Merge pull request #2969 from murgatroid99/debugging_example

Add debugging example

.github/workflows/grpc-tools-build.yml

@@ -8,9 +8,9 @@ on:
     branches:
       - master
 
-permissions:
+permissions:
   contents: read #  to fetch code (actions/checkout)
-
+
 jobs:
   linux_build:
     name: Linux grpc-tools Build
@@ -23,7 +23,7 @@ jobs:
         run: |
           docker build -t kokoro-native-image tools/release/native
           docker run -v /var/run/docker.sock:/var/run/docker.sock -v $GITHUB_WORKSPACE:$GITHUB_WORKSPACE kokoro-native-image $GITHUB_WORKSPACE/packages/grpc-tools/build_binaries.sh
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v4
         with:
           name: grpc-tools_linux
           path: artifacts/
@@ -36,7 +36,7 @@ jobs:
           submodules: recursive
       - name: Build
         run: packages/grpc-tools/build_binaries.sh
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v4
         with:
           name: grpc-tools_macos
           path: artifacts/
@@ -55,7 +55,7 @@ jobs:
       - name: Build
         run: powershell -File ./packages/grpc-tools/build_binaries.ps1
         shell: cmd
-      - uses: actions/upload-artifact@v1
+      - uses: actions/upload-artifact@v4
         with:
           name: grpc-tools_windows_${{matrix.arch}}
           path: artifacts/
@@ -64,12 +64,12 @@ jobs:
     runs-on: ubuntu-latest
     needs: [linux_build, macos_build, windows_build]
     steps:
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v4
       - name: Copy
         run: |
           mkdir artifacts
           cp -r ./**/* artifacts/
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v4
         with:
           name: combined-artifacts
           path: artifacts/

MAINTAINERS.md

@@ -8,17 +8,21 @@ See [CONTRIBUTING.md](https://github.com/grpc/grpc-community/blob/master/CONTRIB
 for general contribution guidelines.
 
 ## Maintainers (in alphabetical order)
- 
- - [jtattermusch](https://github.com/jtattermusch), Google Inc.
+
+ - [gnossen](https://github.com/gnossen), Google Inc.
  - [murgatroid99](https://github.com/murgatroid99), Google Inc.
- - [nicolasnoble](https://github.com/nicolasnoble), Google Inc.
- - [srini100](https://github.com/srini100), Google Inc.
+ - [sergiitk](https://github.com/sergiitk), Google Inc.
+ - [temawi](https://github.com/temawi), Google Inc.
  - [wenbozhu](https://github.com/wenbozhu), Google Inc.
 
  ## Emeritus Maintainers (in alphabetical order)
- - [jiangtaoli2016](https://github.com/jiangtaoli2016), Google Inc.
- - [kjin](https://github.com/kjin), Google Inc.
- - [matt-kwong](https://github.com/matt-kwong), Google Inc.
- - [ofrobots](https://github.com/ofrobots), Google Inc.
- - [WeiranFang](https://github.com/WeiranFang), Google Inc.
+ - [jiangtaoli2016](https://github.com/jiangtaoli2016)
+ - [jtattermusch](https://github.com/jtattermusch)
+ - [kjin](https://github.com/kjin)
+ - [matt-kwong](https://github.com/matt-kwong)
+ - [nicolasnoble](https://github.com/nicolasnoble)
+ - [nimf](https://github.com/nimf)
+ - [ofrobots](https://github.com/ofrobots)
+ - [srini100](https://github.com/srini100)
+ - [WeiranFang](https://github.com/WeiranFang)
  

README.md

@@ -1,4 +1,3 @@
-[![Build Status](https://travis-ci.org/grpc/grpc-node.svg?branch=master)](https://travis-ci.org/grpc/grpc-node)
 # gRPC on Node.js
 
 ## Implementations

doc/environment_variables.md

@@ -11,8 +11,10 @@ can be set.
   checked in order, and the first one that has a value is used.
 
 * no_grpc_proxy, no_proxy
-  A comma separated list of hostnames to connect to without using a proxy even
-  if a proxy is set. These variables are checked in order, and the first one
+  A comma separated list of hostnames, IP addresses,
+  or CIDR blocks to connect to without using a proxy even
+  if a proxy is set, for example: no_proxy=example.com,192.168.0.1,192.168.0.0/16.
+  These variables are checked in order, and the first one
   that has a value is used.
 
 * GRPC_SSL_CIPHER_SUITES
@@ -62,3 +64,8 @@ can be set.
   - INFO - log INFO and ERROR message
   - ERROR - log only errors (default)
   - NONE - won't log any
+
+* GRPC_NODE_USE_ALTERNATIVE_RESOLVER
+  Allows changing dns resolve behavior and parse DNS server authority as described in https://github.com/grpc/grpc/blob/master/doc/naming.md
+  - true - use alternative resolver
+  - false - use default resolver (default)

examples/deadline/server.js

@@ -100,8 +100,11 @@ function main() {
   });
   const server = new grpc.Server();
   server.addService(echoProto.Echo.service, serviceImplementation);
-  server.bindAsync(`0.0.0.0:${argv.port}`, grpc.ServerCredentials.createInsecure(), () => {
-    server.start();
+  server.bindAsync(`0.0.0.0:${argv.port}`, grpc.ServerCredentials.createInsecure(), (err, port) => {
+    if (err != null) {
+      return console.error(err);
+    }
+    console.log(`gRPC listening on ${port}`)
   });
   client = new echoProto.Echo(`localhost:${argv.port}`, grpc.credentials.createInsecure());
 }

examples/debugging/README.md

@@ -0,0 +1,27 @@
+# Debugging
+
+Currently, grpc provides two major tools to help user debug issues, which are logging and channelz.
+
+## Logs
+
+gRPC has put substantial logging instruments on critical paths of gRPC to help users debug issues. The [Environment Variables](https://github.com/grpc/grpc-node/blob/master/doc/environment_variables.md) doc describes the environment variables that control debug logging.
+
+To enable full debug logging, run the code with the following environment variables: `GRPC_TRACE=all GRPC_VERBOSITY=DEBUG`.
+
+## Channelz
+
+We also provide a runtime debugging tool, Channelz, to help users with live debugging.
+
+See the channelz blog post here ([link](https://grpc.io/blog/a-short-introduction-to-channelz/)) for details about how to use channelz service to debug live program.
+
+## Try it
+
+The example is able to showcase how logging and channelz can help with debugging. See the channelz blog post linked above for full explanation.
+
+```
+node server.js
+```
+
+```
+node client.js
+```

examples/debugging/client.js

@@ -0,0 +1,97 @@
+/*
+ *
+ * Copyright 2025 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const grpc = require('@grpc/grpc-js');
+const protoLoader = require('@grpc/proto-loader');
+const parseArgs = require('minimist');
+
+var PROTO_PATH = __dirname + '/../protos/helloworld.proto';
+
+const packageDefinition = protoLoader.loadSync(
+  PROTO_PATH,
+  {keepCase: true,
+   longs: String,
+   enums: String,
+   defaults: true,
+   oneofs: true
+  });
+var helloProto = grpc.loadPackageDefinition(packageDefinition).helloworld;
+
+function serverBindPort(server, port) {
+  return new Promise((resolve, reject) => {
+    server.bindAsync(port, grpc.ServerCredentials.createInsecure(), (error, port) => {
+      if (error) {
+        reject(error);
+      } else {
+        resolve(port);
+      }
+    })
+  });
+}
+
+const addressString = 'ipv4:///127.0.0.1:10001,127.0.0.1:10002,127.0.0.1:10003';
+
+function callSayHello(client, name) {
+  return new Promise((resolve, reject) => {
+    const deadline = new Date();
+    deadline.setMilliseconds(deadline.getMilliseconds() + 150);
+    client.sayHello({name}, {deadline}, (error, response) => {
+      if (error) {
+        reject(error);
+      } else {
+        resolve(response);
+      }
+    });
+  });
+}
+
+async function main() {
+  const argv = parseArgs(process.argv.slice(2), {
+    string: ['addr', 'name'],
+    default: {addr: 'localhost:50051', name: 'world'}
+  });
+
+  // Set up the server serving channelz service.
+  const channelzServer = new grpc.Server();
+  grpc.addAdminServicesToServer(channelzServer);
+  await serverBindPort(channelzServer, argv.addr);
+
+  const roundRobinServiceConfig = {
+    methodConfig: [],
+    loadBalancingConfig: [{ round_robin: {} }]
+  };
+  const client = new helloProto.Greeter(addressString, grpc.credentials.createInsecure(), {'grpc.service_config': JSON.stringify(roundRobinServiceConfig)});
+
+  // Contact the server and print out its response
+
+  // Make 100 SayHello RPCs
+  for (let i = 0; i < 100; i++) {
+    try {
+      const response = await callSayHello(client, argv.name);
+      console.log(`Greeting: ${response.message}`);
+    } catch (e) {
+      console.log(`could not greet: ${e.message}`);
+    }
+  }
+
+  // Unless you exit the program (e.g. CTRL+C), channelz data will be available for querying.
+	// Users can take time to examine and learn about the info provided by channelz.
+  setInterval(() => {}, 10000);
+}
+
+main();

examples/debugging/server.js

@@ -0,0 +1,79 @@
+/*
+ *
+ * Copyright 2025 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const grpc = require('@grpc/grpc-js');
+const protoLoader = require('@grpc/proto-loader');
+
+var PROTO_PATH = __dirname + '/../protos/helloworld.proto';
+
+const packageDefinition = protoLoader.loadSync(
+  PROTO_PATH,
+  {keepCase: true,
+   longs: String,
+   enums: String,
+   defaults: true,
+   oneofs: true
+  });
+var helloProto = grpc.loadPackageDefinition(packageDefinition).helloworld;
+
+const greeterImplementation = {
+  sayHello: (call, callback) => {
+    callback(null, { message: `Hello ${call.request.name}`});
+  }
+};
+
+const slowGreeterImplementation = {
+  sayHello: (call, callback) => {
+    const waitTimeMs = 100 + (Math.random() * 100)|0;
+    setTimeout(() => {
+      callback(null, { message: `Hello ${call.request.name}`});
+    }, waitTimeMs);
+  }
+}
+
+function serverBindPort(server, port) {
+  return new Promise((resolve, reject) => {
+    server.bindAsync(`0.0.0.0:${port}`, grpc.ServerCredentials.createInsecure(), (error, port) => {
+      if (error) {
+        reject(error);
+      } else {
+        resolve(port);
+      }
+    })
+  });
+}
+
+async function main() {
+  const channelzServer = new grpc.Server();
+  grpc.addAdminServicesToServer(channelzServer);
+  await serverBindPort(channelzServer, 50052);
+
+  const server1 = new grpc.Server();
+  server1.addService(helloProto.Greeter.service, greeterImplementation);
+  await serverBindPort(server1, 10001);
+
+  const server2 = new grpc.Server();
+  server2.addService(helloProto.Greeter.service, greeterImplementation);
+  await serverBindPort(server2, 10002);
+
+  const server3 = new grpc.Server();
+  server3.addService(helloProto.Greeter.service, slowGreeterImplementation);
+  await serverBindPort(server3, 10003);
+}
+
+main();

examples/helloworld/dynamic_codegen/greeter_server.js

@@ -44,8 +44,11 @@ function sayHello(call, callback) {
 function main() {
   var server = new grpc.Server();
   server.addService(hello_proto.Greeter.service, {sayHello: sayHello});
-  server.bindAsync('0.0.0.0:50051', grpc.ServerCredentials.createInsecure(), () => {
-    server.start();
+  server.bindAsync('0.0.0.0:50051', grpc.ServerCredentials.createInsecure(), (err, port) => {
+    if (err != null) {
+      return console.error(err);
+    }
+    console.log(`gRPC listening on ${port}`)
   });
 }
 

examples/helloworld/static_codegen/greeter_server.js

@@ -37,8 +37,11 @@ function sayHello(call, callback) {
 function main() {
   var server = new grpc.Server();
   server.addService(services.GreeterService, {sayHello: sayHello});
-  server.bindAsync('0.0.0.0:50051', grpc.ServerCredentials.createInsecure(), () => {
-    server.start();
+  server.bindAsync('0.0.0.0:50051', grpc.ServerCredentials.createInsecure(), (err, port) => {
+    if (err != null) {
+      return console.error(err);
+    }
+    console.log(`gRPC listening on ${port}`)
   });
 }
 

examples/interceptors/README.md

@@ -0,0 +1,120 @@
+# Interceptor
+
+Node gRPC provides simple APIs to implement and install interceptors on clients
+and servers. An interceptor intercepts the execution of each incoming/outgoing
+RPC call on the client or server where it is installed. Users can use
+interceptors to do logging, authentication/authorization, metrics collection,
+and many other functions that can be shared across RPCs.
+
+## Run the server
+
+```
+node server.js
+```
+
+## Run the client
+
+```
+node client.js
+```
+
+# Explanation
+
+In Node gRPC, clients and servers each have their own types of interceptors.
+
+## Client
+
+Node gRPC client interceptors are formally specified in [gRFC L5](https://github.com/grpc/proposal/blob/master/L5-node-client-interceptors.md).
+An interceptor is a function that can wrap a call object with an
+`InterceptingCall`, with intercepting functions for individual call operations.
+To illustrate, the following is a trivial interceptor with all interception
+methods:
+
+```js
+const interceptor = function(options, nextCall) {
+  const requester = {
+    start: function(metadata, listener, next) {
+      const listener = {
+          onReceiveMetadata: function(metadata, next) {
+            next(metadata);
+          },
+          onReceiveMessage: function(message, next) {
+            next(message);
+          },
+          onReceiveStatus: function(status, next) {
+            next(status);
+          }
+      };
+      next(metadata, listener);
+    },
+    sendMessage: function(message, next) {
+      next(messasge);
+    },
+    halfClose: function(next) {
+      next();
+    },
+    cancel: function(message, next) {
+      next();
+    }
+  };
+  return new InterceptingCall(nextCall(options), requester);
+};
+```
+
+The requester intercepts outgoing operations, and the listener intercepts
+incoming operations. Each intercepting method can read or modify the data for
+that operation before passing it along to the `next` callback.
+
+The `RequesterBuilder` and `ListenerBuilder` utility classes provide an
+alternative way to construct requester and listener objects
+
+## Server
+
+Node gRPC server interceptors are formally specified in [gRFC L112](https://github.com/grpc/proposal/blob/master/L112-node-server-interceptors.md).
+Similar to client interceptors, a server interceptor is a function that can
+wrap a call object with a `ServerInterceptingCall`, with intercepting functions
+for individual call operations. Server intercepting functions broadly mirror
+the client intercepting functions, with sending and receiving switched. To
+illustrate, the following is a trivial server interceptor with all interception
+methods:
+
+```js
+const interceptor = function(methodDescriptor, call) {
+  const responder = {
+    start: function(next) {
+      const listener = {
+        onReceiveMetadata: function(metadata, next) {
+          next(metadata);
+        },
+        onReceiveMessage: function(message, next) {
+          next(message);
+        },
+        onReceiveHalfClose: function(next) {
+          next();
+        },
+        onCancel: function() {
+        }
+      };
+      next(listener);
+    },
+    sendMetadata: function(metadata, next) {
+      next(metadata);
+    },
+    sendMessage: function(message, next) {
+      next(message);
+    },
+    sendStatus: function(status, next) {
+      next(status);
+    }
+  };
+  return new ServerInterceptingCall(call, responder);
+}
+```
+
+As with client interceptors, the responder intercepts outgoing operations and
+the listener intercepts incoming operations. Each intercepting method can read
+or modify the data for that operation before passing it along to the `next`
+callback.
+
+The `ResponderBuilder` and `ServerListenerBuilder` utility classes provide an
+alternative way to build responder and server listener objects.

examples/interceptors/client.js

@@ -0,0 +1,113 @@
+/*
+ *
+ * Copyright 2024 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const grpc = require('@grpc/grpc-js');
+const protoLoader = require('@grpc/proto-loader');
+const parseArgs = require('minimist');
+
+const PROTO_PATH = __dirname + '/../protos/echo.proto';
+
+const packageDefinition = protoLoader.loadSync(
+  PROTO_PATH,
+  {keepCase: true,
+   longs: String,
+   enums: String,
+   defaults: true,
+   oneofs: true
+  });
+const echoProto = grpc.loadPackageDefinition(packageDefinition).grpc.examples.echo;
+
+function authInterceptor(options, nextCall) {
+  const requester = (new grpc.RequesterBuilder())
+    .withStart((metadata, listener, next) => {
+      metadata.set('authorization', 'some-secret-token');
+      next(metadata, listener);
+    }).build();
+  return new grpc.InterceptingCall(nextCall(options), requester);
+}
+
+// logger is to mock a sophisticated logging system. To simplify the example, we just print out the content.
+function logger(format, ...args) {
+  console.log(`LOG (client):\t${format}\n`, ...args);
+}
+
+function loggingInterceptor(options, nextCall) {
+  const listener = (new grpc.ListenerBuilder())
+    .withOnReceiveMessage((message, next) => {
+      logger(`Receive a message ${JSON.stringify(message)} at ${(new Date()).toISOString()}`);
+      next(message);
+    }).build();
+  const requester = (new grpc.RequesterBuilder())
+    .withSendMessage((message, next) => {
+      logger(`Send a message ${JSON.stringify(message)} at ${(new Date()).toISOString()}`);
+      next(message);
+    }).build();
+  return new grpc.InterceptingCall(nextCall(options), requester);
+}
+
+function callUnaryEcho(client, message) {
+  return new Promise((resolve, reject) => {
+    const deadline = new Date();
+    deadline.setSeconds(deadline.getSeconds() + 10);
+    client.unaryEcho({message: message}, {deadline}, (error, value) => {
+      if (error) {
+        reject(error);
+        return;
+      }
+      console.log(`UnaryEcho: ${JSON.stringify(value)}`);
+      resolve();
+    });
+  });
+}
+
+function callBidiStreamingEcho(client) {
+  return new Promise((resolve, reject) => {
+    const deadline = new Date();
+    deadline.setSeconds(deadline.getSeconds() + 10);
+    const call = client.bidirectionalStreamingEcho({deadline});
+    call.on('data', value => {
+      console.log(`BidiStreamingEcho: ${JSON.stringify(value)}`);
+    });
+    call.on('status', status => {
+      if (status.code === grpc.status.OK) {
+        resolve();
+      } else {
+        reject(status);
+      }
+    });
+    call.on('error', () => {
+      // Ignore error event
+    });
+    for (let i = 0; i < 5; i++) {
+      call.write({message: `Request ${i + 1}`});
+    }
+    call.end();
+  });
+}
+
+async function main() {
+  let argv = parseArgs(process.argv.slice(2), {
+    string: 'target',
+    default: {target: 'localhost:50051'}
+  });
+  const client = new echoProto.Echo(argv.target, grpc.credentials.createInsecure(), {interceptors: [authInterceptor, loggingInterceptor]});
+  await callUnaryEcho(client, 'hello world');
+  await callBidiStreamingEcho(client);
+}
+
+main();

examples/interceptors/server.js

@@ -0,0 +1,120 @@
+/*
+ *
+ * Copyright 2024 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const grpc = require('@grpc/grpc-js');
+const protoLoader = require('@grpc/proto-loader');
+const parseArgs = require('minimist');
+
+const PROTO_PATH = __dirname + '/../protos/echo.proto';
+
+const packageDefinition = protoLoader.loadSync(
+  PROTO_PATH,
+  {keepCase: true,
+   longs: String,
+   enums: String,
+   defaults: true,
+   oneofs: true
+  });
+const echoProto = grpc.loadPackageDefinition(packageDefinition).grpc.examples.echo;
+
+function unaryEcho(call, callback) {
+  console.log(`unary echoing message ${call.request.message}`);
+  callback(null, call.request);
+}
+
+function bidirectionalStreamingEcho(call) {
+  call.on('data', request => {
+    console.log(`bidi echoing message ${request.message}`);
+    call.write(request);
+  });
+  call.on('end', () => {
+    call.end();
+  });
+}
+
+const serviceImplementation = {
+  unaryEcho,
+  bidirectionalStreamingEcho
+}
+
+function validateAuthorizationMetadata(metadata) {
+  const authorization = metadata.get('authorization');
+  if (authorization.length < 1) {
+    return false;
+  }
+  return authorization[0] === 'some-secret-token';
+}
+
+function authInterceptor(methodDescriptor, call) {
+const listener = (new grpc.ServerListenerBuilder())
+  .withOnReceiveMetadata((metadata, next) => {
+    if (validateAuthorizationMetadata(metadata)) {
+      next(metadata);
+    } else {
+      call.sendStatus({
+        code: grpc.status.UNAUTHENTICATED,
+        details: 'Auth metadata not correct'
+      });
+    }
+  }).build();
+  const responder = (new grpc.ResponderBuilder())
+    .withStart(next => {
+        next(listener);
+    }).build();
+  return new grpc.ServerInterceptingCall(call, responder);
+}
+
+// logger is to mock a sophisticated logging system. To simplify the example, we just print out the content.
+function logger(format, ...args) {
+  console.log(`LOG (server):\t${format}\n`, ...args);
+}
+
+function loggingInterceptor(methodDescriptor, call) {
+  const listener = new grpc.ServerListenerBuilder()
+    .withOnReceiveMessage((message, next) => {
+      logger(`Receive a message ${JSON.stringify(message)} at ${(new Date()).toISOString()}`);
+      next(message);
+    }).build();
+  const responder = new grpc.ResponderBuilder()
+    .withStart(next => {
+      next(listener);
+    })
+    .withSendMessage((message, next) => {
+      logger(`Send a message ${JSON.stringify(message)} at ${(new Date()).toISOString()}`);
+      next(message);
+    }).build();
+  return new grpc.ServerInterceptingCall(call, responder);
+}
+
+function main() {
+  const argv = parseArgs(process.argv.slice(2), {
+    string: 'port',
+    default: {port: '50051'}
+  });
+  const server = new grpc.Server({interceptors: [authInterceptor, loggingInterceptor]});
+  server.addService(echoProto.Echo.service, serviceImplementation);
+  server.bindAsync(`0.0.0.0:${argv.port}`, grpc.ServerCredentials.createInsecure(), (err, port) => {
+    if (err != null) {
+      return console.error(err);
+    }
+    console.log(`gRPC listening on ${port}`)
+  });
+  client = new echoProto.Echo(`localhost:${argv.port}`, grpc.credentials.createInsecure());
+}
+
+main();

examples/keepalive/README.md

@@ -0,0 +1,16 @@
+# Keepalive
+
+This example illustrates how to set up client-side keepalive pings and
+server-side keepalive pings and connection age and idleness settings.
+
+## Start the server
+
+```
+node server.js
+```
+
+## Start the client
+
+```
+GRPC_TRACE=transport,keepalive GRPC_VERBOSITY=DEBUG node client.js
+```

examples/keepalive/client.js

@@ -0,0 +1,61 @@
+/*
+ *
+ * Copyright 2024 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const grpc = require('@grpc/grpc-js');
+const protoLoader = require('@grpc/proto-loader');
+const parseArgs = require('minimist');
+
+const PROTO_PATH = __dirname + '/../protos/echo.proto';
+
+const packageDefinition = protoLoader.loadSync(
+  PROTO_PATH,
+  {keepCase: true,
+   longs: String,
+   enums: String,
+   defaults: true,
+   oneofs: true
+  });
+const echoProto = grpc.loadPackageDefinition(packageDefinition).grpc.examples.echo;
+
+const keepaliveOptions = {
+  // Ping the server every 10 seconds to ensure the connection is still active
+  'grpc.keepalive_time_ms': 10_000,
+  // Wait 1 second for the ping ack before assuming the connection is dead
+  'grpc.keepalive_timeout_ms': 1_000,
+  // send pings even without active streams
+  'grpc.keepalive_permit_without_calls': 1
+}
+
+function main() {
+  let argv = parseArgs(process.argv.slice(2), {
+    string: 'target',
+    default: {target: 'localhost:50052'}
+  });
+  const client = new echoProto.Echo(argv.target, grpc.credentials.createInsecure(), keepaliveOptions);
+  client.unaryEcho({message: 'keepalive demo'}, (error, value) => {
+    if (error) {
+      console.log(`Unexpected error from UnaryEcho: ${error}`);
+      return;
+    }
+    console.log(`RPC response: ${JSON.stringify(value)}`);
+  });
+  // Keep process alive forever; run with GRPC_TRACE=transport,keepalive GRPC_VERBOSITY=DEBUG to observe ping frames and GOAWAYs due to idleness.
+  setInterval(() => {}, 1000);
+}
+
+main();

examples/keepalive/server.js

@@ -0,0 +1,71 @@
+/*
+ *
+ * Copyright 2024 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const grpc = require('@grpc/grpc-js');
+const protoLoader = require('@grpc/proto-loader');
+const parseArgs = require('minimist');
+
+const PROTO_PATH = __dirname + '/../protos/echo.proto';
+
+const packageDefinition = protoLoader.loadSync(
+  PROTO_PATH,
+  {keepCase: true,
+   longs: String,
+   enums: String,
+   defaults: true,
+   oneofs: true
+  });
+const echoProto = grpc.loadPackageDefinition(packageDefinition).grpc.examples.echo;
+
+const keepaliveOptions = {
+  // If a client is idle for 15 seconds, send a GOAWAY
+  'grpc.max_connection_idle_ms': 15_000,
+  // If any connection is alive for more than 30 seconds, send a GOAWAY
+  'grpc.max_connection_age_ms': 30_000,
+  // Allow 5 seconds for pending RPCs to complete before forcibly closing connections
+  'grpc.max_connection_age_grace_ms': 5_000,
+  // Ping the client every 5 seconds to ensure the connection is still active
+  'grpc.keepalive_time_ms': 5_000,
+  // Wait 1 second for the ping ack before assuming the connection is dead
+  'grpc.keepalive_timeout_ms': 1_000
+}
+
+function unaryEcho(call, callback) {
+  callback(null, call.request);
+}
+
+const serviceImplementation = {
+  unaryEcho
+};
+
+function main() {
+  const argv = parseArgs(process.argv.slice(2), {
+    string: 'port',
+    default: {port: '50052'}
+  });
+  const server = new grpc.Server(keepaliveOptions);
+  server.addService(echoProto.Echo.service, serviceImplementation);
+  server.bindAsync(`0.0.0.0:${argv.port}`, grpc.ServerCredentials.createInsecure(), (err, port) => {
+    if (err != null) {
+      return console.error(err);
+    }
+    console.log(`gRPC listening on ${port}`)
+  });
+}
+
+main();

examples/load_balancing/README.md

@@ -0,0 +1,57 @@
+# Load balancing
+
+This examples shows how `Client` can pick different load balancing policies.
+
+## Try it
+
+```
+node server.js
+```
+
+```
+node client.js
+```
+
+## Explanation
+
+Two echo servers are serving on "0.0.0.0:50051" and "0.0.0.0:50052". They will include their serving address in the response. So the server on "0.0.0.0:50051" will reply to the RPC with this is examples/load_balancing (from 0.0.0.0:50051).
+
+Two clients are created, to connect to both of these servers. Each client picks a different load balancer (using the `grpc.service_config` option): `pick_first` or `round_robin`.
+
+Note that balancers can also be switched using service config, which allows service owners (instead of client owners) to pick the balancer to use. Service config doc is available at https://github.com/grpc/grpc/blob/master/doc/service_config.md.
+
+### pick_first
+
+The first client is configured to use `pick_first`. `pick_first` tries to connect to the first address, uses it for all RPCs if it connects, or try the next address if it fails (and keep doing that until one connection is successful). Because of this, all the RPCs will be sent to the same backend. The responses received all show the same backend address.
+
+```
+this is examples/load_balancing (from 0.0.0.0:50051)
+this is examples/load_balancing (from 0.0.0.0:50051)
+this is examples/load_balancing (from 0.0.0.0:50051)
+this is examples/load_balancing (from 0.0.0.0:50051)
+this is examples/load_balancing (from 0.0.0.0:50051)
+this is examples/load_balancing (from 0.0.0.0:50051)
+this is examples/load_balancing (from 0.0.0.0:50051)
+this is examples/load_balancing (from 0.0.0.0:50051)
+this is examples/load_balancing (from 0.0.0.0:50051)
+this is examples/load_balancing (from 0.0.0.0:50051)
+```
+
+### round_robin
+
+The second client is configured to use `round_robin`. `round_robin` connects to all the addresses it sees, and sends an RPC to each backend one at a time in order. E.g. the first RPC will be sent to backend-1, the second RPC will be sent to backend-2, and the third RPC will be sent to backend-1 again.
+
+```
+this is examples/load_balancing (from 0.0.0.0:50051)
+this is examples/load_balancing (from 0.0.0.0:50051)
+this is examples/load_balancing (from 0.0.0.0:50052)
+this is examples/load_balancing (from 0.0.0.0:50051)
+this is examples/load_balancing (from 0.0.0.0:50052)
+this is examples/load_balancing (from 0.0.0.0:50051)
+this is examples/load_balancing (from 0.0.0.0:50052)
+this is examples/load_balancing (from 0.0.0.0:50051)
+this is examples/load_balancing (from 0.0.0.0:50052)
+this is examples/load_balancing (from 0.0.0.0:50051)
+```
+
+Note that it's possible to see two consecutive RPC sent to the same backend. That's because `round_robin` only picks the connections ready for RPCs. So if one of the two connections is not ready for some reason, all RPCs will be sent to the ready connection.

examples/load_balancing/client.js

@@ -0,0 +1,75 @@
+/*
+ *
+ * Copyright 2025 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const grpc = require('@grpc/grpc-js');
+const protoLoader = require('@grpc/proto-loader');
+
+const PROTO_PATH = __dirname + '/../protos/echo.proto';
+
+const packageDefinition = protoLoader.loadSync(
+  PROTO_PATH,
+  {keepCase: true,
+   longs: String,
+   enums: String,
+   defaults: true,
+   oneofs: true
+  });
+const echoProto = grpc.loadPackageDefinition(packageDefinition).grpc.examples.echo;
+
+const addressString = 'ipv4:///127.0.0.1:50051,127.0.0.1:50052';
+
+function callUnaryEcho(client, message) {
+  return new Promise((resolve, reject) => {
+    const deadline = new Date();
+    deadline.setSeconds(deadline.getSeconds() + 1);
+    client.unaryEcho({message}, {deadline}, (error, response) => {
+      if (error) {
+        reject(error);
+      } else {
+        console.log(response.message);
+        resolve(response);
+      }
+    });
+  });
+}
+
+async function makeRPCs(client, count) {
+  for (let i = 0; i < count; i++) {
+    await callUnaryEcho(client, "this is examples/load_balancing");
+  }
+}
+
+async function main() {
+  // "pick_first" is the default, so there's no need to set the load balancing policy.
+  const pickFirstClient = new echoProto.Echo(addressString, grpc.credentials.createInsecure());
+  console.log("--- calling helloworld.Greeter/SayHello with pick_first ---");
+  await makeRPCs(pickFirstClient, 10);
+  console.log();
+
+  const roundRobinServiceConfig = {
+    methodConfig: [],
+    loadBalancingConfig: [{ round_robin: {} }]
+  };
+  const roundRobinClient = new echoProto.Echo(addressString, grpc.credentials.createInsecure(), {'grpc.service_config': JSON.stringify(roundRobinServiceConfig)});
+  console.log("--- calling helloworld.Greeter/SayHello with round_robin ---");
+  await makeRPCs(roundRobinClient, 10);
+  pickFirstClient.close();
+  roundRobinClient.close();
+}
+
+main();

examples/load_balancing/server.js

@@ -0,0 +1,60 @@
+/*
+ *
+ * Copyright 2025 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const grpc = require('@grpc/grpc-js');
+const protoLoader = require('@grpc/proto-loader');
+
+const PROTO_PATH = __dirname + '/../protos/echo.proto';
+
+const packageDefinition = protoLoader.loadSync(
+  PROTO_PATH,
+  {keepCase: true,
+   longs: String,
+   enums: String,
+   defaults: true,
+   oneofs: true
+  });
+const echoProto = grpc.loadPackageDefinition(packageDefinition).grpc.examples.echo;
+
+function startServer(address) {
+  return new Promise((resolve, reject) => {
+    const server = new grpc.Server();
+    server.addService(echoProto.Echo.service, {
+      unaryEcho: (call, callback) => {
+        callback(null, {message: `${call.request.message} (from ${address})`});
+      }
+    });
+    server.bindAsync(address, grpc.ServerCredentials.createInsecure(), (error, port) => {
+      if (error) {
+        reject(error);
+      } else {
+        resolve(server);
+      }
+    });
+  });
+}
+
+const addresses = ['0.0.0.0:50051', '0.0.0.0:50052'];
+
+async function main() {
+  for (const address of addresses) {
+    await startServer(address)
+  }
+}
+
+main();

examples/metadata/server.js

@@ -18,6 +18,7 @@
 
 const grpc = require('@grpc/grpc-js');
 const protoLoader = require('@grpc/proto-loader');
+const parseArgs = require('minimist');
 
 const PROTO_PATH = __dirname + '/../protos/echo.proto';
 
@@ -148,8 +149,11 @@ function main() {
   });
   const server = new grpc.Server();
   server.addService(echoProto.Echo.service, serviceImplementation);
-  server.bindAsync(`0.0.0.0:${argv.port}`, grpc.ServerCredentials.createInsecure(), () => {
-    server.start();
+  server.bindAsync(`0.0.0.0:${argv.port}`, grpc.ServerCredentials.createInsecure(), (err, port) => {
+    if (err != null) {
+      return console.error(err);
+    }
+    console.log(`gRPC listening on ${port}`)
   });
 }
 

examples/package.json

@@ -5,8 +5,8 @@
     "@grpc/proto-loader": "^0.6.0",
     "async": "^1.5.2",
     "google-protobuf": "^3.0.0",
-    "@grpc/grpc-js": "^1.8.0",
-    "@grpc/grpc-js-xds": "^1.8.0",
+    "@grpc/grpc-js": "^1.10.2",
+    "@grpc/grpc-js-xds": "^1.10.0",
     "@grpc/reflection": "^1.0.0",
     "lodash": "^4.6.1",
     "minimist": "^1.2.0"

examples/retry/README.md

@@ -0,0 +1,57 @@
+# Retry
+
+This example shows how to enable and configure retry on gRPC clients.
+
+## Documentation
+
+[gRFC for client-side retry support](https://github.com/grpc/proposal/blob/master/A6-client-retries.md)
+
+## Try it
+
+This example includes a service implementation that fails requests three times with status code Unavailable, then passes the fourth. The client is configured to make four retry attempts when receiving an Unavailable status code.
+
+First start the server:
+
+```
+node server.js
+```
+
+Then run the client:
+
+```
+node client.js
+```
+
+## Usage
+
+### Define your retry policy
+
+Retry is configured via the service config, which can be provided by the name resolver, or as a channel option (described below). In the below example, we set the retry policy for the "grpc.example.echo.Echo" method.
+
+```js
+const serviceConfig = {
+  loadBalancingConfig: [],
+  methodConfig: [
+    {
+      name: [
+        {
+          service: 'grpc.examples.echo.Echo',
+        },
+      ],
+      retryPolicy: {
+        maxAttempts: 4,
+        initialBackoff: '0.01s',
+        maxBackoff: '0.01s',
+        backoffMultiplier: 1.0,
+        retryableStatusCodes: ['UNAVAILABLE'],
+      },
+    },
+  ],
+};
+```
+
+### Providing the retry policy as a channel option
+
+```js
+const client = new Echo('localhost:50052', grpc.credentials.createInsecure(), { 'grpc.service_config': JSON.stringify(serviceConfig) });
+```

examples/retry/client.js

@@ -0,0 +1,75 @@
+/*
+ *
+ * Copyright 2025 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const grpc = require('@grpc/grpc-js');
+const protoLoader = require('@grpc/proto-loader');
+const parseArgs = require('minimist');
+
+const PROTO_PATH = __dirname + '/../protos/echo.proto';
+
+const packageDefinition = protoLoader.loadSync(
+  PROTO_PATH,
+  {keepCase: true,
+   longs: String,
+   enums: String,
+   defaults: true,
+   oneofs: true
+  });
+const echoProto = grpc.loadPackageDefinition(packageDefinition).grpc.examples.echo;
+
+const serviceConfig = {
+  loadBalancingConfig: [],
+  methodConfig: [
+    {
+      name: [
+        {
+          service: 'grpc.examples.echo.Echo',
+        },
+      ],
+      retryPolicy: {
+        maxAttempts: 4,
+        initialBackoff: '0.01s',
+        maxBackoff: '0.01s',
+        backoffMultiplier: 1.0,
+        retryableStatusCodes: ['UNAVAILABLE'],
+      },
+    },
+  ],
+};
+
+function main() {
+  let argv = parseArgs(process.argv.slice(2), {
+    string: 'target',
+    default: {target: 'localhost:50052'}
+  });
+
+	// Set up a connection to the server with service config and create the channel.
+	// However, the recommended approach is to fetch the retry configuration
+	// (which is part of the service config) from the name resolver rather than
+	// defining it on the client side.
+  const client = new echoProto.Echo('localhost:50052', grpc.credentials.createInsecure(), { 'grpc.service_config': JSON.stringify(serviceConfig) });
+  client.unaryEcho({message: 'Try and Success'}, (error, value) => {
+    if (error) {
+      console.log(`Unexpected error from UnaryEcho: ${error}`);
+      return;
+    }
+    console.log(`RPC response: ${JSON.stringify(value)}`);
+  });
+}
+
+main();

examples/retry/server.js

@@ -0,0 +1,73 @@
+/*
+ *
+ * Copyright 2025 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const grpc = require('@grpc/grpc-js');
+const protoLoader = require('@grpc/proto-loader');
+const parseArgs = require('minimist');
+
+const PROTO_PATH = __dirname + '/../protos/echo.proto';
+
+const packageDefinition = protoLoader.loadSync(
+  PROTO_PATH,
+  {keepCase: true,
+   longs: String,
+   enums: String,
+   defaults: true,
+   oneofs: true
+  });
+const echoProto = grpc.loadPackageDefinition(packageDefinition).grpc.examples.echo;
+
+const SUCCEED_EVERY = 4
+let callCount = 0;
+
+/* This method will succeed every SUCCEED_EVERY calls, and fail all others with status code
+ * UNAVAILABLE. */
+function unaryEcho(call, callback) {
+  callCount++;
+  if (callCount % SUCCEED_EVERY === 0) {
+    console.log(`Request succeeded count: ${callCount}`);
+    callback(null, call.request);
+  } else {
+    console.log(`Request failed count: ${callCount}`);
+    callback({
+      code: grpc.status.UNAVAILABLE,
+      details: 'Request failed by policy'
+    });
+  }
+}
+
+const serviceImplementation = {
+  unaryEcho
+};
+
+function main() {
+  const argv = parseArgs(process.argv.slice(2), {
+    string: 'port',
+    default: {port: '50052'}
+  });
+  const server = new grpc.Server();
+  server.addService(echoProto.Echo.service, serviceImplementation);
+  server.bindAsync(`0.0.0.0:${argv.port}`, grpc.ServerCredentials.createInsecure(), (err, port) => {
+    if (err != null) {
+      return console.error(err);
+    }
+    console.log(`gRPC listening on ${port}`)
+  });
+}
+
+main();

gulpfile.ts

@@ -23,15 +23,15 @@ import * as reflection from './packages/grpc-reflection/gulpfile';
 import * as protobuf from './packages/proto-loader/gulpfile';
 import * as internalTest from './test/gulpfile';
 
-const installAll = gulp.series(jsCore.install, healthCheck.install, protobuf.install, internalTest.install, jsXds.install, reflection.install);
+const installAll = gulp.series(protobuf.install, jsCore.install, healthCheck.install, reflection.install, internalTest.install, jsXds.install);
 
 const lint = gulp.parallel(jsCore.lint);
 
-const build = gulp.series(jsCore.compile, protobuf.compile, jsXds.compile);
+const build = gulp.series(protobuf.compile, jsCore.compile, jsXds.compile);
 
 const setup = gulp.series(installAll);
 
-const setupPureJSInterop = gulp.series(jsCore.install, protobuf.install, internalTest.install);
+const setupPureJSInterop = gulp.series(protobuf.install, jsCore.install, internalTest.install);
 
 const clean = gulp.series(jsCore.clean, protobuf.clean, jsXds.clean);
 
@@ -41,7 +41,7 @@ const nativeTestOnly = gulp.parallel(healthCheck.test);
 
 const nativeTest = gulp.series(build, nativeTestOnly);
 
-const testOnly = gulp.parallel(jsCore.test, nativeTestOnly, protobuf.test, jsXds.test, reflection.test);
+const testOnly = gulp.series(jsCore.test, nativeTestOnly, protobuf.test, jsXds.test, reflection.test);
 
 const test = gulp.series(build, testOnly, internalTest.test);
 

package.json

@@ -20,14 +20,13 @@
     "del": "^3.0.0",
     "execa": "^0.8.0",
     "gulp": "^4.0.1",
-    "gulp-jsdoc3": "^1.0.1",
     "gulp-jshint": "^2.0.4",
     "gulp-mocha": "^4.3.1",
     "gulp-sourcemaps": "^2.6.1",
     "gulp-tslint": "^8.1.1",
     "gulp-typescript": "^3.2.2",
     "gulp-util": "^3.0.8",
-    "jsdoc": "^3.3.2",
+    "jsdoc": "^4.0.3",
     "jshint": "^2.9.5",
     "make-dir": "^1.1.0",
     "merge2": "^1.1.0",

packages/grpc-health-check/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grpc-health-check",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "author": "Google Inc.",
   "description": "Health check client and service for use with gRPC-node",
   "repository": {
@@ -21,7 +21,7 @@
     "generate-test-types": "proto-loader-gen-types --keepCase --longs String --enums String --defaults --oneofs --includeComments --includeDirs proto/ -O test/generated --grpcLib=@grpc/grpc-js health/v1/health.proto"
   },
   "dependencies": {
-    "@grpc/proto-loader": "^0.7.10"
+    "@grpc/proto-loader": "^0.7.13"
   },
   "files": [
     "LICENSE",
@@ -35,6 +35,7 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "@grpc/grpc-js": "file:../grpc-js",
+    "@types/mocha": "^10.0.10",
     "typescript": "^5.2.2"
   }
 }

packages/grpc-health-check/proto/health/v1/health.proto

@@ -25,6 +25,13 @@ option java_multiple_files = true;
 option java_outer_classname = "HealthProto";
 option java_package = "io.grpc.health.v1";
 
+message HealthListRequest {}
+
+message HealthListResponse {
+  // statuses contains all the services and their respective status.
+  map<string, HealthCheckResponse> statuses = 1;
+}
+
 message HealthCheckRequest {
   string service = 1;
 }
@@ -70,4 +77,17 @@ service Health {
   // call.  If the call terminates with any other status (including OK),
   // clients should retry the call with appropriate exponential backoff.
   rpc Watch(HealthCheckRequest) returns (stream HealthCheckResponse);
+
+  // List provides a non-atomic snapshot of the health of all the available
+  // services.
+  //
+  // The server may respond with a RESOURCE_EXHAUSTED error if too many services
+  // exist.
+  //
+  // Clients should set a deadline when calling List, and can declare the server
+  // unhealthy if they do not receive a timely response.
+  //
+  // Clients should keep in mind that the list of health services exposed by an
+  // application can change over the lifetime of the process.
+  rpc List(HealthListRequest) returns (HealthListResponse);
 }

packages/grpc-js-xds/README.md

@@ -1,6 +1,6 @@
 # @grpc/grpc-js xDS plugin
 
-This package provides support for the `xds://` URL scheme to the `@grpc/grpc-js` library. The latest version of this package is compatible with `@grpc/grpc-js` version 1.10.x.
+This package provides support for the `xds://` URL scheme to the `@grpc/grpc-js` library. The latest version of this package is compatible with `@grpc/grpc-js` version 1.13.x.
 
 ## Installation
 
@@ -35,3 +35,5 @@ const client = new MyServiceClient('xds:///example.com:123');
  - [xDS Custom Load Balancer Configuration](https://github.com/grpc/proposal/blob/master/A52-xds-custom-lb-policies.md) (Custom load balancer registration not currently supported)
  - [xDS Ring Hash LB Policy](https://github.com/grpc/proposal/blob/master/A42-xds-ring-hash-lb-policy.md)
  - [`pick_first` via xDS](https://github.com/grpc/proposal/blob/master/A62-pick-first.md#pick_first-via-xds-1) (Currently experimental, enabled by environment variable `GRPC_EXPERIMENTAL_PICKFIRST_LB_CONFIG`)
+ - [xDS-Enabled Servers](https://github.com/grpc/proposal/blob/master/A36-xds-for-servers.md)
+ - [xDS-Based Security for gRPC Clients and Servers](https://github.com/grpc/proposal/blob/master/A29-xds-tls-security.md)

packages/grpc-js-xds/deps/envoy-api

@@ -1 +1 @@
-Subproject commit e53e7bbd012f81965f2e79848ad9a58ceb67201f
+Subproject commit f8b75d1efa92bbf534596a013d9ca5873f79dd30

packages/grpc-js-xds/gulpfile.ts

@@ -21,6 +21,10 @@ import * as mocha from 'gulp-mocha';
 import * as path from 'path';
 import * as execa from 'execa';
 import * as semver from 'semver';
+import { ncp } from 'ncp';
+import { promisify } from 'util';
+
+const ncpP = promisify(ncp);
 
 Error.stackTraceLimit = Infinity;
 
@@ -60,9 +64,14 @@ const cleanAll = gulp.parallel(clean);
  */
 const compile = checkTask(() => execNpmCommand('compile'));
 
+const copyTestFixtures = checkTask(() =>
+  ncpP(`${jsCoreDir}/test/fixtures`, `${outDir}/test/fixtures`)
+);
+
 const runTests = checkTask(() => {
   process.env.GRPC_EXPERIMENTAL_XDS_FEDERATION = 'true';
   process.env.GRPC_EXPERIMENTAL_PICKFIRST_LB_CONFIG = 'true';
+  process.env.GRPC_XDS_EXPERIMENTAL_RBAC = 'true';
   if (Number(process.versions.node.split('.')[0]) <= 14) {
     process.env.GRPC_XDS_EXPERIMENTAL_ENABLE_RING_HASH = 'false';
   }
@@ -71,7 +80,7 @@ const runTests = checkTask(() => {
                  require: ['ts-node/register']}));
 });
 
-const test = gulp.series(install, runTests);
+const test = gulp.series(install, copyTestFixtures, runTests);
 
 export {
   install,

packages/grpc-js-xds/interop/test-client.Dockerfile

@@ -14,7 +14,7 @@
 
 # Dockerfile for building the xDS interop client. To build the image, run the
 # following command from grpc-node directory:
-# docker build -t <TAG> -f packages/grpc-js-xds/interop/Dockerfile .
+# docker build -t <TAG> -f packages/grpc-js-xds/interop/test-client.Dockerfile .
 
 FROM node:18-slim as build
 
@@ -22,17 +22,27 @@ FROM node:18-slim as build
 WORKDIR /node/src/grpc-node
 COPY . .
 
+WORKDIR /node/src/grpc-node/packages/proto-loader
+RUN npm install
 WORKDIR /node/src/grpc-node/packages/grpc-js
 RUN npm install
+WORKDIR /node/src/grpc-node/packages/grpc-health-check
+RUN npm install
+WORKDIR /node/src/grpc-node/packages/grpc-reflection
+RUN npm install
 WORKDIR /node/src/grpc-node/packages/grpc-js-xds
 RUN npm install
 
 FROM gcr.io/distroless/nodejs18-debian11:latest
 WORKDIR /node/src/grpc-node
+COPY --from=build /node/src/grpc-node/packages/proto-loader ./packages/proto-loader/
+COPY --from=build /node/src/grpc-node/packages/grpc-health-check ./packages/grpc-health-check/
+COPY --from=build /node/src/grpc-node/packages/grpc-reflection ./packages/grpc-reflection/
 COPY --from=build /node/src/grpc-node/packages/grpc-js ./packages/grpc-js/
 COPY --from=build /node/src/grpc-node/packages/grpc-js-xds ./packages/grpc-js-xds/
 
 ENV GRPC_VERBOSITY="DEBUG"
-ENV GRPC_TRACE=xds_client,xds_resolver,xds_cluster_manager,cds_balancer,xds_cluster_resolver,xds_cluster_impl,priority,weighted_target,round_robin,resolving_load_balancer,subchannel,keepalive,dns_resolver,fault_injection,http_filter,csds,outlier_detection,server,server_call,ring_hash
+ENV GRPC_TRACE=xds_client,xds_resolver,xds_cluster_manager,cds_balancer,xds_cluster_resolver,xds_cluster_impl,priority,weighted_target,round_robin,resolving_load_balancer,subchannel,keepalive,dns_resolver,fault_injection,http_filter,csds,outlier_detection,server,server_call,ring_hash,transport,certificate_provider,xds_channel_credentials
+ENV NODE_XDS_INTEROP_VERBOSITY=1
 
 ENTRYPOINT [ "/nodejs/bin/node", "/node/src/grpc-node/packages/grpc-js-xds/build/interop/xds-interop-client" ]

packages/grpc-js-xds/interop/test-server.Dockerfile

@@ -0,0 +1,54 @@
+# Copyright 2022 gRPC authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Dockerfile for building the xDS interop client. To build the image, run the
+# following command from grpc-node directory:
+# docker build -t <TAG> -f packages/grpc-js-xds/interop/test-server.Dockerfile .
+
+FROM node:18-slim as build
+
+# Make a grpc-node directory and copy the repo into it.
+WORKDIR /node/src/grpc-node
+COPY . .
+
+WORKDIR /node/src/grpc-node/packages/proto-loader
+RUN npm install
+WORKDIR /node/src/grpc-node/packages/grpc-js
+RUN npm install
+WORKDIR /node/src/grpc-node/packages/grpc-health-check
+RUN npm install
+WORKDIR /node/src/grpc-node/packages/grpc-reflection
+RUN npm install
+WORKDIR /node/src/grpc-node/packages/grpc-js-xds
+RUN npm install
+
+ENV TINI_VERSION v0.19.0
+ADD https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini /tini
+RUN chmod +x /tini
+
+FROM gcr.io/distroless/nodejs18-debian11:latest
+WORKDIR /node/src/grpc-node
+COPY --from=build /node/src/grpc-node/packages/proto-loader ./packages/proto-loader/
+COPY --from=build /node/src/grpc-node/packages/grpc-health-check ./packages/grpc-health-check/
+COPY --from=build /node/src/grpc-node/packages/grpc-reflection ./packages/grpc-reflection/
+COPY --from=build /node/src/grpc-node/packages/grpc-js ./packages/grpc-js/
+COPY --from=build /node/src/grpc-node/packages/grpc-js-xds ./packages/grpc-js-xds/
+
+ENV GRPC_VERBOSITY="DEBUG"
+ENV GRPC_TRACE=xds_client,server,xds_server,http_filter,certificate_provider,rbac_filter
+
+# tini serves as PID 1 and enables the server to properly respond to signals.
+COPY --from=build /tini /tini
+
+ENTRYPOINT [ "/tini", "-g", "-vv", "--", "/nodejs/bin/node", "/node/src/grpc-node/packages/grpc-js-xds/build/interop/xds-interop-server" ]

packages/grpc-js-xds/interop/xds-interop-client.ts

@@ -41,6 +41,8 @@ import PickResult = grpc.experimental.PickResult;
 import PickResultType = grpc.experimental.PickResultType;
 import createChildChannelControlHelper = grpc.experimental.createChildChannelControlHelper;
 import parseLoadBalancingConfig = grpc.experimental.parseLoadBalancingConfig;
+import StatusOr = grpc.experimental.StatusOr;
+import { ChannelOptions } from '@grpc/grpc-js';
 
 grpc_xds.register();
 
@@ -88,23 +90,23 @@ const RPC_BEHAVIOR_CHILD_CONFIG = parseLoadBalancingConfig({round_robin: {}});
 class RpcBehaviorLoadBalancer implements LoadBalancer {
   private child: ChildLoadBalancerHandler;
   private latestConfig: RpcBehaviorLoadBalancingConfig | null = null;
-  constructor(channelControlHelper: ChannelControlHelper, options: grpc.ChannelOptions) {
+  constructor(channelControlHelper: ChannelControlHelper) {
     const childChannelControlHelper = createChildChannelControlHelper(channelControlHelper, {
-      updateState: (connectivityState, picker) => {
+      updateState: (connectivityState, picker, errorMessage) => {
         if (connectivityState === grpc.connectivityState.READY && this.latestConfig) {
           picker = new RpcBehaviorPicker(picker, this.latestConfig.getRpcBehavior());
         }
-        channelControlHelper.updateState(connectivityState, picker);
+        channelControlHelper.updateState(connectivityState, picker, errorMessage);
       }
     });
-    this.child = new ChildLoadBalancerHandler(childChannelControlHelper, options);
+    this.child = new ChildLoadBalancerHandler(childChannelControlHelper);
   }
-  updateAddressList(endpointList: Endpoint[], lbConfig: TypedLoadBalancingConfig, attributes: { [key: string]: unknown; }): void {
+  updateAddressList(endpointList: StatusOr<Endpoint[]>, lbConfig: TypedLoadBalancingConfig, options: ChannelOptions, resolutionNote: string): boolean {
     if (!(lbConfig instanceof RpcBehaviorLoadBalancingConfig)) {
-      return;
+      return false;
     }
     this.latestConfig = lbConfig;
-    this.child.updateAddressList(endpointList, RPC_BEHAVIOR_CHILD_CONFIG, attributes);
+    return this.child.updateAddressList(endpointList, RPC_BEHAVIOR_CHILD_CONFIG, options, resolutionNote);
   }
   exitIdle(): void {
     this.child.exitIdle();
@@ -518,7 +520,9 @@ function main() {
      * channels do not share any subchannels. It does not have any
      * inherent function. */
     console.log(`Interop client channel ${i} starting sending ${argv.qps} QPS to ${argv.server}`);
-    sendConstantQps(new loadedProto.grpc.testing.TestService(argv.server, grpc.credentials.createInsecure(), {'unique': i}),
+    const insecureCreds = grpc.credentials.createInsecure();
+    const creds = new grpc_xds.XdsChannelCredentials(insecureCreds);
+    sendConstantQps(new loadedProto.grpc.testing.TestService(argv.server, creds, {'unique': i}),
       argv.qps,
       argv.fail_on_failed_rpcs === 'true',
       callStatsTracker);

packages/grpc-js-xds/interop/xds-interop-server.ts

@@ -0,0 +1,314 @@
+/*
+ * Copyright 2020 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+import * as grpc from '@grpc/grpc-js';
+
+import * as grpc_xds from '../src';
+
+import { ProtoGrpcType } from './generated/test';
+
+import * as protoLoader from '@grpc/proto-loader';
+import * as yargs from 'yargs';
+import * as os from 'os';
+import { HealthImplementation } from 'grpc-health-check';
+import { Empty__Output, Empty } from './generated/grpc/testing/Empty';
+import { SimpleRequest__Output } from './generated/grpc/testing/SimpleRequest';
+import { SimpleResponse } from './generated/grpc/testing/SimpleResponse';
+import { ReflectionService } from '@grpc/reflection';
+
+grpc_xds.register();
+
+const packageDefinition = protoLoader.loadSync('grpc/testing/test.proto', {
+  keepCase: true,
+  defaults: true,
+  oneofs: true,
+  json: true,
+  longs: String,
+  enums: String,
+  includeDirs: [__dirname + '/../../proto']
+});
+
+const loadedProto = grpc.loadPackageDefinition(packageDefinition) as unknown as ProtoGrpcType;
+
+function setAsyncTimeout(delayMs: number): Promise<void> {
+  return new Promise<void>(resolve => {
+    setTimeout(() => {
+      resolve();
+    }, delayMs);
+  });
+}
+
+const HOSTNAME = os.hostname();
+
+const TEST_SERVICE_NAME = '/grpc.testing.TestService/';
+
+function testInfoInterceptor(methodDescriptor: grpc.ServerMethodDefinition<any, any>, call: grpc.ServerInterceptingCallInterface) {
+  const listener: grpc.ServerListener = {
+    onReceiveMetadata: async (metadata, next) => {
+      let attemptNum = 0;
+      const attemptNumHeader = metadata.get('grpc-previous-rpc-attempts');
+      if (attemptNumHeader.length > 0) {
+        attemptNum = Number(attemptNumHeader[0]);
+        if (Number.isNaN(attemptNum)) {
+          call.sendStatus({
+            code: grpc.status.INVALID_ARGUMENT,
+            details: 'Invalid format for grpc-previous-rpc-attempts header: ' + attemptNumHeader[0]
+          });
+          return;
+        }
+      }
+      const rpcBehavior = metadata.get('rpc-behavior').filter(v => typeof v === 'string').join(',');
+      for (const value of rpcBehavior.split(',')) {
+        let behaviorEntry: string;
+        if (value.startsWith('hostname=')) {
+          const splitValue = value.split(' ');
+          if (splitValue.length > 1) {
+            if (splitValue[0].substring('hostname='.length) !== HOSTNAME) {
+              continue;
+            }
+            behaviorEntry = splitValue[1];
+          } else {
+            call.sendStatus({
+              code: grpc.status.INVALID_ARGUMENT,
+              details: 'Invalid format for rpc-behavior header: ' + value
+            });
+            return;
+          }
+        } else {
+          behaviorEntry = value;
+        }
+        if (behaviorEntry.startsWith('sleep-')) {
+          const delaySec = Number(behaviorEntry.substring('sleep-'.length));
+          if (Number.isNaN(delaySec)) {
+            call.sendStatus({
+              code: grpc.status.INVALID_ARGUMENT,
+              details: 'Invalid format for rpc-behavior header: ' + value
+            });
+            return;
+          }
+          await setAsyncTimeout(delaySec * 1000);
+        }
+        if (behaviorEntry === 'keep-open') {
+          return;
+        }
+        if (behaviorEntry.startsWith('error-code-')) {
+          const errorCode = Number(behaviorEntry.substring('error-code-'.length));
+          if (Number.isNaN(errorCode)) {
+            call.sendStatus({
+              code: grpc.status.INVALID_ARGUMENT,
+              details: 'Invalid format for rpc-behavior header: ' + value
+            });
+            return;
+          }
+          call.sendStatus({
+            code: errorCode,
+            details: 'RPC failed as directed by rpc-behavior header value ' + value
+          });
+          return;
+        }
+        if (behaviorEntry.startsWith('succeed-on-retry-attempt-')) {
+          const targetAttempt = Number(behaviorEntry.substring('succeed-on-retry-attempt-'.length));
+          if (Number.isNaN(targetAttempt)) {
+            call.sendStatus({
+              code: grpc.status.INVALID_ARGUMENT,
+              details: 'Invalid format for rpc-behavior header: ' + value
+            });
+            return;
+          }
+          if (attemptNum === targetAttempt) {
+            next(metadata);
+            return;
+          }
+        }
+      }
+      next(metadata);
+    }
+  };
+  const responder: grpc.Responder = {
+    start: next => {
+      next(listener);
+    },
+    sendMetadata: (metadata, next) => {
+      metadata.add('hostname', HOSTNAME);
+      next(metadata);
+    }
+  }
+  return new grpc.ServerInterceptingCall(call, responder);
+};
+
+function adminServiceInterceptor(methodDescriptor: grpc.ServerMethodDefinition<any, any>, call: grpc.ServerInterceptingCallInterface): grpc.ServerInterceptingCall {
+  const listener: grpc.ServerListener = {
+    onReceiveMessage: (message, next) => {
+      console.log(`Received request to method ${methodDescriptor.path}: ${JSON.stringify(message)}`);
+      next(message);
+    }
+  }
+  const responder: grpc.Responder = {
+    start: next => {
+      next(listener);
+    },
+    sendMessage: (message, next) => {
+      console.log(`Responded to request to method ${methodDescriptor.path}: ${JSON.stringify(message)}`);
+      next(message);
+    }
+  };
+  return new grpc.ServerInterceptingCall(call, responder);
+}
+
+function unifiedInterceptor(methodDescriptor: grpc.ServerMethodDefinition<any, any>, call: grpc.ServerInterceptingCallInterface): grpc.ServerInterceptingCall {
+  if (methodDescriptor.path.startsWith(TEST_SERVICE_NAME)) {
+    return testInfoInterceptor(methodDescriptor, call);
+  } else {
+    return adminServiceInterceptor(methodDescriptor, call);
+  }
+}
+
+const testServiceHandler = {
+  EmptyCall: (call: grpc.ServerUnaryCall<Empty__Output, Empty>, callback: grpc.sendUnaryData<Empty>) => {
+    callback(null, {});
+  },
+  UnaryCall: (call: grpc.ServerUnaryCall<SimpleRequest__Output, SimpleResponse>, callback: grpc.sendUnaryData<SimpleResponse>) => {
+    callback(null, {
+      hostname: HOSTNAME,
+      payload: {
+        body: Buffer.from('0'.repeat(call.request.response_size))
+      }
+    });
+  }
+};
+
+function serverBindPromise(server: grpc.Server, port: string, credentials: grpc.ServerCredentials): Promise<number> {
+  return new Promise((resolve, reject) => {
+    server.bindAsync(port, credentials, (error, port) => {
+      if (error) {
+        reject(error);
+      } else {
+        resolve(port);
+      }
+    })
+  })
+}
+
+function getIPv4Address(): string | null {
+  for (const [name, addressList] of Object.entries(os.networkInterfaces())) {
+    if (name === 'lo' || !addressList) {
+      continue;
+    }
+    for (const address of addressList) {
+      if (address.family === 'IPv4') {
+        return address.address;
+      }
+    }
+  }
+  return null;
+}
+
+function getIPv6Addresses(): string[] {
+  const ipv6Addresses: string[] = [];
+  for (const [name, addressList] of Object.entries(os.networkInterfaces())) {
+    if (name === 'lo' || !addressList) {
+      continue;
+    }
+    for (const address of addressList) {
+      if (address.family === 'IPv6') {
+        ipv6Addresses.push(address.address);
+      }
+    }
+  }
+  return ipv6Addresses;
+}
+
+async function main() {
+  const argv = yargs
+    .string(['port', 'maintenance_port', 'address_type', 'secure_mode'])
+    .demandOption(['port'])
+    .default('address_type', 'IPV4_IPV6')
+    .default('secure_mode', 'false')
+    .parse()
+    console.log('Starting xDS interop server. Args: ', argv);
+  const healthImpl = new HealthImplementation({'': 'NOT_SERVING'});
+  const xdsUpdateHealthServiceImpl = {
+    SetServing(call: grpc.ServerUnaryCall<Empty, Empty__Output>, callback: grpc.sendUnaryData<Empty__Output>) {
+      healthImpl.setStatus('', 'SERVING');
+      callback(null, {});
+    },
+    SetNotServing(call: grpc.ServerUnaryCall<Empty, Empty__Output>, callback: grpc.sendUnaryData<Empty__Output>) {
+      healthImpl.setStatus('', 'NOT_SERVING');
+      callback(null, {});
+    }
+  }
+  const reflection = new ReflectionService(packageDefinition, {
+    services: ['grpc.testing.TestService']
+  })
+  const addressType = argv.address_type.toUpperCase();
+  const secureMode = argv.secure_mode.toLowerCase() == 'true';
+  if (secureMode) {
+    if (addressType !== 'IPV4_IPV6') {
+      throw new Error('Secure mode only supports IPV4_IPV6 address type');
+    }
+    const maintenanceServer = new grpc.Server({interceptors: [adminServiceInterceptor]});
+    maintenanceServer.addService(loadedProto.grpc.testing.XdsUpdateHealthService.service, xdsUpdateHealthServiceImpl)
+    healthImpl.addToServer(maintenanceServer);
+    reflection.addToServer(maintenanceServer);
+    grpc.addAdminServicesToServer(maintenanceServer);
+
+    const server = new grpc_xds.XdsServer({interceptors: [testInfoInterceptor]});
+    server.addService(loadedProto.grpc.testing.TestService.service, testServiceHandler);
+    const xdsCreds = new grpc_xds.XdsServerCredentials(grpc.ServerCredentials.createInsecure());
+    await Promise.all([
+      serverBindPromise(maintenanceServer, `[::]:${argv.maintenance_port}`, grpc.ServerCredentials.createInsecure()),
+      serverBindPromise(server, `0.0.0.0:${argv.port}`, xdsCreds)
+    ]);
+  } else {
+    const server = new grpc.Server({interceptors: [unifiedInterceptor]});
+    server.addService(loadedProto.grpc.testing.XdsUpdateHealthService.service, xdsUpdateHealthServiceImpl);
+    healthImpl.addToServer(server);
+    reflection.addToServer(server);
+    grpc.addAdminServicesToServer(server);
+    server.addService(loadedProto.grpc.testing.TestService.service, testServiceHandler);
+    const creds = grpc.ServerCredentials.createInsecure();
+    switch (addressType) {
+      case 'IPV4_IPV6':
+        await serverBindPromise(server, `[::]:${argv.port}`, creds);
+        break;
+      case 'IPV4':
+        await serverBindPromise(server, `127.0.0.1:${argv.port}`, creds);
+        const address = getIPv4Address();
+        if (address) {
+          await serverBindPromise(server, `${address}:${argv.port}`, creds);
+        }
+        break;
+      case 'IPV6':
+        await serverBindPromise(server, `[::1]:${argv.port}`, creds);
+        for (const address of getIPv6Addresses()) {
+          try {
+            await serverBindPromise(server, `[${address}]:${argv.port}`, creds);
+          } catch (e) {
+            console.log(`Binding ${address} failed with error ${(e as Error).message}`);
+          }
+        }
+        break;
+      default:
+        throw new Error(`Unknown address type: ${argv.address_type}`);
+    }
+  }
+  healthImpl.setStatus('', 'SERVING');
+}
+
+if (require.main === module) {
+  main();
+}

packages/grpc-js-xds/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@grpc/grpc-js-xds",
-  "version": "1.10.1",
+  "version": "1.13.0",
   "description": "Plugin for @grpc/grpc-js. Adds the xds:// URL scheme and associated features.",
   "main": "build/src/index.js",
   "scripts": {
@@ -12,7 +12,7 @@
     "prepare": "npm run generate-types && npm run compile",
     "pretest": "npm run compile",
     "posttest": "npm run check",
-    "generate-types": "proto-loader-gen-types --keepCase --longs String --enums String --defaults --oneofs --includeComments --includeDirs deps/envoy-api/ deps/xds/ deps/googleapis/ deps/protoc-gen-validate/ -O src/generated/ --grpcLib @grpc/grpc-js envoy/service/discovery/v3/ads.proto envoy/service/load_stats/v3/lrs.proto envoy/config/listener/v3/listener.proto envoy/config/route/v3/route.proto envoy/config/cluster/v3/cluster.proto envoy/config/endpoint/v3/endpoint.proto envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto udpa/type/v1/typed_struct.proto xds/type/v3/typed_struct.proto envoy/extensions/filters/http/fault/v3/fault.proto envoy/service/status/v3/csds.proto envoy/extensions/load_balancing_policies/wrr_locality/v3/wrr_locality.proto envoy/extensions/load_balancing_policies/ring_hash/v3/ring_hash.proto envoy/extensions/load_balancing_policies/pick_first/v3/pick_first.proto envoy/extensions/clusters/aggregate/v3/cluster.proto",
+    "generate-types": "proto-loader-gen-types --keepCase --longs String --enums String --defaults --oneofs --includeComments --includeDirs deps/envoy-api/ deps/xds/ deps/googleapis/ deps/protoc-gen-validate/ -O src/generated/ --grpcLib @grpc/grpc-js envoy/service/discovery/v3/ads.proto envoy/service/load_stats/v3/lrs.proto envoy/config/listener/v3/listener.proto envoy/config/route/v3/route.proto envoy/config/cluster/v3/cluster.proto envoy/config/endpoint/v3/endpoint.proto envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto udpa/type/v1/typed_struct.proto xds/type/v3/typed_struct.proto envoy/extensions/filters/http/fault/v3/fault.proto envoy/service/status/v3/csds.proto envoy/extensions/load_balancing_policies/wrr_locality/v3/wrr_locality.proto envoy/extensions/load_balancing_policies/ring_hash/v3/ring_hash.proto envoy/extensions/load_balancing_policies/pick_first/v3/pick_first.proto envoy/extensions/clusters/aggregate/v3/cluster.proto envoy/extensions/transport_sockets/tls/v3/tls.proto envoy/config/rbac/v3/rbac.proto envoy/extensions/filters/http/rbac/v3/rbac.proto",
     "generate-interop-types": "proto-loader-gen-types --keep-case --longs String --enums String --defaults --oneofs --json --includeComments --includeDirs proto/ -O interop/generated --grpcLib @grpc/grpc-js grpc/testing/test.proto",
     "generate-test-types": "proto-loader-gen-types --keep-case --longs String --enums String --defaults --oneofs --json --includeComments --includeDirs proto/ -O test/generated --grpcLib @grpc/grpc-js grpc/testing/echo.proto"
   },
@@ -33,13 +33,18 @@
   "homepage": "https://github.com/grpc/grpc-node#readme",
   "devDependencies": {
     "@grpc/grpc-js": "file:../grpc-js",
+    "@grpc/proto-loader": "file:../proto-loader",
     "@types/gulp": "^4.0.6",
     "@types/gulp-mocha": "0.0.32",
     "@types/mocha": "^5.2.6",
-    "@types/node": "^13.11.1",
+    "@types/node": ">=20.11.20",
+    "@grpc/reflection": "file:../grpc-reflection",
     "@types/yargs": "^15.0.5",
+    "find-free-ports": "^3.1.1",
+    "grpc-health-check": "file:../grpc-health-check",
     "gts": "^5.0.1",
-    "typescript": "^4.9.5",
+    "ncp": "^2.0.0",
+    "typescript": "^5.1.3",
     "yargs": "^15.4.1"
   },
   "dependencies": {
@@ -50,7 +55,7 @@
     "xxhash-wasm": "^1.0.2"
   },
   "peerDependencies": {
-    "@grpc/grpc-js": "~1.10.0"
+    "@grpc/grpc-js": "~1.13.0"
   },
   "engines": {
     "node": ">=10.10.0"

packages/grpc-js-xds/scripts/psm-interop-build-node.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Copyright 2024 gRPC authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+set -eo pipefail
+
+#######################################
+# Builds test app Docker images and pushes them to GCR.
+# Called from psm_interop_kokoro_lib.sh.
+#
+# Globals:
+#   SRC_DIR: Absolute path to the source repo on Kokoro VM
+#   SERVER_IMAGE_NAME: Test server Docker image name
+#   CLIENT_IMAGE_NAME: Test client Docker image name
+#   GIT_COMMIT: SHA-1 of git commit being built
+#   DOCKER_REGISTRY: Docker registry to push to
+# Outputs:
+#   Writes the output of docker image build stdout, stderr
+#######################################
+psm::lang::build_docker_images() {
+  local client_dockerfile="packages/grpc-js-xds/interop/test-client.Dockerfile"
+  local server_dockerfile="packages/grpc-js-xds/interop/test-server.Dockerfile"
+
+  cd "${SRC_DIR}"
+  psm::tools::run_verbose git submodule update --init --recursive
+  psm::tools::run_verbose git submodule status
+
+  psm::build::docker_images_generic "${client_dockerfile}" "${server_dockerfile}"
+}

packages/grpc-js-xds/scripts/psm-interop-test-node.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Copyright 2024 gRPC authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+set -eo pipefail
+
+# Input parameters to psm:: methods of the install script.
+readonly GRPC_LANGUAGE="node"
+readonly BUILD_SCRIPT_DIR="$(dirname "$0")"
+
+# Used locally.
+readonly TEST_DRIVER_INSTALL_SCRIPT_URL="https://raw.githubusercontent.com/${TEST_DRIVER_REPO_OWNER:-grpc}/psm-interop/${TEST_DRIVER_BRANCH:-main}/.kokoro/psm_interop_kokoro_lib.sh"
+
+psm::lang::source_install_lib() {
+  echo "Sourcing test driver install script from: ${TEST_DRIVER_INSTALL_SCRIPT_URL}"
+  local install_lib
+  # Download to a tmp file.
+  install_lib="$(mktemp -d)/psm_interop_kokoro_lib.sh"
+  curl -s --retry-connrefused --retry 5 -o "${install_lib}" "${TEST_DRIVER_INSTALL_SCRIPT_URL}"
+  # Checksum.
+  if command -v sha256sum &> /dev/null; then
+    echo "Install script checksum:"
+    sha256sum "${install_lib}"
+  fi
+  source "${install_lib}"
+}
+
+psm::lang::source_install_lib
+source "${BUILD_SCRIPT_DIR}/psm-interop-build-${GRPC_LANGUAGE}.sh"
+psm::run "${PSM_TEST_SUITE}"

packages/grpc-js-xds/scripts/xds.sh

@@ -34,9 +34,18 @@ echo "source $NVM_DIR/nvm.sh" > ~/.profile
 echo "source $NVM_DIR/nvm.sh" > ~/.shrc
 export ENV=~/.shrc
 
+cd $base/../proto-loader
+npm install
+
 cd $base/../grpc-js
 npm install
 
+cd $base/../grpc-health-check
+npm install
+
+cd $base/../grpc-reflection
+npm install
+
 # grpc-js-xds has a dev dependency on "../grpc-js", so it should pull that in automatically
 cd $base
 git submodule update --init --recursive

packages/grpc-js-xds/scripts/xds_k8s_lb.sh

@@ -1,186 +0,0 @@
-#!/usr/bin/env bash
-# Copyright 2022 gRPC authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-set -eo pipefail
-
-# Constants
-readonly GITHUB_REPOSITORY_NAME="grpc-node"
-readonly TEST_DRIVER_INSTALL_SCRIPT_URL="https://raw.githubusercontent.com/${TEST_DRIVER_REPO_OWNER:-grpc}/psm-interop/${TEST_DRIVER_BRANCH:-main}/.kokoro/psm_interop_kokoro_lib.sh"
-## xDS test client Docker images
-readonly DOCKER_REGISTRY="us-docker.pkg.dev"
-readonly SERVER_IMAGE_NAME="us-docker.pkg.dev/grpc-testing/psm-interop/java-server:canonical"
-readonly CLIENT_IMAGE_NAME="us-docker.pkg.dev/grpc-testing/psm-interop/node-client"
-readonly FORCE_IMAGE_BUILD="${FORCE_IMAGE_BUILD:-0}"
-readonly BUILD_APP_PATH="packages/grpc-js-xds/interop/Dockerfile"
-readonly LANGUAGE_NAME="Node"
-
-#######################################
-# Builds test app Docker images and pushes them to GCR
-# Globals:
-#   BUILD_APP_PATH
-#   CLIENT_IMAGE_NAME: Test client Docker image name
-#   GIT_COMMIT: SHA-1 of git commit being built
-#   TESTING_VERSION: version branch under test, f.e. v1.42.x, master
-# Arguments:
-#   None
-# Outputs:
-#   Writes the output of `gcloud builds submit` to stdout, stderr
-#######################################
-build_test_app_docker_images() {
-  echo "Building ${LANGUAGE_NAME} xDS interop test app Docker images"
-
-  pushd "${SRC_DIR}"
-  docker build \
-    -f "${BUILD_APP_PATH}" \
-    -t "${CLIENT_IMAGE_NAME}:${GIT_COMMIT}" \
-    .
-
-  gcloud -q auth configure-docker "${DOCKER_REGISTRY}"
-  docker push "${CLIENT_IMAGE_NAME}:${GIT_COMMIT}"
-  if is_version_branch "${TESTING_VERSION}"; then
-    tag_and_push_docker_image "${CLIENT_IMAGE_NAME}" "${GIT_COMMIT}" "${TESTING_VERSION}"
-  fi
-  popd
-}
-
-#######################################
-# Builds test app and its docker images unless they already exist
-# Globals:
-#   CLIENT_IMAGE_NAME: Test client Docker image name
-#   GIT_COMMIT: SHA-1 of git commit being built
-#   FORCE_IMAGE_BUILD
-# Arguments:
-#   None
-# Outputs:
-#   Writes the output to stdout, stderr
-#######################################
-build_docker_images_if_needed() {
-  # Check if images already exist
-  client_tags="$(gcloud_gcr_list_image_tags "${CLIENT_IMAGE_NAME}" "${GIT_COMMIT}")"
-  printf "Client image: %s:%s\n" "${CLIENT_IMAGE_NAME}" "${GIT_COMMIT}"
-  echo "${client_tags:-Client image not found}"
-
-  # Build if any of the images are missing, or FORCE_IMAGE_BUILD=1
-  if [[ "${FORCE_IMAGE_BUILD}" == "1" || -z "${client_tags}" ]]; then
-    build_test_app_docker_images
-  else
-    echo "Skipping ${LANGUAGE_NAME} test app build"
-  fi
-}
-
-#######################################
-# Executes the test case
-# Globals:
-#   TEST_DRIVER_FLAGFILE: Relative path to test driver flagfile
-#   KUBE_CONTEXT: The name of kubectl context with GKE cluster access
-#   SECONDARY_KUBE_CONTEXT: The name of kubectl context with secondary GKE cluster access, if any
-#   TEST_XML_OUTPUT_DIR: Output directory for the test xUnit XML report
-#   CLIENT_IMAGE_NAME: Test client Docker image name
-#   GIT_COMMIT: SHA-1 of git commit being built
-# Arguments:
-#   Test case name
-# Outputs:
-#   Writes the output of test execution to stdout, stderr
-#   Test xUnit report to ${TEST_XML_OUTPUT_DIR}/${test_name}/sponge_log.xml
-#######################################
-run_test() {
-  # Test driver usage:
-  # https://github.com/grpc/grpc/tree/master/tools/run_tests/xds_k8s_test_driver#basic-usage
-  local test_name="${1:?Usage: run_test test_name}"
-  local out_dir="${TEST_XML_OUTPUT_DIR}/${test_name}"
-  mkdir -pv "${out_dir}"
-  # testing_version is used by the framework to determine the supported PSM
-  # features. It's captured from Kokoro job name of the Node repo, which takes
-  # the form:
-  #   grpc/node/<branch name>/<job name>
-  python3 -m "tests.${test_name}" \
-    --flagfile="${TEST_DRIVER_FLAGFILE}" \
-    --kube_context="${KUBE_CONTEXT}" \
-    --secondary_kube_context="${SECONDARY_KUBE_CONTEXT}" \
-    --client_image="${CLIENT_IMAGE_NAME}:${GIT_COMMIT}" \
-    --server_image="${SERVER_IMAGE_NAME}" \
-    --testing_version="${TESTING_VERSION}" \
-    --force_cleanup \
-    --collect_app_logs \
-    --log_dir="${out_dir}" \
-    --xml_output_file="${out_dir}/sponge_log.xml" \
-    |& tee "${out_dir}/sponge_log.log"
-}
-
-#######################################
-# Main function: provision software necessary to execute tests, and run them
-# Globals:
-#   KOKORO_ARTIFACTS_DIR
-#   GITHUB_REPOSITORY_NAME
-#   SRC_DIR: Populated with absolute path to the source repo
-#   TEST_DRIVER_REPO_DIR: Populated with the path to the repo containing
-#                         the test driver
-#   TEST_DRIVER_FULL_DIR: Populated with the path to the test driver source code
-#   TEST_DRIVER_FLAGFILE: Populated with relative path to test driver flagfile
-#   TEST_XML_OUTPUT_DIR: Populated with the path to test xUnit XML report
-#   GIT_ORIGIN_URL: Populated with the origin URL of git repo used for the build
-#   GIT_COMMIT: Populated with the SHA-1 of git commit being built
-#   GIT_COMMIT_SHORT: Populated with the short SHA-1 of git commit being built
-#   KUBE_CONTEXT: Populated with name of kubectl context with GKE cluster access
-#   SECONDARY_KUBE_CONTEXT: Populated with name of kubectl context with secondary GKE cluster access, if any
-# Arguments:
-#   None
-# Outputs:
-#   Writes the output of test execution to stdout, stderr
-#######################################
-main() {
-  local script_dir
-  script_dir="$(dirname "$0")"
-
-  cd "${script_dir}"
-
-  git submodule update --init --recursive
-
-  # Source the test driver from the master branch.
-  echo "Sourcing test driver install script from: ${TEST_DRIVER_INSTALL_SCRIPT_URL}"
-  source /dev/stdin <<< "$(curl -s "${TEST_DRIVER_INSTALL_SCRIPT_URL}")"
-
-  activate_gke_cluster GKE_CLUSTER_PSM_LB
-  activate_secondary_gke_cluster GKE_CLUSTER_PSM_LB
-
-  set -x
-  if [[ -n "${KOKORO_ARTIFACTS_DIR}" ]]; then
-    kokoro_setup_test_driver "${GITHUB_REPOSITORY_NAME}"
-  else
-    local_setup_test_driver "${script_dir}"
-  fi
-  build_docker_images_if_needed
-
-  # Run tests
-  cd "${TEST_DRIVER_FULL_DIR}"
-  local failed_tests=0
-  test_suites=(
-    "affinity_test"
-    "api_listener_test"
-    "baseline_test"
-    "change_backend_service_test"
-    "custom_lb_test"
-    "failover_test"
-    "outlier_detection_test"
-    "remove_neg_test"
-    "round_robin_test"
-  )
-  for test in "${test_suites[@]}"; do
-    run_test $test || (( ++failed_tests ))
-  done
-  echo "Failed test suites: ${failed_tests}"
-}
-
-main "$@"

packages/grpc-js-xds/scripts/xds_k8s_url_map.sh

@@ -1,163 +0,0 @@
-#!/usr/bin/env bash
-# Copyright 2022 gRPC authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-set -eo pipefail
-
-# Constants
-readonly GITHUB_REPOSITORY_NAME="grpc-node"
-readonly TEST_DRIVER_INSTALL_SCRIPT_URL="https://raw.githubusercontent.com/${TEST_DRIVER_REPO_OWNER:-grpc}/psm-interop/${TEST_DRIVER_BRANCH:-main}/.kokoro/psm_interop_kokoro_lib.sh"
-## xDS test client Docker images
-readonly DOCKER_REGISTRY="us-docker.pkg.dev"
-readonly CLIENT_IMAGE_NAME="us-docker.pkg.dev/grpc-testing/psm-interop/node-client"
-readonly FORCE_IMAGE_BUILD="${FORCE_IMAGE_BUILD:-0}"
-readonly BUILD_APP_PATH="packages/grpc-js-xds/interop/Dockerfile"
-readonly LANGUAGE_NAME="Node"
-
-#######################################
-# Builds test app Docker images and pushes them to GCR
-# Globals:
-#   BUILD_APP_PATH
-#   CLIENT_IMAGE_NAME: Test client Docker image name
-#   GIT_COMMIT: SHA-1 of git commit being built
-#   TESTING_VERSION: version branch under test, f.e. v1.42.x, master
-# Arguments:
-#   None
-# Outputs:
-#   Writes the output of `gcloud builds submit` to stdout, stderr
-#######################################
-build_test_app_docker_images() {
-  echo "Building ${LANGUAGE_NAME} xDS interop test app Docker images"
-
-  pushd "${SRC_DIR}"
-  docker build \
-    -f "${BUILD_APP_PATH}" \
-    -t "${CLIENT_IMAGE_NAME}:${GIT_COMMIT}" \
-    .
-
-  gcloud -q auth configure-docker "${DOCKER_REGISTRY}"
-  docker push "${CLIENT_IMAGE_NAME}:${GIT_COMMIT}"
-  if is_version_branch "${TESTING_VERSION}"; then
-    tag_and_push_docker_image "${CLIENT_IMAGE_NAME}" "${GIT_COMMIT}" "${TESTING_VERSION}"
-  fi
-  popd
-}
-
-#######################################
-# Builds test app and its docker images unless they already exist
-# Globals:
-#   CLIENT_IMAGE_NAME: Test client Docker image name
-#   GIT_COMMIT: SHA-1 of git commit being built
-#   FORCE_IMAGE_BUILD
-# Arguments:
-#   None
-# Outputs:
-#   Writes the output to stdout, stderr
-#######################################
-build_docker_images_if_needed() {
-  # Check if images already exist
-  client_tags="$(gcloud_gcr_list_image_tags "${CLIENT_IMAGE_NAME}" "${GIT_COMMIT}")"
-  printf "Client image: %s:%s\n" "${CLIENT_IMAGE_NAME}" "${GIT_COMMIT}"
-  echo "${client_tags:-Client image not found}"
-
-  # Build if any of the images are missing, or FORCE_IMAGE_BUILD=1
-  if [[ "${FORCE_IMAGE_BUILD}" == "1" || -z "${client_tags}" ]]; then
-    build_test_app_docker_images
-  else
-    echo "Skipping ${LANGUAGE_NAME} test app build"
-  fi
-}
-
-#######################################
-# Executes the test case
-# Globals:
-#   TEST_DRIVER_FLAGFILE: Relative path to test driver flagfile
-#   KUBE_CONTEXT: The name of kubectl context with GKE cluster access
-#   TEST_XML_OUTPUT_DIR: Output directory for the test xUnit XML report
-#   CLIENT_IMAGE_NAME: Test client Docker image name
-#   GIT_COMMIT: SHA-1 of git commit being built
-#   TESTING_VERSION: version branch under test: used by the framework to determine the supported PSM
-#                    features.
-# Arguments:
-#   Test case name
-# Outputs:
-#   Writes the output of test execution to stdout, stderr
-#   Test xUnit report to ${TEST_XML_OUTPUT_DIR}/${test_name}/sponge_log.xml
-#######################################
-run_test() {
-  # Test driver usage:
-  # https://github.com/grpc/grpc/tree/master/tools/run_tests/xds_k8s_test_driver#basic-usage
-  local test_name="${1:?Usage: run_test test_name}"
-  local out_dir="${TEST_XML_OUTPUT_DIR}/${test_name}"
-  mkdir -pv "${out_dir}"
-  set -x
-  python3 -m "tests.${test_name}" \
-    --flagfile="${TEST_DRIVER_FLAGFILE}" \
-    --flagfile="config/url-map.cfg" \
-    --kube_context="${KUBE_CONTEXT}" \
-    --client_image="${CLIENT_IMAGE_NAME}:${GIT_COMMIT}" \
-    --testing_version="${TESTING_VERSION}" \
-    --collect_app_logs \
-    --log_dir="${out_dir}" \
-    --xml_output_file="${out_dir}/sponge_log.xml" \
-    |& tee "${out_dir}/sponge_log.log"
-}
-
-#######################################
-# Main function: provision software necessary to execute tests, and run them
-# Globals:
-#   KOKORO_ARTIFACTS_DIR
-#   GITHUB_REPOSITORY_NAME
-#   SRC_DIR: Populated with absolute path to the source repo
-#   TEST_DRIVER_REPO_DIR: Populated with the path to the repo containing
-#                         the test driver
-#   TEST_DRIVER_FULL_DIR: Populated with the path to the test driver source code
-#   TEST_DRIVER_FLAGFILE: Populated with relative path to test driver flagfile
-#   TEST_XML_OUTPUT_DIR: Populated with the path to test xUnit XML report
-#   GIT_ORIGIN_URL: Populated with the origin URL of git repo used for the build
-#   GIT_COMMIT: Populated with the SHA-1 of git commit being built
-#   GIT_COMMIT_SHORT: Populated with the short SHA-1 of git commit being built
-#   KUBE_CONTEXT: Populated with name of kubectl context with GKE cluster access
-# Arguments:
-#   None
-# Outputs:
-#   Writes the output of test execution to stdout, stderr
-#######################################
-main() {
-  local script_dir
-  script_dir="$(dirname "$0")"
-
-  cd "${script_dir}"
-
-  git submodule update --init --recursive
-
-  # Source the test driver from the master branch.
-  echo "Sourcing test driver install script from: ${TEST_DRIVER_INSTALL_SCRIPT_URL}"
-  source /dev/stdin <<< "$(curl -s "${TEST_DRIVER_INSTALL_SCRIPT_URL}")"
-
-  activate_gke_cluster GKE_CLUSTER_PSM_BASIC
-
-  set -x
-  if [[ -n "${KOKORO_ARTIFACTS_DIR}" ]]; then
-    kokoro_setup_test_driver "${GITHUB_REPOSITORY_NAME}"
-  else
-    local_setup_test_driver "${script_dir}"
-  fi
-  build_docker_images_if_needed
-  # Run tests
-  cd "${TEST_DRIVER_FULL_DIR}"
-  run_test url_map || echo "Failed url_map test"
-}
-
-main "$@"

packages/grpc-js-xds/src/cidr.ts

@@ -0,0 +1,192 @@
+/*
+ * Copyright 2024 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import * as net from 'net';
+import { CidrRange__Output } from './generated/envoy/config/core/v3/CidrRange';
+
+const IPV4_COMPONENT_COUNT = 4n;
+const IPV4_COMPONENT_SIZE = 8n;
+const IPV4_COMPONENT_CAP = 1n << IPV4_COMPONENT_SIZE;
+const IPV4_TOTAL_SIZE = IPV4_COMPONENT_COUNT * IPV4_COMPONENT_SIZE;
+const IPV6_COMPONENT_SIZE = 16n;
+const IPV6_COMPONENT_COUNT = 8n;
+const IPV6_COMPONENT_CAP = 1n << IPV6_COMPONENT_SIZE;
+const IPV6_TOTAL_SIZE = IPV6_COMPONENT_COUNT * IPV6_COMPONENT_SIZE;
+
+export interface CidrRange {
+  addressPrefix: string;
+  prefixLen: number;
+}
+
+export function parseIPv4(address: string): bigint {
+  return address.split('.').map(component => BigInt(component)).reduce((accumulator, current) => accumulator * IPV4_COMPONENT_CAP + current, 0n);
+}
+
+export function parseIPv6(address: string): bigint {
+  /* If an IPv6 address contains two or more consecutive components with value
+   * which can be collectively represented with the string '::'. For example,
+   * the IPv6 adddress 0:0:0:0:0:0:0:1 can also be represented as ::1. Here we
+   * expand any :: into the correct number of individual components. */
+  const sections = address.split('::');
+  let components: string[];
+  if (sections.length === 1) {
+    components = sections[0].split(':');
+  } else if (sections.length === 2) {
+    const beginning = sections[0].split(':').filter(value => value !== '');
+    const end = sections[1].split(':').filter(value => value !== '');
+    components = beginning.concat(Array(8 - beginning.length - end.length).fill('0'), end);
+  } else {
+    throw new Error('Invalid IPv6 address contains more than one instance of ::');
+  }
+  return components.map(component => BigInt('0x' + component)).reduce((accumulator, current) => accumulator * 65536n + current, 0n);
+}
+
+function parseIP(address: string): bigint {
+  switch (net.isIP(address)) {
+    case 4:
+      return parseIPv4(address);
+    case 6:
+      return parseIPv6(address);
+    default:
+      throw new Error(`Invalid IP address ${address}`);
+  }
+}
+
+export function formatIPv4(address: bigint): string {
+  const reverseComponents: bigint[] = [];
+  for (let i = 0; i < IPV4_COMPONENT_COUNT; i++) {
+    reverseComponents.push(address % IPV4_COMPONENT_CAP);
+    address = address / IPV4_COMPONENT_CAP;
+  }
+  return reverseComponents.reverse().map(component => component.toString(10)).join('.');
+}
+
+export function formatIPv6(address: bigint): string {
+  const reverseComponents: bigint[] = [];
+  for (let i = 0; i < IPV6_COMPONENT_COUNT; i++) {
+    reverseComponents.push(address % IPV6_COMPONENT_CAP);
+    address = address / IPV6_COMPONENT_CAP;
+  }
+  const components = reverseComponents.reverse();
+  /* Find the longest run of consecutive 0 values in the list of components, to
+   * replace it with :: in the output */
+  let maxZeroRunIndex = 0;
+  let maxZeroRunLength = 0;
+  let inZeroRun = false;
+  let currentZeroRunIndex = 0;
+  let currentZeroRunLength = 0;
+  for (let i = 0; i < components.length; i++) {
+    if (components[i] === 0n) {
+      if (inZeroRun) {
+        currentZeroRunLength += 1;
+      } else {
+        inZeroRun = true;
+        currentZeroRunIndex = i;
+        currentZeroRunLength = 1;
+      }
+      if (currentZeroRunLength > maxZeroRunLength) {
+        maxZeroRunIndex = currentZeroRunIndex;
+        maxZeroRunLength = currentZeroRunLength;
+      }
+    } else {
+      currentZeroRunLength = 0;
+      inZeroRun = false;
+    }
+  }
+  if (maxZeroRunLength >= 2) {
+    const beginning = components.slice(0, maxZeroRunIndex);
+    const end = components.slice(maxZeroRunIndex + maxZeroRunLength);
+    return beginning.map(value => value.toString(16)).join(':') + '::' + end.map(value => value.toString(16)).join(':');
+  } else {
+    return components.map(value => value.toString(16)).join(':');
+  }
+}
+
+function getSubnetMaskIPv4(prefixLen: number) {
+  return ~((1n << (IPV4_TOTAL_SIZE - BigInt(prefixLen))) - 1n);
+}
+
+function getSubnetMaskIPv6(prefixLen: number) {
+  return ~((1n << (IPV6_TOTAL_SIZE - BigInt(prefixLen))) - 1n);
+}
+
+export function firstNBitsIPv4(address: string, prefixLen: number): string {
+  const addressNum = parseIPv4(address);
+  const prefixMask = getSubnetMaskIPv4(prefixLen);
+  return formatIPv4(addressNum & prefixMask);
+}
+
+export function firstNBitsIPv6(address: string, prefixLen: number): string {
+  const addressNum = parseIPv6(address);
+  const prefixMask = getSubnetMaskIPv6(prefixLen);
+  return formatIPv6(addressNum & prefixMask);
+}
+
+export function normalizeCidrRange(range: CidrRange): CidrRange {
+  switch (net.isIP(range.addressPrefix)) {
+    case 4: {
+      const prefixLen = Math.min(Math.max(range.prefixLen, 0), 32);
+      return {
+        addressPrefix: firstNBitsIPv4(range.addressPrefix, prefixLen),
+        prefixLen: prefixLen
+      };
+    }
+    case 6: {
+      const prefixLen = Math.min(Math.max(range.prefixLen, 0), 128);
+      return {
+        addressPrefix: firstNBitsIPv6(range.addressPrefix, prefixLen),
+        prefixLen: prefixLen
+      };
+    }
+    default:
+      throw new Error(`Invalid IP address prefix ${range.addressPrefix}`);
+  }
+}
+
+export function getCidrRangeSubnetMask(range: CidrRange): bigint {
+  switch (net.isIP(range.addressPrefix)) {
+    case 4:
+      return getSubnetMaskIPv4(range.prefixLen);
+    case 6:
+      return getSubnetMaskIPv6(range.prefixLen);
+    default:
+      throw new Error('Invalid CIDR range');
+  }
+}
+
+export function inCidrRange(range: CidrRange, address: string): boolean {
+  if (net.isIP(range.addressPrefix) !== net.isIP(address)) {
+    return false;
+  }
+  return (parseIP(address) & getCidrRangeSubnetMask(range)) === parseIP(range.addressPrefix);
+}
+
+export function cidrRangeEqual(range1: CidrRange | undefined, range2: CidrRange | undefined): boolean {
+  if (range1 === undefined && range2 === undefined) {
+    return true;
+  }
+  if (range1 === undefined || range2 === undefined) {
+    return false;
+  }
+  return range1.addressPrefix === range2.addressPrefix && range1.prefixLen === range2.prefixLen;
+}
+
+export function cidrRangeMessageToCidrRange(message: CidrRange__Output): CidrRange {
+  return {
+    addressPrefix: message.address_prefix,
+    prefixLen: message.prefix_len?.value ?? 0
+  };
+}

packages/grpc-js-xds/src/cross-product.ts

@@ -0,0 +1,48 @@
+ /*
+ * Copyright 2024 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// Types and function from https://stackoverflow.com/a/72059390/159388, with modifications
+type ElementType<A> = A extends ReadonlyArray<infer T> ? T | undefined : never;
+
+type ElementsOfAll<Inputs, R extends ReadonlyArray<unknown> = []> = Inputs extends readonly [infer F, ...infer M] ? ElementsOfAll<M, [...R, ElementType<F>]> : R;
+
+type CartesianProduct<Inputs> = ElementsOfAll<Inputs>[];
+
+/**
+ * Get the cross product or Cartesian product of a list of groups. The
+ * implementation is copied, with some modifications, from
+ * https://stackoverflow.com/a/72059390/159388.
+ * @param sets A list of groups of elements
+ * @returns A list of all possible combinations of one element from each group
+ * in sets. Empty groups will result in undefined in that slot in each
+ * combination.
+ */
+export function crossProduct<Sets extends ReadonlyArray<ReadonlyArray<unknown>>>(sets: Sets): CartesianProduct<Sets> {
+  /* The input is an array of arrays, and the expected output is an array of
+   * each possible combination of one element each of the input arrays, with
+   * the exception that if one of the input arrays is empty, each combination
+   * gets [undefined] in that slot.
+   *
+   * At each step in the reduce call, we start with the cross product of the
+   * first N groups, and the next group. For each combation, for each element
+   * of the next group, extend the combination with that element.
+   *
+   * The type assertion at the end is needed because TypeScript doesn't track
+   * the types well enough through the reduce calls to see that the result has
+   * the expected type.
+   */
+  return sets.map(x => x.length === 0 ? [undefined] : x).reduce((combinations: unknown[][], nextGroup) => combinations.flatMap(combination => nextGroup.map(element => [...combination, element])), [[]] as unknown[][]) as CartesianProduct<Sets>;
+}

packages/grpc-js-xds/src/environment.ts

@@ -25,3 +25,6 @@ export const EXPERIMENTAL_FEDERATION = (process.env.GRPC_EXPERIMENTAL_XDS_FEDERA
 export const EXPERIMENTAL_CUSTOM_LB_CONFIG = (process.env.GRPC_EXPERIMENTAL_XDS_CUSTOM_LB_CONFIG ?? 'true') === 'true';
 export const EXPERIMENTAL_RING_HASH = (process.env.GRPC_XDS_EXPERIMENTAL_ENABLE_RING_HASH ?? 'true') === 'true';
 export const EXPERIMENTAL_PICK_FIRST = (process.env.GRPC_EXPERIMENTAL_PICKFIRST_LB_CONFIG ?? 'false') === 'true';
+export const EXPERIMENTAL_DUALSTACK_ENDPOINTS = (process.env.GRPC_EXPERIMENTAL_XDS_DUALSTACK_ENDPOINTS ?? 'true') === 'true';
+export const AGGREGATE_CLUSTER_BACKWARDS_COMPAT = (process.env.GRPC_XDS_AGGREGATE_CLUSTER_BACKWARD_COMPAT ?? 'false') === 'true';
+export const EXPERIMENTAL_RBAC = (process.env.GRPC_XDS_EXPERIMENTAL_RBAC ?? 'false') === 'true';

packages/grpc-js-xds/src/generated/ads.ts

@@ -29,6 +29,9 @@ export interface ProtoGrpcType {
           HeaderValue: MessageTypeDefinition
           HeaderValueOption: MessageTypeDefinition
           HttpUri: MessageTypeDefinition
+          KeyValue: MessageTypeDefinition
+          KeyValueAppend: MessageTypeDefinition
+          KeyValueMutation: MessageTypeDefinition
           Locality: MessageTypeDefinition
           Metadata: MessageTypeDefinition
           Node: MessageTypeDefinition
@@ -49,6 +52,7 @@ export interface ProtoGrpcType {
           TcpKeepalive: MessageTypeDefinition
           TrafficDirection: EnumTypeDefinition
           TransportSocket: MessageTypeDefinition
+          TypedExtensionConfig: MessageTypeDefinition
           WatchedDirectory: MessageTypeDefinition
         }
       }

packages/grpc-js-xds/src/generated/cluster.ts

@@ -59,11 +59,16 @@ export interface ProtoGrpcType {
           HttpProtocolOptions: MessageTypeDefinition
           HttpUri: MessageTypeDefinition
           KeepaliveSettings: MessageTypeDefinition
+          KeyValue: MessageTypeDefinition
+          KeyValueAppend: MessageTypeDefinition
+          KeyValueMutation: MessageTypeDefinition
           Locality: MessageTypeDefinition
           Metadata: MessageTypeDefinition
           Node: MessageTypeDefinition
           PathConfigSource: MessageTypeDefinition
           Pipe: MessageTypeDefinition
+          ProxyProtocolConfig: MessageTypeDefinition
+          ProxyProtocolPassThroughTLVs: MessageTypeDefinition
           QueryParameter: MessageTypeDefinition
           QuicKeepAliveSettings: MessageTypeDefinition
           QuicProtocolOptions: MessageTypeDefinition
@@ -119,6 +124,12 @@ export interface ProtoGrpcType {
           StringMatcher: MessageTypeDefinition
         }
       }
+      metadata: {
+        v3: {
+          MetadataKey: MessageTypeDefinition
+          MetadataKind: MessageTypeDefinition
+        }
+      }
       v3: {
         CodecClientType: EnumTypeDefinition
         DoubleRange: MessageTypeDefinition
@@ -224,6 +235,7 @@ export interface ProtoGrpcType {
         CollectionEntry: MessageTypeDefinition
         ContextParams: MessageTypeDefinition
         ResourceLocator: MessageTypeDefinition
+        TypedExtensionConfig: MessageTypeDefinition
       }
     }
   }

packages/grpc-js-xds/src/generated/csds.ts

@@ -41,6 +41,9 @@ export interface ProtoGrpcType {
           HeaderValue: MessageTypeDefinition
           HeaderValueOption: MessageTypeDefinition
           HttpUri: MessageTypeDefinition
+          KeyValue: MessageTypeDefinition
+          KeyValueAppend: MessageTypeDefinition
+          KeyValueMutation: MessageTypeDefinition
           Locality: MessageTypeDefinition
           Metadata: MessageTypeDefinition
           Node: MessageTypeDefinition
@@ -61,6 +64,7 @@ export interface ProtoGrpcType {
           TcpKeepalive: MessageTypeDefinition
           TrafficDirection: EnumTypeDefinition
           TransportSocket: MessageTypeDefinition
+          TypedExtensionConfig: MessageTypeDefinition
           WatchedDirectory: MessageTypeDefinition
         }
       }
@@ -90,6 +94,7 @@ export interface ProtoGrpcType {
           ListMatcher: MessageTypeDefinition
           ListStringMatcher: MessageTypeDefinition
           NodeMatcher: MessageTypeDefinition
+          OrMatcher: MessageTypeDefinition
           RegexMatchAndSubstitute: MessageTypeDefinition
           RegexMatcher: MessageTypeDefinition
           StringMatcher: MessageTypeDefinition
@@ -201,6 +206,7 @@ export interface ProtoGrpcType {
     core: {
       v3: {
         ContextParams: MessageTypeDefinition
+        TypedExtensionConfig: MessageTypeDefinition
       }
     }
   }

packages/grpc-js-xds/src/generated/endpoint.ts

@@ -38,11 +38,16 @@ export interface ProtoGrpcType {
           HealthStatus: EnumTypeDefinition
           HealthStatusSet: MessageTypeDefinition
           HttpUri: MessageTypeDefinition
+          KeyValue: MessageTypeDefinition
+          KeyValueAppend: MessageTypeDefinition
+          KeyValueMutation: MessageTypeDefinition
           Locality: MessageTypeDefinition
           Metadata: MessageTypeDefinition
           Node: MessageTypeDefinition
           PathConfigSource: MessageTypeDefinition
           Pipe: MessageTypeDefinition
+          ProxyProtocolConfig: MessageTypeDefinition
+          ProxyProtocolPassThroughTLVs: MessageTypeDefinition
           QueryParameter: MessageTypeDefinition
           RateLimitSettings: MessageTypeDefinition
           RemoteDataSource: MessageTypeDefinition
@@ -186,6 +191,7 @@ export interface ProtoGrpcType {
       v3: {
         Authority: MessageTypeDefinition
         ContextParams: MessageTypeDefinition
+        TypedExtensionConfig: MessageTypeDefinition
       }
     }
   }

packages/grpc-js-xds/src/generated/envoy/config/accesslog/v3/AccessLog.ts

@@ -34,5 +34,5 @@ export interface AccessLog__Output {
    * Custom configuration that must be set according to the access logger extension being instantiated.
    * [#extension-category: envoy.access_loggers]
    */
-  'config_type': "typed_config";
+  'config_type'?: "typed_config";
 }

packages/grpc-js-xds/src/generated/envoy/config/accesslog/v3/AccessLogFilter.ts

@@ -131,5 +131,5 @@ export interface AccessLogFilter__Output {
    * Log Type Filter
    */
   'log_type_filter'?: (_envoy_config_accesslog_v3_LogTypeFilter__Output | null);
-  'filter_specifier': "status_code_filter"|"duration_filter"|"not_health_check_filter"|"traceable_filter"|"runtime_filter"|"and_filter"|"or_filter"|"header_filter"|"response_flag_filter"|"grpc_status_filter"|"extension_filter"|"metadata_filter"|"log_type_filter";
+  'filter_specifier'?: "status_code_filter"|"duration_filter"|"not_health_check_filter"|"traceable_filter"|"runtime_filter"|"and_filter"|"or_filter"|"header_filter"|"response_flag_filter"|"grpc_status_filter"|"extension_filter"|"metadata_filter"|"log_type_filter";
 }

packages/grpc-js-xds/src/generated/envoy/config/accesslog/v3/ExtensionFilter.ts

@@ -31,5 +31,5 @@ export interface ExtensionFilter__Output {
   /**
    * Custom configuration that depends on the filter being instantiated.
    */
-  'config_type': "typed_config";
+  'config_type'?: "typed_config";
 }

packages/grpc-js-xds/src/generated/envoy/config/cluster/v3/Cluster.ts

@@ -27,6 +27,7 @@ import type { Struct as _google_protobuf_Struct, Struct__Output as _google_proto
 import type { RuntimeDouble as _envoy_config_core_v3_RuntimeDouble, RuntimeDouble__Output as _envoy_config_core_v3_RuntimeDouble__Output } from '../../../../envoy/config/core/v3/RuntimeDouble';
 import type { Percent as _envoy_type_v3_Percent, Percent__Output as _envoy_type_v3_Percent__Output } from '../../../../envoy/type/v3/Percent';
 import type { UInt64Value as _google_protobuf_UInt64Value, UInt64Value__Output as _google_protobuf_UInt64Value__Output } from '../../../../google/protobuf/UInt64Value';
+import type { MetadataKey as _envoy_type_metadata_v3_MetadataKey, MetadataKey__Output as _envoy_type_metadata_v3_MetadataKey__Output } from '../../../../envoy/type/metadata/v3/MetadataKey';
 import type { HealthStatusSet as _envoy_config_core_v3_HealthStatusSet, HealthStatusSet__Output as _envoy_config_core_v3_HealthStatusSet__Output } from '../../../../envoy/config/core/v3/HealthStatusSet';
 import type { DoubleValue as _google_protobuf_DoubleValue, DoubleValue__Output as _google_protobuf_DoubleValue__Output } from '../../../../google/protobuf/DoubleValue';
 
@@ -178,7 +179,7 @@ export interface _envoy_config_cluster_v3_Cluster_CommonLbConfig__Output {
    * set with an empty set of statuses then host overrides will be ignored by the load balancing.
    */
   'override_host_status': (_envoy_config_core_v3_HealthStatusSet__Output | null);
-  'locality_config_specifier': "zone_aware_lb_config"|"locality_weighted_lb_config";
+  'locality_config_specifier'?: "zone_aware_lb_config"|"locality_weighted_lb_config";
 }
 
 /**
@@ -1265,6 +1266,11 @@ export interface _envoy_config_cluster_v3_Cluster_OriginalDstLbConfig {
    * will take precedence over filter state and header override ports
    */
   'upstream_port_override'?: (_google_protobuf_UInt32Value | null);
+  /**
+   * The dynamic metadata key to override destination address.
+   * First the request metadata is considered, then the connection one.
+   */
+  'metadata_key'?: (_envoy_type_metadata_v3_MetadataKey | null);
 }
 
 /**
@@ -1299,6 +1305,11 @@ export interface _envoy_config_cluster_v3_Cluster_OriginalDstLbConfig__Output {
    * will take precedence over filter state and header override ports
    */
   'upstream_port_override': (_google_protobuf_UInt32Value__Output | null);
+  /**
+   * The dynamic metadata key to override destination address.
+   * First the request metadata is considered, then the connection one.
+   */
+  'metadata_key': (_envoy_type_metadata_v3_MetadataKey__Output | null);
 }
 
 export interface _envoy_config_cluster_v3_Cluster_PreconnectPolicy {
@@ -1591,7 +1602,7 @@ export interface _envoy_config_cluster_v3_Cluster_TransportSocketMatch {
    */
   'name'?: (string);
   /**
-   * Optional endpoint metadata match criteria.
+   * Optional metadata match criteria.
    * The connection to the endpoint with metadata matching what is set in this field
    * will use the transport socket configuration specified here.
    * The endpoint's metadata entry in ``envoy.transport_socket_match`` is used to match
@@ -1615,7 +1626,7 @@ export interface _envoy_config_cluster_v3_Cluster_TransportSocketMatch__Output {
    */
   'name': (string);
   /**
-   * Optional endpoint metadata match criteria.
+   * Optional metadata match criteria.
    * The connection to the endpoint with metadata matching what is set in this field
    * will use the transport socket configuration specified here.
    * The endpoint's metadata entry in ``envoy.transport_socket_match`` is used to match
@@ -1689,7 +1700,7 @@ export interface _envoy_config_cluster_v3_Cluster_CommonLbConfig_ZoneAwareLbConf
 
 /**
  * Configuration for a single upstream cluster.
- * [#next-free-field: 57]
+ * [#next-free-field: 58]
  */
 export interface Cluster {
   /**
@@ -1993,12 +2004,14 @@ export interface Cluster {
    */
   'lrs_server'?: (_envoy_config_core_v3_ConfigSource | null);
   /**
-   * Configuration to use different transport sockets for different endpoints.
-   * The entry of ``envoy.transport_socket_match`` in the
-   * :ref:`LbEndpoint.Metadata <envoy_v3_api_field_config.endpoint.v3.LbEndpoint.metadata>`
-   * is used to match against the transport sockets as they appear in the list. The first
-   * :ref:`match <envoy_v3_api_msg_config.cluster.v3.Cluster.TransportSocketMatch>` is used.
-   * For example, with the following match
+   * Configuration to use different transport sockets for different endpoints. The entry of
+   * ``envoy.transport_socket_match`` in the :ref:`LbEndpoint.Metadata
+   * <envoy_v3_api_field_config.endpoint.v3.LbEndpoint.metadata>` is used to match against the
+   * transport sockets as they appear in the list. If a match is not found, the search continues in
+   * :ref:`LocalityLbEndpoints.Metadata
+   * <envoy_v3_api_field_config.endpoint.v3.LocalityLbEndpoints.metadata>`. The first :ref:`match
+   * <envoy_v3_api_msg_config.cluster.v3.Cluster.TransportSocketMatch>` is used. For example, with
+   * the following match
    * 
    * .. code-block:: yaml
    * 
@@ -2022,8 +2035,9 @@ export interface Cluster {
    * socket match in case above.
    * 
    * If an endpoint metadata's value under ``envoy.transport_socket_match`` does not match any
-   * ``TransportSocketMatch``, socket configuration fallbacks to use the ``tls_context`` or
-   * ``transport_socket`` specified in this cluster.
+   * ``TransportSocketMatch``, the locality metadata is then checked for a match. Barring any
+   * matches in the endpoint or locality metadata, the socket configuration fallbacks to use the
+   * ``tls_context`` or ``transport_socket`` specified in this cluster.
    * 
    * This field allows gradual and flexible transport socket configuration changes.
    * 
@@ -2162,6 +2176,23 @@ export interface Cluster {
    * Optional configuration for the RoundRobin load balancing policy.
    */
   'round_robin_lb_config'?: (_envoy_config_cluster_v3_Cluster_RoundRobinLbConfig | null);
+  /**
+   * [#not-implemented-hide:]
+   * A list of metric names from ORCA load reports to propagate to LRS.
+   * 
+   * For map fields in the ORCA proto, the string will be of the form ``<map_field_name>.<map_key>``.
+   * For example, the string ``named_metrics.foo`` will mean to look for the key ``foo`` in the ORCA
+   * ``named_metrics`` field.
+   * 
+   * The special map key ``*`` means to report all entries in the map (e.g., ``named_metrics.*`` means to
+   * report all entries in the ORCA named_metrics field). Note that this should be used only with trusted
+   * backends.
+   * 
+   * The metric names in LRS will follow the same semantics as this field. In other words, if this field
+   * contains ``named_metrics.foo``, then the LRS load report will include the data with that same string
+   * as the key.
+   */
+  'lrs_report_endpoint_metrics'?: (string)[];
   'cluster_discovery_type'?: "type"|"cluster_type";
   /**
    * Optional configuration for the load balancing algorithm selected by
@@ -2178,7 +2209,7 @@ export interface Cluster {
 
 /**
  * Configuration for a single upstream cluster.
- * [#next-free-field: 57]
+ * [#next-free-field: 58]
  */
 export interface Cluster__Output {
   /**
@@ -2482,12 +2513,14 @@ export interface Cluster__Output {
    */
   'lrs_server': (_envoy_config_core_v3_ConfigSource__Output | null);
   /**
-   * Configuration to use different transport sockets for different endpoints.
-   * The entry of ``envoy.transport_socket_match`` in the
-   * :ref:`LbEndpoint.Metadata <envoy_v3_api_field_config.endpoint.v3.LbEndpoint.metadata>`
-   * is used to match against the transport sockets as they appear in the list. The first
-   * :ref:`match <envoy_v3_api_msg_config.cluster.v3.Cluster.TransportSocketMatch>` is used.
-   * For example, with the following match
+   * Configuration to use different transport sockets for different endpoints. The entry of
+   * ``envoy.transport_socket_match`` in the :ref:`LbEndpoint.Metadata
+   * <envoy_v3_api_field_config.endpoint.v3.LbEndpoint.metadata>` is used to match against the
+   * transport sockets as they appear in the list. If a match is not found, the search continues in
+   * :ref:`LocalityLbEndpoints.Metadata
+   * <envoy_v3_api_field_config.endpoint.v3.LocalityLbEndpoints.metadata>`. The first :ref:`match
+   * <envoy_v3_api_msg_config.cluster.v3.Cluster.TransportSocketMatch>` is used. For example, with
+   * the following match
    * 
    * .. code-block:: yaml
    * 
@@ -2511,8 +2544,9 @@ export interface Cluster__Output {
    * socket match in case above.
    * 
    * If an endpoint metadata's value under ``envoy.transport_socket_match`` does not match any
-   * ``TransportSocketMatch``, socket configuration fallbacks to use the ``tls_context`` or
-   * ``transport_socket`` specified in this cluster.
+   * ``TransportSocketMatch``, the locality metadata is then checked for a match. Barring any
+   * matches in the endpoint or locality metadata, the socket configuration fallbacks to use the
+   * ``tls_context`` or ``transport_socket`` specified in this cluster.
    * 
    * This field allows gradual and flexible transport socket configuration changes.
    * 
@@ -2651,7 +2685,24 @@ export interface Cluster__Output {
    * Optional configuration for the RoundRobin load balancing policy.
    */
   'round_robin_lb_config'?: (_envoy_config_cluster_v3_Cluster_RoundRobinLbConfig__Output | null);
-  'cluster_discovery_type': "type"|"cluster_type";
+  /**
+   * [#not-implemented-hide:]
+   * A list of metric names from ORCA load reports to propagate to LRS.
+   * 
+   * For map fields in the ORCA proto, the string will be of the form ``<map_field_name>.<map_key>``.
+   * For example, the string ``named_metrics.foo`` will mean to look for the key ``foo`` in the ORCA
+   * ``named_metrics`` field.
+   * 
+   * The special map key ``*`` means to report all entries in the map (e.g., ``named_metrics.*`` means to
+   * report all entries in the ORCA named_metrics field). Note that this should be used only with trusted
+   * backends.
+   * 
+   * The metric names in LRS will follow the same semantics as this field. In other words, if this field
+   * contains ``named_metrics.foo``, then the LRS load report will include the data with that same string
+   * as the key.
+   */
+  'lrs_report_endpoint_metrics': (string)[];
+  'cluster_discovery_type'?: "type"|"cluster_type";
   /**
    * Optional configuration for the load balancing algorithm selected by
    * LbPolicy. Currently only
@@ -2662,5 +2713,5 @@ export interface Cluster__Output {
    * Specifying ring_hash_lb_config or maglev_lb_config or least_request_lb_config without setting the corresponding
    * LbPolicy will generate an error at runtime.
    */
-  'lb_config': "ring_hash_lb_config"|"maglev_lb_config"|"original_dst_lb_config"|"least_request_lb_config"|"round_robin_lb_config";
+  'lb_config'?: "ring_hash_lb_config"|"maglev_lb_config"|"original_dst_lb_config"|"least_request_lb_config"|"round_robin_lb_config";
 }

packages/grpc-js-xds/src/generated/envoy/config/cluster/v3/Filter.ts

@@ -1,6 +1,7 @@
 // Original file: deps/envoy-api/envoy/config/cluster/v3/filter.proto
 
 import type { Any as _google_protobuf_Any, Any__Output as _google_protobuf_Any__Output } from '../../../../google/protobuf/Any';
+import type { ExtensionConfigSource as _envoy_config_core_v3_ExtensionConfigSource, ExtensionConfigSource__Output as _envoy_config_core_v3_ExtensionConfigSource__Output } from '../../../../envoy/config/core/v3/ExtensionConfigSource';
 
 export interface Filter {
   /**
@@ -11,9 +12,17 @@ export interface Filter {
    * Filter specific configuration which depends on the filter being
    * instantiated. See the supported filters for further documentation.
    * Note that Envoy's :ref:`downstream network
-   * filters <config_network_filters>` are not valid upstream filters.
+   * filters <config_network_filters>` are not valid upstream network filters.
+   * Only one of typed_config or config_discovery can be used.
    */
   'typed_config'?: (_google_protobuf_Any | null);
+  /**
+   * Configuration source specifier for an extension configuration discovery
+   * service. In case of a failure and without the default configuration, the
+   * listener closes the connections.
+   * Only one of typed_config or config_discovery can be used.
+   */
+  'config_discovery'?: (_envoy_config_core_v3_ExtensionConfigSource | null);
 }
 
 export interface Filter__Output {
@@ -25,7 +34,15 @@ export interface Filter__Output {
    * Filter specific configuration which depends on the filter being
    * instantiated. See the supported filters for further documentation.
    * Note that Envoy's :ref:`downstream network
-   * filters <config_network_filters>` are not valid upstream filters.
+   * filters <config_network_filters>` are not valid upstream network filters.
+   * Only one of typed_config or config_discovery can be used.
    */
   'typed_config': (_google_protobuf_Any__Output | null);
+  /**
+   * Configuration source specifier for an extension configuration discovery
+   * service. In case of a failure and without the default configuration, the
+   * listener closes the connections.
+   * Only one of typed_config or config_discovery can be used.
+   */
+  'config_discovery': (_envoy_config_core_v3_ExtensionConfigSource__Output | null);
 }

packages/grpc-js-xds/src/generated/envoy/config/cluster/v3/OutlierDetection.ts

@@ -2,11 +2,13 @@
 
 import type { UInt32Value as _google_protobuf_UInt32Value, UInt32Value__Output as _google_protobuf_UInt32Value__Output } from '../../../../google/protobuf/UInt32Value';
 import type { Duration as _google_protobuf_Duration, Duration__Output as _google_protobuf_Duration__Output } from '../../../../google/protobuf/Duration';
+import type { BoolValue as _google_protobuf_BoolValue, BoolValue__Output as _google_protobuf_BoolValue__Output } from '../../../../google/protobuf/BoolValue';
+import type { TypedExtensionConfig as _envoy_config_core_v3_TypedExtensionConfig, TypedExtensionConfig__Output as _envoy_config_core_v3_TypedExtensionConfig__Output } from '../../../../envoy/config/core/v3/TypedExtensionConfig';
 
 /**
  * See the :ref:`architecture overview <arch_overview_outlier_detection>` for
  * more information on outlier detection.
- * [#next-free-field: 23]
+ * [#next-free-field: 26]
  */
 export interface OutlierDetection {
   /**
@@ -29,8 +31,8 @@ export interface OutlierDetection {
    */
   'base_ejection_time'?: (_google_protobuf_Duration | null);
   /**
-   * The maximum % of an upstream cluster that can be ejected due to outlier
-   * detection. Defaults to 10% but will eject at least one host regardless of the value.
+   * The maximum % of an upstream cluster that can be ejected due to outlier detection. Defaults to 10% .
+   * Will eject at least one host regardless of the value if :ref:`always_eject_one_host<envoy_v3_api_field_config.cluster.v3.OutlierDetection.always_eject_one_host>` is enabled.
    */
   'max_ejection_percent'?: (_google_protobuf_UInt32Value | null);
   /**
@@ -163,12 +165,29 @@ export interface OutlierDetection {
    * Defaults to 0s.
    */
   'max_ejection_time_jitter'?: (_google_protobuf_Duration | null);
+  /**
+   * If active health checking is enabled and a host is ejected by outlier detection, a successful active health check
+   * unejects the host by default and considers it as healthy. Unejection also clears all the outlier detection counters.
+   * To change this default behavior set this config to ``false`` where active health checking will not uneject the host.
+   * Defaults to true.
+   */
+  'successful_active_health_check_uneject_host'?: (_google_protobuf_BoolValue | null);
+  /**
+   * Set of host's passive monitors.
+   * [#not-implemented-hide:]
+   */
+  'monitors'?: (_envoy_config_core_v3_TypedExtensionConfig)[];
+  /**
+   * If enabled, at least one host is ejected regardless of the value of :ref:`max_ejection_percent<envoy_v3_api_field_config.cluster.v3.OutlierDetection.max_ejection_percent>`.
+   * Defaults to false.
+   */
+  'always_eject_one_host'?: (_google_protobuf_BoolValue | null);
 }
 
 /**
  * See the :ref:`architecture overview <arch_overview_outlier_detection>` for
  * more information on outlier detection.
- * [#next-free-field: 23]
+ * [#next-free-field: 26]
  */
 export interface OutlierDetection__Output {
   /**
@@ -191,8 +210,8 @@ export interface OutlierDetection__Output {
    */
   'base_ejection_time': (_google_protobuf_Duration__Output | null);
   /**
-   * The maximum % of an upstream cluster that can be ejected due to outlier
-   * detection. Defaults to 10% but will eject at least one host regardless of the value.
+   * The maximum % of an upstream cluster that can be ejected due to outlier detection. Defaults to 10% .
+   * Will eject at least one host regardless of the value if :ref:`always_eject_one_host<envoy_v3_api_field_config.cluster.v3.OutlierDetection.always_eject_one_host>` is enabled.
    */
   'max_ejection_percent': (_google_protobuf_UInt32Value__Output | null);
   /**
@@ -325,4 +344,21 @@ export interface OutlierDetection__Output {
    * Defaults to 0s.
    */
   'max_ejection_time_jitter': (_google_protobuf_Duration__Output | null);
+  /**
+   * If active health checking is enabled and a host is ejected by outlier detection, a successful active health check
+   * unejects the host by default and considers it as healthy. Unejection also clears all the outlier detection counters.
+   * To change this default behavior set this config to ``false`` where active health checking will not uneject the host.
+   * Defaults to true.
+   */
+  'successful_active_health_check_uneject_host': (_google_protobuf_BoolValue__Output | null);
+  /**
+   * Set of host's passive monitors.
+   * [#not-implemented-hide:]
+   */
+  'monitors': (_envoy_config_core_v3_TypedExtensionConfig__Output)[];
+  /**
+   * If enabled, at least one host is ejected regardless of the value of :ref:`max_ejection_percent<envoy_v3_api_field_config.cluster.v3.OutlierDetection.max_ejection_percent>`.
+   * Defaults to false.
+   */
+  'always_eject_one_host': (_google_protobuf_BoolValue__Output | null);
 }

packages/grpc-js-xds/src/generated/envoy/config/cluster/v3/TrackClusterStats.ts

@@ -16,6 +16,22 @@ export interface TrackClusterStats {
    * of requests and responses will be published.
    */
   'request_response_sizes'?: (boolean);
+  /**
+   * If true, some stats will be emitted per-endpoint, similar to the stats in admin ``/clusters``
+   * output.
+   * 
+   * This does not currently output correct stats during a hot-restart.
+   * 
+   * This is not currently implemented by all stat sinks.
+   * 
+   * These stats do not honor filtering or tag extraction rules in :ref:`StatsConfig
+   * <envoy_v3_api_msg_config.metrics.v3.StatsConfig>` (but fixed-value tags are supported). Admin
+   * endpoint filtering is supported.
+   * 
+   * This may not be used at the same time as
+   * :ref:`load_stats_config <envoy_v3_api_field_config.bootstrap.v3.ClusterManager.load_stats_config>`.
+   */
+  'per_endpoint_stats'?: (boolean);
 }
 
 export interface TrackClusterStats__Output {
@@ -33,4 +49,20 @@ export interface TrackClusterStats__Output {
    * of requests and responses will be published.
    */
   'request_response_sizes': (boolean);
+  /**
+   * If true, some stats will be emitted per-endpoint, similar to the stats in admin ``/clusters``
+   * output.
+   * 
+   * This does not currently output correct stats during a hot-restart.
+   * 
+   * This is not currently implemented by all stat sinks.
+   * 
+   * These stats do not honor filtering or tag extraction rules in :ref:`StatsConfig
+   * <envoy_v3_api_msg_config.metrics.v3.StatsConfig>` (but fixed-value tags are supported). Admin
+   * endpoint filtering is supported.
+   * 
+   * This may not be used at the same time as
+   * :ref:`load_stats_config <envoy_v3_api_field_config.bootstrap.v3.ClusterManager.load_stats_config>`.
+   */
+  'per_endpoint_stats': (boolean);
 }

packages/grpc-js-xds/src/generated/envoy/config/cluster/v3/UpstreamConnectionOptions.ts

@@ -1,6 +1,59 @@
 // Original file: deps/envoy-api/envoy/config/cluster/v3/cluster.proto
 
 import type { TcpKeepalive as _envoy_config_core_v3_TcpKeepalive, TcpKeepalive__Output as _envoy_config_core_v3_TcpKeepalive__Output } from '../../../../envoy/config/core/v3/TcpKeepalive';
+import type { UInt32Value as _google_protobuf_UInt32Value, UInt32Value__Output as _google_protobuf_UInt32Value__Output } from '../../../../google/protobuf/UInt32Value';
+
+// Original file: deps/envoy-api/envoy/config/cluster/v3/cluster.proto
+
+export const _envoy_config_cluster_v3_UpstreamConnectionOptions_FirstAddressFamilyVersion = {
+  /**
+   * respect the native ranking of destination ip addresses returned from dns
+   * resolution
+   */
+  DEFAULT: 'DEFAULT',
+  V4: 'V4',
+  V6: 'V6',
+} as const;
+
+export type _envoy_config_cluster_v3_UpstreamConnectionOptions_FirstAddressFamilyVersion =
+  /**
+   * respect the native ranking of destination ip addresses returned from dns
+   * resolution
+   */
+  | 'DEFAULT'
+  | 0
+  | 'V4'
+  | 1
+  | 'V6'
+  | 2
+
+export type _envoy_config_cluster_v3_UpstreamConnectionOptions_FirstAddressFamilyVersion__Output = typeof _envoy_config_cluster_v3_UpstreamConnectionOptions_FirstAddressFamilyVersion[keyof typeof _envoy_config_cluster_v3_UpstreamConnectionOptions_FirstAddressFamilyVersion]
+
+export interface _envoy_config_cluster_v3_UpstreamConnectionOptions_HappyEyeballsConfig {
+  /**
+   * Specify the IP address family to attempt connection first in happy
+   * eyeballs algorithm according to RFC8305#section-4.
+   */
+  'first_address_family_version'?: (_envoy_config_cluster_v3_UpstreamConnectionOptions_FirstAddressFamilyVersion);
+  /**
+   * Specify the number of addresses of the first_address_family_version being
+   * attempted for connection before the other address family.
+   */
+  'first_address_family_count'?: (_google_protobuf_UInt32Value | null);
+}
+
+export interface _envoy_config_cluster_v3_UpstreamConnectionOptions_HappyEyeballsConfig__Output {
+  /**
+   * Specify the IP address family to attempt connection first in happy
+   * eyeballs algorithm according to RFC8305#section-4.
+   */
+  'first_address_family_version': (_envoy_config_cluster_v3_UpstreamConnectionOptions_FirstAddressFamilyVersion__Output);
+  /**
+   * Specify the number of addresses of the first_address_family_version being
+   * attempted for connection before the other address family.
+   */
+  'first_address_family_count': (_google_protobuf_UInt32Value__Output | null);
+}
 
 export interface UpstreamConnectionOptions {
   /**
@@ -13,6 +66,12 @@ export interface UpstreamConnectionOptions {
    * implementation specific. Defaults to false due to performance concerns.
    */
   'set_local_interface_name_on_upstream_connections'?: (boolean);
+  /**
+   * Configurations for happy eyeballs algorithm.
+   * Add configs for first_address_family_version and first_address_family_count
+   * when sorting destination ip addresses.
+   */
+  'happy_eyeballs_config'?: (_envoy_config_cluster_v3_UpstreamConnectionOptions_HappyEyeballsConfig | null);
 }
 
 export interface UpstreamConnectionOptions__Output {
@@ -26,4 +85,10 @@ export interface UpstreamConnectionOptions__Output {
    * implementation specific. Defaults to false due to performance concerns.
    */
   'set_local_interface_name_on_upstream_connections': (boolean);
+  /**
+   * Configurations for happy eyeballs algorithm.
+   * Add configs for first_address_family_version and first_address_family_count
+   * when sorting destination ip addresses.
+   */
+  'happy_eyeballs_config': (_envoy_config_cluster_v3_UpstreamConnectionOptions_HappyEyeballsConfig__Output | null);
 }

packages/grpc-js-xds/src/generated/envoy/config/core/v3/Address.ts

@@ -33,5 +33,5 @@ export interface Address__Output {
    * <envoy_v3_api_field_config.listener.v3.Listener.internal_listener>`.
    */
   'envoy_internal_address'?: (_envoy_config_core_v3_EnvoyInternalAddress__Output | null);
-  'address': "socket_address"|"pipe"|"envoy_internal_address";
+  'address'?: "socket_address"|"pipe"|"envoy_internal_address";
 }

packages/grpc-js-xds/src/generated/envoy/config/core/v3/ApiVersion.ts

@@ -6,14 +6,11 @@
  */
 export const ApiVersion = {
   /**
-   * When not specified, we assume v2, to ease migration to Envoy's stable API
-   * versioning. If a client does not support v2 (e.g. due to deprecation), this
-   * is an invalid value.
-   * @deprecated
+   * When not specified, we assume v3; it is the only supported version.
    */
   AUTO: 'AUTO',
   /**
-   * Use xDS v2 API.
+   * Use xDS v2 API. This is no longer supported.
    * @deprecated
    */
   V2: 'V2',
@@ -29,14 +26,12 @@ export const ApiVersion = {
  */
 export type ApiVersion =
   /**
-   * When not specified, we assume v2, to ease migration to Envoy's stable API
-   * versioning. If a client does not support v2 (e.g. due to deprecation), this
-   * is an invalid value.
+   * When not specified, we assume v3; it is the only supported version.
    */
   | 'AUTO'
   | 0
   /**
-   * Use xDS v2 API.
+   * Use xDS v2 API. This is no longer supported.
    */
   | 'V2'
   | 1

packages/grpc-js-xds/src/generated/envoy/config/core/v3/AsyncDataSource.ts

@@ -30,5 +30,5 @@ export interface AsyncDataSource__Output {
    * Remote async data source.
    */
   'remote'?: (_envoy_config_core_v3_RemoteDataSource__Output | null);
-  'specifier': "local"|"remote";
+  'specifier'?: "local"|"remote";
 }

packages/grpc-js-xds/src/generated/envoy/config/core/v3/BindConfig.ts

@@ -4,9 +4,10 @@ import type { SocketAddress as _envoy_config_core_v3_SocketAddress, SocketAddres
 import type { BoolValue as _google_protobuf_BoolValue, BoolValue__Output as _google_protobuf_BoolValue__Output } from '../../../../google/protobuf/BoolValue';
 import type { SocketOption as _envoy_config_core_v3_SocketOption, SocketOption__Output as _envoy_config_core_v3_SocketOption__Output } from '../../../../envoy/config/core/v3/SocketOption';
 import type { ExtraSourceAddress as _envoy_config_core_v3_ExtraSourceAddress, ExtraSourceAddress__Output as _envoy_config_core_v3_ExtraSourceAddress__Output } from '../../../../envoy/config/core/v3/ExtraSourceAddress';
+import type { TypedExtensionConfig as _envoy_config_core_v3_TypedExtensionConfig, TypedExtensionConfig__Output as _envoy_config_core_v3_TypedExtensionConfig__Output } from '../../../../envoy/config/core/v3/TypedExtensionConfig';
 
 /**
- * [#next-free-field: 6]
+ * [#next-free-field: 7]
  */
 export interface BindConfig {
   /**
@@ -35,20 +36,23 @@ export interface BindConfig {
    */
   'additional_source_addresses'?: (_envoy_config_core_v3_SocketAddress)[];
   /**
-   * Extra source addresses appended to the address specified in the `source_address`
-   * field. This enables to specify multiple source addresses. Currently, only one extra
-   * address can be supported, and the extra address should have a different IP version
-   * with the address in the `source_address` field. The address which has the same IP
-   * version with the target host's address IP version will be used as bind address. If more
-   * than one extra address specified, only the first address matched IP version will be
-   * returned. If there is no same IP version address found, the address in the `source_address`
-   * will be returned.
+   * Extra source addresses appended to the address specified in the ``source_address``
+   * field. This enables to specify multiple source addresses.
+   * The source address selection is determined by :ref:`local_address_selector
+   * <envoy_v3_api_field_config.core.v3.BindConfig.local_address_selector>`.
    */
   'extra_source_addresses'?: (_envoy_config_core_v3_ExtraSourceAddress)[];
+  /**
+   * Custom local address selector to override the default (i.e.
+   * :ref:`DefaultLocalAddressSelector
+   * <envoy_v3_api_msg_config.upstream.local_address_selector.v3.DefaultLocalAddressSelector>`).
+   * [#extension-category: envoy.upstream.local_address_selector]
+   */
+  'local_address_selector'?: (_envoy_config_core_v3_TypedExtensionConfig | null);
 }
 
 /**
- * [#next-free-field: 6]
+ * [#next-free-field: 7]
  */
 export interface BindConfig__Output {
   /**
@@ -77,14 +81,17 @@ export interface BindConfig__Output {
    */
   'additional_source_addresses': (_envoy_config_core_v3_SocketAddress__Output)[];
   /**
-   * Extra source addresses appended to the address specified in the `source_address`
-   * field. This enables to specify multiple source addresses. Currently, only one extra
-   * address can be supported, and the extra address should have a different IP version
-   * with the address in the `source_address` field. The address which has the same IP
-   * version with the target host's address IP version will be used as bind address. If more
-   * than one extra address specified, only the first address matched IP version will be
-   * returned. If there is no same IP version address found, the address in the `source_address`
-   * will be returned.
+   * Extra source addresses appended to the address specified in the ``source_address``
+   * field. This enables to specify multiple source addresses.
+   * The source address selection is determined by :ref:`local_address_selector
+   * <envoy_v3_api_field_config.core.v3.BindConfig.local_address_selector>`.
    */
   'extra_source_addresses': (_envoy_config_core_v3_ExtraSourceAddress__Output)[];
+  /**
+   * Custom local address selector to override the default (i.e.
+   * :ref:`DefaultLocalAddressSelector
+   * <envoy_v3_api_msg_config.upstream.local_address_selector.v3.DefaultLocalAddressSelector>`).
+   * [#extension-category: envoy.upstream.local_address_selector]
+   */
+  'local_address_selector': (_envoy_config_core_v3_TypedExtensionConfig__Output | null);
 }

packages/grpc-js-xds/src/generated/envoy/config/core/v3/ConfigSource.ts

@@ -141,5 +141,5 @@ export interface ConfigSource__Output {
    * Local filesystem path configuration source.
    */
   'path_config_source'?: (_envoy_config_core_v3_PathConfigSource__Output | null);
-  'config_source_specifier': "path"|"path_config_source"|"api_config_source"|"ads"|"self";
+  'config_source_specifier'?: "path"|"path_config_source"|"api_config_source"|"ads"|"self";
 }

packages/grpc-js-xds/src/generated/envoy/config/core/v3/DataSource.ts

@@ -1,8 +1,10 @@
 // Original file: deps/envoy-api/envoy/config/core/v3/base.proto
 
+import type { WatchedDirectory as _envoy_config_core_v3_WatchedDirectory, WatchedDirectory__Output as _envoy_config_core_v3_WatchedDirectory__Output } from '../../../../envoy/config/core/v3/WatchedDirectory';
 
 /**
  * Data source consisting of a file, an inline value, or an environment variable.
+ * [#next-free-field: 6]
  */
 export interface DataSource {
   /**
@@ -21,11 +23,29 @@ export interface DataSource {
    * Environment variable data source.
    */
   'environment_variable'?: (string);
+  /**
+   * Watched directory that is watched for file changes. If this is set explicitly, the file
+   * specified in the ``filename`` field will be reloaded when relevant file move events occur.
+   * 
+   * .. note::
+   * This field only makes sense when the ``filename`` field is set.
+   * 
+   * .. note::
+   * Envoy only updates when the file is replaced by a file move, and not when the file is
+   * edited in place.
+   * 
+   * .. note::
+   * Not all use cases of ``DataSource`` support watching directories. It depends on the
+   * specific usage of the ``DataSource``. See the documentation of the parent message for
+   * details.
+   */
+  'watched_directory'?: (_envoy_config_core_v3_WatchedDirectory | null);
   'specifier'?: "filename"|"inline_bytes"|"inline_string"|"environment_variable";
 }
 
 /**
  * Data source consisting of a file, an inline value, or an environment variable.
+ * [#next-free-field: 6]
  */
 export interface DataSource__Output {
   /**
@@ -44,5 +64,22 @@ export interface DataSource__Output {
    * Environment variable data source.
    */
   'environment_variable'?: (string);
-  'specifier': "filename"|"inline_bytes"|"inline_string"|"environment_variable";
+  /**
+   * Watched directory that is watched for file changes. If this is set explicitly, the file
+   * specified in the ``filename`` field will be reloaded when relevant file move events occur.
+   * 
+   * .. note::
+   * This field only makes sense when the ``filename`` field is set.
+   * 
+   * .. note::
+   * Envoy only updates when the file is replaced by a file move, and not when the file is
+   * edited in place.
+   * 
+   * .. note::
+   * Not all use cases of ``DataSource`` support watching directories. It depends on the
+   * specific usage of the ``DataSource``. See the documentation of the parent message for
+   * details.
+   */
+  'watched_directory': (_envoy_config_core_v3_WatchedDirectory__Output | null);
+  'specifier'?: "filename"|"inline_bytes"|"inline_string"|"environment_variable";
 }

packages/grpc-js-xds/src/generated/envoy/config/core/v3/EnvoyInternalAddress.ts

@@ -36,5 +36,5 @@ export interface EnvoyInternalAddress__Output {
    * example, may be set to the final destination IP for the target internal listener.
    */
   'endpoint_id': (string);
-  'address_name_specifier': "server_listener_name";
+  'address_name_specifier'?: "server_listener_name";
 }

packages/grpc-js-xds/src/generated/envoy/config/core/v3/EventServiceConfig.ts

@@ -23,5 +23,5 @@ export interface EventServiceConfig__Output {
    * Specifies the gRPC service that hosts the event reporting service.
    */
   'grpc_service'?: (_envoy_config_core_v3_GrpcService__Output | null);
-  'config_source_specifier': "grpc_service";
+  'config_source_specifier'?: "grpc_service";
 }

packages/grpc-js-xds/src/generated/envoy/config/core/v3/GrpcService.ts

@@ -3,8 +3,8 @@
 import type { Duration as _google_protobuf_Duration, Duration__Output as _google_protobuf_Duration__Output } from '../../../../google/protobuf/Duration';
 import type { HeaderValue as _envoy_config_core_v3_HeaderValue, HeaderValue__Output as _envoy_config_core_v3_HeaderValue__Output } from '../../../../envoy/config/core/v3/HeaderValue';
 import type { RetryPolicy as _envoy_config_core_v3_RetryPolicy, RetryPolicy__Output as _envoy_config_core_v3_RetryPolicy__Output } from '../../../../envoy/config/core/v3/RetryPolicy';
-import type { Struct as _google_protobuf_Struct, Struct__Output as _google_protobuf_Struct__Output } from '../../../../google/protobuf/Struct';
 import type { UInt32Value as _google_protobuf_UInt32Value, UInt32Value__Output as _google_protobuf_UInt32Value__Output } from '../../../../google/protobuf/UInt32Value';
+import type { Struct as _google_protobuf_Struct, Struct__Output as _google_protobuf_Struct__Output } from '../../../../google/protobuf/Struct';
 import type { DataSource as _envoy_config_core_v3_DataSource, DataSource__Output as _envoy_config_core_v3_DataSource__Output } from '../../../../envoy/config/core/v3/DataSource';
 import type { Empty as _google_protobuf_Empty, Empty__Output as _google_protobuf_Empty__Output } from '../../../../google/protobuf/Empty';
 import type { Any as _google_protobuf_Any, Any__Output as _google_protobuf_Any__Output } from '../../../../google/protobuf/Any';
@@ -95,7 +95,7 @@ export interface _envoy_config_core_v3_GrpcService_GoogleGrpc_CallCredentials__O
    * See https://github.com/grpc/grpc/pull/19587.
    */
   'sts_service'?: (_envoy_config_core_v3_GrpcService_GoogleGrpc_CallCredentials_StsService__Output | null);
-  'credential_specifier': "access_token"|"google_compute_engine"|"google_refresh_token"|"service_account_jwt_access"|"google_iam"|"from_plugin"|"sts_service";
+  'credential_specifier'?: "access_token"|"google_compute_engine"|"google_refresh_token"|"service_account_jwt_access"|"google_iam"|"from_plugin"|"sts_service";
 }
 
 /**
@@ -143,9 +143,12 @@ export interface _envoy_config_core_v3_GrpcService_GoogleGrpc_ChannelCredentials
    */
   'google_default'?: (_google_protobuf_Empty__Output | null);
   'local_credentials'?: (_envoy_config_core_v3_GrpcService_GoogleGrpc_GoogleLocalCredentials__Output | null);
-  'credential_specifier': "ssl_credentials"|"google_default"|"local_credentials";
+  'credential_specifier'?: "ssl_credentials"|"google_default"|"local_credentials";
 }
 
+/**
+ * [#next-free-field: 6]
+ */
 export interface _envoy_config_core_v3_GrpcService_EnvoyGrpc {
   /**
    * The name of the upstream gRPC cluster. SSL credentials will be supplied
@@ -165,8 +168,25 @@ export interface _envoy_config_core_v3_GrpcService_EnvoyGrpc {
    * If not set, xDS gRPC streams default base interval:500ms, maximum interval:30s will be applied.
    */
   'retry_policy'?: (_envoy_config_core_v3_RetryPolicy | null);
+  /**
+   * Maximum gRPC message size that is allowed to be received.
+   * If a message over this limit is received, the gRPC stream is terminated with the RESOURCE_EXHAUSTED error.
+   * This limit is applied to individual messages in the streaming response and not the total size of streaming response.
+   * Defaults to 0, which means unlimited.
+   */
+  'max_receive_message_length'?: (_google_protobuf_UInt32Value | null);
+  /**
+   * This provides gRPC client level control over envoy generated headers.
+   * If false, the header will be sent but it can be overridden by per stream option.
+   * If true, the header will be removed and can not be overridden by per stream option.
+   * Default to false.
+   */
+  'skip_envoy_headers'?: (boolean);
 }
 
+/**
+ * [#next-free-field: 6]
+ */
 export interface _envoy_config_core_v3_GrpcService_EnvoyGrpc__Output {
   /**
    * The name of the upstream gRPC cluster. SSL credentials will be supplied
@@ -186,6 +206,20 @@ export interface _envoy_config_core_v3_GrpcService_EnvoyGrpc__Output {
    * If not set, xDS gRPC streams default base interval:500ms, maximum interval:30s will be applied.
    */
   'retry_policy': (_envoy_config_core_v3_RetryPolicy__Output | null);
+  /**
+   * Maximum gRPC message size that is allowed to be received.
+   * If a message over this limit is received, the gRPC stream is terminated with the RESOURCE_EXHAUSTED error.
+   * This limit is applied to individual messages in the streaming response and not the total size of streaming response.
+   * Defaults to 0, which means unlimited.
+   */
+  'max_receive_message_length': (_google_protobuf_UInt32Value__Output | null);
+  /**
+   * This provides gRPC client level control over envoy generated headers.
+   * If false, the header will be sent but it can be overridden by per stream option.
+   * If true, the header will be removed and can not be overridden by per stream option.
+   * Default to false.
+   */
+  'skip_envoy_headers': (boolean);
 }
 
 /**
@@ -327,7 +361,7 @@ export interface _envoy_config_core_v3_GrpcService_GoogleGrpc_CallCredentials_Me
   /**
    * [#extension-category: envoy.grpc_credentials]
    */
-  'config_type': "typed_config";
+  'config_type'?: "typed_config";
 }
 
 export interface _envoy_config_core_v3_GrpcService_GoogleGrpc_CallCredentials_ServiceAccountJWTAccessCredentials {
@@ -501,13 +535,13 @@ export interface _envoy_config_core_v3_GrpcService_GoogleGrpc_ChannelArgs_Value_
    * Pointer values are not supported, since they don't make any sense when
    * delivered via the API.
    */
-  'value_specifier': "string_value"|"int_value";
+  'value_specifier'?: "string_value"|"int_value";
 }
 
 /**
  * gRPC service configuration. This is used by :ref:`ApiConfigSource
  * <envoy_v3_api_msg_config.core.v3.ApiConfigSource>` and filter configurations.
- * [#next-free-field: 6]
+ * [#next-free-field: 7]
  */
 export interface GrpcService {
   /**
@@ -535,13 +569,18 @@ export interface GrpcService {
    * <config_http_conn_man_headers_custom_request_headers>`.
    */
   'initial_metadata'?: (_envoy_config_core_v3_HeaderValue)[];
+  /**
+   * Optional default retry policy for streams toward the service.
+   * If an async stream doesn't have retry policy configured in its stream options, this retry policy is used.
+   */
+  'retry_policy'?: (_envoy_config_core_v3_RetryPolicy | null);
   'target_specifier'?: "envoy_grpc"|"google_grpc";
 }
 
 /**
  * gRPC service configuration. This is used by :ref:`ApiConfigSource
  * <envoy_v3_api_msg_config.core.v3.ApiConfigSource>` and filter configurations.
- * [#next-free-field: 6]
+ * [#next-free-field: 7]
  */
 export interface GrpcService__Output {
   /**
@@ -569,5 +608,10 @@ export interface GrpcService__Output {
    * <config_http_conn_man_headers_custom_request_headers>`.
    */
   'initial_metadata': (_envoy_config_core_v3_HeaderValue__Output)[];
-  'target_specifier': "envoy_grpc"|"google_grpc";
+  /**
+   * Optional default retry policy for streams toward the service.
+   * If an async stream doesn't have retry policy configured in its stream options, this retry policy is used.
+   */
+  'retry_policy': (_envoy_config_core_v3_RetryPolicy__Output | null);
+  'target_specifier'?: "envoy_grpc"|"google_grpc";
 }

packages/grpc-js-xds/src/generated/envoy/config/core/v3/HeaderValue.ts

@@ -15,8 +15,15 @@ export interface HeaderValue {
    * The same :ref:`format specifier <config_access_log_format>` as used for
    * :ref:`HTTP access logging <config_access_log>` applies here, however
    * unknown header values are replaced with the empty string instead of ``-``.
+   * Header value is encoded as string. This does not work for non-utf8 characters.
+   * Only one of ``value`` or ``raw_value`` can be set.
    */
   'value'?: (string);
+  /**
+   * Header value is encoded as bytes which can support non-utf8 characters.
+   * Only one of ``value`` or ``raw_value`` can be set.
+   */
+  'raw_value'?: (Buffer | Uint8Array | string);
 }
 
 /**
@@ -33,6 +40,13 @@ export interface HeaderValue__Output {
    * The same :ref:`format specifier <config_access_log_format>` as used for
    * :ref:`HTTP access logging <config_access_log>` applies here, however
    * unknown header values are replaced with the empty string instead of ``-``.
+   * Header value is encoded as string. This does not work for non-utf8 characters.
+   * Only one of ``value`` or ``raw_value`` can be set.
    */
   'value': (string);
+  /**
+   * Header value is encoded as bytes which can support non-utf8 characters.
+   * Only one of ``value`` or ``raw_value`` can be set.
+   */
+  'raw_value': (Buffer);
 }

packages/grpc-js-xds/src/generated/envoy/config/core/v3/HeaderValueOption.ts

@@ -10,9 +10,12 @@ import type { BoolValue as _google_protobuf_BoolValue, BoolValue__Output as _goo
  */
 export const _envoy_config_core_v3_HeaderValueOption_HeaderAppendAction = {
   /**
-   * This action will append the specified value to the existing values if the header
-   * already exists. If the header doesn't exist then this will add the header with
-   * specified key and value.
+   * If the header already exists, this action will result in:
+   * 
+   * - Comma-concatenated for predefined inline headers.
+   * - Duplicate header added in the ``HeaderMap`` for other headers.
+   * 
+   * If the header doesn't exist then this will add new header with specified key and value.
    */
   APPEND_IF_EXISTS_OR_ADD: 'APPEND_IF_EXISTS_OR_ADD',
   /**
@@ -26,6 +29,11 @@ export const _envoy_config_core_v3_HeaderValueOption_HeaderAppendAction = {
    * with specified key and value.
    */
   OVERWRITE_IF_EXISTS_OR_ADD: 'OVERWRITE_IF_EXISTS_OR_ADD',
+  /**
+   * This action will overwrite the specified value by discarding any existing values if
+   * the header already exists. If the header doesn't exist then this will be no-op.
+   */
+  OVERWRITE_IF_EXISTS: 'OVERWRITE_IF_EXISTS',
 } as const;
 
 /**
@@ -33,9 +41,12 @@ export const _envoy_config_core_v3_HeaderValueOption_HeaderAppendAction = {
  */
 export type _envoy_config_core_v3_HeaderValueOption_HeaderAppendAction =
   /**
-   * This action will append the specified value to the existing values if the header
-   * already exists. If the header doesn't exist then this will add the header with
-   * specified key and value.
+   * If the header already exists, this action will result in:
+   * 
+   * - Comma-concatenated for predefined inline headers.
+   * - Duplicate header added in the ``HeaderMap`` for other headers.
+   * 
+   * If the header doesn't exist then this will add new header with specified key and value.
    */
   | 'APPEND_IF_EXISTS_OR_ADD'
   | 0
@@ -52,6 +63,12 @@ export type _envoy_config_core_v3_HeaderValueOption_HeaderAppendAction =
    */
   | 'OVERWRITE_IF_EXISTS_OR_ADD'
   | 2
+  /**
+   * This action will overwrite the specified value by discarding any existing values if
+   * the header already exists. If the header doesn't exist then this will be no-op.
+   */
+  | 'OVERWRITE_IF_EXISTS'
+  | 3
 
 /**
  * Describes the supported actions types for header append action.

packages/grpc-js-xds/src/generated/envoy/config/core/v3/HealthCheck.ts

@@ -12,6 +12,7 @@ import type { Int64Range as _envoy_type_v3_Int64Range, Int64Range__Output as _en
 import type { CodecClientType as _envoy_type_v3_CodecClientType, CodecClientType__Output as _envoy_type_v3_CodecClientType__Output } from '../../../../envoy/type/v3/CodecClientType';
 import type { StringMatcher as _envoy_type_matcher_v3_StringMatcher, StringMatcher__Output as _envoy_type_matcher_v3_StringMatcher__Output } from '../../../../envoy/type/matcher/v3/StringMatcher';
 import type { RequestMethod as _envoy_config_core_v3_RequestMethod, RequestMethod__Output as _envoy_config_core_v3_RequestMethod__Output } from '../../../../envoy/config/core/v3/RequestMethod';
+import type { ProxyProtocolConfig as _envoy_config_core_v3_ProxyProtocolConfig, ProxyProtocolConfig__Output as _envoy_config_core_v3_ProxyProtocolConfig__Output } from '../../../../envoy/config/core/v3/ProxyProtocolConfig';
 import type { Any as _google_protobuf_Any, Any__Output as _google_protobuf_Any__Output } from '../../../../google/protobuf/Any';
 
 /**
@@ -45,7 +46,7 @@ export interface _envoy_config_core_v3_HealthCheck_CustomHealthCheck__Output {
    * being instantiated. See :api:`envoy/config/health_checker` for reference.
    * [#extension-category: envoy.health_checkers]
    */
-  'config_type': "typed_config";
+  'config_type'?: "typed_config";
 }
 
 /**
@@ -315,7 +316,7 @@ export interface _envoy_config_core_v3_HealthCheck_Payload__Output {
    * Binary payload.
    */
   'binary'?: (Buffer);
-  'payload': "text"|"binary";
+  'payload'?: "text"|"binary";
 }
 
 export interface _envoy_config_core_v3_HealthCheck_RedisHealthCheck {
@@ -349,6 +350,14 @@ export interface _envoy_config_core_v3_HealthCheck_TcpHealthCheck {
    * necessarily contiguous.
    */
   'receive'?: (_envoy_config_core_v3_HealthCheck_Payload)[];
+  /**
+   * When setting this value, it tries to attempt health check request with ProxyProtocol.
+   * When ``send`` is presented, they are sent after preceding ProxyProtocol header.
+   * Only ProxyProtocol header is sent when ``send`` is not presented.
+   * It allows to use both ProxyProtocol V1 and V2. In V1, it presents L3/L4. In V2, it includes
+   * LOCAL command and doesn't include L3/L4.
+   */
+  'proxy_protocol_config'?: (_envoy_config_core_v3_ProxyProtocolConfig | null);
 }
 
 export interface _envoy_config_core_v3_HealthCheck_TcpHealthCheck__Output {
@@ -362,6 +371,14 @@ export interface _envoy_config_core_v3_HealthCheck_TcpHealthCheck__Output {
    * necessarily contiguous.
    */
   'receive': (_envoy_config_core_v3_HealthCheck_Payload__Output)[];
+  /**
+   * When setting this value, it tries to attempt health check request with ProxyProtocol.
+   * When ``send`` is presented, they are sent after preceding ProxyProtocol header.
+   * Only ProxyProtocol header is sent when ``send`` is not presented.
+   * It allows to use both ProxyProtocol V1 and V2. In V1, it presents L3/L4. In V2, it includes
+   * LOCAL command and doesn't include L3/L4.
+   */
+  'proxy_protocol_config': (_envoy_config_core_v3_ProxyProtocolConfig__Output | null);
 }
 
 /**
@@ -397,7 +414,7 @@ export interface _envoy_config_core_v3_HealthCheck_TlsOptions__Output {
 }
 
 /**
- * [#next-free-field: 26]
+ * [#next-free-field: 27]
  */
 export interface HealthCheck {
   /**
@@ -584,11 +601,17 @@ export interface HealthCheck {
    * [#extension-category: envoy.health_check.event_sinks]
    */
   'event_logger'?: (_envoy_config_core_v3_TypedExtensionConfig)[];
+  /**
+   * If set to true, health check success events will always be logged. If set to false, only host addition event will be logged
+   * if it is the first successful health check, or if the healthy threshold is reached.
+   * The default value is false.
+   */
+  'always_log_health_check_success'?: (boolean);
   'health_checker'?: "http_health_check"|"tcp_health_check"|"grpc_health_check"|"custom_health_check";
 }
 
 /**
- * [#next-free-field: 26]
+ * [#next-free-field: 27]
  */
 export interface HealthCheck__Output {
   /**
@@ -775,5 +798,11 @@ export interface HealthCheck__Output {
    * [#extension-category: envoy.health_check.event_sinks]
    */
   'event_logger': (_envoy_config_core_v3_TypedExtensionConfig__Output)[];
-  'health_checker': "http_health_check"|"tcp_health_check"|"grpc_health_check"|"custom_health_check";
+  /**
+   * If set to true, health check success events will always be logged. If set to false, only host addition event will be logged
+   * if it is the first successful health check, or if the healthy threshold is reached.
+   * The default value is false.
+   */
+  'always_log_health_check_success': (boolean);
+  'health_checker'?: "http_health_check"|"tcp_health_check"|"grpc_health_check"|"custom_health_check";
 }

packages/grpc-js-xds/src/generated/envoy/config/core/v3/Http1ProtocolOptions.ts

@@ -42,7 +42,7 @@ export interface _envoy_config_core_v3_Http1ProtocolOptions_HeaderKeyFormat__Out
    * [#extension-category: envoy.http.stateful_header_formatters]
    */
   'stateful_formatter'?: (_envoy_config_core_v3_TypedExtensionConfig__Output | null);
-  'header_format': "proper_case_words"|"stateful_formatter";
+  'header_format'?: "proper_case_words"|"stateful_formatter";
 }
 
 export interface _envoy_config_core_v3_Http1ProtocolOptions_HeaderKeyFormat_ProperCaseWords {

packages/grpc-js-xds/src/generated/envoy/config/core/v3/Http2ProtocolOptions.ts

@@ -83,10 +83,10 @@ export interface Http2ProtocolOptions {
    */
   'allow_connect'?: (boolean);
   /**
-   * [#not-implemented-hide:] Hiding until envoy has full metadata support.
+   * [#not-implemented-hide:] Hiding until Envoy has full metadata support.
    * Still under implementation. DO NOT USE.
    * 
-   * Allows metadata. See [metadata
+   * Allows sending and receiving HTTP/2 METADATA frames. See [metadata
    * docs](https://github.com/envoyproxy/envoy/blob/main/source/docs/h2_metadata.md) for more
    * information.
    */
@@ -264,10 +264,10 @@ export interface Http2ProtocolOptions__Output {
    */
   'allow_connect': (boolean);
   /**
-   * [#not-implemented-hide:] Hiding until envoy has full metadata support.
+   * [#not-implemented-hide:] Hiding until Envoy has full metadata support.
    * Still under implementation. DO NOT USE.
    * 
-   * Allows metadata. See [metadata
+   * Allows sending and receiving HTTP/2 METADATA frames. See [metadata
    * docs](https://github.com/envoyproxy/envoy/blob/main/source/docs/h2_metadata.md) for more
    * information.
    */

packages/grpc-js-xds/src/generated/envoy/config/core/v3/Http3ProtocolOptions.ts

@@ -5,7 +5,7 @@ import type { BoolValue as _google_protobuf_BoolValue, BoolValue__Output as _goo
 
 /**
  * A message which allows using HTTP/3.
- * [#next-free-field: 6]
+ * [#next-free-field: 7]
  */
 export interface Http3ProtocolOptions {
   'quic_protocol_options'?: (_envoy_config_core_v3_QuicProtocolOptions | null);
@@ -27,11 +27,20 @@ export interface Http3ProtocolOptions {
    * Note that HTTP/3 CONNECT is not yet an RFC.
    */
   'allow_extended_connect'?: (boolean);
+  /**
+   * [#not-implemented-hide:] Hiding until Envoy has full metadata support.
+   * Still under implementation. DO NOT USE.
+   * 
+   * Allows sending and receiving HTTP/3 METADATA frames. See [metadata
+   * docs](https://github.com/envoyproxy/envoy/blob/main/source/docs/h2_metadata.md) for more
+   * information.
+   */
+  'allow_metadata'?: (boolean);
 }
 
 /**
  * A message which allows using HTTP/3.
- * [#next-free-field: 6]
+ * [#next-free-field: 7]
  */
 export interface Http3ProtocolOptions__Output {
   'quic_protocol_options': (_envoy_config_core_v3_QuicProtocolOptions__Output | null);
@@ -53,4 +62,13 @@ export interface Http3ProtocolOptions__Output {
    * Note that HTTP/3 CONNECT is not yet an RFC.
    */
   'allow_extended_connect': (boolean);
+  /**
+   * [#not-implemented-hide:] Hiding until Envoy has full metadata support.
+   * Still under implementation. DO NOT USE.
+   * 
+   * Allows sending and receiving HTTP/3 METADATA frames. See [metadata
+   * docs](https://github.com/envoyproxy/envoy/blob/main/source/docs/h2_metadata.md) for more
+   * information.
+   */
+  'allow_metadata': (boolean);
 }

packages/grpc-js-xds/src/generated/envoy/config/core/v3/HttpProtocolOptions.ts

@@ -99,10 +99,9 @@ export interface HttpProtocolOptions {
   'max_headers_count'?: (_google_protobuf_UInt32Value | null);
   /**
    * The maximum duration of a connection. The duration is defined as a period since a connection
-   * was established. If not set, there is no max duration. When max_connection_duration is reached
-   * and if there are no active streams, the connection will be closed. If the connection is a
-   * downstream connection and there are any active streams, the drain sequence will kick-in,
-   * and the connection will be force-closed after the drain period. See :ref:`drain_timeout
+   * was established. If not set, there is no max duration. When max_connection_duration is reached,
+   * the drain sequence will kick-in. The connection will be closed after the drain timeout period
+   * if there are no active streams. See :ref:`drain_timeout
    * <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.drain_timeout>`.
    */
   'max_connection_duration'?: (_google_protobuf_Duration | null);
@@ -159,10 +158,9 @@ export interface HttpProtocolOptions__Output {
   'max_headers_count': (_google_protobuf_UInt32Value__Output | null);
   /**
    * The maximum duration of a connection. The duration is defined as a period since a connection
-   * was established. If not set, there is no max duration. When max_connection_duration is reached
-   * and if there are no active streams, the connection will be closed. If the connection is a
-   * downstream connection and there are any active streams, the drain sequence will kick-in,
-   * and the connection will be force-closed after the drain period. See :ref:`drain_timeout
+   * was established. If not set, there is no max duration. When max_connection_duration is reached,
+   * the drain sequence will kick-in. The connection will be closed after the drain timeout period
+   * if there are no active streams. See :ref:`drain_timeout
    * <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.drain_timeout>`.
    */
   'max_connection_duration': (_google_protobuf_Duration__Output | null);

packages/grpc-js-xds/src/generated/envoy/config/core/v3/HttpUri.ts

@@ -75,5 +75,5 @@ export interface HttpUri__Output {
    * inline DNS resolution. See `issue
    * <https://github.com/envoyproxy/envoy/issues/1606>`_.
    */
-  'http_upstream_type': "cluster";
+  'http_upstream_type'?: "cluster";
 }

packages/grpc-js-xds/src/generated/envoy/config/core/v3/JsonFormatOptions.ts

@@ -0,0 +1,22 @@
+// Original file: deps/envoy-api/envoy/config/core/v3/substitution_format_string.proto
+
+
+/**
+ * Optional configuration options to be used with json_format.
+ */
+export interface JsonFormatOptions {
+  /**
+   * The output JSON string properties will be sorted.
+   */
+  'sort_properties'?: (boolean);
+}
+
+/**
+ * Optional configuration options to be used with json_format.
+ */
+export interface JsonFormatOptions__Output {
+  /**
+   * The output JSON string properties will be sorted.
+   */
+  'sort_properties': (boolean);
+}

packages/grpc-js-xds/src/generated/envoy/config/core/v3/KeyValue.ts

@@ -0,0 +1,24 @@
+// Original file: deps/envoy-api/envoy/config/core/v3/base.proto
+
+
+export interface KeyValue {
+  /**
+   * The key of the key/value pair.
+   */
+  'key'?: (string);
+  /**
+   * The value of the key/value pair.
+   */
+  'value'?: (Buffer | Uint8Array | string);
+}
+
+export interface KeyValue__Output {
+  /**
+   * The key of the key/value pair.
+   */
+  'key': (string);
+  /**
+   * The value of the key/value pair.
+   */
+  'value': (Buffer);
+}

packages/grpc-js-xds/src/generated/envoy/config/core/v3/KeyValueAppend.ts

@@ -0,0 +1,109 @@
+// Original file: deps/envoy-api/envoy/config/core/v3/base.proto
+
+import type { KeyValue as _envoy_config_core_v3_KeyValue, KeyValue__Output as _envoy_config_core_v3_KeyValue__Output } from '../../../../envoy/config/core/v3/KeyValue';
+
+// Original file: deps/envoy-api/envoy/config/core/v3/base.proto
+
+/**
+ * Describes the supported actions types for key/value pair append action.
+ */
+export const _envoy_config_core_v3_KeyValueAppend_KeyValueAppendAction = {
+  /**
+   * If the key already exists, this action will result in the following behavior:
+   * 
+   * - Comma-concatenated value if multiple values are not allowed.
+   * - New value added to the list of values if multiple values are allowed.
+   * 
+   * If the key doesn't exist then this will add pair with specified key and value.
+   */
+  APPEND_IF_EXISTS_OR_ADD: 'APPEND_IF_EXISTS_OR_ADD',
+  /**
+   * This action will add the key/value pair if it doesn't already exist. If the
+   * key already exists then this will be a no-op.
+   */
+  ADD_IF_ABSENT: 'ADD_IF_ABSENT',
+  /**
+   * This action will overwrite the specified value by discarding any existing
+   * values if the key already exists. If the key doesn't exist then this will add
+   * the pair with specified key and value.
+   */
+  OVERWRITE_IF_EXISTS_OR_ADD: 'OVERWRITE_IF_EXISTS_OR_ADD',
+  /**
+   * This action will overwrite the specified value by discarding any existing
+   * values if the key already exists. If the key doesn't exist then this will
+   * be no-op.
+   */
+  OVERWRITE_IF_EXISTS: 'OVERWRITE_IF_EXISTS',
+} as const;
+
+/**
+ * Describes the supported actions types for key/value pair append action.
+ */
+export type _envoy_config_core_v3_KeyValueAppend_KeyValueAppendAction =
+  /**
+   * If the key already exists, this action will result in the following behavior:
+   * 
+   * - Comma-concatenated value if multiple values are not allowed.
+   * - New value added to the list of values if multiple values are allowed.
+   * 
+   * If the key doesn't exist then this will add pair with specified key and value.
+   */
+  | 'APPEND_IF_EXISTS_OR_ADD'
+  | 0
+  /**
+   * This action will add the key/value pair if it doesn't already exist. If the
+   * key already exists then this will be a no-op.
+   */
+  | 'ADD_IF_ABSENT'
+  | 1
+  /**
+   * This action will overwrite the specified value by discarding any existing
+   * values if the key already exists. If the key doesn't exist then this will add
+   * the pair with specified key and value.
+   */
+  | 'OVERWRITE_IF_EXISTS_OR_ADD'
+  | 2
+  /**
+   * This action will overwrite the specified value by discarding any existing
+   * values if the key already exists. If the key doesn't exist then this will
+   * be no-op.
+   */
+  | 'OVERWRITE_IF_EXISTS'
+  | 3
+
+/**
+ * Describes the supported actions types for key/value pair append action.
+ */
+export type _envoy_config_core_v3_KeyValueAppend_KeyValueAppendAction__Output = typeof _envoy_config_core_v3_KeyValueAppend_KeyValueAppendAction[keyof typeof _envoy_config_core_v3_KeyValueAppend_KeyValueAppendAction]
+
+/**
+ * Key/value pair plus option to control append behavior. This is used to specify
+ * key/value pairs that should be appended to a set of existing key/value pairs.
+ */
+export interface KeyValueAppend {
+  /**
+   * Key/value pair entry that this option to append or overwrite.
+   */
+  'entry'?: (_envoy_config_core_v3_KeyValue | null);
+  /**
+   * Describes the action taken to append/overwrite the given value for an existing
+   * key or to only add this key if it's absent.
+   */
+  'action'?: (_envoy_config_core_v3_KeyValueAppend_KeyValueAppendAction);
+}
+
+/**
+ * Key/value pair plus option to control append behavior. This is used to specify
+ * key/value pairs that should be appended to a set of existing key/value pairs.
+ */
+export interface KeyValueAppend__Output {
+  /**
+   * Key/value pair entry that this option to append or overwrite.
+   */
+  'entry': (_envoy_config_core_v3_KeyValue__Output | null);
+  /**
+   * Describes the action taken to append/overwrite the given value for an existing
+   * key or to only add this key if it's absent.
+   */
+  'action': (_envoy_config_core_v3_KeyValueAppend_KeyValueAppendAction__Output);
+}

packages/grpc-js-xds/src/generated/envoy/config/core/v3/KeyValueMutation.ts

@@ -0,0 +1,31 @@
+// Original file: deps/envoy-api/envoy/config/core/v3/base.proto
+
+import type { KeyValueAppend as _envoy_config_core_v3_KeyValueAppend, KeyValueAppend__Output as _envoy_config_core_v3_KeyValueAppend__Output } from '../../../../envoy/config/core/v3/KeyValueAppend';
+
+/**
+ * Key/value pair to append or remove.
+ */
+export interface KeyValueMutation {
+  /**
+   * Key/value pair to append or overwrite. Only one of ``append`` or ``remove`` can be set.
+   */
+  'append'?: (_envoy_config_core_v3_KeyValueAppend | null);
+  /**
+   * Key to remove. Only one of ``append`` or ``remove`` can be set.
+   */
+  'remove'?: (string);
+}
+
+/**
+ * Key/value pair to append or remove.
+ */
+export interface KeyValueMutation__Output {
+  /**
+   * Key/value pair to append or overwrite. Only one of ``append`` or ``remove`` can be set.
+   */
+  'append': (_envoy_config_core_v3_KeyValueAppend__Output | null);
+  /**
+   * Key to remove. Only one of ``append`` or ``remove`` can be set.
+   */
+  'remove': (string);
+}

packages/grpc-js-xds/src/generated/envoy/config/core/v3/Node.ts

@@ -174,5 +174,5 @@ export interface Node__Output {
    * parameter then appears in this field during future discovery requests.
    */
   'dynamic_parameters': ({[key: string]: _xds_core_v3_ContextParams__Output});
-  'user_agent_version_type': "user_agent_version"|"user_agent_build_version";
+  'user_agent_version_type'?: "user_agent_version"|"user_agent_build_version";
 }

packages/grpc-js-xds/src/generated/envoy/config/core/v3/QuicProtocolOptions.ts

@@ -2,10 +2,11 @@
 
 import type { UInt32Value as _google_protobuf_UInt32Value, UInt32Value__Output as _google_protobuf_UInt32Value__Output } from '../../../../google/protobuf/UInt32Value';
 import type { QuicKeepAliveSettings as _envoy_config_core_v3_QuicKeepAliveSettings, QuicKeepAliveSettings__Output as _envoy_config_core_v3_QuicKeepAliveSettings__Output } from '../../../../envoy/config/core/v3/QuicKeepAliveSettings';
+import type { Duration as _google_protobuf_Duration, Duration__Output as _google_protobuf_Duration__Output } from '../../../../google/protobuf/Duration';
 
 /**
  * QUIC protocol options which apply to both downstream and upstream connections.
- * [#next-free-field: 6]
+ * [#next-free-field: 9]
  */
 export interface QuicProtocolOptions {
   /**
@@ -16,7 +17,7 @@ export interface QuicProtocolOptions {
   /**
    * `Initial stream-level flow-control receive window
    * <https://tools.ietf.org/html/draft-ietf-quic-transport-34#section-4.1>`_ size. Valid values range from
-   * 1 to 16777216 (2^24, maximum supported by QUICHE) and defaults to 65536 (2^16).
+   * 1 to 16777216 (2^24, maximum supported by QUICHE) and defaults to 16777216 (16 * 1024 * 1024).
    * 
    * NOTE: 16384 (2^14) is the minimum window size supported in Google QUIC. If configured smaller than it, we will use 16384 instead.
    * QUICHE IETF Quic implementation supports 1 bytes window. We only support increasing the default window size now, so it's also the minimum.
@@ -28,8 +29,8 @@ export interface QuicProtocolOptions {
   'initial_stream_window_size'?: (_google_protobuf_UInt32Value | null);
   /**
    * Similar to ``initial_stream_window_size``, but for connection-level
-   * flow-control. Valid values rage from 1 to 25165824 (24MB, maximum supported by QUICHE) and defaults to 65536 (2^16).
-   * window. Currently, this has the same minimum/default as ``initial_stream_window_size``.
+   * flow-control. Valid values rage from 1 to 25165824 (24MB, maximum supported by QUICHE) and defaults
+   * to 25165824 (24 * 1024 * 1024).
    * 
    * NOTE: 16384 (2^14) is the minimum window size supported in Google QUIC. We only support increasing the default
    * window size now, so it's also the minimum.
@@ -37,7 +38,7 @@ export interface QuicProtocolOptions {
   'initial_connection_window_size'?: (_google_protobuf_UInt32Value | null);
   /**
    * The number of timeouts that can occur before port migration is triggered for QUIC clients.
-   * This defaults to 1. If set to 0, port migration will not occur on path degrading.
+   * This defaults to 4. If set to 0, port migration will not occur on path degrading.
    * Timeout here refers to QUIC internal path degrading timeout mechanism, such as PTO.
    * This has no effect on server sessions.
    */
@@ -47,11 +48,28 @@ export interface QuicProtocolOptions {
    * If absent, use the default keepalive behavior of which a client connection sends PINGs every 15s, and a server connection doesn't do anything.
    */
   'connection_keepalive'?: (_envoy_config_core_v3_QuicKeepAliveSettings | null);
+  /**
+   * A comma-separated list of strings representing QUIC connection options defined in
+   * `QUICHE <https://github.com/google/quiche/blob/main/quiche/quic/core/crypto/crypto_protocol.h>`_ and to be sent by upstream connections.
+   */
+  'connection_options'?: (string);
+  /**
+   * A comma-separated list of strings representing QUIC client connection options defined in
+   * `QUICHE <https://github.com/google/quiche/blob/main/quiche/quic/core/crypto/crypto_protocol.h>`_ and to be sent by upstream connections.
+   */
+  'client_connection_options'?: (string);
+  /**
+   * The duration that a QUIC connection stays idle before it closes itself. If this field is not present, QUICHE
+   * default 600s will be applied.
+   * For internal corporate network, a long timeout is often fine.
+   * But for client facing network, 30s is usually a good choice.
+   */
+  'idle_network_timeout'?: (_google_protobuf_Duration | null);
 }
 
 /**
  * QUIC protocol options which apply to both downstream and upstream connections.
- * [#next-free-field: 6]
+ * [#next-free-field: 9]
  */
 export interface QuicProtocolOptions__Output {
   /**
@@ -62,7 +80,7 @@ export interface QuicProtocolOptions__Output {
   /**
    * `Initial stream-level flow-control receive window
    * <https://tools.ietf.org/html/draft-ietf-quic-transport-34#section-4.1>`_ size. Valid values range from
-   * 1 to 16777216 (2^24, maximum supported by QUICHE) and defaults to 65536 (2^16).
+   * 1 to 16777216 (2^24, maximum supported by QUICHE) and defaults to 16777216 (16 * 1024 * 1024).
    * 
    * NOTE: 16384 (2^14) is the minimum window size supported in Google QUIC. If configured smaller than it, we will use 16384 instead.
    * QUICHE IETF Quic implementation supports 1 bytes window. We only support increasing the default window size now, so it's also the minimum.
@@ -74,8 +92,8 @@ export interface QuicProtocolOptions__Output {
   'initial_stream_window_size': (_google_protobuf_UInt32Value__Output | null);
   /**
    * Similar to ``initial_stream_window_size``, but for connection-level
-   * flow-control. Valid values rage from 1 to 25165824 (24MB, maximum supported by QUICHE) and defaults to 65536 (2^16).
-   * window. Currently, this has the same minimum/default as ``initial_stream_window_size``.
+   * flow-control. Valid values rage from 1 to 25165824 (24MB, maximum supported by QUICHE) and defaults
+   * to 25165824 (24 * 1024 * 1024).
    * 
    * NOTE: 16384 (2^14) is the minimum window size supported in Google QUIC. We only support increasing the default
    * window size now, so it's also the minimum.
@@ -83,7 +101,7 @@ export interface QuicProtocolOptions__Output {
   'initial_connection_window_size': (_google_protobuf_UInt32Value__Output | null);
   /**
    * The number of timeouts that can occur before port migration is triggered for QUIC clients.
-   * This defaults to 1. If set to 0, port migration will not occur on path degrading.
+   * This defaults to 4. If set to 0, port migration will not occur on path degrading.
    * Timeout here refers to QUIC internal path degrading timeout mechanism, such as PTO.
    * This has no effect on server sessions.
    */
@@ -93,4 +111,21 @@ export interface QuicProtocolOptions__Output {
    * If absent, use the default keepalive behavior of which a client connection sends PINGs every 15s, and a server connection doesn't do anything.
    */
   'connection_keepalive': (_envoy_config_core_v3_QuicKeepAliveSettings__Output | null);
+  /**
+   * A comma-separated list of strings representing QUIC connection options defined in
+   * `QUICHE <https://github.com/google/quiche/blob/main/quiche/quic/core/crypto/crypto_protocol.h>`_ and to be sent by upstream connections.
+   */
+  'connection_options': (string);
+  /**
+   * A comma-separated list of strings representing QUIC client connection options defined in
+   * `QUICHE <https://github.com/google/quiche/blob/main/quiche/quic/core/crypto/crypto_protocol.h>`_ and to be sent by upstream connections.
+   */
+  'client_connection_options': (string);
+  /**
+   * The duration that a QUIC connection stays idle before it closes itself. If this field is not present, QUICHE
+   * default 600s will be applied.
+   * For internal corporate network, a long timeout is often fine.
+   * But for client facing network, 30s is usually a good choice.
+   */
+  'idle_network_timeout': (_google_protobuf_Duration__Output | null);
 }

packages/grpc-js-xds/src/generated/envoy/config/core/v3/RateLimitSettings.ts

@@ -14,7 +14,8 @@ export interface RateLimitSettings {
   'max_tokens'?: (_google_protobuf_UInt32Value | null);
   /**
    * Rate at which tokens will be filled per second. If not set, a default fill rate of 10 tokens
-   * per second will be used.
+   * per second will be used. The minimal fill rate is once per year. Lower
+   * fill rates will be set to once per year.
    */
   'fill_rate'?: (_google_protobuf_DoubleValue | null);
 }
@@ -30,7 +31,8 @@ export interface RateLimitSettings__Output {
   'max_tokens': (_google_protobuf_UInt32Value__Output | null);
   /**
    * Rate at which tokens will be filled per second. If not set, a default fill rate of 10 tokens
-   * per second will be used.
+   * per second will be used. The minimal fill rate is once per year. Lower
+   * fill rates will be set to once per year.
    */
   'fill_rate': (_google_protobuf_DoubleValue__Output | null);
 }

packages/grpc-js-xds/src/generated/envoy/config/core/v3/RetryPolicy.ts

@@ -2,9 +2,48 @@
 
 import type { BackoffStrategy as _envoy_config_core_v3_BackoffStrategy, BackoffStrategy__Output as _envoy_config_core_v3_BackoffStrategy__Output } from '../../../../envoy/config/core/v3/BackoffStrategy';
 import type { UInt32Value as _google_protobuf_UInt32Value, UInt32Value__Output as _google_protobuf_UInt32Value__Output } from '../../../../google/protobuf/UInt32Value';
+import type { Any as _google_protobuf_Any, Any__Output as _google_protobuf_Any__Output } from '../../../../google/protobuf/Any';
+import type { Long } from '@grpc/proto-loader';
+
+/**
+ * See :ref:`RetryHostPredicate <envoy_v3_api_field_config.route.v3.RetryPolicy.retry_host_predicate>`.
+ */
+export interface _envoy_config_core_v3_RetryPolicy_RetryHostPredicate {
+  'name'?: (string);
+  'typed_config'?: (_google_protobuf_Any | null);
+  'config_type'?: "typed_config";
+}
+
+/**
+ * See :ref:`RetryHostPredicate <envoy_v3_api_field_config.route.v3.RetryPolicy.retry_host_predicate>`.
+ */
+export interface _envoy_config_core_v3_RetryPolicy_RetryHostPredicate__Output {
+  'name': (string);
+  'typed_config'?: (_google_protobuf_Any__Output | null);
+  'config_type'?: "typed_config";
+}
+
+/**
+ * See :ref:`RetryPriority <envoy_v3_api_field_config.route.v3.RetryPolicy.retry_priority>`.
+ */
+export interface _envoy_config_core_v3_RetryPolicy_RetryPriority {
+  'name'?: (string);
+  'typed_config'?: (_google_protobuf_Any | null);
+  'config_type'?: "typed_config";
+}
+
+/**
+ * See :ref:`RetryPriority <envoy_v3_api_field_config.route.v3.RetryPolicy.retry_priority>`.
+ */
+export interface _envoy_config_core_v3_RetryPolicy_RetryPriority__Output {
+  'name': (string);
+  'typed_config'?: (_google_protobuf_Any__Output | null);
+  'config_type'?: "typed_config";
+}
 
 /**
  * The message specifies the retry policy of remote data source when fetching fails.
+ * [#next-free-field: 7]
  */
 export interface RetryPolicy {
   /**
@@ -18,10 +57,27 @@ export interface RetryPolicy {
    * defaults to 1.
    */
   'num_retries'?: (_google_protobuf_UInt32Value | null);
+  /**
+   * For details, see :ref:`retry_on <envoy_v3_api_field_config.route.v3.RetryPolicy.retry_on>`.
+   */
+  'retry_on'?: (string);
+  /**
+   * For details, see :ref:`retry_priority <envoy_v3_api_field_config.route.v3.RetryPolicy.retry_priority>`.
+   */
+  'retry_priority'?: (_envoy_config_core_v3_RetryPolicy_RetryPriority | null);
+  /**
+   * For details, see :ref:`RetryHostPredicate <envoy_v3_api_field_config.route.v3.RetryPolicy.retry_host_predicate>`.
+   */
+  'retry_host_predicate'?: (_envoy_config_core_v3_RetryPolicy_RetryHostPredicate)[];
+  /**
+   * For details, see :ref:`host_selection_retry_max_attempts <envoy_v3_api_field_config.route.v3.RetryPolicy.host_selection_retry_max_attempts>`.
+   */
+  'host_selection_retry_max_attempts'?: (number | string | Long);
 }
 
 /**
  * The message specifies the retry policy of remote data source when fetching fails.
+ * [#next-free-field: 7]
  */
 export interface RetryPolicy__Output {
   /**
@@ -35,4 +91,20 @@ export interface RetryPolicy__Output {
    * defaults to 1.
    */
   'num_retries': (_google_protobuf_UInt32Value__Output | null);
+  /**
+   * For details, see :ref:`retry_on <envoy_v3_api_field_config.route.v3.RetryPolicy.retry_on>`.
+   */
+  'retry_on': (string);
+  /**
+   * For details, see :ref:`retry_priority <envoy_v3_api_field_config.route.v3.RetryPolicy.retry_priority>`.
+   */
+  'retry_priority': (_envoy_config_core_v3_RetryPolicy_RetryPriority__Output | null);
+  /**
+   * For details, see :ref:`RetryHostPredicate <envoy_v3_api_field_config.route.v3.RetryPolicy.retry_host_predicate>`.
+   */
+  'retry_host_predicate': (_envoy_config_core_v3_RetryPolicy_RetryHostPredicate__Output)[];
+  /**
+   * For details, see :ref:`host_selection_retry_max_attempts <envoy_v3_api_field_config.route.v3.RetryPolicy.host_selection_retry_max_attempts>`.
+   */
+  'host_selection_retry_max_attempts': (string);
 }

packages/grpc-js-xds/src/generated/envoy/config/core/v3/SchemeHeaderTransformation.ts

@@ -7,8 +7,16 @@
 export interface SchemeHeaderTransformation {
   /**
    * Overwrite any Scheme header with the contents of this string.
+   * If set, takes precedence over match_upstream.
    */
   'scheme_to_overwrite'?: (string);
+  /**
+   * Set the Scheme header to match the upstream transport protocol. For example, should a
+   * request be sent to the upstream over TLS, the scheme header will be set to "https". Should the
+   * request be sent over plaintext, the scheme header will be set to "http".
+   * If scheme_to_overwrite is set, this field is not used.
+   */
+  'match_upstream'?: (boolean);
   'transformation'?: "scheme_to_overwrite";
 }
 
@@ -18,7 +26,15 @@ export interface SchemeHeaderTransformation {
 export interface SchemeHeaderTransformation__Output {
   /**
    * Overwrite any Scheme header with the contents of this string.
+   * If set, takes precedence over match_upstream.
    */
   'scheme_to_overwrite'?: (string);
-  'transformation': "scheme_to_overwrite";
+  /**
+   * Set the Scheme header to match the upstream transport protocol. For example, should a
+   * request be sent to the upstream over TLS, the scheme header will be set to "https". Should the
+   * request be sent over plaintext, the scheme header will be set to "http".
+   * If scheme_to_overwrite is set, this field is not used.
+   */
+  'match_upstream': (boolean);
+  'transformation'?: "scheme_to_overwrite";
 }

packages/grpc-js-xds/src/generated/envoy/config/core/v3/SocketAddress.ts

@@ -101,5 +101,5 @@ export interface SocketAddress__Output {
    * IPv6 space as ``::FFFF:<IPv4-address>``.
    */
   'ipv4_compat': (boolean);
-  'port_specifier': "port_value"|"named_port";
+  'port_specifier'?: "port_value"|"named_port";
 }

packages/grpc-js-xds/src/generated/envoy/config/core/v3/SocketOption.ts

@@ -145,5 +145,5 @@ export interface SocketOption__Output {
    * STATE_PREBIND is currently the only valid value.
    */
   'state': (_envoy_config_core_v3_SocketOption_SocketState__Output);
-  'value': "int_value"|"buf_value";
+  'value'?: "int_value"|"buf_value";
 }

packages/grpc-js-xds/src/generated/envoy/config/core/v3/SubstitutionFormatString.ts

@@ -3,11 +3,12 @@
 import type { Struct as _google_protobuf_Struct, Struct__Output as _google_protobuf_Struct__Output } from '../../../../google/protobuf/Struct';
 import type { DataSource as _envoy_config_core_v3_DataSource, DataSource__Output as _envoy_config_core_v3_DataSource__Output } from '../../../../envoy/config/core/v3/DataSource';
 import type { TypedExtensionConfig as _envoy_config_core_v3_TypedExtensionConfig, TypedExtensionConfig__Output as _envoy_config_core_v3_TypedExtensionConfig__Output } from '../../../../envoy/config/core/v3/TypedExtensionConfig';
+import type { JsonFormatOptions as _envoy_config_core_v3_JsonFormatOptions, JsonFormatOptions__Output as _envoy_config_core_v3_JsonFormatOptions__Output } from '../../../../envoy/config/core/v3/JsonFormatOptions';
 
 /**
  * Configuration to use multiple :ref:`command operators <config_access_log_command_operators>`
  * to generate a new string in either plain text or JSON format.
- * [#next-free-field: 7]
+ * [#next-free-field: 8]
  */
 export interface SubstitutionFormatString {
   /**
@@ -99,13 +100,17 @@ export interface SubstitutionFormatString {
    * [#extension-category: envoy.formatter]
    */
   'formatters'?: (_envoy_config_core_v3_TypedExtensionConfig)[];
+  /**
+   * If json_format is used, the options will be applied to the output JSON string.
+   */
+  'json_format_options'?: (_envoy_config_core_v3_JsonFormatOptions | null);
   'format'?: "text_format"|"json_format"|"text_format_source";
 }
 
 /**
  * Configuration to use multiple :ref:`command operators <config_access_log_command_operators>`
  * to generate a new string in either plain text or JSON format.
- * [#next-free-field: 7]
+ * [#next-free-field: 8]
  */
 export interface SubstitutionFormatString__Output {
   /**
@@ -197,5 +202,9 @@ export interface SubstitutionFormatString__Output {
    * [#extension-category: envoy.formatter]
    */
   'formatters': (_envoy_config_core_v3_TypedExtensionConfig__Output)[];
-  'format': "text_format"|"json_format"|"text_format_source";
+  /**
+   * If json_format is used, the options will be applied to the output JSON string.
+   */
+  'json_format_options': (_envoy_config_core_v3_JsonFormatOptions__Output | null);
+  'format'?: "text_format"|"json_format"|"text_format_source";
 }

packages/grpc-js-xds/src/generated/envoy/config/core/v3/TransportSocket.ts

@@ -39,5 +39,5 @@ export interface TransportSocket__Output {
    * Implementation specific configuration which depends on the implementation being instantiated.
    * See the supported transport socket implementations for further documentation.
    */
-  'config_type': "typed_config";
+  'config_type'?: "typed_config";
 }

packages/grpc-js-xds/src/generated/envoy/config/endpoint/v3/ClusterLoadAssignment.ts

@@ -6,9 +6,6 @@ import type { UInt32Value as _google_protobuf_UInt32Value, UInt32Value__Output a
 import type { Duration as _google_protobuf_Duration, Duration__Output as _google_protobuf_Duration__Output } from '../../../../google/protobuf/Duration';
 import type { FractionalPercent as _envoy_type_v3_FractionalPercent, FractionalPercent__Output as _envoy_type_v3_FractionalPercent__Output } from '../../../../envoy/type/v3/FractionalPercent';
 
-/**
- * [#not-implemented-hide:]
- */
 export interface _envoy_config_endpoint_v3_ClusterLoadAssignment_Policy_DropOverload {
   /**
    * Identifier for the policy specifying the drop.
@@ -20,9 +17,6 @@ export interface _envoy_config_endpoint_v3_ClusterLoadAssignment_Policy_DropOver
   'drop_percentage'?: (_envoy_type_v3_FractionalPercent | null);
 }
 
-/**
- * [#not-implemented-hide:]
- */
 export interface _envoy_config_endpoint_v3_ClusterLoadAssignment_Policy_DropOverload__Output {
   /**
    * Identifier for the policy specifying the drop.
@@ -36,7 +30,7 @@ export interface _envoy_config_endpoint_v3_ClusterLoadAssignment_Policy_DropOver
 
 /**
  * Load balancing policy settings.
- * [#next-free-field: 6]
+ * [#next-free-field: 7]
  */
 export interface _envoy_config_endpoint_v3_ClusterLoadAssignment_Policy {
   /**
@@ -59,7 +53,15 @@ export interface _envoy_config_endpoint_v3_ClusterLoadAssignment_Policy {
    * "throttle"_drop = 60%
    * "lb"_drop = 20%  // 50% of the remaining 'actual' load, which is 40%.
    * actual_outgoing_load = 20% // remaining after applying all categories.
-   * [#not-implemented-hide:]
+   * 
+   * Envoy supports only one element and will NACK if more than one element is present.
+   * Other xDS-capable data planes will not necessarily have this limitation.
+   * 
+   * In Envoy, this ``drop_overloads`` config can be overridden by a runtime key
+   * "load_balancing_policy.drop_overload_limit" setting. This runtime key can be set to
+   * any integer number between 0 and 100. 0 means drop 0%. 100 means drop 100%.
+   * When both ``drop_overloads`` config and "load_balancing_policy.drop_overload_limit"
+   * setting are in place, the min of these two wins.
    */
   'drop_overloads'?: (_envoy_config_endpoint_v3_ClusterLoadAssignment_Policy_DropOverload)[];
   /**
@@ -86,11 +88,22 @@ export interface _envoy_config_endpoint_v3_ClusterLoadAssignment_Policy {
    * Defaults to 0 which means endpoints never go stale.
    */
   'endpoint_stale_after'?: (_google_protobuf_Duration | null);
+  /**
+   * If true, use the :ref:`load balancing weight
+   * <envoy_v3_api_field_config.endpoint.v3.LbEndpoint.load_balancing_weight>` of healthy and unhealthy
+   * hosts to determine the health of the priority level. If false, use the number of healthy and unhealthy hosts
+   * to determine the health of the priority level, or in other words assume each host has a weight of 1 for
+   * this calculation.
+   * 
+   * Note: this is not currently implemented for
+   * :ref:`locality weighted load balancing <arch_overview_load_balancing_locality_weighted_lb>`.
+   */
+  'weighted_priority_health'?: (boolean);
 }
 
 /**
  * Load balancing policy settings.
- * [#next-free-field: 6]
+ * [#next-free-field: 7]
  */
 export interface _envoy_config_endpoint_v3_ClusterLoadAssignment_Policy__Output {
   /**
@@ -113,7 +126,15 @@ export interface _envoy_config_endpoint_v3_ClusterLoadAssignment_Policy__Output
    * "throttle"_drop = 60%
    * "lb"_drop = 20%  // 50% of the remaining 'actual' load, which is 40%.
    * actual_outgoing_load = 20% // remaining after applying all categories.
-   * [#not-implemented-hide:]
+   * 
+   * Envoy supports only one element and will NACK if more than one element is present.
+   * Other xDS-capable data planes will not necessarily have this limitation.
+   * 
+   * In Envoy, this ``drop_overloads`` config can be overridden by a runtime key
+   * "load_balancing_policy.drop_overload_limit" setting. This runtime key can be set to
+   * any integer number between 0 and 100. 0 means drop 0%. 100 means drop 100%.
+   * When both ``drop_overloads`` config and "load_balancing_policy.drop_overload_limit"
+   * setting are in place, the min of these two wins.
    */
   'drop_overloads': (_envoy_config_endpoint_v3_ClusterLoadAssignment_Policy_DropOverload__Output)[];
   /**
@@ -140,6 +161,17 @@ export interface _envoy_config_endpoint_v3_ClusterLoadAssignment_Policy__Output
    * Defaults to 0 which means endpoints never go stale.
    */
   'endpoint_stale_after': (_google_protobuf_Duration__Output | null);
+  /**
+   * If true, use the :ref:`load balancing weight
+   * <envoy_v3_api_field_config.endpoint.v3.LbEndpoint.load_balancing_weight>` of healthy and unhealthy
+   * hosts to determine the health of the priority level. If false, use the number of healthy and unhealthy hosts
+   * to determine the health of the priority level, or in other words assume each host has a weight of 1 for
+   * this calculation.
+   * 
+   * Note: this is not currently implemented for
+   * :ref:`locality weighted load balancing <arch_overview_load_balancing_locality_weighted_lb>`.
+   */
+  'weighted_priority_health': (boolean);
 }
 
 /**

packages/grpc-js-xds/src/generated/envoy/config/endpoint/v3/Endpoint.ts

@@ -2,6 +2,20 @@
 
 import type { Address as _envoy_config_core_v3_Address, Address__Output as _envoy_config_core_v3_Address__Output } from '../../../../envoy/config/core/v3/Address';
 
+export interface _envoy_config_endpoint_v3_Endpoint_AdditionalAddress {
+  /**
+   * Additional address that is associated with the endpoint.
+   */
+  'address'?: (_envoy_config_core_v3_Address | null);
+}
+
+export interface _envoy_config_endpoint_v3_Endpoint_AdditionalAddress__Output {
+  /**
+   * Additional address that is associated with the endpoint.
+   */
+  'address': (_envoy_config_core_v3_Address__Output | null);
+}
+
 /**
  * The optional health check configuration.
  */
@@ -107,6 +121,14 @@ export interface Endpoint {
    * :ref:`auto_host_rewrite <envoy_v3_api_field_config.route.v3.RouteAction.auto_host_rewrite>`.
    */
   'hostname'?: (string);
+  /**
+   * An ordered list of addresses that together with ``address`` comprise the
+   * list of addresses for an endpoint. The address given in the ``address`` is
+   * prepended to this list. It is assumed that the list must already be
+   * sorted by preference order of the addresses. This will only be supported
+   * for STATIC and EDS clusters.
+   */
+  'additional_addresses'?: (_envoy_config_endpoint_v3_Endpoint_AdditionalAddress)[];
 }
 
 /**
@@ -142,4 +164,12 @@ export interface Endpoint__Output {
    * :ref:`auto_host_rewrite <envoy_v3_api_field_config.route.v3.RouteAction.auto_host_rewrite>`.
    */
   'hostname': (string);
+  /**
+   * An ordered list of addresses that together with ``address`` comprise the
+   * list of addresses for an endpoint. The address given in the ``address`` is
+   * prepended to this list. It is assumed that the list must already be
+   * sorted by preference order of the addresses. This will only be supported
+   * for STATIC and EDS clusters.
+   */
+  'additional_addresses': (_envoy_config_endpoint_v3_Endpoint_AdditionalAddress__Output)[];
 }

packages/grpc-js-xds/src/generated/envoy/config/endpoint/v3/LbEndpoint.ts

@@ -86,5 +86,5 @@ export interface LbEndpoint__Output {
   /**
    * Upstream host identifier or a named reference.
    */
-  'host_identifier': "endpoint"|"endpoint_name";
+  'host_identifier'?: "endpoint"|"endpoint_name";
 }

packages/grpc-js-xds/src/generated/envoy/config/endpoint/v3/LocalityLbEndpoints.ts

@@ -4,6 +4,7 @@ import type { Locality as _envoy_config_core_v3_Locality, Locality__Output as _e
 import type { LbEndpoint as _envoy_config_endpoint_v3_LbEndpoint, LbEndpoint__Output as _envoy_config_endpoint_v3_LbEndpoint__Output } from '../../../../envoy/config/endpoint/v3/LbEndpoint';
 import type { UInt32Value as _google_protobuf_UInt32Value, UInt32Value__Output as _google_protobuf_UInt32Value__Output } from '../../../../google/protobuf/UInt32Value';
 import type { LedsClusterLocalityConfig as _envoy_config_endpoint_v3_LedsClusterLocalityConfig, LedsClusterLocalityConfig__Output as _envoy_config_endpoint_v3_LedsClusterLocalityConfig__Output } from '../../../../envoy/config/endpoint/v3/LedsClusterLocalityConfig';
+import type { Metadata as _envoy_config_core_v3_Metadata, Metadata__Output as _envoy_config_core_v3_Metadata__Output } from '../../../../envoy/config/core/v3/Metadata';
 
 /**
  * [#not-implemented-hide:]
@@ -25,7 +26,7 @@ export interface _envoy_config_endpoint_v3_LocalityLbEndpoints_LbEndpointList__O
  * A group of endpoints belonging to a Locality.
  * One can have multiple LocalityLbEndpoints for a locality, but only if
  * they have different priorities.
- * [#next-free-field: 9]
+ * [#next-free-field: 10]
  */
 export interface LocalityLbEndpoints {
   /**
@@ -57,9 +58,9 @@ export interface LocalityLbEndpoints {
    * default to the highest priority (0).
    * 
    * Under usual circumstances, Envoy will only select endpoints for the highest
-   * priority (0). In the event all endpoints for a particular priority are
+   * priority (0). In the event that enough endpoints for a particular priority are
    * unavailable/unhealthy, Envoy will fail over to selecting endpoints for the
-   * next highest priority group.
+   * next highest priority group. Read more at :ref:`priority levels <arch_overview_load_balancing_priority_levels>`.
    * 
    * Priorities should range from 0 (highest) to N (lowest) without skipping.
    */
@@ -83,6 +84,10 @@ export interface LocalityLbEndpoints {
    * LEDS Configuration for the current locality.
    */
   'leds_cluster_locality_config'?: (_envoy_config_endpoint_v3_LedsClusterLocalityConfig | null);
+  /**
+   * Metadata to provide additional information about the locality endpoints in aggregate.
+   */
+  'metadata'?: (_envoy_config_core_v3_Metadata | null);
   /**
    * [#not-implemented-hide:]
    */
@@ -93,7 +98,7 @@ export interface LocalityLbEndpoints {
  * A group of endpoints belonging to a Locality.
  * One can have multiple LocalityLbEndpoints for a locality, but only if
  * they have different priorities.
- * [#next-free-field: 9]
+ * [#next-free-field: 10]
  */
 export interface LocalityLbEndpoints__Output {
   /**
@@ -125,9 +130,9 @@ export interface LocalityLbEndpoints__Output {
    * default to the highest priority (0).
    * 
    * Under usual circumstances, Envoy will only select endpoints for the highest
-   * priority (0). In the event all endpoints for a particular priority are
+   * priority (0). In the event that enough endpoints for a particular priority are
    * unavailable/unhealthy, Envoy will fail over to selecting endpoints for the
-   * next highest priority group.
+   * next highest priority group. Read more at :ref:`priority levels <arch_overview_load_balancing_priority_levels>`.
    * 
    * Priorities should range from 0 (highest) to N (lowest) without skipping.
    */
@@ -151,8 +156,12 @@ export interface LocalityLbEndpoints__Output {
    * LEDS Configuration for the current locality.
    */
   'leds_cluster_locality_config'?: (_envoy_config_endpoint_v3_LedsClusterLocalityConfig__Output | null);
+  /**
+   * Metadata to provide additional information about the locality endpoints in aggregate.
+   */
+  'metadata': (_envoy_config_core_v3_Metadata__Output | null);
   /**
    * [#not-implemented-hide:]
    */
-  'lb_config': "load_balancer_endpoints"|"leds_cluster_locality_config";
+  'lb_config'?: "load_balancer_endpoints"|"leds_cluster_locality_config";
 }

packages/grpc-js-xds/src/generated/envoy/config/endpoint/v3/UnnamedEndpointLoadMetricStats.ts

@@ -0,0 +1,33 @@
+// Original file: deps/envoy-api/envoy/config/endpoint/v3/load_report.proto
+
+import type { Long } from '@grpc/proto-loader';
+
+/**
+ * Same as EndpointLoadMetricStats, except without the metric_name field.
+ */
+export interface UnnamedEndpointLoadMetricStats {
+  /**
+   * Number of calls that finished and included this metric.
+   */
+  'num_requests_finished_with_metric'?: (number | string | Long);
+  /**
+   * Sum of metric values across all calls that finished with this metric for
+   * load_reporting_interval.
+   */
+  'total_metric_value'?: (number | string);
+}
+
+/**
+ * Same as EndpointLoadMetricStats, except without the metric_name field.
+ */
+export interface UnnamedEndpointLoadMetricStats__Output {
+  /**
+   * Number of calls that finished and included this metric.
+   */
+  'num_requests_finished_with_metric': (string);
+  /**
+   * Sum of metric values across all calls that finished with this metric for
+   * load_reporting_interval.
+   */
+  'total_metric_value': (number);
+}

packages/grpc-js-xds/src/generated/envoy/config/endpoint/v3/UpstreamLocalityStats.ts

@@ -3,13 +3,14 @@
 import type { Locality as _envoy_config_core_v3_Locality, Locality__Output as _envoy_config_core_v3_Locality__Output } from '../../../../envoy/config/core/v3/Locality';
 import type { EndpointLoadMetricStats as _envoy_config_endpoint_v3_EndpointLoadMetricStats, EndpointLoadMetricStats__Output as _envoy_config_endpoint_v3_EndpointLoadMetricStats__Output } from '../../../../envoy/config/endpoint/v3/EndpointLoadMetricStats';
 import type { UpstreamEndpointStats as _envoy_config_endpoint_v3_UpstreamEndpointStats, UpstreamEndpointStats__Output as _envoy_config_endpoint_v3_UpstreamEndpointStats__Output } from '../../../../envoy/config/endpoint/v3/UpstreamEndpointStats';
+import type { UnnamedEndpointLoadMetricStats as _envoy_config_endpoint_v3_UnnamedEndpointLoadMetricStats, UnnamedEndpointLoadMetricStats__Output as _envoy_config_endpoint_v3_UnnamedEndpointLoadMetricStats__Output } from '../../../../envoy/config/endpoint/v3/UnnamedEndpointLoadMetricStats';
 import type { Long } from '@grpc/proto-loader';
 
 /**
  * These are stats Envoy reports to the management server at a frequency defined by
  * :ref:`LoadStatsResponse.load_reporting_interval<envoy_v3_api_field_service.load_stats.v3.LoadStatsResponse.load_reporting_interval>`.
  * Stats per upstream region/zone and optionally per subzone.
- * [#next-free-field: 9]
+ * [#next-free-field: 15]
  */
 export interface UpstreamLocalityStats {
   /**
@@ -32,7 +33,8 @@ export interface UpstreamLocalityStats {
    */
   'total_error_requests'?: (number | string | Long);
   /**
-   * Stats for multi-dimensional load balancing.
+   * Named stats for multi-dimensional load balancing.
+   * These typically come from endpoint metrics reported via ORCA.
    */
   'load_metric_stats'?: (_envoy_config_endpoint_v3_EndpointLoadMetricStats)[];
   /**
@@ -52,13 +54,56 @@ export interface UpstreamLocalityStats {
    * upstream endpoints in the locality.
    */
   'total_issued_requests'?: (number | string | Long);
+  /**
+   * The total number of connections in an established state at the time of the
+   * report. This field is aggregated over all the upstream endpoints in the
+   * locality.
+   * In Envoy, this information may be based on ``upstream_cx_active metric``.
+   * [#not-implemented-hide:]
+   */
+  'total_active_connections'?: (number | string | Long);
+  /**
+   * The total number of connections opened since the last report.
+   * This field is aggregated over all the upstream endpoints in the locality.
+   * In Envoy, this information may be based on ``upstream_cx_total`` metric
+   * compared to itself between start and end of an interval, i.e.
+   * ``upstream_cx_total``(now) - ``upstream_cx_total``(now -
+   * load_report_interval).
+   * [#not-implemented-hide:]
+   */
+  'total_new_connections'?: (number | string | Long);
+  /**
+   * The total number of connection failures since the last report.
+   * This field is aggregated over all the upstream endpoints in the locality.
+   * In Envoy, this information may be based on ``upstream_cx_connect_fail``
+   * metric compared to itself between start and end of an interval, i.e.
+   * ``upstream_cx_connect_fail``(now) - ``upstream_cx_connect_fail``(now -
+   * load_report_interval).
+   * [#not-implemented-hide:]
+   */
+  'total_fail_connections'?: (number | string | Long);
+  /**
+   * CPU utilization stats for multi-dimensional load balancing.
+   * This typically comes from endpoint metrics reported via ORCA.
+   */
+  'cpu_utilization'?: (_envoy_config_endpoint_v3_UnnamedEndpointLoadMetricStats | null);
+  /**
+   * Memory utilization for multi-dimensional load balancing.
+   * This typically comes from endpoint metrics reported via ORCA.
+   */
+  'mem_utilization'?: (_envoy_config_endpoint_v3_UnnamedEndpointLoadMetricStats | null);
+  /**
+   * Blended application-defined utilization for multi-dimensional load balancing.
+   * This typically comes from endpoint metrics reported via ORCA.
+   */
+  'application_utilization'?: (_envoy_config_endpoint_v3_UnnamedEndpointLoadMetricStats | null);
 }
 
 /**
  * These are stats Envoy reports to the management server at a frequency defined by
  * :ref:`LoadStatsResponse.load_reporting_interval<envoy_v3_api_field_service.load_stats.v3.LoadStatsResponse.load_reporting_interval>`.
  * Stats per upstream region/zone and optionally per subzone.
- * [#next-free-field: 9]
+ * [#next-free-field: 15]
  */
 export interface UpstreamLocalityStats__Output {
   /**
@@ -81,7 +126,8 @@ export interface UpstreamLocalityStats__Output {
    */
   'total_error_requests': (string);
   /**
-   * Stats for multi-dimensional load balancing.
+   * Named stats for multi-dimensional load balancing.
+   * These typically come from endpoint metrics reported via ORCA.
    */
   'load_metric_stats': (_envoy_config_endpoint_v3_EndpointLoadMetricStats__Output)[];
   /**
@@ -101,4 +147,47 @@ export interface UpstreamLocalityStats__Output {
    * upstream endpoints in the locality.
    */
   'total_issued_requests': (string);
+  /**
+   * The total number of connections in an established state at the time of the
+   * report. This field is aggregated over all the upstream endpoints in the
+   * locality.
+   * In Envoy, this information may be based on ``upstream_cx_active metric``.
+   * [#not-implemented-hide:]
+   */
+  'total_active_connections': (string);
+  /**
+   * The total number of connections opened since the last report.
+   * This field is aggregated over all the upstream endpoints in the locality.
+   * In Envoy, this information may be based on ``upstream_cx_total`` metric
+   * compared to itself between start and end of an interval, i.e.
+   * ``upstream_cx_total``(now) - ``upstream_cx_total``(now -
+   * load_report_interval).
+   * [#not-implemented-hide:]
+   */
+  'total_new_connections': (string);
+  /**
+   * The total number of connection failures since the last report.
+   * This field is aggregated over all the upstream endpoints in the locality.
+   * In Envoy, this information may be based on ``upstream_cx_connect_fail``
+   * metric compared to itself between start and end of an interval, i.e.
+   * ``upstream_cx_connect_fail``(now) - ``upstream_cx_connect_fail``(now -
+   * load_report_interval).
+   * [#not-implemented-hide:]
+   */
+  'total_fail_connections': (string);
+  /**
+   * CPU utilization stats for multi-dimensional load balancing.
+   * This typically comes from endpoint metrics reported via ORCA.
+   */
+  'cpu_utilization': (_envoy_config_endpoint_v3_UnnamedEndpointLoadMetricStats__Output | null);
+  /**
+   * Memory utilization for multi-dimensional load balancing.
+   * This typically comes from endpoint metrics reported via ORCA.
+   */
+  'mem_utilization': (_envoy_config_endpoint_v3_UnnamedEndpointLoadMetricStats__Output | null);
+  /**
+   * Blended application-defined utilization for multi-dimensional load balancing.
+   * This typically comes from endpoint metrics reported via ORCA.
+   */
+  'application_utilization': (_envoy_config_endpoint_v3_UnnamedEndpointLoadMetricStats__Output | null);
 }

packages/grpc-js-xds/src/generated/envoy/config/listener/v3/Filter.ts

@@ -21,7 +21,6 @@ export interface Filter {
    * Configuration source specifier for an extension configuration discovery
    * service. In case of a failure and without the default configuration, the
    * listener closes the connections.
-   * [#not-implemented-hide:]
    */
   'config_discovery'?: (_envoy_config_core_v3_ExtensionConfigSource | null);
   'config_type'?: "typed_config"|"config_discovery";
@@ -45,8 +44,7 @@ export interface Filter__Output {
    * Configuration source specifier for an extension configuration discovery
    * service. In case of a failure and without the default configuration, the
    * listener closes the connections.
-   * [#not-implemented-hide:]
    */
   'config_discovery'?: (_envoy_config_core_v3_ExtensionConfigSource__Output | null);
-  'config_type': "typed_config"|"config_discovery";
+  'config_type'?: "typed_config"|"config_discovery";
 }

packages/grpc-js-xds/src/generated/envoy/config/listener/v3/Listener.ts

@@ -47,7 +47,7 @@ export interface _envoy_config_listener_v3_Listener_ConnectionBalanceConfig__Out
    * [#extension-category: envoy.network.connection_balance]
    */
   'extend_balance'?: (_envoy_config_core_v3_TypedExtensionConfig__Output | null);
-  'balance_type': "exact_balance"|"extend_balance";
+  'balance_type'?: "exact_balance"|"extend_balance";
 }
 
 /**
@@ -148,7 +148,7 @@ export interface _envoy_config_listener_v3_Listener_InternalListenerConfig__Outp
 }
 
 /**
- * [#next-free-field: 34]
+ * [#next-free-field: 36]
  */
 export interface Listener {
   /**
@@ -208,7 +208,12 @@ export interface Listener {
    * before a connection is created.
    * UDP Listener filters can be specified when the protocol in the listener socket address in
    * :ref:`protocol <envoy_v3_api_field_config.core.v3.SocketAddress.protocol>` is :ref:`UDP
-   * <envoy_v3_api_enum_value_config.core.v3.SocketAddress.Protocol.UDP>`.
+   * <envoy_v3_api_enum_value_config.core.v3.SocketAddress.Protocol.UDP>` and no
+   * :ref:`quic_options <envoy_v3_api_field_config.listener.v3.UdpListenerConfig.quic_options>` is specified in :ref:`udp_listener_config <envoy_v3_api_field_config.listener.v3.Listener.udp_listener_config>`.
+   * QUIC listener filters can be specified when :ref:`quic_options
+   * <envoy_v3_api_field_config.listener.v3.UdpListenerConfig.quic_options>` is
+   * specified in :ref:`udp_listener_config <envoy_v3_api_field_config.listener.v3.Listener.udp_listener_config>`.
+   * They are processed sequentially right before connection creation. And like TCP Listener filters, they can be used to manipulate the connection metadata and socket. But the difference is that they can't be used to pause connection creation.
    */
   'listener_filters'?: (_envoy_config_listener_v3_ListenerFilter)[];
   /**
@@ -258,7 +263,7 @@ export interface Listener {
    * Additional socket options that may not be present in Envoy source code or
    * precompiled binaries. The socket options can be updated for a listener when
    * :ref:`enable_reuse_port <envoy_v3_api_field_config.listener.v3.Listener.enable_reuse_port>`
-   * is `true`. Otherwise, if socket options change during a listener update the update will be rejected
+   * is ``true``. Otherwise, if socket options change during a listener update the update will be rejected
    * to make it clear that the options were not updated.
    */
   'socket_options'?: (_envoy_config_core_v3_SocketOption)[];
@@ -433,6 +438,21 @@ export interface Listener {
    * all addresses use the same protocol, and multiple internal addresses are not supported.
    */
   'additional_addresses'?: (_envoy_config_listener_v3_AdditionalAddress)[];
+  /**
+   * The maximum number of connections to accept from the kernel per socket
+   * event. Envoy may decide to close these connections after accepting them
+   * from the kernel e.g. due to load shedding, or other policies.
+   * If there are more than max_connections_to_accept_per_socket_event
+   * connections pending accept, connections over this threshold will be
+   * accepted in later event loop iterations.
+   * If no value is provided Envoy will accept all connections pending accept
+   * from the kernel.
+   */
+  'max_connections_to_accept_per_socket_event'?: (_google_protobuf_UInt32Value | null);
+  /**
+   * Whether the listener bypasses configured overload manager actions.
+   */
+  'bypass_overload_manager'?: (boolean);
   /**
    * The exclusive listener type and the corresponding config.
    */
@@ -440,7 +460,7 @@ export interface Listener {
 }
 
 /**
- * [#next-free-field: 34]
+ * [#next-free-field: 36]
  */
 export interface Listener__Output {
   /**
@@ -500,7 +520,12 @@ export interface Listener__Output {
    * before a connection is created.
    * UDP Listener filters can be specified when the protocol in the listener socket address in
    * :ref:`protocol <envoy_v3_api_field_config.core.v3.SocketAddress.protocol>` is :ref:`UDP
-   * <envoy_v3_api_enum_value_config.core.v3.SocketAddress.Protocol.UDP>`.
+   * <envoy_v3_api_enum_value_config.core.v3.SocketAddress.Protocol.UDP>` and no
+   * :ref:`quic_options <envoy_v3_api_field_config.listener.v3.UdpListenerConfig.quic_options>` is specified in :ref:`udp_listener_config <envoy_v3_api_field_config.listener.v3.Listener.udp_listener_config>`.
+   * QUIC listener filters can be specified when :ref:`quic_options
+   * <envoy_v3_api_field_config.listener.v3.UdpListenerConfig.quic_options>` is
+   * specified in :ref:`udp_listener_config <envoy_v3_api_field_config.listener.v3.Listener.udp_listener_config>`.
+   * They are processed sequentially right before connection creation. And like TCP Listener filters, they can be used to manipulate the connection metadata and socket. But the difference is that they can't be used to pause connection creation.
    */
   'listener_filters': (_envoy_config_listener_v3_ListenerFilter__Output)[];
   /**
@@ -550,7 +575,7 @@ export interface Listener__Output {
    * Additional socket options that may not be present in Envoy source code or
    * precompiled binaries. The socket options can be updated for a listener when
    * :ref:`enable_reuse_port <envoy_v3_api_field_config.listener.v3.Listener.enable_reuse_port>`
-   * is `true`. Otherwise, if socket options change during a listener update the update will be rejected
+   * is ``true``. Otherwise, if socket options change during a listener update the update will be rejected
    * to make it clear that the options were not updated.
    */
   'socket_options': (_envoy_config_core_v3_SocketOption__Output)[];
@@ -725,8 +750,23 @@ export interface Listener__Output {
    * all addresses use the same protocol, and multiple internal addresses are not supported.
    */
   'additional_addresses': (_envoy_config_listener_v3_AdditionalAddress__Output)[];
+  /**
+   * The maximum number of connections to accept from the kernel per socket
+   * event. Envoy may decide to close these connections after accepting them
+   * from the kernel e.g. due to load shedding, or other policies.
+   * If there are more than max_connections_to_accept_per_socket_event
+   * connections pending accept, connections over this threshold will be
+   * accepted in later event loop iterations.
+   * If no value is provided Envoy will accept all connections pending accept
+   * from the kernel.
+   */
+  'max_connections_to_accept_per_socket_event': (_google_protobuf_UInt32Value__Output | null);
+  /**
+   * Whether the listener bypasses configured overload manager actions.
+   */
+  'bypass_overload_manager': (boolean);
   /**
    * The exclusive listener type and the corresponding config.
    */
-  'listener_specifier': "internal_listener";
+  'listener_specifier'?: "internal_listener";
 }

packages/grpc-js-xds/src/generated/envoy/config/listener/v3/ListenerFilter.ts

@@ -59,5 +59,5 @@ export interface ListenerFilter__Output {
    * listener closes the connections.
    */
   'config_discovery'?: (_envoy_config_core_v3_ExtensionConfigSource__Output | null);
-  'config_type': "typed_config"|"config_discovery";
+  'config_type'?: "typed_config"|"config_discovery";
 }

packages/grpc-js-xds/src/generated/envoy/config/listener/v3/ListenerFilterChainMatchPredicate.ts

@@ -132,5 +132,5 @@ export interface ListenerFilterChainMatchPredicate__Output {
    * the owning listener filter is after :ref:`an original_dst listener filter <config_listener_filters_original_dst>`.
    */
   'destination_port_range'?: (_envoy_type_v3_Int32Range__Output | null);
-  'rule': "or_match"|"and_match"|"not_match"|"any_match"|"destination_port_range";
+  'rule'?: "or_match"|"and_match"|"not_match"|"any_match"|"destination_port_range";
 }

packages/grpc-js-xds/src/generated/envoy/config/listener/v3/QuicProtocolOptions.ts

@@ -5,10 +5,11 @@ import type { Duration as _google_protobuf_Duration, Duration__Output as _google
 import type { RuntimeFeatureFlag as _envoy_config_core_v3_RuntimeFeatureFlag, RuntimeFeatureFlag__Output as _envoy_config_core_v3_RuntimeFeatureFlag__Output } from '../../../../envoy/config/core/v3/RuntimeFeatureFlag';
 import type { UInt32Value as _google_protobuf_UInt32Value, UInt32Value__Output as _google_protobuf_UInt32Value__Output } from '../../../../google/protobuf/UInt32Value';
 import type { TypedExtensionConfig as _envoy_config_core_v3_TypedExtensionConfig, TypedExtensionConfig__Output as _envoy_config_core_v3_TypedExtensionConfig__Output } from '../../../../envoy/config/core/v3/TypedExtensionConfig';
+import type { BoolValue as _google_protobuf_BoolValue, BoolValue__Output as _google_protobuf_BoolValue__Output } from '../../../../google/protobuf/BoolValue';
 
 /**
  * Configuration specific to the UDP QUIC listener.
- * [#next-free-field: 10]
+ * [#next-free-field: 12]
  */
 export interface QuicProtocolOptions {
   'quic_protocol_options'?: (_envoy_config_core_v3_QuicProtocolOptions | null);
@@ -60,16 +61,27 @@ export interface QuicProtocolOptions {
   'connection_id_generator_config'?: (_envoy_config_core_v3_TypedExtensionConfig | null);
   /**
    * Configure the server's preferred address to advertise so that client can migrate to it. See :ref:`example <envoy_v3_api_msg_extensions.quic.server_preferred_address.v3.FixedServerPreferredAddressConfig>` which configures a pair of v4 and v6 preferred addresses.
-   * The current QUICHE implementation will advertise only one of the preferred IPv4 and IPv6 addresses based on the address family the client initially connects with, and only if the client is also QUICHE-based.
+   * The current QUICHE implementation will advertise only one of the preferred IPv4 and IPv6 addresses based on the address family the client initially connects with.
    * If not specified, Envoy will not advertise any server's preferred address.
    * [#extension-category: envoy.quic.server_preferred_address]
    */
   'server_preferred_address_config'?: (_envoy_config_core_v3_TypedExtensionConfig | null);
+  /**
+   * Configure the server to send transport parameter `disable_active_migration <https://www.rfc-editor.org/rfc/rfc9000#section-18.2-4.30.1>`_.
+   * Defaults to false (do not send this transport parameter).
+   */
+  'send_disable_active_migration'?: (_google_protobuf_BoolValue | null);
+  /**
+   * Configure which implementation of ``quic::QuicConnectionDebugVisitor`` to be used for this listener.
+   * If not specified, no debug visitor will be attached to connections.
+   * [#extension-category: envoy.quic.connection_debug_visitor]
+   */
+  'connection_debug_visitor_config'?: (_envoy_config_core_v3_TypedExtensionConfig | null);
 }
 
 /**
  * Configuration specific to the UDP QUIC listener.
- * [#next-free-field: 10]
+ * [#next-free-field: 12]
  */
 export interface QuicProtocolOptions__Output {
   'quic_protocol_options': (_envoy_config_core_v3_QuicProtocolOptions__Output | null);
@@ -121,9 +133,20 @@ export interface QuicProtocolOptions__Output {
   'connection_id_generator_config': (_envoy_config_core_v3_TypedExtensionConfig__Output | null);
   /**
    * Configure the server's preferred address to advertise so that client can migrate to it. See :ref:`example <envoy_v3_api_msg_extensions.quic.server_preferred_address.v3.FixedServerPreferredAddressConfig>` which configures a pair of v4 and v6 preferred addresses.
-   * The current QUICHE implementation will advertise only one of the preferred IPv4 and IPv6 addresses based on the address family the client initially connects with, and only if the client is also QUICHE-based.
+   * The current QUICHE implementation will advertise only one of the preferred IPv4 and IPv6 addresses based on the address family the client initially connects with.
    * If not specified, Envoy will not advertise any server's preferred address.
    * [#extension-category: envoy.quic.server_preferred_address]
    */
   'server_preferred_address_config': (_envoy_config_core_v3_TypedExtensionConfig__Output | null);
+  /**
+   * Configure the server to send transport parameter `disable_active_migration <https://www.rfc-editor.org/rfc/rfc9000#section-18.2-4.30.1>`_.
+   * Defaults to false (do not send this transport parameter).
+   */
+  'send_disable_active_migration': (_google_protobuf_BoolValue__Output | null);
+  /**
+   * Configure which implementation of ``quic::QuicConnectionDebugVisitor`` to be used for this listener.
+   * If not specified, no debug visitor will be attached to connections.
+   * [#extension-category: envoy.quic.connection_debug_visitor]
+   */
+  'connection_debug_visitor_config': (_envoy_config_core_v3_TypedExtensionConfig__Output | null);
 }

packages/grpc-js-xds/src/generated/envoy/config/rbac/v3/Action.ts

@@ -0,0 +1,63 @@
+// Original file: deps/envoy-api/envoy/config/rbac/v3/rbac.proto
+
+import type { _envoy_config_rbac_v3_RBAC_Action, _envoy_config_rbac_v3_RBAC_Action__Output } from '../../../../envoy/config/rbac/v3/RBAC';
+
+/**
+ * Action defines the result of allowance or denial when a request matches the matcher.
+ */
+export interface Action {
+  /**
+   * The name indicates the policy name.
+   */
+  'name'?: (string);
+  /**
+   * The action to take if the matcher matches. Every action either allows or denies a request,
+   * and can also carry out action-specific operations.
+   * 
+   * Actions:
+   * 
+   * * ``ALLOW``: If the request gets matched on ALLOW, it is permitted.
+   * * ``DENY``: If the request gets matched on DENY, it is not permitted.
+   * * ``LOG``: If the request gets matched on LOG, it is permitted. Besides, the
+   * dynamic metadata key ``access_log_hint`` under the shared key namespace
+   * ``envoy.common`` will be set to the value ``true``.
+   * * If the request cannot get matched, it will fallback to ``DENY``.
+   * 
+   * Log behavior:
+   * 
+   * If the RBAC matcher contains at least one LOG action, the dynamic
+   * metadata key ``access_log_hint`` will be set based on if the request
+   * get matched on the LOG action.
+   */
+  'action'?: (_envoy_config_rbac_v3_RBAC_Action);
+}
+
+/**
+ * Action defines the result of allowance or denial when a request matches the matcher.
+ */
+export interface Action__Output {
+  /**
+   * The name indicates the policy name.
+   */
+  'name': (string);
+  /**
+   * The action to take if the matcher matches. Every action either allows or denies a request,
+   * and can also carry out action-specific operations.
+   * 
+   * Actions:
+   * 
+   * * ``ALLOW``: If the request gets matched on ALLOW, it is permitted.
+   * * ``DENY``: If the request gets matched on DENY, it is not permitted.
+   * * ``LOG``: If the request gets matched on LOG, it is permitted. Besides, the
+   * dynamic metadata key ``access_log_hint`` under the shared key namespace
+   * ``envoy.common`` will be set to the value ``true``.
+   * * If the request cannot get matched, it will fallback to ``DENY``.
+   * 
+   * Log behavior:
+   * 
+   * If the RBAC matcher contains at least one LOG action, the dynamic
+   * metadata key ``access_log_hint`` will be set based on if the request
+   * get matched on the LOG action.
+   */
+  'action': (_envoy_config_rbac_v3_RBAC_Action__Output);
+}

packages/grpc-js-xds/src/generated/envoy/config/rbac/v3/Permission.ts

@@ -0,0 +1,198 @@
+// Original file: deps/envoy-api/envoy/config/rbac/v3/rbac.proto
+
+import type { HeaderMatcher as _envoy_config_route_v3_HeaderMatcher, HeaderMatcher__Output as _envoy_config_route_v3_HeaderMatcher__Output } from '../../../../envoy/config/route/v3/HeaderMatcher';
+import type { CidrRange as _envoy_config_core_v3_CidrRange, CidrRange__Output as _envoy_config_core_v3_CidrRange__Output } from '../../../../envoy/config/core/v3/CidrRange';
+import type { MetadataMatcher as _envoy_type_matcher_v3_MetadataMatcher, MetadataMatcher__Output as _envoy_type_matcher_v3_MetadataMatcher__Output } from '../../../../envoy/type/matcher/v3/MetadataMatcher';
+import type { Permission as _envoy_config_rbac_v3_Permission, Permission__Output as _envoy_config_rbac_v3_Permission__Output } from '../../../../envoy/config/rbac/v3/Permission';
+import type { StringMatcher as _envoy_type_matcher_v3_StringMatcher, StringMatcher__Output as _envoy_type_matcher_v3_StringMatcher__Output } from '../../../../envoy/type/matcher/v3/StringMatcher';
+import type { PathMatcher as _envoy_type_matcher_v3_PathMatcher, PathMatcher__Output as _envoy_type_matcher_v3_PathMatcher__Output } from '../../../../envoy/type/matcher/v3/PathMatcher';
+import type { Int32Range as _envoy_type_v3_Int32Range, Int32Range__Output as _envoy_type_v3_Int32Range__Output } from '../../../../envoy/type/v3/Int32Range';
+import type { TypedExtensionConfig as _envoy_config_core_v3_TypedExtensionConfig, TypedExtensionConfig__Output as _envoy_config_core_v3_TypedExtensionConfig__Output } from '../../../../envoy/config/core/v3/TypedExtensionConfig';
+
+/**
+ * Used in the ``and_rules`` and ``or_rules`` fields in the ``rule`` oneof. Depending on the context,
+ * each are applied with the associated behavior.
+ */
+export interface _envoy_config_rbac_v3_Permission_Set {
+  'rules'?: (_envoy_config_rbac_v3_Permission)[];
+}
+
+/**
+ * Used in the ``and_rules`` and ``or_rules`` fields in the ``rule`` oneof. Depending on the context,
+ * each are applied with the associated behavior.
+ */
+export interface _envoy_config_rbac_v3_Permission_Set__Output {
+  'rules': (_envoy_config_rbac_v3_Permission__Output)[];
+}
+
+/**
+ * Permission defines an action (or actions) that a principal can take.
+ * [#next-free-field: 14]
+ */
+export interface Permission {
+  /**
+   * A set of rules that all must match in order to define the action.
+   */
+  'and_rules'?: (_envoy_config_rbac_v3_Permission_Set | null);
+  /**
+   * A set of rules where at least one must match in order to define the action.
+   */
+  'or_rules'?: (_envoy_config_rbac_v3_Permission_Set | null);
+  /**
+   * When any is set, it matches any action.
+   */
+  'any'?: (boolean);
+  /**
+   * A header (or pseudo-header such as :path or :method) on the incoming HTTP request. Only
+   * available for HTTP request.
+   * Note: the pseudo-header :path includes the query and fragment string. Use the ``url_path``
+   * field if you want to match the URL path without the query and fragment string.
+   */
+  'header'?: (_envoy_config_route_v3_HeaderMatcher | null);
+  /**
+   * A CIDR block that describes the destination IP.
+   */
+  'destination_ip'?: (_envoy_config_core_v3_CidrRange | null);
+  /**
+   * A port number that describes the destination port connecting to.
+   */
+  'destination_port'?: (number);
+  /**
+   * Metadata that describes additional information about the action.
+   */
+  'metadata'?: (_envoy_type_matcher_v3_MetadataMatcher | null);
+  /**
+   * Negates matching the provided permission. For instance, if the value of
+   * ``not_rule`` would match, this permission would not match. Conversely, if
+   * the value of ``not_rule`` would not match, this permission would match.
+   */
+  'not_rule'?: (_envoy_config_rbac_v3_Permission | null);
+  /**
+   * The request server from the client's connection request. This is
+   * typically TLS SNI.
+   * 
+   * .. attention::
+   * 
+   * The behavior of this field may be affected by how Envoy is configured
+   * as explained below.
+   * 
+   * * If the :ref:`TLS Inspector <config_listener_filters_tls_inspector>`
+   * filter is not added, and if a ``FilterChainMatch`` is not defined for
+   * the :ref:`server name
+   * <envoy_v3_api_field_config.listener.v3.FilterChainMatch.server_names>`,
+   * a TLS connection's requested SNI server name will be treated as if it
+   * wasn't present.
+   * 
+   * * A :ref:`listener filter <arch_overview_listener_filters>` may
+   * overwrite a connection's requested server name within Envoy.
+   * 
+   * Please refer to :ref:`this FAQ entry <faq_how_to_setup_sni>` to learn to
+   * setup SNI.
+   */
+  'requested_server_name'?: (_envoy_type_matcher_v3_StringMatcher | null);
+  /**
+   * A URL path on the incoming HTTP request. Only available for HTTP.
+   */
+  'url_path'?: (_envoy_type_matcher_v3_PathMatcher | null);
+  /**
+   * A port number range that describes a range of destination ports connecting to.
+   */
+  'destination_port_range'?: (_envoy_type_v3_Int32Range | null);
+  /**
+   * Extension for configuring custom matchers for RBAC.
+   * [#extension-category: envoy.rbac.matchers]
+   */
+  'matcher'?: (_envoy_config_core_v3_TypedExtensionConfig | null);
+  /**
+   * URI template path matching.
+   * [#extension-category: envoy.path.match]
+   */
+  'uri_template'?: (_envoy_config_core_v3_TypedExtensionConfig | null);
+  'rule'?: "and_rules"|"or_rules"|"any"|"header"|"url_path"|"destination_ip"|"destination_port"|"destination_port_range"|"metadata"|"not_rule"|"requested_server_name"|"matcher"|"uri_template";
+}
+
+/**
+ * Permission defines an action (or actions) that a principal can take.
+ * [#next-free-field: 14]
+ */
+export interface Permission__Output {
+  /**
+   * A set of rules that all must match in order to define the action.
+   */
+  'and_rules'?: (_envoy_config_rbac_v3_Permission_Set__Output | null);
+  /**
+   * A set of rules where at least one must match in order to define the action.
+   */
+  'or_rules'?: (_envoy_config_rbac_v3_Permission_Set__Output | null);
+  /**
+   * When any is set, it matches any action.
+   */
+  'any'?: (boolean);
+  /**
+   * A header (or pseudo-header such as :path or :method) on the incoming HTTP request. Only
+   * available for HTTP request.
+   * Note: the pseudo-header :path includes the query and fragment string. Use the ``url_path``
+   * field if you want to match the URL path without the query and fragment string.
+   */
+  'header'?: (_envoy_config_route_v3_HeaderMatcher__Output | null);
+  /**
+   * A CIDR block that describes the destination IP.
+   */
+  'destination_ip'?: (_envoy_config_core_v3_CidrRange__Output | null);
+  /**
+   * A port number that describes the destination port connecting to.
+   */
+  'destination_port'?: (number);
+  /**
+   * Metadata that describes additional information about the action.
+   */
+  'metadata'?: (_envoy_type_matcher_v3_MetadataMatcher__Output | null);
+  /**
+   * Negates matching the provided permission. For instance, if the value of
+   * ``not_rule`` would match, this permission would not match. Conversely, if
+   * the value of ``not_rule`` would not match, this permission would match.
+   */
+  'not_rule'?: (_envoy_config_rbac_v3_Permission__Output | null);
+  /**
+   * The request server from the client's connection request. This is
+   * typically TLS SNI.
+   * 
+   * .. attention::
+   * 
+   * The behavior of this field may be affected by how Envoy is configured
+   * as explained below.
+   * 
+   * * If the :ref:`TLS Inspector <config_listener_filters_tls_inspector>`
+   * filter is not added, and if a ``FilterChainMatch`` is not defined for
+   * the :ref:`server name
+   * <envoy_v3_api_field_config.listener.v3.FilterChainMatch.server_names>`,
+   * a TLS connection's requested SNI server name will be treated as if it
+   * wasn't present.
+   * 
+   * * A :ref:`listener filter <arch_overview_listener_filters>` may
+   * overwrite a connection's requested server name within Envoy.
+   * 
+   * Please refer to :ref:`this FAQ entry <faq_how_to_setup_sni>` to learn to
+   * setup SNI.
+   */
+  'requested_server_name'?: (_envoy_type_matcher_v3_StringMatcher__Output | null);
+  /**
+   * A URL path on the incoming HTTP request. Only available for HTTP.
+   */
+  'url_path'?: (_envoy_type_matcher_v3_PathMatcher__Output | null);
+  /**
+   * A port number range that describes a range of destination ports connecting to.
+   */
+  'destination_port_range'?: (_envoy_type_v3_Int32Range__Output | null);
+  /**
+   * Extension for configuring custom matchers for RBAC.
+   * [#extension-category: envoy.rbac.matchers]
+   */
+  'matcher'?: (_envoy_config_core_v3_TypedExtensionConfig__Output | null);
+  /**
+   * URI template path matching.
+   * [#extension-category: envoy.path.match]
+   */
+  'uri_template'?: (_envoy_config_core_v3_TypedExtensionConfig__Output | null);
+  'rule'?: "and_rules"|"or_rules"|"any"|"header"|"url_path"|"destination_ip"|"destination_port"|"destination_port_range"|"metadata"|"not_rule"|"requested_server_name"|"matcher"|"uri_template";
+}

packages/grpc-js-xds/src/generated/envoy/config/rbac/v3/Policy.ts

@@ -0,0 +1,76 @@
+// Original file: deps/envoy-api/envoy/config/rbac/v3/rbac.proto
+
+import type { Permission as _envoy_config_rbac_v3_Permission, Permission__Output as _envoy_config_rbac_v3_Permission__Output } from '../../../../envoy/config/rbac/v3/Permission';
+import type { Principal as _envoy_config_rbac_v3_Principal, Principal__Output as _envoy_config_rbac_v3_Principal__Output } from '../../../../envoy/config/rbac/v3/Principal';
+import type { Expr as _google_api_expr_v1alpha1_Expr, Expr__Output as _google_api_expr_v1alpha1_Expr__Output } from '../../../../google/api/expr/v1alpha1/Expr';
+import type { CheckedExpr as _google_api_expr_v1alpha1_CheckedExpr, CheckedExpr__Output as _google_api_expr_v1alpha1_CheckedExpr__Output } from '../../../../google/api/expr/v1alpha1/CheckedExpr';
+
+/**
+ * Policy specifies a role and the principals that are assigned/denied the role.
+ * A policy matches if and only if at least one of its permissions match the
+ * action taking place AND at least one of its principals match the downstream
+ * AND the condition is true if specified.
+ */
+export interface Policy {
+  /**
+   * Required. The set of permissions that define a role. Each permission is
+   * matched with OR semantics. To match all actions for this policy, a single
+   * Permission with the ``any`` field set to true should be used.
+   */
+  'permissions'?: (_envoy_config_rbac_v3_Permission)[];
+  /**
+   * Required. The set of principals that are assigned/denied the role based on
+   * “action”. Each principal is matched with OR semantics. To match all
+   * downstreams for this policy, a single Principal with the ``any`` field set to
+   * true should be used.
+   */
+  'principals'?: (_envoy_config_rbac_v3_Principal)[];
+  /**
+   * An optional symbolic expression specifying an access control
+   * :ref:`condition <arch_overview_condition>`. The condition is combined
+   * with the permissions and the principals as a clause with AND semantics.
+   * Only be used when checked_condition is not used.
+   */
+  'condition'?: (_google_api_expr_v1alpha1_Expr | null);
+  /**
+   * [#not-implemented-hide:]
+   * An optional symbolic expression that has been successfully type checked.
+   * Only be used when condition is not used.
+   */
+  'checked_condition'?: (_google_api_expr_v1alpha1_CheckedExpr | null);
+}
+
+/**
+ * Policy specifies a role and the principals that are assigned/denied the role.
+ * A policy matches if and only if at least one of its permissions match the
+ * action taking place AND at least one of its principals match the downstream
+ * AND the condition is true if specified.
+ */
+export interface Policy__Output {
+  /**
+   * Required. The set of permissions that define a role. Each permission is
+   * matched with OR semantics. To match all actions for this policy, a single
+   * Permission with the ``any`` field set to true should be used.
+   */
+  'permissions': (_envoy_config_rbac_v3_Permission__Output)[];
+  /**
+   * Required. The set of principals that are assigned/denied the role based on
+   * “action”. Each principal is matched with OR semantics. To match all
+   * downstreams for this policy, a single Principal with the ``any`` field set to
+   * true should be used.
+   */
+  'principals': (_envoy_config_rbac_v3_Principal__Output)[];
+  /**
+   * An optional symbolic expression specifying an access control
+   * :ref:`condition <arch_overview_condition>`. The condition is combined
+   * with the permissions and the principals as a clause with AND semantics.
+   * Only be used when checked_condition is not used.
+   */
+  'condition': (_google_api_expr_v1alpha1_Expr__Output | null);
+  /**
+   * [#not-implemented-hide:]
+   * An optional symbolic expression that has been successfully type checked.
+   * Only be used when condition is not used.
+   */
+  'checked_condition': (_google_api_expr_v1alpha1_CheckedExpr__Output | null);
+}