WamU2FuwaN8t`aH=kg3E|8$=?4T99Mv-LYZUp)(tf
zdA^pIb}xdkU92QN5@dsJ{8}Ktl0Z4^Q}_{xPXk}HCGUkZ?05)!G0Ht`3B>@{T86(R
zezU>tzD+2$AgsM|vi1t7x_6--bb!7>tdSlJh;U<9Lmi}fj?*7xo4BcBHGdy<aRZJo
zIn}LroktUs5X8g5HXWD2w3~@413tI-;?}*ZK+8H^x@tj9p)l)@1(T2sP1X~#A|juQ
z%by7vdAU5Zx_B8Xl!4@XMXZ^iKAUqN4tcppG=mcXkqz$i%_V-9(JWzv?KuUSn(1!H
zQVa1mEEwJ<$d=8_Agy(>mzAgy64s$3&=_E09^{32QFAoXt@YMBr&7-i^t10<*m$#h
zH(}6CDhbyI!oZrNF>~0#@((79VQj&Bk26QVKikx#MiUSq{g}6T`~89Qw&~3}eoAMB
z+ire5LeByJ0FHa#amGGqlg5&vR;e!{F+6(tRsJu&pB_u!CuKOQnJXiC-b%1ENF@&{
z=ZDZn;X$xd@qH?n!MqT+!hKZhPKRtxps8MA&gpGhNzKh_uA^>C#FLJ~T!J}zc`0)E
z$|8<~^9Hfv@A;#)uMi$IwQL6z5e7r(m-KN5=)0!0dnMs`h6=xvl_Q{Z@^q$hh-<uN
z6vKW^RRmFp@r3AuxaR1^K#wm!Q-4;9skh&LJEe;thS<%D&o9m)k9SL%g1K<QF9x{g
z3tBFyl~EagExe`qL30;2#qAdc^#O*rPVsg>WUBVE9h!O2Fsn#YlXJH+0@+C7nB9oS
zb~~?08`zxx6itQ>ybjTdl<zJH*kWlA-3xt9t~FBMtdH+XU9CU4o^)olUiZ25JiG=}
zh5-_`cTkts|Nhrv&{k!paoKJ#;z4+M*bDv4$ECEEVIPSt`|R;_>UZpOAGN4Z;n!aA
z^F1QS5lZgb+=&AeY7_Ot?>d5FSH8`Tm7@C(7nnx2w<v0V0PcvaMrLdn;`M~^n-B+G
zs$;8DiV|`j6<_jrg+8yh-@1T1>D~=Nk}7D6G|Sql=vHHf1kV0>rh#q^dkJ?uXpl&-
z?AHP{>zHC?L#-r}vsE>62w@||?0gkg`}bxyWVUq5!|sMX;kX(IM~&j6u8M8pHPo|E
z%%(>%hCtThme1Gx@HS~Sr$#^##~|Io_ngKFA7c@y)aR0qje`n%>uLcRP4QHqVt6gu
zt&5XfFC0oUxNjwUb4C9xrfJ(H7<e{UvUU@TMWK`*_zEwK%1{jEX}qcL{;qM`P~oTF
z=q#$(tEPL>NggV5!PEO6eKlE-G%q3^8Gl!XD^5raUt+1z7u^X*jRm4hCsP8JO<hFO
zhE$F<Z*R|BP=gLAV;j3@3((hqqnO^m&YU>0f7_m8$7Cx@0z>(n(Rj$)IK8aaILfrp
z<Z5V>pk|b@wZRXpelBPDk??Qu`W705;i$9MI;sF=v>ge0E9EIiTKWV~2W8R7WWgG_
ze#5ZFI@--CPv0L5;U08go>@YiE$4Fgs<V9HVMsk1Ue@sy`RH<QOa>e^vb=ItNQn@4
zor{~pzW!wMw&=y1V4^<rLUDm0b#^K|;!1|*xYjX7%KjgBZN}{AE^iRzr&2{k>W_aO
z9DB9KCd{$4ILldxO7|CD=;F;i7!K+P7+3b;>@ZDJE=;6ApO@_<W|*$m{#zUr1(KwF
z9!M24Teg=K%e^4y?PYbG2#|_2wfWFcrQL>;kB?vEb>*8+jva}*>7tXR8MV>1aJH?t
z?h#Q)<fJHlUNe(hljE1CDPCApRawt__8BljPz4^S11FL`kB*9Zi+1AUOXJt?AHIK$
z+pe&ntIXAHyOPHvxd72MWS!`RG<e9!@{n5if?H#~?E~}Sp*@d8mBe0g#B#oqzV_ix
zb9&A$Ce~%2qg%5&InW8TZIa$mr%MoYProNW(iZ}dk^UPMB&h#N&ydLD>oCnL%8&@Y
zt#$hKyNHI=CHM2z)+au2{>A$h8KIxkolY~gJ+W|AOL~p-<8G^CM0IThQQ;bk;yb;_
zZ^Y}XgS(EaH5-TDku@rOuld)ICAW&255MuL#WtjsVCxS>Q3^@`OHe!ByfJ@cwFYGz
zz7dsh^Wt@{_T>UV>b`3FF!1WK6ugCgFZ+TI-}<nWvf%~~yg9gsqH35JL>@crJd@05
zSfS2ZUHV5=67V}|!0$u@JsJ2i;$(Acw~(Ni$lw<&{cVxneh>J}g4T?6q$FGt)Kpdl
z_`bH_Bm|wERvZmEH#++|uN5%Ty!t?dtRE9|l?!%>93M`pE>LkTt8?*Fg)-q}gV7uV
zpJ@`)UXul_A;y?k`+^Gpjr^+}oHnKz*yRHjk;+!InS3#B=~AP!z1Xvn?0`1|sNh>>
z&rY{&1}iWgwiQ0l>(ZpYWS@Y_jPD(|GCK0wUg+?^0CzD@?P1Wy1L9hHzKhzSF!-De
zReGO&7tPd&H>xxw)o%#pY0biY>@&c|M>;E;w>dil9Q$eSXz(gkX<i)FVl^~<elH6E
zGH{!KZ+xVaC7CIKe9H(c@GbRT>XXMA3Y}bfB6-9(HdHkF_y-GW?x%G<Wn*KP5x_Vt
zRWl7kC$coQBN34B;CrtHAq(9Z+8|IJ;G4@xB}D@$Nb{;X4V|L_hds=0y>coLjJx#L
zXmU)9N#{0e?}Nunr66+hU*_hJCDb2hiJv_4HSEn^?G>;)mb`<bd9S}1OcwO`51&8#
z<yARQtHkAqAE`U;066jr8el*qS=r5n$>(uO%*62w(Oq!l#?S>&q8+7v@g{91KPK>t
z)W9hKQD|W~)%R+kLU}M(A&8MIy(WGTf-DnP((|&6J50{yWn@TvR7jdB=2g-gn9LHK
z%tJaT-=qO@XI<ZZti*|5nNADkilDu66oeb^&+1c?QNcZUz^IPk=QDi$3ExtDEmMtN
z4H;*2UCHC7xlBVj_hgOO&+I>)anZ@GZBF6NTI`7&-P|a|KGh4Lzm2S{3!Ms}#SP2`
zl%0WdM$2->8_ZN$DCuRTr%$Y`TpwxQ4DZ+F<pcSGVwW%8)QGYF4Dj_%udh6Hi+vc=
z+Y@J~AwwPk-!Oj_vB3JU<FUKZ{FBK7D`O{9duqq1qdSQfNIjX8o7JNdZ*FLYDQRRj
zWgGZZHr!)!0~fQ0_ruAa!R+ck3@t)cHQNXp+ZkRE7||?({ZX;PW4^*dXB?N9TmA^+
zKFCJJ2srZ?C@$qHrY}X-%X;-gO&S+0cx{A?KQ|iOs<fc%8AvI?`)A1-+1rQwF4YG=
zqx_sEq3}x4-85mI0cQR|RDNAV8s@a%1vj<kQUuuwwXpoA=L{kFxC~wz246%t!#hQa
z%m+qZ{*2aXAC%U5$Y6ZgAoJPx*DgNi0lGvq-v={NKk*&j0brI$8gDz<*<BKdL5*h0
z7a26YEMx{vCV3h4mMNzr;3nF%7k5rCG<995^Ih@E(u1eB^wRp%pS^}3cZHfPA6Yj;
zn!og8Is)W5A>-Qm0x~f&LeHU4nJN;x*WhrH#Xx^=_8|UAvWd0jmGs{4$Ku)81)mPM
z7Bu~;1-L(5;Vui!$N<!iI9P#(7NUZ%L>pvr!*9_2RVNo;GN74j7U0x2gNZFW;L}bp
zE*9nU9Fj`e$;U!FiD=G&&vT~)x^G_#Kqjr95<K;}|A9~YIQo^gNAGS>!zm8IKzVFl
z`i>Xy<cD16f?zg3*wJR4@GiSV;0I7!SpA@!7cKFMk0To7S=pvK7`EBiSq1k;*V0`a
z019Ic7?xKlLzkEy5fys-y2)<QkESlRJ-TxBPB_bG(Zhn#A6EdsXIFTsE%mc|Ssfkm
zFfQvf_z_4%&_7%B4M+@2k=q#pV|cth-%EM7N9boYOrR@>{yAj*B&7w;QaU)4t7xE{
zfo}>qsJ)}Z`*on`$&)c&4|VlK*=O9EC+jDOA&!n`COtp}3b?vJ^Taj5OA|t3N}^)x
zNoi?%7%3NqJ3o1uRluZ=CL7&5dkH~IxkwIBFt3#hr)wKr70zR>_(fjB>RYBfd|!8P
zQJ2`~Qg?0R*>_Drz0uJPEI2s)>jf%4QE4jU-(}Msey=0kgF$%Rt~R0gN=p3sCq;Ss
zs;<T+L)n)>cxFRZ43Etz%bhz!Fi^-qt;qbVOalm_)EpC8y=BR*Do>OLM5|+p=c56f
z;jgPU{#L&o=k>a|JpS=Zq`#SoR@xQdI@-$%@#n_@ZP7qE877A*MrI!!02i3gF#@bR
z!iFGScx39<?Xl3c+i?or&m}KLE+B(o#yx!hFiSvx$VvqL!|WDbtz?-ySk<pI+S1<|
zMbB{dy65e@sT;uc1k;jt2p``4s~e6F(jt9apV;rw0Qlz-v(6_R3HAJJh-l0qg-*s0
z2lP#6KPcz^YFYYQ87QATE@6t+*mD~*BxYINC9iu964G~p&J}aAAjJ!ITE8M8d+l+f
zHI9-JB~KQx<?!ucr1c<yr)x3Kwy}++Vnxz|d7JTu;t#gpGWex><X?LyR(hk2Uc|ad
zuwWOrjcF0MZ|8q3%zq8^uT_L!qB~nzu}@~qPsv=q@O{MtAJx#N+*0KS{_+M1d)cTs
zX|y5tGb~--Pw5DtuoW<<@ZcZP|9c<)^=W~wFp2YuA9Yga^SQC~+(Y5_>Bu|r<jcFO
zHRSKRF+e+C1t0i_dH>fC|NIqlpKwpIpBlF)#qoSIXMY6cNR)XeAYHwa{NUR^jmv*F
zM`lgP93-3UW<5<AXTOE?UZ|K`x!Dy8Bt}fq1Am{G|L@%(3lS<BmVUX?mD|E+3q?=T
zma`EQ+;+zjGW0PLrvXX&+k*V3pH!f6AXe(wNy<3a7$U!sv(Pmn5G)y{H-ci$|4!bZ
z78pPhuQ3jv8fx;cMLJuFL&fp1@EAzU%$_Ij{fY<wtHG2{fpH=|%{h$zqKu>N@=e^5
zypU?hvUym9V|U_;|6H+v*zRXH7c71<^fUEqfBW&;Y1g{#%p32-ov67EkgfXM=S)LE
z%BsNL@luS=f49s9I*Ju`(lGM}O;6d6IA{N_C{}pFpl_o@SXo_t-ENq_9w|k!%=-OB
znw~pX`)NVAMvjeNY2-jS0<0MbLHR#33jf~jk%LPr%~1(OM%T3p`bFXs+47pQH80-X
zaNBo3fB*gGWHX4lFT!;%3R*d)3UbA6Li!5-{ci6_%8lZEe7&~w$Ty4dzJ^Z1g}CUe
z|C19%K5ERllxZmEJl&}dXw`<)_fy~`<!+n*i4HT1AEij?FPG1|DYKV305J&alfA#F
ztp84d!IA)*2+8`nJ;jwGRH4;KpSAl%QT`XFap!pPo~2+w)i);&k&|x92ciACAHjNk
zrwsbPAEQ~4Vi&49g>jTgi$8*PhIdD%h_LV~DN@0d5-Ck~N<@FUVMDXnX%&6Qk9=rB
z5q62N>9_v2c20Eq>mn)Ro`fWGL(aSZVfmm6HyNEh{g*K~jQ|Z^l|!C`;LhBTX0|o?
z*j^$Z+nX1l=5X*#^C@Z*rJs*XMnXxa%rPe9Z84?R^cy{Y?v0*zmL>Mj1@bO~A5aUW
zgMoeCf53ydH3(rpk2`D%s$|O7!v^d#Y>n>_RAdUCsbzoeCw{baq@WLCcbOZSGu7Rg
znrH?8t<#V}xk@9Av?uq@_8j!U?TmXCrLfaIVFZn<9;x@0JS;8s$<o!j;r^}ZFzP`i
zN>w*CzrN4+{enui-5C0G$N!*VhfEMF7HrV|F<ViYcDs{<Aa%ca2~YB)d&qXk<3}9D
z4*}Y?NUSMePZSxdOtQCd%YW7>rT=pk7iVh0dd1b7{E)3~y4QwgWs{Vij#xwf2X-6I
z&mN-#(*+(axK1B6Ey_gyu|>8QzzmK*ItvQZ0SC)mwE`~P27&pYm=!%m%osz+SBU@O
z&R1y?(0HwLiW@E@Mtcj_{7sg9dPu5b^0OYgwmtJ}Ote&qi`Dh{x{B?!xAes+BLDk$
zud-vdB<CbPtwZvC3%@E&(S}c^JE`M8KoZD!D%Q@)RyM89#PT*Sm9WF7$Zdzb4e$ce
z&u47t6@3znL26Xl$26H`j7s9npEBlR#cU1sJjieXf3Q9H`}gD@-u<hHGOG!5$P8Gb
zbiyeAT_aqIsga1cEXxn0HEi;$TFw`;I&z?rd?+6Aey;VdRb20?B%1OGcAVQTp7o%R
zbN}=a9n{juN*9$=<oe5S<wISRjh(iA+p`mIW<!Tn+?Z*evK7oU;Q@Qnq-~$~xz`<|
zZ*h18W}-YnGbS_tOpo!}X`R6Js@5b(z5kXY_=Io;dOsw2ydNs;oKS1V?QCAHnfofV
zpWuo8(B?flsCu08#S0e@yC&{ypKXEmYjD2@5%z*^XJ>z#3toEYG+j;LpwyB49yQp9
zGFJ*$vybtG0mVDgT7oe_<pNZ=8LmuisieG*`myexp0l+KHeD^VJ4X&|L-PSD)Q+xO
zl=BKu+DOB_A(33l5i8!|!osbo_Qjadfr$f;4@P}5Re1UjLmi$==Ml<T$>G=lJyn93
zovtPa#v9}Y3h+Zmq2+TOK9fbZSiH<NusyBedQ>#fO2TPtLJ?fFhf^qj`&+m%*QvVP
zz4q$*K?3B17pI}gEMb-1d4nC3KSO2-b!{vm!9!y;!nt_g9DoFHgB}{S)9iXb`44~p
zbD0I`y^}<jKadPq+AjgDuu@Vof4Tr(53u@OX>f8>0*7`=hWV`Qf7q*!V6Udg7a+o@
zw1Dg>hsmWaB6Bb0AoT8syi-b34H-a!T@R#@R(9ZnCJjs)81?0w50vUnF#8=Hczv>Y
z!?oWb`6ncq#@_;%651&y`UC1KW5DY7DAF8+L`Z!Mvq|O2djqQ3|9kP^6S%8U8rgYT
zdK7}L2|)It&Sbdpj7Ecl@?hq1C|r>Zx%JDDuF`uTK50VJdMyBrde-sr<v-m01s%l7
zaBipcI3$@speDbp37Pl-mBIfGxqvm1R^As(e+pVE?S*FCt_kJOKYm^R@=F5YTnrwe
zN!LB<ppz{OWKS{trF;y}&QPAYqz;)3@6GRI+zH0|!HR*sh=&Al!4MktM%Q7AkN7QA
z=KC+f3Amhe>jQ*=R)LyO1n|6sma<a-FM?YgUmg907Q-1l5M1jA^&vSj-$%>>%}wtS
z__t6&Uj!RatB)9O2=QJ4vfn5olQCLsC+sQ5HRcKA(q~rRpWE4v&qB>qXM~{Uo%`9)
zs6EN&)F2v&@;I~vUgmS)1Y}5#KZ2r#AFRIwAa1jt@)Vib|3x?f8Nt~xFqtKRbf`A~
zT(X8@irIBO<JTPsza`))4Akn$+ZiZ9RtjXlW33W|FSS#i;pK*oYwt{y^UhABn<94E
znZThL=|H1q$T<J*YutH+*9o##t{*s{827W#Zvixcer9NsJs?gT+yt$iN0~acXfu^3
z#!wlm`d8+K7xVD$iBQY==i(s=Ok4qK#dW)n8w_gu;I~~7F^h?#99Lyo2(e}MvF~(I
z1M34!OCg!udkKxI?lpLbe9P0{l2z^pZsGCJBMAugq?`U0K=4J1=>ONS!vEK>{*y!b
zU&H$UreQq;iX9dP%Z&?gKYQ(+W`F2g`NU(L^W)PJ6K@(?@}xsnm#Vkt5Ay(QIRp_L
z`@Qcd-vE|^@uN}Qj*pP$ntgGZY$PsRfE>?#kJH)|r}2pPiw9z>4fI2N3sTZ|bS!t&
zwo#f;=3cE$kvM{0ao<)?91ZmglS>REO1r-4+09WM+s4Q~8XRdIJUgFiv2S=~Wpk)7
zM50z<vXV)Dg?|*c-lvcz1PE$XFHu8bHcp><)pJWj^^3E~Jfpp&85=7ccYI=;U6GP0
zr`zI>&->Y}UJc^$sYfjXd&`DGV;`S6(q&__SzTN=+q8diWvZz-+q{qe32MQ@Jx@gH
zip@{|;8wyQQT8xarDXJRwr<ZO4VH7)m#ODV+dgQXxaa0K@2hCO^&s@;up_PjO*(DA
zk~Zw=#a*_xFyuDQs9x!S48<{lizN744ue|Pvmx*NJCo%#Bu?sl_Dyohd}uH@f1km*
zhylRGF1tcYGTT7*Xq0~t1;AN6ahsAxa;Kze`FVv3-3p!UeaKyF@(YedH<;Aypd4oi
zkCr+pAKZb`yWo;syhypQS53ih{Rows4<D|6dW-@Wd?+1%%Tm&it@LPiRC;<fwsP9n
z!m(d1n>{G}bM<sczt`}$p!saCXqjX7Eb}QTPA+aU8_Dd=!UBR^<prDzVVBnAH|n>$
zNwW(UYOL8@H?_k8W>`C$@Y&lPp@fXu!-mE(y{=CQ4N_tCsb}iLMoiOupW(+slOAy&
z*&es?p6p)eTyGL_&_-qPA1M$R#~O~+FQ6{hacd`u>$3BNJ!-&55^5G_9KGkoj%XK{
zEzT~K$07&c3=)Hb@e}TOwUy^GEE-Af$zH49Hs4MAw*P3dv}wrCGfQd9Y|sv~H+%8j
zZ0}n1SxMl3)erNe?Nqb@*Sh1h_mXAGCi6?C9UDataP1pKbnnL`$^2YW5(~M|7+`~0
z$ZOg)>O;5IL0I7eT=EESPy<?F<_h=v*VWs>?jhoO>Q>8*R1((>Vg3u<i;H1SSV_*#
zemya1=T_qj;8J0+(sZU61y-?%z(srZ?7dV3M%da-v~SPXA*b6M0zVf+HaV;k9oDN$
zsKoSxR|3#o(yfc5i~O(=)S?uV(uI#lN~7bWT7xuKn$Yqk$SMmlc`XZfX^B#EI@lgH
zy<fc)zqKY)1fZ57BLOjODcGlt`5(!yHAySOt4GE_ru%b2{EEdJn>KRL(b>gNM4@G4
zj3FFTZhqo11+6llp|W6#Y0P=1=rNFWQ)vUgJiOTBzP(jV^#-hR{h{1KPewOxaGK`$
zV#CD9QPbXC-CG)KibO(cw`qL*OzNU_%z*Jn7DV58=OEQ`BL0gp<GF!d4}T<7-1zDl
z@D?9NS{tQGOX}4x*;BGzeBi-40%;=!YZ!M(x-rYRXLn%GkX4<wdv{VvB0AKunP^?J
z{$RG)<l@aX1d_Daupztkx?|7Q=$*RLvY~^aFHZ-&re9e(M~dYO{J|79h_(*!Y4+jg
zk=L?OT5n!Opz56FVWlY4+xmqwxsO>3IC0w_qgGLg+X_Fts;xZ|s>V*$*v{+k!Y4O*
z3|=IrZMOxysU)7{w4b|<-3@Q1WXX4QhpYs!@Hr60$;l3T?`j68v+L`<dKo0qn@t*t
zt3D=!#7#@~Tm6p&tT5%>a!bp!xOdDkS>lF+B_nJ)@WFnVuAaQbo>uGUD24_m+|Mme
zQqP9eXuf@c$(oJl{G9s@R8iF-kB&MjOw<!O^T;{;*Q3J#hbL}@;TLFhKh!Obue&>R
z^GDgI2=r<Q=KaVV=?#DQy7&CWx^XpuJ6s1eUh8XS87(~2G*S^r@!^kqrYmd9jS|HN
zj|EthzB-D@y^*Mwc!RR^>ijev*qDl1nd>5L@{Ez3*8&&NL>zjWy<=>3Z&7D1717SN
zq=ReWMa>f5#!?viCVKW(m)Y`<uzQ#6E?lT=vI%y7EF3(o5V=?qxP1BM*s1pt6C`)z
zbFkn5l-JyNZT&vGBMC1`n!YhpH(^%$Ch|@nZ#>+0|HHwU$NCOC(cs^5SJ6Ujx{l)e
zc&IRSovnoWJanLg8nNo#gUuqx?x+Hje)o`SFP|K1hz#0XU}&UhHpY~yahnH*)P1%?
zq0*kFl3<TfVEoy*x_vmnxAyuEeODGL+wLPK^sT8fH2H`^haBD7#<ez@p$i1>dgbiB
zwVhYLkL^YbbcW519hcI1S&Z{qzEw1dyZKQ!cQo;-fGL`kjt_{v$2c+iwU19$u$}K^
zr$a1Vche~z_YoITgX-|O9Uc&Sqtl&}I<PCaB%3RzcAeDmqm>A&@^Gu{d(`;iw$hM+
zGCooe-0<}``X<LUL-2n0*(&gEi`gl5Z9hXKYY=zBX3?Ua2+jgMZ#kN03RO!q5mekM
z0l~U428CR^bknR>@`J#~>X_D6EPvF7&jD{rH<0pky63fs!m8I*eV3!Ow6fN6f9}i4
zFmbyoy$8V%6~%W_P*a#qt4Pn=YFG2*<m7Ao`MWAbM;@8Z-obuJPtU#d`gq2PWACtD
zdQLigS@s85LWF-DZiScA5Bk;z#VP#AFV^L+Ol0SOa_dSO=&cxdtKgNIz^Ftl#8uk2
ztqhTfV~L!0Ls424B|Kc-QLD3KMQWy#r0+omlgWm93B@@n*uEqFoG_Ey!e(!Dr^JHP
zITs(##7<;N7CCX-5DPD;t34dR5>^a+VqSkg@ZiZq?~OO=RJDWi={q#(KY}7@I(=l(
z@bRmIFmap(wz`r?Q{B#=wh6>Wcw<|3sem;Ki)ZL*u8-2voLoyGRO~-~ywFo~I6<)!
zTv?&#GD1nJDce%}F36pb37{Fm6eXQ|Hu2Ybv-Z8qJ2Vmt)f@I00;wQLyJnoNy1opb
z^!Ut7?R!xrKUP?m^h-X5u~1W^bc4Is7m*u*)j4<EHYcSvFthISAyRJoHfomW>LKY$
z))<uQh%jg9mRZxrjALZXvN3zA<D$?zr}$gdqZ7<$iQ8-3%VX@Eb7?szP_aR74aGw>
z#Y2UgSWdHz4b<}Z6J!P6)#7Yy>U63IG00Mwk&yN9;jdbNS-x8DWj@%J<B+vkom=D9
z5+SX8w)uRKjgQj`UrKkJb6twq)BOXaqo^kp3d=)7dUNyfB%Fe1Roa1B?517c+VTLC
z(oI+OF^{6rmW}pL?Fo}<p+{}Dmtwc7ysGiHKC%q82XO1fQz?-6+8)qVZeJ+ym`dUa
zJDC=SG?vqlRFpL7x`Ebpn+tg0EnC)TDeoOO*!}67Uz@#ES8=7y^ll+Vf~G^m)=T{S
zkjg?lV@aC0u~Dn3m6Odth_RT>u4cW4?SzJ(J%L39VyQ{|4}RXlmrOVPtZKkteIJ_V
zJP;eLxuPauUGjC9Gnft*RyDbYLxLpZnw#_C(LtQNtc|*tXXW%{TF9OXeIJ5}$Yg|s
zY%5sa(`*68QQg|j#hC5an`X$Fpbd1@{Lm4rTVu6nGWEn{ngS%+gigirgImzgl$X!v
z$e3DVzd8+^7}&P2*3B6v$)`O<*|hNUaEi9lx2nmW2CZBF;3B{g4nLS4szprLbbYVK
ziyNljgRSm&-?gE;>^+z9HQ<@AxS?|@GrN$hg-QRr#zt_Nh>%(k1)ac8m5LGX+c`|$
zkkJ2T!wR4Jb!|O~?s*xaFd{$lO*D~2ohC1#e)vS~zLK#s_V?H}jl#yTm~Y1qCltU+
z=|ApE-L4sQ*tl*uPo-drdhMqaGi_2>9+o+^`ZGdi;N<`tEcC}+(}~+9B-8QT#X*5p
zs-?JiCdIfMwE0b>I*mRu@M>r!A!Rr>y+W31U^Hv<GXIA<+5H1aaL?M#lPd|LiKv1*
zDprrb9;<vRudsRKW?$ihmXBTh>4GRf2b}`8ciY$3j?~`l^`5t8^$!UFW>lcXSd6ta
zbxFIEgtaOP*&Mw+_twr2Rjoui*1}V=U|C5l4MnxS^BY4o+1tTtDhjph_HIT?R?#PR
z9rDd-@eF2!MO!RI1TT-W%?A*cHv)!cDwz}suY*_TPr4@SlnD3FXO6rKJq2_C*|_Z$
zFgK88UaiIRLYTkGSN?Ld%!xU-eJpOsuSZ_``N)v=)%qzbMaD*^EM7)N_IF#M%Z%Su
ziOL@N{HFd9w{-dkG;3hkCD;}B%bS1l<jP@G&`#!|AL=8sLM?FBLO2T|`dr{zjWhaa
zTe0W5ji%?bvwE(WK5_60muuso{|<tU@Z;&aB;y>IX`>OXw7^l_1K+RBg=r@K>VaBi
z6~9hpmU3Utxvh*By);W`#}t$lR(VYGrmloI(8BbrR`YXX1DxxUcXa_jq!4n<h}jo6
zqMl_PF@CdV>|l%|$?t_QVO=8np3%24RJP7R)=$NOMO#}!0d_yjSUiGK&=<3rxC_q-
zhzjgyohz1~Hwj69hver$4ZY%FH8=idtXJZAq{g%^)z_(Vsvgf1H~T^7X9Z_b%2O(g
zsp9&j)KKTUlK3AMZZSz>i{Hc@ZQ#v<H_(osPRt)1d7~$DIW<k(eAe%;xtzJ2q5KZ3
zL!-{pOm0h(u)>HLQs^q(#<w+Y^F>n7&2UxQt*FJYIKs5T?Asr#I@x1B^_C$$8<pE*
zc||R(Z?ZKm+!<J~?DOehO&roYA+>xA=8`FSo#M#<c8r)L7|w#U8<B@LK>BRAtxk&7
zTt;#mjEhNQtDA`1OjVn%8X9>M?5t6;#A>H?)1oHVf|JjfImcP3sch4})PSm1ur1-u
zbeY_(fS}t5Pl6rafxQlJ9MAKq((k_ATyj1Gr|73Kujzxj0*E3apK>BH3#PjYeK%*<
z9ogDGa!L*7nC*8<5g3ge&Cwa&OJ&Pi`sq{qvmCUg0B7jtSH)^cout;nr=%(py65TT
z0o^v-IauM|;-(++GQ>N+1_tKGEJBAbiv$<ymT~vyRJRNU9)@j)n7$m5-`F1+v{-}n
zlqtEsCok>!DGR?Xd!>2*;j}PkS0jW0jX;65WRi|rSAaP~LVowuh@4TK--4Zcc0_T$
zt$6_BEK2>}>dfS4^{cnaEJH}Q_wipWD68|4wd%k57EAq2Pl}YTz=L&Qy%0)zz;S?M
z|F_SHUQcag@O9}?$zPjN;^K!VBGIH6Kjatv`H$avNPC}l)TfT)q8~`nOpI*71Lj-w
zE~Kbg;mptYM0no_N^V(eV1zkNPj+P96}#D;g`FD|3Th9L!l5=BgQi%@H&9A*HbTgA
zD@RrW8=FQjI<T6;LQA&B>Y=x}Aq5HLE+5KR{2(l{_*`Qj|D6KK#MGb!E>vOOoQ9HJ
zm~|DYvF~bKnn<$6ytmVIn7@9&ZBMz$b;)O@`lp<mzTODK=PMo$%bu@{mI&NdaecIB
zH@NUl*Ug<&cT-bU<6-pL-Hz#?WQJCC$AMtYvhH2CeznK^ZLrscm5GB$DqHAir-Vu8
zp$E5TA8xwNs|8lj#&5c=e8BN#g({?J(837XA0JaJJ+-dw@RQMS&g7>%SU`g64O<Ko
zw}N0sYOvby<C}g=&&Jrj2bvUP0<Hw2rOp!q|H6e#PIZXIuS7oj+~jx<<}qoPjjXu9
z@HDljDMdJS3o*>!iGr144RJuWjo&O@EN^uTRU19u9H;T(8uC93D?VIf!d<i6DJC38
z6`KuVaM!)8pG>}e$Va_xQO_i;=MA;J5%eaEC9B(^ws)Pe`%t!#7gJ!K=yk(yBgdxw
zlc_bTuA$7)@A6g6Y3J|n5+_<nAvqz#G8F|8f3ff7nDH2X{owjUVXUCai+Gee+U?n%
zw2+=}L4h;~V`gLGKvcfz`O9T?T%De@g(jh)79|}MV^qZaq5&CLp|+?(^&3?=)+Sx0
z;0wMBO1$pDt9er;hw~J!Y=1F|WJ%hi7iMXMF}4yh;A|s!In;!>;kMG9sLT}lj=R-V
znXj4E)|L~L>lD1LaTPZPJjRGEldmQ8Pz#rHJPOkNCbM*7L+#t8A3T)Dv#Ygtbl6WM
z=S+YTF);M_@Mpc<__|M5T}-JkQrUXXVuva`hgyz3h`J@;W4rijZ>_`Xg`&|n<7yg-
z`*MD0OdH$00$AIr=j`tq@SPZgx0N~<y(tB=+>j=l_YGlyiu2GWq$~~M;B$73+<tet
zD!;ASCu7+CFuchlJVh0rU*MGxQpacUoNjY@zLRcyC1g7YUw%+zp^4se()qlBv7N<c
z>xr@}!uZZBOZfWb<^0N_4~1b<bU|N4Eq67mmeiXsV1wd2_6*3>)cbA=Yq;v$IL~Up
zuG~E?b|f&3?U0X8xx0NNa(+alT3d$gV2Irh+uG$V(SfOKU5%8jk!$k=$28B^ncVUd
z%z+_}gDrR#^OTa)D`~OaRa>^CD%r~cGsk23PRiz+%lSksR5ED~>e4sipGDdAVk|0s
zyRLSfH?<KE)Ly_EoOfc)EpAu^Z+lu9zIgYljlYL?rE&$fMFuqXA@k=~U)|11>{A>)
z?V8~G`i-ac&zkWE-^QMNyGh8WvC~`3b3v_rXRupNsg@bZem5-mmsLQcTu@zw(=+oT
zXB-n#aS-O{yo}Oxf9z!K&yTvSrc%;M5?G#-xnb#;wu`VYEPO+MAIzOk%ErL!zS<AV
z-hou^lGy50<amSvY$V+}qQd3b_l=0riW4wPN0nbJjR!p7?)zu)Dg1Ze^BEXf3TN3*
zh9~X)W#wPP9YlBwSY*+}E$0_a>&TZ4^xyN8t<PV6YALx)C6XzX?&!xM=YcrLns~<*
z_Qguy<XcFSeZiwtq`sH8qECM;%wy=S_l%rx`Cw#0Us%EReIrJXu|Rvh+QsZ`(Xfd8
z-2o|_xeCTXvskRmwMT4NAHPla$q-{bDwFfe_7YEuS~fVme4aVmE1|b4MnhFxCIRZX
zlF}u&e9t*+k&j)|JKoS4^yQi>n}kHy;&#vU%||%(J4jP~NwR75v-GJ|pylD@p7*dQ
zxjbHJ8vr0_#|YtG{k$&-ttJ}9q;90Sn=Ln}T1>+{T$LD%-NDTcoo>DVv3xNOh8zA&
z3o}F(ZKH;B(SdlmC!0kXEI5nq)FkDKhmT5!n6Mzqip%^<8d%Z+`@_@-pR1WH6j1Xk
zFb~&fy;SdezomCbL1J_%OLh;tO`7CoBUnvo&6U6>hYDyygl-3Qz3Oc5lLtDqHQK?z
z2O>z%#pIA_is#C##GQa`&30LN&c>-%28k{PKH)+)Y_>JTGbR*nTp5<~$uE?(0vEo%
zh<9aTn`UQ|1wM0^we)sq**57xch{P4)4bcf1-IS}A@=04xAR{0p?yr{$6cd|UdF;i
z?A;CXVU*(5g((m=;Bly^)N=M*ORJzhiHVn|St_G}q8CipVIO>QLZp$#1h6M2+h^aN
zufBv_7<JnEx_S~;$ffJlr`iADUG-X%HkR*1%^YFjg<k8F4XHG2F!SmzGl|91s-a5$
zUhvXQt6QE)CY~Lv3R$jE4x-bhxB!me&iFG8$XUbGfzFb!^#}51lP|t3eec^Ber+1I
z^u3Mg3%5e;rz0@8%4<*gJJNsUk^epehfXOICC|c}A=GIAK<DgyLCXd;#-j**0EWl6
zz51gdP5BBrz?b~~e$Au<0@Qdr5D3_>Hr$2cKEhgHvR8t<V)?PXhr7UQtPC{^6#v?D
zhDmFYaPkJ);Ho8Sdr^Zt9n5`Wo@rw(LvMZc&8v4G1ij}L%y9!!XMB1J_VG}toK{@g
zJwXwnSkc?t<9(L>I>tq8jf8Od>TB_Xs43GlmZ+r9W%NQelAeWwCMB??VTl|QhT`o?
z$Fz|pOv}&}$P2Wa^^M+ZFjk$0FOQ<EMNr;y$d`uN-f?FyX)d?A12j1iHe5A4EE}1l
zfNlP$X1uF;+Gmb8b~oC*h@aJ8FV9r3&;<2%t(`MDE%B+8B|kRP)(=&0;}SC?Ceov5
zy|(J2p;4R@GS3C`tqfb(1czXJ*IU;=0yWw@WxoyqZY%OR#1CMrS(U`75kg!bF54!=
zCj9Y@tEX)7@a1oFTr=QkS4m(G_TG++zF}jk5E2V3o!ui%Y`t8&Ja%g+(r~fP3c$T9
z;=o=kW!r?tzKZU|&G2U~PdNBVb^C9eGyD0~bRQ4uV6lj(z|)llu5V;PGPHJ=Sn`P#
zZYj?eWUFlTBwNm$4z3vVom#4&C>M1MQedhyshn!>utIo`M6gf9E>_)`Prg0ewM%Xf
zf`4C~aq(>EQ`Aa9V9O3nbw=k4@LJ`BC%Y9NhMDB(6imNGb!@D?+hOlUeAl)U(XB0F
zM;J20*87ETS|XbUQ(>hga&JTaSUD(zjDm#41T2QnR$F@L?1no%w)$AVyF!?CL?s^;
z#&%R@>W{>{?R~^ohF1EkQw8p=%QzdOl^^~p76JC{Wwr&N1-{xr@x;9OS-+cBIPWj_
zaL*<H*2%Br6u(tBcWL-KY5TE4eaEg{duryiQcmUTvKgZ|=7%59i`Lg$Z(vjdHjCo%
z(W5DK=9Q0~Obx{)=56a%x#i3_-3IT6b!1KZ4mROWz#52)DW1dqFNPG>_Wj`Jue>?g
zBQbQQvaI69NUQxYAg6@aJ_XbbIXaClehR!|z{$m6ZQ|O$QT5O;Z6Hfmq6zzYMgFCh
zr%FU}u%&a+d_jTIvz#%@S0Tjt?~W$~&-B{c2>OpX_xsOFgr&j?cW>-KcvpEJ`lW|v
zeJ9QwdpEhYwI7yB97-y88O<5;cb@L{tmi-Ciimu?x))Y(v_Mhp7XTQ3(SU24KI7bG
zFux*}mL^7bt855GjZhf5@bb?n2!Rj<)ZmU$SV*M9S?tGF*EKk4kJ3@u8oD!q*ZKa=
zctD?ME0o0##`w)EokBfMGI;FN)u@^kG_5<d76O81@v9Zyijx--hxO0-yWnA^D@f0h
zy7W%uwy0lsumNGv@VZ(%O-@>N$h-#C*8ryE`H+AoZ&sGG&@}?Dbpw2T@?^Sr6jT6p
zSQ$N#_c?xTG&q2XBcy||N&EbmHK|q}k1Z>m2C(lw{ZL(96>+0_1mFk!Q{=8@r}Unc
z)c9^B=`v^E#_Cl5$|`sr<1e&&?}hIg?@Y*f)Zrqnj`lfzSwGns>YM2NEIq<&KUj@Z
z7<Scp^2fr<dhgnXD*W~Nah(!H{z1WRUJ&P1#U=f6QNQKTtiBV!gTQfZ_V#8GEzW|+
zM)bTlC%E2jNI3hC3Lx7CNM!L3y_gN|o;B@yDY}2Z31cTX&0WMjndq9xilCE>O~%EI
z6UP#l1n2Tp(y+Y}u(@E*vK35IGR)HO5bka~PwR@1>CKh~nd=XeKj+`YSMt+LJnJ=>
zk@c_f?Y`^i8yB#~=*Q88TNOwJc)vWbrP_RD&z{j^Nue87ieojkgG7$g1OYNXHI~~K
zG0S(tU$$bnQfX`Pyyw8(;$6jEIij5VVZMq1wHhtEm$z9YEK}ig(XdjlrFxydljU1w
z;Lfchgjz2(({LwNU@`d|Q;x<iHt1ma`2s7Y0{0*y6(vn2iOWeL``SGw$NM0VIF#Jp
z-frKVdGodKz(CbSiGZLfqex$HLB){f;XlfmKuroaO)l9r5gy?UFAxWRveQFG)F=2o
z_4|2h#O-TI&rkfDA5%`Jj>tl6wJgfnwLX$L+;?Z#Jz-lx)Yo<efVeA`!XOsO8_j_~
z7Q~pIyHu#S<wkHn<1%Pjlu{2{5;1gWb(ixS9?oNN9+;^sF8)ZW*B;wimmsJMB5EAQ
zuDex_B*IExqLZQ(?U)2j8@IKGg`{+or<NKQt*w8Qj+Ioq#RjEWrdI~wUj6hmuOBby
zEOEMT5F+i1fpL6(6IAI7f@`3(cNM5*am8|(fW6PJ+;Hh&I^(eIHMG_}`{jJ<5eb8G
z&y|TyIzw(<no#$y<GsM3sPaUa7R5UP&X<rXOBaY&@T=c@!hHkB6yVavNd^Ur@7bkS
zV_(FJBtGUU2oVG1sEMMY&fx()-y3V)O~l@?hU?7z_rc`<`o)`fI=06QXX;6P^vPu+
z?uVHW^Bq+cj>ji%)^dgo>xdQ&v?0M&0-bN&Cg)~)>ooF*r$-0&fIS77mr9U%331J(
zN+fE17z?~!`6^|&R@SOclnSG&9^KBm_Nec}uPDO$>yNMNCEsGBeH_Wm`08Bh&dXjX
zNl&sNQQq_W>=ezI0(0{bx$hFuB$7S4tq$BpRnB--_78tCb$~VjUT#1DH1acFO!^7_
zlkMk5yGnfN^Z7w;KyTo4@uqo-f$Rc4iLdf}hyXwnkQq2)y_!G4&gPUfDGCclk2p?r
z@Pzgb<-wL-%<ILhe>oJ1$XuBzBh8@IAuMxNOC!(sKpsdooD28TRWMs<n9`KV2$2&I
z5Q!B*5|2V`rPZE&PAm1_8@%j4l*(}*d1tfzm2VeMpb^1(k)f{LDkMm&FYev}R*t+7
zGzf(i51mU-^Pcz5uW<gVLLc?eUVZ3Dz<363xy{d_f{>t{f?<X$CZ`+^`Jmk!Z2ZF{
z1yis!FlqUD!P_7x;OaZ#zML-EJpuzEMACqc=xpGVT$Y3)wkQSWf~i7X<>H19=+Ib8
z^!R~D99q&RJ2%!>NbFpyIdbS@`SO{K?P~5bq)xvI!>dBW9IP;3(JT3|TKbEoqnzjX
z!)Oo#0$;Fa=kgQJ)Mczq_BQ!wJ$Uf&S!3iGyUA&rj`nV(=Z$I68y3Uv=Nor5@1Q#A
zy>f-<bG^hl-QKDI2@NeJJCaN);luDg*M6@6%QxBk&;?q6dlU~|NWW?x1}H)Eduxl%
zOe6e%eJ~+J(pJh0;Jo0?KCBa=|3>|w?M_S?5Zq+EbdH$)3dClEB=^_NPe8{^>Gq>v
zm(T5}gso?|tspN-ZRRFyy{}WL^-Io^6h(`#CG@XN7>Op_-B#dQW2vzOl+sq_P`?9O
z!f4yamw%ohXqo%&U2$<Yo1y^jz=4WrzyqVEG8Anjua{T25A?puqo2TYoz5Pb$9hk&
zM)Sxi)HF1V9HA~coKWPdZD04}ZO`k7C-JCVdP-umQXwTF^MaQMt=~~x?=pdhY8(lC
zpS7>0(+2+pq??MX1f+u%H@b%NQ{Y?g*Oc0cE2+4Ao`Em9u+qaF8>^FTxA$nGwM4z2
zzd^#AotSM32UarPp+QE%dKk+M!`m}rD{kN#q-}iYU<FOPwUgbL+U0CO%wV}t`%|{0
z2<y2E<Sl>P`n$1hC(-wTRv)P_r48)ni;Pf<m2QwPco~w5uEW0yb^cV}nRFSz(2R=~
z{}z9EDGTjKkasKB1>A7q*plmG!YE+l=XAPDt8cNx#zMrcin--#&6OnXF+LUQl2a!%
z9bTDgld#-P8dOlQFnBh5(-rvr0>nJ9rKp-CKIV(f)`_()8S*9}xW_Gy*vzkhu=836
zFMwqVu&Zjxd$+LL*efu2Vzl@5t>Z;)L++C8nbT~}HfwX9Rq~Qs#ZFcetOwh1EZOaV
zimK=yOO-Jms=ARKQlx8`vOc1<{PRO+<@QKE$rJM+D6*}VTeo;{(BVzn9BM31N@=_B
zLuh~7JM7uJ?an(e7bRQeb(=LUgby-r^L3U!HIpc%3A9AoXGMeVacn@ehIc&6OCkr%
zWLFRiT#*pRVvkp7$+T8!Kq+E(hfyO2R+cgE*tvCce5Gm^Qsmk)S|X*_O{$8VVe2a*
z7WS)KcL(n6F#gT_Vm9vJh3N%cYkz_)+hjmBuMI*t%Ope=gvg<`yTSiJn&zSpuZ6C7
zpMW=~YWDoPKjjyXBuw*3UwJI(lqz^X;N=w?8Nh$IJ;UNc<KhxD0aaH?NadE&tn-$B
zZ?7~dnbgqWR3vP%mY1vVJfKDFSi4n?J|XA3__S6laahUVts$$jkB{rfcEP7WpFGu5
zzB|~~_eLrd4_}tu6OB?@xzn$w**}!eiybFfIgrd*%g|{O8AGLAN57q0acGa5wqf(>
zEnUeP^jh;V?U=NRrg@e!JTb-I8c~gouSSIxhfKK5ZM{1N<p>*=->Qr1X`6iOS7f(2
z<%gRQIo)%4pQ_bb^TAGy&e=(U@e?vXzs!6z<}65`y#H12=JgTJ_gS8#PL$kgPQ<{h
zq}x+Rbbu*?vs_6LYQxIzFGkcu`m^=*MzrhmIGa|Gj>^T$=LYrPECqO63}VlHey%<b
zn%L@-^Cu=3Z#ZOV7axe&#<ZztnPtS86KX*wei=9DYF?iet)0MP!6VoCbz`~}h49p2
zxlHxL)U*WRxG?1}WUV%<#u7EUz2vlv;ypZzqP(0w16(e$HH!TB{>(RgQsewP`=H8h
zXVO}VeD(K`#O|oTsXaEMTE%sx1sBvV)Xa^qS=|I~9q6w~cZz_H;o-n@NIl6AF}=o(
zCoNo-3TSH|tm<`mvts%!hJPa(7<@Ma#2FSGk%3rbg^dAKqRE}jB7QwhkIJJkE=$6D
zmp}Ro_OgkqQhmkn$?eV2r6F!ChD|6>T?I5t;y%}CFV0IvuBn2Df_}7K7O0Nbnmwrl
zrQMg=SXGR!Vv@IlA3S+f9vR%&IFfRpQ1{blEeXNZ))k+5M><IS=lWFVUruHIXYbIf
zIdXMAYlwi?t7mMsxh)!g8wRfMp=^Ljk-%w1-NUF7v5!*jf+hvCl|g6ecsTPa3qJdT
zq=ABe^0Q<YCby4j>OmtJ^iPG5M2^U;^xW3aGhX!xomuA%o_!3tqpFIV%TME&%xo~O
zF;{Rtcek)}3S>4%x99Q|^fd1$PCYi5%Q5EMm=l!4$z@a&esasv&6oVIQaadb<1{Xc
z_;gf=gDhD?!yt!0+IpXj8u1?sLc-HoY1iPMrEbafFptvW$N=zyfS;f*|FM+gg?}4M
zD(VJS5UdtGml-ldp8KdM&OjYu25L#(FYJfyo631!`v;_5w?e?n(GQ4cU^I5f(p~}h
zRX$}ZnZl~1_kUDpQ0IYg7&8LWPH$`7KOLr$fNBoDFv6Q10tH|Ep&^JF>QlT)Zd&p$
znQ82zpWguW1?On>m8X9G17eYJR`V7J>pGF@#SWK<lG1CB&5qli1jviE{ygl9wjQ6?
z?|WA$)<!%9%(Bn*fjY};#N2+C$DmGoHx+%W{1LL}wLWm#{Z}o(KhW888^mVO##-yZ
z-aPc~>88`p)Spf$6RWOC(ZZ5u^6W(a@hHSZWwWFsT<S!A-cUIhqj2ptxa_T;SDEU?
z$DOyS{VnYka0t$kj?}(93du#v;W6R`pwvy~c2n6(D8zpPmtOocBy0ADAB@qd<~yQu
z17NHTfb#KG0&Q)c?*pd&y?MY&VBwn3QW*Z24(<QH>0ea=;~<WL-(<Y%0KEp|U-2;(
z5`b>-2-K2BT?F>^VbO6IS4Ffq%OB-~;wnHp_P0NRs_LKXfzKQGI~;%d4Gc&rB{)K5
znY4P)<`KY^yz*&bCV!A4m{(x)m|oq0-ko*lIgDn4d00Q;SBK8ds+peweNgqZFgplL
zj(!1{8T~PMbETr-*?%v9nbr{q>ste%5WH9Fof!h|DZQxZ{Kw>J*}!bxmK%P8-ah`>
z6dZ!P0E>sD2?hSi7Muoy9j$sL3^jx;>4RlP>Yx4N8D(AsnA)!U-Jii!m0=(XG{JzE
z%41Ypq5rW1Z^)mf*nt9VD_pw={tKZ54g%r-Q1+E!QEt(~1A-`mAc}}csC0@*r=rrJ
zNVlYPcOO(lDM{(>?q*N~q?PV&7`kC*zCFe{2lU+U-ao+byz}n8SJz%kIP~w9E5C>W
zwVj;W*liRrFi?S}w=uUMHyC9Yw@%%jJog4b$|IkR761g_0_+oQ9G&{adZ_*6fV~-0
zC88>WzJrjVG!$YXDlo?Qvs=qA0uW*WZ*UUp!b3f%2B^c!82W(;eE8QJg&eS-Kyf==
z4M58Z57f>KK(AuK-{|rmt^imExTsjm{(klMA3~!j2mElh-;EVz&w-TzX#`<->^LR<
zoVWN37D5!1n6wn$Go^*J;K6tW@U{|yZ~wgK$6uZvfZuTUuiim@je-Ikm|*~vgwAZ}
zJo$CHpATwXiubs|$lJh&QbMla)yvCbKP$%mIp@AGK!Bj!B8oQdKvBo!2MKtDK`8NQ
zxd-UM3bH|rI^4N<fDFhK+r5(zgP@ZEknP~V)kopt&3D201a!^V)hfDia&Q0Mj!-@j
zi5J6Sv|~?zAA&v!_=zLhJ`P-I6ygGh&KYn;ubVu6RyTA?s~Qo;d#Ev7!bJ&>z$@U;
zLBlPHr&#@gB%u2@rnIdnQOXA@byU$n=BXa*HEOT_Cfi9mAouz9V&qW@;!2<+n8bGy
z1t=(~ZmnHnLs97QO&~!YghKKKW0?<6lPod7;LV~?MhpP5b#cH>ifX^-A5j=Q^Qj{q
z1+qF6JDH%NO?U{tl{~qsP+c3?O?x$O8>+?PdK{1;$iXhue3lctcLG4~l?ZY}fntIH
zoU#Bk?Dtx(&?`OlATV8oIIcxcqD~hK5Wvy=_zvzVBw-lg$Gf#oqlDheG!$vL(m-y+
zb_!;lN}~Q-Q~)@mTm6Fbzd(0R4AA|}ik$D9m@W^Hfq4mSLWP|0`pE;Fdszf%%VNy6
z4|tP+0?@dBP{6-Y^g~i;4bsh_+7v7>02F)zaroL!!k_h@e}m+Ne087|LK_sO{Vk}9
zF9f!R_SxVCilI=_jbR-y)cQ?b)Ia`>1)%AKIFMwlV6>M|9XUV;JV89}6kNY=M?q8O
zyKMdI5z69_1{OycO_<|phI*(q9)Faw@}iW(E=r_PRM%_9qwUrG@3ifEiME~ZR#hrr
z2JY4O(Uk3)5yov3zCSAb{|yN;z!p0n-l9aT&=-_XSsIGrAv{;0fAiF~5cpi%>uPi(
zmFmlt%`u$fQ_5)vI<!A1_KuHGM`KP<?F^|Y2WwgkWkz>Xq^_OhZ;Bp+9+2lIBMM)W
zG(zy*fmk5;q4RNsr%Wk_n-(_TWWg*|jVj?+?(*k8e6M+;u)(}oTP|tk&b1pLNRYR{
zjJsM(Wkb}~auUWsxX1!@+^@8hMD_en_X2dM;{YmQ*C{L+PExzj!i6g?P^r7Ao%TxU
z*l11me9BWpCGWq493}+RVFNgN-odBk52AX7Ocoo%8>ZSjiX&Bs=CQ8+9PRSp8g2e>
z7UN&2Vq*&!Q4#8vrVGk^RPhH%5t%EeUBs7ub(0nEDA!v3%n-pPR3<l+zN@7!bdIRj
z*<SLyLP1WN*SjPPEKgzK97Yj1j@B6e94b@-=n>vWbp=feFOK{)QNAn_8Y&U~MB>ql
z0`7DAuST=)o>y9how6l7gw_Gpabs(=Q^8UmvFMW;P%23FeD_1mQ%m1u3M@Lj%zZdj
z7^rdk-FKy)jxV~<_vreVJ<*L*4+Eu03HZQEH|YavhGjeo3D^(O>v;GiZGK!V{F?~z
z1<)Ts;dBR@CLuxmN6ET-8g!i<xN!|dvM6qPiFs?OKRA6_MNDohm7x3Jo)2%9&bhp>
zl+(5oek52=*jiH=)v^wNWrqz+m5cjLAf2X_6YTkeTmM4M+rc-z`t0;2<bQMWDaQWw
z5h(c1zfbnJ5IH5F{_ycWB?y4M;dqyEipBr%=x>k)=QQ|VZ0+<To)iRND&NDX2Dwwp
z@P7d!d<sY#+yCKszxFJI51NZzOl;TA{Pmyz1F-NRbHsl@*Z*(36mP&BLacB4tn$B*
zbQ%&sO8nP*&q20u{x>){1q=L#z@_whQS{+wL!AH9X)!#0HyKd-Q^P*q=$Ag&j%x2J
ze}0A=He+WcTQwc{tJL?mL)`HcvNQ8s>Eydr@bsxHR3nj+rZGZGK@!}E_5~xq{!}9g
zj&c81V63H57^5arN=nL*Z_^0>lUqr*ymT=oQ3l?h;B-#P^HZYs0UIoSz=XrplXR%$
zN>=an$P4<Q56T2;2o&DW@}?6|@bD5+R<1bSi@}=_a!Re=3nsX%yHCm)|D#dNAIJiq
z!qX~B3L(u)f%%B)BHJ5Z-@s@7=9l7?Ss8)l{{S^WuZQ>#d%ROnhehsACx}FZw-VcN
zWyGkB7Df3OboTu5FhJ&iB^2ciyeVS6sm`45R)b;KO9`}0C(tr=_fd!WdEx%#VW`)k
z?Sjoj<7OF8lkEfEB~R1Q#G^ctKhlm?ywKsK3HJxb;>Jtz5G72{3LxmVQB9f<WJSMb
zQTz+ib+<hQ5kpK2eYtz-Fj7vn+fvWC#Xj9;ynb2+{-Q$LD_=So0@aT$I`*`l&xsOK
zlME3tH3YGPj|@P}IPCdHoKm=`ZC0Mwy}?Znt`&t=A3q2<ELLK?yObLR@_Iu_yZ8Q+
z$kwIe(~}<ptk8mDDKgvmrLweQ)0>wRvP59t7euwf`W}w>wYPsjQi)w%tL>Kz<6V%C
zYbr5fK69wH+ROi&efu}Ju1im>@h=7`P7F@shVs)iHnnUp$<~m(=>y6}4#jUqRUZH;
zoCbM3v~H-A<4eFWay?`ELMQh#=9RAIH0O#R^}K(e>3Dt5nnmwf3x!-6NvZ495=P>M
zGJ95_JwFH_K=Kdv-kf%9P%FA!9w@f0%0?bm@$9(oq>LulH^Y{CusHt!=pQ@e!q&af
z{2op$vh=yDQ0(o!^zbKX0_9+ES{ne_K=je4>_5;a^ulokn^c(lx)1a8$WUHcu}NcG
za5rYK^dFuD%u2C>X=SygH;=$kzcEx|M88q+t#bPj4Y=x0hK61@H+Vt+cZ2ZUHEN4{
z3?gG{CDQ&k+WYj{8gWU!c+`eVJaCC-hJQQ%JAl7q7C#rgfhwiYdhI41J>9og6dXJ%
z{^k+%?=LB+A0~m?uRGpgI-m8*nWBHu^)Jlg5I&(nW?uH#sg~xR<XW_TWY1rf%<^Yp
z1I~nD2jit2bi}O8<>hA8P~kLAHjc9a%;rf5^qG?T<5R&4)PgufO2{4iLc?V{sIT+b
zU|MT~I`2`6`EPATe(mUix)w6wc97-0CYDx{k^I<uQW<OEwTqyChA$D2oYma7|DdPQ
zF7I0&kr(b3;kuDR`=QK%-7@^&@^rp({};%N(7lVS^vn;RLz%PmjD!sXqZj&F7f{n^
zFM&mT*^*9^GJtd{zEbsyt61lk?PWDt684afXAbvmad`f4=I<o&KuW7=6)vkJH`TA#
z(D+c|s80&cb2bJ9Jy`+A_*v>-`5nx4SI{qnS2HOOR=CBr?qBjc7C3w64?Foz#tD?`
zM;)%RYO+gvRJJDLLu)#BfYjSZF$&U;7}a~@6u$5H)%BCO2j+2_?ku}7!}=a|2*Bl_
z{`cp9<J%tsLn!@xvVnf{$9iQqb%m{-vq3@8Gyi`e5e(Gqc?=&^7g(A4S=Ss4F^sy!
z4y7lg3*Kz{PyI3x1!_4HhDnfP!5TVgrmCrxaJ62u+t~`^)D7x@Wq1I~qz)5M12KAf
zuNVpw1(+=TT%H@Z&tlsBbvljt<0Rl~FEi>&Nvn+29GiA?>g8VR-NttVSg1GeR0fk!
zPlNbL65trJ-y)7b0a_OgzS&;E(uVCR1f~XEe95Ep2a==)(@IUI+MgT!_Vyo4+lN}-
z=}4Im{UZ3wk>WJAP{_Lh%%?5j*8YBM)c@vCmPCi^bA|s|1%snpHoy4nbSUr#zj@|^
zZQke`?wq=0fwC;mobnL9FFip4>|Cs$SJr<gt2C5&S-nv7fC3+!<V-@xhu@Fv;RAGR
zl!Nt$pKVG{Kk>2z43o+qbGsVg;e~?z&we#0fr16dfDixlSAT-XgB!JiwdMyxbWd=S
z8|Q2rPla?)5S0Yem<K*b)&GYDLXnL!1$K6e9R3H`a{;8!d7fgfzd!z?L(aVfXA(+h
zLwRARP^hI1jzT?lBlSNFmFG-AcW0NyHQfGh*#Ealgd!I$X|TfF2$B9PAqtcc{vd|+
z55C4_(Ab<~W9|<7Z&>|)o^!_FCC_W%jAUs44g3ElUljJN!7MwD`Pw@S80a^_nLwN6
zKXj-304B-h`*3<^{Mo7!QUcq&xC}GcIQK``rw0o;R!F^-5Kk^ImJ}BkPf5;}1m#dE
z+0|+-Fr<$4!njev8}?81z%+XJP>GWMmTY3;ElQrdvWZEFpN&d-3<Xe01Y4k9)a-?w
zgzCmYhkrPeB=R@3dHhXep|$8&>B7&^5oBF?_ei|qRs+G!lv}dQS5+g@J5iT?<W2g{
zJw;Zj-D;qIDr@FL5cN<Z;`1A+>_h3Vlr@(izX$9nlrY3wTR_fE>FryI<b3c;qQ`xp
zZ%y|8#J~WpkDq^7`M@<F3jAzxX8xNX3jqQTAPeE)3AT#+SsxX1{-r>F{#ExGFr!p8
zw`9&mbUgyY)^JgYgoi`eE1sJCc~*oNrJuzjK8t01_Lijh0LhP)Iq!NB_BZL{rMKIe
zXhW+1y5+pk|Am2rN1R|vhl&-9H8Q$G^lwEY112~)B|aqieGe4Xfb_ik-MlxAa%Ab>
zm#X;$^7(|I3x}&@{#6%-K^IC{AoemrXPNsNnifC%;;-v<KTdFt)${nTTg@Gv;m7DY
z!qC-gm#4HT=>!y}rnQA7BWEeJm{Alygr|Sm4FKUkB>6-JfRs$i3j+mD(J1U=eTk5n
z2<^A@=hU<%f@CEU>E@=}DgRKeK_Q7zxV1^ekR~K9E+JJhmHy?NnDpClr}G=B(d5Ao
zC<cI-z&g5k7pVoB<dbCcHdX(Dxu(J4NetRW53wJLg*_ZD{7gT`<?zMPcD9t3uCy<l
zK&;Px(rv{Ll22~Acrxp7jsuO5k0&yiB_&1gKC3MuMsD~umS!IePcQBI54vAbN+&W$
zJMreNx+Bhq96@@g#S4%&XTd`pkcgW$gz4uHWS6o&Y)#ypZx~{HDofccduzwmc3s2(
z!{fIYs8Hbf8KNsKlPhX;%;)_l^4QF6<dQ*sci_wY0g7OQ%5xu{0aoSSd!_s;7P2<}
zb@-XWAC&UGDtHL`YEhHLlU6nNVe=)Qz*{wy_lo1JeBR$Oq(}*SDBQH8e+Rv8?8Uc}
zmmI)df7`CL_bY16%`7-Rp;V1c;^2ZN;96mAenxapAyf<_gl`)3cwHN}7&PqrgD_cO
z5rQbWKXd9)tkY%)Rgy@3IApaA;}WU~6-~UNdR?sI;n^2wSG}nqAVK;)!}yPO1(sRG
z!K)xkN|6@R*+!ffUuhNI$;&R$h|4~RzJL2J4tfF&kYU@qA%qbk9(#F?yMIOe0rVef
z!9&;VnOx>>FmV%@w&K6TnAaq=EqeyU!dpha<j=C5a#3QC0lDFix+mFI2ji~)oT!~y
zEvpyiiz|c>vynPA<V`-ID>&~w`T;xFP*0!5;3JrTFMrP)pW=A%(Fmo(r=Kf$DsfXj
zEoCf{mI-&vfLJ6XFLi~J#o$Bwgx?FCSkjZ?5-l@RsIYfYa(ekaQGK;C!^X!VVo7Ir
zD0y03+=J507^clIj)Ctw0Il67`=2<C1+XI`C`D5fGh3Fipwx@t=A&A>OLBXms@hbV
zvJKSV(Be2ja>N|%@<~zUd+7@cW6*XRBVE~`FY#B(q=!mOAj(qsxvBAk?qd+i-a;uU
z5V^0PxHJK8J>qnTRnR|G_X`OABQR39uG!JK%w3~9AW(IC!WdS#u3YSzqR<>pEvqkf
zZlMw+214RKp5#;=46CgRRB($I$mW<K%4a0h651{%rtSN{6?pg(awh-{{qWp6f^ZU^
z)mikA<#&xBlmY}yEN0QUhhqNlnQ@C+Y$mDXhe7C%!EUs+aeg#a{Y7EdZU@GwQV@$2
z`4P9xB;Cu5que2wmJ*Oi^%j~yNfbA{5BJx>6gU1-?`n51Bv(6Y=C4`+M}5rS7XRr=
zzO#rGD`t|=o_WG``Gqk{NTaN_*u^)P0M<V;uK(B`TE39Uq@|9RfxeEr*Qm--OYR|9
zkLtjZvv89Av_RtD$XO^IDDaEDF}Sg|mk>F%ik{eLAaM{IM{)`U4pen<r1qV?0CAKJ
zO-{37IvAhCKwyXq#$nv6>aoYNrdbn5_uKt!K(m=(fjP%>$wDDBqS-JliZrdEf(ze)
zh!aDOrX^fK{ImP}PyKS|F-2ay=tX@pcKv(`(iFp_LjrP=%gIFsL+ADtf!uL-UF5d`
zGeP=l%c|XtITQaqed8wxp9G_j79e!~;lL)P#x9o8e*85~%}B8bs*m{<1P~72NY4{o
zf~JG<RzgBg^YA$xOBpenR-nIjiAu8L^lJiALgHiwEwHi-SQ%-u$c<XrsT8ctZ=Lva
zg3G`0HX)4)Q$MD_06el$TBH5GPzZ<op3cx`ddILZ?cf)}b6{*dzW&*hH6y;42cq0i
zhJi21oi`$Hef)#2X5e}`U`mprA%UFV4PdBwT?$##?A#0A%bQmy{)6Eg4UoMhiSd9!
zql@yB!j(4(US@4p623EH48n6#e_HYqmkp(=)h4ztG2_F>V&ZRt8*!IjeKArx3m5_j
zlBV|>pHMPz&$<1m-<fUoBu{^bUI+@vXOb|rO%@551|Q>*^h}2;Er}&0AG+cK)g#>o
z`8Q-xZZS&ux^cCB`1rsCNI!-9l*}NBgs+tE5HT}Xg=oS6wVQXf*CFZnLK8>;=R*YT
zI$~$kpZ6q713IB_!E}Qg<b{NVRbc#zR@QQ5tJ!<LXnucf`2Oe-uJ^_7@jtjDxEY$p
z?0Pa-boP8mXsE={M@c#sa5?Yu*XxZ&1>#w$bOe{4<L107xQ^j+MXA=Q=J=q~EZjcM
z!o_%TyvjR(-<kwHfvWDP%<QNc{BRpNo$vv<H@bXl_t!JvIBG66pSeII21|!e`9`Ba
zX40Q8y?4oyl&jyh4uAQpevx=>NlA!A^0>ld$bfnAkIu_~v+^~Xz}N_?3d~oHxYz!=
zjZ%|F^)vWt#1aqcI6a%LR<CR}0*CmZ@234t{J(&Cv|O73ewc~kod7vXE&)Gy*sffl
zE<xw0Z_@kYTR1hoF)zi_pye_|eZn+>SjYp3XHX`PBp-jVc<n?`0Wcy9^vOlCj=TE#
z_~a>K^}1qj0&q9v3;8hkh#dCnJ1I>y8{&42daHf5YZ9yGIlBow@rfqjS>tE75WSs2
zu_t-#JK8Yp)&waJUN!7uHZ?VhF6;Y!GT6xOSwnwc%I6adcO$2{ah5hPRn|ysyH)l)
z<mgrCsV2bF7`r#xLZ*Ubr_bU{zE4cLm7*6Mg0FE?;=B9%RRU0~M$oNl_no3-)Yy~X
zHRv|}o3a$Kmsb|Q$q(#3rDhE>H=HHHLa%dso^rC;Xx%l>m1^{6t{~Gkt><^efyM;2
ztZE;!!}Puf1NMP!)=yLtxdt=`l#c%o0Rq(JETLjuF<)39OPN&wiRUc|9l9{xQP*>j
zWodEm6NvJ#M6bfr6*V-Busrknqv+H3m%1|P+^HFGN+YRIuND9jd?%s<<_Av3nIiJX
zlet_H4N=!F2;H}0*ek!3ubfD!IJ5w!zA4$u@|+YHKqI%bhqonhH{x8?Pr7Fm2-MV6
zy-6?QkHHR?(Z-;$v<H2!_wvlmM*bMo@z6kjY9*&_O6+7SA}Ei6&E%KzaQ>OcdC1nA
zlWxX+`oK~_Veu9&ct81Y6WvS1lN1>gA>0E##i2R5Bl55_EcQ3{Mxkx}Aw_~qxDrz|
zV%aCO%(TVyX^=th-W4riRIZ}KPJZR`Ih0ZB*~WOejnXFV>pd!EloMg^nf+a})ER>V
zX#_jEo>|k(YcBso<P6Y>I>s$iM*^B7+r@X%Y8S4EKBFt4TxtZ+;}qvP8KL*R%oXS;
zw|U_$5Y{*%;&0x)r>5Jfx0q!F0cMcMhyijMDM$i5O!KyLCy@NhN+>6I6MP1EY?w^}
z=qbQU3e>Ok119b73tggRU<g+~!Xsu=`Vi2S>Zs$BuTrn(Is09f(Sk!Y@?%xI`xWU^
z{*fR;Jmgy_KknjPJ9}<M#h)nZ;lf=4G%fXOi>Q*9e^}#=GzD*&&|QCh5>Bma0U=!!
zVnLUu>XkfFzAqz(y^dgCRi1zwN3-8PiQAuti^oWuP5(S_x9*Nm{Fg4#w~ykW55yq@
z9=JLugFHeqo^Wq}QP8j;R=q2n#B*SQ)-ZMmpZv#OUhd^t;-Rf+PG=MUIeS2bZ$8X$
zNfz=N4LyZ`1~cqxrSC(C647IxQ>qjIt*klMb+Hjgq3J0$Humh-1ROCz8__O2y*Ir^
zp-#<WU9?n>q(PeurJTcK!zdo<qQ2qbdorQtvQql&ew6T?Q%5VRb(avAXi(75FxX#M
zSm4=9um`Z-xtb#QZ`l0}MYRh`$&v)7NQ~&T<YW+>xUn45ckbOokw=GoWx^4IL3R|+
zcFDPJVX*}OU!%JCMVC+{yD4o>6esq8JJttdLk5n5!|L1?lJk)Mh`@{g!VXwr`lksS
zW_jlDP8Z?~mfmbtmTr9+$><m<5y|aQ=E^6z%g!Z~)Rg;o-ddI=r&3C2t7TiBS>ls@
zJolW~Y1{#{nJL)gbJ`!Z+IXdIOGd?2dF0wOe%G$W#<VbxMTJ7lXU+{V(rmVG7u*(!
z%<f#*5y1(4$GkAL1s{3gTUV@Xt+&+|x8kL4-y3Sx#Kb8_;;@t?^JQ<?t<)WPY~2~Q
zv4_j4Z}ptxE%7*XiF^o$m_s%^#=&Cb+M-2^Smkz#BF#qxqPNu(Rr+*-_`V9)bvtRR
zNoL<O3%LdJH`mF#9rvxk>!H#z*^@1OT#zT-9E-Hwg!h>i+9Tb#U5clmmmL=~xVy?N
z-*T!uj`UUdYjpdyKYNzqxRq-4%~5^k7*v}}n)o(Ne@L0!1Xr$u^jcxv+y&~Y5nEq$
z!=GghN%NDmYPcydhJEF_laih<YDU5%j{O!JW(+;@S54WQ<!>u|^t$u5xD{oe-Pd(X
z2CTMbhL9$rS_THe!;aY-rMWRo@86G+GHy@jRq1X-#kCyb4v*w6mxpECok=C@%5qNQ
zdFAWs$xwVRlt65IR>9l(+#iv8k+eB1n$H?>KpNFfEitafoF%9>&-w-%J>a<W3HS7N
zH(zbj!fW6_BtL~aJ;uu#c0jHSF>#J_KUg*&NuTW6%WSn>7W}|-IBu^xgTNy1OFc#u
zhQk_Gw5rG86SpJS*NEfN1SS!etfcZ<U25Y<{4SO24A4IPXltu(FU3Oa-1*h$4Bqix
z&F1_#Aq`vf@PTB6pm8K?@P(qMZTpD!j^@zkx7WJ$Xc|X2WqD#OE16vvd&Tmh?mJfT
zKbiI)Y;NPPm&7_e_I{@OX}~#IO2QQ(=W1%)+}aub5lPHcwYQSfx9t~x^~;8-it#uL
zEo~r3YajKWKfeJiY<bl^GeP^@B<G>`*pz|}$a9NM(grf-tdFWNS*jWHpe0=b;eAZ1
zU!w9DZMgF?VRByP0&bn#XcN&Rd{1v$6(~`1(}`u9AwDG;*(;An72D!fZE;k<QW2>G
zaYB-}6uPKd!bsmFJi@eHi$lD<!8e0|Br|0hh)EXD3r@>09|~QC?qoDAb7z=ZD{t@L
zG5laMlE6w8rb`#nNY?pHT^QW9qD}_Ws{Tc~bzGkOSa(yD2$>}vYKk^pl{d!d<McU9
zH@&)YM>hmUm)D{aZ{JSQ>z=^zp(jDFYl_7OKNvy3nj=nc0r+KLUq21d08qx=0j2T)
zqz<bKzm;^=V1V0ISsT;SQ@R_UXmHP?u{iD6Dj$z?sxuFBLtLgw>x<*p)yu|jd0~w$
zu!ZNLO|+mHND|W^m+U+{r%7CO(m{(vu@1#?2k*v%70{TCh7;>6KE%#tiNK_)fu7LQ
zDJi$G(8^iV9x=sUa&b`#;?Qwnt(C#tUBfu819zyzke)@5btE6(qT-=M?CgM`(Yn(o
zr282(EzMcfG`D{N<c?B&_6T*=ZVCxsra`@Hnd7@Q&Gl#lKlNgxfqc)lIJRfm3Tp_L
zfX*{cj?<Ry&qfgpmMm3wtGUr8bY>E6fLrkOsT^iA8(X%ER79fh^xOH&Wa{hAIS@c%
z4;L<PZka=eX&k;e&bQRmzsArnyvdiTJPu7DgD3>Z-GRCb?~D9(x@ZX_!2`_N*5m)C
zAH3}=c`)4xotf99Uy=$9=b=)-w77liShaqw*FF9Qw~8fpIyTw3Wh-u1;UhL5KcDx^
z263}b(x7vx_pKJ5q}IS<&R~5B95&x|G>BeaQ129w=-^8_)MRdJX$cy2-fezu&M8k~
zeBd637a5tAhBh&~mJ_D8R&AhZT$4<xeB5?ffP}<yx)zR=GG13zoDl2e5*cmX7s2e!
zOwSl}zg|SbQtZ*f&g%U$DF%D*d_SZvHs*^~P!7=}2x6WpDoEFkY<-m|)KhKHEX#sz
z-h)&hq(Nu=zttjlK9l6~Xr_)BkBEJ(2rJdTY;4+^w}HAGI5qvx7`yLA2^ZQ<TJ|m}
zkM@X%hVQ-U0`ARLB-YpJ^7e#9*W1Y32KK8n%P_Z^Jjdy?1SFSX{jA5mDAW`J)Yu8Y
zKWTPehF@ox05Por;#c!8^j(p!!3eJp<Iu^2?oXK~Z83~C`iUEm+??2bc)+l3*LG9M
zom`dv6~oK3pSG&@O?~JC9h>F*jo|?m2I<>Xso}#L$HWjaPNVYenkB0;owdO-O|l4f
z88>jhs&6h8;W`tWV1L*y(&^8S3t8q)z2xe68N#70@bT{B<SU}lrg;h7uJ)tU5%-)k
znsh+Ju3GDr2ZQCd-c9gIqw>`fv94;ddY+xh#dcsZ$kJQJa@Y_0Lo8zUQRM*tCSYI$
zv1s1)pSi{v?|nNZjXdax%;Brva$k;$cwClK>mn(ysDfST@t&XF=Cq7pm5KAltNB)_
zH_oPooK6(`4-?vtR4(n?IS9EIB_z9B_z~x85Y6Q9t!(scJ4EErL0shX7&2qjpgT>b
zg}kN#ttHYCcNC;~79U!BC`LR2bS&lF{PJIWLdly?Ds{t<{7<rJBmNQh)UB(Q-b(0A
zeQ-XWD+lUuQE=TX2N@}CF7Jm9?%hq3w|ogf^FrJ{z{K3;=1h-cG!8@dn+rJENkWul
z+9%c+#0!B=`||bG{%z3SCC+)~@VQK-nn?Yj&*nh6Dk!Wm)$K&!C>Pt*WFKvcgqwQf
zEZj_5T`_$l@;;^DiiA~6<1L69jeyz73S-~PU-%*!lq(z?aTg{<1<jF<^gCjg3wNg3
z$il8NMH<Hu5)rj7Yy{7&PcG3A$MqmEBJNs7dna8VW&||`Ao@zon=YLMF4r>C(-UN|
zKLEL#<$GIGK?K0sT|Q2m0STW5?Mptsd>nC=7#^)HttrLj4-*rUvR*B@DCbAU^%`wB
z#?)R}sfkJBvAlhkr=^zMNi7rlVc;5nWmgRzP_7M+8Y(+v;F1qTMBY8(e?z90>*5Or
z^~J%uWPN;g;UQa_R#72gq2e}jAy^E!wbX#VD=$DeO$LNw-8MIjzT!!`i0-bAD#DI-
zmZ+N9w)BVHy`x~*b9;G%j1j0?3V*xppwidj!oIAG9D9*O9&tRTTIYg8CLiY>YXC)S
zOUuLFnCc87*hmaDCoWm;4szsJ*$Sx45r3iuaK(J!vtiLpHwZ^qAG@?$1uU63^+(n0
zaNL4qFD1QyTH7D)nlX6Y5j}r(XDjiR&)cqfsQdbYcd>ZVHPzP-Tc4VnXFYQU*DS{!
z){Gr(K4OP&sT}X$;VygT3@ZXTo<%_$|72Keb|0cRSf#ZPGij+<K*pRo?5wP=*hX<h
zs~xD~{oK@k;w-=`#kw0H>UO`t@{AL!thBWM%2<(1S6A0VOljm`g+yhnbE#VY{E|^k
zb?LU0^3gY%-r6<h{F#P($9?y}MCZuVo;_70Vr4)RO-sJ|=mngpaBf;guPF}s;?V?3
zqYr}42mO06rlt}z`Q<LR@r|-<#QNm}=YF#T=XqwBOiM;LK_rJ*Xi*23)Y<Lj+kUb}
zNNWi}Q>4_G%0_Lvpp5;@i!fJ{UYUODjv!UDas^=Ix4`iPvfCHodMpytk5?}+xWkK{
zjj0ugyN&F=TN$%n>C}v|H#1nYb5pEXdP{Z@O=rHL!+DpgxjBcc<Y*`>x43h*ekZOq
zb**gZNG_aSYuxcj%Bn-zpwCFY#FGW{Xy`0gWGEBEm?nd!`%%owP>slN_vIlnmiZXx
zFnA}7UCeZ)G%9Dfv^BGYd|1$YAifp{x_nW2Z!mmwbdG!`$}bA$Oh8UV!?|0fVphI;
zJtIy{rgmgK$E9FW6$WJ8*c^vNHumCD&n4TPr3045kwu$u>*nV6;8!e6mv($Jvt-s7
zX0|WV@D|HA49b(c-cofRVy^1iZHaS7Cb{OuPF`(~YALD73%t<5+iyC-dwc5*UzvkX
z`h#NZgG|A-z0TEp2gj|rg_c_iM{5sk)e(8`X8l#o(|5N5qrz#j`rK|A_qi_JL5RVI
z#q(nMlQqZ3tmfB`9>IOnmn)5(ng^U;E2tJZT`h&nZls;<<Vi}}uB{d+;pphp4(@rp
z`O$lMHZ9Kmy*a15xq04h>Yg6|Oyn5<BbcM9qJo`2qq})YHuBimG-s){TZZ=$^NN$d
z&C<aAIsUz%kdTmps_Qn(eqDu*MMIVBv-5xvoi0NVTY1pgghe*>!`)?PKehg{!=oXb
zs7q~Ynr!>5SpSydD2Yjr>5@Y;<}!aSXV=;#s&BJV;(}VDK4@zlN}gTP|5m;xr!Y3t
zNV+|WJ@oQW>3cNz;oD4CZp}=y{kB9!O17;x3R#)iw(O>|PXn^E!F3Jsknk|Z(3&H>
zFGB%>M}oVnXWD!+VaWX$rWNKYi8a#C{^|u3hi?e4JYhW7bzcaL?y3;aIqY+9Z0P=?
zeT4StQ2`qL?pxCPpwYZ@t8>gs)nG_-s#K8JX3Vlv9<pA4E~JzA19T5z)i@NAIj`Qg
zaH}=WSRs#jl&5sZXu~xpDXVh0h21#E)iwXnmQJ(OSAQJH1qKCLmON<1V-B~CP<8&}
z#0wq4SZg&R*EMY`THDX_;X;giUDQ8jI;}L3)CSsu?!V5vt7ZNfR<mz6q12pTYW7BM
z;x6^tRxl%aOuE_b>K;bFvYMKqGsac6O<r1KH@@0OX<l7hFw(VswhBSIoa)ESGd{bI
z{#0;$f3|-UE(8722}L}I^CmUA?5USEleU`$y?i-glK%dM0PP0B2=1F=(EVIpNwM^}
zM%5bEO@;F*fp};&TEk~<W4*=5&Y0Xhm5OYaQj?JGP6HOWs6KS}eRpSYFu_cfeTi{~
z2E2aiV{=8SZZiRLX$~~o@t8YVOI3Fc{V3o@_)0Y2ZJdTY*6M;OsRJ$7=b~SCUpPpg
zA!gG~*EGdi(w3J?S8i~Hus?wxb?4^2Y7IJ+yFXehgIjiWT`eZ-ZFYd2+rurL9jD^v
z?)fj_<1TC8wjbjXQ`(R23Wm=!t5rU@%BVcIX)XVv7HWGzxl+4i=Y}GhR!P*Nuj2*1
zh9!H68&UN1G7)#gm-;dnZDO%sjafJwFL&}5o8Dd)IBZK9^vYR#e;@ATq?;hUS)#R;
z>D9^U&LI3)#$p)R4R@A^3S+w0>1=vHFR`vb+ENAg+H3i%Kdj2cy0^=5b7xPmxraDU
zsZ;sR^rMRXPh0o+Rm;|>MFOt6k!TX$@4ZN&;%((-wrR60!lrqHMN!?&XQz`s`M7HZ
zv(Lj?ELZ^=_<_?jajv6|-eN2Z$=26;w7Wu|X|cL=P0%X;UR8$A?6en%$K-i><!pVc
ze2nRhgqx@B5HaSW*TJy@Le|_5d%Hfv%I<|0)W?<@cWh|L-8UmlWyWqc-r;{fgI_UA
zeWYCubFA834PFfpR8D+8Z-@6KXf`W5yk`5;wTj&(hLJIy$9x~tJ2eS!t@SoJ(qI$z
z#PKvE*0zoxN$7SHMX@`kNx5lc%H`@lbdq=~s1^r(jiLACgbIS7KV_JZ;D1`fp1G)Q
znysIy!G1VM1H<X<C}NvqD!uSA>}9t6^r7=I$6{Yot$GfJ+`iJQKvll41)qn)4*x>7
zG+0-w7;7#sobmQ8J^Bl7u$E)9#EHM7FE4}G-eQrkdEvSjvnh#eV&~*qzXw@S+Ukvr
zi(KzecTVnnRzHI1(CYf|ysNmmMEWtJ&t#93ix$srNq#C)(7{}SxM%O_GPl2NHz*WD
zu~f$3V~VADe`ub?ijwK>9m|y>P*JziTeH&IoYL-0rGU-ZbFS|>Xr|7)D(#ROv%>G7
zc8H@H&y692Ugs6(uHI)#JF@<1w|pt+uu#`XFfA?*v93zYz9ZF+a6@PXg=}v5g~uvg
z{XjseK4PBwOjZ?e#{0RGm-p%*=*|~OgR84u&iH=byLsixOl#mJ9d^z8V=L~QVtdS_
zuI79mij55o;xR^zI3g8MrFpL;6k)4lWtx@z9AA>wlZ}!@=6Ablrt78KO%Jxr7f0Rm
zt0q+i6+OEM^E&!Q3hd!DBzkS14av&nZ4$E}>pc-$vpM!-Tj~5IS!+{+-O1vFM@RJq
z4hy-gghO(ZQZjg&*t@wyW5+x8o7-PDV(pmf<5u%3TC+`A2h?>kpCFf3=z#1oH0)0B
z-m$UGOLuPE*tb8rxHvK_u&_VYLM5A_?U-gQAE->I+ncZ&6)>($T~JWaw`FpsXtgmz
zKylKvB&uL~@*2dhzwd2>HRJP*kr6(_ez@hJ`$S-s#EL*a17yW8O=4au{PjH78b)+z
z1eGa|z*6alwE-E>Pt@=Dc(lqLnyy(qNTw$%`v{h)X``#F`z0x0uV3v@f<&FsD-OG3
zd4;cL&!qFh{CpnE*6gp5ZGVRZ(5X;VYMOe-`6Iz{;90&g^`TO_v27vOc%w&U#V%j6
zo<sLX&KX*bviBJy4)z2W5BG)2Ot19zk6?O83}p<+)718SBQ+k8$}?vKnK=8UTUU1G
z67O%XbltDCv(O;tKT|h`=$Oc$aZ(-QFmT>iEgE%Sj|XHv16i-%D+@vd5cVem56L^x
zO+z=yjxqL*(VJl?2_iO-v5KluZJ)YKi}VrNL~TrzM1XgcPv#jn#HgklrpJ-L5^Yp1
zyxS04ibRvbx{=qsu5h&|PH+7}p0V`7a#@o^L`brS^_34jW39RNjk~%KKy**1ej_^G
zT~dxZS{L%aoN$jfITc$);#^V(zg%{8YA)$lgE?cNRo|s<q}(x*JFkW3X*?AENlz@P
z09P?{tEcR1Z%4HsGoPma4PG-x_1?m=u>#|%b}H)>yY}nS?E>sB(X+N{Mx6cLtL9X;
zM!kV8q4Z)33SoNv-3_f{K}=AjUQMoI|HZD^OGnx%*tMhm3Erd9nMMX0J5JeWcb1w5
ziwtH#1N`?aP<ot~Lu6~r?(#j$O(u9b@rF&_YvIOuwX!XtQlaCBeN};dT`zDEL}6La
ze%vvO>WZ;*IcP?COJ_POH~&hJ+rHyFJ&~y+6^?L&L&3RTsR^Zg&3ndgqq8pc*_hm;
zrtULq@{S%+bBuo`!wY?lyQHe|N+HjTX|N0#Z!&c3m#)rb5&+1TIfHJO7w-k=9%M!m
zLsqM4)SF9(1=Edf`Be*mM;698?$+6*@U%dqB*Six)@WSb((PMU=w0__5<4A--DbD0
z!ULF{;Iq7lqw!HZ757xVqxo^9cz~OXa>r9ou-$SwBe^Ui$C#n!XKA|AMB`jLI}P5(
zlw*^_2$XzxvJJk_X->PiNL+~Mmf9Sgk7BCYyoy;(YEP>$UA{9%GJ9y88&baSFt|H@
z@nB*aR~k)KanGlW7eX|d4lT>n+&TPw#v8A71XBX`7ksH`{_&MH3pJZjRparp;Sy!I
z8l3cryNI@q&P)?%vsgBM^mWngB4~bEF6ho_a`@mXvqt8Dd0U-ZKx?levAw~Zg&V?Y
zCxD0MWR?~rFSXFj(d(9Sgc%fa2zUC}hlP77Son}?Y40<g)_on{F_!e@!pMWRuE*Z)
z%~ZHrq&)NGo6hF$5qZnevS5jZeeY~|OB+#K5rP{UFJ!km#8kDr5`L*ust}<D`!ckU
z_^IqwL*r+001rl_s%wD&8{0D{+-ur71|{W55yj5&ccRrwC5hYpD8+B>ruyd^b&;Fz
zt7*76#;Wtfe8xs|bZD0tz5-<uXYN#AB3oibH3%AN&bDg~+piQ$%bNz~+ci886O%58
zs*Od{Y8od_KN5mn&1nn^i@gaw-t|_md6IQDTcmv#8dJr%*EsRC!Mst{e6(sR=pB=_
z;$Cu&7Y(Q|?eFY8dz+u9EI2ciLA7=!Z>gCCdOT#7Gp2M$_<GM43&qlET)5npoqgH@
z;$U!FlG~9-eW{0bOs!!YVo{c+-@2z7J#S?kETMb2kSlGyKl6_1u7%o0_ze@8eUk&)
z43&)R)h#=duZ*lg`bHCqf*^Mf(q|{^Y6=JR$!kJ~_DAlUz5V0BElZmnHyxgBiztfJ
z!d>bQXTAN}sP-+r!zZe}o_GcMB%FpUONVFWHvQ}V>Q%Gv$r|#+c#tD!@0uS{iqXoq
ztag<w3j`6RwihDW<SjP#eS!<uCT>bVl$M`ViSYHnSdF>l8D1Q9=RqaL(_SmHC}I|I
zUTwRwgB&6YPVKbBrZU3x@D7O5J#TWAbXw$Mm_8?afic5vwr4y$OXg)>%e<{u#e3;P
zbLI^}qwFt=$^&Hd`Pa!cTb7;23$)hEU~dKN)h;yM$yDh+V1d3MvXjT$zb`D(x+e%X
zf~9J9=5`?xj#esdK`Y4hwPWJo6v<3iOKx5URRV&`+5K1Hf5k6gnb&a081<%`_1iVY
z!eQ9`OZCennpDqdd<%Kks(`dX6MpNyyO~^I)gBtoyODmB`rOM&wp22cdX#r9FWiTv
zz0@t0ojM1y9#p~7?1&3{XS*aIEh%1H+Uq=lU-oeq<!}hcI1l?tbwcu;dSjesV_=pu
zUsw(MYXU}Dm}=FakEf=lRyvHwYx1b#HEnQ+2Sj?7F-!wMP9St%!)0*Q07z=MY9`WA
zSj6`|zw;h9dvwSL3Tp%DGMAelzlf9zxciy344jHLCCbzl#HMqgS!56E>FYHYT&7v!
zxIi1^G?Q?YY%Vhoi8)lO*;q=`Ec+rKt~s|&b(pwpx}2M7cl42do`qp;s7P_hc3DR~
zx}uw=GMh9jSfymyh%_sU^POX5m%ptIp>~dXz2mcYHCPv49Nw#3aEaibbxb?JDjdtU
zdm77URz7<H@yI)~#%_sUXm@4U96p%-@yu-Quz5k!SD?lBdCw4XX_Q)|s^_SIey5Er
zdNcdYR)bVT&09%vp__WGTugps?89fU@LJ)d<RzuBOo43abxO#MFNYOFUvwwi=%m?~
zl(&dlml^t%=D${{iY$)QI&@!<Su-^6xbO&~WbA@C>%oir;ie!``GyC}(zJgRb8yCO
z9$wpu$z{PApQrEcWeB*rmiMHqd?a}s*U4{ew6ImO^Z?WkY*?PWXn@b>X@LXDb30O3
zF50ajc;6Bt7CPw_7ZiD&_w!kqepi{v>q4mJl;vA#Suw7mb8Jb}O7^4j4YGu#JF_2n
zrU{?IGlel<$$#tLwZMsyc6JL<vu~G|R?qk}f1Cek@Rc3unL7FfCy`~lK1i~{M0xsT
z&aj<mc+**>BVzt-v5Kv}s2q1YMzYMrU1tU&36pGr`@CR$ixG|QrOqn>s)XwD8zl>0
zu`4q>{YeFHnpW}YmspOZ2**s9U#*XGdazo%%u&`_yH<DKG5^`d@?cLc4qj<(lT*x4
z$$gk?wyjH{UBqZEZnu7W*~;DQi}EHK&^g?2s12>5mQgL!uw6myU7by?io>_9E6kQS
z5KbukDlvEYj3Qws>1{JJH)si|txRVm&;6}h3!HCDpcn``^7Ou5Nm1r>f}O2$zHY=$
zQ&xCK`1Rg*(Br_cSn9GeGjq7wtNb)ya>G4|*NJ$f_6Q2d%5L5RA?bkv>onhM&#ISw
zOlfk~44Luxzfx1cmj+(|8sE7W&vZhRfe^tlAxKuGAIh_5M?7ofb$vP##hMXg=<Uap
z3o}#M3!C**EA@U4>I~YXdT)laL{rIUURl%4%*E5KQQoOAT4azWd7kdpd$G<)_*G&O
z7_YLqeR($ucYzS1QDPS(8Nu2)6b_5}dIML!UB0*3HRrvvY*8;SiU<#qS?iMxgN<X%
z*qg3rJ6(u%BGI4-5IqkO-27}axVdLWlgVpdtCothHnY7YHGX{4Rm2F(L(s+aLr<<5
z@@%tE4ro6i)ZE2<BIc-d$5Rv+g6HZKf3I@?mX{$f9*x==QKz#WaZ!BgJ)C2`33m4C
z6%PKbw$>w<`$=Wt+%Ve7=0q0dTJbq%5NgcCW@dKPs~pu!qLF+bz~N#BA5<jIv#p5A
zH4-UNwBb7ILF$#RQiU9{b2Dx&?GrLN!deS;tEp5Lv;z`SC=0uE$#!2Q-yR1tyc+av
z`>^q@;fO`J@D1ctt6kpG(OkDZtOF%W>#S4W#<~iR*?DX37?mqOYg8RBWxB;_Y8A6G
zR?}bU^$K>KZmSPgrEEX3o_0s&iB=f3{gv9gPe_eu{7CZ5O*l21Ao*2CkJPJ;*8~jv
zcPx#0{hu2QU+iMLJ5#EFr|O=p2q{k<Rk>mR#BM|nWMPI=RO9aVvHIQM6N(%kliZ3u
zu<6#XQsf|j^evl1?O}{6o0Tr51^eTo!&zyPH&}oPv61@`KbkbRa~%K4H>wj*1~Fb{
zOqUFr%)mt*ejc%`tM;N9`wmc>vg3oY?Nz~nq1OsETsO|t!N^`Pkq+~xS0tHIEVtWp
zR4G3eJW6h5FK~SqJ{04CXbpyS^fEyBp10sQuGPzAo0=mQOykbfuA1GEF)9U}LeD4*
zg6Pt0P-IXxH_Xg6HUwH`R^-yRpV_K+__<)!;rK8blFv4dB@r9S!@eR6ce@#G!TO(M
zk);?Y$d(R`wjZlFd%28Uy8LV)XmKpaHpP9g8MVfAXDRA%udH@>Hqvyow!ZRAK96C;
z6t`@df>isK{7sv^SXZm<f%Dv!n;{<>O!(Kl$=xr>-%#*Yfb3^XPS0eSyXU*)%6}<_
zS^V@0`^dS^dLX|$I1U>ZbIZoN<d*s}U{?OEV=luWJF{GhY)-$~@KLl0vaU1AE0$)5
zw_q2*dv(Rx7DmBtEN4ILR)5wu#ch<QZz~s?6T0J`)&C}=-=~5{A=^zcwNqIO?$CW?
zF7`lsgPGJHP0Rdkjemb;jB{(4Sjl$peDm|ot*~(>q-ssBbdA0_Fqy*yhp$#5hbts_
z_zqv%y5!n<G4tHy<y9>;JCeCb&d)3oKo;D#VzOLP0mfbE4yyJEI)kJmr)!X!(*`D0
zt|$Fa=9KBTN#-lVQ=a}-n>~iDi(vXj-0HaMP_an@cSlUsuILe&YffBy#BQ~kTXRF7
zV3zHZ<)=33iaqK!p1aUdq}lk*7-yn24wzZ4nfVxgEWUrIW<zL11QkD7_ZaC+;sut#
z=U(c_AljEB((2yJTm7Q1eNQ#!f}k}yB@W@l%TgVUG9eEQveG%@2uZ!L_?Y*`tizie
zGW}ER;`pt$%V+(x9S;urjQ3!I6w896y6~cJXX=Pz-E-9}G=!@v$hn=`RNg6&k2r1l
zZH~M#P&>o`s(0z5I+^1az421seqdG?zGC}Mp(aPvLVBey`mO}55#?Nl=L~|Tniu7O
z3|<y=&dYDivBe?h6caddDVn|Agv)k}Zf9wkjNw7PdK7eAU>nfQ7&UJ7O46<Gz@8j9
zn9mOVmC`dFfD1zQ*G*3r%RObr_eV?aHHR`7_tnnZ&7u_Le3O5W)oe>8Kj#&i&mSaZ
z^HMkL#d-?Au|Z5oK5yHRhPAnhbr=uStrkKNgVgUdG@mQpW6Ds^fmp103hTD6xhpeQ
ztu8U>4P8i5=O{4T;=F6Kz17zVR3^&o<`Y;@Hc!*%M$VDs1rt3c(p<g<A>)e=7;)~5
z5h%&AeXsLTgV4g%t0vYaBs`o(YRyQ8e`kX%CS|&Quc}%OHWP1WL(9`wvlA&ttJ!gA
zFpQs9g`TQI<6q@`rG|dBXOXSz7;&+$TTl&NnSRS`ueRZ1gA{po&`a5r89&bPtMcUv
z-b=`O_B`WN$)K1}CiB{@T1K~NDPxb}m~hbjOQx@mRcM*{-biVyPT#2i4mKp*h6NR(
zAzR)25L(X)$^NuUZ=-3$=x$rulcg>Z+*!bcUbnh>7cMxy-Jl-<ec_{DFSET!)vsY)
zf{0lf(dH6#w@n3+rc>75F~NFrY`IRqnPalZM!1i0Uph5|X3VsmNPm(@Kx@#fdGnIJ
z;JSnFV>}R0{#s~lHB-Agnxi?O7_44m6Wf!WTf-_0gxnc&cR4bn?yi)*&*Az$D%Q4g
zxoS`4m_~Mi&1Q1Md&Yj}Ajs@u4UleUJ%p77$$2d!UG|$FUm!-C_{2M(W_y_`L9Uti
z{Vye$rV8tbVhN|K=jDdGbaT3kj=z6*&%7N^(^<ht5%2h7oxZhia>D>}wQbs66p4J;
zol)F2Wolbp6S;LN75x`={`^<g=2iwoqsv#G-K3;7xBaIAhc;fxDJiW8IF`6c#z9P(
zn75rNe1XX#{6|>K6Nv{GY7;`4-H%kinN^SZ+kVT=u$nw*;H6HFq2SqFS(9grMAM35
zRUhA{kKlP8(#ionUgCAs?{Qe3U(0onrypLi+URD1ijAjvJF}-I2KV|C2R9OGl3YYZ
zk3S(--M;dSyYW|vA9=4@b0dFQ?1u*^LoMYkVYd4&4J7+|0dCb*kP))OB;NWYCqWJ(
zycumS8{ALxoT}y%r28IJsaTinmhR1u+K<uK$Mw}hP2Q!&GM8$gO^~|}-h#)HJ%`zS
z^d*{|y3lFOjWevcQ)1ZrAl5Chth?e@fOpfn#JB`oW|(Yj<lQQI-M9-f7{|%Zx8y+Y
zf<Ewy8+gTscbBg%p<H(^0ry@N91?bEJDA<r#sgTjph4q3pS`W#m{<gSW4;==@P};X
zxu+Yu2$`dS@Mf6PrvabB$#;3#qgiFK8D()5JV0wF4^PXeKtHc8mZNBTF7-hNOD$hN
zPkUIqdALDbkK37NfVjL4cS5jK$ESmwH(Ras+L2g=y~D=>N+mt3YBlI}Agmi^?tVPj
zRa$lEBDVKhgIyJb$`Z2Uuy`TSsL)sR@}lOrN6g-Vy}MZ4WP|z5Vi+wx+Jv7b@+SOo
z1vUgPc&Ha<FNXK|^99L`AZA;*Q6wZ^(?#v%#SRP^E#&*lK{1yPk&r#xMs9BI%}J5C
zFHu?J-%K802I)ij<i$hjXN`%_s-#`B%JoC1;&tkHu!ZUY#rJl^8DTxKO&`_A+FhLd
z_C`lrdv;TTC2ZiswdDgmn<cs<yc>lGW!HCbcTRPd&=$qOkdUsvxGeJuBG+zpz(J~7
z)hl2w&}uP}n*U<3pXOVq9p!J6<!9E%Rm;T61R8i-cVUC_9mY!IN!*$0WJYp%M*RIz
zUsFU#xuRzbKaQynm*(AB{#H?Av$mh#Dxr|0PV-E^t;h|rSj9kDVY8ufKmySywn=Hz
z+<aZ)T2i!@ex9XeJ_=fLyt0U>Ns(&38iwRI?Q?P5f_)lo=<O&EuycH<GO%*xc*^>A
za<gqeSNkLQ<^woE(!vv7%(B{}i`;wBhqAdQ%1@sQ+orRq4xCj7G7Jd<YmVDKQy#0?
zbkj_{T;)6_$k=Pou_izWj}AD5B^T|-Bv`(r_%V0gsGU{=qiJsVcaEz&?|#XD-%!Oq
z%-qG#v>IfGS1|?~9)*&8Jm!mzgMPG0{H>e8$ax19nd9#vWM_{O?ve}ZZyyy=F*8dS
zT_Aj2GI~%ZofFwL<*zTB<it)F9C?eCmAcgyXlX-N=kP=8a)2@El0Dmn=VcexRrA_|
zRoJ8L(Jt!N42}+uG)g&%3G6#~HE85CgVe%GpG+PkAGU@w(mSs{n&i}HvIFegjn|oO
zWXF(o4Ifs6sv`r+iMS&Y$m%_<*T={6(rK1smfd=HZ66w>#hLFP;yHeL1lgbN_m=R>
z^hDNZ)zaO+n_Q|{`sWyow|`uaZ`)TSRyk-gkC-!ZM0)K+w)>K>OJ48En>Qz_)YRmm
zyPqk~nC4vd@x>D$!c4!3VS0o!MK5+=LAiM-$4uks#k@$est9Z}PE)huv3|Rz3AZ93
zv#Q&#`lQd6o^hFOFN3{p1IAU;sEp<{c=m|Pw5>ops~UP;S*ZyFaYRHIcUZA;?x9O#
z^`pX-oGAzrxC<p$*L&xI^Gs_0N&x{<T=|E2>ZPKYa&#j;!*(?4gj23dJ{ouJrX>2T
zIdhyP2nYzG`#N@s2$tL&O~-7i)O}4^@|jkFBWM>r{nO|FR^4<%lhxoQB!7BeV#rVz
zRv9q!%CIQg`oa%!6kc7cCV(hj59jl5nmMnN^16{F#pSSxxsK@7))r^oy?X(_Dz1MP
zXm}{1$DZ|&PwMoIq|kJe-%oL|P3JVt7)t1SeuTNZoLehPEy$_H#<;Stw_$+`VesPY
zucqnN?<}(_&&)cDicuitOSlz9e%TlT0wAVU=pbzglY>hFLU3}9a(WlVgCYh$`Oe6k
zF|>&%y`5g95a|$M0(0rDrSTA<=oNEF`BAs^OqFICH!duU<a)C&>u9taVuMIk_iH&-
z<g>wi?GU*PB@X=VVq-SNAgb1xV@z~&9xyG(@9O+X)9L0FE=zhT>68?23yeb>*W=IU
z9kst|wKtyKc9zVoSQ2;T=_&{<q)SQBu8<>D#nE^M#8G&z5>pY;6(Zp|D4+6mb(`A$
z;DcT7INgb_tbNPHZ)+Zr53O!z5<*Iu<T8yFm||#*I5l#TkQ47wX<rpVD;&uD++4F%
z`>>LrBJY>XiL_?9a*0=*BIOt!M*{3>ZihRZtv&RLxwPg?v022??VX+B{`^PpD&u+*
z2qAl%knEun_$yEB-K(#HQIT9_5J0y*-=i|xJ9lY$zI2}Bd!WD}e$Fa`G`6>cWXWM4
zq0oh7g{f!DMDtPE3l207y#^|d&7gax<7h~An2F8?J{*S>%|mo5b+Q8slZI2#%uJ)&
zI(vwJrlf*J>_MXIfJzNn-ZD@&Yeeim78fDj!&{sTyb_grU2Z!w2lE^u@9T@>K8_ue
z5M^7}9~_V{-ab58RSxR<FQX#SpqNCea*xUFS!5<jt}@R!-9S|A`<rDY^lnK5KYe?4
z@1no$&FzbjEL`fI$Cqo##(KUL-7T6~_2yAE4$kZ(d^ayTs=^MdL<JRkXM4_)78JZP
zzgNWH)zv+-+t<MU1;jMpZ`_70-v{mn>G)D=W3o}x*bS730s996W(8vL*TIL7pl4%@
zszMz*oRAUw&kqK-VR6zr#zXt)5o}}Jcc8ygIUTdVQaNqirQdGQu?(iZb=wh!46uMQ
zof8$=f6-V_^9%dO@R3wsgfC>o*O`>DrJFumD)JvKhDMC#SYuV}ghjy@xbK83(8tm1
z1xa9~Za~VGq$ayYpST@Ovn;Y}z1g`ZzwfGpkQ9>=v#Z?xI(d6@WF|btEJo#SdS{Z|
zt1o%A@cTVkAK&`hhcSg@%G2|fBxt1VigvmcBI|Cp8mOT3vl~;VzvD+ISZKKVEfyIv
zngUi<J6H}<H_11Gt9{h~h^L(d)B7@T$0y?=vmc#RdHkd>U3#-%ebq+^dRV^in7R5_
zqb<%uc(1-7ugpuqS=mbOb|LLF9!@R6aj32ub#%h;AYxShf9$<wSQOkAFghS8f*^{D
zij<U+0@5uC64D_#C<xNsZPDE=B@L284~o(u-6b(}_YijvzVA7Lp6`CY?{ok7j4<q2
zU3)ERoQPbrdAMnN?s|jp&cNaDHk(ZesU!)Hq)DX^k`R~nTeeNUqUb`!N+|g`<m=IG
zklB}vkKrBJkJ1D)Gqi>n0~+I<kvYb2Uj1x!%js#GNtqp&w9#{mZLE(#Kzqfr*My?v
z%VCn&drJssY&^UPxzP%3ro++fse~an=gB$L^A2}vM_9?OC3pa_bxm{g?3-sdIuz+;
z`U$oB2boqMHx3SePKyt8TrO|T-7D0ev#76H$`&9xiTNol?N@6vNCyDHAD5G&nm}Xw
z9%gM-4{I$O3?-A<(q&82)Zlp<AxdHq9lw-YIWMeOuehZ?By7By$bN8-yL#8m?^}I6
zSMhZ2400p@-rz=_oZXk<cSkddzvDi=3y4485}1Bfw)UYeY2K^EBc4sI9(Fn0O4>oL
z_Ojw3Z$H|&oQ3Mu7E!*vtgAmP4?tAP<;YqEHldfstZ6OgtisY`U;9px)QKWFttyo(
z4ay%$zqZzf=2(SR@GOi<^k7IIG%Fa*dgOSj2td#cqoBZYs-`0Z&0u6lx3Hk#6=Hd$
zz;;D*px7|LXsk?PdqsdOU}ur>nMr9|#zaV(l-L-Ww4n{>Zic&sezK1fsia$Owrp7?
zC3Psa%!0ddZ@!uRLMw-O$U^RRX_tewfe-CqhVXkB5AR^RiE?`uBV1u{v`>x^o*k4z
z84-TY1Ftbp?I<*(a7N8m&}{g{I7rx})Fw+mum6FHcUd$*P+6X%#o7ExmRB>pdrp>X
zSu>ypCQT|KXlBRub4)v^54fMBHcW+J&t{^Ljt?ev9sPOjNRbev0To?Q`qD5Dm3Y{l
zZ%!4eatMx#qdH#hr!viTQD%2q3)`xE&zjc%-i_}*i9;pUZIA{2Y}?Z}K_NOly1gx=
zSu9`2@GLLF!P>C78axl#;1FnNwj>;6%RlHDkjt}Ss7NTIJMYLc_D_VEGcL3EZ5<&L
z%mEY~$O|hs0}&OjrKf7$<Dc^hmU@ln-^p4yPiAEwW;h;f<W=Y6gk@a@hE2Q1ZZy40
zb<<#)1KX&)^yZB%+xul!!3V{lIhT4>uSx8@PBMlYhwDZaFW*nD3N|_D`O?I-o~r}|
z6l2GmK5Rv%j&i7c`~HFTmaW0J$cqKqdM|#AY(Ev33>;vR4wFm$im<=Y)((|EYMnft
zVFn`V4b`|YU&q>#LgrE7e(|0Zd54->NpY`x4_9HDWS}aW_t=k5HqFl3Jv>R(yQYq_
zU;>lV<WT<$X)wB2lm1n6Xvd|(aGfP%$nzza;Y?%Y3JtengHP_69E7dYjV@L6)@AcO
znGLxkj?>Aw3E<VpwtL;QkFHnd#t;de5}d9JLI3&aX-`eeScha&%BOzgnTgz)tkFAt
zB@5a%TQxUqABM1libhOC9EE+E{rV8pwK@Hw{M1xNSNPGgY0p==%M9F`*#ntt!*+UW
zB3BU!LxK*r3-<`2cJ854;zcnrG;9aIj0OJ?Nih~eQ`IZkt`T>TYa9?>{bf~q<1K_#
z?XRk-Y|eB|tFPHq3$NN1NO|HCVnfNss?;jA?aBC9p0QC$pKy^GnX+feX?K_ya~-Fp
z09kW|SgkuP1J+wfu~JzfRhS>4=_Ev}T;OWmiptz0NwfQSU3(>%#LFy>oVyegR0d#j
zc_P;%cy3=v65t!MqE~kq+Ky{A3GZmX0bg!4-_evFv>ZMZq<fk@h$?UhmMbqxA9;(4
zi^_MYqG?$NW2Z4fi+e*7`{R<YL)w_`1&Sj17+g(9X3QN^LxOd-yAe;W6ZqgsdwY=B
zel$;lVIn~VjPpngjkdwSfsOsP7{au<0uXR#iG|@vb<7<;hhc|uhqw`7fyXkox3q-n
zG7JqK4zIabSH7Mkgf<sy``G#_C1fEpT}D)c!$Rne4=P%7SCSS05tH(`$f=erEnf5(
z;SvG!R^ae+9{$0oVy7&wci_bUs8-6s>@T!UxJ1k>Vrd*bW*=kq8jSO<%X)I@OXI}B
z0WKP$#%U`I)rzqu!XasLxmftZR+tjQ^5+HZd0*wJoZ^+CL&>Vt9Pw#yi}~(bdrR%`
zrAGx%Xu!1EcxKZeddCIgG_EY}rJr0(_SPJBpft#j3B-Y7I~+X!tp$kMnP2F2DKZEF
zl<LS`rWQR)Mj&z>-jg?5&II3=ioeA+nsKY1<D0$Qh9c3cbo{(D(Jtz~#uVmuRq4J$
z-K^WiBeMNAlEk3Ykw3sD|EQtsw#&VF#1}kBOp2gf3lFcxSGPEXDVXp!*vjHEbGvn|
zm3U0v#K_5gtB_Sc$^zOhX0iMF#e<RU*H$jXD$HH>$-#n>ysh1WEiaEnButUykj0#v
zh|`IC@@xIJv!zp0)9=kN+B95C)+|+uQc4?MIf}GKv(djuw!GaPQdIPC&!`qrU{bXK
z)9+z>)s)f{8<BR~z{KD|>d(m(B}F8D;lz2BuWl$KD)%3!b;C39Seq}!I41lhOVnc9
zvEzb`y+!{`@RnJF?URk)J?yvT*pRf;wC0+`<mmu-NjT@Hed~q(CC!6nZ{;}j`AoE8
z0-+T&VV!pVoiRJ*?^72kJjDIx6_@t6i|l5vB-M$5LUN6*RGTL^xsINs5$hGV!T0JG
z9xtWH((;eaX-j*5iErs!+p^^2E)H3a^M+Er9;ySGyM_qp^_8oK2eXOmaH2fh0l(;l
z%>kS^m-`cTLan!Z7Hx8VutKu;_jM*CSS${vu5uZzI9tDrQDT_VkBMXUW-J+*o7z^3
zR_(3dUY*e#t}=!54o@>LOj~~9V~T)U<acrQv@z7yOW)Xf56KaJ|5FtA)@zusC6J~)
zcl>q_dJ0^f2gLVQC#Bi?ruWQ~Q~Yb&M&b|RF7<Ft939|>5gneT*pH}sr8NWtTq1$S
zLnTJuw7@}c?{3B5$IMhb;*Cn9y~Dh#6T}O~z)0#*n^NT)?#X~E6Jduw6a=H@^}0Hz
zM{PzH(c7ADw1n<&&G%bh_jD-K&QUWoX>tN_iWIr;*ixj3>FLJW5fWR6kO+s0(Q!2A
zY=ooghO_hZ?I<?a{2{oLL17^I+x@{2VPMtvK-8<amVq7D^szcXwSHEA<l(ig4Xq1q
z*Tuc<10pHwmu{b5$8bGYbG*!Z&)C7BZ=@%;n&3Q)@cQzI>+U=H=W9_;YdPC+wJM%r
zMrR(5%To#r#xbd(DN&2ZRjaA;=rz^p=BJ0b;@@@GPHXerSIP|X|79|4yR$;;`VRbu
zQiL5Rmn5H4rxq#DM$9*dUNUcWf9o-Q<p2E%gXx7Wtp!IN8F;)@M8@Z(mc6`k`bACa
zz0}S^3CFUcjwg&23h&$VnIuC{fvLGWiYZIIYcH6;N9uI%5;7!Y#Zl-!Gan5TbpG_H
z#wR@Y$MD7H@2@!8u4oO+ZLJA?=fTN_ZhQ!3NUka|upJ0991TgOQ!-qZN%S7ci5_Fr
z;3*1w_YNa%jpxSY`hYw1ttJLP8Q{$ueXiwVb(J!AB3+Swm~uG=*As@6Cl6-}+h2V#
zY>xG=&XiT8Umji-lEoY>E#+)=>6Rijs1HcmP_9zig;(*Ftn}*-q$bYVX@9w-FO!$6
z%UbeXy_niCye;Be%43)YEgaOyzRu0T=DJMWEzP~{@bxx-ANJRy3TF?iWsORlntw_z
zMz%GqzS;^L-L<^I7?d*<YpYbc_!H+9NHyqeZpc45OnO2bH^fI)Rbgvk;My>IF-emu
z9k0F*k&$3;$;4gVX);$i*SQ+I&xlB|nMc(Of@hy-jcrZ&i*KAK_7II!gitaXsn}5e
zD(^n?(M>Unx$ob3=<P1O3M2r0V4c#~*ceowaFa4hWkAXRw_Tr1TjUa(=O?{dtQ|z2
zUf~q|*%0^}ig81}HIU3&tj5SyWRiQ)$%O;$8unA}SzIn#VAprvAzl}(*X(UHu`^Aj
zq#A&4AB`tcbbb=Pyuc*^jWWrY3%5$YJ<@$^V{!Ce+SmN%8*Q7|z4`w9CcCT_L&qjo
zLmvj+pD#UDw@Ozn&&=Q<0oB`zPdTWlRN@m@gbV93Mt}AeHd91Tj3wnS@tFOPqbPRn
ziqLlMh>2dwgCFZ(L^Cw*PBhpA8JefvjFtW|@2~lZ21Fansu?IxsNmcf>M19!hKHr&
zN_gX$&VTxnn;;#{FFNY7BHS#avGj9sduDU}-D9r1Ycs5xnyD*uAVkyinuKWE+iCAm
zzy;T+)>~FC_2u}OQnVp0oyyO>m22wHyg>xCx%K;L8{7=Dlciv);Uc211H<-OTUCyo
zp<g8|_w&t(X4xuL#ajZp?{ot@BepjyMGi$>yf3&v;zM3aE9qvua12syQVD!?%*@Pk
ziB9$z8d)Dgnbhhg^>uV~o0j>II%Dp_pmyqsz6?A!g_6e6scOlK7OPTk1x;2+#9ATy
zxlo(w^D%^@L{*aUO7&rZ<&LIAAWNB*eujF+o9-NWwU^oljtn8v1ed-($y}{4>?3J5
znasG~m~`ZldF)fPcjH>*H1I*gH4-g1)~90kty6Wk=C2ZH!_}-mHumIJi2C0N3rTB#
zI?$~k(O<6QH}Ag8KEA}WT(tJ9`gG52hbSG-cmJR`ZbcdDN>>O~Nf-N3D5_kxS4V{Y
zogmQ0{^<O>Fp<;N7U-29DQIF6zc}P7XtOjz<8|?(#WL5H#HEk(T=>Nj3qi^CR6I0l
za`JL1FEO=y6P<E6Dh6|u-sc^URLggpH0)vSfy&n>8EO@un*ErHT6)Tfxf~=dHY^xS
zTjbfyT=5hU2YL(aT$b$5f<vyR%B6~<mZxNA?=>!T=rbxTESR44B1nn_<<*q5o{KA2
zGPXAC#6li#kh|I+lxqe+R+(Ivg8dJn+xB+?hWivg@Vg|m_c>a=2+xR~68GkacpWbR
z8k0P_{hu1wljPAGn!pGsnIqnf^F)4DQ!_J7{TD-C)wjj*<1UnS)TUPZ5c4}5$khAH
zE9B9e=Lg-|><;q!1R6egV{|jo;*oHxzmyr+X0!I5S&;56A0DB&Gm8RjF%geTlF>+s
zMu_D^<*nezaTi-7iX6;#C`HbB?X#g6h`S6nsLS-QklZAGfj;9Tc74pHJ}u%M2^cvU
zK9J{3Ss39mwe|US98^@(J~1LxY)#<avKT_|nSqDp&KEmdW8fOld^_D0)$I!g-W@J-
z6|S=LL}8u|Tf4)UKGPK|uB&!N)&_mSxp6!V_PFh9yU|+lk<V#04HPo)TNqCo+C3<8
z8+`Waz=x^XBf%)taivUte|vGhh_2xSQ+4nQZ5maC`ACm)QxTyEk%MOZr8Zz-ve^_@
zw2i+=ewb!nZ`_(<>0uKu+3^6edcf8q_u$X2qz~Lcqn&f~kFH%JZ>)s=q-51$1qB4z
z)DI9_0k3+4w@BKl`X|PC#eyZ}p9Rz_cY2)+g}-u2(t!fLG@!M2Gm6HoXJ1LXnjR|m
zI`0M@tS^`{=4HzyRu)yKy?=;=%6oaO9S`Mb;&n`R(S=KZ;Nel#a?@lR=N0f=66>7%
z08V&A=k=@{3I=Fy_OP9^Hdo$@bB#?+;ZWCO`Re`NBOfw}nQEOq-r>s>0<Q4=eYL2=
zrbjeCQ@&x`Vtbk1otq)e%=O%`VT0p&=jNHYN}$4G0@dW}j?(>u`sYnfa#yG98mQO1
zR(Mi2K1N9$($G*f^qB@kJZBo~EwipiQ>iovsoZG{U_@ATl(D7O*TNceo-wYKJG*`?
zNDZEfY})I3x21|+Q~sb6>r^QRJ}+7^^5^o~`Zs-v0eshic<9cMw^&`h!eue#843oz
z&G%%9ZyEGZ-M`PPDXa-|nErTl0Upq;eliH@nbyA*@H;!JhdC+0Am!yBYoPf6lyJj`
zcz-`cUYcC2$C=nO1ib@wx7$iwo0bowHYlIiymukv4j4Cb__WAlr;bO=Mdc9?7v4QZ
znIT*CraN67yo;cvpbim3kc@CdP;Y%R^0stMx}XQTK|#FaPv>!yFW%vH5ocj3^kdKV
zye&PKA}5#ga?dlGAOyuaoA~`ekFx03sdG7WZ<*i&mn#LDXVO{leF?nvO%{cHc>NY(
zIv(K;{_&gpvpdRH3DD-tE=QR&fW5;><|h?jY?{_?K0>@eCn|G+T?)WgwiEvheBFIp
z=((&8tX8>wzs7@n1Wjtl)g-eSNz|iTGp4|}IFR$%3OLwUab4d5tsR`}8G$TMdYG=P
z45~%$b8wVt(molFxMz1%4(B-FdyB|}zfnIM&4-`|-CJ!#E>O|&)Uy=F#HiEsWGQ-m
z(`QM;$N3i3MJ0y!!R}hni1R0f2wwRDlMwJImxv1YbPJO&*ZUoTqcSs%3G2Ey$H31h
zWuTmOldAAl^ojBt#acbs5^1imv_En{d>=Ta5dX#REJL8tC<U|JO?Jc&<&T2mV&xhB
zxqhI;C@iGz6q?+}FUE?s2Wr!_pU<nkH=iN5r*J<+o!eWt<=2!5-s|Ig3mKt1h_!>Q
zQD3@KfBWxS<sb57no<%;d+G7dI(v_CbfRb_azlH1-a<a-#y&jVYZgOUtNlxIa0C>8
zSc;+&R$BTzLq13DU3>7{2?%y6YBu^v`IZdrkLFFqeg1m2-MipwRLo!1o;v4ST0e9D
z2JRLg|4eldyh-J`k9*pu_(H%L7fxO;osaW5{^ufpdK$GcYNMe0H5<yu*3)~SOA^EB
zzxZcQ&?TudHu&)dGn8@qHX*uu|Dm$=6G)`m=^36_mhR4?{t{AnV_$o;Z%KTw7thID
zJj(K*GDanLf*8Rr@ar>sSqW4Or&0XRE+0Jv3l_s}T9%MJd*V#A7fg2R(;%8T=p&4;
zbo+G98fZAsddnjq0Z-H8%CLN~_p4MZxtAF2ff?lEaW(Uo*&Dz>RR%)EJXMut(~g#k
z^PEKPSU1M^vc`U{AAq)3;eTL`%mKrOn3p<A<vm(!r&nr<$yQSbtG(`RGj~qQa>~Xp
zZaW0H#5!VZjclnHI+>uw@>lWXQwR|>!}O2kWYE8*@@47aR|g4(xO-uAp?;rLn29l*
z2qQT+6q$L{O|Axgajw`Oy{CK^{{=d)>mgJo9)3jBiGGSV0kE(hC)BJAZNHY<54K!*
zOnRObFH$ggFYud~YRzE4hYuT)8Nv4z&#^0_*Ptb*zBsE!?Ctjoc2+Mk$Kbr_)5qAl
zrtKZ1sz~=#UEK(y)jNZ1yrPC@ful)a$X1`-OsLkuVnqYCJIV>pB!oJXnj|>Wo;ll}
zXG*Jye_KCgrTSrJs`*oBICl@-6Pinfy&5$-Z6P`vB+OB}hsjK(x?W*c84SAeu}l$;
zR=8+d0g;@i+XX$Su0fT+JFNSzT`;J*qLd+{BqvUD+f3)uMfV?AEzgV8J2e(*<JGxk
z_pJ>Hquo2`(9d53jE77DtUlsTch-m#By+$#8qJqpUoSovwPv1gA#@ns;ZxgUP3RfH
z8vL3+$+4p2hgL~O=G0RI!8CCQ=f}#2r$;SgC<}rZFTPi;r8^5q#mSY`9M!`R$rF+o
zzT~T4Ta+d4Gz3;__%X|fxVs5q*c~~*@p)aVI3}@ALH;C3BY5$k+F05PKO$D`!aWSD
z>rX=|uA1r++%=W4eD;b;g4WT}OB!(%vhC&PbD9XXu_Ie`xy&}-=^&<VS-PDkQhb!b
znW2)J^hM;m89r7OXk`5(4~+tg2`wHznnTzQU8&?mO?WzO`{92EV*pwX@vYDbRm7Y5
zy}}kh+7kN{&q%z{i8Q$IY8K3i_$moTAfRaMpML~bLGz+@ov{gmq_0o!<YK;*q|T5n
zeiQ2L^A_L@)&Ja5f^57B(hhBJ0au^-rt<G!{&x+K|3I%9CQ8Kj47(#n+fPF+FLbZ`
zatwd#Rk~ZBqUFd^->~SS*9g7%1ZE-pc3`qn^jj(e7PI{s<2JW-s}ysdO94aqt5NqQ
zLicf0i(P-#s>ktQ=N-eQjlQZYdcU9hpWUfI2Zxy>tT4gY6p7$Ht@QHCJ}#^&<x?@i
zZ`qZ=p2?pm&hDu{7iBRu6$SRBu2TF(eIFWM-=aqU0{Tziak6yqy#s)p+ZT*5of<~8
zobJViI{qUXU?*5@Z_-~i<)`qnz`(|Jr<Yf34D0?l2o6ol5qDa?eYwsV5>H+)6_0C@
zc77#Cu8c*FnyPU;S;r3Rof6R8uMg+=4lwPGxbw){$5!EaQK<QgzhMa6^rkRqZpqwB
z9xZx>DUGVb>0$K6*qL~SFsgb5_E~CxRVk^{?dpI$!Xm%!NWhQ1TqSBcftq~c)aM^W
zB<hA>YKKk^`}zKPt-Gjhp_DngyKV3B&DI9r(;j4rp#JU{kJ;iB3~RK}G({P|8rJhw
zYXGy89Mba4&5a)j51^?mX*#g~I6j#SX!;&m@#P-++Du{aJr6&Y*g#*3W(7qHDmF^z
zEUAkS58rtIQ;h9Cj;*8fsyS#<FQrBuf7oAmSk1SQ63EoBsg!s40q>TtV37i%n<!NB
z?cP1v`t~v7t9NGsM}{v2y7t!U7vFWwHV<a>!u0sA<DEMu5KX1TlIjhpM7X>GjC^a7
zKJ9D(@ByZnYVhg`jte0KyLYPrc9htKDX6P^iU`6`1O3p(SJgR0jMV|H)M*fjoYw6p
z_<I)vzGSAB-#}`bJ@xd>-sf-PHdE3{kJqV$y4&EGa<o$$RFFICR9dIoaDvTSbPMnB
zSSz)C(mM~EB-;s(j-?E1j<{%%XXPQN131Iq*IMUB-PQ3u!|W}shksn!O|TTzGqx|x
zXVpBWHTX3*EeI}L;R9)9ih)nGAEGGGv})-w&z*ML-q3vn9gw6`#oW0HG#d$k))1eT
zr%JVYX(lv>>yC95@P?32qrxQ`V3wFke0BSslTTzH#QihsOG?ext>5|q(W}KzP3@I^
z0&5G&FiKH5+~Q9dZn(vFE}cImxUg~sH8rbaIYX#V)F<c@4Z=82zgxTlt}?YC-w%59
z4pifM?%pVs4^nOj)7izj)2(4nL<*KIiX5un1PQo=a7kaCjs)8Bu_U{)9R0)?x)<xP
z6KDl)B6jnP9qi-|+8%S6Q)^gQZoC;Q!{ZD04hUJ#Xbf)2g>%2|#6Z7`;Z}x&kL3?(
z9~<ZFIy0acC4=zA0D)2Hvr#xQn$K9>r=p=$DyX$c0`?1+oY1;t;|F2^0BuIxb0_^T
z|0Dh0Fqv`l2}>nBi>RzzwPTQ0SI-WWU|>LH>q&h`u6SyJ+gzzEm23?J#En}<f9cE!
zRuse^qyV>5m=WhKtq?Fe#qMw1_X=9=_iQloj<|E5hD)w@bpf>bTb1|*Im22wvH2M8
ztW+HBk;mjDq(pSD<Rl~puDyYOf%D8V-v%OIw3e1tlmZ+0yFW7@P@iJ{6I9nc2bcCM
zCh@JabhqPTNNq`@60zWg-}BVF5jjak^C^2uyo_vn9;ytgq&6lEPAx!|gb5s>DM^uV
z9i7{gJ-op2NRga-d_OMqX2-H5p1TZc)W8<@57#1`)dRn69=E;Isf!b8&jrnNEp6Xb
z2*z@0{G9UrCQ(lQDOgWDNZm4XDk>P4nZy({@a-pJXgh5=CMl2!2tYxYjFOL4t-!+K
zZDwGoj5ts_R9yFkz+=cagFtxW=YY#4TTe&9I)JjjZT#fsnGP~1Xm<bzN`#&h`555V
z7)!Heq4bhU_$Q@&f(V}x)tG|n`r|`r=C!BU9?G{?9-`OOsS${rZqt5K74&Wu1X=T=
z<6{dd8Ybz!wQz5rkazFwWWS67XWYw=d2W#3kKE185$v?=$9c|O3jhSSg!AyUdO3kd
z9cmIui}ecy7wpIls?kvWi|6X23n@h`4vc;rt)t(k+WYjl5%$g{<lCLPMCee|6-e(E
zdm{5`#Oz~$^kZ<0+D(kMR))ag1NFvsCj6}p@KpU-An;C5jko%rhlG0jMU?K|1gG5H
zwL^z@*y1p2pF_=<7*BdY2@D3iBMXT$>I?PX4%9F#?moUjUE_kq<{0CP=rJv2FN4*+
zf_Ryuuqo@Z4@)}H<tshEJ+1!cHE@SXSHAN38+b68u2&1p_bSA{1b(aKr2FYFS@W+1
zF{1#QMeR>z_DecF_yjmaI~OPU5!p3>RN+LaKL(DHxw*LmVj{9Lzxh8VqdZ1UMoHIn
zp$>411IwA5ZkqYead-fdhX3be6lT;8mKry&qbH&!qhMSA8Xfu{X>fAdOQ^{xH9oaJ
z{*<h!+mdC1MMSsOS?w_vQC6AoUx19&k1~fooL=|8%lV?FYeg=6O~=Q25AGzB-bM4L
zuGT_{p7WY_KKw<ap|+GoO-9L#NNA+c0(MX&(ch-h)S#MdbNp>s9Ex|eB*6}K>VzWi
z1@D2Icsz>xW3V;2!8ugZ`PH8f9-bo7|6t$K04yR~bs$NC_P=3o1CU-u{$Bu`{-lkf
z+L`hPv>1<23g+7UAB8<A(+f2j#huV2@h@BlSWi#^9MgY(T5tXT0Q=7bz$(Z6+h8A*
znRgR4(1E${y(~FCHn>xwOd6^I?|&}(>r+h)xC(A1=Oxtq;<LX5-%U~l#+w3@K#1u7
zhW-D6e8HMEkzfbEGDcr)cNvuN{hr(TFVTSWU|NyU`1cpD|1>&I#9|LvB-vpviWmKV
z!~TDhFN(hYBg(MeJpy;S*L^Zv`^=TG5(Pzc!|(8zcTQu4S5;Mi>nMh=Fh(TwWvKAI
zV@)>vD~tdS6`*)%d!K~|qY{i6`?Fs2<W?^jR~JatULAhQJIC$wsZW#qS#BBcN9P}$
ze=-X=@4TK<>c6!Bz#Q;H0l>T`iWPkjd@5u86It%}u10bi=0~>9xV3Rol@)C+4YL2w
z)&Fl-e10%fVKLjV=GInf@qWFt>aYrJ>22L9z5idraeoce#T~z_w%98_06tsd{z96M
zgKF|zO~ST_;CQpXF&u_>BQ&fu1(6@k{}*U)qd+^E$*PA@1U^~*%~_MBULA-SYrd>@
zbg3abuc{zu*rJvVO+V(3#LPd~c7KiX$d+s&8=@Zp8$Pf-_a_GM-=ov@xzO|MEcaQ@
zAlTC>c3`E7eeC+DM;81>KL1(i8cJ4b{`Q-HSuROtd}@w$y>5t9Tvhc0V`1L&>ewP<
z>xxjZXC0}0w@;hRzv0&m1xpP8%O@zz6aMy_fA4ee`mP?5(O&ORL_>G1WGhY%ZiA~a
zm~=W5@b58De{T!~!tgCDG8sxBY90R!{o;GRbZ;Fyyc^@X+r#8OWLhniTR!y&J~)25
zJHYQt?tsIM5SgDx@3;$uo~lx`{a@Ie5u=;2#(+Z$>Yv3__0*(dP8AjV`yZ%>pfLfA
zJ6^1t!+QJ~=oKtY^}mhPvZMWMHo#-C`Atk(8WyXZXM<~Bx)rCXQQP=;Sps;g8VJ{I
zRLsZoApk^BNm9#&|5EY4pH_v)82E&BtIFkCNHk-D)l~<_Y$FuzDfiaWasCf!38Wnq
zEO>-%!G|6MEC^1E-r&Ctl5x3cG?cHV<ofwbGCN5rf?fZ4UWq8e;_9Ddh!W($l;8)z
z-7-(Pj&WBA<xFSawfqZxSzYblYz<gnl7>h0s}@rCJ)NYxJ=aaq`ZtAs@-sVHptt4k
zw+WN2qnPaIHmmTTsHmZHpI*t17(wD0Xj(SD$DLkQi*e{7`J-dUuakn~&Vq|SClyr{
zBD;z*`M=V#{L!inUr<obJz@q<t}?)7lhd27Dn_Dj3Hw%8H#<z!`ges07PbR~)lWdx
zCPc=KTDYE@RpPJ5U5qt~+HPW5U|U-=@0>fTNVQ1C)-3)%ki-7PgDOk-)bz9=`%OYZ
zI>O$(45(fau&Y0yw9@SK3$s5dNpKcpdr{zC4E$IT7~9jI7IFhWY#Df%JlH(_fao{i
zlU3l6gcR!EioW_vE*KRHzDMpR7>aVcgWv1^$~*kI&k6qj_-BGai{0lS-#K80l93B0
zWhd?50me@%11hQd`BUdlsQk{TXMg*M?lZDRwy~k9<kDTP`?4T^du<S{g9pt2)c~~i
zqj3)ZUyk?-&HX8ietmfi5ERm+KJ5SYLce|Q|KIj3hW<YfWU^Syg5v?kTTmyaGRMnL
zM@J8XU8xyj(`x%qER7>5*(ak+%I-W0bGA&epNf8zYu+OLzj4+t*&`TvQ3j4%h^bu)
zsL9O(jIJ+E1p347ocSLfm|mYVZQ6}&$cd9dhK&&nG#u@v*(;c=ue^UF#gi=_e}HTa
zH9Qy9MOiaI1|62jctJkX*y140oZxX)%_tJf{mJ1o2>9mXRKX<};p6GbsE238`UIum
zA$zQnPd-XR?q7WDco+`(?6Px};f&~eoL;l0zd<$WvvSwUM)G8c-bYGz3qF$Y?h4a$
zr_&!O-n>LBc-Z?9r}i@-7<V$PlXcDTO<2m$FfJC<JsWxyn5+#gh!JeM?w7Keije38
zH6*z&%U0v=P@D|D{fs>o$IGC?vm?IW?)r3)$#t+%!QRD_QvC=1AAL3OA4Ed7)ZQ{+
z)uN0TbZ|W-qHu_rn+a$1=|Bm-=Oy=$jR=Xs3kfPTAr`MFG6t)RbtL^&PC)q@`;O-4
zuZ$S6gOyRC3j-woFZ;Y91Gu;u1p!y&{L2-SwLgjV=6&Z8%3RIEMzj2d%iNlQ6_+rI
zyqprL2Z<efa<7KFf_Pr&p7luuBe4M~b-mZ_N0AaKASItQAkfSy%<rE@rr;FLomuXu
z>(X)gQbo&_(qig+1wjJlx}GQs$QK-43n_4%QpgfC8c@i{w^P05^T7HncLVSFu=m7!
z23QjW`!e)`@NEN+-<c|IjIWwnE6#k2GiGhs<}U<js86VVTyq@GPhpgqPMuMuTaEPL
z{G*#Z#v4Eu?CHZ+s7u}yaoabZkOK~C3qzye8NuRvPY`XuGwW+4ihgQvWCZalnfcBT
zIoWs~K(#Ao83_>dSkh?ou=fih5Ki6|sK}Y2Ncfa!*bPE&KB2}()@Y$$3&brUyYz>h
zg$q^~z5$>tXob4Ex-EK5hy5|@Sx@US<~=e;tnd1$FTT4dBk2Db^A-0QPQ3yE$$mE?
zObo?FCYb4CH?D$$AIB`SGl@{ahu~`dGd+6Czzb>x2TQi!iURuX_nQiqVgUk(2zwa|
ze(Y8a2mpugB4oi4+HppfoH`8<I@bdE-u?U|w(#g4ING~iD-?*{$p93P^P`R9kG?zk
z!EgI&IRTi}K`BH~^n>xp4c&rFL7(8P{&fa-n_mz!L;(YJP6qY+AVzIb&mwi2w%h};
z01hwm#G&L2IpIgQKa&Dro6_qaT^7PU2~bG)y!O#Wtuz}%p4Yc^<xW8ag6;s|-YXGo
zgZkp?Rj``o!uQu_T)`xHa5<}7o<h{)GJt{6a~N)W6(^MX+dqOA0i4SCPz%jo0}I71
zv}K=J2o#^}8{6d&CZhz%=2dX4dt#91c|6{z?SBWzT{!@y$Bc9#s9`<B*fN4P65lSK
zIXTulb+B4Pgc}+P*5p^fY7J5lPD&W*321)%_B$U4=9HPr{W{cJtXVoiG!>|{>gf<W
zaQE>6J)BDvj{$$^wuU0K+$(5WlVe%FXG|rsci^7Fp3;5bi-K5yggx*Ra?e~8e-+R}
zj)zPviaj3#IXd(e6Y&2F4)(4y9^nsVH}rz)_#)I7Po48O0s{2hZTb&AKQ2Tq)<Xli
z)9Q*7d4|B<)BvTKcyXe9KhLM&^Odq}$ur3SvabMzBK>bzh*2yojN)|}&|9qX#aaJ{
zj2qld6j6S{wr=PwJK%)B9SXp_j_{+4;Q`xAR3;6~Ee0UVyb8hlHu3}oL-1`3F|E!;
zDmfV$vSLGpFwwyxEV;aW>q4_VRW65vccDzmA`aH2Q1}N>7JEYD#9+e(PceDaayJ28
z;w687nSN$ZSvtUU1`+XI6u`{J0c=u<2Hb`{D8{FgiX!|`bfy-k9v1g`MOtx$hwA$g
zof$?AD)4eE47|hdgh>p2CK5Pz@<`GX4*;kmzpdpe*xd|JYzyDn(8dWJ+;;W5Ne-@#
zkA;F2s-VN%w&R~E(Lz^2%z^TC`3X`%lo7k(SCkPW={X?aYfSv|Cu;Y<#EnG+7I{&q
zaOoP@^oJr!Xn+<W8m4r&f6*gIbAt@+!ZXv8YlApA8W(q8oC+$d0hsH;88*RxPz~hv
zWZo4D)JQNevKg2$VGuL2WyZl@Gs4K8qJsyg8|&*-)a)W4TOS}Ap8(Y=tJ|P^42CIv
zyC(0{I-Hs{)jbEA+sdi#+vuyk90L!Yt`d?W)^@$66efNB{MPol8Gl{i<5LtFpad^|
z95_z0<w(?-(hos9l(m+(^|A<@AB+_P5|#=`SZmP^ykEpaj=xF+sazR<vA5a0GS!eD
z^8Sl@h?qfNI;~&cYf9XO9-HWA?gR7!$J-GHpQo9`+8eH2zpdnf-KRtk)ii-;<ag)F
zw$5>1A3j|7fa)Oqt1J$>^(6$Rn?5yJD?bc2bvdf~23ZXkfHlpK!k&VN45*aw^6?4V
zAnFcV$Sr?NtDLRX7jb)xE-x><^1!KVxk+Mbc1?bL#kGQxm2RjLfr;o28#1ZZ1bH6e
z&vI5LuQ&1Az-?>ow{D`?ZM*`4sWY}zilUnT;uQ!zE!5S+A0DDezYZnaN=ZPB)Edh2
zPbj4F>M9%Lpk82T8a%zW8t7w-(4dF08yoHH#jH5r<*`|zGj{^b9fCn$$icY6`9tYf
z$lNL_&9vfktH=Z=a#y3n_GxQlwGr~Ih3+Dkc&H4R@XK^RKS9mZh`vwVC11HN_8%`5
zQ)d}<xKj-Ln|MXZc^9I8<$M*2Z^cnfwEUA$A_08y5!tu|gp-Fx^b^x_lYuQ|VpOOM
zccHgn5u<WC!8plgQBgGQf||HrW>|Ki9J%K8nH+`0SapjpWpepWw;I8yA?Q&*tpUdi
z>+WpLC)}g1u&ro#$x^7Tz@WnJ@!W$$QpX)MV#VST^Mh8MPDgaKNAmcxS1LV6=)AGF
zM?Z5cYMp!X_}Y`l7>+{U&l6U7R=pwSnJ-qyxj`06nX<zoR$c7D<k6xNEXl=c*>s$3
z-B+%&JunTE{<*gGf=1*#?kt_ktvNXv1^NXX?;@K~G_C6omE5(hGvr-8aEa-i9k)VV
zdyNCfj#L-;aXCRJ2}XgPYhFG9maq*x2+w3}!9tsGYHqdc(Scr^PD)x67Y!-#dySV*
zPk>Vh%nWugOWG9$U{1jBU&_qEeC^YMF$ic}A~EASl=kwa5InSL)&#~`8*8KFFOtD}
z4#s$|(m->A+u?^De7*b?et{j1ew}p;!|JrsRjbiFS}}1!jD+#_Z|Y++GYu&j*ivhG
zN$uwCGjemoKvij!-KgEt#(N3P@ZfdqorHkfF!-e*m%#0T7&`ut1Q(5^qe5HAZX*JE
zosG~s&gI}mr$8ReW{gAN;4U3Ma_|r#TWcGdk6f8PItFbGn%lSr5bEbdX3n2naR^+o
z<d6aaBzV69&`!@d;$NLft44|g^_EfM(}*%c$^qezJOYXwChG0~>w=z@f)CKfkLjI-
z*^LJ2@jQfct2P($LR^-6Y+pS)64~*pl4s(n&wEm}yN_J&8{A5g8i}*$h#KUx<t=J(
z?lf~y%~W^T79(-a$ZJ>o+)vEDjRyfAo<_&0rP!MIx63=OIO%vjWMeCnrieEiG+%ZZ
z0*|K}zt3Z6gCV3S8s5bJ=$7qq*BOPF8G?^)M%8@Ub!X7DO#t*4oKFw+Ho^_?M8z~0
z2+HpK6F8>6fkh2DXb4V~Q_`Hn+ud$o=y|a<KQ;29PGqMqP2DM+GcI41NI68J`gq#*
zK0RaDe6*@<sj>!Uj6_O)eugll)Y#?ih3$|K|Jy?^vXLaNN(Kw_JQ!|6%RW9nA^c@r
z#LH^%j0Qd%B!LGwy)6m%bI>$-@EcEa_lY&(O9>43rxjn+!F}8tQ0DPpX7=G{19L#@
z*8rynFz}fHDGKQyZf7q1<?ofD@NgmCX_R<$3lVK~lo1>pI%`tCzfxSV7#C3VBQFm*
zlmHp#53HE98ERnm@Sihle(R$dn3;Jy0Ahwjmd9v6a;j9fo|s$KU0NBk-o;}vIj*Xx
zh-?34@vKS!0)a|CL{U0D4LGocTGN|fH1HqcNDu7f-ZwE#!Kj}L0C8g?bQiK%U;F5v
z3NK$;d`Zae#Bn9%^mWCbW}G_Rp2R#F(X8xBM^%WYUe=r`iTOgy&Wl_O2U$|nO9K>Y
z3J_%t_+fD!@su$sL<wpdGZtukq2Z$Fo$eRe7vk-tG7T5F`Ou!ntyWBKzvYh8R?>}L
zEZ+!c157wC-&Bb@#|Dazk4Xy9QG9$8#mDL9f28h%fE7)oVk&~t&AuQ=VACuGmS`eq
z<o$I;tVbw5P9oF{dG>?~^)k9o-Jyi@<;!wnmAIpd&78}_OL#<u0gEg~>GgaPW2)p?
z$C`cQ5Z;|HX(`3UiViw@P4Bw=7ap`#V)~?%m8A+pcKtnWl-1V7jUWuaVz^a|h}`~V
zNudmZr<^9jHFfCo#HB?A;@INisfih47KJRS$~NKOxZ>EAn8!Nrlf{^}N1kq7>gIL`
zU_NNtuELC-i1L6Hf85-WhmRCo2I^^zmj&k+!@Ri)$i4DsSKf5Y@zGBb({EBk%@Y@v
z7np5So}@Y<YmaqWsw;fDZY>-wF08nQUsiINJUUJzaZJCo*jGOp?{TB*UYKGJF?!8q
z-mOXn<-YQvc<1$wBq=<Tit58P*MftPykS?#XV1dD5V1+lC9880sVUiC4-o`-0x};i
z-JWG0O)y+fO({~}9=0yswg%;Re2<1t${@x)+^%3Z#56ZgAE+U`ntK-G*PhgqQq}uz
zALx~mN(3pw56L+MN}ett!hPDpMr<|@eE5zw37*Ex;gCeExI&kzr>EXt4z%>=eHb|8
zT;lv<PjtPTXr)v@!Z#oy)zZ}Fc>0r>2K=B(B)4qkMGg{SS|QsR98${`tB*7`G6-Jl
z(i3ymPIkoQ&@d}m<jUR{<LnrCB!HZtDO<`&tFV@FOo)l2dW)QHbWav(YDgR^b8UX2
z7qPP=tGA>8=P}`t`LMY{BYb`{tm?xOWqy9#&QNv2){~g&C|l(QP&7YVi0q&cZP+!x
z&_u$sgx|^P*b&P^1vj&d5SiC-F&pC@a1nI9)d|mAWHu5Nlb$GB+WunDhjJrTi_S!1
zfX)Xtm#}4;3sH1J)bb}6x<`k-lF~*ymZ>fk-#sB_JMGvEzi9VCwxAk>lbm1EhJ?Gc
z+1^CJ?jujBnwm1xW&W*7<dlXrE)n<h55@vdfBuYJ-x<VR@7WQkkRDr#3SmGbIQUjP
zGgm3&-QHx`Ic{%z8c}<BRC*uuzcAe3Xv!pY4TJaQ+Pcp8S~i9Hv~|y{tr2ET`6vpM
zA7{^SI^+d)X6ap4DKvSTeXtE*?sD&$CWaj8jhweXD&84R$oTwy`S>>VkSUK05SUXD
z0!QIc<>SdCqky2=sT$`Uvtw8Enh(yBQ8$6w)p9_ixE6Rk`dLgWnq9t7Qc5y(`f^Le
zyWLVZCz_V{y!YlkewH+v_b#k3(|+VfH_k>+%-Voe(#5ja_^Lb3*d=H@ELWG)P(vI^
zVm=5VAmApRA4P;W{e+cN(xop9J-O_0?bD*kvxKA7WOe(#x2lD<D;2^HI=WW2F-!c)
zNZ9drWrKxy%K=OlllBpG8@s()=~vq!66n>Y5#(>DKV8&ouHmn88eKSao?3yt-QNx(
zYU7btIM&dRh8L<YJIp+Rmn)9hazO3;kt&yG23Nk)rIb|je^l#f_cLtceBw`1B`vt~
zq}=?~vz*fCm?y9HS>@yp_x-3QqA7q&+t|r;*7Vp%S)r}L`^K+bbjxG*8Mf5;;+5xN
z4)^AVE}&^S^UeLra=CkA7h$>`-m>~8B|Noy?s&;0^HEVAe8)Tjwgm6HH{b}nq8j5!
z>L@ZlPgGu6&jZQ+Sru@Apt_%zKEKYt0{LukFjzs_czh%<yRe{p{SyCPy7{2~H&DW5
zkNx`OB@n)^+ZCJ!17cPtPBs6*_G7ZK6~m3`qFXQr{F`8UTD@z0m(;Tn<NBrPApH=Y
z5k~ZyFT9NtaGF6(o#IE=Ei^1Pw)ll>zMOX(nz|vCaJK@F_$PryBTw_Ri9jvfm^fW<
z?M;R<=A9|!oeKmI6QZ4UdH;yQ08Yw-%a8FX(&eKsS2<<cAd>r}!)1AlNFPh@4}%6S
zq@oUI{BJ?BSQN)}ftEXxhwKmaD2AUM_QGq4(#LF$isayIUu`Ywxq#50seVBBOHdwM
zjYN*i58f{y8TmZq88<cF;b_oWjojnd+eSiDijw4z(fd6E`Wg2vy891PTs2Jt7<(GO
zw9`APc}q0&RmX>fk(Y6)tS>~=e4_lf79hcplAm8Hw|ezbKzlQ7=F~KdKk#QKi*c?&
zEOE(@2)2*-@T8t@O5=CE_*wIW{p$!)*S(yBgCQu%7ws*>ILEDqU;_V}bQ$->2KnZ@
zfAWy1P90eyL)<GYCoF%Rx}4yF0h&sj`2JU8jy>n~C58ZoaAg6NxqNjBOgBBg>gSq!
zcFhM057xbI_1ToOG0`7C4X@m&MsBopE2!{Vs@e|S>_o&u7D=I{*bOu!MexnGw)Mz&
z`#!qwQ(q;$SrRzhgVpPubKD6gM6_5PQ+sVk*h1`9CTexM@#5VzZQ)d@1>CN04{W!f
zBs*DVYcaO%L7SmE0eQz!a3QHE7oYmR{h95+4S!zA50_?XE}EMcys*rtKO84e0plJ?
zmKb@LpO(#*CLf$L>C1G6JomF6K2keMf+DjjGgW)9U2D=4IOv`z6is^u@GZjhd}!cJ
zSXW0#njxvc!!7Xv%YJ_}<gE2MG_5MixwG*~_tg`o=^cYS*c$o~>u1KXHI!2U;tZuU
zfRW5hCaQhFu!Hw=q`zFgw>S!leGPSAUy4bHg^yM_SRv_bdhXW{VS7`y&4pH1IeK@^
zZ5qC({a9ghNDZ9NkjhcM3gR^9wD-U=Ov+Ssn9>om5h;gGc3}NlunNOhRZwYRgX4~}
zob3HcYK<=UZ`t6a+r48hAV5uXJr}(Idn2>PQLir(dK|bw;-nx>2RrKZs>rQW*dDVc
z3{a~)SJTxFIz5pVLema2A*;Tk@qxHczN^O2)hCeYk?^-o#-p^MZS}4ya!{yZg%+m4
zEfkxdPrUE4*aOq~(y7c>eYCFu6VnX1a~yaKS42Wq$sL!LN%9J_KBg$l&^y#oU{$Vo
z#!Xk>4?(}pde!efndqY^=3lzxKc*i3=Wt+y{@7-{1D+u0UfUh%Ha%ob2CBzvKgYG*
zCr_!{^eqer5eLewGbF~&nB$)aA6TFbjNy+>=2cN$u9~{Vtw02tTEXi>&<k9pI%vtV
z1~TML@=6!bjFakpN0m)t&BE)yodZ)<V~(H0G^MIug!i`N4P6RMGaYbvv{d)=D%bq{
zLUFs}E4@a#4P7xO^;qem-d?4s?H}6fN6KU60;KG(iK1-xz9%i?Oksl;W&1ffc@b+I
zE$djUuBGG4cxksTuy~jirMlh0Q{4X*Q300VKX<MfL<x=|&_N+_FKW(Y9`-Z0Rt}DP
zl#%K}RH?za0vgpzY3!ebn*Ix)2UTuCI1SjaiY{3q4Mwh?O$)qIqQ*nlcrLgt5D`(4
zGfKS#=A*NSFu2v&yN}yK?;jDn`1UQmdt@Zj_k(P$jnm7|8e=3xRX!w3<?2t^d5vTh
zL8UK)9fTTlc;%UfQ$NVp`#0~CEZ|T>vbjs0jt&df>l2Erl^9$eBaic33gk@ejq<k<
z3+;RwQa4%4C6uR+`?E}&mU))Q9G5EPWgPKeL!RRn?B?uD0Yzvq$;Y~I{ucLVSJ-6M
zN|;@m{2l-Cgoy384<E9NImLD%c1SR%Oki)%pFt%ElTZQvDH8pfj;1va>o%=G;+hys
z^KYrm!<O~PsYUkTl@E$YJ*lf=AfLrJ{PoZHmybniW-+G-F5hA3YU8Ss_k{@@i<{W(
zUQ9?pVnYZclpD@5Ro|tR$@rSDoM0oDmiEqN13ot8*IsS4Gr~$IPaSV%<Y8V;M+V>N
zffcO71)328M~heF_}9lAE0EsSoI3L=X$~0A;7I4<%KbI*9R$~{Ig7pf^|m+rlw<k?
z4%Ne*H=|IpN);*OjBM!Vvk4)%JP0l5>T=@71T*YdUElH|N3r*gb_8A-3nljEaTo8o
z$sPwMi>^?#_4ngV=CnbXBt|utkIL5t<~|;dq<z~j4|m;&bJ{-)P#qGZAw_JjR*Tcp
zPN!bx50|b!mUU4pltS9=+Pu|Snc!*M&A%WnVjvD1lc9~>I{*VvM8^(4#!<$^M&7Hq
zbc;UCmrqc{MBwo@d{;atfh$6TY;t=zXUL_BsPbSUjRo0AH5gHWQwC$>)gP3UC5KvP
zI4kZH!{6XS#`ZRG)>|s*igNi~c1gsZNm(54E$eB9Qmq&bFj-f*^ce^DQP7ODU2qTv
zj^kxzXD0b&=jTN8fa@Rg1&k`&D;9589u(#a;wWC88<XB1c@-IJ^#iSwho++IzU{#+
zi==cHB`0uC&@p$Agt&Z%gk>VK_SH}&znr`>lP%xIn`_Dn<<gcW72SnBaOGTNK(eU6
z*|9_QQ%zS5cI^c-c1AMM&e;63as^Al4Q0#B!_=w`fdgs&(M95r{fDc6WECHpR^bZS
z#@RS)7RvgdO;=S_NzHNGd%HnJ*J^9GwMnFBm?*uqkb^DJT!eH2FS$6kD^+Y?8*7$3
zf8zOwSWw+<B3fT<&Z`iRvvfFi-y@E;CWKVab)=z)Yu4iOScPl6=;y5rj?o|_^!ZG+
zD5i{n^X4etjw4J~NZ%UWKrdomH16iY!sBj1>;{IM9E<isrpB(NM~T&Si!npO%Lz_p
zmlnI4C$(1yWWp9Y%V1VmFOKs~s$v~#>6bLG+d1!t&n?S;7=qGj@hyGHJ?^bgMP~c7
zSzid@si;2KbF~;C20b@m@TqsnufBBl6)`<wfh-!Bg!8pmDG;f>m(YV+RM%SoOiMeD
z%c>l0(Jt8|r-B@dx(xGNXPNDHnoWz$tL+WkO=zZVww_%9j`#QLq>W2H@jd0v+r766
z4&7WxYVADU@x;^?6-rxr%s6X|3JB-kbbV9bSUb9to*+DrT<$j<d~fV*#p|+ovuvhi
zP2(v02NDd{cJS#W{lgvwG5S=1ETwk<e?!{>8X05r$L+T%cAi4|8!Bpt&mcO9QR^Fe
z0rwT#<)1l1)y-1eN^LyzpYfDNg?LwxzW9*%GP9uc5c`Vq%5!b*=iLsSJr(e`TPsXM
zHm|jJnVq{&){bnqTpvb~?z5#}?=Y6VDo@w4K^hK-CN$+p8}Xs-tU7Opst_imvFRHb
zT)n<%!n360{P8QC$B4Bine@7<;)J4W-i5rXN85w;X?U%DCbXfGX`{2I9I6#h!3YM2
zNsY4O_YuYUGzl&Ru{I4tB$jwU(7xHOmn;+F!L)@D!y-gKJ?q_%<6Pn2$tanhr}rg!
z5KGE|aT}uaWfRA=LcaRgxwsce7$7iy<>v8j#c@;54)0X`tXgzS<+u@-0o=L#u&hhN
zgQ>mh$xCfw6GU!q*JZwb=ezclOrWZ*TldeNCm@PNGzv@?z#XGwQC|+ubIijC$`8;)
zfdP|n+-(Xgy#m2o-kbO*GIohvMt+R!dRVdCSU)AMpWjad6XtJ~k^dB6D_w1<+`bVo
zeaXdaAtNhDHO<yc_B|g$;PB0j8F`^jj+OYXiOs$R67_p4u3I^d(Q03FEOlC_l=ZvV
zfqjihFF{K?b%cm$Y$A2FX*bqd(PXjhe7}55y5hTFCT{W>P3x6ew~J%5=hAtJkSsB!
z!;*60-RE&Hc_tz$cuRl<w)(G^FznbC<k2u%>mjCVka_TVpJ_+G9%W?qieTPT3@kY8
z862bynHkH&l<3jh$SZwb=X-n3<kOqnOszp14U4bLD7nM8pKfXtnw(obI+^mCt#>wv
z;&I%KY$^Ps@u8Jsgz!lAn})m*E;V2WkvQ8E?uAWGAeZkS-)4Cpt)@DS96JtF=GPpU
z7@8=NplJZs5XmY`j0|&Xevn&bz0E>4O%?{f(H=`(d)|0*tyu6}O&D9TMeUpVVuYNv
zP2CIa=}dX)?)|FQZE@>Md9J0$*$1QLh;6q%B2eCq;T994rZbUc>TnYm$kBK(8~EFZ
zNQ8ucoW<MvixZixUmO={hc@RJ7JS$%5+a~Snv={UmkEbQCaerr;C4T3-dYTq54od+
zs;To)7;?by*!Lg`{)Mk?%8~H3Hp;afu=XHd7T9TP3@@6R(kgvZU0>m*&JSCV_kK&_
zNpv=0DM<DjWTqx?A@YD-7Y<v+4oi@v%0O{*bSA$an1{7J_n@Sre)^{Ce#U*T;PBv-
z3&57vxHk9eHHG^<tk6*9rn=T?*_%=1zt;X7;U<f761HioAn9hGL<MIkwnrq8mO^3~
zcg%YpF0~U#b1O;lOlb}1eSN%SD1rrnJ=5)-^eM)lV-!B$Ou(AEv?+wc4(u`oXBd1`
zeJ^!*w;^OOLLqYh@WPB^(Hdxz%5Rp#y*jO?24$Kwjie&-_AX{tc%b&4Xb1}Y5{sYK
zti>UEinH52d$6X#XP7K6wtM$70<%;jY+vsH)f>bm&6i_s-_*~X^fh#}Zxb`1nFs2W
z<2=Aql=bEtQYv!FeCX?(yiQ-D+M_7rz6z)dMW4WCWPRTzm?TGLAd;!KT9}(C>)lMp
zi=JitHo<zAv+U);MdDsCT|tQ&1Ra`^<FKKGVd0I@&oF`BC4GIA88rAd!X#nN{N;vy
z;WGYpJ4NNOVUqR1gMm1Hn1joYYPan8IWHR0zC@(=yn%|c%oJW6On^a^tr9WctOIxT
z`>`yWW|sBQb|_UU#AUuN<0`_+0BWeOA0)Q162jzqq=+00o0JY@y-bQ=F3E$evKE>I
zCZ0n&7G)W}4orE65s+uxuTC#29iQvGl$fF16klu89m4prx<yG4@3r~EGX|?*&0S#T
z))GNX93|7o<lx4RH-N9vZOU`>0NA-vt~HTWE-_)@cMly9?|i>stRW}p{O3t(5aF)=
zR(ZqaCeL5SVZTC6I_A{Uh0PG{ytqV6F~y*z0X5UW$jF;JQhcjF>DH$fObshaetzK@
zdBIb0-i?X>=w8`)KZP^@_t7sSu$4HvGL<M*H4yxvy;BC_F8c1WP#R>3_3lu#wZ*=l
z+S??Urc?Z#lJ<DwnNLz;aciptgMGF`=8la_!;4oOG`M$kcP{3P_Jul<h6BT9<*0yL
zc5gsU@985abq||)jFHLQxWu??PQz%(MqET(V(|u^WxQkei=?kp)r{9ul-%b_B=SIV
zRlq^v=61&djV;#WEPenB_sy)qw(?zGu3^K3wz5~bHc5pRE_-<G1hwagYsa>ia2k$A
zyLy-V4|l?DArhv|W3WxL@NI{-nkrQ~;mRf+xjj%`&ZEJYB81aUoK2ud-jG9PY55mq
zl&mYW&><$KD+rAo-Rn604ie>23<A|!ECPxA$1rj!kcDp@Cz$JAhQM;Hb_3Clm<B~9
z&}+!o%vpbF<siZarhDP*nS%|NTYg81j`br19jP;QVf=1D2`jB<8oK?wPOEuHZqFl!
z$$I}F!?rt2xPH${a3QugLKW>ubM}R($0`IZH~Fo*6Ch?TFM{qkwqDA)3{5*OIlf^)
zI?g-!Ip3lugJ%B#&yaL#%jDy>!ctD2;o`UZs_C%8F4v)DLs#t2*uerEjtktC3CvKM
zvXZThy#RQrw5M^!-CGc)v<)flJx;D|H&+R#3VFk!Aq+J^C1+`_NgXcT&1&LwKQnZI
ziRgB&b$nZVerEpB$&%W<N-3Q101_@R?P|V2s-kK-|NHtp4P9}&GK0&v<Q!W_X~oL>
zZ4Lqmo(_k;&mYwcsFW5P`Uz=ov(Lkh4t<kd7Umv<Xb__AY0mzXu2_I?(Z{sM5YE@!
zCjX?@*U=S=w+eKHgX(MM`^eK$DaFL)-h8V!KD=HPlt4^@%8r2;<umt#NoqTKqt&;C
zcdKPq#(#FfBnhuWa)EBjC&=q~Q*Hc(Z{>&Xkbb-k9>n!<3LW@(yTd%DV|&W#^x7hR
z-GlqU=df;7<(jM;DssddFti<D&zo$lH2!}$d+V^Owy<Axfgojo3Me5cC5<92AqYqa
zNFyl-h@_;%Vl6NbDd`qOx;rIQK#`PgP`Z_F&X{X1-23eB+;g9M|Jn~*7;}twy!m@$
zoTjMVs42CbSJ!c>%+AY7PU@uP$j!;y0w(q3$MMRnhCfFvV(w!i^VxpI+^5HE-Y$w5
zYp1m@y|Jx{?AciuNysvuOA8v!D$xf9tzs{lvP2wJ`de&EuCpc=zz6p0VRM7Bpn{;s
zVdU_R8DCvHDv!)5#D2)>pdziA$VA3vr~1-egtpKr+J3`s-_PcB*OfZeR6RD40KuLb
zGCZ<F^@7RVklA~^??E_;XS7jd?BjJXwJ!A)Oa?@HwB;SF*^mD4X)<Nm6`Rr-*<S|$
zU#@d|{r9iSTZ9+f3D5~qPjiNTBs9<Bj307yubW>g{x5)s@FE0Rjei6IRPh|h`fL%^
z$>fdk^Hn65zQ6yS-7>i_waujB`QApvBxCz?k^K$O(UW&!33fku&~=STH&`>$JI#_l
z*Phs2=c#Ln!WNkIk^@viCqsO5KDN+k&T{bNN5?(IXpeSW9bJ{#LkyPUqBwZ&WC<8I
zx);{Dscdy@-W1sUvm`65BgJvXp%ew>sI$4s7$KWgw&d4%{XEoeMT=hfw~2|qmCAdo
zZj;*|8+wL0+~2uds5smgC@DLRL@bfWs@aFWbBvDJpT7fa=tBt@7q$N@E}GUm3zai=
zjl~dE#IFfVNTJnowvyCn=6e^Mour9CC>HJd#Ck<csjzc@Z)o%U%m|C&{<>e)*_Gdp
z9n|Ar1C~zIxu2zD7Kn3^@u^ZD7iAIEr#UnBX{(g_V?rbdQMu=n$J=s&3&dJ<*)SWq
zKYFmn$ikq%2U5%ZeTPoH0yswE{0YqeGxP^_D7{or+<%BNf!qlNkT~1&8^Enws%`GG
z8RQ7>(Uqzbx?~X&89Q}!*4vqr2tm-$cn@Caj;vAZt5#KwstqQImnaRwC`^egP<NkM
zjMj1OElk7x;{~NpsHDB6h={O2*`Rirag4^=<?icL&^R}!FMWxojN_DDD&xC2uZ-A^
zJvv~f9P@NhIcq%B)EYl>3&h5&t3C;C9>W^tr3D#sn_?(q48ghS#S0gmTpb6f9~goM
z4w|zvrxKf)Ev;wtoW1;q9Lmr$?|U<Qhn<}$=;L?mJ{0aRXgm;E886+c0~z$W88EaV
zXn=csr=<30B?0C4Jws#`G9wG^c=v?s$gmh9TPaqvT`E6vtNkSwk<0B`HrShVsMsmU
z@mhCTj%63+<t^C+#XloN%m1xS1H~mEh4(-lK-9f!BF}eoj>K8h$KI#_eede~NWqC1
z=wM&|NAjvkr{*K6yDt#_Z}c4RtL^j4s*tAk_-eiPrt1=Qd=n2FY!Ud$c-(MwtiQxb
zw|`S$7hBF}_)<pAs60~6*G~mP!<Rw=P2)ALVlGt&bNK^v7ORIR)<lY_#gP%&ZH6m{
zyR0T(zm=E=ZVf~V-&c?4$jsG$b&7&qZ+X#eKEP%2kTRk|e0j0EXVY4}D%U%D=cTm$
zA|G$@&uOKPDrZJb!Zyu;F^BSQZ81W!RWon?uzc(AIyl(nnu{C)bJx}nbZIpYw~O?|
zjt<Wpq&soPyBAHGS)Vp2wY@o?&6y^ar4VoCG3n{P#~0}zc46RQEY5==Y1<n1EzzUG
z%^B{5XDYwqloF5`<2ygK4APJkZRgQF^tE}dkzHoPnE`1^IG(P{oWJ}x4m@cB5x+k&
zwKqGgAQM}EF1gP*SF(6oqZ0za>uOn7hQzrk=}=*Mc8kIBZIdsj=$eKb+Mgt#R=-sz
zy$Q9Z1acq{Z1z9oAkhyLXF=ds#+dWwmlwM^gd4j0hxb3Yvjp7Z+CjF;<QSS~OF7eY
zbEiN3&yA(^EZjPIS?rOeAcHWku{sPnW^)_8!d)G__Y%}RQHxkL?z3}6T>l{R#PBSr
zQ<yDoy7A=e64J(TZ@d7!5;lrzu0HUtIoNQic-*Ex7`YsKLvE9{pa{^M_}i%axHVmi
zi#*6G#qn&&+)ul;SJ_Ro5`XJHKp%xYvXx%iRIL<Coe615OQ31FFbP8hrLRN{W5spV
zJ9_&zx)M;$LS-#IV#F>0F1)$(&S&z&%3)T(9Ma8U&-E1pV!x9h;agnVyWUq7Q%Md}
zuaR5xor68Yi()@qCp(rN-8~v7b_37j4Q-_<)oKRD>$`~Wg>bm;A(tj>DMUE}o!jYg
z#uICL%Kv9Uyf-MWQ8<Wz;Dk0$50zT-_ny>~;(Ax@Vhwiaz#xQvj#n_=D#49YZGc#h
zIg2UD0(O`HhxfwU9<gTxS2XTA3=Hd>qh9DJZAw7=2F|(t=kC~IcN@W#Q$ow=0}q=L
zV)x9Bv`TRQ?g@I}ad#dTgbTS05~zpOZ-sp&58ovqKUnqE=3(f0k1KM~Y1DL3^ysk9
zu3{#$+2fVN!9h*MpJ0}$)^Niot$E^Gjyuz++Gd~^hL#Q$<6IIj2-#?Qmv@(%>OO5{
zSIL;i&kFm=S|ov9wX%NT9bio+rwj&kRzWcs@*OVV(0rHQ?jWFE?Oft*_}RaUoC(Oq
z?P1f-$vxpbB5f9jig=Woa<W(eP?fvpzy|tU#Z2O<$dT&`=YCBHw`5dQNH>nz`CU_R
zIz2xmYY@lV^??>=99<gn-?|u3-<O1CUApcXzw|M;Ly7kg;8u^Sf3e|Qy$T)`{!)3*
z5uS_$3aQ<y5wjxfZm`+{xVRZBJ?d!hNi>gpP3fhsHnDq3w;rQ{TK}*h^v3$Hfv_rh
zBn>x!ZM;wHZnoI|ZsgcxNQH~#k}wG(!E?fD$GSCQ%s5dgTO(~@w{m$K06G8ytrS<q
zsV`fusO}<Q2hR$`jIEW8OrBvYt37NPqfb+;ZJ4k$6tAc=sZKcf9jf=V@5F;xX#sr}
zk+Y+vU-k!muJ!oz#R(ZS2GMrC*SECH`dI$U#D&mt8h_?n{_P>h$7??`S4_WGpS3g`
zbKmBvKz(P-NY4!pO>JElB;N+nqkQe~yUWO1e|Cpf$Nlmi8>+F~Zm-(En&365QG0l$
zjN4O2N!&4;rs}BX@<Euo`uB3VzQ=|NARTS$GJI9^2JfxGgQBOQanIt-NpGG5qb+@#
zXU4eMQTsZv?E&Z8LQG`bbES|M!6naYiBivBvZ(6b8gVj@pYM7Qzb^ue)@A4B>DCaO
zYI_mnC=!_ns=Erb#=`Iw47*-Yi7!i3O#7<|pIRDe>znI*561RKMmE2XRPJf4-uSgP
znUCB&^-ZR|5kgokU9Mm6Jeqpx=B#Y^KQ-3#e>B#{2cWTLYzdM*v%ZKwbDWpV+dqqA
z6wm*{2KJd=zd##sBZ8yYO)wQI^hV@3MHk+NZ>`$agzkGwHr>4!4tXFyFQ@}0pP8`v
zUVp>fNq(-oNI7&kTk$EMKr_I!wQLN^?><>rD6wAVKzQ_woc+!+c9dSChBJ;jJ)jhF
z{`@W6kkPcS25!Hu+jlHi$tT3conZ++c^;v8z8{%JJGuYiY$&if5zJae*}F?;D`o~F
z9|1g`zgB8%RLTs3LMQfWQN7=z1x8YlOF#*QkOYcKy3IUNi0jHgj({j%tlWN|sIc#M
z{3E;C8r89mYguc3&AcnQZ>J3NI+t~CImE~kLiIL*(e}@$vn0#r@eHT(xK_M3zrB~5
z{9&Qx9w)p&o2<SS|7`s6rLw-|BqeR<`ug${1y9=M@g_?bDvOlEL(d4;nH-q6#xcw%
zkCZ9|r1j=)7F49@)a+T84Dao$E~)pIItLRY+$lLU(0VVEhE@V%)XKq2=@+b=sGRo{
zF2y_4U%Bx}LR{{(U+C#rKT`l_HWdbmZ9MMN=_svANB|;FA}>GnIxE%nlzS7AY;)9z
z%=g5PVj+gb0|!WtEnaT7;`{AW{75%<56&=vuReSh<iP!7cL<nF`vKptl_$1XeSK*U
zuS&Woz4rt~^y;^l{{yH?(C-5rAOj!(DV{?;%2beD`*Nh5G%nM@ek6qu6htjUHDI8a
ziVac+cT87Ly}^W7XgT~Ab&2J`et_)}jCpeR4VP`K50rXpkd`24%MPB!<D*wV9fa#{
z{1j~}|H`W0RNV-$X<9!e$tgCSkmciCa>{Z)#EAJ3!|_48`xOJcz<79GzNbO&0^&(p
z8?7{kT92>2UC(tNJQ%*+vH5UdxluipBrk!3ZMNT8-~EW8@K@|gvG^Ww=jd+zxgef7
zjkI`1a~ik&uXbBvW$GY;GH_A*z3tJsW9}q~zdf;X$gVZErXq2W-U#j_tKg%u;k&1!
z(e{ftN1IU&;98!%HOlT;`|x=zqe%{D2zp1;?DTx`<BgBc41wrr7*3?M+Y?Mx=YeX3
zJ6z&Z+vpt03NJ96z-{=yL8rtcs2a{G)l(T+fAP2$U}2}_e(ln(``caXKCy0F<eo}x
z&q{)|+Z2iru~5dc4v&VB=*M4o!y(+ea|xS~Bq8cAKxcbr^HOq!2xxf@Oet-)E?ohD
z*oZaIt9k4kArraLKi(${L@K@o(xJasNwrpdsR()UXcXi$CLbkRT0aLbD4>^YEqk3R
zE;~I~iS`Lv8<27RcsMt6IUys|Y^-v|IVdk9|Mv^s8P_<r;eo^_N-m0(cfo|*_k6B<
zYk8Bed=feiZ#lP*Ol~%F&2~uN)31)ZX`OljIO+-2g665GfZf?E629lO`y~iAg)Ygv
zK_^@cp8A5?CZ99by1Kfiqaia>;K|v=LOQ3yeBpcVmtwHxHI=kORiB#aJlTp8^g8D%
zJ)Fwt`@|<d3%NX@%b5Ao>TVOc?aXr12aM)Fd4>`1<51vG^T%dxP-QTQMs}b6Nr=dr
zncBq<a*b0O8JGlcF>9GV|EDiyIo9bo<3XAS^r0*I9S>*!0H2o6Jn-yy_WoGlm9c+C
z{#Q-jQ37TAGrf>Bl%j;w$97RhCxI`5%Eeri?f?5lU3`!J2#OnML|rRWE3HO3E_JXA
z7)>!pDr^d`+*qpdNi|?~KQr{hTpZ+&AXE%;OX=CV2M<+IYsmS5wD0py3scJ=(}PO(
zPGdvQFYL}o8k#OAnTtvmV2ho;e{hwPP7%2?M|;cQ&v<-DbVO!}#_evA!?n1*_RQA@
z0B)pxwQ+{1)~THaa#N(^Z!RJ;HuN0#@7sSf&^^&KY7L4gC%q^QgDJH<l9Am5{UsZx
zR~OycCqeFO!_~NuIPG%LQSFqsN#NTT+k!#w18X;BTIE_7nyAy{W#)Ukf`$Y%Z#Vm{
zEq65v9&|jPn(tCtomIxq8rypkeyez$oHKi=y7bG|07%w)#HC9(m`4)h)B>Zd12S;5
z?+BcNgimjRh~RsaLT+beIqLgVVf*WcIO1s#+}-k+(%W+)cPLpoD9&cD;#V%gWD%Wb
z=b)(j!l?nzy56q1>e?Xh)7M=1$jH$K>(lP5z`7&()zTCaoazNHReinYYe}iJ?EKW=
z^qJaKVa|QzuiJagAm2q&Op>tFBUXFR&<AA!cRUQbc~PVHeVT)hMioGsKx}UtX<ZY?
zKcTr)1X3Xk)eeOxV#XkoxA)F){yKqSyNg8p$sbXmeev<I_kSQJi5H-&NVQfYhz1G^
z4#D#hnDV>?7N#54>)($+%Xo|Db?iXAO2XL<+{ETbv)E}xv4ntWXzo36Vw-J89WmfD
zrG!Mpae&N2mj!)Em20Na;&h?Cg@tu6PPLnyRrZ$|PPP~6pX)SAO3tnLJNS5<s1_Ds
z(vFX+GE?&k)6i6SARi(URc>uS_q4u#o9_j&3`nZqy{8{P^g-54CT%O@_tK!Z<b9U*
zOuiIm7P<BoMF2RJ3DVT`E%z~cTP64AN)BxV1T2p~Rg!rnQXYSiZp9^t?N07KKY66Q
zzSQ%*N7J7URvFnjTUW#uJ5)rg=G|q4SZ&F3HQOI(U9tR7F-b{Lk)U5PW5L=463$<d
z51bei^i9(|%|Mmgi1U2%{9Oakua?oO{a@k3W03&9zx5uA4+MLnJVQVbESs^%4`nLm
zGhbptfcHx$T;PHN()&;da8=miB-S^b#C7JTk9FDuDlyhcv;|DXyvhwmI;>9nL(O@x
zCxZd)&=QHj-kl)lm2sahYwRa5^Fl}Cw;0s+K-R9mMfth|Twom!c|oPmO+LYY{DK}7
z>f(L8HY$%J^k(~109qQa#XzF;8-M<(<GK;7zQ(Hrag1df0r0YfwgPk*j2Ll>`fN8K
zKH%?EYl5o2fjOO(k;tP&Bx18Qbtq7%e5iXVg9-l;!_rBI+jVicX5c((aEH*p_fHBn
zoz;Ex?~K{ax$o@lN^fNF&-yF8EiITOt*#~Zk)Th{Y2Sbke;ZUqpNZkh6i}52WD|eR
zU_^vdMERDpfQaM2lbgJ3fawBH^u7mYK$`RtUX-g_+|b2@1_A5pHz?uLR+4or;3FPm
zkN(>b6pJ5e$~=+77Pj-Gp$AC5O{<&t{(I{X{qdMV`3Mj9hvHOE%dmK(%Y;!{f7fr_
zJH-oEwNVoTDKU}~j({6qBsxH!&hu2i`2fg?>#N<LekTR^lcsWO`F{M_=U|w^4s;v*
z34*-;&2rG&f$W!8?4_S)=F4RI@u$(~ihpkVpK|(W=(hPyOe(Oq4NCNd7{zR$)fCx{
zHgO9ren$U~$v-$y*D1m;75okQCD;I#ha}JPDPXY7{2FN0-bmw@@T#+*j$TJx!42}K
zS{R{KqqC#g|99?0;C_Nixitg#AU<&*0a=(VtwSF~eno<b8Kx7?h!<jgtHwrqn0W~0
zK*jJ~k70;ZQJQs&_>a0i^Zt(kJ-DPGnT(*g2mK8R(ce{HUVajRQD;U-Xw_`)24Z;C
z4rOqqo)H+QBnq$q{v%!;UakMKx;IoupG~s`_3%zp@VFmnVuA?=@vkjV$FW468RRqe
z`v*+Hh&gEpXxMzaT@H<I<jH|}B=x2FFAQ}eC>~o_gg2%#TR8G5sD&!T#Kfk6z!oHI
zlN%0dHG?)pjE(Eb7T#+6NP!uBj9k5}PoEZ?TXB>J)n9@%*CRHKpTbn8@2Cb6vK;Uj
zYWmZ@|ChURwjGP$DTd7$?$V*BfO<3OK}#YY==H=2=Ymdto-nE!ZG~%`icuRzCvdbJ
z{JQyW%1fDqb_?8;Hwjhf)5xN?Gd7N6Z2YRAYV2Kqj<B~UvJHzjLva@G;yDK>jj&Gn
zmmmiToNn06f)zxO7uMd6Fl(dnL2sn4oth3bP6iaj1Cn@h1Y@z+7t#{(v%30P+<Z=_
zmpg13^Xj(+!3%a_-II5=GCt{H&kL?@zN~l5L=)Qb_PM_wtr5p=Di~rz<_9;_;G%N+
zd8o&)244}<L$BXJpS*wDL<MuVx+LAbe0NQ)bGmz_`PYXoxq-AtG82ouy=qd<*2@N1
z`5HNa4{DA*?1iT1Z~t@cHB$dSK1i(I+bu7x5r4Bn@0A`Zj#u+WX9$xh)4<y`ljD|V
z(io`raK9WHb<C569#{aQ{(;XNyFp|&ilIU21)z=UBA#(jK}?76q6ai3Ao^+z{t?{-
z#9e}4NW2T9)_J_p#D@`DJ#U(Oth@)_q|@8EJt=&Yd=8Jl;nj6Hn7#Lb{$60Y&<Y*K
z?;lZVxNH@HDS$Sz#)wKz{XBeJY^U!!#7$Askf;<1^1{>G)`+@$dlW28OK$Q<Gi)z#
z($LL>WfxxncX*Rd>{wTModE{P^%}I8JMmx16iq;BVtVwARH4r)R(hnuE&CGcfL&!@
z#@`0)>Xi-@1e(T4f*DRo3E?<(+Ul5=sQ2{h8e3;H`G$lBGZz$`QONd@#zym6;O?A9
zTzkP{&i^oI6^bR_6LWkuB1rXSO7rT#)JWn0s_;8?-ET-z!XPypc#irDMx3?P6Dvy%
z-ZW<>r<63PvOCrbGP3Y$bgG7MlyFhNuSTHbp%xX3G95_G<!k&E#+_VnTJV9oJCHa;
zJ#JDYhp#Rj7^=Ws3LfYu5OD${D2pEe9Tl`8v8w19FopM&MCj=bC8;CI%{41i`o8^w
zZy`Suh+ft*#{#5XEC0om*jE^M{y#{80ug8)D6A-!q@vP~c%WtOC+8m&dRb@g9NkQD
zgPRT`q%{z@nxHe?GCckfEkqe3T(i8f`S7DF2%3HeDeORmBsO4$CDbWDjbr|RFiH_9
z)h2%bIf#71fVI%s=TD4aE~Z~Sv9#v)8+kTB%N|YKg20P&(eYQBe2GdQ2>8KrTh{{k
zr1hhF3oRfHp}}8TK1aPOho=sBy(R&dNBYN?mmc0CGX-dn`_*bP4{ebUqNY#2qYY-c
z{0a#t>*@>Pn*9&12#83jhMu>!uKNWme;x?nE?T^>hEZeWe>Dm+;TQ{~&&H@Rr;uZ;
zumLcou9cJy)DAq3vHqT1p;+kr8KJsnpWIVdCbp}c47~R`)j|v4+ehF$2dQqp?UUC<
zq3c%shlZ&H{x<Ml2z?;!^)reZJBZLo1Gq|>BRah=fw(zx0xNoB4-UV9WA_3j@`eoe
z%sOk5C`^E0(8*5i>L3Fh#Gl@1b2kU$NXk5;ipF*WdP2rve8%qPac+j}J-WpN5~qGO
zNS57~sj@Im1)(N}+vVB4t4BJwHd@-=7Ej($$O~?O=fD`50l_jG6`h8_Q#|g!pZX*&
zH4Hx$D^U+c_OG|=FOgz+9p^mMs`h94Iy7X29uIQJq_l<0FrwA3n3$S-n^@tyb?JOv
z#88!NDkBRsp7Z$}m?#qTQ1J%C=N5W!vFM-w_#Spa%;#aaCeZ;>8$8GU&=F9Hd$!UF
zkj%+LjG$}5t&N#vEU}G8rO!2>t<J{Dne&sn9#>R^=6XmUukNpjI12643RppX06v&g
zl8_CREByY)XFEU|KZYMsK?95DhQm{*dYoWQCF_5-+|#LNkkRTgo}*SD9sV$8hxb0%
z0hm{Uug7FsxY<}$Ol`v3$+(hHbz<eU2rS7w<#n%;R4pD`-Pq;`xLyr{(7D)HYyT!5
zY(pDq2hb_2JdoIIp3j%W`W$<rN7)x4y4KZWR7w;&0~;zl^=cIu<J=J6PYM`X*jHn8
z>WgO(J9`pik6*`0^k|9S{qZYh5KSa<Hhfs8?~V<wKNgC?!{d+Ckk`1Uk0(>uMry$-
z*U8I1B1~e;1dFq_1gI>)=MQFrwt_>f{T_DJ?9gY=w!-)HIu&BxA9^QDu$GhGYxQNj
ze2*@Bu|*bU&<%!pw6zj{7tAE@?&Y9%7&bbthdBM1>(%FB$FO96{IQ_gjJR=VLyr{v
zO`ZBf8QF__bsP{)@BXs`#)MmqFdNX{f!IJY?qnHu2kc&zE1n_0bhg~GbzY)FeOBn@
zo)f&`W$Dtq%s~O@m!FBw%9flzYKn|mK?TpRcy4N&Eypb|KJ;12u5`pm9la5+*Yq?+
z6E{b2L<B`_j$Xo)urW<%txI5iqwxCNTLbtWCFmJ}NMNf}jHqz3dazMYD?`g2m_DRG
zKokM-BoI$hLdC@O<(H~!O<Fa!Z+wZec^_c5d{Hg2q-W;i4Ho~%VumyP({a({ux#HZ
zyb!K_*GV5q>SC`DEAhlWY0}IbaU7hVgtYV903#|$^$Fs0Xu{sPVBA?+But9LBIt62
zmHn3C@8`diIDC5Esz8YXBd_DE9jF15w;1hAZ*<8kX3&k5BPYMbEve$I!N8@EkhqJj
ztUUbiUI>dpv1aoGR&8Ws1E!^&;UakMbtuN=?407Yh7X&>rLr+?&x%^CNN;~mg!#q`
zLweKocOl3g{GW8M$>1%$PORJge9pqkUfS-?!WnYlJ$P2zXIDvR!k#Od2mlW;c3n|W
zlt-HU*E1s6K|G~~H}-=RxJL9;4(5vRhqJGC{2oeB-TR}}S?u}YX3h{jXLygM4%Gs5
z1y-D-vC&*lht?y@KaPg*JTaFWbSlpg)xHI-h2Fqpvz$*Z&+c?1@%#10?NN#X@D4AS
z*LA?sKtIk2B6xEsp3F~0_kh+k$Vt;(b2Zn%`~n3z<fJ9t;yBLxW4Q#ndg$ZAWZGIP
z99&wwV#37rLMADwmCM4LceSvKLzIQc<V=czrTfn)lUQOTINu+-#R!~-SN`*x*dIG`
zB&3~kKoO(UP~b@~lJ#%$p#V6nvz<JHWjk2EA#jF>XCd=#H6;7`C5Azw?n5CuZ*II0
z%rD1VIR1`=9qvx-o0N>`F4Xg`g<UQsoHIUbSSxk>yS)_fb_d&uvS4YBg0@Rx@=)k_
z8SKH1x9clmtzUg1Onv;kjMu2prI5I=i;ZNnuw#p*6h?)^)Sb&P;>7%A1SLe>RTU1b
zZTZjP@P={mnWj{A`_M8M@l`|4C2J{}U6f74`YC^Jf}IGaK}wo;35F@P4ImmcOBG1`
zcR~1X-U2<KQ)R(>j*RqTRG*qLZ6Kk4J?VdrW=07UVNn@(4F*@jAtIDYniTx!H{l<F
zFH~5m1Zpp>D|f$fiLkKWyP+DwAad;kY-x{aOBkgpfeAO&Y{Ww`b}l~)TGx5QWaR(6
zuAEWV^o<P5$HiSCA4+>cFxAxD8aTLp3J%5oUWCzQ91PykS~SxFjdKAU0_iFF|1$~l
zOC=l>va(0CAC*g&78k#6o+7p|Py!7#XJqdpUrbDUxmKK8cugeRw+_1j|9s{O{29)5
zmHZ2swHF}w%?QbgiR56#^Y^eo0ITr<beoc1{MnAsFX9%<3a24i=f^<dUp$vkoqw)u
zkOjs%INV_5W4%tJ|KFM30H44hk)<6{pHwkdm(2|!L>npE&<Gs(D-!9rpp$K~$ky{M
zYE_`JYOoabZr^<iC71V3=)H66!SU}QaLGvf^)y*E_?*ZtvgTj8?6&??XJ;qUYh<#=
zZTJ(x_W|=bDpk6l<wBx-a&C`OeLh(Jx5+C1EgIv9QMg^x#vr5U4ahmluerdEk!p-k
z5=tl9Ib?9??7q5L5hGgZ>(Kc95(^D$wVRnwr|1@pC_p>EBVmNR?F(FX%x<!25P>ej
zDTcO(pY@EC@s2$vteV-wa(Jz|4>>I5+7O4IKmV^$Z(f9i9LR+eItN=15*SWjx~ZZh
zxL-%u;{C4~;@;$sZ7jk|sQtXFMYFebgb>-|rA^J`J`Bv+udpsL=AO~#(zA0z?=_f)
zM3HhwTQr3P$DBF^!o)i;=Z0DdcERVBfWj^`cKQ&8(E3EfJHJuM8KGUEQCkT-n;VVz
z=g1ee6Kmez=eObFojjFu8PT>7J$1&&?qBjjs^qoXD6_*}3ufg!D1P|r^fJpCABMOu
zodRG|7Goj?Qc|Lp6oBvajwB!g`ff}3^}nhBuZ7)i?}W0m(9Qz$JIm3A>)3u%pnOi^
zf`WKeJx$YZ;m#BYvAq_xhD!_UmTe+d;&)b8cei`^I|G1ukaHtu$&((8|MPcE5u)Pa
z;_u?r#3`jUKTHOmwrLMM9IA0nGRgtS6-<#XF<eC&NapGSAvdo7M<Cxn+IJg3y8S5j
z2Y=}xbKx3mUc{SuDh8!{0QnU^=$4df6X=l3FszCTji#8jF8)`xv(DCQ-`kiqFLPr+
zj8{~8ckBC~DsHN)V3r*$8-Z<y*RkbOx1rl0?H(V79YN?Sji|w_;L?F76ma$vflEPt
z?HX(7pm2LvoqwTv76CdGykX&@lzP8Bn&7WUp&Rht$g`*9Cx2|#*l2Ez$o5zF%ZZz!
zH{yh4KW9TPA08v*hmrlK%n|=QNeGHHz}z{U3Mk&g2*m3`;2EE@c<d<cN>Sre<_5L-
zEA393QFp$>jM0NHGfEdypS?DNi+xv1sXJst&i&edq5xh%di@a=y5KPp8JO!pZvgNP
zz26}O{*siiUlL5B=PZqu#{Mt#OZ;B)3w{7F`9|(cj^JYFj=V=r^2p@2S9f=hoSDq4
z_2%Z#Ly!~@6B~WI@aJ7v*CqB7Zd*JJdePWG8EgyfiboX_Gr6)a`IN70TXZh|<W{J*
z&zF_Wn|GiYC>X0lQz2@?2%l7v0`giWeLJuv=g<l%U`Va5o4XDTmbm>A<0~64U+J5g
zgQ9|!sxpt#Rg#1?C3(fS3}?j^&s=hU%gDq;<!t@L_>8Q-RcNH;tk4Z1EFl3k*T5Lz
zn!8Wt=TF2ud!m|TH5BC1h3<IlFYyA)4IQtp14)HcqZ=k?^Hp#5pJ|PCmAH85oT{?y
z;|b%7SBx4F`Qjo)t#vpzmIkw!_?Q|Jrte$wrW@v^2ej6~R|Boqd%j;qoh^mD=Qd}y
zmh-F0=|^}@+yY>@@HYJ6Gh>&3VC%XoA)ZLwtDpVHsMo224|A5pa~zkATU|5iLF5m9
ze=k)Uda2J4dcOD7hz=N}Fha!)dx?O1qm&ZMv*ke!=jF{6;6XC7kMyH_xsvhid2yL9
zz{dGSY<n2SDPLrV3<DBhM+iPWEk4j7DWIZ~O24(Udom<-+RVbnCU`o6!s6*sUe5%x
ztfIf5G3~hpySr9a{`C#QOk7-=zv7jAgZvzhDz&)qTELXC{zZ{*``FmEZW&h-JQiOa
zZ{NdssiK+iiw!S$9LMJL`Qr#2PmxJQLyg6f-=^2JZJw5oiS>454U{mGgdGXN_3A|I
zl<KR@5W-T=+#&%J_@YW(&+t{J(*d0w{frynKmC)PP7!Q`aZwjpeE<9j35%jH!1H$6
zNGbY;c|nQy!(TJ|^IX0g;#nH4%iB3M79T(ENl)-1mEv83<C{Y-;dgs6p=_^pF4aB+
z;BON@(t)Y%lBK&Yf|SP_mMoe6d(*HjMJGV&Yg>p010w>L*dHw_MtSwP7C`t%S!J%l
zlX<G)_hWYrGSeeM;;sR>ZdvVl1u4&S@W9A1h>Q_@VM-oL#CFnJdobA-mxu`9a_vk-
zt`7TgyHtK_2omQgC}<?%P9LNC;7xuE3PZbiaW&srtpH#zuR5iD+<Ch~AfLK&Q_dU&
z3vuv<KkYbRhg{u<GCK5Zq2@3UjF&{OqT5FwUQ(i}OF7VCYp$SCYrxJabRW!5`;hqQ
zE#dz`7sLL05m_2Da8KA*IFAy)45#Yx$;m9=_&l*dlAz5<hg^+rcN)IFXErw^&~9hx
zC~RVicu)Lgi3E#U04v?Xn4eLu2vEh(H>QRc9p}PBFGbYM0Y7XX>qep+um*tC3DRCk
zHKfci%_XAn*({%=BxNea=;iVRUC`T_*RnEAW&&}Fy&bI`CGJBoA)Lm{sPeB-_{@?2
zK3$!PD)#d&`R%H9!&-yfs-I>FCq{Uds0N<SZvITTgJxi?|0*{&yogvy!b${&BXsfP
z*)yf9+kMvN``C30JJr4j;eo(XLI4-znXjc|VWF$g9u<oprNVYYLIRg<Th~CtvOhHU
zBjpG0y15MC6v&ebCI+NF?FTB(Cq4@2*kF3)6JH1m^V<!$W>!l@MK$@+k9k+GvAap@
z+v}eq)Hc3Nazvf6=X*|-aVugc4gi4MuWsHcHo4}?M^rTT^(zKo=z=xHxoKZC6F%$#
zPELGE!h9ebLMPE0NNo%U0Eq`vSyGA%A5g{m@37lc4MlGYraekYxhrpP>~e31#_KgC
zF@(I&|4Pim^Vc}@B39>P@;B%*0%K!ir?S_$H-(17vY4B`>C4=C!sZ$D;n3S$$t-4U
z$>LvmSP6HpvBLrSd%3@l$^w5%okW1d)_qtH3BHN_h7Bn3Fz9LGL?<SdguwYgT&~xu
zs;R>XS~FzgjV0FP?<s}F`QL;Z=N;(+$U1a^;Tla^|7$?+XoAU3VZRD9zn!6a^<#d4
zdUD?nnSk(^D7Jhw+p+Y8=gDLJO(-6`;MuJ3_{}hkuLHs9*Gf!JmLyhS|4jV0k5|q9
zM%NeNlkwnk`>>ar{Qq#dX}CQl8_P$DBb|fBtW2{0Qua60m^hi5R2Ph|PoD$h>2nW^
zOaCgAG6|&A2diN{Gwmo)Bf@XZ@wQ}V;nC8dhn$j9#6+NwDk$2$HT}_SNjTcGiz8v7
z{Gc~B8CC1~O4r1oo#TG3YV^NCX)hJL%mrcb?MX0!NZ+~Ix^`GeT-iT}lEvrki$cC(
zKQtG-_k}`QM;IdkMM@AJ*<y7GALC$vX&DzHwd72lthZ0{NVKydhI##Jy=>7r`BR|q
ze8_%C=Xf@@_T9va6pdb+Md1siIa6)5GoCw#K6E0dP=`Y1-@OR@H@A0@XT`1>BG+=-
zGq^lv4P5N{ANTRQR{XMib}~AEUv?VK4q*H$8=RG4^wyJCXD=Bo<KJ+{v!aK+)6<tJ
zBH$z(EhIwO44>sOY`e(ZF>Bv6-AN4mpaJ7KU+`=I1G_!|D@(Px{cZ*V-8r#{&-=HT
z#G72(Q040U*n5A_J-XAQs-rXI@E|Sj*~fj$$e+vYnx22cKmO?z5gR%^JElC{QrYxa
z!QrS%x7I-DRV?K{S_v9}fn#L3#FABz2CL3Z4^M5(luS?v2LYdRtI-%R2;B+<i8>iD
z(1QoM)=XpzuY=zKxF{~lD9fp+e-=D96qqai;jdHcMhJ*5Z|W3(S$}Tu>xUq5COTB*
zjbt%p(WyH^tNBur^9(csX=%&~K`q60j`#lkbk$?v3b<Y*<*9`?G>xLr#`sI<0O(@#
z$u23tNdIdrfT;b5?-M5j4E8^-imoChQ~_@Wpp9<+)rY698FizA9@IYkpcsF7f3A9N
z&cc3We~1aVc6Rd>0F8*LuPwV|V-ofE1wEtdz%8a2Qi(88fIV94o$Y+ME}#g5dG&7a
z+G4yecjEN(S=~(<dcVZv<m0b3yp$-1)SYhBA=WPdbBamIV{{*lq_+N~yY`wa0`)ui
zR>k%l{qlv1C!HyUL+Qb{N2r%$Pp;3gwrR_j`@Dx{HDcqsSnx<l>CTC|Rn99g`!HQ5
zpumiMHKK&rXYp5qFy=cg+!EVm6PM57@*g=^zaj@k8DF@r%N{S3=<XFDodO!DyOCe6
z6>o2BiBGmwt%O$Yo~)Hk5T0VYRIsMxSr+u@3l=<>eCrS8Az+ngqy}igKk_WXniU(_
zZ)oRV#4MeK@$Q{iFey`dqtiGa4l5rp%x*$igh!q^*<_oaGaZ0_=!rMgKVD713j{W-
zta<#4g$fGIj|MDlzfl@`_E?Y#vR=P^M)Xm({{Tw7sfpjFj-Q41-i_@5&R59ZC}?;V
z#vB?kf!$~h-s?5if_JmDi&tQS*^L_JX1+J@T3~+ECF<_xyZcbCBBz&T*4TaPTi9g%
z3kll~qPU*mb(~E<Uzxuu>nDCpY^>>0s<A_hgMLjIs4a4pepz2%f7e+v;?c|_xfO$I
zFe~TgKGn(1IaZK({L&su^iOCJWe7C%&emIUSj2hSp`<t1Eb}=Cyt<=cmWlb1|H5O(
ziaQ4}gAoy$)VZTaOn(y+{zr754-CmU1E9x6u8DlYj_U*9cLzSP{P&d7+$-yWv+vcs
zCX=7d#fQH9%ckHXWZ<nQ8Zxt!x1rn>1Wo!l#m-_vO#}`SlHd*(O-v3K#2PiY)NjBT
zz5=;1CC))zNsqYoR=(xDx{_;EoDtH9eu|-%tH;hPGj55~hN_C{!_XcX^XO`a8%#pJ
zV;$#ckuq@B4)Et93)rovd)u2F7MM3T-ksLOM3zPmA>QOrtnb7yvLaW0MYd|@lX=CO
zH{X=RIho|#%u-~XRb+}j0_D?ed!6JM9El~Gqzt<o+H6{+A!}CgR4HwJCH{Q$r;D&A
zhvP*u@FuGXD2;*bKL1fs9WmxBR*aC{5BR2y33k!Gco<YEOfAEE;08HD^R^Ke7~xHi
z$c|*h_E!MnHIk-hXN3PMWHV80G%lJA4riWYZKBX6Z~m)iNqGvv9vN27I7ror!wh$@
zmWqYyUqL8z9jV{Lb1)|rpMMNOh<yNUTUdNzBE*sP|APFbZk5gOx~c--D-hCaY=1?2
zfhc>ZSVymQUnKIK$bw_zcl4;}`eI1U-(LXLRGL7MmEE~1QTH3ZTWZg&XnL5rbfLSg
z!{T@!h~S(-^^a83%$;Or7I_=zR~geSj{?B!xc%ksUs{e=^)kX|%d|{Mj#EQF-&k{^
zOFNp+ko#9<{UK1~n_6$22`_5F$i>9+bzV4vNqi2$kR34J8!=)t2Rxl&iXxG4=HT(*
z4)4<m;7{?l8Sr4IWrAmRl)W~jnL7JtJBt*CHp%HI*$>>F?&g6}m=thF2GBHj?t_zF
z_;ZO0Cms$Ldo849;aJe?E)=Jd`c~XH37`CsI2)vB8krAI6xSN)mw-XI^1!UQIZD&<
zgD17D)(Fs3STlq+#RrjaO8$#lbjH_{V6?#7NybCm)XNd;|4hyXg=aY9bsrxGpvkZt
z^=tVC3#>SWG38)J@DKi1Rdm!?8cf4wq63+xe*oj$sTRUfKtVw!3N+G>BJ;mb-p~)@
zN~e&6DSdRy4>?9q5A2iHTiWv1ss6_JKop+>BSGzA8+8fy5C-TM^928PcS3YNsZFc~
zTY);x{M<xsy<D@Kju&1#G|C^1?o&OWm9rio$1&2i5%D|Dg~k%5qX?S0Il_B;DPps=
z$4sH@Ri0KUnESfxtO!r&hWT_GdMi=+TFezABbcR6e{533J||@hiSAo$YMv06yr)D}
z)xh*chPKTa(ZWtfP{LxrV0=6HJkUBqmNIZQ4k&}9D^P43yJO99`^Su#`Q0b>#wuI(
z=a02EkTo~J7rj!!Vx+HgVZ;7oL{<hi(e(7tM{%jb8sYuDkfTSb72M==*tHdWCWJ3Y
zlesw`ipa0tjO{r_Z$$Cc!T1iZihatv%J(8JM_U|@NgQX~AhLa?2W66{(j9$46)Rk<
z`n&Nu7GrsjVW{sk<=8hjMe(2zAu(ApD0lY5c{n{$pP_z>{u8hhXW9a)j)ez@m#Db3
z6pW2X>Fk)j(N+9`zwgDfwDs0j-~SzLmjI6=8@<EFYvG0!<4yuTkYqp$BL?W8R(Bdz
zF?#kCn~I7mSBcZ<lkxF<so^1E^wst^atbbLl05}1MaE+OH$4GrMnKaR;CpiNlhgBh
zb!6umT&oM2M(1AqtKkfk%>XY9Q)L2>CQO^dWKQA<n0>FZK#;<uS<79R#*P;tT~!jx
zFLfTr%ga@isrTpWy1S<y@<HZx=zi~CSJshBMR$xIzhR2h=}O|Eeafyv#J{8Qi?@OC
zBXjl=q9=`k@Adyu&Z>aTfIRg@ODJi^JW6JiHDY{~9|OphwRCOauhy-kNYBj(O}cR?
z+8U_}R2k4{tAucH0@Lv#*yXDMVrFkpLy56^1l9P%a404*32DaH`z@EqVE;b{H<mwA
zPG5?Fk&N^%sCfA}ya;7;Gyw}+mC%}s!t?;?)GaIk+=G;&E}0FE=9<fp<9~1+b~iDy
z$nzXTq4=s}O(=6Y#n+KnPPoNBywpO5qe}uOm=?aiZh+zUdl39yloPvyVOVWhII`fl
zG2%@{jU<Sen3y<S8v*A~uJ7N9PAmYgiBVgMN1Z;F7*bXo$vWK>q9d943=<mo4gnu}
zN#M(~Wj->wAKgB*YF`8zoH;wVEI^=1hQ0C6)L-qeQgju%@oNs_2Jl}?lBMV7L?(5<
zQK@{rT^+>XAt|P_^RoRZ9cmj#PEqmob{y^{9sw3mGqdef;uZA+*m54_zeuH#q1Swj
zFe_VDF*o`($VlIPa^vW->4Fa$J}~6(oTR+Ql^0U@oob2E$Z6HqStb*-X;67gE1t!{
z3xj#%mNLAzsJoc-1ZQ*xOdmxf2b~o4p6+Nf4Qc`MZ+u;5+i@!$SB9Dby3(jTIp_O&
zGDEY<NeS-&Gx6^+ve_&Ub4oLXcY@Hgy1}X7DuC^PwtXAMXmTX2tZPl|_t#&+NHNDX
zSS0c3&P2eziasQg+3fY-G5_w*m0y#12UL!HP*#f_JMS0q?af*7O`)+SEu}F1qY}TL
zeNb^`?WoYJ1eWtRq2S46iJ<5&<0f6{n6$4zJy($W;Ce{Qbs-Jt2a)}(L)th0ifLiC
zw1f3NO`Coa97*6gLh!J}jKvRHm<c?IZk82)9}JN8Ea8*<@a7G1#rhjov9!)K7w(FQ
zQr-HWb{8LJj<h|D{iyd;(74iC_5|J_V52n-*i(ii<(d~5Ab7v_LBC>c6H`>Yf`VMg
zJDvUMFr&qCXsYD4_~tTRTjPAt#I~)bf5~-LvW#Mj0`;Wu$66V8EH?5k_^O0GCIgW}
zXJ$z9ONw(L@)^afIfIYrzVJjLr$={c+djCq#8>b-ti(I46d{)vde|LST-$cyw}g1x
z<IQW<uuwDR(tnc7Le=7D#@;btNKKlrDA7laXl5q;TsQASjB$FoN$MLa1d^i-RjyH&
zS-G^Vwz<0Gws`JUCvF&wtvnH03Jay-jZC!&NOsP7^tD^zeJ_b()T(N@wEx9t0UOe)
zIJi{!!ybn{-|lE(zImBK1!ue^+v-o`wtfmJ9VNGgdrzbrYl%J|H}kQE^TOTV52l4Y
z0zuunfIeF%$cq+nw^hRwTcN+=IacH3lTeRY4Vf~f1FU?JYdpgCiOcll_ui$d#Ww41
zE%0K<34*hsANRe9H+nPl72d_%k_!oqKc9ZjQr)ndHs={VX(sS8R8k(#nBkPgp+-K+
zv|!9FeJO53gV;bRc(B`H%|yg5OeRY!E#jt4x5T+~aepH9lj<ePV1X%DLMMn<+Q>yi
zzCWpY-5hqGYeX>WfqstJrrY=To)ffBM6zbSY=b|PxQ8!!aFVavnJ<Us!Pl%R>7{RN
zzM5MP_6}wzluZYldA&DXE%N*(y&c+ng$;^DEVTusH=k$=41VdT^}}Np+prHWszBED
zaK&({{mGO_pXpH<a_tFr#pt+a%JeMUhNVj_!AVKRvPxp$-M-CCL#=uHK111DI%(Jk
zQ;C*H7uPyfLfeTsM=$XUH+}wY=iau|U$bD=ARc<Dw6Gh#2?=uC%29;&OT8X}ZjU1C
zo=hGtfLUoIX4-1T?*>@8O*=QWvKND?I+0^5p+6a9o2UIbZ(Aa#n`BcAs@+NxWCw87
zp7ez<XPl<d;B9ySdA<)&GG$720W*dRH!nfO*%Eb2xFYuUreAYuSh+Suj5B?Gi8|9g
z-`q@({q@?7_4thp$@AkgLGOirKu^)wJx9mpj?F`y>-?q7><s1@@5nkfPSW=pg(D~Q
z4_zhe3Jfka0w=kOIP7S;q|nwZo&s<5Z7?hT%gtJ;?y|9*x3US(*k(5c_gZZ18%(R0
zDxKJJ*o9c-Vp91W^+qmO#n(xxrD+LmTMOu$>Ob}O2NkKqZifNqC`Yi~Hu2(3?>bji
zb*uK3t&nr)l5Zbeu+R<~=N^J;n}BH&Ao{%~E0DwN0BNF3O1mM@x({`i_pH!9fVBZg
z^y%9ojD_ACjd?^O14->Tw4N6Lf)L?qAlIlkelH}G{vKS<QPo>4I=C?`x{0#`#-@As
z?#$Nz=}c}KElrTx!99Qe+@soRYN1>k;!>sYpJ|2}_P>7$7+7God;t##UH~qoKD=d8
zb$S7AL+9yf1sek|&KIil-61DgOPErWtaZDk$Y7?XPgDk6Jztaz`P*P8HXl8+F#Re-
zB2iRuB)Y8(bOc)4OOt$=6Pc6AV>cjNA!3)U8SoSo7i!|ZKlF|1bT%FG*`>}ch*3zN
z*e~*QNWaHvSvKEZJ6ZGeym#Q(+>43HX=>a2?9!N1G<0+<dnsgyT;KP7f${5$SsF^N
zv!{{OGM_#4uZ}mY<tao2T3`q!c(-n5P0rb-W^$7JuII!1itKr6>^k$k8JtcF-61bt
zY)1vQ8exw?N{!=rc#+y%2BLm8>F-V~^)(mO8?hNlNr?JaX~eR>u<cD(dHgObMDTcx
z<(FH4A`LFmbdGUdF$4_<X?E($3lSWVD_}svdF3X+IfRuT8b?Lt&saI3O<Z(&ml2Eo
zB}GZUWfNj`rt-@SP!;5+*O_q#@ju!f_5@DnpIM8@drO<w9-h==DV2Hay<E&<PhMH~
zTt8RxW=g<C0)Z0B&m#nKIS(%G<@5&o6pn4*3fNu<<TlA-EEyc@mvyRgjHqX}c(|1I
zSb%GDhp9I4ckR)e<ot5&g||(<zN%T8A?f3`@q;CdAVq6=#J7|!Xp*%UvlaaGvg%A!
z<MZ6p8O?UJ@9Yi-Ti;O6m~47oG_-ssPF<Bpa0PikEm#xKDLp(C(^fD<QoggBlM8ie
z580X!!*ntVLgxw~e(;~3ie35cU5E2EBJ56;`YseEEM6fkn;{6(!1rW#&v88Gd=_U&
z6!DQ2S#*ldRjWhvY5hZ=@9Du`OeY%e6*>+?k`K~6lTZ*kEI+f^uN<ykU^sEIG&kti
zBGd1FlA=tG$KQ^2`?HKP!2_{4L2)RC_fNa7Q||>`AP*#&c`q5gr$lwW?aF7ttK~#{
z68!}8BtGGWXMZiE-u)s*dAE8^>Fk1~HV5_IK9j0?u?V4_`efu)!{BWX&-?9^lzZM0
zAyHBEL?AEsmXxK5NG>Gm0yo=sY*^T%syf>_ynUgH!i`U?s=wDV(LyO_DmCYwMGGF-
zvv1vZYWTA;I@s>en<k9YD@*jpm8uGvSkt!h>_GI39)6zd9W5X(GJTPwkZcSQmG2+Z
zZ%L0Bj>Hn}AwEm806KKcRH`=R$n(#F>8i&4z-%_wFxrNfKR5zvpg;afcvDd^L~0@=
zMa^EcV!C`p{G$5L(Lx*}mQkYqWt?%!v|2X5NRM-l3BzKJ`7{pe!G%UYWLLkpy!rHP
z(>f^lp_EPO(q*+;Rfkp){L-AD&x<T}xgP4K_gDOoQcRm&$yd_|yOk+~(hc4f+s1Jt
zt7w*E*7DT$r80QM#0`HrtTEQ)tJJTYog&rY-6dlkjUZPY>Xd0}-3&iip}E+5-Jiib
zHh=5|IK5r}&jqhaKi9!;ziR?tZb%0;Y7nPa9hiyzQSGQ|UvW~RloKtpEb(^kmklRx
z>T`GZcvmDAj-vXr^JPbnd1hk!8S7^Fw?VRrWJZ?u{<p09%BOaeR(jqMK32I+Kb#=m
z=DLN{*=T<-5EaZSR8iIU8dK$fF2V;IE5d9qx#=N6N!YuYgo*8iGK|5Bug=SWyMRm}
zdvzx?XHj5$>O`%n_@VQL;SGx}!&S?NHaDB!Ltb6oA6)AvDc?F$b5g$G5NLn~T@sw3
z9j-bsIBTW9Lha=64USn)i(V^nSGz^gb98hwvxwh4cxc+A4f=@lf_X8B-?wn<3iQr2
z7D|kF$VhkA>Vwz1M~45*7?NxkpS=X;Z4v2+I1`}0cuekZ$6CeK-XZQw^KpD+{DeWS
zYLX_yy=9s7S^C+=PxqF>?Y3^)uOR~tG}D~2RLWw0a1B50@2hgHo=#ns)XtOL%HO02
z*dTo5@0tEN9;MMf?@%*$8p%}f^urT^)j?0rv!DAoZ9PYf>F|y^>-tXY)wH+lIh0s=
zSUsrw{L(FL>xnYn&2)Ow`F1+g?hd8v!a+l!^B1!V7&WfP(NQ>1W8dUDGWm^PRuI&y
zW8|LF)-e^6%pVuSur1U1d4aJ^{V{IJbB6)Fk{#f+fO4h8dpVUiCSLG*kK*^sT`>Za
zr)NHjXqnX>7<5!SOl<UhZ(?!gH*lDzMLQ5HOs4Mq^hwp*YN~%B31vlZke}A)uzUQ$
z*fmp&_iF-bB>#@DE-wS|QRTzs7U<bILTL&7x23hUcUBMg`>ZY-0{<uarp&q6<d>cJ
z);EdL#qslS>rCl@__`_e<)bR@sL45E+!a!3uYjOxQoBP9sU;B$f5wt0WDWPL`<w*D
zQ6J5JJ^EZbI&`%KRBqp5>nPl*vEQ<OP6PVLFa=7o;y6)oPK6gA_?EAG7n@NhE-#*`
z^Q<*A*xe+Fj*BJBxiJf&6Lu+e<6+G98wK%9AX%|5Q);zcwiu6Ea-$qCnbS=v?>Dd7
zVCCQl!znuz4!NHte2-NOnU!O%$@%&=S}L7J*fwznKlB56E}ON1a(aN{8_>x6Wz>}r
zn9GlKopD*;5lA(<f05&gxZ$}{>mbQ?N2r>wTshH$FynT@TFS$fwGn~))a{QKo~tq1
z?hqG!7S1{Q7P+?-zAap0t;d&w3Ci!Vjkh;P@_nFl)YpD~Tnj+9anwoR@-s-iXmvvJ
zU}s`zr8Ux3p{BzSA&T)3`ZdQt=EkSY?92$R9_uk1WnwJWn1rzd`8msFwml1tD9_sA
z?H=Qu%4;lCrX4K61s;FkHE~{Ta!zT4DOV3TjmUU=%JI{ehLRKWzd2hLPll$fepblC
z%UM_*jr>+&o?uZk-HrG?Hl#2)s!a4BYDf%q-*PQCCy`A+nGmNw<#8ft&|jla(7PXe
zQ+VoGMptEc<LDg57fh4b5tlZ|YQ54qc{ns8q!Zi5Hj(SA`n#FV%xQ1bPRQl3WbVOz
z3b4OK1^St<V~hs_(Pl1A!lj|b!6%%YR(3o;@9a#xXlnmXm(}MwdI|xl2nF06-6d`Y
z+lo)YSf}3I;w!c(@hi!!+X>RsuZ?PvmajaUU!Zy%^lNt|oG%Q4YTMJ4nEFFUqMM3$
zLzv>*Mv+@%@{)DVwIp_KW)YLq8Xuc;xjx+8{j-O>;W7DmAg+LE_Gi1;MtS!=x$A}w
zPY~Nx_dH!agl0zXZobwEx`J5j2{#{|!l&wf6FPvT7TMij=+?ML=az6G$G|eoFw0fV
z!t*O4P3dJN5NfX|qV%e>xnNX34R?*ro13xMh0G>+-+rrn*N4wTbJLWA1LGWVQC@3n
z3E?xjeBC^{gYn*``}FO|c46l(l9`#H=PPa!_V#PWS~Lt8Hqz!&5l9KV<#|LKc<czS
zTHnQiovasJi3_JCW*J`f-Uu73+1NX{%EXj(h*~VHc<-dh4mrVI2rpaZ#fSSu)V_XM
zztgPZ>?p^rbp}Ght@A|cj*8q${A*l1Qbcl)LngQedoD{41~i)zu5eqsPfbP2hce%@
zDsiVgTng1fv6X7vyI^7qAf`<Nx=g>Ex+F`87}UC)$PZ+Ro#t`?#2DxFswD_K6ZQMh
zR(ypM;b-2w)BFqH=oxgOS8>{Ee|VkUnhEMVTO}g=vIEl$i_XD+=RRp53;Jm>1=$Nr
za@f{RJYsOki9>wdV>KE-4SP1rxu@s2ybdA1zK^8d_gi0lJFn++jhE>7XO!ddz<Y4o
z<I>IPSwZcCfo96x54z&Z&W7{L(&U!3$2jvJd^OhjIH=WSBRDDrG7h4}{fZ?Iyk7Pt
z3-9jhF5y`Zq7mWuC|?zVjc(%3wYP-Dh1XtkT4niWQmYqNYi!#FjoL)hLa*DKlYa(+
zd-}_YuhNxuOreL7rI$Hf&DUc_9ddJ5#e%9{kTINf&RM3m11*7D)GkLGk=rQ~k!wzo
z5-4cJ1%TLYXDQ9x_0aox3Bm7O_w*_GA$!BMYW946yHyfm(}{>BXV$OjU)aG5U}D@M
zW2L*+rpnhhDFkK3f}asxrrJ{QZi(z#6vfGulK4<Zpe10xzN5t;typzcf?Un!Bv2fb
zKwnGc;?~ui+(>c$>KxL~*eYFAbfnI|Nq42jU-3gneYZ@f{UXmE<-L~}uHpkWLeJ!L
zBJGR4wXf8+Rowr+EYHXO450Z9iu_79Hj@P*9s{pdLMpps>A~*lX9GuBsH`LTFTl;(
z+(FuZ)}ovJdu{26-;peFoJ4<!s!r6gZBri^UMyE6)V>{d617Bu*xXTg)Y^DTHz!;R
zw@#qi@S2b`Q)yw^MRyV!7Iss*fpf**S_{iO7-Wasan*g$GG04ce2&MbMbKbROMGFu
zulr?D;Za!OjOR6-qG@?OUqjXQrK_i_97|C@)G>IdiV5IjKIT({x66TLn%gY+!TQ1g
zW0b8pd7OSd{=e{JzreW6@2y%=yMd~s%o*@5rUA|_pfWdM*h#boutWN2g%yMz6|p9T
zGkE@Cus6+I{^8RC>xdQ-obl6D@{@r<#MUNCSK3G)U#ptDvy=N-AKf#8ij*T5xUvy{
zoh<W?#B($;LgZjS%j?RtK7g);gic&VqniQi=~g8+Q48qkBH)UGdUb&NIhKDp*kQmK
zpUpl|4OtLpN)_O*9*ff!tvnLe6k$+sE+OzFU*ssF_C!AM;jY4dBdwPRr(t3h9&`Xa
zJ?=!@Izz`>S)T>+r$^Au!}$GeIO91wBBtif@2q<*)ppHXmm4CPL_}DUV@gfU<PAJ;
zca*lqEU^Hm{>Jun?4vPc%!_VA4k~0}BX^hPg$Cnmjdsy!VjQ}wS*ErFW-V5J$=~TZ
z-~7&N?v0*P=l*>dewqe#nBy6-X?YtYO)Vv*fePUOH`AL7#_?GmT!M;WUzbSi^71m7
zPuVu+V{L|szBl_<5}-*=$PBN@6EI`4@+u{DYUh{jC$Ukc$16C(AE$?$C`YA=^;p}U
zG}o_Voqzyg7rn*`T>!)FckWo?)(Q8aL4vW48kY_6adEqd@yeCoXX-TY(cy{~7yG&7
z2P$?#3aowfzY|pj;`>oFv-29}+38i4$~OPL^8E8MHwA&>LGIley_ui}6@LgZD_1od
zC5MjY^y@PKNPcDB2Q{Akav&v8k_8S5@E0g_Gv-u@i)IpHN0A#oKdD+}A|huMLa}g8
zPr!gt97Q7-g2-Rs$Hf$-NRmdaj_V(*f58{`jvw7yyb9Dmx^3sh?&<RO72eNvo+u(P
z-it&6<SxfAd37S}JUrt5=w<_f1Fyl_?(4qvXg<;+HYr2c6|{3(3Rpi~tmM>Q5B_+=
zLG$JAP?@OAtJ4(&5o=U}wGz(cgM~NWKmioZ6~Guu;zz=`m3qN===ky{-5@@9J_j-d
zOHY6r=uP+miB1-t;L&_&(Bw=I9(rS^3(9hhGvbhg^JA|>X)vc7qc6u@F?S-VxpDg0
z4v?at9$K{WzS;Y>bF&a2{QCtE0F>u&bQS8k20m)ykmN}794?o1fi6P3r{uaxESNhY
zWIqx|fjG4GGrX)lt!OE0L;40}{IrN$mUPF+XAILg&)^uP<y_nVk~4xwNUu|M6_oI9
zm^(t2hz(ex-AM-EbF{kncWEI+F?Lo^X1s|&M(Eh<`f8;?41?qncK{w6ACWSKjy$N{
zE!)lWK=jY3x!`bJL1a7NKs&z0paNb7sQnc4_N|I3Li_#y;_W@4qRh6m;Q~YiR6s;T
zl8Oj|fJn}$P0o@tN|Ky21sD*OoF#*RfaDwsC<G-3CFerPvB;U?KW}N@d*|M7X72RN
z`q%2kYPw6`x6Y2w-p}3#a%Wdzli^7WaoQsxdI%-4(}&4$%vYlF6xVhcM>sOqhA)ds
zjH2TM5?+xTh`nl&i7*>hMBR;4ysue)3FbQbP6g!o!wP<|h;r74f76+~OH;?WN}>@d
zV&JaVc_pZC;1_vD4L1Dt&kC(Y<>Oz0bsp=I38~unrp9r!=83)m=AXMng947x4)F~u
zUYnivUTwji&mhEj`Mk~Kxd&~$m~w`UFK?<D!|)|G+~R!l`%!6~5Lz>Z8$poZ_<_TT
zC?^JYQ~p-r|M%;hgPG57M2a)5YFT1WaJ|eg60boNS#wlq=q-v&++Mw@RLBqs*}zRQ
zP>Jpd5otOm=Y^D%o}R;DV*_zYPic<HI;`BH1(e0bIPHi8O;SSqmRHQ{C%03CD{A?_
z4E`G7&6c04>sYRyJ6_IE?@m5SGwF(Fbzt-X;5U$arFTSTRuwu7qiPt=Evs0_{xCsM
zcU_CI;XpIRI~!-J1eluhygMBK8@4O!XM864s&Ce>2xm`V^e<Wv4aX~JtY0d>g!FY=
zkA)Q}x*h@(At6!&WQr%Kk{d=}jrU;owg&YX=4<Oyvdy;bp>XxPsH~%>eAlu096Lq!
zUD(Q(twQqHH?U}O&ER-4@rH}IXTtLI@w*KN54i-P7mkL_8^SlkK?xpKB<hP@B9eGZ
zSsOOI_V3Es2FIw}cDa`;GyA<zzoapVT|0X?Ss-!xcOEztCX&e^>y02!Ex}rELpAmd
zg#Md10NrDu!Y?w!lKH=ain}&A(^$=vYOs}M2!9;td|V`}ZY6s2uvgL)!*Qy0mp*@P
z4XN@uQx%wXBIpZQ#U{d{e@UVHGP7O^yMz~COoj$qq5ux1TGv4beqifmC~G|jWm<k3
zZ8v}~(eB0i5?7#`XZ$AWTjH?yllTRmNxTMJxc5(vjliCHN+gP79A{V}AtDD<_&d+Y
z;x%kwYfT&*4ojzy`{QsuCFfPYkv~x;@eYo8FW~tkm93ibzBL(0${KaJ04?lIFmODG
z)njUE0g-gl)ZS@n4qy|s&x017OolconqR5bIL9<sZf|wZ*l??M8}jO$mxYR(PnpHR
zt#q!;I8&QqzB3ma4v!b12DE(y6v#Iq7^kFn1w`dl&EE!51>rbBDu#oziLjz>ic}78
zI`8~+@fw6moEW(R5wPX)7JrGakJUOSd|l#uf#nWAGBQtVJxscp;Pi*jNX-#aOZXhD
z<ze+E=Q(BV<(>ubp2E)unp)n9aiExme?gBCk4Ss_ulQnx5fE_m_NfOZA+uCwJ3BR^
z3~8C4ICM{W6Gd(<97G&&b5>7EGL+3Rfd>C=*h<EU>@P9X0RqX&#)XD$ps9VhwjisK
z&`$}!<M019*}zagQqyg;hn2Z^fELRjs<@(6U;Kx`p-j?^^dnGf&_^wKf{md`q=iuH
z<2kM`2@UP~7l02)RL<k~223(Z<PKe97_^*Ji$`%@f1S>C8G19n0q|x!`9NXdzt+-J
z>HER%;TTn-9p<o<->I8G8`yQ^KSGV3S9hl7VD^dz_14|vWFOCUy(GMR`HD<&4+(Zb
z0Tqt#+tvn&?@8<+OFGmT62h5UdgYGYt8f`If)K5ttr|bvi}CjdM_*jU&fi=&!^L0b
zli8TGi0J<$(b??0B@Q&Nwg%gu`UZL^V0Y;xt%Th#EBHmzaae@rHjAqL67U+{i5ibx
zZ0nvlF}L*i<Mz}RC>e(#P9;CKr~o;cJm>SFJaAXoHUsA5S&_Ca597bgI0~gJUf3j$
z8f1D{k^1?m<5Km_w-(H@2L1T0d!?T)4+Y7=hI!=L{(uYxVmI7|(d;NR!+yQZ0*K3b
zauGg|B<BgML|}S)E0Hb<l`=AfZiT@nZnwX*bUY#8j-JW*B7JclVk|b0;o|#$En($T
zsxUL{7|heh;SsA9R>X9(yln?sCgsmFqX>;hNIZf*ObVTuB>0j4i`c3`m`5k7c<h0&
zvn2(EqWG@&*6Mc(sDN*@iivm&eJd59Kj1qqB?SE@yMJQ@_VSx?)=h5j1=GrJEl3m|
zDS>BgU1>Q>QE43y`c+G#sh4CSaPgF3{Ro+W`>-J;kHX`mav?|o#xGcqwkr!(T;3Ul
zf;R#h7ebK#<GCgJ?sSmD2JK`+A$8IPA0UUhE>D^nU{8r1NPeYJ!c-RgCjJK3;2eyV
z2up{fOC!$U`NVOAj=Xk=QwEja^{$5%+hiRV^G+nTeX_Y33MWr`O9l%GvC6Ky1iPpX
zNMYCg8f<ZJr3cr}fZ+KL4*X;j=x{<W15oHGjbF~IrZVmq0iPJW5W-$14kAU8e((c;
zXQ^?mnQiQklQ=iJ0pg5)#h6FBy!rJv*dRH^0tVofwn}6HuX%Z{^2}~%I+qM!S2<iL
z2Y)b4_WMPkdBbetu(r{pU;RBOwqk>`VKS`9M-{t|Xq*MBx4L`0TiCL=eHt(?N_G}i
z=(mTL*JWW^4woq?I}W?XGPZBpz4;^ADu$GvBcN<t(~^nF!*)#`TDhQ%n{v7yK&W!_
zCf*gv7JmRh^m3QWr{>j5tR|nn?dgeqtuH8(G?@QM=+zLE6+#+aPXPTma~VkLoEBhn
zYKaNq7@d6FhM-uL`Y*#?vzf!D@ly{W!`4&#2=NeJF;8W}if*=bafEH>Yu{LMFCBT_
z6))Z7=~64;VFpq7L3({cC;ht`(^;yq^|ALj1g9W{iyV@j^Ep!S-n6S8^k5BL<ur8n
zdqW#8(2PR5fBX66u%f4J-EEOUt3r=1Z)%jrDD>Sbf1q!t5I+LN(b+RqctwcHGdL`6
zg&d`iV9yr_NyXnK+c1kbVTdH&@&e`XJAx8pLsi^{Lxn|%ePf>s4j#9`c47=*Lg=0R
zfwR-E%9e+M#yORSKpZ29QZ6RV3R@J#hX}s-Riu)!jFnmsb);zwq^}g<;}dlv=aj3x
z;BkNz@rTm&leoBu(oH^NKSA0tnbFqg->HL=S<l&Ho~l9yI0>{p&vyb~RlZD!{oIfb
z{suxA!o`jYL>?d{O2BV){qf;GBlrz0ktjUtM?rF9N+jXcy4{<Udr+#S1fBHWeezVt
zy~F!LAXFxcJDA0g!FGAFIm(49B0+oX*E6kG#2$K6#Wioe%?Zw!9e%=$O|IR=L85?>
z0Jm(RqUa#Cs02?0F=nu?s}_2JGkPF|4*LhTM}gm-lj7IXz%>3C5%7p8hMT|9S+gE2
zv53#$&0g+q<AkbO*KvW8kfjPNkm5F6)VV7Q(o9_}?vHV)uFGDjrk5SetG=Z9Gq&Fe
zA>G8DG$CsGD{Nf92~5%s@81^1GLF&Ls0737RB=LI4S$lTbkTN!HQW;ZzSM)c(;<YM
z#NcJbBY`*-!gyC-!-{^FkT}8l=Iei&2~Nmk^TUFpGf#o_X^DZ`7XCfG7l*m?si`;=
zn^=$C0M7YFy8uF4cGZO8SXW4(ZG=3{6FLPV@R)Qz%XD^7yM4yV4EVq_5QlNpl;LmQ
zx%i5-ui3|$yyLE`6^fwv!|Q02Cucw54iv6313O6c2I86FHmHp0{kf$KIJ1TtiABIq
zBDDu27E>Ztnd}(bu2DvW<7Q&1ADP-{)e{kmV!P>cAv2`lJpgcq6tWxoQQrxC(FbT7
z<6*OU@ZX)$e+qViB@VIO!NS}Rw;=~*-_J`)`->)#3Jv+#s$i=Vi45Yfs-HSJFncqN
ziha4`ZtYf57KJyVv2#ZmvX(DvZj^l_gdD9tc=<I0FX)G%8AuhrgWy90pZ@e8A{J;1
zGbzEeQW&w&&lVe>hF85353tHwB@G@McqI}fk}%vSKv6GV)BrKmMyQlgh)+yj#fw*S
z%fjoKoQ$k|k@<5q$ZZWne<b({15qX@*x<5&Zogj^7Iu#RGwcLL_`9>e3Qi3eAv}~z
z3>+d<rvoPT{po!QNVM|cYpB1Rotf>ZND_FgrbhEIPbB{6gz>SK+Fenkp`xYN8<BS(
zh@jJ-1AmWAy*SU^P?-G%909;`7Y66wHVWdwf5d4Z6o~#>NH`9rG(ie8w#UB(RenhA
z!=X^Xc3Tz7W*dRGpt&|2lBhRQ%qsOR@Fb1a$RQV`%Dwm6m?XZ6mR<rwARI(ZAm=v*
z-d)Hn=O&A@@hREQj#lmv1$moWY%Lc9v*|BFVWk#mecNa>)8F(_gYbWP_9WI>WM{e~
zKRorCB;$w28eYMy#)e{c+WNWh<|SeLwdEhdV2-;cIDf>DsMlIR1dmn0m*{=QopJWw
zA~|z6rS~I{RO9i_UAH)Up;QRB;mM2d&?tcYTL@$k%lr@YfP4ixSM707!o_FkxJ7hx
zS$s<cWw+VUTP~_{$^i#V-XM85po3IEc#~R|xN4JH=4POEbO@fk$af)2s@w3#v+oc&
z#Xb~zw$=aW*?D?SDLqV3F)C8?I=F^|XZdbtx-UxSCdy{BV~E<jL<E`9_#GtlXELGL
z#q|^*Q#)(?|LeDSH}_Q(IWtcw?eidfhT@8>O0kmR{LK;v&9}$li<A_{Cmw-@u2<B~
zpTy9H!HP6|1c8Q;K%*tiPsvj^n+3V#&VaQp%2lHJ?{;nP0@B68>ifxuSEi0BKwA<D
z4VvJ?gO!Q@74QSO(=*OEXqN=(N8q6Deg0%&05)v)7~YhSkbq3Y|EuU7cJ?bNC=MUw
z)l-t);RxNE2%<kqHcv`;G)<fo-&zlA-?Va#l2%k1c#hgUA%hJfDxiUoNiaCF5?p>;
zd^Xs{3`E;hrR&CrG$ZBS{@<U-#&-Aa$M_ryW@Uxp^ZWY$PKeck{q3+Z{ku>FxJLOR
z%XleAoP*=I5zoN=LO$SqpI{NP9}pSI-I6z?e>*6qBF}yPjrmz>+U6mJa5Jvk%gc$$
zpD393J)&3QE46-Zfo^21;$zUfwhT@CH4p}Yh-KXl=>pWn8mHQN+yyKdx&ewwguq%$
zA2Wk<0~T?{Zv+oYPuxH%x~zXB&3+x^%ZRhsv6z0Sw5))i<RFY=WS&Q^4*VJX42F(h
zF!lWj%4bsat4C_YcG{lI_oeb?c`F_}mM-+wspr~U5|Af*4hV-0hr17N4cP&2x0QwE
zG0FUTyan=id8!3G)yo_29vnd5GVrzQI_TT*O~Cb|Lw=Lc-w_Y|Zb42eR|peqCCKFi
z*vC>73O;5v^i;oR8JCFvS-X}M@l&Xt2Q}R;=b>(W^~#cYoO^|nx~~gQ!to>qR+Qj&
z#tHIoELaEszJ~<*GzgL)lnes`a~kyRp{jzX3`4b_JWLCH?Hja7Nf{dL;-PSE-T=kU
zVnsDz!Mi{$tXFmZvDkV4V^6q#hvwC$Ea%0$!FG%05bEKJSgr)2we(mXTKRlV4$5t(
zig?clV^d+$qQ}5ZMIQ!1nX49nky?emw<yEFA?f3JLN96w+-23r7v228RdWr#WdVR&
z6r5YWKJh;wi-x5i(_d0z?atHx1Kj%m<H5jXoot5dAsIn3NxOi}WM2T0fZFhIR{t-W
zx!(;CSb~9a{qo3@<)JgU_knP&#38H<h?nPJLu%isS^ySn7F1ybfl~@9DMID{e=I2)
ziek@krw|X@6;}k9Qyw-<cog-U|8@_kcqthqOf*oFLBwvjo;b)Y-7YLZ1k&sr;1lAB
z1gG6`8@jcaJ^>_f1b{$^E89N<L@BJAU|dqMSux=+6@8NO7=mozOS}f(ju*N?44YMW
z4v9t(w*p%)z^Q{G3J(Qnlc_%NqBmUMVj1DFEB-P+F9(v%48>)QUH11&(CZ~&pL^r)
z&y}=`N%)fspbkNij{lo?ND<u@y`xh%$XxOp0{y3N@PGMKCBOE`<wq`{U}*>e;DQVD
z9KX9ZMY4Wdg+2$s34ua2@*)=M@jt*qJ*E{^O9-5S)CI`3QxY=CTF4mCqrfS~fyxR`
zDj)d2sULwntXQ6*rwNruyx`d&v0Pyd!*t5GX&)r07$t?Q-m;kyKf1Eq*v{`;{U??N
z8aYK8)@XgHZATY``kQ^fLp`LY>?7^+*tH%F#Ne;4D{2Qr3cyN1GNgs>e)C&XQ`0M%
zlD)L&I(4r)Xci*ZUvbM=(QItcT!lY>(fDxDV>UP<HpT8dFQ(u}?_$+14&MAcWvhfH
z%A}%t_O(^Ue6{%>NPfv8Jz(jxa-;*e=aeO)W4nPRf5rV8r!5I?T}!R+UmI2gY?^BK
zirs|K-^KRJF~5uL$eTIX0e^7>P`}lTUti>K=s6ZQF##L~aMLTeY%o?u&s_!IWaJ#=
z$^OZY3wlzEn$>omu1CH>#PcoV3lz;_$mn~Xf2SOdPGX=%>~Rx#nyfGjAjWcV@X+JY
zY)pv`;RoaSd^?fLg-hfoKd*jv1b#4v<AEA6NC?#p1VK@O<Q&vp#VajCT`v9C?y6z9
z8id-fr-EW#k?Ug+1Y~{zUZ{|V+fXnuE{|QI(f|i9JyH3w6Z)R#)Iq4pew<d$0HcYI
zoX{nMRU8ow)QSQZ%;)Sx0zOz<bMs%JMOdvvWI6u5Uv*4*D1^<2%p9`0{SUQG2=cwO
zb<rd+k~QDpFJD^%`duDBe4*#scJLUXksmhN*Lv-_GH%1c0e){Ts_U_q*0ak3Rj1{S
zihF%|ciyWQ1CP!Bah#Jr2xi~e1}*#4yA44we8#_}y#E;l!+O${8k>e!Pz(zLE)862
zX_5Zz_jU&%AnA%G7G-F4sZlUEz`C_Ry`1y51}{vHk5QujV1br)qBkJ;%tHVHv-M=(
z76bLa`m)8HAGd+?tU2h;+b4lPY84yxx8BDWom74<IY$i)Oa0jk8NUbtY=ewdwzXJe
zb)DcfdI<SyX&@s|^(#|(hL!0r^268@ifo7=RwM}|Y_Rud&LHT?0Ly#yeG;U=6?=zT
z`m|tjN%MNmG&vZ5=coff;Rpyw7t#FBV2GjGM-HUlVptfacnRy}WsahCu+dT&*yZpv
zwcjH6^I4F9^)Y{cUZ5*%7|jvh*!VC<omKni&wleKUGzXmj}fl<@oty>>AXc#_K$sJ
z6lHq{z4*7(jVUQ8WL9;&yq|(HpD`sRrCk2Z%$xaw5X~dd?!EC-l>eSE(Dol50{J}u
zZRhZ>zqKT6KgD;boz<?E0fkwQJg)N$)}Gr~4Gr&8Tw$*BN@j9d>Mtnsb{S8sCJq{+
z&RSz^I%~j$_T4Y`E<P4I*bXc-9oxN|lMr!JbGKf(ptdY)Wgt7vyKI~IV4=@+j`NZ2
z64Z@<(4tjklH*-tUA-}iZ|)Ww(o%6@6x>2??cuz{eTSL(o&nnBM|JO7HUsXcnRQpx
z5Gt7odAd=VXMixk=p!cG^#_K$k?`5Dm%42OaP}C6iy~Uf-W{$LKE^e*hjT(DGo>7+
z6R#EK_E$qhAF?B7a2M@6!+VRpl(xd8nnNN=5lK2}$prLXI<9M@rox4T3-1|73M;zm
zk5<_1dUS803Xio#PnUF^R)~8R*<<zWD`-5|pAXoo&hpwcQ*Rz@+L<~vYox;iDx_o)
z>7&x2rHXu_J{tpk!KX}2Ol=E4UY<LrnS0F>6mrsZ1&SF#Z>8WG*c}EoP(!`mYyWq8
z)<*@?@Op@Emf}0R!y+d)ksB`WV-!>-HrJZEnw%iou^=U)7PcGT!5(vmqxP{y3Ngx4
zCdTI=ILOQ7-H6%XR^;pgZ-6?#<iPMwW4+n8vXk#NCe2)-XIGC__bA)4kLY;~y*Anc
zGK>R^gF*+AeCR!Y3dCU!6T@QCdL%?lI&EH-b-A6I9Z|vAbTLVKVlyEuR#%-*1~$Jq
zaU|Hh02~Fmgl_YAn>8xVKiKQm6a9QTDyvt1(v{e^nM+<rl(ZO6OLkD{D-~?-NYMM<
zezZoTySQw5qW*q=pmLID%)4@?js<V#2HUw{sN%3Tc^=TcNev}Ga<=_u1^u`9nF<?d
z|JL%tdV0mt!rz^KXk?QP1(T--RS8g#&_Zwi8RNfwPw0lNHz|oS^<lu}z|7@!C+&R?
z(4@M+wdsoylw01htKZKsvF(Uhqtv(HrT>N|sy;Z(Wud{0(fhW2)g(FRj_Io|H9?p4
z6WQ2Nc@*BopbHvV-W(2m7@12l-`d>Fd^EI`%gQmelM@;gtt#Y}XD@$iD_=i1#-Zhh
zlh+<`?%4q?O&EXwb5t^>jApdvXOf?<{!Xl(qr#NVt6nBBniTcW4%~|6%*s^J`LE68
zw|%K*P!e+=q&_j<sqx7Fg$Z%U20$TZ8}gt0fc*jbSO3rg1P2vr2m1(y6q5npD$niU
zPYklKknauK-y)d=SMuyzA{6E2&p+GRTjJ@R-dx5@7OL)Za9nyzo2l~h?1vYXTUXdP
z(Y3kPT%UPm)ZTY_>|gu>|0&6{?|KEulFBmc?|Qt}^08FF-H4r3$WHpg<I60+k1wRV
zAs;k5Ev3Eq>|`#gnTF2kGq_MiU0``{w>!<zA+!{CbdK_}^iiMZ`<|UOkK}Rq5gU$;
zLHt3Cy!TJ-kt~_`ardrS$Nd`w9X?0A;Sra@w}aR=4~5Vjz-@IJ3(}2g7<fPZP;u}H
zL7t1a94o3OUEQLc6<Cv7+=Gs^(>%Ua+7V<py7uE}Ey}4T<%+V@EjJkZs(7%+;9{1n
zo?fE$a1?u}0$jz>(WwhFU=_JWul{7x6mM`z!o_@nxO?q(OSzb2g_&(+rlGgZ*`f|Q
zd05q`Qcuw}P^$~<C=Mo67I0l;2ASX8E7$!@R&nhyzuMe?C#n2p(OARy6EW=p(j5UR
zg-h`8AR0$w@z}VriVl3u?O2<!($0Bv5i#u$TPH1X#3qgr1qQxa-IDp_<sr`M<`!{=
z>#EM2Q|9yWUZyLx2N7k@>J1w>MG9+GG){Ju8k|_Nk2^CQaC&~*`o*nk%G+YhNg-DB
z-#%t%YsL8Py>wprrV$Z=i}yYALck=C;uY`hoQ*W1Dj(6)V4}|OPR*`5c&rGH>A>Q4
zPH1bfO(@ZVFD4-6jm~rlNfOSK$|C|<lmX?L?UZ_tK(ezO)VKx*Bi?tYuc2bfA1MkV
zG#eZ~ubmUwtbe;XNf3xPN(Q?)&sBa{amFu~&+!p4u9~fu#2mmr8W65|2=95Hh|K$s
zteU?b8@XY^YaplI8s`eS)NjCFudBqhp0ieeG$^N<q2cK0f2o7ODq!3_f82h@6lb-a
z;Au<nwc8>+LZzdN1^P&p?j@Jt5!?Qv=e>IoB0u_FsCnDsV)batQfBG9!w+|s;tGR(
zx9?1|H!Y>D<sE%}QOR=QKtp}Fkx_1TP-QPcq5jmQpueD;sVvXnjY&PL&!PI^<h?H|
zd#`g3Tf-6#@!2xH-)LyU_P@O(i5lThir#nM8Q@vp=r5z%oN?;wVxsIyX7Ab?8#>-E
z<v@mG9_@`&xDPih&-iNU>7=EsB<dL}bi8gRglQh-kZORy^~6D-f)j_Og`L(P1TKGE
z|K+~SXXs|oaQ63CclUbMZ8&M*3*7=U32<hf-RfV@mHNnFlSLM#&d3GX(nPYCc2T)U
zdTJIPOi4~TR0}JfvgRI+jUqTU9RyFs;*R1WxYO(0G5KR}f48MoPL=L{XoA3zNcHIt
zrr^+ls?%eH29zS~?|*l2Ym3uY;>6_dx(*Q^wa*3RH@8sk@yj(&3UFs^bnqSe%yKwN
zoa%OEA@%qXjY&ZaacEsM{JJrnd;f~tZiiCaj{q8)vgRJ-p@wbMj^Y-NKF*X6+^cOp
zp^!w->>zb7$eb>ESE`b8tX|kEMBe?_Vr$ypuI|<mA91a&(_-MB$o8wwc&;I9IT-(k
ze67U?0GxY{mh<7Nx$09bf%-Fo$V5Jc0TEMpuU&4jSNj_3(lKTJiVjkD>F4omOtc9d
zl<2yHM7L?{(<hg|Sg#V7vYW+gAYY@qK}bkA;5xBb<yxYd{#p`YsCmK|tH;$KJXhU9
z7e+4Rnq3z9yfQdERP40fUElwqI)B+py7%?ntRAs*IkyL-4vYtqyr_AsjhubE8pdY8
zq#-xvWa|BxY1iR}`!1uo%`Nju-_>tV3ia;q(fbz05Em}k#cZ#nPtRtMhvYkpF0Ga2
zVh*KxxhmRY^5Y(_Y{l6O<&9l;qVzWLp#jbEsDt|LQR_JV1FBNgr-#L}Xzx5$nDAW1
zgWmZMbPx0~hvvbFC^sd3_rrdvnc)hlIGYaCjr~}TE5Idx6(Y>VGk|aDQ}J2IN;~Dd
zPWPrl#UDFsqQ4iI&uEa)Ghu4I)0_5d?(|wWo4}L$RLgPym4TwZ%E=AEey9!(LZsDS
z&mnY2VD=MHmk;LB-5S?+6DU|`mvEZ8rVZe`oEC2VWYN1^KPL&zn0NiIbeUq7`*25N
zE^NHkjjYK<d&KIS?`mFiok#|rPZ$w<a9lz%8MQ;*m$`R(Hm(QUAe7uMs~BTZSbv8^
z>>zQY_L}d=3qD4HJ2{Qs{j@Jqk}&bLyk0#M7P(Ei>@b=o?<T@;X0~JOOetfC7cwI{
z1M^N$W~Ma3_4JLN=MMp#KEh0eMV#EBf><XnbhWC%0c@Q?H93~jtoF$@&2ls-I54{f
zdwt3C7lLV4b~Jh=!R*})6m1k>!#S){6A&q^0fi?;aK7$ztVdV<9aGDnLkOL9ziK`r
zNb3a|(%VpR(On+kvwHkcfQbKE3ZftdXz6yE(#Qu4osMR|BU<KcaIM{k+P%+Dr(Gs+
zj0WZf>W<owRzuV$DK3XO_ZKlLl2cmvp#$mD#Wu5FnQp&B8Q#oF9MbKl^&XgxlbN2G
zQEX|WII)XHYhs=X4*^eaGOq8{*p(UC-rW{0cQj!gLcXN4Km=3rz)-|(HnPqYA$_W|
zdoQ&Iq|j3d$#$=~T8bYjH`b+<-B~TGfvu;jW>L9WX@o94?6IpCGF<an=PWe<m|(5q
z8x*>_+7|Ocg9?tH1Jci@ApPVY{P}!3f4O>|^01$kK!M82<^h%uc%78%`HP)|40klQ
zjOD;hGvgYM)L&?LE5yhaauTyxG`w~2YemkVjW1?s)6h4le#Bw%XCariZt)!KbbI-e
zpU`6c{>-D^;wH}M7`~bA;*y2wo}i&n!DD3)_$WD!jg=#T(ZKh9i^6vDo;vH@oV69N
zvG)Wf8(AGe^UdSD(uaEeP5XQMQYjHsb}RME4(R0hwp8kZn8^0=JMK#i#<Tt1w5*+`
zD@{sg#t$^{<2Zz~5ZtK39Byl6!=KXwnl#}k%>GzyLeU{ebG0T!G$$k~w>PGH4<e$X
zuJ#MVx2`ODJ~7-X??v2<wV{!%;)~+Vglka3eC9IaHut$W;u!Oet?O^yK3j-fp^Y2B
zIpgQzJ%?U=36Q@MVi#1h3RoZM1HIG)IsRb5`M)u?i)8=onQ(gl>Y0f6YPWuhPZYJq
zx>zCj03;C7H$X{2dA!y2q7=68dfn(b@CL-+sGy1SqPO7R>xjvIHwA!`6~t|Tf=@TX
zx<|jJpVnz0$%)l#yLMAjduK?jxg#mmj-y8mV<g@e4~Y0E%b?zt83J^SuH>YZPwh;S
zrYQ=(%PY$6wfEG8X%z9ABuZ$_tJV7Ggvlw>HD8C~qvIT-W=GA1grIpP!5>;4OKC?h
z&T9D{AMjPL9DbhLsKIS0>`G>3d8K!#wLjQV;#>OhL0iX=Q2@;T;Lsd-97W^P`uV{!
z@??#`bn*k^oYlX7T1GqT4nKQ3_+Ez=Cfw{Yldpg%Ues7vRiN#2`vtJ)SAa1ETH{*O
zuYWHC(t;ZOvhZeT%~2kdAPkB9E>1rWnRGtmM@&SVIgv9TH=Fp|G9Pq|)tcry3!FM`
zm4o<yi{UJqaQPFZB_J-tqb@9bGO|;&E#Nde5V{B|C35qn?3{)iW4p(th_;u;wuSdX
zK>{OCKjuHTrKDITRg>H+u;49rJmW;=-2$Jp0*8}wSC<{{btvx<+^EyW@$<;U%R%Kq
zRi2_pu>GTGWGk?Gp5^?`n&YHb{}V;}-xQGnzyvpOf0~YeUfDK;I(-(iy^m*{ab&@S
zAGNS`G+XnT!StX~?0ruzV#`%%=Zl{!P%tG?KK<l)-gMmWAP0#Bxd^_n@BDDUOws|p
z#xo()pLM;nGl~?+sA^VSMgHlVTL*9Vf}*y%SFSk=wD0A!!fJV(5)vH^=$+&#^pZ~x
zxkrT9cv3?)-OM#OMsL6pQw*=KBDT+E?|}Ky*`NZZgdU136m7FZB;g=ep!x=0H>BrS
z1ZpHNTMSKt`9v4fY(NoO0Yyg8MZfX4k|MT?&O!eRdH;pVa32NC02GME1($qEZ&66s
zS?!B2I_r5^)M_#uxC|KH_gW*^Y!=$;;yvP)iIlKYh|S3O;+L}kF5lf?uQn6M|FCD6
zayws#o5UTHo@v;cO17u=?C7KgSkkJ_gSb$klZRUcpDpP)lsvR_xKTaU39+#p9QC^~
z+1DLM0t&$O=%oOFZuZ&bcCHDPi99~Ljd(apJ0S_k;oe70vL5?w^RwsyD_l#UJz5mo
z-^hE~1G!K{*{g3J>B=F}L&B0qMoLT;V?R2KNd6aQ1{xCo=#>7Kx&&UkXP#?qP=_~6
zM;{KQdm`O}bq~2ft+QMVVKA)8Yi`YRB$g`SG|gT;OJD8b;b=WXjGHWq4l206F&Q4M
z_+*?xbq17OF1Vk7)cOq(o?XxA4OR`zHSXF^T(IK}bHnzAF?2ylb>p%tA<S;1M#0m-
zCEa=~nPQLzY%u()Zet8~S6mXPdGNU>*JP;n>!p+w4lvaeA(*c#;3;|;V1;vEWc^@|
z^D<tBg8NPXPdaMO+aFnBd6p^<x>;>$SWXM{4Q(u%?CK2;cUCFNl7Pl8x%aAav~CsF
z+J<nh`)al~EEk*?oa<s(3ulx=-ZS(%e$Lr@QWnXQ6cE2WC4`Pd`|MY@SFfS+a`MKC
z+N{&TP0ykPElQrB9+FmjKWL%xs5;)?vYYD*4WeZ<cN5}Cja$l9nCI%6|FgtZG!{iy
z<hkl8Q0XSNwZEuJA8tHGr~cWptLB1ZQ@-2TtI;;j{XYWQ56s;n9U?!zS0aZM?Dnzd
zods$B&v#WDC54);O2|{TwzjrjO!lKpn}kOUYpjWQeZR@b0sUAqvdTvH!jEk!U8uyv
z3fS?kg=OmV9Jmbz2lB?rHD@-7iA_)D*h(0Lq;@T8W4Ud{wJu%y>Efa!cJ7Njq-sll
zvG?`u``E%pq{;3$zN98gUd?)btX02_kI(bkd(#&@7RyH-p#5^!BF0YRJ2LtlR#|DK
zCbTsto>YG1$v<4ChuTwf{OJ0_yfV>sztm|TP#LD;{z*4o-d}gEEub_@E=jOFw~U#c
zJw_@^F_O}}UOg>oY5K!fca#BTBAdB^WAMRYrQBq6l%Nal=#WYM($;#pfYWRarP-Of
z$hEH`-4SDFC$2-SB7wQm(2&?jMSkAY*PA#~QY{mV=B^@)E4-Nm)}x6xvJBn*J&wov
zQUH&Y{%XJKgor0dY-YwN#M(wLP&3}SBLiwA?`d52Z-6p1@BR4`f5+1%rT7-i_5ncz
zn4?LDw||D13@v7S!uvCUIC!+Ef?#Knjs0vAML(9MFBLRXvA&q-vD;!cgS&_OoR7sA
zzs8imR*fR!>C&sx@-Zw`9LzL-LnO31#;^V{xLzdD7I$>lcZy8A(j#zVd?YC}_Cf5L
zfT6~~VxQAoyO&%nl|p>R8Y4$A6`8{YS5f;;E{^s}Wd42G+N$L{o5(FZUjga-&$Dh5
zc6t7u<3p!90=w(O$1fh0fz*8U%G@!<YLeus0qL8;Az2p#?;mvsCHu>0ldXzX3TE9k
zL@14iGV9_*U0_+x%#jhtK9`g^#Dqc`{KbB{(fp*h5Aqn(f-2#JmuA;R4DzeT^GrzX
zjtF&in@Xwas;Cra3yok(&GP$m^vBNC@B&z`Vi-=BVW~WAC*KoRTkCC+SQA?&x&V{0
z>A%;@ZsRomswE{R*1U^zNdS1UI1s+Z`sZFh1PpLriXq$KTU@BglfWyc^aPcbHzt(U
zm@iQG2kMXk3ZkUda){W`lg#sXoaVRvBbj95n|cV4CkRQ~t70;aTU&Ub<2w}7lMEN0
zss@v~0GZ0@B?1=j&MkwJ^oW)=zVp0C!dtJVO^*GRAL@*$s2Yah8~WIkUC?+Woy4E2
zg5sQ>+4FTnNgPM?DMbqv)YraniA}KONlCbujdafa8Cy$p&$RT*wz-*Xcl(6zgS1~v
z$JEI7p~tNA9Be_(FZ{B%BGw9{(d_!SNqXGV8$F8euPI8EhcC19OO4Vw-eY|MCXqpp
z$uRjZnk{HqC$fh{CYX=ksVQl2e()qMabWoxm@Xf9Z&|6T6xBvDxw>sJ_Q?nEwhcqt
zan&qmc3R1U|KtMHUE>L}WpasndGQ%tG<4+t1G`BzY_PmZCkz@BFw-J-T3}=->WyGz
zmFuoC?U`^-sdIYo%)b&QI|N#f17jl{I8#46?=rwvtdtEc-K?43Dva;RSr5QDOE-_p
zi%-vOn3`N;y#0|kBE~pCU6Z|#!AKWp0%vL#d3+o1w(ynj-jwpm*S+{GFMltlc_n@q
zA`xjq9aX?sT^7fZ=*h7yO4mlwOiADrLE?EHB>vWCAP0#6@Mxz1{wD_Vd<1ybV<oPw
zr)Pu1)O}AF(qCVU>R=ZIuw-vMv$(2C>$b?wi&{{PaEgCKaI92-D5;FhvO$az0$r2&
zM5G)Y;&Uj|(&1n;_KXA2YF!^oIWJVe*5eftW<QV_%OBw-@I-fX^XosR?vHK0K;5cB
zK>w`1;z@^wfbTH#)^wKS`S1{%i-pb;=U|$3nRPTU_UJp~g*gnO=ya8g==s8br3j~U
zN*w-i{Wh*3UV}EGBy)&%ueBlx(K)&&Ga*-in9{ST^X1CXXVvDlZHwYrOfYS$WSz-E
zVmQZK(C&G{{OgDBJL4XZzJYjC8IIBPlz%Zd+kWjAi4StD)Z>~ZB_|@N4Z`HIay?&X
zjYIc-W!q1s7^)vry;4gC!6x5VV!`4lS|+72*K*Kk#YDWil=@h`Ok`78V41rPhY3<N
zL!po<aBkohZFW8d_x_Az9^10ANwIzXQb0PI2tVT|aSq0j?W!s<eXK6{Y_nNmAVdid
z>~c#5`N(81$IRrsA#axV%8!87nJ1Of`7;@*=TRq^fLeaH=MI!70_5n~HKZ%*Za)(c
zzuk-fh3VYA=Xrc9PNecsS!R(Y<-L7qqR+cY`;5pF=K)19D`GNx@(LgokrkA+A;Xz*
z_rljYM4;vD|J@;}iVY@=-YT3~GdJWOdNQ)5B)vK_lL~Hz)k3>60@{%K+*n$jW*;2G
zGSLR!(nql`fd`T@Nte668Jo^i#hE&(W|`8uzE4T-kr{vdoZdYykG3R9#lgKom>~u(
z1kk{k1sP<4@my+wZy#jGxva4u7GZu82N8}*p(XU7alAq~3e5umI1JcFMsf#K5bvZ2
zs6&y#-`dt#;R3gf4dvELWh_|^;(>FHJ#RicdLJ1l3hR#zDgxrP969*P>Z*L16^R~8
zZyj47uvzLQk^>Hczkl>=fk!yX&tn=t+{}rNy5$i6f{iC%W<Xy}@9u^Jv{{M1ox7~!
zttpIOFSqgMQ<-ypv#Uy?kw;lw_k!y^4i;q}$twcq@>F@??8eav<cJ*~uOq}>*HpjA
zH@%D7;DL`1me-rK&C4?Lj^pr`!HU+lG#5ufTg5bX$wpOK>z2%0Xi9VBprc^kRNs)5
z;rk#JY>m(Lg9D%8j<k(3a8a8-q-BW?t|l3#2lK2SF$!>U&TP2w^b3%vt5%_Xox7Td
zPcECA$#l0HejQ4E{)-BuMsL6OLQY}sD%Nax$mX>muL6b=A<ClL-ec@#9Deh_0eRWB
z#odFB8B6@4y7_nFo-OGxXkz$i9RwbiEGZo<4yl)bb~WgC>0PuOc&tP3?w9y|$0SF+
zEs1X8o^S3v#8GD@wS`rceNa_gxSkX$QX`2!$_Y!XHqPoaC{YvD-$>6>=m{G?_BIa5
z-?L+%5ONI*tVz7<HBe|cTdQd|ZZdwdcBJkLF1gx0_Hf@ZFH*AgD$^U^xtyb#tC0!s
zJlN;r5>5{h0HJLrNhy}<1im-MGE(6b>tJ0uEhHTpDcB}s6Z*-ORxR5JsBddP2Qso8
z_!f{fG;<z-WQ1*ZLQ0T+qItm%S=RjEDE?&QvG&2dShLlqk914~$mwb#4UzlPE^Xao
ztAhwHN`VjR9e$!NXZ@nv5Gm|jhj!ydpwo18Q+s`uZ*!mr*<M2Ldq3|nh{YW}D=e`|
z4mI4L3^`I`P^bE=X!x#wv7&Dw%4qb{x5s^D&AmU09?fi)Dv}&BwFQf5Vm8c6EV~2`
zoF+U=QERlJJh&)RtM;~zSQ#!<SiX>J`@Gn(NrlMAod+eSq6$HwN)~Qqi9UKqeus+n
zPl~Du21KulP1RTq>F`|T*}(^IG$g6Za|&{T+TLl)r^=&?42AVKSj0cl#X5^f>{=wU
zEcG;;uD2L&&MG0_yKM7UM{WzR-kRRZsgZKEO|C6<j_W*H>42e{E<U?4pXB^vdu>pn
zpmrWdWrun?+2_-^!_F+ugybblRYSZ<oz0xP`o+B~x-Opmp9y5M0D=^qK*)kIqFh!n
zvqC_-0aJ1{%!1v9nQ$=Lh0)M_jv}c))|rE2GV?~FY<-e6<_p<rN82Uz6~kY~qcu%$
zxC(RRzCZ$9>onNR$(wx7Zq>_|V8}Y)-GA^SD5OO;0gvRIAYan_taQDG#@R{peyuI5
z3c=I6@HtK!BrLNzZ*gd06J4w*R`9YGvF&uQJEXq3Q<xj%WLtXMq8D9TIy)Yz8207W
znYerKm~6iS&%{y8)kRNh1k2u-6S^~Uhe{V*tx+ke%)aI*>%YsBB&C2l{o|Bt=!C)j
z;5gUI<yX6CkL4RQEIS27YKY9Ln)7>`BeXA`_rGA?fmK}Q))Ti=e79ca8C0rxOVr0J
z4)jjTW!(C(F-GHBl-M`><qbN>q7t_Lvk)0crX;GH=}$zXK<kiOW?iG?@48gi5@}b@
z#?hs#1r|l=9e!iulO20>@#3iM)R&f-+!VJ{iyt5X<6KKV>?%ZRj?Pm6p2}x9d%<==
zDVR==Nw_U+`PwI!Wo?s7DHbE*C0!RKh||?R=&X@7Z91-SN<11|Q@T!gvU_}I#;X8X
z^H5969JZh7K|J%8Z;}__)pS<SC+?{iDeS#df3$wmTiZ4nQ7j@y=f0@UFhkXDyb^pe
zlh{p*7vHT_q(zr>U=|$^``T{EraO$-j#}Sz3}{HJjpi=lGx9E2(M3G<ywSZD19-Z&
zTVbD4WN7_C_xVNqgzZ-kPBL|?i=0MWsVmLeUG~J(W|P&A)<eseJHzTiVCx@dQSG#<
z$+@lyExSk!#pQ3jQTgOMyy0iUc<tI|j@6rhdu_Y~3t78z>eVD!z42T|-A6=)LjKzQ
zhI3{yzQa4Ud28K*CcRNCJ*$~cDrh`Oy@8fv)9~JTm*iMr=>td1J3gPb9ncqst|80P
zrqiaaoV6?aM(K^m?^JG!XdYaHz(;4CdrG31ca-%$$G6<cCbmT3;$9);+&w+Y;H$>2
zE))3k?Fy7B^xw)uJpMSuNVN!lYq5PU-HjZ^r+kA=0bQ{Z*a}!Js;l0L`*jxz1IU<#
z97mX;!PjrlTpw}zh|J$}K#(C?vKS4)*5}y9W(EY%aw^58FOfX@^e*0gw=Eo9hsZN!
zbS#G_M()69WcMqbU$FEa%-B?3b(?2Ba`zszjuZ7&X}wt59DLD}slVh$l(G=D!+@!y
zMP(lgx8~;<tF<IjdxC+bLvQN^@oB}cru2d@CBGBFH2Dgl^pI*VBtoZ6rkOToAmt9p
zPTHXN?klg%HiO{KM`rBD()~$xxt?HU%aFNsIPq(gy6ITGxl3eP>>kmd0=GT@yu^=%
z6Jk0SEmSrX8(9AE*=R*{6{%;R3~<9}x`$xueNkfs9fVSJWR@N(R+P3dnIxoHXL8Fy
z?(6x&UO)k)DbHtPk@omHG2Mko)#U4K&E+89AwK6S#*us2T*u#3_0l^#G`CxzX<s7c
zSrQ~qLm%HXc^|l<cs}1=jk2d3n&nP8>*+GVfcC=SHQH{kyDm~kLIsOf$4`gI?N;LY
zxZKW18<U7}KWpnj9@Wbyog^Q`d!p^d``}%nE?w!?uqr`B3EKCQRmXA~@hdOPg*tO|
zc@S2n=v8tv=rUAhtW*!=u?;zK?3@5?soG^|;lndPoX?Bp{wLaVkrm9n`<QWaerdwj
zH90`~@#7EM3$7(Jj>_v|s`_!?e-m136Mqw03A2dWcCUJxH_)CPNEz4g{dusi!3Gu^
z<!^rHW1Z<p@!?!%r5`*tZ@Rtc(jtPhlj6P|?)Z2tJ>yAT4HR>rV1eVtZR7UL%EPCB
zoyh6p6-AYuY|eos4>yzf*6lq?{8yd>w2PCzD-UE8<<Bpm)9vbG$5Pyzy%i@`*Ip-!
z1PKw^qN?RE3QDmYKF8W-@crWNk^_0T(24+@6aG7}ytQGsE)R1mH;c(4)7(y-vOjzd
z<_+Vxe$@L3@sT8NXLw_plqAD+Cl0jA?Mj9Wno|xmmIZ9q2uhv~q<n1hlVcA%P4W#n
zaDax;$7=?(hDzMv$v!=_5s779v`Ygy3<`bMs82Cg6K7Q(Og#xz;yJ21X&3Fq6b&}F
z9PuhfAKtlxvu29dAVuq)dVXnuE2Ag;j$NJctHgnH?pHJ`4e{5qMOleqxk9(y0N(iW
z^{w@I#2uyj14Z#LrMlgzhGo_$p1o3zndEtci|z*HtKMqVU_32MY_K5KBgI$yM@VYs
zgZvVL*VinGcX?7<+LC6YT%`hu6mvLZy%7&Z^)UG(bv4xcUZFu;7~$IJP<uS-(t(5J
z6dsKj>)c`n5#MOV7cl$n7^nSdrH&S`fptGo)eW;|zkeelDS-)f3NS&rNzOsdp&oqe
zxybwzL~<;b+e#GI*@-L4dqwrJ?PU2ENq2}zPi<vmQ$Um2K)+~sUofj1T^NcS+xHy_
z=-zV7He`LIy}AjH7LlxL;jh_w(Cc|>);u(5rm$PET}T-vqBuXaV1zF2_u|>%K{~uV
z+&qdezrR{XlHt(wdb4+eA;Z<NB*WY`(#fu_>F#19K;7R@5ub1a1nCXz$Mokoin8}?
zmqZ>cKAIN>%(+MKQ}TAf-jANo?R$^|dkYg+elc<<P8vG_U3(0he0m*m`Hf(w5&1!7
zwJ1F%@F_%2g$8KL9j`q(v%`GkyJLq$*$Hd@+yiSU$bH`)B2n&Oe&g>fcCZIZ$<ypL
zS?^S_RH{nTq2qLP>??@~k-bN4@jRM8Wsf5~Z7D5=Go7?rmM!ye{~)Q|{xp(AWGzn(
z_YyBss#9{e9<*i%>zfCK<n0oJh_E82Te-M_ELB>E%FiEDEZjL#PD>F@Un4%pUhlmp
zEwGuY0r)Wisx`Ez2hAvF{RVe`2?@vPm!a`Dlm<Q%yG`7-AratDEzBuJMbD#>?1Zy$
z1JR=1$Xn6Ggt<d%t<M(s#AJu2N9A7DJino~Q`4QQ!i|RIHFB^N^`+WQzz8U6RBj}1
zE~nvE&!T7aMkVo|bI>_dQjKc-NQFXiV};jIWX}x7f~#{L34sng1(q;xOp%J&*x!IT
zYwQJ>R1GSZ2$n0Nt@_dkXKJiqg#ljUM#$^|(qG56RxjL#4IPHwpC0<{);N%8Qq^iC
z6-*@F5V51C{pPEH+c1kfyS+9kp~jCmHtz4I3~F#&GzRsfnNISMKxd0G8sLr>!?O&3
z9IGpeMr>(XPy&frPZK2_*ZHLDdCu3(Z7nSiCy<QW9Dn#@q@}U2K3pip)1aTDU)WjB
zcO(~+3^ua#bQpp?T;~(_s|128>94V}?OHtkES@wkhFK$+=D^P`vOWNcTha~MOj~_u
z->9@u5%twM<>k?X1>WA}ZPm=CCjrulhr!|3NdO$`K(;(i+bljQys-b3Y5Gw4t=QB_
zZx@Ne#eIn)(;hLEAMme*xkIhdZlQeU_L@l6jCl*D1p4JfDG-SGfe+WedhOLM(zOG=
z3`N@hXCp(P0D(G<nVB)M@a<3Qtx#A;JPo*?i3Q;oC1QS$o@4hOpbE@>UF%c;T7@g4
znWj&no_0A<;#@|e+y~f@9UviZ3_#cQCGcO<74vNTUXlzOvI`XI{&AvBoBG(TRo$(f
z4PLwTO>6pM^=G<-3bS}OXEwNg-8_HhDJj=*_6xznNj}+#$Osl^714dJq9Om@!j=)N
zCSFlYX0`~vrm?U*hSHEZCAb~e6IxfCl8q>cfd~0`#&@1Rt=>>O5c=+4ss#n{^Dq>A
zV!#n|=kUc0xnUe*;i;RO3B_fN&+D5cOay+9M(_rxqDWx5MWdZZXrgN`eAbdYHn$V2
z=Zcmt)^zPEa*46uWsgxjIU7&Ux;4K>Lr3bv0pF+tt*W{nK)tXB>SK!L{`61{itd(-
zn#afLZnUc&N6)yv6u!`BnKGSa7>8ZLnR=HyJF^uV?Zpvqj4a+KkGprm<MifJ<F0N=
z$*ppqmwtuhuA&^st;PFPM~%)-wx3^Qqzx|#b1Z`!PY(yYqBc0{SpY5wxKBGB>p(~6
zt?DmCoBPtmCz$<|F8A1wAUkikx5#60ncTMiK|jZ{Xt=PbRfT*CvekQOIw$n(@#E-j
z5AZdYeNM@HKX}xtRLvV!I*35ka8<#2ed<NepBrQfT-Z@5h7WVsA;`Re^;$wc<Xj*p
z1C9y}rU-Vsb-2L(9r0A?VyQZ>oBxk+zI#O9W_VhVyST0Aa*S{865d22di{fdHZ4rl
zyj6OOy>O{VTugL(u4t~<!Rq7oRnIJs&Tk!FGN@7(l1FYxk1DF`!ucnho2_9uIMdM=
zva;{Z<~clf6J)bV1k>|ODEmN<m99GWD60<tw<+$%A+_9gX(MLRDS?@qAe$R6FQ_40
zK7UPu3s!5id1eHmlD_njd~=zj`$Rn1dy6(5Zff;o7iRBr77(p8lbl|kUvqL$p5DZ9
zr^sgaBAD~#%cOSGXNPAa);}RO&U(#&vFSS}1PL4iw_tj^P9-IX)0m5DyX+0>aG%$;
zZI;9L#$mm>OULD&HW#E^hJGlD`c_*p?siJzo2V;SY;WuYs=mbB6gS<f-16`kX-}Dr
z2}rpor|Fiej;6lGXH7cj2!t#J>QA@RF`kXR6s*BQ^FCY4pDddiy5ck1<cuXX&fzQ{
zU(+8{IB9H2e7omAQ-FzRcsq3A{#bJF+B1*sK@nuphqY_ogHvN&du|g#bgU#7YeiG-
zlD3%XVS^_ardyXo`H1$8mv0x810rK*C8gT?-p~0u(tD9YvQ1}q8smRaDSjJm0}od0
z2s17&GOXD5z*ZR7(`#JN#+Fn-P;T(tll<4j+}>02W2g5K9ww;fO@D5}O+EvU;#;?G
zOV*BS5cmn{4WPhIs%Pq9yooL7(}L)F<L0;k`D%DkqWuh6w5!8%x+<n;(!)<mrOe?t
z<sorh<+lWBf<>O~$%N~Vqi$Zm`N3I*^vnYZQZllrn=g8!K5&ysyyJf0iGCIG>e6*W
z6jw)Vm-?Em9lMv;5o-Q`4msXkyVZ?O8gJfkb9zV0z%G^5uG4<!r?Y@Vdtzy>XCYsI
zWPqVnA8ujAGwT88Wz0)=_@)|S?I-tC?MUejr^B+=NH*$sGi{m2JtK^&+?$!Om7H6*
z=e#iO>WOvU_?mVT&0Runq^EotRh6r#N5gK%880O4aH<^NKE1jlOIaB+S0zAv{T7$Q
z+d{3=t=w0I32v7gsLxj5t``*~eXCGZ2=GX*btha6s4JXI;CXtl{mPvTjQ4s!RqgR)
zfbA)}cDvf-xrP`t4kOW=)Ih}7M90Z0CytO5<P@)NCDF&?@9D(h?uh~n5i=dDu4gum
z4{b-Ti6U`l4rX0{To_!>zhgMHCvp^(SDt8q?&+BwQ*l$tLg~6vklnXT8~@Q7e*@fu
z<oQ`oAR0;b@X<pW4W&7!5l!48o1af<HfjaD=V*56#oj6)PE}4{zqMOlcy#MNDxIxb
zoyFjCABt*W*RCZ1<rBb&JV~oCJUuW`*Qhwrc%Ado5PH@8ryYp_`LMiMG<_vg_v?#<
z%CHJbKm6?N#okog@^{Q(eB-Op>87VKxJ6^`BVlKx{m$UNgW($yHQ<z|3Q%3Tj&tey
z^M>2vIQ&J+9V6i|!mx(YbIPz7glL)dbyZl5E}kR<_y~?2;eIac?wrf)sDky#4oP=n
z-JAErT6S5Mt(dQYm&N-$d1|}$m2kBB3!d)1B6l~mLtUGQ=UsoM2pVXQ3ODF;;nqq#
z<rjFDIs~*zT>>^s();G`&PJV$Zhz#xQ(fBe*w6VEED#xRR^i|wMMw${=MC)(=s~KU
z+45LI(|3~fm;5Hk^x5V)O!^8n@)~2nhQ{1UPvVAx!56c)?keTLuTWB*x5l3$n=pL1
z{ATH59MSihoiMinFQ5Z!O)cM+AMN?Z>L9lYJU?V;;0*7IG~|CZ`u=RMHZIvUyce@n
zYx-uiSo1B#6%~9cf^B=Df-t{><NKJcj@1{`MNiNqV$B6jEm56c1L#G4g?^NIxqY1O
z=`jsIePPHq)#oo(lPLR|JBM>W^CBtwv?8{1-tj46Lxocn1%<ywVC;03*d;};D>fBA
zCjt?S3Lm&*Pv}<LP+AoS??}$<Ts;auESV)RXoi=<I(ScV#>ridc1lC@6!T+5NaS#a
z`;fkR?83bEfk0|4xc0)ef&(n6-WK!p*(I;?u!7a?hzbUBmA*a&B=-?UV;>k#eiIVf
zrE_|?m;LZ6D-x*)!(fC}H^p&=DQ@(vS&fK)gso5+SKNj^Wk|kmj>FF^EnJ;qpyYj_
zF<_&|@ZFb2Q>44_!|73VmCb`jx;>}<2SB>srcVBAg*g@%R)){&UmMzcX5dRN{9@>~
z&!^ouAy4Lal&$mJ%?K{!=OttX>mD2|66U1)`eiD2Hg~;Cc5mspY5zMjX>t>bZ`_A)
zv2zVS&kThyG<&Mei<A4Aa)#Z3c^xA9ZHK-1T{cP{OF1kRg%#iBaLcHW3Z+lqWIYkl
zA&v>&x#XurLKjd)@LiVW^PQ$Jr{^a!s5SX_JsfV#Bb6TRQ_LSUY{c!IxqBtmB;P&k
zMs1Y`8?70fFe!Yk@Fig({c`8iPi}Q3b|sYDrK9S*b0wA?uHMBa_yyy&vyPU=o^Dc+
zpQ62Y^<3xcdQBs)QNKYpd4{CqC0B4X-c8!C-(<sYN8O7+rPq=9ecdYfI>z9zvE;&7
zx!;!~5#n-qK|_h_3jHl|dgjtvlb)BjMa}q3#nkvy=EM!SE{i`Uz7=Uu#P*l3pdQ0q
z-$q}+O6@wZSs=AA;)KZGQj>?IR$7oqftA`LKindrsByb=Q@l9bq9gB-2*`>rz4TK#
zGxf#jM=oc#er=F{hyE#nUdINa!Y*V*`@XE43=o%m<0fm|QJL-QWVQrPZa#;1OC4x<
z_HLYjHK_r!&KHXyw~t+4nv=Yujza23$H@i04iGlP$c%fDUf3vKXz5OA8AzyfSUkKy
zBkH6<q5X4gFkks1`O#iUJ8B~Fm9<{Alvp|1O9b&j+hzH59ZiC3zxA0RZ|>yb_r~m#
zhuS9cu~%}M9%mmEPL}9Lm*XkGV!i^sJ4U}%UEnqQ(0-cx#4b%wWuBh9DDmYWxt|RR
z@0w=Ln~wvmh#k5xUQ^isCNspqNQWfTQE<t-Fsp+h14(WJH<1*>@R!X~8;edvWhOsH
z$VBh{xaBb&zKsk*?aw&vIPcz<Ao{UP_EJQ)m$}E(fn}xGiPC;$#Y3;&0WX}-_Q%4=
z7AgI=qS`NSOLDX1#e2Ug@0iB*n2O*Vai)D;=KGO;5ZGU>;5&aojRjMCSUQWcn5>sV
zbaaipD7|bakuV$C{B!$jM|&mP7sJ4oy1*CJj-&oz0whEYbajmT8Jze=dzceW&2H;=
zXA(K#I$18?N_>G8Gj+s2kO4N@fW}IDWiK#_Famg6@Q=7K4pD<1@hx%OTSf*z^0R{m
z9cS<38&&fdaYIJD9s?}jj<9A8{Z>4hNmxjS=hOd3+*?3Z*=}o~3j`H|Mnt+n8l+3Q
zyBkR*1*BU*8WbcX6+}Q9q$HJ;6zOh|?ymcO3;g%l`|NwqIeVWo?igz@WC5=4o9~S0
zdFFiIFMRGt)K}D1q1!dcQ_D3IiVD`2+Ig%K8~vSrtG>N)jOlAX5BdZmK5Df4%*+kD
zRAwq~rNy6jJ<i$Ud!xdK;gc*UEm?n!N}-{XS4kR6!hq8HU2lm=Zce#PdJn!x$`4^%
zgu{`w(WhJ_q%DIZk6LmV61W=KocFY4^{QnnaU~H8WuYq^RS70ccEdBE87)vb5QmkW
z@-O$jN1a$6n@B%^@jp<3UElTaO19nmtTudG_Fz@ij(;HRO*6sXJVEa8R}m?#)`Atm
z)K#Tpac{;@^QHKL#q3Oy&>t6v)9$UQY*lSS3l3Vg2rl24R<@Q7Wcn&Q-EHHy5wZ_u
z7Tmv3dmD3WzlbZCeB3M4(62M&XH3nc-+WA1^>#3&JrRF09B=x0O<U3pWW&e_%#WO2
zF4L?=tmeW|9+ep_9Kw$kQtFHZXd9x^g*rde=+?6^F`SfR`-B%N$CE>A(n|dpAs(^t
zRIMopS{Cq{A_ptui4^+;zKAd+8dy6+RP0@oTPNss#D8W1>g_G-pTd8e0W9eR=8N&k
z@e3cFJmF`mIf~7WkMA<<-t%$yK4fts6!>J4!Y<;L8~^B@R5XR1J5`y%if+No?f9Ps
znGNS<FRd0|IkIG_@aB}Iw9>L78L}Lv?Ikk*nAxqdE)gs@Vm4~FI{mt4OQ}F=oR@rz
z@zT$4ZK2|<o^<!*H`|`0Hy?t_70hC9kz*4ON_b04IAHnfWs~NYb<TNx5|nyYyjE<V
zjj^i0puy|erRbRwq3m<NN1RV7+``TzYv#jYW8S}1)xKb@=y;q}m#|Oo<NHP8gREr$
z+i%(lMJ%+%JscFwYYxj0%<&s)E65i|^It6HLaFG@LhH-+;@*{e3!XE+XAU9@B&|ay
z-=-BWkwhN$H@uejG%{YgyxL9O#VaG`$}KxvS$QUz@@Trj44@wVBm8!)?O2w^z)$NE
z5;<~#)u&`5gL(6XIUTNwFsI5d0C@i?*2I^^dUIIw{K3$;xA&LMI`ItqtZiYbs%OuJ
z>i~!>$nkT9AdQdhWzdb{H2=O@Pm(tvsDhdCLZDoFM;xTsv6s)FvPfTkJxm;0@(IlM
zuvG@3!L#urv<kTub&0LTTVGK>6$MNnZthajF)uC}^sN#~Rn9D|leaLh1<t$F=+V8U
z(;l)Yi^VLeV0reKxX<gGc6>x=sK{ibKtq>^L|<+6<Zr(q`++qOhPo*AGdWFy=Qb?b
z5`B-)LYPQsBu|^3dCQ$V!K>9PRj-`>{iTU1F0U~cC#Nrhcz-3kv81|jQoq218AZ4w
ztd0PsUg!J>cV=aLwxBXSFwMo+!%0d^(9J&@mod9wu`}f^tqMiCMW&cf5x=j?UM4Y_
zPV*hq7F)qnPu*%ay-I2kSQ)?Tfu8{X&n#)N%sTGaOcl;7RifDw?NpxS-1Ln53%^Cp
z-`z2}Rc|DaH|dINPF|3ua$?l_Se0JA&*HO@^@|5bzG}P@h|l}ZPO|zJ<w`f|BdmXB
z*m?3=IjEn%ToTMzG{CKkj=sL@ba+yHvdJPFUyh!PKOoYcpq4z)HONT=tD=UTEFXy>
z43*Q3?Ke=&JR0IopAdQ~8Ps2|VKea^q=Yo_cgnvNnZ7Tl)Ct4|Sn(d`*ecR{3sm=I
z<;VQC;6@lVpYM)tAvKScwZH<-<~&KK#~-&b;q9|-Og+=r)GnO@aA+f4CqC^Y{nTo)
zM?@%xYq4olab&Y5d)yHmhjrPXJC4eS#c!21jN*S%5I^qACY*@oMq}{4INUEE;On^r
z910m5Q*WQNR+3DMnC8>yRytkNaXR<wU1TENx6930@bbJsNqO2<Fyw&T!<F_>SQt}4
zG7FB+s7_Z!A&+`>nN_B7S*S0QiXjn5DxE5pU2h>Tv;s~VTSfI3?!K*yICHQf^x~1Q
zu<+}SnHQhxlkH}@!aT5CRABpOBkr-VBwA0NM}X>050@N2!T`14wno8+rl~jT4g^0x
zuv^41g!2uT%&4nkb8HMp7L_b!Tl)vm`ga^!HcVEr%<UBPr3S2$$@}JLo^qQ=CSRB6
zN@)n`)G4&;O|`(c8`)Hd7JMA_Q!%HA|BXrtB`meh9w%8mTt(rN`-i7bb}feQh;7da
ze=fvsi!Um&)2uS4ZXC>OF>q{)Ymz89C~NznE{eH>f41D7rI!DN%p^EE98%wIqQ=IN
zBOLx*D*4UoRy~p{)i3>fxHy<>TDw^D{3P|zunVztyp@RQgIeCQ`c~;pX6h~j(Lf9o
zd!=wzN|sN~&L2^4s~CqKc|5Yk;8^o=`<_@~a<l%WGlWZ7nlu6qEJu|w-m6e4*iecD
zLA=3~^)&;``+WA6M+vJ?E3WX@Lp@AtgIfrvQ`u~q6;A2n+71-3(FH0CuH_g;n)@kO
zKcc9Twyo*RZts)npGnUvr5So5-9V-lPSiv*U{FAx4s`OwSX<^2SnA2NO@PtB1a)Bh
zd+?N~QQ=Zx#cuNU7~u|!cCSTDPrkeyc4y*^NMqx-Xo+D-Ecl!oqO?DPCdIaRmjHht
z{kfmaC3f~c?2y-RD%4u(lcbP|e4KozUWfIjIa^<4u=zSMTc)Nb4XA{};|J0j-KJX|
z_pIrewumMwEGSj!)Cekz&6FluY|n86K-o8*NN`jqet>z_T(kf1fx7(RiF7s94*y7W
zT~Sir_6;=RH0^E#r}CyiiN+gMNqVe{9{_EfJReA){yMO@5o5_&WVrN@FM_4)kS_h#
zaEXa<`iR;a%HCeIDR@4mPsa=sf*iS-99|x`)EU^|3<8rGs&}6l_^IWgAHRpuJ7YZk
zlT7bbARVK*qSc)h;bes1HXW2;)-LluH&3cy8!fpY(O*8>ZTybRCMY%>)r853Aow60
zv2Y`FS{CM&Z>ZmwrzC|V=J_so0<kcDRALAB$=0!)je^6b%-WXG8IOfKDP6G2hJVuU
zb@nm^v`0?Qk8`N)+e(n8kn3_=GAEhr;v=}km_-sEfhPdO8t5@R=zhR*-!v4vcp3L#
z4u$8Aw*h~D_x7i?K?9u$;03p}Wag~hhf|KrU-S~+zvy(fD1j5on;Xc6<__8FUy+nE
zBz@ZlZHG{#$WZVQ3xj&?8Z`+7y}#L<>m@$&LGNZ@GJu!Xdp-q|=V*7YSI@2&ycy|w
z1EaSo!{1M7aICT!p)iq66kod-PRj@hTlm4g924iri>#UBGxy{4v?ed5o9R}4tpQ;f
zajqS^QC@Mz=2m^J*O{)s^X*4pYX!eetNPQ>Aq}_UbCSw)lvN*>S_Tt!J~&#fTwQn1
z$XVPTS>t6nz1>1R`}K2b1rx=_fxDx_km>*&G4aza+D+0I9xKK@J^4{zo26CO$Cmlf
zk_g*pTuZ6;S^C~l)r(GBF0bWW+bCAUJ_;$}o?IJ8Y{u7dh=m9%EpH+0^Oy<bELzw~
z={^@D9KOO(z@9b4!j{${U%0yP3KZ7LjE^w-xJ;(BGiT~si;TL$vR3r=X5Aqjcx+r}
z7WM{V-SHzgPb;md-OwI<ctNx+PW)o+DFfZJ&<7PYX~Y7JF*$>F^CONQ<zq01OU#6L
zZcn%Nbcm%chx1NNoSnGTN|K&3FFGLI2+j0AVg%+YaNTW?h-ak}D#j*PXVk!Cr;FP;
zo4O$WMvP>*MgM@+n#yakq<g-)>DkA%m66nA+QtD5!Fd0YHyXOlF6qYj)ngU44Nd@Q
zbz}Mj%pIMLgddtrM>6gN+itp@4E!GW;@hw<tm|eygU$P7sJMuWVQ&&Evo8*m;F$&Y
zk_DsrRGqwL3~JK+cTptbm6+k8=6Q%=TmgsSk(t?<bUfE6>_c#iOi=3UHqLL@dU7<_
zv_|ZaZ92t8s27|_!|wUD8j<M0?p0QjztI{H-+iW&N%hKc&7?&wm#t{Rs-QpBD=UeI
z&>JP#yD_e$$g71hu8v9A?cy+eQ1Qc%1LNrNXJ2)M9~wu$F*Lw=>c~@#*@t8OmMo52
ztZ{z9(Q^{DzmTP@<@*lG7mMRt_pb%MRXLbdV02=y{7e~Y-1gq<CMs%~<-?uI)h_o8
zUci~YpS~57DO#KK%l~BNXy6efa%xR6VL+%?JOKf;6)i0E%tr@6w-^zfI~&C%9`(%e
zv%aIX^Yi#1QbO#BaUjwc0dK)`djX=B#@C;beP29NNmqy~!}h6s2oYW%q%oj30eC$c
z8gLhKDafmAfmiM2!&;~zMdA!npxRRq3w2Y9(~@}{P*v&@LhGDX)#t=VWm+R}+GD=A
z6Ka!N#>y7IG9{2gGBP&qDV8Bl;yc@&OR%<#BePEEi%J^}TpHN0PO5p{V|p64)JrZ=
zMxUi!L|~y&@Ur9L;-Qo|VP<DSsA<l?*RVutKI)Krj6UCy!9L|*l&|T`o#H%2{o>>A
z=Z=0scBnnU2#g>qUx_C5<f$GjVjtnKyt#EjsF&KE5XiJZuV^Dj#6}Rlvb2LUYa=%l
z7)}E_LC+WaJ${1r<cyg2ZNU=;jWil*9J(Z$Yl3{wv6XT-NVs?&JR^TdF80AAm^Hsd
zXl7=n@VH<tzG&CHs`o&Y*iLvYF?l4-Z7E8A2istS!9N4J&gwZ$Tdm?3X17PSVIfT+
zJmD;0!+O!P1O55hHI0N(Ckp`=|6`n`u11rsm|i-s$(O_&r|YU*4=+v~eoy98hTyt5
z-Idp`_LthhHD3Hc?sUYNqmR7tVhKi?*K8mhl?$r0-e}bU@zf5n##BpqUCu#ccB7yI
zQRaEI*$S#yR7f4w{zkx8oZO}tb`~XEHCno5XL<}&qy{y-JNSW7QCW`Nv2y6x*kKrK
zDJf<&7Mu=4I!;f#hreDUzevqYFL>tsw&hi_JG0}Ka!x_{##kZabw>;H{_3sz56jvw
zs493uY+YHWODb9o4e4OKpH(~}W=z_tY*AHI&d>dnXp(rxo@Dz|Z~~;wWxtR#ex@97
z%TV}2|Nh>*)hdsNY~^H)7P;x&QT>?%w;#6NG)43ZRp*Y&q9*d@XLs&d53UV`GsWf?
zehxR4wX<-(*v}(DGT~>+LySt{J~6VYNihKYPD!qX<$!=cU$Q=ym@(LvcEZ8n*~ERl
z#6IU^A!Tn5#?U0M@iMH?fwP58(ZfS??F*+o#c~g=z-?Q;Ygzz&PSB0JGPW#I&dr7M
z9?%f~F68eSD*lBr-}c^i^j_;mbDjAQm&pA&+g$TJ`>j>?XS*(Yc>S4<Y`a#&eR&3V
z@OCyAfQ}nwLY@hQ5G`z!oFSeQcZ4HP1|h!A7L-=-vcY-}lSLR>Yx@4`@(qgjoS^!;
zY52@WLtMuT;-;oR{b5wFO-CW!o?S99UMCx*=4y)U|DdL_`+MwOrTxODlgoabsNvDF
z<Nd8~CX@+T-M^i$ONOj+$sX}A5Qfa;Unk@#MB^#9_I>>tJy7mO9WRmP0JWrf{!G)P
zcd5*c-L);uC~Ad;FYWy+oFt9&Y>TUP6XRtnZH3ITiChn2^l6N76_Oqh^vo<ty%K(9
zP;NrhIB1fvmIh05!SO~UDe8U~LGb8$q=I0~NmPKj#9^U-!Mc3)J6@ut@BNnOnM3?8
zhv?5#GK3>K@ZNB`bCmaD+PCyLEZQ9%%gqZ~m`lgq8)h>Vy+{44Zq&EN%4Kl^uo|bk
z8nzSaWWlbc-SHUN-<4gkwIrJY<&y(m$NPVY7L-8s_a91?|NStFE93BZ?c({yw`&lZ
z<f7cC{P?psj*QfT@nhG^X>R_75A5dOHb(MB+sa9UijtE(ve;{@&UQ_v9=4Rk6_9K%
z$c=q<z+F<#6z%GG_nHn++Hr!3IzmU>@{I|xr;<0nmza2&-672-6m%BSngxJTsQJsY
zn9>x!XUcNM?du=a9!Dhy3O4r60_wxHMdwZTP@22)v}@eG&D}Ki&XOXR24i_D|M{`*
zy$zPQ{BgyU&KWHdfq0U0{npo1r4o}7<SUi*4_AJGiXTIAe*LT4O4)WU?nS6OW@ZPA
z#DZ)aL8<=vInmmBHKHledKV}9$TQD#My(nQ>hp^Ye&2ebW&-U;VUK%Wy3)eheSX}B
z9LW$9Uf2^&vK<mG9n1Hz58`tY)i(}MlK{aQ_?6}CLM|>S?|e1kX08d@)J5A1s4WRi
zD47?ozv8Utv7V0RrMji9IUC3cy~FHoCvGH5Q%BJBM@QTYDnI7#Pyj82mtv|p{@GaK
zyl+GK-*_`%VQnoB<XXg8ZU~WYE|w*?t@KidD>ZYB0>c#2$@@OMYD*kO_<$1UjQ5U?
zHPv9@GpD%>6boBWn2;At)H}BiOxekXEj{@pjrU4GZ-nI0?$V7UptIHrcvLTOW5SiT
zc!=}gsyEX;NMeIS7at)&xj3Fq$8$j6N|HQA&_omsMF$%N6Pc>%ID;=F5_{@-tV(|c
z@ANMVybF8v-hH32UdHpf)*ii1@%^tao(7CfbED(q2Rh&~PVWxyXclkd21P5(GTD94
z<$4wyca9X1%oiTZw5N`VK|N?=03Kb8QdL}BitXbt-x0yli9Z|=5fRb+&H)!kX&)dP
z^#kfiyolyKi{ZT@9G}VG<9CI=4Nz-L)Lp>LyA2w<YEJBS2704eXA92x4b<fk%W5VF
zwh#u+_XGRetrOT)?OUU0)9sCh*S*i1I&AC8+tfC7tLAh}3c2xKY;CK#T%>19S07{a
zvzVUJXg$4)6^K~)L^^|3>6U6jVG$N&1QPoN;jvL~P0}}MMtCL<mJdY~MCb7lJ-m)y
z(WOIzrB5B!&xf#3R}>VN_I&T>3#(%Djkaw1S52VYPx)}li>HCMC=0C++~TMFa1R1b
z)PVjTW)-i@q67(>ujK)5)cpv|4ZJW<$m7cgV}bA8bykXg2g}D~*wd`7=j{u|Mn;?M
zuR7zmI-MmGso3vzoMMx57=5xWHc{0;5=dsbQL@0GoKR|^Ogt-&>eSz~aspaiub&3|
zTv-kI>W-G`!GbTG5MCF8-4QvzQ}<=Xh!%GH$Z4?|M}Aho1wEXpPA{uV?-91=xn}82
zT4f52lVm>6d!0OcUqVWz+7%SbRPCyUW<E|0Fx8n+-n-qScXK0lFhJ%_*5rceUPhhQ
z5ynz)#$H0s8${qq%B6hWF^DmX9YcN)szLIN$1lf0;Np<8peWG1{y~csLzWD)qR;)N
zQNe_w_?^zzsIJYmF+u4LG>|z+5Nd9^ki&EqPDKk)B<~-bW=PWO?uWL#c`%qC64gCQ
z9P}P;+m^%OOQii0Zd`<-*W4(VfA0WUH-g6@7K-1gAP9)B2w!Q*L6HL$B4|n6&O%2@
zNi$!~wg}4QBXHPXP@tSp$%s3Oz1N=I|6F*yRPpAi;^=YTJ&m){u>(=qy)9#7<Cxx0
z2ZSzeWGNK`jPG)CdE48u5V&e5-@lpNTxssKh{q$26zhD5)1NA#5dV_cTRZ)n&ul31
z>B>~&%;EJLsKg>CL}&f`A~*KG0oXSBr1<m<<5%hHg3cF8Fw|8G74YTQ-U(cDE%hc%
z;NB!xE%6)jn~2UD`7LW=bQrr7sCWsYB-WxhFG(RQVKO5iXdxE9QA)0I!Mh!IvD}0G
z^|I^1vwGR-lsFuY|BH)&PG?CxHwN57zV$$Y;o7w9z=OLo8_0O``F9!cffPDF@K_Wp
zGcz`4T=(u+u^oRH@m|@f?>R9G2P0}EF~9h)k5U)}R^HzWGp`AH5u`VQBV)F{<Y=s!
zc8fG(*<1ahka{!^x}%Pwk2XH;>w%z~YkSwQrrCo=Oy*i_VpASz`#T#(f6Sm=hG|SC
zr_yq~up^bFng6zbNE^wJ6sK-z=Pr8}$dVr%M(-_m$G&{=YIkXKRAI7muEuo*m4M&w
z!CC^Ry<71{)>f+FQd{PQU1tyNHzE;s%^SDsuhYc`E-AzI(eEe1F~D5_2#y(pKgKbx
zB*G-%m>N@372GX?0@4)U^l;B-C2I<W*uH1UU!Yc$e4lCeHwcE;+rm4DtDK>4f<ZEX
zUOsf-&-5^6JRt+Z`-$@d>Q_F6-g91s70`BfB+GY2Lbc`XR{BTO7prs6It;1_styPh
z6&~EXrdps&<Y=KPw(@BY<H3XF7ab@nwT;PHH1oCS^a0hC_G{u+qm?(RF1X)U>zA3Z
z?7ElUei+9T+DbRbyq9AeGuVXEG|pQp^6k_$sX6j0pwWm0R7bv8jKJpG-+r;&SmX23
zEV_Pi>aG~9Q)@;0C`*q}#`_$HcYn1ZLhk}%jBQdC{08em_rjM+r7#y|t)fSF7ddv_
z&A%LP`_>Hzs1)9t+5PNTHywzRV>i>MWxATH#ri>bSeZuSGt$T-+n|ElGonQ%ePtt#
zER}}kN8^XSUvAdpb6f-<h)ilYBy()>_hmove3*C-;cy{u6g|rJbk8CV^?u(0&V0-0
z#kf$+E9-uDkf0lfru{zV?reCSqRa}s%Wr)6nh8yvF^Q5gU+E>tAJQ3L=A{rc@j3UQ
zMxd_?u>79hZSZBjy9XjlBt<BqUAjT;C#hbuiXkDUub(}wYm^r{*c!v}$x)*Tx4>zu
z=+J0CXFxWL(;S8~E5xYFBvDz&O?wpr6d(kcSK74T$~Z5m>Qy2?&N$#%xT<?FIyM$F
z^Y_7yb4dzq$5(t_#&r}bxy0bg&{+PG(AWBPrzQm3^Qh&P)B{pQ5AXI38n|Zj#}??{
zAa&>Y+8A7rCbt%w+&|j+VBlM0k4Vx2iM%aNW<|3>Nv6D_=**!^GoNU##^n8wJns#q
z?*sWt$UQwh%iU!^<~s=^*h3d9z`oR!I`BlnU;3>-Z<~27f7v*@f%emK>iO#Mg{rvI
zi&C2b^g7$&eEap@8m#NP%VvYBp|I1v)25K;gx=s_1N@_%x#EyKF_?hc47Rr8QhGBU
zcZDENsjJ)9y&t{iJ-I3hdlNcm`f3BgVKS|w;|AUmcT0`W?19vvEdEra5hTzc)@Slj
zh=pb^Rwbbdb_*U$NFboL7vbH5*F#7~He<~-XMyO6RCl8^=>2}uzr*B39&d4wfZ1r5
z^MnX${LIt6Z1Ub_z=!M%9@PY)cCM*=?9^~Am;${5SpJ5MH8&fyEYHP2DWnrl86Pb6
z1>l~odA)3XZ{fMsaIK6rqx=xzxtYOy-{9*hL+6H}Qv8b_xSE@@x5|%0!4NPT;c&58
znT0JKtm+nrYsd3P`5L#&9FE-^Zhe%-TPSod_p+Vc0MjY%WRab8brO=2K_lv56_`O&
zvY)R}swI6AZ|d_qH}9#<BF*w8h55yO2K?C?(rd~4IGGzEDlYt$K)9HpnE1q0YeD(^
z;$*PEX+<^^#&@=I6ffXj%ad1WAgiumKjA#ZtiO8n%FVW;kh7=Em0SUx3p|VXG9gYF
z@EqL6W>}r@mW+<_=@O!Wt?0st(G(DdT72+QpveUQ#0JV6|K{pIW-{|S7m$H<y%ivQ
zFp&Rpb5(1cF+BE6=T^PVtf>e*8_|FOp@rS(d%0i&WiK$=k_bbds?TRKmw;BT8_YXs
zt{?w|OsZ*fcP4#ps0MBPq|O>wx3v(bEmpWvx#^9dEhBbE9PT?d)8}--4K3jL?1Q!H
z)&^_85Y*^ueZUxv;l{b2W|0}ce>|S|70f7Go|T2Ij})<gR;3C2`4b&vFx(kcEtzLd
zoyU`;6u%B-l3?@@IwLF4E#YCP&=|yJDO7MSeV6MR<P(83m7qqKrZ#)r8c)iPO2{Aa
z&Y@0XAq;QxEVuhLpDSy*W~g{9rb9s-uhEnxKf%7^qtxY?_H?Jcwh)gR=Sd-Yt)rZA
zl=g{R^=T0Rk2VIXn9=Nn)is`)%Mw|}<zymmF68lUj_9Q4&RCr}qWsE`ORp|-*zkI>
zmRMLO;ATscz>&4aF=@^o7U30CjM3RgH7R>?6UTstfwBw(N<+diUlt`1G<kXVDWG~Q
zRNsLZC727lRe!FCya4B*!3y;q-3I1}n-0i3X*S`~k~p#7(_cP?H{CFdI3Q8j7n~>$
zM4spM^k(w@(Ar3nY=T8bJ$>K+=dDv=5InIIxhf@vVf#yA-0|$TZ`u+3vBxTG7^;WL
zxIw0I9`X9wYIo>3YqocuIV+wfwDv%KZDZWqXMpM8+fis-{~%|+rq8NYNtPflrccw4
z3gP|IYM>#Cf{KhmK<}l3phH_C9Z-CDT!P|s)TQ_34wm4FvZrVNfdRSq#Mp9o@d7F0
z$gO(0mBHq~^vNQgGY$@pdv<mTuPLOm+O;(~o(^PF%cltBRPU<SX>7I0tP$?xI^Z}&
z)QO@J*9i7~UJF(+@2PfB$Qc~N@KJdc02H}^)#e(vv+G?+RfY#&pI-Djv%MitJo~{0
zkm>KkwOy&3W!&M%-~65?Rk=uU*SPH%@aE1O{2oK~JE87)(vt7}^K8$#kApap&{y2i
z(yj4OD?GJ8*Pw<Up!UAVEJlX1x*KV*)eW3&MnTYK-ZHj@qJg=@XAZ4D6Sj(`W{3&_
zz}JUJ9jB+^UWYeT%skDJYwRndva~9bJ_*CuDHnyE7hVCT!K!?MSsjXX!0SB>B|Z?W
z%uZhd8zr>*Iv~d8^HHuaQa#7WfsDpXG?UpZD62Mi`-&Xd!tVFsl9H0DuNlwIC}!(h
zvPYyxd(QF_@VFsbS5YQmTe-95<iY5X=0N%>$M0484vxpe35_dIwzWQXB`r4VGU@-K
z7AL^vHuH8{J2*|O(536qUTueK(0eevwcO;8LaS7z=6}KYd7z@k&0@n{Wa9BjtQ>)p
zEkrgE3k)j(mi;J|+?K!QEO_p3mny4a;4A^#r!eSoYHl%BDv=fo9JfL?R4`fuHO6$u
zjKsCrAM0)T+L)ilb&8;_2>%xf&4t!Fwem8KHIaDxR3jX=b8=iFdl@jREPL0a)r<)d
zboaeiznC70@XX<z#I~?pD%~Bj@WALxMl2Lm_2mX&X{ZJ{_|GiB>&G)#%qKg}2j?Q1
z7cHnJKi(qDOJj>=8wIfA3c*WsXT|UvC@}8G`5-bQ8;UR)QYk=bi^7l**t}ECwksC;
zF+EtH*eaqwZ9$2ibwL*&HA~Lv4gL$mlYDR0?7rdFQcKluUr^F9uy=Ro^z4$Wo}=6y
zbyV?oqSVoDiw5|qX|&)#`2@Im@@QE-K$(@uMjLg3KPv|xm#+Qv_1v@%99Zto>`D^p
z#Whg#F2gZ5?Gm{IQ6(w0*79OTXJo_nXp2-zGlNPeLX1w{?4=*rKIEU(zSj@By;nT1
zmd`9ugWX$El3a?-lnfQ}@B}wBm6_pz_<loMD`$kKt2<elHuG_yKN2~Y<S84H(6?`G
z?vXBfr)=k*t^299KUxWtHu7~NM?=-geoGOsJ_>$367+B(p37VcvPjg;c)iC_{z?w_
zZ`CLC6v0O{?k9kTq{77+-;+#vcW!vG9q3BrhmU8pg3_u2<JdknU5D)X7?BDztcFaG
z7hk}C4DqJQcA=}x^PGAFNLbI0SCLQMf8TW4;PvVBUMpPLZ<;I0Qe&T{81$2fNY^_+
zk}9{W(QZxUEbpDJJ+cXQbF(OU<;ZNei(Z<S2RmJ`<o~%dAF=)swMQeU6<|g65nS4M
z;`T-F?EN#NE<_Ij%ar4tvQn8hfDMANh#hnx2IQ%SIBhd4-BcCqXwDDVSNgE16;jm_
zP?t|`>976zmOnb%!a}2#UUYoSTW}y;E^nRus{C!hI2b$&{=R3SRuY1Xh2@t)=dEVo
zaDZg40BD3t=t!BBa`#g3ciw|_iNRXGem<&jyjN6vWMe`r#o=oYl3Bg5mnBr4hnW-~
zY$8oP&Ymk-6!L8&a9p4VrkTTf??aKAO^tDMy6t~&6yivar_iT%H1rwZ299k>eFJ6k
zddW)z|8g_UzcMi3RYP;PeR=`cU}gu1$-cb+KCU+Q;AyZEfYf2fn^>#7&o$Tdw*r10
znvF;R&{v#6J=>S3g`+|prd~DF7PD~|FKC|ui$Yza$h=d>U%{Lr=}VQ-H(Aht>Xt{f
z(afY0I5PBC;{wL>1rV21Oo51POzqfaas%l6r#0rOzw~eZ5`J4&vo1O=mT`<iP4Xw4
zU)*U|fee@2`RuBgI1-S$-0nHiipzsl+br?T&uNU(8Nb?<OrQvskuS>>iX;@c2>|<x
z;qK(?Xhfpvx@!v-y|x0W{vq?ymA&jFBcPN8v3^ZLLVg$*Gz1491eouAK5l%U+L19h
zCrE}ucbBYwv4C$|d*2oa9JAe$kgW_U;GhNnSq-ZOl(tC_qJf}mwT)cA1gKkl0_2<X
za1;n2%NKF1OhnG5%@8*WTcE72j#UWXEjJz%{C$4RoA6x%C}~U4%~_r`I6h2b`a<LC
zdVMZ6Uu%PWJ-^OQib(WK#|-ulntSjKtnX?9qg^{vhIu(O-q1W5C2sTZA9{$SF}ku|
zbCRW4o^iZ=l~<DnvOSVxEyBTkV`K_ffV$ps)-0g1gqHWZg#dQ!EdrJw-ODh2LMZ5X
zoq^{-x#}y=*-$hKfI1=&^k<Y=^zuy$xb24d{iii84F9W#4Yh)Ao3*MH98Ev;mB1z2
z;&KqD__27J$Q;yOj&yjs&0ru7C#l|)0I}(t!b$1B<ZLcj*7ZLRik|EkSOksNorPi3
zM$ripb9rE|xl^>3`kfqz_IyVkd%&pCMR2qGjhyugC`^c2A?0|#G8-1uLN~V-OE%XI
zWMb_64Zm8iVfw#%r9DsMKvd@1Du8gfqqVcyl!PpOP8o9V+YEQ_s!L0AbDC(WKbCjE
zO$Ps`5*k*z1k$Q<T%?2e2%3%MdQ8N%Cmh<3J}<tIYrW@VJ60XAEXR{I>u5E8XQMW`
zP<&iFN&bN~puYuo?th*buiT>kct>VhPV%buJd=+_jJc#ChRTQ<iwq)t5jAbA4P>85
zW??6`=FGGSqRAYo2EieTe(+L03G^TO0_=a?->QT6N2Zj9P6tuh8|!quloVd@d#)oU
zypViN@JarD_*eEEiwE+rVAW=48|cE%PTAd;k*fLK5N#&D=2h<kXtV_&(%Lo{oxvE3
zqlR6a52Ef8^0htTr>8b^{alb0oE4tF()Z5c>9G+amM!wsWoGqSR-D0}>JK#=l^Wc-
zYjV4uEPsA%oI5~sci4OLrhE!_AV5Koh=Qusc?I7pH9i`8(WhSQUVvj|faE2u@}5;9
znOg=#lPi+^)p&3{d|JowbM;i%TvUC-H3^JTi)$~_)8BBUu_|M?Ef%BUUuqmks32i&
zTV%u4HNNvOI6)H!<N@?3-we<>z;O^JGdK7xDg#)O01!p8p`xtgb%lyZ1V;At+>6XF
zgkC(G#LQO7u;-TS8?VY5pP?M9@-}#;1B4Cw_@nHRjjh@HZ$I~Fo>iLlha4LHx{rh$
zJW1Bgh=;i8ccX_!qpFgpkZX%mz<DbTog<*)nfs5Vz@Rl5gu~@M{H%WZ=|__WUWeCR
z?dQKFMw_C}EObwH3Ik<ibtL@31xjrGsha1w4uU39aZGbdI6;`Y+%m5&dM&z7V6`9y
zo%eWF#KG1OM##|0Dkh@K$@*DLDVcl((Xlx3BWuOc{G%W=Dr3+OYFlAdxVOK`DONWC
z=$LV8Jh=)?UUq~a6d-u?n@Ov2o8RbJQgz$wQ2n3bnW0|I;!4;4_+CQpp=r=C*Ch&7
zSs$cos3y3-+QRtP!#U`wghG;V4x{JWdf_m_^99SN6BR_lFZ~EnsXh+*HnbS_#;z@&
z#f_9VZgS>bq`MsqPJRQDPnNa#o#nu;HSM7$?3Jk#Q@X9QUorOu?U|+d3>rU&-vK7_
zu${p^Ei?)rKg^f6ieX1%DP%%6#1Kpqqt>l-(|b1y#EYM~PYA1yx=x))1rm?)j*oZ1
zTya%_fLQTIss6!%i&|vcJNU-^8Xz1t>Yr3Y`kl=H{kuY&AAA&2m=<9A0cq-5U}TzS
z<Y0eMqniPj<*i%u-IkoSug7?+Sz+c~dWsvRR=Q}j5;fN40{CSsuXb>m1f#1?Cv`7^
zB@u?aEvDOLK_@wi(HIm4Br@QA$Lf0?bSt(8G|Zm4wJ3Hk;Pt~-lzemZyJ@3Imp{dk
zJ@rVuFW+l8P4=xO<Kl#V<vGyV0l+->`XlK*0V*GdY<4^ig!m=FGHEg@|0RN!ycM5K
z$8C+f(TP7GG{0^7n%%*SLM{R6jYj^Hix1?70L-YdhTGP;Z4u116WYX#z3TLS0+Mc?
zzI&Cof@-!VYQXlQ$Zo?^0&cHc;FelOCeIZ|8B+K=r4eH(VWC(N2Fquk2<zYYousQI
z`uF-;<F_UR2CY~kxQygh#<MK)n%?SvSmRS5KxoT3xx#6aCf*C?ByMAHq-j%rlu5iU
z{OjysQ>n@eOvUP4pIIzwxbZ=*<dxIxkuaE~*mZN@Dzlo*h@f7W$Wy`Z%Tc?l#b*8;
z2#%}c-Zy*AyEQT<4x8~~yCov5wDRo7L5AU}<$3IBee%^*GJ0f>c4XT-dM^~vU%~xg
zZdNc$@v*ZAI5VOzD9oNY;QhZ9_velitfFf}Id`rmQGe3K_~60iw<#Z5L26+Lc@n{O
zpP_W*hUQD8MDd;)tfbqo#UbeX_e|g$`y=><3@~|0Hgc#?SN{?mS&GVMGiUh4LU}UZ
z8x$3un&Vd@@A`%fg`1O3noRf%KE59jjfK(AXr}Z%5Uh`77bFomejyJY;zeWxGq_!!
z*_9&E8&QzuaO63E0QH2%$7&N!_&<3Zg-fu<QNlLP7hzwkIV1^nk`Sw%e&|xjMKwMo
z2BS-$%OtuuVLJm<OrlQjD<!8&0PB-Suxn@>Z2@Pl3RbEI^Y`=$-=Bcolc@IW5dZ<v
ztnnTk+eiTwt9Hc~d^zRjft>5N*wpTnU64C^-W}p3);rv|vi<+Ik+ym`tcN3{dTYOf
zzS$Vj<JPZd?zLh0ggU%y<P`03$9L@M)<LX3X**N`HNNv<3O$JTGm8l_*>@}w;RaRW
zI35C9{BaJkENCo21z_x7Jdmg$=ht44(Am#Qz1x91C43A+N`ArVfm6|VCH=iArYQAB
zxi)7L&6Do?*$uUvCL|-}R#q{u3cy%)>yiWR&x~%8a>}V6#;?)=MR1BYGBQ%E6w-lG
ze<kNmv|W~dWp(==_S3sS@Y5C}>;_#o?&S_G0IypCFVQ5DVR!>ts~?&L;5PI?^f+%T
z_y7;#?Uni<_?t+Vpz%pEs{}mg5ik`&3@-@70pt#tRHiTAzv`p;ntmA?(mXBNv$YyJ
z#T~F7Ns|sQBM<4dPvp$?OJQ;rJ$~^_kLtz6w`-70Z_s`5?TIW#fpy8N-@WN<QPeVK
zxZUco^A}^1Ku2$wuZVacs$coaEZOa|YexzXLQH#{BVBCy4!Yl+`^UB4HFTNEp1o4?
zGjO)FQh1Q3eS$yXYWwn+m}I|9ZSwk;6CltO0f|3}+Z|!hW<vB^wX5RH5gCorDmTa-
z5sP%xNvjZbdYdq+kHNr`9re6rpmTG5G=K36D5lkYCvxnn;|Xdkj^Cf={7i55ehIN1
z{q`8PDtqa|4!Y%ae#-N~9b8@<UtTb&Ait(fLr<XRZ8I7?;g^zfNN2BG;(`jMXH7mm
z3(~~)xvNA~5d9Ih$}W5z(o66VZb=^BOZtz_>eFp-G<QjL3~q?S)h}{@semGTbLA~J
z#D}1ch%iW}xQNid<KrN>Uit^FCy8NEC+gSQ;|%6cHs)Qd({wiesOBy)7y115NkUXm
zcxb~g*o!i=s}(eoDg6#pi`888yt)ztlOUJ&6H)T1ClOg)ncm6F?_iZ%DKWRrKRmAG
zBTE13dLpQ5*(bloX*x#JSD-gO%XK~>6ttm{uh%l)YS|{Jk|`Yw^e>tfeph>U(s6qM
zk%`oxm^vF({o~aJXQcvlcJI`Dh3$0MDpsx+?pwsd$ryhWfENz|paBL5`d>7_eFkO}
zsGS4hS=oHs$he<%i|tNW{La&u_6w~Gs<rxM77XGMCz@;J9usji$~4}Fh`r1?RR`<o
z!sD^h-O5d&M$;N9=-3n~m<v@PT%0<IiMT?t)bP;>2*bZ%#JovUtgTOBzSMW4ZYn;G
zLQ*ycs=$M9MflKy+)o0k!1nFSx$9FNW-|DjQ0~4}FRq!{0T*0AI>!d_REZA$Az5Dy
zxNLh~4YZd7zJJ44#&EN0wg^DntV7{v9&BsmIl<?JMt3I?xsXj|?ll}L*^)cEpyr%V
z%O^L5@=w;+oE*dq0^x5uQZ4i~nb>wc^1^gS*~UmHQ30Bg8^f{NL+N|&T@5#Vdy^2K
zPxbxkktMqk{%y8*@vY7!W}5uJz9TsjDyr*1b5YMcJ--~fe8RqUz0~r3<Br&CdM#xF
zZYN9`jdKe}@42b--+iB44I6$j^GbNI`?Gl9-l~7aG|fi+_&<zdz>p~>iyW!JB*wa;
z5k8cVZt}siR`$P~wGh(ZMb`IVWo{~O2rVzw=HCQ04*gztN(dM~(vWkV{0MbRoTh0N
zk)1rbdBI0cVgw~sq95!Nt6!H?D!RjZcWtri+x_7PSgL_8Haus_gEgKX)PrknM~;S~
z&~-8+f_e*W^pSrDSCN3r(18EhffOFtu5eWEeg%bmdOD=04zt-@yl2dZN-n0@5MHbe
zJveiB5^F2OUO;Nns)Cv}I`MZ#gAik$$h0&9*!zMC-C?$j4A$~VDtr#7o#c@WRWcjv
z;AWf~n$T)Le%nV8wvQqyMYiv5!!9RSs36AcHT|#Woco>CNR1nl01Q9hY-J(fvL^s@
z-Xhy`KNOh_h~~PZZ>v3gEAmG8sPlFZn=@#S7?vyH6_WzFF*aNZ;L1Y`UkUEw6D5uX
zsrmJ`y^5NrlrK{nNkyV>ehkktO8MdN32sXx$d<SU|AsB$u?C6BHI%<6&uC#M&Ytmv
zAemkO^&{6dJWBs-t}WuFY$8db1T93Q&i~!Vfd*82YC6;_e{6*H$B|yiT{=?S5G^>V
z63(J;jImDn!!MlyTskeRs#I|(2qHJ&bqb{w?<~a2@hDID%&Oj%sQ7m~_l}*tLGMJ5
z*bH=~rY?ZHt>}>dm+iy=AAAMq{-=C&t|y^GX{-Xc8-VfU_in*kiclpI1jXquz5hKL
zge5EgV9CGR#dNU_dTn(p4Xe;~r-JMDv=sf1Q1;){sqTlv2_Nv~A)S}!<Ee;+-h+YA
zZt_DxsKyNZV~ugWDzg8Ip2++FGKPx`h`n;8vnoMk!;5^h60k{q(;E@{^==*pxVa+-
zI5+wk3RQzvOQ<hJA1O!<7fIg0M;xp^?zQP&@>E%94Cx0hEEA~jh8B>c#~S?eWxSB7
z2_)HHzDxPz=bfe3=Bwbre$3D(lOPBJASX2mnr8!Xf|v6aH8(ep=pw5x6XGEoCcF>@
zUlt<mf{qxt6V=ZFZ%Fh&czz6`>=T%Z*0eb){fB+`im?6I_udC}RrdTgOxnTksqI>S
zQXoDf|9t5Dy(0qdh@h25;dxv5|7t;-e**#UzM~N|R&*}mgBVrIKK;Kaa{it3{Qve@
zVpBZ<l6+lB7*gBw`vr}%Z||lWP(9?xl!jQ`J+MseI;j7;u=f9ck0O8eGfL6Wr`=*j
z{XH%C;~fo_K%K0rl|0-_=%LI~PVld*D1R3*;XSE{F)YiCklue9Sikgb7X5%kTZ)Fu
z^u9fK_BHr$lIXx25o8wq*O4S7$gM?9KhnJIMk-mrzKoU`C^eVg`(M18!oOY353lsx
zs2`=LmKRc8Nbf{ZANaLocGI%S-Af^yZa7Xb97uu#y2~xo+XFBEm!ga17<7xoljA9&
zdIVBxt}R1Xxm*83U&P*)<wW#915}R?(U^3_Wfx>6qnMo2!tq+K!M8;bw9>tFfM<b4
z;3g`tg^e3fu!GlqXfI5|+mK-RwAl+NwUG5+O(XoHM<5LSi7;rte{Cta3MTIe_<kxk
zj0zrGyfmj(wO44NSuew`x&4ljt`EzB^vdV;Z&R`0V{wu2ytdl&@`*8obinIpH28S_
zB?l|`H*l(Q`cJdVKe_+E6-XcbKZ<JGCj7vKZ>lxQDDif1$buTb?LY=0geeR-u;SNd
zwt~-ng7@42EzPC&jF5vO=osRtadm&8Z1~???vj2a4$5P57FG%1TbsndNPBt6|Cqyn
zT;}jP)G&A#K^%<g0&x~&fYt#{(!dP{fO};`g6@<VuBll5=|BA^@Bf>>L21)c=pWLi
z$5p?k;2Jr6*)T5ag}-AP!DR$UK87Y6Zo_9VJD@T&Hu6tvuJLXr%qonB1yZFiz@JD>
zYX4(>NWH2L{{qcNNQYOma^Q0AGC%81{`1C?zZEC=hYSB7ez?R{q)JiU?vB`e;(5mV
z1Ohvc5xs<=auM)%&J6mA0<Q4=_Va_j7?4ftZ^8qI<2#RO1mqZyFb2Y~BLM#I1qdSB
ztO3sjd!<q|Z%angKk=FmotG%4_+U@n@f7-XbVH;xV*ciQk<5NAF@D5};kiVq^D$Z+
zurD416EkdzWUCt;3Hb&&4UMF$-l@u|f^ONxuAKNnko14u{PenNe*VuCfiqVFk3X{j
zzN>TyF7>yCXcD%9dA==fn@N0nkv%UT-va?jlKPvvHLf>Wy2L)0@VH^c7x!{PA_aba
zewy-od$FJcxP@4JTi@Nbv%PpSZ+1EOCzvKJ3dXW2$*fSt;FcBzo_J~mpY5RkAI1qd
zjOh8vqE8SX$`00c!D}D*rg<0&7xnYG4pZGa!VHeXGlIgy>=lZ$G#EW$whjWVVr4*Z
zICS~-5sy2<M?+u)U^x3~7EY2D14Vb4AE`*gmWKS5nPecJ@uYNP4>vYEErNUkiYavg
zyxa0WrRYGSY+^+?YuD;lkgUi1^+|N(E$wUiXPA}I=J2yJm}z_iBaP7=HxTkCYb_}+
zLY8FD@wr^vIkABJ0XHek>B^*2!$?H)Q-QbkG|B(-q%r@msrXAz42Cv0dQ4rG{{LZ4
z*pGqHn+>E>D5hL^>f5}*11P!v5t0|zDN<rrFm;A4v~_WM`QbxkLk)kIR0ztYfLV~j
zS~`lQjP_%ydic;MIO-(^<hG-Ve~BZm${=WV*oa@NbTGLz&^2Fb*m3^enk=ATu>~c+
zLAsspQUX4P2#x)CT7vo0KMFTy;^VoFfQs^qLRPE4rcFtwntP!WO}M6F5iUm=Z7wD5
zynyfGSHU}l2A23l1SkF)wBo;^f~LC;<Vom2AUyFogb_h%=ln~4;wwG1(XO!B={1>r
zir)?P{tD0mvLG<V{SZET0I$Vhx9NW%Yn68Rfb|PoB|MVUFS;XKVj{hYjcCIMPbk-H
z@SY1p7cq4YUXI4KX{;{CEdg=`yIKAW>b&+5fShnX-}D+c3s7;}5tsZF1x~O`6!82B
zvQtRZlq(&s9O|JjFPd+tl2B0f0n&~9Yk~RHU7#yNjcPus1ZreMGPEfI-atGa07IjH
z)4hR|_%E^??jj_^N;XsYazO`g!3jXwIkr!!oiP(s;DSKMMryJYWW_%#^=}UvT%wUM
zVPGPGm^4@}nsWpIzUW*?G$czpGJhkh?{N_XyyxExLLQ(=<Sh<Au!#K90VG#qDla9{
z_$1&;(M&LT;M4Vekfj;^zVaJF`rBT1-_>XptIN|@FIw6589Xtkv!LZORD`G;1HnJS
zfPb6HF~g^MRhR#h)RCq@MgT|KcckGJEB!yhFHo_Ft}51+IRzYJU|#A-U-aM6U1qf(
zV4XOQ5T|xQD9J)mJhuJ!s6ZT4Va-WtrT4!sDIzl?oEk@TGyN~q)ysQS4?&E%^hO^$
z6vfBC%AGvCmaf7Gq~OET7zus2zT$d{7YwDIFi=2%yg;6(u>j{h6o&R-k>qM&T+ryh
z3Xo~&%TKR*3|HVo2|%NPa%JqS-OB;>Fsc7QqBs_i5J@b-F?sKUlHg+bQ)qwHwMW!?
z|1Nj94`Dq|Ix%1AOaHHTLCWvad6h-z9@7XPj_@IBP85ZibS!GXu-~Y_!SG$+g_b@G
zA4C6L%8(A{2N^VqSH`>_`4@-cyW~(7)l&DlX8$vXsxNu6e3>9q02p4SWm#OiOzHo%
z3WCOk_(ND&kx|5qFO}+A*F@;|{6r1Am7WHlL~3dZC~<QW%%=Z!<O2Nsnm_*bN0MMB
z@{K+d*P=`Y2Wd4Y`unn7?!Qb`F?&tV$NN2SkA2fB9^SNj?UM<t<u2Xf>V65+{y&|5
zzY|eYKOLjZtaX*uWh|Py0)OXz;6+t{7B%V<&pFpPPcR*2h4S$xO4D2WenmldMvA+r
zMc1%*C{Ue=1iyc0YhhX1)NgETLgs5^qU#e*C#Z~Z6>vqIyKog~+`wnDgjiGl&A&8R
zIOc#f+Z7$!zw#1vAcf{+0{o~cMC4DA{hXwi)QRHtQzRn&iZJkupVt(Vy)`!a6Bw5V
za`7&#!ikAEK$n0@C=D|1T%Bb>3PQV<_IUE{2&uWIbfjNu^$9W0MJdtZ#^hcF6K{O<
z<HhO#mV8x83KUeQ+x4>*T=ZNH*v4q9-y4QB%a89D^(<@4De-txvG3{9Er27F6eWQ!
zr&0cQ+~+a_=3)Pp;buV+&9&|PJKpujtEaEL+ARZ<dDa3_vj~{y7e(QwfX<}?2j_h;
z9D;9o0`KjD4IV?ByQR14$r4XkSh6adP;3N3_T}uu9xx+?WOVwJmL`fwCZ*`JMG`m0
zU*qLpGmGB`M?lcwfV0cEDo3T^;+OMMF_33LZG$T5@j&#S+UBzb4|+3@zpr+sfKmO-
z8<8Soewi1^S2Dt9jfV(q`S4IfQ1QB)|K__KsFAq+DjY(z;PqGmT)U^pBxpD8EK@cP
z--)51xyk)qnan&y)hV-_DDoJsl!N{Nx^Q%)mwqn`>+B>xDkOAR2<Q~(HGgfr&E;@_
zdMi^Z5Oaw&&Epk)Yb=?pH7;;0Q|}`LPNM7iCIThG43ApRcP)Dwvs(hx8E*!CZBIc0
zEj!V_=fQu1`VY{!9|^}o;{Q-#|9jMMi1YS0FldKJ;&D_ie?$5K!OO^Yb+HxQqr8#6
zi9@W2iOTszB)tAjq|fF*e8tpOa(2*Ha)&o^iVg<Y10Ar|T4Hm9gtL2%wx??jcUuJ-
z*rxuB(!^r?nF78%l=GimHej^>`elP{eFA=Jr3vq4k2@@ccNB=5etMT3Q3;8&^Z8CU
zwS6#{#w03;d;OlIQ2^sBGZQ8_{ia<H`JWesKmHMRsTlraLH+Mhz}3Wn_hK-ccz#YZ
zjn8>hU-m{!zl;_S<RP(9$wXweL~hYA4&?23J;;!Y!ge+$a%TuKlT09RHX<UWV(iNC
z@aW+-eTvB!5xNr;GiA@jA->}w?C1A}>Jja^`{_^1vMt%z{-^#ScqN~MMr^f0>+<#X
zky$A}<+9&PH9Y?K<M~RDNb3BGoT2T?+HL)bjzuj`Fvv-nb2Zs|sVrPpqlY-o8v^G#
z)tG=wNQ{iAz0Q^+{|n79!_mx8K-aa+xpPnUV2@}C5-u@&&*+)omjyw9610stx@u2~
z`tMi9daw1ebfW9Rt20~foi2FOauwi<Pq2>3+YtPKRE|6FG!=6Xq2l@Siy_tWjD(-Q
zqntg4z1^r-^ifp&%`u;Yel4+)ib-aTEa-O_uhw~9^E<F=dgtz}E6?ct`O)DQU3R`W
zDt`a_bS97OP=wT5-{F&W8@Kg%R=8YDuo(w)VM%MK%QMSkJowz~dLKVj#M#EEueJ{I
z(@d7Hi%cOY$f+9ZlODV1a^42>U)I95*_9r8Qq7+eYcO&1QM&4_ElA=dh(2T6`|Xuf
z>wd#8G*&!#_ucE`i-Oxdu5E8T<Lyp;#x;duo&}=FkJ{edpcN6uAlQ8?+Y!x0P`5)&
zMK}>!8rRJq9gO}}0^1v*^1Cvr)bqlT{e|?WR$uKgMD}eO{D$twvD*(!#RZwsykksv
zs~U`u)AU@*U2rKQtkE-$us9aV4hd>az^ZIerju>rZmhD=ZF<kI^L%-oup?LTHs!fs
zro%zn&#eN-?xgOl8K(D25q#3{ym>OJVBxMX@HWiNy<J9on(vM%!jOm|W5Pdyb*a*4
z<%i~DT5mTuG>6?Bh1-<H_M~22?w1z2IX3Ei|BV5IYKfeBE_1QRW`s~NTG*q4h|`;B
zXhbU1(HSz9AM;hIn5kN{E_FjL3iMJ>ru;60=EZ`!y$^7vJV(Y%0OjNR{vb7h9iLjC
zWuxI))Cb80v9Msk2RMSm#P`E2SseBZ;_l@7`f;6AWsf=&<ZA7yY<e*BXEeXqvTywT
z8^8SM9VT_uvs-b`gC93)yG}nk-Z*ZUUMg(}i4pPUoH=~~-dP`8eO?`)wvuiZOVGy8
zqJOw;o4nxoQOjIyhTom(mf8SAsRdo*uN{V}&jo8Wj)WP%OjRlMN9!fl$Apu^QD&aj
zSXDA-DqCl+&7RyYa+x7@uO$@{(p1U83(0KXlr0l3UN7?`_o}n+F}+K`j!yPsXVYVu
zfz(4oFRqX@i}v>g?+;DmNww@iZ7qk-?Bibim@#ao4hia`g5FJm8FcB2%U>)KyL1M5
z=gH;O1jegFwW&$#aP^OpM+Tid%q`nS-9iyeH@83OPwaw&0Ppgj)c%t!m8o2YSjffC
zGFa$!vol^k)t?KnPGDl6`p*8k>45|}i%;2!17cq_cpi}K)JtvcuZjg}mkK2-K5gD@
zWiwNpl6}o~xh1)f44T2yO{^oBN!`-W6vZ(i`04ktn&NWDcHGZl_&hkoEda#!W7PWu
z#~u`h;)r~pR;wMT!tVWAu5BiKP5SKn-~r0C)6tQNI!dihHJ=;q!v&{bvuNwhyT%tI
zrMO0)&?)#U{dFzeKX3AO$9=;WlddE*n|^2P;=Z9?wO<Q1>r!$q&OHemsS|ldRY9Mn
ztib<mNNqBeDXH0#LwV=b2!rAyYc~zOm=imNl=s66{fCPKj^!gd9BwQMq_T`U{hw2_
z6u>i41a`idYFzuFZ5)f3pTk1j)ReZH(DXEctsn-e?kWvGIncO;-4q{%1I}6gUd@YG
z80OYKGavG%U>%$sE%RrW@MSObig`U;Sa#H1=kK%F1ZTI#s9>wa(o17#rWQX}1xZbi
z+Rz>G`TjdB^o02(PPQ#+0>qgkoTG*Ne3jk?gs(G)s8QV`;A3^ca*rkJ;y!f<jrl#z
z`B37y%?QrsP99qNZ})8{Rli{&XeNamAKhku%^((^5XOaE{`+%4klU%GCxhoNlcC9q
z^!^`Tgb#H+x9H3CB30-5o4L11BtqU=q{dU*x!BAL^96+$C1mA&{Ccv$9>!aEJ9B+P
zX!y=MB^G1#FKsczT2Yyb$JQWEF<I-`;*dK&#UyxoOeXC2vVV}cx!Gv2Gl%PNQVv@_
z85M`sOic4>mRg;(W!%*1S(SPL<tv!S)V^G9?ThP?Gc!LQnG?O0O2unQKNrcn+upCc
z&$0ZzORJjZ@XY;$YQR7sGVDiGx_B&sI(6SIJN8M1o&NI~QGGksg85RAtb=+ZyC<u1
zZszZmEDE>%q_DuUm0vIAyE|+zYxiKiDC?qdae+O92%ntkarMG-RAn=Cu2tV`#-hT*
z?>jrsdeg1*U$!0p-W}wzs&$jn8qG{_7K)n6w3OcLzUcJ`q*l1lFON}UcvztK(&64p
z8zI8bs9XEo{AZ5Zuh20xS^&ETQ^Ig1(W+nHZB4n=`sS8ojOzLrB!>aoDLvKIKwaU&
zc~fH@@kW8*nSqfmwhxwH@hpptY_i`;;;P`=r=vWk*=enPpNd+PH^He3Bo?DYRTqXE
zR?P&9w0QQjZnHdK5AYcY<1^(key;~Tf$}6;TV!A?B+ScphKgu-ANvG|(xd{7GwV$U
zTD9HVo&(;K=Cj_BNA7Ktz2J}ryYq%6rwhh!z24)VBb7Fp@QiDjZv{W?&Q}tO+NsC7
zgGulsGG0ISf%seEcWrPorhgSnWK6F<LxIURQppFHGn-$AX(jfb{F<&&Ukjk1|2THI
z(weN3RkB50g|hne=e_AC*?oiNseED17vA5kPeWV4iG7rP4hQRL+g~YBg&wu0;5(KC
z7`F<Ju5PEQe!9go&yc&16=j#r9-1fG`*X^0)v^y^DT+#E)H;YSGJljqJABa+IPyn&
zdDXJ&UsO_``zZG>95Eb{RkF)QL{)PDuw0Yx#mVgYe@J`ls4TRmefS1JN<ctB>F$v3
z5CsGTl$N+D1(fbCk?sa55drD$mTnR0?(UZQ_6?lpeSY8iz26__bFo;6=d1;L&z`wv
z=9+5)1`X5nNYd7Jax5s;Maug7e715CHsjkd^?E#$R2ERP)N?}}I+Z6))^&*NRSb@p
z_zDZ9g&654--?9q>>tpwT{W6f+e^mwa2YTH35|+npCw*r)~=66mg`5ok|>!^{BYtZ
zi<gxq9*ouCqV*A#tWz!?H23o7Gzj2t&xp5{4I7VwdT81-yJMB2xprwP=m%xTpf9#O
z^q{m7d3OHo+juQ3EAT+j#5z64-VMIQH>zA;-g5=Y%9N4A<l8{uhnNo~v_H}Q2?uCP
zzWX>a`o8A${=CR&itCAf#Y8*LBJU#2F#HJIh^Ka**DP5JwTurfy#g7x<If6Z$BX;z
z7z!wp$#uvBpuK5ZQvFh^is%!mpy+Ozq^Ra3NBi8t8a)ZjIAS&+v*(`f4Wxp+mUywk
zm*eX~LQ>P39s5la$a3)(9zlP613Q6QEXc!5ip77f!HQmu*SGjg`~Lq6pXEU|JL%^C
z3>ze<PS_R+<|%bVr4KXxbjPDbXt(c3rl7tu`=t^sCO>_N$u&%yXvH|LWi%ukP1}l6
z#LQi=M<t$~w?#B@3r@=e6`4%$=jKgm63Z`MTx5HzY`K6Ly}jzjel#+<4cFnL_ulG8
zF&qWsE#bVx?utEYEmPNIa)KcZpEq4HTD#W;Q*4XPyLVmU%q$glClw{1y3E*x8k6z+
zDaIJ826#ODFja*R>gimrvsM);tfdd;FTa(v?+qt6XlBsK89<eD{DGF?>XpjC@5hIl
zAIf@Lo;yDU;4Wu09|2%w=KGOn0&Cbop#-2sj0W6)aRK7&6ZFNt@S8?Q;{${iq^AF=
zJ?E^7!Pj5St(=lN8^Rfg54G)G+ZDC^p1S!%=ZF1`;wyZBhqQ~wr%zwWKK&;C{go5^
zBl^Upkl`?~*>;kE{kGN4)U{wJ=5~+sv~}N(P<Qo$`Ao22=CzlB&jP##r|7tSwVE`o
z2!6x2%O>ZvNA0xttw^kJ3_VvoRvN?mJ%`+jEIpoM&5mS#w%Xl!dnMFu4cXnf*M4;_
z>XNd*yI|?(dhtr#Xq_eRdqWM~^~aO<%Dv}c0DXMVkOp?m7Bn}>x4@v|lKO2<tH29T
z`7s~lBN)c}f$DGhw^fk_-!@a${Ovl|$R&^ES2KJa@~mZzhL@}>Ln=bED|7TS2~KmL
zIqmg$G^v%$%GMC&dF<&ArQY#&nLrKfM(cgH!g!QFo;e<KHLSIcD?-X!7%a)13Co`g
zCvh!nRdjsg%&qbN_@qQfJeX#mS#iqUcEOf<bC5M9b!{76x-cPlEh-1%w8R)B=J{c1
zyHARm$abF$Z>sV;{<ozk9FIH*x70(e3z8Yf7pj)EmhuP08tJR&FzfPLt5-CTdl9*r
zh9iqwsbT=veuH`WS41quQ#)i(AZAwLVh!7(hnz6uhDyI3J5!xt-~bFvQEBqRO^U*m
zm`gjLFW_d9*Gc4fjQxpcTU7JqkMIXfZmq84Zb@_T^j=)_<kcKLoBST9g-^v7c;(?~
ztQH&>_#i}=JNLxhv)DRxQEsoK!I1cR=dD}v{(+K9GOCoo{4UC=3XAd42?fTvc!wum
z#_}Z?Nkd{Fi@iYxowwflouFCbjkYuJCnm7zPj0tm2}0Dyk>^mt&ayMb^cZhwcxLyN
z>FD`s{TSku@r0xs9sy3UB5U%OU}n-N6k!sQ-`3=>m!Cc~8yPVR*?;!rs4cK^c9l*r
zIH)nr@2S+Vru)hL5FvLxE0U=rwRH-?25BMAzArL;ih6_CwSECnBITKo+LZwz8<D~(
zy;R$pDxcPtud_a_c<rnAOMBxnOBnt{m`|ahwdVaAF|bzZjZ@ynbD?EIP%h6e{aF9~
z)1c$|%Op=@!!Dn$C+umWIs|Wr<%sY}2))DzuRI<a;jl9I$E89{f?o^OE4@GL)>eX!
zoW#oM?w{fOZhw1mVVNsMdlp|6GIo1+cwebmdjrhhQ=m4gz?VGCUq&phLzta^GWE1_
zGNIqR=<vaZdstC4kgR(bvm0CKTg&k`;W;r%^qtLvPtTk84&Ngu*FPAZX#LY{R(Y&&
zy`zv<4w^-b5k1duI<}x}|6d<n$UhumJ%T415;uM7oZBA3P#@>X?SDS|6V&h~GApa$
z3+drhd-y@6rnEa=9_kVH+1O0m)auzcje^zjoMZOQO2*H>l8!V8rBXBYMIK;2Z+F!o
z8;*5&l5cpD=DZsI`JF(WCb~_RmMDp~eY?6Qh8w-Ri9DRcP?GUuCz}Fs8+>(}=O0<k
z>E${)#T3eyooL<PxM*b;b3I=iZO59UJC8lX=*o^*e}KAs`15d|>zAO0S)G!0BLC-^
zeC??153X%YD3wxM^c@rUhF==al)L92#LN_H60oP*yg%$ck-*rtH^MI$t~8D6`+ZS9
ztYHi-A6DCPKyCck8BdaVd(3j;9@YFQ`(jtj5wtnwga+I<-h&Mu-(2`tq{qqR{TQvn
zej1?n=gU}f+d{cb1n)k3@WFqao>71-JKpHRM1e6207#-7_p6L=qfI8P<R|=Ikphyr
zx8F9ltaVfkK^r)3jP#WVL_OSZYsH&VVjX@B!Sk0+mkrfs7<q1Y4K%#c7Urp*aTOUC
zsGU0|9c?-|Ak|@Rb0(~~FJ-66Y=7E6kf<4!A@;#xm3-(S&irCU(^4ojK(td<hS_QW
zeO3D_Z#~1?fowMaCV7hHHwGn_U>}9!@Q|4g>a+MouKY?@+~$z2Na5kXL2t1wm_5e_
zzcQoV&j@eMHq-K-&?V;`%0**8J(WHY$6tWokhT9<&e@Q6H2fu&n&j9?4o*#@_#>2T
zLIy&jK8-HUQM;y2zo<<PcW}ES<Ei}Y-oZ$v%XzPRptci6&*_M83$UmE-{%(?zoL@u
zwLEsv5m@=;FTqen{5HHxfhj59ww#*ZWYy4b3=$t-y{#!igXVxt6tPH?s@L3F67P<W
zp5uwQe?K_(et6Hez}DV;*311m#(XV*r7;p|b?N)qtADrvmF78Pe9KDNUNQXVkES%m
zRYzL7u@H2$ia2>`2*kNBbW!rA500z$7ku}*mYfAhr&~QU+t@3zzPG1{G=&?6=6;cv
zwa6iIWUJ9LbzE)eCrRrSNst}>Gt6Ni)mT<~MdFC6t1$M_YV@~;>h3|b_2|^sV3+>g
zSL@5Au;azE9^0_~jZMg$q6is|p!s@hpHj9Se^5jQ$+U0-SG+=FGyls(vEB^uI$ia;
z^B_sWQQA!yMn3Y`YL0$;SHit5<lcU6B!c7G0h7)Lg0L4a+68P9j0klJo=tMyw#XC#
zY&J<LrpNX0s&%!jcElGNE5Gx=13$M**O=|m@TRQA@wJ?_NX*Pmi{DY#MmGEqY^^JN
ztu$UOc6DktA-rE5i5=VO(Xd_~#g9P?tr})|VRDhs7X{piAJ%?en1!qskH*QT*qWNd
zRTZPB*`^xl_{-bN_nR2@)NNM?d`PB@v4&DXqCF@Q{RkhQG&Io|U!5q8@U?&<x1TE&
zw1g$4sbVGMZFKW=lTXC{v9J9v$xQ2#7{i_j591F7-$F(-j-rg2`<joD?0>Ns3OgG0
zZsk}CEtYjE#Vl8pP3tKzJHDOQEm#5VTI!tJ(;W*wI#Ee`MQ+N|Z36R=v)>SolWLiE
zUR{i=gB@sXy)YPI`m??1za8k^*E(FchpG`Ae-DO^8>w$;Uf4+S3Acs7mrrgSX`eKh
zWIF%Ea5O+?Eaym`@m*za*W@7o<x0}8zBkC(T;&BZ2x`ty+AnqzG}<B`0>a{q9u2Pr
zIM<8weBaxTNp5XvPyLgT?tn}DzLdz^9#iw<82Y@trFd&A#ZI-jlO;#jh-kYe;-a$<
z=4NBQq<yfJf0-W_H54R4-Nu{}M?r6wChIV^Jyz#)4q={jDQ0SEH!~cI?tFwjOXau{
zUZ}3{y9A|4rM=>MP|l*dLLJt}_gyr;AtKI?tn(A2MTYlbZX!BYmB-f)p9)7nQ6vEQ
zc~wJ9f~@`rH;s+Ua$(wNixL_i_(HByruJ+{m`)PAsszkMidq57N=z)}!@n`K8}8kI
z94Hm(?FrIqyYk-TZ@jm?TjDiAE9SdX4x_q(ZDhm9jba~#rb|np__Nzc<@)_;&Q5_G
zQ9PuQpVKa4mS_+M?GNyq@u|D?w~`1?S5Jl0WZhIV7`_;E2N(2T1u9n*#D6B^FGNip
z>ZhDjZJR-MWR`08k4+VIyc)9R<Q#||ecGpVGVh5fqw~ri)oQ!DiS-SLS!uR;xnl^*
z9Ph$+jOihmEK1lZxU8%z7=ixJvU+8(NC?v^LfF^XMLW{ZQv@45D4h?J*Q5vLn=;NT
zp3WBT?F8eQ7^>zn`_E9y5w!$NsOIte>0Q8(qX5}!0@}Wx&XUKo9VL<m2YzOK+OgTW
zCz?<3a&PbhHJoavPdC#0mcQe@vOay44ycMOiBA*SeqX5n(U5^kJB(6-120z^ss*bt
za!t|WZa{$vjOeZMiRf0Y<iDamIL;6$(Ho2$@>VAQ27qne%9}W+ur1#T(UHOR!dgfV
z(xDW_fP3+)aBwZD@S)OJwF0Z5f9bPP^@`}}I>x4g!qql$rUqMFw!OU{Dbz@R7a70N
zcIG!Y-`lx9uMjj-+OvAB@FVJ?sDo{5UTV|L0l$fD;P+*&8(f@rIthq#tnL1CCHHJU
zj}))5>**7_@+rP7I>=9M?~}AoH><wf#~s=*V~RN9EhMf%UtEUw{IF~9Rqo_0aIuLs
zEl`UDVp{k>JEn+ouJ=cNVkhxJpxzVei^Nj4iot4c??_D1@KAPSy3SK68M+!(1F5Hj
zl880pj<k-jzII>X=Yt}*h%pV-*$LKC4jFcPO(5?di-TzKG}q$8yS;<hW*_1S!)SyH
z*)@jMqyoQzIoypYhaH+LHy2W#=h~Ek1tMLD?_V^yw1zQ~MME!!W>tUG=?81|#m&Xz
zB{^H?p2-f;P5{Ine%#PE;*at|cp#Ynu;Jh%LlHHcTA-8h5nmQ+kc1a#dL!&NaDqSz
z+<p1|o}12aIm{0;J`4HhI_@&o8+X!9_4Ni%x93u;-tfwfZ?(GX`X3*_#wEaqhXHUn
z#y$$H;brg^07np+O};5WvncQqC_I?cs;f;{FZEazHSVQeRGeaI%=}{e>^`Y>Bt3<`
zK9;XT)rPs=>%_1?`~1NTJjUd=HOU*~1#c8H0}Hn)%14a7^*($G8m3;Bdt`=A`jH+I
zIH@nA)Z&a7$k@inzY}w598a{fwjF}jThlbdk!oBVA=8oTb$zK35flyWEm>+yl(y}$
zDvF}zXOUYcxnyGhN%v>`O8|n8;j76Ks#$e){rLkFP(3!U|K>Dj2o-)FIYk)pD)k-k
zFL}$>jYO>Jf~6s#Q^ouSWH<B>V~u+TH^g2IkldF?leOQSz<)a!4}I*{2Uoy0^oJvI
zZm@~-tw8g%VbIw>jZT=*B-it-*ba3#wFl5QX+==q31{8ZAEmb5P$+P=o92Ho#xCHQ
zSTz087l0#4DM%a)#7#0(9WwbO2$#jY{PMwL=f6+g>g<~6pt&nLX~#}eCcV_S#U^=M
zIZG_fK9=6_gL*PkF%Oe~MuHD};V{^jVE?A<{*PEbUvch==g)r`jqs;k`nj6qj7S$m
z7FNBRD`HzMcNYi|bbe<k+zffsfT+CjtjDnTh=Ct<hj`4ZE_5e>D5LcWj(;?ArSx#p
zbUS`#g6#krE^(f?;l_8C^n(d?^E?N7UENSHe>bk6d;lL0JO!7|4Yn<WQPwn2tOWlr
z4w;wc)*%ZRFjq0aY_AZeUkzY|Yg^n62@b?LPFO>qBg)DDnA^nHB?}utW5ATFzj}sQ
zE=qvx;W<J1;KuqF>n$<lHRTg*ErSMzw^%~^kGL7*r%}+tsrq4ATvCPjvEbvkxrw!M
zik>54P~FvmI^OsfBm+tIdTU*)UuwcSkNhqRs;r4qQuq<bYiVr#<vKtp<EE!YYJZV-
zer0-^_t6!>k=Ev^@cBL;!49+_Rv~vqE@67Vu1d9EcQW3cd4B}`A+ezdBNPKJ87i^x
zg6mkY8fhSPtdQHk>51#b(-JY+KOIrB1v%F9)@<7?ftjn0Is%`=jJuWTT@4;EYobOE
z8p;(PSg5^vU;q^kCS^$~=S{*hG%-u(H%b-?RZh9LjF&MHt(NFTL3mYIiDV3e80x#l
zmE;15z=h)Fe!&OQrDb_=B{xY{9t;Uchb{cyz!@9LO+q%xW?Z$oLce>oS5#RUH~RRq
zkN3ji8KYX2rGVLVm7!(OFdUedZ;`y`M4=HA^m1tjiHFDjg}7v@{`H)?JoU=PaQPGd
z3Ns2<B2rS{wFA6`oqLjb$>xWJa6i;CJ_~M7$=A0;8nWj0r5$;UD>Ke605SFtNG|*s
zp~-@SP6T|~I@u7WFMMyZlPZ^4wY+RK>?TZwY3v@{7E;=z7VlOBycC54MuAGkXYn%L
z=E--nGEXQJ+26mdH%w>K$p)YG8wGBGI&z7(Vy3wF*H;g*_q%_*OmsYZ72%c_t(fz^
z=M%w`lAj|}IH8oy>4Lr~LSnBp6X%coM9F{I^(sD$ce%9K8$vUwcJIy>ddu||y9p6~
z@ax<1$&UGr(Aa_SO6&{Ngq<0&cP6>t=s!PJXVm9LX4$rAF8P71iSFi|6uPb6`=ayn
zH%1E(usTv0&=s5==iD6VLPXpHI0}-plH~(AGTv>4Jk&R?Yb8kx#z)jKl~4Xxmo;}1
zZ()sd?b}?vF<UekCul7EO+Ug+?VXm&!9ZD#a^tRNUGOkNpI$fg`Qd$ozBm%$X{f?M
z>N#c#Szp(6MRvkwq-Wim3McWi;Xu`b0qflr6;nq2zcy-5^=qf&Qqvlmk2LJ_y7WVJ
z$azjSe~HNnnQXq(th1aTQIz5nH+4(mmg{S9I*{wpE^aeBU@OuG{3n3C*yJcwZ>r-U
z<fDRct^)BVhk+@8Z9#C*Q2RIjQvrza*jXR+xjwkMAgnQeh1}J>BIlW6{?nXmsO|yc
z>_wIJ>^Vx>Vpvt6ir!_pQ1*xs9VGBYT0??=<O&OY-`UtN`!{uZPwGJOjlxR@VHB2-
zBYp{E_b8I;umG7!fS<|UgF-}N@p|tREYJ1;9K6QyWTb!f)2c#3{DWKL4`PGy))yAM
zUabw1yS`RW!>AR@$BoDnDk!E7)VuI|w*P2gfNj)%5g}RF-Sa#&S?7EPY00n^b*X)k
zjkJ?AaJyKHUD-Jv8|VX7`I4u&=g_6cX40x$v7?iaY&-3NUWf%aUYnpqVLw>&FjJ&u
z@;3g6b^%5q@6w+y0yhFR&%qNa6T<m7p*}qya<Mpuc1X<KwkgJekluP4?iJ3VfyYO~
zz)!ICw+_o}tEjuYcYPr#-*oBEjLS6|5G4L!mA&}TqqSwnZ6B9J*zKcbjnFucWGuIA
z@I2thl7Y(99&*)-n`SkOWmwg%M73wsGoUHo^@GFyM%XO_1_X~af55=J+62MVn;Gs=
z&?PO*L*To;u>a05JrIZ@J-(cPO?|{AF#xOUAx%S}rwf@ovnv~v=0=O3*LdyMzD#lR
zR%)wqW@%{k%^Y2ZBV(X&@o8J3G)l@PwvG%gt4$vK=8FtxXq=%7fwzFiMs36k4U<8D
zu`4$JUs+XV5WjUS%&K)@D|1czz5mS%{s6OTHoe!{f3g*z)4ys(RCK3erUJMh$1y<2
zQ*~boK9|1lDp-iWu3SLnTfQ#z$kNi1#+N1*!ZbW%*=X_N#fvXfVn+e*cY$@w3Rg%#
z?CkAhsr1N&G@5%Y^t81}TiRPG*%_qW{#4oG9D)~o<uE$hS?RP;9#Q-wpfiz82=<0a
zawH&fIB}@Db69>M{s0+ZNW0zmT-xibg&^4P2tK~T#Db$|d4q1cFdneqIq=6aBG~k3
zYTS5}y6P~32UCu{=<wf|@$PGjSGQFvyB_syEDvY<kKQ57gq?)yMY@D|EZXL!&&cyp
zt4bx(i-C^&!+K$1m|NpP^a~D-eDMdzkafNtQD%>yx5cP-_3uQg_;ZAG8A@9cx!Po5
zXHT$dc&&M)DfRR;hyG;>3v>OM3myE$Wf-^ZS0X|ZEKk(}9IKt{6Dm9=En{VJ;U}Yn
zwmGVtd<MWt#MKz3kGWXWggy(&jR)sP1yQBbBHFPr4rF@5(b(Os*oQ@c7h)ZoKY#A%
zJ{yf<;1kJ}uR*M(!Sn3z*HU)py|eSvHEU!`0s9aWJjB_#ofC<0c*pcVnSh<qqkYX;
zMf+xFhc@VQioBTps)&mD&+W_W^;U2ItpqbWQ&@-xOFp3$K)a99a%<Vt<+?k?VRzME
z+4jA~K0x6>5!g|l$nXYZf>R^}&!HTS#P`NE!DQibP2v7k=EViSTPZIhdZy62i0;a_
zL`x*#3N`l<n<oBM;+0%!9OA(%k7L-=oVt*CB-Z9~NWu`y7*EB^R{p+#oK7qEA&nb1
zXXhxP{kCq$%8a@)@^dgl5KG5~=2>+qK$_4KOQ~Vd6VEB(mLVWF$w>=9x?;lxg7?8n
zQRU7UTCDy-U!B21{h0}D<;}a}Dz(9-jf%r%_8~Zj&dpBbS4*r*So0PQp>1D!==mQM
zB%X+zjg>cG&iZN}zSlKIoP`tO|Ej#ekM}lrvU2MCXEWuZCnh{MwmPw8!NzunD2-qo
z>){vip)gxbgi&Bkjnn^)t*SFZ40{u?tTTh6snv>dxLt*#1ommRt$^#M(<uHiFDv;%
zB6Xt?_H4r2UD!+@*)goq??PU{RlW%Sbh;gg85vY(x4|MzbeS~I<uCdi?zF?7<A>65
zaMZ=1dG{;nO6}0cpRM@MXY3b0|3Tr~W2c44lb&S#SyNd%+QMvjnG}p(@XWR5>xVi5
z>A?=m5GqK+U>Wl`cTRx=W&^VZ5;^>VmEbKrn$B7bfCVvF9SBDM5+s1V+Au4SoeY;B
z|0~b00H<b?VXD$V^Vin&9;vyxBL}NCQd;}h{vhsHayn+bp2w{IKLK`Y9u`8fSZXsB
zbT~waXGci28$vaDU4kkoIJs2xEp01<__~8MQ$7|?9Ch(o%`*C7^&h#E8e}Z2aD~Yd
z`~r);b@a8FoG4c6R$G&?mwiRo9VlQcQQTqCs@*w=JUOVkbdZLFf!I^qzr1|y2eAde
zj63k1_{3=^aji4EB1-+<9*nRcr*iGFQ$tjl6p6Im_UobfBTeMIwpZ-XdeoTX7!i3n
zAp_vvRylPlryrZMvgXE}h|~d$tEO3Rho)*iDY4$DM5k5z@OQeDY0G?CQDi#*8q_@P
zo&|uU7iWX^PT#6{1;p%xt>*&%cvh=>|LzDAPOAMgI?C(sz1q{$T?Aeyh!JYE5jnS{
zA2LrW@U7)NSmNv%1)BscFH`+DX^<_V&Kp(oC;}+JZo7wvoYk!JB9~5Im}Uv?Ba`zm
zFc7r&Yd)<y1M=>(2beR_DJW77%LVQPt!{T=W5#^QnGURwdbP}?LMK8KdiK(d+r5(@
zce+-Q%jG#-rFehS)6L%kALmbao%aF++dW8#e`Q+|pDmE$GkJ%7Vn%5^$Z$g$(B<2!
zcH3b2Oqc7t)Rl}V;&$$x{8&JLTW@pJ`6Y(&)OVJ@_U5eaOzWJhCH|GJJE_q8u}BF@
z!*V946C!a4$(0-FpDdMU(1~7w6SmU>^PqKJ_rD_%uah0}X3CMQ@$;0l%rQz~Dg_|f
zvo4Oioq_j2*n~~y5PxL{<F{bw3<doAIG%Jb8qi}IANCl#v33>k08FVn_U;1JZMeGq
zJR67brxv#DHLmOru1B8M9BB@ZZs(VVT;dG;2D_#QZ&~oL^TIx$vr6K41mbr2cIpeq
z#5!&bYq|WOT+hFFPvGK;T}=gh<jpmtX{IHArGT)u;{IQ6kq$j`8=D7C53U}h>dr|B
z@|PO<2`6cEpU5ZH`LRVBbdtIY={@X<W@2!^I1fNqt9Q$JLo$GJdJ>N_w>C#EV*LnC
zEtiqbl;DFF8{4PW6=W22j&U!u%ny6J+g_57dG%^#4I{kDz%UO$sK=QBPwvvTMmbm-
zhr%>?69#Z#^9H8jfBsDY4upYj)uuQucN7d_5z~W=n4aXIMx`r-<QyI|eE<?9_=sg8
zcxarPg6Dmb+Vca0hDK^N48krIHMPFV33fV7zsvA|Qb^Y6FOYdW)z5!hUv2BWx6b8+
zaitl;rKzDn9GU5Mh7$0ogE7<={I>S)%hlI3Eb8_RZw3a8Ms{S8j1n;EaE!!mXm7F@
z*pYWtSy3zSTO|@j@!d>HgMt9;s>T1^l{1TLi6bdbbx%zZgO!yL=Khb#)g;<m=*GiV
zO*C>oIxcpGqmKclCGg7YEU5$WqH3o3BO#g~BXVIctf-BBp{uGY5e!gB^);$W3_oNf
zUmY&R?U!U<g~gdu?r32z(?V-Wz4$n%=kJ4EKV+Lt5zP>-i-n4p3H*C+srZktTTGJg
z{P(`KB$fvci__o$uOJ1sYW@s+jV}e_!Ow|q87G!LLy)39N|L=#O?vYJB6mtHZ&(Dd
z3J7d75h0uv@68KfyLkcf|L!<EQUskn>zmsiGaptwSqKLk>&~v0lbrWJEMhV<679z@
zQm?pQTPw)i7635>g6U4Nmx73JS8l(jTUJ_r_;Wn{aG0=N;*3e!{{8Ji`brGKtV-~@
z=&p3FL7(=gyqc4QrQ?lK%Z^00x<f&rDrEW>BT_%MKMB=cM0;&vHte;HtNZscL0A3?
z312+)rIipe$hm{F{!qc-qogN_&zPMsRD@#gZGn+MkjtDWG8x>8Ym&hU0E;j|`tj-}
zFOUNkQ&{e;@Nb-HG;-q*V@#9b^O<O#hd6|Ra+ki84E*Dp8N!=0_t1@%i#`ta(Ln4?
zCmu~raK)a`@n1PPRLYPB_J=1w7j6gd<##*im^ZI*EVHzQ)cN-8%Sc0@Y~~CXE;tCY
zAmXeZH_??iI@uZd_vI0G_xlDXG5L>Hk3@_`V#Rf7S04eiczAA<+v!qYFRaG5<Gx>F
z>Q35-*>I7C&-nd)(Q%9M(Q;B;!@FQ;P*}FNX5KMiQ^X`*w!Hzt#iU`dwdc;qeTA6;
z!M*qVFnDc20UTf%bIiX<K(fFVAI59f<rfI)vXtg}-P@PIBlvg9;xa~IMz*`;p1kr)
z%VgDT1DlMo@bFkfaNs}c`RW+rcmN_!(ch5|yN8_H7A{x&wn2}tGXnFd;VRvFyH1Tn
z<>R~Wk{JWc-W`!wFJ4!Fc6xE+N6j5r<AqQ>v*5oQ-bLgw!JVT`znI{U-TlnA5bhCb
zb*hJ2zTziyEixcKYBSg5l<7NI?c^{S-wXXF|J9HcI=AB`iQCFfcXktY6J0WcIbcOD
zSk@j4bCAek%`k`A=zoKL9R4NxskAFYJw3b>-lutiKihXtSp1z*)Ii(x)-(p#AsM+t
zOI@<wl@07A5dF)B&Bfg6js=Ju@t)ui#Mb6dKc1djT>xbC^g#7;yQ=!DYJUm_Kptx<
z7B3%zWvyavwY$D3AYsWnEIQRR9W(YDYd%?`z4xZ*70Ou^H5@N}YNhD3X58LUg6${;
zWFxtIqheccb#;g60LL#!;dUTT9Lf9Hok`5X=Hvy$a4T;}W)863Eymqi|He-!ffZgu
ztXF#)-(`vE%v+*n=}F`+_i-N4hp7exhJ-wuaBJ={bKCm##0p8v8MzTHCciaXRzRuw
z`kjvXpFHRrl9_KSI(3>^@E7D%20T1_?*7>Mz-KJf$u|rKmQX>EPS176`V|-1<WuTI
zQ*`xT<xjjW#r;<FFa)PyZ9!PP$)##3R8sbW1Y9&*yzyOLAi_Zn=})=hVt<buq1UqF
zHc{V9hG5a0^E?oU6IR(qtWa9F9iG~b^YR(oy`eWOT5Os<WA3NCf-V<Iw#0n9TQ_Od
z=~l96-;H<%I64)WYe8i4xrwKNusJK!Xa6d#GDev7Da)B}wy)_X^bZbxzT%leK|!Hl
zZe0zZ?e}5I@JDBFEIsrwjzry>T#h#+QN$j@MMO7Ba0b9*o#UTN*>f7$S0kOP|8N03
z#OF~ck<woIQ|uGr81%HJ>SrD;mr_9jb;u!TSiF1cpepO8Q7*?Cn(6CHrH8f$zIB^T
zv${`K$PkvAPm5mhaxxK3i9CK!wS}=hfhfB%^sCz(=p=CdrF_Jis2!rwV2ioT0?p!)
zL;iJBPAe#InTaAxW^?6dierO@@LA0>)hBbe{}5h~#E^JPoYAjcFSe7KMh!Q%`*Ele
z<FB2WR|6(-Yfx37^2nEaTVR?8=DCwt3~tBe$l!uu5AZSF;8>DqSOsef=6B)1pu%%a
zdQ13y*|*A>;I!-h<!S2_-D?gh5;!Jdk6@8}upX$c+|^Ae3=n^tY*O%#RiiWL)<@jk
zH`gRqC)#_WXmF$5gE+=`Jz*>UK><IDZ8i2zJkuUxf3SHKr0o5g0)qC${&h-UM3nQ|
zUuGs~)qoKOHT-VP)I_Rmq|?6Io@2RfKiox`HLKZ-v!A+hcba~nL`OJt36Z|^&%R`8
z9Jge46?1g^9g&|Aw(h#ub2uH*lsQya1YHe!9`taP#uFK<)A?1?)x)M!!QzbEV!OD+
z{_QTD5U?O_C}A)P!t_Gdav7V|lE&b&8bMMnS^T9@oXgDXMLf*yNq4^nyKOICYrPrV
z?njb=K4q`Jy?o|4IsLr-=~_FY%1~U>@hwiglz(Cf%Qs*j!N4;PBU24hp?LyIkNBVo
zO2bw9pXKx@53UT7*){KOW*j$Erwy-(RePh@HjbxBX*aen{;#kkNX(bfKh9lFCoT3O
zW0h>2Q$EDI${2gyR9p4*as$hW5YKSAwR^-*QV?Ddv2mii8`%#JzVKzW)0Iu+8LM`U
zcWA>GJ!SGJ<VI<11}qQn+S+%0?@s?ZFiO$4B9kAt&%_Y4x{J6`?XPrZ@yhFcrH2~@
zh%U!1{yr<Ke45L*e6e*dTTmqxpZs#h@oJgiaEzzY_M|>hx+1dlcW@l`@92>CiLk}N
z|4S6D!J-2@l<kJhnU~zLpM<a{#EzM=sJ`4>nDf-j@_J2S`cQ9v-eP%(L(}C_;qS@!
zd>mN;%1HB{1?wLQjfq)mo#s$^E0H*0F4vj!zfRBw#jn4!T|Q-Q`qFpz_*f#JXe^BX
zDK2?9kfx-A9C+Lz-rLA^7r%`EX&ELX8YAiy1-=)Nf9B!-^ZFWl1XPda-L3J~O)V@M
z@{JTKs#|3@P`|6AG}Z}}iM7WB2QAlIu8{b+T;;WLt=*@}gfK1lMhl_2#XXfS;3%#_
zymsDaYP&QK>1==U>9^kTcedSwBPpu}P=a=1-!23>uUwChs@E6gUES+#gZJ84q$F5b
zJSlu|4jlqhzbfUp()fhWJ~FUq)zHu2iyhWxX;T1UVLW4+zJZH$<069txxk_aFaP(-
zA=4PjX6_7uxB{(9$zgAm{^{QSlbSqT*}M!o{HOuFtIAV{&n+)xA~tJtR*Ej?lBn8U
zG`~L(W>V<Vn_jKtoy5d!JyT_c^^tQcU5Do5T0EeRfwK$W(!&Q<dSxC=HQ{SFgq`}=
zX5`;-D1N5_rod~%c7j%Gj$bgSFkEi%4-}9tNvg9zc`gwg*}Niqjfc2TZ4<Y$bb)Y8
za)B>$eM}pYB5YV14{>(~3nuV`*N0yCs>sgm82;TzKTw>-_yYn-ZVXZT9q9N!E>Ium
zpPsMHl(|S_bF-HE<d!q$Uega0JpA!eDEfo-3Goo;t9@K2^s}Evnp@epy93TbAT88A
zWTIe4ow+W4JT<`$G^pd#S2Fvwe&Wycat7cM`--pVTKboaWS_iV>;InbrZoZfMDaUW
zYuDJ~lZIUN&0pEv6J8yB(z`wqwPFVFgz^H87vWHTK<W<7#qw**x`Vw~hr`AAPR(z7
zKUbd5Jlp$;_zJZGq^}@5WmGX84_{ROj3Bt2cJj&&9`6EF@x86_3-mx%V3mB;+&<To
zMoV*`!k~do+Ax9xf_rdsAR8s^tM(m^hVYcU(L!{z*aDsa+!ftZB-hulPRphLxF5k9
zl;U`5d+XPCD0<||%NEp-ncfRr)mMJq*#WK3zT9-f)efGwe!fF7I<O7$TjDW}WmGWM
z)x}$(xlE`xQG)v=MT`0=%~;G?DCf4{<`tYuW+mP}>ePvOJK%>z>bw7Vjk9IFT*1Gy
z;Ae3tP>Mzijk{V_raC;>Z4p7Aph!q5wnc-h9C@~2UMw^@X_2Qa?@&cs%e!W&BVZ>|
zZFuyBuaWP@LgfC(Lbk@-ACo>HrS!dKv%lXJ!<1peyFe7>v3e}9obcfxd?6qhG~RQv
ze->-U{4lPolEXq%QxID3M4i5Wc=+x_hx)Y^86e1@Jqp+O$1C6Z=G)IWx21_htI&wm
zj~W>-uwZL|@bfj>ixgL|@JPa$L_fbu;4$QOaCDsen<wA^Kz4CYPAip|TOPEEX@9wg
z#lIMnR3w^8Rgu^!@{7D*V|pOI#5U2`_d<ZS^smElKv6-ltOs<)zN)tt@17jA#-pi{
z@ncE0xBTde7LuV^(|jQzzOdQKD78!%CBnlH#em`NuDy1Fymq>pbpU!J%3M51{~sBt
zL-E5=wM@jWjBc`C>UT=y>Ej0qjF3PsZ@^{VAC7h)d4GW|3K0B$8{m(1Zlfzy=r+rA
zG@KKbJvY!^NP)@*493Uye^2xo*-<9^>J~%vdke-*&+>olyl=R@2y63e4FAt{yn(1l
zcR9|(7P=emX7bwY=MDvKPp5L#pS}wls5GrP)*HoNSURV@9zy^)JLkaK!y3f2P0geE
zkN=mZw<!HB(||F(n-_K=7Iz|^!~V-=w{=ua*uIrmmI4`*zV_zl>n|B!h+Crb))FRc
z&lGP=gPtRxK~VPTNU-woygR@YwQEqas+epEyYo3|Tm-0%v0mEq&nmCvvjb|!E)}Jc
zTySc3X=qSG{3XKC-5)PqX6c!h_JynNT;;6NG1Xh5WI_d__W>&a9oVv0Ma@+K)8D_F
z4X0-TR|PN46S?r0RkLW9a2kSs%>Hdf4plx;EVN^O6gdHtA?igw!v3dMM%Qb%zKIxg
z$}l&Q;ppI?(|1inHsYRy5Vfq6sE-wQa<1?yMM&HHjcEdpSeg@8IJ1la0+R3SaFTPS
z#Tfx!fm#lJg~0$3Y`2clbHeh?mJZ9v#q)N1bB}_8P<_+HoB^1KOK&*8mY7UK$lw}x
z3nGmD;t`GTB9;Yu_mn{eZZ_bq{1!m#>3qX~=>~BR%qh4?KmMmdj3EYoc&|sFx}VDE
z7|kibNEwHMEW#vJBbO|fANplfA$S~1Y6l5pYoA}AH&_h~uw>TrDw(hFYdYo4<c++B
zY};BO*$LMgvsd^g5Yj~D2Z5-tDs;U%D$La2s$7r1y5@brT-~I#;{MCj*#gNGbBnW!
z@!h(<EI)bD385oBKMRKA@TJ)!=Nws9hw3VslWY4qsthf`5AusWmoYG(fLHsU)H+=g
zp6iS4Pq4b+Jw!x4!4GWf`+~5~&x;_VYTj5o6Pv2xt8%(}=|;0a2g&R?cmc=zekiHf
zyepf>9xSE)nhZ(TIojlnxGB@a5>(4uD*UMBdV4es4cxF5LFb3BpK#@t%uEKC0DgvY
z6jCJGd!DZ76XfREe}2CLp-%KNX=773hYQ|fUXOeDLkM89bs1~eEMQ9{3I3>10r^Oa
zCm16T(;%)o1?&=|BEz)AlZ4;OzXWCorB2P%kQvOiKE%9XxmG&O)D@_z*}dF-tu$Hu
zlg`b#PK7Rp=4G`z$01j?xrV9zb|Tps49Le+{m((Xg6~gm5ba$~TI#JZA46CWxgMnm
zs;qRVtV!6hkc1nh5Q}{PUSGs}uJI^^J=G7IU0>U@K$ca>4wwF^;5V<TL2KQA!Y425
z9qq@wuF4Ab8Vg}EE})y3NE&ii1oC_bh=sgwEv?yc5zNZBsk^fS&7o}_I7p8Sr52Wg
zXXA`=1n%cxc_h5+_14b$6FFix+j-AsvO?KB4-DK4l$|)`BwHolkorg1&lbFb`N>p8
z8O|1jk?i%(n+2rUvm^NgeDImQ*6`)yw?r>Y;~A_@bgi{M;o^Vt#JDNor@y(YIlb&N
z0iY>DaD8qrwX-z*&70l5<MKF0up5xAs3<@$QW}pC-*@$gk%O}{Eq#-^<}Y_R3T+on
zB0(V`W(@y;kQn|EM*p(72aQecp$kc=X^X$WLV+~X0|{v#nkQ-A5GJYxx;Gl6=0@Z_
z$bIt<9Go5Lr?p?aqY|7Hnq7Kd#T^h?Z9#^pgU`a^@%=Njt3F@Lc^jy`HafveT~-9*
zU2ExI2Jn9R$H-tqF1N(Ji8yP{n<^r#Q~SsR(E6>WZeJ^X7+8+^NX>?J+^SwFtEfU(
zz_HaU^va9NKA*PA>jV|A9SKo}qGLibB5)o~F!({cw<_!RklMO^Jc&V*s&pdY=){mq
zd}0aUDqriUZ<_s*kh48rvgVwwgR+(pz^PGH4ph_DPT?Sw?2bNuq}HI;$GE6NjuOa7
zBaBfsa+NRTt+CV*IEHK7UA4Zg#<(}Xqz*&V8uI_JFVe@71zkg)STD;^#D(EYJaEPQ
zpn$ZF&Vy^cGVN+Ic7_>}#2=_=$og^*XzGjC-~|uli{rfO3H!x2^{32b%OFwETFyzS
zNb>`yu^Lhiw@K3gj-kckDZQZk9=12y;`7$x^w&A+)PH^`Jd-=v@gE#@KYa|=3$eBa
zFw$wMbLMFi=6&H7?bP$eHND&~BUCFj2`;@#sMzV!|EQAZ_qQxNO)F4BO1f&MH_mIM
zsp)rRpQ#3!%yN)gi6tSxl7X(iA<`$^vGktOOVVjlm*aGCtf4mYFLN~Pue@+F`{zJ;
ztI~#R&e#!%{tuKsGc7fqR_jVX9<SSZc;A&@g+$otRL916M%t8Lv)YOnEjIt>k};3v
z)o)xr`30vk7{|eNvcg%?(cK3}tHF^lFs2~-*lDYc`K)MGA=Bx-e^N?H!F<W@N~mnE
zdIO?wXv)vIG+NNzrb()~s;mBLJLn^!SMbn{$85^m*4?xnWNYaTmP?({_kcvWcxXso
zIIBF%kc*}(FuRf5LcXezU14hQm54ncg6astJ#QLG+?Bx^bt)(N$FWoG9^X2*)2*RE
z4p@9>oVcO=?@kE1CnnrkXD(2F8D-FXAZGyYg&N(m(%Ri!5;I==sGoweCtuHaN`)?b
zxYmVwaSU+M-yQBnT77PNk@m|+BxpYi%cEw6{&VO1oX#qh$@&1@_T#lB6-o%2|CwFF
z^vesxB_Cpso$@V85oau1f9!-9BZYLEX<^=p+MGn=-)9S_bH6{xT5<R<+%!>`|4G}T
z3<NBf1*<V1)A*X7S|?MbtwVj-yr$RuN!_*H*`bmzvRqgOyh(0>+i~MXMG7H`6@Fx8
z4yp)L)?aGs3C_s*%RYphx#u?id3z8sIbQju`4?D&S;F=WZ7V8XM1Su0kkm4k!dl`7
zoNyjhj5J=$`ao4<rkS1bdg}7+aYp~{jC_!E^rY}fMZ6Os6hYLmztp!g!#eLinfYep
z|4mxv2R`lR`Entou9Fwcv6p}EU0h<<Pir{mjg_Knzl!^^SomZn=vi7d*O4AV+FHrV
zLaews|51W8MPC=@Oo({ZZ|YZlsm?0vL)kule#mE=k1-x9>@2@OSegJWi5D|Xls&`L
zY`d3kQ*7Ve&5Z}X`vJaGzN&$uLcz9>H2BJT8%Ufta>Gk?He`I(mToNHTQ>R!)p{=8
z`kC3q98ANT=p}ip>qD6&neTmf;Sn$!Kxzp`>B&+;VlJVz!7TkVb-W^N`)j^IE#3LI
zGz2eVJIf#mYw<E8AtlSK73RGM98CNJ_G6Ak96jXD%cV&J9d}9{DR(B((Vi{kF-Dus
z=uP$x*Uc_%v$UF4+vD5|*(~Dqf$M{5@RuL`(<ylUMK&0cOI7huz&`gaf_BPhmZIv|
z{6AS#v3^)$CVH8=GWvKuUp{p$$s{~DHyD>!tJTX(fArhB$Tu3zjdQ)j7_i2qkF{g9
zr&ubbf(1%VxfGBx6uzj31p4{CfCWOiiuq??ZSdY&7+m&uy#c<Hl7dXCs*w1|da+A&
zbGKbd1hh9A$P>~9T!G6kwNgy^7{4X##!~u7)0<7!2g<o3ZCJki$P5<I{Y1KSqSG=9
z@CU+_>gjUQ+gumb%y!92NIG^%c6lXDQvfQ6{*`^a%ra%@e{Hr7op+FK6nyg^;MFI3
z%d_u${WkwbAg1(xZzO&c({T)L`;p9+6UE3xb03k1i924^CP!#0H;}4@1{z*e#0yC8
zpPy;~R;p5O7~)lOveQBtnE9H1i~Es0Fr^_;fJAg4*qwrxU)o$4RD#Cii|0;0qR+0y
zkj(`cx3wz9S<QVu+;JmGt{h(vuC!)e#QkWhordBZzG&6Gjl6ppu}|#q_aX6#*#Hv{
z4&QxPgKPNNUEx~v1Gfekmwgq(1bw`>*SM!>7+hV4`b6<%yiY8stGyfexjI!Q1gc82
zOF1JEf(+GTU#dT<76jQb6HwBbs%zFb5{mR($`*9zJcQz33r-oWdUvZ1)Sn<Zoy=^F
zJsDzD6|FAKvYbEU%blv#lIJv=sKufQA<5@yON2}oOSy7pX=`A=+!k{1ds2cQhx^*u
z{sV3A#@rmn8?UzqZX*f$ziNcY`I&R7+`cr7(xr4z@-M2eXy2y}#Fdzy<Vz1}$%3DD
z>E-5%eHdUqRp+}^bMkCawid5H-pAv*4X-1Ckc5O}pM#vQVsluVRjW4}mwY{j+xDX$
zzsY1dS}2J~w0;+e8R8|G^!$tz@)HKZVZwC8ecIKZQt(-xwH-cFW8ZN;{Y!(q@?0{w
zIi%sF`-~x)5&ccd@7BQifyhi=i^a!y7g^U{V(!e^9+P|}InTC>^}$jmxevYI0oOxm
zxB0XB8uOp~2;9&X1`&Et>Osy*Pp<avJ3>$74a*;9R<o;jNPbm$>F-U~9VU_qkbHlq
zp32?(FT4k?&d#GN>I>GWN&zkyfs5F$^9y+4FDvtEnMApk$mbCQwMbw{;PX~y#$76Q
z&H7kC9B=<(6Cp4jfFzBegN2Wc6U?jYw5BP%O|pBu>yhQgR~?bR{rEYYL+e%!@6mib
zV8mnEKSFusTm0<Fo2O5Mr#Z-<#g5h@h?(K3evRc}DPN^&2UDK@)dEqr4oV8&6??16
zyyV4H7tjizUz_r6rG41i{BQDnwf{*hvv56P`&0a}#nCooOAN1dU7orGxfED=v#UL|
zE*?+-nO@t`N8R<2lr^dE0PHy!cDy7Kag{T_@PKMP-Mn;jI{Ex`^4ms@6ZUR>g9;g4
z-qlD*sHA*LOp<%Iex^JTI$OmyE+CTG)!m=(t3%q~N;1Z$G+utS-=2Xm%PLIrd7D^c
zW69}s)t~C8kB|4-)V1UI3uJPY6YQzrn&a!&_0b~cW+osQ{bpZp_4bvV^}^D(JYAIv
zTxb;pdq|@`uiM<OwLvl;Eykg2myIwdo~e5lV~S3DruS1RcdS&lek#XWAc%nbHS6Zs
z0lv}Hf>7NT=F26dC<f>Y*1p}`QX?hI88<$7l55)~{HCI!BEP^u-&ob3m^@llZa8^0
zm|+Kx7&RZd_atEe7Es+J<FIL4>`ZUi&YIoBa%2{7z>l;G7Gn%|@AYqV(nqgHvOwpb
zM1%p&II^z?_lBfU8kUo(4S+!n{*OU*+!<5{?$Y>;LAl);)XbWm!JR?<iUUbNuqS&`
z1_B26x`!qlN(1VJo5K&Pqc7F}WIUlhq%)z^75R_7%e%tyOBjb^b{GNEW9-k~iu|wr
z9a$RR$Ec0Ni?~Hom?rJXk|&G0&!+2n2WtZ__HL$eGVLO^=fKEcvxw*Q6qq!c&Yt1=
zHGae~eIsR8PV-+@g5@E8G9FI4j+W$qaO85WPbA=|^7pBA#)HwiZTYnH$I?me=4t^!
zPq5uO#83ELHXr@PxKgU8-Zy=_mk{1T4<D01?NN}~6Qz%ixHMYHtMp-1F2+*U_E?t4
z<?6Sx&FVph;_hOBM5_3Lla(1@=2&>TsFhi8Pfi89KWZx^EO@9!8%p@TSdi3}4GzEp
zN)dq?_ngi|>5q*3CvxX&s!Y(-3twFtmpy+f_=M^x)W%P;>Gw_F_lZ4)o=t?(7?)q~
zvK^8h#|ussdb+ZGwO6fML+|g(cz*zpNC*|yMUfRT&DD-1A5B(Yy_ck$x7Ib$%l%r0
zxvgwAkSjD4gOFdXor80I`E$Q)SHvCN&7PD(m{+N^(8djU5)O9Vqhe&jBxas)$lc+H
zSgmMZJKRNfsTZMIaB)c<rk*`T{|Qj$Ubj@;8HsdWTG;<t>w3dtYq(VGzy*JWeRzn0
zZ{dE@8`U8Hsss@p%jIDIdn#r8D9On>U(3j@4vca})Ih*YoMdb3ysu0q+vPlciFFRH
zhxm3;W~k0Uu#8jH))e5+>}v2Gck<H%5};+y9hsP}H$wt)^<mxNPZo4+@e#)|Q{$w!
zdG()^u?F!1jhx5d8EsJ=?RvlQ(O7$X`=*K2@o3p<aG84Sw1qr<VobNymw1S~K9Wt-
zK3(rjD$9QyF2X%@smf#7`q%WGf0=m&#;Hw5LP)U>yhXz{F`J8pd*lXtlxAdv2|lxi
zm$_k2%t73`UT$f=za=J#P@7L)jm75TlTD%1g4Q{)O}tMPbLmQu`jc5Kg7OV|OrBU)
zwyzQ;a#r}WPG#A;!`}-IGlqp2!KTkf0Nj|jpH<u|N@w%Y^1w9H^5)FC$J`gL01tY>
z?&*L#_IytDWWhPJ4<a+%e9)FaT4;SWWsL;8h_6DPakYFNW_e+CN+^_YqfrPwEREwM
z9{*5{JP=CBZ_`H8Q4TcNmGBbYrj1)YR&}>mNe^D=>?2JV+R?wm)p?*%B4*!$|0bNS
zXf0SXz2+j2xrXxBpiK1<Cp&yP4=Yzq&28i46H_ku{Ydr+itaaD@wjLIu^3sy7=C}v
zz3J*AB9#rBw0!6GgxLR{Jc-_Dkt=d&Fk9Ew%A9{ro>Rw3!TkoYEn;KNoZM9wrs@ZQ
z8$WaKjS6LIwts$Mj_@~u<r6e65?=qb6{8FkDIo=5n>cL2rd0sQn&xt(X1e?PHqX&O
z@O3JxRxkt^6xlmX!1MJJsB~v_`L)wKb5yOLEadL_rB|T4!oY>&e(?HmlnB_pipqaX
zOyxca)_*Q`M|N-4qFt%cqct)o{AvHrD%n-!1HU^e@B3AzCWgjZtIiEAueu@J3;zyP
z22Ir)k_umJ8lR1c5XMqGcUtJ{kTy1cj88}yc#cUrw;nvfYkLfjLBbcpfq&@!RU(LO
zDEw^}#Dq?-KVgqKTb0G!uG34HIB@D5L#n?!njxfBM4rc4C0m)nSG)eYZ~oZU`hL1h
zpc%1xJTc{P!YJ5nNWb>f#1f9>5jd5qz$~RJT+0)YbD#YJ>)3=GFyr@90$vQh?|92F
z0%9_X7>8}aj`vCNKV_NG7q>W)n|wtF=94YdZ(gau*4)z1+mfmR2`~xzg5|!_g(WV6
zG^e)Q-x1AV#i2#BUSu~uc5aw%t1S-`LUctwXN~Ms{!eLySqBK;@P$E?xdD))iRDOf
z(SG@ptD-;-yC4-Jc=Qux)A1b>x`-cgYxC~Yz;tZ*{Uq+XrAh%^@*fc`)66uS$d!}D
z0`ONjIhcZu9wF!D>It9rFkoAH$`St$pkF)J?+Dw--bt@wJ{d58b4@D(xCdxh_8^WY
zXyu#vj;7xGtD`exMx(D?haoZ4wzXskZm)q>F6{)VIa+TZ(D-!?zuW1y%vo|O<YK5p
z7c4)E@0{c@n-M?gyIeGE=)WRmh@$_%uHsiH29>QX#q*GrWvGUC=XML2^j2+gIfate
zj!34ID8P+|9gtcZel_XTGpGtB;z6OPsC;F+F%;d(oD|(6_4mQwN0K24*USh~#GjPW
z+{FgO5S5ZFB7>Cw;R4{O5&?a|s+^BtA<#O62p`{9hH;qO=*Vtmno0F$(6;l{tmC-^
z-DE26<kZxAtkKu^<utKtAhgz&yf;d%Hx8BJmV>YIIp!Jc`OaG1L|nV7=e_8+S6&Gl
zdCAw%P#qoH3@965kQA$EjXULCgr3)QnreL*yLXk00{>5)aPt_GXWN75D(m}7IdbEN
z+FHwUN7Xu(M&c9GaQ@>jH2^k2k?eI=nrpbD*THoDL+s2-CR>qmyKf13&Q0A@S_I{5
z)3OhEi`&N^1=(8w%PM0IyQ?pH{x+c(hX}hIQvJnvlKLnRsyRiVyt@#^ljNu+1;Hbn
z0@aznnCGvitpg>Fo;ps_3Eh`QoP91S|8*veXDTB0YX6=zE~{S5`Huox{Y!0u?<=57
zDl~nL44Scu${R}uhN&+G#IoC}=gCkT`!tkgrrcYt*HS=}kwk>p4L@IC$KbXO>41jt
zGjQ>Fei3O?uPB6j6E(4tQ@YVS^=0CJYPe)lcLE%#u$0&He-YrI?~c*K6Drg}38H`V
zY}$ORA!g3<MdiR%f5qy3^2LA+Wt&F<rWb=uX&k*ZWE~T#PG*6C`qZDNgw$KI624M>
zt2eO&Z-NP@rusV=faqk~4C)WYn6gf!+KFbv;v~mgRr+zZXF+8j9`DTF6wk>1r+B6i
z0C73~No}*v^P-I%#G^;dQQBA;iDM<?lI2WRxj86}KIimW-{@j`&Y_{f3UH@AXELi7
zeT02z2C`t$Z+fp4$?=(k$wZy16SUY!mnlI+kyS+&Y4*f7v}xuXQ^xT{=6b(~llGgW
zsVSk?sU}hm7bo{b0`6BiJVex4VJ^(tZYVy?p}Y=o?w=;~K7H8TVA<^W!D8t)5W!V6
zLcXUQn2Mcfb6^+d9|CQdbAqS;Ea40DFulc!CWO`@H^dUdTV3XoWUc($IuaQoXvikQ
z2X4R6=vzubMIy8hQx)7C6^1p6jgUZ!AqEsU*4%1WGb*<2fu3~yWR_XGrUs%8Id+QK
zwD@)-Bh6;9JK?c#y}6Yc;51!xulbp{!R@<jU7ewU2|?-NuGT>WAhn#%c65OP5{wV*
z<*t1f4>x3MKbmO=gE8f#)kBLcX^>f{h)FpH-I#Io!4NxpI&$Nk$9QKW;&MVw@FzbX
zH65HcfZ23!)3SQL*&TJo3E9??5T?WL9wk%^fJ9<{^sXLkz*n)w_b@h}#)c$MC5y=I
z>`I_cjSIfeOjVa00xM5t^IJazuANWbGh(~Ja{k=w)WJ_A<>>SmA5WL^UCnKF+2=6O
zpi%2$HY_3G&`|G0+YZhx!Fz7<Him=G(zo-UYV=xdFh}5F4EknZj;~CP)BaA7=Ql8@
z8XHF~J?m;>v)JkCPx2u<JmVuNLxibz87BL#)|N9dS)ZVeGZ)fk;8@w_{t=tl)<|vo
zQEnP7b$tBLBQrL~Q?3fF;{YYKVmqYFz?k*>5~VDEV}G+^0N>^QlP}xTI*&xsO}K2j
zBX>6%%Ql%dv3-AgbAvTJ6M8qQ4qy<Bt~W*jVRm)(aa8`$t2PR%k(3M<W`BZVXb200
z^=%m(6q+3208(^aOXqg^B=JyB(r!!A!wt`-OXsy<MFxnZgm|jS7T*3S&5^PG_-EEv
z`Ewvs{xOlAaFJ^tYxnqUP84>=yR82Yd+!+()wZ>bE>I*XD2j+kP(YNZA~`CO5hQ0C
zBuPe)oJBxEauP`*AUOz<L!+oj5Rja6lAKf1-FL3WeZKSV`@Ub@s(ZeB|LiJiSGieq
z&o##!V?5&-VTQyR4Jjd8+#c{5|LT1czXP^Fx1;Tx)QuGk+YI6ys&@XCv=(nau%zPn
z?UD^Y&)h>Q#bb0;qI?Dk2C5dDdf}Qf+>gvSd9eJR(#G1WaklSG-|iiCy6V;Lb1Q-o
zh;ImkU}8)KE_1%%t2);_UwG_Uli+@<EOy;soozUQ4QBForAQL${Cd^5PN7m1;o($7
z=20;*(H*o|(DIwx*r|Xo8T0i7$H@tWdT;*!GNnRl=~EDt1ovpa{q1tqz#fe+l`6N-
zGf^F1lSo6xYZ(q~_{{Lrjg22w&S}c|6stEE8LAh|;1>6PwQ6P#0t>?Kx=nirKPWsU
z=9lNj2E((pfgz$;ex$sH9heS>q!zgXXpg=Sw?zDPz;l3hEiIjJWGemUY;$HsIS)<6
zRLCoA^eQE11UbU<4iRNb%w3NwbYfnC?Q5q$r#C6hzF9-kh6FlUE`$zNFVTB$e>-_F
z7RD120kV_PZYZ3SOqIKX09RhW7|GKmSJhAGC29z~?>MJGU2MCdmqF&a#Uu9g=^njk
zl<Vxz*z*X_Bfo1#I=|=R*uE-5&h4x^6uz0*1e*ADF}rWrA6|n?Kgl8f`LHTW7~23#
zKQa>GJc*rHo#P~J_)rZkVTu#p(hGZ#3QfoSOI2>ZIF4LYe@ssB;%ZFcRydM|qYUsF
zxSuT0c{yMq7yFp%(EBsRCH?o$Yq5ZRo{&__pd-IpZeTm8ziOGd|L7|i?<L9W<MXn;
zA}}75L;X0AE(^?#7N|+WC~6VqTI*ZfO%(w%Fq+?6o_WOONLF|7fMqHnUU7P0i)DS+
zUOHJ}aN}NDl+5&O0oC60EcgE0$n83hYjb)bwk17B$Id_@Sj4}u_9<Z0G&KLksFlYs
zL2LUSVu4|ovx4TjKckfk9NaFn#Z#S&JXh&DD|nGZ_XKEpH)!=v&SAkrKE$hhjOHae
zLmC}-abhjp$EE)FGarz2xx3oglnoMuYT|%x&g875?k2nnioU`2e-|SRo5(r{*_qm!
z{~1b2YWBImNqVh*Qo!O@b_$acRZA)rsDE}(jyYp$^s)UHxTD?jn*-ds2Z*g;bs7wa
zFB4}4US!nR%&w`-KOU72g)vWfpUA0+p-^3i+!o4~cjisJ*^kOEz|7w&nvmap>U4dA
zsP5cgr2&URD!<O}EXClLfIUqz<=x}aTAkTO%p<NsP2aywsjn#|Ii~C3#tzj!#J9DT
z*&0@Jt@L0bYOu9cp)!;p)?&Y{e3S_t@sfV8`d8t=>0=Z5W*&FL=l@P!KULHa7M3mI
zT|Ef4+KnxJW51hy&L2Y%Jee02oBudH7D^fwgMw&WdY14<mL|xSJzX{JM0P2B14caG
zJ@q*0?yg;itpRY?`o0<_-_`9jXH2Jn@-rgNVx!w&Oh!S=Ps4fmvW#KDoPPzgaZ!LH
zcPbyQp`U6CkeAz#iCX!R`r*CSB>v_lX-Z!NVUS_x%a3ry#1xwPR3X-wj%23Q<}L=@
zz@7aoKf1ZL6w5~k8ph*NUm?f`3$VBH_>~SFm~?n^>|zk15PQ_}aV3l~C8&a;nW*{5
zn16YC@iSlrO22%lKh=u-!Xs)>ges~87l{fiwZV?3))XI0+;D%tcLksQ71-GlB6bZ~
zynT-T;BMG0;eOuynI}SrYju!Gz`;?)1eVmA<ML5^IRFZiORR6&{#vr+lL&aH&{Ypl
z+gV1mD%=5u0)SBD%w(BbJY_)a4MrpK%{+|NsV)F>L>&sUe_iUmV-}lrJ~@cZMnA1W
z(F5Gm9`#z(8|1omGk6!)tyYVZybiAX#E!juQ^}tmfeTEFQlDYJhOmHCxoWVG<4w~>
zcz(jCf5W5zdn&y6F=RZ^ROzORB~(?|VAZH(fa61f64PHE%h~wFS{V^`l7!PBTg2{C
zuI_Nr!K@?rV=9^CPRs1iK&3-(vWuMhHrsl)C};znxUBfe=|||%)h>4hioo~}CX{2Z
zyTThm`R3i*n~i=8y;TJUEXI;2^o7B_M~)Y@_N<EcT}FMF&hc}SO?6c6zYs(0QLiS^
z%;v)9bi#(h-ce$aK$Yp2rY69uP|}T)A(<s7)`!_I&Hq)9OL6PZrl&B%=IVdD>0s#4
z=a#n*XT17H>Mw)gh>0^1y<E_=oW_G+ckjupO^0YIEA#Jc-gFkJ4N-R~oO}|kSTb^W
zhn3<RAII&MQjkQRK`Bv$;jk)F*Cge5I!Ck+WeA=?KWB{K!gYgV)DZH6zT(j1JUlS*
zc10KTi^EOrqr*aM(XAulZJ%V<$6+jylW?_QTaEjeiO$FH6QM(`9fB*v!DuDA8~XUu
zN#K%GLmSc$e_A}>-5vhJ@;mIemxV;~IDR32%VZ$;n8KLPZrp#;7#S&gVbqb_262Ym
z#ih>k4|guVS6y!R>ULw$8-3epvbv}924BYO(u2sQDs~GLz5`-5{V}?4v-E(QB~31%
z<hpU=mqupU-FV5?hjJzNes{f>XuW=Eph(Em%k#AZARW6|!lVGPpwPZE@yoc!u3N&p
zd~Q$RhTg5z=7Hl#C33S=VpxOG$&j^fpt_)D^4D}$m&nx>Tm7m|lS0rg1H<j9qdiQc
z*+K9XuWDy;xCU|7^l-^^Y64U^AAzh{8_Fwzu0k7RnCf(TU(daK`SNQ~Nc?mKbDn}j
zp<3bHv88TGb+$O}8d0nE;2fr`c7ui<`uT*FV7;pQ)TiAls9It<jhxTiJir4mJ<ofp
zAMw#a;y}~W`UWtT->+73!T<ZNCb+h7y^pxE>Z(2Ff~)HdD&KE!Z{i_$TAt$l%Q0fl
z;mRIwg_FbDouPnZ3bNXwJM@qBou3&X97XN&3snmRPP%Cih8Qf??$6MIDU7USd^&qC
z&YFI6+SnoO8Lv`Qr<0~v<98B_kxQhLRLPQ5@T~pRKi!c!q4C5%N<P(~@RZ=J;(qMf
zJVHdeQGbcnD^D*KzQbo2>iGKTub9WIRDpq)ldQsa{97+g1(PzTx;S*lR3Y5c&4F6B
zHLg^^_JOPG$rmq=_J4ENdeh?j_=uTw#1RaZngv$G$L9th$;dvJQgLM}zOQnem5GX<
z@Z8ws8S&YdnM%6q6>-;P?lraA&jPaut+fDo&5g|+s~pu-Es52n!E-UZp>LnvG&>Ep
zj;%}ukDr&5H;vR@PZ<6;H@uagRRe?Tpvl0NuiNkWCN7*>Ugean55zKYf;l;i7r@xv
zKVX95>~ZMRR*D1SH{n}50pYSW<Jf<^^NL{JW3g%+ha{)Yvl%of<RLP;&2;^80N;_(
z*EH9+3@^zl!Wq9jyptO*KzLEzia~4`Op+QCDq)e_yj$@bN6>NKd!1Wj%)v>BWTK~n
z?-?GR`U`9Sm!S*MKAtN0#YUi<{^J64rE9Hw264k2cg3bT3y3k)kcx^65c^j|1$G96
zarRTrHz6U9$tv$-SVUn@`)33|@}VOOym-SiILuoh!1emC8lMU<-eFz$TSs#N)2%!(
z^z&!JI@{L}>-`g8e3wHYJoyl{$&;Bnk>a{~X--cdFJ44R-111hf&k1|Y2A}f;`bG^
zH7IwWETl<kA0{+UbcyAy#H^mF#jcGP)@ZLP0CG@k*dGiw{J)PaP{3@=)nkHDfU~vE
zU%<bjgvWo-`V}Ta_52!q@QW9q<;ls&42aze`TKhPwC7e98^Z+Mait*mZ&KnhE=;bO
z(-VO;Ap1B*9V%^n`bS41mcbci5pqy`!iYytPJUAYOpr;+0g7OqGb|THeZDAOIkIy7
zkN^ykysDJjb0eD5e{4(ooY9TFeg_)OY4^s58%}ll4$`l{$5?q>{HtK$zl>dL7E8gm
z-{hW$r#9S-fyr4NSKGg8E%btp*QlR`86k$(sCC?GXVp$>{0Hbv6o5ebNMpm%A(RM=
zB5U#sT#39<#40=dxZ`?~>&64w8^$sXrns)EPk*IG{(W%R=NbAUH7G3f{HV|LSsI$4
zP8TUA?0o@TD9<m1$H#Z_=ngTMU1IOz5)@Puw4Igc@ulhgwB3~0<Gf{Pd6{7T@Xtyb
zcK(#c?X=^$Jb+^?IJyRd=4O&^1^%fexbhsRL(q*ARB3pAdYBw|hTsgbOtMM&yz)8M
zy-wRJ-n%mX+6m8rbYKUu1SYQjw}O|e$H+}_5lqZ*k--NVl!D3v3VOFU*7w_YaId?@
zK^4tkhnN6guHNT$XsD!~=NIzu;5BCO`}?z1gz)c+Q*heZmwGwukN)~qfIh8tUHlG<
z6{&ZC9DNcg!q-A*dOyWi9F!VPTbP`*4XFP<#zMZ{nAz=|nD|PzVGx&{eEdIc?#vRr
z&LUFWI`07^t6!Wwg1bN*wz}-_>N3C#oA#4%y`eb%9B$9rI>`Q7|793beNfZ80n7gh
zjyIM0iz@%yNit~eN02l$BdFTJy}A?6!Kte;RIXzF^GPz=Cu2OZGN8aQnRqo07DyY8
zHF%Rs`{%q*+y#Fk^f0IL5&S2eaLK4m<o{q<YTp(i)7D<gU;-SZ;HT}KVfeVZy1Kq@
zA5@dL-+jV%b=BU{(Z7-la{>FZbzRAPT(tjRGX^J)PWE_W`DeE5l6<C*b5Rk#z2NIX
zhWfD6{x85;3)lFLUvz87?TsCL*S(F^|6~m;>oF>jB1Z5jydWw7xd#Y>e{g_ZgMY+Z
zz<5-YG%&@eHv2tT+2AXb!9Vx59p{hVUlDXe6?ezJCdEOoKVuDJWd6I3yf;VFy`Jby
zDCx*)3f5dsxas}h>c;)Br7rXn%4$pWP2<nH7GAItkr3T@EWv(6$##w8@#p8kuIH4k
z_1OCzY+l~THk2eF&3^azGs%tjH>kb^zGSG|BfBZyf=MlXGq`LPJt`tFxZLJB@8)?+
zh}*pVpqAw{_Ywco3g7lEMm$584r-}z2!EB50aAbl>Pk~18GRvqq5(x;sCY$AD(IXz
zglCL@(l=Duou&)KAJBmHnI~uPPM*!qhVUkWNu;oz$tW(oiG}`GY}b5!Pn;xzgx<Y8
zjR&3pf9XQHAS^}!IqxMIZ4)s}7~tVIob(+PLQxCg6EXPuu7Ib93r(I~0#Dz%E)ES`
z%B;AWO!ecW@6SHpKJWp4!6av)!feCsj{Yhv1r+9;TzL(jh+iBm?nLm9v+!4(JZt~Y
ztNbICe-79`y7G?&`^Omn|L<4ywDBfb6sdAjrf9~AS9E0LRNfEbbzcSxo4DoYMYuT|
zAHY_iyduKj(BIZVJ;S1DCgbT@%f$3m-ZSZt=ib!RG&3h>JF4nX9i3I)fMCm#-nCJm
z$H+qi^*bNti5MOQ0C${sHdP+ysDT$H#!H@;#&5VjV{rm_!{Ss3&k(<1H?eFRcB|qI
zW#DmrUH4OAz^xPE8J2<@O9>oI34HBDL=}g6HndI%Pjv>WRG5AEU#sL0+Wis5lbEl}
zF?RLN;(QA=6P}@Cq2L|@zhUmkf*9|l9usiZlHbg-ffolK%daXve-H^3bI;?a-v=)F
zKJi)TI&{S{te75N0_6AR90PQPJM$eQcwW4RfCx%t?sxNpcd9k)?C-8NK2b`H`c*?-
z+`}aV7=tq9@|7Vg+Vz#okuFr~VVC}oeZRAl<SE*DF;PnVLVZSk%Zw~JIftmh&p3G*
zs`{Z12uk=^l*(6Hc1f|hldqH5N<7VHPrrtW1vFvYW9W$a^a8@?q+o!S-#_M7!=av&
zNjKkZ9mzlg366fsSHT9Q0i1IlBIA)B08k6wf;OVFP*{RW=Q;2^!y*vS&#0wZ@xpwl
z`0}9Bibz+gL+tQhwE!Q}a_`XK{wf21jbrmi8&B+>#|^v*88(&OjsLt%67URps^i;v
zgrsyNfG9^8CeB4Beo$YPA%+sSdSMjCJFg@U4)Zkt<~Uh-B_v@CCf<;MFW3=&(l=Rv
z>JlYb?O8cr=oa3@BgYr$<1_O0HNcB+ZW7Sm1JA$b1m}mns-1MEg$&9&=WKD^Vep(;
zlbjWJ)>oBa&h~<vm-lRV7}#dx|M)hCNkLkno5ea$9qvnn-&F{YmZGL>mf;n0#=Y<|
zYq2@<$6?*mlABG8J~rXe$nxABA2uIG$hut%r-n&l99MmPLx4<cvIkC6;!Zf8Imt27
zozpW^gC%?e2X!TWp4&ZE)3e+_%EliqJUa=Ve_0K5v~)(0D<Yi|;uTWCeeqw2`mh~`
zb^nvQY=YllW+jf>Tz#<Y#JrexbUfHwA042rR6tpsl|NFm!e<P^Z@<v#=FJ2xw^cP{
z!>aoTteY4Ldds*hjT1D38Tf=Ig_{dRu#}y^YnnAX88DoOcy&)4Z{Rf`TfNL@t4MIH
z54tJvi7I6PUJnWW`3Mds0ABxa9D10y6G#OBeRu(sM*-sRxnd-CyoB3~;t;=?+&yXd
z`?E>ULcH>Ypb-ly9=zNM+fhR*@U3&KnT}XyAe7WNaQY-+Bd2B^7>v^|Uv7eDDfGmU
zkR#_UR#?Sia5gb*jtF(UgqPId6K<=L2tEhTKhOuu({}jxxC5^SC@8Py&Hwn>yAD~G
zpZXLCzI8wnd~225?-3tZv9g%KzC?mmQc)(RU4v~Z!-T@IU2jh!eN6(kjfhzsdIQ;K
z3w-fDwla^Ud?EX`nCD@z*p#UlAnQ22d4fCOWbwS?fmM<dY|2k{x&Qc~1q&{~D}W7~
zGqCH{g)0AXEA+p@%;FHRDUPvS|7pYXk4pTb68}Lv{*Oxh<0bxcK=2<g@&71(_{U59
z1DyT=PH?pGuaNrxW0iPM3#C*Ter(gN)Z(=p1cRcI*rhA1Y^ZW0&^<6>BWrHK<D>wW
zect@Nq9dz<t}d}Vuxv(qRJoGP)X4az1#&zhz%z8h9vV+R9-L`FX%4JjS<vxAcw;5#
z+#F(fFll?^94o`LMjqjkA@MDv<Y!91Z?q50Gck&!w|w7OOtfpwQbq0>Aie9VHy2A8
zbMv|M0PDeu!0{3Gv;6^VFgX5r0|%Yi+vN{Iunuq7BY^)EPQxI%4hG4627d$2zfMCP
z``(2|M@<OtyA=jL0U4PZrKFlw$FCKJ?lRx0lCezL@`=(CQJqqWs-+#<#ZZ+Tl(`rq
zw*uYYI5~0UxR{c!^p)4460E(a(eLJ2_;R@(t|28=-qK%tN=%#?wsGNt45mD}#Po=;
zWNC@MWm%%E@olqFhsd?}bnFjI`uj^w(W*rcM&<=YI$}@pfh%@PfA_vBK{w`{t7s&S
zWj{L$6?d;8V)Z!Qy7)HelaocSnPZ=XW-MuEwfgU!E=T_`!|s=!uEHu?T}iD+edsAr
z%>$b@-X!%ylN-5bAjZL?Zsxg|B4(vVEl4Hxj^sFK(lq*9c^7OFj%Ol<G$*&GyKs>q
z(Sz$CF1y18;%B^*NiYLs&GWa&?`$Zv-ahJKa#-PLGCOo8Q>(BxJMXT|NGGS>?5-*t
zi13%ok6RvbM~%EQ$WdH<dt0|pWJAT;Wz2Bx?TE-D%M`a@=a8EELxa9h*Q%a_P^_1K
zk6>1*%!pXd=vmDhBheg*<DLj-Pr>w_$OIPW2(xgq4X@RWAMZo#V!kXVy*wP<oz`R)
z<>(bOAD-bd>1JDd&~u7V`W}NEe9YeNu3XWcT}NqNVExW)&Hk>Qyjp)GtA|L9Up+u=
zrS=?D?zpocguhFL3xTb%)gWj;D=sb#QyGTIZjA!R`=Is;P#LU7^Y7u4qyR^Xx~KjY
zJ*qiFuD?oR?@R|(MI|TG#Jqsk^_>$~3zy7C<vZd}p^JzFZSfl-9|jrXO>BBfl+{~L
zc)_}XY?LGLl{A^}u`@+?8%yw*uM|DiVG)?AzvtZq7^Fn5YC@^2&~lxRmzZXWW0DUx
z*mk4x?dVBSjP+aL+lv7zquw+1LbJ=9$t%29kQfT6-05IJ7{466kq=-HcTLS9uxQ^n
z9QfBc9~6C@Ldzxr`k<cH&I7_@zk#zLs4FJ}?8LvL+Uz!Hom>pfDRv}Wq(=hh@r-vo
znC*AQy;?P7+n+P5RPyPnz1wN{Q1EfcX&OzUhv$l2+=)WkNDuT63O)^<X~PZ+ie}25
zun=&5AyaENi%>F3TgL24Hy;>By7Z3qG$zWHHIl_{?@G&fTJkK792E?kZm3tpRy!9%
z#Vle7%;K2R*J<Lsq5=c@o6Vs#`?TORu~#q9t2N^pR*WLwBg6}zu=vr~)#zgOt(0>(
zQ@ehjq!!r56FQTrh9HK9t3995;SG~6)FJ_GfGXjJVA;y!WLxm6QTC5)1AuIEAI-mo
zWowO-E#co~s{!p#bD6h{w`vBM;5_gQQ_lMnL*Bv~Q{7~zl(s5XV!mmPsYr_C9JZc1
z<*O-nOJx_M=3R-bHQ=KgL0CG8{1nW%C8Qar=NQDdPh*|ey`|T@=oral@}adPk^U^@
zce0V^1irnu6AhAY43A-jnI4x(B>tEzI?d&D1#cqanYyDm^C{mf1++%bA~KDaWfXZo
zG#0%|sfB!+uII4hdk3%njqp9o-h3ln2K<I{4q962hI9CWYj%JVdB1%cAEuzRaQxg$
zmNP7{g#_xZ4h&(QT*?y6KB#lS+I{BPf8})y1)-$mXqGj_gzLI4%cnycWbs&&QFiS+
zCw&{=-cYyij8tXOV(Xb>*J5WQ6w@K7dl@SKmJFg7HG89G^{eOdNbu)yxz*?2t`gEv
z(Q~D|fB&v2mJ;F|snfiuFL=vjIEV}>eJ4z$r03~LUx_aDpLnrnA&tEv*;IvSo8eIx
zZ0_4@4(dWgwE|B|UQ_dpEiO*nL(l%6N0imqqjnQB%=Zc@FUuJjrCqp4DeIu35-_C9
zk|!2IJK!U(lAHOWH;(2+gQO%~vzWbjlxh?+XL|*OkCq`b*$~nP$;6_WA1YJSyg|hO
z@R-Z)Hp82Ssmd?saU!lw_@aD#LcaQf6LRSWzCKK5<-*jKw(H+c$eYs;m;Og7(f!9#
z4<uM%a_c?uc`#lliTB=2s-ePekxxr5R`}en-f4>SOrp$^B#sV@f<^iM=exSUSg~;`
zQskP;Or}`JzPRIH(~UO~mB%I@DSh!-UG*0<I~$aLnXK&bQ%{}TPv~_@wsrjy?vuW3
zdT(1S8tfshQKab6CXJozt&yLydqwt5ZBJLvFO0gp%h#?L6I$=%(EU+4pBm-pZg8{8
z&26kB%(h?Z`)e{UpDR04{DX;g{T}U-qaD$LWme6)YhE|F&40!v*EoBKX|fSlh`f*0
z8!D}NCR`|yFxe9>mU!KVQ*TCOejq(Os#H-(eas!pm>@bWlviYtlhgIyP4)M$6+M9(
zd2?A=Vmcx+N+^YUPxIh#c&)BqPU&HEA_}2vTj|<6<h0qBL7qP@e`<S$QCr)oF@+!N
zW&OgFXKP}o=aQM{q3ytYoXbQmkJW5lxM;N77B(t2uU{*O6{#wi%urYD5^I@5=(Bjw
zZI}y*y&5gL|KK8~?yD|eZ_~8k73P(pPjMlf{7T+vull3)X+691K|Eq=g|(l|v#$?^
z`{ofm8yg1&3Og}I>wt2549p-P5{1#!f-p?*9R*zHaKYnkDxfj9Sb$C>Wm?Mq4Jv%V
zZy5i1pgwmbC^lszbW<GAlBNU`FS8UfQ|$*x!`)AOYTjAW?%#yHeIIRKzwUU#HK8mo
z&0MaX!pcXB+x(goxmoghkEcGP>B29p40ECSZDLmFA4cmVuxFp0c5+YRaB@$cAJwch
zFJec|-m~b$k~A+rd(Fhxwpl)ZlRf5$W0=_-GhQ+|*#9*eF(D#4U74O?TeOuiWb~8i
zqlOb(WfIb<1~#>W+lyaGsuIYc3e>XGD|w80rgS(7gixI<c5uU+KwI(t=<<oBEw_6n
zkI3=*tbH$(2-1AAs5aJo>O{i`lC?<TleL{6GM+tt$+o)j^4AqUeXcr>owJm4UVDu<
z`{wBtT-7i0<Rj(`dsD*|MQeh}uw8VcvrB9B70;2M6_=l4svP=l_+&jje^Xl8)u51f
z_WIq%x&>){@~`~ph#$x7m$ohCO>8<c(nYtu-d1UPK?3=R+611ay*(tj_Sxf<e1EAT
z*OrdbYxjF<;#IDwDgTNLFp%Cz>0~#ap((bja^sFs7vb#gy?~-1v2A(_ACuub;WX$j
zExY}S{D%VOy#;LJ9Rimi(GnXgx1GUrM&ZdP&e^9Q)6snG7rws+mhdGUd$#T2!3O}s
zFNYb<M3rC4FjlMtZnHGwZ;tWSIVfd&<F0m@t$$y{^aHFkxs`tBx-79Qao16Vl*1x1
zEmNMYjolLSTH_)%BsjP>)h#&q0s76-weZ8TA1DDl!$yMJog<Om<0OMEh18{{qvyG_
zn{pcL^Y~JtUNB6)Z}{HRQfn0`$|kUN@o+`(*?@l3Q%{tCs+(|Bg=;_t-BYauFM(o<
zJoY+_Vovw;6}v~3u4Pk(EX#-*<v4P8@!-wffGfJiClm;Mb&*?1OuYrB`j$;p<39qG
zi!62u_A^xQCa#5#2iMCNA?0_A&R|e#!%B$g{g@g5?SKG^_z1(D0LVU|Ma7MUh6K`F
z#;ChBrkkErATcq?koC{6c6eIB&1kuMplJ|aF^>8nXx<`J<fd7gjO`!4Gr>D9mRnf`
zhD>(XXeQVYp7L#6`Fh3+^~1@Flg-Js8M3dmq3utr6BcuLlG7*woSs~hxk2Z!pi+T?
z@Zl@z=LXJLzY|?6Q+WlwkxD{k(WiYD#_VerMB1N0{KbK3g4~m_zZ_gc<}%3=g=Zbz
z7OUbVl2<FlMxgbWobi^SGl@(rdlR``)<pc;;^-v5HVP!m5)1%9`~8;zIKNN=vXSSZ
zITV~b1r~i6xcu^mISV&{_zm@7<F4{I<F3X8<v%Ag{;m{P>xEjmGa|QSuJZV~Uhk4;
z4x)$`Z$eHrOtEqDq_2x&D)W+b{bQ%>*-94X*$62kmq!5}@#C8a<TM(;!KhsA6V{hf
z?~IdNJ3XoCY;xm$+KbPSzajh5rq!6X^I^L+8nC0NW@(c7-0m+%BHG1q3#vucq-K1#
zVA1($f-M)<80D^2D=n)@z8Y$~X6{AjN(ZL}&t*=tU4rH?l$nB06W*M!H1BjW+L1;3
zXOg<_m1+DI*<DDV3CN<`O3_uDiA>Sli7wEs@Icy*<>%CLuO8eP<^V2cXxVe~l?u{8
zU%SjK*^}F<oL%>0mn92`7(OUmW}*H~?QKIy3h~)=X|=C*Y3tmzn_JmRszL^n?8S{3
zc)Gv2(v6WpcH9T@{Op%^=zZt6Q;ueZV$KHUmU-dGfiIVd@KhvfrYG8KFU@}9A;3t5
z28@~pVn5bOSe%3v6-75(bCm0<*|p2{K6q^<t4ljg{E{w<z1^`t&bGHU%tf_x5I-LL
zla<M{?{`+qxdO6yQ#Os}*K6JpAWS^eXG?<C&vVrpp{oS0(1+b?ki}or-`D5c+abFd
z<s&W!4ak=IeuTAq5+s*Eq8ej8DT9;#$y@-7>?x^yTj8voItUvF*hPWPr{GdH;0W<S
zwa)14Zm4vwWQFq^13J8Rtaa7N=YAn3O7QK!w#9ni|Nc>0?!H;z6^B%=yXhKXqetIS
zePxc`D0$%I>kyhkpI%+T1aq-ZH+RHyoEME5<@Sl$@3|nm)~R?$h>nB0iO$Jha_Cw(
zJFR{AGNNwGj{P1$Ep&q-OVWc#Gykv5EV2cqLh_Gk$6KnHY1S`Xcu8`7O}AV}<t=ZN
z&V17K4U68R!jCgUpB)UR<6fRQaiW1WyJjBcFE&+E`xAHv{R2UJdD}-yI-x$-7jgn>
z_T<Kbd7>(w<d}5m-l*Ebk_|~sH2dLAl!YT1LhY7VHY{=o$wAineF&kJ6PqY<XE>cX
zXH4uKXSj5Xa&!GTh)jK!bqL`H-P$W+&83bHCHCVD;)|!#S0W#bPxVP;sTi9@1+ikO
zg=ILGox_~Q-aMV2{rM`opr}<xK!f%yJLD;sb>8G_`kuUA(i+RX?03I;_{KP``VLmZ
z$;Z5co{7|iAbh}Ulv(ygyeg`@!INu#NXxgJGe6VKg)9+W8rxy7vinis-Spx-WKeAX
zaT~d#xKyiaS8GsMnIV0%v0;6+hkQIPBjamCA2azaYKTto@h4B<ReC+w3`Ayj6ASm2
zI>M4`GL*2oM_=lUQ)zAj%uo`R$b*uuLfsn|W3U{__ET_m`;_qk<LE;f>E(u+8S-=4
z@8wj3_Wil)BQx1Fq-PpG!^jbx;yGEBCAkeJ|1C;=H*ja{xENwgVe-cD8G9@a&e-V-
zew^@c)!{grUHHGAu_JH+Ps`h##3cBPS&J}s{8bAOMRDGA-B<J+nt&5;;$=d*^Owl(
z>o1SaE2!jk7an$;zgMJRv`3(VbsrBW)XZzk?KL}5@nZXKbM-DoGsdZY8Es*ZgZ9HS
zRJxbOj_%iYFl;nK8k2jh8p+yty%{$T7_2Ipc`F2BlcqyGf<RrROU$pzEVWW?lDA)3
zd#}{t&eJ6CyXUQzr$3h;dT~X%Ywn&NjcH;$7<OqcZ%%F94gZkCq}}NV!WY%IcVqJN
zyu{+Xo92P9`BkJnpGEid&6VBd#=idCb}M=hgCWla)a`iy_T#hV!m<HJgVKyudmZxq
zrMSBePgUkP<yDXKm*~)&z|EV1c^q!?aRm`pcD192heK>!u{0=s+E1emP_fRS%jOHs
z2LvuB_{#9td-+DpyhfJ3*gDJ?@Ey`#yaaiB&lo%C1*OZC#m2|8)S*UA3heWq=S4T6
zG}bg(z`4;tBaf;R^X;vQDZ?Ed9B1=Mxhf9r557^g*qp#pb_uLQs(6OI=Dn#SwZd!6
zYN-gH-xjj6ik!V!son?rw#fN=OOEQ&>K#)n-#*&4ypW~WLLd*9iIgYD8aV6~0g4gB
z9x^qz3k-<yo*ZF)=dDEdY;^XVh!_B#OV&ms0C+m%fafSiq+uVIp|*yPh19qAc`yn!
z0>3o72ZHgP3|wBf8NV8DqW}8CNRDA={)FpOAJ0KyZ`eO55%EDIu0PJGEG1z}zn3g@
z`MuZp82XI#G-T&x9z34g_-%#Rv^TQPE_Bz*dk4*Ex;E04Hnqq?&+?GIx>3-1Eot0j
z$6rZ$i09WCD6coLH@Mo=#>w3&_7t{SZ;GN(_v*(RE~)IumCq`9EP1>Bz__!1vk`N9
zI7M;3R)77<k9Z{Kf_cD8-Pi7qx`xU>Rabl(KYMeaEFQA|%AG-?cr0Mbo)G!(uf_TC
z49nhH#glTD9*!Jjgl*2G@5Nu1SgSu#@F<^T%X@ds^_3>uD4{hlMUEZ(59zA+#!cVq
zxuF@ftK36fe2ULnG(*KC=R5YdNAC<@1`sb{`!h=)#!k!w0fId(L=ccFArdutff@uh
zOSODWucI`ADvIk<L>=RV_XlK_miP=VGZ*L{?gk0rDG>Pb*$!Q+JKV?r!TLJ?ezU2~
zC}-7>4ngJC&E%QpptUlxx+TA~O>~lf9wtxF=eFDZgcUu9pJz(E8$bIn$UyufxsFMR
z07=wT9loZ8!)paxc>TldwDfWP$A78XQfCL!wZ;RL82>I&Q?~veP2I@o=STP~TMzD*
zH<F7y;1tESz0|OO3<8Rm>F)NGVAp~Rbbgk*wvN|6)PRYF0v#%4*gjfHj-N;@KV_4?
z!ZOWN&))!iJAuA`QFXS)t=+KcRGaY<^^)ZeT~`Yq(H4L@qv}GEc{6>-k7{BEuClf<
zly^?&Ye*UJu8*l)odBHFDEGWfv=E`p&r%^>i4p!en?cNEe3TZWYMASqq*d&^7hB(t
z5}LKx7q6e;H>6#Ez`k6BQ(yKA5u$3b;!A+Yl$=jiUY$iI@aV33e63hSGwzMvG<VrR
zi|Tl8F4@(w6xD9T_4c)<2g;)uhvO`TZb8Bm)uLT{tcV8w^%qfB2MqI8;!Z>Kf6!sV
z^ud0q#pc&+s(dtSt&YR&r2UBoA?MYoEv~xnmRU+`1`dwc`o4aNRiB=kx5Y!xcLYY<
z6G<R0gX;T-WZMOu!j}7u4pSRVF@vE|SI5(b%OY>5d+i`M!aQce#i-mnL^8XH?>H=+
zFs;~{xOL#Y8$O0k!*7TdOTD_dXAJa~9q8@qV43`bj_`bFd5*eq;GB5FPe7UwLp5#~
zZfBfvPXxxkT>J9^Ck!7S0r+@Np{#mPOzd*iOwlp=M+r+xs%UB5kfhtOirm{G9dG6x
zCO$3zDh}|qg|yDtF7488e&Z`Oou0EPzhq_VtWtpSn3bFdSX=Pe^0(y6eH$X<gOa*3
z{62a9tXM>BsEZH~jP;t3x~#;ZX)0t^Q$tMW<GC}RVEx|FZjnMB!X*<Uckb6+>pEQd
z6{S`bR+0REL|A*E)F;8;X73w~Ms_*>%;g*fLx>+$K~UoJGcW=mOhE+Tt=vtgHWd{L
z5lUS{^jE2yXlM14`KrA2*)nuJ4aTM@OOE2Ohdinp5PzC`;3qdMb6)84<eJ&FF}`?`
zQ$@8_Z)Vzbfr6N*8_)QXob>G_>LJ-hcy9Sy50!{WoqE7`_GMTD=vgOqON%mk<g}i(
zR)6)kMNVeBE&!g}HG>sVYu~7xqpwzsX)RVZK<l)8JMpdV`j5=S)C@HVTzWN%3}_Eb
zrk1>$z*!+I)Swx7GSO1|Cla-zy$Cim`Q80rtXB$nDX(d85)%`bIPTH?c795q_w&&-
zTM-1pcVq{Gf$z+2!4zt9fhE(chOwn~yRk7fE(hVWG&=rC*4S+?G(O*0Jwl5hxc8#v
z&YX0Lt5p4w<%hk2M|g(eFNHU1eQYEY70JXKjPPB?J=f_e9&BRbpyI~sc#Sv?=>m>J
zYRmazbj%^C)xj)d5uON+Ljt98#oBJb#*0|MofY;a;*$6cEs|)7C@%B%I07Fo$2+PC
z#_|d>5fX_!ajM~K3_DA`Vf$S6#8A`fCt^M*U#fF?@^h41*T*zM)tShZR8M9a#1+Ki
zfDC>^!FMsn<}-_K!#CR6V<qcsZ)^>%h<fNxMMc-59s(0i(iC~hLt^@**fkKMbS+1I
zjvA@-8^;TAKNIm~`N~ph34X((@0=1wx=ZL&X_&qjR>tD6b4BA;wINFJ02QoTi_*r^
zs!&lDEqV@o<nZ$^_Y(xSd<yG)B&#0l6_OC#=~B(Sry)``bHpvNd+k=+<;@oqgc+G1
zT8>fK17tV;i3WeWs(YL(zv|jPNDB)|i5|_6u6a{_QqS9s8<9KZdmQ)upn7)3dV9&v
zCxS3g)WYisvmc)+n;zKLA9>Puz74H@Y8+MUWV?}Dtty&&y)kv8;Lg#Yhn-yVP}#M#
z(l8!M2s67UHWMf0#kLdXWt;KIsynw$H1_l=U})8Uc>J2m9CPdtUQweyY|u9?-|8&R
zG8y6<ciRghf%1%dM&8_6(bcXoDxH~`vq*SKf$x0&#(_skJ4zS7!8wl~4HrSeMV%mX
zZ+86`$uW1J42bkA1SXt*fK~Vk+GPw&1Ae*rwUPW=F&^t>h?8z!3CR_aP)d$jn3gGL
z^GIe1y1PlfE9u~^PM?Q4ty+t#5z}-cXs!2V0(&f%K8%tra8!z}eDNZ}e`w=?uf%BE
z%Dd?t#F@y!c~g0)R!nNDJ6D^qpn6TV8RJ&J;{@297_-pK*}Qss^VOT|+j-rG%F`zE
zRD_!BOwbjF!|&hmPT@CvJ8`g4AvQaVMN@24E_-8xT^o`Nb^W4zG>Ca#0=|zG5HGiT
zj7(SQ0jn+m%%wL9I37Oql1|m(W=N~`^e-0aW~y%F#wz*g^xO_0IUzvp2y-8$-5Eag
z96C)6karoPU`V&3{j*PTW;r;Wi&;1HJ8O!TN6LmhR^7~9BC!DTkGM98Y&NBm)}=a$
z=A;WBETD(Hftr$H4OsihHw)U2j(#-FRFX-@4i<UP({XYmv8gUTiG3WiWmG98VYGK=
zybqklKBHEi(hjw5F$TpAhLOnRz56uug&2yrmMI`=3-qNq$$AKb^fRR|Zo`Ck<{uUS
zrpEsV7676E0{mBH9axWLZL3CMY!0`%yz@ymSA92SO^cy{3W`Mik>@+dxh`imItx&1
z3MgLf+*J4HCRaQ%m_QcrRhgBXO0rHLNp0Vg5aE*I{xd3SQyze0IdGheAheCWoGhe6
zXhXMGXzjJ9y0o+jwuylf(zrL#P;kR8m3?`GYsnbD;Uh}qcR#m3p5YqWs#hoBFw|oW
z!J8vE`ue#zR(CCifRxG#@q2_@F*;~<hd@bP0>J*V!y<rb@(WDfl{>Xw-25(|eniGW
z4Ut_u%jvdWNgQpmoVcb%@5N*K-XtSS7a>gnX|ROSh$(*$OMQ}z?aS+sOT|>^AjB}8
zJ~P{@N?p6$l#oH0S%KcKHM2bWy>Yk1Bp=&BHgSYkqfLqRH@US9+VCZY^i<ccf_wGS
zDG_#NKX<(gG~7}|P2V$pZ6c(dPN3S38>#hYJCM2z^+`=XI0>?HxYFtG1X)YKR*Dk<
z2KGEu*swkMr?&b%8%RP{kLkgd@+C8jjPug|Rva1)N|@(pYn)rR?R;X?mv~=DibIvl
z^yybFG7zf2^;Lu_^V>7ZtvQ24y(^g1I*Q4((G4<#sBYmUEBuDp_>w_Jf9BHekA3%+
zq-xngGIH!tPz~ar-rs%y`b0%Rv}o+lqB<)t1*o#CKC_M2njg-`t&A~to3}rmMYmc%
zee$yqe~H&RM!tv|BpqL4g(Nxo*YYD8m9Gv*rA<<&)-Rn2zGw&JK{@1QKC%^c*5upK
za+0+`O;fD5m+Lap1+|lA0%@)61HYzHWRUz0%}#w?!|U)cT9$%pUe|}a3$lNwJS}y`
z1ReNr%qnjexo`M9g9(@owj~g$OrQzLe*7Ng{K)AzXOY#?N%$O_;J8%2;xIYeuia$e
zy%FFrEIuyw+Rbswgqqv7whW88TG4W#FW(UYJRTc4xzCUwsJ!02JMn;u7?&+ueoy=b
zF5dN{z`>oZGq6Pifr$-FkAF~mb^*xZ7Otc_r=8RUh~!_z#(;ASX+rnrr_S^r5c*tk
zaHD~n6Vm2n)K~bZAr0f~KiSPbd)_cN-EyD(%$>4C{00k9Ezp=)82NMhy6mnU>HT<q
zPQ@VwZ&`{vUU-X=@nkVyMm-7~VY<*yTEYDug;jrXJ4mOue4*<PVL>(=zJ}}<9KL=%
z2PcrGRXUWp>r>f~mCG2)^E{d7)j8Magw|T$^k3IPU)pM$cGy;4xxc%#m4j&QjO@^9
z5^)$$c5sewuOGJ(p%XY*rt@AoU0E2uUAI`GVv`5ukVIXys~CS)x4k;+V`~U$6=<Q_
zrpe_!Yq<vU+OgZMMJ5BP9oja3*)H$?)2E^EKOSe~Hu+@-<dLAAcaAaVikshQx*o9%
zO*g_fz{^;T9Ic^dD#S3KIH|0iroOztR<%-yJq$J9m)L8u$Z{@ePedA~ovuXFA#IgX
z)=Tc%E})3%SWkL2^MIfPC`qT<gh@QnvBaX9Ki`5S2H^tBgAXv!01P%S5TK1Js~}t_
zeF;}GtoFBb2FS>1Ok-C%B=4YW=vy;!z(oV8`Q;46(qF{Fk>Vu-LJk%Xy(^OJnGn*d
zXrzWPExipX@B%46Rsm8^F|)c{U>nt^+QMk_y=U7{@|zVa+cXl<HH30Mxs^VOlIqp*
zM_s<&Tfk8;<|#K76;+!x%c*nSijIz%K*%|E@O5e^iN(bWKM)|yr=<tVx*K3FpMI}j
zXMP3a9F|YJ`y3&3(w8yEjFL`Q7H?weT#iq}d(2gNx5VgGgu0e2C#?j29f~Z5XQ|J_
zLoLtj%)xdYAM;gFQ4{jL<)3kmT$=?$9x&%L(@B`Wg|7*5j%}>zp8C;D8y+8cro^Oo
zvFy%D;@X3N2zlG{2#<SYHtsLS&0*`g1+p2LC^z%wNshOzVaY<XSqSg=G)5^@vP%ao
zpM3aM#}3N+*OY13+T7<p^ZDda$wPgws-7ZErKl(h|1fl3!gvVD;wjsry7ib(7Nd7y
z!N;72@}_$%Yc`0}tlou%M)M0yZ>usNq@tGiO3hlm!iA0W6$>5-&-CFreECRQyQ5$G
zEWlIHsoL{s@b1#3vZzhMX~YgqP42i8-{_=B{Y>BQedF0qvxg=-LpyiOSBo+OC85gu
zs(#V>*WPWxm{k5cVdDdE81Qk1buRIL<MIBj5f>E1tC>Ms)cJa)2K8@u(w7IySZ=(E
z##a;E8&6sSICODO4utfSDK;YBF<-OPx5ye*wQdNB9_Tm&8XOf@R3502r%PqwX(bjp
z)k`cwr`@@8xojlcNkN^!H*v%%y+?RSEswsY9&@ixMBsZ7`}GqI98IASF%q76r`)+f
zFk3sDXVU)~E4%uIdF+<GT=(~=F$__T<D@{G-P5dcr36kI#5$VaVaE+D!%5E{qbXB%
z@nNQ6Ki%Lh%cKh{ViSBCz-J!PQg;@~kwK_cgjjQ!ehsY;wnVn~w;40Z$x}u}RZ|qy
zu4o=3#70U`V6%(ZKIT_HRWysM#D_5t;|NOMMvF@M`DoJte+*kk?iS#<B+9Z5H-8Nq
zGcz-PTk8awQuzw`LQW_5?(3nmqkIM=L(3R1ROWDIzl^OxN*S_tT4JYQ2Gao9GtK83
zv(#hWUvZZ?zh)5-5YUC~t1$r})QE3uLc~84)bPX$V*1^DTHamV3m6R(jDYMP=v`S>
zIqnJIOlCh#1KO}an*I$`yo4l%aQa;w4nQWVCpZO$G#>z@Nu=!k_nz(I5OGsN-`K`g
zk-^R0J+bDJSSz`YI0ig#oDHNbtdh5Ux?Epk!)wdGgE->77mAsaS$2wo;wUfyJ&dpI
z)M1b8$OV*bhj@-#pq<mWKDSwGHOrBN5)juJyK1S$ZDHw}WkO!tNap@S4J&rr8zZ1&
zffQ7(FkfIqrGrM3ZZw-zt{h+Pqlv0`M6}Boc3|;yqOp{0UZd`d(e#8;49lMAR87&S
z)3A8e!t<@#d5|(n<g;RB(~QS(8#RaU*!GBj7v|Pm?90*5C1(co_CSpf77uyLwpbCl
z-8S7dneBY9DP4mE0{|z|%aVCS>3Y4v+<vMzNLyj2l?u=mrx#c>4TiX_i%Q7u0w2`>
z2ydRo4%wtLSXE0#Ry`?LwOA6;B0Pf{6l<1fOy%s>=@k+aLx?6GmQ|d=Z=g&eyE}o8
zm%LX262-S}UjqH;3}+wUsz~Z@!`KnD;DrJ)495hA!D9Fhi-Gy?Vz>*?_QmlwjP@L+
zz9D=r<zD|_0IP|Z(<(9_x)N2^LPo>_<qK-!$lU5y&pcG%!qdssy3IXG|F5c#7F;qw
z++o?-t0by;nS7PYl3-S*98TZ1)C9U|5|ND%LDJWL`x>WTfSg;=t$5teuc|$Ix7Gj(
zYPu-LG@d<Av{WAnIXr5m;a49fm`~=|!=Ns%VZm0f)uYXtf5^l)rMh!Id83x>Au*o!
zJkUqo1MIZ9%Ww961GgOEThB~7A3X)>^&g?=!Z_Xn-ME`E$<d6)-ycShiynLtlp=^=
z3HQlta}+&zTrG^*-s;0BjeDiHVWd>v8Yzje0Mb;QDQllrXg0Z@i7l^i+&q`pu5K@l
zZ$jUpcWTN%Oyuy!Z;#$g*y7zc(A4%i*iq1~w$8L3sMIc5?2Rm!{uISqpyM98<~8%w
ziusAD7|0afFK@;ps?<I%-bge*Z4BC#_;Bf+<++0nz|{cBSYHRcn;AiR4GdoH0nd2q
zHuiv&xA$=~RrCMK&DM&MmHbHe=GgRBgo|L7$8@@NWbb^^Jz=3Cq<u$qs!r^qC&Eu!
zP^2`!E0A|RM)1zWOc$FlfkAO6V^kedrhNXw57d@(YYlQuMNDAi;&AiN?wN1$mvz1B
zEWhX+Sapl)ZjU}=$r>BbyKHjZJrV8pFlF1vCHc2}r@<S1P<fcgiQed^I5-FoD6zwe
z{_ZR<OLCvOZM1uLm%RIcR1cUj-F|08y+y%D4Qg1R#Cd?!)R{L;>ciaypMV}=G}9}2
zMH2TUlB3oAZ7Y!S7s~vCTznxxSE+9KY;{3IlNO~}Vbxk|(E3qHPOe*O3{5cX(lV}j
z<+L`z@Np4SuA9qj8-j@~NO;agD_yrJdT6xclj!j7WPFK5+c2hSq)XEhVIQ|M7(7fL
zHxe+3mDwmc{GjnjV?{%#Ry#*MN<JkWAGwrD&F10rR&$QOJItDcBgMO6s7OOggN;MF
z`dgMpbh+wxoh%!7r}x$#*e#jF$^Dj#FC75=)zrLK)WS)%QlrbD1y!2wIcC0lCmzSH
zdsDZ<CjQI&`#HK<VRwZxKK5j%Xme^ALi>@Z)onU(QQYOhVha$T&&nq2lw~OUA9fYr
z(-_zX6+eUZ#z7!%my>c2gliz%9M>x6uO4i~kJqA<7G0BsMV3Do7pbZfUc5-@=3kRo
zZoN@Ym8)M9cQ-ecd1tZjc3&o25xoh)N3NA$`lrTKzAMSza+bV&zhUgS<#9#d(H-vV
zTmZ8wu0#1kF8t&$);exo3lkKeg5B+7DM0cJsw~us<BI#8Z3}dV6{yGR(!S={wNWHC
zF?L~^nfq8+FO1YGmh3Hg9nfhbg^>3fy=y&A{2nWG|7x?$wf-Y?tsolFHz(<7`$?%X
zL*k6v`p99Qsa;B~ff+}~D`&pPQ|@BqqI$W^-#kzyp2K**1#Hz7wp&A!Uphkr&EIi-
zTJ4GFEY*iU@dn9T=3S(Sk6|M0vxyn`)+$+Gz_w`CqM^gUsi>k$$9nVUTN%0OQ`a^&
zL@Roi&PgyVB+1gFUVLq8lE44_u*q_<|KzKX@c7C~{<Zl<&7IUCe4hXi2)t)`qycGF
z5P}Y4r{R$8TFN|)R(0$qx-oH*e3UIKdFW=BnYGJN`HBz|2Zwr>imLyvSMS?02T5dN
zffu&k)K{--+H*KGnvC)6!((UnEB|ai+*SM-SBE(<kPx~JH&KEOJ`2!n!Zlc#Jzy(a
zQ1>VLFzoMB%ii;;py&MEOz5A$TmgtfWKB<WJ(wJJE%~lxf{Ura=tIDp6=rEbt6~<(
zZTiu99tYV;($GK?sMcat<;)K`3z3D~%=gFjF*d%RWq{!`;vI<w^x-5C!#kFV3~2rP
zL*1Er=~R$(CNF%BfSJgJf{$Z9z7sPKLtQ!}PyiNa)79^d!-niAu*RdqplWY&a&ws8
zM<*32d?;%%zDmSWdW-iY>v7au`DOVoa2Z4cDmZ_ltEeX!3P)NKiojN_<_o36mA7y&
zW9b%X;>LCQ6<b-c@F_*db6Guh!iuL!f56sh@~&`1@Ca?qrXSQ4c#$VXGsn}ab{|%6
zmA0B{8l>%Z0@7xSZ#kMrh<v{+{t`(4STW0n2sZaEe*8w5P5H7WOgqO5{Uiy{BUxZG
zE^~9%T7k{zxS5oGycv<Rm%wH)h=WC{;)99_{;SZ@YLMzoY0mhM5=u-*qOI1fM#0f=
z&6;@g&n@)V<gg~Eh~1STnH3!#)5Z@!Hz!#ThbwDc2PV|J6C&ja>CZ0s<x=2kZuQiA
zr>fz&zZa)WdS%=ZdB+Kqvmlh2AS&jEV@>-v@E#ES<y4o4hRSHInj<)O@>j<<ew{jS
zmv!!(1SPopbInVpeVa+|`Zd@n#XJp8{B~1wLZU^Q3ZiC*k0csDs*&P1)LVjH?BoPl
z(6q{dd%wRmt*&rRz}36tr@{QWwjH)_zgC8RY$=IcfA#8>GnaA|x}*7LER7vjDQDf$
zjm7Jzoj)ga)}v_R3B#!%z+T|`P&J_>RoDU1;QW#G^l$looIe_Y{gDl&c`bZ|m0$xg
z`0fvvF;G@U*ipd6nxRu0Tajz0e#$olwP%5qnC%>D*6^WEDc8Q<u~ndQ#mWhEp63za
z0kud5h3vie|C?^l-c@`>kVx@T({<af7s@mk6?EoO(n60XCNriZF0-X7B`U9Oz;zcG
zkte=)ZF?B<odt;SD*nvwLFF4Afg`Aa3nWJc_o(@BvHuyMal^$=o>2pN+=8=}XJ^EI
z{$<`i=*qtikG7P33jE=X<quXLuK!5!3Q(CLMqQxptMk+AY_G^&{iVctbL&Wp2qIt9
zlRlNSjFRuK@EK)pM2=DP`8s(%=gHS#Y?l#uLTd>og%!VLNw~RDBJ`y?zJE<8hq#2B
zYkT0DjX!{wgA{dW@ao!2|4l2c;Ju0Ijt?#MXhI*AR*S4>Q6R$m6vP7pqZ0QO_q78X
zU3$)yaO=ELjY<~GcI#S+!;VgKn@s%mhnHnh<<c^GN$%0Jg*Kysp(Tcsj}JVW9S)Y(
zkf!7HC%S62&s+3upS2jS&di2xfe!r_TsZ2A-xCoATYR`e9)R=cIc{S(2XNLNt{w}b
zdNT<(&d$P>#X=%~71$>C(XEY%3*J@SNfC5;SST!Hl_+el=p|77lqV-T?#AL86=|^W
z=E0YRE2evY)dJMrS<d5#@@SwsrE#@K7gJQ2)GesGn86~Wqf)!)T1I)%jfrcV(NSZz
zCB2)M@Qh=w;o=TUUz|JjtEi|2R7l%H50ct`wL}s>0|D>QB*zCIMxN^E=Om^u^hQk;
zq}dMYG7yrG)1hYgbWP{FmS0}#*{_Kwq8}G_t83FqQMIK(E9G)jU=aFCZ|2QxqBZB1
zZ#XGRdg0S7cioXVm1>}QxnCwK<AuKgUAWAy-?alXi}KUS^^&`@@nlv(G|=i(H78|b
z`TeYysq6!cTtCO?dZu2-Q9DSBBZ8NBJS4+}g*jXi!8D{vE{yeqtmG~QTq`u0avEmu
zZwQs;9M)r-Y^hbH#N?a{z0KZ_xG2UYc|NHg_f)xFsyWvZag)ZheI-bH%lx4HM3>`8
z?#nq+!o>5SlCNFmztNBXcP;#Ik-VRxmDq^$o1W~r2@xk<ML#|*og*hhkAna@0p}T&
zwI)_I_l^W@?|ZE!g+=#sE4)6Xsqya(hS12yH*&YElnYj%qvdBNw-)7#c6nMvc6U;p
zTe`<>LtoxwfsWdF9?oV5_U11gS#=2>SU44qJ3ZXLz?c1{IJ(g0y3Jx%j8M70TY$sH
zQeIu!V3aOD-b6RKQoOkbPdWZb3;O$Be=}C&Fr00qJ{#J5*Gyxw+cIIa7`3Iiqg$qn
zPIbFv9YM;s63zC#=%%CTg7MpomL<)*kuRoZ>?5Rjmz(3Of4_=4QgVF@0?={R@8kf!
zgsJ_X+C*mmH)-vNk7(cROCI*$dVp8E2D}@oQ*fCW7g9!%wr)hHKy&5NXkKJ?tV!!|
z@QDWU6y0$eK~6gw)HE42dbGS4l|lCUF68NzHROP@sPFYr@7(#C6@L)g8l$u!F1paK
zpwr7HcBJdMjKL3g`8LC>yQfQ*hTjm>`!J5Y&}xn<MLkbM>BvU&W~<EM`-@Lkxs5`P
zs-7ZpoUbLgd}C2Uc@()&jyG^{2pE`+JHKIyJC8ZTdlST4+Xau00JS+M17bK}jsDYv
z4;DUMWPe%3Sn)_yyI7icxjp`TVy0|-9QAt*tjN+g%J&*p>bmH*2MMCZ0WPzBJ2hLg
z{$kFph{WCIx5)=x+3r!#tP*dEgy$OAX5VGwRt~dOdwA%a&#^*tpwUx@-Fg_6h?uEs
zk6XTfVC<FBBlj?3I`M;C>a<n!$A>BfX=FfiooDFuHk|u5uPEaU$dm&_r5RE>yY>^~
z*ZcJazw*^V<I7ocb*~>F=MYCmHMMs=JaXjUt}BN++eF`F<g{Msuh+>rXi~2li&*>k
zuxln}&SES!F{A?6jfi=(gXf*IfXvOU=_cfj-=1+@I@<FdXAV~!SFu$1e0ayFQ8c0Y
zNs$X#lE;G&*|9Iw87f>=w<eD?HR3GU25MEWZiLURMXm@Cyq}Z$zuJ4xxTdykZ#YDd
zs(@6bDkx1rQR&SBC@3HZNJkMt5JHhAB}6wM(rk!y6p`MgNK2HaND+`CEl8CbdQbAq
zmEhU#d+v4b^ZuUu>3#f^g=?)j#~A-n=a_S~rr59N9Ls^%rG;4>`L@N_5<WcpGIwQc
zI0awxJ#LltW4wV}A^MAehIIN7N3JVNEuBwHKdJf%x&>J`Lq>Td-K6b*<*<R|4ihUT
zx0*y>IpUbXE5j1;LA`w=m8S>$cM;xe72nOH>u<4$VOegsEpB{dD`9_QR{!Al;5SYZ
z?lbvwdq(ehbmp{1`n!faE33pV{41!-20>kpZehzhi0QtUyfi%GZ`0!8P1tJxjvbc1
zxbAx@Kk#Jw96gU@Pnk|GC%Qf_F5E%z)97^U1$E8JN)<$@qEs`s4D^H0)%qV#ewV%!
zTAI{7s)-Jnz9&VwI@bJ7!Dh4xG}mPYyrpA}HVa?VET)^^P1JQCs_ZK)RV}Y7Y?lN}
z%u6em#J4|u5}n7-;Rs?Zt?%&8xSmiMwum`mE|F87C-z9*s?%_{5ghZqWwlWbI@jg@
z{_#1a#7aJgYWH#K%2I7YsgzM#M)JhA^y}1O`B_ParO|TFuIKVCxfDYU=)prQ$R)-U
zbvmQONV*>_6-80C_#)RFI@2V=_M)EHP^LqsfoI&;^NYE3+-0C7&g-ehGTC#oS>7yX
zxNmkW>U2%F=$EWblm6&J!&QUujLxK_GEAxc!fUMOCu<5ZI_ehCwrI-p7H7m~sWm5G
zl-SvT=?pQLH=+s%Esfu$wuo$%h~5>LYIM(kv~tt+vJY1CJt%4?<lKxD0$z%=eAq)e
zXht=R?)968X%}`aoJ^P0%Zp&`%n;E_Dfg0US8LA<xw3>`rp3`Lu6h$gKesS{t1=xf
z#j$@YzceiE__)kH?%d+yIs9p1zZsT&e0-9$v<v(A()=$yDqHso2@PHH&-FJTW{A&s
zb4I-~1u-Zo*EqCOVvOY{ooyq05DH_CVVTJP-vi~bj+$y3Pyjmu@~`G6Q#(1Wd`=X@
z^>L27qdkwc++#(S;-Ab)_P^D+i=IT^&5>`50JVAw;@aot#kTE%-kW0^+#P}j^_K1r
zI#-))zPV0Qa~-NS%!kc`YROpUh_9GP*3gWxWG>AC2}6!6r?0VbN(|o1A($3gFX0xc
zqVIQBjg}eYZ>*=?Ypsx<q+Og%uE~C5AZs4@HMCUU^z~=0Xz7yb#A>g+?X8jU)8U0u
zEH?F*#IyYXmlHMBbwDf-@hg{a)1+JFO+0vhNIXvKa_F1kTaRqsTDyQwn(fR^z1g?g
zPvV~mhlGH0FyS4XQ2Yy6bxw`E%k+w7jT)4Vz5oFR$d|^C9Oi-2RVLNsqabE(+5;ty
zf8AyJ<yOuOCbzZfGji_Biw|NiXMKgNWX@FT$AiUBUf;C8huvu4dvauov-sOVnD1H|
zmrebX+vwxzoqZ;@spr#fX0+pKdj~r`LS-T~UN@8(6uNGqlAYKVF6RnJEa$x5n#p!t
zoQmgR?$qGn=7bTJ^ORgqS4{cO9wk`;OZj+nU)`b1YOXcbkG<ya8?syEzCSwYP;6CP
z=-ho=44-S{I_L=EKilfES4}Qa3@pSld8198MPQ+2uLM+j`HWXMF7`&+aN%8y#2l2t
zxtw02`;|~YskMJOFvmb>DC4sE!-!i#iL0}<9fjUk6rMa|lI(o)R8Z;E#*iomR5}fi
z63|&V5IgUZizzGFa`b?A`4u2o2CWrIHOr(U#Qt)?4<#vhKKy6!thxKRLHbgBbmQLZ
zyGxL*#>TF<f)6~2pV#>ybB=n330CdBcsHh4F|Fxwx+>0Sm+1qOOC?@$?@pRJ;q#Xp
zE7?}w4fn*l;=WaPPV**~8y_JuZ`jwMD257mdv=VjEc)%YHp-&PTKI9>w1|E*jAMJk
zKyWGdhMmkYSpUSjiR)U-O14v=)TZNktqYsB)%##w8E@XXfr3O4X%jU0Bqt_6)T@-<
z^Ow`C>pH3(mnC^eA7*^I@Z@>y(aDU?%F|Y)0!nyDOFJ#V3n^bHChtoz(%HWol$Rvf
zA$0ZBbtJtcCB!|KfFcfvsv{vqbb}PpIP>|REICAb{rPQTo70}x6PF2DAA`!PSwO`&
z%)WSpar0DBP{l1BR6Gw;y!7{uEWbV8>y?{b?sLTJPcLq`=?IVOZPo07;RY-P(;_U6
zs3o>Xmu>!G;@Z8xI@wV$p(jyaI86nIF1!PnPzjqSr{2~6fC293wZ!tPcj``pXTM*)
z56$b^)SrpjgGANK6A^k|y&{KJrqyw;n9W3vAGgR%OS`bLd<AC=loK<eyTgD74@nFd
zN`Dp<3L)e;*nkBNKx(?ADZjIe+Zen)h6}*wztn$#s}(%mG`t#l>xt+{o_sCNm1}kM
zbAP9Ip*I3`11I@*bzl+co`Xr%2Rv~;d^W>-L#=&b(x&Uhr46$$x#bMggBbg@Py0=6
zK1eDENVtJ>>KG?*&-LTdwsLN6&*3U={8$!G&1LT4DArsA9~rEf`n<gdEZw?$`!}dd
z;Tq{-)IqP4UKAJ%iZ=XMQ!v$hWm0c^?ka_B_M$=WX~2@UUs#gvi+a@}r1{-ALCwB9
zb31f@*%`ev_insN(+qDqiEyYpZMExC2jz~<;nzJ#HqUH_CT>86r3A15>}~Z}Y<D5C
zZ4Elj%d&a@aqxgH)Mh$k_GM=Y=#ELK-~;1+LW1qrrw-clRL2_W-}ob^uj!pQ_1-7*
zDIBwevp-DSzGM3>%1AgNX(h+mp>g8b_@vZ$VZEWTfz{f3Nf`~ZanK#=J-swKRoc~f
zc~90Sh3=EZy~|$bT70}yv#|*{&xEIOX`envpDIx1S_3ip%0S73Ej`~eWUv_LNR7sX
z9x%pxAqSnjZ<siz*k4#!TpFs$v8IJNM7Mr~Ozg3{T)%{1y58`_Rma!)eKEtg`tuhh
z^g_gigbr&qH{JPkKFct~=;f^)yr}Z~l6mue%T*ANKO{&hStOiH+D{L$FQ5jLEEFm+
z3{ZJi7!(upzfJyZ9RcC>1*W1heCg)Ns1z<f1}Sdg<&Q1`(a*gnu|aR2fjm|$*H9g{
zPE0hHP+0O6+pA$e@3pqOy~^Bu`fZ$09!GJxqj#U$tiwlviO$l!m&N)mPF)LMDHchZ
z>fCo@)iKz3)~R2gf1>j3q4tBCRxq!QM7W%16P?H+_wA{jL@?VU8lk`sic^af+9s}*
z+joK`6)Ql*U#^Jmw-;#FRwE%xCL>1Ba<83}xqovD2qmMUPFJw}04*`?nK4R<zy$03
zVuHu16i;PpU2e_QyR+Rk&XsqM-2hgm9e(k``3HITvfM8GWE@6_RJnMuAJVHbeNyq!
zv&C1PRD8730&FZf%9Q{WAHyKi`@!zitDQ2{Prik8pNtaV;$?twuzSC*c`!sVq#gX`
zQ&yE<R(&ie@J#CI<j(#u^($*Nbr_3W@je}#Ysfp-e`uh0ts~a#TVW{%*K>XsMngtB
zsyol_dSI-9H4a~`#hXxFXW#w0wf{XRRzHzEy4V=cv)G^AE{0PcD0&?K<)ndAY^4RE
zKfe_bhI-#^s(e)vE3p(9-`Q9uY8St)qidSrOXP^V(U|13-FvwqUDtJCwR8CP{_TYz
zaCV~0A&{2{r<FE6(s<+aT!enR@3PQ25|6V=G=rKtyLFoTMG;K{lihis;3PFN&hGCn
z0Lxxd2>LhUZe@t+n3NUy(RoR*(>QA!eDX^xA$I?hm_&Q_Fz6g>C>nsFXvoz-4Or7l
z2#)tjEASp)?%Wh6c|dK@k1?}McS0H5oO~NF{ibd3PC@&pK})L4e;MC>q@%oFC(BJO
zC%ytblyule?KQNP(3^v@9BMxYlRef{eod!3ET-ygwfS@LiX}R{;cFhK>ZW_$9jim^
z6<G5x`4lMv`mNoJOOAdk#Nu9nBK|Ft6BkTuQqO}zu>aN-Sb3jV){UAu-)Xm}%0IIW
z`@Rw8nDsshZ^WR)Ww90BK0yP5o5yqR$5F#d>a*zCls!^zw@Tc#la2EYB7FGt_2*QC
zKFe!#E<S7fylsDX>z4c2rgkyDo;a|`9kV#$6jLB*YM*-eV@!^e4dz1eVX+f!@^ge%
znJ7964JjPhJf@XfmMxKKD4jUJq@C9WlGDjSY5m=adJTCxQ?hW3Jlgt&LNLI*)-RY3
zq8uK6{bMmv&ueiZ=s;NW%_}hQi72d2(t~D;cCj7AJ7<!8Yg)_hdgutkXQYMnV^{%_
zAZUIY<f`qfJ?exuzi%%!+55&nTL0x|M>(oPypIoL&^~#RUR|>-!$L7sGj-&1LpR@n
zJL!^yd~=J~s)1ga?R&dj{Y@<~!$s)TkH|B?*PY^C?PN#rmyX_S7wVa+e7U)fm6Z9c
zvE*qQ90=`SK>D9`yJaHwNnX-95L>%0yMdhz-pD!6ohd2$$hXy&Yb-R-2fsJ`#$X^F
ztTZ$F5Z|%`d!|_GDht>T()5ECI2xB<9Zgw4+O_Ab7VZUJu^axb=ju$u2iP;ghOz;Z
z&ckw_))?PhFD+eWAYm0MUy>W~E}Z!1Tji?%0@o+ADqc>0m*2PR#?b}T<DXJVGlSK3
zpFG5gTl&PIhoy&0yOF&jI>?I7&2*_<7*H(po=xLf++M53xY%r@clrrg^j*0EE3Ld_
z%!s!Stz4@>^2_yuRMiOi6{nkJF=bMPH515ms*95!$5%IR8+u4&>1-{A-oW@wj{#qt
zx;KQxnXG!Eo8faa?|4M&sFj~y)+wQ9$F7J8uW^@(er3IhJPbUhG<DXWhe;-1hbNZg
zydLTuJans5wChoGiy`tzhEYY(YXdR7tx4RTz&U7PA5!6PvPSo%W9~pj#ACvwlJEP;
zbNXZ;UC9ND7L6;Z?f`fE&q-@k5&z;*uZ&FTqr3a5jrdGU+|g#sy;J#dlU>sKyb9>k
zU##pc{6Ue+4k4c!aWe1ejN?*6=eu@fd%4~$7F0XU{F~m-zo9Ge;4C=z_2CB_$NeG;
zi+5Vp+cS(~Ew8Rb$tjG!Gw#do;FT59lGsW!U-`bC<k|QD;Y)FC<r{wD#s%EIhG*`V
zz>cO}YK2Ors{R%ULN&IxALFUU?&zJnxRI`GV{@eOBRyB+@k@I5JzQF=&%9fD8or2*
zdY8KDNiONwfg@V~IJG#j+cLd$ly)sK;jj_+G<|!^)hFVm$hYtFnn7A7Rq1n9?l=a$
z&To_2i@vpZ_cETY1UNE(bW!T5hBx>sqo9l5INvr;D}dt}baKV*J4Z3%6RMAw<I1$_
zEe6j?>F=E*TH}=`m%3u}Clsh-!FLM&k{$<CtG0zSoWGW&wan#=i7_sAI3M)+L+f5)
zuCrvb3nC=a!L*L1PN1t1PICpE*Z>ZurMtwh4LLL*msk)&rDQZ0LngXsA9#NW@6HzQ
z(+0(F3<H%WzudW{cjCf$PU}-X!_o7rgjeZz(p<s?<=%P});5GT8OMlGjU5h7X-{eA
zI6nFG38#>`$<2=-IPyMQFzqq+S<=DHrfnR5nJ=N7Z~^oJ{BgGZoOpJHK%TCllL|jp
zvNfY!KE7Y^5|rH4OkIG2RGBbE&r6e5cfP(aONI_~c4PT<VJA_wEkj828jgNN+oQ+W
z-QlL@O4!NZ@Q2^YDSUwHQSxcD5p|mFLXbCE1keKwg4@RRY-DdlUa=8uh8~axyAy7g
z*!`Dn?ci^JIoR_M2miKdZy1yF=+c7|J1&jil^k$AR&d)51zeQmfa_S~{#_*X&;lN=
z;`J8>7QknkLr^gK_Gd5(eM5qPu2Mi1&g4#060(eZ42)Lvs#00@eLQY;=nrukS_)>K
z1e&&8`<Ookz$q?2=f8I1RiVJEA&NWP>KgSnic<_V!pXvWho$6S9X*sBb{i#Z_k2z}
zZ)Gq`E-y2yqP#qFvlC6gRaN*-#VdCTt`TrJ;s!pHSRsS0zLb0v4##ZBM->w3U=vF+
z`zYXXEOsi}@7u~3F2pHh9MQmiD^|Ms=7_zNX@{U{0BEA5+<owoD^VDx_(1#J5$IBq
zA9fU`xNeXR2c2|G{9jVRrp{>Hy#lJBXPJsJU`hJa7)2q>d61VAbOXU{n3-TL-5JmD
zMljhV^kW*P9~Q}eb@*2+{b}yVGkYTY(LNd%FNJkGkG}ys$H4n(me2B!5iY~Z_!3<9
zfJ;^#RTyZ8@XFFtgN9SJ;-R3h(z*|BU10;S?%R4s{Sl7w_OUt%Zhi(Do@Fi5^j0k?
zhI|R?hg6dlP=WNT>Pu>^AupDL`oe1uguj%{w>1h2kGMlUEli?7H2`yjQg4nA?1iJ4
z0jK@~O(6|==JU5J(1^)XfM*7{{0(L>x*r9_P-T|D?@2skWhWdf>F;#Z%=H=vwZaYG
z+b1RZE9e1ANF?xAs5atLV9u-3oR0t<sZ2~Tc9=xn83PcvgByO((7;To!H@Jjz}msV
zG(}Z*K<KU%F#f;GZ-T>4X^gh5dOUN9@5h4<_=%3E1-27MnRiH2HAFqz(x4d17C*)b
z-mWPCNzW{{E)yb@i64M{4@6=$Ako_=X%S`&lSMFwsRw}b0l+jSrmr*-#9;BQ*z=S$
zw~yw}KL}P|%FwBO#{Y#D=6MfO4e<vO+dDD?-6pw$!PVG45=Gq)4a6aezM6nG^sZSM
zZ#bpB1V1d^lj8MnN#dfJ>ET@}t>(Xe9j<>*)jFMdtyhJkrY8K4qJ%SKkTA&_kx<g3
zc?jT63E++@VEWx+b1WF0Qd5K<X4Y6D0$mtWQU(+qOXL;&t;DWcCa)|DX>4VRF*}~N
z>ic?bW}w)QUO+YqdL5wAS)Du@-T$4@Oq2b_*xJe`GrXi|X8MYi-lSEk$?Zx#NaCjI
zEENfi4(Qu3CVpLg0C$R^SP8$5BY@K=DLNWhbb*6CxKQN<SX7Moobr2aI?$iABy3+T
zb5==YfLo^sxU^NjV-VPXk4#$n4i*QD!Z%p>b&W`)mFM~`kw)7Gjh25)6B_LZ813St
zw4e*#0Y_o+rPS(>#zX8~au>BBvcXy=5Q1>Z7B)MTDdx7##ObyhtUXn3(l^tDPDI%4
zXj*avTx2a0j&U~=83*c)0>|=GSgAl*2N*mFFqnEP3Y?+O{|KBhBrAEVan}u?ZA!-u
z04X#c0?5hJ7um{#IV&RtnE9P^G22;AAw9(`m()>hkH43769)EcoMa_SOjm=9d-+^e
zH!%AE*!-6PIL3c3nZ>ujw6!`!1NZT(@>c*QvuOXV6&bpX>MCZ8Tz!gW(PE?o`-MZk
zO=j?h-9ArNvSf)Js*HKYF952Fs46M0!g^ZC`Ys#}2DoLC3Mt$T4q&phVt=b<@#4pb
z)-oD1efLwT;e+u0U02S6X@b|r(!TCjp@Vhbe*8iL5UEW|1EYs+T_Y=CDzLK>m$F#F
zmO9i7V5Ij2eO`Wg*u*TV4UnwM4ut2Mp!p3+6|l6y6#_$@fYTdU@HWReoohdf!n^fZ
z+q=FBHad24hkG_;?uq8nxB)R^Ho+SK_muy?aW70&XuFS=Vrwb^1D3dE;`-Vu=s9C{
z@b{K%3sa;2_ypNka|nP|D!jjegnr+R4?lYW{%3gP3+CthNyp~-?T=8VF>|%jVURiC
zSN23}$6y(-oPUR8h2{2&9^(Uoxg!MG#r^?J7czc?0b-mfVw0h6aR%THWF>un3&woG
zFaAxZ+BWAJzW=z7>2HbYQC8{<7JIj2@^w#<`I(smUpffX#*@U)fgDy1Kr@gS_&^1W
zBbincTwnqKHkUs9-so$=b2t>mdZP!ZHTWox)T@tR2F?HXh+|?t(RZD&k|)fgRx$AK
zW|6!0Kut|e+lIktp4Q%(@bBsq5nbS9da}rT$du0c@j$8|N&>0TEu}bm=!Pq1z!MDb
zkyZk~Zv*EO@9F(}<HbyGq$C`xgMN91RU?u&JR0AlQ=i~D2xee3NaPx}DeX7=u`!d-
z$J=*Ah|WA^m;_K5YM87l9C?wVki}L3ETszADrhl-;s&6GP*C#04s_AcJktZhMfB<Y
zR#_f&=_fMHI^>G7)!{0)losaJwg+QR5r;0RFh$-SJr$VPI#cqgr^>qI%PG+aGOmRa
z$+%wFOg{vMSq4Elh+_Drn@*8+2vW$SVY?wPh(J+OiTH0F)C0T0yKYBku=)ocwwNN5
zhys%4MT7K`icARKW}R~>ZNkgG_3G-wukdbxxtCo?k_b>;AUoyIZVfglbl@X_4u91)
z_cY0gLJr>c+DRI~5y)f4mpY0tJ_7b(6=MfpARG!bpjtb11`Ptn?eKHSb8vcn{kH84
zQ?0uB7E6C4-yb!|lAFzvJ`40Cjnw^U)}?oAsH!%*J9GAaBvga<mXoz?uBGcTcx8Gl
zC_TcQJG<U)Kw7982nZMJH`9kKj5maOiO0V)!@8cRz|Rul<MfHf2ZH*lx5vCTBCG71
z@A5el#fHa9E7MQ9$>rPHUJQ$jdSd~Zc8JRR93(yG^~GKR*QnEgW_lRo^#M{WOT%;?
zL@L_X-9Q{nDS8m%LHOVBU{*urkco_$<$)j>^orv`TcqFh=DU__Q%3bwlGSA=-M&@1
z9l4p7rm3F?`7vn7_w*#Q%~*{P1=kpUKqyrJb-|q3QxZ}Hfrbbb$bpkJ;ZYzEZ0W22
z8y<9dswnqHzAI;CNZM>tshu8NA3x<#wffko!3}X&U1Yq#Y;@I8|9GkOn=7Zpz<HMd
zeN3F$Bs9)j`HW9Nm(L(U%qMpxPLo~BC3+edBDRSZ5>gnD`=H^Q-$ZDra{7~qyY@%T
zyw$$%@0|_w8q2cavRogI?#f=tLHJwGd{Z)7_s%}*Z11YL+Bz$2(ERW)Nf?y7#mKot
zPvSdyFtOc-Nx4LN@kBWo8Cd@gI2;pq#0?IK14OFvrBQz)j%L$DF8XM*D_%k9?X1Y!
zKL76=-Puc<4dxtJpBff=mEcaQh{*8zKp)SjTqi1)9ZZl>$!mr-gS^mvRw!EK9o=+u
zgm}fDF9LM)l8YSZwS-3je6;kn{EbL9j0W}<IM}}2KOWb-{y3Uo*Y7=HKJisf?l`Z?
zS`p&mWJboB)@wP#>gquw!}tm<qtbgn!9g}ujJcM%P&{-R#9IKKuK0J-B)RnfLCwD@
z<A(lE698qx(e`(4D7^x+-DhFsb&qkoje5i!y&C7x<vpUG$ldL?Rm$$a*MY6aj-jrK
zaYo!`_8}DDK{5~^i{ypHJ5lIToFtMTr+#dbM3U?Pn30>o4T=Y-M$!y^8<l}@vJI58
zBY49(2p_dZdKOq5N~TaogUE#>Tz`SUDz1-<(eLB^5e(IqR!5hXWUo=I2^)x6AZi&b
zNI|yOydQ{p!AyWYf<*Iy`$Q~hCj1wGr4DJn04~!1fG{fkHyCAAf^CCy-{!npaa9O?
z$Gacz^K!PX6Sz3ezE=ZBG)vqK{tDJYz(@}dlUQJu&6^nnuJNSoWv<)Ajfac}8^8i_
zmIKhesid5<{BQ7Zh&n(4LG)W?tU8vV_LOC0Aw{y{utZgB)zcPS_XRix|HOm*YTZ3#
zZ)v|gcoagOF)93R&fVWYf+`9HIL;V07zogE%o)t0QvCeyqHlK&VOQ9C6`F`z565oL
zj<PqmwA4;p;zt7gS%Ben^+^C?1O(fQkO}^rdc7U6lN^QbCd>Oji^74tFYm(S7>XsX
zy^5}Vc{aH8>njI7Z+FGDH@3HLg;^x@a~^o;V_8;eRKpbw4Gn~sO!kaa9QQ;Zw?t2(
zS>k!fS+Zw54h&>y8?^ys514>G@b3IwB&#|=HE!vyRhyd-XubZUL4_IN|GBR#Cu_+A
zn}^2vrF^?xpQf@DBkQqUTi#GTl7oogQ7GYXiVzT}aakY?1ZHWSCea<B>OxMtLi=>0
zplL;eq2ZV+Gs}9iq8I~bRpfdAe9Q@+N-_$$e*=PXaTQizny$(QtyQk!7fjK3m9FgR
zw#Z8PM8aEKXvjiH9TGYJ<)zn_WaSCvmC4p@?`^Q7U!~TXZ|TQ}W*2hNAj{cZ<N=v+
z!ntI|xol-f0Y)x^$OVKH(bJ!MNEGmA0i`h1z7I|Q3dFa*sNdxoQxab)C+n}4EiQgI
zzCEmflvCcGAWp=Wug(szAbe+a>U(;6jEQr(6}X6rf$b-!CS33%xuLkK?;(M4BVR!n
zpVW7`teo{6S$A2<>3CTg{tEcQ5anGEPk?ax^NP)Fk_tUC0J<xd_8v%BR}{kWtmf}=
zY=>MMNm+T3Mc?2&ty6iVdcICFLBHEmnNaSv__S;9QuUal3LoD_Tx6nKOAVigLFG_z
zl75+-6IPndP2nb;QS?0$m_Q^*NAkWLrAeYtzA6c%NEP7ot~%@zY2t;z;M$IzB$Y;h
zGm0-Y{~L$%)Bno`t-vul>$wdLPZQ_O9lEx((2H3M4SbvPa>O~Vyt{Ul^WG{~%jD(;
z<yeY3^#2!e_A@4u4U(ze5MS_2+Wso%?$=S=U0am2vJ1?NCC~fpHX6CvFGtK};hduk
z4qbJ(YHfMJ$tPxFJOv_92wrqY$tGbaNE9mDDUp2Q-1kK(az^-33^1p=gA^D(g^aIL
z>hA-DqZco!Eu}e$bJs|sr@M#m6Ss5#`qM0lQ?kxO_lgJu4Jr$tygFJ5{jm+`_3??i
zv%Jfg56ugM)T`<#ZSS&H)X2bM`k_rO2P&9Cxl*z{Ni7XbJI2pKH?XmT&*VD0U4rI3
z0Y&u{=l&*?AJ36#_&`t!e6_xWUjMwlL0r~y=sF2Jb?Z7Rt&VN2!t!lz&U##=|Ixvf
zETZGUCU&s{@u14bgTvl`r+RXx^ED?4)~d<t<jlVgmqiC`^cS)%v&a^+CdXBYG|x`K
z`khKShyr!PYlaHB_>a_ghpkCPMq?{En4)6;1N9W<n(*&+xU&hCXU}S(`3{(DcW#*A
zs~V+6+@{AV7N_vwxNo&yIiTdiXjRZ8M{MqBAk|YNt1i<pUEODg#In3{Uoi+Aevy<E
zIiXBcbD3EW5$|+IZ<({_`EF=wW9gl4<%bEiI>kL4P`D}eXE|o?PT}I}{&C2`yHUwg
z3`r@Yo1=*P%S}NAgNkIag~L^I8DVll@vgfhVDUw}>Ooyq0<tg)35DPzUjJi_;Xz;)
zFKcreR#*0+%H{}T9daWNooHq>ap^t6Yc}h8>)deFEl*tkYLB$sV?`OEorryfm7JMR
zm>hQiTqYGcMEFT4{ZES=4+3Kx+kEk2bQc!H(3{f>!F=1gdX6gF@wRoRj8qgS`z@00
zEKvDezfsmU{h1RiH$YNNe?d00b?m4~;DeI2$o?t%VGYToV1}p~Sz&YiFFXlT%Yhy~
z3qDx`CYyuy!7?yLfAI{!#YNiNtT3mO2SSm}(~Eg6GxBK5jVj+0bB=Y>N~(i)AoQ4X
z)CtoDcfO*_=75zDovN*&vex`~Lc-|)Og+4rL-7Q=M8#X@i?beLgb7@=Bw?$9Xw+Ri
z+gp4hk?=LG)_~E^xqD)H2@_J#CY$eRq#`+Kvg5|o$Vs1AyKe_z8s-R97d?yvzu}m>
z-3nE};>@J>3Xzz3pXK8U1^)y?c@+gh^3Dfz0@M5%#l<`#zb!2gaDb{frM%0aice3e
zM#^zkDBtI_uN@9|82Rc6qT`(V&+yZmmMWDQ4zf_3OqqFbzCtIVfOym1rjg*&dcxw#
z<Wvx_Etn^&({Xtrt1Ns*S0f~mW2;`+Eh0Ywr$IOp!J|@eGoh&H#DXJsvB#_59m{TQ
zZ5^2Kxj!PNr`j<ye?<iHwh-<i&o{DUu~0s&eclEl^velUDf)Yt9to?=u(@yTQpZTQ
zew2JPy-T&FQO^lO72xK9xeCh9YEX)wroRfl*8M*g6E&?GE;gaZ#{wr_Af!jMEGxz5
zl)aAa<&|em0VUJ-1bhLKSluJ7WWK(sKxN_jK9Q5x>DenowH?sb?IVF!!jRDb*d>%d
zh}(R2IitH`r^!j6I6bQztUtzV;->Fdo<{`_{jA5GYR^Gf|HhzwaTSHvXR-G%FjIq}
zR=(BQP~yVdrEzTdAWZS(*ARM1znpD9^MS6|wZ&bd%`@Ozq=rm@)+rHCgYQEwEi03%
zuhs}wP<>^$Q`)MxQyFqSs>J#tmOB*hrr_g6b#^E5F<>XF*5bosGJvnylHd)|3lKIU
zWnf#AWF<SikA#b7GUXJw?TRrbXMk@ycqzwlIT~-peY<7iXboU0Q+g#P;&Fi&_AGD3
zx={}}3=bGF&M8V1S9skc+?3^KemKTKG8~{}%YVz6TfRVdqxj}MNOaEXRvx~>{v$#A
zw-9gC9v2b^m$vyL1AQWHW@3(k8?Nqyf)cyII|32BbRf!L)_*#pRC({^PR1k(rPI~R
zohmFK%gB-neFwZk07euwnE~8MB)aTbE5dCINg05@O6L4N+R;teBe%wZ!2n4#IM;CZ
z5C>s4cqA{5u*<1MnKKlInxgj|`FN*t<zS@ACQJ6&w0of9@hM#A8`{YahpuhF#cEc+
zVSz?Z_JuR{x*xUJ;@O%($CyMH68%@w2ATDfHhkaEF+g%Z0bk1Vy<9suaQ-g;F?p$d
zVBMno{^LEM5(a_us~T`+3pvCEqv0aUbyxETO{5aQq2a<UGgcXui7l;-ZD}I{*ozqn
zWxxRUk0HbRF0Im+WpJZ<vwM*%AbJ-j0f$~KKu37SmkD_8uZN<VR4RY3+Y(N`^EK?)
z^*%>fPajgoVqe?<+JCy0ATqeJp%i6ddxVti*wQP`DqDsMS#G(nV#DaIi?(noRa<@q
z6H3VV0{B_LOsfmY`1D|nX`gBqjh$lmEu>c=_1hrwf?)B!o*DcIt{TTUf=4bI6-!Bh
zZbX`|=0oL(yIy8Q9%AlK5lj>Gtq73FbwyETd@xs?yJLI2Y-d`C77PRl>U({&b;JRS
ztDA$~^z%h3gtUb<p(-j_PsuQi0M%1extwtiJ(cIb_8~#*xWYkfOP=;IFS+@OO`lT+
zCCXU<SarB6F~Y*!;~dL=8qz3Us4b_Y$RzLW+|*Ky9%Rvqm<_RN>l7mVaVzq$>7L!d
zs$mLMmxK@@f$tJjrRc)K7#ixfs*L3XGG3BwyQ(9U17Md|iQJZ(jYbX*H;2KC)1PAM
zIOam5m2t+Ye*SS{L;;vtngJr0H0E6rWoNV9cU5x}%>8%Gy9$?eI;mAuF(J3=TI*V|
z-lo3xgsXF|fGQ}52ZmPV?b0i+kB6hxA-fv>z2h48r8ei}m3dD&n*Nwdn6sxAzYTG-
z#}>U0x7l>gcXi0llY?BAex^56tuQ_^X^A|<yY5a6K&bGdkVse(Qr<s;BdCV?e_w6t
z<cxrU0?k|Al?Qgn))jZ#kMc+avAOZqF$huox(*=YY|tU#(?-^m*VA13W-YUd6Fvb0
z0hT!v=5ZtFvEKC{F$u}pr9QI_KIpJMk0pRHXzq|AaoKF_2B&3DmJ%e;c+U+-Ocq$8
zpr!Eq@E*Mo5?QOku3f8A?+cj;iDoY_pl~W?^>JGnBCNjV0L#KNYQ;N~Irqa;OSh$i
zv;+OSX^6QD6rM+_xhW+MpW%Br*hpAWKrXynuYDP_zTGw{d*}K~#?Eq56@A$RvKw<J
z+y!&vmAG}v-z-rhX3$l~u#JSRjkQXZo61{tF9?f9*57%NDHkO-tuMmeS?#KaHwv7s
zkUVLLel6B1H7;$+fEjxoRLRWHN96!xvbIJPR`%>uX_&RF5QyMjk$M#?aS$xGfqs|{
z{iiNgI5V@mdGy0BM1rXnk*uL**XalDK$uDHg}+mVjT*{h_pDzRUcUnKTDXLvpRJq6
zxzczoh`;}g`mT@0eJ$J6Ssl;qgE+$Z7BeNYBC*@csItvd#Osd7db(TFuqo20YQs}*
zyFzMN3|8q9JZpKMK<n%Wrpcg=At-RJjb-&Bsi$$Ed>1eF<>5=adYV`U_|`;8!`IPs
zL5~^8C0!aO*(EG(G%@bGiR8gWEME@r2{c!9k|lPGV%FLTD|HeKu90xdl0#rDa~OEw
zd8XQB$`SLKVyN!ee1;4~o_oijod1Ty*eTa;gd#MFGeg<VPD1My^?74}v>%=uv*-eD
zxP`m6EiW81;Mqawtcnr<MpBoJVhcB<aEr*}%Lpp2n0Ig?jstBboM(!tP%#-HJw*;%
z?CQ=?r3vER&~1vfNJB`xQ$o6F6Q%DKRp6MFExF^?(Eke;K<2NC|HrDhw$@9m$I;ph
zT-q6o12`CwO?102G-Cf#80rvB_TK5-y%aJBwB8TZ$q?!@a9M-<DmUZDyuG&&o;)Q;
z_lZ$x`SHpHz{hnbz(wpXHsFRzRDBK(Uwx{XsXD=!W$_ka1k6F&-tQ2#kmta}!sqzJ
z8Nk)oKlwMkcH(+HiGSB2{@p$Or8((?Im3p>2ejB3Od1mHJf62`ymy!9l$k@n#aF~d
z@c6R6RZi)$1huz<`%%2|^Lyw7tS2+UTp8gFanAiKp)=uW3Z$7-6k7<Fayz29w&ayF
z0hs-$jjl7?h{TP)^qxDC`JUY%PCnI!r;XU@%b>X<GDIlQ5)OvaA~@XLXU8<5>JW6K
zDe{q~c(|l1>BFp<!&sjms7ZxuGkMkJt$xrGUT-SUVxuFjX6n};R!ydXJ78-i0+9-q
zp$GzxJUHEsfs)ak@I6L%eo;k%hf{f}yOWOSlv}f!*X%6^Ev(zH=M&k}d{(i;%V!P)
zP%_KjEo2jla}<nYdNCl)R^i!ndzc}3Cp@B*78)YBxLHJiT8e56)ztEi7Bz`k%#!A+
zK$<I+XSGUT-@CcVA%qYOH*<pO{Nz01DAoPwNYf3!s#qPK!7P#eP#MXTT{ddM+%rB3
zg>5<g8L@3n@S70FgrY6|x#k}R%uki>mb5$v^Kx@6LOQm5ZUaLI-w(i-uA3JU+0h!J
zf?##Hg($<LEX~(kB17TXL0l+!T;_~3lL?lGDuB?G9vvMb9FJ)Ufu79{m?&i?VKdNt
zoDQ;vAlsw^=J1PF-=%>+JliYM1}Xb9Zpm?1u5Zb1sl3hRE{$H{iUYUd_g&>_=XrPn
zK~NH7^_{we&Z?>Yfc93fAvR9mf?8Hs4KM`L?3Ny6XeVPQC;<w7v6rk(SmVYi#xEA5
zRITlV_s;aOSqlinlVAy6sl?$->~Xu!0YIvHkn&%=WYRKXh9(a6yZ~&LSD5r(&bnVN
zhW%0T9cNV8=(%DV(4BQoST;wa1tf4p_=JxDZmJX}X;^k>y<%A<m>rq3vK4hg9$UPr
zvgK;lMlgs_&UgX_jANF?CfX4P!fqlWiixZBo#|lp&V1-b5u2y`8BBE-TaQesz#E|k
zS|}6)_fu{j0?3qXk^s#bsA{^er0gRS=4=_A6H2-Tl>_;b{9@4-<f^*N_k^O>yB)ZU
zAzbWBEZfVWCCg5T5a9yML-fQ=cg|ZWUvP3rx>aAKrFKZj=H+sH7GEQ@hJ}LD_8{ro
z7`6}xdjWzeyO?A>hF>$y%Zpj#a%T%1?LU<7R5xgr4KR3X%Xj8bLUErXeSOEdy_Ylq
zrU3G8xm2!xupgWEOl9-q;^tfC9q>^~S;P(YMv|@46v&rqs_4RX)9;qlnfFC%mYihT
zCGnMTYG`+vB1G^}E8^^lb@}KbB6|vBCNOMfD1ip;+JQChvqfjD)*`+Eo%r+z#2X-?
zV@$y6?Yic98C)@3Om5sU&eSD}=A>MT=C%cYH+4X>rQB@Tiqi*$l$@1%Y-dAW<&-*6
zB1hg93exi7TvQ%1bTH4%)p6|LY73#$)G`HlajQr0RqW|0gs&qoCO#=raCeR$e+1y<
zec#S8gf4LqiW$f-0(P?udGrj&SBUsQny-_jECA+==z4XT6ltsKP(mEJ;4;lnZs_b;
zRZ8#(Vp^WH^)v$^^C7z1taIkmZ@S}<J{@XXMhLTTsPW(x9e{Bgi0hAUCeuN^AkfgV
zUOG9qR_A(o`#@Wnqtzk_qoCYM*{{N$#vux=fT~btuJ2d`KCv%5E2Kvt6iY>QtQ?yT
zyeqTGQf|&T2f1x<pi`gBHn3bJ8>@K>ZuwVXFh-6G=T2W4+&qu~IIPA33{#50D)##F
zX*S4PI?vR8S}(2GtKoC)rJ-W@%a_0j`CQbA=(Zm`qD79(SuFuP7JOcx0q-AWP4C@-
zM|@Tjl<EMLYJj}_a#@pmF!sl6_29NbdTtqL!cb%Tv6@#VVvje-{7f)Nb&7>nxuqe?
zXd4Jv(Lo<Y%6F>2Jw#Sa>&Cx8bltP@y?x{Owt}>jUg$=wAQ=$4+5iw^GjW-K^N$Yc
zrtUaG5wTBD)dvVw6&ju)eY+!iR(hsy*5!U;<TNDgEcih6r_#QW5|hZKZuTD@mQ$;;
zEhLCtMLDf?Iz@8L+|Kk_A^ptCeHO#a|3wm5K5W0sd}7(ej|G2oSN`spn8Yw81zT!Y
zM~<CkI-1uscYG{+W?e*1$wK{Hl#8@?w#-WUMivd8+rB1+g^KuN;L~|vs2`z_llBuS
z2@NfKKL`JG5d7`IgTlcw!(#8%yiAX-N<e{g39!Cb#XbN_=bs(~Lp`X`h^$NS#Ino=
z25P#T3_4KYGjZ{DTx|N+%8NS&I6X38t6_7w_aZG*da3HSB<y%2kp|YiHG!ES<zhD=
zmauyFIyHv&^ArQZ7*U1T?A4m|2i^HdwgNGGsD`lylwmIC;hop`((?nl^r*XZC*yL;
zmgXPJ>OC%{K*VuJzT+u6uGpV$dzRcf2BQ6JFm7W>S1tG%qRRGj+|gjnNz%9npmDF9
zt%25S$ky)99}E^l9}7lYCSD30SHW`o9;amkeTKCyF_SM=yRei>X@7kJ)l5GM(S#Tr
z+z-i2)yj$_=G$-yu-->T#-Af3zk*Xoa);j!jyzZNO`?uLLp{j4q3KGKwocS5i=Sl(
z(rbVsX3~(}Y-FSMf*N|!*E5hoF|mr-0o<Rj1vgXBaGNl|`9e2t9>>xs$}4ggozO4v
ziyOkho(F6Fbl_wnQ6Hm-;A4?5NLQ*MkcAL#dlt2`fcGnT$<N>#kvx%SH6k0@tcB<<
z6Ty-}llG-r5Un1Zx(r2pf3l4!JxdjoAYjhsMvuIqQUz#<fZjYd%0{lz|8gtP#XsO+
zy=hMFu3`kY0&{~-%bNS{rz6(KmE@Q^o{j)v{+KQ%+4)~bxN6EzO00LBH>t*vd`{o+
zXCV3uzfp}eCrxK%{f9?0ESFpgzctC17Ce5;$;TJ2J@4syT``F3tZ{=3v|{k<wDR3i
zB)!O4`#?%YRg)2rFqd<zH~<j;O`2BbC_|rv;}g;MFiT6bFA&WdS)CCrDhO#)heR1E
zDejtZbp}Spx}JHvurTRYEZaOhJZ$U5UB8Y9*hEX|3Y9vvzT7@ck`u}XvY8M5DzpDG
z(SJ?m3z9rz!deR(+2R*Mn*51M_VK?>_umNsxVb@oew2OZfn`ewWCWwRhkxPBzXtrT
zKS&TY1+CHmH_7K9ZauSW)ck3Jeg)IN4X?YOJa*$zS{BH~qvUBoK%q-5=Jqo<{{7=8
z$&bHsH&h}GZ?y|z96yA;zo-5GF>dJpG4B7@h)W{$N2h$VPs&|i+%n??OX-JWQF<gB
z@^{+vRexyI_XOcPeQ8qS_D5#{3H0(SK?aH;L1`g!X7HZI_xma`yhbA;p?bZJV<uv@
z@6B%gu&jS*(~2<z!4b8NmQ^Fm3ms2cTqf0gDwL69C^+WAZEdn4zRz5Sckry^p=L~~
z_98c?{&yDo-wi=>58Sd6Z#nYiVKlMXF)3u1kLM9KaaerqIOux@M(h|Ts-+L9fS|D0
z=%l4+y{J<Ux?Mp4!0_gn(Lb_kszcnUjg6b!N-k3J2%`CZ!YsGfWYucja;?`Ba0=1B
zxThrhj~SwL+KNVoRxtAMm{CA|L;sVB|HYbNo>T6f`Nj+u$DcNUmbW)<he!``#$&L4
zt6KLf%EbPe@ykDqqBiqbc;3PR8{C)llq7U8p*dMEStnwz`F$}=)IS0OQ_nL@%eTog
zJ8b`(7UOBq;=a>i15zUGp^pnsUFN?$mi1q}5icvp*K7z5MJki}2V??P*wThYFf`Pz
zUkwWnt8FUz^dctq;~_y<d|(^@Kl4jJUB@QqK<nqTHTs!D{`~u2o$!BU{v&9$i9Y4@
z@9+9WGNczQYk<aBm6qI}+Z+CoBU0rL1xxYl>i7TI%zlpfBN9A?j5h}#eEw?;^Ye!P
zc5u}{J68XL=f3cPZV!TN1vyvvZ(sc1ybT5IQZnY;^Ph1eSp__Wcky8R52ylzlXr+5
z_?evlmI?owt16O`GGJ?DM)W^})GsZ!{~RAE0$2oJYxrjH&mVyVdxLqMc#W@hy-u<~
R5C;BTP}4q_d&cVC{{cg)^tJ#1

literal 0
HcmV?d00001

diff --git a/internal/storage/raft/backend.go b/internal/storage/raft/backend.go
index 387e35973c71..4e1cd05bbb18 100644
--- a/internal/storage/raft/backend.go
+++ b/internal/storage/raft/backend.go
@@ -44,6 +44,9 @@ import (
 // intended to communicate over Consul's multiplexed server port (which handles
 // TLS).
 //
+// For more information, see here:
+// https://github.com/hashicorp/consul/tree/main/docs/resources#raft-storage-backend
+//
 // You must call Run before using the backend.
 func NewBackend(h Handle, l hclog.Logger) (*Backend, error) {
 	s, err := inmem.NewStore()
diff --git a/proto-public/pbresource/resource.pb.go b/proto-public/pbresource/resource.pb.go
index 76bf1be45c56..4a46d1ea8bdf 100644
--- a/proto-public/pbresource/resource.pb.go
+++ b/proto-public/pbresource/resource.pb.go
@@ -7,6 +7,8 @@
 // 	protoc        (unknown)
 // source: pbresource/resource.proto
 
+// For more information, see: https://github.com/hashicorp/consul/tree/main/docs/resources
+
 package pbresource
 
 import (
diff --git a/proto-public/pbresource/resource.proto b/proto-public/pbresource/resource.proto
index 038f96c7a5bd..9e65647587b7 100644
--- a/proto-public/pbresource/resource.proto
+++ b/proto-public/pbresource/resource.proto
@@ -3,6 +3,7 @@
 
 syntax = "proto3";
 
+// For more information, see: https://github.com/hashicorp/consul/tree/main/docs/resources
 package hashicorp.consul.resource;
 
 import "annotations/ratelimit/ratelimit.proto";

From 0a38fc1a2a9589963fc86fcf915385f36ad9e7eb Mon Sep 17 00:00:00 2001
From: Dan Upton <daniel@floppy.co>
Date: Mon, 15 May 2023 12:35:10 +0100
Subject: [PATCH 84/92] resource: handle `ErrWatchClosed` in `WatchList`
 endpoint (#17289)

---
 agent/grpc-external/services/resource/watch.go | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/agent/grpc-external/services/resource/watch.go b/agent/grpc-external/services/resource/watch.go
index 2fd943a6c946..35ec14513ac3 100644
--- a/agent/grpc-external/services/resource/watch.go
+++ b/agent/grpc-external/services/resource/watch.go
@@ -4,6 +4,8 @@
 package resource
 
 import (
+	"errors"
+
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
@@ -51,7 +53,10 @@ func (s *Server) WatchList(req *pbresource.WatchListRequest, stream pbresource.R
 
 	for {
 		event, err := watch.Next(stream.Context())
-		if err != nil {
+		switch {
+		case errors.Is(err, storage.ErrWatchClosed):
+			return status.Error(codes.Aborted, "watch closed by the storage backend (possibly due to snapshot restoration)")
+		case err != nil:
 			return status.Errorf(codes.Internal, "failed next: %v", err)
 		}
 

From 17f06b88081de742a5ee652050396ce41b0e8224 Mon Sep 17 00:00:00 2001
From: cskh <hui.kang@hashicorp.com>
Date: Mon, 15 May 2023 09:33:05 -0400
Subject: [PATCH 85/92] upgrade test: fix on-the-fly-image build and downsize
 runner (#17331)

---
 .github/workflows/test-integrations.yml                   | 6 ++++--
 .../test/upgrade/ingress_gateway_sds_test.go              | 8 ++++----
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/test-integrations.yml b/.github/workflows/test-integrations.yml
index ccafc68a6968..e75e9df2a4ea 100644
--- a/.github/workflows/test-integrations.yml
+++ b/.github/workflows/test-integrations.yml
@@ -514,7 +514,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
   
   upgrade-integration-test:
-    runs-on: ${{ fromJSON(needs.setup.outputs.compute-xl) }}
+    runs-on: ${{ fromJSON(needs.setup.outputs.compute-large) }}
     needs:
       - setup
       - dev-build
@@ -548,6 +548,8 @@ jobs:
         run: docker build -t consul-envoy:latest-version --build-arg CONSUL_IMAGE=docker.mirror.hashicorp.services/${{ env.CONSUL_LATEST_IMAGE_NAME }}:${{ env.CONSUL_LATEST_VERSION }} --build-arg ENVOY_VERSION=${{ env.ENVOY_VERSION }} -f ./test/integration/consul-container/assets/Dockerfile-consul-envoy ./test/integration/consul-container/assets
       - name: Build consul-envoy:target-version image
         run: docker build -t consul-envoy:target-version --build-arg CONSUL_IMAGE=${{ env.CONSUL_LATEST_IMAGE_NAME }}:local --build-arg ENVOY_VERSION=${{ env.ENVOY_VERSION }} -f ./test/integration/consul-container/assets/Dockerfile-consul-envoy ./test/integration/consul-container/assets
+      - name: Build sds image
+        run: docker build -t consul-sds-server ./test/integration/connect/envoy/test-sds-server/
       - name: Configure GH workaround for ipv6 loopback
         if: ${{ !endsWith(github.repository, '-enterprise') }}
         run: |
@@ -566,7 +568,7 @@ jobs:
             --raw-command \
             --format=short-verbose \
             --debug \
-            --rerun-fails=3 \
+            --rerun-fails=2 \
             --packages="./..." \
             -- \
             go test \
diff --git a/test/integration/consul-container/test/upgrade/ingress_gateway_sds_test.go b/test/integration/consul-container/test/upgrade/ingress_gateway_sds_test.go
index 52ee91bac8fc..c31f8007b2e3 100644
--- a/test/integration/consul-container/test/upgrade/ingress_gateway_sds_test.go
+++ b/test/integration/consul-container/test/upgrade/ingress_gateway_sds_test.go
@@ -22,6 +22,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/testcontainers/testcontainers-go"
+	"github.com/testcontainers/testcontainers-go/wait"
 )
 
 const sdsServerPort = 1234
@@ -313,10 +314,8 @@ func createSDSServer(t *testing.T, cluster *libcluster.Cluster) (containerName s
 	_, err = testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
 		Started: true,
 		ContainerRequest: testcontainers.ContainerRequest{
-			FromDockerfile: testcontainers.FromDockerfile{
-				Context: sdsServerFilesPath,
-			},
-			Name: containerName,
+			Image: "consul-sds-server",
+			Name:  containerName,
 			Networks: []string{
 				cluster.NetworkName,
 			},
@@ -332,6 +331,7 @@ func createSDSServer(t *testing.T, cluster *libcluster.Cluster) (containerName s
 					ReadOnly: true,
 				},
 			},
+			WaitingFor: wait.ForLog("").WithStartupTimeout(60 * time.Second),
 		},
 	})
 	require.NoError(t, err, "create SDS server container")

From d37572bd442b1bd9f5e92778c83718ff14e87df3 Mon Sep 17 00:00:00 2001
From: Matt Keeler <mkeeler@users.noreply.github.com>
Date: Mon, 15 May 2023 09:55:03 -0400
Subject: [PATCH 86/92] Add a Node health controller (#17214)

This will aggregate all HealthStatus objects owned by the Node and update the status of the Node with an overall health.
---
 agent/consul/server.go                        |   2 +
 internal/catalog/exports.go                   |   8 +
 .../controllers/nodehealth/controller.go      | 120 ++++++
 .../controllers/nodehealth/controller_test.go | 365 ++++++++++++++++++
 .../internal/controllers/nodehealth/status.go |  12 +
 .../catalog/internal/controllers/register.go  |  13 +
 internal/controller/api.go                    |  23 ++
 internal/controller/api_test.go               |  74 ++++
 internal/resource/resourcetest/builder.go     | 136 +++++++
 9 files changed, 753 insertions(+)
 create mode 100644 internal/catalog/internal/controllers/nodehealth/controller.go
 create mode 100644 internal/catalog/internal/controllers/nodehealth/controller_test.go
 create mode 100644 internal/catalog/internal/controllers/nodehealth/status.go
 create mode 100644 internal/catalog/internal/controllers/register.go
 create mode 100644 internal/resource/resourcetest/builder.go

diff --git a/agent/consul/server.go b/agent/consul/server.go
index d3c3044121b7..46adbd9955c5 100644
--- a/agent/consul/server.go
+++ b/agent/consul/server.go
@@ -844,6 +844,8 @@ func NewServer(config *Config, flat Deps, externalGRPCServer *grpc.Server, incom
 
 func (s *Server) registerResources() {
 	catalog.RegisterTypes(s.typeRegistry)
+	catalog.RegisterControllers(s.controllerManager)
+
 	mesh.RegisterTypes(s.typeRegistry)
 	reaper.RegisterControllers(s.controllerManager)
 
diff --git a/internal/catalog/exports.go b/internal/catalog/exports.go
index 4f3ddb6a9d8d..39d6c44e6659 100644
--- a/internal/catalog/exports.go
+++ b/internal/catalog/exports.go
@@ -4,7 +4,9 @@
 package catalog
 
 import (
+	"github.com/hashicorp/consul/internal/catalog/internal/controllers"
 	"github.com/hashicorp/consul/internal/catalog/internal/types"
+	"github.com/hashicorp/consul/internal/controller"
 	"github.com/hashicorp/consul/internal/resource"
 )
 
@@ -43,3 +45,9 @@ var (
 func RegisterTypes(r resource.Registry) {
 	types.Register(r)
 }
+
+// RegisterControllers registers controllers for the catalog types with
+// the given controller Manager.
+func RegisterControllers(mgr *controller.Manager) {
+	controllers.Register(mgr)
+}
diff --git a/internal/catalog/internal/controllers/nodehealth/controller.go b/internal/catalog/internal/controllers/nodehealth/controller.go
new file mode 100644
index 000000000000..342eed02e84f
--- /dev/null
+++ b/internal/catalog/internal/controllers/nodehealth/controller.go
@@ -0,0 +1,120 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package nodehealth
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/consul/internal/catalog/internal/types"
+	"github.com/hashicorp/consul/internal/controller"
+	"github.com/hashicorp/consul/internal/resource"
+	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+func NodeHealthController() controller.Controller {
+	return controller.ForType(types.NodeType).
+		WithWatch(types.HealthStatusType, controller.MapOwnerFiltered(types.NodeType)).
+		WithReconciler(&nodeHealthReconciler{})
+}
+
+type nodeHealthReconciler struct{}
+
+func (r *nodeHealthReconciler) Reconcile(ctx context.Context, rt controller.Runtime, req controller.Request) error {
+	// The runtime is passed by value so replacing it here for the remaineder of this
+	// reconciliation request processing will not affect future invocations.
+	rt.Logger = rt.Logger.With("resource-id", req.ID)
+
+	rt.Logger.Trace("reconciling node health")
+
+	// read the node
+	rsp, err := rt.Client.Read(ctx, &pbresource.ReadRequest{Id: req.ID})
+	switch {
+	case status.Code(err) == codes.NotFound:
+		rt.Logger.Trace("node has been deleted")
+		return nil
+	case err != nil:
+		rt.Logger.Error("the resource service has returned an unexpected error", "error", err)
+		return err
+	}
+
+	res := rsp.Resource
+
+	health, err := getNodeHealth(ctx, rt, req.ID)
+	if err != nil {
+		rt.Logger.Error("failed to calculate the nodes health", "error", err)
+		return err
+	}
+
+	message := NodeHealthyMessage
+	statusState := pbresource.Condition_STATE_TRUE
+	if health != pbcatalog.Health_HEALTH_PASSING {
+		statusState = pbresource.Condition_STATE_FALSE
+		message = NodeUnhealthyMessage
+	}
+
+	newStatus := &pbresource.Status{
+		ObservedGeneration: res.Generation,
+		Conditions: []*pbresource.Condition{
+			{
+				Type:    StatusConditionHealthy,
+				State:   statusState,
+				Reason:  health.String(),
+				Message: message,
+			},
+		},
+	}
+
+	if resource.EqualStatus(res.Status[StatusKey], newStatus, false) {
+		rt.Logger.Trace("resources node health status is unchanged", "health", health.String())
+		return nil
+	}
+
+	_, err = rt.Client.WriteStatus(ctx, &pbresource.WriteStatusRequest{
+		Id:     res.Id,
+		Key:    StatusKey,
+		Status: newStatus,
+	})
+
+	if err != nil {
+		rt.Logger.Error("error encountered when attempting to update the resources node health status", "error", err)
+		return err
+	}
+
+	rt.Logger.Trace("resources node health status was updated", "health", health.String())
+	return nil
+}
+
+func getNodeHealth(ctx context.Context, rt controller.Runtime, nodeRef *pbresource.ID) (pbcatalog.Health, error) {
+	rsp, err := rt.Client.ListByOwner(ctx, &pbresource.ListByOwnerRequest{
+		Owner: nodeRef,
+	})
+
+	if err != nil {
+		return pbcatalog.Health_HEALTH_CRITICAL, err
+	}
+
+	health := pbcatalog.Health_HEALTH_PASSING
+
+	for _, res := range rsp.Resources {
+		if resource.EqualType(res.Id.Type, types.HealthStatusType) {
+			var hs pbcatalog.HealthStatus
+			if err := res.Data.UnmarshalTo(&hs); err != nil {
+				// This should be impossible as the resource service + type validations the
+				// catalog is performing will ensure that no data gets written where unmarshalling
+				// to this type will error.
+				return pbcatalog.Health_HEALTH_CRITICAL, fmt.Errorf("error unmarshalling health status data: %w", err)
+			}
+
+			if hs.Status > health {
+				health = hs.Status
+			}
+		}
+	}
+
+	return health, nil
+}
diff --git a/internal/catalog/internal/controllers/nodehealth/controller_test.go b/internal/catalog/internal/controllers/nodehealth/controller_test.go
new file mode 100644
index 000000000000..8150fe0bdda3
--- /dev/null
+++ b/internal/catalog/internal/controllers/nodehealth/controller_test.go
@@ -0,0 +1,365 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package nodehealth
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	svctest "github.com/hashicorp/consul/agent/grpc-external/services/resource/testing"
+	"github.com/hashicorp/consul/internal/catalog/internal/types"
+	"github.com/hashicorp/consul/internal/controller"
+	"github.com/hashicorp/consul/internal/resource/resourcetest"
+	pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/hashicorp/consul/proto/private/prototest"
+	"github.com/hashicorp/consul/sdk/testutil"
+	"github.com/hashicorp/consul/sdk/testutil/retry"
+	"github.com/oklog/ulid/v2"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+var (
+	nodeData = &pbcatalog.Node{
+		Addresses: []*pbcatalog.NodeAddress{
+			{
+				Host: "127.0.0.1",
+			},
+		},
+	}
+
+	dnsPolicyData = &pbcatalog.DNSPolicy{
+		Workloads: &pbcatalog.WorkloadSelector{
+			Prefixes: []string{""},
+		},
+		Weights: &pbcatalog.Weights{
+			Passing: 1,
+			Warning: 1,
+		},
+	}
+)
+
+func resourceID(rtype *pbresource.Type, name string) *pbresource.ID {
+	return &pbresource.ID{
+		Type: rtype,
+		Tenancy: &pbresource.Tenancy{
+			Partition: "default",
+			Namespace: "default",
+			PeerName:  "local",
+		},
+		Name: name,
+	}
+}
+
+type nodeHealthControllerTestSuite struct {
+	suite.Suite
+
+	resourceClient pbresource.ResourceServiceClient
+	runtime        controller.Runtime
+
+	ctl nodeHealthReconciler
+
+	nodeNoHealth    *pbresource.ID
+	nodePassing     *pbresource.ID
+	nodeWarning     *pbresource.ID
+	nodeCritical    *pbresource.ID
+	nodeMaintenance *pbresource.ID
+}
+
+func (suite *nodeHealthControllerTestSuite) SetupTest() {
+	suite.resourceClient = svctest.RunResourceService(suite.T(), types.Register)
+	suite.runtime = controller.Runtime{Client: suite.resourceClient, Logger: testutil.Logger(suite.T())}
+
+	// The rest of the setup will be to prime the resource service with some data
+	suite.nodeNoHealth = resourcetest.Resource(types.NodeType, "test-node-no-health").
+		WithData(suite.T(), nodeData).
+		Write(suite.T(), suite.resourceClient).Id
+
+	suite.nodePassing = resourcetest.Resource(types.NodeType, "test-node-passing").
+		WithData(suite.T(), nodeData).
+		Write(suite.T(), suite.resourceClient).Id
+
+	suite.nodeWarning = resourcetest.Resource(types.NodeType, "test-node-warning").
+		WithData(suite.T(), nodeData).
+		Write(suite.T(), suite.resourceClient).Id
+
+	suite.nodeCritical = resourcetest.Resource(types.NodeType, "test-node-critical").
+		WithData(suite.T(), nodeData).
+		Write(suite.T(), suite.resourceClient).Id
+
+	suite.nodeMaintenance = resourcetest.Resource(types.NodeType, "test-node-maintenance").
+		WithData(suite.T(), nodeData).
+		Write(suite.T(), suite.resourceClient).Id
+
+	nodeHealthDesiredStatus := map[string]pbcatalog.Health{
+		suite.nodePassing.Name:     pbcatalog.Health_HEALTH_PASSING,
+		suite.nodeWarning.Name:     pbcatalog.Health_HEALTH_WARNING,
+		suite.nodeCritical.Name:    pbcatalog.Health_HEALTH_CRITICAL,
+		suite.nodeMaintenance.Name: pbcatalog.Health_HEALTH_MAINTENANCE,
+	}
+
+	// In order to exercise the behavior to ensure that its not a last-status-wins sort of thing
+	// we are strategically naming health statuses so that they will be returned in an order with
+	// the most precedent status being in the middle of the list. This will ensure that statuses
+	// seen later can overide a previous status and that statuses seen later do not override if
+	// they would lower the overall status such as going from critical -> warning.
+	precedenceHealth := []pbcatalog.Health{
+		pbcatalog.Health_HEALTH_PASSING,
+		pbcatalog.Health_HEALTH_WARNING,
+		pbcatalog.Health_HEALTH_CRITICAL,
+		pbcatalog.Health_HEALTH_MAINTENANCE,
+		pbcatalog.Health_HEALTH_CRITICAL,
+		pbcatalog.Health_HEALTH_WARNING,
+		pbcatalog.Health_HEALTH_PASSING,
+	}
+
+	for _, node := range []*pbresource.ID{suite.nodePassing, suite.nodeWarning, suite.nodeCritical, suite.nodeMaintenance} {
+		for idx, health := range precedenceHealth {
+			if nodeHealthDesiredStatus[node.Name] >= health {
+				resourcetest.Resource(types.HealthStatusType, fmt.Sprintf("test-check-%s-%d", node.Name, idx)).
+					WithData(suite.T(), &pbcatalog.HealthStatus{Type: "tcp", Status: health}).
+					WithOwner(node).
+					Write(suite.T(), suite.resourceClient)
+			}
+		}
+	}
+
+	// create a DNSPolicy to be owned by the node. The type doesn't really matter it just needs
+	// to be something that doesn't care about its owner. All we want to prove is that we are
+	// filtering out non-HealthStatus types appropriately.
+	resourcetest.Resource(types.DNSPolicyType, "test-policy").
+		WithData(suite.T(), dnsPolicyData).
+		WithOwner(suite.nodeNoHealth).
+		Write(suite.T(), suite.resourceClient)
+}
+
+func (suite *nodeHealthControllerTestSuite) TestGetNodeHealthListError() {
+	// This resource id references a resource type that will not be
+	// registered with the resource service. The ListByOwner call
+	// should produce an InvalidArgument error. This test is meant
+	// to validate how that error is handled (its propagated back
+	// to the caller)
+	ref := resourceID(
+		&pbresource.Type{Group: "not", GroupVersion: "v1", Kind: "found"},
+		"irrelevant",
+	)
+	health, err := getNodeHealth(context.Background(), suite.runtime, ref)
+	require.Equal(suite.T(), pbcatalog.Health_HEALTH_CRITICAL, health)
+	require.Error(suite.T(), err)
+	require.Equal(suite.T(), codes.InvalidArgument, status.Code(err))
+}
+
+func (suite *nodeHealthControllerTestSuite) TestGetNodeHealthNoNode() {
+	// This test is meant to ensure that when the node doesn't exist
+	// no error is returned but also no data is. The default passing
+	// status should then be returned in the same manner as the node
+	// existing but with no associated HealthStatus resources.
+	ref := resourceID(types.NodeType, "foo")
+	ref.Uid = ulid.Make().String()
+	health, err := getNodeHealth(context.Background(), suite.runtime, ref)
+
+	require.NoError(suite.T(), err)
+	require.Equal(suite.T(), pbcatalog.Health_HEALTH_PASSING, health)
+}
+
+func (suite *nodeHealthControllerTestSuite) TestGetNodeHealthNoStatus() {
+	health, err := getNodeHealth(context.Background(), suite.runtime, suite.nodeNoHealth)
+	require.NoError(suite.T(), err)
+	require.Equal(suite.T(), pbcatalog.Health_HEALTH_PASSING, health)
+}
+
+func (suite *nodeHealthControllerTestSuite) TestGetNodeHealthPassingStatus() {
+	health, err := getNodeHealth(context.Background(), suite.runtime, suite.nodePassing)
+	require.NoError(suite.T(), err)
+	require.Equal(suite.T(), pbcatalog.Health_HEALTH_PASSING, health)
+}
+
+func (suite *nodeHealthControllerTestSuite) TestGetNodeHealthCriticalStatus() {
+	health, err := getNodeHealth(context.Background(), suite.runtime, suite.nodeCritical)
+	require.NoError(suite.T(), err)
+	require.Equal(suite.T(), pbcatalog.Health_HEALTH_CRITICAL, health)
+}
+
+func (suite *nodeHealthControllerTestSuite) TestGetNodeHealthWarningStatus() {
+	health, err := getNodeHealth(context.Background(), suite.runtime, suite.nodeWarning)
+	require.NoError(suite.T(), err)
+	require.Equal(suite.T(), pbcatalog.Health_HEALTH_WARNING, health)
+}
+
+func (suite *nodeHealthControllerTestSuite) TestGetNodeHealthMaintenanceStatus() {
+	health, err := getNodeHealth(context.Background(), suite.runtime, suite.nodeMaintenance)
+	require.NoError(suite.T(), err)
+	require.Equal(suite.T(), pbcatalog.Health_HEALTH_MAINTENANCE, health)
+}
+
+func (suite *nodeHealthControllerTestSuite) TestReconcileNodeNotFound() {
+	// This test ensures that removed nodes are ignored. In particular we don't
+	// want to propagate the error and indefinitely keep re-reconciling in this case.
+	err := suite.ctl.Reconcile(context.Background(), suite.runtime, controller.Request{
+		ID: resourceID(types.NodeType, "not-found"),
+	})
+	require.NoError(suite.T(), err)
+}
+
+func (suite *nodeHealthControllerTestSuite) TestReconcilePropagateReadError() {
+	// This test aims to ensure that errors other than NotFound errors coming
+	// from the initial resource read get propagated. This case is very unrealistic
+	// as the controller should not have given us a request ID for a resource type
+	// that doesn't exist but this was the easiest way I could think of to synthesize
+	// a Read error.
+	ref := resourceID(
+		&pbresource.Type{Group: "not", GroupVersion: "v1", Kind: "found"},
+		"irrelevant",
+	)
+
+	err := suite.ctl.Reconcile(context.Background(), suite.runtime, controller.Request{
+		ID: ref,
+	})
+	require.Error(suite.T(), err)
+	require.Equal(suite.T(), codes.InvalidArgument, status.Code(err))
+}
+
+func (suite *nodeHealthControllerTestSuite) testReconcileStatus(id *pbresource.ID, expectedStatus *pbresource.Condition) *pbresource.Resource {
+	suite.T().Helper()
+
+	err := suite.ctl.Reconcile(context.Background(), suite.runtime, controller.Request{
+		ID: id,
+	})
+	require.NoError(suite.T(), err)
+
+	rsp, err := suite.resourceClient.Read(context.Background(), &pbresource.ReadRequest{
+		Id: id,
+	})
+	require.NoError(suite.T(), err)
+
+	nodeHealthStatus, found := rsp.Resource.Status[StatusKey]
+	require.True(suite.T(), found)
+	require.Equal(suite.T(), rsp.Resource.Generation, nodeHealthStatus.ObservedGeneration)
+	require.Len(suite.T(), nodeHealthStatus.Conditions, 1)
+	prototest.AssertDeepEqual(suite.T(),
+		nodeHealthStatus.Conditions[0],
+		expectedStatus)
+
+	return rsp.Resource
+}
+
+func (suite *nodeHealthControllerTestSuite) TestReconcile_StatusPassing() {
+	suite.testReconcileStatus(suite.nodePassing, &pbresource.Condition{
+		Type:    StatusConditionHealthy,
+		State:   pbresource.Condition_STATE_TRUE,
+		Reason:  "HEALTH_PASSING",
+		Message: NodeHealthyMessage,
+	})
+}
+
+func (suite *nodeHealthControllerTestSuite) TestReconcile_StatusWarning() {
+	suite.testReconcileStatus(suite.nodeWarning, &pbresource.Condition{
+		Type:    StatusConditionHealthy,
+		State:   pbresource.Condition_STATE_FALSE,
+		Reason:  "HEALTH_WARNING",
+		Message: NodeUnhealthyMessage,
+	})
+}
+
+func (suite *nodeHealthControllerTestSuite) TestReconcile_StatusCritical() {
+	suite.testReconcileStatus(suite.nodeCritical, &pbresource.Condition{
+		Type:    StatusConditionHealthy,
+		State:   pbresource.Condition_STATE_FALSE,
+		Reason:  "HEALTH_CRITICAL",
+		Message: NodeUnhealthyMessage,
+	})
+}
+
+func (suite *nodeHealthControllerTestSuite) TestReconcile_StatusMaintenance() {
+	suite.testReconcileStatus(suite.nodeMaintenance, &pbresource.Condition{
+		Type:    StatusConditionHealthy,
+		State:   pbresource.Condition_STATE_FALSE,
+		Reason:  "HEALTH_MAINTENANCE",
+		Message: NodeUnhealthyMessage,
+	})
+}
+
+func (suite *nodeHealthControllerTestSuite) TestReconcile_AvoidRereconciliationWrite() {
+	res1 := suite.testReconcileStatus(suite.nodeWarning, &pbresource.Condition{
+		Type:    StatusConditionHealthy,
+		State:   pbresource.Condition_STATE_FALSE,
+		Reason:  "HEALTH_WARNING",
+		Message: NodeUnhealthyMessage,
+	})
+
+	res2 := suite.testReconcileStatus(suite.nodeWarning, &pbresource.Condition{
+		Type:    StatusConditionHealthy,
+		State:   pbresource.Condition_STATE_FALSE,
+		Reason:  "HEALTH_WARNING",
+		Message: NodeUnhealthyMessage,
+	})
+
+	// If another status write was performed then the versions would differ. This
+	// therefore proves that after a second reconciliation without any change in status
+	// that we are not making subsequent status writes.
+	require.Equal(suite.T(), res1.Version, res2.Version)
+}
+
+func (suite *nodeHealthControllerTestSuite) waitForReconciliation(id *pbresource.ID, reason string) {
+	suite.T().Helper()
+
+	retry.Run(suite.T(), func(r *retry.R) {
+		rsp, err := suite.resourceClient.Read(context.Background(), &pbresource.ReadRequest{
+			Id: id,
+		})
+		require.NoError(r, err)
+
+		nodeHealthStatus, found := rsp.Resource.Status[StatusKey]
+		require.True(r, found)
+		require.Equal(r, rsp.Resource.Generation, nodeHealthStatus.ObservedGeneration)
+		require.Len(r, nodeHealthStatus.Conditions, 1)
+		require.Equal(r, reason, nodeHealthStatus.Conditions[0].Reason)
+	})
+}
+func (suite *nodeHealthControllerTestSuite) TestController() {
+	// create the controller manager
+	mgr := controller.NewManager(suite.resourceClient, testutil.Logger(suite.T()))
+
+	// register our controller
+	mgr.Register(NodeHealthController())
+	mgr.SetRaftLeader(true)
+	ctx, cancel := context.WithCancel(context.Background())
+	suite.T().Cleanup(cancel)
+
+	// run the manager
+	go mgr.Run(ctx)
+
+	// ensure that the node health eventually gets set.
+	suite.waitForReconciliation(suite.nodePassing, "HEALTH_PASSING")
+
+	// rewrite the resource - this will cause the nodes health
+	// to be rereconciled but wont result in any health change
+	resourcetest.Resource(types.NodeType, suite.nodePassing.Name).
+		WithData(suite.T(), &pbcatalog.Node{
+			Addresses: []*pbcatalog.NodeAddress{
+				{
+					Host: "198.18.0.1",
+				},
+			},
+		}).
+		Write(suite.T(), suite.resourceClient)
+
+	// wait for rereconciliation to happen
+	suite.waitForReconciliation(suite.nodePassing, "HEALTH_PASSING")
+
+	resourcetest.Resource(types.HealthStatusType, "failure").
+		WithData(suite.T(), &pbcatalog.HealthStatus{Type: "fake", Status: pbcatalog.Health_HEALTH_CRITICAL}).
+		WithOwner(suite.nodePassing).
+		Write(suite.T(), suite.resourceClient)
+
+	suite.waitForReconciliation(suite.nodePassing, "HEALTH_CRITICAL")
+}
+
+func TestNodeHealthController(t *testing.T) {
+	suite.Run(t, new(nodeHealthControllerTestSuite))
+}
diff --git a/internal/catalog/internal/controllers/nodehealth/status.go b/internal/catalog/internal/controllers/nodehealth/status.go
new file mode 100644
index 000000000000..8cb989101dad
--- /dev/null
+++ b/internal/catalog/internal/controllers/nodehealth/status.go
@@ -0,0 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package nodehealth
+
+const (
+	StatusKey              = "consul.io/node-health"
+	StatusConditionHealthy = "healthy"
+
+	NodeHealthyMessage   = "All node health checks are passing"
+	NodeUnhealthyMessage = "One or more node health checks are not passing"
+)
diff --git a/internal/catalog/internal/controllers/register.go b/internal/catalog/internal/controllers/register.go
new file mode 100644
index 000000000000..b4b6f190f74b
--- /dev/null
+++ b/internal/catalog/internal/controllers/register.go
@@ -0,0 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package controllers
+
+import (
+	"github.com/hashicorp/consul/internal/catalog/internal/controllers/nodehealth"
+	"github.com/hashicorp/consul/internal/controller"
+)
+
+func Register(mgr *controller.Manager) {
+	mgr.Register(nodehealth.NodeHealthController())
+}
diff --git a/internal/controller/api.go b/internal/controller/api.go
index 7a2e89be4641..c2cc0925da1b 100644
--- a/internal/controller/api.go
+++ b/internal/controller/api.go
@@ -169,6 +169,29 @@ func MapOwner(_ context.Context, _ Runtime, res *pbresource.Resource) ([]Request
 	return reqs, nil
 }
 
+func MapOwnerFiltered(filter *pbresource.Type) DependencyMapper {
+	return func(_ context.Context, _ Runtime, res *pbresource.Resource) ([]Request, error) {
+		if res.Owner == nil {
+			return nil, nil
+		}
+
+		ownerType := res.Owner.GetType()
+		if ownerType.Group != filter.Group {
+			return nil, nil
+		}
+
+		if ownerType.GroupVersion != filter.GroupVersion {
+			return nil, nil
+		}
+
+		if ownerType.Kind != filter.Kind {
+			return nil, nil
+		}
+
+		return []Request{{ID: res.Owner}}, nil
+	}
+}
+
 // Placement determines where and how many replicas of the controller will run.
 type Placement int
 
diff --git a/internal/controller/api_test.go b/internal/controller/api_test.go
index 2006664b20fb..51bb62843f7d 100644
--- a/internal/controller/api_test.go
+++ b/internal/controller/api_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/stretchr/testify/require"
 
 	svctest "github.com/hashicorp/consul/agent/grpc-external/services/resource/testing"
@@ -266,3 +267,76 @@ func testContext(t *testing.T) context.Context {
 
 	return ctx
 }
+
+func resourceID(group string, version string, kind string, name string) *pbresource.ID {
+	return &pbresource.ID{
+		Type: &pbresource.Type{
+			Group:        group,
+			GroupVersion: version,
+			Kind:         kind,
+		},
+		Tenancy: &pbresource.Tenancy{
+			Partition: "default",
+			Namespace: "default",
+			PeerName:  "local",
+		},
+		Name: name,
+	}
+}
+
+func TestMapOwnerFiltered(t *testing.T) {
+	mapper := controller.MapOwnerFiltered(&pbresource.Type{
+		Group:        "foo",
+		GroupVersion: "v1",
+		Kind:         "bar",
+	})
+
+	type testCase struct {
+		owner   *pbresource.ID
+		matches bool
+	}
+
+	cases := map[string]testCase{
+		"nil-owner": {
+			owner:   nil,
+			matches: false,
+		},
+		"group-mismatch": {
+			owner:   resourceID("other", "v1", "bar", "irrelevant"),
+			matches: false,
+		},
+		"group-version-mismatch": {
+			owner:   resourceID("foo", "v2", "bar", "irrelevant"),
+			matches: false,
+		},
+		"kind-mismatch": {
+			owner:   resourceID("foo", "v1", "baz", "irrelevant"),
+			matches: false,
+		},
+		"match": {
+			owner:   resourceID("foo", "v1", "bar", "irrelevant"),
+			matches: true,
+		},
+	}
+
+	for name, tcase := range cases {
+		t.Run(name, func(t *testing.T) {
+			// the runtime is not used by the mapper so its fine to pass an empty struct
+			req, err := mapper(context.Background(), controller.Runtime{}, &pbresource.Resource{
+				Id:    resourceID("foo", "v1", "other", "x"),
+				Owner: tcase.owner,
+			})
+
+			// The mapper has no error paths at present
+			require.NoError(t, err)
+
+			if tcase.matches {
+				require.NotNil(t, req)
+				require.Len(t, req, 1)
+				prototest.AssertDeepEqual(t, req[0].ID, tcase.owner, cmpopts.EquateEmpty())
+			} else {
+				require.Nil(t, req)
+			}
+		})
+	}
+}
diff --git a/internal/resource/resourcetest/builder.go b/internal/resource/resourcetest/builder.go
new file mode 100644
index 000000000000..46039e209a70
--- /dev/null
+++ b/internal/resource/resourcetest/builder.go
@@ -0,0 +1,136 @@
+package resourcetest
+
+import (
+	"context"
+	"testing"
+
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/oklog/ulid/v2"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+type resourceBuilder struct {
+	resource    *pbresource.Resource
+	statuses    map[string]*pbresource.Status
+	dontCleanup bool
+}
+
+func Resource(rtype *pbresource.Type, name string) *resourceBuilder {
+	return &resourceBuilder{
+		resource: &pbresource.Resource{
+			Id: &pbresource.ID{
+				Type: &pbresource.Type{
+					Group:        rtype.Group,
+					GroupVersion: rtype.GroupVersion,
+					Kind:         rtype.Kind,
+				},
+				Tenancy: &pbresource.Tenancy{
+					Partition: "default",
+					Namespace: "default",
+					PeerName:  "local",
+				},
+				Name: name,
+			},
+		},
+	}
+}
+
+func (b *resourceBuilder) WithData(t *testing.T, data protoreflect.ProtoMessage) *resourceBuilder {
+	anyData, err := anypb.New(data)
+	require.NoError(t, err)
+	b.resource.Data = anyData
+	return b
+}
+
+func (b *resourceBuilder) WithOwner(id *pbresource.ID) *resourceBuilder {
+	b.resource.Owner = id
+	return b
+}
+
+func (b *resourceBuilder) WithStatus(key string, status *pbresource.Status) *resourceBuilder {
+	if b.statuses == nil {
+		b.statuses = make(map[string]*pbresource.Status)
+	}
+	b.statuses[key] = status
+	return b
+}
+
+func (b *resourceBuilder) WithoutCleanup() *resourceBuilder {
+	b.dontCleanup = true
+	return b
+}
+
+func (b *resourceBuilder) WithGeneration(gen string) *resourceBuilder {
+	b.resource.Generation = gen
+	return b
+}
+
+func (b *resourceBuilder) Build() *pbresource.Resource {
+	// clone the resource so we can add on status information
+	res := proto.Clone(b.resource).(*pbresource.Resource)
+
+	// fill in the generation if empty to make it look like
+	// a real managed resource
+	if res.Generation == "" {
+		res.Generation = ulid.Make().String()
+	}
+
+	// Now create the status map
+	res.Status = make(map[string]*pbresource.Status)
+	for key, original := range b.statuses {
+		status := &pbresource.Status{
+			ObservedGeneration: res.Generation,
+			Conditions:         original.Conditions,
+		}
+		res.Status[key] = status
+	}
+
+	return res
+}
+
+func (b *resourceBuilder) Write(t *testing.T, client pbresource.ResourceServiceClient) *pbresource.Resource {
+	res := b.resource
+
+	rsp, err := client.Write(context.Background(), &pbresource.WriteRequest{
+		Resource: res,
+	})
+
+	require.NoError(t, err)
+
+	if !b.dontCleanup {
+		t.Cleanup(func() {
+			_, err := client.Delete(context.Background(), &pbresource.DeleteRequest{
+				Id: rsp.Resource.Id,
+			})
+			require.NoError(t, err)
+		})
+	}
+
+	if len(b.statuses) == 0 {
+		return rsp.Resource
+	}
+
+	for key, original := range b.statuses {
+		status := &pbresource.Status{
+			ObservedGeneration: rsp.Resource.Generation,
+			Conditions:         original.Conditions,
+		}
+		_, err := client.WriteStatus(context.Background(), &pbresource.WriteStatusRequest{
+			Id:     rsp.Resource.Id,
+			Key:    key,
+			Status: status,
+		})
+		require.NoError(t, err)
+	}
+
+	readResp, err := client.Read(context.Background(), &pbresource.ReadRequest{
+		Id: rsp.Resource.Id,
+	})
+
+	require.NoError(t, err)
+
+	return readResp.Resource
+}

From abeccb4c760c40dff5f3b6584d1d7319288c61f6 Mon Sep 17 00:00:00 2001
From: Semir Patel <semir.patel@hashicorp.com>
Date: Mon, 15 May 2023 09:42:01 -0500
Subject: [PATCH 87/92] Support update resource with change in GroupVersion
 (#17330)

---
 .../grpc-external/services/resource/write.go  |  7 ++++-
 .../services/resource/write_test.go           | 31 +++++++++++++++++++
 2 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/agent/grpc-external/services/resource/write.go b/agent/grpc-external/services/resource/write.go
index d50ca1dd8bcd..3a365cee3713 100644
--- a/agent/grpc-external/services/resource/write.go
+++ b/agent/grpc-external/services/resource/write.go
@@ -107,6 +107,7 @@ func (s *Server) Write(ctx context.Context, req *pbresource.WriteRequest) (*pbre
 		//
 		//	- CAS failures will be retried by retryCAS anyway. So the read-modify-write
 		//	  cycle should eventually succeed.
+		var mismatchError storage.GroupVersionMismatchError
 		existing, err := s.Backend.Read(ctx, storage.EventualConsistency, input.Id)
 		switch {
 		// Create path.
@@ -146,7 +147,11 @@ func (s *Server) Write(ctx context.Context, req *pbresource.WriteRequest) (*pbre
 			// TODO(spatel): Revisit owner<->resource tenancy rules post-1.16
 
 		// Update path.
-		case err == nil:
+		case err == nil || errors.As(err, &mismatchError):
+			// Allow writes that update GroupVersion.
+			if mismatchError.Stored != nil {
+				existing = mismatchError.Stored
+			}
 			// Use the stored ID because it includes the Uid.
 			//
 			// Generally, users won't provide the Uid but controllers will, because
diff --git a/agent/grpc-external/services/resource/write_test.go b/agent/grpc-external/services/resource/write_test.go
index b2960a9243d7..9b94ecae8bb9 100644
--- a/agent/grpc-external/services/resource/write_test.go
+++ b/agent/grpc-external/services/resource/write_test.go
@@ -19,6 +19,7 @@ import (
 	"github.com/hashicorp/consul/internal/resource/demo"
 	"github.com/hashicorp/consul/internal/storage"
 	"github.com/hashicorp/consul/proto-public/pbresource"
+	pbdemov1 "github.com/hashicorp/consul/proto/private/pbdemo/v1"
 	pbdemov2 "github.com/hashicorp/consul/proto/private/pbdemo/v2"
 )
 
@@ -392,6 +393,36 @@ func TestWrite_Update_NoUid(t *testing.T) {
 	require.NoError(t, err)
 }
 
+func TestWrite_Update_GroupVersion(t *testing.T) {
+	server := testServer(t)
+	client := testClient(t, server)
+
+	demo.RegisterTypes(server.Registry)
+
+	res, err := demo.GenerateV2Artist()
+	require.NoError(t, err)
+
+	rsp1, err := client.Write(testContext(t), &pbresource.WriteRequest{Resource: res})
+	require.NoError(t, err)
+
+	res = rsp1.Resource
+	res.Id.Type = demo.TypeV1Artist
+
+	// translate artistV2 to artistV1
+	var artistV2 pbdemov2.Artist
+	require.NoError(t, res.Data.UnmarshalTo(&artistV2))
+	artistV1 := &pbdemov1.Artist{
+		Name:         artistV2.Name,
+		Description:  "some awesome band",
+		Genre:        pbdemov1.Genre_GENRE_JAZZ,
+		GroupMembers: int32(len(artistV2.GroupMembers)),
+	}
+	res.Data.MarshalFrom(artistV1)
+
+	_, err = client.Write(testContext(t), &pbresource.WriteRequest{Resource: res})
+	require.NoError(t, err)
+}
+
 func TestWrite_NonCASUpdate_Success(t *testing.T) {
 	server := testServer(t)
 	client := testClient(t, server)

From be7d2a4d842a8cbab7ce6161e88807a1f0a946b0 Mon Sep 17 00:00:00 2001
From: Dan Stough <dan.stough@hashicorp.com>
Date: Mon, 15 May 2023 10:45:16 -0400
Subject: [PATCH 88/92] =?UTF-8?q?fix(connect=20envoy):=20set=20initial=5Ff?=
 =?UTF-8?q?etch=5Ftimeout=20to=20wait=20for=20initial=20xDS=E2=80=A6=20(#1?=
 =?UTF-8?q?7317)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(connect envoy): set initial_fetch_timeout to wait for initial xDS indefinitely

---------

Co-authored-by: Kiril Angov <kiril.angov@gmail.com>
---
 .changelog/17317.txt                                           | 3 +++
 command/connect/envoy/bootstrap_tpl.go                         | 2 ++
 .../CONSUL_GRPC_ADDR-with-https-scheme-enables-tls.golden      | 2 ++
 ...HTTP_ADDR-with-https-scheme-does-not-affect-grpc-tls.golden | 2 ++
 command/connect/envoy/testdata/access-log-path.golden          | 2 ++
 .../connect/envoy/testdata/access-logs-enabled-custom.golden   | 2 ++
 command/connect/envoy/testdata/access-logs-enabled.golden      | 2 ++
 command/connect/envoy/testdata/acl-enabled-and-token.golden    | 2 ++
 command/connect/envoy/testdata/acl-enabled-but-no-token.golden | 2 ++
 ...NSUL_HTTP_ADDR-PLAIN-and-CONSUL_GRPC_ADDR-TLS-is-tls.golden | 2 ++
 ...UL_HTTP_ADDR-TLS-and-CONSUL_GRPC_ADDR-PLAIN-is-plain.golden | 2 ++
 command/connect/envoy/testdata/defaults-nodemeta.golden        | 2 ++
 command/connect/envoy/testdata/defaults.golden                 | 2 ++
 .../connect/envoy/testdata/deprecated-grpc-addr-config.golden  | 2 ++
 command/connect/envoy/testdata/envoy-readiness-probe.golden    | 2 ++
 command/connect/envoy/testdata/existing-ca-file.golden         | 2 ++
 command/connect/envoy/testdata/existing-ca-path.golden         | 2 ++
 command/connect/envoy/testdata/extra_-multiple.golden          | 2 ++
 command/connect/envoy/testdata/extra_-single.golden            | 2 ++
 command/connect/envoy/testdata/grpc-addr-env.golden            | 2 ++
 command/connect/envoy/testdata/grpc-addr-flag.golden           | 2 ++
 command/connect/envoy/testdata/grpc-addr-unix-with-tls.golden  | 2 ++
 command/connect/envoy/testdata/grpc-addr-unix.golden           | 2 ++
 command/connect/envoy/testdata/grpc-tls-addr-config.golden     | 2 ++
 command/connect/envoy/testdata/hcp-metrics.golden              | 2 ++
 .../envoy/testdata/ingress-gateway-address-specified.golden    | 2 ++
 .../envoy/testdata/ingress-gateway-no-auto-register.golden     | 2 ++
 command/connect/envoy/testdata/ingress-gateway-nodemeta.golden | 2 ++
 .../ingress-gateway-register-with-service-and-proxy-id.golden  | 2 ++
 ...gress-gateway-register-with-service-without-proxy-id.golden | 2 ++
 command/connect/envoy/testdata/ingress-gateway.golden          | 2 ++
 .../envoy/testdata/prometheus-metrics-tls-ca-file.golden       | 2 ++
 .../envoy/testdata/prometheus-metrics-tls-ca-path.golden       | 2 ++
 command/connect/envoy/testdata/prometheus-metrics.golden       | 2 ++
 command/connect/envoy/testdata/stats-config-override.golden    | 2 ++
 command/connect/envoy/testdata/token-arg.golden                | 2 ++
 command/connect/envoy/testdata/token-env.golden                | 2 ++
 command/connect/envoy/testdata/token-file-arg.golden           | 2 ++
 command/connect/envoy/testdata/token-file-env.golden           | 2 ++
 command/connect/envoy/testdata/xds-addr-config.golden          | 2 ++
 command/connect/envoy/testdata/zipkin-tracing-config.golden    | 2 ++
 41 files changed, 83 insertions(+)
 create mode 100644 .changelog/17317.txt

diff --git a/.changelog/17317.txt b/.changelog/17317.txt
new file mode 100644
index 000000000000..76c86a0a28eb
--- /dev/null
+++ b/.changelog/17317.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+connect: fix a bug with Envoy potentially starting with incomplete configuration by not waiting enough for initial xDS configuration.
+```
diff --git a/command/connect/envoy/bootstrap_tpl.go b/command/connect/envoy/bootstrap_tpl.go
index 78d88f9b1d11..26b8e2118b1e 100644
--- a/command/connect/envoy/bootstrap_tpl.go
+++ b/command/connect/envoy/bootstrap_tpl.go
@@ -281,10 +281,12 @@ const bootstrapTemplate = `{
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/CONSUL_GRPC_ADDR-with-https-scheme-enables-tls.golden b/command/connect/envoy/testdata/CONSUL_GRPC_ADDR-with-https-scheme-enables-tls.golden
index a8ba4704f5e3..c8144ac72fa2 100644
--- a/command/connect/envoy/testdata/CONSUL_GRPC_ADDR-with-https-scheme-enables-tls.golden
+++ b/command/connect/envoy/testdata/CONSUL_GRPC_ADDR-with-https-scheme-enables-tls.golden
@@ -197,10 +197,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/CONSUL_HTTP_ADDR-with-https-scheme-does-not-affect-grpc-tls.golden b/command/connect/envoy/testdata/CONSUL_HTTP_ADDR-with-https-scheme-does-not-affect-grpc-tls.golden
index 5485256b4f99..a89575d2c167 100644
--- a/command/connect/envoy/testdata/CONSUL_HTTP_ADDR-with-https-scheme-does-not-affect-grpc-tls.golden
+++ b/command/connect/envoy/testdata/CONSUL_HTTP_ADDR-with-https-scheme-does-not-affect-grpc-tls.golden
@@ -184,10 +184,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/access-log-path.golden b/command/connect/envoy/testdata/access-log-path.golden
index 18a28a491e86..184a290b245f 100644
--- a/command/connect/envoy/testdata/access-log-path.golden
+++ b/command/connect/envoy/testdata/access-log-path.golden
@@ -184,10 +184,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/access-logs-enabled-custom.golden b/command/connect/envoy/testdata/access-logs-enabled-custom.golden
index 6af720bdaccb..50531f89c257 100644
--- a/command/connect/envoy/testdata/access-logs-enabled-custom.golden
+++ b/command/connect/envoy/testdata/access-logs-enabled-custom.golden
@@ -197,10 +197,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/access-logs-enabled.golden b/command/connect/envoy/testdata/access-logs-enabled.golden
index 892cf46324b4..ea2e15060718 100644
--- a/command/connect/envoy/testdata/access-logs-enabled.golden
+++ b/command/connect/envoy/testdata/access-logs-enabled.golden
@@ -219,10 +219,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/acl-enabled-and-token.golden b/command/connect/envoy/testdata/acl-enabled-and-token.golden
index 3342f0390471..a5427c7f2454 100644
--- a/command/connect/envoy/testdata/acl-enabled-and-token.golden
+++ b/command/connect/envoy/testdata/acl-enabled-and-token.golden
@@ -184,10 +184,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/acl-enabled-but-no-token.golden b/command/connect/envoy/testdata/acl-enabled-but-no-token.golden
index 5485256b4f99..a89575d2c167 100644
--- a/command/connect/envoy/testdata/acl-enabled-but-no-token.golden
+++ b/command/connect/envoy/testdata/acl-enabled-but-no-token.golden
@@ -184,10 +184,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-PLAIN-and-CONSUL_GRPC_ADDR-TLS-is-tls.golden b/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-PLAIN-and-CONSUL_GRPC_ADDR-TLS-is-tls.golden
index a8ba4704f5e3..c8144ac72fa2 100644
--- a/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-PLAIN-and-CONSUL_GRPC_ADDR-TLS-is-tls.golden
+++ b/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-PLAIN-and-CONSUL_GRPC_ADDR-TLS-is-tls.golden
@@ -197,10 +197,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-TLS-and-CONSUL_GRPC_ADDR-PLAIN-is-plain.golden b/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-TLS-and-CONSUL_GRPC_ADDR-PLAIN-is-plain.golden
index 5485256b4f99..a89575d2c167 100644
--- a/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-TLS-and-CONSUL_GRPC_ADDR-PLAIN-is-plain.golden
+++ b/command/connect/envoy/testdata/both-CONSUL_HTTP_ADDR-TLS-and-CONSUL_GRPC_ADDR-PLAIN-is-plain.golden
@@ -184,10 +184,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/defaults-nodemeta.golden b/command/connect/envoy/testdata/defaults-nodemeta.golden
index 41788c3c42e4..ea65421109f3 100644
--- a/command/connect/envoy/testdata/defaults-nodemeta.golden
+++ b/command/connect/envoy/testdata/defaults-nodemeta.golden
@@ -185,10 +185,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/defaults.golden b/command/connect/envoy/testdata/defaults.golden
index 5485256b4f99..a89575d2c167 100644
--- a/command/connect/envoy/testdata/defaults.golden
+++ b/command/connect/envoy/testdata/defaults.golden
@@ -184,10 +184,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/deprecated-grpc-addr-config.golden b/command/connect/envoy/testdata/deprecated-grpc-addr-config.golden
index ab87aa9b438f..e604c61d5063 100644
--- a/command/connect/envoy/testdata/deprecated-grpc-addr-config.golden
+++ b/command/connect/envoy/testdata/deprecated-grpc-addr-config.golden
@@ -184,10 +184,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/envoy-readiness-probe.golden b/command/connect/envoy/testdata/envoy-readiness-probe.golden
index 444528e8808e..18680a3206b3 100644
--- a/command/connect/envoy/testdata/envoy-readiness-probe.golden
+++ b/command/connect/envoy/testdata/envoy-readiness-probe.golden
@@ -273,10 +273,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/existing-ca-file.golden b/command/connect/envoy/testdata/existing-ca-file.golden
index a8ba4704f5e3..c8144ac72fa2 100644
--- a/command/connect/envoy/testdata/existing-ca-file.golden
+++ b/command/connect/envoy/testdata/existing-ca-file.golden
@@ -197,10 +197,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/existing-ca-path.golden b/command/connect/envoy/testdata/existing-ca-path.golden
index e246dbb324eb..c0566ab351d7 100644
--- a/command/connect/envoy/testdata/existing-ca-path.golden
+++ b/command/connect/envoy/testdata/existing-ca-path.golden
@@ -197,10 +197,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/extra_-multiple.golden b/command/connect/envoy/testdata/extra_-multiple.golden
index 038e65d8d9fb..819994f0c0ff 100644
--- a/command/connect/envoy/testdata/extra_-multiple.golden
+++ b/command/connect/envoy/testdata/extra_-multiple.golden
@@ -206,10 +206,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/extra_-single.golden b/command/connect/envoy/testdata/extra_-single.golden
index 14b8f0820500..b1fb71997b3f 100644
--- a/command/connect/envoy/testdata/extra_-single.golden
+++ b/command/connect/envoy/testdata/extra_-single.golden
@@ -197,10 +197,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/grpc-addr-env.golden b/command/connect/envoy/testdata/grpc-addr-env.golden
index ab87aa9b438f..e604c61d5063 100644
--- a/command/connect/envoy/testdata/grpc-addr-env.golden
+++ b/command/connect/envoy/testdata/grpc-addr-env.golden
@@ -184,10 +184,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/grpc-addr-flag.golden b/command/connect/envoy/testdata/grpc-addr-flag.golden
index ab87aa9b438f..e604c61d5063 100644
--- a/command/connect/envoy/testdata/grpc-addr-flag.golden
+++ b/command/connect/envoy/testdata/grpc-addr-flag.golden
@@ -184,10 +184,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/grpc-addr-unix-with-tls.golden b/command/connect/envoy/testdata/grpc-addr-unix-with-tls.golden
index 89764c310a47..2b902d48d476 100644
--- a/command/connect/envoy/testdata/grpc-addr-unix-with-tls.golden
+++ b/command/connect/envoy/testdata/grpc-addr-unix-with-tls.golden
@@ -196,10 +196,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/grpc-addr-unix.golden b/command/connect/envoy/testdata/grpc-addr-unix.golden
index eb8841ae993f..88e6e46bfb95 100644
--- a/command/connect/envoy/testdata/grpc-addr-unix.golden
+++ b/command/connect/envoy/testdata/grpc-addr-unix.golden
@@ -183,10 +183,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/grpc-tls-addr-config.golden b/command/connect/envoy/testdata/grpc-tls-addr-config.golden
index e79cf0455d2b..e65fc5f09cd6 100644
--- a/command/connect/envoy/testdata/grpc-tls-addr-config.golden
+++ b/command/connect/envoy/testdata/grpc-tls-addr-config.golden
@@ -197,10 +197,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/hcp-metrics.golden b/command/connect/envoy/testdata/hcp-metrics.golden
index 0739ab531dac..4871c1cb6a2f 100644
--- a/command/connect/envoy/testdata/hcp-metrics.golden
+++ b/command/connect/envoy/testdata/hcp-metrics.golden
@@ -221,10 +221,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/ingress-gateway-address-specified.golden b/command/connect/envoy/testdata/ingress-gateway-address-specified.golden
index cc2e504eaf95..038c8fcc5dd2 100644
--- a/command/connect/envoy/testdata/ingress-gateway-address-specified.golden
+++ b/command/connect/envoy/testdata/ingress-gateway-address-specified.golden
@@ -273,10 +273,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/ingress-gateway-no-auto-register.golden b/command/connect/envoy/testdata/ingress-gateway-no-auto-register.golden
index cddaa490dd2c..80f1f9a8b7c6 100644
--- a/command/connect/envoy/testdata/ingress-gateway-no-auto-register.golden
+++ b/command/connect/envoy/testdata/ingress-gateway-no-auto-register.golden
@@ -273,10 +273,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/ingress-gateway-nodemeta.golden b/command/connect/envoy/testdata/ingress-gateway-nodemeta.golden
index d79739ed7280..8a2d5f62768e 100644
--- a/command/connect/envoy/testdata/ingress-gateway-nodemeta.golden
+++ b/command/connect/envoy/testdata/ingress-gateway-nodemeta.golden
@@ -274,10 +274,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/ingress-gateway-register-with-service-and-proxy-id.golden b/command/connect/envoy/testdata/ingress-gateway-register-with-service-and-proxy-id.golden
index 3149fc4b33a5..6192f674ac17 100644
--- a/command/connect/envoy/testdata/ingress-gateway-register-with-service-and-proxy-id.golden
+++ b/command/connect/envoy/testdata/ingress-gateway-register-with-service-and-proxy-id.golden
@@ -273,10 +273,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/ingress-gateway-register-with-service-without-proxy-id.golden b/command/connect/envoy/testdata/ingress-gateway-register-with-service-without-proxy-id.golden
index f8eb44754117..92d80e033e9b 100644
--- a/command/connect/envoy/testdata/ingress-gateway-register-with-service-without-proxy-id.golden
+++ b/command/connect/envoy/testdata/ingress-gateway-register-with-service-without-proxy-id.golden
@@ -273,10 +273,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/ingress-gateway.golden b/command/connect/envoy/testdata/ingress-gateway.golden
index c4fba520ed99..40a5c74d1bc2 100644
--- a/command/connect/envoy/testdata/ingress-gateway.golden
+++ b/command/connect/envoy/testdata/ingress-gateway.golden
@@ -273,10 +273,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/prometheus-metrics-tls-ca-file.golden b/command/connect/envoy/testdata/prometheus-metrics-tls-ca-file.golden
index 71b82250e30d..c93286e64e81 100644
--- a/command/connect/envoy/testdata/prometheus-metrics-tls-ca-file.golden
+++ b/command/connect/envoy/testdata/prometheus-metrics-tls-ca-file.golden
@@ -310,10 +310,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/prometheus-metrics-tls-ca-path.golden b/command/connect/envoy/testdata/prometheus-metrics-tls-ca-path.golden
index 07e56ae878a7..272175f70733 100644
--- a/command/connect/envoy/testdata/prometheus-metrics-tls-ca-path.golden
+++ b/command/connect/envoy/testdata/prometheus-metrics-tls-ca-path.golden
@@ -310,10 +310,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/prometheus-metrics.golden b/command/connect/envoy/testdata/prometheus-metrics.golden
index 5adc8a9485ee..5806dd671f76 100644
--- a/command/connect/envoy/testdata/prometheus-metrics.golden
+++ b/command/connect/envoy/testdata/prometheus-metrics.golden
@@ -273,10 +273,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/stats-config-override.golden b/command/connect/envoy/testdata/stats-config-override.golden
index d2a2371f20ea..dd4ff53dd194 100644
--- a/command/connect/envoy/testdata/stats-config-override.golden
+++ b/command/connect/envoy/testdata/stats-config-override.golden
@@ -62,10 +62,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/token-arg.golden b/command/connect/envoy/testdata/token-arg.golden
index ac057e9a60b1..816bf7487572 100644
--- a/command/connect/envoy/testdata/token-arg.golden
+++ b/command/connect/envoy/testdata/token-arg.golden
@@ -184,10 +184,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/token-env.golden b/command/connect/envoy/testdata/token-env.golden
index ac057e9a60b1..816bf7487572 100644
--- a/command/connect/envoy/testdata/token-env.golden
+++ b/command/connect/envoy/testdata/token-env.golden
@@ -184,10 +184,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/token-file-arg.golden b/command/connect/envoy/testdata/token-file-arg.golden
index ac057e9a60b1..816bf7487572 100644
--- a/command/connect/envoy/testdata/token-file-arg.golden
+++ b/command/connect/envoy/testdata/token-file-arg.golden
@@ -184,10 +184,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/token-file-env.golden b/command/connect/envoy/testdata/token-file-env.golden
index ac057e9a60b1..816bf7487572 100644
--- a/command/connect/envoy/testdata/token-file-env.golden
+++ b/command/connect/envoy/testdata/token-file-env.golden
@@ -184,10 +184,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/xds-addr-config.golden b/command/connect/envoy/testdata/xds-addr-config.golden
index ab87aa9b438f..e604c61d5063 100644
--- a/command/connect/envoy/testdata/xds-addr-config.golden
+++ b/command/connect/envoy/testdata/xds-addr-config.golden
@@ -184,10 +184,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {
diff --git a/command/connect/envoy/testdata/zipkin-tracing-config.golden b/command/connect/envoy/testdata/zipkin-tracing-config.golden
index fd52f5ae3f57..dc4779a7753d 100644
--- a/command/connect/envoy/testdata/zipkin-tracing-config.golden
+++ b/command/connect/envoy/testdata/zipkin-tracing-config.golden
@@ -217,10 +217,12 @@
   "dynamic_resources": {
     "lds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "cds_config": {
       "ads": {},
+      "initial_fetch_timeout": "0s",
       "resource_api_version": "V3"
     },
     "ads_config": {

From 70ed184c2b618463cb9a2ac9e1dd37c65deabed8 Mon Sep 17 00:00:00 2001
From: wangxinyi7 <121973291+wangxinyi7@users.noreply.github.com>
Date: Mon, 15 May 2023 10:49:43 -0700
Subject: [PATCH 89/92] counterpart of the ent in oss (#17367)

---
 agent/consul/rate/handler.go      | 110 ++++++++++++++++++------------
 agent/consul/rate/handler_oss.go  |  11 ++-
 agent/consul/rate/handler_test.go |  48 +++----------
 3 files changed, 85 insertions(+), 84 deletions(-)

diff --git a/agent/consul/rate/handler.go b/agent/consul/rate/handler.go
index 12ed974c6a87..a67a104cc46f 100644
--- a/agent/consul/rate/handler.go
+++ b/agent/consul/rate/handler.go
@@ -215,6 +215,7 @@ func NewHandlerWithLimiter(
 		logger:    logger,
 	}
 	h.globalCfg.Store(&cfg)
+	h.ipCfg.Store(&IPLimitConfig{})
 
 	return h
 }
@@ -248,45 +249,39 @@ func (h *Handler) Allow(op Operation) error {
 		return nil
 	}
 
-	for _, l := range h.limits(op) {
-		if l.mode == ModeDisabled {
-			continue
-		}
-
-		if h.limiter.Allow(l.ent) {
-			continue
-		}
-
-		// TODO(NET-1382): is this the correct log-level?
-
-		enforced := l.mode == ModeEnforcing
-		h.logger.Debug("RPC exceeded allowed rate limit",
-			"rpc", op.Name,
-			"source_addr", op.SourceAddr,
-			"limit_type", l.desc,
-			"limit_enforced", enforced,
-		)
-
-		metrics.IncrCounterWithLabels([]string{"rpc", "rate_limit", "exceeded"}, 1, []metrics.Label{
-			{
-				Name:  "limit_type",
-				Value: l.desc,
-			},
-			{
-				Name:  "op",
-				Value: op.Name,
-			},
-			{
-				Name:  "mode",
-				Value: l.mode.String(),
-			},
-		})
-
-		if enforced {
-			if h.leaderStatusProvider.IsLeader() && op.Type == OperationTypeWrite {
-				return ErrRetryLater
+	allow, throttledLimits := h.allowAllLimits(h.limits(op))
+
+	if !allow {
+		for _, l := range throttledLimits {
+			enforced := l.mode == ModeEnforcing
+			h.logger.Debug("RPC exceeded allowed rate limit",
+				"rpc", op.Name,
+				"source_addr", op.SourceAddr,
+				"limit_type", l.desc,
+				"limit_enforced", enforced,
+			)
+
+			metrics.IncrCounterWithLabels([]string{"rpc", "rate_limit", "exceeded"}, 1, []metrics.Label{
+				{
+					Name:  "limit_type",
+					Value: l.desc,
+				},
+				{
+					Name:  "op",
+					Value: op.Name,
+				},
+				{
+					Name:  "mode",
+					Value: l.mode.String(),
+				},
+			})
+
+			if enforced {
+				if h.leaderStatusProvider.IsLeader() && op.Type == OperationTypeWrite {
+					return ErrRetryLater
+				}
+				return ErrRetryElsewhere
 			}
-			return ErrRetryElsewhere
 		}
 	}
 	return nil
@@ -320,6 +315,23 @@ type limit struct {
 	desc string
 }
 
+func (h *Handler) allowAllLimits(limits []limit) (bool, []limit) {
+	allow := true
+	throttledLimits := make([]limit, 0)
+
+	for _, l := range limits {
+		if l.mode == ModeDisabled {
+			continue
+		}
+
+		if !h.limiter.Allow(l.ent) {
+			throttledLimits = append(throttledLimits, l)
+			allow = false
+		}
+	}
+	return allow, throttledLimits
+}
+
 // limits returns the limits to check for the given operation (e.g. global +
 // ip-based + tenant-based).
 func (h *Handler) limits(op Operation) []limit {
@@ -329,6 +341,14 @@ func (h *Handler) limits(op Operation) []limit {
 		limits = append(limits, *global)
 	}
 
+	if ipGlobal := h.ipGlobalLimit(op); ipGlobal != nil {
+		limits = append(limits, *ipGlobal)
+	}
+
+	if ipCategory := h.ipCategoryLimit(op); ipCategory != nil {
+		limits = append(limits, *ipCategory)
+	}
+
 	return limits
 }
 
@@ -354,23 +374,23 @@ func (h *Handler) globalLimit(op Operation) *limit {
 
 var (
 	// globalWrite identifies the global rate limit applied to write operations.
-	globalWrite = globalLimit("global.write")
+	globalWrite = limitedEntity("global.write")
 
 	// globalRead identifies the global rate limit applied to read operations.
-	globalRead = globalLimit("global.read")
+	globalRead = limitedEntity("global.read")
 
 	// globalIPRead identifies the global rate limit applied to read operations.
-	globalIPRead = globalLimit("global.ip.read")
+	globalIPRead = limitedEntity("global.ip.read")
 
 	// globalIPWrite identifies the global rate limit applied to read operations.
-	globalIPWrite = globalLimit("global.ip.write")
+	globalIPWrite = limitedEntity("global.ip.write")
 )
 
-// globalLimit represents a limit that applies to all writes or reads.
-type globalLimit []byte
+// limitedEntity convert the string type to Multilimiter.LimitedEntity
+type limitedEntity []byte
 
 // Key satisfies the multilimiter.LimitedEntity interface.
-func (prefix globalLimit) Key() multilimiter.KeyType {
+func (prefix limitedEntity) Key() multilimiter.KeyType {
 	return multilimiter.Key(prefix, nil)
 }
 
diff --git a/agent/consul/rate/handler_oss.go b/agent/consul/rate/handler_oss.go
index 1316ae6cc96c..fc33a69487f8 100644
--- a/agent/consul/rate/handler_oss.go
+++ b/agent/consul/rate/handler_oss.go
@@ -6,9 +6,16 @@
 
 package rate
 
-type IPLimitConfig struct {
-}
+type IPLimitConfig struct{}
 
 func (h *Handler) UpdateIPConfig(cfg IPLimitConfig) {
 	// noop
 }
+
+func (h *Handler) ipGlobalLimit(op Operation) *limit {
+	return nil
+}
+
+func (h *Handler) ipCategoryLimit(op Operation) *limit {
+	return nil
+}
diff --git a/agent/consul/rate/handler_test.go b/agent/consul/rate/handler_test.go
index 8f1b465f473f..0311cb60089d 100644
--- a/agent/consul/rate/handler_test.go
+++ b/agent/consul/rate/handler_test.go
@@ -5,20 +5,18 @@ package rate
 
 import (
 	"bytes"
-	"context"
+	"github.com/hashicorp/consul/agent/metrics"
+	"github.com/stretchr/testify/require"
 	"net"
 	"net/netip"
 	"testing"
 
 	"golang.org/x/time/rate"
 
-	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
-
 	"github.com/hashicorp/go-hclog"
+	"github.com/stretchr/testify/mock"
 
 	"github.com/hashicorp/consul/agent/consul/multilimiter"
-	"github.com/hashicorp/consul/agent/metrics"
 )
 
 //
@@ -226,10 +224,10 @@ func TestHandler(t *testing.T) {
 	for desc, tc := range testCases {
 		t.Run(desc, func(t *testing.T) {
 			sink := metrics.TestSetupMetrics(t, "")
-			limiter := newMockLimiter(t)
+			limiter := multilimiter.NewMockRateLimiter(t)
 			limiter.On("UpdateConfig", mock.Anything, mock.Anything).Return()
 			for _, c := range tc.checks {
-				limiter.On("Allow", c.limit).Return(c.allow)
+				limiter.On("Allow", mock.Anything).Return(c.allow)
 			}
 
 			leaderStatusProvider := NewMockLeaderStatusProvider(t)
@@ -376,7 +374,7 @@ func TestAllow(t *testing.T) {
 	type testCase struct {
 		description        string
 		cfg                *HandlerConfig
-		expectedAllowCalls int
+		expectedAllowCalls bool
 	}
 	testCases := []testCase{
 		{
@@ -390,7 +388,7 @@ func TestAllow(t *testing.T) {
 					},
 				},
 			},
-			expectedAllowCalls: 0,
+			expectedAllowCalls: false,
 		},
 		{
 			description: "RateLimiter gets called when mode is permissive.",
@@ -403,7 +401,7 @@ func TestAllow(t *testing.T) {
 					},
 				},
 			},
-			expectedAllowCalls: 1,
+			expectedAllowCalls: true,
 		},
 		{
 			description: "RateLimiter gets called when mode is enforcing.",
@@ -416,14 +414,14 @@ func TestAllow(t *testing.T) {
 					},
 				},
 			},
-			expectedAllowCalls: 1,
+			expectedAllowCalls: true,
 		},
 	}
 
 	for _, tc := range testCases {
 		t.Run(tc.description, func(t *testing.T) {
 			mockRateLimiter := multilimiter.NewMockRateLimiter(t)
-			if tc.expectedAllowCalls > 0 {
+			if tc.expectedAllowCalls {
 				mockRateLimiter.On("Allow", mock.Anything).Return(func(entity multilimiter.LimitedEntity) bool { return true })
 			}
 			mockRateLimiter.On("UpdateConfig", mock.Anything, mock.Anything).Return()
@@ -435,31 +433,7 @@ func TestAllow(t *testing.T) {
 			addr := net.TCPAddrFromAddrPort(netip.MustParseAddrPort("127.0.0.1:1234"))
 			mockRateLimiter.Calls = nil
 			handler.Allow(Operation{Name: "test", SourceAddr: addr})
-			mockRateLimiter.AssertNumberOfCalls(t, "Allow", tc.expectedAllowCalls)
+			mockRateLimiter.AssertExpectations(t)
 		})
 	}
 }
-
-var _ multilimiter.RateLimiter = (*mockLimiter)(nil)
-
-func newMockLimiter(t *testing.T) *mockLimiter {
-	l := &mockLimiter{}
-	l.Mock.Test(t)
-
-	t.Cleanup(func() { l.AssertExpectations(t) })
-
-	return l
-}
-
-type mockLimiter struct {
-	mock.Mock
-}
-
-func (m *mockLimiter) Allow(v multilimiter.LimitedEntity) bool { return m.Called(v).Bool(0) }
-func (m *mockLimiter) Run(ctx context.Context)                 { m.Called(ctx) }
-func (m *mockLimiter) UpdateConfig(cfg multilimiter.LimiterConfig, prefix []byte) {
-	m.Called(cfg, prefix)
-}
-func (m *mockLimiter) DeleteConfig(prefix []byte) {
-	m.Called(prefix)
-}

From 59db5e1a2abcf34fc22709288012525e70a0212f Mon Sep 17 00:00:00 2001
From: cskh <hui.kang@hashicorp.com>
Date: Mon, 15 May 2023 14:53:07 -0400
Subject: [PATCH 90/92] integ-test CI: retry if fail to install packages
 (#17359)

---
 .github/workflows/test-integrations.yml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/.github/workflows/test-integrations.yml b/.github/workflows/test-integrations.yml
index e75e9df2a4ea..e1d86f031fde 100644
--- a/.github/workflows/test-integrations.yml
+++ b/.github/workflows/test-integrations.yml
@@ -409,6 +409,11 @@ jobs:
       - name: Build consul:local image
         run: docker build -t ${{ env.CONSUL_LATEST_IMAGE_NAME }}:local -f ./build-support/docker/Consul-Dev.dockerfile .
       - name: Build consul-envoy:target-version image
+        id: buildConsulEnvoyImage
+        continue-on-error: true
+        run: docker build -t consul-envoy:target-version --build-arg CONSUL_IMAGE=${{ env.CONSUL_LATEST_IMAGE_NAME }}:local --build-arg ENVOY_VERSION=${{ env.ENVOY_VERSION }} -f ./test/integration/consul-container/assets/Dockerfile-consul-envoy ./test/integration/consul-container/assets
+      - name: Retry Build consul-envoy:target-version image
+        if: steps.buildConsulEnvoyImage.outcome == 'failure'
         run: docker build -t consul-envoy:target-version --build-arg CONSUL_IMAGE=${{ env.CONSUL_LATEST_IMAGE_NAME }}:local --build-arg ENVOY_VERSION=${{ env.ENVOY_VERSION }} -f ./test/integration/consul-container/assets/Dockerfile-consul-envoy ./test/integration/consul-container/assets
       - name: Configure GH workaround for ipv6 loopback
         if: ${{ !endsWith(github.repository, '-enterprise') }}
@@ -545,8 +550,18 @@ jobs:
       - name: Build consul:local image
         run: docker build -t ${{ env.CONSUL_LATEST_IMAGE_NAME }}:local -f ./build-support/docker/Consul-Dev.dockerfile .
       - name: Build consul-envoy:latest-version image
+        id: buildConsulEnvoyLatestImage
+        continue-on-error: true
+        run: docker build -t consul-envoy:latest-version --build-arg CONSUL_IMAGE=docker.mirror.hashicorp.services/${{ env.CONSUL_LATEST_IMAGE_NAME }}:${{ env.CONSUL_LATEST_VERSION }} --build-arg ENVOY_VERSION=${{ env.ENVOY_VERSION }} -f ./test/integration/consul-container/assets/Dockerfile-consul-envoy ./test/integration/consul-container/assets
+      - name: Retry Build consul-envoy:latest-version image
+        if: steps.buildConsulEnvoyLatestImage.outcome == 'failure'
         run: docker build -t consul-envoy:latest-version --build-arg CONSUL_IMAGE=docker.mirror.hashicorp.services/${{ env.CONSUL_LATEST_IMAGE_NAME }}:${{ env.CONSUL_LATEST_VERSION }} --build-arg ENVOY_VERSION=${{ env.ENVOY_VERSION }} -f ./test/integration/consul-container/assets/Dockerfile-consul-envoy ./test/integration/consul-container/assets
       - name: Build consul-envoy:target-version image
+        id: buildConsulEnvoyTargetImage
+        continue-on-error: true
+        run: docker build -t consul-envoy:target-version --build-arg CONSUL_IMAGE=${{ env.CONSUL_LATEST_IMAGE_NAME }}:local --build-arg ENVOY_VERSION=${{ env.ENVOY_VERSION }} -f ./test/integration/consul-container/assets/Dockerfile-consul-envoy ./test/integration/consul-container/assets
+      - name: Retry Build consul-envoy:target-version image
+        if: steps.buildConsulEnvoyTargetImage.outcome == 'failure'
         run: docker build -t consul-envoy:target-version --build-arg CONSUL_IMAGE=${{ env.CONSUL_LATEST_IMAGE_NAME }}:local --build-arg ENVOY_VERSION=${{ env.ENVOY_VERSION }} -f ./test/integration/consul-container/assets/Dockerfile-consul-envoy ./test/integration/consul-container/assets
       - name: Build sds image
         run: docker build -t consul-sds-server ./test/integration/connect/envoy/test-sds-server/

From 8dee3534927eb50572b003e6335f65e063b36701 Mon Sep 17 00:00:00 2001
From: Dan Bond <danbond@protonmail.com>
Date: Tue, 16 May 2023 02:50:27 -0700
Subject: [PATCH 91/92] agent: don't write server metadata in dev mode (#17383)

Signed-off-by: Dan Bond <danbond@protonmail.com>
---
 agent/agent.go | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/agent/agent.go b/agent/agent.go
index 73906f853fcc..acb0ccd94e01 100644
--- a/agent/agent.go
+++ b/agent/agent.go
@@ -636,8 +636,10 @@ func (a *Agent) Start(ctx context.Context) error {
 			return err
 		}
 
-		// periodically write server metadata to disk.
-		go a.persistServerMetadata()
+		// Periodically write server metadata to disk.
+		if !consulCfg.DevMode {
+			go a.persistServerMetadata()
+		}
 
 		incomingRPCLimiter := consul.ConfiguredIncomingRPCLimiter(
 			&lib.StopChannelContext{StopCh: a.shutdownCh},

From 06481bf03a6520b5c4bc269ac938c606a05ec03a Mon Sep 17 00:00:00 2001
From: "R.B. Boyer" <4903+rboyer@users.noreply.github.com>
Date: Tue, 16 May 2023 11:49:27 -0500
Subject: [PATCH 92/92] test: fix oss/ent drift in gateway container tests
 (#17365)

---
 .../test/gateways/gateway_endpoint_test.go    | 20 +++----
 .../test/gateways/http_route_test.go          | 55 +++++--------------
 .../test/gateways/namespace_oss.go            | 11 ----
 .../test/gateways/tenancy_oss.go              | 14 +++++
 4 files changed, 36 insertions(+), 64 deletions(-)
 delete mode 100644 test/integration/consul-container/test/gateways/namespace_oss.go
 create mode 100644 test/integration/consul-container/test/gateways/tenancy_oss.go

diff --git a/test/integration/consul-container/test/gateways/gateway_endpoint_test.go b/test/integration/consul-container/test/gateways/gateway_endpoint_test.go
index 309538e89ce6..1f7a00e6830e 100644
--- a/test/integration/consul-container/test/gateways/gateway_endpoint_test.go
+++ b/test/integration/consul-container/test/gateways/gateway_endpoint_test.go
@@ -15,11 +15,12 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/hashicorp/consul/api"
+	"github.com/hashicorp/go-cleanhttp"
+
 	libassert "github.com/hashicorp/consul/test/integration/consul-container/libs/assert"
 	libcluster "github.com/hashicorp/consul/test/integration/consul-container/libs/cluster"
 	libservice "github.com/hashicorp/consul/test/integration/consul-container/libs/service"
 	libtopology "github.com/hashicorp/consul/test/integration/consul-container/libs/topology"
-	"github.com/hashicorp/go-cleanhttp"
 )
 
 // Creates a gateway service and tests to see if it is routable
@@ -56,12 +57,7 @@ func TestAPIGatewayCreate(t *testing.T) {
 	cluster, _, _ := libtopology.NewCluster(t, clusterConfig)
 	client := cluster.APIClient(0)
 
-	namespace := getNamespace()
-	if namespace != "" {
-		ns := &api.Namespace{Name: namespace}
-		_, _, err := client.Namespaces().Create(ns, nil)
-		require.NoError(t, err)
-	}
+	namespace := getOrCreateNamespace(t, client)
 
 	// add api gateway config
 	apiGateway := &api.APIGatewayConfigEntry{
@@ -119,7 +115,7 @@ func TestAPIGatewayCreate(t *testing.T) {
 
 	// make sure the gateway/route come online
 	// make sure config entries have been properly created
-	checkGatewayConfigEntry(t, client, gatewayName, namespace)
+	checkGatewayConfigEntry(t, client, gatewayName, &api.QueryOptions{Namespace: namespace})
 	checkTCPRouteConfigEntry(t, client, routeName, namespace)
 
 	port, err := gatewayService.GetPort(listenerPortOne)
@@ -144,11 +140,11 @@ func conditionStatusIsValue(typeName string, statusValue string, conditions []ap
 	return false
 }
 
-func checkGatewayConfigEntry(t *testing.T, client *api.Client, gatewayName string, namespace string) {
+func checkGatewayConfigEntry(t *testing.T, client *api.Client, gatewayName string, opts *api.QueryOptions) {
 	t.Helper()
 
 	require.Eventually(t, func() bool {
-		entry, _, err := client.ConfigEntries().Get(api.APIGateway, gatewayName, &api.QueryOptions{Namespace: namespace})
+		entry, _, err := client.ConfigEntries().Get(api.APIGateway, gatewayName, opts)
 		if err != nil {
 			t.Log("error constructing request", err)
 			return false
@@ -163,11 +159,11 @@ func checkGatewayConfigEntry(t *testing.T, client *api.Client, gatewayName strin
 	}, time.Second*10, time.Second*1)
 }
 
-func checkHTTPRouteConfigEntry(t *testing.T, client *api.Client, routeName string, namespace string) {
+func checkHTTPRouteConfigEntry(t *testing.T, client *api.Client, routeName string, opts *api.QueryOptions) {
 	t.Helper()
 
 	require.Eventually(t, func() bool {
-		entry, _, err := client.ConfigEntries().Get(api.HTTPRoute, routeName, &api.QueryOptions{Namespace: namespace})
+		entry, _, err := client.ConfigEntries().Get(api.HTTPRoute, routeName, opts)
 		if err != nil {
 			t.Log("error constructing request", err)
 			return false
diff --git a/test/integration/consul-container/test/gateways/http_route_test.go b/test/integration/consul-container/test/gateways/http_route_test.go
index 97f8c8dc60d7..c8236294b093 100644
--- a/test/integration/consul-container/test/gateways/http_route_test.go
+++ b/test/integration/consul-container/test/gateways/http_route_test.go
@@ -15,6 +15,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/hashicorp/consul/api"
+
 	libassert "github.com/hashicorp/consul/test/integration/consul-container/libs/assert"
 	libcluster "github.com/hashicorp/consul/test/integration/consul-container/libs/cluster"
 	libservice "github.com/hashicorp/consul/test/integration/consul-container/libs/service"
@@ -82,26 +83,9 @@ func TestHTTPRouteFlattening(t *testing.T) {
 	cluster, _, _ := libtopology.NewCluster(t, clusterConfig)
 	client := cluster.Agents[0].GetClient()
 
-	gwNamespace := getNamespace()
-	if gwNamespace != "" {
-		ns := &api.Namespace{Name: gwNamespace}
-		_, _, err := client.Namespaces().Create(ns, nil)
-		require.NoError(t, err)
-	}
-
-	serviceOneNamespace := getNamespace()
-	if serviceOneNamespace != "" {
-		ns := &api.Namespace{Name: serviceOneNamespace}
-		_, _, err := client.Namespaces().Create(ns, nil)
-		require.NoError(t, err)
-	}
-
-	serviceTwoNamespace := getNamespace()
-	if serviceTwoNamespace != "" {
-		ns := &api.Namespace{Name: serviceTwoNamespace}
-		_, _, err := client.Namespaces().Create(ns, nil)
-		require.NoError(t, err)
-	}
+	gwNamespace := getOrCreateNamespace(t, client)
+	serviceOneNamespace := getOrCreateNamespace(t, client)
+	serviceTwoNamespace := getOrCreateNamespace(t, client)
 
 	_, _, err := libservice.CreateAndRegisterStaticServerAndSidecar(cluster.Agents[0], &libservice.ServiceOpts{
 		Name:      serviceOneName,
@@ -244,9 +228,9 @@ func TestHTTPRouteFlattening(t *testing.T) {
 	libassert.CatalogServiceExists(t, client, gatewayName, &api.QueryOptions{Namespace: gwNamespace})
 
 	// make sure config entries have been properly created
-	checkGatewayConfigEntry(t, client, gatewayName, gwNamespace)
-	checkHTTPRouteConfigEntry(t, client, routeOneName, gwNamespace)
-	checkHTTPRouteConfigEntry(t, client, routeTwoName, gwNamespace)
+	checkGatewayConfigEntry(t, client, gatewayName, &api.QueryOptions{Namespace: gwNamespace})
+	checkHTTPRouteConfigEntry(t, client, routeOneName, &api.QueryOptions{Namespace: gwNamespace})
+	checkHTTPRouteConfigEntry(t, client, routeTwoName, &api.QueryOptions{Namespace: gwNamespace})
 
 	// gateway resolves routes
 	gatewayPort, err := gatewayService.GetPort(listenerPort)
@@ -332,12 +316,7 @@ func TestHTTPRoutePathRewrite(t *testing.T) {
 	fooPath := "/v1/foo"
 	barPath := "/v1/bar"
 
-	namespace := getNamespace()
-	if namespace != "" {
-		ns := &api.Namespace{Name: namespace}
-		_, _, err := client.Namespaces().Create(ns, nil)
-		require.NoError(t, err)
-	}
+	namespace := getOrCreateNamespace(t, client)
 
 	_, _, err := libservice.CreateAndRegisterStaticServerAndSidecar(cluster.Agents[0], &libservice.ServiceOpts{
 		ID:        fooName,
@@ -486,9 +465,9 @@ func TestHTTPRoutePathRewrite(t *testing.T) {
 	libassert.CatalogServiceExists(t, client, gatewayName, &api.QueryOptions{Namespace: namespace})
 
 	// make sure config entries have been properly created
-	checkGatewayConfigEntry(t, client, gatewayName, namespace)
-	checkHTTPRouteConfigEntry(t, client, invalidRouteName, namespace)
-	checkHTTPRouteConfigEntry(t, client, validRouteName, namespace)
+	checkGatewayConfigEntry(t, client, gatewayName, &api.QueryOptions{Namespace: namespace})
+	checkHTTPRouteConfigEntry(t, client, invalidRouteName, &api.QueryOptions{Namespace: namespace})
+	checkHTTPRouteConfigEntry(t, client, validRouteName, &api.QueryOptions{Namespace: namespace})
 
 	gatewayPort, err := gatewayService.GetPort(listenerPort)
 	require.NoError(t, err)
@@ -560,13 +539,7 @@ func TestHTTPRouteParentRefChange(t *testing.T) {
 	cluster, _, _ := libtopology.NewCluster(t, clusterConfig)
 	client := cluster.APIClient(0)
 
-	// getNamespace() should always return an empty string in Consul OSS
-	namespace := getNamespace()
-	if namespace != "" {
-		ns := &api.Namespace{Name: namespace}
-		_, _, err := client.Namespaces().Create(ns, nil)
-		require.NoError(t, err)
-	}
+	namespace := getOrCreateNamespace(t, client)
 
 	_, _, err := libservice.CreateAndRegisterStaticServerAndSidecar(cluster.Agents[0], &libservice.ServiceOpts{
 		ID:        serviceName,
@@ -603,7 +576,7 @@ func TestHTTPRouteParentRefChange(t *testing.T) {
 		Namespace: namespace,
 	}
 	require.NoError(t, cluster.ConfigEntryWrite(gatewayOne))
-	checkGatewayConfigEntry(t, client, gatewayOneName, namespace)
+	checkGatewayConfigEntry(t, client, gatewayOneName, &api.QueryOptions{Namespace: namespace})
 
 	// create gateway service
 	gwOneCfg := libservice.GatewayConfig{
@@ -630,7 +603,7 @@ func TestHTTPRouteParentRefChange(t *testing.T) {
 		Namespace: namespace,
 	}
 	require.NoError(t, cluster.ConfigEntryWrite(gatewayTwo))
-	checkGatewayConfigEntry(t, client, gatewayTwoName, namespace)
+	checkGatewayConfigEntry(t, client, gatewayTwoName, &api.QueryOptions{Namespace: namespace})
 
 	// create gateway service
 	gwTwoCfg := libservice.GatewayConfig{
diff --git a/test/integration/consul-container/test/gateways/namespace_oss.go b/test/integration/consul-container/test/gateways/namespace_oss.go
deleted file mode 100644
index b9c21d4a9e8a..000000000000
--- a/test/integration/consul-container/test/gateways/namespace_oss.go
+++ /dev/null
@@ -1,11 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-//go:build !consulent
-// +build !consulent
-
-package gateways
-
-func getNamespace() string {
-	return ""
-}
diff --git a/test/integration/consul-container/test/gateways/tenancy_oss.go b/test/integration/consul-container/test/gateways/tenancy_oss.go
new file mode 100644
index 000000000000..19d82d39db17
--- /dev/null
+++ b/test/integration/consul-container/test/gateways/tenancy_oss.go
@@ -0,0 +1,14 @@
+//go:build !consulent
+// +build !consulent
+
+package gateways
+
+import (
+	"testing"
+
+	"github.com/hashicorp/consul/api"
+)
+
+func getOrCreateNamespace(_ *testing.T, _ *api.Client) string {
+	return ""
+}