fix(wasi): reduce startup RSS, align ABI v4 and wire v3 (#2588)

* feat(easytier-go): accept data plane ABI v4

The core raised DATA_PLANE_ABI_VERSION to 4 in f26c2aa1 ("feat(wasi):
run EasyTier core on Cloudflare Workers and browsers") to advertise the
new guest exports easytier_data_plane_tcp_shutdown_write_submit and
easytier_data_plane_tcp_shutdown_write_result_take, which let a host
half-close guest TCP streams.

The Go host has no caller for half-close: net.Conn exposes only Close,
which already tears down both directions, so the v3 behavior is
preserved and no new plumbing is added. Without this bump, any artifact
rebuilt from current core source is rejected at instance creation with
"unsupported EasyTier data plane ABI version 4, want 3".

* fix(easytier-go): decode socket options wire v3, rebuild core artifact

38e2a621 ("refactor(ohos): 拆分 OHRS 包并按 socket 精细保护 VPN 流量")
raised the host socket options wire format from version 2 to 3: a
need_protect byte is appended after the purpose byte in TCP connect,
UDP bind, and TCP listen options, shifting bind_device one byte later.
The Go hostABI decoders were never updated, so every socket operation
from a HEAD-built core was rejected as "invalid options" and required
listeners failed to start.

Bump the accepted wire version to 3 and skip the need_protect byte in
all three decoders. The byte requests VPN socket protection, which only
Android-style VPN hosts can honor; on every other platform sockets are
already protected, so reading and discarding it is correct.

Regenerate the embedded core artifact and protobuf bindings from HEAD
(599e4eac) so the shipped artifact matches the Go host again. The proto
regeneration also picks up schema fields added since the last embed
(e.g. prefer_peer_relay).

* perf(easytier-go): release compiler garbage after host init

wazero's optimizing compiler allocates ~100MB of throwaway state on
the Go heap while compiling the embedded core. Go's runtime does not
return that memory to the OS after the initiating GC, so the process
retained the compilation peak for its entire lifetime: RSS sat at
~164MB before any instance or network activity.

Call debug.FreeOSMemory() once after the module is instantiated.
NewHost is a one-time initialization path outside the dataplane, so
the stop-the-world pass is safe here. Measured RSS after host.New
drops from ~164MB to ~64MB; no behavioral change.

* chore(easytier-js): bump toolchain dependencies

- vitest 2.1.9 -> 3.2.7 (all three packages)
- esbuild 0.25.9 -> 0.28.2 (browser bundler)
- wrangler 4.114.0 -> 4.134.0 (cloudflare + web example)
- @cloudflare/workers-types 5.20260724.1 -> 5.20260917.1
- binaryen 131.0.0 -> 132.0.0 (JS bindings only; the wasm build
  uses the standalone wasm-opt binary fetched by the build script)

Not bumped: typescript stays at 5.9.3 (latest 5.x; 7.0 is a major
jump not worth taking for this workspace), vite stays at 5.4.21
(web-example only; 5->8 spans three majors).

Verified with pnpm test (28 + 2 + 2 tests across runtime, browser,
cloudflare) and pnpm check (tsc + wrangler deploy --dry-run).
pnpm-workspace.yaml gained three minimumReleaseAgeExclude entries
recorded automatically by pnpm for freshly published versions.

* fix(easytier-js): align host wire format with core wire v3

The core socket options wire format moved to version 3 in 38e2a621
(need_protect byte after purpose). The JS websocket-host still
required version 2 and rejected every TCP bind from a HEAD-built core,
breaking browser port leases.

- websocket-host.ts: accept version 3, minimum length 49. The
  need_protect byte sits after purpose (offset 43) and is a no-op
  outside Android VPN hosts, so the decoder just skips it.
- websocket-host.test.ts: update the test encoder to emit v3.
- binaryen stays at 131.0.0 to match script/build-wasi-core.sh, which
  intentionally pins binaryen 131 for the Go-side embedded core.
  The npm binaryen package provides the wasm-opt binary used by
  build-wasm.mjs, so keeping both sides on the same version avoids
  divergent optimization output.
- pnpm-workspace.yaml: drop two stale minimumReleaseAgeExclude entries
  for @cloudflare/workers-types versions no longer in the lockfile.

* test(easytier-go): cover socket options wire v3 decoders

Direct unit tests for decodeTCPConnectOptions, decodeUDPBindOptions, and
decodeTCPListenOptions with wire v3 documents. Covers combinations of
socket mark, netns, bind device, and local address presence, plus
rejection of wire v2.

Resolves review feedback on PR #2588.

easytier-go/internal/artifact/provenance.go

@@ -3,6 +3,6 @@
 package artifact
 
 const (
-	Commit = "63519db2b5f2a6a1b9b7f20905f036dab54eb829"
+	Commit = "599e4eacaa9c9a6f84b8d6439418af9d860f9aa3"
-	SHA256 = "8b82f37d62fba2ffe8e256386096fddf448d4261d51c495d5bd97cd11bbb24a0"
+	SHA256 = "f5cc76a30d4c6128f7ce77d494dd4e8130aa7e3ce9d5b9ede7604745064bed8d"
 )

easytier-go/internal/coreabi/dataplane.go

@@ -12,7 +12,7 @@ import (
 )
 
 const (
-	DataPlaneABIVersion = 3
+	DataPlaneABIVersion = 4
 
 	DataPlaneCapability    uint64 = 1 << 0
 	DataPlaneTCPCapability uint64 = 1 << 1

easytier-go/internal/engine/host.go

@@ -5,6 +5,7 @@ import (
 	"crypto/rand"
 	"errors"
 	"fmt"
+	"runtime/debug"
 	"sync"
 	"time"
 
@@ -105,6 +106,12 @@ func NewHost(ctx context.Context, options Options) (_ *Host, err error) {
 	if err != nil {
 		return nil, fmt.Errorf("instantiate embedded EasyTier core: %w", err)
 	}
+	// Compiling the core allocates ~100MB of throwaway compiler state on the
+	// Go heap. The Go runtime does not return it to the OS on its own after
+	// the initiating GC, so the process would retain the compilation peak as
+	// resident memory for its entire lifetime. NewHost runs once at startup,
+	// outside the packet path, so reclaim it explicitly here.
+	debug.FreeOSMemory()
 
 	host := &Host{
 		ctx:       lifetime,

easytier-go/internal/hostabi/socket_wire.go

@@ -28,8 +28,16 @@ func readOwnedOptions(module api.Module, pointer, length uint32) ([]byte, bool)
 	return append([]byte(nil), options...), true
 }
 
+// optionsWireVersion matches OPTIONS_VERSION in
+// easytier-core/src/wasi/wire/options.rs. Version 3 appends a need_protect
+// byte after the purpose byte in every socket options document. The byte
+// requests VPN socket protection, which only Android-style VPN hosts can
+// honor; every other platform treats sockets as already protected, so the
+// decoders read and discard it.
+const optionsWireVersion = 3
+
 func decodeTCPConnectOptions(encoded []byte) (platform.TCPConnectOptions, error) {
-	if len(encoded) < 75 || encoded[0] != 2 {
+	if len(encoded) < 76 || encoded[0] != optionsWireVersion {
 		return platform.TCPConnectOptions{}, fmt.Errorf("invalid TCP connect options")
 	}
 	remote, err := decodeSocketAddress(encoded[1:28], false)
@@ -44,7 +52,7 @@ func decodeTCPConnectOptions(encoded []byte) (platform.TCPConnectOptions, error)
 	if err != nil {
 		return platform.TCPConnectOptions{}, fmt.Errorf("invalid TCP socket context: %w", err)
 	}
-	if len(remainder) < 9 {
+	if len(remainder) < 10 {
 		return platform.TCPConnectOptions{}, fmt.Errorf("truncated TCP bind policy")
 	}
 	bind, err := decodeTCPBindPolicy(
@@ -53,7 +61,7 @@ func decodeTCPConnectOptions(encoded []byte) (platform.TCPConnectOptions, error)
 		remainder[0],
 		remainder[1],
 		remainder[2],
-		remainder[4:],
+		remainder[5:],
 	)
 	if err != nil {
 		return platform.TCPConnectOptions{}, err
@@ -70,7 +78,7 @@ func decodeTCPConnectOptions(encoded []byte) (platform.TCPConnectOptions, error)
 }
 
 func decodeUDPBindOptions(encoded []byte) (platform.UDPBindOptions, error) {
-	if len(encoded) < 48 || encoded[0] != 2 {
+	if len(encoded) < 49 || encoded[0] != optionsWireVersion {
 		return platform.UDPBindOptions{}, fmt.Errorf("invalid UDP bind options")
 	}
 	local, err := decodeSocketAddress(encoded[1:28], true)
@@ -81,7 +89,7 @@ func decodeUDPBindOptions(encoded []byte) (platform.UDPBindOptions, error) {
 	if err != nil {
 		return platform.UDPBindOptions{}, fmt.Errorf("invalid UDP socket context: %w", err)
 	}
-	if len(remainder) < 9 {
+	if len(remainder) < 10 {
 		return platform.UDPBindOptions{}, fmt.Errorf("truncated UDP bind policy")
 	}
 	reuseAddr, err := decodeWireBool("UDP reuse_addr", remainder[0])
@@ -100,7 +108,7 @@ func decodeUDPBindOptions(encoded []byte) (platform.UDPBindOptions, error) {
 	if err != nil {
 		return platform.UDPBindOptions{}, err
 	}
-	device, err := decodeBindDevice(remainder[4:])
+	device, err := decodeBindDevice(remainder[5:])
 	if err != nil {
 		return platform.UDPBindOptions{}, err
 	}
@@ -116,7 +124,7 @@ func decodeUDPBindOptions(encoded []byte) (platform.UDPBindOptions, error) {
 }
 
 func decodeTCPListenOptions(encoded []byte) (platform.TCPListenOptions, error) {
-	if len(encoded) < 48 || encoded[0] != 2 {
+	if len(encoded) < 49 || encoded[0] != optionsWireVersion {
 		return platform.TCPListenOptions{}, fmt.Errorf("invalid TCP listen options")
 	}
 	local, err := decodeSocketAddress(encoded[1:28], false)
@@ -127,7 +135,7 @@ func decodeTCPListenOptions(encoded []byte) (platform.TCPListenOptions, error) {
 	if err != nil {
 		return platform.TCPListenOptions{}, fmt.Errorf("invalid TCP listen context: %w", err)
 	}
-	if len(remainder) < 9 {
+	if len(remainder) < 10 {
 		return platform.TCPListenOptions{}, fmt.Errorf("truncated TCP listen bind policy")
 	}
 	bind, err := decodeTCPBindPolicy(
@@ -136,7 +144,7 @@ func decodeTCPListenOptions(encoded []byte) (platform.TCPListenOptions, error) {
 		remainder[0],
 		remainder[1],
 		remainder[2],
-		remainder[4:],
+		remainder[5:],
 	)
 	if err != nil {
 		return platform.TCPListenOptions{}, err

easytier-go/internal/hostabi/socket_wire_test.go

@@ -0,0 +1,265 @@
+package hostabi
+
+import (
+	"encoding/binary"
+	"net"
+	"testing"
+)
+
+// encodeSocketAddress encodes a 27-byte socket address in the wire format
+// used by the wasm core (first 27 bytes of UDP metadata).
+func encodeSocketAddress(addr *net.UDPAddr) []byte {
+	if addr == nil {
+		return make([]byte, socketAddressLen)
+	}
+	var buf [48]byte
+	if ipv4 := addr.IP.To4(); ipv4 != nil {
+		buf[0] = 4
+		copy(buf[1:5], ipv4)
+	} else if ipv6 := addr.IP.To16(); ipv6 != nil {
+		buf[0] = 6
+		copy(buf[1:17], ipv6)
+	} else {
+		panic("invalid IP")
+	}
+	binary.BigEndian.PutUint16(buf[17:19], uint16(addr.Port))
+	return buf[:socketAddressLen]
+}
+
+// encodeSocketContext encodes the socket context portion of the wire format.
+func encodeSocketContext(
+	ipVersion byte,
+	mark *uint32,
+	netns *string,
+) []byte {
+	buf := make([]byte, 0, 64)
+	buf = append(buf, ipVersion)
+	if mark != nil {
+		buf = append(buf, 1)
+		var m [4]byte
+		binary.BigEndian.PutUint32(m[:], *mark)
+		buf = append(buf, m[:]...)
+	} else {
+		buf = append(buf, 0, 0, 0, 0, 0)
+	}
+	if netns != nil {
+		buf = append(buf, 1)
+		var l [4]byte
+		binary.BigEndian.PutUint32(l[:], uint32(len(*netns)))
+		buf = append(buf, l[:]...)
+		buf = append(buf, []byte(*netns)...)
+	} else {
+		buf = append(buf, 0, 0, 0, 0, 0)
+	}
+	return buf
+}
+
+// encodeBindDeviceField encodes the bind_device field (present byte +
+// u32 length + bytes).
+func encodeBindDeviceField(device *string) []byte {
+	if device == nil {
+		return []byte{0, 0, 0, 0, 0}
+	}
+	buf := make([]byte, 0, 5+len(*device))
+	buf = append(buf, 1)
+	var l [4]byte
+	binary.BigEndian.PutUint32(l[:], uint32(len(*device)))
+	buf = append(buf, l[:]...)
+	buf = append(buf, []byte(*device)...)
+	return buf
+}
+
+func TestDecodeTCPConnectOptionsV3(t *testing.T) {
+	tests := []struct {
+		name     string
+		mark     *uint32
+		netns    *string
+		device   *string
+		local    *net.UDPAddr
+		wantMark *uint32
+	}{
+		{
+			name:  "minimal no netns no device",
+			mark:  nil,
+			netns: nil,
+			device: nil,
+			local: nil,
+		},
+		{
+			name:  "with netns",
+			mark:  nil,
+			netns: strPtr("test-ns"),
+			device: nil,
+			local: nil,
+		},
+		{
+			name:  "with bind device",
+			mark:  nil,
+			netns: nil,
+			device: strPtr("eth0"),
+			local: nil,
+		},
+		{
+			name:  "with netns and device",
+			mark:  nil,
+			netns: strPtr("netns1"),
+			device: strPtr("wg0"),
+			local: nil,
+		},
+		{
+			name:  "with socket mark",
+			mark:  uint32Ptr(42),
+			netns: nil,
+			device: nil,
+			local: nil,
+		},
+		{
+			name:  "with local address",
+			mark:  nil,
+			netns: nil,
+			device: nil,
+			local: &net.UDPAddr{IP: net.ParseIP("192.168.1.1"), Port: 8080},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			remote := &net.UDPAddr{IP: net.ParseIP("10.0.0.1"), Port: 11010}
+			encoded := make([]byte, 0, 128)
+			encoded = append(encoded, optionsWireVersion) // wire v3
+			encoded = append(encoded, encodeSocketAddress(remote)...)
+			encoded = append(encoded, encodeSocketAddress(tt.local)...)
+			encoded = append(encoded, encodeSocketContext(0, tt.mark, tt.netns)...)
+			// bind policy: reuse_addr, reuse_port, only_v6
+			encoded = append(encoded, 0, 0, 0)
+			// purpose: TcpDial (0)
+			encoded = append(encoded, 0)
+			// need_protect (wire v3 addition)
+			encoded = append(encoded, 0)
+			// bind device
+			encoded = append(encoded, encodeBindDeviceField(tt.device)...)
+
+			opts, err := decodeTCPConnectOptions(encoded)
+			if err != nil {
+				t.Fatalf("decodeTCPConnectOptions failed: %v", err)
+			}
+			if opts.RemoteAddr == nil {
+				t.Fatal("remote address is nil")
+			}
+			if !opts.RemoteAddr.IP.Equal(remote.IP) || opts.RemoteAddr.Port != remote.Port {
+				t.Errorf("remote addr = %v, want %v", opts.RemoteAddr, remote)
+			}
+			if tt.mark != nil {
+				if opts.Bind.Context.SocketMark == nil || *opts.Bind.Context.SocketMark != *tt.mark {
+					t.Errorf("socket mark = %v, want %v", opts.Bind.Context.SocketMark, tt.mark)
+				}
+			}
+			if tt.netns != nil {
+				if opts.Bind.Context.NetNS == nil || *opts.Bind.Context.NetNS != *tt.netns {
+					t.Errorf("netns = %v, want %v", opts.Bind.Context.NetNS, tt.netns)
+				}
+			}
+			if tt.device != nil {
+				if opts.Bind.BindDevice == nil || *opts.Bind.BindDevice != *tt.device {
+					t.Errorf("bind device = %v, want %v", opts.Bind.BindDevice, tt.device)
+				}
+			}
+			if tt.local != nil {
+				if opts.Bind.LocalAddr == nil || opts.Bind.LocalAddr.Port != tt.local.Port {
+					t.Errorf("local addr = %v, want port %d", opts.Bind.LocalAddr, tt.local.Port)
+				}
+			}
+		})
+	}
+}
+
+func TestDecodeUDPBindOptionsV3(t *testing.T) {
+	device := strPtr("eth1")
+	netns := strPtr("udp-ns")
+	mark := uint32Ptr(100)
+
+	bindAddr := &net.UDPAddr{IP: net.ParseIP("0.0.0.0"), Port: 11011}
+	encoded := make([]byte, 0, 128)
+	encoded = append(encoded, optionsWireVersion)
+	encoded = append(encoded, encodeSocketAddress(bindAddr)...)
+	encoded = append(encoded, encodeSocketContext(0, mark, netns)...)
+	// remainder: reuse_addr, reuse_port, only_v6, purpose, need_protect, bind_device
+	encoded = append(encoded, 0, 0, 0) // reuse_addr, reuse_port, only_v6
+	encoded = append(encoded, 1)       // purpose: Standalone
+	encoded = append(encoded, 0)       // need_protect (wire v3)
+	encoded = append(encoded, encodeBindDeviceField(device)...)
+
+	opts, err := decodeUDPBindOptions(encoded)
+	if err != nil {
+		t.Fatalf("decodeUDPBindOptions failed: %v", err)
+	}
+	if opts.LocalAddr == nil || opts.LocalAddr.Port != 11011 {
+		t.Errorf("local addr = %v, want port 11011", opts.LocalAddr)
+	}
+	if opts.Context.SocketMark == nil || *opts.Context.SocketMark != 100 {
+		t.Errorf("socket mark = %v, want 100", opts.Context.SocketMark)
+	}
+	if opts.Context.NetNS == nil || *opts.Context.NetNS != "udp-ns" {
+		t.Errorf("netns = %v, want udp-ns", opts.Context.NetNS)
+	}
+	if opts.BindDevice == nil || *opts.BindDevice != "eth1" {
+		t.Errorf("bind device = %v, want eth1", opts.BindDevice)
+	}
+	if opts.Purpose != 1 {
+		t.Errorf("purpose = %d, want 1 (Standalone)", opts.Purpose)
+	}
+}
+
+func TestDecodeTCPListenOptionsV3(t *testing.T) {
+	device := strPtr("wg0")
+	netns := strPtr("listen-ns")
+
+	bindAddr := &net.UDPAddr{IP: net.ParseIP("0.0.0.0"), Port: 22020}
+	encoded := make([]byte, 0, 128)
+	encoded = append(encoded, optionsWireVersion)
+	encoded = append(encoded, encodeSocketAddress(bindAddr)...)
+	encoded = append(encoded, encodeSocketContext(2, nil, netns)...) // IPVersionBoth
+	// bind policy: reuse_addr=0, reuse_port=0, only_v6=0
+	encoded = append(encoded, 0, 0, 0)
+	// purpose: Kcp (1)
+	encoded = append(encoded, 1)
+	// need_protect (wire v3)
+	encoded = append(encoded, 0)
+	encoded = append(encoded, encodeBindDeviceField(device)...)
+
+	opts, err := decodeTCPListenOptions(encoded)
+	if err != nil {
+		t.Fatalf("decodeTCPListenOptions failed: %v", err)
+	}
+	if opts.Bind.LocalAddr == nil || opts.Bind.LocalAddr.Port != 22020 {
+		t.Errorf("bind addr = %v, want port 22020", opts.Bind.LocalAddr)
+	}
+	if opts.Bind.Context.NetNS == nil || *opts.Bind.Context.NetNS != "listen-ns" {
+		t.Errorf("netns = %v, want listen-ns", opts.Bind.Context.NetNS)
+	}
+	if opts.Bind.BindDevice == nil || *opts.Bind.BindDevice != "wg0" {
+		t.Errorf("bind device = %v, want wg0", opts.Bind.BindDevice)
+	}
+	if opts.Purpose != 1 {
+		t.Errorf("purpose = %d, want 1 (Kcp)", opts.Purpose)
+	}
+}
+
+func TestDecodeTCPConnectOptionsV2Rejected(t *testing.T) {
+	remote := &net.UDPAddr{IP: net.ParseIP("10.0.0.1"), Port: 11010}
+	encoded := make([]byte, 0, 128)
+	encoded = append(encoded, 2) // wire v2 — must be rejected
+	encoded = append(encoded, encodeSocketAddress(remote)...)
+	encoded = append(encoded, encodeSocketAddress(nil)...)
+	encoded = append(encoded, encodeSocketContext(0, nil, nil)...)
+	encoded = append(encoded, 0, 0, 0, 0) // no need_protect in v2
+	encoded = append(encoded, encodeBindDeviceField(nil)...)
+
+	_, err := decodeTCPConnectOptions(encoded)
+	if err == nil {
+		t.Fatal("wire v2 should be rejected")
+	}
+}
+
+func strPtr(s string) *string    { return &s }
+func uint32Ptr(v uint32) *uint32 { return &v }

easytier-go/proto/api/config/api_config.pb.go

@@ -75,21 +75,24 @@ func (ConfigPatchAction) EnumDescriptor() ([]byte, []int) {
 }
 
 type InstanceConfigPatch struct {
-	state                  protoimpl.MessageState `protogen:"open.v1"`
+	state                  protoimpl.MessageState       `protogen:"open.v1"`
-	Hostname               *string                `protobuf:"bytes,1,opt,name=hostname,proto3,oneof" json:"hostname,omitempty"`
+	Hostname               *string                      `protobuf:"bytes,1,opt,name=hostname,proto3,oneof" json:"hostname,omitempty"`
-	Ipv4                   *common.Ipv4Inet       `protobuf:"bytes,2,opt,name=ipv4,proto3,oneof" json:"ipv4,omitempty"`
+	Ipv4                   *common.Ipv4Inet             `protobuf:"bytes,2,opt,name=ipv4,proto3,oneof" json:"ipv4,omitempty"`
-	Ipv6                   *common.Ipv6Inet       `protobuf:"bytes,3,opt,name=ipv6,proto3,oneof" json:"ipv6,omitempty"`
+	Ipv6                   *common.Ipv6Inet             `protobuf:"bytes,3,opt,name=ipv6,proto3,oneof" json:"ipv6,omitempty"`
-	PortForwards           []*PortForwardPatch    `protobuf:"bytes,4,rep,name=port_forwards,json=portForwards,proto3" json:"port_forwards,omitempty"`
+	PortForwards           []*PortForwardPatch          `protobuf:"bytes,4,rep,name=port_forwards,json=portForwards,proto3" json:"port_forwards,omitempty"`
-	Acl                    *AclPatch              `protobuf:"bytes,5,opt,name=acl,proto3,oneof" json:"acl,omitempty"`
+	Acl                    *AclPatch                    `protobuf:"bytes,5,opt,name=acl,proto3,oneof" json:"acl,omitempty"`
-	ProxyNetworks          []*ProxyNetworkPatch   `protobuf:"bytes,6,rep,name=proxy_networks,json=proxyNetworks,proto3" json:"proxy_networks,omitempty"`
+	ProxyNetworks          []*ProxyNetworkPatch         `protobuf:"bytes,6,rep,name=proxy_networks,json=proxyNetworks,proto3" json:"proxy_networks,omitempty"`
-	Routes                 []*RoutePatch          `protobuf:"bytes,7,rep,name=routes,proto3" json:"routes,omitempty"`
+	Routes                 []*RoutePatch                `protobuf:"bytes,7,rep,name=routes,proto3" json:"routes,omitempty"`
-	ExitNodes              []*ExitNodePatch       `protobuf:"bytes,8,rep,name=exit_nodes,json=exitNodes,proto3" json:"exit_nodes,omitempty"`
+	ExitNodes              []*ExitNodePatch             `protobuf:"bytes,8,rep,name=exit_nodes,json=exitNodes,proto3" json:"exit_nodes,omitempty"`
-	MappedListeners        []*UrlPatch            `protobuf:"bytes,9,rep,name=mapped_listeners,json=mappedListeners,proto3" json:"mapped_listeners,omitempty"`
+	MappedListeners        []*UrlPatch                  `protobuf:"bytes,9,rep,name=mapped_listeners,json=mappedListeners,proto3" json:"mapped_listeners,omitempty"`
-	Connectors             []*UrlPatch            `protobuf:"bytes,10,rep,name=connectors,proto3" json:"connectors,omitempty"`
+	Connectors             []*UrlPatch                  `protobuf:"bytes,10,rep,name=connectors,proto3" json:"connectors,omitempty"`
-	Ipv6PublicAddrProvider *bool                  `protobuf:"varint,11,opt,name=ipv6_public_addr_provider,json=ipv6PublicAddrProvider,proto3,oneof" json:"ipv6_public_addr_provider,omitempty"`
+	Ipv6PublicAddrProvider *bool                        `protobuf:"varint,11,opt,name=ipv6_public_addr_provider,json=ipv6PublicAddrProvider,proto3,oneof" json:"ipv6_public_addr_provider,omitempty"`
-	Ipv6PublicAddrAuto     *bool                  `protobuf:"varint,12,opt,name=ipv6_public_addr_auto,json=ipv6PublicAddrAuto,proto3,oneof" json:"ipv6_public_addr_auto,omitempty"`
+	Ipv6PublicAddrAuto     *bool                        `protobuf:"varint,12,opt,name=ipv6_public_addr_auto,json=ipv6PublicAddrAuto,proto3,oneof" json:"ipv6_public_addr_auto,omitempty"`
-	Ipv6PublicAddrPrefix   *string                `protobuf:"bytes,13,opt,name=ipv6_public_addr_prefix,json=ipv6PublicAddrPrefix,proto3,oneof" json:"ipv6_public_addr_prefix,omitempty"`
+	Ipv6PublicAddrPrefix   *string                      `protobuf:"bytes,13,opt,name=ipv6_public_addr_prefix,json=ipv6PublicAddrPrefix,proto3,oneof" json:"ipv6_public_addr_prefix,omitempty"`
-	DisableRelayData       *bool                  `protobuf:"varint,14,opt,name=disable_relay_data,json=disableRelayData,proto3,oneof" json:"disable_relay_data,omitempty"`
+	DisableRelayData       *bool                        `protobuf:"varint,14,opt,name=disable_relay_data,json=disableRelayData,proto3,oneof" json:"disable_relay_data,omitempty"`
+	VpnPortalClients       []*VpnPortalClientPatch      `protobuf:"bytes,15,rep,name=vpn_portal_clients,json=vpnPortalClients,proto3" json:"vpn_portal_clients,omitempty"`
+	ManagedCredentials     *manage.ManagedCredentialSet `protobuf:"bytes,16,opt,name=managed_credentials,json=managedCredentials,proto3" json:"managed_credentials,omitempty"`
+	PreferPeerRelay        *bool                        `protobuf:"varint,17,opt,name=prefer_peer_relay,json=preferPeerRelay,proto3,oneof" json:"prefer_peer_relay,omitempty"`
 	unknownFields          protoimpl.UnknownFields
 	sizeCache              protoimpl.SizeCache
 }
@@ -222,6 +225,79 @@ func (x *InstanceConfigPatch) GetDisableRelayData() bool {
 	return false
 }
 
+func (x *InstanceConfigPatch) GetVpnPortalClients() []*VpnPortalClientPatch {
+	if x != nil {
+		return x.VpnPortalClients
+	}
+	return nil
+}
+
+func (x *InstanceConfigPatch) GetManagedCredentials() *manage.ManagedCredentialSet {
+	if x != nil {
+		return x.ManagedCredentials
+	}
+	return nil
+}
+
+func (x *InstanceConfigPatch) GetPreferPeerRelay() bool {
+	if x != nil && x.PreferPeerRelay != nil {
+		return *x.PreferPeerRelay
+	}
+	return false
+}
+
+type VpnPortalClientPatch struct {
+	state         protoimpl.MessageState        `protogen:"open.v1"`
+	Action        ConfigPatchAction             `protobuf:"varint,1,opt,name=action,proto3,enum=api.config.ConfigPatchAction" json:"action,omitempty"`
+	Client        *manage.VpnPortalClientConfig `protobuf:"bytes,2,opt,name=client,proto3" json:"client,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *VpnPortalClientPatch) Reset() {
+	*x = VpnPortalClientPatch{}
+	mi := &file_api_config_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *VpnPortalClientPatch) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*VpnPortalClientPatch) ProtoMessage() {}
+
+func (x *VpnPortalClientPatch) ProtoReflect() protoreflect.Message {
+	mi := &file_api_config_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use VpnPortalClientPatch.ProtoReflect.Descriptor instead.
+func (*VpnPortalClientPatch) Descriptor() ([]byte, []int) {
+	return file_api_config_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *VpnPortalClientPatch) GetAction() ConfigPatchAction {
+	if x != nil {
+		return x.Action
+	}
+	return ConfigPatchAction_ADD
+}
+
+func (x *VpnPortalClientPatch) GetClient() *manage.VpnPortalClientConfig {
+	if x != nil {
+		return x.Client
+	}
+	return nil
+}
+
 type PortForwardPatch struct {
 	state         protoimpl.MessageState      `protogen:"open.v1"`
 	Action        ConfigPatchAction           `protobuf:"varint,1,opt,name=action,proto3,enum=api.config.ConfigPatchAction" json:"action,omitempty"`
@@ -232,7 +308,7 @@ type PortForwardPatch struct {
 
 func (x *PortForwardPatch) Reset() {
 	*x = PortForwardPatch{}
-	mi := &file_api_config_proto_msgTypes[1]
+	mi := &file_api_config_proto_msgTypes[2]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -244,7 +320,7 @@ func (x *PortForwardPatch) String() string {
 func (*PortForwardPatch) ProtoMessage() {}
 
 func (x *PortForwardPatch) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[1]
+	mi := &file_api_config_proto_msgTypes[2]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -257,7 +333,7 @@ func (x *PortForwardPatch) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PortForwardPatch.ProtoReflect.Descriptor instead.
 func (*PortForwardPatch) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{1}
+	return file_api_config_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *PortForwardPatch) GetAction() ConfigPatchAction {
@@ -284,7 +360,7 @@ type StringPatch struct {
 
 func (x *StringPatch) Reset() {
 	*x = StringPatch{}
-	mi := &file_api_config_proto_msgTypes[2]
+	mi := &file_api_config_proto_msgTypes[3]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -296,7 +372,7 @@ func (x *StringPatch) String() string {
 func (*StringPatch) ProtoMessage() {}
 
 func (x *StringPatch) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[2]
+	mi := &file_api_config_proto_msgTypes[3]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -309,7 +385,7 @@ func (x *StringPatch) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StringPatch.ProtoReflect.Descriptor instead.
 func (*StringPatch) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{2}
+	return file_api_config_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *StringPatch) GetAction() ConfigPatchAction {
@@ -336,7 +412,7 @@ type UrlPatch struct {
 
 func (x *UrlPatch) Reset() {
 	*x = UrlPatch{}
-	mi := &file_api_config_proto_msgTypes[3]
+	mi := &file_api_config_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -348,7 +424,7 @@ func (x *UrlPatch) String() string {
 func (*UrlPatch) ProtoMessage() {}
 
 func (x *UrlPatch) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[3]
+	mi := &file_api_config_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -361,7 +437,7 @@ func (x *UrlPatch) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UrlPatch.ProtoReflect.Descriptor instead.
 func (*UrlPatch) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{3}
+	return file_api_config_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *UrlPatch) GetAction() ConfigPatchAction {
@@ -389,7 +465,7 @@ type AclPatch struct {
 
 func (x *AclPatch) Reset() {
 	*x = AclPatch{}
-	mi := &file_api_config_proto_msgTypes[4]
+	mi := &file_api_config_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -401,7 +477,7 @@ func (x *AclPatch) String() string {
 func (*AclPatch) ProtoMessage() {}
 
 func (x *AclPatch) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[4]
+	mi := &file_api_config_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -414,7 +490,7 @@ func (x *AclPatch) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AclPatch.ProtoReflect.Descriptor instead.
 func (*AclPatch) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{4}
+	return file_api_config_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *AclPatch) GetAcl() *acl.Acl {
@@ -449,7 +525,7 @@ type ProxyNetworkPatch struct {
 
 func (x *ProxyNetworkPatch) Reset() {
 	*x = ProxyNetworkPatch{}
-	mi := &file_api_config_proto_msgTypes[5]
+	mi := &file_api_config_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -461,7 +537,7 @@ func (x *ProxyNetworkPatch) String() string {
 func (*ProxyNetworkPatch) ProtoMessage() {}
 
 func (x *ProxyNetworkPatch) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[5]
+	mi := &file_api_config_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -474,7 +550,7 @@ func (x *ProxyNetworkPatch) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ProxyNetworkPatch.ProtoReflect.Descriptor instead.
 func (*ProxyNetworkPatch) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{5}
+	return file_api_config_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *ProxyNetworkPatch) GetAction() ConfigPatchAction {
@@ -508,7 +584,7 @@ type RoutePatch struct {
 
 func (x *RoutePatch) Reset() {
 	*x = RoutePatch{}
-	mi := &file_api_config_proto_msgTypes[6]
+	mi := &file_api_config_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -520,7 +596,7 @@ func (x *RoutePatch) String() string {
 func (*RoutePatch) ProtoMessage() {}
 
 func (x *RoutePatch) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[6]
+	mi := &file_api_config_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -533,7 +609,7 @@ func (x *RoutePatch) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RoutePatch.ProtoReflect.Descriptor instead.
 func (*RoutePatch) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{6}
+	return file_api_config_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *RoutePatch) GetAction() ConfigPatchAction {
@@ -560,7 +636,7 @@ type ExitNodePatch struct {
 
 func (x *ExitNodePatch) Reset() {
 	*x = ExitNodePatch{}
-	mi := &file_api_config_proto_msgTypes[7]
+	mi := &file_api_config_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -572,7 +648,7 @@ func (x *ExitNodePatch) String() string {
 func (*ExitNodePatch) ProtoMessage() {}
 
 func (x *ExitNodePatch) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[7]
+	mi := &file_api_config_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -585,7 +661,7 @@ func (x *ExitNodePatch) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExitNodePatch.ProtoReflect.Descriptor instead.
 func (*ExitNodePatch) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{7}
+	return file_api_config_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *ExitNodePatch) GetAction() ConfigPatchAction {
@@ -612,7 +688,7 @@ type PatchConfigRequest struct {
 
 func (x *PatchConfigRequest) Reset() {
 	*x = PatchConfigRequest{}
-	mi := &file_api_config_proto_msgTypes[8]
+	mi := &file_api_config_proto_msgTypes[9]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -624,7 +700,7 @@ func (x *PatchConfigRequest) String() string {
 func (*PatchConfigRequest) ProtoMessage() {}
 
 func (x *PatchConfigRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[8]
+	mi := &file_api_config_proto_msgTypes[9]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -637,7 +713,7 @@ func (x *PatchConfigRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PatchConfigRequest.ProtoReflect.Descriptor instead.
 func (*PatchConfigRequest) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{8}
+	return file_api_config_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *PatchConfigRequest) GetPatch() *InstanceConfigPatch {
@@ -662,7 +738,7 @@ type PatchConfigResponse struct {
 
 func (x *PatchConfigResponse) Reset() {
 	*x = PatchConfigResponse{}
-	mi := &file_api_config_proto_msgTypes[9]
+	mi := &file_api_config_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -674,7 +750,7 @@ func (x *PatchConfigResponse) String() string {
 func (*PatchConfigResponse) ProtoMessage() {}
 
 func (x *PatchConfigResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[9]
+	mi := &file_api_config_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -687,7 +763,7 @@ func (x *PatchConfigResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PatchConfigResponse.ProtoReflect.Descriptor instead.
 func (*PatchConfigResponse) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{9}
+	return file_api_config_proto_rawDescGZIP(), []int{10}
 }
 
 type GetConfigRequest struct {
@@ -699,7 +775,7 @@ type GetConfigRequest struct {
 
 func (x *GetConfigRequest) Reset() {
 	*x = GetConfigRequest{}
-	mi := &file_api_config_proto_msgTypes[10]
+	mi := &file_api_config_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -711,7 +787,7 @@ func (x *GetConfigRequest) String() string {
 func (*GetConfigRequest) ProtoMessage() {}
 
 func (x *GetConfigRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[10]
+	mi := &file_api_config_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -724,7 +800,7 @@ func (x *GetConfigRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetConfigRequest.ProtoReflect.Descriptor instead.
 func (*GetConfigRequest) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{10}
+	return file_api_config_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *GetConfigRequest) GetInstance() *instance.InstanceIdentifier {
@@ -744,7 +820,7 @@ type GetConfigResponse struct {
 
 func (x *GetConfigResponse) Reset() {
 	*x = GetConfigResponse{}
-	mi := &file_api_config_proto_msgTypes[11]
+	mi := &file_api_config_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -756,7 +832,7 @@ func (x *GetConfigResponse) String() string {
 func (*GetConfigResponse) ProtoMessage() {}
 
 func (x *GetConfigResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_config_proto_msgTypes[11]
+	mi := &file_api_config_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -769,7 +845,7 @@ func (x *GetConfigResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetConfigResponse.ProtoReflect.Descriptor instead.
 func (*GetConfigResponse) Descriptor() ([]byte, []int) {
-	return file_api_config_proto_rawDescGZIP(), []int{11}
+	return file_api_config_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *GetConfigResponse) GetConfig() *manage.NetworkConfig {
@@ -791,7 +867,7 @@ var File_api_config_proto protoreflect.FileDescriptor
 const file_api_config_proto_rawDesc = "" +
 	"\n" +
 	"\x10api_config.proto\x12\n" +
-	"api.config\x1a\fcommon.proto\x1a\tacl.proto\x1a\x12api_instance.proto\x1a\x10api_manage.proto\"\x9c\a\n" +
+	"api.config\x1a\fcommon.proto\x1a\tacl.proto\x1a\x12api_instance.proto\x1a\x10api_manage.proto\"\x86\t\n" +
 	"\x13InstanceConfigPatch\x12\x1f\n" +
 	"\bhostname\x18\x01 \x01(\tH\x00R\bhostname\x88\x01\x01\x12)\n" +
 	"\x04ipv4\x18\x02 \x01(\v2\x10.common.Ipv4InetH\x01R\x04ipv4\x88\x01\x01\x12)\n" +
@@ -810,7 +886,10 @@ const file_api_config_proto_rawDesc = "" +
 	"\x19ipv6_public_addr_provider\x18\v \x01(\bH\x04R\x16ipv6PublicAddrProvider\x88\x01\x01\x126\n" +
 	"\x15ipv6_public_addr_auto\x18\f \x01(\bH\x05R\x12ipv6PublicAddrAuto\x88\x01\x01\x12:\n" +
 	"\x17ipv6_public_addr_prefix\x18\r \x01(\tH\x06R\x14ipv6PublicAddrPrefix\x88\x01\x01\x121\n" +
-	"\x12disable_relay_data\x18\x0e \x01(\bH\aR\x10disableRelayData\x88\x01\x01B\v\n" +
+	"\x12disable_relay_data\x18\x0e \x01(\bH\aR\x10disableRelayData\x88\x01\x01\x12N\n" +
+	"\x12vpn_portal_clients\x18\x0f \x03(\v2 .api.config.VpnPortalClientPatchR\x10vpnPortalClients\x12Q\n" +
+	"\x13managed_credentials\x18\x10 \x01(\v2 .api.manage.ManagedCredentialSetR\x12managedCredentials\x12/\n" +
+	"\x11prefer_peer_relay\x18\x11 \x01(\bH\bR\x0fpreferPeerRelay\x88\x01\x01B\v\n" +
 	"\t_hostnameB\a\n" +
 	"\x05_ipv4B\a\n" +
 	"\x05_ipv6B\x06\n" +
@@ -818,7 +897,11 @@ const file_api_config_proto_rawDesc = "" +
 	"\x1a_ipv6_public_addr_providerB\x18\n" +
 	"\x16_ipv6_public_addr_autoB\x1a\n" +
 	"\x18_ipv6_public_addr_prefixB\x15\n" +
-	"\x13_disable_relay_data\"x\n" +
+	"\x13_disable_relay_dataB\x14\n" +
+	"\x12_prefer_peer_relay\"\x88\x01\n" +
+	"\x14VpnPortalClientPatch\x125\n" +
+	"\x06action\x18\x01 \x01(\x0e2\x1d.api.config.ConfigPatchActionR\x06action\x129\n" +
+	"\x06client\x18\x02 \x01(\v2!.api.manage.VpnPortalClientConfigR\x06client\"x\n" +
 	"\x10PortForwardPatch\x125\n" +
 	"\x06action\x18\x01 \x01(\x0e2\x1d.api.config.ConfigPatchActionR\x06action\x12-\n" +
 	"\x03cfg\x18\x02 \x01(\v2\x1b.common.PortForwardConfigPbR\x03cfg\"Z\n" +
@@ -878,68 +961,75 @@ func file_api_config_proto_rawDescGZIP() []byte {
 }
 
 var file_api_config_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_api_config_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
+var file_api_config_proto_msgTypes = make([]protoimpl.MessageInfo, 13)
 var file_api_config_proto_goTypes = []any{
-	(ConfigPatchAction)(0),              // 0: api.config.ConfigPatchAction
+	(ConfigPatchAction)(0),               // 0: api.config.ConfigPatchAction
-	(*InstanceConfigPatch)(nil),         // 1: api.config.InstanceConfigPatch
+	(*InstanceConfigPatch)(nil),          // 1: api.config.InstanceConfigPatch
-	(*PortForwardPatch)(nil),            // 2: api.config.PortForwardPatch
+	(*VpnPortalClientPatch)(nil),         // 2: api.config.VpnPortalClientPatch
-	(*StringPatch)(nil),                 // 3: api.config.StringPatch
+	(*PortForwardPatch)(nil),             // 3: api.config.PortForwardPatch
-	(*UrlPatch)(nil),                    // 4: api.config.UrlPatch
+	(*StringPatch)(nil),                  // 4: api.config.StringPatch
-	(*AclPatch)(nil),                    // 5: api.config.AclPatch
+	(*UrlPatch)(nil),                     // 5: api.config.UrlPatch
-	(*ProxyNetworkPatch)(nil),           // 6: api.config.ProxyNetworkPatch
+	(*AclPatch)(nil),                     // 6: api.config.AclPatch
-	(*RoutePatch)(nil),                  // 7: api.config.RoutePatch
+	(*ProxyNetworkPatch)(nil),            // 7: api.config.ProxyNetworkPatch
-	(*ExitNodePatch)(nil),               // 8: api.config.ExitNodePatch
+	(*RoutePatch)(nil),                   // 8: api.config.RoutePatch
-	(*PatchConfigRequest)(nil),          // 9: api.config.PatchConfigRequest
+	(*ExitNodePatch)(nil),                // 9: api.config.ExitNodePatch
-	(*PatchConfigResponse)(nil),         // 10: api.config.PatchConfigResponse
+	(*PatchConfigRequest)(nil),           // 10: api.config.PatchConfigRequest
-	(*GetConfigRequest)(nil),            // 11: api.config.GetConfigRequest
+	(*PatchConfigResponse)(nil),          // 11: api.config.PatchConfigResponse
-	(*GetConfigResponse)(nil),           // 12: api.config.GetConfigResponse
+	(*GetConfigRequest)(nil),             // 12: api.config.GetConfigRequest
-	(*common.Ipv4Inet)(nil),             // 13: common.Ipv4Inet
+	(*GetConfigResponse)(nil),            // 13: api.config.GetConfigResponse
-	(*common.Ipv6Inet)(nil),             // 14: common.Ipv6Inet
+	(*common.Ipv4Inet)(nil),              // 14: common.Ipv4Inet
-	(*common.PortForwardConfigPb)(nil),  // 15: common.PortForwardConfigPb
+	(*common.Ipv6Inet)(nil),              // 15: common.Ipv6Inet
-	(*common.Url)(nil),                  // 16: common.Url
+	(*manage.ManagedCredentialSet)(nil),  // 16: api.manage.ManagedCredentialSet
-	(*acl.Acl)(nil),                     // 17: acl.Acl
+	(*manage.VpnPortalClientConfig)(nil), // 17: api.manage.VpnPortalClientConfig
-	(*common.IpAddr)(nil),               // 18: common.IpAddr
+	(*common.PortForwardConfigPb)(nil),   // 18: common.PortForwardConfigPb
-	(*instance.InstanceIdentifier)(nil), // 19: api.instance.InstanceIdentifier
+	(*common.Url)(nil),                   // 19: common.Url
-	(*manage.NetworkConfig)(nil),        // 20: api.manage.NetworkConfig
+	(*acl.Acl)(nil),                      // 20: acl.Acl
+	(*common.IpAddr)(nil),                // 21: common.IpAddr
+	(*instance.InstanceIdentifier)(nil),  // 22: api.instance.InstanceIdentifier
+	(*manage.NetworkConfig)(nil),         // 23: api.manage.NetworkConfig
 }
 var file_api_config_proto_depIdxs = []int32{
-	13, // 0: api.config.InstanceConfigPatch.ipv4:type_name -> common.Ipv4Inet
+	14, // 0: api.config.InstanceConfigPatch.ipv4:type_name -> common.Ipv4Inet
-	14, // 1: api.config.InstanceConfigPatch.ipv6:type_name -> common.Ipv6Inet
+	15, // 1: api.config.InstanceConfigPatch.ipv6:type_name -> common.Ipv6Inet
-	2,  // 2: api.config.InstanceConfigPatch.port_forwards:type_name -> api.config.PortForwardPatch
+	3,  // 2: api.config.InstanceConfigPatch.port_forwards:type_name -> api.config.PortForwardPatch
-	5,  // 3: api.config.InstanceConfigPatch.acl:type_name -> api.config.AclPatch
+	6,  // 3: api.config.InstanceConfigPatch.acl:type_name -> api.config.AclPatch
-	6,  // 4: api.config.InstanceConfigPatch.proxy_networks:type_name -> api.config.ProxyNetworkPatch
+	7,  // 4: api.config.InstanceConfigPatch.proxy_networks:type_name -> api.config.ProxyNetworkPatch
-	7,  // 5: api.config.InstanceConfigPatch.routes:type_name -> api.config.RoutePatch
+	8,  // 5: api.config.InstanceConfigPatch.routes:type_name -> api.config.RoutePatch
-	8,  // 6: api.config.InstanceConfigPatch.exit_nodes:type_name -> api.config.ExitNodePatch
+	9,  // 6: api.config.InstanceConfigPatch.exit_nodes:type_name -> api.config.ExitNodePatch
-	4,  // 7: api.config.InstanceConfigPatch.mapped_listeners:type_name -> api.config.UrlPatch
+	5,  // 7: api.config.InstanceConfigPatch.mapped_listeners:type_name -> api.config.UrlPatch
-	4,  // 8: api.config.InstanceConfigPatch.connectors:type_name -> api.config.UrlPatch
+	5,  // 8: api.config.InstanceConfigPatch.connectors:type_name -> api.config.UrlPatch
-	0,  // 9: api.config.PortForwardPatch.action:type_name -> api.config.ConfigPatchAction
+	2,  // 9: api.config.InstanceConfigPatch.vpn_portal_clients:type_name -> api.config.VpnPortalClientPatch
-	15, // 10: api.config.PortForwardPatch.cfg:type_name -> common.PortForwardConfigPb
+	16, // 10: api.config.InstanceConfigPatch.managed_credentials:type_name -> api.manage.ManagedCredentialSet
-	0,  // 11: api.config.StringPatch.action:type_name -> api.config.ConfigPatchAction
+	0,  // 11: api.config.VpnPortalClientPatch.action:type_name -> api.config.ConfigPatchAction
-	0,  // 12: api.config.UrlPatch.action:type_name -> api.config.ConfigPatchAction
+	17, // 12: api.config.VpnPortalClientPatch.client:type_name -> api.manage.VpnPortalClientConfig
-	16, // 13: api.config.UrlPatch.url:type_name -> common.Url
+	0,  // 13: api.config.PortForwardPatch.action:type_name -> api.config.ConfigPatchAction
-	17, // 14: api.config.AclPatch.acl:type_name -> acl.Acl
+	18, // 14: api.config.PortForwardPatch.cfg:type_name -> common.PortForwardConfigPb
-	3,  // 15: api.config.AclPatch.tcp_whitelist:type_name -> api.config.StringPatch
+	0,  // 15: api.config.StringPatch.action:type_name -> api.config.ConfigPatchAction
-	3,  // 16: api.config.AclPatch.udp_whitelist:type_name -> api.config.StringPatch
+	0,  // 16: api.config.UrlPatch.action:type_name -> api.config.ConfigPatchAction
-	0,  // 17: api.config.ProxyNetworkPatch.action:type_name -> api.config.ConfigPatchAction
+	19, // 17: api.config.UrlPatch.url:type_name -> common.Url
-	13, // 18: api.config.ProxyNetworkPatch.cidr:type_name -> common.Ipv4Inet
+	20, // 18: api.config.AclPatch.acl:type_name -> acl.Acl
-	13, // 19: api.config.ProxyNetworkPatch.mapped_cidr:type_name -> common.Ipv4Inet
+	4,  // 19: api.config.AclPatch.tcp_whitelist:type_name -> api.config.StringPatch
-	0,  // 20: api.config.RoutePatch.action:type_name -> api.config.ConfigPatchAction
+	4,  // 20: api.config.AclPatch.udp_whitelist:type_name -> api.config.StringPatch
-	13, // 21: api.config.RoutePatch.cidr:type_name -> common.Ipv4Inet
+	0,  // 21: api.config.ProxyNetworkPatch.action:type_name -> api.config.ConfigPatchAction
-	0,  // 22: api.config.ExitNodePatch.action:type_name -> api.config.ConfigPatchAction
+	14, // 22: api.config.ProxyNetworkPatch.cidr:type_name -> common.Ipv4Inet
-	18, // 23: api.config.ExitNodePatch.node:type_name -> common.IpAddr
+	14, // 23: api.config.ProxyNetworkPatch.mapped_cidr:type_name -> common.Ipv4Inet
-	1,  // 24: api.config.PatchConfigRequest.patch:type_name -> api.config.InstanceConfigPatch
+	0,  // 24: api.config.RoutePatch.action:type_name -> api.config.ConfigPatchAction
-	19, // 25: api.config.PatchConfigRequest.instance:type_name -> api.instance.InstanceIdentifier
+	14, // 25: api.config.RoutePatch.cidr:type_name -> common.Ipv4Inet
-	19, // 26: api.config.GetConfigRequest.instance:type_name -> api.instance.InstanceIdentifier
+	0,  // 26: api.config.ExitNodePatch.action:type_name -> api.config.ConfigPatchAction
-	20, // 27: api.config.GetConfigResponse.config:type_name -> api.manage.NetworkConfig
+	21, // 27: api.config.ExitNodePatch.node:type_name -> common.IpAddr
-	9,  // 28: api.config.ConfigRpc.PatchConfig:input_type -> api.config.PatchConfigRequest
+	1,  // 28: api.config.PatchConfigRequest.patch:type_name -> api.config.InstanceConfigPatch
-	11, // 29: api.config.ConfigRpc.GetConfig:input_type -> api.config.GetConfigRequest
+	22, // 29: api.config.PatchConfigRequest.instance:type_name -> api.instance.InstanceIdentifier
-	10, // 30: api.config.ConfigRpc.PatchConfig:output_type -> api.config.PatchConfigResponse
+	22, // 30: api.config.GetConfigRequest.instance:type_name -> api.instance.InstanceIdentifier
-	12, // 31: api.config.ConfigRpc.GetConfig:output_type -> api.config.GetConfigResponse
+	23, // 31: api.config.GetConfigResponse.config:type_name -> api.manage.NetworkConfig
-	30, // [30:32] is the sub-list for method output_type
+	10, // 32: api.config.ConfigRpc.PatchConfig:input_type -> api.config.PatchConfigRequest
-	28, // [28:30] is the sub-list for method input_type
+	12, // 33: api.config.ConfigRpc.GetConfig:input_type -> api.config.GetConfigRequest
-	28, // [28:28] is the sub-list for extension type_name
+	11, // 34: api.config.ConfigRpc.PatchConfig:output_type -> api.config.PatchConfigResponse
-	28, // [28:28] is the sub-list for extension extendee
+	13, // 35: api.config.ConfigRpc.GetConfig:output_type -> api.config.GetConfigResponse
-	0,  // [0:28] is the sub-list for field type_name
+	34, // [34:36] is the sub-list for method output_type
+	32, // [32:34] is the sub-list for method input_type
+	32, // [32:32] is the sub-list for extension type_name
+	32, // [32:32] is the sub-list for extension extendee
+	0,  // [0:32] is the sub-list for field type_name
 }
 
 func init() { file_api_config_proto_init() }
@@ -948,15 +1038,15 @@ func file_api_config_proto_init() {
 		return
 	}
 	file_api_config_proto_msgTypes[0].OneofWrappers = []any{}
-	file_api_config_proto_msgTypes[4].OneofWrappers = []any{}
 	file_api_config_proto_msgTypes[5].OneofWrappers = []any{}
+	file_api_config_proto_msgTypes[6].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_api_config_proto_rawDesc), len(file_api_config_proto_rawDesc)),
 			NumEnums:      1,
-			NumMessages:   12,
+			NumMessages:   13,
 			NumExtensions: 0,
 			NumServices:   1,
 		},

easytier-go/proto/common/common.pb.go

@@ -255,9 +255,12 @@ type FlagsInConfig struct {
 	// SO_MARK untouched (kernel default 0). Any set value (including 0) is
 	// applied via setsockopt. Requires CAP_NET_ADMIN; silently ignored on
 	// non-Linux platforms.
-	SocketMark    *uint32 `protobuf:"varint,43,opt,name=socket_mark,json=socketMark,proto3,oneof" json:"socket_mark,omitempty"`
+	SocketMark *uint32 `protobuf:"varint,43,opt,name=socket_mark,json=socketMark,proto3,oneof" json:"socket_mark,omitempty"`
-	unknownFields protoimpl.UnknownFields
+	// Prefer direct credential peers that already relay to a destination over
-	sizeCache     protoimpl.SizeCache
+	// advertising another direct edge to the same destination.
+	PreferPeerRelay bool `protobuf:"varint,44,opt,name=prefer_peer_relay,json=preferPeerRelay,proto3" json:"prefer_peer_relay,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
 }
 
 func (x *FlagsInConfig) Reset() {
@@ -585,6 +588,13 @@ func (x *FlagsInConfig) GetSocketMark() uint32 {
 	return 0
 }
 
+func (x *FlagsInConfig) GetPreferPeerRelay() bool {
+	if x != nil {
+		return x.PreferPeerRelay
+	}
+	return false
+}
+
 type RpcDescriptor struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// allow same service registered multiple times in different domain
@@ -2071,66 +2081,6 @@ func (x *ProxyDstInfo) GetDstAddr() *SocketAddr {
 	return nil
 }
 
-type LimiterConfig struct {
-	state          protoimpl.MessageState `protogen:"open.v1"`
-	BurstRate      *uint64                `protobuf:"varint,1,opt,name=burst_rate,json=burstRate,proto3,oneof" json:"burst_rate,omitempty"`                  // default 1 means no burst (capacity is same with bps)
-	Bps            *uint64                `protobuf:"varint,2,opt,name=bps,proto3,oneof" json:"bps,omitempty"`                                               // default 0 means no limit (unit is B/s)
-	FillDurationMs *uint64                `protobuf:"varint,3,opt,name=fill_duration_ms,json=fillDurationMs,proto3,oneof" json:"fill_duration_ms,omitempty"` // default 10ms, the period to fill the bucket
-	unknownFields  protoimpl.UnknownFields
-	sizeCache      protoimpl.SizeCache
-}
-
-func (x *LimiterConfig) Reset() {
-	*x = LimiterConfig{}
-	mi := &file_common_proto_msgTypes[23]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *LimiterConfig) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*LimiterConfig) ProtoMessage() {}
-
-func (x *LimiterConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_common_proto_msgTypes[23]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use LimiterConfig.ProtoReflect.Descriptor instead.
-func (*LimiterConfig) Descriptor() ([]byte, []int) {
-	return file_common_proto_rawDescGZIP(), []int{23}
-}
-
-func (x *LimiterConfig) GetBurstRate() uint64 {
-	if x != nil && x.BurstRate != nil {
-		return *x.BurstRate
-	}
-	return 0
-}
-
-func (x *LimiterConfig) GetBps() uint64 {
-	if x != nil && x.Bps != nil {
-		return *x.Bps
-	}
-	return 0
-}
-
-func (x *LimiterConfig) GetFillDurationMs() uint64 {
-	if x != nil && x.FillDurationMs != nil {
-		return *x.FillDurationMs
-	}
-	return 0
-}
-
 type SecureModeConfig struct {
 	state   protoimpl.MessageState `protogen:"open.v1"`
 	Enabled bool                   `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
@@ -2144,7 +2094,7 @@ type SecureModeConfig struct {
 
 func (x *SecureModeConfig) Reset() {
 	*x = SecureModeConfig{}
-	mi := &file_common_proto_msgTypes[24]
+	mi := &file_common_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2156,7 +2106,7 @@ func (x *SecureModeConfig) String() string {
 func (*SecureModeConfig) ProtoMessage() {}
 
 func (x *SecureModeConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_common_proto_msgTypes[24]
+	mi := &file_common_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2169,7 +2119,7 @@ func (x *SecureModeConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SecureModeConfig.ProtoReflect.Descriptor instead.
 func (*SecureModeConfig) Descriptor() ([]byte, []int) {
-	return file_common_proto_rawDescGZIP(), []int{24}
+	return file_common_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *SecureModeConfig) GetEnabled() bool {
@@ -2197,7 +2147,7 @@ var File_common_proto protoreflect.FileDescriptor
 
 const file_common_proto_rawDesc = "" +
 	"\n" +
-	"\fcommon.proto\x12\x06common\x1a\verror.proto\"\xc9\x0e\n" +
+	"\fcommon.proto\x12\x06common\x1a\verror.proto\"\xf5\x0e\n" +
 	"\rFlagsInConfig\x12)\n" +
 	"\x10default_protocol\x18\x01 \x01(\tR\x0fdefaultProtocol\x12\x19\n" +
 	"\bdev_name\x18\x02 \x01(\tR\adevName\x12+\n" +
@@ -2248,7 +2198,8 @@ const file_common_proto_rawDesc = "" +
 	"\x12disable_relay_data\x18) \x01(\bR\x10disableRelayData\x12;\n" +
 	"\x1aenable_udp_broadcast_relay\x18* \x01(\bR\x17enableUdpBroadcastRelay\x12$\n" +
 	"\vsocket_mark\x18+ \x01(\rH\x00R\n" +
-	"socketMark\x88\x01\x01B\x0e\n" +
+	"socketMark\x88\x01\x01\x12*\n" +
+	"\x11prefer_peer_relay\x18, \x01(\bR\x0fpreferPeerRelayB\x0e\n" +
 	"\f_socket_mark\"\x95\x01\n" +
 	"\rRpcDescriptor\x12\x1f\n" +
 	"\vdomain_name\x18\x01 \x01(\tR\n" +
@@ -2374,15 +2325,7 @@ const file_common_proto_rawDesc = "" +
 	"\vsocket_type\x18\x03 \x01(\x0e2\x12.common.SocketTypeR\n" +
 	"socketType\"=\n" +
 	"\fProxyDstInfo\x12-\n" +
-	"\bdst_addr\x18\x01 \x01(\v2\x12.common.SocketAddrR\adstAddr\"\xa5\x01\n" +
+	"\bdst_addr\x18\x01 \x01(\v2\x12.common.SocketAddrR\adstAddr\"\xb7\x01\n" +
-	"\rLimiterConfig\x12\"\n" +
-	"\n" +
-	"burst_rate\x18\x01 \x01(\x04H\x00R\tburstRate\x88\x01\x01\x12\x15\n" +
-	"\x03bps\x18\x02 \x01(\x04H\x01R\x03bps\x88\x01\x01\x12-\n" +
-	"\x10fill_duration_ms\x18\x03 \x01(\x04H\x02R\x0efillDurationMs\x88\x01\x01B\r\n" +
-	"\v_burst_rateB\x06\n" +
-	"\x04_bpsB\x13\n" +
-	"\x11_fill_duration_ms\"\xb7\x01\n" +
 	"\x10SecureModeConfig\x12\x18\n" +
 	"\aenabled\x18\x01 \x01(\bR\aenabled\x12/\n" +
 	"\x11local_private_key\x18\x02 \x01(\tH\x00R\x0flocalPrivateKey\x88\x01\x01\x12-\n" +
@@ -2423,7 +2366,7 @@ func file_common_proto_rawDescGZIP() []byte {
 }
 
 var file_common_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
-var file_common_proto_msgTypes = make([]protoimpl.MessageInfo, 25)
+var file_common_proto_msgTypes = make([]protoimpl.MessageInfo, 24)
 var file_common_proto_goTypes = []any{
 	(CompressionAlgoPb)(0),        // 0: common.CompressionAlgoPb
 	(NatType)(0),                  // 1: common.NatType
@@ -2451,16 +2394,15 @@ var file_common_proto_goTypes = []any{
 	(*PeerFeatureFlag)(nil),       // 23: common.PeerFeatureFlag
 	(*PortForwardConfigPb)(nil),   // 24: common.PortForwardConfigPb
 	(*ProxyDstInfo)(nil),          // 25: common.ProxyDstInfo
-	(*LimiterConfig)(nil),         // 26: common.LimiterConfig
+	(*SecureModeConfig)(nil),      // 26: common.SecureModeConfig
-	(*SecureModeConfig)(nil),      // 27: common.SecureModeConfig
+	(*error1.Error)(nil),          // 27: error.Error
-	(*error1.Error)(nil),          // 28: error.Error
 }
 var file_common_proto_depIdxs = []int32{
 	0,  // 0: common.FlagsInConfig.data_compress_algo:type_name -> common.CompressionAlgoPb
 	4,  // 1: common.RpcRequest.descriptor:type_name -> common.RpcDescriptor
 	6,  // 2: common.HostManagementRequest.rpc:type_name -> common.DirectRpcRequest
 	12, // 3: common.HostManagementRequest.prepared_instance_id:type_name -> common.UUID
-	28, // 4: common.RpcResponse.error:type_name -> error.Error
+	27, // 4: common.RpcResponse.error:type_name -> error.Error
 	0,  // 5: common.RpcCompressionInfo.algo:type_name -> common.CompressionAlgoPb
 	0,  // 6: common.RpcCompressionInfo.accepted_algo:type_name -> common.CompressionAlgoPb
 	4,  // 7: common.RpcPacket.descriptor:type_name -> common.RpcDescriptor
@@ -2510,14 +2452,13 @@ func file_common_proto_init() {
 		(*SocketAddr_Ipv6)(nil),
 	}
 	file_common_proto_msgTypes[23].OneofWrappers = []any{}
-	file_common_proto_msgTypes[24].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_common_proto_rawDesc), len(file_common_proto_rawDesc)),
 			NumEnums:      3,
-			NumMessages:   25,
+			NumMessages:   24,
 			NumExtensions: 0,
 			NumServices:   0,
 		},

easytier-go/proto/peer_rpc/peer_rpc.pb.go

@@ -2756,6 +2756,7 @@ type PeerConnNoiseMsg1Pb struct {
 	ASessionGeneration        *uint32                `protobuf:"varint,3,opt,name=a_session_generation,json=aSessionGeneration,proto3,oneof" json:"a_session_generation,omitempty"`
 	AConnId                   *common.UUID           `protobuf:"bytes,4,opt,name=a_conn_id,json=aConnId,proto3" json:"a_conn_id,omitempty"`
 	ClientEncryptionAlgorithm string                 `protobuf:"bytes,5,opt,name=client_encryption_algorithm,json=clientEncryptionAlgorithm,proto3" json:"client_encryption_algorithm,omitempty"`
+	Features                  []string               `protobuf:"bytes,6,rep,name=features,proto3" json:"features,omitempty"`
 	unknownFields             protoimpl.UnknownFields
 	sizeCache                 protoimpl.SizeCache
 }
@@ -2825,6 +2826,13 @@ func (x *PeerConnNoiseMsg1Pb) GetClientEncryptionAlgorithm() string {
 	return ""
 }
 
+func (x *PeerConnNoiseMsg1Pb) GetFeatures() []string {
+	if x != nil {
+		return x.Features
+	}
+	return nil
+}
+
 type PeerConnNoiseMsg2Pb struct {
 	state                     protoimpl.MessageState  `protogen:"open.v1"`
 	BNetworkName              string                  `protobuf:"bytes,1,opt,name=b_network_name,json=bNetworkName,proto3" json:"b_network_name,omitempty"`
@@ -2837,6 +2845,7 @@ type PeerConnNoiseMsg2Pb struct {
 	AConnIdEcho               *common.UUID            `protobuf:"bytes,8,opt,name=a_conn_id_echo,json=aConnIdEcho,proto3" json:"a_conn_id_echo,omitempty"`
 	SecretProof_32            []byte                  `protobuf:"bytes,9,opt,name=secret_proof_32,json=secretProof32,proto3,oneof" json:"secret_proof_32,omitempty"`
 	ServerEncryptionAlgorithm string                  `protobuf:"bytes,10,opt,name=server_encryption_algorithm,json=serverEncryptionAlgorithm,proto3" json:"server_encryption_algorithm,omitempty"`
+	Features                  []string                `protobuf:"bytes,11,rep,name=features,proto3" json:"features,omitempty"`
 	unknownFields             protoimpl.UnknownFields
 	sizeCache                 protoimpl.SizeCache
 }
@@ -2941,6 +2950,13 @@ func (x *PeerConnNoiseMsg2Pb) GetServerEncryptionAlgorithm() string {
 	return ""
 }
 
+func (x *PeerConnNoiseMsg2Pb) GetFeatures() []string {
+	if x != nil {
+		return x.Features
+	}
+	return nil
+}
+
 type RelayNoiseMsg1Pb struct {
 	state                     protoimpl.MessageState `protogen:"open.v1"`
 	Version                   uint32                 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
@@ -3574,14 +3590,15 @@ const file_peer_rpc_proto_rawDesc = "" +
 	"\x15network_secret_digest\x18\x06 \x01(\fR\x13networkSecretDigest\"Y\n" +
 	"\vKcpConnData\x12$\n" +
 	"\x03src\x18\x01 \x01(\v2\x12.common.SocketAddrR\x03src\x12$\n" +
-	"\x03dst\x18\x04 \x01(\v2\x12.common.SocketAddrR\x03dst\"\x8f\x02\n" +
+	"\x03dst\x18\x04 \x01(\v2\x12.common.SocketAddrR\x03dst\"\xab\x02\n" +
 	"\x13PeerConnNoiseMsg1Pb\x12\x18\n" +
 	"\aversion\x18\x01 \x01(\rR\aversion\x12$\n" +
 	"\x0ea_network_name\x18\x02 \x01(\tR\faNetworkName\x125\n" +
 	"\x14a_session_generation\x18\x03 \x01(\rH\x00R\x12aSessionGeneration\x88\x01\x01\x12(\n" +
 	"\ta_conn_id\x18\x04 \x01(\v2\f.common.UUIDR\aaConnId\x12>\n" +
-	"\x1bclient_encryption_algorithm\x18\x05 \x01(\tR\x19clientEncryptionAlgorithmB\x17\n" +
+	"\x1bclient_encryption_algorithm\x18\x05 \x01(\tR\x19clientEncryptionAlgorithm\x12\x1a\n" +
-	"\x15_a_session_generation\"\xfd\x03\n" +
+	"\bfeatures\x18\x06 \x03(\tR\bfeaturesB\x17\n" +
+	"\x15_a_session_generation\"\x99\x04\n" +
 	"\x13PeerConnNoiseMsg2Pb\x12$\n" +
 	"\x0eb_network_name\x18\x01 \x01(\tR\fbNetworkName\x12\x1b\n" +
 	"\trole_hint\x18\x02 \x01(\rR\broleHint\x129\n" +
@@ -3593,7 +3610,8 @@ const file_peer_rpc_proto_rawDesc = "" +
 	"\x0ea_conn_id_echo\x18\b \x01(\v2\f.common.UUIDR\vaConnIdEcho\x12+\n" +
 	"\x0fsecret_proof_32\x18\t \x01(\fH\x01R\rsecretProof32\x88\x01\x01\x12>\n" +
 	"\x1bserver_encryption_algorithm\x18\n" +
-	" \x01(\tR\x19serverEncryptionAlgorithmB\x0e\n" +
+	" \x01(\tR\x19serverEncryptionAlgorithm\x12\x1a\n" +
+	"\bfeatures\x18\v \x03(\tR\bfeaturesB\x0e\n" +
 	"\f_root_key_32B\x12\n" +
 	"\x10_secret_proof_32\"\xe6\x01\n" +
 	"\x10RelayNoiseMsg1Pb\x12\x18\n" +

easytier-go/proto/provenance.go

@@ -3,6 +3,6 @@
 package proto
 
 const (
-	EasyTierCommit = "63519db2b5f2a6a1b9b7f20905f036dab54eb829"
+	EasyTierCommit = "599e4eacaa9c9a6f84b8d6439418af9d860f9aa3"
-	SchemaSHA256   = "4fc7f40eac5d3803ed8afe707f2be1db121a022547f91568955c369212875064"
+	SchemaSHA256   = "7de60ee229e6ee2f17e3673cff6f9d9d4d4bece13ed74e46b1999277b364db67"
 )

easytier-js/browser/package.json

@@ -38,9 +38,9 @@
   },
   "devDependencies": {
     "@types/node": "22.18.1",
-    "esbuild": "0.25.9",
+    "esbuild": "0.28.2",
     "typescript": "5.9.3",
-    "vitest": "2.1.9"
+    "vitest": "3.2.7"
   },
   "publishConfig": {
     "access": "public"

easytier-js/cloudflare/package.json

@@ -32,14 +32,14 @@
     "prepack": "pnpm check"
   },
   "dependencies": {
-    "@cloudflare/workers-types": "5.20260724.1",
+    "@cloudflare/workers-types": "5.20260917.1",
     "@easytier/runtime": "workspace:0.1.0"
   },
   "devDependencies": {
     "@types/node": "22.18.1",
     "typescript": "5.9.3",
-    "vitest": "2.1.9",
+    "vitest": "3.2.7",
-    "wrangler": "4.114.0"
+    "wrangler": "4.134.0"
   },
   "publishConfig": {
     "access": "public"

easytier-js/examples/web/package.json

@@ -18,10 +18,10 @@
     "@easytier/cloudflare": "workspace:0.1.0"
   },
   "devDependencies": {
-    "@cloudflare/workers-types": "5.20260724.1",
+    "@cloudflare/workers-types": "5.20260917.1",
     "@types/node": "22.18.1",
     "typescript": "5.9.3",
     "vite": "5.4.21",
-    "wrangler": "4.114.0"
+    "wrangler": "4.134.0"
   }
 }

easytier-js/pnpm-workspace.yaml

@@ -12,4 +12,5 @@ allowBuilds:
   workerd: true
 
 minimumReleaseAgeExclude:
-  - '@cloudflare/workers-types@5.20260724.1'
+  - miniflare@5.20260917.0-alpha
+  - wrangler@4.134.0

easytier-js/runtime/package.json

@@ -36,7 +36,7 @@
     "@types/node": "22.18.1",
     "binaryen": "131.0.0",
     "typescript": "5.9.3",
-    "vitest": "2.1.9"
+    "vitest": "3.2.7"
   },
   "publishConfig": {
     "access": "public"

easytier-js/runtime/src/websocket-host.ts

@@ -800,7 +800,7 @@ export class WebSocketHost {
     } catch {
       return HOST_INVALID;
     }
-    if (options.byteLength < 48 || options[0] !== 2) {
+    if (options.byteLength < 49 || options[0] !== 3) {
       return HOST_INVALID;
     }
     const netnsLength = new DataView(

easytier-js/runtime/test/websocket-host.test.ts

@@ -74,13 +74,14 @@ function encodeTcpPortLease(
   port: number,
   purpose = 6,
 ): number {
-  const options = new Uint8Array(memory.buffer, pointer, 48);
+  const options = new Uint8Array(memory.buffer, pointer, 49);
   options.fill(0);
-  options[0] = 2;
+  options[0] = 3;
   options[1] = 4;
   const view = new DataView(memory.buffer, pointer, options.byteLength);
   view.setUint16(18, port, false);
   options[42] = purpose;
+  // options[43] is need_protect, left at 0; the browser host is not a VPN.
   return options.byteLength;
 }