fix(deps): update module cloud.google.com/go/logging to v1.21.1

Signed-off-by: Mend Renovate <bot@renovateapp.com>
2026-11-06 05:17:30 +00:00 · 2026-10-31 22:31:12 +00:00
1 parent 9aa9edfa78
commit 940c82b168
@@ -12,7 +12,7 @@ tool (

 require (
 	cloud.google.com/go/compute/metadata v0.10.0
-	cloud.google.com/go/logging v1.21.0
+	cloud.google.com/go/logging v1.21.1
 	dario.cat/mergo v1.0.2
 	github.com/Azure/go-ansiterm v0.0.0-20261013165250-51075c6ea6bc
 	github.com/Graylog2/go-gelf v0.0.0-20191017102106-1550ee647df0 // head of v2 branch
@@ -117,7 +117,7 @@ require (
 	golang.org/x/sys v0.49.0
 	golang.org/x/text v0.43.0
 	golang.org/x/time v0.16.0
-	google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc
+	google.golang.org/genproto/googleapis/api v0.0.0-20261012220534-4341edf3f941
 	google.golang.org/grpc v1.85.0
 	google.golang.org/protobuf v1.36.12
 	gotest.tools/v3 v3.5.2
@@ -128,8 +128,8 @@ require (

 require (
 	cloud.google.com/go v0.123.0 // indirect
-	cloud.google.com/go/auth v0.20.0 // indirect
-	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
+	cloud.google.com/go/auth v0.24.1-0.20261001053825-dbc26066f70a // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.3.0 // indirect
 	cloud.google.com/go/longrunning v1.3.0 // indirect
 	code.cloudfoundry.org/clock v1.60.0 // indirect
 	cyphar.com/go-pathrs v0.2.5 // indirect
@@ -212,10 +212,10 @@ require (
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/certificate-transparency-go v1.3.3 // indirect
 	github.com/google/go-containerregistry v0.22.0 // indirect
-	github.com/google/s2a-go v0.1.9 // indirect
+	github.com/google/s2a-go v0.1.11 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.17 // indirect
-	github.com/googleapis/gax-go/v2 v2.26.2 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.23 // indirect
+	github.com/googleapis/gax-go/v2 v2.27.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.31.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
@@ -298,9 +298,9 @@ require (
 	golang.org/x/mod v0.42.0 // indirect
 	golang.org/x/oauth2 v0.37.0 // indirect
 	golang.org/x/term v0.47.0 // indirect
-	google.golang.org/api v0.288.0 // indirect
-	google.golang.org/genproto v0.0.0-20260928230214-8a89bd6388cc // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect
+	google.golang.org/api v0.304.0 // indirect
+	google.golang.org/genproto v0.0.0-20261012220534-4341edf3f941 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20261012220534-4341edf3f941 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	k8s.io/apimachinery v0.37.0 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
@@ -1,17 +1,17 @@
 cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
 cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
-cloud.google.com/go/auth v0.20.0 h1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=
-cloud.google.com/go/auth v0.20.0/go.mod h1:942/yi/itH1SsmpyrbnTMDgGfdy2BUqIKyd0cyYLc5Q=
-cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
-cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
+cloud.google.com/go/auth v0.24.1-0.20261001053825-dbc26066f70a h1:jW1ZLFy9oa5ai8LOI40z6s+DL1cO/L1KSm9hVGnibn8=
+cloud.google.com/go/auth v0.24.1-0.20261001053825-dbc26066f70a/go.mod h1:1dmBXa9xfBvBr39ZnDUDkaaA91ccq9CcqENDgJA4d7c=
+cloud.google.com/go/auth/oauth2adapt v0.3.0 h1:FY8oSZpCYoUNv6QxVODuMjQz4IlSOVeiQtZ08vLPz88=
+cloud.google.com/go/auth/oauth2adapt v0.3.0/go.mod h1:7+2uCm7++XFO+/lN06c2HXpDXb/NMNn2/UwyBPbTnkk=
 cloud.google.com/go/compute/metadata v0.10.0 h1:pyKMUQSwchgkIBBJGdILqQbs/BNJXqwSA7Ej6LAvvtY=
 cloud.google.com/go/compute/metadata v0.10.0/go.mod h1:rGFHRrIif570kSibjFTMbt6/4/tzgJWFGI/HVol4GIk=
 cloud.google.com/go/iam v1.14.0 h1:YRIB1/4xxwJ+NfI6RQr1WaOoHHeV0MizJEj940nBXJA=
 cloud.google.com/go/iam v1.14.0/go.mod h1:JTPZfbHdGXJrOYREtkRoFzCDGaBdbA7ILLKO/DDuav0=
 cloud.google.com/go/kms v1.31.0 h1:LS8N92OxFDgOLg5NCo3OmbvjtQAIVT5gUHVLKIDHaFE=
 cloud.google.com/go/kms v1.31.0/go.mod h1:YIyXZym11R5uovJJt4oN5eUL3oPmirF3yKeIh6QAf4U=
-cloud.google.com/go/logging v1.21.0 h1:Grn9NZsh87BO5+CEtZFFdj5mXEAnrlPFEdHDMVo9p8Y=
-cloud.google.com/go/logging v1.21.0/go.mod h1:4foM+ucR/w1KQrJOh4tDr14iHUIt0MLh2cL8094/LZs=
+cloud.google.com/go/logging v1.21.1 h1:fvlcl/l7d4b0f3T5Y7u37GeDEPeDEKXN/y/Xs+KluUE=
+cloud.google.com/go/logging v1.21.1/go.mod h1:SntfPM/4mHzQEd/LiOO9/IUclKaucFHLemeLBk/mcsA=
 cloud.google.com/go/longrunning v1.3.0 h1:lZ6c8SJJBmILp/Wnr3vGnBLa0q+cYfSHRCcUfVI2hpI=
 cloud.google.com/go/longrunning v1.3.0/go.mod h1:wpgLxCn+UA3/TZ1bj/fW39mfDpwVlMPu1xKJyoMt7V0=
 code.cloudfoundry.org/clock v1.60.0 h1:X47eUg0qVXhzGnGSo6TTQtWKfT1vjMfomP7a3sXi2lo=
@@ -341,8 +341,8 @@ github.com/google/go-github v17.0.0+incompatible/go.mod h1:zLgOLi98H3fifZn+44m+u
 github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
 github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg=
 github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
-github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
-github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
+github.com/google/s2a-go v0.1.11 h1:7v1V1TraNGP63WptsAkNqr2w8jgm4vM6A6qx6Lsw9iM=
+github.com/google/s2a-go v0.1.11/go.mod h1:pz4tyvwXvJLLbyrkh6FW1eS2zPUXMaTmyNhYtyP2tNw=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/trillian v1.7.3 h1:hziW+vo4czis48tzx2GK5xRBl/ZxBA9B0/UR5avXOro=
@@ -350,10 +350,10 @@ github.com/google/trillian v1.7.3/go.mod h1:qh8iy4x/GvnVXUBd5pK4oncuT1Y9vVYfibQV
 github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.17 h1:73NfMHdiqo9JFU9+7a5ExpVa10/R29pXfZIaW559nrg=
-github.com/googleapis/enterprise-certificate-proxy v0.3.17/go.mod h1:rSEsBUemEBZEexP2y6jPp16LUmUbjmSbcPMQizR0o4k=
-github.com/googleapis/gax-go/v2 v2.26.2 h1:ydkmNXxj7bEmmeK5AihkKnWxyOyBR9TDebvp5L5izk8=
-github.com/googleapis/gax-go/v2 v2.26.2/go.mod h1:sMKqnMesnKH+3wiRJROcttA+cJoZoGbZl1vDQ8XYtGk=
+github.com/googleapis/enterprise-certificate-proxy v0.3.23 h1:J+VGF1wjAM2dU2kKUXZxJdDppRLReWP7KWcclfngQhc=
+github.com/googleapis/enterprise-certificate-proxy v0.3.23/go.mod h1:Y8NO/15GNLkrXI3OR5xOFmeU3XLX1sLSdtlXgJ0zmIw=
+github.com/googleapis/gax-go/v2 v2.27.0 h1:qe2iQOUzxb3fd6x6ewpIEixPQhJ+0Ihc/RRZhKA/2g0=
+github.com/googleapis/gax-go/v2 v2.27.0/go.mod h1:RofiqDw3ehcG4L0H1zO3D2Itpwd3/uS/7wdmbNDF1DE=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI=
@@ -859,14 +859,14 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/api v0.288.0 h1:glhO/J88obKP5I269W3hB73dvBKrjU56ZfmNlNXpgTU=
-google.golang.org/api v0.288.0/go.mod h1:lM2kYRzYUCBY91P9h6VF1PYmvhxii3O5hji37qRvIcY=
-google.golang.org/genproto v0.0.0-20260928230214-8a89bd6388cc h1:MBreUmlUQ+UROuto7tVQeNrZxy9ZxJsajKJQwWa8mLE=
-google.golang.org/genproto v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:JUQe2nbekxMCka0JpW+abO6SMvrY4Gk3+Cnl84QtcCg=
-google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc h1:rZHRz0ogq4Pid1IKtA/ivHi8XONVF5tqUQXA2TtgpkE=
-google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:K/n0XLazCJHjD73YuMyNJsN38BPPy1kfFnKxUXaThFU=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc h1:4bNTbnb44EqGVy9HaQxSY2jnafSUdgV3qHtedvNpDKg=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc=
+google.golang.org/api v0.304.0 h1:2R1dYSiIVQRGcKN901u9yPFEdJu5h90oGY5X4TcgbmA=
+google.golang.org/api v0.304.0/go.mod h1:dcjRWAy1QdjGb3Z67Qu0gdBWH2gL8Qoy/RI2ZVuvdeE=
+google.golang.org/genproto v0.0.0-20261012220534-4341edf3f941 h1:CXq2XEi5aEyLjjPZIwqrmQH8ZY4ctUwK7uyAx3mjX/U=
+google.golang.org/genproto v0.0.0-20261012220534-4341edf3f941/go.mod h1:3gK0ehnhP0V7/x3ypGoLyT3d0n6TSi/EcsphIjHrcz4=
+google.golang.org/genproto/googleapis/api v0.0.0-20261012220534-4341edf3f941 h1:DS/w3N8rsfrwxwgGSj6WhMsPo7aNQGmDx74J81zd0NQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20261012220534-4341edf3f941/go.mod h1:AuGAdi9KnXss7xbLxIKhCvk+Ro/SxpET/iS45DNYN+M=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20261012220534-4341edf3f941 h1:QG6hS4zFplRZvOQedzei4t2pT/zkQc3VR1u+S9/rcAw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20261012220534-4341edf3f941/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc=
 google.golang.org/grpc v1.85.0 h1:BPBCfuVRQ1qvBhKDOq9uvQllMvO59rKsYhXpp7Dd8vw=
 google.golang.org/grpc v1.85.0/go.mod h1:0rQrOD58yjal/0EaVbGBANindixsCZNQPDV3VKtaKuQ=
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
@@ -1,5 +1,66 @@
 # Changes

+## [0.24.0](https://github.com/googleapis/google-cloud-go/compare/auth/v0.23.3...auth/v0.24.0) (2026-09-23)
+
+
+### Features
+
+* **all:** Update supported go versions ([#20520](https://github.com/googleapis/google-cloud-go/issues/20520)) ([90413d3](https://github.com/googleapis/google-cloud-go/commit/90413d3e9d381ef4b92e3c496d98b023c5b2d8cc))
+
+
+### Bug Fixes
+
+* **auth:** Honor DisableAsyncRefresh and EarlyTokenRefresh consistently ([#20564](https://github.com/googleapis/google-cloud-go/issues/20564)) ([39f0ea5](https://github.com/googleapis/google-cloud-go/commit/39f0ea51dcbcae2bef1e8c900bdf2e675a19199c)), refs [#20563](https://github.com/googleapis/google-cloud-go/issues/20563)
+
+## [0.23.3](https://github.com/googleapis/google-cloud-go/compare/auth/v0.23.2...auth/v0.23.3) (2026-09-17)
+
+
+### Bug Fixes
+
+* Handle secureconnect helper failures gracefully ([c2794c6](https://github.com/googleapis/google-cloud-go/commit/c2794c6bdf267278489af42591f3c3549ae8fcba))
+* Handle secureconnect helper failures gracefully ([#20443](https://github.com/googleapis/google-cloud-go/issues/20443)) ([c2794c6](https://github.com/googleapis/google-cloud-go/commit/c2794c6bdf267278489af42591f3c3549ae8fcba))
+
+## [0.23.2](https://github.com/googleapis/google-cloud-go/compare/auth/v0.23.1...auth/v0.23.2) (2026-08-20)
+
+
+### Bug Fixes
+
+* **auth:** Eliminate timing race conditions in grpctransport otel tests ([#20175](https://github.com/googleapis/google-cloud-go/issues/20175)) ([#20382](https://github.com/googleapis/google-cloud-go/issues/20382)) ([637505e](https://github.com/googleapis/google-cloud-go/commit/637505e5d5f090eec020604c3702b6ace11dcd38))
+
+## [0.23.1](https://github.com/googleapis/google-cloud-go/compare/auth/v0.23.0...auth/v0.23.1) (2026-08-13)
+
+
+### Bug Fixes
+
+* **auth:** Fix OpenTelemetry test flake in grpctransport ([#20191](https://github.com/googleapis/google-cloud-go/issues/20191)) ([e43ce28](https://github.com/googleapis/google-cloud-go/commit/e43ce28d01ea80970e6373e1c4540cb470cdc4a6))
+
+## [0.23.0](https://github.com/googleapis/google-cloud-go/compare/auth/v0.22.0...auth/v0.23.0) (2026-08-07)
+
+
+### Features
+
+* X509 workload identity ecp support ([#20138](https://github.com/googleapis/google-cloud-go/issues/20138)) ([5fa474a](https://github.com/googleapis/google-cloud-go/commit/5fa474a10a3863a1bb34ecb27540e8a574d7a736))
+
+## [0.22.0](https://github.com/googleapis/google-cloud-go/compare/auth/v0.21.0...auth/v0.22.0) (2026-07-13)
+
+
+### Features
+
+* **auth:** Populate http.response.status_code in http transport ([#20053](https://github.com/googleapis/google-cloud-go/issues/20053)) ([bff5d7c](https://github.com/googleapis/google-cloud-go/commit/bff5d7c9bc7f8ea8c0059f7d8e2d4294ba92c5bc))
+
+## [0.21.0](https://github.com/googleapis/google-cloud-go/compare/auth/v0.20.0...auth/v0.21.0) (2026-07-07)
+
+
+### Features
+
+* **auth:** Implement updated design for regional access boundary ([#13417](https://github.com/googleapis/google-cloud-go/issues/13417)) ([fadb6c7](https://github.com/googleapis/google-cloud-go/commit/fadb6c764dbe869fca736d9f0446b5010f21d2f2))
+
+
+### Bug Fixes
+
+* **auth:** Avoid double impersonation in idtoken and clarify docs ([#14474](https://github.com/googleapis/google-cloud-go/issues/14474)) ([995bfc3](https://github.com/googleapis/google-cloud-go/commit/995bfc36199ba6ae1c88803c71f39a0b19fc8c0f)), closes [#11105](https://github.com/googleapis/google-cloud-go/issues/11105)
+* **auth:** Correct go min version ([#20094](https://github.com/googleapis/google-cloud-go/issues/20094)) ([6bb4358](https://github.com/googleapis/google-cloud-go/commit/6bb4358dca69b803e52eb2af882fa5afc24d54e2))
+
 ## [0.20.0](https://github.com/googleapis/google-cloud-go/releases/tag/auth%2Fv0.20.0) (2026-04-06)

 ## [0.19.0](https://github.com/googleapis/google-cloud-go/releases/tag/auth%2Fv0.19.0) (2026-03-23)
@@ -386,7 +386,7 @@ func (c *cachedTokenProvider) tokenBlocking(ctx context.Context) (*Token, error)
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	c.isRefreshErr = false
-	if c.cachedToken.IsValid() || (!c.autoRefresh && !c.cachedToken.isEmpty()) {
+	if c.cachedToken.isValidWithEarlyExpiry(c.expireEarly) || (!c.autoRefresh && !c.cachedToken.isEmpty()) {
 		return c.cachedToken, nil
 	}
 	t, err := c.tp.Token(ctx)
@@ -27,7 +27,7 @@ import (
 	"cloud.google.com/go/auth"
 	"cloud.google.com/go/auth/internal"
 	"cloud.google.com/go/auth/internal/credsfile"
-	"cloud.google.com/go/auth/internal/trustboundary"
+	"cloud.google.com/go/auth/internal/regionalaccessboundary"
 	"cloud.google.com/go/compute/metadata"
 	"github.com/googleapis/gax-go/v2/internallog"
 )
@@ -138,11 +138,15 @@ func OnGCE() bool {
 // Google APIs can compromise the security of your systems and data. For
 // more information, refer to [Validate credential configurations from
 // external sources](https://cloud.google.com/docs/authentication/external/externally-sourced-credentials).
+//
+// Note: If the detected credential configuration file contains a
+// `service_account_impersonation_url` field, the returned credentials will
+// yield tokens that are already impersonated to that target service account.
 func DetectDefault(opts *DetectOptions) (*auth.Credentials, error) {
 	if err := opts.validate(); err != nil {
 		return nil, err
 	}
-	trustBoundaryEnabled, err := trustboundary.IsEnabled()
+	regionalAccessBoundaryEnabled, err := regionalaccessboundary.IsEnabled()
 	if err != nil {
 		return nil, err
 	}
@@ -175,12 +179,12 @@ func DetectDefault(opts *DetectOptions) (*auth.Credentials, error) {
 		}

 		tp := computeTokenProvider(opts, metadataClient)
-		if trustBoundaryEnabled {
-			gceConfigProvider := trustboundary.NewGCEConfigProvider(gceUniverseDomainProvider)
+		if regionalAccessBoundaryEnabled {
+			gceConfigProvider := regionalaccessboundary.NewGCEConfigProvider(gceUniverseDomainProvider)
 			var err error
-			tp, err = trustboundary.NewProvider(opts.client(), gceConfigProvider, opts.logger(), tp)
+			tp, err = regionalaccessboundary.NewProvider(opts.client(), gceConfigProvider, opts.logger(), tp)
 			if err != nil {
-				return nil, fmt.Errorf("credentials: failed to initialize GCE trust boundary provider: %w", err)
+				return nil, fmt.Errorf("credentials: failed to initialize GCE Regional Access Boundary provider: %w", err)
 			}

 		}
@@ -454,16 +458,17 @@ func clientCredConfigFromJSON(b []byte, opts *DetectOptions) *auth.Options3LO {
 		}
 	}
 	return &auth.Options3LO{
-		ClientID:         c.ClientID,
-		ClientSecret:     c.ClientSecret,
-		RedirectURL:      c.RedirectURIs[0],
-		Scopes:           opts.scopes(),
-		AuthURL:          c.AuthURI,
-		TokenURL:         c.TokenURI,
-		Client:           opts.client(),
-		Logger:           opts.logger(),
-		EarlyTokenExpiry: opts.EarlyTokenRefresh,
-		AuthHandlerOpts:  handleOpts,
+		ClientID:            c.ClientID,
+		ClientSecret:        c.ClientSecret,
+		RedirectURL:         c.RedirectURIs[0],
+		Scopes:              opts.scopes(),
+		AuthURL:             c.AuthURI,
+		TokenURL:            c.TokenURI,
+		Client:              opts.client(),
+		Logger:              opts.logger(),
+		EarlyTokenExpiry:    opts.EarlyTokenRefresh,
+		DisableAsyncRefresh: opts.DisableAsyncRefresh,
+		AuthHandlerOpts:     handleOpts,
 		// TODO(codyoss): refactor this out. We need to add in auto-detection
 		// for this use case.
 		AuthStyle: auth.StyleInParams,
@@ -25,7 +25,7 @@ import (
 	"cloud.google.com/go/auth/credentials/internal/impersonate"
 	internalauth "cloud.google.com/go/auth/internal"
 	"cloud.google.com/go/auth/internal/credsfile"
-	"cloud.google.com/go/auth/internal/trustboundary"
+	"cloud.google.com/go/auth/internal/regionalaccessboundary"
 )

 const cloudPlatformScope = "https://www.googleapis.com/auth/cloud-platform"
@@ -109,7 +109,8 @@ func fileCredentials(b []byte, opts *DetectOptions) (*auth.Credentials, error) {
 	}
 	return auth.NewCredentials(&auth.CredentialsOptions{
 		TokenProvider: auth.NewCachedTokenProvider(tp, &auth.CachedTokenProviderOptions{
-			ExpireEarly: opts.EarlyTokenRefresh,
+			ExpireEarly:         opts.EarlyTokenRefresh,
+			DisableAsyncRefresh: opts.DisableAsyncRefresh,
 		}),
 		JSON:              b,
 		ProjectIDProvider: internalauth.StaticCredentialsProperty(projectID),
@@ -159,29 +160,30 @@ func handleServiceAccount(f *credsfile.ServiceAccountFile, opts *DetectOptions)
 		return nil, err
 	}

-	trustBoundaryEnabled, err := trustboundary.IsEnabled()
+	regionalAccessBoundaryEnabled, err := regionalaccessboundary.IsEnabled()
 	if err != nil {
 		return nil, err
 	}
-	if !trustBoundaryEnabled {
+	if !regionalAccessBoundaryEnabled {
 		return tp, nil
 	}
-	saConfig := trustboundary.NewServiceAccountConfigProvider(opts2LO.Email, opts2LO.UniverseDomain)
-	return trustboundary.NewProvider(opts.client(), saConfig, opts.logger(), tp)
+	saConfig := regionalaccessboundary.NewServiceAccountConfigProvider(opts2LO.Email, opts2LO.UniverseDomain)
+	return regionalaccessboundary.NewProvider(opts.client(), saConfig, opts.logger(), tp)
 }

 func handleUserCredential(f *credsfile.UserCredentialsFile, opts *DetectOptions) (auth.TokenProvider, error) {
 	opts3LO := &auth.Options3LO{
-		ClientID:         f.ClientID,
-		ClientSecret:     f.ClientSecret,
-		Scopes:           opts.scopes(),
-		AuthURL:          googleAuthURL,
-		TokenURL:         opts.tokenURL(),
-		AuthStyle:        auth.StyleInParams,
-		EarlyTokenExpiry: opts.EarlyTokenRefresh,
-		RefreshToken:     f.RefreshToken,
-		Client:           opts.client(),
-		Logger:           opts.logger(),
+		ClientID:            f.ClientID,
+		ClientSecret:        f.ClientSecret,
+		Scopes:              opts.scopes(),
+		AuthURL:             googleAuthURL,
+		TokenURL:            opts.tokenURL(),
+		AuthStyle:           auth.StyleInParams,
+		EarlyTokenExpiry:    opts.EarlyTokenRefresh,
+		DisableAsyncRefresh: opts.DisableAsyncRefresh,
+		RefreshToken:        f.RefreshToken,
+		Client:              opts.client(),
+		Logger:              opts.logger(),
 	}
 	return auth.New3LOTokenProvider(opts3LO)
 }
@@ -199,6 +201,8 @@ func handleExternalAccount(f *credsfile.ExternalAccountFile, opts *DetectOptions
 		QuotaProjectID:                 f.QuotaProjectID,
 		Scopes:                         opts.scopes(),
 		WorkforcePoolUserProject:       f.WorkforcePoolUserProject,
+		EarlyTokenRefresh:              opts.EarlyTokenRefresh,
+		DisableAsyncRefresh:            opts.DisableAsyncRefresh,
 		Client:                         opts.client(),
 		Logger:                         opts.logger(),
 		IsDefaultClient:                opts.Client == nil,
@@ -210,67 +214,69 @@ func handleExternalAccount(f *credsfile.ExternalAccountFile, opts *DetectOptions
 	if err != nil {
 		return nil, err
 	}
-	trustBoundaryEnabled, err := trustboundary.IsEnabled()
+	regionalAccessBoundaryEnabled, err := regionalaccessboundary.IsEnabled()
 	if err != nil {
 		return nil, err
 	}
-	if !trustBoundaryEnabled {
+	if !regionalAccessBoundaryEnabled {
 		return tp, nil
 	}

 	ud := resolveUniverseDomain(opts.UniverseDomain, f.UniverseDomain)
-	var configProvider trustboundary.ConfigProvider
+	var configProvider regionalaccessboundary.ConfigProvider

 	if f.ServiceAccountImpersonationURL == "" {
 		// No impersonation, this is a direct external account credential.
-		// The trust boundary is based on the workload/workforce pool.
+		// The Regional Access Boundary is based on the workload/workforce pool.
 		var err error
-		configProvider, err = trustboundary.NewExternalAccountConfigProvider(f.Audience, ud)
+		configProvider, err = regionalaccessboundary.NewExternalAccountConfigProvider(f.Audience, ud)
 		if err != nil {
 			return nil, err
 		}
 	} else {
-		// Impersonation is used. The trust boundary is based on the target service account.
+		// Impersonation is used. The Regional Access Boundary is based on the target service account.
 		targetSAEmail, err := impersonate.ExtractServiceAccountEmail(f.ServiceAccountImpersonationURL)
 		if err != nil {
-			return nil, fmt.Errorf("credentials: could not extract target service account email for trust boundary: %w", err)
+			return nil, fmt.Errorf("credentials: could not extract target service account email for Regional Access Boundary: %w", err)
 		}
-		configProvider = trustboundary.NewServiceAccountConfigProvider(targetSAEmail, ud)
+		configProvider = regionalaccessboundary.NewServiceAccountConfigProvider(targetSAEmail, ud)
 	}

-	return trustboundary.NewProvider(opts.client(), configProvider, opts.logger(), tp)
+	return regionalaccessboundary.NewProvider(opts.client(), configProvider, opts.logger(), tp)
 }

 func handleExternalAccountAuthorizedUser(f *credsfile.ExternalAccountAuthorizedUserFile, opts *DetectOptions) (auth.TokenProvider, error) {
 	externalOpts := &externalaccountuser.Options{
-		Audience:     f.Audience,
-		RefreshToken: f.RefreshToken,
-		TokenURL:     f.TokenURL,
-		TokenInfoURL: f.TokenInfoURL,
-		ClientID:     f.ClientID,
-		ClientSecret: f.ClientSecret,
-		Scopes:       opts.scopes(),
-		Client:       opts.client(),
-		Logger:       opts.logger(),
+		Audience:            f.Audience,
+		RefreshToken:        f.RefreshToken,
+		TokenURL:            f.TokenURL,
+		TokenInfoURL:        f.TokenInfoURL,
+		ClientID:            f.ClientID,
+		ClientSecret:        f.ClientSecret,
+		Scopes:              opts.scopes(),
+		EarlyTokenRefresh:   opts.EarlyTokenRefresh,
+		DisableAsyncRefresh: opts.DisableAsyncRefresh,
+		Client:              opts.client(),
+		Logger:              opts.logger(),
 	}
 	tp, err := externalaccountuser.NewTokenProvider(externalOpts)
 	if err != nil {
 		return nil, err
 	}
-	trustBoundaryEnabled, err := trustboundary.IsEnabled()
+	regionalAccessBoundaryEnabled, err := regionalaccessboundary.IsEnabled()
 	if err != nil {
 		return nil, err
 	}
-	if !trustBoundaryEnabled {
+	if !regionalAccessBoundaryEnabled {
 		return tp, nil
 	}

 	ud := resolveUniverseDomain(opts.UniverseDomain, f.UniverseDomain)
-	configProvider, err := trustboundary.NewExternalAccountConfigProvider(f.Audience, ud)
+	configProvider, err := regionalaccessboundary.NewExternalAccountConfigProvider(f.Audience, ud)
 	if err != nil {
 		return nil, err
 	}
-	return trustboundary.NewProvider(opts.client(), configProvider, opts.logger(), tp)
+	return regionalaccessboundary.NewProvider(opts.client(), configProvider, opts.logger(), tp)
 }

 func handleImpersonatedServiceAccount(f *credsfile.ImpersonatedServiceAccountFile, opts *DetectOptions) (auth.TokenProvider, error) {
@@ -306,19 +312,19 @@ func handleImpersonatedServiceAccount(f *credsfile.ImpersonatedServiceAccountFil
 	if err != nil {
 		return nil, err
 	}
-	trustBoundaryEnabled, err := trustboundary.IsEnabled()
+	regionalAccessBoundaryEnabled, err := regionalaccessboundary.IsEnabled()
 	if err != nil {
 		return nil, err
 	}
-	if !trustBoundaryEnabled {
+	if !regionalAccessBoundaryEnabled {
 		return tp, nil
 	}
 	targetSAEmail, err := impersonate.ExtractServiceAccountEmail(f.ServiceAccountImpersonationURL)
 	if err != nil {
-		return nil, fmt.Errorf("credentials: could not extract target service account email for trust boundary: %w", err)
+		return nil, fmt.Errorf("credentials: could not extract target service account email for Regional Access Boundary: %w", err)
 	}
-	targetSAConfig := trustboundary.NewServiceAccountConfigProvider(targetSAEmail, ud)
-	return trustboundary.NewProvider(opts.client(), targetSAConfig, opts.logger(), tp)
+	targetSAConfig := regionalaccessboundary.NewServiceAccountConfigProvider(targetSAEmail, ud)
+	return regionalaccessboundary.NewProvider(opts.client(), targetSAConfig, opts.logger(), tp)
 }
 func handleGDCHServiceAccount(f *credsfile.GDCHServiceAccountFile, opts *DetectOptions) (auth.TokenProvider, error) {
 	return gdch.NewTokenProvider(f, &gdch.Options{
@@ -100,6 +100,13 @@ type Options struct {
 	// for AWS credentials. One of SubjectTokenProvider,
 	// AWSSecurityCredentialProvider or CredentialSource must be provided. Optional.
 	AwsSecurityCredentialsProvider AwsSecurityCredentialsProvider
+	// EarlyTokenRefresh configures how early before a token expires that it
+	// should be refreshed. If unset, the default value is 3 minutes and 45
+	// seconds. Optional.
+	EarlyTokenRefresh time.Duration
+	// DisableAsyncRefresh configures a synchronous workflow that refreshes
+	// stale tokens while blocking. The default is false. Optional.
+	DisableAsyncRefresh bool
 	// Client for token request.
 	Client *http.Client
 	// IsDefaultClient marks whether the client passed in is a default client that can be overriden.
@@ -249,8 +256,12 @@ func NewTokenProvider(opts *Options) (auth.TokenProvider, error) {
 		logger: logger,
 	}

+	cacheOpts := &auth.CachedTokenProviderOptions{
+		ExpireEarly:         opts.EarlyTokenRefresh,
+		DisableAsyncRefresh: opts.DisableAsyncRefresh,
+	}
 	if opts.ServiceAccountImpersonationURL == "" {
-		return auth.NewCachedTokenProvider(tp, nil), nil
+		return auth.NewCachedTokenProvider(tp, cacheOpts), nil
 	}

 	scopes := make([]string, len(opts.Scopes))
@@ -261,14 +272,14 @@ func NewTokenProvider(opts *Options) (auth.TokenProvider, error) {
 		Client:               client,
 		URL:                  opts.ServiceAccountImpersonationURL,
 		Scopes:               scopes,
-		Tp:                   auth.NewCachedTokenProvider(tp, nil),
+		Tp:                   auth.NewCachedTokenProvider(tp, cacheOpts),
 		TokenLifetimeSeconds: opts.ServiceAccountImpersonationLifetimeSeconds,
 		Logger:               logger,
 	})
 	if err != nil {
 		return nil, err
 	}
-	return auth.NewCachedTokenProvider(imp, nil), nil
+	return auth.NewCachedTokenProvider(imp, cacheOpts), nil
 }

 type subjectTokenProvider interface {
@@ -30,6 +30,7 @@ import (
 	"time"

 	"cloud.google.com/go/auth/internal/transport/cert"
+	"github.com/googleapis/enterprise-certificate-proxy/client"
 )

 // x509Provider implements the subjectTokenProvider type for x509 workload
@@ -57,13 +58,13 @@ func (xp *x509Provider) providerType() string {
 // reads the certificate file, and parses the certificate data.
 func loadLeafCertificate(configFilePath string) (*x509.Certificate, error) {
 	// Get the path to the certificate file from the configuration file.
-	path, err := cert.GetCertificatePath(configFilePath)
+	path, err := cert.GetFileBasedCertificatePath(configFilePath)
 	if err != nil {
-		return nil, fmt.Errorf("failed to get certificate path from config file: %w", err)
+		return nil, fmt.Errorf("credentials: failed to get certificate path from config file: %w", err)
 	}
 	leafCertBytes, err := os.ReadFile(path)
 	if err != nil {
-		return nil, fmt.Errorf("failed to read leaf certificate file: %w", err)
+		return nil, fmt.Errorf("credentials: failed to read leaf certificate file: %w", err)
 	}
 	// Parse the certificate bytes.
 	return parseCertificate(leafCertBytes)
@@ -78,20 +79,20 @@ func encodeCert(cert *x509.Certificate) string {
 // parseCertificate parses a PEM-encoded certificate from the given byte slice.
 func parseCertificate(certData []byte) (*x509.Certificate, error) {
 	if len(certData) == 0 {
-		return nil, errors.New("invalid certificate data: empty input")
+		return nil, errors.New("credentials: invalid certificate data: empty input")
 	}
 	// Decode the PEM-encoded data.
 	block, _ := pem.Decode(certData)
 	if block == nil {
-		return nil, errors.New("invalid PEM-encoded certificate data: no PEM block found")
+		return nil, errors.New("credentials: invalid PEM-encoded certificate data: no PEM block found")
 	}
 	if block.Type != "CERTIFICATE" {
-		return nil, fmt.Errorf("invalid PEM-encoded certificate data: expected CERTIFICATE block type, got %s", block.Type)
+		return nil, fmt.Errorf("credentials: invalid PEM-encoded certificate data: expected CERTIFICATE block type, got %s", block.Type)
 	}
 	// Parse the DER-encoded certificate.
 	certificate, err := x509.ParseCertificate(block.Bytes)
 	if err != nil {
-		return nil, fmt.Errorf("failed to parse certificate: %w", err)
+		return nil, fmt.Errorf("credentials: failed to parse certificate: %w", err)
 	}
 	return certificate, nil
 }
@@ -110,9 +111,9 @@ func readTrustChain(trustChainPath string) ([]*x509.Certificate, error) {
 	trustChainData, err := os.ReadFile(trustChainPath)
 	if err != nil {
 		if errors.Is(err, fs.ErrNotExist) {
-			return nil, fmt.Errorf("trust chain file not found: %w", err)
+			return nil, fmt.Errorf("credentials: trust chain file not found: %w", err)
 		}
-		return nil, fmt.Errorf("failed to read trust chain file: %w", err)
+		return nil, fmt.Errorf("credentials: failed to read trust chain file: %w", err)
 	}

 	// Split the file content into PEM certificate blocks.
@@ -130,7 +131,7 @@ func readTrustChain(trustChainPath string) ([]*x509.Certificate, error) {
 			// Parse the certificate data.
 			cert, err := parseCertificate([]byte(certData))
 			if err != nil {
-				return nil, fmt.Errorf("error parsing certificate from trust chain file: %w", err)
+				return nil, fmt.Errorf("credentials: error parsing certificate from trust chain file: %w", err)
 			}

 			// Append the certificate to the trust chain.
@@ -141,6 +142,35 @@ func readTrustChain(trustChainPath string) ([]*x509.Certificate, error) {
 	return certificateTrustChain, nil
 }

+func (xp *x509Provider) ecpSubjectToken(configFilePath string) (string, error) {
+	key, err := client.Cred(configFilePath)
+	if err != nil {
+		return "", fmt.Errorf("credentials: failed to initialize ECP client: %w", err)
+	}
+	defer key.Close()
+
+	rawChain := key.CertificateChain()
+	if len(rawChain) == 0 {
+		return "", errors.New("credentials: ECP returned an empty certificate chain")
+	}
+
+	certChain := make([]string, 0, len(rawChain))
+	for _, derBytes := range rawChain {
+		cert, err := x509.ParseCertificate(derBytes)
+		if err != nil {
+			return "", fmt.Errorf("credentials: failed to parse certificate from ECP chain: %w", err)
+		}
+		certChain = append(certChain, encodeCert(cert))
+	}
+
+	jsonChain, err := json.Marshal(certChain)
+	if err != nil {
+		return "", fmt.Errorf("credentials: failed to format certificate data: %w", err)
+	}
+
+	return string(jsonChain), nil
+}
+
 // subjectToken retrieves the X.509 subject token. It loads the leaf
 // certificate and, if a trust chain path is configured, the trust chain
 // certificates. It then constructs a JSON array containing the base64-encoded
@@ -148,16 +178,24 @@ func readTrustChain(trustChainPath string) ([]*x509.Certificate, error) {
 // The leaf certificate must be at the top of the trust chain file. This JSON
 // array is used as the subject token for mTLS authentication.
 func (xp *x509Provider) subjectToken(context.Context) (string, error) {
+	configFilePath := cert.GetConfigFilePath(xp.ConfigFilePath)
+
+	// First check if it's ECP based cert config
+	if cert.IsECPConfig(configFilePath) {
+		return xp.ecpSubjectToken(configFilePath)
+	}
+
+	// It's not ECP, do the normal file based cert config way.
 	// Load the leaf certificate.
-	leafCert, err := loadLeafCertificate(xp.ConfigFilePath)
+	leafCert, err := loadLeafCertificate(configFilePath)
 	if err != nil {
-		return "", fmt.Errorf("failed to load leaf certificate: %w", err)
+		return "", fmt.Errorf("credentials: failed to load leaf certificate: %w", err)
 	}

 	// Read the trust chain.
 	trustChain, err := readTrustChain(xp.TrustChainPath)
 	if err != nil {
-		return "", fmt.Errorf("failed to read trust chain: %w", err)
+		return "", fmt.Errorf("credentials: failed to read trust chain: %w", err)
 	}

 	// Initialize the certificate chain with the leaf certificate.
@@ -178,7 +216,7 @@ func (xp *x509Provider) subjectToken(context.Context) (string, error) {

 			// Return an error if the current certificate is the same as the leaf certificate.
 			if encoded == certChain[0] {
-				return "", errors.New("the leaf certificate must be at the top of the trust chain file")
+				return "", errors.New("credentials: the leaf certificate must be at the top of the trust chain file")
 			}

 			// Add the current certificate to the chain.
@@ -189,7 +227,7 @@ func (xp *x509Provider) subjectToken(context.Context) (string, error) {
 	// Convert the certificate chain to a JSON array of base64-encoded strings.
 	jsonChain, err := json.Marshal(certChain)
 	if err != nil {
-		return "", fmt.Errorf("failed to format certificate data: %w", err)
+		return "", fmt.Errorf("credentials: failed to format certificate data: %w", err)
 	}

 	// Return the JSON-formatted certificate chain.
@@ -51,6 +51,14 @@ type Options struct {
 	// Scopes contains the desired scopes for the returned access token.
 	Scopes []string

+	// EarlyTokenRefresh configures how early before a token expires that it
+	// should be refreshed. If unset, the default value is 3 minutes and 45
+	// seconds. Optional.
+	EarlyTokenRefresh time.Duration
+	// DisableAsyncRefresh configures a synchronous workflow that refreshes
+	// stale tokens while blocking. The default is false. Optional.
+	DisableAsyncRefresh bool
+
 	// Client for token request.
 	Client *http.Client
 	// Logger for logging.
@@ -71,7 +79,10 @@ func NewTokenProvider(opts *Options) (auth.TokenProvider, error) {
 	tp := &tokenProvider{
 		o: opts,
 	}
-	return auth.NewCachedTokenProvider(tp, nil), nil
+	return auth.NewCachedTokenProvider(tp, &auth.CachedTokenProviderOptions{
+		ExpireEarly:         opts.EarlyTokenRefresh,
+		DisableAsyncRefresh: opts.DisableAsyncRefresh,
+	}), nil
 }

 type tokenProvider struct {
@@ -17,28 +17,127 @@ package grpctransport
 import (
 	"context"
 	"net"
+	"net/url"
 	"os"
+	"sort"
 	"strconv"
 	"strings"
 	"time"

 	"cloud.google.com/go/auth"
 	"cloud.google.com/go/auth/credentials"
+	"cloud.google.com/go/auth/internal"
 	"cloud.google.com/go/auth/internal/compute"
 	"golang.org/x/time/rate"
 	"google.golang.org/grpc"
 	grpcgoogle "google.golang.org/grpc/credentials/google"
 )

+const directPathInterconnectInfix = "-direct."
+
 var logRateLimiter = rate.Sometimes{Interval: 1 * time.Second}

+func parseTarget(endpoint string) (host string, query url.Values, err error) {
+	raw := endpoint
+	if !strings.Contains(raw, "://") {
+		raw = "//" + raw
+	}
+	u, err := url.Parse(raw)
+	if err != nil {
+		return "", nil, err
+	}
+	target := u.Host
+	if target == "" {
+		target = strings.TrimPrefix(u.Path, "/")
+	}
+	if slashIdx := strings.Index(target, "/"); slashIdx != -1 {
+		target = target[:slashIdx]
+	}
+	if h, _, err := net.SplitHostPort(target); err == nil {
+		host = h
+	} else {
+		host = target
+	}
+	return host, u.Query(), nil
+}
+
+func encodeQuery(v url.Values) string {
+	if len(v) == 0 {
+		return ""
+	}
+	var buf strings.Builder
+	keys := make([]string, 0, len(v))
+	for k := range v {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	for _, k := range keys {
+		vs := v[k]
+		keyEscaped := url.QueryEscape(k)
+		if len(vs) == 0 {
+			if buf.Len() > 0 {
+				buf.WriteByte('&')
+			}
+			buf.WriteString(keyEscaped)
+			continue
+		}
+		for _, val := range vs {
+			if buf.Len() > 0 {
+				buf.WriteByte('&')
+			}
+			buf.WriteString(keyEscaped)
+			if val != "" {
+				buf.WriteByte('=')
+				buf.WriteString(url.QueryEscape(val))
+			}
+		}
+	}
+	return buf.String()
+}
+
+func isDirectPathXdsOverInterconnectUsed(endpoint string, o *Options) bool {
+	if valStr, ok := os.LookupEnv(enableDirectPathXdsOverInterconnectEnvVar); ok {
+		if b, err := strconv.ParseBool(valStr); err == nil {
+			return b
+		}
+	}
+	if o != nil && o.InternalOptions != nil && o.InternalOptions.EnableDirectPathXdsOverInterconnect {
+		return true
+	}
+	if strings.Contains(endpoint, directPathInterconnectInfix) || strings.Contains(endpoint, "force-xds") {
+		return true
+	}
+	return false
+}
+
+func hasUniverseDomainHost(endpoint, universeDomain string) bool {
+	host, _, err := parseTarget(endpoint)
+	if err != nil {
+		return false
+	}
+	return host == universeDomain || strings.HasSuffix(host, "."+universeDomain)
+}
+
+func canUseDirectPathWithUniverseDomain(endpoint string, opts *Options) bool {
+	if opts != nil && opts.clientUniverseDomain() != internal.DefaultUniverseDomain {
+		return false
+	}
+	if isDirectPathXdsOverInterconnectUsed(endpoint, opts) && strings.Contains(endpoint, ".") {
+		return hasUniverseDomainHost(endpoint, internal.DefaultUniverseDomain)
+	}
+	return true
+}
+
 func isDirectPathEnabled(endpoint string, opts *Options) bool {
-	if opts.InternalOptions != nil && !opts.InternalOptions.EnableDirectPath {
+	if opts == nil || opts.InternalOptions == nil || !opts.InternalOptions.EnableDirectPath {
 		return false
 	}
 	if !checkDirectPathEndPoint(endpoint) {
 		return false
 	}
+	if !canUseDirectPathWithUniverseDomain(endpoint, opts) {
+		return false
+	}
 	if b, _ := strconv.ParseBool(os.Getenv(disableDirectPathEnvVar)); b {
 		return false
 	}
@@ -46,10 +145,10 @@ func isDirectPathEnabled(endpoint string, opts *Options) bool {
 }

 func checkDirectPathEndPoint(endpoint string) bool {
-	// Only [dns:///]host[:port] is supported, not other schemes (e.g., "tcp://" or "unix://").
-	// Also don't try direct path if the user has chosen an alternate name resolver
-	// (i.e., via ":///" prefix).
-	if strings.Contains(endpoint, "://") && !strings.HasPrefix(endpoint, "dns:///") {
+	// Only [dns:///]host[:port] or google-c2p:/// is supported, not other schemes (e.g., "tcp://" or "unix://").
+	if strings.Contains(endpoint, "://") &&
+		!strings.HasPrefix(endpoint, "dns:///") &&
+		!strings.HasPrefix(endpoint, "google-c2p:///") {
 		return false
 	}

@@ -84,7 +183,7 @@ func isTokenProviderDirectPathCompatible(tp auth.TokenProvider, o *Options) bool
 	if tp == nil {
 		return false
 	}
-	if o.InternalOptions != nil && o.InternalOptions.EnableNonDefaultSAForDirectPath {
+	if o != nil && o.InternalOptions != nil && o.InternalOptions.EnableNonDefaultSAForDirectPath {
 		return true
 	}
 	return isTokenProviderComputeEngine(tp)
@@ -96,13 +195,16 @@ func isDirectPathXdsUsed(o *Options) bool {
 		return true
 	}
 	// Method 2: Enable DirectPath xDS by option;
-	if o.InternalOptions != nil && o.InternalOptions.EnableDirectPathXds {
+	if o != nil && o.InternalOptions != nil && o.InternalOptions.EnableDirectPathXds {
 		return true
 	}
 	return false
 }

 func isDirectPathBoundTokenEnabled(opts *InternalOptions) bool {
+	if opts == nil {
+		return false
+	}
 	for _, ev := range opts.AllowHardBoundTokens {
 		if ev == "ALTS" {
 			return true
@@ -111,37 +213,84 @@ func isDirectPathBoundTokenEnabled(opts *InternalOptions) bool {
 	return false
 }

+func canUseDirectPath(endpoint string, opts *Options, creds *auth.Credentials) bool {
+	if !isDirectPathEnabled(endpoint, opts) {
+		return false
+	}
+	interconnect := isDirectPathXdsOverInterconnectUsed(endpoint, opts)
+	if !compute.OnComputeEngine() && !interconnect {
+		return false
+	}
+	if interconnect {
+		return creds != nil && creds.TokenProvider != nil
+	}
+	return isTokenProviderDirectPathCompatible(creds, opts)
+}
+
 // configureDirectPath returns some dial options and an endpoint to use if the
 // configuration allows the use of direct path. If it does not the provided
 // grpcOpts and endpoint are returned.
-func configureDirectPath(grpcOpts []grpc.DialOption, opts *Options, endpoint string, creds *auth.Credentials) ([]grpc.DialOption, string, error) {
+func configureDirectPath(grpcOpts []grpc.DialOption, opts *Options, endpoint string, creds *auth.Credentials, metadata map[string]string) ([]grpc.DialOption, string, error) {
 	logRateLimiter.Do(func() {
 		logDirectPathMisconfig(endpoint, creds, opts)
 	})
-	if isDirectPathEnabled(endpoint, opts) && compute.OnComputeEngine() && isTokenProviderDirectPathCompatible(creds, opts) {
+	if canUseDirectPath(endpoint, opts, creds) {
+		interconnect := isDirectPathXdsOverInterconnectUsed(endpoint, opts)
 		// Overwrite all of the previously specific DialOptions, DirectPath uses its own set of credentials and certificates.
-		defaultCredetialsOptions := grpcgoogle.DefaultCredentialsOptions{PerRPCCreds: &grpcCredentialsProvider{creds: creds}}
-		if isDirectPathBoundTokenEnabled(opts.InternalOptions) && isTokenProviderComputeEngine(creds) {
+		perRPCCreds := &grpcCredentialsProvider{
+			creds:    creds,
+			endpoint: endpoint,
+			metadata: metadata,
+		}
+		if opts != nil {
+			perRPCCreds.clientUniverseDomain = opts.UniverseDomain
+		}
+		defaultCredetialsOptions := grpcgoogle.DefaultCredentialsOptions{
+			PerRPCCreds: perRPCCreds,
+		}
+		if !interconnect && opts != nil && isDirectPathBoundTokenEnabled(opts.InternalOptions) && isTokenProviderComputeEngine(creds) {
 			optsClone := opts.resolveDetectOptions()
 			optsClone.TokenBindingType = credentials.ALTSHardBinding
 			altsCreds, err := credentials.DetectDefault(optsClone)
 			if err != nil {
 				return nil, "", err
 			}
-			defaultCredetialsOptions.ALTSPerRPCCreds = &grpcCredentialsProvider{creds: altsCreds}
+			defaultCredetialsOptions.ALTSPerRPCCreds = &grpcCredentialsProvider{creds: altsCreds, endpoint: endpoint}
 		}
 		grpcOpts = []grpc.DialOption{
 			grpc.WithCredentialsBundle(grpcgoogle.NewDefaultCredentialsWithOptions(defaultCredetialsOptions))}
 		if timeoutDialerOption != nil {
 			grpcOpts = append(grpcOpts, timeoutDialerOption)
 		}
+		cleanAddr, query, err := parseTarget(endpoint)
+		if err != nil {
+			return nil, "", err
+		}
+		if interconnect {
+			if strings.HasSuffix(cleanAddr, ".googleapis.com") && !strings.Contains(cleanAddr, directPathInterconnectInfix) {
+				authority := cleanAddr
+				cleanAddr = strings.TrimSuffix(cleanAddr, ".googleapis.com") + directPathInterconnectInfix + "googleapis.com"
+				grpcOpts = append(grpcOpts, grpc.WithAuthority(authority))
+			} else if strings.Contains(cleanAddr, directPathInterconnectInfix) {
+				authority := strings.Replace(cleanAddr, directPathInterconnectInfix, ".", 1)
+				grpcOpts = append(grpcOpts, grpc.WithAuthority(authority))
+			}
+		}
 		// Check if google-c2p resolver is enabled for DirectPath
-		if isDirectPathXdsUsed(opts) {
-			// google-c2p resolver target must not have a port number
-			if addr, _, err := net.SplitHostPort(endpoint); err == nil {
-				endpoint = "google-c2p:///" + addr
-			} else {
-				endpoint = "google-c2p:///" + endpoint
+		if strings.HasPrefix(endpoint, "google-c2p:///") {
+			if interconnect {
+				if !query.Has("force-xds") {
+					query["force-xds"] = nil
+				}
+			}
+			endpoint = "google-c2p:///" + cleanAddr
+			if q := encodeQuery(query); q != "" {
+				endpoint += "?" + q
+			}
+		} else if isDirectPathXdsUsed(opts) || interconnect {
+			endpoint = "google-c2p:///" + cleanAddr
+			if interconnect {
+				endpoint += "?force-xds"
 			}
 		} else {
 			if !strings.HasPrefix(endpoint, "dns:///") {
@@ -160,17 +309,31 @@ func configureDirectPath(grpcOpts []grpc.DialOption, opts *Options, endpoint str
 }

 func logDirectPathMisconfig(endpoint string, creds *auth.Credentials, o *Options) {
+	if o == nil {
+		return
+	}
+	if isDirectPathXdsOverInterconnectUsed(endpoint, o) {
+		if !canUseDirectPathWithUniverseDomain(endpoint, o) {
+			o.logger().Warn("DirectPath over Interconnect is disabled. Non-default universe domain is not supported.")
+		} else if creds == nil || creds.TokenProvider == nil {
+			o.logger().Warn("DirectPath over Interconnect is disabled. Valid credentials are required.")
+		} else if !isDirectPathEnabled(endpoint, o) {
+			o.logger().Warn("DirectPath is disabled. To enable, please set the EnableDirectPath option along with the EnableDirectPathXds option.")
+		}
+		return
+	}

 	// Case 1: does not enable DirectPath
 	if !isDirectPathEnabled(endpoint, o) {
 		o.logger().Warn("DirectPath is disabled. To enable, please set the EnableDirectPath option along with the EnableDirectPathXds option.")
 	} else {
+		interconnect := isDirectPathXdsOverInterconnectUsed(endpoint, o)
 		// Case 2: credential is not correctly set
-		if !isTokenProviderDirectPathCompatible(creds, o) {
+		if !interconnect && !isTokenProviderDirectPathCompatible(creds, o) {
 			o.logger().Warn("DirectPath is disabled. Please make sure the token source is fetched from GCE metadata server and the default service account is used.")
 		}
 		// Case 3: not running on GCE
-		if !compute.OnComputeEngine() {
+		if !interconnect && !compute.OnComputeEngine() {
 			o.logger().Warn("DirectPath is disabled. DirectPath is only available in a GCE environment.")
 		}
 	}
@@ -52,6 +52,9 @@ const (
 	// Check env to decide if using google-c2p resolver for DirectPath traffic.
 	enableDirectPathXdsEnvVar = "GOOGLE_CLOUD_ENABLE_DIRECT_PATH_XDS"

+	// Check env to decide if using DirectPath over Interconnect (on-premises xDS).
+	enableDirectPathXdsOverInterconnectEnvVar = "GOOGLE_CLOUD_ENABLE_DIRECT_PATH_XDS_OVER_INTERCONNECT"
+
 	quotaProjectHeaderKey = "X-goog-user-project"
 )

@@ -152,6 +155,16 @@ func (o *Options) logger() *slog.Logger {
 	return internallog.New(o.Logger)
 }

+func (o *Options) clientUniverseDomain() string {
+	if o != nil && o.UniverseDomain != "" {
+		return o.UniverseDomain
+	}
+	if envUD := os.Getenv(internal.UniverseDomainEnvVar); envUD != "" {
+		return envUD
+	}
+	return internal.DefaultUniverseDomain
+}
+
 func (o *Options) validate() error {
 	if o == nil {
 		return errors.New("grpctransport: opts required to be non-nil")
@@ -212,6 +225,9 @@ type InternalOptions struct {
 	// EnableDirectPathXds overrides the default DirectPath type. It is only
 	// valid when DirectPath is enabled.
 	EnableDirectPathXds bool
+	// EnableDirectPathXdsOverInterconnect enables DirectPath over Google Cloud
+	// Interconnect (on-premises xDS name resolution via google-c2p with force-xds).
+	EnableDirectPathXdsOverInterconnect bool
 	// EnableJWTWithScope specifies if scope can be used with self-signed JWT.
 	EnableJWTWithScope bool
 	// AllowHardBoundTokens allows libraries to request a hard-bound token.
@@ -284,6 +300,7 @@ func dial(ctx context.Context, secure bool, opts *Options) (*grpc.ClientConn, er
 		tOpts.DefaultMTLSEndpoint = io.DefaultMTLSEndpoint
 		tOpts.EnableDirectPath = io.EnableDirectPath
 		tOpts.EnableDirectPathXds = io.EnableDirectPathXds
+		tOpts.EnableDirectPathXdsOverInterconnect = io.EnableDirectPathXdsOverInterconnect
 	}
 	transportCreds, err := transport.GetGRPCTransportCredsAndEndpoint(tOpts)
 	if err != nil {
@@ -358,10 +375,11 @@ func dial(ctx context.Context, secure bool, opts *Options) (*grpc.ClientConn, er
 				creds:                creds,
 				metadata:             metadata,
 				clientUniverseDomain: opts.UniverseDomain,
+				endpoint:             transportCreds.Endpoint,
 			}),
 		)
 		// Attempt Direct Path
-		grpcOpts, transportCreds.Endpoint, err = configureDirectPath(grpcOpts, opts, transportCreds.Endpoint, creds)
+		grpcOpts, transportCreds.Endpoint, err = configureDirectPath(grpcOpts, opts, transportCreds.Endpoint, creds, metadata)
 		if err != nil {
 			return nil, err
 		}
@@ -405,6 +423,7 @@ type grpcCredentialsProvider struct {
 	// Additional metadata attached as headers.
 	metadata             map[string]string
 	clientUniverseDomain string
+	endpoint             string
 }

 // getClientUniverseDomain returns the default service domain for a given Cloud
@@ -447,7 +466,7 @@ func (c *grpcCredentialsProvider) GetRequestMetadata(ctx context.Context, uri ..
 		}
 	}
 	metadata := make(map[string]string, len(c.metadata)+1)
-	headers.SetAuthMetadata(token, metadata)
+	headers.SetAuthMetadata(ctx, token, c.endpoint, metadata)
 	for k, v := range c.metadata {
 		metadata[k] = v
 	}
@@ -505,6 +524,9 @@ func extractHostPort(target string) (string, int) {
 			target = target[slashIdx+1:]
 		}
 	}
+	if qIdx := strings.Index(target, "?"); qIdx != -1 {
+		target = target[:qIdx]
+	}
 	host, portStr, err := net.SplitHostPort(target)
 	if err != nil {
 		return target, 0
@@ -284,6 +284,11 @@ func (t *otelAttributeTransport) RoundTrip(req *http.Request) (*http.Response, e
 	}

 	resp, err := t.base.RoundTrip(req)
+	if gax.IsFeatureEnabled("METRICS") {
+		if data != nil && resp != nil {
+			data.SetHTTPStatusCode(resp.StatusCode)
+		}
+	}

 	var logger *slog.Logger
 	if gax.IsFeatureEnabled("LOGGING") {
@@ -48,11 +48,8 @@ const (
 	// Universe domain is the default service domain for a given Cloud universe.
 	DefaultUniverseDomain = "googleapis.com"

-	// TrustBoundaryNoOp is a constant indicating no trust boundary is enforced.
-	TrustBoundaryNoOp = "0x0"
-
-	// TrustBoundaryDataKey is the key used to store trust boundary data in a token's metadata.
-	TrustBoundaryDataKey = "google.auth.trust_boundary_data"
+	// RegionalAccessBoundaryDataKey is the key used to store regional access boundary data in a token's metadata.
+	RegionalAccessBoundaryDataKey = "google.auth.regional_access_boundary_data"
 )

 type clonableTransport interface {
@@ -231,55 +228,35 @@ func FormatIAMServiceAccountResource(name string) string {
 	return fmt.Sprintf("projects/-/serviceAccounts/%s", name)
 }

-// TrustBoundaryData represents the trust boundary data associated with a token.
+// RegionalAccessBoundaryData represents the regional access boundary data associated with a token.
 // It contains information about the regions or environments where the token is valid.
-type TrustBoundaryData struct {
+type RegionalAccessBoundaryData struct {
 	// Locations is the list of locations that the token is allowed to be used in.
 	Locations []string
 	// EncodedLocations represents the locations in an encoded format.
 	EncodedLocations string
 }

-// NewTrustBoundaryData returns a new TrustBoundaryData with the specified locations and encoded locations.
-func NewTrustBoundaryData(locations []string, encodedLocations string) *TrustBoundaryData {
+// NewRegionalAccessBoundaryData returns a new RegionalAccessBoundaryData with the specified locations and encoded locations.
+func NewRegionalAccessBoundaryData(locations []string, encodedLocations string) *RegionalAccessBoundaryData {
 	// Ensure consistency by treating a nil slice as an empty slice.
 	if locations == nil {
 		locations = []string{}
 	}
 	locationsCopy := make([]string, len(locations))
 	copy(locationsCopy, locations)
-	return &TrustBoundaryData{
+	return &RegionalAccessBoundaryData{
 		Locations:        locationsCopy,
 		EncodedLocations: encodedLocations,
 	}
 }

-// NewNoOpTrustBoundaryData returns a new TrustBoundaryData with no restrictions.
-func NewNoOpTrustBoundaryData() *TrustBoundaryData {
-	return &TrustBoundaryData{
-		Locations:        []string{},
-		EncodedLocations: TrustBoundaryNoOp,
-	}
-}
-
-// TrustBoundaryHeader returns the value for the x-allowed-locations header and a bool
-// indicating if the header should be set. The return values are structured to
-// handle three distinct states required by the backend:
-// 1. Header not set: (value="", present=false) -> data is empty.
-// 2. Header set to an empty string: (value="", present=true) -> data is a no-op.
-// 3. Header set to a value: (value="...", present=true) -> data has locations.
-func (t TrustBoundaryData) TrustBoundaryHeader() (value string, present bool) {
+// RegionalAccessBoundaryHeader returns the value for the x-allowed-locations header and a bool
+// indicating if the header should be set. If EncodedLocations is empty, the header
+// should not be present. Otherwise, it should be present with the value of EncodedLocations.
+func (t RegionalAccessBoundaryData) RegionalAccessBoundaryHeader() (value string, present bool) {
 	if t.EncodedLocations == "" {
-		// If the data is empty, the header should not be present.
 		return "", false
 	}
-
-	// If data is not empty, the header should always be present.
-	present = true
-	value = ""
-	if t.EncodedLocations != TrustBoundaryNoOp {
-		value = t.EncodedLocations
-	}
-	// For a no-op, the backend requires an empty string.
-	return value, present
+	return t.EncodedLocations, true
 }
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-package trustboundary
+package regionalaccessboundary

 import (
 	"context"
@@ -21,13 +21,13 @@ import (
 )

 const (
-	workloadAllowedLocationsEndpoint  = "https://iamcredentials.%s/v1/projects/%s/locations/global/workloadIdentityPools/%s/allowedLocations"
-	workforceAllowedLocationsEndpoint = "https://iamcredentials.%s/v1/locations/global/workforcePools/%s/allowedLocations"
+	workloadAllowedLocationsEndpoint  = "https://iamcredentials.googleapis.com/v1/projects/%s/locations/global/workloadIdentityPools/%s/allowedLocations"
+	workforceAllowedLocationsEndpoint = "https://iamcredentials.googleapis.com/v1/locations/global/workforcePools/%s/allowedLocations"
 )

 var (
-	workforceAudiencePattern = regexp.MustCompile(`//iam\.([^/]+)/locations/global/workforcePools/([^/]+)`)
-	workloadAudiencePattern  = regexp.MustCompile(`//iam\.([^/]+)/projects/([^/]+)/locations/global/workloadIdentityPools/([^/]+)`)
+	workforceAudiencePattern = regexp.MustCompile(`^//iam\.([^/]+)/locations/([^/]+)/workforcePools/([^/]+)/providers/[^/]+$`)
+	workloadAudiencePattern  = regexp.MustCompile(`^//iam\.([^/]+)/projects/([^/]+)/locations/([^/]+)/workloadIdentityPools/([^/]+)/providers/[^/]+$`)
 )

 // NewExternalAccountConfigProvider creates a new ConfigProvider for external accounts.
@@ -36,19 +36,19 @@ func NewExternalAccountConfigProvider(audience, inputUniverseDomain string) (Con
 	var isWorkload bool

 	matches := workloadAudiencePattern.FindStringSubmatch(audience)
-	if len(matches) == 4 { // Expecting full match, domain, projectNumber, poolID
+	if len(matches) == 5 { // Expecting full match, domain, projectNumber, location, poolID
 		audienceDomain = matches[1]
 		projectNumber = matches[2]
-		poolID = matches[3]
+		poolID = matches[4]
 		isWorkload = true
 	} else {
 		matches = workforceAudiencePattern.FindStringSubmatch(audience)
-		if len(matches) == 3 { // Expecting full match, domain, poolID
+		if len(matches) == 4 { // Expecting full match, domain, location, poolID
 			audienceDomain = matches[1]
-			poolID = matches[2]
+			poolID = matches[3]
 			isWorkload = false
 		} else {
-			return nil, fmt.Errorf("trustboundary: unknown audience format: %q", audience)
+			return nil, fmt.Errorf("regionalaccessboundary: unknown audience format: %q", audience)
 		}
 	}

@@ -56,7 +56,7 @@ func NewExternalAccountConfigProvider(audience, inputUniverseDomain string) (Con
 	if effectiveUniverseDomain == "" {
 		effectiveUniverseDomain = audienceDomain
 	} else if audienceDomain != "" && effectiveUniverseDomain != audienceDomain {
-		return nil, fmt.Errorf("trustboundary: provided universe domain (%q) does not match domain in audience (%q)", inputUniverseDomain, audienceDomain)
+		return nil, fmt.Errorf("regionalaccessboundary: provided universe domain (%q) does not match domain in audience (%q)", inputUniverseDomain, audienceDomain)
 	}

 	if isWorkload {
@@ -77,8 +77,8 @@ type workforcePoolConfigProvider struct {
 	universeDomain string
 }

-func (p *workforcePoolConfigProvider) GetTrustBoundaryEndpoint(ctx context.Context) (string, error) {
-	return fmt.Sprintf(workforceAllowedLocationsEndpoint, p.universeDomain, p.poolID), nil
+func (p *workforcePoolConfigProvider) GetRegionalAccessBoundaryEndpoint(ctx context.Context) (string, error) {
+	return fmt.Sprintf(workforceAllowedLocationsEndpoint, p.poolID), nil
 }

 func (p *workforcePoolConfigProvider) GetUniverseDomain(ctx context.Context) (string, error) {
@@ -91,8 +91,8 @@ type workloadIdentityPoolConfigProvider struct {
 	universeDomain string
 }

-func (p *workloadIdentityPoolConfigProvider) GetTrustBoundaryEndpoint(ctx context.Context) (string, error) {
-	return fmt.Sprintf(workloadAllowedLocationsEndpoint, p.universeDomain, p.projectNumber, p.poolID), nil
+func (p *workloadIdentityPoolConfigProvider) GetRegionalAccessBoundaryEndpoint(ctx context.Context) (string, error) {
+	return fmt.Sprintf(workloadAllowedLocationsEndpoint, p.projectNumber, p.poolID), nil
 }

 func (p *workloadIdentityPoolConfigProvider) GetUniverseDomain(ctx context.Context) (string, error) {
@@ -0,0 +1,503 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package regionalaccessboundary
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"maps"
+	"math/rand"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+	"sync"
+	"time"
+
+	"cloud.google.com/go/auth"
+	"cloud.google.com/go/auth/internal"
+	"cloud.google.com/go/auth/internal/retry"
+	"github.com/googleapis/gax-go/v2/internallog"
+)
+
+// ProviderKey is the key to fetch the DataProvider from Token Metadata.
+const ProviderKey = "regionalaccessboundary.ProviderKey"
+
+const (
+	// serviceAccountAllowedLocationsEndpoint is the URL for fetching allowed locations for a given service account email.
+	serviceAccountAllowedLocationsEndpoint = "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/%s/allowedLocations"
+
+	// cacheTTL is the duration cached RAB data remains valid before hard expiry.
+	cacheTTL = 6 * time.Hour
+	// cacheSoftExpiry is the threshold before hard expiry where a background refresh is triggered.
+	cacheSoftExpiry = 1 * time.Hour
+	// baseCooldownDuration is the initial delay after a failed background fetch.
+	baseCooldownDuration = 15 * time.Minute
+)
+
+var (
+	// retryOptions configures the retry behavior for Regional Access Boundary lookups.
+	retryOptions = &retry.Options{
+		Initial:     1 * time.Second,
+		Max:         60 * time.Second,
+		Multiplier:  2.0,
+		MaxAttempts: 6,
+	}
+)
+
+// isEnabled wraps isRegionalAccessBoundaryEnabled with sync.OnceValues to ensure it's
+// called only once.
+var isEnabled = sync.OnceValues(isRegionalAccessBoundaryEnabled)
+
+// IsEnabled returns if the Regional Access Boundary feature is enabled and an error if
+// the configuration is invalid. The underlying check is performed only once.
+func IsEnabled() (bool, error) {
+	return isEnabled()
+}
+
+// isRegionalAccessBoundaryEnabled checks if the Regional Access Boundary feature
+// is enabled via the GOOGLE_AUTH_TRUST_BOUNDARY_ENABLED environment variable.
+//
+// If the environment variable is not set or empty, it is considered false.
+//
+// The environment variable is interpreted as a boolean with the following
+// (case-insensitive) rules:
+//   - "true", "1" are considered true.
+//   - All other values (including "false", "0", or invalid strings) are considered false.
+func isRegionalAccessBoundaryEnabled() (bool, error) {
+	val := strings.ToLower(os.Getenv("GOOGLE_AUTH_TRUST_BOUNDARY_ENABLED"))
+	return val == "true" || val == "1", nil
+}
+
+// ConfigProvider provides specific configuration for Regional Access Boundary lookups.
+type ConfigProvider interface {
+	// GetRegionalAccessBoundaryEndpoint returns the endpoint URL for the Regional Access Boundary lookup.
+	GetRegionalAccessBoundaryEndpoint(ctx context.Context) (url string, err error)
+	// GetUniverseDomain returns the universe domain associated with the credential.
+	// It may return an error if the universe domain cannot be determined.
+	GetUniverseDomain(ctx context.Context) (string, error)
+}
+
+// AllowedLocationsResponse is the structure of the response from the Regional Access Boundary API.
+type AllowedLocationsResponse struct {
+	// Locations is the list of allowed locations.
+	Locations []string `json:"locations"`
+	// EncodedLocations is the encoded representation of the allowed locations.
+	EncodedLocations string `json:"encodedLocations"`
+}
+
+// fetchRegionalAccessBoundaryData fetches the Regional Access Boundary data from the API.
+func fetchRegionalAccessBoundaryData(ctx context.Context, client *http.Client, url string, token *auth.Token, logger *slog.Logger) (*internal.RegionalAccessBoundaryData, error) {
+	if logger == nil {
+		logger = slog.New(slog.NewTextHandler(io.Discard, nil))
+	}
+	if client == nil {
+		return nil, errors.New("regionalaccessboundary: HTTP client is required")
+	}
+
+	if url == "" {
+		return nil, errors.New("regionalaccessboundary: URL cannot be empty")
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return nil, fmt.Errorf("regionalaccessboundary: failed to create Regional Access Boundary request: %w", err)
+	}
+
+	if token == nil || token.Value == "" {
+		return nil, errors.New("regionalaccessboundary: access token required for lookup API authentication")
+	}
+	typ := token.Type
+	if typ == "" {
+		typ = internal.TokenTypeBearer
+	}
+	req.Header.Set("Authorization", typ+" "+token.Value)
+	logger.DebugContext(ctx, "Regional Access Boundary request", "request", internallog.HTTPRequest(req, nil))
+
+	retryer := retry.NewWithOptions(retryOptions)
+	startTime := time.Now()
+	var response *http.Response
+	for {
+		response, err = client.Do(req)
+
+		var statusCode int
+		if response != nil {
+			statusCode = response.StatusCode
+		}
+		pause, shouldRetry := retryer.Retry(statusCode, err)
+
+		// Enforce a maximum 1 minute retry window for specific server errors.
+		if shouldRetry && (statusCode == 500 || statusCode == 502 || statusCode == 503 || statusCode == 504) {
+			if time.Since(startTime)+pause > 1*time.Minute {
+				shouldRetry = false
+			}
+		}
+
+		if !shouldRetry {
+			break
+		}
+
+		if response != nil {
+			// Drain and close the body to reuse the connection
+			io.Copy(io.Discard, response.Body)
+			response.Body.Close()
+		}
+
+		if err := retry.Sleep(ctx, pause); err != nil {
+			return nil, err
+		}
+	}
+
+	if err != nil {
+		return nil, fmt.Errorf("regionalaccessboundary: failed to fetch Regional Access Boundary: %w", err)
+	}
+	defer response.Body.Close()
+
+	body, err := io.ReadAll(response.Body)
+	if err != nil {
+		return nil, fmt.Errorf("regionalaccessboundary: failed to read Regional Access Boundary response: %w", err)
+	}
+
+	logger.DebugContext(ctx, "Regional Access Boundary response", "response", internallog.HTTPResponse(response, body))
+
+	if response.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("regionalaccessboundary: Regional Access Boundary request failed with status: %s, body: %s", response.Status, string(body))
+	}
+
+	apiResponse := AllowedLocationsResponse{}
+	if err := json.Unmarshal(body, &apiResponse); err != nil {
+		return nil, fmt.Errorf("regionalaccessboundary: failed to unmarshal Regional Access Boundary response: %w", err)
+	}
+
+	if apiResponse.EncodedLocations == "" {
+		return nil, errors.New("regionalaccessboundary: invalid API response: encodedLocations is empty")
+	}
+
+	return internal.NewRegionalAccessBoundaryData(apiResponse.Locations, apiResponse.EncodedLocations), nil
+}
+
+// DataProvider fetches and caches Regional Access Boundary Data.
+// It implements the auth.TokenProvider interface and uses a ConfigProvider
+// to get type-specific details for the lookup.
+type DataProvider struct {
+	client         *http.Client
+	configProvider ConfigProvider
+	logger         *slog.Logger
+	base           auth.TokenProvider
+
+	mu               sync.RWMutex
+	data             *internal.RegionalAccessBoundaryData
+	dataExpiry       time.Time
+	isFetching       bool
+	cooldownExpiry   time.Time
+	cooldownDuration time.Duration // tracks the current cooldown duration for exponential backoff
+}
+
+// NewProvider wraps the provided base [auth.TokenProvider] and returns a new
+// provider that fetches and caches the Regional Access Boundary data. It uses
+// the provided HTTP client and configProvider.
+func NewProvider(client *http.Client, configProvider ConfigProvider, logger *slog.Logger, base auth.TokenProvider) (*DataProvider, error) {
+	if client == nil {
+		return nil, errors.New("regionalaccessboundary: HTTP client cannot be nil for DataProvider")
+	}
+	if configProvider == nil {
+		return nil, errors.New("regionalaccessboundary: ConfigProvider cannot be nil for DataProvider")
+	}
+	p := &DataProvider{
+		client:           client,
+		configProvider:   configProvider,
+		logger:           internallog.New(logger),
+		base:             base,
+		cooldownDuration: 15 * time.Minute,
+	}
+	return p, nil
+}
+
+// Token retrieves a token from the base provider and injects the DataProvider
+// instance into its metadata.
+func (p *DataProvider) Token(ctx context.Context) (*auth.Token, error) {
+	token, err := p.base.Token(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	// Clone the token and its metadata to avoid mutating shared/cached state.
+	newToken := *token
+	newToken.Metadata = maps.Clone(token.Metadata)
+	if newToken.Metadata == nil {
+		newToken.Metadata = make(map[string]interface{})
+	}
+	newToken.Metadata[ProviderKey] = p
+
+	return &newToken, nil
+}
+
+// GetHeaderValue immediately returns a valid header if it's cached, or kicks off a background fetch
+// if it is unpopulated or expired.
+func (p *DataProvider) GetHeaderValue(ctx context.Context, reqURL string, accessToken *auth.Token) string {
+	if !strings.Contains(reqURL, "://") {
+		reqURL = "https://" + reqURL
+	}
+	if u, err := url.Parse(reqURL); err == nil {
+		host := u.Host
+		if host == "" && strings.HasPrefix(u.Path, "/") {
+			host = strings.TrimPrefix(u.Path, "/")
+		}
+		if h, _, err := net.SplitHostPort(host); err == nil {
+			host = h
+		}
+		// Skip lookup for regional endpoints.
+		if host == "rep.googleapis.com" || strings.HasSuffix(host, ".rep.googleapis.com") ||
+			host == "rep.sandbox.googleapis.com" || strings.HasSuffix(host, ".rep.sandbox.googleapis.com") {
+			return ""
+		}
+		// Skip lookup for IAM and STS endpoints as they do not require RAB headers.
+		if host == "iam.googleapis.com" || host == "iamcredentials.googleapis.com" ||
+			host == "sts.googleapis.com" {
+			return ""
+		}
+	}
+
+	// Skip lookup for non-default universe domains.
+	uniDomain, err := p.configProvider.GetUniverseDomain(ctx)
+	if err != nil {
+		p.logger.WarnContext(ctx, "regionalaccessboundary: error getting universe domain", "error", err)
+		return ""
+	}
+	if uniDomain != "" && uniDomain != internal.DefaultUniverseDomain {
+		return ""
+	}
+
+	// Return the cached data if present and not expired.
+	p.mu.RLock()
+	data := p.data
+	dataExpiry := p.dataExpiry
+	p.mu.RUnlock()
+
+	now := time.Now()
+	if data != nil && now.Before(dataExpiry) {
+		val, _ := data.RegionalAccessBoundaryHeader()
+
+		// Soft Expiry: if the cached data is within the soft expiration window,
+		// initiate a non-blocking background refresh to proactively fetch new data
+		// while continuing to serve the current valid cache block.
+		if now.After(dataExpiry.Add(-cacheSoftExpiry)) {
+			p.mu.Lock()
+			if !p.isFetching && now.After(p.cooldownExpiry) {
+				p.isFetching = true
+				go p.fetchAsync(context.Background(), accessToken)
+			}
+			p.mu.Unlock()
+		}
+
+		return val
+	}
+
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	// Skip lookup if in cooldown or another process is already fetching.
+	if p.isFetching || time.Now().Before(p.cooldownExpiry) {
+		return ""
+	}
+
+	// Start async RAB lookup and return empty header.
+	p.isFetching = true
+	go p.fetchAsync(context.Background(), accessToken)
+	return ""
+}
+
+// fetchAsync performs the background lookup for Regional Access Boundary data.
+// It updates the provider's state based on the result (success or failure).
+func (p *DataProvider) fetchAsync(ctx context.Context, accessToken *auth.Token) {
+	defer func() {
+		p.mu.Lock()
+		p.isFetching = false
+		p.mu.Unlock()
+	}()
+
+	url, err := p.configProvider.GetRegionalAccessBoundaryEndpoint(ctx)
+	if err != nil {
+		p.logger.WarnContext(ctx, "regionalaccessboundary: error getting the lookup endpoint", "error", err)
+		p.handleFetchFailure(ctx)
+		return
+	}
+
+	newData, fetchErr := fetchRegionalAccessBoundaryData(ctx, p.client, url, accessToken, p.logger)
+
+	if fetchErr != nil {
+		p.logger.WarnContext(ctx, "regionalaccessboundary: async fetch failed", "error", fetchErr)
+		p.handleFetchFailure(ctx)
+		return
+	}
+
+	p.handleFetchSuccess(newData)
+}
+
+// handleFetchSuccess updates the cache with new data and clears any existing cooldown.
+func (p *DataProvider) handleFetchSuccess(newData *internal.RegionalAccessBoundaryData) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.data = newData
+	p.dataExpiry = time.Now().Add(cacheTTL)
+	p.cooldownExpiry = time.Time{}
+	p.cooldownDuration = baseCooldownDuration
+}
+
+// handleFetchFailure triggers the cooldown period using exponential backoff.
+func (p *DataProvider) handleFetchFailure(ctx context.Context) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	// Add random bounded jitter (between half of the base and the full base) to prevent thundering herds
+	jitter := p.cooldownDuration/2 + time.Duration(rand.Int63n(int64(p.cooldownDuration/2)))
+	p.cooldownExpiry = time.Now().Add(jitter)
+
+	// Exponential backoff for the NEXT attempt, up to cacheTTL max (6 hours)
+	nextCooldown := p.cooldownDuration * 2
+	if nextCooldown > cacheTTL {
+		nextCooldown = cacheTTL
+	}
+	p.cooldownDuration = nextCooldown
+}
+
+// serviceAccountConfig holds configuration for SA Regional Access Boundary lookups.
+// It implements the ConfigProvider interface.
+type serviceAccountConfig struct {
+	ServiceAccountEmail string
+	UniverseDomain      string
+}
+
+// NewServiceAccountConfigProvider creates a new config for service accounts.
+func NewServiceAccountConfigProvider(saEmail, universeDomain string) ConfigProvider {
+	return &serviceAccountConfig{
+		ServiceAccountEmail: saEmail,
+		UniverseDomain:      universeDomain,
+	}
+}
+
+// GetRegionalAccessBoundaryEndpoint returns the formatted URL for fetching allowed locations
+// for the configured service account.
+func (sac *serviceAccountConfig) GetRegionalAccessBoundaryEndpoint(ctx context.Context) (url string, err error) {
+	if sac.ServiceAccountEmail == "" {
+		return "", errors.New("regionalaccessboundary: service account email cannot be empty for config")
+	}
+	return fmt.Sprintf(serviceAccountAllowedLocationsEndpoint, sac.ServiceAccountEmail), nil
+}
+
+// GetUniverseDomain returns the configured universe domain, defaulting to
+// [internal.DefaultUniverseDomain] if not explicitly set.
+func (sac *serviceAccountConfig) GetUniverseDomain(ctx context.Context) (string, error) {
+	if sac.UniverseDomain == "" {
+		return internal.DefaultUniverseDomain, nil
+	}
+	return sac.UniverseDomain, nil
+}
+
+// GCEConfigProvider implements ConfigProvider for GCE environments.
+// It lazily fetches and caches the necessary metadata (service account email, universe domain)
+type GCEConfigProvider struct {
+	// universeDomainProvider provides the universe domain and underlying metadata client.
+	universeDomainProvider *internal.ComputeUniverseDomainProvider
+
+	// Caching for service account email
+	saMu    sync.Mutex
+	saEmail string
+
+	// Caching for universe domain
+	udOnce sync.Once
+	ud     string
+	udErr  error
+}
+
+// NewGCEConfigProvider creates a new GCEConfigProvider
+// which uses the provided gceUDP to interact with the GCE metadata server.
+func NewGCEConfigProvider(gceUDP *internal.ComputeUniverseDomainProvider) *GCEConfigProvider {
+	// The validity of gceUDP and its internal MetadataClient will be checked
+	// within the GetRegionalAccessBoundaryEndpoint and GetUniverseDomain methods.
+	return &GCEConfigProvider{
+		universeDomainProvider: gceUDP,
+	}
+}
+
+func (g *GCEConfigProvider) fetchSA(ctx context.Context) (string, error) {
+	if g.universeDomainProvider == nil || g.universeDomainProvider.MetadataClient == nil {
+		return "", errors.New("regionalaccessboundary: GCEConfigProvider not properly initialized (missing ComputeUniverseDomainProvider or MetadataClient)")
+	}
+	mdClient := g.universeDomainProvider.MetadataClient
+	saEmail, err := mdClient.EmailWithContext(ctx, "default")
+	if err != nil {
+		return "", fmt.Errorf("regionalaccessboundary: GCE config: failed to get service account email: %w", err)
+	}
+	return saEmail, nil
+}
+
+func (g *GCEConfigProvider) fetchUD(ctx context.Context) {
+	if g.universeDomainProvider == nil || g.universeDomainProvider.MetadataClient == nil {
+		g.udErr = errors.New("regionalaccessboundary: GCEConfigProvider not properly initialized (missing ComputeUniverseDomainProvider or MetadataClient)")
+		return
+	}
+	ud, err := g.universeDomainProvider.GetProperty(ctx)
+	if err != nil {
+		g.udErr = fmt.Errorf("regionalaccessboundary: GCE config: failed to get universe domain: %w", err)
+		return
+	}
+	if ud == "" {
+		ud = internal.DefaultUniverseDomain
+	}
+	g.ud = ud
+}
+
+// GetRegionalAccessBoundaryEndpoint constructs the Regional Access Boundary lookup URL for a GCE environment.
+// It uses cached service account email after the first call.
+func (g *GCEConfigProvider) GetRegionalAccessBoundaryEndpoint(ctx context.Context) (string, error) {
+	// Check if we already have a cached service account email.
+	g.saMu.Lock()
+	if g.saEmail != "" {
+		email := g.saEmail
+		g.saMu.Unlock()
+		return fmt.Sprintf(serviceAccountAllowedLocationsEndpoint, email), nil
+	}
+	g.saMu.Unlock()
+
+	// Fetch the email from the metadata server. We do not hold the lock
+	// during this I/O operation to avoid blocking other goroutines.
+	email, err := g.fetchSA(ctx)
+	if err != nil {
+		return "", err
+	}
+
+	// Cache the successful result.
+	g.saMu.Lock()
+	g.saEmail = email
+	g.saMu.Unlock()
+
+	return fmt.Sprintf(serviceAccountAllowedLocationsEndpoint, email), nil
+}
+
+// GetUniverseDomain retrieves the universe domain from the GCE metadata server.
+// It uses a cached value after the first call.
+func (g *GCEConfigProvider) GetUniverseDomain(ctx context.Context) (string, error) {
+	g.udOnce.Do(func() { g.fetchUD(ctx) })
+	if g.udErr != nil {
+		return "", g.udErr
+	}
+	return g.ud, nil
+}
@@ -22,10 +22,6 @@ import (
 	"time"
 )

-const (
-	maxRetryAttempts = 5
-)
-
 var (
 	syscallRetryable = func(error) bool { return false }
 )
@@ -61,21 +57,69 @@ func Sleep(ctx context.Context, d time.Duration) error {

 // New returns a new Retryer with the default backoff strategy.
 func New() *Retryer {
-	return &Retryer{bo: &defaultBackoff{
-		cur: 100 * time.Millisecond,
-		max: 30 * time.Second,
-		mul: 2,
-	}}
+	return NewWithOptions(&Options{
+		Initial:     100 * time.Millisecond,
+		Max:         30 * time.Second,
+		Multiplier:  2,
+		MaxAttempts: 5,
+	})
+}
+
+// Options defines the configuration for the Retryer.
+type Options struct {
+	// Initial is the initial backoff duration.
+	Initial time.Duration
+	// Max is the maximum backoff duration for a single retry attempt.
+	// It does not limit the total time of all retries.
+	Max time.Duration
+	// Multiplier is the factor by which the backoff duration is multiplied after each attempt.
+	Multiplier float64
+	// MaxAttempts is the maximum number of attempts before giving up.
+	MaxAttempts int
+}
+
+// NewWithOptions returns a new Retryer with the specified backoff strategy.
+// If any option is not set (zero value), it defaults to the values used in New().
+func NewWithOptions(opts *Options) *Retryer {
+	initial := opts.Initial
+	if initial <= 0 {
+		initial = 100 * time.Millisecond
+	}
+
+	max := opts.Max
+	if max <= 0 {
+		max = 30 * time.Second
+	}
+
+	multiplier := opts.Multiplier
+	if multiplier < 1.0 {
+		multiplier = 2.0
+	}
+
+	maxAttempts := opts.MaxAttempts
+	if maxAttempts <= 0 {
+		maxAttempts = 5
+	}
+
+	return &Retryer{
+		bo: &defaultBackoff{
+			cur: initial,
+			max: max,
+			mul: multiplier,
+		},
+		maxAttempts: maxAttempts,
+	}
 }

 type backoff interface {
 	Pause() time.Duration
 }

-// Retryer is a retryer for HTTP requests.
+// Retryer handles retry logic for HTTP requests using a configurable backoff strategy.
 type Retryer struct {
-	bo       backoff
-	attempts int
+	bo          backoff
+	attempts    int
+	maxAttempts int
 }

 // Retry determines if a request should be retried.
@@ -87,7 +131,7 @@ func (r *Retryer) Retry(status int, err error) (time.Duration, bool) {
 	if !retryOk {
 		return 0, false
 	}
-	if r.attempts == maxRetryAttempts {
+	if r.attempts == r.maxAttempts {
 		return 0, false
 	}
 	r.attempts++
@@ -0,0 +1,31 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build linux
+// +build linux
+
+package retry
+
+import (
+	"errors"
+	"syscall"
+)
+
+func init() {
+	// Initialize syscallRetryable to return true on transient socket-level
+	// errors. These errors are specific to Linux.
+	syscallRetryable = func(err error) bool {
+		return errors.Is(err, syscall.ECONNRESET) || errors.Is(err, syscall.ECONNREFUSED)
+	}
+}
@@ -65,15 +65,16 @@ const (
 // transport packages in order to avoid cyclic deps. It correlates 1:1 with
 // fields on httptransport.Options and grpctransport.Options.
 type Options struct {
-	Endpoint                string
-	DefaultEndpointTemplate string
-	DefaultMTLSEndpoint     string
-	ClientCertProvider      cert.Provider
-	Client                  *http.Client
-	UniverseDomain          string
-	EnableDirectPath        bool
-	EnableDirectPathXds     bool
-	Logger                  *slog.Logger
+	Endpoint                            string
+	DefaultEndpointTemplate             string
+	DefaultMTLSEndpoint                 string
+	ClientCertProvider                  cert.Provider
+	Client                              *http.Client
+	UniverseDomain                      string
+	EnableDirectPath                    bool
+	EnableDirectPathXds                 bool
+	EnableDirectPathXdsOverInterconnect bool
+	Logger                              *slog.Logger
 }

 // getUniverseDomain returns the default service domain for a given Cloud
@@ -76,9 +76,17 @@ func NewSecureConnectProvider(configFilePath string) (Provider, error) {
 	if err := validateMetadata(metadata); err != nil {
 		return nil, fmt.Errorf("cert: invalid config in %q: %w", configFilePath, err)
 	}
-	return (&secureConnectSource{
+	source := &secureConnectSource{
 		metadata: metadata,
-	}).getClientCertificate, nil
+	}
+	cert, err := source.getClientCertificate(nil)
+	if err != nil {
+		return nil, err
+	}
+	if cert == nil {
+		return nil, errSourceUnavailable
+	}
+	return source.getClientCertificate, nil
 }

 func validateMetadata(metadata secureConnectMetadata) error {
@@ -101,7 +109,9 @@ func (s *secureConnectSource) getClientCertificate(info *tls.CertificateRequestI
 	command := s.metadata.Cmd
 	data, err := exec.Command(command[0], command[1:]...).Output()
 	if err != nil {
-		return nil, err
+		// Intentionally return nil, nil when the helper fails so the probe in
+		// NewSecureConnectProvider can recognize the source as unavailable.
+		return nil, nil
 	}
 	cert, err := tls.X509KeyPair(data, data)
 	if err != nil {
@@ -37,11 +37,21 @@ type certificateConfig struct {
 	CertConfigs certConfigs `json:"cert_configs"`
 }

-// getconfigFilePath determines the path to the certificate configuration file.
+type certConfigInfo struct {
+	certPath string // path to the certificate file
+	keyPath  string // path to the private key file
+	useECP   bool   // whether to use Enterprise Certificate Proxy
+}
+
+// GetConfigFilePath determines the path to the certificate configuration file.
 // It first checks for the presence of an environment variable that specifies
 // the file path. If the environment variable is not set, it falls back to
-// a default configuration file path.
-func getconfigFilePath() string {
+// a default configuration file path. If a non-empty configFilePath is provided,
+// it is returned.
+func GetConfigFilePath(configFilePath string) string {
+	if configFilePath != "" {
+		return configFilePath
+	}
 	envFilePath := util.GetConfigFilePathFromEnv()
 	if envFilePath != "" {
 		return envFilePath
@@ -50,21 +60,32 @@ func getconfigFilePath() string {

 }

-// GetCertificatePath retrieves the certificate file path from the provided
+// GetFileBasedCertificatePath retrieves the certificate file path from the provided
 // configuration file. If the configFilePath is empty, it attempts to load
 // the configuration from a well-known gcloud location.
 // This function is exposed to allow other packages, such as the
 // externalaccount package, to retrieve the certificate path without needing
 // to load the entire certificate configuration.
-func GetCertificatePath(configFilePath string) (string, error) {
-	if configFilePath == "" {
-		configFilePath = getconfigFilePath()
-	}
-	certFile, _, err := getCertAndKeyFiles(configFilePath)
+func GetFileBasedCertificatePath(configFilePath string) (string, error) {
+	configFilePath = GetConfigFilePath(configFilePath)
+	info, err := parseCertConfig(configFilePath)
 	if err != nil {
 		return "", err
 	}
-	return certFile, nil
+	if info.useECP {
+		return "", errors.New("enterprise certificate proxy is enabled, certificate path is not available")
+	}
+	return info.certPath, nil
+}
+
+// IsECPConfig checks if the given configuration is an ECP certificate configuration.
+func IsECPConfig(configFilePath string) bool {
+	configFilePath = GetConfigFilePath(configFilePath)
+	info, err := parseCertConfig(configFilePath)
+	if err != nil {
+		return false
+	}
+	return info.useECP
 }

 // NewWorkloadX509CertProvider creates a certificate source
@@ -76,17 +97,19 @@ func GetCertificatePath(configFilePath string) (string, error) {
 // If configFilePath is empty, the client will attempt to load the config from
 // a well-known gcloud location.
 func NewWorkloadX509CertProvider(configFilePath string) (Provider, error) {
-	if configFilePath == "" {
-		configFilePath = getconfigFilePath()
-	}
-	certFile, keyFile, err := getCertAndKeyFiles(configFilePath)
+	configFilePath = GetConfigFilePath(configFilePath)
+	info, err := parseCertConfig(configFilePath)
 	if err != nil {
 		return nil, err
 	}

+	if info.useECP {
+		return NewEnterpriseCertificateProxyProvider(configFilePath)
+	}
+
 	source := &workloadSource{
-		CertPath: certFile,
-		KeyPath:  keyFile,
+		CertPath: info.certPath,
+		KeyPath:  info.keyPath,
 	}
 	return source.getClientCertificate, nil
 }
@@ -101,38 +124,60 @@ func (s *workloadSource) getClientCertificate(info *tls.CertificateRequestInfo)
 	return &cert, nil
 }

-// getCertAndKeyFiles attempts to read the provided config file and return the certificate and private
-// key file paths.
-func getCertAndKeyFiles(configFilePath string) (string, string, error) {
+// parseCertConfig attempts to read the provided config file and return the certificate, private
+// key file paths, and a boolean indicating whether to use ECP inside a certConfigInfo struct.
+func parseCertConfig(configFilePath string) (certConfigInfo, error) {
 	jsonFile, err := os.Open(configFilePath)
 	if err != nil {
-		return "", "", errSourceUnavailable
+		return certConfigInfo{}, errSourceUnavailable
 	}
+	defer jsonFile.Close()

 	byteValue, err := io.ReadAll(jsonFile)
 	if err != nil {
-		return "", "", err
+		return certConfigInfo{}, err
 	}

 	var config certificateConfig
 	if err := json.Unmarshal(byteValue, &config); err != nil {
-		return "", "", err
+		return certConfigInfo{}, err
 	}

 	if config.CertConfigs.Workload == nil {
-		return "", "", errSourceUnavailable
+		// If 'workload' field is absent, it is an ECP config.
+		// Validate that the config file is a valid ECP file.
+		var rawMap map[string]any
+		if err := json.Unmarshal(byteValue, &rawMap); err != nil {
+			return certConfigInfo{}, err
+		}
+		certConfigs, ok := rawMap["cert_configs"].(map[string]any)
+		if !ok {
+			return certConfigInfo{}, errSourceUnavailable
+		}
+		hasECPSection := false
+		for _, section := range []string{"pkcs11", "windows_store", "macos_keychain"} {
+			if _, exists := certConfigs[section]; exists {
+				hasECPSection = true
+				break
+			}
+		}
+		_, hasLibs := rawMap["libs"]
+		if !hasECPSection || !hasLibs {
+			return certConfigInfo{}, errSourceUnavailable
+		}
+		return certConfigInfo{useECP: true}, nil
 	}

 	certFile := config.CertConfigs.Workload.CertPath
 	keyFile := config.CertConfigs.Workload.KeyPath

 	if certFile == "" {
-		return "", "", errors.New("certificate configuration is missing the certificate file location")
+		return certConfigInfo{}, errors.New("certificate configuration is missing the certificate file location")
 	}

 	if keyFile == "" {
-		return "", "", errors.New("certificate configuration is missing the key file location")
+		return certConfigInfo{}, errors.New("certificate configuration is missing the key file location")
 	}

-	return certFile, keyFile, nil
+	return certConfigInfo{certPath: certFile, keyPath: keyFile}, nil
 }
@@ -15,14 +15,20 @@
 package headers

 import (
+	"context"
 	"net/http"

 	"cloud.google.com/go/auth"
 	"cloud.google.com/go/auth/internal"
+	"cloud.google.com/go/auth/internal/regionalaccessboundary"
 )

-// SetAuthHeader uses the provided token to set the Authorization and trust
-// boundary headers on a request. If the token.Type is empty, the type is
+type regionalAccessBoundaryProvider interface {
+	GetHeaderValue(ctx context.Context, reqURL string, token *auth.Token) string
+}
+
+// SetAuthHeader uses the provided token to set the Authorization and regional
+// access boundary headers on a request. If the token.Type is empty, the type is
 // assumed to be Bearer.
 func SetAuthHeader(token *auth.Token, req *http.Request) {
 	typ := token.Type
@@ -31,31 +37,26 @@ func SetAuthHeader(token *auth.Token, req *http.Request) {
 	}
 	req.Header.Set("Authorization", typ+" "+token.Value)

-	if headerVal, setHeader := getTrustBoundaryHeader(token); setHeader {
-		req.Header.Set("x-allowed-locations", headerVal)
+	if provider, ok := token.Metadata[regionalaccessboundary.ProviderKey].(regionalAccessBoundaryProvider); ok {
+		if headerVal := provider.GetHeaderValue(req.Context(), req.URL.String(), token); headerVal != "" {
+			req.Header.Set("x-allowed-locations", headerVal)
+		}
 	}
 }

-// SetAuthMetadata uses the provided token to set the Authorization and trust
-// boundary metadata. If the token.Type is empty, the type is assumed to be
+// SetAuthMetadata uses the provided token to set the Authorization and regional
+// access boundary metadata. If the token.Type is empty, the type is assumed to be
 // Bearer.
-func SetAuthMetadata(token *auth.Token, m map[string]string) {
+func SetAuthMetadata(ctx context.Context, token *auth.Token, reqURL string, m map[string]string) {
 	typ := token.Type
 	if typ == "" {
 		typ = internal.TokenTypeBearer
 	}
 	m["authorization"] = typ + " " + token.Value

-	if headerVal, setHeader := getTrustBoundaryHeader(token); setHeader {
-		m["x-allowed-locations"] = headerVal
-	}
-}
-
-func getTrustBoundaryHeader(token *auth.Token) (val string, present bool) {
-	if data, ok := token.Metadata[internal.TrustBoundaryDataKey]; ok {
-		if tbd, ok := data.(internal.TrustBoundaryData); ok {
-			return tbd.TrustBoundaryHeader()
+	if provider, ok := token.Metadata[regionalaccessboundary.ProviderKey].(regionalAccessBoundaryProvider); ok {
+		if headerVal := provider.GetHeaderValue(ctx, reqURL, token); headerVal != "" {
+			m["x-allowed-locations"] = headerVal
 		}
 	}
-	return "", false
 }
@@ -126,7 +126,7 @@ func shouldUseS2A(clientCertSource cert.Provider, opts *Options) bool {
 		return false
 	}
 	// If directPath is enabled, skip S2A.
-	return !opts.EnableDirectPath && !opts.EnableDirectPathXds
+	return !opts.EnableDirectPath && !opts.EnableDirectPathXds && !opts.EnableDirectPathXdsOverInterconnect
 }

 func isGoogleS2AEnabled() bool {
@@ -67,15 +67,16 @@ func CloneDetectOptions(oldDo *credentials.DetectOptions) *credentials.DetectOpt
 	}
 	newDo := &credentials.DetectOptions{
 		// Simple types
-		TokenBindingType:  oldDo.TokenBindingType,
-		Audience:          oldDo.Audience,
-		Subject:           oldDo.Subject,
-		EarlyTokenRefresh: oldDo.EarlyTokenRefresh,
-		TokenURL:          oldDo.TokenURL,
-		STSAudience:       oldDo.STSAudience,
-		CredentialsFile:   oldDo.CredentialsFile,
-		UseSelfSignedJWT:  oldDo.UseSelfSignedJWT,
-		UniverseDomain:    oldDo.UniverseDomain,
+		TokenBindingType:    oldDo.TokenBindingType,
+		Audience:            oldDo.Audience,
+		Subject:             oldDo.Subject,
+		EarlyTokenRefresh:   oldDo.EarlyTokenRefresh,
+		DisableAsyncRefresh: oldDo.DisableAsyncRefresh,
+		TokenURL:            oldDo.TokenURL,
+		STSAudience:         oldDo.STSAudience,
+		CredentialsFile:     oldDo.CredentialsFile,
+		UseSelfSignedJWT:    oldDo.UseSelfSignedJWT,
+		UniverseDomain:      oldDo.UniverseDomain,

 		// These fields are pointer types that we just want to use exactly as
 		// the user set, copy the ref
@@ -1,392 +0,0 @@
-// Copyright 2025 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package trustboundary
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"log/slog"
-	"net/http"
-	"os"
-	"strings"
-	"sync"
-
-	"cloud.google.com/go/auth"
-	"cloud.google.com/go/auth/internal"
-	"cloud.google.com/go/auth/internal/retry"
-	"cloud.google.com/go/auth/internal/transport/headers"
-	"github.com/googleapis/gax-go/v2/internallog"
-)
-
-const (
-	// serviceAccountAllowedLocationsEndpoint is the URL for fetching allowed locations for a given service account email.
-	serviceAccountAllowedLocationsEndpoint = "https://iamcredentials.%s/v1/projects/-/serviceAccounts/%s/allowedLocations"
-)
-
-// isEnabled wraps isTrustBoundaryEnabled with sync.OnceValues to ensure it's
-// called only once.
-var isEnabled = sync.OnceValues(isTrustBoundaryEnabled)
-
-// IsEnabled returns if the trust boundary feature is enabled and an error if
-// the configuration is invalid. The underlying check is performed only once.
-func IsEnabled() (bool, error) {
-	return isEnabled()
-}
-
-// isTrustBoundaryEnabled checks if the trust boundary feature is enabled via
-// GOOGLE_AUTH_TRUST_BOUNDARY_ENABLED environment variable.
-//
-// If the environment variable is not set, it is considered false.
-//
-// The environment variable is interpreted as a boolean with the following
-// (case-insensitive) rules:
-//   - "true", "1" are considered true.
-//   - "false", "0" are considered false.
-//
-// Any other values will return an error.
-func isTrustBoundaryEnabled() (bool, error) {
-	const envVar = "GOOGLE_AUTH_TRUST_BOUNDARY_ENABLED"
-	val, ok := os.LookupEnv(envVar)
-	if !ok {
-		return false, nil
-	}
-	val = strings.ToLower(val)
-	switch val {
-	case "true", "1":
-		return true, nil
-	case "false", "0":
-		return false, nil
-	default:
-		return false, fmt.Errorf(`invalid value for %s: %q. Must be one of "true", "false", "1", or "0"`, envVar, val)
-	}
-}
-
-// ConfigProvider provides specific configuration for trust boundary lookups.
-type ConfigProvider interface {
-	// GetTrustBoundaryEndpoint returns the endpoint URL for the trust boundary lookup.
-	GetTrustBoundaryEndpoint(ctx context.Context) (url string, err error)
-	// GetUniverseDomain returns the universe domain associated with the credential.
-	// It may return an error if the universe domain cannot be determined.
-	GetUniverseDomain(ctx context.Context) (string, error)
-}
-
-// AllowedLocationsResponse is the structure of the response from the Trust Boundary API.
-type AllowedLocationsResponse struct {
-	// Locations is the list of allowed locations.
-	Locations []string `json:"locations"`
-	// EncodedLocations is the encoded representation of the allowed locations.
-	EncodedLocations string `json:"encodedLocations"`
-}
-
-// fetchTrustBoundaryData fetches the trust boundary data from the API.
-func fetchTrustBoundaryData(ctx context.Context, client *http.Client, url string, token *auth.Token, logger *slog.Logger) (*internal.TrustBoundaryData, error) {
-	if logger == nil {
-		logger = slog.New(slog.NewTextHandler(io.Discard, nil))
-	}
-	if client == nil {
-		return nil, errors.New("trustboundary: HTTP client is required")
-	}
-
-	if url == "" {
-		return nil, errors.New("trustboundary: URL cannot be empty")
-	}
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
-	if err != nil {
-		return nil, fmt.Errorf("trustboundary: failed to create trust boundary request: %w", err)
-	}
-
-	if token == nil || token.Value == "" {
-		return nil, errors.New("trustboundary: access token required for lookup API authentication")
-	}
-	headers.SetAuthHeader(token, req)
-	logger.DebugContext(ctx, "trust boundary request", "request", internallog.HTTPRequest(req, nil))
-
-	retryer := retry.New()
-	var response *http.Response
-	for {
-		response, err = client.Do(req)
-
-		var statusCode int
-		if response != nil {
-			statusCode = response.StatusCode
-		}
-		pause, shouldRetry := retryer.Retry(statusCode, err)
-
-		if !shouldRetry {
-			break
-		}
-
-		if response != nil {
-			// Drain and close the body to reuse the connection
-			io.Copy(io.Discard, response.Body)
-			response.Body.Close()
-		}
-
-		if err := retry.Sleep(ctx, pause); err != nil {
-			return nil, err
-		}
-	}
-
-	if err != nil {
-		return nil, fmt.Errorf("trustboundary: failed to fetch trust boundary: %w", err)
-	}
-	defer response.Body.Close()
-
-	body, err := io.ReadAll(response.Body)
-	if err != nil {
-		return nil, fmt.Errorf("trustboundary: failed to read trust boundary response: %w", err)
-	}
-
-	logger.DebugContext(ctx, "trust boundary response", "response", internallog.HTTPResponse(response, body))
-
-	if response.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("trustboundary: trust boundary request failed with status: %s, body: %s", response.Status, string(body))
-	}
-
-	apiResponse := AllowedLocationsResponse{}
-	if err := json.Unmarshal(body, &apiResponse); err != nil {
-		return nil, fmt.Errorf("trustboundary: failed to unmarshal trust boundary response: %w", err)
-	}
-
-	if apiResponse.EncodedLocations == "" {
-		return nil, errors.New("trustboundary: invalid API response: encodedLocations is empty")
-	}
-
-	return internal.NewTrustBoundaryData(apiResponse.Locations, apiResponse.EncodedLocations), nil
-}
-
-// serviceAccountConfig holds configuration for SA trust boundary lookups.
-// It implements the ConfigProvider interface.
-type serviceAccountConfig struct {
-	ServiceAccountEmail string
-	UniverseDomain      string
-}
-
-// NewServiceAccountConfigProvider creates a new config for service accounts.
-func NewServiceAccountConfigProvider(saEmail, universeDomain string) ConfigProvider {
-	return &serviceAccountConfig{
-		ServiceAccountEmail: saEmail,
-		UniverseDomain:      universeDomain,
-	}
-}
-
-// GetTrustBoundaryEndpoint returns the formatted URL for fetching allowed locations
-// for the configured service account and universe domain.
-func (sac *serviceAccountConfig) GetTrustBoundaryEndpoint(ctx context.Context) (url string, err error) {
-	if sac.ServiceAccountEmail == "" {
-		return "", errors.New("trustboundary: service account email cannot be empty for config")
-	}
-	ud := sac.UniverseDomain
-	if ud == "" {
-		ud = internal.DefaultUniverseDomain
-	}
-	return fmt.Sprintf(serviceAccountAllowedLocationsEndpoint, ud, sac.ServiceAccountEmail), nil
-}
-
-// GetUniverseDomain returns the configured universe domain, defaulting to
-// [internal.DefaultUniverseDomain] if not explicitly set.
-func (sac *serviceAccountConfig) GetUniverseDomain(ctx context.Context) (string, error) {
-	if sac.UniverseDomain == "" {
-		return internal.DefaultUniverseDomain, nil
-	}
-	return sac.UniverseDomain, nil
-}
-
-// DataProvider fetches and caches trust boundary Data.
-// It implements the DataProvider interface and uses a ConfigProvider
-// to get type-specific details for the lookup.
-type DataProvider struct {
-	client         *http.Client
-	configProvider ConfigProvider
-	data           *internal.TrustBoundaryData
-	logger         *slog.Logger
-	base           auth.TokenProvider
-}
-
-// NewProvider wraps the provided base [auth.TokenProvider] to create a new
-// provider that injects tokens with trust boundary data. It uses the provided
-// HTTP client and configProvider to fetch the data and attach it to the token's
-// metadata.
-func NewProvider(client *http.Client, configProvider ConfigProvider, logger *slog.Logger, base auth.TokenProvider) (*DataProvider, error) {
-	if client == nil {
-		return nil, errors.New("trustboundary: HTTP client cannot be nil for DataProvider")
-	}
-	if configProvider == nil {
-		return nil, errors.New("trustboundary: ConfigProvider cannot be nil for DataProvider")
-	}
-	p := &DataProvider{
-		client:         client,
-		configProvider: configProvider,
-		logger:         internallog.New(logger),
-		base:           base,
-	}
-	return p, nil
-}
-
-// Token retrieves a token from the base provider and injects it with trust
-// boundary data.
-func (p *DataProvider) Token(ctx context.Context) (*auth.Token, error) {
-	// Get the original token.
-	token, err := p.base.Token(ctx)
-	if err != nil {
-		return nil, err
-	}
-
-	tbData, err := p.GetTrustBoundaryData(ctx, token)
-	if err != nil {
-		return nil, fmt.Errorf("trustboundary: error fetching the trust boundary data: %w", err)
-	}
-	if tbData != nil {
-		if token.Metadata == nil {
-			token.Metadata = make(map[string]interface{})
-		}
-		token.Metadata[internal.TrustBoundaryDataKey] = *tbData
-	}
-	return token, nil
-}
-
-// GetTrustBoundaryData retrieves the trust boundary data.
-// It first checks the universe domain: if it's non-default, a NoOp is returned.
-// Otherwise, it checks a local cache. If the data is not cached as NoOp,
-// it fetches new data from the endpoint provided by its ConfigProvider,
-// using the given accessToken for authentication. Results are cached.
-// If fetching fails, it returns previously cached data if available, otherwise the fetch error.
-func (p *DataProvider) GetTrustBoundaryData(ctx context.Context, token *auth.Token) (*internal.TrustBoundaryData, error) {
-	// Check the universe domain.
-	uniDomain, err := p.configProvider.GetUniverseDomain(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("trustboundary: error getting universe domain: %w", err)
-	}
-	if uniDomain != "" && uniDomain != internal.DefaultUniverseDomain {
-		if p.data == nil || p.data.EncodedLocations != internal.TrustBoundaryNoOp {
-			p.data = internal.NewNoOpTrustBoundaryData()
-		}
-		return p.data, nil
-	}
-
-	// Check cache for a no-op result from a previous API call.
-	cachedData := p.data
-	if cachedData != nil && cachedData.EncodedLocations == internal.TrustBoundaryNoOp {
-		return cachedData, nil
-	}
-
-	// Get the endpoint
-	url, err := p.configProvider.GetTrustBoundaryEndpoint(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("trustboundary: error getting the lookup endpoint: %w", err)
-	}
-
-	// Proceed to fetch new data.
-	newData, fetchErr := fetchTrustBoundaryData(ctx, p.client, url, token, p.logger)
-
-	if fetchErr != nil {
-		// Fetch failed. Fallback to cachedData if available.
-		if cachedData != nil {
-			return cachedData, nil // Successful fallback
-		}
-		// No cache to fallback to.
-		return nil, fmt.Errorf("trustboundary: failed to fetch trust boundary data for endpoint %s and no cache available: %w", url, fetchErr)
-	}
-
-	// Fetch successful. Update cache.
-	p.data = newData
-	return newData, nil
-}
-
-// GCEConfigProvider implements ConfigProvider for GCE environments.
-// It lazily fetches and caches the necessary metadata (service account email, universe domain)
-// from the GCE metadata server.
-type GCEConfigProvider struct {
-	// universeDomainProvider provides the universe domain and underlying metadata client.
-	universeDomainProvider *internal.ComputeUniverseDomainProvider
-
-	// Caching for service account email
-	saOnce     sync.Once
-	saEmail    string
-	saEmailErr error
-
-	// Caching for universe domain
-	udOnce sync.Once
-	ud     string
-	udErr  error
-}
-
-// NewGCEConfigProvider creates a new GCEConfigProvider
-// which uses the provided gceUDP to interact with the GCE metadata server.
-func NewGCEConfigProvider(gceUDP *internal.ComputeUniverseDomainProvider) *GCEConfigProvider {
-	// The validity of gceUDP and its internal MetadataClient will be checked
-	// within the GetTrustBoundaryEndpoint and GetUniverseDomain methods.
-	return &GCEConfigProvider{
-		universeDomainProvider: gceUDP,
-	}
-}
-
-func (g *GCEConfigProvider) fetchSA(ctx context.Context) {
-	if g.universeDomainProvider == nil || g.universeDomainProvider.MetadataClient == nil {
-		g.saEmailErr = errors.New("trustboundary: GCEConfigProvider not properly initialized (missing ComputeUniverseDomainProvider or MetadataClient)")
-		return
-	}
-	mdClient := g.universeDomainProvider.MetadataClient
-	saEmail, err := mdClient.EmailWithContext(ctx, "default")
-	if err != nil {
-		g.saEmailErr = fmt.Errorf("trustboundary: GCE config: failed to get service account email: %w", err)
-		return
-	}
-	g.saEmail = saEmail
-}
-
-func (g *GCEConfigProvider) fetchUD(ctx context.Context) {
-	if g.universeDomainProvider == nil || g.universeDomainProvider.MetadataClient == nil {
-		g.udErr = errors.New("trustboundary: GCEConfigProvider not properly initialized (missing ComputeUniverseDomainProvider or MetadataClient)")
-		return
-	}
-	ud, err := g.universeDomainProvider.GetProperty(ctx)
-	if err != nil {
-		g.udErr = fmt.Errorf("trustboundary: GCE config: failed to get universe domain: %w", err)
-		return
-	}
-	if ud == "" {
-		ud = internal.DefaultUniverseDomain
-	}
-	g.ud = ud
-}
-
-// GetTrustBoundaryEndpoint constructs the trust boundary lookup URL for a GCE environment.
-// It uses cached metadata (service account email, universe domain) after the first call.
-func (g *GCEConfigProvider) GetTrustBoundaryEndpoint(ctx context.Context) (string, error) {
-	g.saOnce.Do(func() { g.fetchSA(ctx) })
-	if g.saEmailErr != nil {
-		return "", g.saEmailErr
-	}
-	g.udOnce.Do(func() { g.fetchUD(ctx) })
-	if g.udErr != nil {
-		return "", g.udErr
-	}
-	return fmt.Sprintf(serviceAccountAllowedLocationsEndpoint, g.ud, g.saEmail), nil
-}
-
-// GetUniverseDomain retrieves the universe domain from the GCE metadata server.
-// It uses a cached value after the first call.
-func (g *GCEConfigProvider) GetUniverseDomain(ctx context.Context) (string, error) {
-	g.udOnce.Do(func() { g.fetchUD(ctx) })
-	if g.udErr != nil {
-		return "", g.udErr
-	}
-	return g.ud, nil
-}
@@ -17,4 +17,4 @@
 package internal

 // Version is the current tagged release of the library.
-const Version = "0.20.0"
+const Version = "0.24.0"
@@ -1,4 +1,11 @@
-# Changelog
+# Changes
+
+## [0.3.0](https://github.com/googleapis/google-cloud-go/compare/auth/oauth2adapt/v0.2.8...auth/oauth2adapt/v0.3.0) (2026-09-23)
+
+
+### Features
+
+* **all:** Update supported go versions ([#20520](https://github.com/googleapis/google-cloud-go/issues/20520)) ([90413d3](https://github.com/googleapis/google-cloud-go/commit/90413d3e9d381ef4b92e3c496d98b023c5b2d8cc))

 ## [0.2.8](https://github.com/googleapis/google-cloud-go/compare/auth/oauth2adapt/v0.2.7...auth/oauth2adapt/v0.2.8) (2025-03-17)

@@ -67,6 +67,9 @@ type Options3LO struct {
 	// refreshed. If not set the default value is 3 minutes and 45 seconds.
 	// Optional.
 	EarlyTokenExpiry time.Duration
+	// DisableAsyncRefresh configures a synchronous workflow that refreshes
+	// stale tokens while blocking. The default is false. Optional.
+	DisableAsyncRefresh bool

 	// AuthHandlerOpts provides a set of options for doing a
 	// 3-legged OAuth2 flow with a custom [AuthorizationHandler]. Optional.
@@ -192,7 +195,8 @@ func New3LOTokenProvider(opts *Options3LO) (TokenProvider, error) {
 		return new3LOTokenProviderWithAuthHandler(opts), nil
 	}
 	return NewCachedTokenProvider(&tokenProvider3LO{opts: opts, refreshToken: opts.RefreshToken, client: opts.client()}, &CachedTokenProviderOptions{
-		ExpireEarly: opts.EarlyTokenExpiry,
+		ExpireEarly:         opts.EarlyTokenExpiry,
+		DisableAsyncRefresh: opts.DisableAsyncRefresh,
 	}), nil
 }

@@ -211,7 +215,8 @@ type AuthorizationHandlerOptions struct {

 func new3LOTokenProviderWithAuthHandler(opts *Options3LO) TokenProvider {
 	return NewCachedTokenProvider(&tokenProviderWithHandler{opts: opts, state: opts.AuthHandlerOpts.State}, &CachedTokenProviderOptions{
-		ExpireEarly: opts.EarlyTokenExpiry,
+		ExpireEarly:         opts.EarlyTokenExpiry,
+		DisableAsyncRefresh: opts.DisableAsyncRefresh,
 	})
 }

@@ -1,5 +1,12 @@
 # Changes

+## [1.21.1](https://github.com/googleapis/google-cloud-go/compare/logging/v1.21.0...logging/v1.21.1) (2026-10-28)
+
+
+### Bug Fixes
+
+* Adds additional validation for REST RPC requests ([#20753](https://github.com/googleapis/google-cloud-go/issues/20753)) ([7827181](https://github.com/googleapis/google-cloud-go/commit/7827181e7cb653fb69645c538b162b2c7490b0bb))
+
 ## [1.21.0](https://github.com/googleapis/google-cloud-go/compare/logging/v1.20.0...logging/v1.21.0) (2026-10-22)


@@ -2176,6 +2176,11 @@ func (c *configRESTClient) ListBuckets(ctx context.Context, req *loggingpb.ListB
 		if err != nil {
 			return nil, "", err
 		}
+		if err = gax.ValidatePathExpressions(
+			req.GetParent(),
+		); err != nil {
+			return nil, "", err
+		}
 		baseUrl.Path += fmt.Sprintf("/v2/%v/buckets", req.GetParent())

 		params := url.Values{}
@@ -2241,6 +2246,11 @@ func (c *configRESTClient) GetBucket(ctx context.Context, req *loggingpb.GetBuck
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v", req.GetName())

 	params := url.Values{}
@@ -2304,6 +2314,11 @@ func (c *configRESTClient) CreateBucketAsync(ctx context.Context, req *loggingpb
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetParent(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v/buckets:createAsync", req.GetParent())

 	params := url.Values{}
@@ -2378,6 +2393,11 @@ func (c *configRESTClient) UpdateBucketAsync(ctx context.Context, req *loggingpb
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v:updateAsync", req.GetName())

 	params := url.Values{}
@@ -2454,6 +2474,11 @@ func (c *configRESTClient) CreateBucket(ctx context.Context, req *loggingpb.Crea
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetParent(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v/buckets", req.GetParent())

 	params := url.Values{}
@@ -2521,6 +2546,11 @@ func (c *configRESTClient) UpdateBucket(ctx context.Context, req *loggingpb.Upda
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v", req.GetName())

 	params := url.Values{}
@@ -2586,6 +2616,11 @@ func (c *configRESTClient) DeleteBucket(ctx context.Context, req *loggingpb.Dele
 	if err != nil {
 		return err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v", req.GetName())

 	params := url.Values{}
@@ -2632,6 +2667,11 @@ func (c *configRESTClient) UndeleteBucket(ctx context.Context, req *loggingpb.Un
 	if err != nil {
 		return err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v:undelete", req.GetName())

 	params := url.Values{}
@@ -2684,6 +2724,11 @@ func (c *configRESTClient) ListViews(ctx context.Context, req *loggingpb.ListVie
 		if err != nil {
 			return nil, "", err
 		}
+		if err = gax.ValidatePathExpressions(
+			req.GetParent(),
+		); err != nil {
+			return nil, "", err
+		}
 		baseUrl.Path += fmt.Sprintf("/v2/%v/views", req.GetParent())

 		params := url.Values{}
@@ -2749,6 +2794,11 @@ func (c *configRESTClient) GetView(ctx context.Context, req *loggingpb.GetViewRe
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v", req.GetName())

 	params := url.Values{}
@@ -2811,6 +2861,11 @@ func (c *configRESTClient) CreateView(ctx context.Context, req *loggingpb.Create
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetParent(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v/views", req.GetParent())

 	params := url.Values{}
@@ -2877,6 +2932,11 @@ func (c *configRESTClient) UpdateView(ctx context.Context, req *loggingpb.Update
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v", req.GetName())

 	params := url.Values{}
@@ -2941,6 +3001,11 @@ func (c *configRESTClient) DeleteView(ctx context.Context, req *loggingpb.Delete
 	if err != nil {
 		return err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v", req.GetName())

 	params := url.Values{}
@@ -2993,6 +3058,11 @@ func (c *configRESTClient) ListSinks(ctx context.Context, req *loggingpb.ListSin
 		if err != nil {
 			return nil, "", err
 		}
+		if err = gax.ValidatePathExpressions(
+			req.GetParent(),
+		); err != nil {
+			return nil, "", err
+		}
 		baseUrl.Path += fmt.Sprintf("/v2/%v/sinks", req.GetParent())

 		params := url.Values{}
@@ -3058,6 +3128,11 @@ func (c *configRESTClient) GetSink(ctx context.Context, req *loggingpb.GetSinkRe
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetSinkName(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v", req.GetSinkName())

 	params := url.Values{}
@@ -3122,6 +3197,11 @@ func (c *configRESTClient) CreateSink(ctx context.Context, req *loggingpb.Create
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetParent(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v/sinks", req.GetParent())

 	params := url.Values{}
@@ -3190,6 +3270,11 @@ func (c *configRESTClient) UpdateSink(ctx context.Context, req *loggingpb.Update
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetSinkName(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v", req.GetSinkName())

 	params := url.Values{}
@@ -3255,6 +3340,11 @@ func (c *configRESTClient) DeleteSink(ctx context.Context, req *loggingpb.Delete
 	if err != nil {
 		return err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetSinkName(),
+	); err != nil {
+		return err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v", req.GetSinkName())

 	params := url.Values{}
@@ -3303,6 +3393,11 @@ func (c *configRESTClient) CreateLink(ctx context.Context, req *loggingpb.Create
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetParent(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v/links", req.GetParent())

 	params := url.Values{}
@@ -3366,6 +3461,11 @@ func (c *configRESTClient) DeleteLink(ctx context.Context, req *loggingpb.Delete
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v", req.GetName())

 	params := url.Values{}
@@ -3440,6 +3540,11 @@ func (c *configRESTClient) ListLinks(ctx context.Context, req *loggingpb.ListLin
 		if err != nil {
 			return nil, "", err
 		}
+		if err = gax.ValidatePathExpressions(
+			req.GetParent(),
+		); err != nil {
+			return nil, "", err
+		}
 		baseUrl.Path += fmt.Sprintf("/v2/%v/links", req.GetParent())

 		params := url.Values{}
@@ -3505,6 +3610,11 @@ func (c *configRESTClient) GetLink(ctx context.Context, req *loggingpb.GetLinkRe
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v", req.GetName())

 	params := url.Values{}
@@ -3572,6 +3682,11 @@ func (c *configRESTClient) ListExclusions(ctx context.Context, req *loggingpb.Li
 		if err != nil {
 			return nil, "", err
 		}
+		if err = gax.ValidatePathExpressions(
+			req.GetParent(),
+		); err != nil {
+			return nil, "", err
+		}
 		baseUrl.Path += fmt.Sprintf("/v2/%v/exclusions", req.GetParent())

 		params := url.Values{}
@@ -3637,6 +3752,11 @@ func (c *configRESTClient) GetExclusion(ctx context.Context, req *loggingpb.GetE
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v", req.GetName())

 	params := url.Values{}
@@ -3700,6 +3820,11 @@ func (c *configRESTClient) CreateExclusion(ctx context.Context, req *loggingpb.C
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetParent(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v/exclusions", req.GetParent())

 	params := url.Values{}
@@ -3762,6 +3887,11 @@ func (c *configRESTClient) UpdateExclusion(ctx context.Context, req *loggingpb.U
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v", req.GetName())

 	params := url.Values{}
@@ -3823,6 +3953,11 @@ func (c *configRESTClient) DeleteExclusion(ctx context.Context, req *loggingpb.D
 	if err != nil {
 		return err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v", req.GetName())

 	params := url.Values{}
@@ -3871,6 +4006,11 @@ func (c *configRESTClient) GetCmekSettings(ctx context.Context, req *loggingpb.G
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v/cmekSettings", req.GetName())

 	params := url.Values{}
@@ -3946,6 +4086,11 @@ func (c *configRESTClient) UpdateCmekSettings(ctx context.Context, req *loggingp
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v/cmekSettings", req.GetName())

 	params := url.Values{}
@@ -4016,6 +4161,11 @@ func (c *configRESTClient) GetSettings(ctx context.Context, req *loggingpb.GetSe
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v/settings", req.GetName())

 	params := url.Values{}
@@ -4092,6 +4242,11 @@ func (c *configRESTClient) UpdateSettings(ctx context.Context, req *loggingpb.Up
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v/settings", req.GetName())

 	params := url.Values{}
@@ -4223,6 +4378,11 @@ func (c *configRESTClient) CancelOperation(ctx context.Context, req *longrunning
 	if err != nil {
 		return err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v:cancel", req.GetName())

 	params := url.Values{}
@@ -4262,6 +4422,11 @@ func (c *configRESTClient) GetOperation(ctx context.Context, req *longrunningpb.
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v", req.GetName())

 	params := url.Values{}
@@ -4329,6 +4494,11 @@ func (c *configRESTClient) ListOperations(ctx context.Context, req *longrunningp
 		if err != nil {
 			return nil, "", err
 		}
+		if err = gax.ValidatePathExpressions(
+			req.GetName(),
+		); err != nil {
+			return nil, "", err
+		}
 		baseUrl.Path += fmt.Sprintf("/v2/%v/operations", req.GetName())

 		params := url.Values{}
@@ -972,6 +972,11 @@ func (c *restClient) DeleteLog(ctx context.Context, req *loggingpb.DeleteLogRequ
 	if err != nil {
 		return err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetLogName(),
+	); err != nil {
+		return err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v", req.GetLogName())

 	params := url.Values{}
@@ -1247,6 +1252,11 @@ func (c *restClient) ListLogs(ctx context.Context, req *loggingpb.ListLogsReques
 		if err != nil {
 			return nil, "", err
 		}
+		if err = gax.ValidatePathExpressions(
+			req.GetParent(),
+		); err != nil {
+			return nil, "", err
+		}
 		baseUrl.Path += fmt.Sprintf("/v2/%v/logs", req.GetParent())

 		params := url.Values{}
@@ -1331,6 +1341,11 @@ func (c *restClient) CancelOperation(ctx context.Context, req *longrunningpb.Can
 	if err != nil {
 		return err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v:cancel", req.GetName())

 	params := url.Values{}
@@ -1370,6 +1385,11 @@ func (c *restClient) GetOperation(ctx context.Context, req *longrunningpb.GetOpe
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v", req.GetName())

 	params := url.Values{}
@@ -1437,6 +1457,11 @@ func (c *restClient) ListOperations(ctx context.Context, req *longrunningpb.List
 		if err != nil {
 			return nil, "", err
 		}
+		if err = gax.ValidatePathExpressions(
+			req.GetName(),
+		); err != nil {
+			return nil, "", err
+		}
 		baseUrl.Path += fmt.Sprintf("/v2/%v/operations", req.GetName())

 		params := url.Values{}
@@ -837,6 +837,11 @@ func (c *metricsRESTClient) ListLogMetrics(ctx context.Context, req *loggingpb.L
 		if err != nil {
 			return nil, "", err
 		}
+		if err = gax.ValidatePathExpressions(
+			req.GetParent(),
+		); err != nil {
+			return nil, "", err
+		}
 		baseUrl.Path += fmt.Sprintf("/v2/%v/metrics", req.GetParent())

 		params := url.Values{}
@@ -902,6 +907,11 @@ func (c *metricsRESTClient) GetLogMetric(ctx context.Context, req *loggingpb.Get
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetMetricName(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v", req.GetMetricName())

 	params := url.Values{}
@@ -963,6 +973,11 @@ func (c *metricsRESTClient) CreateLogMetric(ctx context.Context, req *loggingpb.
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetParent(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v/metrics", req.GetParent())

 	params := url.Values{}
@@ -1024,6 +1039,11 @@ func (c *metricsRESTClient) UpdateLogMetric(ctx context.Context, req *loggingpb.
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetMetricName(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v", req.GetMetricName())

 	params := url.Values{}
@@ -1078,6 +1098,11 @@ func (c *metricsRESTClient) DeleteLogMetric(ctx context.Context, req *loggingpb.
 	if err != nil {
 		return err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetMetricName(),
+	); err != nil {
+		return err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v", req.GetMetricName())

 	params := url.Values{}
@@ -1123,6 +1148,11 @@ func (c *metricsRESTClient) CancelOperation(ctx context.Context, req *longrunnin
 	if err != nil {
 		return err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v:cancel", req.GetName())

 	params := url.Values{}
@@ -1162,6 +1192,11 @@ func (c *metricsRESTClient) GetOperation(ctx context.Context, req *longrunningpb
 	if err != nil {
 		return nil, err
 	}
+	if err = gax.ValidatePathExpressions(
+		req.GetName(),
+	); err != nil {
+		return nil, err
+	}
 	baseUrl.Path += fmt.Sprintf("/v2/%v", req.GetName())

 	params := url.Values{}
@@ -1229,6 +1264,11 @@ func (c *metricsRESTClient) ListOperations(ctx context.Context, req *longrunning
 		if err != nil {
 			return nil, "", err
 		}
+		if err = gax.ValidatePathExpressions(
+			req.GetName(),
+		); err != nil {
+			return nil, "", err
+		}
 		baseUrl.Path += fmt.Sprintf("/v2/%v/operations", req.GetName())

 		params := url.Values{}
@@ -17,4 +17,4 @@
 package internal

 // Version is the current tagged release of the library.
-const Version = "1.21.0"
+const Version = "1.21.1"
@@ -14,7 +14,7 @@

 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.34.2
+// 	protoc-gen-go v1.36.9
 // 	protoc        v3.21.12
 // source: internal/proto/common/common.proto

@@ -25,6 +25,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )

 const (
@@ -136,11 +137,8 @@ func (TLSVersion) EnumDescriptor() ([]byte, []int) {
 }

 type Identity struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	// Types that are assignable to IdentityOneof:
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to IdentityOneof:
 	//
 	//	*Identity_SpiffeId
 	//	*Identity_Hostname
@@ -149,16 +147,16 @@ type Identity struct {
 	//	*Identity_GcpId
 	IdentityOneof isIdentity_IdentityOneof `protobuf_oneof:"identity_oneof"`
 	// Additional identity-specific attributes.
-	Attributes map[string]string `protobuf:"bytes,3,rep,name=attributes,proto3" json:"attributes,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	Attributes    map[string]string `protobuf:"bytes,3,rep,name=attributes,proto3" json:"attributes,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }

 func (x *Identity) Reset() {
 	*x = Identity{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_proto_common_common_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_internal_proto_common_common_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }

 func (x *Identity) String() string {
@@ -169,7 +167,7 @@ func (*Identity) ProtoMessage() {}

 func (x *Identity) ProtoReflect() protoreflect.Message {
 	mi := &file_internal_proto_common_common_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -184,44 +182,54 @@ func (*Identity) Descriptor() ([]byte, []int) {
 	return file_internal_proto_common_common_proto_rawDescGZIP(), []int{0}
 }

-func (m *Identity) GetIdentityOneof() isIdentity_IdentityOneof {
-	if m != nil {
-		return m.IdentityOneof
+func (x *Identity) GetIdentityOneof() isIdentity_IdentityOneof {
+	if x != nil {
+		return x.IdentityOneof
 	}
 	return nil
 }

 func (x *Identity) GetSpiffeId() string {
-	if x, ok := x.GetIdentityOneof().(*Identity_SpiffeId); ok {
-		return x.SpiffeId
+	if x != nil {
+		if x, ok := x.IdentityOneof.(*Identity_SpiffeId); ok {
+			return x.SpiffeId
+		}
 	}
 	return ""
 }

 func (x *Identity) GetHostname() string {
-	if x, ok := x.GetIdentityOneof().(*Identity_Hostname); ok {
-		return x.Hostname
+	if x != nil {
+		if x, ok := x.IdentityOneof.(*Identity_Hostname); ok {
+			return x.Hostname
+		}
 	}
 	return ""
 }

 func (x *Identity) GetUid() string {
-	if x, ok := x.GetIdentityOneof().(*Identity_Uid); ok {
-		return x.Uid
+	if x != nil {
+		if x, ok := x.IdentityOneof.(*Identity_Uid); ok {
+			return x.Uid
+		}
 	}
 	return ""
 }

 func (x *Identity) GetUsername() string {
-	if x, ok := x.GetIdentityOneof().(*Identity_Username); ok {
-		return x.Username
+	if x != nil {
+		if x, ok := x.IdentityOneof.(*Identity_Username); ok {
+			return x.Username
+		}
 	}
 	return ""
 }

 func (x *Identity) GetGcpId() string {
-	if x, ok := x.GetIdentityOneof().(*Identity_GcpId); ok {
-		return x.GcpId
+	if x != nil {
+		if x, ok := x.IdentityOneof.(*Identity_GcpId); ok {
+			return x.GcpId
+		}
 	}
 	return ""
 }
@@ -274,51 +282,41 @@ func (*Identity_GcpId) isIdentity_IdentityOneof() {}

 var File_internal_proto_common_common_proto protoreflect.FileDescriptor

-var file_internal_proto_common_common_proto_rawDesc = []byte{
-	0x0a, 0x22, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x12, 0x09, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22,
-	0xa8, 0x02, 0x0a, 0x08, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12, 0x1d, 0x0a, 0x09,
-	0x73, 0x70, 0x69, 0x66, 0x66, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x48,
-	0x00, 0x52, 0x08, 0x73, 0x70, 0x69, 0x66, 0x66, 0x65, 0x49, 0x64, 0x12, 0x1c, 0x0a, 0x08, 0x68,
-	0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52,
-	0x08, 0x68, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x03, 0x75, 0x69, 0x64,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x03, 0x75, 0x69, 0x64, 0x12, 0x1c, 0x0a,
-	0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x48,
-	0x00, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x17, 0x0a, 0x06, 0x67,
-	0x63, 0x70, 0x5f, 0x69, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x05, 0x67,
-	0x63, 0x70, 0x49, 0x64, 0x12, 0x43, 0x0a, 0x0a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
-	0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x2e, 0x41, 0x74,
-	0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0a, 0x61,
-	0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x1a, 0x3d, 0x0a, 0x0f, 0x41, 0x74, 0x74,
-	0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03,
-	0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14,
-	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x10, 0x0a, 0x0e, 0x69, 0x64, 0x65, 0x6e,
-	0x74, 0x69, 0x74, 0x79, 0x5f, 0x6f, 0x6e, 0x65, 0x6f, 0x66, 0x2a, 0x5b, 0x0a, 0x0b, 0x43, 0x69,
-	0x70, 0x68, 0x65, 0x72, 0x73, 0x75, 0x69, 0x74, 0x65, 0x12, 0x16, 0x0a, 0x12, 0x41, 0x45, 0x53,
-	0x5f, 0x31, 0x32, 0x38, 0x5f, 0x47, 0x43, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x32, 0x35, 0x36, 0x10,
-	0x00, 0x12, 0x16, 0x0a, 0x12, 0x41, 0x45, 0x53, 0x5f, 0x32, 0x35, 0x36, 0x5f, 0x47, 0x43, 0x4d,
-	0x5f, 0x53, 0x48, 0x41, 0x33, 0x38, 0x34, 0x10, 0x01, 0x12, 0x1c, 0x0a, 0x18, 0x43, 0x48, 0x41,
-	0x43, 0x48, 0x41, 0x32, 0x30, 0x5f, 0x50, 0x4f, 0x4c, 0x59, 0x31, 0x33, 0x30, 0x35, 0x5f, 0x53,
-	0x48, 0x41, 0x32, 0x35, 0x36, 0x10, 0x02, 0x2a, 0x24, 0x0a, 0x0a, 0x54, 0x4c, 0x53, 0x56, 0x65,
-	0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x0a, 0x0a, 0x06, 0x54, 0x4c, 0x53, 0x31, 0x5f, 0x32, 0x10,
-	0x00, 0x12, 0x0a, 0x0a, 0x06, 0x54, 0x4c, 0x53, 0x31, 0x5f, 0x33, 0x10, 0x01, 0x42, 0x36, 0x5a,
-	0x34, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2f, 0x73, 0x32, 0x61, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x5f, 0x67, 0x6f, 0x5f,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+const file_internal_proto_common_common_proto_rawDesc = "" +
+	"\n" +
+	"\"internal/proto/common/common.proto\x12\ts2a.proto\"\xa8\x02\n" +
+	"\bIdentity\x12\x1d\n" +
+	"\tspiffe_id\x18\x01 \x01(\tH\x00R\bspiffeId\x12\x1c\n" +
+	"\bhostname\x18\x02 \x01(\tH\x00R\bhostname\x12\x12\n" +
+	"\x03uid\x18\x04 \x01(\tH\x00R\x03uid\x12\x1c\n" +
+	"\busername\x18\x05 \x01(\tH\x00R\busername\x12\x17\n" +
+	"\x06gcp_id\x18\x06 \x01(\tH\x00R\x05gcpId\x12C\n" +
+	"\n" +
+	"attributes\x18\x03 \x03(\v2#.s2a.proto.Identity.AttributesEntryR\n" +
+	"attributes\x1a=\n" +
+	"\x0fAttributesEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01B\x10\n" +
+	"\x0eidentity_oneof*[\n" +
+	"\vCiphersuite\x12\x16\n" +
+	"\x12AES_128_GCM_SHA256\x10\x00\x12\x16\n" +
+	"\x12AES_256_GCM_SHA384\x10\x01\x12\x1c\n" +
+	"\x18CHACHA20_POLY1305_SHA256\x10\x02*$\n" +
+	"\n" +
+	"TLSVersion\x12\n" +
+	"\n" +
+	"\x06TLS1_2\x10\x00\x12\n" +
+	"\n" +
+	"\x06TLS1_3\x10\x01B6Z4github.com/google/s2a/internal/proto/common_go_protob\x06proto3"

 var (
 	file_internal_proto_common_common_proto_rawDescOnce sync.Once
-	file_internal_proto_common_common_proto_rawDescData = file_internal_proto_common_common_proto_rawDesc
+	file_internal_proto_common_common_proto_rawDescData []byte
 )

 func file_internal_proto_common_common_proto_rawDescGZIP() []byte {
 	file_internal_proto_common_common_proto_rawDescOnce.Do(func() {
-		file_internal_proto_common_common_proto_rawDescData = protoimpl.X.CompressGZIP(file_internal_proto_common_common_proto_rawDescData)
+		file_internal_proto_common_common_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_internal_proto_common_common_proto_rawDesc), len(file_internal_proto_common_common_proto_rawDesc)))
 	})
 	return file_internal_proto_common_common_proto_rawDescData
 }
@@ -345,20 +343,6 @@ func file_internal_proto_common_common_proto_init() {
 	if File_internal_proto_common_common_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_internal_proto_common_common_proto_msgTypes[0].Exporter = func(v any, i int) any {
-			switch v := v.(*Identity); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	file_internal_proto_common_common_proto_msgTypes[0].OneofWrappers = []any{
 		(*Identity_SpiffeId)(nil),
 		(*Identity_Hostname)(nil),
@@ -370,7 +354,7 @@ func file_internal_proto_common_common_proto_init() {
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_internal_proto_common_common_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_internal_proto_common_common_proto_rawDesc), len(file_internal_proto_common_common_proto_rawDesc)),
 			NumEnums:      2,
 			NumMessages:   2,
 			NumExtensions: 0,
@@ -382,7 +366,6 @@ func file_internal_proto_common_common_proto_init() {
 		MessageInfos:      file_internal_proto_common_common_proto_msgTypes,
 	}.Build()
 	File_internal_proto_common_common_proto = out.File
-	file_internal_proto_common_common_proto_rawDesc = nil
 	file_internal_proto_common_common_proto_goTypes = nil
 	file_internal_proto_common_common_proto_depIdxs = nil
 }
@@ -14,7 +14,7 @@

 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.34.2
+// 	protoc-gen-go v1.36.9
 // 	protoc        v3.21.12
 // source: internal/proto/s2a_context/s2a_context.proto

@@ -26,6 +26,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )

 const (
@@ -36,10 +37,7 @@ const (
 )

 type S2AContext struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The application protocol negotiated for this connection, e.g., 'grpc'.
 	ApplicationProtocol string `protobuf:"bytes,1,opt,name=application_protocol,json=applicationProtocol,proto3" json:"application_protocol,omitempty"`
 	// The TLS version number that the S2A's handshaker module used to set up the
@@ -62,15 +60,15 @@ type S2AContext struct {
 	LocalCertFingerprint []byte `protobuf:"bytes,7,opt,name=local_cert_fingerprint,json=localCertFingerprint,proto3" json:"local_cert_fingerprint,omitempty"`
 	// Set to true if a cached session was reused to resume the handshake.
 	IsHandshakeResumed bool `protobuf:"varint,8,opt,name=is_handshake_resumed,json=isHandshakeResumed,proto3" json:"is_handshake_resumed,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
 }

 func (x *S2AContext) Reset() {
 	*x = S2AContext{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_proto_s2a_context_s2a_context_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_internal_proto_s2a_context_s2a_context_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }

 func (x *S2AContext) String() string {
@@ -81,7 +79,7 @@ func (*S2AContext) ProtoMessage() {}

 func (x *S2AContext) ProtoReflect() protoreflect.Message {
 	mi := &file_internal_proto_s2a_context_s2a_context_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -154,56 +152,29 @@ func (x *S2AContext) GetIsHandshakeResumed() bool {

 var File_internal_proto_s2a_context_s2a_context_proto protoreflect.FileDescriptor

-var file_internal_proto_s2a_context_s2a_context_proto_rawDesc = []byte{
-	0x0a, 0x2c, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x2f, 0x73, 0x32, 0x61, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x2f, 0x73, 0x32, 0x61,
-	0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x09,
-	0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x22, 0x69, 0x6e, 0x74, 0x65, 0x72,
-	0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
-	0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xc3, 0x03,
-	0x0a, 0x0a, 0x53, 0x32, 0x41, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x12, 0x31, 0x0a, 0x14,
-	0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x61, 0x70, 0x70, 0x6c,
-	0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12,
-	0x36, 0x0a, 0x0b, 0x74, 0x6c, 0x73, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0e, 0x32, 0x15, 0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x2e, 0x54, 0x4c, 0x53, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x74, 0x6c, 0x73,
-	0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x38, 0x0a, 0x0b, 0x63, 0x69, 0x70, 0x68, 0x65,
-	0x72, 0x73, 0x75, 0x69, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x16, 0x2e, 0x73,
-	0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x43, 0x69, 0x70, 0x68, 0x65, 0x72, 0x73,
-	0x75, 0x69, 0x74, 0x65, 0x52, 0x0b, 0x63, 0x69, 0x70, 0x68, 0x65, 0x72, 0x73, 0x75, 0x69, 0x74,
-	0x65, 0x12, 0x38, 0x0a, 0x0d, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x74, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x52, 0x0c, 0x70,
-	0x65, 0x65, 0x72, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12, 0x3a, 0x0a, 0x0e, 0x6c,
-	0x6f, 0x63, 0x61, 0x6c, 0x5f, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x18, 0x05, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e,
-	0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x52, 0x0d, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x49,
-	0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12, 0x32, 0x0a, 0x15, 0x70, 0x65, 0x65, 0x72, 0x5f,
-	0x63, 0x65, 0x72, 0x74, 0x5f, 0x66, 0x69, 0x6e, 0x67, 0x65, 0x72, 0x70, 0x72, 0x69, 0x6e, 0x74,
-	0x18, 0x06, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x13, 0x70, 0x65, 0x65, 0x72, 0x43, 0x65, 0x72, 0x74,
-	0x46, 0x69, 0x6e, 0x67, 0x65, 0x72, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x12, 0x34, 0x0a, 0x16, 0x6c,
-	0x6f, 0x63, 0x61, 0x6c, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x5f, 0x66, 0x69, 0x6e, 0x67, 0x65, 0x72,
-	0x70, 0x72, 0x69, 0x6e, 0x74, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x14, 0x6c, 0x6f, 0x63,
-	0x61, 0x6c, 0x43, 0x65, 0x72, 0x74, 0x46, 0x69, 0x6e, 0x67, 0x65, 0x72, 0x70, 0x72, 0x69, 0x6e,
-	0x74, 0x12, 0x30, 0x0a, 0x14, 0x69, 0x73, 0x5f, 0x68, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b,
-	0x65, 0x5f, 0x72, 0x65, 0x73, 0x75, 0x6d, 0x65, 0x64, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x12, 0x69, 0x73, 0x48, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b, 0x65, 0x52, 0x65, 0x73, 0x75,
-	0x6d, 0x65, 0x64, 0x42, 0x3b, 0x5a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
-	0x6d, 0x2f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x73, 0x32, 0x61, 0x2f, 0x69, 0x6e, 0x74,
-	0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x73, 0x32, 0x61, 0x5f,
-	0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x5f, 0x67, 0x6f, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+const file_internal_proto_s2a_context_s2a_context_proto_rawDesc = "" +
+	"\n" +
+	",internal/proto/s2a_context/s2a_context.proto\x12\ts2a.proto\x1a\"internal/proto/common/common.proto\"\xc3\x03\n" +
+	"\n" +
+	"S2AContext\x121\n" +
+	"\x14application_protocol\x18\x01 \x01(\tR\x13applicationProtocol\x126\n" +
+	"\vtls_version\x18\x02 \x01(\x0e2\x15.s2a.proto.TLSVersionR\n" +
+	"tlsVersion\x128\n" +
+	"\vciphersuite\x18\x03 \x01(\x0e2\x16.s2a.proto.CiphersuiteR\vciphersuite\x128\n" +
+	"\rpeer_identity\x18\x04 \x01(\v2\x13.s2a.proto.IdentityR\fpeerIdentity\x12:\n" +
+	"\x0elocal_identity\x18\x05 \x01(\v2\x13.s2a.proto.IdentityR\rlocalIdentity\x122\n" +
+	"\x15peer_cert_fingerprint\x18\x06 \x01(\fR\x13peerCertFingerprint\x124\n" +
+	"\x16local_cert_fingerprint\x18\a \x01(\fR\x14localCertFingerprint\x120\n" +
+	"\x14is_handshake_resumed\x18\b \x01(\bR\x12isHandshakeResumedB;Z9github.com/google/s2a/internal/proto/s2a_context_go_protob\x06proto3"

 var (
 	file_internal_proto_s2a_context_s2a_context_proto_rawDescOnce sync.Once
-	file_internal_proto_s2a_context_s2a_context_proto_rawDescData = file_internal_proto_s2a_context_s2a_context_proto_rawDesc
+	file_internal_proto_s2a_context_s2a_context_proto_rawDescData []byte
 )

 func file_internal_proto_s2a_context_s2a_context_proto_rawDescGZIP() []byte {
 	file_internal_proto_s2a_context_s2a_context_proto_rawDescOnce.Do(func() {
-		file_internal_proto_s2a_context_s2a_context_proto_rawDescData = protoimpl.X.CompressGZIP(file_internal_proto_s2a_context_s2a_context_proto_rawDescData)
+		file_internal_proto_s2a_context_s2a_context_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_internal_proto_s2a_context_s2a_context_proto_rawDesc), len(file_internal_proto_s2a_context_s2a_context_proto_rawDesc)))
 	})
 	return file_internal_proto_s2a_context_s2a_context_proto_rawDescData
 }
@@ -232,25 +203,11 @@ func file_internal_proto_s2a_context_s2a_context_proto_init() {
 	if File_internal_proto_s2a_context_s2a_context_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_internal_proto_s2a_context_s2a_context_proto_msgTypes[0].Exporter = func(v any, i int) any {
-			switch v := v.(*S2AContext); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_internal_proto_s2a_context_s2a_context_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_internal_proto_s2a_context_s2a_context_proto_rawDesc), len(file_internal_proto_s2a_context_s2a_context_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   1,
 			NumExtensions: 0,
@@ -261,7 +218,6 @@ func file_internal_proto_s2a_context_s2a_context_proto_init() {
 		MessageInfos:      file_internal_proto_s2a_context_s2a_context_proto_msgTypes,
 	}.Build()
 	File_internal_proto_s2a_context_s2a_context_proto = out.File
-	file_internal_proto_s2a_context_s2a_context_proto_rawDesc = nil
 	file_internal_proto_s2a_context_s2a_context_proto_goTypes = nil
 	file_internal_proto_s2a_context_s2a_context_proto_depIdxs = nil
 }
@@ -14,7 +14,7 @@

 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.34.2
+// 	protoc-gen-go v1.36.9
 // 	protoc        v3.21.12
 // source: internal/proto/s2a/s2a.proto

@@ -26,6 +26,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )

 const (
@@ -36,28 +37,25 @@ const (
 )

 type AuthenticationMechanism struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// (Optional) Application may specify an identity associated to an
 	// authentication mechanism. Otherwise, S2A assumes that the authentication
 	// mechanism is associated with the default identity. If the default identity
 	// cannot be determined, session setup fails.
 	Identity *common_go_proto.Identity `protobuf:"bytes,1,opt,name=identity,proto3" json:"identity,omitempty"`
-	// Types that are assignable to MechanismOneof:
+	// Types that are valid to be assigned to MechanismOneof:
 	//
 	//	*AuthenticationMechanism_Token
 	MechanismOneof isAuthenticationMechanism_MechanismOneof `protobuf_oneof:"mechanism_oneof"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
 }

 func (x *AuthenticationMechanism) Reset() {
 	*x = AuthenticationMechanism{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_proto_s2a_s2a_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_internal_proto_s2a_s2a_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }

 func (x *AuthenticationMechanism) String() string {
@@ -68,7 +66,7 @@ func (*AuthenticationMechanism) ProtoMessage() {}

 func (x *AuthenticationMechanism) ProtoReflect() protoreflect.Message {
 	mi := &file_internal_proto_s2a_s2a_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -90,16 +88,18 @@ func (x *AuthenticationMechanism) GetIdentity() *common_go_proto.Identity {
 	return nil
 }

-func (m *AuthenticationMechanism) GetMechanismOneof() isAuthenticationMechanism_MechanismOneof {
-	if m != nil {
-		return m.MechanismOneof
+func (x *AuthenticationMechanism) GetMechanismOneof() isAuthenticationMechanism_MechanismOneof {
+	if x != nil {
+		return x.MechanismOneof
 	}
 	return nil
 }

 func (x *AuthenticationMechanism) GetToken() string {
-	if x, ok := x.GetMechanismOneof().(*AuthenticationMechanism_Token); ok {
-		return x.Token
+	if x != nil {
+		if x, ok := x.MechanismOneof.(*AuthenticationMechanism_Token); ok {
+			return x.Token
+		}
 	}
 	return ""
 }
@@ -116,10 +116,7 @@ type AuthenticationMechanism_Token struct {
 func (*AuthenticationMechanism_Token) isAuthenticationMechanism_MechanismOneof() {}

 type ClientSessionStartReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The application protocols supported by the client, e.g., "grpc".
 	ApplicationProtocols []string `protobuf:"bytes,1,rep,name=application_protocols,json=applicationProtocols,proto3" json:"application_protocols,omitempty"`
 	// (Optional) The minimum TLS version number that the S2A's handshaker module
@@ -148,16 +145,16 @@ type ClientSessionStartReq struct {
 	// MUST not contain the scheme or the port number. For example, if the server
 	// address is dns://www.example.com:443, the value of this field should be
 	// set to www.example.com.
-	TargetName string `protobuf:"bytes,7,opt,name=target_name,json=targetName,proto3" json:"target_name,omitempty"`
+	TargetName    string `protobuf:"bytes,7,opt,name=target_name,json=targetName,proto3" json:"target_name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }

 func (x *ClientSessionStartReq) Reset() {
 	*x = ClientSessionStartReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_proto_s2a_s2a_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_internal_proto_s2a_s2a_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }

 func (x *ClientSessionStartReq) String() string {
@@ -168,7 +165,7 @@ func (*ClientSessionStartReq) ProtoMessage() {}

 func (x *ClientSessionStartReq) ProtoReflect() protoreflect.Message {
 	mi := &file_internal_proto_s2a_s2a_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -233,10 +230,7 @@ func (x *ClientSessionStartReq) GetTargetName() string {
 }

 type ServerSessionStartReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The application protocols supported by the server, e.g., "grpc".
 	ApplicationProtocols []string `protobuf:"bytes,1,rep,name=application_protocols,json=applicationProtocols,proto3" json:"application_protocols,omitempty"`
 	// (Optional) The minimum TLS version number that the S2A's handshaker module
@@ -260,16 +254,16 @@ type ServerSessionStartReq struct {
 	// Specifically, if the client peer is using S2A, this field contains the
 	// bytes in the out_frames field of SessionResp message that the client peer
 	// received from its S2A after initiating the handshake.
-	InBytes []byte `protobuf:"bytes,6,opt,name=in_bytes,json=inBytes,proto3" json:"in_bytes,omitempty"`
+	InBytes       []byte `protobuf:"bytes,6,opt,name=in_bytes,json=inBytes,proto3" json:"in_bytes,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }

 func (x *ServerSessionStartReq) Reset() {
 	*x = ServerSessionStartReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_proto_s2a_s2a_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_internal_proto_s2a_s2a_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }

 func (x *ServerSessionStartReq) String() string {
@@ -280,7 +274,7 @@ func (*ServerSessionStartReq) ProtoMessage() {}

 func (x *ServerSessionStartReq) ProtoReflect() protoreflect.Message {
 	mi := &file_internal_proto_s2a_s2a_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -338,10 +332,7 @@ func (x *ServerSessionStartReq) GetInBytes() []byte {
 }

 type SessionNextReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The byte representation of session setup, i.e., handshake messages.
 	// Specifically:
 	//   - All handshake messages sent from the server to the client.
@@ -351,16 +342,16 @@ type SessionNextReq struct {
 	//
 	// If the peer is using S2A, this field contains the bytes in the out_frames
 	// field of SessionResp message that the peer received from its S2A.
-	InBytes []byte `protobuf:"bytes,1,opt,name=in_bytes,json=inBytes,proto3" json:"in_bytes,omitempty"`
+	InBytes       []byte `protobuf:"bytes,1,opt,name=in_bytes,json=inBytes,proto3" json:"in_bytes,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }

 func (x *SessionNextReq) Reset() {
 	*x = SessionNextReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_proto_s2a_s2a_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_internal_proto_s2a_s2a_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }

 func (x *SessionNextReq) String() string {
@@ -371,7 +362,7 @@ func (*SessionNextReq) ProtoMessage() {}

 func (x *SessionNextReq) ProtoReflect() protoreflect.Message {
 	mi := &file_internal_proto_s2a_s2a_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -394,10 +385,7 @@ func (x *SessionNextReq) GetInBytes() []byte {
 }

 type ResumptionTicketReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The byte representation of a NewSessionTicket message received from the
 	// server.
 	InBytes [][]byte `protobuf:"bytes,1,rep,name=in_bytes,json=inBytes,proto3" json:"in_bytes,omitempty"`
@@ -407,15 +395,15 @@ type ResumptionTicketReq struct {
 	// The local identity that was used by S2A during session setup and included
 	// in |SessionResult|.
 	LocalIdentity *common_go_proto.Identity `protobuf:"bytes,3,opt,name=local_identity,json=localIdentity,proto3" json:"local_identity,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }

 func (x *ResumptionTicketReq) Reset() {
 	*x = ResumptionTicketReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_proto_s2a_s2a_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_internal_proto_s2a_s2a_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }

 func (x *ResumptionTicketReq) String() string {
@@ -426,7 +414,7 @@ func (*ResumptionTicketReq) ProtoMessage() {}

 func (x *ResumptionTicketReq) ProtoReflect() protoreflect.Message {
 	mi := &file_internal_proto_s2a_s2a_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -463,11 +451,8 @@ func (x *ResumptionTicketReq) GetLocalIdentity() *common_go_proto.Identity {
 }

 type SessionReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	// Types that are assignable to ReqOneof:
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to ReqOneof:
 	//
 	//	*SessionReq_ClientStart
 	//	*SessionReq_ServerStart
@@ -479,15 +464,15 @@ type SessionReq struct {
 	// first authentication mechanism that appears in the list and is supported by
 	// the S2A.
 	AuthMechanisms []*AuthenticationMechanism `protobuf:"bytes,5,rep,name=auth_mechanisms,json=authMechanisms,proto3" json:"auth_mechanisms,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
 }

 func (x *SessionReq) Reset() {
 	*x = SessionReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_proto_s2a_s2a_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_internal_proto_s2a_s2a_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }

 func (x *SessionReq) String() string {
@@ -498,7 +483,7 @@ func (*SessionReq) ProtoMessage() {}

 func (x *SessionReq) ProtoReflect() protoreflect.Message {
 	mi := &file_internal_proto_s2a_s2a_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -513,37 +498,45 @@ func (*SessionReq) Descriptor() ([]byte, []int) {
 	return file_internal_proto_s2a_s2a_proto_rawDescGZIP(), []int{5}
 }

-func (m *SessionReq) GetReqOneof() isSessionReq_ReqOneof {
-	if m != nil {
-		return m.ReqOneof
+func (x *SessionReq) GetReqOneof() isSessionReq_ReqOneof {
+	if x != nil {
+		return x.ReqOneof
 	}
 	return nil
 }

 func (x *SessionReq) GetClientStart() *ClientSessionStartReq {
-	if x, ok := x.GetReqOneof().(*SessionReq_ClientStart); ok {
-		return x.ClientStart
+	if x != nil {
+		if x, ok := x.ReqOneof.(*SessionReq_ClientStart); ok {
+			return x.ClientStart
+		}
 	}
 	return nil
 }

 func (x *SessionReq) GetServerStart() *ServerSessionStartReq {
-	if x, ok := x.GetReqOneof().(*SessionReq_ServerStart); ok {
-		return x.ServerStart
+	if x != nil {
+		if x, ok := x.ReqOneof.(*SessionReq_ServerStart); ok {
+			return x.ServerStart
+		}
 	}
 	return nil
 }

 func (x *SessionReq) GetNext() *SessionNextReq {
-	if x, ok := x.GetReqOneof().(*SessionReq_Next); ok {
-		return x.Next
+	if x != nil {
+		if x, ok := x.ReqOneof.(*SessionReq_Next); ok {
+			return x.Next
+		}
 	}
 	return nil
 }

 func (x *SessionReq) GetResumptionTicket() *ResumptionTicketReq {
-	if x, ok := x.GetReqOneof().(*SessionReq_ResumptionTicket); ok {
-		return x.ResumptionTicket
+	if x != nil {
+		if x, ok := x.ReqOneof.(*SessionReq_ResumptionTicket); ok {
+			return x.ResumptionTicket
+		}
 	}
 	return nil
 }
@@ -591,10 +584,7 @@ func (*SessionReq_Next) isSessionReq_ReqOneof() {}
 func (*SessionReq_ResumptionTicket) isSessionReq_ReqOneof() {}

 type SessionState struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The TLS version number that the S2A's handshaker module used to set up the
 	// session.
 	TlsVersion common_go_proto.TLSVersion `protobuf:"varint,1,opt,name=tls_version,json=tlsVersion,proto3,enum=s2a.proto.TLSVersion" json:"tls_version,omitempty"`
@@ -619,15 +609,15 @@ type SessionState struct {
 	ConnectionId uint64 `protobuf:"varint,9,opt,name=connection_id,json=connectionId,proto3" json:"connection_id,omitempty"`
 	// Set to true if a cached session was reused to do an abbreviated handshake.
 	IsHandshakeResumed bool `protobuf:"varint,10,opt,name=is_handshake_resumed,json=isHandshakeResumed,proto3" json:"is_handshake_resumed,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
 }

 func (x *SessionState) Reset() {
 	*x = SessionState{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_proto_s2a_s2a_proto_msgTypes[6]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_internal_proto_s2a_s2a_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }

 func (x *SessionState) String() string {
@@ -638,7 +628,7 @@ func (*SessionState) ProtoMessage() {}

 func (x *SessionState) ProtoReflect() protoreflect.Message {
 	mi := &file_internal_proto_s2a_s2a_proto_msgTypes[6]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -724,10 +714,7 @@ func (x *SessionState) GetIsHandshakeResumed() bool {
 }

 type SessionResult struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The application protocol negotiated for this session.
 	ApplicationProtocol string `protobuf:"bytes,1,opt,name=application_protocol,json=applicationProtocol,proto3" json:"application_protocol,omitempty"`
 	// The session state at the end. This state contains all cryptographic
@@ -746,15 +733,15 @@ type SessionResult struct {
 	LocalCertFingerprint []byte `protobuf:"bytes,6,opt,name=local_cert_fingerprint,json=localCertFingerprint,proto3" json:"local_cert_fingerprint,omitempty"`
 	// The SHA256 hash of the peer certificate used in the handshake.
 	PeerCertFingerprint []byte `protobuf:"bytes,7,opt,name=peer_cert_fingerprint,json=peerCertFingerprint,proto3" json:"peer_cert_fingerprint,omitempty"`
+	unknownFields       protoimpl.UnknownFields
+	sizeCache           protoimpl.SizeCache
 }

 func (x *SessionResult) Reset() {
 	*x = SessionResult{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_proto_s2a_s2a_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_internal_proto_s2a_s2a_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }

 func (x *SessionResult) String() string {
@@ -765,7 +752,7 @@ func (*SessionResult) ProtoMessage() {}

 func (x *SessionResult) ProtoReflect() protoreflect.Message {
 	mi := &file_internal_proto_s2a_s2a_proto_msgTypes[7]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -823,24 +810,21 @@ func (x *SessionResult) GetPeerCertFingerprint() []byte {
 }

 type SessionStatus struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The status code that is specific to the application and the implementation
 	// of S2A, e.g., gRPC status code.
 	Code uint32 `protobuf:"varint,1,opt,name=code,proto3" json:"code,omitempty"`
 	// The status details.
-	Details string `protobuf:"bytes,2,opt,name=details,proto3" json:"details,omitempty"`
+	Details       string `protobuf:"bytes,2,opt,name=details,proto3" json:"details,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }

 func (x *SessionStatus) Reset() {
 	*x = SessionStatus{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_proto_s2a_s2a_proto_msgTypes[8]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_internal_proto_s2a_s2a_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }

 func (x *SessionStatus) String() string {
@@ -851,7 +835,7 @@ func (*SessionStatus) ProtoMessage() {}

 func (x *SessionStatus) ProtoReflect() protoreflect.Message {
 	mi := &file_internal_proto_s2a_s2a_proto_msgTypes[8]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -881,10 +865,7 @@ func (x *SessionStatus) GetDetails() string {
 }

 type SessionResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The local identity used during session setup. This could be:
 	//   - The local identity that the client specifies in ClientSessionStartReq.
 	//   - One of the local identities that the server specifies in
@@ -909,16 +890,16 @@ type SessionResp struct {
 	// still be set to frames that needs to be forwarded to the peer.
 	Result *SessionResult `protobuf:"bytes,4,opt,name=result,proto3" json:"result,omitempty"`
 	// Status of session setup at the current stage.
-	Status *SessionStatus `protobuf:"bytes,5,opt,name=status,proto3" json:"status,omitempty"`
+	Status        *SessionStatus `protobuf:"bytes,5,opt,name=status,proto3" json:"status,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }

 func (x *SessionResp) Reset() {
 	*x = SessionResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_proto_s2a_s2a_proto_msgTypes[9]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_internal_proto_s2a_s2a_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }

 func (x *SessionResp) String() string {
@@ -929,7 +910,7 @@ func (*SessionResp) ProtoMessage() {}

 func (x *SessionResp) ProtoReflect() protoreflect.Message {
 	mi := &file_internal_proto_s2a_s2a_proto_msgTypes[9]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -981,191 +962,86 @@ func (x *SessionResp) GetStatus() *SessionStatus {

 var File_internal_proto_s2a_s2a_proto protoreflect.FileDescriptor

-var file_internal_proto_s2a_s2a_proto_rawDesc = []byte{
-	0x0a, 0x1c, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x2f, 0x73, 0x32, 0x61, 0x2f, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x09,
-	0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x22, 0x69, 0x6e, 0x74, 0x65, 0x72,
-	0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
-	0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x75, 0x0a,
-	0x17, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4d,
-	0x65, 0x63, 0x68, 0x61, 0x6e, 0x69, 0x73, 0x6d, 0x12, 0x2f, 0x0a, 0x08, 0x69, 0x64, 0x65, 0x6e,
-	0x74, 0x69, 0x74, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x73, 0x32, 0x61,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x52,
-	0x08, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12, 0x16, 0x0a, 0x05, 0x74, 0x6f, 0x6b,
-	0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65,
-	0x6e, 0x42, 0x11, 0x0a, 0x0f, 0x6d, 0x65, 0x63, 0x68, 0x61, 0x6e, 0x69, 0x73, 0x6d, 0x5f, 0x6f,
-	0x6e, 0x65, 0x6f, 0x66, 0x22, 0xac, 0x03, 0x0a, 0x15, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x53,
-	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x52, 0x65, 0x71, 0x12, 0x33,
-	0x0a, 0x15, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x14, 0x61,
-	0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63,
-	0x6f, 0x6c, 0x73, 0x12, 0x3d, 0x0a, 0x0f, 0x6d, 0x69, 0x6e, 0x5f, 0x74, 0x6c, 0x73, 0x5f, 0x76,
-	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x15, 0x2e, 0x73,
-	0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x54, 0x4c, 0x53, 0x56, 0x65, 0x72, 0x73,
-	0x69, 0x6f, 0x6e, 0x52, 0x0d, 0x6d, 0x69, 0x6e, 0x54, 0x6c, 0x73, 0x56, 0x65, 0x72, 0x73, 0x69,
-	0x6f, 0x6e, 0x12, 0x3d, 0x0a, 0x0f, 0x6d, 0x61, 0x78, 0x5f, 0x74, 0x6c, 0x73, 0x5f, 0x76, 0x65,
-	0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x15, 0x2e, 0x73, 0x32,
-	0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x54, 0x4c, 0x53, 0x56, 0x65, 0x72, 0x73, 0x69,
-	0x6f, 0x6e, 0x52, 0x0d, 0x6d, 0x61, 0x78, 0x54, 0x6c, 0x73, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f,
-	0x6e, 0x12, 0x41, 0x0a, 0x10, 0x74, 0x6c, 0x73, 0x5f, 0x63, 0x69, 0x70, 0x68, 0x65, 0x72, 0x73,
-	0x75, 0x69, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0e, 0x32, 0x16, 0x2e, 0x73, 0x32,
-	0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x43, 0x69, 0x70, 0x68, 0x65, 0x72, 0x73, 0x75,
-	0x69, 0x74, 0x65, 0x52, 0x0f, 0x74, 0x6c, 0x73, 0x43, 0x69, 0x70, 0x68, 0x65, 0x72, 0x73, 0x75,
-	0x69, 0x74, 0x65, 0x73, 0x12, 0x40, 0x0a, 0x11, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69,
-	0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x13, 0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x49, 0x64, 0x65, 0x6e,
-	0x74, 0x69, 0x74, 0x79, 0x52, 0x10, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x49, 0x64, 0x65, 0x6e,
-	0x74, 0x69, 0x74, 0x69, 0x65, 0x73, 0x12, 0x3a, 0x0a, 0x0e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x5f,
-	0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13,
-	0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x49, 0x64, 0x65, 0x6e, 0x74,
-	0x69, 0x74, 0x79, 0x52, 0x0d, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x74, 0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x6e, 0x61, 0x6d,
-	0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x4e,
-	0x61, 0x6d, 0x65, 0x22, 0xe8, 0x02, 0x0a, 0x15, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x53, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x52, 0x65, 0x71, 0x12, 0x33, 0x0a,
-	0x15, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x14, 0x61, 0x70,
-	0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f,
-	0x6c, 0x73, 0x12, 0x3d, 0x0a, 0x0f, 0x6d, 0x69, 0x6e, 0x5f, 0x74, 0x6c, 0x73, 0x5f, 0x76, 0x65,
-	0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x15, 0x2e, 0x73, 0x32,
-	0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x54, 0x4c, 0x53, 0x56, 0x65, 0x72, 0x73, 0x69,
-	0x6f, 0x6e, 0x52, 0x0d, 0x6d, 0x69, 0x6e, 0x54, 0x6c, 0x73, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f,
-	0x6e, 0x12, 0x3d, 0x0a, 0x0f, 0x6d, 0x61, 0x78, 0x5f, 0x74, 0x6c, 0x73, 0x5f, 0x76, 0x65, 0x72,
-	0x73, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x15, 0x2e, 0x73, 0x32, 0x61,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x54, 0x4c, 0x53, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f,
-	0x6e, 0x52, 0x0d, 0x6d, 0x61, 0x78, 0x54, 0x6c, 0x73, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
-	0x12, 0x41, 0x0a, 0x10, 0x74, 0x6c, 0x73, 0x5f, 0x63, 0x69, 0x70, 0x68, 0x65, 0x72, 0x73, 0x75,
-	0x69, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0e, 0x32, 0x16, 0x2e, 0x73, 0x32, 0x61,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x43, 0x69, 0x70, 0x68, 0x65, 0x72, 0x73, 0x75, 0x69,
-	0x74, 0x65, 0x52, 0x0f, 0x74, 0x6c, 0x73, 0x43, 0x69, 0x70, 0x68, 0x65, 0x72, 0x73, 0x75, 0x69,
-	0x74, 0x65, 0x73, 0x12, 0x3e, 0x0a, 0x10, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x5f, 0x69, 0x64, 0x65,
-	0x6e, 0x74, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x13, 0x2e,
-	0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x74, 0x79, 0x52, 0x0f, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74,
-	0x69, 0x65, 0x73, 0x12, 0x19, 0x0a, 0x08, 0x69, 0x6e, 0x5f, 0x62, 0x79, 0x74, 0x65, 0x73, 0x18,
-	0x06, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x69, 0x6e, 0x42, 0x79, 0x74, 0x65, 0x73, 0x22, 0x2b,
-	0x0a, 0x0e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4e, 0x65, 0x78, 0x74, 0x52, 0x65, 0x71,
-	0x12, 0x19, 0x0a, 0x08, 0x69, 0x6e, 0x5f, 0x62, 0x79, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0c, 0x52, 0x07, 0x69, 0x6e, 0x42, 0x79, 0x74, 0x65, 0x73, 0x22, 0x91, 0x01, 0x0a, 0x13,
-	0x52, 0x65, 0x73, 0x75, 0x6d, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x69, 0x63, 0x6b, 0x65, 0x74,
-	0x52, 0x65, 0x71, 0x12, 0x19, 0x0a, 0x08, 0x69, 0x6e, 0x5f, 0x62, 0x79, 0x74, 0x65, 0x73, 0x18,
-	0x01, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x07, 0x69, 0x6e, 0x42, 0x79, 0x74, 0x65, 0x73, 0x12, 0x23,
-	0x0a, 0x0d, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0c, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x49, 0x64, 0x12, 0x3a, 0x0a, 0x0e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x5f, 0x69, 0x64, 0x65,
-	0x6e, 0x74, 0x69, 0x74, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x73, 0x32,
-	0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79,
-	0x52, 0x0d, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x22,
-	0xf4, 0x02, 0x0a, 0x0a, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x12, 0x45,
-	0x0a, 0x0c, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x2e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x74,
-	0x61, 0x72, 0x74, 0x52, 0x65, 0x71, 0x48, 0x00, 0x52, 0x0b, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x45, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f,
-	0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x73, 0x32,
-	0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x53, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x52, 0x65, 0x71, 0x48, 0x00, 0x52,
-	0x0b, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x2f, 0x0a, 0x04,
-	0x6e, 0x65, 0x78, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x73, 0x32, 0x61,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4e, 0x65,
-	0x78, 0x74, 0x52, 0x65, 0x71, 0x48, 0x00, 0x52, 0x04, 0x6e, 0x65, 0x78, 0x74, 0x12, 0x4d, 0x0a,
-	0x11, 0x72, 0x65, 0x73, 0x75, 0x6d, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x69, 0x63, 0x6b,
-	0x65, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x73, 0x75, 0x6d, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x54,
-	0x69, 0x63, 0x6b, 0x65, 0x74, 0x52, 0x65, 0x71, 0x48, 0x00, 0x52, 0x10, 0x72, 0x65, 0x73, 0x75,
-	0x6d, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x69, 0x63, 0x6b, 0x65, 0x74, 0x12, 0x4b, 0x0a, 0x0f,
-	0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x63, 0x68, 0x61, 0x6e, 0x69, 0x73, 0x6d, 0x73, 0x18,
-	0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x4d, 0x65, 0x63, 0x68, 0x61, 0x6e, 0x69, 0x73, 0x6d, 0x52, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x4d,
-	0x65, 0x63, 0x68, 0x61, 0x6e, 0x69, 0x73, 0x6d, 0x73, 0x42, 0x0b, 0x0a, 0x09, 0x72, 0x65, 0x71,
-	0x5f, 0x6f, 0x6e, 0x65, 0x6f, 0x66, 0x22, 0xa0, 0x03, 0x0a, 0x0c, 0x53, 0x65, 0x73, 0x73, 0x69,
-	0x6f, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x36, 0x0a, 0x0b, 0x74, 0x6c, 0x73, 0x5f, 0x76,
-	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x15, 0x2e, 0x73,
-	0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x54, 0x4c, 0x53, 0x56, 0x65, 0x72, 0x73,
-	0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x74, 0x6c, 0x73, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
-	0x3f, 0x0a, 0x0f, 0x74, 0x6c, 0x73, 0x5f, 0x63, 0x69, 0x70, 0x68, 0x65, 0x72, 0x73, 0x75, 0x69,
-	0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x16, 0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x43, 0x69, 0x70, 0x68, 0x65, 0x72, 0x73, 0x75, 0x69, 0x74, 0x65,
-	0x52, 0x0e, 0x74, 0x6c, 0x73, 0x43, 0x69, 0x70, 0x68, 0x65, 0x72, 0x73, 0x75, 0x69, 0x74, 0x65,
-	0x12, 0x1f, 0x0a, 0x0b, 0x69, 0x6e, 0x5f, 0x73, 0x65, 0x71, 0x75, 0x65, 0x6e, 0x63, 0x65, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0a, 0x69, 0x6e, 0x53, 0x65, 0x71, 0x75, 0x65, 0x6e, 0x63,
-	0x65, 0x12, 0x21, 0x0a, 0x0c, 0x6f, 0x75, 0x74, 0x5f, 0x73, 0x65, 0x71, 0x75, 0x65, 0x6e, 0x63,
-	0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0b, 0x6f, 0x75, 0x74, 0x53, 0x65, 0x71, 0x75,
-	0x65, 0x6e, 0x63, 0x65, 0x12, 0x15, 0x0a, 0x06, 0x69, 0x6e, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x05,
-	0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x69, 0x6e, 0x4b, 0x65, 0x79, 0x12, 0x17, 0x0a, 0x07, 0x6f,
-	0x75, 0x74, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x6f, 0x75,
-	0x74, 0x4b, 0x65, 0x79, 0x12, 0x24, 0x0a, 0x0e, 0x69, 0x6e, 0x5f, 0x66, 0x69, 0x78, 0x65, 0x64,
-	0x5f, 0x6e, 0x6f, 0x6e, 0x63, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0c, 0x69, 0x6e,
-	0x46, 0x69, 0x78, 0x65, 0x64, 0x4e, 0x6f, 0x6e, 0x63, 0x65, 0x12, 0x26, 0x0a, 0x0f, 0x6f, 0x75,
-	0x74, 0x5f, 0x66, 0x69, 0x78, 0x65, 0x64, 0x5f, 0x6e, 0x6f, 0x6e, 0x63, 0x65, 0x18, 0x08, 0x20,
-	0x01, 0x28, 0x0c, 0x52, 0x0d, 0x6f, 0x75, 0x74, 0x46, 0x69, 0x78, 0x65, 0x64, 0x4e, 0x6f, 0x6e,
-	0x63, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x5f, 0x69, 0x64, 0x18, 0x09, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0c, 0x63, 0x6f, 0x6e, 0x6e, 0x65,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x30, 0x0a, 0x14, 0x69, 0x73, 0x5f, 0x68, 0x61,
-	0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b, 0x65, 0x5f, 0x72, 0x65, 0x73, 0x75, 0x6d, 0x65, 0x64, 0x18,
-	0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x69, 0x73, 0x48, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61,
-	0x6b, 0x65, 0x52, 0x65, 0x73, 0x75, 0x6d, 0x65, 0x64, 0x22, 0xd1, 0x02, 0x0a, 0x0d, 0x53, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x12, 0x31, 0x0a, 0x14, 0x61,
-	0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x63, 0x6f, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x61, 0x70, 0x70, 0x6c, 0x69,
-	0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x2d,
-	0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e,
-	0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f,
-	0x6e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x12, 0x38, 0x0a,
-	0x0d, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x2e, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x49,
-	0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12, 0x3a, 0x0a, 0x0e, 0x6c, 0x6f, 0x63, 0x61, 0x6c,
-	0x5f, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x13, 0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x49, 0x64, 0x65, 0x6e,
-	0x74, 0x69, 0x74, 0x79, 0x52, 0x0d, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x49, 0x64, 0x65, 0x6e, 0x74,
-	0x69, 0x74, 0x79, 0x12, 0x34, 0x0a, 0x16, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x5f, 0x63, 0x65, 0x72,
-	0x74, 0x5f, 0x66, 0x69, 0x6e, 0x67, 0x65, 0x72, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x18, 0x06, 0x20,
-	0x01, 0x28, 0x0c, 0x52, 0x14, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x43, 0x65, 0x72, 0x74, 0x46, 0x69,
-	0x6e, 0x67, 0x65, 0x72, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x12, 0x32, 0x0a, 0x15, 0x70, 0x65, 0x65,
-	0x72, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x5f, 0x66, 0x69, 0x6e, 0x67, 0x65, 0x72, 0x70, 0x72, 0x69,
-	0x6e, 0x74, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x13, 0x70, 0x65, 0x65, 0x72, 0x43, 0x65,
-	0x72, 0x74, 0x46, 0x69, 0x6e, 0x67, 0x65, 0x72, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x22, 0x3d, 0x0a,
-	0x0d, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x12,
-	0x0a, 0x04, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x63, 0x6f,
-	0x64, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x07, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x22, 0xf3, 0x01, 0x0a,
-	0x0b, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x12, 0x3a, 0x0a, 0x0e,
-	0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x5f, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x2e, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x52, 0x0d, 0x6c, 0x6f, 0x63, 0x61, 0x6c,
-	0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12, 0x1d, 0x0a, 0x0a, 0x6f, 0x75, 0x74, 0x5f,
-	0x66, 0x72, 0x61, 0x6d, 0x65, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x6f, 0x75,
-	0x74, 0x46, 0x72, 0x61, 0x6d, 0x65, 0x73, 0x12, 0x25, 0x0a, 0x0e, 0x62, 0x79, 0x74, 0x65, 0x73,
-	0x5f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6d, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52,
-	0x0d, 0x62, 0x79, 0x74, 0x65, 0x73, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6d, 0x65, 0x64, 0x12, 0x30,
-	0x0a, 0x06, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x18,
-	0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x53, 0x65, 0x73, 0x73, 0x69,
-	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x52, 0x06, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74,
-	0x12, 0x30, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x18, 0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x53, 0x65, 0x73,
-	0x73, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74,
-	0x75, 0x73, 0x32, 0x51, 0x0a, 0x0a, 0x53, 0x32, 0x41, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-	0x12, 0x43, 0x0a, 0x0c, 0x53, 0x65, 0x74, 0x55, 0x70, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
-	0x12, 0x15, 0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x53, 0x65, 0x73,
-	0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x1a, 0x16, 0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x2e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x22,
-	0x00, 0x28, 0x01, 0x30, 0x01, 0x42, 0x33, 0x5a, 0x31, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
-	0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x73, 0x32, 0x61, 0x2f, 0x69,
-	0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x73, 0x32,
-	0x61, 0x5f, 0x67, 0x6f, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x33,
-}
+const file_internal_proto_s2a_s2a_proto_rawDesc = "" +
+	"\n" +
+	"\x1cinternal/proto/s2a/s2a.proto\x12\ts2a.proto\x1a\"internal/proto/common/common.proto\"u\n" +
+	"\x17AuthenticationMechanism\x12/\n" +
+	"\bidentity\x18\x01 \x01(\v2\x13.s2a.proto.IdentityR\bidentity\x12\x16\n" +
+	"\x05token\x18\x02 \x01(\tH\x00R\x05tokenB\x11\n" +
+	"\x0fmechanism_oneof\"\xac\x03\n" +
+	"\x15ClientSessionStartReq\x123\n" +
+	"\x15application_protocols\x18\x01 \x03(\tR\x14applicationProtocols\x12=\n" +
+	"\x0fmin_tls_version\x18\x02 \x01(\x0e2\x15.s2a.proto.TLSVersionR\rminTlsVersion\x12=\n" +
+	"\x0fmax_tls_version\x18\x03 \x01(\x0e2\x15.s2a.proto.TLSVersionR\rmaxTlsVersion\x12A\n" +
+	"\x10tls_ciphersuites\x18\x04 \x03(\x0e2\x16.s2a.proto.CiphersuiteR\x0ftlsCiphersuites\x12@\n" +
+	"\x11target_identities\x18\x05 \x03(\v2\x13.s2a.proto.IdentityR\x10targetIdentities\x12:\n" +
+	"\x0elocal_identity\x18\x06 \x01(\v2\x13.s2a.proto.IdentityR\rlocalIdentity\x12\x1f\n" +
+	"\vtarget_name\x18\a \x01(\tR\n" +
+	"targetName\"\xe8\x02\n" +
+	"\x15ServerSessionStartReq\x123\n" +
+	"\x15application_protocols\x18\x01 \x03(\tR\x14applicationProtocols\x12=\n" +
+	"\x0fmin_tls_version\x18\x02 \x01(\x0e2\x15.s2a.proto.TLSVersionR\rminTlsVersion\x12=\n" +
+	"\x0fmax_tls_version\x18\x03 \x01(\x0e2\x15.s2a.proto.TLSVersionR\rmaxTlsVersion\x12A\n" +
+	"\x10tls_ciphersuites\x18\x04 \x03(\x0e2\x16.s2a.proto.CiphersuiteR\x0ftlsCiphersuites\x12>\n" +
+	"\x10local_identities\x18\x05 \x03(\v2\x13.s2a.proto.IdentityR\x0flocalIdentities\x12\x19\n" +
+	"\bin_bytes\x18\x06 \x01(\fR\ainBytes\"+\n" +
+	"\x0eSessionNextReq\x12\x19\n" +
+	"\bin_bytes\x18\x01 \x01(\fR\ainBytes\"\x91\x01\n" +
+	"\x13ResumptionTicketReq\x12\x19\n" +
+	"\bin_bytes\x18\x01 \x03(\fR\ainBytes\x12#\n" +
+	"\rconnection_id\x18\x02 \x01(\x04R\fconnectionId\x12:\n" +
+	"\x0elocal_identity\x18\x03 \x01(\v2\x13.s2a.proto.IdentityR\rlocalIdentity\"\xf4\x02\n" +
+	"\n" +
+	"SessionReq\x12E\n" +
+	"\fclient_start\x18\x01 \x01(\v2 .s2a.proto.ClientSessionStartReqH\x00R\vclientStart\x12E\n" +
+	"\fserver_start\x18\x02 \x01(\v2 .s2a.proto.ServerSessionStartReqH\x00R\vserverStart\x12/\n" +
+	"\x04next\x18\x03 \x01(\v2\x19.s2a.proto.SessionNextReqH\x00R\x04next\x12M\n" +
+	"\x11resumption_ticket\x18\x04 \x01(\v2\x1e.s2a.proto.ResumptionTicketReqH\x00R\x10resumptionTicket\x12K\n" +
+	"\x0fauth_mechanisms\x18\x05 \x03(\v2\".s2a.proto.AuthenticationMechanismR\x0eauthMechanismsB\v\n" +
+	"\treq_oneof\"\xa0\x03\n" +
+	"\fSessionState\x126\n" +
+	"\vtls_version\x18\x01 \x01(\x0e2\x15.s2a.proto.TLSVersionR\n" +
+	"tlsVersion\x12?\n" +
+	"\x0ftls_ciphersuite\x18\x02 \x01(\x0e2\x16.s2a.proto.CiphersuiteR\x0etlsCiphersuite\x12\x1f\n" +
+	"\vin_sequence\x18\x03 \x01(\x04R\n" +
+	"inSequence\x12!\n" +
+	"\fout_sequence\x18\x04 \x01(\x04R\voutSequence\x12\x15\n" +
+	"\x06in_key\x18\x05 \x01(\fR\x05inKey\x12\x17\n" +
+	"\aout_key\x18\x06 \x01(\fR\x06outKey\x12$\n" +
+	"\x0ein_fixed_nonce\x18\a \x01(\fR\finFixedNonce\x12&\n" +
+	"\x0fout_fixed_nonce\x18\b \x01(\fR\routFixedNonce\x12#\n" +
+	"\rconnection_id\x18\t \x01(\x04R\fconnectionId\x120\n" +
+	"\x14is_handshake_resumed\x18\n" +
+	" \x01(\bR\x12isHandshakeResumed\"\xd1\x02\n" +
+	"\rSessionResult\x121\n" +
+	"\x14application_protocol\x18\x01 \x01(\tR\x13applicationProtocol\x12-\n" +
+	"\x05state\x18\x02 \x01(\v2\x17.s2a.proto.SessionStateR\x05state\x128\n" +
+	"\rpeer_identity\x18\x04 \x01(\v2\x13.s2a.proto.IdentityR\fpeerIdentity\x12:\n" +
+	"\x0elocal_identity\x18\x05 \x01(\v2\x13.s2a.proto.IdentityR\rlocalIdentity\x124\n" +
+	"\x16local_cert_fingerprint\x18\x06 \x01(\fR\x14localCertFingerprint\x122\n" +
+	"\x15peer_cert_fingerprint\x18\a \x01(\fR\x13peerCertFingerprint\"=\n" +
+	"\rSessionStatus\x12\x12\n" +
+	"\x04code\x18\x01 \x01(\rR\x04code\x12\x18\n" +
+	"\adetails\x18\x02 \x01(\tR\adetails\"\xf3\x01\n" +
+	"\vSessionResp\x12:\n" +
+	"\x0elocal_identity\x18\x01 \x01(\v2\x13.s2a.proto.IdentityR\rlocalIdentity\x12\x1d\n" +
+	"\n" +
+	"out_frames\x18\x02 \x01(\fR\toutFrames\x12%\n" +
+	"\x0ebytes_consumed\x18\x03 \x01(\rR\rbytesConsumed\x120\n" +
+	"\x06result\x18\x04 \x01(\v2\x18.s2a.proto.SessionResultR\x06result\x120\n" +
+	"\x06status\x18\x05 \x01(\v2\x18.s2a.proto.SessionStatusR\x06status2Q\n" +
+	"\n" +
+	"S2AService\x12C\n" +
+	"\fSetUpSession\x12\x15.s2a.proto.SessionReq\x1a\x16.s2a.proto.SessionResp\"\x00(\x010\x01B3Z1github.com/google/s2a/internal/proto/s2a_go_protob\x06proto3"

 var (
 	file_internal_proto_s2a_s2a_proto_rawDescOnce sync.Once
-	file_internal_proto_s2a_s2a_proto_rawDescData = file_internal_proto_s2a_s2a_proto_rawDesc
+	file_internal_proto_s2a_s2a_proto_rawDescData []byte
 )

 func file_internal_proto_s2a_s2a_proto_rawDescGZIP() []byte {
 	file_internal_proto_s2a_s2a_proto_rawDescOnce.Do(func() {
-		file_internal_proto_s2a_s2a_proto_rawDescData = protoimpl.X.CompressGZIP(file_internal_proto_s2a_s2a_proto_rawDescData)
+		file_internal_proto_s2a_s2a_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_internal_proto_s2a_s2a_proto_rawDesc), len(file_internal_proto_s2a_s2a_proto_rawDesc)))
 	})
 	return file_internal_proto_s2a_s2a_proto_rawDescData
 }
@@ -1225,128 +1101,6 @@ func file_internal_proto_s2a_s2a_proto_init() {
 	if File_internal_proto_s2a_s2a_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_internal_proto_s2a_s2a_proto_msgTypes[0].Exporter = func(v any, i int) any {
-			switch v := v.(*AuthenticationMechanism); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_internal_proto_s2a_s2a_proto_msgTypes[1].Exporter = func(v any, i int) any {
-			switch v := v.(*ClientSessionStartReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_internal_proto_s2a_s2a_proto_msgTypes[2].Exporter = func(v any, i int) any {
-			switch v := v.(*ServerSessionStartReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_internal_proto_s2a_s2a_proto_msgTypes[3].Exporter = func(v any, i int) any {
-			switch v := v.(*SessionNextReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_internal_proto_s2a_s2a_proto_msgTypes[4].Exporter = func(v any, i int) any {
-			switch v := v.(*ResumptionTicketReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_internal_proto_s2a_s2a_proto_msgTypes[5].Exporter = func(v any, i int) any {
-			switch v := v.(*SessionReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_internal_proto_s2a_s2a_proto_msgTypes[6].Exporter = func(v any, i int) any {
-			switch v := v.(*SessionState); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_internal_proto_s2a_s2a_proto_msgTypes[7].Exporter = func(v any, i int) any {
-			switch v := v.(*SessionResult); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_internal_proto_s2a_s2a_proto_msgTypes[8].Exporter = func(v any, i int) any {
-			switch v := v.(*SessionStatus); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_internal_proto_s2a_s2a_proto_msgTypes[9].Exporter = func(v any, i int) any {
-			switch v := v.(*SessionResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	file_internal_proto_s2a_s2a_proto_msgTypes[0].OneofWrappers = []any{
 		(*AuthenticationMechanism_Token)(nil),
 	}
@@ -1360,7 +1114,7 @@ func file_internal_proto_s2a_s2a_proto_init() {
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_internal_proto_s2a_s2a_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_internal_proto_s2a_s2a_proto_rawDesc), len(file_internal_proto_s2a_s2a_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   10,
 			NumExtensions: 0,
@@ -1371,7 +1125,6 @@ func file_internal_proto_s2a_s2a_proto_init() {
 		MessageInfos:      file_internal_proto_s2a_s2a_proto_msgTypes,
 	}.Build()
 	File_internal_proto_s2a_s2a_proto = out.File
-	file_internal_proto_s2a_s2a_proto_rawDesc = nil
 	file_internal_proto_s2a_s2a_proto_goTypes = nil
 	file_internal_proto_s2a_s2a_proto_depIdxs = nil
 }
@@ -14,7 +14,7 @@

 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.4.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             v3.21.12
 // source: internal/proto/s2a/s2a.proto

@@ -29,8 +29,8 @@ import (

 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.62.0 or later.
-const _ = grpc.SupportPackageIsVersion8
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9

 const (
 	S2AService_SetUpSession_FullMethodName = "/s2a.proto.S2AService/SetUpSession"
@@ -49,7 +49,7 @@ type S2AServiceClient interface {
 	// Every time S2A client sends a request, this service sends a response.
 	// However, clients do not have to wait for service response before sending
 	// the next request.
-	SetUpSession(ctx context.Context, opts ...grpc.CallOption) (S2AService_SetUpSessionClient, error)
+	SetUpSession(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[SessionReq, SessionResp], error)
 }

 type s2AServiceClient struct {
@@ -60,41 +60,22 @@ func NewS2AServiceClient(cc grpc.ClientConnInterface) S2AServiceClient {
 	return &s2AServiceClient{cc}
 }

-func (c *s2AServiceClient) SetUpSession(ctx context.Context, opts ...grpc.CallOption) (S2AService_SetUpSessionClient, error) {
+func (c *s2AServiceClient) SetUpSession(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[SessionReq, SessionResp], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	stream, err := c.cc.NewStream(ctx, &S2AService_ServiceDesc.Streams[0], S2AService_SetUpSession_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &s2AServiceSetUpSessionClient{ClientStream: stream}
+	x := &grpc.GenericClientStream[SessionReq, SessionResp]{ClientStream: stream}
 	return x, nil
 }

-type S2AService_SetUpSessionClient interface {
-	Send(*SessionReq) error
-	Recv() (*SessionResp, error)
-	grpc.ClientStream
-}
-
-type s2AServiceSetUpSessionClient struct {
-	grpc.ClientStream
-}
-
-func (x *s2AServiceSetUpSessionClient) Send(m *SessionReq) error {
-	return x.ClientStream.SendMsg(m)
-}
-
-func (x *s2AServiceSetUpSessionClient) Recv() (*SessionResp, error) {
-	m := new(SessionResp)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type S2AService_SetUpSessionClient = grpc.BidiStreamingClient[SessionReq, SessionResp]

 // S2AServiceServer is the server API for S2AService service.
 // All implementations must embed UnimplementedS2AServiceServer
-// for forward compatibility
+// for forward compatibility.
 type S2AServiceServer interface {
 	// S2A service accepts a stream of session setup requests and returns a stream
 	// of session setup responses. The client of this service is expected to send
@@ -105,18 +86,22 @@ type S2AServiceServer interface {
 	// Every time S2A client sends a request, this service sends a response.
 	// However, clients do not have to wait for service response before sending
 	// the next request.
-	SetUpSession(S2AService_SetUpSessionServer) error
+	SetUpSession(grpc.BidiStreamingServer[SessionReq, SessionResp]) error
 	mustEmbedUnimplementedS2AServiceServer()
 }

-// UnimplementedS2AServiceServer must be embedded to have forward compatible implementations.
-type UnimplementedS2AServiceServer struct {
-}
+// UnimplementedS2AServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedS2AServiceServer struct{}

-func (UnimplementedS2AServiceServer) SetUpSession(S2AService_SetUpSessionServer) error {
+func (UnimplementedS2AServiceServer) SetUpSession(grpc.BidiStreamingServer[SessionReq, SessionResp]) error {
 	return status.Errorf(codes.Unimplemented, "method SetUpSession not implemented")
 }
 func (UnimplementedS2AServiceServer) mustEmbedUnimplementedS2AServiceServer() {}
+func (UnimplementedS2AServiceServer) testEmbeddedByValue()                    {}

 // UnsafeS2AServiceServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to S2AServiceServer will
@@ -126,34 +111,22 @@ type UnsafeS2AServiceServer interface {
 }

 func RegisterS2AServiceServer(s grpc.ServiceRegistrar, srv S2AServiceServer) {
+	// If the following call pancis, it indicates UnimplementedS2AServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&S2AService_ServiceDesc, srv)
 }

 func _S2AService_SetUpSession_Handler(srv interface{}, stream grpc.ServerStream) error {
-	return srv.(S2AServiceServer).SetUpSession(&s2AServiceSetUpSessionServer{ServerStream: stream})
+	return srv.(S2AServiceServer).SetUpSession(&grpc.GenericServerStream[SessionReq, SessionResp]{ServerStream: stream})
 }

-type S2AService_SetUpSessionServer interface {
-	Send(*SessionResp) error
-	Recv() (*SessionReq, error)
-	grpc.ServerStream
-}
-
-type s2AServiceSetUpSessionServer struct {
-	grpc.ServerStream
-}
-
-func (x *s2AServiceSetUpSessionServer) Send(m *SessionResp) error {
-	return x.ServerStream.SendMsg(m)
-}
-
-func (x *s2AServiceSetUpSessionServer) Recv() (*SessionReq, error) {
-	m := new(SessionReq)
-	if err := x.ServerStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type S2AService_SetUpSessionServer = grpc.BidiStreamingServer[SessionReq, SessionResp]

 // S2AService_ServiceDesc is the grpc.ServiceDesc for S2AService service.
 // It's only intended for direct use with grpc.RegisterService,
@@ -14,7 +14,7 @@

 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.34.2
+// 	protoc-gen-go v1.36.9
 // 	protoc        v3.21.12
 // source: internal/proto/v2/common/common.proto

@@ -25,6 +25,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )

 const (
@@ -257,11 +258,8 @@ func (AlpnProtocol) EnumDescriptor() ([]byte, []int) {
 }

 type Identity struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	// Types that are assignable to IdentityOneof:
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to IdentityOneof:
 	//
 	//	*Identity_SpiffeId
 	//	*Identity_Hostname
@@ -270,16 +268,16 @@ type Identity struct {
 	//	*Identity_GcpId
 	IdentityOneof isIdentity_IdentityOneof `protobuf_oneof:"identity_oneof"`
 	// Additional identity-specific attributes.
-	Attributes map[string]string `protobuf:"bytes,3,rep,name=attributes,proto3" json:"attributes,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	Attributes    map[string]string `protobuf:"bytes,3,rep,name=attributes,proto3" json:"attributes,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }

 func (x *Identity) Reset() {
 	*x = Identity{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_proto_v2_common_common_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_internal_proto_v2_common_common_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }

 func (x *Identity) String() string {
@@ -290,7 +288,7 @@ func (*Identity) ProtoMessage() {}

 func (x *Identity) ProtoReflect() protoreflect.Message {
 	mi := &file_internal_proto_v2_common_common_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -305,44 +303,54 @@ func (*Identity) Descriptor() ([]byte, []int) {
 	return file_internal_proto_v2_common_common_proto_rawDescGZIP(), []int{0}
 }

-func (m *Identity) GetIdentityOneof() isIdentity_IdentityOneof {
-	if m != nil {
-		return m.IdentityOneof
+func (x *Identity) GetIdentityOneof() isIdentity_IdentityOneof {
+	if x != nil {
+		return x.IdentityOneof
 	}
 	return nil
 }

 func (x *Identity) GetSpiffeId() string {
-	if x, ok := x.GetIdentityOneof().(*Identity_SpiffeId); ok {
-		return x.SpiffeId
+	if x != nil {
+		if x, ok := x.IdentityOneof.(*Identity_SpiffeId); ok {
+			return x.SpiffeId
+		}
 	}
 	return ""
 }

 func (x *Identity) GetHostname() string {
-	if x, ok := x.GetIdentityOneof().(*Identity_Hostname); ok {
-		return x.Hostname
+	if x != nil {
+		if x, ok := x.IdentityOneof.(*Identity_Hostname); ok {
+			return x.Hostname
+		}
 	}
 	return ""
 }

 func (x *Identity) GetUid() string {
-	if x, ok := x.GetIdentityOneof().(*Identity_Uid); ok {
-		return x.Uid
+	if x != nil {
+		if x, ok := x.IdentityOneof.(*Identity_Uid); ok {
+			return x.Uid
+		}
 	}
 	return ""
 }

 func (x *Identity) GetUsername() string {
-	if x, ok := x.GetIdentityOneof().(*Identity_Username); ok {
-		return x.Username
+	if x != nil {
+		if x, ok := x.IdentityOneof.(*Identity_Username); ok {
+			return x.Username
+		}
 	}
 	return ""
 }

 func (x *Identity) GetGcpId() string {
-	if x, ok := x.GetIdentityOneof().(*Identity_GcpId); ok {
-		return x.GcpId
+	if x != nil {
+		if x, ok := x.IdentityOneof.(*Identity_GcpId); ok {
+			return x.GcpId
+		}
 	}
 	return ""
 }
@@ -395,89 +403,55 @@ func (*Identity_GcpId) isIdentity_IdentityOneof() {}

 var File_internal_proto_v2_common_common_proto protoreflect.FileDescriptor

-var file_internal_proto_v2_common_common_proto_rawDesc = []byte{
-	0x0a, 0x25, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x2f, 0x76, 0x32, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
-	0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0c, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x2e, 0x76, 0x32, 0x22, 0xab, 0x02, 0x0a, 0x08, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x74, 0x79, 0x12, 0x1d, 0x0a, 0x09, 0x73, 0x70, 0x69, 0x66, 0x66, 0x65, 0x5f, 0x69, 0x64, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x08, 0x73, 0x70, 0x69, 0x66, 0x66, 0x65, 0x49,
-	0x64, 0x12, 0x1c, 0x0a, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x12,
-	0x12, 0x0a, 0x03, 0x75, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x03,
-	0x75, 0x69, 0x64, 0x12, 0x1c, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d,
-	0x65, 0x12, 0x17, 0x0a, 0x06, 0x67, 0x63, 0x70, 0x5f, 0x69, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28,
-	0x09, 0x48, 0x00, 0x52, 0x05, 0x67, 0x63, 0x70, 0x49, 0x64, 0x12, 0x46, 0x0a, 0x0a, 0x61, 0x74,
-	0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x26,
-	0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x49, 0x64,
-	0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x2e, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65,
-	0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
-	0x65, 0x73, 0x1a, 0x3d, 0x0a, 0x0f, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73,
-	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
-	0x01, 0x42, 0x10, 0x0a, 0x0e, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x5f, 0x6f, 0x6e,
-	0x65, 0x6f, 0x66, 0x2a, 0xee, 0x02, 0x0a, 0x0b, 0x43, 0x69, 0x70, 0x68, 0x65, 0x72, 0x73, 0x75,
-	0x69, 0x74, 0x65, 0x12, 0x1b, 0x0a, 0x17, 0x43, 0x49, 0x50, 0x48, 0x45, 0x52, 0x53, 0x55, 0x49,
-	0x54, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00,
-	0x12, 0x33, 0x0a, 0x2f, 0x43, 0x49, 0x50, 0x48, 0x45, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f,
-	0x45, 0x43, 0x44, 0x48, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x53, 0x41, 0x5f, 0x57, 0x49, 0x54, 0x48,
-	0x5f, 0x41, 0x45, 0x53, 0x5f, 0x31, 0x32, 0x38, 0x5f, 0x47, 0x43, 0x4d, 0x5f, 0x53, 0x48, 0x41,
-	0x32, 0x35, 0x36, 0x10, 0x01, 0x12, 0x33, 0x0a, 0x2f, 0x43, 0x49, 0x50, 0x48, 0x45, 0x52, 0x53,
-	0x55, 0x49, 0x54, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x48, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x53, 0x41,
-	0x5f, 0x57, 0x49, 0x54, 0x48, 0x5f, 0x41, 0x45, 0x53, 0x5f, 0x32, 0x35, 0x36, 0x5f, 0x47, 0x43,
-	0x4d, 0x5f, 0x53, 0x48, 0x41, 0x33, 0x38, 0x34, 0x10, 0x02, 0x12, 0x39, 0x0a, 0x35, 0x43, 0x49,
-	0x50, 0x48, 0x45, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x48, 0x45, 0x5f,
-	0x45, 0x43, 0x44, 0x53, 0x41, 0x5f, 0x57, 0x49, 0x54, 0x48, 0x5f, 0x43, 0x48, 0x41, 0x43, 0x48,
-	0x41, 0x32, 0x30, 0x5f, 0x50, 0x4f, 0x4c, 0x59, 0x31, 0x33, 0x30, 0x35, 0x5f, 0x53, 0x48, 0x41,
-	0x32, 0x35, 0x36, 0x10, 0x03, 0x12, 0x31, 0x0a, 0x2d, 0x43, 0x49, 0x50, 0x48, 0x45, 0x52, 0x53,
-	0x55, 0x49, 0x54, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x48, 0x45, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x57,
-	0x49, 0x54, 0x48, 0x5f, 0x41, 0x45, 0x53, 0x5f, 0x31, 0x32, 0x38, 0x5f, 0x47, 0x43, 0x4d, 0x5f,
-	0x53, 0x48, 0x41, 0x32, 0x35, 0x36, 0x10, 0x04, 0x12, 0x31, 0x0a, 0x2d, 0x43, 0x49, 0x50, 0x48,
-	0x45, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x48, 0x45, 0x5f, 0x52, 0x53,
-	0x41, 0x5f, 0x57, 0x49, 0x54, 0x48, 0x5f, 0x41, 0x45, 0x53, 0x5f, 0x32, 0x35, 0x36, 0x5f, 0x47,
-	0x43, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x33, 0x38, 0x34, 0x10, 0x05, 0x12, 0x37, 0x0a, 0x33, 0x43,
-	0x49, 0x50, 0x48, 0x45, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x48, 0x45,
-	0x5f, 0x52, 0x53, 0x41, 0x5f, 0x57, 0x49, 0x54, 0x48, 0x5f, 0x43, 0x48, 0x41, 0x43, 0x48, 0x41,
-	0x32, 0x30, 0x5f, 0x50, 0x4f, 0x4c, 0x59, 0x31, 0x33, 0x30, 0x35, 0x5f, 0x53, 0x48, 0x41, 0x32,
-	0x35, 0x36, 0x10, 0x06, 0x2a, 0x7d, 0x0a, 0x0a, 0x54, 0x4c, 0x53, 0x56, 0x65, 0x72, 0x73, 0x69,
-	0x6f, 0x6e, 0x12, 0x1b, 0x0a, 0x17, 0x54, 0x4c, 0x53, 0x5f, 0x56, 0x45, 0x52, 0x53, 0x49, 0x4f,
-	0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12,
-	0x13, 0x0a, 0x0f, 0x54, 0x4c, 0x53, 0x5f, 0x56, 0x45, 0x52, 0x53, 0x49, 0x4f, 0x4e, 0x5f, 0x31,
-	0x5f, 0x30, 0x10, 0x01, 0x12, 0x13, 0x0a, 0x0f, 0x54, 0x4c, 0x53, 0x5f, 0x56, 0x45, 0x52, 0x53,
-	0x49, 0x4f, 0x4e, 0x5f, 0x31, 0x5f, 0x31, 0x10, 0x02, 0x12, 0x13, 0x0a, 0x0f, 0x54, 0x4c, 0x53,
-	0x5f, 0x56, 0x45, 0x52, 0x53, 0x49, 0x4f, 0x4e, 0x5f, 0x31, 0x5f, 0x32, 0x10, 0x03, 0x12, 0x13,
-	0x0a, 0x0f, 0x54, 0x4c, 0x53, 0x5f, 0x56, 0x45, 0x52, 0x53, 0x49, 0x4f, 0x4e, 0x5f, 0x31, 0x5f,
-	0x33, 0x10, 0x04, 0x2a, 0x69, 0x0a, 0x0e, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x53, 0x69, 0x64, 0x65, 0x12, 0x1f, 0x0a, 0x1b, 0x43, 0x4f, 0x4e, 0x4e, 0x45, 0x43, 0x54,
-	0x49, 0x4f, 0x4e, 0x5f, 0x53, 0x49, 0x44, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49,
-	0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1a, 0x0a, 0x16, 0x43, 0x4f, 0x4e, 0x4e, 0x45, 0x43,
-	0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x53, 0x49, 0x44, 0x45, 0x5f, 0x43, 0x4c, 0x49, 0x45, 0x4e, 0x54,
-	0x10, 0x01, 0x12, 0x1a, 0x0a, 0x16, 0x43, 0x4f, 0x4e, 0x4e, 0x45, 0x43, 0x54, 0x49, 0x4f, 0x4e,
-	0x5f, 0x53, 0x49, 0x44, 0x45, 0x5f, 0x53, 0x45, 0x52, 0x56, 0x45, 0x52, 0x10, 0x02, 0x2a, 0x79,
-	0x0a, 0x0c, 0x41, 0x6c, 0x70, 0x6e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x1d,
-	0x0a, 0x19, 0x41, 0x4c, 0x50, 0x4e, 0x5f, 0x50, 0x52, 0x4f, 0x54, 0x4f, 0x43, 0x4f, 0x4c, 0x5f,
-	0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x16, 0x0a,
-	0x12, 0x41, 0x4c, 0x50, 0x4e, 0x5f, 0x50, 0x52, 0x4f, 0x54, 0x4f, 0x43, 0x4f, 0x4c, 0x5f, 0x47,
-	0x52, 0x50, 0x43, 0x10, 0x01, 0x12, 0x17, 0x0a, 0x13, 0x41, 0x4c, 0x50, 0x4e, 0x5f, 0x50, 0x52,
-	0x4f, 0x54, 0x4f, 0x43, 0x4f, 0x4c, 0x5f, 0x48, 0x54, 0x54, 0x50, 0x32, 0x10, 0x02, 0x12, 0x19,
-	0x0a, 0x15, 0x41, 0x4c, 0x50, 0x4e, 0x5f, 0x50, 0x52, 0x4f, 0x54, 0x4f, 0x43, 0x4f, 0x4c, 0x5f,
-	0x48, 0x54, 0x54, 0x50, 0x31, 0x5f, 0x31, 0x10, 0x03, 0x42, 0x39, 0x5a, 0x37, 0x67, 0x69, 0x74,
-	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x73,
-	0x32, 0x61, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x2f, 0x76, 0x32, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x5f, 0x67, 0x6f, 0x5f, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+const file_internal_proto_v2_common_common_proto_rawDesc = "" +
+	"\n" +
+	"%internal/proto/v2/common/common.proto\x12\fs2a.proto.v2\"\xab\x02\n" +
+	"\bIdentity\x12\x1d\n" +
+	"\tspiffe_id\x18\x01 \x01(\tH\x00R\bspiffeId\x12\x1c\n" +
+	"\bhostname\x18\x02 \x01(\tH\x00R\bhostname\x12\x12\n" +
+	"\x03uid\x18\x04 \x01(\tH\x00R\x03uid\x12\x1c\n" +
+	"\busername\x18\x05 \x01(\tH\x00R\busername\x12\x17\n" +
+	"\x06gcp_id\x18\x06 \x01(\tH\x00R\x05gcpId\x12F\n" +
+	"\n" +
+	"attributes\x18\x03 \x03(\v2&.s2a.proto.v2.Identity.AttributesEntryR\n" +
+	"attributes\x1a=\n" +
+	"\x0fAttributesEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01B\x10\n" +
+	"\x0eidentity_oneof*\xee\x02\n" +
+	"\vCiphersuite\x12\x1b\n" +
+	"\x17CIPHERSUITE_UNSPECIFIED\x10\x00\x123\n" +
+	"/CIPHERSUITE_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256\x10\x01\x123\n" +
+	"/CIPHERSUITE_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384\x10\x02\x129\n" +
+	"5CIPHERSUITE_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256\x10\x03\x121\n" +
+	"-CIPHERSUITE_ECDHE_RSA_WITH_AES_128_GCM_SHA256\x10\x04\x121\n" +
+	"-CIPHERSUITE_ECDHE_RSA_WITH_AES_256_GCM_SHA384\x10\x05\x127\n" +
+	"3CIPHERSUITE_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256\x10\x06*}\n" +
+	"\n" +
+	"TLSVersion\x12\x1b\n" +
+	"\x17TLS_VERSION_UNSPECIFIED\x10\x00\x12\x13\n" +
+	"\x0fTLS_VERSION_1_0\x10\x01\x12\x13\n" +
+	"\x0fTLS_VERSION_1_1\x10\x02\x12\x13\n" +
+	"\x0fTLS_VERSION_1_2\x10\x03\x12\x13\n" +
+	"\x0fTLS_VERSION_1_3\x10\x04*i\n" +
+	"\x0eConnectionSide\x12\x1f\n" +
+	"\x1bCONNECTION_SIDE_UNSPECIFIED\x10\x00\x12\x1a\n" +
+	"\x16CONNECTION_SIDE_CLIENT\x10\x01\x12\x1a\n" +
+	"\x16CONNECTION_SIDE_SERVER\x10\x02*y\n" +
+	"\fAlpnProtocol\x12\x1d\n" +
+	"\x19ALPN_PROTOCOL_UNSPECIFIED\x10\x00\x12\x16\n" +
+	"\x12ALPN_PROTOCOL_GRPC\x10\x01\x12\x17\n" +
+	"\x13ALPN_PROTOCOL_HTTP2\x10\x02\x12\x19\n" +
+	"\x15ALPN_PROTOCOL_HTTP1_1\x10\x03B9Z7github.com/google/s2a/internal/proto/v2/common_go_protob\x06proto3"

 var (
 	file_internal_proto_v2_common_common_proto_rawDescOnce sync.Once
-	file_internal_proto_v2_common_common_proto_rawDescData = file_internal_proto_v2_common_common_proto_rawDesc
+	file_internal_proto_v2_common_common_proto_rawDescData []byte
 )

 func file_internal_proto_v2_common_common_proto_rawDescGZIP() []byte {
 	file_internal_proto_v2_common_common_proto_rawDescOnce.Do(func() {
-		file_internal_proto_v2_common_common_proto_rawDescData = protoimpl.X.CompressGZIP(file_internal_proto_v2_common_common_proto_rawDescData)
+		file_internal_proto_v2_common_common_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_internal_proto_v2_common_common_proto_rawDesc), len(file_internal_proto_v2_common_common_proto_rawDesc)))
 	})
 	return file_internal_proto_v2_common_common_proto_rawDescData
 }
@@ -506,20 +480,6 @@ func file_internal_proto_v2_common_common_proto_init() {
 	if File_internal_proto_v2_common_common_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_internal_proto_v2_common_common_proto_msgTypes[0].Exporter = func(v any, i int) any {
-			switch v := v.(*Identity); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	file_internal_proto_v2_common_common_proto_msgTypes[0].OneofWrappers = []any{
 		(*Identity_SpiffeId)(nil),
 		(*Identity_Hostname)(nil),
@@ -531,7 +491,7 @@ func file_internal_proto_v2_common_common_proto_init() {
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_internal_proto_v2_common_common_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_internal_proto_v2_common_common_proto_rawDesc), len(file_internal_proto_v2_common_common_proto_rawDesc)),
 			NumEnums:      4,
 			NumMessages:   2,
 			NumExtensions: 0,
@@ -543,7 +503,6 @@ func file_internal_proto_v2_common_common_proto_init() {
 		MessageInfos:      file_internal_proto_v2_common_common_proto_msgTypes,
 	}.Build()
 	File_internal_proto_v2_common_common_proto = out.File
-	file_internal_proto_v2_common_common_proto_rawDesc = nil
 	file_internal_proto_v2_common_common_proto_goTypes = nil
 	file_internal_proto_v2_common_common_proto_depIdxs = nil
 }
@@ -14,7 +14,7 @@

 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.34.2
+// 	protoc-gen-go v1.36.9
 // 	protoc        v3.21.12
 // source: internal/proto/v2/s2a_context/s2a_context.proto

@@ -26,6 +26,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )

 const (
@@ -36,10 +37,7 @@ const (
 )

 type S2AContext struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The SPIFFE ID from the peer leaf certificate, if present.
 	//
 	// This field is only populated if the leaf certificate is a valid SPIFFE
@@ -68,15 +66,15 @@ type S2AContext struct {
 	// The SHA256 hash of the DER-encoding of the local leaf certificate used in
 	// the handshake.
 	LocalLeafCertFingerprint []byte `protobuf:"bytes,6,opt,name=local_leaf_cert_fingerprint,json=localLeafCertFingerprint,proto3" json:"local_leaf_cert_fingerprint,omitempty"`
+	unknownFields            protoimpl.UnknownFields
+	sizeCache                protoimpl.SizeCache
 }

 func (x *S2AContext) Reset() {
 	*x = S2AContext{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_proto_v2_s2a_context_s2a_context_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_internal_proto_v2_s2a_context_s2a_context_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }

 func (x *S2AContext) String() string {
@@ -87,7 +85,7 @@ func (*S2AContext) ProtoMessage() {}

 func (x *S2AContext) ProtoReflect() protoreflect.Message {
 	mi := &file_internal_proto_v2_s2a_context_s2a_context_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -146,51 +144,26 @@ func (x *S2AContext) GetLocalLeafCertFingerprint() []byte {

 var File_internal_proto_v2_s2a_context_s2a_context_proto protoreflect.FileDescriptor

-var file_internal_proto_v2_s2a_context_s2a_context_proto_rawDesc = []byte{
-	0x0a, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x2f, 0x76, 0x32, 0x2f, 0x73, 0x32, 0x61, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x2f,
-	0x73, 0x32, 0x61, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x12, 0x0c, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x76, 0x32, 0x1a,
-	0x25, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f,
-	0x76, 0x32, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xee, 0x02, 0x0a, 0x0a, 0x53, 0x32, 0x41, 0x43, 0x6f,
-	0x6e, 0x74, 0x65, 0x78, 0x74, 0x12, 0x2d, 0x0a, 0x13, 0x6c, 0x65, 0x61, 0x66, 0x5f, 0x63, 0x65,
-	0x72, 0x74, 0x5f, 0x73, 0x70, 0x69, 0x66, 0x66, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x10, 0x6c, 0x65, 0x61, 0x66, 0x43, 0x65, 0x72, 0x74, 0x53, 0x70, 0x69, 0x66,
-	0x66, 0x65, 0x49, 0x64, 0x12, 0x24, 0x0a, 0x0e, 0x6c, 0x65, 0x61, 0x66, 0x5f, 0x63, 0x65, 0x72,
-	0x74, 0x5f, 0x75, 0x72, 0x69, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x6c, 0x65,
-	0x61, 0x66, 0x43, 0x65, 0x72, 0x74, 0x55, 0x72, 0x69, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x6c, 0x65,
-	0x61, 0x66, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x5f, 0x64, 0x6e, 0x73, 0x6e, 0x61, 0x6d, 0x65, 0x73,
-	0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x6c, 0x65, 0x61, 0x66, 0x43, 0x65, 0x72, 0x74,
-	0x44, 0x6e, 0x73, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x12, 0x4d, 0x0a, 0x23, 0x70, 0x65, 0x65, 0x72,
-	0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x63, 0x68, 0x61,
-	0x69, 0x6e, 0x5f, 0x66, 0x69, 0x6e, 0x67, 0x65, 0x72, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x73, 0x18,
-	0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x20, 0x70, 0x65, 0x65, 0x72, 0x43, 0x65, 0x72, 0x74, 0x69,
-	0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x46, 0x69, 0x6e, 0x67, 0x65,
-	0x72, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x73, 0x12, 0x3d, 0x0a, 0x0e, 0x6c, 0x6f, 0x63, 0x61, 0x6c,
-	0x5f, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x16, 0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x49,
-	0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x52, 0x0d, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x49, 0x64,
-	0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12, 0x3d, 0x0a, 0x1b, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x5f,
-	0x6c, 0x65, 0x61, 0x66, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x5f, 0x66, 0x69, 0x6e, 0x67, 0x65, 0x72,
-	0x70, 0x72, 0x69, 0x6e, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x18, 0x6c, 0x6f, 0x63,
-	0x61, 0x6c, 0x4c, 0x65, 0x61, 0x66, 0x43, 0x65, 0x72, 0x74, 0x46, 0x69, 0x6e, 0x67, 0x65, 0x72,
-	0x70, 0x72, 0x69, 0x6e, 0x74, 0x4a, 0x04, 0x08, 0x05, 0x10, 0x06, 0x4a, 0x04, 0x08, 0x07, 0x10,
-	0x08, 0x4a, 0x04, 0x08, 0x08, 0x10, 0x09, 0x42, 0x3e, 0x5a, 0x3c, 0x67, 0x69, 0x74, 0x68, 0x75,
-	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x73, 0x32, 0x61,
-	0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f,
-	0x76, 0x32, 0x2f, 0x73, 0x32, 0x61, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x5f, 0x67,
-	0x6f, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+const file_internal_proto_v2_s2a_context_s2a_context_proto_rawDesc = "" +
+	"\n" +
+	"/internal/proto/v2/s2a_context/s2a_context.proto\x12\fs2a.proto.v2\x1a%internal/proto/v2/common/common.proto\"\xee\x02\n" +
+	"\n" +
+	"S2AContext\x12-\n" +
+	"\x13leaf_cert_spiffe_id\x18\x01 \x01(\tR\x10leafCertSpiffeId\x12$\n" +
+	"\x0eleaf_cert_uris\x18\x02 \x03(\tR\fleafCertUris\x12,\n" +
+	"\x12leaf_cert_dnsnames\x18\x03 \x03(\tR\x10leafCertDnsnames\x12M\n" +
+	"#peer_certificate_chain_fingerprints\x18\x04 \x03(\tR peerCertificateChainFingerprints\x12=\n" +
+	"\x0elocal_identity\x18\t \x01(\v2\x16.s2a.proto.v2.IdentityR\rlocalIdentity\x12=\n" +
+	"\x1blocal_leaf_cert_fingerprint\x18\x06 \x01(\fR\x18localLeafCertFingerprintJ\x04\b\x05\x10\x06J\x04\b\a\x10\bJ\x04\b\b\x10\tB>Z<github.com/google/s2a/internal/proto/v2/s2a_context_go_protob\x06proto3"

 var (
 	file_internal_proto_v2_s2a_context_s2a_context_proto_rawDescOnce sync.Once
-	file_internal_proto_v2_s2a_context_s2a_context_proto_rawDescData = file_internal_proto_v2_s2a_context_s2a_context_proto_rawDesc
+	file_internal_proto_v2_s2a_context_s2a_context_proto_rawDescData []byte
 )

 func file_internal_proto_v2_s2a_context_s2a_context_proto_rawDescGZIP() []byte {
 	file_internal_proto_v2_s2a_context_s2a_context_proto_rawDescOnce.Do(func() {
-		file_internal_proto_v2_s2a_context_s2a_context_proto_rawDescData = protoimpl.X.CompressGZIP(file_internal_proto_v2_s2a_context_s2a_context_proto_rawDescData)
+		file_internal_proto_v2_s2a_context_s2a_context_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_internal_proto_v2_s2a_context_s2a_context_proto_rawDesc), len(file_internal_proto_v2_s2a_context_s2a_context_proto_rawDesc)))
 	})
 	return file_internal_proto_v2_s2a_context_s2a_context_proto_rawDescData
 }
@@ -214,25 +187,11 @@ func file_internal_proto_v2_s2a_context_s2a_context_proto_init() {
 	if File_internal_proto_v2_s2a_context_s2a_context_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_internal_proto_v2_s2a_context_s2a_context_proto_msgTypes[0].Exporter = func(v any, i int) any {
-			switch v := v.(*S2AContext); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_internal_proto_v2_s2a_context_s2a_context_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_internal_proto_v2_s2a_context_s2a_context_proto_rawDesc), len(file_internal_proto_v2_s2a_context_s2a_context_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   1,
 			NumExtensions: 0,
@@ -243,7 +202,6 @@ func file_internal_proto_v2_s2a_context_s2a_context_proto_init() {
 		MessageInfos:      file_internal_proto_v2_s2a_context_s2a_context_proto_msgTypes,
 	}.Build()
 	File_internal_proto_v2_s2a_context_s2a_context_proto = out.File
-	file_internal_proto_v2_s2a_context_s2a_context_proto_rawDesc = nil
 	file_internal_proto_v2_s2a_context_s2a_context_proto_goTypes = nil
 	file_internal_proto_v2_s2a_context_s2a_context_proto_depIdxs = nil
 }
@@ -14,7 +14,7 @@

 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.4.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             v3.21.12
 // source: internal/proto/v2/s2a/s2a.proto

@@ -29,8 +29,8 @@ import (

 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.62.0 or later.
-const _ = grpc.SupportPackageIsVersion8
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9

 const (
 	S2AService_SetUpSession_FullMethodName = "/s2a.proto.v2.S2AService/SetUpSession"
@@ -42,7 +42,7 @@ const (
 type S2AServiceClient interface {
 	// SetUpSession is a bidirectional stream used by applications to offload
 	// operations from the TLS handshake.
-	SetUpSession(ctx context.Context, opts ...grpc.CallOption) (S2AService_SetUpSessionClient, error)
+	SetUpSession(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[SessionReq, SessionResp], error)
 }

 type s2AServiceClient struct {
@@ -53,56 +53,41 @@ func NewS2AServiceClient(cc grpc.ClientConnInterface) S2AServiceClient {
 	return &s2AServiceClient{cc}
 }

-func (c *s2AServiceClient) SetUpSession(ctx context.Context, opts ...grpc.CallOption) (S2AService_SetUpSessionClient, error) {
+func (c *s2AServiceClient) SetUpSession(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[SessionReq, SessionResp], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	stream, err := c.cc.NewStream(ctx, &S2AService_ServiceDesc.Streams[0], S2AService_SetUpSession_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &s2AServiceSetUpSessionClient{ClientStream: stream}
+	x := &grpc.GenericClientStream[SessionReq, SessionResp]{ClientStream: stream}
 	return x, nil
 }

-type S2AService_SetUpSessionClient interface {
-	Send(*SessionReq) error
-	Recv() (*SessionResp, error)
-	grpc.ClientStream
-}
-
-type s2AServiceSetUpSessionClient struct {
-	grpc.ClientStream
-}
-
-func (x *s2AServiceSetUpSessionClient) Send(m *SessionReq) error {
-	return x.ClientStream.SendMsg(m)
-}
-
-func (x *s2AServiceSetUpSessionClient) Recv() (*SessionResp, error) {
-	m := new(SessionResp)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type S2AService_SetUpSessionClient = grpc.BidiStreamingClient[SessionReq, SessionResp]

 // S2AServiceServer is the server API for S2AService service.
 // All implementations must embed UnimplementedS2AServiceServer
-// for forward compatibility
+// for forward compatibility.
 type S2AServiceServer interface {
 	// SetUpSession is a bidirectional stream used by applications to offload
 	// operations from the TLS handshake.
-	SetUpSession(S2AService_SetUpSessionServer) error
+	SetUpSession(grpc.BidiStreamingServer[SessionReq, SessionResp]) error
 	mustEmbedUnimplementedS2AServiceServer()
 }

-// UnimplementedS2AServiceServer must be embedded to have forward compatible implementations.
-type UnimplementedS2AServiceServer struct {
-}
+// UnimplementedS2AServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedS2AServiceServer struct{}

-func (UnimplementedS2AServiceServer) SetUpSession(S2AService_SetUpSessionServer) error {
+func (UnimplementedS2AServiceServer) SetUpSession(grpc.BidiStreamingServer[SessionReq, SessionResp]) error {
 	return status.Errorf(codes.Unimplemented, "method SetUpSession not implemented")
 }
 func (UnimplementedS2AServiceServer) mustEmbedUnimplementedS2AServiceServer() {}
+func (UnimplementedS2AServiceServer) testEmbeddedByValue()                    {}

 // UnsafeS2AServiceServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to S2AServiceServer will
@@ -112,34 +97,22 @@ type UnsafeS2AServiceServer interface {
 }

 func RegisterS2AServiceServer(s grpc.ServiceRegistrar, srv S2AServiceServer) {
+	// If the following call pancis, it indicates UnimplementedS2AServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&S2AService_ServiceDesc, srv)
 }

 func _S2AService_SetUpSession_Handler(srv interface{}, stream grpc.ServerStream) error {
-	return srv.(S2AServiceServer).SetUpSession(&s2AServiceSetUpSessionServer{ServerStream: stream})
+	return srv.(S2AServiceServer).SetUpSession(&grpc.GenericServerStream[SessionReq, SessionResp]{ServerStream: stream})
 }

-type S2AService_SetUpSessionServer interface {
-	Send(*SessionResp) error
-	Recv() (*SessionReq, error)
-	grpc.ServerStream
-}
-
-type s2AServiceSetUpSessionServer struct {
-	grpc.ServerStream
-}
-
-func (x *s2AServiceSetUpSessionServer) Send(m *SessionResp) error {
-	return x.ServerStream.SendMsg(m)
-}
-
-func (x *s2AServiceSetUpSessionServer) Recv() (*SessionReq, error) {
-	m := new(SessionReq)
-	if err := x.ServerStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type S2AService_SetUpSessionServer = grpc.BidiStreamingServer[SessionReq, SessionResp]

 // S2AService_ServiceDesc is the grpc.ServiceDesc for S2AService service.
 // It's only intended for direct use with grpc.RegisterService,
@@ -168,7 +168,8 @@ func (c *s2av2TransportCreds) ClientHandshake(ctx context.Context, serverAuthori
 	}
 	retry.Run(timeoutCtx,
 		func() error {
-			config, err = tlsconfigstore.GetTLSConfigurationForClient(sn, s2AStream, tokenManager, c.localIdentity, c.verificationMode, c.serverAuthorizationPolicy)
+			// The gRPC transport requires HTTP/2, so this path never overrides ALPN.
+			config, err = tlsconfigstore.GetTLSConfigurationForClient(sn, s2AStream, tokenManager, c.localIdentity, c.verificationMode, c.serverAuthorizationPolicy, nil)
 			return err
 		})
 	if err != nil {
@@ -307,14 +308,16 @@ func NewClientTLSConfig(
 	verificationMode s2av2pb.ValidatePeerCertificateChainReq_VerificationMode,
 	serverName string,
 	serverAuthorizationPolicy []byte,
-	getStream stream.GetS2AStream) (*tls.Config, error) {
+	getStream stream.GetS2AStream,
+	localIdentity *commonpb.Identity,
+	nextProtos []string) (*tls.Config, error) {
 	s2AStream, err := createStream(ctx, s2av2Address, transportCreds, getStream)
 	if err != nil {
 		grpclog.Infof("Failed to connect to S2Av2: %v", err)
 		return nil, err
 	}

-	return tlsconfigstore.GetTLSConfigurationForClient(removeServerNamePort(serverName), s2AStream, tokenManager, nil, verificationMode, serverAuthorizationPolicy)
+	return tlsconfigstore.GetTLSConfigurationForClient(removeServerNamePort(serverName), s2AStream, tokenManager, localIdentity, verificationMode, serverAuthorizationPolicy, nextProtos)
 }

 // OverrideServerName sets the ServerName in the s2av2TransportCreds protocol
@@ -25,6 +25,7 @@ import (
 	"encoding/pem"
 	"errors"
 	"fmt"
+	"slices"

 	"github.com/google/s2a-go/internal/tokenmanager"
 	"github.com/google/s2a-go/internal/v2/certverifier"
@@ -42,8 +43,18 @@ const (
 	h2 = "h2"
 )

+// nextProtosOrDefault returns the ALPN protocols to offer during the handshake.
+func nextProtosOrDefault(nextProtos []string) []string {
+	if len(nextProtos) == 0 {
+		return []string{h2}
+	}
+	return slices.Clone(nextProtos)
+}
+
 // GetTLSConfigurationForClient returns a tls.Config instance for use by a client application.
-func GetTLSConfigurationForClient(serverHostname string, s2AStream stream.S2AStream, tokenManager tokenmanager.AccessTokenManager, localIdentity *commonpb.Identity, verificationMode s2av2pb.ValidatePeerCertificateChainReq_VerificationMode, serverAuthorizationPolicy []byte) (*tls.Config, error) {
+// nextProtos sets the ALPN protocols offered during the handshake; if it is
+// empty, the returned config offers HTTP/2 only.
+func GetTLSConfigurationForClient(serverHostname string, s2AStream stream.S2AStream, tokenManager tokenmanager.AccessTokenManager, localIdentity *commonpb.Identity, verificationMode s2av2pb.ValidatePeerCertificateChainReq_VerificationMode, serverAuthorizationPolicy []byte, nextProtos []string) (*tls.Config, error) {
 	authMechanisms := getAuthMechanisms(tokenManager, []*commonpb.Identity{localIdentity})

 	if grpclog.V(1) {
@@ -116,7 +127,7 @@ func GetTLSConfigurationForClient(serverHostname string, s2AStream stream.S2AStr
 		SessionTicketsDisabled: true,
 		MinVersion:             minVersion,
 		MaxVersion:             maxVersion,
-		NextProtos:             []string{h2},
+		NextProtos:             nextProtosOrDefault(nextProtos),
 	}
 	if len(tlsConfig.CertificateChain) > 0 {
 		config.Certificates = []tls.Certificate{cert}
@@ -33,7 +33,7 @@ import (
 	"github.com/google/s2a-go/internal/handshaker"
 	"github.com/google/s2a-go/internal/handshaker/service"
 	"github.com/google/s2a-go/internal/tokenmanager"
-	"github.com/google/s2a-go/internal/v2"
+	v2 "github.com/google/s2a-go/internal/v2"
 	"github.com/google/s2a-go/retry"
 	"github.com/google/s2a-go/stream"
 	"google.golang.org/grpc/credentials"
@@ -305,6 +305,11 @@ type TLSClientConfigOptions struct {
 	//			ServerName: "example.com",
 	//		})
 	ServerName string
+
+	// NextProtos is the list of ALPN protocols offered during the TLS
+	// handshake. If empty, ClientOptions.NextProtos is used; if that is also
+	// empty, HTTP/2 ("h2") is offered.
+	NextProtos []string
 }

 // TLSClientConfigFactory defines the interface for a client TLS config factory.
@@ -320,6 +325,10 @@ func NewTLSClientConfigFactory(opts *ClientOptions) (TLSClientConfigFactory, err
 	if opts.EnableLegacyMode {
 		return nil, fmt.Errorf("NewTLSClientConfigFactory only supports S2Av2")
 	}
+	localIdentity, err := toV2ProtoIdentity(opts.LocalIdentity)
+	if err != nil {
+		return nil, err
+	}
 	tokenManager, err := tokenmanager.NewSingleTokenAccessTokenManager()
 	if err != nil {
 		// The only possible error is: access token not set in the environment,
@@ -332,6 +341,8 @@ func NewTLSClientConfigFactory(opts *ClientOptions) (TLSClientConfigFactory, err
 			verificationMode:          getVerificationMode(opts.VerificationMode),
 			serverAuthorizationPolicy: opts.serverAuthorizationPolicy,
 			getStream:                 opts.getS2AStream,
+			localIdentity:             localIdentity,
+			nextProtos:                opts.NextProtos,
 		}, nil
 	}
 	return &s2aTLSClientConfigFactory{
@@ -341,6 +352,8 @@ func NewTLSClientConfigFactory(opts *ClientOptions) (TLSClientConfigFactory, err
 		verificationMode:          getVerificationMode(opts.VerificationMode),
 		serverAuthorizationPolicy: opts.serverAuthorizationPolicy,
 		getStream:                 opts.getS2AStream,
+		localIdentity:             localIdentity,
+		nextProtos:                opts.NextProtos,
 	}, nil
 }

@@ -351,15 +364,24 @@ type s2aTLSClientConfigFactory struct {
 	verificationMode          s2av2pb.ValidatePeerCertificateChainReq_VerificationMode
 	serverAuthorizationPolicy []byte
 	getStream                 stream.GetS2AStream
+	// localIdentity should only be used by the client.
+	localIdentity *commonpb.Identity
+	nextProtos    []string
 }

 func (f *s2aTLSClientConfigFactory) Build(
 	ctx context.Context, opts *TLSClientConfigOptions) (*tls.Config, error) {
 	serverName := ""
-	if opts != nil && opts.ServerName != "" {
-		serverName = opts.ServerName
+	nextProtos := f.nextProtos
+	if opts != nil {
+		if opts.ServerName != "" {
+			serverName = opts.ServerName
+		}
+		if len(opts.NextProtos) > 0 {
+			nextProtos = opts.NextProtos
+		}
 	}
-	return v2.NewClientTLSConfig(ctx, f.s2av2Address, f.transportCreds, f.tokenManager, f.verificationMode, serverName, f.serverAuthorizationPolicy, f.getStream)
+	return v2.NewClientTLSConfig(ctx, f.s2av2Address, f.transportCreds, f.tokenManager, f.verificationMode, serverName, f.serverAuthorizationPolicy, f.getStream, f.localIdentity, nextProtos)
 }

 func getVerificationMode(verificationMode VerificationModeType) s2av2pb.ValidatePeerCertificateChainReq_VerificationMode {
@@ -376,6 +398,8 @@ func getVerificationMode(verificationMode VerificationModeType) s2av2pb.Validate
 		return s2av2pb.ValidatePeerCertificateChainReq_RESERVED_CUSTOM_VERIFICATION_MODE_5
 	case ReservedCustomVerificationMode6:
 		return s2av2pb.ValidatePeerCertificateChainReq_RESERVED_CUSTOM_VERIFICATION_MODE_6
+	case ReservedCustomVerificationMode7:
+		return s2av2pb.ValidatePeerCertificateChainReq_RESERVED_CUSTOM_VERIFICATION_MODE_7
 	default:
 		return s2av2pb.ValidatePeerCertificateChainReq_UNSPECIFIED
 	}
@@ -94,6 +94,7 @@ const (
 	ReservedCustomVerificationMode4
 	ReservedCustomVerificationMode5
 	ReservedCustomVerificationMode6
+	ReservedCustomVerificationMode7
 )

 // ClientOptions contains the client-side options used to establish a secure
@@ -144,6 +145,17 @@ type ClientOptions struct {
 	// peer certificate chain.
 	VerificationMode VerificationModeType

+	// NextProtos is the list of ALPN protocols offered during the TLS
+	// handshake. If empty, HTTP/2 ("h2") is offered.
+	//
+	// This is only consulted when building a tls.Config for an HTTP client,
+	// via NewTLSClientConfigFactory or NewS2ADialTLSContextFunc. It is ignored
+	// by NewClientCreds, because the gRPC transport requires HTTP/2.
+	//
+	// Set this when the connection will not speak HTTP/2, for example
+	// []string{"http/1.1"} for an HTTP/1.1 client.
+	NextProtos []string
+
 	// Optional fallback after dialing with S2A fails.
 	FallbackOpts *FallbackOptions

@@ -1,3 +1,3 @@
 {
-    "v2": "2.26.2"
+    "v2": "2.27.0"
 }
@@ -1,5 +1,12 @@
 # Changes

+## [2.27.0](https://github.com/googleapis/gax-go/compare/v2.26.2...v2.27.0) (2026-10-21)
+
+
+### Features
+
+* add a path expression helper ([#568](https://github.com/googleapis/gax-go/issues/568)) ([7d7373f](https://github.com/googleapis/gax-go/commit/7d7373f69b2a10796449f9ef1971ebea643c0c3a))
+
 ## [2.26.2](https://github.com/googleapis/gax-go/compare/v2.26.1...v2.26.2) (2026-09-26)


@@ -17,4 +17,4 @@
 package internal

 // Version is the current tagged release of the library.
-const Version = "2.26.2"
+const Version = "2.27.0"
@@ -0,0 +1,53 @@
+// Copyright 2026, Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package gax
+
+import (
+	"errors"
+	"fmt"
+	"slices"
+)
+
+var PathExpressionError = errors.New("invalid values present in values used to construct an HTTP URL")
+
+// This function ensure values being used to construct an HTTP URL path
+// for REST-based SDK transports do not contain problematic values.
+//
+// It will return PathExpressionError if validation fails.
+func ValidatePathExpressions(vals ...any) error {
+	disallowedStringValues := []string{".", ".."}
+	for _, v := range vals {
+		s := fmt.Sprint(v)
+		if slices.Contains(disallowedStringValues, s) {
+			return PathExpressionError
+		}
+	}
+	return nil
+}
@@ -44,30 +44,31 @@ type DialSettings struct {
 	// Deprecated: Use AuthCredentialsFile instead, due to security risk.
 	CredentialsFile string
 	// Deprecated: Use AuthCredentialsJSON instead, due to security risk.
-	CredentialsJSON               []byte
-	InternalCredentials           *google.Credentials
-	UserAgent                     string
-	APIKey                        string
-	Audiences                     []string
-	DefaultAudience               string
-	HTTPClient                    *http.Client
-	GRPCDialOpts                  []grpc.DialOption
-	GRPCConn                      *grpc.ClientConn
-	GRPCConnPool                  ConnPool
-	GRPCConnPoolSize              int
-	NoAuth                        bool
-	TelemetryDisabled             bool
-	ClientCertSource              func(*tls.CertificateRequestInfo) (*tls.Certificate, error)
-	CustomClaims                  map[string]interface{}
-	SkipValidation                bool
-	ImpersonationConfig           *impersonate.Config
-	EnableDirectPath              bool
-	EnableDirectPathXds           bool
-	AllowNonDefaultServiceAccount bool
-	DefaultUniverseDomain         string
-	UniverseDomain                string
-	AllowHardBoundTokens          []string
-	Logger                        *slog.Logger
+	CredentialsJSON                     []byte
+	InternalCredentials                 *google.Credentials
+	UserAgent                           string
+	APIKey                              string
+	Audiences                           []string
+	DefaultAudience                     string
+	HTTPClient                          *http.Client
+	GRPCDialOpts                        []grpc.DialOption
+	GRPCConn                            *grpc.ClientConn
+	GRPCConnPool                        ConnPool
+	GRPCConnPoolSize                    int
+	NoAuth                              bool
+	TelemetryDisabled                   bool
+	ClientCertSource                    func(*tls.CertificateRequestInfo) (*tls.Certificate, error)
+	CustomClaims                        map[string]interface{}
+	SkipValidation                      bool
+	ImpersonationConfig                 *impersonate.Config
+	EnableDirectPath                    bool
+	EnableDirectPathXds                 bool
+	EnableDirectPathXdsOverInterconnect bool
+	AllowNonDefaultServiceAccount       bool
+	DefaultUniverseDomain               string
+	UniverseDomain                      string
+	AllowHardBoundTokens                []string
+	Logger                              *slog.Logger
 	// Google API system parameters. For more information please read:
 	// https://cloud.google.com/apis/docs/system-parameters
 	QuotaProject  string
@@ -5,4 +5,4 @@
 package internal

 // Version is the current tagged release of the library.
-const Version = "0.288.0"
+const Version = "0.304.0"
@@ -110,6 +110,22 @@ func (x enableDirectPathXds) Apply(o *internal.DialSettings) {
 	o.EnableDirectPathXds = bool(x)
 }

+// EnableDirectPathXdsOverInterconnect returns a ClientOption that enables
+// DirectPath xDS over Cloud Interconnect. It is only valid when DirectPath
+// and DirectPath xDS are enabled.
+//
+// It should only be used internally by generated clients.
+// This is an EXPERIMENTAL API and may be changed or removed in the future.
+func EnableDirectPathXdsOverInterconnect() option.ClientOption {
+	return enableDirectPathXdsOverInterconnect(true)
+}
+
+type enableDirectPathXdsOverInterconnect bool
+
+func (x enableDirectPathXdsOverInterconnect) Apply(o *internal.DialSettings) {
+	o.EnableDirectPathXdsOverInterconnect = bool(x)
+}
+
 // AllowNonDefaultServiceAccount returns a ClientOption that overrides the default
 // requirement for using the default service account for DirectPath.
 //
@@ -96,6 +96,15 @@ func (ur *UnsafeResolver) ResolvedEnableDirectPathXds() bool {
 	return ur.ds.EnableDirectPathXds
 }

+// ResolvedEnableDirectPathXdsOverInterconnect returns whether DirectPath xDS over
+// Cloud Interconnect was requested. This corresponds to the
+// EnableDirectPathXdsOverInterconnect option in this package.
+//
+// This is an EXPERIMENTAL API and may be changed or removed in the future.
+func (ur *UnsafeResolver) ResolvedEnableDirectPathXdsOverInterconnect() bool {
+	return ur.ds.EnableDirectPathXdsOverInterconnect
+}
+
 // ResolvedWithoutAuthentication returns whether the option to explicitly disable
 // authentication was requested.  This corresponds to the WithoutAuthentication
 // ClientOption in google.golang.org/option.
@@ -221,16 +221,18 @@ func dialPoolNewAuth(ctx context.Context, secure bool, poolSize int, ds *interna
 			EnableNonDefaultSAForDirectPath: ds.AllowNonDefaultServiceAccount,
 			EnableDirectPath:                ds.EnableDirectPath,
 			EnableDirectPathXds:             ds.EnableDirectPathXds,
-			EnableJWTWithScope:              ds.EnableJwtWithScope,
-			AllowHardBoundTokens:            ds.AllowHardBoundTokens,
-			DefaultAudience:                 ds.DefaultAudience,
-			DefaultEndpointTemplate:         defaultEndpointTemplate,
-			DefaultMTLSEndpoint:             ds.DefaultMTLSEndpoint,
-			DefaultScopes:                   ds.DefaultScopes,
-			SkipValidation:                  skipValidation,
-			TelemetryAttributes:             ds.TelemetryAttributes,
+			// TODO(https://github.com/googleapis/google-cloud-go/pull/20559): Bump cloud.google.com/go/auth in go.mod once released.
+			EnableDirectPathXdsOverInterconnect: ds.EnableDirectPathXdsOverInterconnect,
+			EnableJWTWithScope:                  ds.EnableJwtWithScope,
+			AllowHardBoundTokens:                ds.AllowHardBoundTokens,
+			DefaultAudience:                     ds.DefaultAudience,
+			DefaultEndpointTemplate:             defaultEndpointTemplate,
+			DefaultMTLSEndpoint:                 ds.DefaultMTLSEndpoint,
+			DefaultScopes:                       ds.DefaultScopes,
+			SkipValidation:                      skipValidation,
+			TelemetryAttributes:                 ds.TelemetryAttributes,
 		},
-		UniverseDomain: ds.UniverseDomain,
+		UniverseDomain: ds.GetUniverseDomain(),
 		Logger:         ds.Logger,
 	})
 	return pool, err
@@ -135,7 +135,7 @@ func newClientNewAuth(ctx context.Context, base http.RoundTripper, ds *internal.
 			SkipValidation:          skipValidation,
 			TelemetryAttributes:     ds.TelemetryAttributes,
 		},
-		UniverseDomain: ds.UniverseDomain,
+		UniverseDomain: ds.GetUniverseDomain(),
 		Logger:         ds.Logger,
 	})
 	if err != nil {
@@ -1,8 +1,8 @@
 # cloud.google.com/go v0.123.0
 ## explicit; go 1.24.0
 cloud.google.com/go
-# cloud.google.com/go/auth v0.20.0
-## explicit; go 1.25.0
+# cloud.google.com/go/auth v0.24.1-0.20261001053825-dbc26066f70a
+## explicit; go 1.26.0
 cloud.google.com/go/auth
 cloud.google.com/go/auth/credentials
 cloud.google.com/go/auth/credentials/internal/externalaccount
@@ -16,18 +16,18 @@ cloud.google.com/go/auth/internal
 cloud.google.com/go/auth/internal/compute
 cloud.google.com/go/auth/internal/credsfile
 cloud.google.com/go/auth/internal/jwt
+cloud.google.com/go/auth/internal/regionalaccessboundary
 cloud.google.com/go/auth/internal/retry
 cloud.google.com/go/auth/internal/transport
 cloud.google.com/go/auth/internal/transport/cert
 cloud.google.com/go/auth/internal/transport/headers
-cloud.google.com/go/auth/internal/trustboundary
-# cloud.google.com/go/auth/oauth2adapt v0.2.8
-## explicit; go 1.23.0
+# cloud.google.com/go/auth/oauth2adapt v0.3.0
+## explicit; go 1.26.0
 cloud.google.com/go/auth/oauth2adapt
 # cloud.google.com/go/compute/metadata v0.10.0
 ## explicit; go 1.26.0
 cloud.google.com/go/compute/metadata
-# cloud.google.com/go/logging v1.21.0
+# cloud.google.com/go/logging v1.21.1
 ## explicit; go 1.26.0
 cloud.google.com/go/logging
 cloud.google.com/go/logging/apiv2
@@ -918,7 +918,7 @@ github.com/google/go-cmp/cmp/internal/value
 # github.com/google/go-containerregistry v0.22.0
 ## explicit; go 1.25.0
 github.com/google/go-containerregistry/pkg/name
-# github.com/google/s2a-go v0.1.9
+# github.com/google/s2a-go v0.1.11
 ## explicit; go 1.20
 github.com/google/s2a-go
 github.com/google/s2a-go/fallback
@@ -947,11 +947,11 @@ github.com/google/shlex
 # github.com/google/uuid v1.6.0
 ## explicit
 github.com/google/uuid
-# github.com/googleapis/enterprise-certificate-proxy v0.3.17
+# github.com/googleapis/enterprise-certificate-proxy v0.3.23
 ## explicit; go 1.25.0
 github.com/googleapis/enterprise-certificate-proxy/client
 github.com/googleapis/enterprise-certificate-proxy/client/util
-# github.com/googleapis/gax-go/v2 v2.26.2
+# github.com/googleapis/gax-go/v2 v2.27.0
 ## explicit; go 1.26.0
 github.com/googleapis/gax-go/v2
 github.com/googleapis/gax-go/v2/apierror
@@ -2070,8 +2070,8 @@ golang.org/x/text/unicode/norm
 # golang.org/x/time v0.16.0
 ## explicit; go 1.26.0
 golang.org/x/time/rate
-# google.golang.org/api v0.288.0
-## explicit; go 1.25.0
+# google.golang.org/api v0.304.0
+## explicit; go 1.26.0
 google.golang.org/api/googleapi
 google.golang.org/api/googleapi/transport
 google.golang.org/api/internal
@@ -2085,10 +2085,10 @@ google.golang.org/api/option/internaloption
 google.golang.org/api/support/bundler
 google.golang.org/api/transport/grpc
 google.golang.org/api/transport/http
-# google.golang.org/genproto v0.0.0-20260928230214-8a89bd6388cc
+# google.golang.org/genproto v0.0.0-20261012220534-4341edf3f941
 ## explicit; go 1.26.0
 google.golang.org/genproto/googleapis/logging/type
-# google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc
+# google.golang.org/genproto/googleapis/api v0.0.0-20261012220534-4341edf3f941
 ## explicit; go 1.26.0
 google.golang.org/genproto/googleapis/api
 google.golang.org/genproto/googleapis/api/annotations
@@ -2097,7 +2097,7 @@ google.golang.org/genproto/googleapis/api/httpbody
 google.golang.org/genproto/googleapis/api/label
 google.golang.org/genproto/googleapis/api/metric
 google.golang.org/genproto/googleapis/api/monitoredres
-# google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc
+# google.golang.org/genproto/googleapis/rpc v0.0.0-20261012220534-4341edf3f941
 ## explicit; go 1.26.0
 google.golang.org/genproto/googleapis/rpc/code
 google.golang.org/genproto/googleapis/rpc/errdetails