diff --git a/easytier-go/internal/artifact/easytier_core.wasm b/easytier-go/internal/artifact/easytier_core.wasm
index e116661f..af27a3bd 100644
Binary files a/easytier-go/internal/artifact/easytier_core.wasm and b/easytier-go/internal/artifact/easytier_core.wasm differ
diff --git a/easytier-go/internal/artifact/provenance.go b/easytier-go/internal/artifact/provenance.go
index 68b90326..fa3154a8 100644
--- a/easytier-go/internal/artifact/provenance.go
+++ b/easytier-go/internal/artifact/provenance.go
@@ -3,6 +3,6 @@
 package artifact
 
 const (
-	Commit = "63519db2b5f2a6a1b9b7f20905f036dab54eb829"
-	SHA256 = "8b82f37d62fba2ffe8e256386096fddf448d4261d51c495d5bd97cd11bbb24a0"
+	Commit = "599e4eacaa9c9a6f84b8d6439418af9d860f9aa3"
+	SHA256 = "f5cc76a30d4c6128f7ce77d494dd4e8130aa7e3ce9d5b9ede7604745064bed8d"
 )
diff --git a/easytier-go/internal/coreabi/dataplane.go b/easytier-go/internal/coreabi/dataplane.go
index 97d1a4e4..8200a723 100644
--- a/easytier-go/internal/coreabi/dataplane.go
+++ b/easytier-go/internal/coreabi/dataplane.go
@@ -12,7 +12,7 @@ import (
 )
 
 const (
-	DataPlaneABIVersion = 3
+	DataPlaneABIVersion = 4
 
 	DataPlaneCapability    uint64 = 1 << 0
 	DataPlaneTCPCapability uint64 = 1 << 1
diff --git a/easytier-go/internal/engine/host.go b/easytier-go/internal/engine/host.go
index 2640f74b..267162f3 100644
--- a/easytier-go/internal/engine/host.go
+++ b/easytier-go/internal/engine/host.go
@@ -5,6 +5,7 @@ import (
 	"crypto/rand"
 	"errors"
 	"fmt"
+	"runtime/debug"
 	"sync"
 	"time"
 
@@ -105,6 +106,12 @@ func NewHost(ctx context.Context, options Options) (_ *Host, err error) {
 	if err != nil {
 		return nil, fmt.Errorf("instantiate embedded EasyTier core: %w", err)
 	}
+	// Compiling the core allocates ~100MB of throwaway compiler state on the
+	// Go heap. The Go runtime does not return it to the OS on its own after
+	// the initiating GC, so the process would retain the compilation peak as
+	// resident memory for its entire lifetime. NewHost runs once at startup,
+	// outside the packet path, so reclaim it explicitly here.
+	debug.FreeOSMemory()
 
 	host := &Host{
 		ctx:       lifetime,
diff --git a/easytier-go/internal/hostabi/socket_wire.go b/easytier-go/internal/hostabi/socket_wire.go
index 2097b713..4a1af42e 100644
--- a/easytier-go/internal/hostabi/socket_wire.go
+++ b/easytier-go/internal/hostabi/socket_wire.go
@@ -28,8 +28,16 @@ func readOwnedOptions(module api.Module, pointer, length uint32) ([]byte, bool)
 	return append([]byte(nil), options...), true
 }
 
+// optionsWireVersion matches OPTIONS_VERSION in
+// easytier-core/src/wasi/wire/options.rs. Version 3 appends a need_protect
+// byte after the purpose byte in every socket options document. The byte
+// requests VPN socket protection, which only Android-style VPN hosts can
+// honor; every other platform treats sockets as already protected, so the
+// decoders read and discard it.
+const optionsWireVersion = 3
+
 func decodeTCPConnectOptions(encoded []byte) (platform.TCPConnectOptions, error) {
-	if len(encoded) < 75 || encoded[0] != 2 {
+	if len(encoded) < 76 || encoded[0] != optionsWireVersion {
 		return platform.TCPConnectOptions{}, fmt.Errorf("invalid TCP connect options")
 	}
 	remote, err := decodeSocketAddress(encoded[1:28], false)
@@ -44,7 +52,7 @@ func decodeTCPConnectOptions(encoded []byte) (platform.TCPConnectOptions, error)
 	if err != nil {
 		return platform.TCPConnectOptions{}, fmt.Errorf("invalid TCP socket context: %w", err)
 	}
-	if len(remainder) < 9 {
+	if len(remainder) < 10 {
 		return platform.TCPConnectOptions{}, fmt.Errorf("truncated TCP bind policy")
 	}
 	bind, err := decodeTCPBindPolicy(
@@ -53,7 +61,7 @@ func decodeTCPConnectOptions(encoded []byte) (platform.TCPConnectOptions, error)
 		remainder[0],
 		remainder[1],
 		remainder[2],
-		remainder[4:],
+		remainder[5:],
 	)
 	if err != nil {
 		return platform.TCPConnectOptions{}, err
@@ -70,7 +78,7 @@ func decodeTCPConnectOptions(encoded []byte) (platform.TCPConnectOptions, error)
 }
 
 func decodeUDPBindOptions(encoded []byte) (platform.UDPBindOptions, error) {
-	if len(encoded) < 48 || encoded[0] != 2 {
+	if len(encoded) < 49 || encoded[0] != optionsWireVersion {
 		return platform.UDPBindOptions{}, fmt.Errorf("invalid UDP bind options")
 	}
 	local, err := decodeSocketAddress(encoded[1:28], true)
@@ -81,7 +89,7 @@ func decodeUDPBindOptions(encoded []byte) (platform.UDPBindOptions, error) {
 	if err != nil {
 		return platform.UDPBindOptions{}, fmt.Errorf("invalid UDP socket context: %w", err)
 	}
-	if len(remainder) < 9 {
+	if len(remainder) < 10 {
 		return platform.UDPBindOptions{}, fmt.Errorf("truncated UDP bind policy")
 	}
 	reuseAddr, err := decodeWireBool("UDP reuse_addr", remainder[0])
@@ -100,7 +108,7 @@ func decodeUDPBindOptions(encoded []byte) (platform.UDPBindOptions, error) {
 	if err != nil {
 		return platform.UDPBindOptions{}, err
 	}
-	device, err := decodeBindDevice(remainder[4:])
+	device, err := decodeBindDevice(remainder[5:])
 	if err != nil {
 		return platform.UDPBindOptions{}, err
 	}
@@ -116,7 +124,7 @@ func decodeUDPBindOptions(encoded []byte) (platform.UDPBindOptions, error) {
 }
 
 func decodeTCPListenOptions(encoded []byte) (platform.TCPListenOptions, error) {
-	if len(encoded) < 48 || encoded[0] != 2 {
+	if len(encoded) < 49 || encoded[0] != optionsWireVersion {
 		return platform.TCPListenOptions{}, fmt.Errorf("invalid TCP listen options")
 	}
 	local, err := decodeSocketAddress(encoded[1:28], false)
@@ -127,7 +135,7 @@ func decodeTCPListenOptions(encoded []byte) (platform.TCPListenOptions, error) {
 	if err != nil {
 		return platform.TCPListenOptions{}, fmt.Errorf("invalid TCP listen context: %w", err)
 	}
-	if len(remainder) < 9 {
+	if len(remainder) < 10 {
 		return platform.TCPListenOptions{}, fmt.Errorf("truncated TCP listen bind policy")
 	}
 	bind, err := decodeTCPBindPolicy(
@@ -136,7 +144,7 @@ func decodeTCPListenOptions(encoded []byte) (platform.TCPListenOptions, error) {
 		remainder[0],
 		remainder[1],
 		remainder[2],
-		remainder[4:],
+		remainder[5:],
 	)
 	if err != nil {
 		return platform.TCPListenOptions{}, err
diff --git a/easytier-go/internal/hostabi/socket_wire_test.go b/easytier-go/internal/hostabi/socket_wire_test.go
new file mode 100644
index 00000000..a3c57013
--- /dev/null
+++ b/easytier-go/internal/hostabi/socket_wire_test.go
@@ -0,0 +1,265 @@
+package hostabi
+
+import (
+	"encoding/binary"
+	"net"
+	"testing"
+)
+
+// encodeSocketAddress encodes a 27-byte socket address in the wire format
+// used by the wasm core (first 27 bytes of UDP metadata).
+func encodeSocketAddress(addr *net.UDPAddr) []byte {
+	if addr == nil {
+		return make([]byte, socketAddressLen)
+	}
+	var buf [48]byte
+	if ipv4 := addr.IP.To4(); ipv4 != nil {
+		buf[0] = 4
+		copy(buf[1:5], ipv4)
+	} else if ipv6 := addr.IP.To16(); ipv6 != nil {
+		buf[0] = 6
+		copy(buf[1:17], ipv6)
+	} else {
+		panic("invalid IP")
+	}
+	binary.BigEndian.PutUint16(buf[17:19], uint16(addr.Port))
+	return buf[:socketAddressLen]
+}
+
+// encodeSocketContext encodes the socket context portion of the wire format.
+func encodeSocketContext(
+	ipVersion byte,
+	mark *uint32,
+	netns *string,
+) []byte {
+	buf := make([]byte, 0, 64)
+	buf = append(buf, ipVersion)
+	if mark != nil {
+		buf = append(buf, 1)
+		var m [4]byte
+		binary.BigEndian.PutUint32(m[:], *mark)
+		buf = append(buf, m[:]...)
+	} else {
+		buf = append(buf, 0, 0, 0, 0, 0)
+	}
+	if netns != nil {
+		buf = append(buf, 1)
+		var l [4]byte
+		binary.BigEndian.PutUint32(l[:], uint32(len(*netns)))
+		buf = append(buf, l[:]...)
+		buf = append(buf, []byte(*netns)...)
+	} else {
+		buf = append(buf, 0, 0, 0, 0, 0)
+	}
+	return buf
+}
+
+// encodeBindDeviceField encodes the bind_device field (present byte +
+// u32 length + bytes).
+func encodeBindDeviceField(device *string) []byte {
+	if device == nil {
+		return []byte{0, 0, 0, 0, 0}
+	}
+	buf := make([]byte, 0, 5+len(*device))
+	buf = append(buf, 1)
+	var l [4]byte
+	binary.BigEndian.PutUint32(l[:], uint32(len(*device)))
+	buf = append(buf, l[:]...)
+	buf = append(buf, []byte(*device)...)
+	return buf
+}
+
+func TestDecodeTCPConnectOptionsV3(t *testing.T) {
+	tests := []struct {
+		name     string
+		mark     *uint32
+		netns    *string
+		device   *string
+		local    *net.UDPAddr
+		wantMark *uint32
+	}{
+		{
+			name:  "minimal no netns no device",
+			mark:  nil,
+			netns: nil,
+			device: nil,
+			local: nil,
+		},
+		{
+			name:  "with netns",
+			mark:  nil,
+			netns: strPtr("test-ns"),
+			device: nil,
+			local: nil,
+		},
+		{
+			name:  "with bind device",
+			mark:  nil,
+			netns: nil,
+			device: strPtr("eth0"),
+			local: nil,
+		},
+		{
+			name:  "with netns and device",
+			mark:  nil,
+			netns: strPtr("netns1"),
+			device: strPtr("wg0"),
+			local: nil,
+		},
+		{
+			name:  "with socket mark",
+			mark:  uint32Ptr(42),
+			netns: nil,
+			device: nil,
+			local: nil,
+		},
+		{
+			name:  "with local address",
+			mark:  nil,
+			netns: nil,
+			device: nil,
+			local: &net.UDPAddr{IP: net.ParseIP("192.168.1.1"), Port: 8080},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			remote := &net.UDPAddr{IP: net.ParseIP("10.0.0.1"), Port: 11010}
+			encoded := make([]byte, 0, 128)
+			encoded = append(encoded, optionsWireVersion) // wire v3
+			encoded = append(encoded, encodeSocketAddress(remote)...)
+			encoded = append(encoded, encodeSocketAddress(tt.local)...)
+			encoded = append(encoded, encodeSocketContext(0, tt.mark, tt.netns)...)
+			// bind policy: reuse_addr, reuse_port, only_v6
+			encoded = append(encoded, 0, 0, 0)
+			// purpose: TcpDial (0)
+			encoded = append(encoded, 0)
+			// need_protect (wire v3 addition)
+			encoded = append(encoded, 0)
+			// bind device
+			encoded = append(encoded, encodeBindDeviceField(tt.device)...)
+
+			opts, err := decodeTCPConnectOptions(encoded)
+			if err != nil {
+				t.Fatalf("decodeTCPConnectOptions failed: %v", err)
+			}
+			if opts.RemoteAddr == nil {
+				t.Fatal("remote address is nil")
+			}
+			if !opts.RemoteAddr.IP.Equal(remote.IP) || opts.RemoteAddr.Port != remote.Port {
+				t.Errorf("remote addr = %v, want %v", opts.RemoteAddr, remote)
+			}
+			if tt.mark != nil {
+				if opts.Bind.Context.SocketMark == nil || *opts.Bind.Context.SocketMark != *tt.mark {
+					t.Errorf("socket mark = %v, want %v", opts.Bind.Context.SocketMark, tt.mark)
+				}
+			}
+			if tt.netns != nil {
+				if opts.Bind.Context.NetNS == nil || *opts.Bind.Context.NetNS != *tt.netns {
+					t.Errorf("netns = %v, want %v", opts.Bind.Context.NetNS, tt.netns)
+				}
+			}
+			if tt.device != nil {
+				if opts.Bind.BindDevice == nil || *opts.Bind.BindDevice != *tt.device {
+					t.Errorf("bind device = %v, want %v", opts.Bind.BindDevice, tt.device)
+				}
+			}
+			if tt.local != nil {
+				if opts.Bind.LocalAddr == nil || opts.Bind.LocalAddr.Port != tt.local.Port {
+					t.Errorf("local addr = %v, want port %d", opts.Bind.LocalAddr, tt.local.Port)
+				}
+			}
+		})
+	}
+}
+
+func TestDecodeUDPBindOptionsV3(t *testing.T) {
+	device := strPtr("eth1")
+	netns := strPtr("udp-ns")
+	mark := uint32Ptr(100)
+
+	bindAddr := &net.UDPAddr{IP: net.ParseIP("0.0.0.0"), Port: 11011}
+	encoded := make([]byte, 0, 128)
+	encoded = append(encoded, optionsWireVersion)
+	encoded = append(encoded, encodeSocketAddress(bindAddr)...)
+	encoded = append(encoded, encodeSocketContext(0, mark, netns)...)
+	// remainder: reuse_addr, reuse_port, only_v6, purpose, need_protect, bind_device
+	encoded = append(encoded, 0, 0, 0) // reuse_addr, reuse_port, only_v6
+	encoded = append(encoded, 1)       // purpose: Standalone
+	encoded = append(encoded, 0)       // need_protect (wire v3)
+	encoded = append(encoded, encodeBindDeviceField(device)...)
+
+	opts, err := decodeUDPBindOptions(encoded)
+	if err != nil {
+		t.Fatalf("decodeUDPBindOptions failed: %v", err)
+	}
+	if opts.LocalAddr == nil || opts.LocalAddr.Port != 11011 {
+		t.Errorf("local addr = %v, want port 11011", opts.LocalAddr)
+	}
+	if opts.Context.SocketMark == nil || *opts.Context.SocketMark != 100 {
+		t.Errorf("socket mark = %v, want 100", opts.Context.SocketMark)
+	}
+	if opts.Context.NetNS == nil || *opts.Context.NetNS != "udp-ns" {
+		t.Errorf("netns = %v, want udp-ns", opts.Context.NetNS)
+	}
+	if opts.BindDevice == nil || *opts.BindDevice != "eth1" {
+		t.Errorf("bind device = %v, want eth1", opts.BindDevice)
+	}
+	if opts.Purpose != 1 {
+		t.Errorf("purpose = %d, want 1 (Standalone)", opts.Purpose)
+	}
+}
+
+func TestDecodeTCPListenOptionsV3(t *testing.T) {
+	device := strPtr("wg0")
+	netns := strPtr("listen-ns")
+
+	bindAddr := &net.UDPAddr{IP: net.ParseIP("0.0.0.0"), Port: 22020}
+	encoded := make([]byte, 0, 128)
+	encoded = append(encoded, optionsWireVersion)
+	encoded = append(encoded, encodeSocketAddress(bindAddr)...)
+	encoded = append(encoded, encodeSocketContext(2, nil, netns)...) // IPVersionBoth
+	// bind policy: reuse_addr=0, reuse_port=0, only_v6=0
+	encoded = append(encoded, 0, 0, 0)
+	// purpose: Kcp (1)
+	encoded = append(encoded, 1)
+	// need_protect (wire v3)
+	encoded = append(encoded, 0)
+	encoded = append(encoded, encodeBindDeviceField(device)...)
+
+	opts, err := decodeTCPListenOptions(encoded)
+	if err != nil {
+		t.Fatalf("decodeTCPListenOptions failed: %v", err)
+	}
+	if opts.Bind.LocalAddr == nil || opts.Bind.LocalAddr.Port != 22020 {
+		t.Errorf("bind addr = %v, want port 22020", opts.Bind.LocalAddr)
+	}
+	if opts.Bind.Context.NetNS == nil || *opts.Bind.Context.NetNS != "listen-ns" {
+		t.Errorf("netns = %v, want listen-ns", opts.Bind.Context.NetNS)
+	}
+	if opts.Bind.BindDevice == nil || *opts.Bind.BindDevice != "wg0" {
+		t.Errorf("bind device = %v, want wg0", opts.Bind.BindDevice)
+	}
+	if opts.Purpose != 1 {
+		t.Errorf("purpose = %d, want 1 (Kcp)", opts.Purpose)
+	}
+}
+
+func TestDecodeTCPConnectOptionsV2Rejected(t *testing.T) {
+	remote := &net.UDPAddr{IP: net.ParseIP("10.0.0.1"), Port: 11010}
+	encoded := make([]byte, 0, 128)
+	encoded = append(encoded, 2) // wire v2 — must be rejected
+	encoded = append(encoded, encodeSocketAddress(remote)...)
+	encoded = append(encoded, encodeSocketAddress(nil)...)
+	encoded = append(encoded, encodeSocketContext(0, nil, nil)...)
+	encoded = append(encoded, 0, 0, 0, 0) // no need_protect in v2
+	encoded = append(encoded, encodeBindDeviceField(nil)...)
+
+	_, err := decodeTCPConnectOptions(encoded)
+	if err == nil {
+		t.Fatal("wire v2 should be rejected")
+	}
+}
+
+func strPtr(s string) *string    { return &s }
+func uint32Ptr(v uint32) *uint32 { return &v }
diff --git a/easytier-go/proto/api/config/api_config.pb.go b/easytier-go/proto/api/config/api_config.pb.go
index 3491a84c..909bfa07 100644
--- a/easytier-go/proto/api/config/api_config.pb.go
+++ b/easytier-go/proto/api/config/api_config.pb.go
@@ -75,21 +75,24 @@ func (ConfigPatchAction) EnumDescriptor() ([]byte, []int) {
 }
 
 type InstanceConfigPatch struct {
-	state                  protoimpl.MessageState `protogen:"open.v1"`
-	Hostname               *string                `protobuf:"bytes,1,opt,name=hostname,proto3,oneof" json:"hostname,omitempty"`
-	Ipv4                   *common.Ipv4Inet       `protobuf:"bytes,2,opt,name=ipv4,proto3,oneof" json:"ipv4,omitempty"`
-	Ipv6                   *common.Ipv6Inet       `protobuf:"bytes,3,opt,name=ipv6,proto3,oneof" json:"ipv6,omitempty"`
-	PortForwards           []*PortForwardPatch    `protobuf:"bytes,4,rep,name=port_forwards,json=portForwards,proto3" json:"port_forwards,omitempty"`
-	Acl                    *AclPatch              `protobuf:"bytes,5,opt,name=acl,proto3,oneof" json:"acl,omitempty"`
-	ProxyNetworks          []*ProxyNetworkPatch   `protobuf:"bytes,6,rep,name=proxy_networks,json=proxyNetworks,proto3" json:"proxy_networks,omitempty"`
-	Routes                 []*RoutePatch          `protobuf:"bytes,7,rep,name=routes,proto3" json:"routes,omitempty"`
-	ExitNodes              []*ExitNodePatch       `protobuf:"bytes,8,rep,name=exit_nodes,json=exitNodes,proto3" json:"exit_nodes,omitempty"`
-	MappedListeners        []*UrlPatch            `protobuf:"bytes,9,rep,name=mapped_listeners,json=mappedListeners,proto3" json:"mapped_listeners,omitempty"`
-	Connectors             []*UrlPatch            `protobuf:"bytes,10,rep,name=connectors,proto3" json:"connectors,omitempty"`
-	Ipv6PublicAddrProvider *bool                  `protobuf:"varint,11,opt,name=ipv6_public_addr_provider,json=ipv6PublicAddrProvider,proto3,oneof" json:"ipv6_public_addr_provider,omitempty"`
-	Ipv6PublicAddrAuto     *bool                  `protobuf:"varint,12,opt,name=ipv6_public_addr_auto,json=ipv6PublicAddrAuto,proto3,oneof" json:"ipv6_public_addr_auto,omitempty"`
-	Ipv6PublicAddrPrefix   *string                `protobuf:"bytes,13,opt,name=ipv6_public_addr_prefix,json=ipv6PublicAddrPrefix,proto3,oneof" json:"ipv6_public_addr_prefix,omitempty"`
-	DisableRelayData       *bool                  `protobuf:"varint,14,opt,name=disable_relay_data,json=disableRelayData,proto3,oneof" json:"disable_relay_data,omitempty"`
+	state                  protoimpl.MessageState       `protogen:"open.v1"`
+	Hostname               *string                      `protobuf:"bytes,1,opt,name=hostname,proto3,oneof" json:"hostname,omitempty"`
+	Ipv4                   *common.Ipv4Inet             `protobuf:"bytes,2,opt,name=ipv4,proto3,oneof" json:"ipv4,omitempty"`
+	Ipv6                   *common.Ipv6Inet             `protobuf:"bytes,3,opt,name=ipv6,proto3,oneof" json:"ipv6,omitempty"`
+	PortForwards           []*PortForwardPatch          `protobuf:"bytes,4,rep,name=port_forwards,json=portForwards,proto3" json:"port_forwards,omitempty"`
+	Acl                    *AclPatch                    `protobuf:"bytes,5,opt,name=acl,proto3,oneof" json:"acl,omitempty"`
+	ProxyNetworks          []*ProxyNetworkPatch         `protobuf:"bytes,6,rep,name=proxy_networks,json=proxyNetworks,proto3" json:"proxy_networks,omitempty"`
+	Routes                 []*RoutePatch                `protobuf:"bytes,7,rep,name=routes,proto3" json:"routes,omitempty"`
+	ExitNodes              []*ExitNodePatch             `protobuf:"bytes,8,rep,name=exit_nodes,json=exitNodes,proto3" json:"exit_nodes,omitempty"`
+	MappedListeners        []*UrlPatch                  `protobuf:"bytes,9,rep,name=mapped_listeners,json=mappedListeners,proto3" json:"mapped_listeners,omitempty"`
+	Connectors             []*UrlPatch                  `protobuf:"bytes,10,rep,name=connectors,proto3" json:"connectors,omitempty"`
+	Ipv6PublicAddrProvider *bool                        `protobuf:"varint,11,opt,name=ipv6_public_addr_provider,json=ipv6PublicAddrProvider,proto3,oneof" json:"ipv6_public_addr_provider,omitempty"`
+	Ipv6PublicAddrAuto     *bool                        `protobuf:"varint,12,opt,name=ipv6_public_addr_auto,json=ipv6PublicAddrAuto,proto3,oneof" json:"ipv6_public_addr_auto,omitempty"`
+	Ipv6PublicAddrPrefix   *string                      `protobuf:"bytes,13,opt,name=ipv6_public_addr_prefix,json=ipv6PublicAddrPrefix,proto3,oneof" json:"ipv6_public_addr_prefix,omitempty"`
+	DisableRelayData       *bool                        `protobuf:"varint,14,opt,name=disable_relay_data,json=disableRelayData,proto3,oneof" json:"disable_relay_data,omitempty"`
+	VpnPortalClients       []*VpnPortalClientPatch      `protobuf:"bytes,15,rep,name=vpn_portal_clients,json=vpnPortalClients,proto3" json:"vpn_portal_clients,omitempty"`
+	ManagedCredentials     *manage.ManagedCredentialSet `protobuf:"bytes,16,opt,name=managed_credentials,json=managedCredentials,proto3" json:"managed_credentials,omitempty"`
+	PreferPeerRelay        *bool                        `protobuf:"varint,17,opt,name=prefer_peer_relay,json=preferPeerRelay,proto3,oneof" json:"prefer_peer_relay,omitempty"`
 	unknownFields          protoimpl.UnknownFields
 	sizeCache              protoimpl.SizeCache
 }
@@ -222,6 +225,79 @@ func (x *InstanceConfigPatch) GetDisableRelayData() bool {
 	return false
 }
 
+func (x *InstanceConfigPatch) GetVpnPortalClients() []*VpnPortalClientPatch {
+	if x != nil {
+		return x.VpnPortalClients
+	}
+	return nil
+}
+
+func (x *InstanceConfigPatch) GetManagedCredentials() *manage.ManagedCredentialSet {
+	if x != nil {
+		return x.ManagedCredentials
+	}
+	return nil
+}
+
+func (x *InstanceConfigPatch) GetPreferPeerRelay() bool {
+	if x != nil && x.PreferPeerRelay != nil {
+		return *x.PreferPeerRelay
+	}
+	return false
+}
+
+type VpnPortalClientPatch struct {
+	state         protoimpl.MessageState        `protogen:"open.v1"`
+	Action        ConfigPatchAction             `protobuf:"varint,1,opt,name=action,proto3,enum=api.config.ConfigPatchAction" json:"action,omitempty"`
+	Client        *manage.VpnPortalClientConfig `protobuf:"bytes,2,opt,name=client,proto3" json:"client,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *VpnPortalClientPatch) Reset() {
+	*x = VpnPortalClientPatch{}
+	mi := &file_api_config_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *VpnPortalClientPatch) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*VpnPortalClientPatch) ProtoMessage() {}
+
+func (x *VpnPortalClientPatch) ProtoReflect() protoreflect.Message {
+	mi := &file_api_config_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use VpnPortalClientPatch.ProtoReflect.Descriptor instead.
+func (*VpnPortalClientPatch) Descriptor() ([]byte, []int) {
+	return file_api_config_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *VpnPortalClientPatch) GetAction() ConfigPatchAction {
+	if x != nil {
+		return x.Action
+	}
+	return ConfigPatchAction_ADD
+}
+
+func (x *VpnPortalClientPatch) GetClient() *manage.VpnPortalClientConfig {
+	if x != nil {
+		return x.Client
+	}
+	return nil
+}
+
 type PortForwardPatch struct {
 	state         protoimpl.MessageState      `protogen:"open.v1"`
 	Action        ConfigPatchAction           `protobuf:"varint,1,opt,name=action,proto3,enum=api.config.ConfigPatchAction" json:"action,omitempty"`
@@ -232,7 +308,7 @@ type PortForwardPatch struct {
 
 func (x *PortForwardPatch) Reset() {
 	*x = PortForwardPatch{}
-	mi := &file_api_config_proto_msgTypes[1]
+	mi := &file_api_config_proto_msgTypes[2]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -244,7 +320,7 @@ func (x *PortForwardPatch) String() string {
 func (*PortForwardPatch) ProtoMessage() {}
 
 func (x *PortForwardPatch) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[1]
+	mi := &file_api_config_proto_msgTypes[2]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -257,7 +333,7 @@ func (x *PortForwardPatch) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PortForwardPatch.ProtoReflect.Descriptor instead.
 func (*PortForwardPatch) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{1}
+	return file_api_config_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *PortForwardPatch) GetAction() ConfigPatchAction {
@@ -284,7 +360,7 @@ type StringPatch struct {
 
 func (x *StringPatch) Reset() {
 	*x = StringPatch{}
-	mi := &file_api_config_proto_msgTypes[2]
+	mi := &file_api_config_proto_msgTypes[3]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -296,7 +372,7 @@ func (x *StringPatch) String() string {
 func (*StringPatch) ProtoMessage() {}
 
 func (x *StringPatch) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[2]
+	mi := &file_api_config_proto_msgTypes[3]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -309,7 +385,7 @@ func (x *StringPatch) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StringPatch.ProtoReflect.Descriptor instead.
 func (*StringPatch) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{2}
+	return file_api_config_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *StringPatch) GetAction() ConfigPatchAction {
@@ -336,7 +412,7 @@ type UrlPatch struct {
 
 func (x *UrlPatch) Reset() {
 	*x = UrlPatch{}
-	mi := &file_api_config_proto_msgTypes[3]
+	mi := &file_api_config_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -348,7 +424,7 @@ func (x *UrlPatch) String() string {
 func (*UrlPatch) ProtoMessage() {}
 
 func (x *UrlPatch) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[3]
+	mi := &file_api_config_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -361,7 +437,7 @@ func (x *UrlPatch) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UrlPatch.ProtoReflect.Descriptor instead.
 func (*UrlPatch) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{3}
+	return file_api_config_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *UrlPatch) GetAction() ConfigPatchAction {
@@ -389,7 +465,7 @@ type AclPatch struct {
 
 func (x *AclPatch) Reset() {
 	*x = AclPatch{}
-	mi := &file_api_config_proto_msgTypes[4]
+	mi := &file_api_config_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -401,7 +477,7 @@ func (x *AclPatch) String() string {
 func (*AclPatch) ProtoMessage() {}
 
 func (x *AclPatch) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[4]
+	mi := &file_api_config_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -414,7 +490,7 @@ func (x *AclPatch) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AclPatch.ProtoReflect.Descriptor instead.
 func (*AclPatch) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{4}
+	return file_api_config_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *AclPatch) GetAcl() *acl.Acl {
@@ -449,7 +525,7 @@ type ProxyNetworkPatch struct {
 
 func (x *ProxyNetworkPatch) Reset() {
 	*x = ProxyNetworkPatch{}
-	mi := &file_api_config_proto_msgTypes[5]
+	mi := &file_api_config_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -461,7 +537,7 @@ func (x *ProxyNetworkPatch) String() string {
 func (*ProxyNetworkPatch) ProtoMessage() {}
 
 func (x *ProxyNetworkPatch) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[5]
+	mi := &file_api_config_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -474,7 +550,7 @@ func (x *ProxyNetworkPatch) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ProxyNetworkPatch.ProtoReflect.Descriptor instead.
 func (*ProxyNetworkPatch) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{5}
+	return file_api_config_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *ProxyNetworkPatch) GetAction() ConfigPatchAction {
@@ -508,7 +584,7 @@ type RoutePatch struct {
 
 func (x *RoutePatch) Reset() {
 	*x = RoutePatch{}
-	mi := &file_api_config_proto_msgTypes[6]
+	mi := &file_api_config_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -520,7 +596,7 @@ func (x *RoutePatch) String() string {
 func (*RoutePatch) ProtoMessage() {}
 
 func (x *RoutePatch) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[6]
+	mi := &file_api_config_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -533,7 +609,7 @@ func (x *RoutePatch) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RoutePatch.ProtoReflect.Descriptor instead.
 func (*RoutePatch) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{6}
+	return file_api_config_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *RoutePatch) GetAction() ConfigPatchAction {
@@ -560,7 +636,7 @@ type ExitNodePatch struct {
 
 func (x *ExitNodePatch) Reset() {
 	*x = ExitNodePatch{}
-	mi := &file_api_config_proto_msgTypes[7]
+	mi := &file_api_config_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -572,7 +648,7 @@ func (x *ExitNodePatch) String() string {
 func (*ExitNodePatch) ProtoMessage() {}
 
 func (x *ExitNodePatch) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[7]
+	mi := &file_api_config_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -585,7 +661,7 @@ func (x *ExitNodePatch) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExitNodePatch.ProtoReflect.Descriptor instead.
 func (*ExitNodePatch) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{7}
+	return file_api_config_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *ExitNodePatch) GetAction() ConfigPatchAction {
@@ -612,7 +688,7 @@ type PatchConfigRequest struct {
 
 func (x *PatchConfigRequest) Reset() {
 	*x = PatchConfigRequest{}
-	mi := &file_api_config_proto_msgTypes[8]
+	mi := &file_api_config_proto_msgTypes[9]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -624,7 +700,7 @@ func (x *PatchConfigRequest) String() string {
 func (*PatchConfigRequest) ProtoMessage() {}
 
 func (x *PatchConfigRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[8]
+	mi := &file_api_config_proto_msgTypes[9]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -637,7 +713,7 @@ func (x *PatchConfigRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PatchConfigRequest.ProtoReflect.Descriptor instead.
 func (*PatchConfigRequest) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{8}
+	return file_api_config_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *PatchConfigRequest) GetPatch() *InstanceConfigPatch {
@@ -662,7 +738,7 @@ type PatchConfigResponse struct {
 
 func (x *PatchConfigResponse) Reset() {
 	*x = PatchConfigResponse{}
-	mi := &file_api_config_proto_msgTypes[9]
+	mi := &file_api_config_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -674,7 +750,7 @@ func (x *PatchConfigResponse) String() string {
 func (*PatchConfigResponse) ProtoMessage() {}
 
 func (x *PatchConfigResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[9]
+	mi := &file_api_config_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -687,7 +763,7 @@ func (x *PatchConfigResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PatchConfigResponse.ProtoReflect.Descriptor instead.
 func (*PatchConfigResponse) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{9}
+	return file_api_config_proto_rawDescGZIP(), []int{10}
 }
 
 type GetConfigRequest struct {
@@ -699,7 +775,7 @@ type GetConfigRequest struct {
 
 func (x *GetConfigRequest) Reset() {
 	*x = GetConfigRequest{}
-	mi := &file_api_config_proto_msgTypes[10]
+	mi := &file_api_config_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -711,7 +787,7 @@ func (x *GetConfigRequest) String() string {
 func (*GetConfigRequest) ProtoMessage() {}
 
 func (x *GetConfigRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[10]
+	mi := &file_api_config_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -724,7 +800,7 @@ func (x *GetConfigRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetConfigRequest.ProtoReflect.Descriptor instead.
 func (*GetConfigRequest) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{10}
+	return file_api_config_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *GetConfigRequest) GetInstance() *instance.InstanceIdentifier {
@@ -744,7 +820,7 @@ type GetConfigResponse struct {
 
 func (x *GetConfigResponse) Reset() {
 	*x = GetConfigResponse{}
-	mi := &file_api_config_proto_msgTypes[11]
+	mi := &file_api_config_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -756,7 +832,7 @@ func (x *GetConfigResponse) String() string {
 func (*GetConfigResponse) ProtoMessage() {}
 
 func (x *GetConfigResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[11]
+	mi := &file_api_config_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -769,7 +845,7 @@ func (x *GetConfigResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetConfigResponse.ProtoReflect.Descriptor instead.
 func (*GetConfigResponse) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{11}
+	return file_api_config_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *GetConfigResponse) GetConfig() *manage.NetworkConfig {
@@ -791,7 +867,7 @@ var File_api_config_proto protoreflect.FileDescriptor
 const file_api_config_proto_rawDesc = "" +
 	"\n" +
 	"\x10api_config.proto\x12\n" +
-	"api.config\x1a\fcommon.proto\x1a\tacl.proto\x1a\x12api_instance.proto\x1a\x10api_manage.proto\"\x9c\a\n" +
+	"api.config\x1a\fcommon.proto\x1a\tacl.proto\x1a\x12api_instance.proto\x1a\x10api_manage.proto\"\x86\t\n" +
 	"\x13InstanceConfigPatch\x12\x1f\n" +
 	"\bhostname\x18\x01 \x01(\tH\x00R\bhostname\x88\x01\x01\x12)\n" +
 	"\x04ipv4\x18\x02 \x01(\v2\x10.common.Ipv4InetH\x01R\x04ipv4\x88\x01\x01\x12)\n" +
@@ -810,7 +886,10 @@ const file_api_config_proto_rawDesc = "" +
 	"\x19ipv6_public_addr_provider\x18\v \x01(\bH\x04R\x16ipv6PublicAddrProvider\x88\x01\x01\x126\n" +
 	"\x15ipv6_public_addr_auto\x18\f \x01(\bH\x05R\x12ipv6PublicAddrAuto\x88\x01\x01\x12:\n" +
 	"\x17ipv6_public_addr_prefix\x18\r \x01(\tH\x06R\x14ipv6PublicAddrPrefix\x88\x01\x01\x121\n" +
-	"\x12disable_relay_data\x18\x0e \x01(\bH\aR\x10disableRelayData\x88\x01\x01B\v\n" +
+	"\x12disable_relay_data\x18\x0e \x01(\bH\aR\x10disableRelayData\x88\x01\x01\x12N\n" +
+	"\x12vpn_portal_clients\x18\x0f \x03(\v2 .api.config.VpnPortalClientPatchR\x10vpnPortalClients\x12Q\n" +
+	"\x13managed_credentials\x18\x10 \x01(\v2 .api.manage.ManagedCredentialSetR\x12managedCredentials\x12/\n" +
+	"\x11prefer_peer_relay\x18\x11 \x01(\bH\bR\x0fpreferPeerRelay\x88\x01\x01B\v\n" +
 	"\t_hostnameB\a\n" +
 	"\x05_ipv4B\a\n" +
 	"\x05_ipv6B\x06\n" +
@@ -818,7 +897,11 @@ const file_api_config_proto_rawDesc = "" +
 	"\x1a_ipv6_public_addr_providerB\x18\n" +
 	"\x16_ipv6_public_addr_autoB\x1a\n" +
 	"\x18_ipv6_public_addr_prefixB\x15\n" +
-	"\x13_disable_relay_data\"x\n" +
+	"\x13_disable_relay_dataB\x14\n" +
+	"\x12_prefer_peer_relay\"\x88\x01\n" +
+	"\x14VpnPortalClientPatch\x125\n" +
+	"\x06action\x18\x01 \x01(\x0e2\x1d.api.config.ConfigPatchActionR\x06action\x129\n" +
+	"\x06client\x18\x02 \x01(\v2!.api.manage.VpnPortalClientConfigR\x06client\"x\n" +
 	"\x10PortForwardPatch\x125\n" +
 	"\x06action\x18\x01 \x01(\x0e2\x1d.api.config.ConfigPatchActionR\x06action\x12-\n" +
 	"\x03cfg\x18\x02 \x01(\v2\x1b.common.PortForwardConfigPbR\x03cfg\"Z\n" +
@@ -878,68 +961,75 @@ func file_api_config_proto_rawDescGZIP() []byte {
 }
 
 var file_api_config_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_api_config_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
+var file_api_config_proto_msgTypes = make([]protoimpl.MessageInfo, 13)
 var file_api_config_proto_goTypes = []any{
-	(ConfigPatchAction)(0),              // 0: api.config.ConfigPatchAction
-	(*InstanceConfigPatch)(nil),         // 1: api.config.InstanceConfigPatch
-	(*PortForwardPatch)(nil),            // 2: api.config.PortForwardPatch
-	(*StringPatch)(nil),                 // 3: api.config.StringPatch
-	(*UrlPatch)(nil),                    // 4: api.config.UrlPatch
-	(*AclPatch)(nil),                    // 5: api.config.AclPatch
-	(*ProxyNetworkPatch)(nil),           // 6: api.config.ProxyNetworkPatch
-	(*RoutePatch)(nil),                  // 7: api.config.RoutePatch
-	(*ExitNodePatch)(nil),               // 8: api.config.ExitNodePatch
-	(*PatchConfigRequest)(nil),          // 9: api.config.PatchConfigRequest
-	(*PatchConfigResponse)(nil),         // 10: api.config.PatchConfigResponse
-	(*GetConfigRequest)(nil),            // 11: api.config.GetConfigRequest
-	(*GetConfigResponse)(nil),           // 12: api.config.GetConfigResponse
-	(*common.Ipv4Inet)(nil),             // 13: common.Ipv4Inet
-	(*common.Ipv6Inet)(nil),             // 14: common.Ipv6Inet
-	(*common.PortForwardConfigPb)(nil),  // 15: common.PortForwardConfigPb
-	(*common.Url)(nil),                  // 16: common.Url
-	(*acl.Acl)(nil),                     // 17: acl.Acl
-	(*common.IpAddr)(nil),               // 18: common.IpAddr
-	(*instance.InstanceIdentifier)(nil), // 19: api.instance.InstanceIdentifier
-	(*manage.NetworkConfig)(nil),        // 20: api.manage.NetworkConfig
+	(ConfigPatchAction)(0),               // 0: api.config.ConfigPatchAction
+	(*InstanceConfigPatch)(nil),          // 1: api.config.InstanceConfigPatch
+	(*VpnPortalClientPatch)(nil),         // 2: api.config.VpnPortalClientPatch
+	(*PortForwardPatch)(nil),             // 3: api.config.PortForwardPatch
+	(*StringPatch)(nil),                  // 4: api.config.StringPatch
+	(*UrlPatch)(nil),                     // 5: api.config.UrlPatch
+	(*AclPatch)(nil),                     // 6: api.config.AclPatch
+	(*ProxyNetworkPatch)(nil),            // 7: api.config.ProxyNetworkPatch
+	(*RoutePatch)(nil),                   // 8: api.config.RoutePatch
+	(*ExitNodePatch)(nil),                // 9: api.config.ExitNodePatch
+	(*PatchConfigRequest)(nil),           // 10: api.config.PatchConfigRequest
+	(*PatchConfigResponse)(nil),          // 11: api.config.PatchConfigResponse
+	(*GetConfigRequest)(nil),             // 12: api.config.GetConfigRequest
+	(*GetConfigResponse)(nil),            // 13: api.config.GetConfigResponse
+	(*common.Ipv4Inet)(nil),              // 14: common.Ipv4Inet
+	(*common.Ipv6Inet)(nil),              // 15: common.Ipv6Inet
+	(*manage.ManagedCredentialSet)(nil),  // 16: api.manage.ManagedCredentialSet
+	(*manage.VpnPortalClientConfig)(nil), // 17: api.manage.VpnPortalClientConfig
+	(*common.PortForwardConfigPb)(nil),   // 18: common.PortForwardConfigPb
+	(*common.Url)(nil),                   // 19: common.Url
+	(*acl.Acl)(nil),                      // 20: acl.Acl
+	(*common.IpAddr)(nil),                // 21: common.IpAddr
+	(*instance.InstanceIdentifier)(nil),  // 22: api.instance.InstanceIdentifier
+	(*manage.NetworkConfig)(nil),         // 23: api.manage.NetworkConfig
 }
 var file_api_config_proto_depIdxs = []int32{
-	13, // 0: api.config.InstanceConfigPatch.ipv4:type_name -> common.Ipv4Inet
-	14, // 1: api.config.InstanceConfigPatch.ipv6:type_name -> common.Ipv6Inet
-	2,  // 2: api.config.InstanceConfigPatch.port_forwards:type_name -> api.config.PortForwardPatch
-	5,  // 3: api.config.InstanceConfigPatch.acl:type_name -> api.config.AclPatch
-	6,  // 4: api.config.InstanceConfigPatch.proxy_networks:type_name -> api.config.ProxyNetworkPatch
-	7,  // 5: api.config.InstanceConfigPatch.routes:type_name -> api.config.RoutePatch
-	8,  // 6: api.config.InstanceConfigPatch.exit_nodes:type_name -> api.config.ExitNodePatch
-	4,  // 7: api.config.InstanceConfigPatch.mapped_listeners:type_name -> api.config.UrlPatch
-	4,  // 8: api.config.InstanceConfigPatch.connectors:type_name -> api.config.UrlPatch
-	0,  // 9: api.config.PortForwardPatch.action:type_name -> api.config.ConfigPatchAction
-	15, // 10: api.config.PortForwardPatch.cfg:type_name -> common.PortForwardConfigPb
-	0,  // 11: api.config.StringPatch.action:type_name -> api.config.ConfigPatchAction
-	0,  // 12: api.config.UrlPatch.action:type_name -> api.config.ConfigPatchAction
-	16, // 13: api.config.UrlPatch.url:type_name -> common.Url
-	17, // 14: api.config.AclPatch.acl:type_name -> acl.Acl
-	3,  // 15: api.config.AclPatch.tcp_whitelist:type_name -> api.config.StringPatch
-	3,  // 16: api.config.AclPatch.udp_whitelist:type_name -> api.config.StringPatch
-	0,  // 17: api.config.ProxyNetworkPatch.action:type_name -> api.config.ConfigPatchAction
-	13, // 18: api.config.ProxyNetworkPatch.cidr:type_name -> common.Ipv4Inet
-	13, // 19: api.config.ProxyNetworkPatch.mapped_cidr:type_name -> common.Ipv4Inet
-	0,  // 20: api.config.RoutePatch.action:type_name -> api.config.ConfigPatchAction
-	13, // 21: api.config.RoutePatch.cidr:type_name -> common.Ipv4Inet
-	0,  // 22: api.config.ExitNodePatch.action:type_name -> api.config.ConfigPatchAction
-	18, // 23: api.config.ExitNodePatch.node:type_name -> common.IpAddr
-	1,  // 24: api.config.PatchConfigRequest.patch:type_name -> api.config.InstanceConfigPatch
-	19, // 25: api.config.PatchConfigRequest.instance:type_name -> api.instance.InstanceIdentifier
-	19, // 26: api.config.GetConfigRequest.instance:type_name -> api.instance.InstanceIdentifier
-	20, // 27: api.config.GetConfigResponse.config:type_name -> api.manage.NetworkConfig
-	9,  // 28: api.config.ConfigRpc.PatchConfig:input_type -> api.config.PatchConfigRequest
-	11, // 29: api.config.ConfigRpc.GetConfig:input_type -> api.config.GetConfigRequest
-	10, // 30: api.config.ConfigRpc.PatchConfig:output_type -> api.config.PatchConfigResponse
-	12, // 31: api.config.ConfigRpc.GetConfig:output_type -> api.config.GetConfigResponse
-	30, // [30:32] is the sub-list for method output_type
-	28, // [28:30] is the sub-list for method input_type
-	28, // [28:28] is the sub-list for extension type_name
-	28, // [28:28] is the sub-list for extension extendee
-	0,  // [0:28] is the sub-list for field type_name
+	14, // 0: api.config.InstanceConfigPatch.ipv4:type_name -> common.Ipv4Inet
+	15, // 1: api.config.InstanceConfigPatch.ipv6:type_name -> common.Ipv6Inet
+	3,  // 2: api.config.InstanceConfigPatch.port_forwards:type_name -> api.config.PortForwardPatch
+	6,  // 3: api.config.InstanceConfigPatch.acl:type_name -> api.config.AclPatch
+	7,  // 4: api.config.InstanceConfigPatch.proxy_networks:type_name -> api.config.ProxyNetworkPatch
+	8,  // 5: api.config.InstanceConfigPatch.routes:type_name -> api.config.RoutePatch
+	9,  // 6: api.config.InstanceConfigPatch.exit_nodes:type_name -> api.config.ExitNodePatch
+	5,  // 7: api.config.InstanceConfigPatch.mapped_listeners:type_name -> api.config.UrlPatch
+	5,  // 8: api.config.InstanceConfigPatch.connectors:type_name -> api.config.UrlPatch
+	2,  // 9: api.config.InstanceConfigPatch.vpn_portal_clients:type_name -> api.config.VpnPortalClientPatch
+	16, // 10: api.config.InstanceConfigPatch.managed_credentials:type_name -> api.manage.ManagedCredentialSet
+	0,  // 11: api.config.VpnPortalClientPatch.action:type_name -> api.config.ConfigPatchAction
+	17, // 12: api.config.VpnPortalClientPatch.client:type_name -> api.manage.VpnPortalClientConfig
+	0,  // 13: api.config.PortForwardPatch.action:type_name -> api.config.ConfigPatchAction
+	18, // 14: api.config.PortForwardPatch.cfg:type_name -> common.PortForwardConfigPb
+	0,  // 15: api.config.StringPatch.action:type_name -> api.config.ConfigPatchAction
+	0,  // 16: api.config.UrlPatch.action:type_name -> api.config.ConfigPatchAction
+	19, // 17: api.config.UrlPatch.url:type_name -> common.Url
+	20, // 18: api.config.AclPatch.acl:type_name -> acl.Acl
+	4,  // 19: api.config.AclPatch.tcp_whitelist:type_name -> api.config.StringPatch
+	4,  // 20: api.config.AclPatch.udp_whitelist:type_name -> api.config.StringPatch
+	0,  // 21: api.config.ProxyNetworkPatch.action:type_name -> api.config.ConfigPatchAction
+	14, // 22: api.config.ProxyNetworkPatch.cidr:type_name -> common.Ipv4Inet
+	14, // 23: api.config.ProxyNetworkPatch.mapped_cidr:type_name -> common.Ipv4Inet
+	0,  // 24: api.config.RoutePatch.action:type_name -> api.config.ConfigPatchAction
+	14, // 25: api.config.RoutePatch.cidr:type_name -> common.Ipv4Inet
+	0,  // 26: api.config.ExitNodePatch.action:type_name -> api.config.ConfigPatchAction
+	21, // 27: api.config.ExitNodePatch.node:type_name -> common.IpAddr
+	1,  // 28: api.config.PatchConfigRequest.patch:type_name -> api.config.InstanceConfigPatch
+	22, // 29: api.config.PatchConfigRequest.instance:type_name -> api.instance.InstanceIdentifier
+	22, // 30: api.config.GetConfigRequest.instance:type_name -> api.instance.InstanceIdentifier
+	23, // 31: api.config.GetConfigResponse.config:type_name -> api.manage.NetworkConfig
+	10, // 32: api.config.ConfigRpc.PatchConfig:input_type -> api.config.PatchConfigRequest
+	12, // 33: api.config.ConfigRpc.GetConfig:input_type -> api.config.GetConfigRequest
+	11, // 34: api.config.ConfigRpc.PatchConfig:output_type -> api.config.PatchConfigResponse
+	13, // 35: api.config.ConfigRpc.GetConfig:output_type -> api.config.GetConfigResponse
+	34, // [34:36] is the sub-list for method output_type
+	32, // [32:34] is the sub-list for method input_type
+	32, // [32:32] is the sub-list for extension type_name
+	32, // [32:32] is the sub-list for extension extendee
+	0,  // [0:32] is the sub-list for field type_name
 }
 
 func init() { file_api_config_proto_init() }
@@ -948,15 +1038,15 @@ func file_api_config_proto_init() {
 		return
 	}
 	file_api_config_proto_msgTypes[0].OneofWrappers = []any{}
-	file_api_config_proto_msgTypes[4].OneofWrappers = []any{}
 	file_api_config_proto_msgTypes[5].OneofWrappers = []any{}
+	file_api_config_proto_msgTypes[6].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_api_config_proto_rawDesc), len(file_api_config_proto_rawDesc)),
 			NumEnums:      1,
-			NumMessages:   12,
+			NumMessages:   13,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/easytier-go/proto/api/instance/api_instance.pb.go b/easytier-go/proto/api/instance/api_instance.pb.go
index 3edb88e6..e22584ba 100644
--- a/easytier-go/proto/api/instance/api_instance.pb.go
+++ b/easytier-go/proto/api/instance/api_instance.pb.go
@@ -122,6 +122,61 @@ func (ConnectorStatus) EnumDescriptor() ([]byte, []int) {
 	return file_api_instance_proto_rawDescGZIP(), []int{1}
 }
 
+type VpnPortalClientState int32
+
+const (
+	VpnPortalClientState_VPN_PORTAL_CLIENT_STATE_UNSPECIFIED VpnPortalClientState = 0
+	VpnPortalClientState_VPN_PORTAL_CLIENT_STATE_OFFLINE     VpnPortalClientState = 1
+	VpnPortalClientState_VPN_PORTAL_CLIENT_STATE_CONNECTING  VpnPortalClientState = 2
+	VpnPortalClientState_VPN_PORTAL_CLIENT_STATE_ONLINE      VpnPortalClientState = 3
+	VpnPortalClientState_VPN_PORTAL_CLIENT_STATE_ERROR       VpnPortalClientState = 4
+)
+
+// Enum value maps for VpnPortalClientState.
+var (
+	VpnPortalClientState_name = map[int32]string{
+		0: "VPN_PORTAL_CLIENT_STATE_UNSPECIFIED",
+		1: "VPN_PORTAL_CLIENT_STATE_OFFLINE",
+		2: "VPN_PORTAL_CLIENT_STATE_CONNECTING",
+		3: "VPN_PORTAL_CLIENT_STATE_ONLINE",
+		4: "VPN_PORTAL_CLIENT_STATE_ERROR",
+	}
+	VpnPortalClientState_value = map[string]int32{
+		"VPN_PORTAL_CLIENT_STATE_UNSPECIFIED": 0,
+		"VPN_PORTAL_CLIENT_STATE_OFFLINE":     1,
+		"VPN_PORTAL_CLIENT_STATE_CONNECTING":  2,
+		"VPN_PORTAL_CLIENT_STATE_ONLINE":      3,
+		"VPN_PORTAL_CLIENT_STATE_ERROR":       4,
+	}
+)
+
+func (x VpnPortalClientState) Enum() *VpnPortalClientState {
+	p := new(VpnPortalClientState)
+	*p = x
+	return p
+}
+
+func (x VpnPortalClientState) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (VpnPortalClientState) Descriptor() protoreflect.EnumDescriptor {
+	return file_api_instance_proto_enumTypes[2].Descriptor()
+}
+
+func (VpnPortalClientState) Type() protoreflect.EnumType {
+	return &file_api_instance_proto_enumTypes[2]
+}
+
+func (x VpnPortalClientState) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use VpnPortalClientState.Descriptor instead.
+func (VpnPortalClientState) EnumDescriptor() ([]byte, []int) {
+	return file_api_instance_proto_rawDescGZIP(), []int{2}
+}
+
 type TcpProxyEntryTransportType int32
 
 const (
@@ -155,11 +210,11 @@ func (x TcpProxyEntryTransportType) String() string {
 }
 
 func (TcpProxyEntryTransportType) Descriptor() protoreflect.EnumDescriptor {
-	return file_api_instance_proto_enumTypes[2].Descriptor()
+	return file_api_instance_proto_enumTypes[3].Descriptor()
 }
 
 func (TcpProxyEntryTransportType) Type() protoreflect.EnumType {
-	return &file_api_instance_proto_enumTypes[2]
+	return &file_api_instance_proto_enumTypes[3]
 }
 
 func (x TcpProxyEntryTransportType) Number() protoreflect.EnumNumber {
@@ -168,7 +223,7 @@ func (x TcpProxyEntryTransportType) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use TcpProxyEntryTransportType.Descriptor instead.
 func (TcpProxyEntryTransportType) EnumDescriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{2}
+	return file_api_instance_proto_rawDescGZIP(), []int{3}
 }
 
 type TcpProxyEntryState int32
@@ -222,11 +277,11 @@ func (x TcpProxyEntryState) String() string {
 }
 
 func (TcpProxyEntryState) Descriptor() protoreflect.EnumDescriptor {
-	return file_api_instance_proto_enumTypes[3].Descriptor()
+	return file_api_instance_proto_enumTypes[4].Descriptor()
 }
 
 func (TcpProxyEntryState) Type() protoreflect.EnumType {
-	return &file_api_instance_proto_enumTypes[3]
+	return &file_api_instance_proto_enumTypes[4]
 }
 
 func (x TcpProxyEntryState) Number() protoreflect.EnumNumber {
@@ -235,7 +290,7 @@ func (x TcpProxyEntryState) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use TcpProxyEntryState.Descriptor instead.
 func (TcpProxyEntryState) EnumDescriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{3}
+	return file_api_instance_proto_rawDescGZIP(), []int{4}
 }
 
 type InstanceIdentifier struct {
@@ -2233,18 +2288,130 @@ func (x *ListMappedListenerResponse) GetMappedlisteners() []*MappedListener {
 	return nil
 }
 
+type VpnPortalClientInfo struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	VirtualIp     string                 `protobuf:"bytes,2,opt,name=virtual_ip,json=virtualIp,proto3" json:"virtual_ip,omitempty"`
+	Groups        []string               `protobuf:"bytes,3,rep,name=groups,proto3" json:"groups,omitempty"`
+	State         VpnPortalClientState   `protobuf:"varint,4,opt,name=state,proto3,enum=api.instance.VpnPortalClientState" json:"state,omitempty"`
+	PeerId        *uint32                `protobuf:"varint,5,opt,name=peer_id,json=peerId,proto3,oneof" json:"peer_id,omitempty"`
+	Endpoint      *string                `protobuf:"bytes,6,opt,name=endpoint,proto3,oneof" json:"endpoint,omitempty"`
+	TunnelIp      *string                `protobuf:"bytes,7,opt,name=tunnel_ip,json=tunnelIp,proto3,oneof" json:"tunnel_ip,omitempty"`
+	ClientConfig  string                 `protobuf:"bytes,8,opt,name=client_config,json=clientConfig,proto3" json:"client_config,omitempty"`
+	Error         *string                `protobuf:"bytes,9,opt,name=error,proto3,oneof" json:"error,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *VpnPortalClientInfo) Reset() {
+	*x = VpnPortalClientInfo{}
+	mi := &file_api_instance_proto_msgTypes[33]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *VpnPortalClientInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*VpnPortalClientInfo) ProtoMessage() {}
+
+func (x *VpnPortalClientInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_api_instance_proto_msgTypes[33]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use VpnPortalClientInfo.ProtoReflect.Descriptor instead.
+func (*VpnPortalClientInfo) Descriptor() ([]byte, []int) {
+	return file_api_instance_proto_rawDescGZIP(), []int{33}
+}
+
+func (x *VpnPortalClientInfo) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *VpnPortalClientInfo) GetVirtualIp() string {
+	if x != nil {
+		return x.VirtualIp
+	}
+	return ""
+}
+
+func (x *VpnPortalClientInfo) GetGroups() []string {
+	if x != nil {
+		return x.Groups
+	}
+	return nil
+}
+
+func (x *VpnPortalClientInfo) GetState() VpnPortalClientState {
+	if x != nil {
+		return x.State
+	}
+	return VpnPortalClientState_VPN_PORTAL_CLIENT_STATE_UNSPECIFIED
+}
+
+func (x *VpnPortalClientInfo) GetPeerId() uint32 {
+	if x != nil && x.PeerId != nil {
+		return *x.PeerId
+	}
+	return 0
+}
+
+func (x *VpnPortalClientInfo) GetEndpoint() string {
+	if x != nil && x.Endpoint != nil {
+		return *x.Endpoint
+	}
+	return ""
+}
+
+func (x *VpnPortalClientInfo) GetTunnelIp() string {
+	if x != nil && x.TunnelIp != nil {
+		return *x.TunnelIp
+	}
+	return ""
+}
+
+func (x *VpnPortalClientInfo) GetClientConfig() string {
+	if x != nil {
+		return x.ClientConfig
+	}
+	return ""
+}
+
+func (x *VpnPortalClientInfo) GetError() string {
+	if x != nil && x.Error != nil {
+		return *x.Error
+	}
+	return ""
+}
+
 type VpnPortalInfo struct {
-	state            protoimpl.MessageState `protogen:"open.v1"`
-	VpnType          string                 `protobuf:"bytes,1,opt,name=vpn_type,json=vpnType,proto3" json:"vpn_type,omitempty"`
-	ClientConfig     string                 `protobuf:"bytes,2,opt,name=client_config,json=clientConfig,proto3" json:"client_config,omitempty"`
+	state   protoimpl.MessageState `protogen:"open.v1"`
+	VpnType string                 `protobuf:"bytes,1,opt,name=vpn_type,json=vpnType,proto3" json:"vpn_type,omitempty"`
+	// Deprecated: Marked as deprecated in api_instance.proto.
+	ClientConfig string `protobuf:"bytes,2,opt,name=client_config,json=clientConfig,proto3" json:"client_config,omitempty"`
+	// Deprecated: Marked as deprecated in api_instance.proto.
 	ConnectedClients []string               `protobuf:"bytes,3,rep,name=connected_clients,json=connectedClients,proto3" json:"connected_clients,omitempty"`
+	Clients          []*VpnPortalClientInfo `protobuf:"bytes,4,rep,name=clients,proto3" json:"clients,omitempty"`
+	Listener         *string                `protobuf:"bytes,5,opt,name=listener,proto3,oneof" json:"listener,omitempty"`
 	unknownFields    protoimpl.UnknownFields
 	sizeCache        protoimpl.SizeCache
 }
 
 func (x *VpnPortalInfo) Reset() {
 	*x = VpnPortalInfo{}
-	mi := &file_api_instance_proto_msgTypes[33]
+	mi := &file_api_instance_proto_msgTypes[34]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2256,7 +2423,7 @@ func (x *VpnPortalInfo) String() string {
 func (*VpnPortalInfo) ProtoMessage() {}
 
 func (x *VpnPortalInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[33]
+	mi := &file_api_instance_proto_msgTypes[34]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2269,7 +2436,7 @@ func (x *VpnPortalInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use VpnPortalInfo.ProtoReflect.Descriptor instead.
 func (*VpnPortalInfo) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{33}
+	return file_api_instance_proto_rawDescGZIP(), []int{34}
 }
 
 func (x *VpnPortalInfo) GetVpnType() string {
@@ -2279,6 +2446,7 @@ func (x *VpnPortalInfo) GetVpnType() string {
 	return ""
 }
 
+// Deprecated: Marked as deprecated in api_instance.proto.
 func (x *VpnPortalInfo) GetClientConfig() string {
 	if x != nil {
 		return x.ClientConfig
@@ -2286,6 +2454,7 @@ func (x *VpnPortalInfo) GetClientConfig() string {
 	return ""
 }
 
+// Deprecated: Marked as deprecated in api_instance.proto.
 func (x *VpnPortalInfo) GetConnectedClients() []string {
 	if x != nil {
 		return x.ConnectedClients
@@ -2293,6 +2462,20 @@ func (x *VpnPortalInfo) GetConnectedClients() []string {
 	return nil
 }
 
+func (x *VpnPortalInfo) GetClients() []*VpnPortalClientInfo {
+	if x != nil {
+		return x.Clients
+	}
+	return nil
+}
+
+func (x *VpnPortalInfo) GetListener() string {
+	if x != nil && x.Listener != nil {
+		return *x.Listener
+	}
+	return ""
+}
+
 type GetVpnPortalInfoRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Instance      *InstanceIdentifier    `protobuf:"bytes,1,opt,name=instance,proto3" json:"instance,omitempty"`
@@ -2302,7 +2485,7 @@ type GetVpnPortalInfoRequest struct {
 
 func (x *GetVpnPortalInfoRequest) Reset() {
 	*x = GetVpnPortalInfoRequest{}
-	mi := &file_api_instance_proto_msgTypes[34]
+	mi := &file_api_instance_proto_msgTypes[35]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2314,7 +2497,7 @@ func (x *GetVpnPortalInfoRequest) String() string {
 func (*GetVpnPortalInfoRequest) ProtoMessage() {}
 
 func (x *GetVpnPortalInfoRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[34]
+	mi := &file_api_instance_proto_msgTypes[35]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2327,7 +2510,7 @@ func (x *GetVpnPortalInfoRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetVpnPortalInfoRequest.ProtoReflect.Descriptor instead.
 func (*GetVpnPortalInfoRequest) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{34}
+	return file_api_instance_proto_rawDescGZIP(), []int{35}
 }
 
 func (x *GetVpnPortalInfoRequest) GetInstance() *InstanceIdentifier {
@@ -2346,7 +2529,7 @@ type GetVpnPortalInfoResponse struct {
 
 func (x *GetVpnPortalInfoResponse) Reset() {
 	*x = GetVpnPortalInfoResponse{}
-	mi := &file_api_instance_proto_msgTypes[35]
+	mi := &file_api_instance_proto_msgTypes[36]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2358,7 +2541,7 @@ func (x *GetVpnPortalInfoResponse) String() string {
 func (*GetVpnPortalInfoResponse) ProtoMessage() {}
 
 func (x *GetVpnPortalInfoResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[35]
+	mi := &file_api_instance_proto_msgTypes[36]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2371,7 +2554,7 @@ func (x *GetVpnPortalInfoResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetVpnPortalInfoResponse.ProtoReflect.Descriptor instead.
 func (*GetVpnPortalInfoResponse) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{35}
+	return file_api_instance_proto_rawDescGZIP(), []int{36}
 }
 
 func (x *GetVpnPortalInfoResponse) GetVpnPortalInfo() *VpnPortalInfo {
@@ -2394,7 +2577,7 @@ type TcpProxyEntry struct {
 
 func (x *TcpProxyEntry) Reset() {
 	*x = TcpProxyEntry{}
-	mi := &file_api_instance_proto_msgTypes[36]
+	mi := &file_api_instance_proto_msgTypes[37]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2406,7 +2589,7 @@ func (x *TcpProxyEntry) String() string {
 func (*TcpProxyEntry) ProtoMessage() {}
 
 func (x *TcpProxyEntry) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[36]
+	mi := &file_api_instance_proto_msgTypes[37]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2419,7 +2602,7 @@ func (x *TcpProxyEntry) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TcpProxyEntry.ProtoReflect.Descriptor instead.
 func (*TcpProxyEntry) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{36}
+	return file_api_instance_proto_rawDescGZIP(), []int{37}
 }
 
 func (x *TcpProxyEntry) GetSrc() *common.SocketAddr {
@@ -2466,7 +2649,7 @@ type ListTcpProxyEntryRequest struct {
 
 func (x *ListTcpProxyEntryRequest) Reset() {
 	*x = ListTcpProxyEntryRequest{}
-	mi := &file_api_instance_proto_msgTypes[37]
+	mi := &file_api_instance_proto_msgTypes[38]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2478,7 +2661,7 @@ func (x *ListTcpProxyEntryRequest) String() string {
 func (*ListTcpProxyEntryRequest) ProtoMessage() {}
 
 func (x *ListTcpProxyEntryRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[37]
+	mi := &file_api_instance_proto_msgTypes[38]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2491,7 +2674,7 @@ func (x *ListTcpProxyEntryRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListTcpProxyEntryRequest.ProtoReflect.Descriptor instead.
 func (*ListTcpProxyEntryRequest) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{37}
+	return file_api_instance_proto_rawDescGZIP(), []int{38}
 }
 
 func (x *ListTcpProxyEntryRequest) GetInstance() *InstanceIdentifier {
@@ -2510,7 +2693,7 @@ type ListTcpProxyEntryResponse struct {
 
 func (x *ListTcpProxyEntryResponse) Reset() {
 	*x = ListTcpProxyEntryResponse{}
-	mi := &file_api_instance_proto_msgTypes[38]
+	mi := &file_api_instance_proto_msgTypes[39]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2522,7 +2705,7 @@ func (x *ListTcpProxyEntryResponse) String() string {
 func (*ListTcpProxyEntryResponse) ProtoMessage() {}
 
 func (x *ListTcpProxyEntryResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[38]
+	mi := &file_api_instance_proto_msgTypes[39]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2535,7 +2718,7 @@ func (x *ListTcpProxyEntryResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListTcpProxyEntryResponse.ProtoReflect.Descriptor instead.
 func (*ListTcpProxyEntryResponse) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{38}
+	return file_api_instance_proto_rawDescGZIP(), []int{39}
 }
 
 func (x *ListTcpProxyEntryResponse) GetEntries() []*TcpProxyEntry {
@@ -2554,7 +2737,7 @@ type GetAclStatsRequest struct {
 
 func (x *GetAclStatsRequest) Reset() {
 	*x = GetAclStatsRequest{}
-	mi := &file_api_instance_proto_msgTypes[39]
+	mi := &file_api_instance_proto_msgTypes[40]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2566,7 +2749,7 @@ func (x *GetAclStatsRequest) String() string {
 func (*GetAclStatsRequest) ProtoMessage() {}
 
 func (x *GetAclStatsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[39]
+	mi := &file_api_instance_proto_msgTypes[40]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2579,7 +2762,7 @@ func (x *GetAclStatsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetAclStatsRequest.ProtoReflect.Descriptor instead.
 func (*GetAclStatsRequest) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{39}
+	return file_api_instance_proto_rawDescGZIP(), []int{40}
 }
 
 func (x *GetAclStatsRequest) GetInstance() *InstanceIdentifier {
@@ -2598,7 +2781,7 @@ type GetAclStatsResponse struct {
 
 func (x *GetAclStatsResponse) Reset() {
 	*x = GetAclStatsResponse{}
-	mi := &file_api_instance_proto_msgTypes[40]
+	mi := &file_api_instance_proto_msgTypes[41]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2610,7 +2793,7 @@ func (x *GetAclStatsResponse) String() string {
 func (*GetAclStatsResponse) ProtoMessage() {}
 
 func (x *GetAclStatsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[40]
+	mi := &file_api_instance_proto_msgTypes[41]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2623,7 +2806,7 @@ func (x *GetAclStatsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetAclStatsResponse.ProtoReflect.Descriptor instead.
 func (*GetAclStatsResponse) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{40}
+	return file_api_instance_proto_rawDescGZIP(), []int{41}
 }
 
 func (x *GetAclStatsResponse) GetAclStats() *acl.AclStats {
@@ -2642,7 +2825,7 @@ type GetWhitelistRequest struct {
 
 func (x *GetWhitelistRequest) Reset() {
 	*x = GetWhitelistRequest{}
-	mi := &file_api_instance_proto_msgTypes[41]
+	mi := &file_api_instance_proto_msgTypes[42]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2654,7 +2837,7 @@ func (x *GetWhitelistRequest) String() string {
 func (*GetWhitelistRequest) ProtoMessage() {}
 
 func (x *GetWhitelistRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[41]
+	mi := &file_api_instance_proto_msgTypes[42]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2667,7 +2850,7 @@ func (x *GetWhitelistRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetWhitelistRequest.ProtoReflect.Descriptor instead.
 func (*GetWhitelistRequest) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{41}
+	return file_api_instance_proto_rawDescGZIP(), []int{42}
 }
 
 func (x *GetWhitelistRequest) GetInstance() *InstanceIdentifier {
@@ -2687,7 +2870,7 @@ type GetWhitelistResponse struct {
 
 func (x *GetWhitelistResponse) Reset() {
 	*x = GetWhitelistResponse{}
-	mi := &file_api_instance_proto_msgTypes[42]
+	mi := &file_api_instance_proto_msgTypes[43]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2699,7 +2882,7 @@ func (x *GetWhitelistResponse) String() string {
 func (*GetWhitelistResponse) ProtoMessage() {}
 
 func (x *GetWhitelistResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[42]
+	mi := &file_api_instance_proto_msgTypes[43]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2712,7 +2895,7 @@ func (x *GetWhitelistResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetWhitelistResponse.ProtoReflect.Descriptor instead.
 func (*GetWhitelistResponse) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{42}
+	return file_api_instance_proto_rawDescGZIP(), []int{43}
 }
 
 func (x *GetWhitelistResponse) GetTcpPorts() []string {
@@ -2738,7 +2921,7 @@ type ListPortForwardRequest struct {
 
 func (x *ListPortForwardRequest) Reset() {
 	*x = ListPortForwardRequest{}
-	mi := &file_api_instance_proto_msgTypes[43]
+	mi := &file_api_instance_proto_msgTypes[44]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2750,7 +2933,7 @@ func (x *ListPortForwardRequest) String() string {
 func (*ListPortForwardRequest) ProtoMessage() {}
 
 func (x *ListPortForwardRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[43]
+	mi := &file_api_instance_proto_msgTypes[44]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2763,7 +2946,7 @@ func (x *ListPortForwardRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListPortForwardRequest.ProtoReflect.Descriptor instead.
 func (*ListPortForwardRequest) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{43}
+	return file_api_instance_proto_rawDescGZIP(), []int{44}
 }
 
 func (x *ListPortForwardRequest) GetInstance() *InstanceIdentifier {
@@ -2782,7 +2965,7 @@ type ListPortForwardResponse struct {
 
 func (x *ListPortForwardResponse) Reset() {
 	*x = ListPortForwardResponse{}
-	mi := &file_api_instance_proto_msgTypes[44]
+	mi := &file_api_instance_proto_msgTypes[45]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2794,7 +2977,7 @@ func (x *ListPortForwardResponse) String() string {
 func (*ListPortForwardResponse) ProtoMessage() {}
 
 func (x *ListPortForwardResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[44]
+	mi := &file_api_instance_proto_msgTypes[45]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2807,7 +2990,7 @@ func (x *ListPortForwardResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListPortForwardResponse.ProtoReflect.Descriptor instead.
 func (*ListPortForwardResponse) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{44}
+	return file_api_instance_proto_rawDescGZIP(), []int{45}
 }
 
 func (x *ListPortForwardResponse) GetCfgs() []*common.PortForwardConfigPb {
@@ -2828,7 +3011,7 @@ type MetricSnapshot struct {
 
 func (x *MetricSnapshot) Reset() {
 	*x = MetricSnapshot{}
-	mi := &file_api_instance_proto_msgTypes[45]
+	mi := &file_api_instance_proto_msgTypes[46]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2840,7 +3023,7 @@ func (x *MetricSnapshot) String() string {
 func (*MetricSnapshot) ProtoMessage() {}
 
 func (x *MetricSnapshot) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[45]
+	mi := &file_api_instance_proto_msgTypes[46]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2853,7 +3036,7 @@ func (x *MetricSnapshot) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MetricSnapshot.ProtoReflect.Descriptor instead.
 func (*MetricSnapshot) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{45}
+	return file_api_instance_proto_rawDescGZIP(), []int{46}
 }
 
 func (x *MetricSnapshot) GetName() string {
@@ -2886,7 +3069,7 @@ type GetStatsRequest struct {
 
 func (x *GetStatsRequest) Reset() {
 	*x = GetStatsRequest{}
-	mi := &file_api_instance_proto_msgTypes[46]
+	mi := &file_api_instance_proto_msgTypes[47]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2898,7 +3081,7 @@ func (x *GetStatsRequest) String() string {
 func (*GetStatsRequest) ProtoMessage() {}
 
 func (x *GetStatsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[46]
+	mi := &file_api_instance_proto_msgTypes[47]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2911,7 +3094,7 @@ func (x *GetStatsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetStatsRequest.ProtoReflect.Descriptor instead.
 func (*GetStatsRequest) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{46}
+	return file_api_instance_proto_rawDescGZIP(), []int{47}
 }
 
 func (x *GetStatsRequest) GetInstance() *InstanceIdentifier {
@@ -2930,7 +3113,7 @@ type GetStatsResponse struct {
 
 func (x *GetStatsResponse) Reset() {
 	*x = GetStatsResponse{}
-	mi := &file_api_instance_proto_msgTypes[47]
+	mi := &file_api_instance_proto_msgTypes[48]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2942,7 +3125,7 @@ func (x *GetStatsResponse) String() string {
 func (*GetStatsResponse) ProtoMessage() {}
 
 func (x *GetStatsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[47]
+	mi := &file_api_instance_proto_msgTypes[48]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2955,7 +3138,7 @@ func (x *GetStatsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetStatsResponse.ProtoReflect.Descriptor instead.
 func (*GetStatsResponse) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{47}
+	return file_api_instance_proto_rawDescGZIP(), []int{48}
 }
 
 func (x *GetStatsResponse) GetMetrics() []*MetricSnapshot {
@@ -2974,7 +3157,7 @@ type GetPrometheusStatsRequest struct {
 
 func (x *GetPrometheusStatsRequest) Reset() {
 	*x = GetPrometheusStatsRequest{}
-	mi := &file_api_instance_proto_msgTypes[48]
+	mi := &file_api_instance_proto_msgTypes[49]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2986,7 +3169,7 @@ func (x *GetPrometheusStatsRequest) String() string {
 func (*GetPrometheusStatsRequest) ProtoMessage() {}
 
 func (x *GetPrometheusStatsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[48]
+	mi := &file_api_instance_proto_msgTypes[49]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2999,7 +3182,7 @@ func (x *GetPrometheusStatsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetPrometheusStatsRequest.ProtoReflect.Descriptor instead.
 func (*GetPrometheusStatsRequest) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{48}
+	return file_api_instance_proto_rawDescGZIP(), []int{49}
 }
 
 func (x *GetPrometheusStatsRequest) GetInstance() *InstanceIdentifier {
@@ -3018,7 +3201,7 @@ type GetPrometheusStatsResponse struct {
 
 func (x *GetPrometheusStatsResponse) Reset() {
 	*x = GetPrometheusStatsResponse{}
-	mi := &file_api_instance_proto_msgTypes[49]
+	mi := &file_api_instance_proto_msgTypes[50]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3030,7 +3213,7 @@ func (x *GetPrometheusStatsResponse) String() string {
 func (*GetPrometheusStatsResponse) ProtoMessage() {}
 
 func (x *GetPrometheusStatsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[49]
+	mi := &file_api_instance_proto_msgTypes[50]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3043,7 +3226,7 @@ func (x *GetPrometheusStatsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetPrometheusStatsResponse.ProtoReflect.Descriptor instead.
 func (*GetPrometheusStatsResponse) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{49}
+	return file_api_instance_proto_rawDescGZIP(), []int{50}
 }
 
 func (x *GetPrometheusStatsResponse) GetPrometheusText() string {
@@ -3068,7 +3251,7 @@ type GenerateCredentialRequest struct {
 
 func (x *GenerateCredentialRequest) Reset() {
 	*x = GenerateCredentialRequest{}
-	mi := &file_api_instance_proto_msgTypes[50]
+	mi := &file_api_instance_proto_msgTypes[51]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3080,7 +3263,7 @@ func (x *GenerateCredentialRequest) String() string {
 func (*GenerateCredentialRequest) ProtoMessage() {}
 
 func (x *GenerateCredentialRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[50]
+	mi := &file_api_instance_proto_msgTypes[51]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3093,7 +3276,7 @@ func (x *GenerateCredentialRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GenerateCredentialRequest.ProtoReflect.Descriptor instead.
 func (*GenerateCredentialRequest) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{50}
+	return file_api_instance_proto_rawDescGZIP(), []int{51}
 }
 
 func (x *GenerateCredentialRequest) GetGroups() []string {
@@ -3149,13 +3332,14 @@ type GenerateCredentialResponse struct {
 	state            protoimpl.MessageState `protogen:"open.v1"`
 	CredentialId     string                 `protobuf:"bytes,1,opt,name=credential_id,json=credentialId,proto3" json:"credential_id,omitempty"`             // UUID
 	CredentialSecret string                 `protobuf:"bytes,2,opt,name=credential_secret,json=credentialSecret,proto3" json:"credential_secret,omitempty"` // private key base64
+	ExpiryUnix       int64                  `protobuf:"varint,3,opt,name=expiry_unix,json=expiryUnix,proto3" json:"expiry_unix,omitempty"`
 	unknownFields    protoimpl.UnknownFields
 	sizeCache        protoimpl.SizeCache
 }
 
 func (x *GenerateCredentialResponse) Reset() {
 	*x = GenerateCredentialResponse{}
-	mi := &file_api_instance_proto_msgTypes[51]
+	mi := &file_api_instance_proto_msgTypes[52]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3167,7 +3351,7 @@ func (x *GenerateCredentialResponse) String() string {
 func (*GenerateCredentialResponse) ProtoMessage() {}
 
 func (x *GenerateCredentialResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[51]
+	mi := &file_api_instance_proto_msgTypes[52]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3180,7 +3364,7 @@ func (x *GenerateCredentialResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GenerateCredentialResponse.ProtoReflect.Descriptor instead.
 func (*GenerateCredentialResponse) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{51}
+	return file_api_instance_proto_rawDescGZIP(), []int{52}
 }
 
 func (x *GenerateCredentialResponse) GetCredentialId() string {
@@ -3197,6 +3381,157 @@ func (x *GenerateCredentialResponse) GetCredentialSecret() string {
 	return ""
 }
 
+func (x *GenerateCredentialResponse) GetExpiryUnix() int64 {
+	if x != nil {
+		return x.ExpiryUnix
+	}
+	return 0
+}
+
+type UpsertCredentialRequest struct {
+	state             protoimpl.MessageState `protogen:"open.v1"`
+	CredentialId      string                 `protobuf:"bytes,1,opt,name=credential_id,json=credentialId,proto3" json:"credential_id,omitempty"`
+	CredentialSecret  string                 `protobuf:"bytes,2,opt,name=credential_secret,json=credentialSecret,proto3" json:"credential_secret,omitempty"`
+	Groups            []string               `protobuf:"bytes,3,rep,name=groups,proto3" json:"groups,omitempty"`
+	AllowRelay        bool                   `protobuf:"varint,4,opt,name=allow_relay,json=allowRelay,proto3" json:"allow_relay,omitempty"`
+	AllowedProxyCidrs []string               `protobuf:"bytes,5,rep,name=allowed_proxy_cidrs,json=allowedProxyCidrs,proto3" json:"allowed_proxy_cidrs,omitempty"`
+	ExpiryUnix        int64                  `protobuf:"varint,6,opt,name=expiry_unix,json=expiryUnix,proto3" json:"expiry_unix,omitempty"`
+	Reusable          *bool                  `protobuf:"varint,7,opt,name=reusable,proto3,oneof" json:"reusable,omitempty"`
+	Instance          *InstanceIdentifier    `protobuf:"bytes,8,opt,name=instance,proto3" json:"instance,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
+}
+
+func (x *UpsertCredentialRequest) Reset() {
+	*x = UpsertCredentialRequest{}
+	mi := &file_api_instance_proto_msgTypes[53]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpsertCredentialRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpsertCredentialRequest) ProtoMessage() {}
+
+func (x *UpsertCredentialRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_instance_proto_msgTypes[53]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpsertCredentialRequest.ProtoReflect.Descriptor instead.
+func (*UpsertCredentialRequest) Descriptor() ([]byte, []int) {
+	return file_api_instance_proto_rawDescGZIP(), []int{53}
+}
+
+func (x *UpsertCredentialRequest) GetCredentialId() string {
+	if x != nil {
+		return x.CredentialId
+	}
+	return ""
+}
+
+func (x *UpsertCredentialRequest) GetCredentialSecret() string {
+	if x != nil {
+		return x.CredentialSecret
+	}
+	return ""
+}
+
+func (x *UpsertCredentialRequest) GetGroups() []string {
+	if x != nil {
+		return x.Groups
+	}
+	return nil
+}
+
+func (x *UpsertCredentialRequest) GetAllowRelay() bool {
+	if x != nil {
+		return x.AllowRelay
+	}
+	return false
+}
+
+func (x *UpsertCredentialRequest) GetAllowedProxyCidrs() []string {
+	if x != nil {
+		return x.AllowedProxyCidrs
+	}
+	return nil
+}
+
+func (x *UpsertCredentialRequest) GetExpiryUnix() int64 {
+	if x != nil {
+		return x.ExpiryUnix
+	}
+	return 0
+}
+
+func (x *UpsertCredentialRequest) GetReusable() bool {
+	if x != nil && x.Reusable != nil {
+		return *x.Reusable
+	}
+	return false
+}
+
+func (x *UpsertCredentialRequest) GetInstance() *InstanceIdentifier {
+	if x != nil {
+		return x.Instance
+	}
+	return nil
+}
+
+type UpsertCredentialResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Changed       bool                   `protobuf:"varint,1,opt,name=changed,proto3" json:"changed,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpsertCredentialResponse) Reset() {
+	*x = UpsertCredentialResponse{}
+	mi := &file_api_instance_proto_msgTypes[54]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpsertCredentialResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpsertCredentialResponse) ProtoMessage() {}
+
+func (x *UpsertCredentialResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_api_instance_proto_msgTypes[54]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpsertCredentialResponse.ProtoReflect.Descriptor instead.
+func (*UpsertCredentialResponse) Descriptor() ([]byte, []int) {
+	return file_api_instance_proto_rawDescGZIP(), []int{54}
+}
+
+func (x *UpsertCredentialResponse) GetChanged() bool {
+	if x != nil {
+		return x.Changed
+	}
+	return false
+}
+
 type RevokeCredentialRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	CredentialId  string                 `protobuf:"bytes,1,opt,name=credential_id,json=credentialId,proto3" json:"credential_id,omitempty"`
@@ -3207,7 +3542,7 @@ type RevokeCredentialRequest struct {
 
 func (x *RevokeCredentialRequest) Reset() {
 	*x = RevokeCredentialRequest{}
-	mi := &file_api_instance_proto_msgTypes[52]
+	mi := &file_api_instance_proto_msgTypes[55]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3219,7 +3554,7 @@ func (x *RevokeCredentialRequest) String() string {
 func (*RevokeCredentialRequest) ProtoMessage() {}
 
 func (x *RevokeCredentialRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[52]
+	mi := &file_api_instance_proto_msgTypes[55]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3232,7 +3567,7 @@ func (x *RevokeCredentialRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RevokeCredentialRequest.ProtoReflect.Descriptor instead.
 func (*RevokeCredentialRequest) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{52}
+	return file_api_instance_proto_rawDescGZIP(), []int{55}
 }
 
 func (x *RevokeCredentialRequest) GetCredentialId() string {
@@ -3258,7 +3593,7 @@ type RevokeCredentialResponse struct {
 
 func (x *RevokeCredentialResponse) Reset() {
 	*x = RevokeCredentialResponse{}
-	mi := &file_api_instance_proto_msgTypes[53]
+	mi := &file_api_instance_proto_msgTypes[56]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3270,7 +3605,7 @@ func (x *RevokeCredentialResponse) String() string {
 func (*RevokeCredentialResponse) ProtoMessage() {}
 
 func (x *RevokeCredentialResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[53]
+	mi := &file_api_instance_proto_msgTypes[56]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3283,7 +3618,7 @@ func (x *RevokeCredentialResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RevokeCredentialResponse.ProtoReflect.Descriptor instead.
 func (*RevokeCredentialResponse) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{53}
+	return file_api_instance_proto_rawDescGZIP(), []int{56}
 }
 
 func (x *RevokeCredentialResponse) GetSuccess() bool {
@@ -3302,7 +3637,7 @@ type ListCredentialsRequest struct {
 
 func (x *ListCredentialsRequest) Reset() {
 	*x = ListCredentialsRequest{}
-	mi := &file_api_instance_proto_msgTypes[54]
+	mi := &file_api_instance_proto_msgTypes[57]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3314,7 +3649,7 @@ func (x *ListCredentialsRequest) String() string {
 func (*ListCredentialsRequest) ProtoMessage() {}
 
 func (x *ListCredentialsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[54]
+	mi := &file_api_instance_proto_msgTypes[57]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3327,7 +3662,7 @@ func (x *ListCredentialsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListCredentialsRequest.ProtoReflect.Descriptor instead.
 func (*ListCredentialsRequest) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{54}
+	return file_api_instance_proto_rawDescGZIP(), []int{57}
 }
 
 func (x *ListCredentialsRequest) GetInstance() *InstanceIdentifier {
@@ -3338,20 +3673,21 @@ func (x *ListCredentialsRequest) GetInstance() *InstanceIdentifier {
 }
 
 type CredentialInfo struct {
-	state             protoimpl.MessageState `protogen:"open.v1"`
-	CredentialId      string                 `protobuf:"bytes,1,opt,name=credential_id,json=credentialId,proto3" json:"credential_id,omitempty"` // UUID
-	Groups            []string               `protobuf:"bytes,2,rep,name=groups,proto3" json:"groups,omitempty"`
-	AllowRelay        bool                   `protobuf:"varint,3,opt,name=allow_relay,json=allowRelay,proto3" json:"allow_relay,omitempty"`
-	ExpiryUnix        int64                  `protobuf:"varint,4,opt,name=expiry_unix,json=expiryUnix,proto3" json:"expiry_unix,omitempty"`
-	AllowedProxyCidrs []string               `protobuf:"bytes,5,rep,name=allowed_proxy_cidrs,json=allowedProxyCidrs,proto3" json:"allowed_proxy_cidrs,omitempty"`
-	Reusable          *bool                  `protobuf:"varint,6,opt,name=reusable,proto3,oneof" json:"reusable,omitempty"`
-	unknownFields     protoimpl.UnknownFields
-	sizeCache         protoimpl.SizeCache
+	state                protoimpl.MessageState `protogen:"open.v1"`
+	CredentialId         string                 `protobuf:"bytes,1,opt,name=credential_id,json=credentialId,proto3" json:"credential_id,omitempty"` // UUID
+	Groups               []string               `protobuf:"bytes,2,rep,name=groups,proto3" json:"groups,omitempty"`
+	AllowRelay           bool                   `protobuf:"varint,3,opt,name=allow_relay,json=allowRelay,proto3" json:"allow_relay,omitempty"`
+	ExpiryUnix           int64                  `protobuf:"varint,4,opt,name=expiry_unix,json=expiryUnix,proto3" json:"expiry_unix,omitempty"`
+	AllowedProxyCidrs    []string               `protobuf:"bytes,5,rep,name=allowed_proxy_cidrs,json=allowedProxyCidrs,proto3" json:"allowed_proxy_cidrs,omitempty"`
+	Reusable             *bool                  `protobuf:"varint,6,opt,name=reusable,proto3,oneof" json:"reusable,omitempty"`
+	PublicKeyFingerprint string                 `protobuf:"bytes,7,opt,name=public_key_fingerprint,json=publicKeyFingerprint,proto3" json:"public_key_fingerprint,omitempty"`
+	unknownFields        protoimpl.UnknownFields
+	sizeCache            protoimpl.SizeCache
 }
 
 func (x *CredentialInfo) Reset() {
 	*x = CredentialInfo{}
-	mi := &file_api_instance_proto_msgTypes[55]
+	mi := &file_api_instance_proto_msgTypes[58]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3363,7 +3699,7 @@ func (x *CredentialInfo) String() string {
 func (*CredentialInfo) ProtoMessage() {}
 
 func (x *CredentialInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[55]
+	mi := &file_api_instance_proto_msgTypes[58]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3376,7 +3712,7 @@ func (x *CredentialInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CredentialInfo.ProtoReflect.Descriptor instead.
 func (*CredentialInfo) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{55}
+	return file_api_instance_proto_rawDescGZIP(), []int{58}
 }
 
 func (x *CredentialInfo) GetCredentialId() string {
@@ -3421,6 +3757,13 @@ func (x *CredentialInfo) GetReusable() bool {
 	return false
 }
 
+func (x *CredentialInfo) GetPublicKeyFingerprint() string {
+	if x != nil {
+		return x.PublicKeyFingerprint
+	}
+	return ""
+}
+
 type ListCredentialsResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Credentials   []*CredentialInfo      `protobuf:"bytes,1,rep,name=credentials,proto3" json:"credentials,omitempty"`
@@ -3430,7 +3773,7 @@ type ListCredentialsResponse struct {
 
 func (x *ListCredentialsResponse) Reset() {
 	*x = ListCredentialsResponse{}
-	mi := &file_api_instance_proto_msgTypes[56]
+	mi := &file_api_instance_proto_msgTypes[59]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3442,7 +3785,7 @@ func (x *ListCredentialsResponse) String() string {
 func (*ListCredentialsResponse) ProtoMessage() {}
 
 func (x *ListCredentialsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[56]
+	mi := &file_api_instance_proto_msgTypes[59]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3455,7 +3798,7 @@ func (x *ListCredentialsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListCredentialsResponse.ProtoReflect.Descriptor instead.
 func (*ListCredentialsResponse) Descriptor() ([]byte, []int) {
-	return file_api_instance_proto_rawDescGZIP(), []int{56}
+	return file_api_instance_proto_rawDescGZIP(), []int{59}
 }
 
 func (x *ListCredentialsResponse) GetCredentials() []*CredentialInfo {
@@ -3474,7 +3817,7 @@ type InstanceIdentifier_InstanceSelector struct {
 
 func (x *InstanceIdentifier_InstanceSelector) Reset() {
 	*x = InstanceIdentifier_InstanceSelector{}
-	mi := &file_api_instance_proto_msgTypes[57]
+	mi := &file_api_instance_proto_msgTypes[60]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3486,7 +3829,7 @@ func (x *InstanceIdentifier_InstanceSelector) String() string {
 func (*InstanceIdentifier_InstanceSelector) ProtoMessage() {}
 
 func (x *InstanceIdentifier_InstanceSelector) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[57]
+	mi := &file_api_instance_proto_msgTypes[60]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3522,7 +3865,7 @@ type ListGlobalForeignNetworkResponse_OneForeignNetwork struct {
 
 func (x *ListGlobalForeignNetworkResponse_OneForeignNetwork) Reset() {
 	*x = ListGlobalForeignNetworkResponse_OneForeignNetwork{}
-	mi := &file_api_instance_proto_msgTypes[59]
+	mi := &file_api_instance_proto_msgTypes[62]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3534,7 +3877,7 @@ func (x *ListGlobalForeignNetworkResponse_OneForeignNetwork) String() string {
 func (*ListGlobalForeignNetworkResponse_OneForeignNetwork) ProtoMessage() {}
 
 func (x *ListGlobalForeignNetworkResponse_OneForeignNetwork) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[59]
+	mi := &file_api_instance_proto_msgTypes[62]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3587,7 +3930,7 @@ type ListGlobalForeignNetworkResponse_ForeignNetworks struct {
 
 func (x *ListGlobalForeignNetworkResponse_ForeignNetworks) Reset() {
 	*x = ListGlobalForeignNetworkResponse_ForeignNetworks{}
-	mi := &file_api_instance_proto_msgTypes[60]
+	mi := &file_api_instance_proto_msgTypes[63]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3599,7 +3942,7 @@ func (x *ListGlobalForeignNetworkResponse_ForeignNetworks) String() string {
 func (*ListGlobalForeignNetworkResponse_ForeignNetworks) ProtoMessage() {}
 
 func (x *ListGlobalForeignNetworkResponse_ForeignNetworks) ProtoReflect() protoreflect.Message {
-	mi := &file_api_instance_proto_msgTypes[60]
+	mi := &file_api_instance_proto_msgTypes[63]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3792,11 +4135,31 @@ const file_api_instance_proto_rawDesc = "" +
 	"\x19ListMappedListenerRequest\x12<\n" +
 	"\binstance\x18\x01 \x01(\v2 .api.instance.InstanceIdentifierR\binstance\"d\n" +
 	"\x1aListMappedListenerResponse\x12F\n" +
-	"\x0fmappedlisteners\x18\x01 \x03(\v2\x1c.api.instance.MappedListenerR\x0fmappedlisteners\"|\n" +
+	"\x0fmappedlisteners\x18\x01 \x03(\v2\x1c.api.instance.MappedListenerR\x0fmappedlisteners\"\xec\x02\n" +
+	"\x13VpnPortalClientInfo\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1d\n" +
+	"\n" +
+	"virtual_ip\x18\x02 \x01(\tR\tvirtualIp\x12\x16\n" +
+	"\x06groups\x18\x03 \x03(\tR\x06groups\x128\n" +
+	"\x05state\x18\x04 \x01(\x0e2\".api.instance.VpnPortalClientStateR\x05state\x12\x1c\n" +
+	"\apeer_id\x18\x05 \x01(\rH\x00R\x06peerId\x88\x01\x01\x12\x1f\n" +
+	"\bendpoint\x18\x06 \x01(\tH\x01R\bendpoint\x88\x01\x01\x12 \n" +
+	"\ttunnel_ip\x18\a \x01(\tH\x02R\btunnelIp\x88\x01\x01\x12#\n" +
+	"\rclient_config\x18\b \x01(\tR\fclientConfig\x12\x19\n" +
+	"\x05error\x18\t \x01(\tH\x03R\x05error\x88\x01\x01B\n" +
+	"\n" +
+	"\b_peer_idB\v\n" +
+	"\t_endpointB\f\n" +
+	"\n" +
+	"_tunnel_ipB\b\n" +
+	"\x06_error\"\xef\x01\n" +
 	"\rVpnPortalInfo\x12\x19\n" +
-	"\bvpn_type\x18\x01 \x01(\tR\avpnType\x12#\n" +
-	"\rclient_config\x18\x02 \x01(\tR\fclientConfig\x12+\n" +
-	"\x11connected_clients\x18\x03 \x03(\tR\x10connectedClients\"W\n" +
+	"\bvpn_type\x18\x01 \x01(\tR\avpnType\x12'\n" +
+	"\rclient_config\x18\x02 \x01(\tB\x02\x18\x01R\fclientConfig\x12/\n" +
+	"\x11connected_clients\x18\x03 \x03(\tB\x02\x18\x01R\x10connectedClients\x12;\n" +
+	"\aclients\x18\x04 \x03(\v2!.api.instance.VpnPortalClientInfoR\aclients\x12\x1f\n" +
+	"\blistener\x18\x05 \x01(\tH\x00R\blistener\x88\x01\x01B\v\n" +
+	"\t_listener\"W\n" +
 	"\x17GetVpnPortalInfoRequest\x12<\n" +
 	"\binstance\x18\x01 \x01(\v2 .api.instance.InstanceIdentifierR\binstance\"_\n" +
 	"\x18GetVpnPortalInfoResponse\x12C\n" +
@@ -3851,17 +4214,33 @@ const file_api_instance_proto_rawDesc = "" +
 	"\binstance\x18\x06 \x01(\v2 .api.instance.InstanceIdentifierR\binstance\x12\x1f\n" +
 	"\breusable\x18\a \x01(\bH\x01R\breusable\x88\x01\x01B\x10\n" +
 	"\x0e_credential_idB\v\n" +
-	"\t_reusable\"n\n" +
+	"\t_reusable\"\x8f\x01\n" +
 	"\x1aGenerateCredentialResponse\x12#\n" +
 	"\rcredential_id\x18\x01 \x01(\tR\fcredentialId\x12+\n" +
-	"\x11credential_secret\x18\x02 \x01(\tR\x10credentialSecret\"|\n" +
+	"\x11credential_secret\x18\x02 \x01(\tR\x10credentialSecret\x12\x1f\n" +
+	"\vexpiry_unix\x18\x03 \x01(\x03R\n" +
+	"expiryUnix\"\xe1\x02\n" +
+	"\x17UpsertCredentialRequest\x12#\n" +
+	"\rcredential_id\x18\x01 \x01(\tR\fcredentialId\x12+\n" +
+	"\x11credential_secret\x18\x02 \x01(\tR\x10credentialSecret\x12\x16\n" +
+	"\x06groups\x18\x03 \x03(\tR\x06groups\x12\x1f\n" +
+	"\vallow_relay\x18\x04 \x01(\bR\n" +
+	"allowRelay\x12.\n" +
+	"\x13allowed_proxy_cidrs\x18\x05 \x03(\tR\x11allowedProxyCidrs\x12\x1f\n" +
+	"\vexpiry_unix\x18\x06 \x01(\x03R\n" +
+	"expiryUnix\x12\x1f\n" +
+	"\breusable\x18\a \x01(\bH\x00R\breusable\x88\x01\x01\x12<\n" +
+	"\binstance\x18\b \x01(\v2 .api.instance.InstanceIdentifierR\binstanceB\v\n" +
+	"\t_reusable\"4\n" +
+	"\x18UpsertCredentialResponse\x12\x18\n" +
+	"\achanged\x18\x01 \x01(\bR\achanged\"|\n" +
 	"\x17RevokeCredentialRequest\x12#\n" +
 	"\rcredential_id\x18\x01 \x01(\tR\fcredentialId\x12<\n" +
 	"\binstance\x18\x02 \x01(\v2 .api.instance.InstanceIdentifierR\binstance\"4\n" +
 	"\x18RevokeCredentialResponse\x12\x18\n" +
 	"\asuccess\x18\x01 \x01(\bR\asuccess\"V\n" +
 	"\x16ListCredentialsRequest\x12<\n" +
-	"\binstance\x18\x01 \x01(\v2 .api.instance.InstanceIdentifierR\binstance\"\xed\x01\n" +
+	"\binstance\x18\x01 \x01(\v2 .api.instance.InstanceIdentifierR\binstance\"\xa3\x02\n" +
 	"\x0eCredentialInfo\x12#\n" +
 	"\rcredential_id\x18\x01 \x01(\tR\fcredentialId\x12\x16\n" +
 	"\x06groups\x18\x02 \x03(\tR\x06groups\x12\x1f\n" +
@@ -3870,7 +4249,8 @@ const file_api_instance_proto_rawDesc = "" +
 	"\vexpiry_unix\x18\x04 \x01(\x03R\n" +
 	"expiryUnix\x12.\n" +
 	"\x13allowed_proxy_cidrs\x18\x05 \x03(\tR\x11allowedProxyCidrs\x12\x1f\n" +
-	"\breusable\x18\x06 \x01(\bH\x00R\breusable\x88\x01\x01B\v\n" +
+	"\breusable\x18\x06 \x01(\bH\x00R\breusable\x88\x01\x01\x124\n" +
+	"\x16public_key_fingerprint\x18\a \x01(\tR\x14publicKeyFingerprintB\v\n" +
 	"\t_reusable\"Y\n" +
 	"\x17ListCredentialsResponse\x12>\n" +
 	"\vcredentials\x18\x01 \x03(\v2\x1c.api.instance.CredentialInfoR\vcredentials*\x8b\x01\n" +
@@ -3882,7 +4262,13 @@ const file_api_instance_proto_rawDesc = "" +
 	"\tCONNECTED\x10\x00\x12\x10\n" +
 	"\fDISCONNECTED\x10\x01\x12\x0e\n" +
 	"\n" +
-	"CONNECTING\x10\x02*8\n" +
+	"CONNECTING\x10\x02*\xd3\x01\n" +
+	"\x14VpnPortalClientState\x12'\n" +
+	"#VPN_PORTAL_CLIENT_STATE_UNSPECIFIED\x10\x00\x12#\n" +
+	"\x1fVPN_PORTAL_CLIENT_STATE_OFFLINE\x10\x01\x12&\n" +
+	"\"VPN_PORTAL_CLIENT_STATE_CONNECTING\x10\x02\x12\"\n" +
+	"\x1eVPN_PORTAL_CLIENT_STATE_ONLINE\x10\x03\x12!\n" +
+	"\x1dVPN_PORTAL_CLIENT_STATE_ERROR\x10\x04*8\n" +
 	"\x1aTcpProxyEntryTransportType\x12\a\n" +
 	"\x03TCP\x10\x00\x12\a\n" +
 	"\x03KCP\x10\x01\x12\b\n" +
@@ -3922,11 +4308,12 @@ const file_api_instance_proto_rawDesc = "" +
 	"\x0fListPortForward\x12$.api.instance.ListPortForwardRequest\x1a%.api.instance.ListPortForwardResponse2\xbe\x01\n" +
 	"\bStatsRpc\x12I\n" +
 	"\bGetStats\x12\x1d.api.instance.GetStatsRequest\x1a\x1e.api.instance.GetStatsResponse\x12g\n" +
-	"\x12GetPrometheusStats\x12'.api.instance.GetPrometheusStatsRequest\x1a(.api.instance.GetPrometheusStatsResponse2\xc1\x02\n" +
+	"\x12GetPrometheusStats\x12'.api.instance.GetPrometheusStatsRequest\x1a(.api.instance.GetPrometheusStatsResponse2\xa4\x03\n" +
 	"\x13CredentialManageRpc\x12g\n" +
 	"\x12GenerateCredential\x12'.api.instance.GenerateCredentialRequest\x1a(.api.instance.GenerateCredentialResponse\x12a\n" +
 	"\x10RevokeCredential\x12%.api.instance.RevokeCredentialRequest\x1a&.api.instance.RevokeCredentialResponse\x12^\n" +
-	"\x0fListCredentials\x12$.api.instance.ListCredentialsRequest\x1a%.api.instance.ListCredentialsResponseb\x06proto3"
+	"\x0fListCredentials\x12$.api.instance.ListCredentialsRequest\x1a%.api.instance.ListCredentialsResponse\x12a\n" +
+	"\x10UpsertCredential\x12%.api.instance.UpsertCredentialRequest\x1a&.api.instance.UpsertCredentialResponseb\x06proto3"
 
 var (
 	file_api_instance_proto_rawDescOnce sync.Once
@@ -3940,211 +4327,220 @@ func file_api_instance_proto_rawDescGZIP() []byte {
 	return file_api_instance_proto_rawDescData
 }
 
-var file_api_instance_proto_enumTypes = make([]protoimpl.EnumInfo, 4)
-var file_api_instance_proto_msgTypes = make([]protoimpl.MessageInfo, 63)
+var file_api_instance_proto_enumTypes = make([]protoimpl.EnumInfo, 5)
+var file_api_instance_proto_msgTypes = make([]protoimpl.MessageInfo, 66)
 var file_api_instance_proto_goTypes = []any{
 	(TrustedKeySourcePb)(0),                     // 0: api.instance.TrustedKeySourcePb
 	(ConnectorStatus)(0),                        // 1: api.instance.ConnectorStatus
-	(TcpProxyEntryTransportType)(0),             // 2: api.instance.TcpProxyEntryTransportType
-	(TcpProxyEntryState)(0),                     // 3: api.instance.TcpProxyEntryState
-	(*InstanceIdentifier)(nil),                  // 4: api.instance.InstanceIdentifier
-	(*Status)(nil),                              // 5: api.instance.Status
-	(*PeerConnStats)(nil),                       // 6: api.instance.PeerConnStats
-	(*PeerConnInfo)(nil),                        // 7: api.instance.PeerConnInfo
-	(*PeerInfo)(nil),                            // 8: api.instance.PeerInfo
-	(*ListPeerRequest)(nil),                     // 9: api.instance.ListPeerRequest
-	(*ListPeerResponse)(nil),                    // 10: api.instance.ListPeerResponse
-	(*Route)(nil),                               // 11: api.instance.Route
-	(*PeerRoutePair)(nil),                       // 12: api.instance.PeerRoutePair
-	(*NodeInfo)(nil),                            // 13: api.instance.NodeInfo
-	(*ShowNodeInfoRequest)(nil),                 // 14: api.instance.ShowNodeInfoRequest
-	(*ShowNodeInfoResponse)(nil),                // 15: api.instance.ShowNodeInfoResponse
-	(*PublicIpv6LeaseInfo)(nil),                 // 16: api.instance.PublicIpv6LeaseInfo
-	(*ListPublicIpv6InfoRequest)(nil),           // 17: api.instance.ListPublicIpv6InfoRequest
-	(*ListPublicIpv6InfoResponse)(nil),          // 18: api.instance.ListPublicIpv6InfoResponse
-	(*ListRouteRequest)(nil),                    // 19: api.instance.ListRouteRequest
-	(*ListRouteResponse)(nil),                   // 20: api.instance.ListRouteResponse
-	(*DumpRouteRequest)(nil),                    // 21: api.instance.DumpRouteRequest
-	(*DumpRouteResponse)(nil),                   // 22: api.instance.DumpRouteResponse
-	(*ListForeignNetworkRequest)(nil),           // 23: api.instance.ListForeignNetworkRequest
-	(*TrustedKeyInfoPb)(nil),                    // 24: api.instance.TrustedKeyInfoPb
-	(*ForeignNetworkEntryPb)(nil),               // 25: api.instance.ForeignNetworkEntryPb
-	(*ListForeignNetworkResponse)(nil),          // 26: api.instance.ListForeignNetworkResponse
-	(*ListGlobalForeignNetworkRequest)(nil),     // 27: api.instance.ListGlobalForeignNetworkRequest
-	(*ListGlobalForeignNetworkResponse)(nil),    // 28: api.instance.ListGlobalForeignNetworkResponse
-	(*GetForeignNetworkSummaryRequest)(nil),     // 29: api.instance.GetForeignNetworkSummaryRequest
-	(*GetForeignNetworkSummaryResponse)(nil),    // 30: api.instance.GetForeignNetworkSummaryResponse
-	(*Connector)(nil),                           // 31: api.instance.Connector
-	(*ListConnectorRequest)(nil),                // 32: api.instance.ListConnectorRequest
-	(*ListConnectorResponse)(nil),               // 33: api.instance.ListConnectorResponse
-	(*MappedListener)(nil),                      // 34: api.instance.MappedListener
-	(*ListMappedListenerRequest)(nil),           // 35: api.instance.ListMappedListenerRequest
-	(*ListMappedListenerResponse)(nil),          // 36: api.instance.ListMappedListenerResponse
-	(*VpnPortalInfo)(nil),                       // 37: api.instance.VpnPortalInfo
-	(*GetVpnPortalInfoRequest)(nil),             // 38: api.instance.GetVpnPortalInfoRequest
-	(*GetVpnPortalInfoResponse)(nil),            // 39: api.instance.GetVpnPortalInfoResponse
-	(*TcpProxyEntry)(nil),                       // 40: api.instance.TcpProxyEntry
-	(*ListTcpProxyEntryRequest)(nil),            // 41: api.instance.ListTcpProxyEntryRequest
-	(*ListTcpProxyEntryResponse)(nil),           // 42: api.instance.ListTcpProxyEntryResponse
-	(*GetAclStatsRequest)(nil),                  // 43: api.instance.GetAclStatsRequest
-	(*GetAclStatsResponse)(nil),                 // 44: api.instance.GetAclStatsResponse
-	(*GetWhitelistRequest)(nil),                 // 45: api.instance.GetWhitelistRequest
-	(*GetWhitelistResponse)(nil),                // 46: api.instance.GetWhitelistResponse
-	(*ListPortForwardRequest)(nil),              // 47: api.instance.ListPortForwardRequest
-	(*ListPortForwardResponse)(nil),             // 48: api.instance.ListPortForwardResponse
-	(*MetricSnapshot)(nil),                      // 49: api.instance.MetricSnapshot
-	(*GetStatsRequest)(nil),                     // 50: api.instance.GetStatsRequest
-	(*GetStatsResponse)(nil),                    // 51: api.instance.GetStatsResponse
-	(*GetPrometheusStatsRequest)(nil),           // 52: api.instance.GetPrometheusStatsRequest
-	(*GetPrometheusStatsResponse)(nil),          // 53: api.instance.GetPrometheusStatsResponse
-	(*GenerateCredentialRequest)(nil),           // 54: api.instance.GenerateCredentialRequest
-	(*GenerateCredentialResponse)(nil),          // 55: api.instance.GenerateCredentialResponse
-	(*RevokeCredentialRequest)(nil),             // 56: api.instance.RevokeCredentialRequest
-	(*RevokeCredentialResponse)(nil),            // 57: api.instance.RevokeCredentialResponse
-	(*ListCredentialsRequest)(nil),              // 58: api.instance.ListCredentialsRequest
-	(*CredentialInfo)(nil),                      // 59: api.instance.CredentialInfo
-	(*ListCredentialsResponse)(nil),             // 60: api.instance.ListCredentialsResponse
-	(*InstanceIdentifier_InstanceSelector)(nil), // 61: api.instance.InstanceIdentifier.InstanceSelector
-	nil, // 62: api.instance.ListForeignNetworkResponse.ForeignNetworksEntry
-	(*ListGlobalForeignNetworkResponse_OneForeignNetwork)(nil), // 63: api.instance.ListGlobalForeignNetworkResponse.OneForeignNetwork
-	(*ListGlobalForeignNetworkResponse_ForeignNetworks)(nil),   // 64: api.instance.ListGlobalForeignNetworkResponse.ForeignNetworks
-	nil,                                         // 65: api.instance.ListGlobalForeignNetworkResponse.ForeignNetworksEntry
-	nil,                                         // 66: api.instance.MetricSnapshot.LabelsEntry
-	(*common.UUID)(nil),                         // 67: common.UUID
-	(*common.TunnelInfo)(nil),                   // 68: common.TunnelInfo
-	(peer_rpc.SecureAuthLevel)(0),               // 69: peer_rpc.SecureAuthLevel
-	(peer_rpc.PeerIdentityType)(0),              // 70: peer_rpc.PeerIdentityType
-	(*common.Ipv4Inet)(nil),                     // 71: common.Ipv4Inet
-	(*common.StunInfo)(nil),                     // 72: common.StunInfo
-	(*common.PeerFeatureFlag)(nil),              // 73: common.PeerFeatureFlag
-	(*common.Ipv6Inet)(nil),                     // 74: common.Ipv6Inet
-	(*peer_rpc.GetIpListResponse)(nil),          // 75: peer_rpc.GetIpListResponse
-	(*peer_rpc.RouteForeignNetworkSummary)(nil), // 76: peer_rpc.RouteForeignNetworkSummary
-	(*common.Url)(nil),                          // 77: common.Url
-	(*common.SocketAddr)(nil),                   // 78: common.SocketAddr
-	(*acl.AclStats)(nil),                        // 79: acl.AclStats
-	(*common.PortForwardConfigPb)(nil),          // 80: common.PortForwardConfigPb
+	(VpnPortalClientState)(0),                   // 2: api.instance.VpnPortalClientState
+	(TcpProxyEntryTransportType)(0),             // 3: api.instance.TcpProxyEntryTransportType
+	(TcpProxyEntryState)(0),                     // 4: api.instance.TcpProxyEntryState
+	(*InstanceIdentifier)(nil),                  // 5: api.instance.InstanceIdentifier
+	(*Status)(nil),                              // 6: api.instance.Status
+	(*PeerConnStats)(nil),                       // 7: api.instance.PeerConnStats
+	(*PeerConnInfo)(nil),                        // 8: api.instance.PeerConnInfo
+	(*PeerInfo)(nil),                            // 9: api.instance.PeerInfo
+	(*ListPeerRequest)(nil),                     // 10: api.instance.ListPeerRequest
+	(*ListPeerResponse)(nil),                    // 11: api.instance.ListPeerResponse
+	(*Route)(nil),                               // 12: api.instance.Route
+	(*PeerRoutePair)(nil),                       // 13: api.instance.PeerRoutePair
+	(*NodeInfo)(nil),                            // 14: api.instance.NodeInfo
+	(*ShowNodeInfoRequest)(nil),                 // 15: api.instance.ShowNodeInfoRequest
+	(*ShowNodeInfoResponse)(nil),                // 16: api.instance.ShowNodeInfoResponse
+	(*PublicIpv6LeaseInfo)(nil),                 // 17: api.instance.PublicIpv6LeaseInfo
+	(*ListPublicIpv6InfoRequest)(nil),           // 18: api.instance.ListPublicIpv6InfoRequest
+	(*ListPublicIpv6InfoResponse)(nil),          // 19: api.instance.ListPublicIpv6InfoResponse
+	(*ListRouteRequest)(nil),                    // 20: api.instance.ListRouteRequest
+	(*ListRouteResponse)(nil),                   // 21: api.instance.ListRouteResponse
+	(*DumpRouteRequest)(nil),                    // 22: api.instance.DumpRouteRequest
+	(*DumpRouteResponse)(nil),                   // 23: api.instance.DumpRouteResponse
+	(*ListForeignNetworkRequest)(nil),           // 24: api.instance.ListForeignNetworkRequest
+	(*TrustedKeyInfoPb)(nil),                    // 25: api.instance.TrustedKeyInfoPb
+	(*ForeignNetworkEntryPb)(nil),               // 26: api.instance.ForeignNetworkEntryPb
+	(*ListForeignNetworkResponse)(nil),          // 27: api.instance.ListForeignNetworkResponse
+	(*ListGlobalForeignNetworkRequest)(nil),     // 28: api.instance.ListGlobalForeignNetworkRequest
+	(*ListGlobalForeignNetworkResponse)(nil),    // 29: api.instance.ListGlobalForeignNetworkResponse
+	(*GetForeignNetworkSummaryRequest)(nil),     // 30: api.instance.GetForeignNetworkSummaryRequest
+	(*GetForeignNetworkSummaryResponse)(nil),    // 31: api.instance.GetForeignNetworkSummaryResponse
+	(*Connector)(nil),                           // 32: api.instance.Connector
+	(*ListConnectorRequest)(nil),                // 33: api.instance.ListConnectorRequest
+	(*ListConnectorResponse)(nil),               // 34: api.instance.ListConnectorResponse
+	(*MappedListener)(nil),                      // 35: api.instance.MappedListener
+	(*ListMappedListenerRequest)(nil),           // 36: api.instance.ListMappedListenerRequest
+	(*ListMappedListenerResponse)(nil),          // 37: api.instance.ListMappedListenerResponse
+	(*VpnPortalClientInfo)(nil),                 // 38: api.instance.VpnPortalClientInfo
+	(*VpnPortalInfo)(nil),                       // 39: api.instance.VpnPortalInfo
+	(*GetVpnPortalInfoRequest)(nil),             // 40: api.instance.GetVpnPortalInfoRequest
+	(*GetVpnPortalInfoResponse)(nil),            // 41: api.instance.GetVpnPortalInfoResponse
+	(*TcpProxyEntry)(nil),                       // 42: api.instance.TcpProxyEntry
+	(*ListTcpProxyEntryRequest)(nil),            // 43: api.instance.ListTcpProxyEntryRequest
+	(*ListTcpProxyEntryResponse)(nil),           // 44: api.instance.ListTcpProxyEntryResponse
+	(*GetAclStatsRequest)(nil),                  // 45: api.instance.GetAclStatsRequest
+	(*GetAclStatsResponse)(nil),                 // 46: api.instance.GetAclStatsResponse
+	(*GetWhitelistRequest)(nil),                 // 47: api.instance.GetWhitelistRequest
+	(*GetWhitelistResponse)(nil),                // 48: api.instance.GetWhitelistResponse
+	(*ListPortForwardRequest)(nil),              // 49: api.instance.ListPortForwardRequest
+	(*ListPortForwardResponse)(nil),             // 50: api.instance.ListPortForwardResponse
+	(*MetricSnapshot)(nil),                      // 51: api.instance.MetricSnapshot
+	(*GetStatsRequest)(nil),                     // 52: api.instance.GetStatsRequest
+	(*GetStatsResponse)(nil),                    // 53: api.instance.GetStatsResponse
+	(*GetPrometheusStatsRequest)(nil),           // 54: api.instance.GetPrometheusStatsRequest
+	(*GetPrometheusStatsResponse)(nil),          // 55: api.instance.GetPrometheusStatsResponse
+	(*GenerateCredentialRequest)(nil),           // 56: api.instance.GenerateCredentialRequest
+	(*GenerateCredentialResponse)(nil),          // 57: api.instance.GenerateCredentialResponse
+	(*UpsertCredentialRequest)(nil),             // 58: api.instance.UpsertCredentialRequest
+	(*UpsertCredentialResponse)(nil),            // 59: api.instance.UpsertCredentialResponse
+	(*RevokeCredentialRequest)(nil),             // 60: api.instance.RevokeCredentialRequest
+	(*RevokeCredentialResponse)(nil),            // 61: api.instance.RevokeCredentialResponse
+	(*ListCredentialsRequest)(nil),              // 62: api.instance.ListCredentialsRequest
+	(*CredentialInfo)(nil),                      // 63: api.instance.CredentialInfo
+	(*ListCredentialsResponse)(nil),             // 64: api.instance.ListCredentialsResponse
+	(*InstanceIdentifier_InstanceSelector)(nil), // 65: api.instance.InstanceIdentifier.InstanceSelector
+	nil, // 66: api.instance.ListForeignNetworkResponse.ForeignNetworksEntry
+	(*ListGlobalForeignNetworkResponse_OneForeignNetwork)(nil), // 67: api.instance.ListGlobalForeignNetworkResponse.OneForeignNetwork
+	(*ListGlobalForeignNetworkResponse_ForeignNetworks)(nil),   // 68: api.instance.ListGlobalForeignNetworkResponse.ForeignNetworks
+	nil,                                         // 69: api.instance.ListGlobalForeignNetworkResponse.ForeignNetworksEntry
+	nil,                                         // 70: api.instance.MetricSnapshot.LabelsEntry
+	(*common.UUID)(nil),                         // 71: common.UUID
+	(*common.TunnelInfo)(nil),                   // 72: common.TunnelInfo
+	(peer_rpc.SecureAuthLevel)(0),               // 73: peer_rpc.SecureAuthLevel
+	(peer_rpc.PeerIdentityType)(0),              // 74: peer_rpc.PeerIdentityType
+	(*common.Ipv4Inet)(nil),                     // 75: common.Ipv4Inet
+	(*common.StunInfo)(nil),                     // 76: common.StunInfo
+	(*common.PeerFeatureFlag)(nil),              // 77: common.PeerFeatureFlag
+	(*common.Ipv6Inet)(nil),                     // 78: common.Ipv6Inet
+	(*peer_rpc.GetIpListResponse)(nil),          // 79: peer_rpc.GetIpListResponse
+	(*peer_rpc.RouteForeignNetworkSummary)(nil), // 80: peer_rpc.RouteForeignNetworkSummary
+	(*common.Url)(nil),                          // 81: common.Url
+	(*common.SocketAddr)(nil),                   // 82: common.SocketAddr
+	(*acl.AclStats)(nil),                        // 83: acl.AclStats
+	(*common.PortForwardConfigPb)(nil),          // 84: common.PortForwardConfigPb
 }
 var file_api_instance_proto_depIdxs = []int32{
-	67, // 0: api.instance.InstanceIdentifier.id:type_name -> common.UUID
-	61, // 1: api.instance.InstanceIdentifier.instance_selector:type_name -> api.instance.InstanceIdentifier.InstanceSelector
-	68, // 2: api.instance.PeerConnInfo.tunnel:type_name -> common.TunnelInfo
-	6,  // 3: api.instance.PeerConnInfo.stats:type_name -> api.instance.PeerConnStats
-	69, // 4: api.instance.PeerConnInfo.secure_auth_level:type_name -> peer_rpc.SecureAuthLevel
-	70, // 5: api.instance.PeerConnInfo.peer_identity_type:type_name -> peer_rpc.PeerIdentityType
-	7,  // 6: api.instance.PeerInfo.conns:type_name -> api.instance.PeerConnInfo
-	67, // 7: api.instance.PeerInfo.default_conn_id:type_name -> common.UUID
-	67, // 8: api.instance.PeerInfo.directly_connected_conns:type_name -> common.UUID
-	4,  // 9: api.instance.ListPeerRequest.instance:type_name -> api.instance.InstanceIdentifier
-	8,  // 10: api.instance.ListPeerResponse.peer_infos:type_name -> api.instance.PeerInfo
-	13, // 11: api.instance.ListPeerResponse.my_info:type_name -> api.instance.NodeInfo
-	71, // 12: api.instance.Route.ipv4_addr:type_name -> common.Ipv4Inet
-	72, // 13: api.instance.Route.stun_info:type_name -> common.StunInfo
-	73, // 14: api.instance.Route.feature_flag:type_name -> common.PeerFeatureFlag
-	74, // 15: api.instance.Route.ipv6_addr:type_name -> common.Ipv6Inet
-	74, // 16: api.instance.Route.public_ipv6_addr:type_name -> common.Ipv6Inet
-	74, // 17: api.instance.Route.ipv6_public_addr_prefix:type_name -> common.Ipv6Inet
-	11, // 18: api.instance.PeerRoutePair.route:type_name -> api.instance.Route
-	8,  // 19: api.instance.PeerRoutePair.peer:type_name -> api.instance.PeerInfo
-	72, // 20: api.instance.NodeInfo.stun_info:type_name -> common.StunInfo
-	73, // 21: api.instance.NodeInfo.feature_flag:type_name -> common.PeerFeatureFlag
-	75, // 22: api.instance.NodeInfo.ip_list:type_name -> peer_rpc.GetIpListResponse
-	74, // 23: api.instance.NodeInfo.public_ipv6_addr:type_name -> common.Ipv6Inet
-	74, // 24: api.instance.NodeInfo.ipv6_public_addr_prefix:type_name -> common.Ipv6Inet
-	4,  // 25: api.instance.ShowNodeInfoRequest.instance:type_name -> api.instance.InstanceIdentifier
-	13, // 26: api.instance.ShowNodeInfoResponse.node_info:type_name -> api.instance.NodeInfo
-	74, // 27: api.instance.PublicIpv6LeaseInfo.leased_addr:type_name -> common.Ipv6Inet
-	4,  // 28: api.instance.ListPublicIpv6InfoRequest.instance:type_name -> api.instance.InstanceIdentifier
-	74, // 29: api.instance.ListPublicIpv6InfoResponse.provider_prefix:type_name -> common.Ipv6Inet
-	16, // 30: api.instance.ListPublicIpv6InfoResponse.provider_leases:type_name -> api.instance.PublicIpv6LeaseInfo
-	4,  // 31: api.instance.ListRouteRequest.instance:type_name -> api.instance.InstanceIdentifier
-	11, // 32: api.instance.ListRouteResponse.routes:type_name -> api.instance.Route
-	4,  // 33: api.instance.DumpRouteRequest.instance:type_name -> api.instance.InstanceIdentifier
-	4,  // 34: api.instance.ListForeignNetworkRequest.instance:type_name -> api.instance.InstanceIdentifier
+	71, // 0: api.instance.InstanceIdentifier.id:type_name -> common.UUID
+	65, // 1: api.instance.InstanceIdentifier.instance_selector:type_name -> api.instance.InstanceIdentifier.InstanceSelector
+	72, // 2: api.instance.PeerConnInfo.tunnel:type_name -> common.TunnelInfo
+	7,  // 3: api.instance.PeerConnInfo.stats:type_name -> api.instance.PeerConnStats
+	73, // 4: api.instance.PeerConnInfo.secure_auth_level:type_name -> peer_rpc.SecureAuthLevel
+	74, // 5: api.instance.PeerConnInfo.peer_identity_type:type_name -> peer_rpc.PeerIdentityType
+	8,  // 6: api.instance.PeerInfo.conns:type_name -> api.instance.PeerConnInfo
+	71, // 7: api.instance.PeerInfo.default_conn_id:type_name -> common.UUID
+	71, // 8: api.instance.PeerInfo.directly_connected_conns:type_name -> common.UUID
+	5,  // 9: api.instance.ListPeerRequest.instance:type_name -> api.instance.InstanceIdentifier
+	9,  // 10: api.instance.ListPeerResponse.peer_infos:type_name -> api.instance.PeerInfo
+	14, // 11: api.instance.ListPeerResponse.my_info:type_name -> api.instance.NodeInfo
+	75, // 12: api.instance.Route.ipv4_addr:type_name -> common.Ipv4Inet
+	76, // 13: api.instance.Route.stun_info:type_name -> common.StunInfo
+	77, // 14: api.instance.Route.feature_flag:type_name -> common.PeerFeatureFlag
+	78, // 15: api.instance.Route.ipv6_addr:type_name -> common.Ipv6Inet
+	78, // 16: api.instance.Route.public_ipv6_addr:type_name -> common.Ipv6Inet
+	78, // 17: api.instance.Route.ipv6_public_addr_prefix:type_name -> common.Ipv6Inet
+	12, // 18: api.instance.PeerRoutePair.route:type_name -> api.instance.Route
+	9,  // 19: api.instance.PeerRoutePair.peer:type_name -> api.instance.PeerInfo
+	76, // 20: api.instance.NodeInfo.stun_info:type_name -> common.StunInfo
+	77, // 21: api.instance.NodeInfo.feature_flag:type_name -> common.PeerFeatureFlag
+	79, // 22: api.instance.NodeInfo.ip_list:type_name -> peer_rpc.GetIpListResponse
+	78, // 23: api.instance.NodeInfo.public_ipv6_addr:type_name -> common.Ipv6Inet
+	78, // 24: api.instance.NodeInfo.ipv6_public_addr_prefix:type_name -> common.Ipv6Inet
+	5,  // 25: api.instance.ShowNodeInfoRequest.instance:type_name -> api.instance.InstanceIdentifier
+	14, // 26: api.instance.ShowNodeInfoResponse.node_info:type_name -> api.instance.NodeInfo
+	78, // 27: api.instance.PublicIpv6LeaseInfo.leased_addr:type_name -> common.Ipv6Inet
+	5,  // 28: api.instance.ListPublicIpv6InfoRequest.instance:type_name -> api.instance.InstanceIdentifier
+	78, // 29: api.instance.ListPublicIpv6InfoResponse.provider_prefix:type_name -> common.Ipv6Inet
+	17, // 30: api.instance.ListPublicIpv6InfoResponse.provider_leases:type_name -> api.instance.PublicIpv6LeaseInfo
+	5,  // 31: api.instance.ListRouteRequest.instance:type_name -> api.instance.InstanceIdentifier
+	12, // 32: api.instance.ListRouteResponse.routes:type_name -> api.instance.Route
+	5,  // 33: api.instance.DumpRouteRequest.instance:type_name -> api.instance.InstanceIdentifier
+	5,  // 34: api.instance.ListForeignNetworkRequest.instance:type_name -> api.instance.InstanceIdentifier
 	0,  // 35: api.instance.TrustedKeyInfoPb.source:type_name -> api.instance.TrustedKeySourcePb
-	8,  // 36: api.instance.ForeignNetworkEntryPb.peers:type_name -> api.instance.PeerInfo
-	24, // 37: api.instance.ForeignNetworkEntryPb.trusted_keys:type_name -> api.instance.TrustedKeyInfoPb
-	62, // 38: api.instance.ListForeignNetworkResponse.foreign_networks:type_name -> api.instance.ListForeignNetworkResponse.ForeignNetworksEntry
-	4,  // 39: api.instance.ListGlobalForeignNetworkRequest.instance:type_name -> api.instance.InstanceIdentifier
-	65, // 40: api.instance.ListGlobalForeignNetworkResponse.foreign_networks:type_name -> api.instance.ListGlobalForeignNetworkResponse.ForeignNetworksEntry
-	4,  // 41: api.instance.GetForeignNetworkSummaryRequest.instance:type_name -> api.instance.InstanceIdentifier
-	76, // 42: api.instance.GetForeignNetworkSummaryResponse.summary:type_name -> peer_rpc.RouteForeignNetworkSummary
-	77, // 43: api.instance.Connector.url:type_name -> common.Url
+	9,  // 36: api.instance.ForeignNetworkEntryPb.peers:type_name -> api.instance.PeerInfo
+	25, // 37: api.instance.ForeignNetworkEntryPb.trusted_keys:type_name -> api.instance.TrustedKeyInfoPb
+	66, // 38: api.instance.ListForeignNetworkResponse.foreign_networks:type_name -> api.instance.ListForeignNetworkResponse.ForeignNetworksEntry
+	5,  // 39: api.instance.ListGlobalForeignNetworkRequest.instance:type_name -> api.instance.InstanceIdentifier
+	69, // 40: api.instance.ListGlobalForeignNetworkResponse.foreign_networks:type_name -> api.instance.ListGlobalForeignNetworkResponse.ForeignNetworksEntry
+	5,  // 41: api.instance.GetForeignNetworkSummaryRequest.instance:type_name -> api.instance.InstanceIdentifier
+	80, // 42: api.instance.GetForeignNetworkSummaryResponse.summary:type_name -> peer_rpc.RouteForeignNetworkSummary
+	81, // 43: api.instance.Connector.url:type_name -> common.Url
 	1,  // 44: api.instance.Connector.status:type_name -> api.instance.ConnectorStatus
-	4,  // 45: api.instance.ListConnectorRequest.instance:type_name -> api.instance.InstanceIdentifier
-	31, // 46: api.instance.ListConnectorResponse.connectors:type_name -> api.instance.Connector
-	77, // 47: api.instance.MappedListener.url:type_name -> common.Url
-	4,  // 48: api.instance.ListMappedListenerRequest.instance:type_name -> api.instance.InstanceIdentifier
-	34, // 49: api.instance.ListMappedListenerResponse.mappedlisteners:type_name -> api.instance.MappedListener
-	4,  // 50: api.instance.GetVpnPortalInfoRequest.instance:type_name -> api.instance.InstanceIdentifier
-	37, // 51: api.instance.GetVpnPortalInfoResponse.vpn_portal_info:type_name -> api.instance.VpnPortalInfo
-	78, // 52: api.instance.TcpProxyEntry.src:type_name -> common.SocketAddr
-	78, // 53: api.instance.TcpProxyEntry.dst:type_name -> common.SocketAddr
-	3,  // 54: api.instance.TcpProxyEntry.state:type_name -> api.instance.TcpProxyEntryState
-	2,  // 55: api.instance.TcpProxyEntry.transport_type:type_name -> api.instance.TcpProxyEntryTransportType
-	4,  // 56: api.instance.ListTcpProxyEntryRequest.instance:type_name -> api.instance.InstanceIdentifier
-	40, // 57: api.instance.ListTcpProxyEntryResponse.entries:type_name -> api.instance.TcpProxyEntry
-	4,  // 58: api.instance.GetAclStatsRequest.instance:type_name -> api.instance.InstanceIdentifier
-	79, // 59: api.instance.GetAclStatsResponse.acl_stats:type_name -> acl.AclStats
-	4,  // 60: api.instance.GetWhitelistRequest.instance:type_name -> api.instance.InstanceIdentifier
-	4,  // 61: api.instance.ListPortForwardRequest.instance:type_name -> api.instance.InstanceIdentifier
-	80, // 62: api.instance.ListPortForwardResponse.cfgs:type_name -> common.PortForwardConfigPb
-	66, // 63: api.instance.MetricSnapshot.labels:type_name -> api.instance.MetricSnapshot.LabelsEntry
-	4,  // 64: api.instance.GetStatsRequest.instance:type_name -> api.instance.InstanceIdentifier
-	49, // 65: api.instance.GetStatsResponse.metrics:type_name -> api.instance.MetricSnapshot
-	4,  // 66: api.instance.GetPrometheusStatsRequest.instance:type_name -> api.instance.InstanceIdentifier
-	4,  // 67: api.instance.GenerateCredentialRequest.instance:type_name -> api.instance.InstanceIdentifier
-	4,  // 68: api.instance.RevokeCredentialRequest.instance:type_name -> api.instance.InstanceIdentifier
-	4,  // 69: api.instance.ListCredentialsRequest.instance:type_name -> api.instance.InstanceIdentifier
-	59, // 70: api.instance.ListCredentialsResponse.credentials:type_name -> api.instance.CredentialInfo
-	25, // 71: api.instance.ListForeignNetworkResponse.ForeignNetworksEntry.value:type_name -> api.instance.ForeignNetworkEntryPb
-	63, // 72: api.instance.ListGlobalForeignNetworkResponse.ForeignNetworks.foreign_networks:type_name -> api.instance.ListGlobalForeignNetworkResponse.OneForeignNetwork
-	64, // 73: api.instance.ListGlobalForeignNetworkResponse.ForeignNetworksEntry.value:type_name -> api.instance.ListGlobalForeignNetworkResponse.ForeignNetworks
-	9,  // 74: api.instance.PeerManageRpc.ListPeer:input_type -> api.instance.ListPeerRequest
-	17, // 75: api.instance.PeerManageRpc.ListPublicIpv6Info:input_type -> api.instance.ListPublicIpv6InfoRequest
-	19, // 76: api.instance.PeerManageRpc.ListRoute:input_type -> api.instance.ListRouteRequest
-	21, // 77: api.instance.PeerManageRpc.DumpRoute:input_type -> api.instance.DumpRouteRequest
-	23, // 78: api.instance.PeerManageRpc.ListForeignNetwork:input_type -> api.instance.ListForeignNetworkRequest
-	27, // 79: api.instance.PeerManageRpc.ListGlobalForeignNetwork:input_type -> api.instance.ListGlobalForeignNetworkRequest
-	14, // 80: api.instance.PeerManageRpc.ShowNodeInfo:input_type -> api.instance.ShowNodeInfoRequest
-	29, // 81: api.instance.PeerManageRpc.GetForeignNetworkSummary:input_type -> api.instance.GetForeignNetworkSummaryRequest
-	32, // 82: api.instance.ConnectorManageRpc.ListConnector:input_type -> api.instance.ListConnectorRequest
-	35, // 83: api.instance.MappedListenerManageRpc.ListMappedListener:input_type -> api.instance.ListMappedListenerRequest
-	38, // 84: api.instance.VpnPortalRpc.GetVpnPortalInfo:input_type -> api.instance.GetVpnPortalInfoRequest
-	41, // 85: api.instance.TcpProxyRpc.ListTcpProxyEntry:input_type -> api.instance.ListTcpProxyEntryRequest
-	43, // 86: api.instance.AclManageRpc.GetAclStats:input_type -> api.instance.GetAclStatsRequest
-	45, // 87: api.instance.AclManageRpc.GetWhitelist:input_type -> api.instance.GetWhitelistRequest
-	47, // 88: api.instance.PortForwardManageRpc.ListPortForward:input_type -> api.instance.ListPortForwardRequest
-	50, // 89: api.instance.StatsRpc.GetStats:input_type -> api.instance.GetStatsRequest
-	52, // 90: api.instance.StatsRpc.GetPrometheusStats:input_type -> api.instance.GetPrometheusStatsRequest
-	54, // 91: api.instance.CredentialManageRpc.GenerateCredential:input_type -> api.instance.GenerateCredentialRequest
-	56, // 92: api.instance.CredentialManageRpc.RevokeCredential:input_type -> api.instance.RevokeCredentialRequest
-	58, // 93: api.instance.CredentialManageRpc.ListCredentials:input_type -> api.instance.ListCredentialsRequest
-	10, // 94: api.instance.PeerManageRpc.ListPeer:output_type -> api.instance.ListPeerResponse
-	18, // 95: api.instance.PeerManageRpc.ListPublicIpv6Info:output_type -> api.instance.ListPublicIpv6InfoResponse
-	20, // 96: api.instance.PeerManageRpc.ListRoute:output_type -> api.instance.ListRouteResponse
-	22, // 97: api.instance.PeerManageRpc.DumpRoute:output_type -> api.instance.DumpRouteResponse
-	26, // 98: api.instance.PeerManageRpc.ListForeignNetwork:output_type -> api.instance.ListForeignNetworkResponse
-	28, // 99: api.instance.PeerManageRpc.ListGlobalForeignNetwork:output_type -> api.instance.ListGlobalForeignNetworkResponse
-	15, // 100: api.instance.PeerManageRpc.ShowNodeInfo:output_type -> api.instance.ShowNodeInfoResponse
-	30, // 101: api.instance.PeerManageRpc.GetForeignNetworkSummary:output_type -> api.instance.GetForeignNetworkSummaryResponse
-	33, // 102: api.instance.ConnectorManageRpc.ListConnector:output_type -> api.instance.ListConnectorResponse
-	36, // 103: api.instance.MappedListenerManageRpc.ListMappedListener:output_type -> api.instance.ListMappedListenerResponse
-	39, // 104: api.instance.VpnPortalRpc.GetVpnPortalInfo:output_type -> api.instance.GetVpnPortalInfoResponse
-	42, // 105: api.instance.TcpProxyRpc.ListTcpProxyEntry:output_type -> api.instance.ListTcpProxyEntryResponse
-	44, // 106: api.instance.AclManageRpc.GetAclStats:output_type -> api.instance.GetAclStatsResponse
-	46, // 107: api.instance.AclManageRpc.GetWhitelist:output_type -> api.instance.GetWhitelistResponse
-	48, // 108: api.instance.PortForwardManageRpc.ListPortForward:output_type -> api.instance.ListPortForwardResponse
-	51, // 109: api.instance.StatsRpc.GetStats:output_type -> api.instance.GetStatsResponse
-	53, // 110: api.instance.StatsRpc.GetPrometheusStats:output_type -> api.instance.GetPrometheusStatsResponse
-	55, // 111: api.instance.CredentialManageRpc.GenerateCredential:output_type -> api.instance.GenerateCredentialResponse
-	57, // 112: api.instance.CredentialManageRpc.RevokeCredential:output_type -> api.instance.RevokeCredentialResponse
-	60, // 113: api.instance.CredentialManageRpc.ListCredentials:output_type -> api.instance.ListCredentialsResponse
-	94, // [94:114] is the sub-list for method output_type
-	74, // [74:94] is the sub-list for method input_type
-	74, // [74:74] is the sub-list for extension type_name
-	74, // [74:74] is the sub-list for extension extendee
-	0,  // [0:74] is the sub-list for field type_name
+	5,  // 45: api.instance.ListConnectorRequest.instance:type_name -> api.instance.InstanceIdentifier
+	32, // 46: api.instance.ListConnectorResponse.connectors:type_name -> api.instance.Connector
+	81, // 47: api.instance.MappedListener.url:type_name -> common.Url
+	5,  // 48: api.instance.ListMappedListenerRequest.instance:type_name -> api.instance.InstanceIdentifier
+	35, // 49: api.instance.ListMappedListenerResponse.mappedlisteners:type_name -> api.instance.MappedListener
+	2,  // 50: api.instance.VpnPortalClientInfo.state:type_name -> api.instance.VpnPortalClientState
+	38, // 51: api.instance.VpnPortalInfo.clients:type_name -> api.instance.VpnPortalClientInfo
+	5,  // 52: api.instance.GetVpnPortalInfoRequest.instance:type_name -> api.instance.InstanceIdentifier
+	39, // 53: api.instance.GetVpnPortalInfoResponse.vpn_portal_info:type_name -> api.instance.VpnPortalInfo
+	82, // 54: api.instance.TcpProxyEntry.src:type_name -> common.SocketAddr
+	82, // 55: api.instance.TcpProxyEntry.dst:type_name -> common.SocketAddr
+	4,  // 56: api.instance.TcpProxyEntry.state:type_name -> api.instance.TcpProxyEntryState
+	3,  // 57: api.instance.TcpProxyEntry.transport_type:type_name -> api.instance.TcpProxyEntryTransportType
+	5,  // 58: api.instance.ListTcpProxyEntryRequest.instance:type_name -> api.instance.InstanceIdentifier
+	42, // 59: api.instance.ListTcpProxyEntryResponse.entries:type_name -> api.instance.TcpProxyEntry
+	5,  // 60: api.instance.GetAclStatsRequest.instance:type_name -> api.instance.InstanceIdentifier
+	83, // 61: api.instance.GetAclStatsResponse.acl_stats:type_name -> acl.AclStats
+	5,  // 62: api.instance.GetWhitelistRequest.instance:type_name -> api.instance.InstanceIdentifier
+	5,  // 63: api.instance.ListPortForwardRequest.instance:type_name -> api.instance.InstanceIdentifier
+	84, // 64: api.instance.ListPortForwardResponse.cfgs:type_name -> common.PortForwardConfigPb
+	70, // 65: api.instance.MetricSnapshot.labels:type_name -> api.instance.MetricSnapshot.LabelsEntry
+	5,  // 66: api.instance.GetStatsRequest.instance:type_name -> api.instance.InstanceIdentifier
+	51, // 67: api.instance.GetStatsResponse.metrics:type_name -> api.instance.MetricSnapshot
+	5,  // 68: api.instance.GetPrometheusStatsRequest.instance:type_name -> api.instance.InstanceIdentifier
+	5,  // 69: api.instance.GenerateCredentialRequest.instance:type_name -> api.instance.InstanceIdentifier
+	5,  // 70: api.instance.UpsertCredentialRequest.instance:type_name -> api.instance.InstanceIdentifier
+	5,  // 71: api.instance.RevokeCredentialRequest.instance:type_name -> api.instance.InstanceIdentifier
+	5,  // 72: api.instance.ListCredentialsRequest.instance:type_name -> api.instance.InstanceIdentifier
+	63, // 73: api.instance.ListCredentialsResponse.credentials:type_name -> api.instance.CredentialInfo
+	26, // 74: api.instance.ListForeignNetworkResponse.ForeignNetworksEntry.value:type_name -> api.instance.ForeignNetworkEntryPb
+	67, // 75: api.instance.ListGlobalForeignNetworkResponse.ForeignNetworks.foreign_networks:type_name -> api.instance.ListGlobalForeignNetworkResponse.OneForeignNetwork
+	68, // 76: api.instance.ListGlobalForeignNetworkResponse.ForeignNetworksEntry.value:type_name -> api.instance.ListGlobalForeignNetworkResponse.ForeignNetworks
+	10, // 77: api.instance.PeerManageRpc.ListPeer:input_type -> api.instance.ListPeerRequest
+	18, // 78: api.instance.PeerManageRpc.ListPublicIpv6Info:input_type -> api.instance.ListPublicIpv6InfoRequest
+	20, // 79: api.instance.PeerManageRpc.ListRoute:input_type -> api.instance.ListRouteRequest
+	22, // 80: api.instance.PeerManageRpc.DumpRoute:input_type -> api.instance.DumpRouteRequest
+	24, // 81: api.instance.PeerManageRpc.ListForeignNetwork:input_type -> api.instance.ListForeignNetworkRequest
+	28, // 82: api.instance.PeerManageRpc.ListGlobalForeignNetwork:input_type -> api.instance.ListGlobalForeignNetworkRequest
+	15, // 83: api.instance.PeerManageRpc.ShowNodeInfo:input_type -> api.instance.ShowNodeInfoRequest
+	30, // 84: api.instance.PeerManageRpc.GetForeignNetworkSummary:input_type -> api.instance.GetForeignNetworkSummaryRequest
+	33, // 85: api.instance.ConnectorManageRpc.ListConnector:input_type -> api.instance.ListConnectorRequest
+	36, // 86: api.instance.MappedListenerManageRpc.ListMappedListener:input_type -> api.instance.ListMappedListenerRequest
+	40, // 87: api.instance.VpnPortalRpc.GetVpnPortalInfo:input_type -> api.instance.GetVpnPortalInfoRequest
+	43, // 88: api.instance.TcpProxyRpc.ListTcpProxyEntry:input_type -> api.instance.ListTcpProxyEntryRequest
+	45, // 89: api.instance.AclManageRpc.GetAclStats:input_type -> api.instance.GetAclStatsRequest
+	47, // 90: api.instance.AclManageRpc.GetWhitelist:input_type -> api.instance.GetWhitelistRequest
+	49, // 91: api.instance.PortForwardManageRpc.ListPortForward:input_type -> api.instance.ListPortForwardRequest
+	52, // 92: api.instance.StatsRpc.GetStats:input_type -> api.instance.GetStatsRequest
+	54, // 93: api.instance.StatsRpc.GetPrometheusStats:input_type -> api.instance.GetPrometheusStatsRequest
+	56, // 94: api.instance.CredentialManageRpc.GenerateCredential:input_type -> api.instance.GenerateCredentialRequest
+	60, // 95: api.instance.CredentialManageRpc.RevokeCredential:input_type -> api.instance.RevokeCredentialRequest
+	62, // 96: api.instance.CredentialManageRpc.ListCredentials:input_type -> api.instance.ListCredentialsRequest
+	58, // 97: api.instance.CredentialManageRpc.UpsertCredential:input_type -> api.instance.UpsertCredentialRequest
+	11, // 98: api.instance.PeerManageRpc.ListPeer:output_type -> api.instance.ListPeerResponse
+	19, // 99: api.instance.PeerManageRpc.ListPublicIpv6Info:output_type -> api.instance.ListPublicIpv6InfoResponse
+	21, // 100: api.instance.PeerManageRpc.ListRoute:output_type -> api.instance.ListRouteResponse
+	23, // 101: api.instance.PeerManageRpc.DumpRoute:output_type -> api.instance.DumpRouteResponse
+	27, // 102: api.instance.PeerManageRpc.ListForeignNetwork:output_type -> api.instance.ListForeignNetworkResponse
+	29, // 103: api.instance.PeerManageRpc.ListGlobalForeignNetwork:output_type -> api.instance.ListGlobalForeignNetworkResponse
+	16, // 104: api.instance.PeerManageRpc.ShowNodeInfo:output_type -> api.instance.ShowNodeInfoResponse
+	31, // 105: api.instance.PeerManageRpc.GetForeignNetworkSummary:output_type -> api.instance.GetForeignNetworkSummaryResponse
+	34, // 106: api.instance.ConnectorManageRpc.ListConnector:output_type -> api.instance.ListConnectorResponse
+	37, // 107: api.instance.MappedListenerManageRpc.ListMappedListener:output_type -> api.instance.ListMappedListenerResponse
+	41, // 108: api.instance.VpnPortalRpc.GetVpnPortalInfo:output_type -> api.instance.GetVpnPortalInfoResponse
+	44, // 109: api.instance.TcpProxyRpc.ListTcpProxyEntry:output_type -> api.instance.ListTcpProxyEntryResponse
+	46, // 110: api.instance.AclManageRpc.GetAclStats:output_type -> api.instance.GetAclStatsResponse
+	48, // 111: api.instance.AclManageRpc.GetWhitelist:output_type -> api.instance.GetWhitelistResponse
+	50, // 112: api.instance.PortForwardManageRpc.ListPortForward:output_type -> api.instance.ListPortForwardResponse
+	53, // 113: api.instance.StatsRpc.GetStats:output_type -> api.instance.GetStatsResponse
+	55, // 114: api.instance.StatsRpc.GetPrometheusStats:output_type -> api.instance.GetPrometheusStatsResponse
+	57, // 115: api.instance.CredentialManageRpc.GenerateCredential:output_type -> api.instance.GenerateCredentialResponse
+	61, // 116: api.instance.CredentialManageRpc.RevokeCredential:output_type -> api.instance.RevokeCredentialResponse
+	64, // 117: api.instance.CredentialManageRpc.ListCredentials:output_type -> api.instance.ListCredentialsResponse
+	59, // 118: api.instance.CredentialManageRpc.UpsertCredential:output_type -> api.instance.UpsertCredentialResponse
+	98, // [98:119] is the sub-list for method output_type
+	77, // [77:98] is the sub-list for method input_type
+	77, // [77:77] is the sub-list for extension type_name
+	77, // [77:77] is the sub-list for extension extendee
+	0,  // [0:77] is the sub-list for field type_name
 }
 
 func init() { file_api_instance_proto_init() }
@@ -4158,16 +4554,19 @@ func file_api_instance_proto_init() {
 	}
 	file_api_instance_proto_msgTypes[7].OneofWrappers = []any{}
 	file_api_instance_proto_msgTypes[20].OneofWrappers = []any{}
-	file_api_instance_proto_msgTypes[50].OneofWrappers = []any{}
-	file_api_instance_proto_msgTypes[55].OneofWrappers = []any{}
-	file_api_instance_proto_msgTypes[57].OneofWrappers = []any{}
+	file_api_instance_proto_msgTypes[33].OneofWrappers = []any{}
+	file_api_instance_proto_msgTypes[34].OneofWrappers = []any{}
+	file_api_instance_proto_msgTypes[51].OneofWrappers = []any{}
+	file_api_instance_proto_msgTypes[53].OneofWrappers = []any{}
+	file_api_instance_proto_msgTypes[58].OneofWrappers = []any{}
+	file_api_instance_proto_msgTypes[60].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_api_instance_proto_rawDesc), len(file_api_instance_proto_rawDesc)),
-			NumEnums:      4,
-			NumMessages:   63,
+			NumEnums:      5,
+			NumMessages:   66,
 			NumExtensions: 0,
 			NumServices:   9,
 		},
diff --git a/easytier-go/proto/api/manage/api_manage.pb.go b/easytier-go/proto/api/manage/api_manage.pb.go
index 9e93c234..2a0d75d7 100644
--- a/easytier-go/proto/api/manage/api_manage.pb.go
+++ b/easytier-go/proto/api/manage/api_manage.pb.go
@@ -124,24 +124,28 @@ func (ConfigSource) EnumDescriptor() ([]byte, []int) {
 }
 
 type NetworkConfig struct {
-	state                      protoimpl.MessageState `protogen:"open.v1"`
-	InstanceId                 *string                `protobuf:"bytes,1,opt,name=instance_id,json=instanceId,proto3,oneof" json:"instance_id,omitempty"`
-	Dhcp                       *bool                  `protobuf:"varint,2,opt,name=dhcp,proto3,oneof" json:"dhcp,omitempty"`
-	VirtualIpv4                *string                `protobuf:"bytes,3,opt,name=virtual_ipv4,json=virtualIpv4,proto3,oneof" json:"virtual_ipv4,omitempty"`
-	NetworkLength              *int32                 `protobuf:"varint,4,opt,name=network_length,json=networkLength,proto3,oneof" json:"network_length,omitempty"`
-	Hostname                   *string                `protobuf:"bytes,5,opt,name=hostname,proto3,oneof" json:"hostname,omitempty"`
-	NetworkName                *string                `protobuf:"bytes,6,opt,name=network_name,json=networkName,proto3,oneof" json:"network_name,omitempty"`
-	NetworkSecret              *string                `protobuf:"bytes,7,opt,name=network_secret,json=networkSecret,proto3,oneof" json:"network_secret,omitempty"`
-	NetworkingMethod           *NetworkingMethod      `protobuf:"varint,8,opt,name=networking_method,json=networkingMethod,proto3,enum=api.manage.NetworkingMethod,oneof" json:"networking_method,omitempty"`
-	PublicServerUrl            *string                `protobuf:"bytes,9,opt,name=public_server_url,json=publicServerUrl,proto3,oneof" json:"public_server_url,omitempty"`
-	PeerUrls                   []string               `protobuf:"bytes,10,rep,name=peer_urls,json=peerUrls,proto3" json:"peer_urls,omitempty"`
-	ProxyCidrs                 []string               `protobuf:"bytes,11,rep,name=proxy_cidrs,json=proxyCidrs,proto3" json:"proxy_cidrs,omitempty"`
-	EnableVpnPortal            *bool                  `protobuf:"varint,12,opt,name=enable_vpn_portal,json=enableVpnPortal,proto3,oneof" json:"enable_vpn_portal,omitempty"`
-	VpnPortalListenPort        *int32                 `protobuf:"varint,13,opt,name=vpn_portal_listen_port,json=vpnPortalListenPort,proto3,oneof" json:"vpn_portal_listen_port,omitempty"`
-	VpnPortalClientNetworkAddr *string                `protobuf:"bytes,14,opt,name=vpn_portal_client_network_addr,json=vpnPortalClientNetworkAddr,proto3,oneof" json:"vpn_portal_client_network_addr,omitempty"`
-	VpnPortalClientNetworkLen  *int32                 `protobuf:"varint,15,opt,name=vpn_portal_client_network_len,json=vpnPortalClientNetworkLen,proto3,oneof" json:"vpn_portal_client_network_len,omitempty"`
-	AdvancedSettings           *bool                  `protobuf:"varint,16,opt,name=advanced_settings,json=advancedSettings,proto3,oneof" json:"advanced_settings,omitempty"`
-	ListenerUrls               []string               `protobuf:"bytes,17,rep,name=listener_urls,json=listenerUrls,proto3" json:"listener_urls,omitempty"`
+	state            protoimpl.MessageState `protogen:"open.v1"`
+	InstanceId       *string                `protobuf:"bytes,1,opt,name=instance_id,json=instanceId,proto3,oneof" json:"instance_id,omitempty"`
+	Dhcp             *bool                  `protobuf:"varint,2,opt,name=dhcp,proto3,oneof" json:"dhcp,omitempty"`
+	VirtualIpv4      *string                `protobuf:"bytes,3,opt,name=virtual_ipv4,json=virtualIpv4,proto3,oneof" json:"virtual_ipv4,omitempty"`
+	NetworkLength    *int32                 `protobuf:"varint,4,opt,name=network_length,json=networkLength,proto3,oneof" json:"network_length,omitempty"`
+	Hostname         *string                `protobuf:"bytes,5,opt,name=hostname,proto3,oneof" json:"hostname,omitempty"`
+	NetworkName      *string                `protobuf:"bytes,6,opt,name=network_name,json=networkName,proto3,oneof" json:"network_name,omitempty"`
+	NetworkSecret    *string                `protobuf:"bytes,7,opt,name=network_secret,json=networkSecret,proto3,oneof" json:"network_secret,omitempty"`
+	NetworkingMethod *NetworkingMethod      `protobuf:"varint,8,opt,name=networking_method,json=networkingMethod,proto3,enum=api.manage.NetworkingMethod,oneof" json:"networking_method,omitempty"`
+	PublicServerUrl  *string                `protobuf:"bytes,9,opt,name=public_server_url,json=publicServerUrl,proto3,oneof" json:"public_server_url,omitempty"`
+	PeerUrls         []string               `protobuf:"bytes,10,rep,name=peer_urls,json=peerUrls,proto3" json:"peer_urls,omitempty"`
+	ProxyCidrs       []string               `protobuf:"bytes,11,rep,name=proxy_cidrs,json=proxyCidrs,proto3" json:"proxy_cidrs,omitempty"`
+	// Deprecated: Marked as deprecated in api_manage.proto.
+	EnableVpnPortal *bool `protobuf:"varint,12,opt,name=enable_vpn_portal,json=enableVpnPortal,proto3,oneof" json:"enable_vpn_portal,omitempty"`
+	// Deprecated: Marked as deprecated in api_manage.proto.
+	VpnPortalListenPort *int32 `protobuf:"varint,13,opt,name=vpn_portal_listen_port,json=vpnPortalListenPort,proto3,oneof" json:"vpn_portal_listen_port,omitempty"`
+	// Deprecated: Marked as deprecated in api_manage.proto.
+	VpnPortalClientNetworkAddr *string `protobuf:"bytes,14,opt,name=vpn_portal_client_network_addr,json=vpnPortalClientNetworkAddr,proto3,oneof" json:"vpn_portal_client_network_addr,omitempty"`
+	// Deprecated: Marked as deprecated in api_manage.proto.
+	VpnPortalClientNetworkLen *int32   `protobuf:"varint,15,opt,name=vpn_portal_client_network_len,json=vpnPortalClientNetworkLen,proto3,oneof" json:"vpn_portal_client_network_len,omitempty"`
+	AdvancedSettings          *bool    `protobuf:"varint,16,opt,name=advanced_settings,json=advancedSettings,proto3,oneof" json:"advanced_settings,omitempty"`
+	ListenerUrls              []string `protobuf:"bytes,17,rep,name=listener_urls,json=listenerUrls,proto3" json:"listener_urls,omitempty"`
 	// optional int32 rpc_port = 18;
 	LatencyFirst                *bool    `protobuf:"varint,19,opt,name=latency_first,json=latencyFirst,proto3,oneof" json:"latency_first,omitempty"`
 	DevName                     *string  `protobuf:"bytes,20,opt,name=dev_name,json=devName,proto3,oneof" json:"dev_name,omitempty"`
@@ -172,27 +176,30 @@ type NetworkConfig struct {
 	EnableQuicProxy             *bool    `protobuf:"varint,45,opt,name=enable_quic_proxy,json=enableQuicProxy,proto3,oneof" json:"enable_quic_proxy,omitempty"`
 	DisableQuicInput            *bool    `protobuf:"varint,46,opt,name=disable_quic_input,json=disableQuicInput,proto3,oneof" json:"disable_quic_input,omitempty"`
 	// Deprecated: Marked as deprecated in api_manage.proto.
-	QuicListenPort          *int32                    `protobuf:"varint,50,opt,name=quic_listen_port,json=quicListenPort,proto3,oneof" json:"quic_listen_port,omitempty"`
-	PortForwards            []*PortForwardConfig      `protobuf:"bytes,48,rep,name=port_forwards,json=portForwards,proto3" json:"port_forwards,omitempty"`
-	DisableSymHolePunching  *bool                     `protobuf:"varint,49,opt,name=disable_sym_hole_punching,json=disableSymHolePunching,proto3,oneof" json:"disable_sym_hole_punching,omitempty"`
-	P2POnly                 *bool                     `protobuf:"varint,51,opt,name=p2p_only,json=p2pOnly,proto3,oneof" json:"p2p_only,omitempty"`
-	DataCompressAlgo        *common.CompressionAlgoPb `protobuf:"varint,52,opt,name=data_compress_algo,json=dataCompressAlgo,proto3,enum=common.CompressionAlgoPb,oneof" json:"data_compress_algo,omitempty"`
-	EncryptionAlgorithm     *string                   `protobuf:"bytes,53,opt,name=encryption_algorithm,json=encryptionAlgorithm,proto3,oneof" json:"encryption_algorithm,omitempty"`
-	DisableTcpHolePunching  *bool                     `protobuf:"varint,54,opt,name=disable_tcp_hole_punching,json=disableTcpHolePunching,proto3,oneof" json:"disable_tcp_hole_punching,omitempty"`
-	SecureMode              *common.SecureModeConfig  `protobuf:"bytes,55,opt,name=secure_mode,json=secureMode,proto3" json:"secure_mode,omitempty"`
-	Acl                     *acl.Acl                  `protobuf:"bytes,56,opt,name=acl,proto3,oneof" json:"acl,omitempty"`
-	CredentialFile          *string                   `protobuf:"bytes,57,opt,name=credential_file,json=credentialFile,proto3,oneof" json:"credential_file,omitempty"`
-	LazyP2P                 *bool                     `protobuf:"varint,58,opt,name=lazy_p2p,json=lazyP2p,proto3,oneof" json:"lazy_p2p,omitempty"`
-	NeedP2P                 *bool                     `protobuf:"varint,59,opt,name=need_p2p,json=needP2p,proto3,oneof" json:"need_p2p,omitempty"`
-	InstanceRecvBpsLimit    *uint64                   `protobuf:"varint,60,opt,name=instance_recv_bps_limit,json=instanceRecvBpsLimit,proto3,oneof" json:"instance_recv_bps_limit,omitempty"`
-	DisableUpnp             *bool                     `protobuf:"varint,61,opt,name=disable_upnp,json=disableUpnp,proto3,oneof" json:"disable_upnp,omitempty"`
-	Ipv6PublicAddrProvider  *bool                     `protobuf:"varint,62,opt,name=ipv6_public_addr_provider,json=ipv6PublicAddrProvider,proto3,oneof" json:"ipv6_public_addr_provider,omitempty"`
-	Ipv6PublicAddrAuto      *bool                     `protobuf:"varint,63,opt,name=ipv6_public_addr_auto,json=ipv6PublicAddrAuto,proto3,oneof" json:"ipv6_public_addr_auto,omitempty"`
-	Ipv6PublicAddrPrefix    *string                   `protobuf:"bytes,64,opt,name=ipv6_public_addr_prefix,json=ipv6PublicAddrPrefix,proto3,oneof" json:"ipv6_public_addr_prefix,omitempty"`
-	DisableRelayData        *bool                     `protobuf:"varint,65,opt,name=disable_relay_data,json=disableRelayData,proto3,oneof" json:"disable_relay_data,omitempty"`
-	EnableUdpBroadcastRelay *bool                     `protobuf:"varint,66,opt,name=enable_udp_broadcast_relay,json=enableUdpBroadcastRelay,proto3,oneof" json:"enable_udp_broadcast_relay,omitempty"`
-	SocketMark              *uint32                   `protobuf:"varint,67,opt,name=socket_mark,json=socketMark,proto3,oneof" json:"socket_mark,omitempty"`
-	Peers                   []*NetworkPeerConfig      `protobuf:"bytes,68,rep,name=peers,proto3" json:"peers,omitempty"`
+	QuicListenPort          *int32                     `protobuf:"varint,50,opt,name=quic_listen_port,json=quicListenPort,proto3,oneof" json:"quic_listen_port,omitempty"`
+	PortForwards            []*PortForwardConfig       `protobuf:"bytes,48,rep,name=port_forwards,json=portForwards,proto3" json:"port_forwards,omitempty"`
+	DisableSymHolePunching  *bool                      `protobuf:"varint,49,opt,name=disable_sym_hole_punching,json=disableSymHolePunching,proto3,oneof" json:"disable_sym_hole_punching,omitempty"`
+	P2POnly                 *bool                      `protobuf:"varint,51,opt,name=p2p_only,json=p2pOnly,proto3,oneof" json:"p2p_only,omitempty"`
+	DataCompressAlgo        *common.CompressionAlgoPb  `protobuf:"varint,52,opt,name=data_compress_algo,json=dataCompressAlgo,proto3,enum=common.CompressionAlgoPb,oneof" json:"data_compress_algo,omitempty"`
+	EncryptionAlgorithm     *string                    `protobuf:"bytes,53,opt,name=encryption_algorithm,json=encryptionAlgorithm,proto3,oneof" json:"encryption_algorithm,omitempty"`
+	DisableTcpHolePunching  *bool                      `protobuf:"varint,54,opt,name=disable_tcp_hole_punching,json=disableTcpHolePunching,proto3,oneof" json:"disable_tcp_hole_punching,omitempty"`
+	SecureMode              *common.SecureModeConfig   `protobuf:"bytes,55,opt,name=secure_mode,json=secureMode,proto3" json:"secure_mode,omitempty"`
+	Acl                     *acl.Acl                   `protobuf:"bytes,56,opt,name=acl,proto3,oneof" json:"acl,omitempty"`
+	CredentialFile          *string                    `protobuf:"bytes,57,opt,name=credential_file,json=credentialFile,proto3,oneof" json:"credential_file,omitempty"`
+	LazyP2P                 *bool                      `protobuf:"varint,58,opt,name=lazy_p2p,json=lazyP2p,proto3,oneof" json:"lazy_p2p,omitempty"`
+	NeedP2P                 *bool                      `protobuf:"varint,59,opt,name=need_p2p,json=needP2p,proto3,oneof" json:"need_p2p,omitempty"`
+	InstanceRecvBpsLimit    *uint64                    `protobuf:"varint,60,opt,name=instance_recv_bps_limit,json=instanceRecvBpsLimit,proto3,oneof" json:"instance_recv_bps_limit,omitempty"`
+	DisableUpnp             *bool                      `protobuf:"varint,61,opt,name=disable_upnp,json=disableUpnp,proto3,oneof" json:"disable_upnp,omitempty"`
+	Ipv6PublicAddrProvider  *bool                      `protobuf:"varint,62,opt,name=ipv6_public_addr_provider,json=ipv6PublicAddrProvider,proto3,oneof" json:"ipv6_public_addr_provider,omitempty"`
+	Ipv6PublicAddrAuto      *bool                      `protobuf:"varint,63,opt,name=ipv6_public_addr_auto,json=ipv6PublicAddrAuto,proto3,oneof" json:"ipv6_public_addr_auto,omitempty"`
+	Ipv6PublicAddrPrefix    *string                    `protobuf:"bytes,64,opt,name=ipv6_public_addr_prefix,json=ipv6PublicAddrPrefix,proto3,oneof" json:"ipv6_public_addr_prefix,omitempty"`
+	DisableRelayData        *bool                      `protobuf:"varint,65,opt,name=disable_relay_data,json=disableRelayData,proto3,oneof" json:"disable_relay_data,omitempty"`
+	EnableUdpBroadcastRelay *bool                      `protobuf:"varint,66,opt,name=enable_udp_broadcast_relay,json=enableUdpBroadcastRelay,proto3,oneof" json:"enable_udp_broadcast_relay,omitempty"`
+	SocketMark              *uint32                    `protobuf:"varint,67,opt,name=socket_mark,json=socketMark,proto3,oneof" json:"socket_mark,omitempty"`
+	Peers                   []*NetworkPeerConfig       `protobuf:"bytes,68,rep,name=peers,proto3" json:"peers,omitempty"`
+	VpnPortalConfig         *VpnPortalConfig           `protobuf:"bytes,69,opt,name=vpn_portal_config,json=vpnPortalConfig,proto3,oneof" json:"vpn_portal_config,omitempty"`
+	ManagedCredentials      []*ManagedCredentialConfig `protobuf:"bytes,71,rep,name=managed_credentials,json=managedCredentials,proto3" json:"managed_credentials,omitempty"`
+	PreferPeerRelay         *bool                      `protobuf:"varint,72,opt,name=prefer_peer_relay,json=preferPeerRelay,proto3,oneof" json:"prefer_peer_relay,omitempty"`
 	unknownFields           protoimpl.UnknownFields
 	sizeCache               protoimpl.SizeCache
 }
@@ -304,6 +311,7 @@ func (x *NetworkConfig) GetProxyCidrs() []string {
 	return nil
 }
 
+// Deprecated: Marked as deprecated in api_manage.proto.
 func (x *NetworkConfig) GetEnableVpnPortal() bool {
 	if x != nil && x.EnableVpnPortal != nil {
 		return *x.EnableVpnPortal
@@ -311,6 +319,7 @@ func (x *NetworkConfig) GetEnableVpnPortal() bool {
 	return false
 }
 
+// Deprecated: Marked as deprecated in api_manage.proto.
 func (x *NetworkConfig) GetVpnPortalListenPort() int32 {
 	if x != nil && x.VpnPortalListenPort != nil {
 		return *x.VpnPortalListenPort
@@ -318,6 +327,7 @@ func (x *NetworkConfig) GetVpnPortalListenPort() int32 {
 	return 0
 }
 
+// Deprecated: Marked as deprecated in api_manage.proto.
 func (x *NetworkConfig) GetVpnPortalClientNetworkAddr() string {
 	if x != nil && x.VpnPortalClientNetworkAddr != nil {
 		return *x.VpnPortalClientNetworkAddr
@@ -325,6 +335,7 @@ func (x *NetworkConfig) GetVpnPortalClientNetworkAddr() string {
 	return ""
 }
 
+// Deprecated: Marked as deprecated in api_manage.proto.
 func (x *NetworkConfig) GetVpnPortalClientNetworkLen() int32 {
 	if x != nil && x.VpnPortalClientNetworkLen != nil {
 		return *x.VpnPortalClientNetworkLen
@@ -690,6 +701,283 @@ func (x *NetworkConfig) GetPeers() []*NetworkPeerConfig {
 	return nil
 }
 
+func (x *NetworkConfig) GetVpnPortalConfig() *VpnPortalConfig {
+	if x != nil {
+		return x.VpnPortalConfig
+	}
+	return nil
+}
+
+func (x *NetworkConfig) GetManagedCredentials() []*ManagedCredentialConfig {
+	if x != nil {
+		return x.ManagedCredentials
+	}
+	return nil
+}
+
+func (x *NetworkConfig) GetPreferPeerRelay() bool {
+	if x != nil && x.PreferPeerRelay != nil {
+		return *x.PreferPeerRelay
+	}
+	return false
+}
+
+type ManagedCredentialConfig struct {
+	state             protoimpl.MessageState `protogen:"open.v1"`
+	CredentialId      string                 `protobuf:"bytes,1,opt,name=credential_id,json=credentialId,proto3" json:"credential_id,omitempty"`
+	CredentialSecret  string                 `protobuf:"bytes,2,opt,name=credential_secret,json=credentialSecret,proto3" json:"credential_secret,omitempty"`
+	Groups            []string               `protobuf:"bytes,3,rep,name=groups,proto3" json:"groups,omitempty"`
+	AllowRelay        bool                   `protobuf:"varint,4,opt,name=allow_relay,json=allowRelay,proto3" json:"allow_relay,omitempty"`
+	AllowedProxyCidrs []string               `protobuf:"bytes,5,rep,name=allowed_proxy_cidrs,json=allowedProxyCidrs,proto3" json:"allowed_proxy_cidrs,omitempty"`
+	ExpiryUnix        int64                  `protobuf:"varint,6,opt,name=expiry_unix,json=expiryUnix,proto3" json:"expiry_unix,omitempty"`
+	Reusable          *bool                  `protobuf:"varint,7,opt,name=reusable,proto3,oneof" json:"reusable,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
+}
+
+func (x *ManagedCredentialConfig) Reset() {
+	*x = ManagedCredentialConfig{}
+	mi := &file_api_manage_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ManagedCredentialConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ManagedCredentialConfig) ProtoMessage() {}
+
+func (x *ManagedCredentialConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_api_manage_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ManagedCredentialConfig.ProtoReflect.Descriptor instead.
+func (*ManagedCredentialConfig) Descriptor() ([]byte, []int) {
+	return file_api_manage_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ManagedCredentialConfig) GetCredentialId() string {
+	if x != nil {
+		return x.CredentialId
+	}
+	return ""
+}
+
+func (x *ManagedCredentialConfig) GetCredentialSecret() string {
+	if x != nil {
+		return x.CredentialSecret
+	}
+	return ""
+}
+
+func (x *ManagedCredentialConfig) GetGroups() []string {
+	if x != nil {
+		return x.Groups
+	}
+	return nil
+}
+
+func (x *ManagedCredentialConfig) GetAllowRelay() bool {
+	if x != nil {
+		return x.AllowRelay
+	}
+	return false
+}
+
+func (x *ManagedCredentialConfig) GetAllowedProxyCidrs() []string {
+	if x != nil {
+		return x.AllowedProxyCidrs
+	}
+	return nil
+}
+
+func (x *ManagedCredentialConfig) GetExpiryUnix() int64 {
+	if x != nil {
+		return x.ExpiryUnix
+	}
+	return 0
+}
+
+func (x *ManagedCredentialConfig) GetReusable() bool {
+	if x != nil && x.Reusable != nil {
+		return *x.Reusable
+	}
+	return false
+}
+
+type ManagedCredentialSet struct {
+	state         protoimpl.MessageState     `protogen:"open.v1"`
+	Entries       []*ManagedCredentialConfig `protobuf:"bytes,1,rep,name=entries,proto3" json:"entries,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ManagedCredentialSet) Reset() {
+	*x = ManagedCredentialSet{}
+	mi := &file_api_manage_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ManagedCredentialSet) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ManagedCredentialSet) ProtoMessage() {}
+
+func (x *ManagedCredentialSet) ProtoReflect() protoreflect.Message {
+	mi := &file_api_manage_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ManagedCredentialSet.ProtoReflect.Descriptor instead.
+func (*ManagedCredentialSet) Descriptor() ([]byte, []int) {
+	return file_api_manage_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ManagedCredentialSet) GetEntries() []*ManagedCredentialConfig {
+	if x != nil {
+		return x.Entries
+	}
+	return nil
+}
+
+type VpnPortalClientConfig struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	VirtualIp     string                 `protobuf:"bytes,2,opt,name=virtual_ip,json=virtualIp,proto3" json:"virtual_ip,omitempty"`
+	Groups        []string               `protobuf:"bytes,3,rep,name=groups,proto3" json:"groups,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *VpnPortalClientConfig) Reset() {
+	*x = VpnPortalClientConfig{}
+	mi := &file_api_manage_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *VpnPortalClientConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*VpnPortalClientConfig) ProtoMessage() {}
+
+func (x *VpnPortalClientConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_api_manage_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use VpnPortalClientConfig.ProtoReflect.Descriptor instead.
+func (*VpnPortalClientConfig) Descriptor() ([]byte, []int) {
+	return file_api_manage_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *VpnPortalClientConfig) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *VpnPortalClientConfig) GetVirtualIp() string {
+	if x != nil {
+		return x.VirtualIp
+	}
+	return ""
+}
+
+func (x *VpnPortalClientConfig) GetGroups() []string {
+	if x != nil {
+		return x.Groups
+	}
+	return nil
+}
+
+type VpnPortalConfig struct {
+	state               protoimpl.MessageState   `protogen:"open.v1"`
+	WireguardListen     string                   `protobuf:"bytes,1,opt,name=wireguard_listen,json=wireguardListen,proto3" json:"wireguard_listen,omitempty"`
+	WireguardPrivateKey *string                  `protobuf:"bytes,2,opt,name=wireguard_private_key,json=wireguardPrivateKey,proto3,oneof" json:"wireguard_private_key,omitempty"`
+	Clients             []*VpnPortalClientConfig `protobuf:"bytes,3,rep,name=clients,proto3" json:"clients,omitempty"`
+	unknownFields       protoimpl.UnknownFields
+	sizeCache           protoimpl.SizeCache
+}
+
+func (x *VpnPortalConfig) Reset() {
+	*x = VpnPortalConfig{}
+	mi := &file_api_manage_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *VpnPortalConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*VpnPortalConfig) ProtoMessage() {}
+
+func (x *VpnPortalConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_api_manage_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use VpnPortalConfig.ProtoReflect.Descriptor instead.
+func (*VpnPortalConfig) Descriptor() ([]byte, []int) {
+	return file_api_manage_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *VpnPortalConfig) GetWireguardListen() string {
+	if x != nil {
+		return x.WireguardListen
+	}
+	return ""
+}
+
+func (x *VpnPortalConfig) GetWireguardPrivateKey() string {
+	if x != nil && x.WireguardPrivateKey != nil {
+		return *x.WireguardPrivateKey
+	}
+	return ""
+}
+
+func (x *VpnPortalConfig) GetClients() []*VpnPortalClientConfig {
+	if x != nil {
+		return x.Clients
+	}
+	return nil
+}
+
 type NetworkPeerConfig struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Uri           string                 `protobuf:"bytes,1,opt,name=uri,proto3" json:"uri,omitempty"`
@@ -700,7 +988,7 @@ type NetworkPeerConfig struct {
 
 func (x *NetworkPeerConfig) Reset() {
 	*x = NetworkPeerConfig{}
-	mi := &file_api_manage_proto_msgTypes[1]
+	mi := &file_api_manage_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -712,7 +1000,7 @@ func (x *NetworkPeerConfig) String() string {
 func (*NetworkPeerConfig) ProtoMessage() {}
 
 func (x *NetworkPeerConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[1]
+	mi := &file_api_manage_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -725,7 +1013,7 @@ func (x *NetworkPeerConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NetworkPeerConfig.ProtoReflect.Descriptor instead.
 func (*NetworkPeerConfig) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{1}
+	return file_api_manage_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *NetworkPeerConfig) GetUri() string {
@@ -755,7 +1043,7 @@ type PortForwardConfig struct {
 
 func (x *PortForwardConfig) Reset() {
 	*x = PortForwardConfig{}
-	mi := &file_api_manage_proto_msgTypes[2]
+	mi := &file_api_manage_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -767,7 +1055,7 @@ func (x *PortForwardConfig) String() string {
 func (*PortForwardConfig) ProtoMessage() {}
 
 func (x *PortForwardConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[2]
+	mi := &file_api_manage_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -780,7 +1068,7 @@ func (x *PortForwardConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PortForwardConfig.ProtoReflect.Descriptor instead.
 func (*PortForwardConfig) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{2}
+	return file_api_manage_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *PortForwardConfig) GetBindIp() string {
@@ -819,22 +1107,23 @@ func (x *PortForwardConfig) GetProto() string {
 }
 
 type MyNodeInfo struct {
-	state         protoimpl.MessageState      `protogen:"open.v1"`
-	VirtualIpv4   *common.Ipv4Inet            `protobuf:"bytes,1,opt,name=virtual_ipv4,json=virtualIpv4,proto3" json:"virtual_ipv4,omitempty"`
-	Hostname      string                      `protobuf:"bytes,2,opt,name=hostname,proto3" json:"hostname,omitempty"`
-	Version       string                      `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
-	Ips           *peer_rpc.GetIpListResponse `protobuf:"bytes,4,opt,name=ips,proto3" json:"ips,omitempty"`
-	StunInfo      *common.StunInfo            `protobuf:"bytes,5,opt,name=stun_info,json=stunInfo,proto3" json:"stun_info,omitempty"`
-	Listeners     []*common.Url               `protobuf:"bytes,6,rep,name=listeners,proto3" json:"listeners,omitempty"`
-	VpnPortalCfg  *string                     `protobuf:"bytes,7,opt,name=vpn_portal_cfg,json=vpnPortalCfg,proto3,oneof" json:"vpn_portal_cfg,omitempty"`
-	PeerId        uint32                      `protobuf:"varint,8,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
+	state       protoimpl.MessageState      `protogen:"open.v1"`
+	VirtualIpv4 *common.Ipv4Inet            `protobuf:"bytes,1,opt,name=virtual_ipv4,json=virtualIpv4,proto3" json:"virtual_ipv4,omitempty"`
+	Hostname    string                      `protobuf:"bytes,2,opt,name=hostname,proto3" json:"hostname,omitempty"`
+	Version     string                      `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
+	Ips         *peer_rpc.GetIpListResponse `protobuf:"bytes,4,opt,name=ips,proto3" json:"ips,omitempty"`
+	StunInfo    *common.StunInfo            `protobuf:"bytes,5,opt,name=stun_info,json=stunInfo,proto3" json:"stun_info,omitempty"`
+	Listeners   []*common.Url               `protobuf:"bytes,6,rep,name=listeners,proto3" json:"listeners,omitempty"`
+	// Deprecated: Marked as deprecated in api_manage.proto.
+	VpnPortalCfg  *string `protobuf:"bytes,7,opt,name=vpn_portal_cfg,json=vpnPortalCfg,proto3,oneof" json:"vpn_portal_cfg,omitempty"`
+	PeerId        uint32  `protobuf:"varint,8,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
 func (x *MyNodeInfo) Reset() {
 	*x = MyNodeInfo{}
-	mi := &file_api_manage_proto_msgTypes[3]
+	mi := &file_api_manage_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -846,7 +1135,7 @@ func (x *MyNodeInfo) String() string {
 func (*MyNodeInfo) ProtoMessage() {}
 
 func (x *MyNodeInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[3]
+	mi := &file_api_manage_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -859,7 +1148,7 @@ func (x *MyNodeInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MyNodeInfo.ProtoReflect.Descriptor instead.
 func (*MyNodeInfo) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{3}
+	return file_api_manage_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *MyNodeInfo) GetVirtualIpv4() *common.Ipv4Inet {
@@ -904,6 +1193,7 @@ func (x *MyNodeInfo) GetListeners() []*common.Url {
 	return nil
 }
 
+// Deprecated: Marked as deprecated in api_manage.proto.
 func (x *MyNodeInfo) GetVpnPortalCfg() string {
 	if x != nil && x.VpnPortalCfg != nil {
 		return *x.VpnPortalCfg
@@ -935,7 +1225,7 @@ type NetworkInstanceRunningInfo struct {
 
 func (x *NetworkInstanceRunningInfo) Reset() {
 	*x = NetworkInstanceRunningInfo{}
-	mi := &file_api_manage_proto_msgTypes[4]
+	mi := &file_api_manage_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -947,7 +1237,7 @@ func (x *NetworkInstanceRunningInfo) String() string {
 func (*NetworkInstanceRunningInfo) ProtoMessage() {}
 
 func (x *NetworkInstanceRunningInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[4]
+	mi := &file_api_manage_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -960,7 +1250,7 @@ func (x *NetworkInstanceRunningInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NetworkInstanceRunningInfo.ProtoReflect.Descriptor instead.
 func (*NetworkInstanceRunningInfo) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{4}
+	return file_api_manage_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *NetworkInstanceRunningInfo) GetDevName() string {
@@ -1035,7 +1325,7 @@ type NetworkInstanceRunningInfoMap struct {
 
 func (x *NetworkInstanceRunningInfoMap) Reset() {
 	*x = NetworkInstanceRunningInfoMap{}
-	mi := &file_api_manage_proto_msgTypes[5]
+	mi := &file_api_manage_proto_msgTypes[9]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1047,7 +1337,7 @@ func (x *NetworkInstanceRunningInfoMap) String() string {
 func (*NetworkInstanceRunningInfoMap) ProtoMessage() {}
 
 func (x *NetworkInstanceRunningInfoMap) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[5]
+	mi := &file_api_manage_proto_msgTypes[9]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1060,7 +1350,7 @@ func (x *NetworkInstanceRunningInfoMap) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NetworkInstanceRunningInfoMap.ProtoReflect.Descriptor instead.
 func (*NetworkInstanceRunningInfoMap) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{5}
+	return file_api_manage_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *NetworkInstanceRunningInfoMap) GetMap() map[string]*NetworkInstanceRunningInfo {
@@ -1083,7 +1373,7 @@ type NetworkMeta struct {
 
 func (x *NetworkMeta) Reset() {
 	*x = NetworkMeta{}
-	mi := &file_api_manage_proto_msgTypes[6]
+	mi := &file_api_manage_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1095,7 +1385,7 @@ func (x *NetworkMeta) String() string {
 func (*NetworkMeta) ProtoMessage() {}
 
 func (x *NetworkMeta) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[6]
+	mi := &file_api_manage_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1108,7 +1398,7 @@ func (x *NetworkMeta) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NetworkMeta.ProtoReflect.Descriptor instead.
 func (*NetworkMeta) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{6}
+	return file_api_manage_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *NetworkMeta) GetInstId() *common.UUID {
@@ -1155,7 +1445,7 @@ type ValidateConfigRequest struct {
 
 func (x *ValidateConfigRequest) Reset() {
 	*x = ValidateConfigRequest{}
-	mi := &file_api_manage_proto_msgTypes[7]
+	mi := &file_api_manage_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1167,7 +1457,7 @@ func (x *ValidateConfigRequest) String() string {
 func (*ValidateConfigRequest) ProtoMessage() {}
 
 func (x *ValidateConfigRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[7]
+	mi := &file_api_manage_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1180,7 +1470,7 @@ func (x *ValidateConfigRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ValidateConfigRequest.ProtoReflect.Descriptor instead.
 func (*ValidateConfigRequest) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{7}
+	return file_api_manage_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *ValidateConfigRequest) GetConfig() *NetworkConfig {
@@ -1199,7 +1489,7 @@ type ValidateConfigResponse struct {
 
 func (x *ValidateConfigResponse) Reset() {
 	*x = ValidateConfigResponse{}
-	mi := &file_api_manage_proto_msgTypes[8]
+	mi := &file_api_manage_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1211,7 +1501,7 @@ func (x *ValidateConfigResponse) String() string {
 func (*ValidateConfigResponse) ProtoMessage() {}
 
 func (x *ValidateConfigResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[8]
+	mi := &file_api_manage_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1224,7 +1514,7 @@ func (x *ValidateConfigResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ValidateConfigResponse.ProtoReflect.Descriptor instead.
 func (*ValidateConfigResponse) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{8}
+	return file_api_manage_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *ValidateConfigResponse) GetTomlConfig() string {
@@ -1246,7 +1536,7 @@ type RunNetworkInstanceRequest struct {
 
 func (x *RunNetworkInstanceRequest) Reset() {
 	*x = RunNetworkInstanceRequest{}
-	mi := &file_api_manage_proto_msgTypes[9]
+	mi := &file_api_manage_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1258,7 +1548,7 @@ func (x *RunNetworkInstanceRequest) String() string {
 func (*RunNetworkInstanceRequest) ProtoMessage() {}
 
 func (x *RunNetworkInstanceRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[9]
+	mi := &file_api_manage_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1271,7 +1561,7 @@ func (x *RunNetworkInstanceRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RunNetworkInstanceRequest.ProtoReflect.Descriptor instead.
 func (*RunNetworkInstanceRequest) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{9}
+	return file_api_manage_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *RunNetworkInstanceRequest) GetInstId() *common.UUID {
@@ -1311,7 +1601,7 @@ type RunNetworkInstanceResponse struct {
 
 func (x *RunNetworkInstanceResponse) Reset() {
 	*x = RunNetworkInstanceResponse{}
-	mi := &file_api_manage_proto_msgTypes[10]
+	mi := &file_api_manage_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1323,7 +1613,7 @@ func (x *RunNetworkInstanceResponse) String() string {
 func (*RunNetworkInstanceResponse) ProtoMessage() {}
 
 func (x *RunNetworkInstanceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[10]
+	mi := &file_api_manage_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1336,7 +1626,7 @@ func (x *RunNetworkInstanceResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RunNetworkInstanceResponse.ProtoReflect.Descriptor instead.
 func (*RunNetworkInstanceResponse) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{10}
+	return file_api_manage_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *RunNetworkInstanceResponse) GetInstId() *common.UUID {
@@ -1355,7 +1645,7 @@ type RetainNetworkInstanceRequest struct {
 
 func (x *RetainNetworkInstanceRequest) Reset() {
 	*x = RetainNetworkInstanceRequest{}
-	mi := &file_api_manage_proto_msgTypes[11]
+	mi := &file_api_manage_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1367,7 +1657,7 @@ func (x *RetainNetworkInstanceRequest) String() string {
 func (*RetainNetworkInstanceRequest) ProtoMessage() {}
 
 func (x *RetainNetworkInstanceRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[11]
+	mi := &file_api_manage_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1380,7 +1670,7 @@ func (x *RetainNetworkInstanceRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RetainNetworkInstanceRequest.ProtoReflect.Descriptor instead.
 func (*RetainNetworkInstanceRequest) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{11}
+	return file_api_manage_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *RetainNetworkInstanceRequest) GetInstIds() []*common.UUID {
@@ -1399,7 +1689,7 @@ type RetainNetworkInstanceResponse struct {
 
 func (x *RetainNetworkInstanceResponse) Reset() {
 	*x = RetainNetworkInstanceResponse{}
-	mi := &file_api_manage_proto_msgTypes[12]
+	mi := &file_api_manage_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1411,7 +1701,7 @@ func (x *RetainNetworkInstanceResponse) String() string {
 func (*RetainNetworkInstanceResponse) ProtoMessage() {}
 
 func (x *RetainNetworkInstanceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[12]
+	mi := &file_api_manage_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1424,7 +1714,7 @@ func (x *RetainNetworkInstanceResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RetainNetworkInstanceResponse.ProtoReflect.Descriptor instead.
 func (*RetainNetworkInstanceResponse) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{12}
+	return file_api_manage_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *RetainNetworkInstanceResponse) GetRemainInstIds() []*common.UUID {
@@ -1443,7 +1733,7 @@ type CollectNetworkInfoRequest struct {
 
 func (x *CollectNetworkInfoRequest) Reset() {
 	*x = CollectNetworkInfoRequest{}
-	mi := &file_api_manage_proto_msgTypes[13]
+	mi := &file_api_manage_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1455,7 +1745,7 @@ func (x *CollectNetworkInfoRequest) String() string {
 func (*CollectNetworkInfoRequest) ProtoMessage() {}
 
 func (x *CollectNetworkInfoRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[13]
+	mi := &file_api_manage_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1468,7 +1758,7 @@ func (x *CollectNetworkInfoRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CollectNetworkInfoRequest.ProtoReflect.Descriptor instead.
 func (*CollectNetworkInfoRequest) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{13}
+	return file_api_manage_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *CollectNetworkInfoRequest) GetInstIds() []*common.UUID {
@@ -1487,7 +1777,7 @@ type CollectNetworkInfoResponse struct {
 
 func (x *CollectNetworkInfoResponse) Reset() {
 	*x = CollectNetworkInfoResponse{}
-	mi := &file_api_manage_proto_msgTypes[14]
+	mi := &file_api_manage_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1499,7 +1789,7 @@ func (x *CollectNetworkInfoResponse) String() string {
 func (*CollectNetworkInfoResponse) ProtoMessage() {}
 
 func (x *CollectNetworkInfoResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[14]
+	mi := &file_api_manage_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1512,7 +1802,7 @@ func (x *CollectNetworkInfoResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CollectNetworkInfoResponse.ProtoReflect.Descriptor instead.
 func (*CollectNetworkInfoResponse) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{14}
+	return file_api_manage_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *CollectNetworkInfoResponse) GetInfo() *NetworkInstanceRunningInfoMap {
@@ -1530,7 +1820,7 @@ type ListNetworkInstanceRequest struct {
 
 func (x *ListNetworkInstanceRequest) Reset() {
 	*x = ListNetworkInstanceRequest{}
-	mi := &file_api_manage_proto_msgTypes[15]
+	mi := &file_api_manage_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1542,7 +1832,7 @@ func (x *ListNetworkInstanceRequest) String() string {
 func (*ListNetworkInstanceRequest) ProtoMessage() {}
 
 func (x *ListNetworkInstanceRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[15]
+	mi := &file_api_manage_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1555,7 +1845,7 @@ func (x *ListNetworkInstanceRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListNetworkInstanceRequest.ProtoReflect.Descriptor instead.
 func (*ListNetworkInstanceRequest) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{15}
+	return file_api_manage_proto_rawDescGZIP(), []int{19}
 }
 
 type ListNetworkInstanceResponse struct {
@@ -1567,7 +1857,7 @@ type ListNetworkInstanceResponse struct {
 
 func (x *ListNetworkInstanceResponse) Reset() {
 	*x = ListNetworkInstanceResponse{}
-	mi := &file_api_manage_proto_msgTypes[16]
+	mi := &file_api_manage_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1579,7 +1869,7 @@ func (x *ListNetworkInstanceResponse) String() string {
 func (*ListNetworkInstanceResponse) ProtoMessage() {}
 
 func (x *ListNetworkInstanceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[16]
+	mi := &file_api_manage_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1592,7 +1882,7 @@ func (x *ListNetworkInstanceResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListNetworkInstanceResponse.ProtoReflect.Descriptor instead.
 func (*ListNetworkInstanceResponse) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{16}
+	return file_api_manage_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *ListNetworkInstanceResponse) GetInstIds() []*common.UUID {
@@ -1611,7 +1901,7 @@ type DeleteNetworkInstanceRequest struct {
 
 func (x *DeleteNetworkInstanceRequest) Reset() {
 	*x = DeleteNetworkInstanceRequest{}
-	mi := &file_api_manage_proto_msgTypes[17]
+	mi := &file_api_manage_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1623,7 +1913,7 @@ func (x *DeleteNetworkInstanceRequest) String() string {
 func (*DeleteNetworkInstanceRequest) ProtoMessage() {}
 
 func (x *DeleteNetworkInstanceRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[17]
+	mi := &file_api_manage_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1636,7 +1926,7 @@ func (x *DeleteNetworkInstanceRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteNetworkInstanceRequest.ProtoReflect.Descriptor instead.
 func (*DeleteNetworkInstanceRequest) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{17}
+	return file_api_manage_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *DeleteNetworkInstanceRequest) GetInstIds() []*common.UUID {
@@ -1655,7 +1945,7 @@ type DeleteNetworkInstanceResponse struct {
 
 func (x *DeleteNetworkInstanceResponse) Reset() {
 	*x = DeleteNetworkInstanceResponse{}
-	mi := &file_api_manage_proto_msgTypes[18]
+	mi := &file_api_manage_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1667,7 +1957,7 @@ func (x *DeleteNetworkInstanceResponse) String() string {
 func (*DeleteNetworkInstanceResponse) ProtoMessage() {}
 
 func (x *DeleteNetworkInstanceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[18]
+	mi := &file_api_manage_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1680,7 +1970,7 @@ func (x *DeleteNetworkInstanceResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteNetworkInstanceResponse.ProtoReflect.Descriptor instead.
 func (*DeleteNetworkInstanceResponse) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{18}
+	return file_api_manage_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *DeleteNetworkInstanceResponse) GetRemainInstIds() []*common.UUID {
@@ -1699,7 +1989,7 @@ type GetNetworkInstanceConfigRequest struct {
 
 func (x *GetNetworkInstanceConfigRequest) Reset() {
 	*x = GetNetworkInstanceConfigRequest{}
-	mi := &file_api_manage_proto_msgTypes[19]
+	mi := &file_api_manage_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1711,7 +2001,7 @@ func (x *GetNetworkInstanceConfigRequest) String() string {
 func (*GetNetworkInstanceConfigRequest) ProtoMessage() {}
 
 func (x *GetNetworkInstanceConfigRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[19]
+	mi := &file_api_manage_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1724,7 +2014,7 @@ func (x *GetNetworkInstanceConfigRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetNetworkInstanceConfigRequest.ProtoReflect.Descriptor instead.
 func (*GetNetworkInstanceConfigRequest) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{19}
+	return file_api_manage_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *GetNetworkInstanceConfigRequest) GetInstId() *common.UUID {
@@ -1744,7 +2034,7 @@ type GetNetworkInstanceConfigResponse struct {
 
 func (x *GetNetworkInstanceConfigResponse) Reset() {
 	*x = GetNetworkInstanceConfigResponse{}
-	mi := &file_api_manage_proto_msgTypes[20]
+	mi := &file_api_manage_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1756,7 +2046,7 @@ func (x *GetNetworkInstanceConfigResponse) String() string {
 func (*GetNetworkInstanceConfigResponse) ProtoMessage() {}
 
 func (x *GetNetworkInstanceConfigResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[20]
+	mi := &file_api_manage_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1769,7 +2059,7 @@ func (x *GetNetworkInstanceConfigResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetNetworkInstanceConfigResponse.ProtoReflect.Descriptor instead.
 func (*GetNetworkInstanceConfigResponse) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{20}
+	return file_api_manage_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *GetNetworkInstanceConfigResponse) GetConfig() *NetworkConfig {
@@ -1795,7 +2085,7 @@ type ListNetworkInstanceMetaRequest struct {
 
 func (x *ListNetworkInstanceMetaRequest) Reset() {
 	*x = ListNetworkInstanceMetaRequest{}
-	mi := &file_api_manage_proto_msgTypes[21]
+	mi := &file_api_manage_proto_msgTypes[25]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1807,7 +2097,7 @@ func (x *ListNetworkInstanceMetaRequest) String() string {
 func (*ListNetworkInstanceMetaRequest) ProtoMessage() {}
 
 func (x *ListNetworkInstanceMetaRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[21]
+	mi := &file_api_manage_proto_msgTypes[25]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1820,7 +2110,7 @@ func (x *ListNetworkInstanceMetaRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListNetworkInstanceMetaRequest.ProtoReflect.Descriptor instead.
 func (*ListNetworkInstanceMetaRequest) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{21}
+	return file_api_manage_proto_rawDescGZIP(), []int{25}
 }
 
 func (x *ListNetworkInstanceMetaRequest) GetInstIds() []*common.UUID {
@@ -1839,7 +2129,7 @@ type ListNetworkInstanceMetaResponse struct {
 
 func (x *ListNetworkInstanceMetaResponse) Reset() {
 	*x = ListNetworkInstanceMetaResponse{}
-	mi := &file_api_manage_proto_msgTypes[22]
+	mi := &file_api_manage_proto_msgTypes[26]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1851,7 +2141,7 @@ func (x *ListNetworkInstanceMetaResponse) String() string {
 func (*ListNetworkInstanceMetaResponse) ProtoMessage() {}
 
 func (x *ListNetworkInstanceMetaResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_manage_proto_msgTypes[22]
+	mi := &file_api_manage_proto_msgTypes[26]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1864,7 +2154,7 @@ func (x *ListNetworkInstanceMetaResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListNetworkInstanceMetaResponse.ProtoReflect.Descriptor instead.
 func (*ListNetworkInstanceMetaResponse) Descriptor() ([]byte, []int) {
-	return file_api_manage_proto_rawDescGZIP(), []int{22}
+	return file_api_manage_proto_rawDescGZIP(), []int{26}
 }
 
 func (x *ListNetworkInstanceMetaResponse) GetMetas() []*NetworkMeta {
@@ -1879,7 +2169,7 @@ var File_api_manage_proto protoreflect.FileDescriptor
 const file_api_manage_proto_rawDesc = "" +
 	"\n" +
 	"\x10api_manage.proto\x12\n" +
-	"api.manage\x1a\fcommon.proto\x1a\x0epeer_rpc.proto\x1a\x12api_instance.proto\x1a\tacl.proto\"\xef!\n" +
+	"api.manage\x1a\fcommon.proto\x1a\x0epeer_rpc.proto\x1a\x12api_instance.proto\x1a\tacl.proto\"\x80$\n" +
 	"\rNetworkConfig\x12$\n" +
 	"\vinstance_id\x18\x01 \x01(\tH\x00R\n" +
 	"instanceId\x88\x01\x01\x12\x17\n" +
@@ -1894,12 +2184,12 @@ const file_api_manage_proto_rawDesc = "" +
 	"\tpeer_urls\x18\n" +
 	" \x03(\tR\bpeerUrls\x12\x1f\n" +
 	"\vproxy_cidrs\x18\v \x03(\tR\n" +
-	"proxyCidrs\x12/\n" +
-	"\x11enable_vpn_portal\x18\f \x01(\bH\tR\x0fenableVpnPortal\x88\x01\x01\x128\n" +
-	"\x16vpn_portal_listen_port\x18\r \x01(\x05H\n" +
-	"R\x13vpnPortalListenPort\x88\x01\x01\x12G\n" +
-	"\x1evpn_portal_client_network_addr\x18\x0e \x01(\tH\vR\x1avpnPortalClientNetworkAddr\x88\x01\x01\x12E\n" +
-	"\x1dvpn_portal_client_network_len\x18\x0f \x01(\x05H\fR\x19vpnPortalClientNetworkLen\x88\x01\x01\x120\n" +
+	"proxyCidrs\x123\n" +
+	"\x11enable_vpn_portal\x18\f \x01(\bB\x02\x18\x01H\tR\x0fenableVpnPortal\x88\x01\x01\x12<\n" +
+	"\x16vpn_portal_listen_port\x18\r \x01(\x05B\x02\x18\x01H\n" +
+	"R\x13vpnPortalListenPort\x88\x01\x01\x12K\n" +
+	"\x1evpn_portal_client_network_addr\x18\x0e \x01(\tB\x02\x18\x01H\vR\x1avpnPortalClientNetworkAddr\x88\x01\x01\x12I\n" +
+	"\x1dvpn_portal_client_network_len\x18\x0f \x01(\x05B\x02\x18\x01H\fR\x19vpnPortalClientNetworkLen\x88\x01\x01\x120\n" +
 	"\x11advanced_settings\x18\x10 \x01(\bH\rR\x10advancedSettings\x88\x01\x01\x12#\n" +
 	"\rlistener_urls\x18\x11 \x03(\tR\flistenerUrls\x12(\n" +
 	"\rlatency_first\x18\x13 \x01(\bH\x0eR\flatencyFirst\x88\x01\x01\x12\x1e\n" +
@@ -1957,7 +2247,10 @@ const file_api_manage_proto_rawDesc = "" +
 	"\x1aenable_udp_broadcast_relay\x18B \x01(\bH6R\x17enableUdpBroadcastRelay\x88\x01\x01\x12$\n" +
 	"\vsocket_mark\x18C \x01(\rH7R\n" +
 	"socketMark\x88\x01\x01\x123\n" +
-	"\x05peers\x18D \x03(\v2\x1d.api.manage.NetworkPeerConfigR\x05peersB\x0e\n" +
+	"\x05peers\x18D \x03(\v2\x1d.api.manage.NetworkPeerConfigR\x05peers\x12L\n" +
+	"\x11vpn_portal_config\x18E \x01(\v2\x1b.api.manage.VpnPortalConfigH8R\x0fvpnPortalConfig\x88\x01\x01\x12T\n" +
+	"\x13managed_credentials\x18G \x03(\v2#.api.manage.ManagedCredentialConfigR\x12managedCredentials\x12/\n" +
+	"\x11prefer_peer_relay\x18H \x01(\bH9R\x0fpreferPeerRelay\x88\x01\x01B\x0e\n" +
 	"\f_instance_idB\a\n" +
 	"\x05_dhcpB\x0f\n" +
 	"\r_virtual_ipv4B\x11\n" +
@@ -2013,7 +2306,32 @@ const file_api_manage_proto_rawDesc = "" +
 	"\x18_ipv6_public_addr_prefixB\x15\n" +
 	"\x13_disable_relay_dataB\x1d\n" +
 	"\x1b_enable_udp_broadcast_relayB\x0e\n" +
-	"\f_socket_mark\"f\n" +
+	"\f_socket_markB\x14\n" +
+	"\x12_vpn_portal_configB\x14\n" +
+	"\x12_prefer_peer_relay\"\xa3\x02\n" +
+	"\x17ManagedCredentialConfig\x12#\n" +
+	"\rcredential_id\x18\x01 \x01(\tR\fcredentialId\x12+\n" +
+	"\x11credential_secret\x18\x02 \x01(\tR\x10credentialSecret\x12\x16\n" +
+	"\x06groups\x18\x03 \x03(\tR\x06groups\x12\x1f\n" +
+	"\vallow_relay\x18\x04 \x01(\bR\n" +
+	"allowRelay\x12.\n" +
+	"\x13allowed_proxy_cidrs\x18\x05 \x03(\tR\x11allowedProxyCidrs\x12\x1f\n" +
+	"\vexpiry_unix\x18\x06 \x01(\x03R\n" +
+	"expiryUnix\x12\x1f\n" +
+	"\breusable\x18\a \x01(\bH\x00R\breusable\x88\x01\x01B\v\n" +
+	"\t_reusable\"U\n" +
+	"\x14ManagedCredentialSet\x12=\n" +
+	"\aentries\x18\x01 \x03(\v2#.api.manage.ManagedCredentialConfigR\aentries\"b\n" +
+	"\x15VpnPortalClientConfig\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1d\n" +
+	"\n" +
+	"virtual_ip\x18\x02 \x01(\tR\tvirtualIp\x12\x16\n" +
+	"\x06groups\x18\x03 \x03(\tR\x06groups\"\xcc\x01\n" +
+	"\x0fVpnPortalConfig\x12)\n" +
+	"\x10wireguard_listen\x18\x01 \x01(\tR\x0fwireguardListen\x127\n" +
+	"\x15wireguard_private_key\x18\x02 \x01(\tH\x00R\x13wireguardPrivateKey\x88\x01\x01\x12;\n" +
+	"\aclients\x18\x03 \x03(\v2!.api.manage.VpnPortalClientConfigR\aclientsB\x18\n" +
+	"\x16_wireguard_private_key\"f\n" +
 	"\x11NetworkPeerConfig\x12\x10\n" +
 	"\x03uri\x18\x01 \x01(\tR\x03uri\x12+\n" +
 	"\x0fpeer_public_key\x18\x02 \x01(\tH\x00R\rpeerPublicKey\x88\x01\x01B\x12\n" +
@@ -2023,7 +2341,7 @@ const file_api_manage_proto_rawDesc = "" +
 	"\tbind_port\x18\x02 \x01(\rR\bbindPort\x12\x15\n" +
 	"\x06dst_ip\x18\x03 \x01(\tR\x05dstIp\x12\x19\n" +
 	"\bdst_port\x18\x04 \x01(\rR\adstPort\x12\x14\n" +
-	"\x05proto\x18\x05 \x01(\tR\x05proto\"\xd7\x02\n" +
+	"\x05proto\x18\x05 \x01(\tR\x05proto\"\xdb\x02\n" +
 	"\n" +
 	"MyNodeInfo\x123\n" +
 	"\fvirtual_ipv4\x18\x01 \x01(\v2\x10.common.Ipv4InetR\vvirtualIpv4\x12\x1a\n" +
@@ -2031,8 +2349,8 @@ const file_api_manage_proto_rawDesc = "" +
 	"\aversion\x18\x03 \x01(\tR\aversion\x12-\n" +
 	"\x03ips\x18\x04 \x01(\v2\x1b.peer_rpc.GetIpListResponseR\x03ips\x12-\n" +
 	"\tstun_info\x18\x05 \x01(\v2\x10.common.StunInfoR\bstunInfo\x12)\n" +
-	"\tlisteners\x18\x06 \x03(\v2\v.common.UrlR\tlisteners\x12)\n" +
-	"\x0evpn_portal_cfg\x18\a \x01(\tH\x00R\fvpnPortalCfg\x88\x01\x01\x12\x17\n" +
+	"\tlisteners\x18\x06 \x03(\v2\v.common.UrlR\tlisteners\x12-\n" +
+	"\x0evpn_portal_cfg\x18\a \x01(\tB\x02\x18\x01H\x00R\fvpnPortalCfg\x88\x01\x01\x12\x17\n" +
 	"\apeer_id\x18\b \x01(\rR\x06peerIdB\x11\n" +
 	"\x0f_vpn_portal_cfg\"\xd3\x03\n" +
 	"\x1aNetworkInstanceRunningInfo\x12\x19\n" +
@@ -2128,105 +2446,113 @@ func file_api_manage_proto_rawDescGZIP() []byte {
 }
 
 var file_api_manage_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
-var file_api_manage_proto_msgTypes = make([]protoimpl.MessageInfo, 24)
+var file_api_manage_proto_msgTypes = make([]protoimpl.MessageInfo, 28)
 var file_api_manage_proto_goTypes = []any{
 	(NetworkingMethod)(0),                       // 0: api.manage.NetworkingMethod
 	(ConfigSource)(0),                           // 1: api.manage.ConfigSource
 	(*NetworkConfig)(nil),                       // 2: api.manage.NetworkConfig
-	(*NetworkPeerConfig)(nil),                   // 3: api.manage.NetworkPeerConfig
-	(*PortForwardConfig)(nil),                   // 4: api.manage.PortForwardConfig
-	(*MyNodeInfo)(nil),                          // 5: api.manage.MyNodeInfo
-	(*NetworkInstanceRunningInfo)(nil),          // 6: api.manage.NetworkInstanceRunningInfo
-	(*NetworkInstanceRunningInfoMap)(nil),       // 7: api.manage.NetworkInstanceRunningInfoMap
-	(*NetworkMeta)(nil),                         // 8: api.manage.NetworkMeta
-	(*ValidateConfigRequest)(nil),               // 9: api.manage.ValidateConfigRequest
-	(*ValidateConfigResponse)(nil),              // 10: api.manage.ValidateConfigResponse
-	(*RunNetworkInstanceRequest)(nil),           // 11: api.manage.RunNetworkInstanceRequest
-	(*RunNetworkInstanceResponse)(nil),          // 12: api.manage.RunNetworkInstanceResponse
-	(*RetainNetworkInstanceRequest)(nil),        // 13: api.manage.RetainNetworkInstanceRequest
-	(*RetainNetworkInstanceResponse)(nil),       // 14: api.manage.RetainNetworkInstanceResponse
-	(*CollectNetworkInfoRequest)(nil),           // 15: api.manage.CollectNetworkInfoRequest
-	(*CollectNetworkInfoResponse)(nil),          // 16: api.manage.CollectNetworkInfoResponse
-	(*ListNetworkInstanceRequest)(nil),          // 17: api.manage.ListNetworkInstanceRequest
-	(*ListNetworkInstanceResponse)(nil),         // 18: api.manage.ListNetworkInstanceResponse
-	(*DeleteNetworkInstanceRequest)(nil),        // 19: api.manage.DeleteNetworkInstanceRequest
-	(*DeleteNetworkInstanceResponse)(nil),       // 20: api.manage.DeleteNetworkInstanceResponse
-	(*GetNetworkInstanceConfigRequest)(nil),     // 21: api.manage.GetNetworkInstanceConfigRequest
-	(*GetNetworkInstanceConfigResponse)(nil),    // 22: api.manage.GetNetworkInstanceConfigResponse
-	(*ListNetworkInstanceMetaRequest)(nil),      // 23: api.manage.ListNetworkInstanceMetaRequest
-	(*ListNetworkInstanceMetaResponse)(nil),     // 24: api.manage.ListNetworkInstanceMetaResponse
-	nil,                                         // 25: api.manage.NetworkInstanceRunningInfoMap.MapEntry
-	(common.CompressionAlgoPb)(0),               // 26: common.CompressionAlgoPb
-	(*common.SecureModeConfig)(nil),             // 27: common.SecureModeConfig
-	(*acl.Acl)(nil),                             // 28: acl.Acl
-	(*common.Ipv4Inet)(nil),                     // 29: common.Ipv4Inet
-	(*peer_rpc.GetIpListResponse)(nil),          // 30: peer_rpc.GetIpListResponse
-	(*common.StunInfo)(nil),                     // 31: common.StunInfo
-	(*common.Url)(nil),                          // 32: common.Url
-	(*instance.Route)(nil),                      // 33: api.instance.Route
-	(*instance.PeerInfo)(nil),                   // 34: api.instance.PeerInfo
-	(*instance.PeerRoutePair)(nil),              // 35: api.instance.PeerRoutePair
-	(*peer_rpc.RouteForeignNetworkSummary)(nil), // 36: peer_rpc.RouteForeignNetworkSummary
-	(*common.UUID)(nil),                         // 37: common.UUID
+	(*ManagedCredentialConfig)(nil),             // 3: api.manage.ManagedCredentialConfig
+	(*ManagedCredentialSet)(nil),                // 4: api.manage.ManagedCredentialSet
+	(*VpnPortalClientConfig)(nil),               // 5: api.manage.VpnPortalClientConfig
+	(*VpnPortalConfig)(nil),                     // 6: api.manage.VpnPortalConfig
+	(*NetworkPeerConfig)(nil),                   // 7: api.manage.NetworkPeerConfig
+	(*PortForwardConfig)(nil),                   // 8: api.manage.PortForwardConfig
+	(*MyNodeInfo)(nil),                          // 9: api.manage.MyNodeInfo
+	(*NetworkInstanceRunningInfo)(nil),          // 10: api.manage.NetworkInstanceRunningInfo
+	(*NetworkInstanceRunningInfoMap)(nil),       // 11: api.manage.NetworkInstanceRunningInfoMap
+	(*NetworkMeta)(nil),                         // 12: api.manage.NetworkMeta
+	(*ValidateConfigRequest)(nil),               // 13: api.manage.ValidateConfigRequest
+	(*ValidateConfigResponse)(nil),              // 14: api.manage.ValidateConfigResponse
+	(*RunNetworkInstanceRequest)(nil),           // 15: api.manage.RunNetworkInstanceRequest
+	(*RunNetworkInstanceResponse)(nil),          // 16: api.manage.RunNetworkInstanceResponse
+	(*RetainNetworkInstanceRequest)(nil),        // 17: api.manage.RetainNetworkInstanceRequest
+	(*RetainNetworkInstanceResponse)(nil),       // 18: api.manage.RetainNetworkInstanceResponse
+	(*CollectNetworkInfoRequest)(nil),           // 19: api.manage.CollectNetworkInfoRequest
+	(*CollectNetworkInfoResponse)(nil),          // 20: api.manage.CollectNetworkInfoResponse
+	(*ListNetworkInstanceRequest)(nil),          // 21: api.manage.ListNetworkInstanceRequest
+	(*ListNetworkInstanceResponse)(nil),         // 22: api.manage.ListNetworkInstanceResponse
+	(*DeleteNetworkInstanceRequest)(nil),        // 23: api.manage.DeleteNetworkInstanceRequest
+	(*DeleteNetworkInstanceResponse)(nil),       // 24: api.manage.DeleteNetworkInstanceResponse
+	(*GetNetworkInstanceConfigRequest)(nil),     // 25: api.manage.GetNetworkInstanceConfigRequest
+	(*GetNetworkInstanceConfigResponse)(nil),    // 26: api.manage.GetNetworkInstanceConfigResponse
+	(*ListNetworkInstanceMetaRequest)(nil),      // 27: api.manage.ListNetworkInstanceMetaRequest
+	(*ListNetworkInstanceMetaResponse)(nil),     // 28: api.manage.ListNetworkInstanceMetaResponse
+	nil,                                         // 29: api.manage.NetworkInstanceRunningInfoMap.MapEntry
+	(common.CompressionAlgoPb)(0),               // 30: common.CompressionAlgoPb
+	(*common.SecureModeConfig)(nil),             // 31: common.SecureModeConfig
+	(*acl.Acl)(nil),                             // 32: acl.Acl
+	(*common.Ipv4Inet)(nil),                     // 33: common.Ipv4Inet
+	(*peer_rpc.GetIpListResponse)(nil),          // 34: peer_rpc.GetIpListResponse
+	(*common.StunInfo)(nil),                     // 35: common.StunInfo
+	(*common.Url)(nil),                          // 36: common.Url
+	(*instance.Route)(nil),                      // 37: api.instance.Route
+	(*instance.PeerInfo)(nil),                   // 38: api.instance.PeerInfo
+	(*instance.PeerRoutePair)(nil),              // 39: api.instance.PeerRoutePair
+	(*peer_rpc.RouteForeignNetworkSummary)(nil), // 40: peer_rpc.RouteForeignNetworkSummary
+	(*common.UUID)(nil),                         // 41: common.UUID
 }
 var file_api_manage_proto_depIdxs = []int32{
 	0,  // 0: api.manage.NetworkConfig.networking_method:type_name -> api.manage.NetworkingMethod
-	4,  // 1: api.manage.NetworkConfig.port_forwards:type_name -> api.manage.PortForwardConfig
-	26, // 2: api.manage.NetworkConfig.data_compress_algo:type_name -> common.CompressionAlgoPb
-	27, // 3: api.manage.NetworkConfig.secure_mode:type_name -> common.SecureModeConfig
-	28, // 4: api.manage.NetworkConfig.acl:type_name -> acl.Acl
-	3,  // 5: api.manage.NetworkConfig.peers:type_name -> api.manage.NetworkPeerConfig
-	29, // 6: api.manage.MyNodeInfo.virtual_ipv4:type_name -> common.Ipv4Inet
-	30, // 7: api.manage.MyNodeInfo.ips:type_name -> peer_rpc.GetIpListResponse
-	31, // 8: api.manage.MyNodeInfo.stun_info:type_name -> common.StunInfo
-	32, // 9: api.manage.MyNodeInfo.listeners:type_name -> common.Url
-	5,  // 10: api.manage.NetworkInstanceRunningInfo.my_node_info:type_name -> api.manage.MyNodeInfo
-	33, // 11: api.manage.NetworkInstanceRunningInfo.routes:type_name -> api.instance.Route
-	34, // 12: api.manage.NetworkInstanceRunningInfo.peers:type_name -> api.instance.PeerInfo
-	35, // 13: api.manage.NetworkInstanceRunningInfo.peer_route_pairs:type_name -> api.instance.PeerRoutePair
-	36, // 14: api.manage.NetworkInstanceRunningInfo.foreign_network_summary:type_name -> peer_rpc.RouteForeignNetworkSummary
-	25, // 15: api.manage.NetworkInstanceRunningInfoMap.map:type_name -> api.manage.NetworkInstanceRunningInfoMap.MapEntry
-	37, // 16: api.manage.NetworkMeta.inst_id:type_name -> common.UUID
-	1,  // 17: api.manage.NetworkMeta.source:type_name -> api.manage.ConfigSource
-	2,  // 18: api.manage.ValidateConfigRequest.config:type_name -> api.manage.NetworkConfig
-	37, // 19: api.manage.RunNetworkInstanceRequest.inst_id:type_name -> common.UUID
-	2,  // 20: api.manage.RunNetworkInstanceRequest.config:type_name -> api.manage.NetworkConfig
-	1,  // 21: api.manage.RunNetworkInstanceRequest.source:type_name -> api.manage.ConfigSource
-	37, // 22: api.manage.RunNetworkInstanceResponse.inst_id:type_name -> common.UUID
-	37, // 23: api.manage.RetainNetworkInstanceRequest.inst_ids:type_name -> common.UUID
-	37, // 24: api.manage.RetainNetworkInstanceResponse.remain_inst_ids:type_name -> common.UUID
-	37, // 25: api.manage.CollectNetworkInfoRequest.inst_ids:type_name -> common.UUID
-	7,  // 26: api.manage.CollectNetworkInfoResponse.info:type_name -> api.manage.NetworkInstanceRunningInfoMap
-	37, // 27: api.manage.ListNetworkInstanceResponse.inst_ids:type_name -> common.UUID
-	37, // 28: api.manage.DeleteNetworkInstanceRequest.inst_ids:type_name -> common.UUID
-	37, // 29: api.manage.DeleteNetworkInstanceResponse.remain_inst_ids:type_name -> common.UUID
-	37, // 30: api.manage.GetNetworkInstanceConfigRequest.inst_id:type_name -> common.UUID
-	2,  // 31: api.manage.GetNetworkInstanceConfigResponse.config:type_name -> api.manage.NetworkConfig
-	1,  // 32: api.manage.GetNetworkInstanceConfigResponse.source:type_name -> api.manage.ConfigSource
-	37, // 33: api.manage.ListNetworkInstanceMetaRequest.inst_ids:type_name -> common.UUID
-	8,  // 34: api.manage.ListNetworkInstanceMetaResponse.metas:type_name -> api.manage.NetworkMeta
-	6,  // 35: api.manage.NetworkInstanceRunningInfoMap.MapEntry.value:type_name -> api.manage.NetworkInstanceRunningInfo
-	9,  // 36: api.manage.WebClientService.ValidateConfig:input_type -> api.manage.ValidateConfigRequest
-	11, // 37: api.manage.WebClientService.RunNetworkInstance:input_type -> api.manage.RunNetworkInstanceRequest
-	13, // 38: api.manage.WebClientService.RetainNetworkInstance:input_type -> api.manage.RetainNetworkInstanceRequest
-	15, // 39: api.manage.WebClientService.CollectNetworkInfo:input_type -> api.manage.CollectNetworkInfoRequest
-	17, // 40: api.manage.WebClientService.ListNetworkInstance:input_type -> api.manage.ListNetworkInstanceRequest
-	19, // 41: api.manage.WebClientService.DeleteNetworkInstance:input_type -> api.manage.DeleteNetworkInstanceRequest
-	21, // 42: api.manage.WebClientService.GetNetworkInstanceConfig:input_type -> api.manage.GetNetworkInstanceConfigRequest
-	23, // 43: api.manage.WebClientService.ListNetworkInstanceMeta:input_type -> api.manage.ListNetworkInstanceMetaRequest
-	10, // 44: api.manage.WebClientService.ValidateConfig:output_type -> api.manage.ValidateConfigResponse
-	12, // 45: api.manage.WebClientService.RunNetworkInstance:output_type -> api.manage.RunNetworkInstanceResponse
-	14, // 46: api.manage.WebClientService.RetainNetworkInstance:output_type -> api.manage.RetainNetworkInstanceResponse
-	16, // 47: api.manage.WebClientService.CollectNetworkInfo:output_type -> api.manage.CollectNetworkInfoResponse
-	18, // 48: api.manage.WebClientService.ListNetworkInstance:output_type -> api.manage.ListNetworkInstanceResponse
-	20, // 49: api.manage.WebClientService.DeleteNetworkInstance:output_type -> api.manage.DeleteNetworkInstanceResponse
-	22, // 50: api.manage.WebClientService.GetNetworkInstanceConfig:output_type -> api.manage.GetNetworkInstanceConfigResponse
-	24, // 51: api.manage.WebClientService.ListNetworkInstanceMeta:output_type -> api.manage.ListNetworkInstanceMetaResponse
-	44, // [44:52] is the sub-list for method output_type
-	36, // [36:44] is the sub-list for method input_type
-	36, // [36:36] is the sub-list for extension type_name
-	36, // [36:36] is the sub-list for extension extendee
-	0,  // [0:36] is the sub-list for field type_name
+	8,  // 1: api.manage.NetworkConfig.port_forwards:type_name -> api.manage.PortForwardConfig
+	30, // 2: api.manage.NetworkConfig.data_compress_algo:type_name -> common.CompressionAlgoPb
+	31, // 3: api.manage.NetworkConfig.secure_mode:type_name -> common.SecureModeConfig
+	32, // 4: api.manage.NetworkConfig.acl:type_name -> acl.Acl
+	7,  // 5: api.manage.NetworkConfig.peers:type_name -> api.manage.NetworkPeerConfig
+	6,  // 6: api.manage.NetworkConfig.vpn_portal_config:type_name -> api.manage.VpnPortalConfig
+	3,  // 7: api.manage.NetworkConfig.managed_credentials:type_name -> api.manage.ManagedCredentialConfig
+	3,  // 8: api.manage.ManagedCredentialSet.entries:type_name -> api.manage.ManagedCredentialConfig
+	5,  // 9: api.manage.VpnPortalConfig.clients:type_name -> api.manage.VpnPortalClientConfig
+	33, // 10: api.manage.MyNodeInfo.virtual_ipv4:type_name -> common.Ipv4Inet
+	34, // 11: api.manage.MyNodeInfo.ips:type_name -> peer_rpc.GetIpListResponse
+	35, // 12: api.manage.MyNodeInfo.stun_info:type_name -> common.StunInfo
+	36, // 13: api.manage.MyNodeInfo.listeners:type_name -> common.Url
+	9,  // 14: api.manage.NetworkInstanceRunningInfo.my_node_info:type_name -> api.manage.MyNodeInfo
+	37, // 15: api.manage.NetworkInstanceRunningInfo.routes:type_name -> api.instance.Route
+	38, // 16: api.manage.NetworkInstanceRunningInfo.peers:type_name -> api.instance.PeerInfo
+	39, // 17: api.manage.NetworkInstanceRunningInfo.peer_route_pairs:type_name -> api.instance.PeerRoutePair
+	40, // 18: api.manage.NetworkInstanceRunningInfo.foreign_network_summary:type_name -> peer_rpc.RouteForeignNetworkSummary
+	29, // 19: api.manage.NetworkInstanceRunningInfoMap.map:type_name -> api.manage.NetworkInstanceRunningInfoMap.MapEntry
+	41, // 20: api.manage.NetworkMeta.inst_id:type_name -> common.UUID
+	1,  // 21: api.manage.NetworkMeta.source:type_name -> api.manage.ConfigSource
+	2,  // 22: api.manage.ValidateConfigRequest.config:type_name -> api.manage.NetworkConfig
+	41, // 23: api.manage.RunNetworkInstanceRequest.inst_id:type_name -> common.UUID
+	2,  // 24: api.manage.RunNetworkInstanceRequest.config:type_name -> api.manage.NetworkConfig
+	1,  // 25: api.manage.RunNetworkInstanceRequest.source:type_name -> api.manage.ConfigSource
+	41, // 26: api.manage.RunNetworkInstanceResponse.inst_id:type_name -> common.UUID
+	41, // 27: api.manage.RetainNetworkInstanceRequest.inst_ids:type_name -> common.UUID
+	41, // 28: api.manage.RetainNetworkInstanceResponse.remain_inst_ids:type_name -> common.UUID
+	41, // 29: api.manage.CollectNetworkInfoRequest.inst_ids:type_name -> common.UUID
+	11, // 30: api.manage.CollectNetworkInfoResponse.info:type_name -> api.manage.NetworkInstanceRunningInfoMap
+	41, // 31: api.manage.ListNetworkInstanceResponse.inst_ids:type_name -> common.UUID
+	41, // 32: api.manage.DeleteNetworkInstanceRequest.inst_ids:type_name -> common.UUID
+	41, // 33: api.manage.DeleteNetworkInstanceResponse.remain_inst_ids:type_name -> common.UUID
+	41, // 34: api.manage.GetNetworkInstanceConfigRequest.inst_id:type_name -> common.UUID
+	2,  // 35: api.manage.GetNetworkInstanceConfigResponse.config:type_name -> api.manage.NetworkConfig
+	1,  // 36: api.manage.GetNetworkInstanceConfigResponse.source:type_name -> api.manage.ConfigSource
+	41, // 37: api.manage.ListNetworkInstanceMetaRequest.inst_ids:type_name -> common.UUID
+	12, // 38: api.manage.ListNetworkInstanceMetaResponse.metas:type_name -> api.manage.NetworkMeta
+	10, // 39: api.manage.NetworkInstanceRunningInfoMap.MapEntry.value:type_name -> api.manage.NetworkInstanceRunningInfo
+	13, // 40: api.manage.WebClientService.ValidateConfig:input_type -> api.manage.ValidateConfigRequest
+	15, // 41: api.manage.WebClientService.RunNetworkInstance:input_type -> api.manage.RunNetworkInstanceRequest
+	17, // 42: api.manage.WebClientService.RetainNetworkInstance:input_type -> api.manage.RetainNetworkInstanceRequest
+	19, // 43: api.manage.WebClientService.CollectNetworkInfo:input_type -> api.manage.CollectNetworkInfoRequest
+	21, // 44: api.manage.WebClientService.ListNetworkInstance:input_type -> api.manage.ListNetworkInstanceRequest
+	23, // 45: api.manage.WebClientService.DeleteNetworkInstance:input_type -> api.manage.DeleteNetworkInstanceRequest
+	25, // 46: api.manage.WebClientService.GetNetworkInstanceConfig:input_type -> api.manage.GetNetworkInstanceConfigRequest
+	27, // 47: api.manage.WebClientService.ListNetworkInstanceMeta:input_type -> api.manage.ListNetworkInstanceMetaRequest
+	14, // 48: api.manage.WebClientService.ValidateConfig:output_type -> api.manage.ValidateConfigResponse
+	16, // 49: api.manage.WebClientService.RunNetworkInstance:output_type -> api.manage.RunNetworkInstanceResponse
+	18, // 50: api.manage.WebClientService.RetainNetworkInstance:output_type -> api.manage.RetainNetworkInstanceResponse
+	20, // 51: api.manage.WebClientService.CollectNetworkInfo:output_type -> api.manage.CollectNetworkInfoResponse
+	22, // 52: api.manage.WebClientService.ListNetworkInstance:output_type -> api.manage.ListNetworkInstanceResponse
+	24, // 53: api.manage.WebClientService.DeleteNetworkInstance:output_type -> api.manage.DeleteNetworkInstanceResponse
+	26, // 54: api.manage.WebClientService.GetNetworkInstanceConfig:output_type -> api.manage.GetNetworkInstanceConfigResponse
+	28, // 55: api.manage.WebClientService.ListNetworkInstanceMeta:output_type -> api.manage.ListNetworkInstanceMetaResponse
+	48, // [48:56] is the sub-list for method output_type
+	40, // [40:48] is the sub-list for method input_type
+	40, // [40:40] is the sub-list for extension type_name
+	40, // [40:40] is the sub-list for extension extendee
+	0,  // [0:40] is the sub-list for field type_name
 }
 
 func init() { file_api_manage_proto_init() }
@@ -2236,15 +2562,17 @@ func file_api_manage_proto_init() {
 	}
 	file_api_manage_proto_msgTypes[0].OneofWrappers = []any{}
 	file_api_manage_proto_msgTypes[1].OneofWrappers = []any{}
-	file_api_manage_proto_msgTypes[3].OneofWrappers = []any{}
 	file_api_manage_proto_msgTypes[4].OneofWrappers = []any{}
+	file_api_manage_proto_msgTypes[5].OneofWrappers = []any{}
+	file_api_manage_proto_msgTypes[7].OneofWrappers = []any{}
+	file_api_manage_proto_msgTypes[8].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_api_manage_proto_rawDesc), len(file_api_manage_proto_rawDesc)),
 			NumEnums:      2,
-			NumMessages:   24,
+			NumMessages:   28,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/easytier-go/proto/common/common.pb.go b/easytier-go/proto/common/common.pb.go
index 327040bf..3db9c4f8 100644
--- a/easytier-go/proto/common/common.pb.go
+++ b/easytier-go/proto/common/common.pb.go
@@ -255,9 +255,12 @@ type FlagsInConfig struct {
 	// SO_MARK untouched (kernel default 0). Any set value (including 0) is
 	// applied via setsockopt. Requires CAP_NET_ADMIN; silently ignored on
 	// non-Linux platforms.
-	SocketMark    *uint32 `protobuf:"varint,43,opt,name=socket_mark,json=socketMark,proto3,oneof" json:"socket_mark,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	SocketMark *uint32 `protobuf:"varint,43,opt,name=socket_mark,json=socketMark,proto3,oneof" json:"socket_mark,omitempty"`
+	// Prefer direct credential peers that already relay to a destination over
+	// advertising another direct edge to the same destination.
+	PreferPeerRelay bool `protobuf:"varint,44,opt,name=prefer_peer_relay,json=preferPeerRelay,proto3" json:"prefer_peer_relay,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
 }
 
 func (x *FlagsInConfig) Reset() {
@@ -585,6 +588,13 @@ func (x *FlagsInConfig) GetSocketMark() uint32 {
 	return 0
 }
 
+func (x *FlagsInConfig) GetPreferPeerRelay() bool {
+	if x != nil {
+		return x.PreferPeerRelay
+	}
+	return false
+}
+
 type RpcDescriptor struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// allow same service registered multiple times in different domain
@@ -2071,66 +2081,6 @@ func (x *ProxyDstInfo) GetDstAddr() *SocketAddr {
 	return nil
 }
 
-type LimiterConfig struct {
-	state          protoimpl.MessageState `protogen:"open.v1"`
-	BurstRate      *uint64                `protobuf:"varint,1,opt,name=burst_rate,json=burstRate,proto3,oneof" json:"burst_rate,omitempty"`                  // default 1 means no burst (capacity is same with bps)
-	Bps            *uint64                `protobuf:"varint,2,opt,name=bps,proto3,oneof" json:"bps,omitempty"`                                               // default 0 means no limit (unit is B/s)
-	FillDurationMs *uint64                `protobuf:"varint,3,opt,name=fill_duration_ms,json=fillDurationMs,proto3,oneof" json:"fill_duration_ms,omitempty"` // default 10ms, the period to fill the bucket
-	unknownFields  protoimpl.UnknownFields
-	sizeCache      protoimpl.SizeCache
-}
-
-func (x *LimiterConfig) Reset() {
-	*x = LimiterConfig{}
-	mi := &file_common_proto_msgTypes[23]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *LimiterConfig) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*LimiterConfig) ProtoMessage() {}
-
-func (x *LimiterConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_common_proto_msgTypes[23]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use LimiterConfig.ProtoReflect.Descriptor instead.
-func (*LimiterConfig) Descriptor() ([]byte, []int) {
-	return file_common_proto_rawDescGZIP(), []int{23}
-}
-
-func (x *LimiterConfig) GetBurstRate() uint64 {
-	if x != nil && x.BurstRate != nil {
-		return *x.BurstRate
-	}
-	return 0
-}
-
-func (x *LimiterConfig) GetBps() uint64 {
-	if x != nil && x.Bps != nil {
-		return *x.Bps
-	}
-	return 0
-}
-
-func (x *LimiterConfig) GetFillDurationMs() uint64 {
-	if x != nil && x.FillDurationMs != nil {
-		return *x.FillDurationMs
-	}
-	return 0
-}
-
 type SecureModeConfig struct {
 	state   protoimpl.MessageState `protogen:"open.v1"`
 	Enabled bool                   `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
@@ -2144,7 +2094,7 @@ type SecureModeConfig struct {
 
 func (x *SecureModeConfig) Reset() {
 	*x = SecureModeConfig{}
-	mi := &file_common_proto_msgTypes[24]
+	mi := &file_common_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2156,7 +2106,7 @@ func (x *SecureModeConfig) String() string {
 func (*SecureModeConfig) ProtoMessage() {}
 
 func (x *SecureModeConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_common_proto_msgTypes[24]
+	mi := &file_common_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2169,7 +2119,7 @@ func (x *SecureModeConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SecureModeConfig.ProtoReflect.Descriptor instead.
 func (*SecureModeConfig) Descriptor() ([]byte, []int) {
-	return file_common_proto_rawDescGZIP(), []int{24}
+	return file_common_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *SecureModeConfig) GetEnabled() bool {
@@ -2197,7 +2147,7 @@ var File_common_proto protoreflect.FileDescriptor
 
 const file_common_proto_rawDesc = "" +
 	"\n" +
-	"\fcommon.proto\x12\x06common\x1a\verror.proto\"\xc9\x0e\n" +
+	"\fcommon.proto\x12\x06common\x1a\verror.proto\"\xf5\x0e\n" +
 	"\rFlagsInConfig\x12)\n" +
 	"\x10default_protocol\x18\x01 \x01(\tR\x0fdefaultProtocol\x12\x19\n" +
 	"\bdev_name\x18\x02 \x01(\tR\adevName\x12+\n" +
@@ -2248,7 +2198,8 @@ const file_common_proto_rawDesc = "" +
 	"\x12disable_relay_data\x18) \x01(\bR\x10disableRelayData\x12;\n" +
 	"\x1aenable_udp_broadcast_relay\x18* \x01(\bR\x17enableUdpBroadcastRelay\x12$\n" +
 	"\vsocket_mark\x18+ \x01(\rH\x00R\n" +
-	"socketMark\x88\x01\x01B\x0e\n" +
+	"socketMark\x88\x01\x01\x12*\n" +
+	"\x11prefer_peer_relay\x18, \x01(\bR\x0fpreferPeerRelayB\x0e\n" +
 	"\f_socket_mark\"\x95\x01\n" +
 	"\rRpcDescriptor\x12\x1f\n" +
 	"\vdomain_name\x18\x01 \x01(\tR\n" +
@@ -2374,15 +2325,7 @@ const file_common_proto_rawDesc = "" +
 	"\vsocket_type\x18\x03 \x01(\x0e2\x12.common.SocketTypeR\n" +
 	"socketType\"=\n" +
 	"\fProxyDstInfo\x12-\n" +
-	"\bdst_addr\x18\x01 \x01(\v2\x12.common.SocketAddrR\adstAddr\"\xa5\x01\n" +
-	"\rLimiterConfig\x12\"\n" +
-	"\n" +
-	"burst_rate\x18\x01 \x01(\x04H\x00R\tburstRate\x88\x01\x01\x12\x15\n" +
-	"\x03bps\x18\x02 \x01(\x04H\x01R\x03bps\x88\x01\x01\x12-\n" +
-	"\x10fill_duration_ms\x18\x03 \x01(\x04H\x02R\x0efillDurationMs\x88\x01\x01B\r\n" +
-	"\v_burst_rateB\x06\n" +
-	"\x04_bpsB\x13\n" +
-	"\x11_fill_duration_ms\"\xb7\x01\n" +
+	"\bdst_addr\x18\x01 \x01(\v2\x12.common.SocketAddrR\adstAddr\"\xb7\x01\n" +
 	"\x10SecureModeConfig\x12\x18\n" +
 	"\aenabled\x18\x01 \x01(\bR\aenabled\x12/\n" +
 	"\x11local_private_key\x18\x02 \x01(\tH\x00R\x0flocalPrivateKey\x88\x01\x01\x12-\n" +
@@ -2423,7 +2366,7 @@ func file_common_proto_rawDescGZIP() []byte {
 }
 
 var file_common_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
-var file_common_proto_msgTypes = make([]protoimpl.MessageInfo, 25)
+var file_common_proto_msgTypes = make([]protoimpl.MessageInfo, 24)
 var file_common_proto_goTypes = []any{
 	(CompressionAlgoPb)(0),        // 0: common.CompressionAlgoPb
 	(NatType)(0),                  // 1: common.NatType
@@ -2451,16 +2394,15 @@ var file_common_proto_goTypes = []any{
 	(*PeerFeatureFlag)(nil),       // 23: common.PeerFeatureFlag
 	(*PortForwardConfigPb)(nil),   // 24: common.PortForwardConfigPb
 	(*ProxyDstInfo)(nil),          // 25: common.ProxyDstInfo
-	(*LimiterConfig)(nil),         // 26: common.LimiterConfig
-	(*SecureModeConfig)(nil),      // 27: common.SecureModeConfig
-	(*error1.Error)(nil),          // 28: error.Error
+	(*SecureModeConfig)(nil),      // 26: common.SecureModeConfig
+	(*error1.Error)(nil),          // 27: error.Error
 }
 var file_common_proto_depIdxs = []int32{
 	0,  // 0: common.FlagsInConfig.data_compress_algo:type_name -> common.CompressionAlgoPb
 	4,  // 1: common.RpcRequest.descriptor:type_name -> common.RpcDescriptor
 	6,  // 2: common.HostManagementRequest.rpc:type_name -> common.DirectRpcRequest
 	12, // 3: common.HostManagementRequest.prepared_instance_id:type_name -> common.UUID
-	28, // 4: common.RpcResponse.error:type_name -> error.Error
+	27, // 4: common.RpcResponse.error:type_name -> error.Error
 	0,  // 5: common.RpcCompressionInfo.algo:type_name -> common.CompressionAlgoPb
 	0,  // 6: common.RpcCompressionInfo.accepted_algo:type_name -> common.CompressionAlgoPb
 	4,  // 7: common.RpcPacket.descriptor:type_name -> common.RpcDescriptor
@@ -2510,14 +2452,13 @@ func file_common_proto_init() {
 		(*SocketAddr_Ipv6)(nil),
 	}
 	file_common_proto_msgTypes[23].OneofWrappers = []any{}
-	file_common_proto_msgTypes[24].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_common_proto_rawDesc), len(file_common_proto_rawDesc)),
 			NumEnums:      3,
-			NumMessages:   25,
+			NumMessages:   24,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/easytier-go/proto/peer_rpc/peer_rpc.pb.go b/easytier-go/proto/peer_rpc/peer_rpc.pb.go
index bd5fa9b1..496897b9 100644
--- a/easytier-go/proto/peer_rpc/peer_rpc.pb.go
+++ b/easytier-go/proto/peer_rpc/peer_rpc.pb.go
@@ -2756,6 +2756,7 @@ type PeerConnNoiseMsg1Pb struct {
 	ASessionGeneration        *uint32                `protobuf:"varint,3,opt,name=a_session_generation,json=aSessionGeneration,proto3,oneof" json:"a_session_generation,omitempty"`
 	AConnId                   *common.UUID           `protobuf:"bytes,4,opt,name=a_conn_id,json=aConnId,proto3" json:"a_conn_id,omitempty"`
 	ClientEncryptionAlgorithm string                 `protobuf:"bytes,5,opt,name=client_encryption_algorithm,json=clientEncryptionAlgorithm,proto3" json:"client_encryption_algorithm,omitempty"`
+	Features                  []string               `protobuf:"bytes,6,rep,name=features,proto3" json:"features,omitempty"`
 	unknownFields             protoimpl.UnknownFields
 	sizeCache                 protoimpl.SizeCache
 }
@@ -2825,6 +2826,13 @@ func (x *PeerConnNoiseMsg1Pb) GetClientEncryptionAlgorithm() string {
 	return ""
 }
 
+func (x *PeerConnNoiseMsg1Pb) GetFeatures() []string {
+	if x != nil {
+		return x.Features
+	}
+	return nil
+}
+
 type PeerConnNoiseMsg2Pb struct {
 	state                     protoimpl.MessageState  `protogen:"open.v1"`
 	BNetworkName              string                  `protobuf:"bytes,1,opt,name=b_network_name,json=bNetworkName,proto3" json:"b_network_name,omitempty"`
@@ -2837,6 +2845,7 @@ type PeerConnNoiseMsg2Pb struct {
 	AConnIdEcho               *common.UUID            `protobuf:"bytes,8,opt,name=a_conn_id_echo,json=aConnIdEcho,proto3" json:"a_conn_id_echo,omitempty"`
 	SecretProof_32            []byte                  `protobuf:"bytes,9,opt,name=secret_proof_32,json=secretProof32,proto3,oneof" json:"secret_proof_32,omitempty"`
 	ServerEncryptionAlgorithm string                  `protobuf:"bytes,10,opt,name=server_encryption_algorithm,json=serverEncryptionAlgorithm,proto3" json:"server_encryption_algorithm,omitempty"`
+	Features                  []string                `protobuf:"bytes,11,rep,name=features,proto3" json:"features,omitempty"`
 	unknownFields             protoimpl.UnknownFields
 	sizeCache                 protoimpl.SizeCache
 }
@@ -2941,6 +2950,13 @@ func (x *PeerConnNoiseMsg2Pb) GetServerEncryptionAlgorithm() string {
 	return ""
 }
 
+func (x *PeerConnNoiseMsg2Pb) GetFeatures() []string {
+	if x != nil {
+		return x.Features
+	}
+	return nil
+}
+
 type RelayNoiseMsg1Pb struct {
 	state                     protoimpl.MessageState `protogen:"open.v1"`
 	Version                   uint32                 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
@@ -3574,14 +3590,15 @@ const file_peer_rpc_proto_rawDesc = "" +
 	"\x15network_secret_digest\x18\x06 \x01(\fR\x13networkSecretDigest\"Y\n" +
 	"\vKcpConnData\x12$\n" +
 	"\x03src\x18\x01 \x01(\v2\x12.common.SocketAddrR\x03src\x12$\n" +
-	"\x03dst\x18\x04 \x01(\v2\x12.common.SocketAddrR\x03dst\"\x8f\x02\n" +
+	"\x03dst\x18\x04 \x01(\v2\x12.common.SocketAddrR\x03dst\"\xab\x02\n" +
 	"\x13PeerConnNoiseMsg1Pb\x12\x18\n" +
 	"\aversion\x18\x01 \x01(\rR\aversion\x12$\n" +
 	"\x0ea_network_name\x18\x02 \x01(\tR\faNetworkName\x125\n" +
 	"\x14a_session_generation\x18\x03 \x01(\rH\x00R\x12aSessionGeneration\x88\x01\x01\x12(\n" +
 	"\ta_conn_id\x18\x04 \x01(\v2\f.common.UUIDR\aaConnId\x12>\n" +
-	"\x1bclient_encryption_algorithm\x18\x05 \x01(\tR\x19clientEncryptionAlgorithmB\x17\n" +
-	"\x15_a_session_generation\"\xfd\x03\n" +
+	"\x1bclient_encryption_algorithm\x18\x05 \x01(\tR\x19clientEncryptionAlgorithm\x12\x1a\n" +
+	"\bfeatures\x18\x06 \x03(\tR\bfeaturesB\x17\n" +
+	"\x15_a_session_generation\"\x99\x04\n" +
 	"\x13PeerConnNoiseMsg2Pb\x12$\n" +
 	"\x0eb_network_name\x18\x01 \x01(\tR\fbNetworkName\x12\x1b\n" +
 	"\trole_hint\x18\x02 \x01(\rR\broleHint\x129\n" +
@@ -3593,7 +3610,8 @@ const file_peer_rpc_proto_rawDesc = "" +
 	"\x0ea_conn_id_echo\x18\b \x01(\v2\f.common.UUIDR\vaConnIdEcho\x12+\n" +
 	"\x0fsecret_proof_32\x18\t \x01(\fH\x01R\rsecretProof32\x88\x01\x01\x12>\n" +
 	"\x1bserver_encryption_algorithm\x18\n" +
-	" \x01(\tR\x19serverEncryptionAlgorithmB\x0e\n" +
+	" \x01(\tR\x19serverEncryptionAlgorithm\x12\x1a\n" +
+	"\bfeatures\x18\v \x03(\tR\bfeaturesB\x0e\n" +
 	"\f_root_key_32B\x12\n" +
 	"\x10_secret_proof_32\"\xe6\x01\n" +
 	"\x10RelayNoiseMsg1Pb\x12\x18\n" +
diff --git a/easytier-go/proto/provenance.go b/easytier-go/proto/provenance.go
index 8bdf7878..13ffccfa 100644
--- a/easytier-go/proto/provenance.go
+++ b/easytier-go/proto/provenance.go
@@ -3,6 +3,6 @@
 package proto
 
 const (
-	EasyTierCommit = "63519db2b5f2a6a1b9b7f20905f036dab54eb829"
-	SchemaSHA256   = "4fc7f40eac5d3803ed8afe707f2be1db121a022547f91568955c369212875064"
+	EasyTierCommit = "599e4eacaa9c9a6f84b8d6439418af9d860f9aa3"
+	SchemaSHA256   = "7de60ee229e6ee2f17e3673cff6f9d9d4d4bece13ed74e46b1999277b364db67"
 )
diff --git a/easytier-js/browser/package.json b/easytier-js/browser/package.json
index de48fc5d..db67a2aa 100644
--- a/easytier-js/browser/package.json
+++ b/easytier-js/browser/package.json
@@ -38,9 +38,9 @@
   },
   "devDependencies": {
     "@types/node": "22.18.1",
-    "esbuild": "0.25.9",
+    "esbuild": "0.28.2",
     "typescript": "5.9.3",
-    "vitest": "2.1.9"
+    "vitest": "3.2.7"
   },
   "publishConfig": {
     "access": "public"
diff --git a/easytier-js/cloudflare/package.json b/easytier-js/cloudflare/package.json
index f15fde97..01818298 100644
--- a/easytier-js/cloudflare/package.json
+++ b/easytier-js/cloudflare/package.json
@@ -32,14 +32,14 @@
     "prepack": "pnpm check"
   },
   "dependencies": {
-    "@cloudflare/workers-types": "5.20260724.1",
+    "@cloudflare/workers-types": "5.20260917.1",
     "@easytier/runtime": "workspace:0.1.0"
   },
   "devDependencies": {
     "@types/node": "22.18.1",
     "typescript": "5.9.3",
-    "vitest": "2.1.9",
-    "wrangler": "4.114.0"
+    "vitest": "3.2.7",
+    "wrangler": "4.134.0"
   },
   "publishConfig": {
     "access": "public"
diff --git a/easytier-js/examples/web/package.json b/easytier-js/examples/web/package.json
index 8dc86ff3..533bcbba 100644
--- a/easytier-js/examples/web/package.json
+++ b/easytier-js/examples/web/package.json
@@ -18,10 +18,10 @@
     "@easytier/cloudflare": "workspace:0.1.0"
   },
   "devDependencies": {
-    "@cloudflare/workers-types": "5.20260724.1",
+    "@cloudflare/workers-types": "5.20260917.1",
     "@types/node": "22.18.1",
     "typescript": "5.9.3",
     "vite": "5.4.21",
-    "wrangler": "4.114.0"
+    "wrangler": "4.134.0"
   }
 }
diff --git a/easytier-js/pnpm-lock.yaml b/easytier-js/pnpm-lock.yaml
index ce1ff271..1551ff32 100644
--- a/easytier-js/pnpm-lock.yaml
+++ b/easytier-js/pnpm-lock.yaml
@@ -21,20 +21,20 @@ importers:
         specifier: 22.18.1
         version: 22.18.1
       esbuild:
-        specifier: 0.25.9
-        version: 0.25.9
+        specifier: 0.28.2
+        version: 0.28.2
       typescript:
         specifier: 5.9.3
         version: 5.9.3
       vitest:
-        specifier: 2.1.9
-        version: 2.1.9(@types/node@22.18.1)
+        specifier: 3.2.7
+        version: 3.2.7(@types/node@22.18.1)
 
   cloudflare:
     dependencies:
       '@cloudflare/workers-types':
-        specifier: 5.20260724.1
-        version: 5.20260724.1
+        specifier: 5.20260917.1
+        version: 5.20260917.1
       '@easytier/runtime':
         specifier: workspace:0.1.0
         version: link:../runtime
@@ -46,11 +46,11 @@ importers:
         specifier: 5.9.3
         version: 5.9.3
       vitest:
-        specifier: 2.1.9
-        version: 2.1.9(@types/node@22.18.1)
+        specifier: 3.2.7
+        version: 3.2.7(@types/node@22.18.1)
       wrangler:
-        specifier: 4.114.0
-        version: 4.114.0(@cloudflare/workers-types@5.20260724.1)
+        specifier: 4.134.0
+        version: 4.134.0(@cloudflare/workers-types@5.20260917.1)(@types/node@22.18.1)
 
   examples/web:
     dependencies:
@@ -62,8 +62,8 @@ importers:
         version: link:../../cloudflare
     devDependencies:
       '@cloudflare/workers-types':
-        specifier: 5.20260724.1
-        version: 5.20260724.1
+        specifier: 5.20260917.1
+        version: 5.20260917.1
       '@types/node':
         specifier: 22.18.1
         version: 22.18.1
@@ -74,8 +74,8 @@ importers:
         specifier: 5.4.21
         version: 5.4.21(@types/node@22.18.1)
       wrangler:
-        specifier: 4.114.0
-        version: 4.114.0(@cloudflare/workers-types@5.20260724.1)
+        specifier: 4.134.0
+        version: 4.134.0(@cloudflare/workers-types@5.20260917.1)(@types/node@22.18.1)
 
   runtime:
     devDependencies:
@@ -89,8 +89,8 @@ importers:
         specifier: 5.9.3
         version: 5.9.3
       vitest:
-        specifier: 2.1.9
-        version: 2.1.9(@types/node@22.18.1)
+        specifier: 3.2.7
+        version: 3.2.7(@types/node@22.18.1)
 
 packages:
 
@@ -107,38 +107,38 @@ packages:
       workerd:
         optional: true
 
-  '@cloudflare/workerd-darwin-64@1.20260722.1':
-    resolution: {integrity: sha512-vZOP8vIS3NwnuaO+gz0FZ7kIGeiO3bZmxV35Ph9zOXKSREhDFlH7wQ7mkCdhW3O4jnXsew+XT7b+DNEI2CcJGQ==}
+  '@cloudflare/workerd-darwin-64@1.20260917.1':
+    resolution: {integrity: sha512-ufFpLi2+WIuifZOiW38N8hzcX1tqfCqxYWgRC3tgT78TzjxUiBPcSkNdwv8dxeQ9xApwQh3BnQiFhfzq67umew==}
     engines: {node: '>=16'}
     cpu: [x64]
     os: [darwin]
 
-  '@cloudflare/workerd-darwin-arm64@1.20260722.1':
-    resolution: {integrity: sha512-EmIQymihDq6WNdER4+LF8Qn80yqayBUpJ+tkOO7wmY8pmgfyXjIUFNXotl21AHovTeu2seR7HdVUgeN/BilCWw==}
+  '@cloudflare/workerd-darwin-arm64@1.20260917.1':
+    resolution: {integrity: sha512-rbdal3kspPfG5O55I9IVHdBv2SH6UJMh66JkmdLIXuN2oS6WYctP226hKQJIme8mLW7XebRjL+ZnVbVES2SrkQ==}
     engines: {node: '>=16'}
     cpu: [arm64]
     os: [darwin]
 
-  '@cloudflare/workerd-linux-64@1.20260722.1':
-    resolution: {integrity: sha512-jvZ3k9fxcnEn04s80CgIYxQfpOyAiz/8qC42DP8EBa9tR27qWyg9wmm31zIobVlrgBZn/+8NfdP73avRGcQOjQ==}
+  '@cloudflare/workerd-linux-64@1.20260917.1':
+    resolution: {integrity: sha512-t981nh4Ol5mjzkH6x7x7Oev/UVmF5n3zjm07btl58BxJ1IgUSUPW0XJz07DR7rWss/EmGey7UlRMUM0qRcWkvg==}
     engines: {node: '>=16'}
     cpu: [x64]
     os: [linux]
 
-  '@cloudflare/workerd-linux-arm64@1.20260722.1':
-    resolution: {integrity: sha512-BOSB55SMNdy+DA5uj2WirgiNanpHGis5PVvXH1wSfvjRKr4JGgWK+EZzxz0RFUo6QjjQQC/NimEzNZ7va7jmKg==}
+  '@cloudflare/workerd-linux-arm64@1.20260917.1':
+    resolution: {integrity: sha512-3nW87yjIxhchhI7ZqbeQsy0Rfzw+7aZVADN/iDF0v1JOH3IxGsExEGGWYB+nQQQG4rUvnBlRTFT4WG21mVB02Q==}
     engines: {node: '>=16'}
     cpu: [arm64]
     os: [linux]
 
-  '@cloudflare/workerd-windows-64@1.20260722.1':
-    resolution: {integrity: sha512-sYM8YgUpKnRz2xjvdJLX1Ojzoi4MlA4gk8WTTExhGydjYB2UTs5NIbv0ZmpKgMoK9io3ixgmiW56ZnTbcWOdiA==}
+  '@cloudflare/workerd-windows-64@1.20260917.1':
+    resolution: {integrity: sha512-S3j07o3yMK0gzyEX+oM4/QmdtGdLxTK0mNYkQMZRjO98PjWr55TPiEkwfwcnfUNxnl6bI53MlHp1x5ZWOBg/JA==}
     engines: {node: '>=16'}
     cpu: [x64]
     os: [win32]
 
-  '@cloudflare/workers-types@5.20260724.1':
-    resolution: {integrity: sha512-gl0brZ60JhkZU3INgr1jsxaFEiWf3AB9RsCjLTMwT5RKspWRUpsFd0wxwbys7gb8Ywkfq9tORhw0y9G+7bDUYw==}
+  '@cloudflare/workers-types@5.20260917.1':
+    resolution: {integrity: sha512-fXMYFJw6HmcDiVZ8umPsUB7fR6HjFDms2Xr9iSovYgs1J7ytIfW3s7Rc9RptBH1JZfvdoJMx3Uo729pm/DJuoA==}
 
   '@cspotcode/source-map-support@0.8.1':
     resolution: {integrity: sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw==}
@@ -153,14 +153,14 @@ packages:
     cpu: [ppc64]
     os: [aix]
 
-  '@esbuild/aix-ppc64@0.25.9':
-    resolution: {integrity: sha512-OaGtL73Jck6pBKjNIe24BnFE6agGl+6KxDtTfHhy1HmhthfKouEcOhqpSL64K4/0WCtbKFLOdzD/44cJ4k9opA==}
+  '@esbuild/aix-ppc64@0.28.1':
+    resolution: {integrity: sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==}
     engines: {node: '>=18'}
     cpu: [ppc64]
     os: [aix]
 
-  '@esbuild/aix-ppc64@0.28.1':
-    resolution: {integrity: sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==}
+  '@esbuild/aix-ppc64@0.28.2':
+    resolution: {integrity: sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ==}
     engines: {node: '>=18'}
     cpu: [ppc64]
     os: [aix]
@@ -171,14 +171,14 @@ packages:
     cpu: [arm64]
     os: [android]
 
-  '@esbuild/android-arm64@0.25.9':
-    resolution: {integrity: sha512-IDrddSmpSv51ftWslJMvl3Q2ZT98fUSL2/rlUXuVqRXHCs5EUF1/f+jbjF5+NG9UffUDMCiTyh8iec7u8RlTLg==}
+  '@esbuild/android-arm64@0.28.1':
+    resolution: {integrity: sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [android]
 
-  '@esbuild/android-arm64@0.28.1':
-    resolution: {integrity: sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==}
+  '@esbuild/android-arm64@0.28.2':
+    resolution: {integrity: sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [android]
@@ -189,14 +189,14 @@ packages:
     cpu: [arm]
     os: [android]
 
-  '@esbuild/android-arm@0.25.9':
-    resolution: {integrity: sha512-5WNI1DaMtxQ7t7B6xa572XMXpHAaI/9Hnhk8lcxF4zVN4xstUgTlvuGDorBguKEnZO70qwEcLpfifMLoxiPqHQ==}
+  '@esbuild/android-arm@0.28.1':
+    resolution: {integrity: sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==}
     engines: {node: '>=18'}
     cpu: [arm]
     os: [android]
 
-  '@esbuild/android-arm@0.28.1':
-    resolution: {integrity: sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==}
+  '@esbuild/android-arm@0.28.2':
+    resolution: {integrity: sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg==}
     engines: {node: '>=18'}
     cpu: [arm]
     os: [android]
@@ -207,14 +207,14 @@ packages:
     cpu: [x64]
     os: [android]
 
-  '@esbuild/android-x64@0.25.9':
-    resolution: {integrity: sha512-I853iMZ1hWZdNllhVZKm34f4wErd4lMyeV7BLzEExGEIZYsOzqDWDf+y082izYUE8gtJnYHdeDpN/6tUdwvfiw==}
+  '@esbuild/android-x64@0.28.1':
+    resolution: {integrity: sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [android]
 
-  '@esbuild/android-x64@0.28.1':
-    resolution: {integrity: sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==}
+  '@esbuild/android-x64@0.28.2':
+    resolution: {integrity: sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [android]
@@ -225,14 +225,14 @@ packages:
     cpu: [arm64]
     os: [darwin]
 
-  '@esbuild/darwin-arm64@0.25.9':
-    resolution: {integrity: sha512-XIpIDMAjOELi/9PB30vEbVMs3GV1v2zkkPnuyRRURbhqjyzIINwj+nbQATh4H9GxUgH1kFsEyQMxwiLFKUS6Rg==}
+  '@esbuild/darwin-arm64@0.28.1':
+    resolution: {integrity: sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [darwin]
 
-  '@esbuild/darwin-arm64@0.28.1':
-    resolution: {integrity: sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==}
+  '@esbuild/darwin-arm64@0.28.2':
+    resolution: {integrity: sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [darwin]
@@ -243,14 +243,14 @@ packages:
     cpu: [x64]
     os: [darwin]
 
-  '@esbuild/darwin-x64@0.25.9':
-    resolution: {integrity: sha512-jhHfBzjYTA1IQu8VyrjCX4ApJDnH+ez+IYVEoJHeqJm9VhG9Dh2BYaJritkYK3vMaXrf7Ogr/0MQ8/MeIefsPQ==}
+  '@esbuild/darwin-x64@0.28.1':
+    resolution: {integrity: sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [darwin]
 
-  '@esbuild/darwin-x64@0.28.1':
-    resolution: {integrity: sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==}
+  '@esbuild/darwin-x64@0.28.2':
+    resolution: {integrity: sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [darwin]
@@ -261,14 +261,14 @@ packages:
     cpu: [arm64]
     os: [freebsd]
 
-  '@esbuild/freebsd-arm64@0.25.9':
-    resolution: {integrity: sha512-z93DmbnY6fX9+KdD4Ue/H6sYs+bhFQJNCPZsi4XWJoYblUqT06MQUdBCpcSfuiN72AbqeBFu5LVQTjfXDE2A6Q==}
+  '@esbuild/freebsd-arm64@0.28.1':
+    resolution: {integrity: sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [freebsd]
 
-  '@esbuild/freebsd-arm64@0.28.1':
-    resolution: {integrity: sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==}
+  '@esbuild/freebsd-arm64@0.28.2':
+    resolution: {integrity: sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [freebsd]
@@ -279,14 +279,14 @@ packages:
     cpu: [x64]
     os: [freebsd]
 
-  '@esbuild/freebsd-x64@0.25.9':
-    resolution: {integrity: sha512-mrKX6H/vOyo5v71YfXWJxLVxgy1kyt1MQaD8wZJgJfG4gq4DpQGpgTB74e5yBeQdyMTbgxp0YtNj7NuHN0PoZg==}
+  '@esbuild/freebsd-x64@0.28.1':
+    resolution: {integrity: sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [freebsd]
 
-  '@esbuild/freebsd-x64@0.28.1':
-    resolution: {integrity: sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==}
+  '@esbuild/freebsd-x64@0.28.2':
+    resolution: {integrity: sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [freebsd]
@@ -297,14 +297,14 @@ packages:
     cpu: [arm64]
     os: [linux]
 
-  '@esbuild/linux-arm64@0.25.9':
-    resolution: {integrity: sha512-BlB7bIcLT3G26urh5Dmse7fiLmLXnRlopw4s8DalgZ8ef79Jj4aUcYbk90g8iCa2467HX8SAIidbL7gsqXHdRw==}
+  '@esbuild/linux-arm64@0.28.1':
+    resolution: {integrity: sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [linux]
 
-  '@esbuild/linux-arm64@0.28.1':
-    resolution: {integrity: sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==}
+  '@esbuild/linux-arm64@0.28.2':
+    resolution: {integrity: sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [linux]
@@ -315,14 +315,14 @@ packages:
     cpu: [arm]
     os: [linux]
 
-  '@esbuild/linux-arm@0.25.9':
-    resolution: {integrity: sha512-HBU2Xv78SMgaydBmdor38lg8YDnFKSARg1Q6AT0/y2ezUAKiZvc211RDFHlEZRFNRVhcMamiToo7bDx3VEOYQw==}
+  '@esbuild/linux-arm@0.28.1':
+    resolution: {integrity: sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==}
     engines: {node: '>=18'}
     cpu: [arm]
     os: [linux]
 
-  '@esbuild/linux-arm@0.28.1':
-    resolution: {integrity: sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==}
+  '@esbuild/linux-arm@0.28.2':
+    resolution: {integrity: sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w==}
     engines: {node: '>=18'}
     cpu: [arm]
     os: [linux]
@@ -333,14 +333,14 @@ packages:
     cpu: [ia32]
     os: [linux]
 
-  '@esbuild/linux-ia32@0.25.9':
-    resolution: {integrity: sha512-e7S3MOJPZGp2QW6AK6+Ly81rC7oOSerQ+P8L0ta4FhVi+/j/v2yZzx5CqqDaWjtPFfYz21Vi1S0auHrap3Ma3A==}
+  '@esbuild/linux-ia32@0.28.1':
+    resolution: {integrity: sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [linux]
 
-  '@esbuild/linux-ia32@0.28.1':
-    resolution: {integrity: sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==}
+  '@esbuild/linux-ia32@0.28.2':
+    resolution: {integrity: sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ==}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [linux]
@@ -351,14 +351,14 @@ packages:
     cpu: [loong64]
     os: [linux]
 
-  '@esbuild/linux-loong64@0.25.9':
-    resolution: {integrity: sha512-Sbe10Bnn0oUAB2AalYztvGcK+o6YFFA/9829PhOCUS9vkJElXGdphz0A3DbMdP8gmKkqPmPcMJmJOrI3VYB1JQ==}
+  '@esbuild/linux-loong64@0.28.1':
+    resolution: {integrity: sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==}
     engines: {node: '>=18'}
     cpu: [loong64]
     os: [linux]
 
-  '@esbuild/linux-loong64@0.28.1':
-    resolution: {integrity: sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==}
+  '@esbuild/linux-loong64@0.28.2':
+    resolution: {integrity: sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ==}
     engines: {node: '>=18'}
     cpu: [loong64]
     os: [linux]
@@ -369,14 +369,14 @@ packages:
     cpu: [mips64el]
     os: [linux]
 
-  '@esbuild/linux-mips64el@0.25.9':
-    resolution: {integrity: sha512-YcM5br0mVyZw2jcQeLIkhWtKPeVfAerES5PvOzaDxVtIyZ2NUBZKNLjC5z3/fUlDgT6w89VsxP2qzNipOaaDyA==}
+  '@esbuild/linux-mips64el@0.28.1':
+    resolution: {integrity: sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==}
     engines: {node: '>=18'}
     cpu: [mips64el]
     os: [linux]
 
-  '@esbuild/linux-mips64el@0.28.1':
-    resolution: {integrity: sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==}
+  '@esbuild/linux-mips64el@0.28.2':
+    resolution: {integrity: sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA==}
     engines: {node: '>=18'}
     cpu: [mips64el]
     os: [linux]
@@ -387,14 +387,14 @@ packages:
     cpu: [ppc64]
     os: [linux]
 
-  '@esbuild/linux-ppc64@0.25.9':
-    resolution: {integrity: sha512-++0HQvasdo20JytyDpFvQtNrEsAgNG2CY1CLMwGXfFTKGBGQT3bOeLSYE2l1fYdvML5KUuwn9Z8L1EWe2tzs1w==}
+  '@esbuild/linux-ppc64@0.28.1':
+    resolution: {integrity: sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==}
     engines: {node: '>=18'}
     cpu: [ppc64]
     os: [linux]
 
-  '@esbuild/linux-ppc64@0.28.1':
-    resolution: {integrity: sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==}
+  '@esbuild/linux-ppc64@0.28.2':
+    resolution: {integrity: sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ==}
     engines: {node: '>=18'}
     cpu: [ppc64]
     os: [linux]
@@ -405,14 +405,14 @@ packages:
     cpu: [riscv64]
     os: [linux]
 
-  '@esbuild/linux-riscv64@0.25.9':
-    resolution: {integrity: sha512-uNIBa279Y3fkjV+2cUjx36xkx7eSjb8IvnL01eXUKXez/CBHNRw5ekCGMPM0BcmqBxBcdgUWuUXmVWwm4CH9kg==}
+  '@esbuild/linux-riscv64@0.28.1':
+    resolution: {integrity: sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==}
     engines: {node: '>=18'}
     cpu: [riscv64]
     os: [linux]
 
-  '@esbuild/linux-riscv64@0.28.1':
-    resolution: {integrity: sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==}
+  '@esbuild/linux-riscv64@0.28.2':
+    resolution: {integrity: sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA==}
     engines: {node: '>=18'}
     cpu: [riscv64]
     os: [linux]
@@ -423,14 +423,14 @@ packages:
     cpu: [s390x]
     os: [linux]
 
-  '@esbuild/linux-s390x@0.25.9':
-    resolution: {integrity: sha512-Mfiphvp3MjC/lctb+7D287Xw1DGzqJPb/J2aHHcHxflUo+8tmN/6d4k6I2yFR7BVo5/g7x2Monq4+Yew0EHRIA==}
+  '@esbuild/linux-s390x@0.28.1':
+    resolution: {integrity: sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==}
     engines: {node: '>=18'}
     cpu: [s390x]
     os: [linux]
 
-  '@esbuild/linux-s390x@0.28.1':
-    resolution: {integrity: sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==}
+  '@esbuild/linux-s390x@0.28.2':
+    resolution: {integrity: sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg==}
     engines: {node: '>=18'}
     cpu: [s390x]
     os: [linux]
@@ -441,26 +441,26 @@ packages:
     cpu: [x64]
     os: [linux]
 
-  '@esbuild/linux-x64@0.25.9':
-    resolution: {integrity: sha512-iSwByxzRe48YVkmpbgoxVzn76BXjlYFXC7NvLYq+b+kDjyyk30J0JY47DIn8z1MO3K0oSl9fZoRmZPQI4Hklzg==}
-    engines: {node: '>=18'}
-    cpu: [x64]
-    os: [linux]
-
   '@esbuild/linux-x64@0.28.1':
     resolution: {integrity: sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [linux]
 
-  '@esbuild/netbsd-arm64@0.25.9':
-    resolution: {integrity: sha512-9jNJl6FqaUG+COdQMjSCGW4QiMHH88xWbvZ+kRVblZsWrkXlABuGdFJ1E9L7HK+T0Yqd4akKNa/lO0+jDxQD4Q==}
+  '@esbuild/linux-x64@0.28.2':
+    resolution: {integrity: sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
+  '@esbuild/netbsd-arm64@0.28.1':
+    resolution: {integrity: sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [netbsd]
 
-  '@esbuild/netbsd-arm64@0.28.1':
-    resolution: {integrity: sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==}
+  '@esbuild/netbsd-arm64@0.28.2':
+    resolution: {integrity: sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [netbsd]
@@ -471,26 +471,26 @@ packages:
     cpu: [x64]
     os: [netbsd]
 
-  '@esbuild/netbsd-x64@0.25.9':
-    resolution: {integrity: sha512-RLLdkflmqRG8KanPGOU7Rpg829ZHu8nFy5Pqdi9U01VYtG9Y0zOG6Vr2z4/S+/3zIyOxiK6cCeYNWOFR9QP87g==}
-    engines: {node: '>=18'}
-    cpu: [x64]
-    os: [netbsd]
-
   '@esbuild/netbsd-x64@0.28.1':
     resolution: {integrity: sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [netbsd]
 
-  '@esbuild/openbsd-arm64@0.25.9':
-    resolution: {integrity: sha512-YaFBlPGeDasft5IIM+CQAhJAqS3St3nJzDEgsgFixcfZeyGPCd6eJBWzke5piZuZ7CtL656eOSYKk4Ls2C0FRQ==}
+  '@esbuild/netbsd-x64@0.28.2':
+    resolution: {integrity: sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@esbuild/openbsd-arm64@0.28.1':
+    resolution: {integrity: sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [openbsd]
 
-  '@esbuild/openbsd-arm64@0.28.1':
-    resolution: {integrity: sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==}
+  '@esbuild/openbsd-arm64@0.28.2':
+    resolution: {integrity: sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [openbsd]
@@ -501,26 +501,26 @@ packages:
     cpu: [x64]
     os: [openbsd]
 
-  '@esbuild/openbsd-x64@0.25.9':
-    resolution: {integrity: sha512-1MkgTCuvMGWuqVtAvkpkXFmtL8XhWy+j4jaSO2wxfJtilVCi0ZE37b8uOdMItIHz4I6z1bWWtEX4CJwcKYLcuA==}
-    engines: {node: '>=18'}
-    cpu: [x64]
-    os: [openbsd]
-
   '@esbuild/openbsd-x64@0.28.1':
     resolution: {integrity: sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [openbsd]
 
-  '@esbuild/openharmony-arm64@0.25.9':
-    resolution: {integrity: sha512-4Xd0xNiMVXKh6Fa7HEJQbrpP3m3DDn43jKxMjxLLRjWnRsfxjORYJlXPO4JNcXtOyfajXorRKY9NkOpTHptErg==}
+  '@esbuild/openbsd-x64@0.28.2':
+    resolution: {integrity: sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@esbuild/openharmony-arm64@0.28.1':
+    resolution: {integrity: sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [openharmony]
 
-  '@esbuild/openharmony-arm64@0.28.1':
-    resolution: {integrity: sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==}
+  '@esbuild/openharmony-arm64@0.28.2':
+    resolution: {integrity: sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [openharmony]
@@ -531,14 +531,14 @@ packages:
     cpu: [x64]
     os: [sunos]
 
-  '@esbuild/sunos-x64@0.25.9':
-    resolution: {integrity: sha512-WjH4s6hzo00nNezhp3wFIAfmGZ8U7KtrJNlFMRKxiI9mxEK1scOMAaa9i4crUtu+tBr+0IN6JCuAcSBJZfnphw==}
+  '@esbuild/sunos-x64@0.28.1':
+    resolution: {integrity: sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [sunos]
 
-  '@esbuild/sunos-x64@0.28.1':
-    resolution: {integrity: sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==}
+  '@esbuild/sunos-x64@0.28.2':
+    resolution: {integrity: sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [sunos]
@@ -549,14 +549,14 @@ packages:
     cpu: [arm64]
     os: [win32]
 
-  '@esbuild/win32-arm64@0.25.9':
-    resolution: {integrity: sha512-mGFrVJHmZiRqmP8xFOc6b84/7xa5y5YvR1x8djzXpJBSv/UsNK6aqec+6JDjConTgvvQefdGhFDAs2DLAds6gQ==}
+  '@esbuild/win32-arm64@0.28.1':
+    resolution: {integrity: sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [win32]
 
-  '@esbuild/win32-arm64@0.28.1':
-    resolution: {integrity: sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==}
+  '@esbuild/win32-arm64@0.28.2':
+    resolution: {integrity: sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [win32]
@@ -567,14 +567,14 @@ packages:
     cpu: [ia32]
     os: [win32]
 
-  '@esbuild/win32-ia32@0.25.9':
-    resolution: {integrity: sha512-b33gLVU2k11nVx1OhX3C8QQP6UHQK4ZtN56oFWvVXvz2VkDoe6fbG8TOgHFxEvqeqohmRnIHe5A1+HADk4OQww==}
+  '@esbuild/win32-ia32@0.28.1':
+    resolution: {integrity: sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [win32]
 
-  '@esbuild/win32-ia32@0.28.1':
-    resolution: {integrity: sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==}
+  '@esbuild/win32-ia32@0.28.2':
+    resolution: {integrity: sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA==}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [win32]
@@ -585,14 +585,14 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@esbuild/win32-x64@0.25.9':
-    resolution: {integrity: sha512-PPOl1mi6lpLNQxnGoyAfschAodRFYXJ+9fs6WHXz7CSWKbOqiMZsubC+BQsVKuul+3vKLuwTHsS2c2y9EoKwxQ==}
+  '@esbuild/win32-x64@0.28.1':
+    resolution: {integrity: sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [win32]
 
-  '@esbuild/win32-x64@0.28.1':
-    resolution: {integrity: sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==}
+  '@esbuild/win32-x64@0.28.2':
+    resolution: {integrity: sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [win32]
@@ -601,160 +601,160 @@ packages:
     resolution: {integrity: sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==}
     engines: {node: '>=18'}
 
-  '@img/sharp-darwin-arm64@0.35.2':
-    resolution: {integrity: sha512-eEieHsMksAW4IiO5NzauESRl2D2qz3J/kwUxUrSfV06A93eEaRfMpHXyUb1mAqrR7i8U9A0GRqE9pjn6u1Jjpg==}
+  '@img/sharp-darwin-arm64@0.35.4':
+    resolution: {integrity: sha512-Uhfl4V4lhP2nbUVF9+hyH1+luj86f1gUFeo8ALYxFoULoU+G87D43BfeMP8XHsk9boxAnCY/bf2EHwhA7MuGsA==}
     engines: {node: '>=20.9.0'}
     cpu: [arm64]
     os: [darwin]
 
-  '@img/sharp-darwin-x64@0.35.2':
-    resolution: {integrity: sha512-BaktuGPCeHJMARpodR8jK4uKiZrPAy9WrfQW0sdI37clracq8Bp01AYS3SZgi5FS/y5twa9t4+LIuuxQjqRrWw==}
+  '@img/sharp-darwin-x64@0.35.4':
+    resolution: {integrity: sha512-hWniXY3bG5qKpkKrAwPe4y+VTPmf086YQAnkxWh7uA1YrlRouWGa0M0Mxj3ZjnXFkv7/TD1bTy9lGUK26vRvWw==}
     engines: {node: '>=20.9.0'}
     cpu: [x64]
     os: [darwin]
 
-  '@img/sharp-freebsd-wasm32@0.35.2':
-    resolution: {integrity: sha512-YoAxdnd8hPUkvLHd3bWY+YA8nw3xM/RyRopYucNsWHVSan8NLVM3X2volsfoRDcXdUJPg6tXahSd7HXPK7lRnw==}
+  '@img/sharp-freebsd-wasm32@0.35.4':
+    resolution: {integrity: sha512-lIsKw/BU+kjB4eZjxrYrZmwOJYi3Ajrv66iAlBmUPyKc3HpnloevB1g3wxGD9P/5BbQ1brBGl65VRRrCvQDEqA==}
     engines: {node: '>=20.9.0'}
     os: [freebsd]
 
-  '@img/sharp-libvips-darwin-arm64@1.3.1':
-    resolution: {integrity: sha512-4V/M3roRMTYjiwZY9IOVQOE8OyeCxFAkYmyZDrZl51uOKjibm3oeEJ4WAmLxutAfzFbC9jqUiPs2gbnGflH+7g==}
+  '@img/sharp-libvips-darwin-arm64@1.3.3':
+    resolution: {integrity: sha512-suTBPTDGrI9WodccaDdwZItTSaBYASlBk1NSfElSHrUfzu3szG6lvIF58+WiFvnfzuK8ZBFS5zE00PxqxnRiPg==}
     cpu: [arm64]
     os: [darwin]
 
-  '@img/sharp-libvips-darwin-x64@1.3.1':
-    resolution: {integrity: sha512-c0/DxItpJv2+dGhgycJBBgotdqruGYDvA79drdh0MD1dFpy7JzJ/PlXwi1H4rFf0eTy8tgbI91aHDnZIceY3jQ==}
+  '@img/sharp-libvips-darwin-x64@1.3.3':
+    resolution: {integrity: sha512-FVJZ5mITMobmXIz/hPDTw0EintTW5H3WfrxwLqEqjiIihlu+hVRyGrFQ60xl0Lxn7Bt3zdpevPaQi0HEzqz9fw==}
     cpu: [x64]
     os: [darwin]
 
-  '@img/sharp-libvips-linux-arm64@1.3.1':
-    resolution: {integrity: sha512-JznefmcK9j1JKPz8AkQDh89kjojubyfOasWBPKfzMIhPwsgDy9evpE/naJTXXXmghS1iFwR8u/kTwh/I2/+GCw==}
+  '@img/sharp-libvips-linux-arm64@1.3.3':
+    resolution: {integrity: sha512-0DaL0A6Xu6sQSQFwe4iVCrKWU2cCTItnRsYsCdxAMm9NF6twAA9BKnoqy4hqz4+azQ0JHuA26qiUKsf1XJ/v5A==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-libvips-linux-arm@1.3.1':
-    resolution: {integrity: sha512-aGGy9aWzXgHBG7HNyQPWorZthlp7+x6fDRoPAQbGO3ThcttuTyKIx3NuSHb6zb4gBNq6/yNn9f1cy9nFKS/Vmg==}
+  '@img/sharp-libvips-linux-arm@1.3.3':
+    resolution: {integrity: sha512-3rbU4vqXXc3hY/OiXdl52xZvT0F1yEngWfvqudtPJg/KkyiaQw2DRsFrNzpmLvfavbwOq3qXn36GP8obHRULQA==}
     cpu: [arm]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-libvips-linux-ppc64@1.3.1':
-    resolution: {integrity: sha512-1EkwGNCZk6iWNCMWqrvdJ+r1j0PT1zIz60CNPhYnJlK/zyeWqlsPZIe+ocBVqPF8k/Ssee/NCk+tE9Ryrko6ng==}
+  '@img/sharp-libvips-linux-ppc64@1.3.3':
+    resolution: {integrity: sha512-cdn1OvUBwsXhbC0zSzJnNzf5MZ/mTrobawDvNXBTxe8VtqKAm0sRuEY2Evzovb/w9JMk4TvRxqt1mekSuJz64w==}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-libvips-linux-riscv64@1.3.1':
-    resolution: {integrity: sha512-Ilays+w2bXdnxzxtQdmXR62u8o8GYa3eL4+Gr+1KiE4xperMZUslRaVPJwwPkzlHEjGfXAfRVAa/7CYCtSqsBw==}
+  '@img/sharp-libvips-linux-riscv64@1.3.3':
+    resolution: {integrity: sha512-HjPVx7yKz+0lqdhDlTw1tt90wamBoxhiXpvl1XZpJLiHH4RCJ5yDTqH+VlYPv2fwFs89JFw4c1IexYOcQUi4IQ==}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-libvips-linux-s390x@1.3.1':
-    resolution: {integrity: sha512-VfBwVHQTbRoj4XlpA/KLZ7ltgMpz+4WSejFzQ+GnoImjo1PtEJ59QB2qR1xQEeRPYIkNrPIm2L4cICMvz4C2ew==}
+  '@img/sharp-libvips-linux-s390x@1.3.3':
+    resolution: {integrity: sha512-neWLh+3yCNThxnfy3c4BbVBeGgt9aftno+XbT56iK28RgeDs3UOFWviLWlUu0bArYVYJaFDK+RRohbicUNCm8Q==}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-libvips-linux-x64@1.3.1':
-    resolution: {integrity: sha512-+c8ukgwU62DS54nCAjw7keOfHUkmr0B5QHEdcOqRnodF/MNXJbVI8Eopoj4B/0H8Asr65I+A4Amrn7a85/md6A==}
+  '@img/sharp-libvips-linux-x64@1.3.3':
+    resolution: {integrity: sha512-4vKmvAst9nrowcqquKFAyZJUDolUaIp8uRiN0mWFguJ1IplC9/pitXtlnnlU4aa/eJw3J7i67V+pwUL+wZGdsA==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-libvips-linuxmusl-arm64@1.3.1':
-    resolution: {integrity: sha512-qlKb/pwbkAi1WMsJrYHk7CuDrd12s27U2QnRhFYUoJNrRCmkosMTttuRFat/DDB3IlDm5qE1TJgZ4JDnHX8Ldw==}
+  '@img/sharp-libvips-linuxmusl-arm64@1.3.3':
+    resolution: {integrity: sha512-Y9kQaLMuNoB0bPYOOdcZMaseNrFpPodIWWMrx+CZyydf2xn68j9WYc6sWWRrDwNkzCQjKYfc68L7jKjGlHMibw==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@img/sharp-libvips-linuxmusl-x64@1.3.1':
-    resolution: {integrity: sha512-yO21HwoUVLN8Qa+/SBjQLMYwBWAVJjeGPNe+hc0OUeMeifEtJqu5a1c4HayE1nNpDih9y3/KkoltfkDodmKAlg==}
+  '@img/sharp-libvips-linuxmusl-x64@1.3.3':
+    resolution: {integrity: sha512-fj8Mv0HHfD1Rr+4I68+3agJynxDWtBFgicTbSOb9Bke6pIwzGcJ+RX/yHjmiEGFMCavY/dxvem7MyNaJF+wDiw==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@img/sharp-linux-arm64@0.35.2':
-    resolution: {integrity: sha512-af12Pnd0ZGu2HfP8NayB0kk6eC/lrfbQE6HlR4jD+34wdJ1Vw9TF6TMn6ZvffT+WgqVsl0hRbmNvz2u/23VmwA==}
+  '@img/sharp-linux-arm64@0.35.4':
+    resolution: {integrity: sha512-De4jpEnAU8Hd5oT0j1G3uL4ZvTuipVMn7YC6vPaJhy6/7EwEae0SVAoBrUMYQbkLGDm85taVWwuPc1a44LTzCQ==}
     engines: {node: '>=20.9.0'}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-linux-arm@0.35.2':
-    resolution: {integrity: sha512-SE4kzF2mepn6z+6E7L6lsV8FzuLL6IPQdyX8ZiwROAG/G8td+hP/m7FsFPwidtrF19gvajuC9l6TxAVcsA4S7A==}
+  '@img/sharp-linux-arm@0.35.4':
+    resolution: {integrity: sha512-7OAS8gI0EReKGVN2HssHlM6umJgxF5VI3xN0p9FA91p/YO+ou5hiNghLdZ5BEHztwaaK5+bLKRf8x/o2L2nk9A==}
     engines: {node: '>=20.9.0'}
     cpu: [arm]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-linux-ppc64@0.35.2':
-    resolution: {integrity: sha512-hYSBm7zcNtDCozCxQHYZJiu63b/bXsgRZuOxCIBZsStMM9Vap47iFHdbX4kCvQsblPB/k+clhELpdQJHQLSHvg==}
+  '@img/sharp-linux-ppc64@0.35.4':
+    resolution: {integrity: sha512-2oYZJeIl4kCcMGk4ouZVjnkCtFrpQFlNEtJ6GbxzhHQchwH0NH/qEb9ykmOl29dqwMq+JhFdZn+1ak2FKhI9fQ==}
     engines: {node: '>=20.9.0'}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-linux-riscv64@0.35.2':
-    resolution: {integrity: sha512-qQt0Kc13+Hoan/Awq/qMSQw3L+RI1NCRPgD5cUJ/1WSSmIoysLOc72jlRM3E0OHN9Yr313jgeQ2T+zW+F03QFA==}
+  '@img/sharp-linux-riscv64@0.35.4':
+    resolution: {integrity: sha512-cPbNChoRURAWdebDIHSenxRpgEdy7JkPydSnUxRm9VvKD7m0/xVaR/8Fzlu81pk5nHEvHH87UZUA7cTtwnbJSA==}
     engines: {node: '>=20.9.0'}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-linux-s390x@0.35.2':
-    resolution: {integrity: sha512-E4fLLfRPzDLlEeDaTzI98OFLcv++WL5ChLLMwPoVd0CIoZQqupBSNbOisPL5am9XsbQ9T84+iiMpUvbFtkunbA==}
+  '@img/sharp-linux-s390x@0.35.4':
+    resolution: {integrity: sha512-RY0JFY8Fd6RonCBtHz+DvadaPkXDSI1AUn6yWL9TipqkZ1vY8w8evqdgyDFnkm4/K1ve1TvZiaePP5oSd4+WVQ==}
     engines: {node: '>=20.9.0'}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-linux-x64@0.35.2':
-    resolution: {integrity: sha512-gi0zFJJRLswfCZmHtJdikXPOc5u7qamSOS3NHedLqLd4W8Q0NqjdBr6TTRIgsfFjqfTsHFgdfvJ9LwqSgcHiAA==}
+  '@img/sharp-linux-x64@0.35.4':
+    resolution: {integrity: sha512-9qvvEAuk8k89TfWUoX2htWjbAMX8p+NxCppjpcg5k6xMsjhBQPTsoIh36h9Qde4WRuGpJeYnOjdosDn/cnv+OA==}
     engines: {node: '>=20.9.0'}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-linuxmusl-arm64@0.35.2':
-    resolution: {integrity: sha512-siWbOW1u6HFnFLrp0waKyW7VEf7jYvcDWdrXEFa8AkdAQgEvuu5Fz8/Y70w9EeqAdwDtfU012BhEHHaDqvQNzg==}
+  '@img/sharp-linuxmusl-arm64@0.35.4':
+    resolution: {integrity: sha512-KB5jxpfWQTr0nc3xdHtWChdbifHrBGsd2SM62Eyxrl8afikm+f5qGBU75SJIZBT/S1MC8XyacdlXBMSWq6OURA==}
     engines: {node: '>=20.9.0'}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@img/sharp-linuxmusl-x64@0.35.2':
-    resolution: {integrity: sha512-YBqMMcjDi4QGYiSn4vNOYBhmlC4z5AXqkOUUqI2e0AFA4urNv4ESgOgwNl3K+4etQhha0twXlzeF20bbULm9Yg==}
+  '@img/sharp-linuxmusl-x64@0.35.4':
+    resolution: {integrity: sha512-f+eZJZIQNEEd26RPSW+76chwOf1XtA2Y/O+5ocVyLliHkeih3e+jhLVBdNTd2rS3IbNXK8+ug93Vf5ZXtF5Lxg==}
     engines: {node: '>=20.9.0'}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@img/sharp-wasm32@0.35.2':
-    resolution: {integrity: sha512-Mrv4JQNYVQ94xH+jzZ9r+gowleN8mv2FTgKT+PI6bx5C0G8TdNYndu161pg2i7uoBwxy2ImPMHrJOM2LZef7Bw==}
+  '@img/sharp-wasm32@0.35.4':
+    resolution: {integrity: sha512-zQnl4Kwp7Q6NHsENtU2T/00Zi+w3AQNwz3+UaTyVBy2FpXrzXzGjndpK61onhZjRtRpQXxCTeqw19bVyXOh7jA==}
     engines: {node: '>=20.9.0'}
 
-  '@img/sharp-webcontainers-wasm32@0.35.2':
-    resolution: {integrity: sha512-QNV27pxs9wpApEiCfvHM1RDoP1w1+2KrUWWDPEhEwg+latvOrfuhWrHWZKwdSFwU6jh3myjw/yOCRsUIuOft3g==}
+  '@img/sharp-webcontainers-wasm32@0.35.4':
+    resolution: {integrity: sha512-ESfNkywmCfPNyaZjxooddJQiQ+l/nTpGEOGthxiLnIHXC/CmcBixnfwUleX9mCz9ovrUUvKMap/pm8RYbzfwaA==}
     engines: {node: '>=20.9.0'}
     cpu: [wasm32]
 
-  '@img/sharp-win32-arm64@0.35.2':
-    resolution: {integrity: sha512-BiVRYc/t6/Vl3e1hBx0hugG4oN9Pydf4fgMSpxTQJmwGUg/YoXTWHiFeRymHfCZzifxu4F4rpk/I67D0LQ20wQ==}
+  '@img/sharp-win32-arm64@0.35.4':
+    resolution: {integrity: sha512-iNdlBX9gLVvqe2I3uIJSIKTq6wckP/DYxZtcqxm09x5Gi24DnFBmPAWZmr60ZyYMG0xlzo6goG3670ar+RXvRw==}
     engines: {node: '>=20.9.0'}
     cpu: [arm64]
     os: [win32]
 
-  '@img/sharp-win32-ia32@0.35.2':
-    resolution: {integrity: sha512-YYEhx9PImCC7T0tI8JDMi4DB9LwLCXCU5OWNYEXAxh5Q1ShKkyC6byxzoBJ3gEFDnH2lQckWuDe70G7mB2XJog==}
+  '@img/sharp-win32-ia32@0.35.4':
+    resolution: {integrity: sha512-kqRsbaa5CS6KHlpxnN7WhE6vAAugXyZButpRdvDWetlv6Qv4N9WTcrWzF7tXfB9T7MsoadqdI8hmwLq6UlLvtw==}
     engines: {node: ^20.9.0}
     cpu: [ia32]
     os: [win32]
 
-  '@img/sharp-win32-x64@0.35.2':
-    resolution: {integrity: sha512-imoOyBcoM/iiUr4J6VPpCNjPnjvP/Gks95898yB8YqoGGYmHYbOyCuNv9FMhFgtaiHFGbHW8bxKqRV6VjtXThQ==}
+  '@img/sharp-win32-x64@0.35.4':
+    resolution: {integrity: sha512-XtmnYhBcrORsJ4XJngyzr/EWP0hRZLAZRFaApdKuviyqF78+ylxh2y06ZmtULAMOnObJ3ucpN0AcwSWnMowTRg==}
     engines: {node: '>=20.9.0'}
     cpu: [x64]
     os: [win32]
@@ -785,141 +785,141 @@ packages:
   '@poppinss/exception@1.2.3':
     resolution: {integrity: sha512-dCED+QRChTVatE9ibtoaxc+WkdzOSjYTKi/+uacHWIsfodVfpsueo3+DKpgU5Px8qXjgmXkSvhXvSCz3fnP9lw==}
 
-  '@rollup/rollup-android-arm-eabi@4.63.1':
-    resolution: {integrity: sha512-UZ8sUxPTiHWYX9QNdJedb1kDZSpS1t/VPWBWGSgqHNi9w3Cu6IXvu2mzbhiTiPvtrqgTQJ+zqiAq2iPIPilpaQ==}
+  '@rollup/rollup-android-arm-eabi@4.63.3':
+    resolution: {integrity: sha512-w3Jnvi1ocaVm/c7yVPpfB98XeSRBMyzp6njL5MVVbGyXjpmUkN+s6Hp4t0PqhGCCaI1ZHMKXt/w0lA1RCaLVcw==}
     cpu: [arm]
     os: [android]
 
-  '@rollup/rollup-android-arm64@4.63.1':
-    resolution: {integrity: sha512-cQ4nFQABN5cDvDpbvJ7bMStCpnaVxynZrRMfUJYgxcIk9Sh54FIO1vtfkg0B69REjER77ioZ/ov+eAApx/KmLQ==}
+  '@rollup/rollup-android-arm64@4.63.3':
+    resolution: {integrity: sha512-uI/ESiaIbbRYAEhzy8PCUWDp1hB0bjAqM06mW9flOoNO4Q8DQpeoREhBR5Hegfl+wpXiguyJv6XSPzEN7OxyHQ==}
     cpu: [arm64]
     os: [android]
 
-  '@rollup/rollup-darwin-arm64@4.63.1':
-    resolution: {integrity: sha512-FQNqd1lRy/0QhDk3xeRIkSBiCpXCiDnZO3YLVdcDKN1UBiKToNftCzcXYNLshmPDUMlu2TdeS8tGcsU6f3YF1Q==}
+  '@rollup/rollup-darwin-arm64@4.63.3':
+    resolution: {integrity: sha512-oxhrd1jmXLwWZ83eQYDXxuqRdkqkzrjR3JobKeuUyfdNZo11FuQIvqEOZhyIT7OBHxXoGslDDjN0cQcM6T0TqQ==}
     cpu: [arm64]
     os: [darwin]
 
-  '@rollup/rollup-darwin-x64@4.63.1':
-    resolution: {integrity: sha512-pvD16V939D3CloK0+qikpGaxiPrDUXTe7Y5cWOMkMSy7m1cawa8EGy/kXYi/G/cKAC4HDAbSnzCIk1WmsoOKXg==}
+  '@rollup/rollup-darwin-x64@4.63.3':
+    resolution: {integrity: sha512-7/YiIMghVE8DrxKvNdorAaJVdriOFgOIpdStnPx8ppx5zfTwC3jBCSEAIzB7JD5404m65THl6H93UTTVUvypmg==}
     cpu: [x64]
     os: [darwin]
 
-  '@rollup/rollup-freebsd-arm64@4.63.1':
-    resolution: {integrity: sha512-pcFGeL2345VwdTnJhA6zLbew+YgWB0qBG2+dMtXjCicf6+rm6kO6cOoh5VnTe0ZMrMRgRyuHmCJxZWrIdzYuOw==}
+  '@rollup/rollup-freebsd-arm64@4.63.3':
+    resolution: {integrity: sha512-GXFZRRoMAytaI5z6N3Zhfw0WL18Q0M8r95D5hlC4GqE/lGk8pbSJNUBoOWDfbm6dTciqHj2nU87tI5f6XhQiOg==}
     cpu: [arm64]
     os: [freebsd]
 
-  '@rollup/rollup-freebsd-x64@4.63.1':
-    resolution: {integrity: sha512-mRJlqSRulVzcKq/LKA6ICSIc3K/l4fzlVn/gePn2nXIHy8seRi5z/eeRE0d/XMBxcMldiXtQTSpRj0tkkC3g8Q==}
+  '@rollup/rollup-freebsd-x64@4.63.3':
+    resolution: {integrity: sha512-77W+8X3ddYgPxUpB8nZFQs2Mq+wc4HVlcSRtApXLjYBcnPMkttrSnU8VwKQjeWYhMsITHFs5cWBQ8vz1Q+5RHQ==}
     cpu: [x64]
     os: [freebsd]
 
-  '@rollup/rollup-linux-arm-gnueabihf@4.63.1':
-    resolution: {integrity: sha512-YDUNvVM85TI3g/1OpnqKP1h4NeW/j64DfWMf+G3M809xNk1bJSnpFp4sh83NpmVE5DXnkh8ULor4LTVZKoYLHw==}
+  '@rollup/rollup-linux-arm-gnueabihf@4.63.3':
+    resolution: {integrity: sha512-FVkwK+iUC+mq+GipVK46rRVticfAPtvPUNlqlGXUDxdVk/UGjQiiiUVPUrEXdSpU2ufU0XxLGyTqDtBidDOVmg==}
     cpu: [arm]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-arm-musleabihf@4.63.1':
-    resolution: {integrity: sha512-7Mcn71p9ZuQFAj+h+dhQXy/yeLePRS2yKRnmW1DijA9thKO5qap0GNOIQK4yQ6iP3SU0Mrb/yWo8h8vgRba8lw==}
+  '@rollup/rollup-linux-arm-musleabihf@4.63.3':
+    resolution: {integrity: sha512-+aGU1t3398yQOVj1Bz8o3e+KtswxAPvO+mtxtNdfXYMkXIHu7XhhkCD7/DEH9q8tF8uhDnMWvfpUKI8y1sZJsg==}
     cpu: [arm]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-linux-arm64-gnu@4.63.1':
-    resolution: {integrity: sha512-4YiLQTX6U4CSl0L9cluep9A9W6UmTfqBDc2/CH6wlu54pl4E7Jn3cOD8oxzvBDEGk/JMKgJ47C8g+radF7mwvg==}
+  '@rollup/rollup-linux-arm64-gnu@4.63.3':
+    resolution: {integrity: sha512-cR0kjpRXR2KJ2oQK8E2KTPtphs+b9hZ8IhTZubNryt/RsqgdOZBQ2Zq0q5UedtiIi0rs3jVhJh55RE1ZHUVGUA==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-arm64-musl@4.63.1':
-    resolution: {integrity: sha512-2ra8F7w8OquwZN9z2/fKFnli69wa8PLwaVzRMIPGb13ByMJwC28Fbp8YcVGoUhlYMTt7j5j9bNgpysrN2UM+vw==}
+  '@rollup/rollup-linux-arm64-musl@4.63.3':
+    resolution: {integrity: sha512-y1RYi4Q3/9ByVWSSt9kX2ustE0B7kFYbJ6zZdVZVyqopZs3yhCTwRfrjIX4vezUJInma/Gs6BOFDJg7yZmJ0IQ==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-linux-loong64-gnu@4.63.1':
-    resolution: {integrity: sha512-Sy20ncyhjmBP0Ml+UvQbimjlk6VFgjW5uNP+qqwHB00mTE8Bl2C1TuHTlRwK2YoXeZbee5lP2XevBWVkAQAtSQ==}
+  '@rollup/rollup-linux-loong64-gnu@4.63.3':
+    resolution: {integrity: sha512-DNhEA5viIj3Z5bZLE4z4oV8N5ozWqDwyt7T6KG7VdLDJ0nW+rNOYlphBl4/3HQkK75qipPLsVOfStHHOwN9WSg==}
     cpu: [loong64]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-loong64-musl@4.63.1':
-    resolution: {integrity: sha512-noITLp8oNjYliPnGWmLyelIHwULGqbHloQHGw1rtxbWhTuWooRpnZarZQJ1y9EUC4szuCusCc+HEpUtxpIwYvA==}
+  '@rollup/rollup-linux-loong64-musl@4.63.3':
+    resolution: {integrity: sha512-17gQCqrIpXBX2Cmi9/TygnVOqGbzsba/iaqcYSL8FY7lNugg+7AiYNs5c5nKWD+NRQha36Sa0CqkJqH4XVHwnQ==}
     cpu: [loong64]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-linux-ppc64-gnu@4.63.1':
-    resolution: {integrity: sha512-hlxxXd+F1mWiAcaFR7Sv9ZQT6m6UfI8+Vy/kFJzztq2pDMU/0wZ9sish0iszNZvsQDo8Gc0i5yuFEOz5dDf6fA==}
+  '@rollup/rollup-linux-ppc64-gnu@4.63.3':
+    resolution: {integrity: sha512-6LwVnZRIyINpdku/yOcI8Tm9YqLmhHK5emmlOOnW9tO0SYEm1FmKPcsSAGp0NBlqR2P04xaND4jvN6sTHqhq8A==}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-ppc64-musl@4.63.1':
-    resolution: {integrity: sha512-EF7OpqQTQ/BvGqLzUi4rEHuagCV9MugAUXSHemwPW5vxZ75RR+jxO/2j95Ph2dalMpFHSVECjRoioHZgA9zOYA==}
+  '@rollup/rollup-linux-ppc64-musl@4.63.3':
+    resolution: {integrity: sha512-xMUqkTXlEUtI/p5AAukMwBRr1enU3efsTeF+bskeFfk8t1C9rcC8sLREcZXmTfAXEbvRdJVSonVJez3TMlbR3w==}
     cpu: [ppc64]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-linux-riscv64-gnu@4.63.1':
-    resolution: {integrity: sha512-wQO3JesW9PRkwlabQ27y7sPfVOOTLRG73I4F2UYHG5PXun3J9U3y+b7ezVKSYbsvSKGQ1k1cq8Qlun4C9kLt3w==}
+  '@rollup/rollup-linux-riscv64-gnu@4.63.3':
+    resolution: {integrity: sha512-S3E94co9F9WRRqEaUoQZ38K1gCz6KiM+nL7/3ijq7fDGF3OznjS5TasgYITlvl27GQKtu4lOAOsr5MFwkijvOA==}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-riscv64-musl@4.63.1':
-    resolution: {integrity: sha512-ouAGwhO6wHRXdnOVCOsB0tRFkA7nhNB2Nwax6oECXN0YiN8EYUTBAOudADOB1PI+yDL61TeNx/u7MVCzksNbkQ==}
+  '@rollup/rollup-linux-riscv64-musl@4.63.3':
+    resolution: {integrity: sha512-1QtRDwG42x5BJI3s9mxu5rEjDnfbSnk20HQ9/ylTAYnSwYwxMVb+Vgu34wzzTQ7ogqBybebgQNUDAvZVQ38DbA==}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-linux-s390x-gnu@4.63.1':
-    resolution: {integrity: sha512-q2R38Sn+1J8RxhfJ+T54wSWmyKXWec+9jgDfqO2AtArEqHO5R2aeayp5H5OYLr5UYDVGsVaZPEFUooMhYCdz5A==}
+  '@rollup/rollup-linux-s390x-gnu@4.63.3':
+    resolution: {integrity: sha512-BQhejF6ZXOpxbngiNTP12GCGQeaDVL2QXGeBVViKIYzFHM5RKxTxwUMB1fr1BeNFphFMpnRqC5QSXFSa4z6UQw==}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-x64-gnu@4.63.1':
-    resolution: {integrity: sha512-gfI5T24WLLuFfSKw7Go/zDXjAAV0fny0swTaDv+WjK7vqcw4cRhFfdsyKL1n+ukI+ooBxn3bVQnyrn06WpI50w==}
+  '@rollup/rollup-linux-x64-gnu@4.63.3':
+    resolution: {integrity: sha512-SXagRwnI2Wlwlitllu59UK/nGVbD1CKPcNqDplHwIC4BqJcpXFjD32d1R/RbuISa95HdQrZM3/7v4bKiowFaLA==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-x64-musl@4.63.1':
-    resolution: {integrity: sha512-4h6XqthmB4Hspji84wvgk+ElodTsGj+dbZqHJHHtKxj4mYq0ANSEEPX9ys3moJueqsRjwpaJYH7874Itwnj2ow==}
+  '@rollup/rollup-linux-x64-musl@4.63.3':
+    resolution: {integrity: sha512-2IPozoEALRCziGqE8O9KMK60PMu5TS1huv4fwoeCexj+WjmcwFtX9CTOVbfXCUqcELAubEwRFPYlzb/WvwY2HQ==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-openbsd-x64@4.63.1':
-    resolution: {integrity: sha512-dlfCOa87o1VAYegLQ9EKilx2JCeRofiyPGhTCmqnuXZ6bMPiycO1rq1+sKoulAp7pGLIsTIw+1x5R+zgh5LhhA==}
+  '@rollup/rollup-openbsd-x64@4.63.3':
+    resolution: {integrity: sha512-AoxqosUHT9IX54hFn2TiN6A7d6ZKTtE6pd2bqWtqkkNJ6HJGaU6FRouGX8L1O7R/ZwsnCnpQrHzb4pDEx+UHRQ==}
     cpu: [x64]
     os: [openbsd]
 
-  '@rollup/rollup-openharmony-arm64@4.63.1':
-    resolution: {integrity: sha512-cjkLbOlfcm3QGhMM1J5zaZjsw1GggbN6rw9UTSSRrPrR1KkcXnN7Uq9rPw34xImQ9VOY9GN+6u2Zj80B9ptkcw==}
+  '@rollup/rollup-openharmony-arm64@4.63.3':
+    resolution: {integrity: sha512-d+CaftKgmkFBzCwezMqqy1d0QNNYugqLCMcYVQWBy5SS2YfeMP8Q8ripkgx9O8IyBXXLHrJ+aaCV4U96usv6Yg==}
     cpu: [arm64]
     os: [openharmony]
 
-  '@rollup/rollup-win32-arm64-msvc@4.63.1':
-    resolution: {integrity: sha512-Li1KdUnWGE4N3e1F/B4RTB1ms+nG4WBgjByO46pkeBVX/2UBsY53xf5vK9WygVmnH3RwncIST7lkSdLSY6P9lg==}
+  '@rollup/rollup-win32-arm64-msvc@4.63.3':
+    resolution: {integrity: sha512-xXlDF6nR1eOuXbdDy5Hl5fmtY7teUDevF/k0O7IPoZe4Tpmdv+lgdE5JRsnhQtt37ql9P0VF2kAN9a0OCZdo+Q==}
     cpu: [arm64]
     os: [win32]
 
-  '@rollup/rollup-win32-ia32-msvc@4.63.1':
-    resolution: {integrity: sha512-t4ZYOSoLTgwhuFMrmTMLx/+i1DQVK7HYqMc6kY46EApwi8X0nIVphzdNoThU3xt6n+N5urG1/gxBdCaKDLavfg==}
+  '@rollup/rollup-win32-ia32-msvc@4.63.3':
+    resolution: {integrity: sha512-YtXAgLN+JP7Ay6qG3eWhc7IHMQPzLc8r3uvhAvlJIoCz/4Q32+Bl9Fmnywidh8v1GOIMmymjovfqY9ETAtysvA==}
     cpu: [ia32]
     os: [win32]
 
-  '@rollup/rollup-win32-x64-gnu@4.63.1':
-    resolution: {integrity: sha512-RgroPfMmKlD1RzSDxvwgcPiy2HNQKoYV7OmwIXDsk73uKW5t6B/V8KIy27SMv/FNXFo/oSBtWc9J0X7t91ezZg==}
+  '@rollup/rollup-win32-x64-gnu@4.63.3':
+    resolution: {integrity: sha512-WuWtSJRNo549vzcfZyEgfqb6zeSgn1F+UE5kQ+BCjzz0W4MGCjntUHkZVc1VRuAM7+ULaSyhiPxD1spyewFvkQ==}
     cpu: [x64]
     os: [win32]
 
-  '@rollup/rollup-win32-x64-msvc@4.63.1':
-    resolution: {integrity: sha512-at8QVep6S3h5Y6gSbdGU06bRY5WJkf6WUduM9YtvYMbYhB1MOFfUgc6kehitQXzOtMSaT70q7f9ydPhpqu821w==}
+  '@rollup/rollup-win32-x64-msvc@4.63.3':
+    resolution: {integrity: sha512-+lIKX7O0+IGe7WuhATaAMMeT7B76vfhXH/l9wLQL+nvyhbw2ohYCKIdWL56JfDu75CWt5oKRP4QFH/jkMtBquA==}
     cpu: [x64]
     os: [win32]
 
@@ -930,40 +930,46 @@ packages:
   '@speed-highlight/core@1.2.24':
     resolution: {integrity: sha512-qeW2e1l78afw8VhRPfPQ1Gjj+KU5XFQ/OFV5ti6eTa9bruO7mJyZtA4vw0ofqmA3tKCkROE9xLk3VZoeRc98nw==}
 
+  '@types/chai@5.2.3':
+    resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==}
+
+  '@types/deep-eql@4.0.2':
+    resolution: {integrity: sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==}
+
   '@types/estree@1.0.9':
     resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
 
   '@types/node@22.18.1':
     resolution: {integrity: sha512-rzSDyhn4cYznVG+PCzGe1lwuMYJrcBS1fc3JqSa2PvtABwWo+dZ1ij5OVok3tqfpEBCBoaR4d7upFJk73HRJDw==}
 
-  '@vitest/expect@2.1.9':
-    resolution: {integrity: sha512-UJCIkTBenHeKT1TTlKMJWy1laZewsRIzYighyYiJKZreqtdxSos/S1t+ktRMQWu2CKqaarrkeszJx1cgC5tGZw==}
+  '@vitest/expect@3.2.7':
+    resolution: {integrity: sha512-E8eBXaKibuvH2pSZErOjdVb5vF4PbKYcrnluBTYxEk1l/VhhwZg1kZQsdtjq+CsF5CFydf2Rdkz7jDHKSisi3w==}
 
-  '@vitest/mocker@2.1.9':
-    resolution: {integrity: sha512-tVL6uJgoUdi6icpxmdrn5YNo3g3Dxv+IHJBr0GXHaEdTcw3F+cPKnsXFhli6nO+f/6SDKPHEK1UN+k+TQv0Ehg==}
+  '@vitest/mocker@3.2.7':
+    resolution: {integrity: sha512-Trr0hYO9CM3Wj6ksWHRhK9IZpIY6wTMO5u/MqXurMxT57sWBaOPEtP3Oq60ihZuh5JsiagKfz95OcxdEP6dBrA==}
     peerDependencies:
       msw: ^2.4.9
-      vite: ^5.0.0
+      vite: ^5.0.0 || ^6.0.0 || ^7.0.0-0
     peerDependenciesMeta:
       msw:
         optional: true
       vite:
         optional: true
 
-  '@vitest/pretty-format@2.1.9':
-    resolution: {integrity: sha512-KhRIdGV2U9HOUzxfiHmY8IFHTdqtOhIzCpd8WRdJiE7D/HUcZVD0EgQCVjm+Q9gkUXWgBvMmTtZgIG48wq7sOQ==}
+  '@vitest/pretty-format@3.2.7':
+    resolution: {integrity: sha512-KUHlwqVu0sRlhCdyPdQ/wBoTfRahjUky1MubOmYw9fWfIZy1gNoHpuaaQBPAaMaVYdQYHJLurzj8ECCj5OwTqA==}
 
-  '@vitest/runner@2.1.9':
-    resolution: {integrity: sha512-ZXSSqTFIrzduD63btIfEyOmNcBmQvgOVsPNPe0jYtESiXkhd8u2erDLnMxmGrDCwHCCHE7hxwRDCT3pt0esT4g==}
+  '@vitest/runner@3.2.7':
+    resolution: {integrity: sha512-sB9y4ovltoQP+WaUPwmSxO9WIg9Ig694Di5PalVPsYHklAdE027mehpWF2SQSVq+k6sFgaivbTjTJwZLSHbedA==}
 
-  '@vitest/snapshot@2.1.9':
-    resolution: {integrity: sha512-oBO82rEjsxLNJincVhLhaxxZdEtV0EFHMK5Kmx5sJ6H9L183dHECjiefOAdnqpIgT5eZwT04PoggUnW88vOBNQ==}
+  '@vitest/snapshot@3.2.7':
+    resolution: {integrity: sha512-7C+MwShwtBSI5Buwoyg3s/iY1eHL9PKAf+O1wVh/TdnjXUtkoL/9YQtre90i4MtNXM6edP1wJ2zOBpfCyhIS7g==}
 
-  '@vitest/spy@2.1.9':
-    resolution: {integrity: sha512-E1B35FwzXXTs9FHNK6bDszs7mtydNi5MIfUWpceJ8Xbfb1gBMscAnwLbEu+B44ed6W3XjL9/ehLPHR1fkf1KLQ==}
+  '@vitest/spy@3.2.7':
+    resolution: {integrity: sha512-Q2eQGI6d2L/hBtZ0qNuKcAGid68XK6cv1xsoaIma6PaJhHPoqcEJhYpXZ/5myCMqkNgtP6UKuBhbc0nHKnrkuQ==}
 
-  '@vitest/utils@2.1.9':
-    resolution: {integrity: sha512-v0psaMSkNJ3A2NMrUEHFRzJtDPFn+/VWZ5WxImB21T9fjucJRmS7xCS3ppEnARb9y11OAzaD+P2Ps+b+BGX5iQ==}
+  '@vitest/utils@3.2.7':
+    resolution: {integrity: sha512-x6BDOd7dyo3PFLY3I9/HJ25X/6OurhGXk2/B9gOZNPF7XDVjeBK4k01lQE5uvDpbuheErh91qYuE1E2OEjK3Rw==}
 
   assertion-error@2.0.1:
     resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==}
@@ -980,8 +986,8 @@ packages:
     resolution: {integrity: sha512-b6Ilus+c3RrdDk+JhLKUAQfzzgLEPy6wcXqS7f/xe1EETvsDP6GORG7SFuOs6cID5YkqchW/LXZbX5bc8j7ZcQ==}
     engines: {node: '>=8'}
 
-  chai@5.1.2:
-    resolution: {integrity: sha512-aGtmf24DW6MLHHG5gCx4zaI3uBq3KRtxeVs0DjFH6Z0rDNbsvTxFASFvdj79pxjxZ8/5u3PIiN3IwEIQkiiuPw==}
+  chai@5.2.0:
+    resolution: {integrity: sha512-mCuXncKXk5iCLhfhwTc0izo0gtEmpz5CtG2y8GiOINBlMVS6v8TMRc5TaLWKS6692m9+dVVfzgeVxR5UxWHTYw==}
     engines: {node: '>=12'}
 
   check-error@2.1.3:
@@ -1012,21 +1018,21 @@ packages:
   error-stack-parser-es@1.0.5:
     resolution: {integrity: sha512-5qucVt2XcuGMcEGgWI7i+yZpmpByQ8J1lHhcL7PwqCwu9FPP3VUXzT4ltHe5i2z9dePwEHcDVOAfSnHsOlCXRA==}
 
-  es-module-lexer@1.5.4:
-    resolution: {integrity: sha512-MVNK56NiMrOwitFB7cqDwq0CQutbw+0BvLshJSse0MUNU+y1FC3bUS/AQg7oUng+/wKrrki7JfmwtVHkVfPLlw==}
+  es-module-lexer@1.7.0:
+    resolution: {integrity: sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==}
 
   esbuild@0.21.3:
     resolution: {integrity: sha512-Kgq0/ZsAPzKrbOjCQcjoSmPoWhlcVnGAUo7jvaLHoxW1Drto0KGkR1xBNg2Cp43b9ImvxmPEJZ9xkfcnqPsfBw==}
     engines: {node: '>=12'}
     hasBin: true
 
-  esbuild@0.25.9:
-    resolution: {integrity: sha512-CRbODhYyQx3qp7ZEwzxOk4JBqmD/seJrzPa/cGjY1VtIn5E09Oi9/dB4JwctnfZ8Q8iT7rioVv5k/FNT/uf54g==}
+  esbuild@0.28.1:
+    resolution: {integrity: sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==}
     engines: {node: '>=18'}
     hasBin: true
 
-  esbuild@0.28.1:
-    resolution: {integrity: sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==}
+  esbuild@0.28.2:
+    resolution: {integrity: sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA==}
     engines: {node: '>=18'}
     hasBin: true
 
@@ -1037,11 +1043,23 @@ packages:
     resolution: {integrity: sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==}
     engines: {node: '>=12.0.0'}
 
+  fdir@6.5.0:
+    resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
+    engines: {node: '>=12.0.0'}
+    peerDependencies:
+      picomatch: ^3 || ^4
+    peerDependenciesMeta:
+      picomatch:
+        optional: true
+
   fsevents@2.3.3:
     resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
     engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
     os: [darwin]
 
+  js-tokens@9.0.1:
+    resolution: {integrity: sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==}
+
   kleur@4.1.5:
     resolution: {integrity: sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==}
     engines: {node: '>=6'}
@@ -1049,28 +1067,24 @@ packages:
   loupe@3.2.1:
     resolution: {integrity: sha512-CdzqowRJCeLU72bHvWqwRBBlLcMEtIvGrlvef74kMnV2AolS9Y8xUv1I0U/MNAWMhBlKIoyuEgoJ0t/bbwHbLQ==}
 
-  magic-string@0.30.12:
-    resolution: {integrity: sha512-Ea8I3sQMVXr8JhN4z+H/d8zwo+tYDgHE9+5G4Wnrwhs0gaK9fXTKx0Tw5Xwsd/bCPTTZNRAdpyzvoeORe9LYpw==}
+  magic-string@0.30.17:
+    resolution: {integrity: sha512-sNPKHvyjVf7gyjwS4xGTaW/mCnF8wnjtifKBEhxfZ7E/S8tQ0rssrwGNn6q8JH/ohItJfSQp9mBtQYuTlH5QnA==}
 
-  miniflare@4.20260722.0:
-    resolution: {integrity: sha512-LW6ABMhCx/yIEFBLC/DO4yAhdm2T/G7jp7pr5T2kj895+CCIaHZqpMXdW9O6YE48LcYcCJChwWc8aEs1vpbTXw==}
+  miniflare@5.20260917.0-alpha:
+    resolution: {integrity: sha512-NpZyBR+h/nonVA/YO/+1/UJpIl8lTwCgpFPVp/KVzAhb8JuCRImPDfyrft040659Zna1RS3Lt2pzTs5Vwy5QSA==}
     engines: {node: '>=22.0.0'}
-    hasBin: true
 
   ms@2.1.3:
     resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
 
-  nanoid@3.3.18:
-    resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==}
+  nanoid@3.3.19:
+    resolution: {integrity: sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==}
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
   path-to-regexp@6.3.0:
     resolution: {integrity: sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==}
 
-  pathe@1.1.2:
-    resolution: {integrity: sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ==}
-
   pathe@2.0.3:
     resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==}
 
@@ -1081,12 +1095,16 @@ packages:
   picocolors@1.1.1:
     resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
 
+  picomatch@4.0.7:
+    resolution: {integrity: sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==}
+    engines: {node: '>=12'}
+
   postcss@8.5.28:
     resolution: {integrity: sha512-RRuzqDtt5Y9h3quz5hWhK+TPnsmVs6WwSU6LkJMeY4HstUEDuYTG8UJSdawMRzmzAtV+KEoG8N3Qg2qLy5vM/A==}
     engines: {node: ^10 || ^12 || >=14}
 
-  rollup@4.63.1:
-    resolution: {integrity: sha512-3Df9jsstwhccuEfmAMi9l8XUh/GOkVObmFTU7CCVBysEbcOZLl84jCtaAZMcPiMz2EGKsATzQcU+Xr3n/wU6cg==}
+  rollup@4.63.3:
+    resolution: {integrity: sha512-1i2XreiAoMMXuPGD6Msj2xWrMMkHojNRKivInxGQcg7/1KuPuYlfUutLyh4drnOxUTHX9cHI4wFoat8D/NKaBw==}
     engines: {node: '>=18.0.0', npm: '>=8.0.0'}
     hasBin: true
 
@@ -1095,9 +1113,14 @@ packages:
     engines: {node: '>=10'}
     hasBin: true
 
-  sharp@0.35.2:
-    resolution: {integrity: sha512-FVtFjtBCMiJS6yb5CX7Sop45WFMpeGw6oRKuJnXYgf/f1ms/D7LE/ZUSNxnW7rZ/dbslQWYkoqFHGPaDBtaK4w==}
+  sharp@0.35.4:
+    resolution: {integrity: sha512-n++8XWcj+jCOr2IOl7h8LbKnGBDY4aPbmprMONBNFdn0ImXqpGVv5zliDs0V9HbmbCQLpbuo2ej9rAoOQTvMDA==}
     engines: {node: '>=20.9.0'}
+    peerDependencies:
+      '@types/node': '*'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
 
   siginfo@2.0.0:
     resolution: {integrity: sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==}
@@ -1109,8 +1132,11 @@ packages:
   stackback@0.0.2:
     resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==}
 
-  std-env@3.8.0:
-    resolution: {integrity: sha512-Bc3YwwCB+OzldMxOXJIIvC6cPRWr/LxOp48CdQTOkPyk/t4JWWJbrilwBd7RJzKV8QW7tJkcgAmeuLLJugl5/w==}
+  std-env@3.9.0:
+    resolution: {integrity: sha512-UGvjygr6F6tpH7o2qyqR6QYpwraIjKSdtzyBdyytFOHmPZY917kwdwLG0RbOjWOnKmnm3PeHjaoLLMie7kPLQw==}
+
+  strip-literal@3.0.0:
+    resolution: {integrity: sha512-TcccoMhJOM3OebGhSBEmp3UZ2SfDMZUEBdRA/9ynfLi8yYajyWX3JiXArcJt4Umh4vISpspkQIY8ZZoCqjbviA==}
 
   supports-color@10.0.0:
     resolution: {integrity: sha512-HRVVSbCCMbj7/kdWF9Q+bbckjBHLtHMEoJWlkmYzzdwhYMkjkOwubLM6t7NbWKjgKamGDrWL1++KrjUO1t9oAQ==}
@@ -1119,19 +1145,23 @@ packages:
   tinybench@2.9.0:
     resolution: {integrity: sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==}
 
-  tinyexec@0.3.1:
-    resolution: {integrity: sha512-WiCJLEECkO18gwqIp6+hJg0//p23HXp4S+gGtAKu3mI2F2/sXC4FvHvXvB0zJVVaTPhx1/tOwdbRsa1sOBIKqQ==}
+  tinyexec@0.3.2:
+    resolution: {integrity: sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA==}
 
-  tinypool@1.0.1:
-    resolution: {integrity: sha512-URZYihUbRPcGv95En+sz6MfghfIc2OJ1sv/RmhWZLouPY0/8Vo80viwPvg3dlaS9fuq7fQMEfgRRK7BBZThBEA==}
+  tinyglobby@0.2.17:
+    resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
+    engines: {node: '>=12.0.0'}
+
+  tinypool@1.1.1:
+    resolution: {integrity: sha512-Zba82s87IFq9A9XmjiX5uZA/ARWDrB03OHlq+Vw1fSdt0I+4/Kutwy8BP4Y/y/aORMo61FQ0vIb5j44vSo5Pkg==}
     engines: {node: ^18.0.0 || >=20.0.0}
 
-  tinyrainbow@1.2.0:
-    resolution: {integrity: sha512-weEDEq7Z5eTHPDh4xjX789+fHfF+P8boiFB+0vbWzpbnbsEr/GRaohi/uMKxg8RZMXnl1ItAi/IUHWMsjDV7kQ==}
+  tinyrainbow@2.0.0:
+    resolution: {integrity: sha512-op4nsTR47R6p0vMUUoYl/a+ljLFVtlfaXkLQmqfLR1qHma1h/ysYk4hEXZ880bf2CYgTskvTa/e196Vd5dDQXw==}
     engines: {node: '>=14.0.0'}
 
-  tinyspy@3.0.2:
-    resolution: {integrity: sha512-n1cw8k1k0x4pgA2+9XrOkFydTerNcJ1zWCO5Nn9scWHTD+5tp8dghT2x1uduQePZTZgd3Tupf+x9BxJjeJi77Q==}
+  tinyspy@4.0.6:
+    resolution: {integrity: sha512-u8KszXvGfU68hVcZpRHKG28T0krMuv2G5nDhiHaMLen/gIuFEgIJhaJuO69qjnXg5paSrbPMFfx3brNuN8eVSg==}
     engines: {node: '>=14.0.0'}
 
   tslib@2.8.1:
@@ -1145,16 +1175,16 @@ packages:
   undici-types@6.21.0:
     resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
 
-  undici@7.28.0:
-    resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==}
+  undici@7.29.0:
+    resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==}
     engines: {node: '>=20.18.1'}
 
   unenv@2.0.0-rc.24:
     resolution: {integrity: sha512-i7qRCmY42zmCwnYlh9H2SvLEypEFGye5iRmEMKjcGi7zk9UquigRjFtTLz0TYqr0ZGLZhaMHl/foy1bZR+Cwlw==}
 
-  vite-node@2.1.9:
-    resolution: {integrity: sha512-AM9aQ/IPrW/6ENLQg3AGY4K1N2TGZdR5e4gu/MmmR2xR3Ll1+dib+nook92g4TV3PXVyeyxdWwtaCAiUL0hMxA==}
-    engines: {node: ^18.0.0 || >=20.0.0}
+  vite-node@3.2.4:
+    resolution: {integrity: sha512-EbKSKh+bh1E1IFxeO0pg1n4dvoOTt0UDiXMd/qn++r98+jPO1xtJilvXldeuQ8giIB5IkpjCgMleHMNEsGH6pg==}
+    engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
     hasBin: true
 
   vite@5.4.21:
@@ -1188,20 +1218,63 @@ packages:
       terser:
         optional: true
 
-  vitest@2.1.9:
-    resolution: {integrity: sha512-MSmPM9REYqDGBI8439mA4mWhV5sKmDlBKWIYbA3lRb2PTHACE0mgKwA8yQ2xq9vxDTuk4iPrECBAEW2aoFXY0Q==}
-    engines: {node: ^18.0.0 || >=20.0.0}
+  vite@7.3.6:
+    resolution: {integrity: sha512-4XP60spRGjSZFf1qYH+dJIkK2znL3zQfl9KkOV9MkkRR/3Dls0dxaBsQPTloEc5BLXWPL9vsOxopxyKoMmDueg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    hasBin: true
+    peerDependencies:
+      '@types/node': ^20.19.0 || >=22.12.0
+      jiti: '>=1.21.0'
+      less: ^4.0.0
+      lightningcss: ^1.21.0
+      sass: ^1.70.0
+      sass-embedded: ^1.70.0
+      stylus: '>=0.54.8'
+      sugarss: ^5.0.0
+      terser: ^5.16.0
+      tsx: ^4.8.1
+      yaml: ^2.4.2
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+      jiti:
+        optional: true
+      less:
+        optional: true
+      lightningcss:
+        optional: true
+      sass:
+        optional: true
+      sass-embedded:
+        optional: true
+      stylus:
+        optional: true
+      sugarss:
+        optional: true
+      terser:
+        optional: true
+      tsx:
+        optional: true
+      yaml:
+        optional: true
+
+  vitest@3.2.7:
+    resolution: {integrity: sha512-KrxIJ62Fd89gfysR4WotlgZABiz2dqFPgqGzX7s+CwsqLFomRH7777ZcrOD6+WVAh7khPQP41A+BKbpcJFrdEg==}
+    engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
     hasBin: true
     peerDependencies:
       '@edge-runtime/vm': '*'
-      '@types/node': ^18.0.0 || >=20.0.0
-      '@vitest/browser': 2.1.9
-      '@vitest/ui': 2.1.9
+      '@types/debug': ^4.1.12
+      '@types/node': ^18.0.0 || ^20.0.0 || >=22.0.0
+      '@vitest/browser': 3.2.7
+      '@vitest/ui': 3.2.7
       happy-dom: '*'
       jsdom: '*'
     peerDependenciesMeta:
       '@edge-runtime/vm':
         optional: true
+      '@types/debug':
+        optional: true
       '@types/node':
         optional: true
       '@vitest/browser':
@@ -1218,17 +1291,17 @@ packages:
     engines: {node: '>=8'}
     hasBin: true
 
-  workerd@1.20260722.1:
-    resolution: {integrity: sha512-NycKuc1x2onvsRfGGpM093vRlLFU2zHDAM0+APpccfg4+gZxDGCH27RmdDvkeBuoZyYqgLo3oAfF6re4mvC3vQ==}
+  workerd@1.20260917.1:
+    resolution: {integrity: sha512-k072RxsZfRz2cnyAq1Titt+0VpNfnFizSXUkT3r15CDJECBfBXj6JeKK0Bk5CrBLAHGP+dvOHjI//TP7GHXDEw==}
     engines: {node: '>=16'}
     hasBin: true
 
-  wrangler@4.114.0:
-    resolution: {integrity: sha512-M65P25t5UHA1TIJfgZXDcj+YzVobgKdRguM2QPz0xnxLFuOcuE3ErgllDht0iaho7MS4o0g/Bb4YK2+GT+bibg==}
+  wrangler@4.134.0:
+    resolution: {integrity: sha512-65JbYVGSt0XpPH8O/y6pNuS0t+AvvwVv+VRPbqYsNI5NMF9oFiJxVoS5GYU47ooamF9ucSXWvGyQ6QnAtXLgRA==}
     engines: {node: '>=22.0.0'}
     hasBin: true
     peerDependencies:
-      '@cloudflare/workers-types': ^5.20260722.1
+      '@cloudflare/workers-types': ^5.20260917.1
     peerDependenciesMeta:
       '@cloudflare/workers-types':
         optional: true
@@ -1255,28 +1328,28 @@ snapshots:
 
   '@cloudflare/kv-asset-handler@0.5.0': {}
 
-  '@cloudflare/unenv-preset@2.16.1(unenv@2.0.0-rc.24)(workerd@1.20260722.1)':
+  '@cloudflare/unenv-preset@2.16.1(unenv@2.0.0-rc.24)(workerd@1.20260917.1)':
     dependencies:
       unenv: 2.0.0-rc.24
     optionalDependencies:
-      workerd: 1.20260722.1
+      workerd: 1.20260917.1
 
-  '@cloudflare/workerd-darwin-64@1.20260722.1':
+  '@cloudflare/workerd-darwin-64@1.20260917.1':
     optional: true
 
-  '@cloudflare/workerd-darwin-arm64@1.20260722.1':
+  '@cloudflare/workerd-darwin-arm64@1.20260917.1':
     optional: true
 
-  '@cloudflare/workerd-linux-64@1.20260722.1':
+  '@cloudflare/workerd-linux-64@1.20260917.1':
     optional: true
 
-  '@cloudflare/workerd-linux-arm64@1.20260722.1':
+  '@cloudflare/workerd-linux-arm64@1.20260917.1':
     optional: true
 
-  '@cloudflare/workerd-windows-64@1.20260722.1':
+  '@cloudflare/workerd-windows-64@1.20260917.1':
     optional: true
 
-  '@cloudflare/workers-types@5.20260724.1': {}
+  '@cloudflare/workers-types@5.20260917.1': {}
 
   '@cspotcode/source-map-support@0.8.1':
     dependencies:
@@ -1290,332 +1363,332 @@ snapshots:
   '@esbuild/aix-ppc64@0.21.3':
     optional: true
 
-  '@esbuild/aix-ppc64@0.25.9':
+  '@esbuild/aix-ppc64@0.28.1':
     optional: true
 
-  '@esbuild/aix-ppc64@0.28.1':
+  '@esbuild/aix-ppc64@0.28.2':
     optional: true
 
   '@esbuild/android-arm64@0.21.3':
     optional: true
 
-  '@esbuild/android-arm64@0.25.9':
+  '@esbuild/android-arm64@0.28.1':
     optional: true
 
-  '@esbuild/android-arm64@0.28.1':
+  '@esbuild/android-arm64@0.28.2':
     optional: true
 
   '@esbuild/android-arm@0.21.3':
     optional: true
 
-  '@esbuild/android-arm@0.25.9':
+  '@esbuild/android-arm@0.28.1':
     optional: true
 
-  '@esbuild/android-arm@0.28.1':
+  '@esbuild/android-arm@0.28.2':
     optional: true
 
   '@esbuild/android-x64@0.21.3':
     optional: true
 
-  '@esbuild/android-x64@0.25.9':
+  '@esbuild/android-x64@0.28.1':
     optional: true
 
-  '@esbuild/android-x64@0.28.1':
+  '@esbuild/android-x64@0.28.2':
     optional: true
 
   '@esbuild/darwin-arm64@0.21.3':
     optional: true
 
-  '@esbuild/darwin-arm64@0.25.9':
+  '@esbuild/darwin-arm64@0.28.1':
     optional: true
 
-  '@esbuild/darwin-arm64@0.28.1':
+  '@esbuild/darwin-arm64@0.28.2':
     optional: true
 
   '@esbuild/darwin-x64@0.21.3':
     optional: true
 
-  '@esbuild/darwin-x64@0.25.9':
+  '@esbuild/darwin-x64@0.28.1':
     optional: true
 
-  '@esbuild/darwin-x64@0.28.1':
+  '@esbuild/darwin-x64@0.28.2':
     optional: true
 
   '@esbuild/freebsd-arm64@0.21.3':
     optional: true
 
-  '@esbuild/freebsd-arm64@0.25.9':
+  '@esbuild/freebsd-arm64@0.28.1':
     optional: true
 
-  '@esbuild/freebsd-arm64@0.28.1':
+  '@esbuild/freebsd-arm64@0.28.2':
     optional: true
 
   '@esbuild/freebsd-x64@0.21.3':
     optional: true
 
-  '@esbuild/freebsd-x64@0.25.9':
+  '@esbuild/freebsd-x64@0.28.1':
     optional: true
 
-  '@esbuild/freebsd-x64@0.28.1':
+  '@esbuild/freebsd-x64@0.28.2':
     optional: true
 
   '@esbuild/linux-arm64@0.21.3':
     optional: true
 
-  '@esbuild/linux-arm64@0.25.9':
+  '@esbuild/linux-arm64@0.28.1':
     optional: true
 
-  '@esbuild/linux-arm64@0.28.1':
+  '@esbuild/linux-arm64@0.28.2':
     optional: true
 
   '@esbuild/linux-arm@0.21.3':
     optional: true
 
-  '@esbuild/linux-arm@0.25.9':
+  '@esbuild/linux-arm@0.28.1':
     optional: true
 
-  '@esbuild/linux-arm@0.28.1':
+  '@esbuild/linux-arm@0.28.2':
     optional: true
 
   '@esbuild/linux-ia32@0.21.3':
     optional: true
 
-  '@esbuild/linux-ia32@0.25.9':
+  '@esbuild/linux-ia32@0.28.1':
     optional: true
 
-  '@esbuild/linux-ia32@0.28.1':
+  '@esbuild/linux-ia32@0.28.2':
     optional: true
 
   '@esbuild/linux-loong64@0.21.3':
     optional: true
 
-  '@esbuild/linux-loong64@0.25.9':
+  '@esbuild/linux-loong64@0.28.1':
     optional: true
 
-  '@esbuild/linux-loong64@0.28.1':
+  '@esbuild/linux-loong64@0.28.2':
     optional: true
 
   '@esbuild/linux-mips64el@0.21.3':
     optional: true
 
-  '@esbuild/linux-mips64el@0.25.9':
+  '@esbuild/linux-mips64el@0.28.1':
     optional: true
 
-  '@esbuild/linux-mips64el@0.28.1':
+  '@esbuild/linux-mips64el@0.28.2':
     optional: true
 
   '@esbuild/linux-ppc64@0.21.3':
     optional: true
 
-  '@esbuild/linux-ppc64@0.25.9':
+  '@esbuild/linux-ppc64@0.28.1':
     optional: true
 
-  '@esbuild/linux-ppc64@0.28.1':
+  '@esbuild/linux-ppc64@0.28.2':
     optional: true
 
   '@esbuild/linux-riscv64@0.21.3':
     optional: true
 
-  '@esbuild/linux-riscv64@0.25.9':
+  '@esbuild/linux-riscv64@0.28.1':
     optional: true
 
-  '@esbuild/linux-riscv64@0.28.1':
+  '@esbuild/linux-riscv64@0.28.2':
     optional: true
 
   '@esbuild/linux-s390x@0.21.3':
     optional: true
 
-  '@esbuild/linux-s390x@0.25.9':
+  '@esbuild/linux-s390x@0.28.1':
     optional: true
 
-  '@esbuild/linux-s390x@0.28.1':
+  '@esbuild/linux-s390x@0.28.2':
     optional: true
 
   '@esbuild/linux-x64@0.21.3':
     optional: true
 
-  '@esbuild/linux-x64@0.25.9':
-    optional: true
-
   '@esbuild/linux-x64@0.28.1':
     optional: true
 
-  '@esbuild/netbsd-arm64@0.25.9':
+  '@esbuild/linux-x64@0.28.2':
     optional: true
 
   '@esbuild/netbsd-arm64@0.28.1':
     optional: true
 
-  '@esbuild/netbsd-x64@0.21.3':
+  '@esbuild/netbsd-arm64@0.28.2':
     optional: true
 
-  '@esbuild/netbsd-x64@0.25.9':
+  '@esbuild/netbsd-x64@0.21.3':
     optional: true
 
   '@esbuild/netbsd-x64@0.28.1':
     optional: true
 
-  '@esbuild/openbsd-arm64@0.25.9':
+  '@esbuild/netbsd-x64@0.28.2':
     optional: true
 
   '@esbuild/openbsd-arm64@0.28.1':
     optional: true
 
-  '@esbuild/openbsd-x64@0.21.3':
+  '@esbuild/openbsd-arm64@0.28.2':
     optional: true
 
-  '@esbuild/openbsd-x64@0.25.9':
+  '@esbuild/openbsd-x64@0.21.3':
     optional: true
 
   '@esbuild/openbsd-x64@0.28.1':
     optional: true
 
-  '@esbuild/openharmony-arm64@0.25.9':
+  '@esbuild/openbsd-x64@0.28.2':
     optional: true
 
   '@esbuild/openharmony-arm64@0.28.1':
     optional: true
 
-  '@esbuild/sunos-x64@0.21.3':
+  '@esbuild/openharmony-arm64@0.28.2':
     optional: true
 
-  '@esbuild/sunos-x64@0.25.9':
+  '@esbuild/sunos-x64@0.21.3':
     optional: true
 
   '@esbuild/sunos-x64@0.28.1':
     optional: true
 
-  '@esbuild/win32-arm64@0.21.3':
+  '@esbuild/sunos-x64@0.28.2':
     optional: true
 
-  '@esbuild/win32-arm64@0.25.9':
+  '@esbuild/win32-arm64@0.21.3':
     optional: true
 
   '@esbuild/win32-arm64@0.28.1':
     optional: true
 
-  '@esbuild/win32-ia32@0.21.3':
+  '@esbuild/win32-arm64@0.28.2':
     optional: true
 
-  '@esbuild/win32-ia32@0.25.9':
+  '@esbuild/win32-ia32@0.21.3':
     optional: true
 
   '@esbuild/win32-ia32@0.28.1':
     optional: true
 
-  '@esbuild/win32-x64@0.21.3':
+  '@esbuild/win32-ia32@0.28.2':
     optional: true
 
-  '@esbuild/win32-x64@0.25.9':
+  '@esbuild/win32-x64@0.21.3':
     optional: true
 
   '@esbuild/win32-x64@0.28.1':
     optional: true
 
+  '@esbuild/win32-x64@0.28.2':
+    optional: true
+
   '@img/colour@1.1.0': {}
 
-  '@img/sharp-darwin-arm64@0.35.2':
+  '@img/sharp-darwin-arm64@0.35.4':
     optionalDependencies:
-      '@img/sharp-libvips-darwin-arm64': 1.3.1
+      '@img/sharp-libvips-darwin-arm64': 1.3.3
     optional: true
 
-  '@img/sharp-darwin-x64@0.35.2':
+  '@img/sharp-darwin-x64@0.35.4':
     optionalDependencies:
-      '@img/sharp-libvips-darwin-x64': 1.3.1
+      '@img/sharp-libvips-darwin-x64': 1.3.3
     optional: true
 
-  '@img/sharp-freebsd-wasm32@0.35.2':
+  '@img/sharp-freebsd-wasm32@0.35.4':
     dependencies:
-      '@img/sharp-wasm32': 0.35.2
+      '@img/sharp-wasm32': 0.35.4
     optional: true
 
-  '@img/sharp-libvips-darwin-arm64@1.3.1':
+  '@img/sharp-libvips-darwin-arm64@1.3.3':
     optional: true
 
-  '@img/sharp-libvips-darwin-x64@1.3.1':
+  '@img/sharp-libvips-darwin-x64@1.3.3':
     optional: true
 
-  '@img/sharp-libvips-linux-arm64@1.3.1':
+  '@img/sharp-libvips-linux-arm64@1.3.3':
     optional: true
 
-  '@img/sharp-libvips-linux-arm@1.3.1':
+  '@img/sharp-libvips-linux-arm@1.3.3':
     optional: true
 
-  '@img/sharp-libvips-linux-ppc64@1.3.1':
+  '@img/sharp-libvips-linux-ppc64@1.3.3':
     optional: true
 
-  '@img/sharp-libvips-linux-riscv64@1.3.1':
+  '@img/sharp-libvips-linux-riscv64@1.3.3':
     optional: true
 
-  '@img/sharp-libvips-linux-s390x@1.3.1':
+  '@img/sharp-libvips-linux-s390x@1.3.3':
     optional: true
 
-  '@img/sharp-libvips-linux-x64@1.3.1':
+  '@img/sharp-libvips-linux-x64@1.3.3':
     optional: true
 
-  '@img/sharp-libvips-linuxmusl-arm64@1.3.1':
+  '@img/sharp-libvips-linuxmusl-arm64@1.3.3':
     optional: true
 
-  '@img/sharp-libvips-linuxmusl-x64@1.3.1':
+  '@img/sharp-libvips-linuxmusl-x64@1.3.3':
     optional: true
 
-  '@img/sharp-linux-arm64@0.35.2':
+  '@img/sharp-linux-arm64@0.35.4':
     optionalDependencies:
-      '@img/sharp-libvips-linux-arm64': 1.3.1
+      '@img/sharp-libvips-linux-arm64': 1.3.3
     optional: true
 
-  '@img/sharp-linux-arm@0.35.2':
+  '@img/sharp-linux-arm@0.35.4':
     optionalDependencies:
-      '@img/sharp-libvips-linux-arm': 1.3.1
+      '@img/sharp-libvips-linux-arm': 1.3.3
     optional: true
 
-  '@img/sharp-linux-ppc64@0.35.2':
+  '@img/sharp-linux-ppc64@0.35.4':
     optionalDependencies:
-      '@img/sharp-libvips-linux-ppc64': 1.3.1
+      '@img/sharp-libvips-linux-ppc64': 1.3.3
     optional: true
 
-  '@img/sharp-linux-riscv64@0.35.2':
+  '@img/sharp-linux-riscv64@0.35.4':
     optionalDependencies:
-      '@img/sharp-libvips-linux-riscv64': 1.3.1
+      '@img/sharp-libvips-linux-riscv64': 1.3.3
     optional: true
 
-  '@img/sharp-linux-s390x@0.35.2':
+  '@img/sharp-linux-s390x@0.35.4':
     optionalDependencies:
-      '@img/sharp-libvips-linux-s390x': 1.3.1
+      '@img/sharp-libvips-linux-s390x': 1.3.3
     optional: true
 
-  '@img/sharp-linux-x64@0.35.2':
+  '@img/sharp-linux-x64@0.35.4':
     optionalDependencies:
-      '@img/sharp-libvips-linux-x64': 1.3.1
+      '@img/sharp-libvips-linux-x64': 1.3.3
     optional: true
 
-  '@img/sharp-linuxmusl-arm64@0.35.2':
+  '@img/sharp-linuxmusl-arm64@0.35.4':
     optionalDependencies:
-      '@img/sharp-libvips-linuxmusl-arm64': 1.3.1
+      '@img/sharp-libvips-linuxmusl-arm64': 1.3.3
     optional: true
 
-  '@img/sharp-linuxmusl-x64@0.35.2':
+  '@img/sharp-linuxmusl-x64@0.35.4':
     optionalDependencies:
-      '@img/sharp-libvips-linuxmusl-x64': 1.3.1
+      '@img/sharp-libvips-linuxmusl-x64': 1.3.3
     optional: true
 
-  '@img/sharp-wasm32@0.35.2':
+  '@img/sharp-wasm32@0.35.4':
     dependencies:
       '@emnapi/runtime': 1.11.3
     optional: true
 
-  '@img/sharp-webcontainers-wasm32@0.35.2':
+  '@img/sharp-webcontainers-wasm32@0.35.4':
     dependencies:
-      '@img/sharp-wasm32': 0.35.2
+      '@img/sharp-wasm32': 0.35.4
     optional: true
 
-  '@img/sharp-win32-arm64@0.35.2':
+  '@img/sharp-win32-arm64@0.35.4':
     optional: true
 
-  '@img/sharp-win32-ia32@0.35.2':
+  '@img/sharp-win32-ia32@0.35.4':
     optional: true
 
-  '@img/sharp-win32-x64@0.35.2':
+  '@img/sharp-win32-x64@0.35.4':
     optional: true
 
   '@jridgewell/resolve-uri@3.1.2': {}
@@ -1642,130 +1715,139 @@ snapshots:
 
   '@poppinss/exception@1.2.3': {}
 
-  '@rollup/rollup-android-arm-eabi@4.63.1':
+  '@rollup/rollup-android-arm-eabi@4.63.3':
     optional: true
 
-  '@rollup/rollup-android-arm64@4.63.1':
+  '@rollup/rollup-android-arm64@4.63.3':
     optional: true
 
-  '@rollup/rollup-darwin-arm64@4.63.1':
+  '@rollup/rollup-darwin-arm64@4.63.3':
     optional: true
 
-  '@rollup/rollup-darwin-x64@4.63.1':
+  '@rollup/rollup-darwin-x64@4.63.3':
     optional: true
 
-  '@rollup/rollup-freebsd-arm64@4.63.1':
+  '@rollup/rollup-freebsd-arm64@4.63.3':
     optional: true
 
-  '@rollup/rollup-freebsd-x64@4.63.1':
+  '@rollup/rollup-freebsd-x64@4.63.3':
     optional: true
 
-  '@rollup/rollup-linux-arm-gnueabihf@4.63.1':
+  '@rollup/rollup-linux-arm-gnueabihf@4.63.3':
     optional: true
 
-  '@rollup/rollup-linux-arm-musleabihf@4.63.1':
+  '@rollup/rollup-linux-arm-musleabihf@4.63.3':
     optional: true
 
-  '@rollup/rollup-linux-arm64-gnu@4.63.1':
+  '@rollup/rollup-linux-arm64-gnu@4.63.3':
     optional: true
 
-  '@rollup/rollup-linux-arm64-musl@4.63.1':
+  '@rollup/rollup-linux-arm64-musl@4.63.3':
     optional: true
 
-  '@rollup/rollup-linux-loong64-gnu@4.63.1':
+  '@rollup/rollup-linux-loong64-gnu@4.63.3':
     optional: true
 
-  '@rollup/rollup-linux-loong64-musl@4.63.1':
+  '@rollup/rollup-linux-loong64-musl@4.63.3':
     optional: true
 
-  '@rollup/rollup-linux-ppc64-gnu@4.63.1':
+  '@rollup/rollup-linux-ppc64-gnu@4.63.3':
     optional: true
 
-  '@rollup/rollup-linux-ppc64-musl@4.63.1':
+  '@rollup/rollup-linux-ppc64-musl@4.63.3':
     optional: true
 
-  '@rollup/rollup-linux-riscv64-gnu@4.63.1':
+  '@rollup/rollup-linux-riscv64-gnu@4.63.3':
     optional: true
 
-  '@rollup/rollup-linux-riscv64-musl@4.63.1':
+  '@rollup/rollup-linux-riscv64-musl@4.63.3':
     optional: true
 
-  '@rollup/rollup-linux-s390x-gnu@4.63.1':
+  '@rollup/rollup-linux-s390x-gnu@4.63.3':
     optional: true
 
-  '@rollup/rollup-linux-x64-gnu@4.63.1':
+  '@rollup/rollup-linux-x64-gnu@4.63.3':
     optional: true
 
-  '@rollup/rollup-linux-x64-musl@4.63.1':
+  '@rollup/rollup-linux-x64-musl@4.63.3':
     optional: true
 
-  '@rollup/rollup-openbsd-x64@4.63.1':
+  '@rollup/rollup-openbsd-x64@4.63.3':
     optional: true
 
-  '@rollup/rollup-openharmony-arm64@4.63.1':
+  '@rollup/rollup-openharmony-arm64@4.63.3':
     optional: true
 
-  '@rollup/rollup-win32-arm64-msvc@4.63.1':
+  '@rollup/rollup-win32-arm64-msvc@4.63.3':
     optional: true
 
-  '@rollup/rollup-win32-ia32-msvc@4.63.1':
+  '@rollup/rollup-win32-ia32-msvc@4.63.3':
     optional: true
 
-  '@rollup/rollup-win32-x64-gnu@4.63.1':
+  '@rollup/rollup-win32-x64-gnu@4.63.3':
     optional: true
 
-  '@rollup/rollup-win32-x64-msvc@4.63.1':
+  '@rollup/rollup-win32-x64-msvc@4.63.3':
     optional: true
 
   '@sindresorhus/is@7.2.0': {}
 
   '@speed-highlight/core@1.2.24': {}
 
+  '@types/chai@5.2.3':
+    dependencies:
+      '@types/deep-eql': 4.0.2
+      assertion-error: 2.0.1
+
+  '@types/deep-eql@4.0.2': {}
+
   '@types/estree@1.0.9': {}
 
   '@types/node@22.18.1':
     dependencies:
       undici-types: 6.21.0
 
-  '@vitest/expect@2.1.9':
+  '@vitest/expect@3.2.7':
     dependencies:
-      '@vitest/spy': 2.1.9
-      '@vitest/utils': 2.1.9
-      chai: 5.1.2
-      tinyrainbow: 1.2.0
+      '@types/chai': 5.2.3
+      '@vitest/spy': 3.2.7
+      '@vitest/utils': 3.2.7
+      chai: 5.2.0
+      tinyrainbow: 2.0.0
 
-  '@vitest/mocker@2.1.9(vite@5.4.21(@types/node@22.18.1))':
+  '@vitest/mocker@3.2.7(vite@7.3.6(@types/node@22.18.1))':
     dependencies:
-      '@vitest/spy': 2.1.9
+      '@vitest/spy': 3.2.7
       estree-walker: 3.0.3
-      magic-string: 0.30.12
+      magic-string: 0.30.17
     optionalDependencies:
-      vite: 5.4.21(@types/node@22.18.1)
+      vite: 7.3.6(@types/node@22.18.1)
 
-  '@vitest/pretty-format@2.1.9':
+  '@vitest/pretty-format@3.2.7':
     dependencies:
-      tinyrainbow: 1.2.0
+      tinyrainbow: 2.0.0
 
-  '@vitest/runner@2.1.9':
+  '@vitest/runner@3.2.7':
     dependencies:
-      '@vitest/utils': 2.1.9
-      pathe: 1.1.2
+      '@vitest/utils': 3.2.7
+      pathe: 2.0.3
+      strip-literal: 3.0.0
 
-  '@vitest/snapshot@2.1.9':
+  '@vitest/snapshot@3.2.7':
     dependencies:
-      '@vitest/pretty-format': 2.1.9
-      magic-string: 0.30.12
-      pathe: 1.1.2
+      '@vitest/pretty-format': 3.2.7
+      magic-string: 0.30.17
+      pathe: 2.0.3
 
-  '@vitest/spy@2.1.9':
+  '@vitest/spy@3.2.7':
     dependencies:
-      tinyspy: 3.0.2
+      tinyspy: 4.0.6
 
-  '@vitest/utils@2.1.9':
+  '@vitest/utils@3.2.7':
     dependencies:
-      '@vitest/pretty-format': 2.1.9
+      '@vitest/pretty-format': 3.2.7
       loupe: 3.2.1
-      tinyrainbow: 1.2.0
+      tinyrainbow: 2.0.0
 
   assertion-error@2.0.1: {}
 
@@ -1775,7 +1857,7 @@ snapshots:
 
   cac@6.7.14: {}
 
-  chai@5.1.2:
+  chai@5.2.0:
     dependencies:
       assertion-error: 2.0.1
       check-error: 2.1.3
@@ -1797,7 +1879,7 @@ snapshots:
 
   error-stack-parser-es@1.0.5: {}
 
-  es-module-lexer@1.5.4: {}
+  es-module-lexer@1.7.0: {}
 
   esbuild@0.21.3:
     optionalDependencies:
@@ -1825,35 +1907,6 @@ snapshots:
       '@esbuild/win32-ia32': 0.21.3
       '@esbuild/win32-x64': 0.21.3
 
-  esbuild@0.25.9:
-    optionalDependencies:
-      '@esbuild/aix-ppc64': 0.25.9
-      '@esbuild/android-arm': 0.25.9
-      '@esbuild/android-arm64': 0.25.9
-      '@esbuild/android-x64': 0.25.9
-      '@esbuild/darwin-arm64': 0.25.9
-      '@esbuild/darwin-x64': 0.25.9
-      '@esbuild/freebsd-arm64': 0.25.9
-      '@esbuild/freebsd-x64': 0.25.9
-      '@esbuild/linux-arm': 0.25.9
-      '@esbuild/linux-arm64': 0.25.9
-      '@esbuild/linux-ia32': 0.25.9
-      '@esbuild/linux-loong64': 0.25.9
-      '@esbuild/linux-mips64el': 0.25.9
-      '@esbuild/linux-ppc64': 0.25.9
-      '@esbuild/linux-riscv64': 0.25.9
-      '@esbuild/linux-s390x': 0.25.9
-      '@esbuild/linux-x64': 0.25.9
-      '@esbuild/netbsd-arm64': 0.25.9
-      '@esbuild/netbsd-x64': 0.25.9
-      '@esbuild/openbsd-arm64': 0.25.9
-      '@esbuild/openbsd-x64': 0.25.9
-      '@esbuild/openharmony-arm64': 0.25.9
-      '@esbuild/sunos-x64': 0.25.9
-      '@esbuild/win32-arm64': 0.25.9
-      '@esbuild/win32-ia32': 0.25.9
-      '@esbuild/win32-x64': 0.25.9
-
   esbuild@0.28.1:
     optionalDependencies:
       '@esbuild/aix-ppc64': 0.28.1
@@ -1883,120 +1936,157 @@ snapshots:
       '@esbuild/win32-ia32': 0.28.1
       '@esbuild/win32-x64': 0.28.1
 
+  esbuild@0.28.2:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.28.2
+      '@esbuild/android-arm': 0.28.2
+      '@esbuild/android-arm64': 0.28.2
+      '@esbuild/android-x64': 0.28.2
+      '@esbuild/darwin-arm64': 0.28.2
+      '@esbuild/darwin-x64': 0.28.2
+      '@esbuild/freebsd-arm64': 0.28.2
+      '@esbuild/freebsd-x64': 0.28.2
+      '@esbuild/linux-arm': 0.28.2
+      '@esbuild/linux-arm64': 0.28.2
+      '@esbuild/linux-ia32': 0.28.2
+      '@esbuild/linux-loong64': 0.28.2
+      '@esbuild/linux-mips64el': 0.28.2
+      '@esbuild/linux-ppc64': 0.28.2
+      '@esbuild/linux-riscv64': 0.28.2
+      '@esbuild/linux-s390x': 0.28.2
+      '@esbuild/linux-x64': 0.28.2
+      '@esbuild/netbsd-arm64': 0.28.2
+      '@esbuild/netbsd-x64': 0.28.2
+      '@esbuild/openbsd-arm64': 0.28.2
+      '@esbuild/openbsd-x64': 0.28.2
+      '@esbuild/openharmony-arm64': 0.28.2
+      '@esbuild/sunos-x64': 0.28.2
+      '@esbuild/win32-arm64': 0.28.2
+      '@esbuild/win32-ia32': 0.28.2
+      '@esbuild/win32-x64': 0.28.2
+
   estree-walker@3.0.3:
     dependencies:
       '@types/estree': 1.0.9
 
   expect-type@1.4.0: {}
 
+  fdir@6.5.0(picomatch@4.0.7):
+    optionalDependencies:
+      picomatch: 4.0.7
+
   fsevents@2.3.3:
     optional: true
 
+  js-tokens@9.0.1: {}
+
   kleur@4.1.5: {}
 
   loupe@3.2.1: {}
 
-  magic-string@0.30.12:
+  magic-string@0.30.17:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.6.0
 
-  miniflare@4.20260722.0:
+  miniflare@5.20260917.0-alpha(@types/node@22.18.1):
     dependencies:
       '@cspotcode/source-map-support': 0.8.1
-      sharp: 0.35.2
-      undici: 7.28.0
-      workerd: 1.20260722.1
+      sharp: 0.35.4(@types/node@22.18.1)
+      undici: 7.29.0
+      workerd: 1.20260917.1
       ws: 8.21.0
       youch: 4.1.0-beta.10
     transitivePeerDependencies:
+      - '@types/node'
       - bufferutil
       - utf-8-validate
 
   ms@2.1.3: {}
 
-  nanoid@3.3.18: {}
+  nanoid@3.3.19: {}
 
   path-to-regexp@6.3.0: {}
 
-  pathe@1.1.2: {}
-
   pathe@2.0.3: {}
 
   pathval@2.0.1: {}
 
   picocolors@1.1.1: {}
 
+  picomatch@4.0.7: {}
+
   postcss@8.5.28:
     dependencies:
-      nanoid: 3.3.18
+      nanoid: 3.3.19
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
-  rollup@4.63.1:
+  rollup@4.63.3:
     dependencies:
       '@types/estree': 1.0.9
     optionalDependencies:
       '@napi-rs/lzma-linux-x64-gnu': 1.5.1
-      '@rollup/rollup-android-arm-eabi': 4.63.1
-      '@rollup/rollup-android-arm64': 4.63.1
-      '@rollup/rollup-darwin-arm64': 4.63.1
-      '@rollup/rollup-darwin-x64': 4.63.1
-      '@rollup/rollup-freebsd-arm64': 4.63.1
-      '@rollup/rollup-freebsd-x64': 4.63.1
-      '@rollup/rollup-linux-arm-gnueabihf': 4.63.1
-      '@rollup/rollup-linux-arm-musleabihf': 4.63.1
-      '@rollup/rollup-linux-arm64-gnu': 4.63.1
-      '@rollup/rollup-linux-arm64-musl': 4.63.1
-      '@rollup/rollup-linux-loong64-gnu': 4.63.1
-      '@rollup/rollup-linux-loong64-musl': 4.63.1
-      '@rollup/rollup-linux-ppc64-gnu': 4.63.1
-      '@rollup/rollup-linux-ppc64-musl': 4.63.1
-      '@rollup/rollup-linux-riscv64-gnu': 4.63.1
-      '@rollup/rollup-linux-riscv64-musl': 4.63.1
-      '@rollup/rollup-linux-s390x-gnu': 4.63.1
-      '@rollup/rollup-linux-x64-gnu': 4.63.1
-      '@rollup/rollup-linux-x64-musl': 4.63.1
-      '@rollup/rollup-openbsd-x64': 4.63.1
-      '@rollup/rollup-openharmony-arm64': 4.63.1
-      '@rollup/rollup-win32-arm64-msvc': 4.63.1
-      '@rollup/rollup-win32-ia32-msvc': 4.63.1
-      '@rollup/rollup-win32-x64-gnu': 4.63.1
-      '@rollup/rollup-win32-x64-msvc': 4.63.1
+      '@rollup/rollup-android-arm-eabi': 4.63.3
+      '@rollup/rollup-android-arm64': 4.63.3
+      '@rollup/rollup-darwin-arm64': 4.63.3
+      '@rollup/rollup-darwin-x64': 4.63.3
+      '@rollup/rollup-freebsd-arm64': 4.63.3
+      '@rollup/rollup-freebsd-x64': 4.63.3
+      '@rollup/rollup-linux-arm-gnueabihf': 4.63.3
+      '@rollup/rollup-linux-arm-musleabihf': 4.63.3
+      '@rollup/rollup-linux-arm64-gnu': 4.63.3
+      '@rollup/rollup-linux-arm64-musl': 4.63.3
+      '@rollup/rollup-linux-loong64-gnu': 4.63.3
+      '@rollup/rollup-linux-loong64-musl': 4.63.3
+      '@rollup/rollup-linux-ppc64-gnu': 4.63.3
+      '@rollup/rollup-linux-ppc64-musl': 4.63.3
+      '@rollup/rollup-linux-riscv64-gnu': 4.63.3
+      '@rollup/rollup-linux-riscv64-musl': 4.63.3
+      '@rollup/rollup-linux-s390x-gnu': 4.63.3
+      '@rollup/rollup-linux-x64-gnu': 4.63.3
+      '@rollup/rollup-linux-x64-musl': 4.63.3
+      '@rollup/rollup-openbsd-x64': 4.63.3
+      '@rollup/rollup-openharmony-arm64': 4.63.3
+      '@rollup/rollup-win32-arm64-msvc': 4.63.3
+      '@rollup/rollup-win32-ia32-msvc': 4.63.3
+      '@rollup/rollup-win32-x64-gnu': 4.63.3
+      '@rollup/rollup-win32-x64-msvc': 4.63.3
       fsevents: 2.3.3
 
   semver@7.8.5: {}
 
-  sharp@0.35.2:
+  sharp@0.35.4(@types/node@22.18.1):
     dependencies:
       '@img/colour': 1.1.0
       detect-libc: 2.1.2
       semver: 7.8.5
     optionalDependencies:
-      '@img/sharp-darwin-arm64': 0.35.2
-      '@img/sharp-darwin-x64': 0.35.2
-      '@img/sharp-freebsd-wasm32': 0.35.2
-      '@img/sharp-libvips-darwin-arm64': 1.3.1
-      '@img/sharp-libvips-darwin-x64': 1.3.1
-      '@img/sharp-libvips-linux-arm': 1.3.1
-      '@img/sharp-libvips-linux-arm64': 1.3.1
-      '@img/sharp-libvips-linux-ppc64': 1.3.1
-      '@img/sharp-libvips-linux-riscv64': 1.3.1
-      '@img/sharp-libvips-linux-s390x': 1.3.1
-      '@img/sharp-libvips-linux-x64': 1.3.1
-      '@img/sharp-libvips-linuxmusl-arm64': 1.3.1
-      '@img/sharp-libvips-linuxmusl-x64': 1.3.1
-      '@img/sharp-linux-arm': 0.35.2
-      '@img/sharp-linux-arm64': 0.35.2
-      '@img/sharp-linux-ppc64': 0.35.2
-      '@img/sharp-linux-riscv64': 0.35.2
-      '@img/sharp-linux-s390x': 0.35.2
-      '@img/sharp-linux-x64': 0.35.2
-      '@img/sharp-linuxmusl-arm64': 0.35.2
-      '@img/sharp-linuxmusl-x64': 0.35.2
-      '@img/sharp-webcontainers-wasm32': 0.35.2
-      '@img/sharp-win32-arm64': 0.35.2
-      '@img/sharp-win32-ia32': 0.35.2
-      '@img/sharp-win32-x64': 0.35.2
+      '@img/sharp-darwin-arm64': 0.35.4
+      '@img/sharp-darwin-x64': 0.35.4
+      '@img/sharp-freebsd-wasm32': 0.35.4
+      '@img/sharp-libvips-darwin-arm64': 1.3.3
+      '@img/sharp-libvips-darwin-x64': 1.3.3
+      '@img/sharp-libvips-linux-arm': 1.3.3
+      '@img/sharp-libvips-linux-arm64': 1.3.3
+      '@img/sharp-libvips-linux-ppc64': 1.3.3
+      '@img/sharp-libvips-linux-riscv64': 1.3.3
+      '@img/sharp-libvips-linux-s390x': 1.3.3
+      '@img/sharp-libvips-linux-x64': 1.3.3
+      '@img/sharp-libvips-linuxmusl-arm64': 1.3.3
+      '@img/sharp-libvips-linuxmusl-x64': 1.3.3
+      '@img/sharp-linux-arm': 0.35.4
+      '@img/sharp-linux-arm64': 0.35.4
+      '@img/sharp-linux-ppc64': 0.35.4
+      '@img/sharp-linux-riscv64': 0.35.4
+      '@img/sharp-linux-s390x': 0.35.4
+      '@img/sharp-linux-x64': 0.35.4
+      '@img/sharp-linuxmusl-arm64': 0.35.4
+      '@img/sharp-linuxmusl-x64': 0.35.4
+      '@img/sharp-webcontainers-wasm32': 0.35.4
+      '@img/sharp-win32-arm64': 0.35.4
+      '@img/sharp-win32-ia32': 0.35.4
+      '@img/sharp-win32-x64': 0.35.4
+      '@types/node': 22.18.1
 
   siginfo@2.0.0: {}
 
@@ -2004,19 +2094,28 @@ snapshots:
 
   stackback@0.0.2: {}
 
-  std-env@3.8.0: {}
+  std-env@3.9.0: {}
+
+  strip-literal@3.0.0:
+    dependencies:
+      js-tokens: 9.0.1
 
   supports-color@10.0.0: {}
 
   tinybench@2.9.0: {}
 
-  tinyexec@0.3.1: {}
+  tinyexec@0.3.2: {}
 
-  tinypool@1.0.1: {}
+  tinyglobby@0.2.17:
+    dependencies:
+      fdir: 6.5.0(picomatch@4.0.7)
+      picomatch: 4.0.7
 
-  tinyrainbow@1.2.0: {}
+  tinypool@1.1.1: {}
 
-  tinyspy@3.0.2: {}
+  tinyrainbow@2.0.0: {}
+
+  tinyspy@4.0.6: {}
 
   tslib@2.8.1:
     optional: true
@@ -2025,21 +2124,22 @@ snapshots:
 
   undici-types@6.21.0: {}
 
-  undici@7.28.0: {}
+  undici@7.29.0: {}
 
   unenv@2.0.0-rc.24:
     dependencies:
       pathe: 2.0.3
 
-  vite-node@2.1.9(@types/node@22.18.1):
+  vite-node@3.2.4(@types/node@22.18.1):
     dependencies:
       cac: 6.7.14
       debug: 4.4.3
-      es-module-lexer: 1.5.4
-      pathe: 1.1.2
-      vite: 5.4.21(@types/node@22.18.1)
+      es-module-lexer: 1.7.0
+      pathe: 2.0.3
+      vite: 7.3.6(@types/node@22.18.1)
     transitivePeerDependencies:
       - '@types/node'
+      - jiti
       - less
       - lightningcss
       - sass
@@ -2048,41 +2148,59 @@ snapshots:
       - sugarss
       - supports-color
       - terser
+      - tsx
+      - yaml
 
   vite@5.4.21(@types/node@22.18.1):
     dependencies:
       esbuild: 0.21.3
       postcss: 8.5.28
-      rollup: 4.63.1
+      rollup: 4.63.3
     optionalDependencies:
       '@types/node': 22.18.1
       fsevents: 2.3.3
 
-  vitest@2.1.9(@types/node@22.18.1):
+  vite@7.3.6(@types/node@22.18.1):
     dependencies:
-      '@vitest/expect': 2.1.9
-      '@vitest/mocker': 2.1.9(vite@5.4.21(@types/node@22.18.1))
-      '@vitest/pretty-format': 2.1.9
-      '@vitest/runner': 2.1.9
-      '@vitest/snapshot': 2.1.9
-      '@vitest/spy': 2.1.9
-      '@vitest/utils': 2.1.9
-      chai: 5.1.2
+      esbuild: 0.28.2
+      fdir: 6.5.0(picomatch@4.0.7)
+      picomatch: 4.0.7
+      postcss: 8.5.28
+      rollup: 4.63.3
+      tinyglobby: 0.2.17
+    optionalDependencies:
+      '@types/node': 22.18.1
+      fsevents: 2.3.3
+
+  vitest@3.2.7(@types/node@22.18.1):
+    dependencies:
+      '@types/chai': 5.2.3
+      '@vitest/expect': 3.2.7
+      '@vitest/mocker': 3.2.7(vite@7.3.6(@types/node@22.18.1))
+      '@vitest/pretty-format': 3.2.7
+      '@vitest/runner': 3.2.7
+      '@vitest/snapshot': 3.2.7
+      '@vitest/spy': 3.2.7
+      '@vitest/utils': 3.2.7
+      chai: 5.2.0
       debug: 4.4.3
       expect-type: 1.4.0
-      magic-string: 0.30.12
-      pathe: 1.1.2
-      std-env: 3.8.0
+      magic-string: 0.30.17
+      pathe: 2.0.3
+      picomatch: 4.0.7
+      std-env: 3.9.0
       tinybench: 2.9.0
-      tinyexec: 0.3.1
-      tinypool: 1.0.1
-      tinyrainbow: 1.2.0
-      vite: 5.4.21(@types/node@22.18.1)
-      vite-node: 2.1.9(@types/node@22.18.1)
+      tinyexec: 0.3.2
+      tinyglobby: 0.2.17
+      tinypool: 1.1.1
+      tinyrainbow: 2.0.0
+      vite: 7.3.6(@types/node@22.18.1)
+      vite-node: 3.2.4(@types/node@22.18.1)
       why-is-node-running: 2.3.0
     optionalDependencies:
       '@types/node': 22.18.1
     transitivePeerDependencies:
+      - jiti
       - less
       - lightningcss
       - msw
@@ -2092,34 +2210,37 @@ snapshots:
       - sugarss
       - supports-color
       - terser
+      - tsx
+      - yaml
 
   why-is-node-running@2.3.0:
     dependencies:
       siginfo: 2.0.0
       stackback: 0.0.2
 
-  workerd@1.20260722.1:
+  workerd@1.20260917.1:
     optionalDependencies:
-      '@cloudflare/workerd-darwin-64': 1.20260722.1
-      '@cloudflare/workerd-darwin-arm64': 1.20260722.1
-      '@cloudflare/workerd-linux-64': 1.20260722.1
-      '@cloudflare/workerd-linux-arm64': 1.20260722.1
-      '@cloudflare/workerd-windows-64': 1.20260722.1
+      '@cloudflare/workerd-darwin-64': 1.20260917.1
+      '@cloudflare/workerd-darwin-arm64': 1.20260917.1
+      '@cloudflare/workerd-linux-64': 1.20260917.1
+      '@cloudflare/workerd-linux-arm64': 1.20260917.1
+      '@cloudflare/workerd-windows-64': 1.20260917.1
 
-  wrangler@4.114.0(@cloudflare/workers-types@5.20260724.1):
+  wrangler@4.134.0(@cloudflare/workers-types@5.20260917.1)(@types/node@22.18.1):
     dependencies:
       '@cloudflare/kv-asset-handler': 0.5.0
-      '@cloudflare/unenv-preset': 2.16.1(unenv@2.0.0-rc.24)(workerd@1.20260722.1)
+      '@cloudflare/unenv-preset': 2.16.1(unenv@2.0.0-rc.24)(workerd@1.20260917.1)
       blake3-wasm: 2.1.5
       esbuild: 0.28.1
-      miniflare: 4.20260722.0
+      miniflare: 5.20260917.0-alpha(@types/node@22.18.1)
       path-to-regexp: 6.3.0
       unenv: 2.0.0-rc.24
-      workerd: 1.20260722.1
+      workerd: 1.20260917.1
     optionalDependencies:
-      '@cloudflare/workers-types': 5.20260724.1
+      '@cloudflare/workers-types': 5.20260917.1
       fsevents: 2.3.3
     transitivePeerDependencies:
+      - '@types/node'
       - bufferutil
       - utf-8-validate
 
diff --git a/easytier-js/pnpm-workspace.yaml b/easytier-js/pnpm-workspace.yaml
index d9741d3a..98b98f83 100644
--- a/easytier-js/pnpm-workspace.yaml
+++ b/easytier-js/pnpm-workspace.yaml
@@ -12,4 +12,5 @@ allowBuilds:
   workerd: true
 
 minimumReleaseAgeExclude:
-  - '@cloudflare/workers-types@5.20260724.1'
+  - miniflare@5.20260917.0-alpha
+  - wrangler@4.134.0
diff --git a/easytier-js/runtime/package.json b/easytier-js/runtime/package.json
index 1feb5ea3..5ffc37f2 100644
--- a/easytier-js/runtime/package.json
+++ b/easytier-js/runtime/package.json
@@ -36,7 +36,7 @@
     "@types/node": "22.18.1",
     "binaryen": "131.0.0",
     "typescript": "5.9.3",
-    "vitest": "2.1.9"
+    "vitest": "3.2.7"
   },
   "publishConfig": {
     "access": "public"
diff --git a/easytier-js/runtime/src/websocket-host.ts b/easytier-js/runtime/src/websocket-host.ts
index b6474d40..586c3d6e 100644
--- a/easytier-js/runtime/src/websocket-host.ts
+++ b/easytier-js/runtime/src/websocket-host.ts
@@ -800,7 +800,7 @@ export class WebSocketHost {
     } catch {
       return HOST_INVALID;
     }
-    if (options.byteLength < 48 || options[0] !== 2) {
+    if (options.byteLength < 49 || options[0] !== 3) {
       return HOST_INVALID;
     }
     const netnsLength = new DataView(
diff --git a/easytier-js/runtime/test/websocket-host.test.ts b/easytier-js/runtime/test/websocket-host.test.ts
index 799485b0..423b7388 100644
--- a/easytier-js/runtime/test/websocket-host.test.ts
+++ b/easytier-js/runtime/test/websocket-host.test.ts
@@ -74,13 +74,14 @@ function encodeTcpPortLease(
   port: number,
   purpose = 6,
 ): number {
-  const options = new Uint8Array(memory.buffer, pointer, 48);
+  const options = new Uint8Array(memory.buffer, pointer, 49);
   options.fill(0);
-  options[0] = 2;
+  options[0] = 3;
   options[1] = 4;
   const view = new DataView(memory.buffer, pointer, options.byteLength);
   view.setUint16(18, port, false);
   options[42] = purpose;
+  // options[43] is need_protect, left at 0; the browser host is not a VPN.
   return options.byteLength;
 }