Merge pull request #32246 from aboch/vnd

Vendoring swarmkit @b74ec2b

integration-cli/docker_cli_swarm_test.go

@@ -468,6 +468,24 @@ func (s *DockerSwarmSuite) TestSwarmIngressNetwork(c *check.C) {
 	c.Assert(err, checker.IsNil, check.Commentf(out))
 }
 
+func (s *DockerSwarmSuite) TestSwarmCreateServiceWithNoIngressNetwork(c *check.C) {
+	d := s.AddDaemon(c, true, true)
+
+	// Remove ingress network
+	out, _, err := testutil.RunCommandPipelineWithOutput(
+		exec.Command("echo", "Y"),
+		exec.Command("docker", "-H", d.Sock(), "network", "rm", "ingress"),
+	)
+	c.Assert(err, checker.IsNil, check.Commentf(out))
+
+	// Create a overlay network and launch a service on it
+	// Make sure nothing panics because ingress network is missing
+	out, err = d.Cmd("network", "create", "-d", "overlay", "another-network")
+	c.Assert(err, checker.IsNil, check.Commentf(out))
+	out, err = d.Cmd("service", "create", "--name", "srv4", "--network", "another-network", "busybox", "top")
+	c.Assert(err, checker.IsNil, check.Commentf(out))
+}
+
 // Test case for #24108, also the case from:
 // https://github.com/docker/docker/pull/24620#issuecomment-233715656
 func (s *DockerSwarmSuite) TestSwarmTaskListFilter(c *check.C) {

vendor.conf

@@ -105,7 +105,7 @@ github.com/docker/containerd 422e31ce907fd9c3833a38d7b8fdd023e5a76e73
 github.com/tonistiigi/fifo 1405643975692217d6720f8b54aeee1bf2cd5cf4
 
 # cluster
-github.com/docker/swarmkit 970b45afa1c9da9ed4b9c793669cedbb05ad3833
+github.com/docker/swarmkit b74ec2b81bb1d4a998f461bb2dc59b9408b7790f
 github.com/golang/mock bd3c8e81be01eef76d4b503f5e687d2d1354d2d9
 github.com/gogo/protobuf 8d70fb3182befc465c4a1eac8ad4d38ff49778e2
 github.com/cloudflare/cfssl 7fb22c8cba7ecaf98e4082d22d65800cf45e042a

vendor/github.com/docker/swarmkit/api/ca.pb.go

@@ -215,6 +215,10 @@ func (m *IssueNodeCertificateRequest) CopyFrom(src interface{}) {
 
 	o := src.(*IssueNodeCertificateRequest)
 	*m = *o
+	if o.CSR != nil {
+		m.CSR = make([]byte, len(o.CSR))
+		copy(m.CSR, o.CSR)
+	}
 }
 
 func (m *IssueNodeCertificateResponse) Copy() *IssueNodeCertificateResponse {
@@ -255,6 +259,10 @@ func (m *GetRootCACertificateResponse) CopyFrom(src interface{}) {
 
 	o := src.(*GetRootCACertificateResponse)
 	*m = *o
+	if o.Certificate != nil {
+		m.Certificate = make([]byte, len(o.Certificate))
+		copy(m.Certificate, o.Certificate)
+	}
 }
 
 func (m *GetUnlockKeyRequest) Copy() *GetUnlockKeyRequest {
@@ -280,6 +288,10 @@ func (m *GetUnlockKeyResponse) CopyFrom(src interface{}) {
 
 	o := src.(*GetUnlockKeyResponse)
 	*m = *o
+	if o.UnlockKey != nil {
+		m.UnlockKey = make([]byte, len(o.UnlockKey))
+		copy(m.UnlockKey, o.UnlockKey)
+	}
 	github_com_docker_swarmkit_api_deepcopy.Copy(&m.Version, &o.Version)
 }
 

vendor/github.com/docker/swarmkit/api/control.pb.go

@@ -234,7 +234,8 @@ func (*CreateServiceResponse) ProtoMessage()               {}
 func (*CreateServiceResponse) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{15} }
 
 type GetServiceRequest struct {
-	ServiceID string `protobuf:"bytes,1,opt,name=service_id,json=serviceId,proto3" json:"service_id,omitempty"`
+	ServiceID      string `protobuf:"bytes,1,opt,name=service_id,json=serviceId,proto3" json:"service_id,omitempty"`
+	InsertDefaults bool   `protobuf:"varint,2,opt,name=insert_defaults,json=insertDefaults,proto3" json:"insert_defaults,omitempty"`
 }
 
 func (m *GetServiceRequest) Reset()                    { *m = GetServiceRequest{} }
@@ -3604,6 +3605,16 @@ func (m *GetServiceRequest) MarshalTo(dAtA []byte) (int, error) {
 		i = encodeVarintControl(dAtA, i, uint64(len(m.ServiceID)))
 		i += copy(dAtA[i:], m.ServiceID)
 	}
+	if m.InsertDefaults {
+		dAtA[i] = 0x10
+		i++
+		if m.InsertDefaults {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i++
+	}
 	return i, nil
 }
 
@@ -6105,6 +6116,9 @@ func (m *GetServiceRequest) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovControl(uint64(l))
 	}
+	if m.InsertDefaults {
+		n += 2
+	}
 	return n
 }
 
@@ -6833,6 +6847,7 @@ func (this *GetServiceRequest) String() string {
 	}
 	s := strings.Join([]string{`&GetServiceRequest{`,
 		`ServiceID:` + fmt.Sprintf("%v", this.ServiceID) + `,`,
+		`InsertDefaults:` + fmt.Sprintf("%v", this.InsertDefaults) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -9448,6 +9463,26 @@ func (m *GetServiceRequest) Unmarshal(dAtA []byte) error {
 			}
 			m.ServiceID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field InsertDefaults", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowControl
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.InsertDefaults = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipControl(dAtA[iNdEx:])
@@ -13463,124 +13498,125 @@ var (
 func init() { proto.RegisterFile("control.proto", fileDescriptorControl) }
 
 var fileDescriptorControl = []byte{
-	// 1894 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xcc, 0x5a, 0x4f, 0x6f, 0xdb, 0x46,
-	0x16, 0xb7, 0xfe, 0xd8, 0x92, 0x9e, 0x2c, 0xd9, 0x1e, 0x2b, 0x59, 0x41, 0xc9, 0xda, 0x06, 0xb3,
-	0x71, 0xe4, 0x85, 0x57, 0xde, 0x28, 0x1b, 0x6c, 0x36, 0x8b, 0xfd, 0x13, 0x5b, 0x49, 0x56, 0x71,
-	0xe2, 0x04, 0xb4, 0x1d, 0xec, 0x4d, 0x90, 0xa5, 0x89, 0xcb, 0x48, 0x16, 0x55, 0x92, 0x72, 0x62,
-	0xf4, 0xd2, 0x16, 0xe9, 0x47, 0x28, 0xd0, 0x6b, 0xaf, 0x2d, 0xd0, 0x43, 0x4f, 0xf9, 0x08, 0x41,
-	0x4f, 0x3d, 0x16, 0x28, 0x60, 0x34, 0x02, 0x0a, 0xf4, 0xd4, 0xcf, 0x50, 0xcc, 0x3f, 0x92, 0xa2,
-	0x86, 0xa4, 0x64, 0x0b, 0x70, 0x4f, 0x21, 0x87, 0xbf, 0x37, 0xef, 0xcd, 0xbc, 0xdf, 0xfc, 0xf4,
-	0xe6, 0x39, 0x90, 0x69, 0xe8, 0x1d, 0xcb, 0xd0, 0xdb, 0xa5, 0xae, 0xa1, 0x5b, 0x3a, 0x42, 0x4d,
-	0xbd, 0xd1, 0xc2, 0x46, 0xc9, 0x7c, 0x55, 0x37, 0x8e, 0x5a, 0x9a, 0x55, 0x3a, 0xbe, 0x59, 0x48,
-	0x9b, 0x5d, 0xdc, 0x30, 0x19, 0xa0, 0x90, 0xd1, 0x0f, 0x5e, 0xe2, 0x86, 0x25, 0x5e, 0xd3, 0xd6,
-	0x49, 0x17, 0x8b, 0x97, 0xdc, 0xa1, 0x7e, 0xa8, 0xd3, 0xc7, 0x0d, 0xf2, 0xc4, 0x47, 0x17, 0xbb,
-	0xed, 0xde, 0xa1, 0xd6, 0xd9, 0x60, 0xff, 0xb0, 0x41, 0xe5, 0x36, 0x64, 0x1f, 0x62, 0x6b, 0x47,
-	0x6f, 0x62, 0x15, 0x7f, 0xd8, 0xc3, 0xa6, 0x85, 0xae, 0x41, 0xa2, 0xa3, 0x37, 0x71, 0x4d, 0x6b,
-	0xe6, 0x23, 0x2b, 0x91, 0x62, 0x6a, 0x13, 0xfa, 0xa7, 0xcb, 0x33, 0x04, 0x51, 0xad, 0xa8, 0x33,
-	0xe4, 0x53, 0xb5, 0xa9, 0xfc, 0x07, 0xe6, 0x6c, 0x33, 0xb3, 0xab, 0x77, 0x4c, 0x8c, 0xd6, 0x21,
-	0x4e, 0x3e, 0x52, 0xa3, 0x74, 0x39, 0x5f, 0x1a, 0x5e, 0x40, 0x89, 0xe2, 0x29, 0x4a, 0x39, 0x8d,
-	0xc1, 0xfc, 0x63, 0xcd, 0xa4, 0x53, 0x98, 0xc2, 0xf5, 0x03, 0x48, 0xbc, 0xd0, 0xda, 0x16, 0x36,
-	0x4c, 0x3e, 0xcb, 0xba, 0x6c, 0x16, 0xaf, 0x59, 0xe9, 0x01, 0xb3, 0x51, 0x85, 0x71, 0xe1, 0x93,
-	0x18, 0x24, 0xf8, 0x20, 0xca, 0xc1, 0x74, 0xa7, 0x7e, 0x84, 0xc9, 0x8c, 0xb1, 0x62, 0x4a, 0x65,
-	0x2f, 0x68, 0x03, 0xd2, 0x5a, 0xb3, 0xd6, 0x35, 0xf0, 0x0b, 0xed, 0x35, 0x36, 0xf3, 0x51, 0xf2,
-	0x6d, 0x33, 0xdb, 0x3f, 0x5d, 0x86, 0x6a, 0xe5, 0x19, 0x1f, 0x55, 0x41, 0x6b, 0x8a, 0x67, 0xf4,
-	0x0c, 0x66, 0xda, 0xf5, 0x03, 0xdc, 0x36, 0xf3, 0xb1, 0x95, 0x58, 0x31, 0x5d, 0xbe, 0x33, 0x4e,
-	0x64, 0xa5, 0xc7, 0xd4, 0xf4, 0x7e, 0xc7, 0x32, 0x4e, 0x54, 0x3e, 0x0f, 0xaa, 0x42, 0xfa, 0x08,
-	0x1f, 0x1d, 0x60, 0xc3, 0xfc, 0x40, 0xeb, 0x9a, 0xf9, 0xf8, 0x4a, 0xac, 0x98, 0x2d, 0xdf, 0xf0,
-	0xdb, 0xb6, 0xdd, 0x2e, 0x6e, 0x94, 0x9e, 0xd8, 0x78, 0xd5, 0x6d, 0x8b, 0xca, 0x30, 0x6d, 0xe8,
-	0x6d, 0x6c, 0xe6, 0xa7, 0xe9, 0x24, 0x57, 0x7d, 0xf7, 0x5e, 0x6f, 0x63, 0x95, 0x41, 0xd1, 0x35,
-	0xc8, 0x90, 0xad, 0x70, 0xf6, 0x60, 0x86, 0xee, 0xcf, 0x2c, 0x19, 0x14, 0xab, 0x2e, 0xfc, 0x03,
-	0xd2, 0xae, 0xd0, 0xd1, 0x3c, 0xc4, 0x5a, 0xf8, 0x84, 0xd1, 0x42, 0x25, 0x8f, 0x64, 0x77, 0x8f,
-	0xeb, 0xed, 0x1e, 0xce, 0x47, 0xe9, 0x18, 0x7b, 0xb9, 0x1b, 0xbd, 0x13, 0x51, 0xb6, 0x60, 0xc1,
-	0xb5, 0x1d, 0x9c, 0x23, 0x25, 0x98, 0x26, 0xd9, 0x67, 0xc9, 0x08, 0x22, 0x09, 0x83, 0x29, 0x5f,
-	0x45, 0x60, 0x61, 0xbf, 0xdb, 0xac, 0x5b, 0x78, 0x5c, 0x86, 0xa2, 0x7f, 0xc3, 0x2c, 0x05, 0x1d,
-	0x63, 0xc3, 0xd4, 0xf4, 0x0e, 0x0d, 0x30, 0x5d, 0xbe, 0x22, 0xf3, 0xf8, 0x9c, 0x41, 0xd4, 0x34,
-	0x31, 0xe0, 0x2f, 0xe8, 0xaf, 0x10, 0x27, 0xc7, 0x2d, 0x1f, 0xa3, 0x76, 0x57, 0x83, 0xf2, 0xa2,
-	0x52, 0xa4, 0xb2, 0x09, 0xc8, 0x1d, 0xeb, 0x99, 0x8e, 0xc5, 0x0e, 0x2c, 0xa8, 0xf8, 0x48, 0x3f,
-	0x1e, 0x7f, 0xbd, 0x39, 0x98, 0x7e, 0xa1, 0x1b, 0x0d, 0x96, 0x89, 0xa4, 0xca, 0x5e, 0x94, 0x1c,
-	0x20, 0xf7, 0x7c, 0x2c, 0x26, 0x7e, 0xe8, 0xf7, 0xea, 0x66, 0xcb, 0xe5, 0xc2, 0xaa, 0x9b, 0x2d,
-	0x8f, 0x0b, 0x82, 0x20, 0x2e, 0xc8, 0x27, 0xfb, 0xd0, 0x33, 0x33, 0x67, 0x75, 0xe4, 0x63, 0xd0,
-	0xea, 0x28, 0x9e, 0xa2, 0x94, 0x3b, 0x62, 0x75, 0x63, 0xbb, 0xb6, 0xd7, 0xe1, 0xf6, 0xae, 0xbc,
-	0x8d, 0x33, 0x11, 0x21, 0x83, 0x67, 0x10, 0x11, 0xb7, 0xd9, 0xb0, 0x88, 0xfc, 0x78, 0x81, 0x22,
-	0x22, 0x8b, 0x4c, 0x2a, 0x22, 0x1b, 0x90, 0x36, 0xb1, 0x71, 0xac, 0x35, 0x08, 0x3b, 0x98, 0x88,
-	0xf0, 0x10, 0x76, 0xd9, 0x70, 0xb5, 0x62, 0xaa, 0xc0, 0x21, 0xd5, 0xa6, 0x89, 0x56, 0x21, 0xc9,
-	0xb9, 0xc4, 0xd4, 0x22, 0xb5, 0x99, 0xee, 0x9f, 0x2e, 0x27, 0x18, 0x99, 0x4c, 0x35, 0xc1, 0xd8,
-	0x64, 0xa2, 0x0a, 0x64, 0x9b, 0xd8, 0xd4, 0x0c, 0xdc, 0xac, 0x99, 0x56, 0xdd, 0xe2, 0xfa, 0x90,
-	0x2d, 0xff, 0xd1, 0x2f, 0xc5, 0xbb, 0x04, 0xa5, 0x66, 0xb8, 0x11, 0x7d, 0x93, 0x88, 0x4c, 0x62,
-	0x58, 0x64, 0xd0, 0x55, 0x80, 0x5e, 0xb7, 0x66, 0xe9, 0x35, 0x72, 0x76, 0xf2, 0x49, 0x4a, 0xdf,
-	0x64, 0xaf, 0xbb, 0xa7, 0x57, 0xea, 0x16, 0x46, 0x05, 0x48, 0x1a, 0xbd, 0x8e, 0xa5, 0x91, 0xdd,
-	0x4f, 0x51, 0x6b, 0xfb, 0x7d, 0x02, 0xf2, 0xc4, 0x37, 0xda, 0x91, 0x27, 0xc2, 0xb7, 0x40, 0x79,
-	0xa2, 0x04, 0x64, 0x30, 0x65, 0x1b, 0x72, 0x5b, 0x06, 0xae, 0x5b, 0x98, 0x6f, 0xb6, 0xa0, 0xe0,
-	0x2d, 0xae, 0x1d, 0x8c, 0x7f, 0xcb, 0xb2, 0x69, 0xb8, 0x85, 0x4b, 0x3e, 0x76, 0xe0, 0x92, 0x67,
-	0x32, 0x1e, 0xd5, 0x6d, 0x48, 0xf0, 0x04, 0xf2, 0x09, 0xaf, 0x04, 0x4c, 0xa8, 0x0a, 0xac, 0x72,
-	0x0f, 0x16, 0x1e, 0x62, 0xcb, 0x13, 0xd9, 0x3a, 0x80, 0xc3, 0x17, 0x7e, 0xde, 0x32, 0xfd, 0xd3,
-	0xe5, 0x94, 0x4d, 0x17, 0x35, 0x65, 0xb3, 0x45, 0xd9, 0x06, 0xe4, 0x9e, 0xe2, 0x7c, 0xf1, 0x7c,
-	0x1b, 0x85, 0x1c, 0xd3, 0xc7, 0xf3, 0xc4, 0x84, 0x2a, 0x30, 0x27, 0xd0, 0x63, 0x48, 0x7b, 0x96,
-	0xdb, 0x08, 0x75, 0xbf, 0x35, 0xa0, 0xee, 0xa3, 0x65, 0x08, 0x3d, 0x81, 0xa4, 0xa1, 0xb7, 0xdb,
-	0x07, 0xf5, 0x46, 0x2b, 0x1f, 0x5f, 0x89, 0x14, 0xb3, 0xe5, 0x9b, 0x32, 0x43, 0xd9, 0x22, 0x4b,
-	0x2a, 0x37, 0x54, 0xed, 0x29, 0x14, 0x05, 0x92, 0x62, 0x14, 0x25, 0x21, 0xbe, 0xf3, 0x74, 0xe7,
-	0xfe, 0xfc, 0x14, 0x9a, 0x85, 0xe4, 0x33, 0xf5, 0xfe, 0xf3, 0xea, 0xd3, 0xfd, 0xdd, 0xf9, 0x08,
-	0x21, 0x85, 0x67, 0xba, 0xf3, 0x25, 0xa1, 0x02, 0x39, 0xa6, 0xa3, 0xe7, 0xe2, 0xc5, 0x1f, 0xe0,
-	0x92, 0x67, 0x16, 0x2e, 0xc8, 0x6f, 0x62, 0xb0, 0x48, 0x8e, 0x15, 0x1f, 0xb7, 0x35, 0xb9, 0xea,
-	0xd5, 0xe4, 0x0d, 0x3f, 0xe5, 0xf3, 0x58, 0x0e, 0xcb, 0xf2, 0x97, 0xd1, 0x89, 0xcb, 0xf2, 0xae,
-	0x47, 0x96, 0xff, 0x39, 0x66, 0x70, 0x52, 0x65, 0x1e, 0x92, 0xbe, 0xb8, 0x44, 0xfa, 0xdc, 0xe2,
-	0x36, 0x3d, 0x39, 0x71, 0x7b, 0x0a, 0xb9, 0xc1, 0x70, 0x39, 0x69, 0xfe, 0x0e, 0x49, 0x9e, 0x44,
-	0x21, 0x71, 0x81, 0xac, 0xb1, 0xc1, 0x8e, 0xd0, 0xed, 0x60, 0xeb, 0x95, 0x6e, 0xb4, 0xc6, 0x10,
-	0x3a, 0x6e, 0x21, 0x13, 0x3a, 0x7b, 0x32, 0x87, 0xd3, 0x1d, 0x36, 0x14, 0xc4, 0x69, 0x61, 0x25,
-	0xb0, 0xca, 0x3e, 0x15, 0x3a, 0x4f, 0x64, 0x08, 0xe2, 0x64, 0xa7, 0xf9, 0x7e, 0xd1, 0x67, 0x42,
-	0x72, 0x6e, 0x43, 0x48, 0x1e, 0x75, 0x48, 0xce, 0x6d, 0x09, 0xc9, 0x39, 0xc0, 0x16, 0xbf, 0x09,
-	0xc5, 0xf8, 0x7f, 0x71, 0xee, 0x26, 0x1e, 0xa6, 0x7d, 0x16, 0x3d, 0x91, 0x2a, 0xbf, 0x44, 0xd9,
-	0x59, 0xe4, 0xe3, 0x67, 0x38, 0x8b, 0x1e, 0xcb, 0xe1, 0xb3, 0xf8, 0xd9, 0x05, 0x9e, 0x45, 0x9f,
-	0xe0, 0xce, 0x7c, 0x16, 0x27, 0x70, 0xde, 0x9c, 0x90, 0x9c, 0xf3, 0xc6, 0x13, 0x15, 0x78, 0xde,
-	0x44, 0xe6, 0x6c, 0x30, 0xff, 0xed, 0xde, 0x6a, 0xf7, 0x4c, 0x0b, 0x1b, 0x2e, 0x8d, 0x6e, 0xb0,
-	0x11, 0x8f, 0x46, 0x73, 0x1c, 0xe1, 0x05, 0x07, 0xd8, 0xf4, 0xb5, 0xa7, 0x70, 0xe8, 0xcb, 0x21,
-	0x41, 0xf4, 0x15, 0x56, 0x02, 0x6b, 0x73, 0x89, 0x7f, 0x38, 0x03, 0x97, 0x3c, 0x96, 0xbf, 0x2f,
-	0x2e, 0xf9, 0x04, 0x77, 0x91, 0x5c, 0x72, 0x42, 0x72, 0xb8, 0xc4, 0xb3, 0x11, 0xc8, 0x25, 0x91,
-	0x3a, 0x1b, 0xac, 0x7c, 0x1e, 0x81, 0xf4, 0x36, 0x3e, 0x51, 0x75, 0xab, 0x6e, 0x91, 0xd2, 0xe7,
-	0xcf, 0xb0, 0x40, 0x48, 0x86, 0x8d, 0xda, 0x4b, 0x5d, 0xeb, 0xd4, 0x2c, 0xbd, 0x85, 0x3b, 0x34,
-	0xb4, 0xa4, 0x3a, 0xc7, 0x3e, 0x3c, 0xd2, 0xb5, 0xce, 0x1e, 0x19, 0x46, 0xeb, 0x80, 0x8e, 0xea,
-	0x9d, 0xfa, 0xe1, 0x20, 0x98, 0xdd, 0x30, 0xe7, 0xf9, 0x17, 0x29, 0xba, 0xd7, 0x69, 0xeb, 0x8d,
-	0x56, 0x8d, 0xac, 0x3a, 0x36, 0x80, 0xde, 0xa7, 0x1f, 0xb6, 0xf1, 0x89, 0xf2, 0xa9, 0x5d, 0x0f,
-	0x9e, 0x87, 0xe7, 0xa4, 0x1e, 0x14, 0xe8, 0x71, 0xea, 0x41, 0x6e, 0x33, 0x46, 0x3d, 0xc8, 0xbd,
-	0xbb, 0xea, 0xc1, 0x7b, 0xa4, 0x1e, 0x64, 0xbb, 0x4a, 0xeb, 0x41, 0x1f, 0x43, 0xd7, 0xe6, 0x6f,
-	0xc6, 0xdf, 0x9d, 0x2e, 0x4f, 0xa9, 0xb6, 0x99, 0x53, 0xdf, 0x4d, 0xe8, 0xa0, 0xfe, 0x0b, 0xe6,
-	0x69, 0xc5, 0xde, 0x30, 0xb0, 0x25, 0xf6, 0x73, 0x0d, 0x52, 0x26, 0x1d, 0x70, 0xb6, 0x73, 0xb6,
-	0x7f, 0xba, 0x9c, 0x64, 0xa8, 0x6a, 0x85, 0xfc, 0xce, 0xd3, 0xa7, 0xa6, 0xf2, 0x90, 0xdf, 0x19,
-	0x98, 0x39, 0x0f, 0xa5, 0x0c, 0x33, 0x0c, 0xc0, 0x23, 0x29, 0xc8, 0x6b, 0x06, 0x6a, 0xc3, 0x91,
-	0xca, 0xdb, 0x08, 0x2c, 0x8a, 0xc2, 0xf5, 0x6c, 0xb1, 0xa0, 0x4d, 0xc8, 0x72, 0xe8, 0x18, 0x79,
-	0xcd, 0x30, 0x13, 0x91, 0xd6, 0xf2, 0x40, 0x5a, 0x97, 0xfc, 0x03, 0x77, 0x95, 0x27, 0x8f, 0x9c,
-	0x6b, 0xca, 0xb9, 0xb7, 0xe1, 0xe7, 0x28, 0x20, 0x56, 0x89, 0x91, 0x57, 0x5b, 0x36, 0xff, 0xe7,
-	0x95, 0xcd, 0x92, 0x7f, 0xc5, 0xe9, 0x36, 0x1c, 0x56, 0xcd, 0x37, 0x93, 0x57, 0x4d, 0xd5, 0xa3,
-	0x9a, 0x77, 0xc7, 0x8b, 0xed, 0x42, 0x44, 0x73, 0x5b, 0x5c, 0x3b, 0x78, 0x44, 0x3c, 0x65, 0x7f,
-	0x23, 0x97, 0x24, 0x3a, 0xc4, 0x25, 0x33, 0x28, 0x67, 0x02, 0xaa, 0x54, 0x61, 0x51, 0x5c, 0xc4,
-	0xdd, 0xd4, 0x2d, 0x0f, 0xd4, 0xba, 0x23, 0x73, 0x69, 0x70, 0xaa, 0x73, 0x70, 0xe9, 0xbf, 0xb0,
-	0x28, 0x2e, 0x5d, 0x67, 0x3c, 0xdd, 0x97, 0x9d, 0xcb, 0x9f, 0x3b, 0x9a, 0xf2, 0xd7, 0x97, 0x21,
-	0xb1, 0xc5, 0xfe, 0xfa, 0x80, 0x34, 0x48, 0xf0, 0xc6, 0x3e, 0x52, 0x64, 0x41, 0x0d, 0xfe, 0xb1,
-	0xa0, 0x70, 0x2d, 0x10, 0xc3, 0x2b, 0xd1, 0x4b, 0xdf, 0x7d, 0xf3, 0xeb, 0x17, 0xd1, 0x39, 0xc8,
-	0x50, 0xd0, 0x5f, 0xf8, 0x2f, 0x01, 0xd2, 0x21, 0x65, 0x77, 0x88, 0xd1, 0x9f, 0x46, 0xe9, 0xa7,
-	0x17, 0xae, 0x87, 0xa0, 0x82, 0x1d, 0x1a, 0x00, 0x4e, 0x83, 0x16, 0x5d, 0xf7, 0xbf, 0xbb, 0xbb,
-	0x57, 0xb8, 0x1a, 0x06, 0x0b, 0xf5, 0xe9, 0x34, 0x60, 0xe5, 0x3e, 0x87, 0x1a, 0xbe, 0x72, 0x9f,
-	0x92, 0x3e, 0xae, 0x8f, 0x4f, 0x96, 0xc3, 0xbd, 0xba, 0xd9, 0xf2, 0xcd, 0xa1, 0xab, 0x01, 0xeb,
-	0x9b, 0xc3, 0x81, 0x56, 0x6b, 0x70, 0x0e, 0x69, 0x1b, 0xcd, 0x3f, 0x87, 0xee, 0x76, 0xa6, 0x7f,
-	0x0e, 0x07, 0x7a, 0x71, 0xa1, 0xfb, 0x49, 0x97, 0x17, 0xb0, 0x9f, 0xee, 0x15, 0xae, 0x86, 0xc1,
-	0x42, 0x7d, 0x3a, 0x6d, 0x30, 0xb9, 0xcf, 0xa1, 0x4e, 0x9b, 0xdc, 0xe7, 0x70, 0x37, 0xcd, 0xcf,
-	0xe7, 0x6b, 0x98, 0x75, 0x5f, 0xe1, 0xd1, 0x8d, 0x11, 0x7b, 0x12, 0x85, 0x62, 0x38, 0x30, 0xd8,
-	0xf3, 0x47, 0x90, 0x19, 0xe8, 0x43, 0x22, 0xe9, 0x8c, 0xb2, 0xbe, 0x67, 0x61, 0x6d, 0x04, 0x64,
-	0xa8, 0xf3, 0x81, 0x7e, 0x97, 0xdc, 0xb9, 0xac, 0xc3, 0x26, 0x77, 0x2e, 0x6d, 0x9e, 0x05, 0x38,
-	0x1f, 0x68, 0x6b, 0xc9, 0x9d, 0xcb, 0xfa, 0x67, 0x72, 0xe7, 0xf2, 0x1e, 0x59, 0x20, 0xc9, 0xf8,
-	0x55, 0xd0, 0x97, 0x64, 0x83, 0xed, 0x03, 0x5f, 0x92, 0x79, 0x7b, 0x01, 0xc1, 0x24, 0x13, 0xf7,
-	0x56, 0x7f, 0x92, 0x79, 0x2e, 0xdb, 0xfe, 0x24, 0xf3, 0x5e, 0x81, 0x43, 0x49, 0x26, 0x16, 0x1c,
-	0x40, 0x32, 0xcf, 0x9a, 0xd7, 0x46, 0x40, 0x8e, 0x98, 0xe7, 0x40, 0xe7, 0xb2, 0x7e, 0x4d, 0x50,
-	0x9e, 0x47, 0x74, 0xce, 0xf2, 0xcc, 0x0b, 0x77, 0xdf, 0x3c, 0x0f, 0x5e, 0x89, 0x7c, 0xf3, 0xec,
-	0xb9, 0x35, 0x84, 0xe4, 0x59, 0xdc, 0x29, 0xfd, 0xf3, 0xec, 0xb9, 0x08, 0xfb, 0xe7, 0xd9, 0x7b,
-	0x3d, 0x0d, 0x3d, 0xcf, 0x62, 0xc1, 0x01, 0xe7, 0xd9, 0xb3, 0xe6, 0xb5, 0x11, 0x90, 0xa1, 0x3f,
-	0x4e, 0xf6, 0x6d, 0x46, 0xfe, 0xe3, 0xe4, 0xbd, 0x2b, 0x15, 0xae, 0x87, 0xa0, 0x42, 0xf7, 0xd9,
-	0x7d, 0x75, 0x90, 0xef, 0xb3, 0xe4, 0x5a, 0x54, 0x28, 0x86, 0x03, 0x83, 0x3d, 0xf7, 0x20, 0xed,
-	0x2a, 0x80, 0xd1, 0xea, 0x68, 0x35, 0x7b, 0xe1, 0x46, 0x28, 0x2e, 0x74, 0xc1, 0xee, 0xfa, 0x56,
-	0xbe, 0x60, 0x49, 0x31, 0x5d, 0x28, 0x86, 0x03, 0x43, 0x3d, 0xbb, 0x6b, 0x59, 0xb9, 0x67, 0x49,
-	0xbd, 0x5c, 0x28, 0x86, 0x03, 0x03, 0x3d, 0x6f, 0xe6, 0xdf, 0xbd, 0x5f, 0x9a, 0xfa, 0xe1, 0xfd,
-	0xd2, 0xd4, 0xc7, 0xfd, 0xa5, 0xc8, 0xbb, 0xfe, 0x52, 0xe4, 0xfb, 0xfe, 0x52, 0xe4, 0xa7, 0xfe,
-	0x52, 0xe4, 0x60, 0x86, 0xfe, 0x97, 0x9a, 0x5b, 0xbf, 0x05, 0x00, 0x00, 0xff, 0xff, 0x35, 0xa6,
-	0x7d, 0x8d, 0xcb, 0x23, 0x00, 0x00,
+	// 1917 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xcc, 0x5a, 0x4f, 0x6f, 0x1b, 0x41,
+	0x15, 0x8f, 0xff, 0x24, 0xb6, 0x9f, 0x63, 0x27, 0x99, 0xb8, 0xc5, 0x72, 0x4b, 0x12, 0x6d, 0x69,
+	0xe2, 0xa0, 0xe0, 0x50, 0x97, 0x8a, 0x52, 0xc4, 0x9f, 0x26, 0x6e, 0x8b, 0x9b, 0x36, 0xad, 0x36,
+	0x49, 0xc5, 0xcd, 0xda, 0xd8, 0x93, 0xb0, 0xb5, 0xe3, 0x35, 0xbb, 0xeb, 0xb4, 0x11, 0x17, 0x40,
+	0xe5, 0x23, 0x20, 0x71, 0xe5, 0x0a, 0x12, 0x07, 0x4e, 0xfd, 0x08, 0x15, 0x27, 0x8e, 0x48, 0x48,
+	0x11, 0xb5, 0x84, 0xc4, 0x89, 0xcf, 0x80, 0xe6, 0xdf, 0xee, 0x7a, 0x3d, 0xbb, 0x6b, 0x27, 0x96,
+	0xc2, 0xa9, 0xde, 0xd9, 0xdf, 0x9b, 0xf7, 0x66, 0xde, 0x6f, 0x7e, 0xfb, 0xe6, 0xa5, 0x90, 0x6b,
+	0x1a, 0x5d, 0xdb, 0x34, 0x3a, 0x95, 0x9e, 0x69, 0xd8, 0x06, 0x42, 0x2d, 0xa3, 0xd9, 0xc6, 0x66,
+	0xc5, 0xfa, 0xa0, 0x99, 0x67, 0x6d, 0xdd, 0xae, 0x9c, 0x3f, 0x28, 0x65, 0xad, 0x1e, 0x6e, 0x5a,
+	0x0c, 0x50, 0xca, 0x19, 0xc7, 0xef, 0x71, 0xd3, 0x16, 0x8f, 0x59, 0xfb, 0xa2, 0x87, 0xc5, 0x43,
+	0xe1, 0xd4, 0x38, 0x35, 0xe8, 0xcf, 0x6d, 0xf2, 0x8b, 0x8f, 0x2e, 0xf7, 0x3a, 0xfd, 0x53, 0xbd,
+	0xbb, 0xcd, 0xfe, 0x61, 0x83, 0xca, 0x23, 0xc8, 0xbf, 0xc0, 0xf6, 0xbe, 0xd1, 0xc2, 0x2a, 0xfe,
+	0x65, 0x1f, 0x5b, 0x36, 0xba, 0x07, 0xa9, 0xae, 0xd1, 0xc2, 0x0d, 0xbd, 0x55, 0x8c, 0xad, 0xc5,
+	0xca, 0x99, 0x1d, 0x18, 0x5c, 0xae, 0xce, 0x11, 0x44, 0xbd, 0xa6, 0xce, 0x91, 0x57, 0xf5, 0x96,
+	0xf2, 0x13, 0x58, 0x70, 0xcc, 0xac, 0x9e, 0xd1, 0xb5, 0x30, 0xda, 0x82, 0x24, 0x79, 0x49, 0x8d,
+	0xb2, 0xd5, 0x62, 0x65, 0x74, 0x01, 0x15, 0x8a, 0xa7, 0x28, 0xe5, 0x32, 0x01, 0x8b, 0xaf, 0x74,
+	0x8b, 0x4e, 0x61, 0x09, 0xd7, 0xcf, 0x21, 0x75, 0xa2, 0x77, 0x6c, 0x6c, 0x5a, 0x7c, 0x96, 0x2d,
+	0xd9, 0x2c, 0x7e, 0xb3, 0xca, 0x73, 0x66, 0xa3, 0x0a, 0xe3, 0xd2, 0x6f, 0x12, 0x90, 0xe2, 0x83,
+	0xa8, 0x00, 0xb3, 0x5d, 0xed, 0x0c, 0x93, 0x19, 0x13, 0xe5, 0x8c, 0xca, 0x1e, 0xd0, 0x36, 0x64,
+	0xf5, 0x56, 0xa3, 0x67, 0xe2, 0x13, 0xfd, 0x23, 0xb6, 0x8a, 0x71, 0xf2, 0x6e, 0x27, 0x3f, 0xb8,
+	0x5c, 0x85, 0x7a, 0xed, 0x2d, 0x1f, 0x55, 0x41, 0x6f, 0x89, 0xdf, 0xe8, 0x2d, 0xcc, 0x75, 0xb4,
+	0x63, 0xdc, 0xb1, 0x8a, 0x89, 0xb5, 0x44, 0x39, 0x5b, 0x7d, 0x3c, 0x49, 0x64, 0x95, 0x57, 0xd4,
+	0xf4, 0x59, 0xd7, 0x36, 0x2f, 0x54, 0x3e, 0x0f, 0xaa, 0x43, 0xf6, 0x0c, 0x9f, 0x1d, 0x63, 0xd3,
+	0xfa, 0x85, 0xde, 0xb3, 0x8a, 0xc9, 0xb5, 0x44, 0x39, 0x5f, 0xdd, 0x08, 0xda, 0xb6, 0x83, 0x1e,
+	0x6e, 0x56, 0x5e, 0x3b, 0x78, 0xd5, 0x6b, 0x8b, 0xaa, 0x30, 0x6b, 0x1a, 0x1d, 0x6c, 0x15, 0x67,
+	0xe9, 0x24, 0x77, 0x03, 0xf7, 0xde, 0xe8, 0x60, 0x95, 0x41, 0xd1, 0x3d, 0xc8, 0x91, 0xad, 0x70,
+	0xf7, 0x60, 0x8e, 0xee, 0xcf, 0x3c, 0x19, 0x14, 0xab, 0x2e, 0xfd, 0x00, 0xb2, 0x9e, 0xd0, 0xd1,
+	0x22, 0x24, 0xda, 0xf8, 0x82, 0xd1, 0x42, 0x25, 0x3f, 0xc9, 0xee, 0x9e, 0x6b, 0x9d, 0x3e, 0x2e,
+	0xc6, 0xe9, 0x18, 0x7b, 0x78, 0x12, 0x7f, 0x1c, 0x53, 0x76, 0x61, 0xc9, 0xb3, 0x1d, 0x9c, 0x23,
+	0x15, 0x98, 0x25, 0xd9, 0x67, 0xc9, 0x08, 0x23, 0x09, 0x83, 0x29, 0x7f, 0x8a, 0xc1, 0xd2, 0x51,
+	0xaf, 0xa5, 0xd9, 0x78, 0x52, 0x86, 0xa2, 0x1f, 0xc3, 0x3c, 0x05, 0x9d, 0x63, 0xd3, 0xd2, 0x8d,
+	0x2e, 0x0d, 0x30, 0x5b, 0xbd, 0x23, 0xf3, 0xf8, 0x8e, 0x41, 0xd4, 0x2c, 0x31, 0xe0, 0x0f, 0xe8,
+	0xbb, 0x90, 0x24, 0xc7, 0xad, 0x98, 0xa0, 0x76, 0x77, 0xc3, 0xf2, 0xa2, 0x52, 0xa4, 0xb2, 0x03,
+	0xc8, 0x1b, 0xeb, 0x95, 0x8e, 0xc5, 0x3e, 0x2c, 0xa9, 0xf8, 0xcc, 0x38, 0x9f, 0x7c, 0xbd, 0x05,
+	0x98, 0x3d, 0x31, 0xcc, 0x26, 0xcb, 0x44, 0x5a, 0x65, 0x0f, 0x4a, 0x01, 0x90, 0x77, 0x3e, 0x16,
+	0x13, 0x3f, 0xf4, 0x87, 0x9a, 0xd5, 0xf6, 0xb8, 0xb0, 0x35, 0xab, 0xed, 0x73, 0x41, 0x10, 0xc4,
+	0x05, 0x79, 0xe5, 0x1c, 0x7a, 0x66, 0xe6, 0xae, 0x8e, 0xbc, 0x0c, 0x5b, 0x1d, 0xc5, 0x53, 0x94,
+	0xf2, 0x58, 0xac, 0x6e, 0x62, 0xd7, 0xce, 0x3a, 0xbc, 0xde, 0x95, 0xcf, 0x49, 0x26, 0x22, 0x64,
+	0xf0, 0x0a, 0x22, 0xe2, 0x35, 0x1b, 0x15, 0x91, 0x7f, 0xde, 0xa0, 0x88, 0xc8, 0x22, 0x93, 0x8a,
+	0xc8, 0x36, 0x64, 0x2d, 0x6c, 0x9e, 0xeb, 0x4d, 0xc2, 0x0e, 0x26, 0x22, 0x3c, 0x84, 0x03, 0x36,
+	0x5c, 0xaf, 0x59, 0x2a, 0x70, 0x48, 0xbd, 0x65, 0xa1, 0x75, 0x48, 0x73, 0x2e, 0x31, 0xb5, 0xc8,
+	0xec, 0x64, 0x07, 0x97, 0xab, 0x29, 0x46, 0x26, 0x4b, 0x4d, 0x31, 0x36, 0x59, 0xa8, 0x06, 0xf9,
+	0x16, 0xb6, 0x74, 0x13, 0xb7, 0x1a, 0x96, 0xad, 0xd9, 0x5c, 0x1f, 0xf2, 0xd5, 0x6f, 0x06, 0xa5,
+	0xf8, 0x80, 0xa0, 0xd4, 0x1c, 0x37, 0xa2, 0x4f, 0x12, 0x91, 0x49, 0x8d, 0x8a, 0x0c, 0xba, 0x0b,
+	0xd0, 0xef, 0x35, 0x6c, 0xa3, 0x41, 0xce, 0x4e, 0x31, 0x4d, 0xe9, 0x9b, 0xee, 0xf7, 0x0e, 0x8d,
+	0x9a, 0x66, 0x63, 0x54, 0x82, 0xb4, 0xd9, 0xef, 0xda, 0x3a, 0xd9, 0xfd, 0x0c, 0xb5, 0x76, 0x9e,
+	0xa7, 0x20, 0x4f, 0x7c, 0xa3, 0x5d, 0x79, 0x22, 0x7c, 0x0b, 0x95, 0x27, 0x4a, 0x40, 0x06, 0x53,
+	0xf6, 0xa0, 0xb0, 0x6b, 0x62, 0xcd, 0xc6, 0x7c, 0xb3, 0x05, 0x05, 0x1f, 0x72, 0xed, 0x60, 0xfc,
+	0x5b, 0x95, 0x4d, 0xc3, 0x2d, 0x3c, 0xf2, 0xb1, 0x0f, 0xb7, 0x7c, 0x93, 0xf1, 0xa8, 0x1e, 0x41,
+	0x8a, 0x27, 0x90, 0x4f, 0x78, 0x27, 0x64, 0x42, 0x55, 0x60, 0x95, 0xf7, 0xb0, 0xf4, 0x02, 0xdb,
+	0xbe, 0xc8, 0xb6, 0x00, 0x5c, 0xbe, 0xf0, 0xf3, 0x96, 0x1b, 0x5c, 0xae, 0x66, 0x1c, 0xba, 0xa8,
+	0x19, 0x87, 0x2d, 0x68, 0x03, 0x16, 0xf4, 0xae, 0x85, 0x4d, 0xbb, 0xd1, 0xc2, 0x27, 0x5a, 0xbf,
+	0x63, 0x5b, 0x5c, 0x5d, 0xf2, 0x6c, 0xb8, 0xc6, 0x47, 0x95, 0x3d, 0x40, 0x5e, 0x5f, 0xd7, 0x0b,
+	0xfc, 0xaf, 0x71, 0x28, 0x30, 0x21, 0xbd, 0x56, 0xf0, 0x35, 0x58, 0x10, 0xe8, 0x09, 0xbe, 0x01,
+	0x79, 0x6e, 0x23, 0x3e, 0x03, 0x0f, 0x87, 0x3e, 0x03, 0xe3, 0xa5, 0x12, 0xbd, 0x86, 0xb4, 0x69,
+	0x74, 0x3a, 0xc7, 0x5a, 0xb3, 0x5d, 0x4c, 0xae, 0xc5, 0xca, 0xf9, 0xea, 0x03, 0x99, 0xa1, 0x6c,
+	0x91, 0x15, 0x95, 0x1b, 0xaa, 0xce, 0x14, 0x8a, 0x02, 0x69, 0x31, 0x8a, 0xd2, 0x90, 0xdc, 0x7f,
+	0xb3, 0xff, 0x6c, 0x71, 0x06, 0xcd, 0x43, 0xfa, 0xad, 0xfa, 0xec, 0x5d, 0xfd, 0xcd, 0xd1, 0xc1,
+	0x62, 0x8c, 0xb0, 0xc7, 0x37, 0xdd, 0xf5, 0x92, 0x50, 0x83, 0x02, 0x13, 0xdc, 0xeb, 0xe4, 0x40,
+	0xf9, 0x06, 0xdc, 0xf2, 0xcd, 0xc2, 0x95, 0xfb, 0x53, 0x02, 0x96, 0xc9, 0xf9, 0xe3, 0xe3, 0x8e,
+	0x78, 0xd7, 0xfd, 0xe2, 0xbd, 0x1d, 0x24, 0x91, 0x3e, 0xcb, 0x51, 0xfd, 0xfe, 0x63, 0x7c, 0xea,
+	0xfa, 0x7d, 0xe0, 0xd3, 0xef, 0x1f, 0x4e, 0x18, 0x9c, 0x54, 0xc2, 0x47, 0x34, 0x32, 0x29, 0xd1,
+	0x48, 0xaf, 0x0a, 0xce, 0x4e, 0x4f, 0x05, 0xdf, 0x40, 0x61, 0x38, 0x5c, 0x4e, 0x9a, 0xef, 0x43,
+	0x9a, 0x27, 0x51, 0x68, 0x61, 0x28, 0x6b, 0x1c, 0xb0, 0xab, 0x88, 0xfb, 0xd8, 0xfe, 0x60, 0x98,
+	0xed, 0x09, 0x14, 0x91, 0x5b, 0xc8, 0x14, 0xd1, 0x99, 0xcc, 0xe5, 0x74, 0x97, 0x0d, 0x85, 0x71,
+	0x5a, 0x58, 0x09, 0xac, 0x72, 0x44, 0x15, 0xd1, 0x17, 0x19, 0x82, 0x24, 0xd9, 0x69, 0xbe, 0x5f,
+	0xf4, 0x37, 0x21, 0x39, 0xb7, 0x21, 0x24, 0x8f, 0xbb, 0x24, 0xe7, 0xb6, 0x84, 0xe4, 0x1c, 0x50,
+	0x6f, 0x71, 0xf1, 0x9b, 0x52, 0x8c, 0x3f, 0x17, 0xe7, 0x6e, 0xea, 0x61, 0x3a, 0x67, 0xd1, 0x17,
+	0xa9, 0xf2, 0x9f, 0x38, 0x3b, 0x8b, 0x7c, 0xfc, 0x0a, 0x67, 0xd1, 0x67, 0x39, 0x7a, 0x16, 0x7f,
+	0x77, 0x83, 0x67, 0x31, 0x20, 0xb8, 0x2b, 0x9f, 0xc5, 0x29, 0x9c, 0x37, 0x37, 0x24, 0xf7, 0xbc,
+	0xf1, 0x44, 0x85, 0x9e, 0x37, 0x91, 0x39, 0x07, 0xac, 0x3c, 0xa5, 0x94, 0xde, 0xed, 0xf4, 0x2d,
+	0x1b, 0x9b, 0x1e, 0x8d, 0x6e, 0xb2, 0x11, 0x9f, 0x46, 0x73, 0x1c, 0xe1, 0x05, 0x07, 0x38, 0xf4,
+	0x75, 0xa6, 0x70, 0xe9, 0xcb, 0x21, 0x61, 0xf4, 0x15, 0x56, 0x02, 0xeb, 0x70, 0x89, 0xbf, 0xb8,
+	0x02, 0x97, 0x7c, 0x96, 0xff, 0x5f, 0x5c, 0x0a, 0x08, 0xee, 0x26, 0xb9, 0xe4, 0x86, 0xe4, 0x72,
+	0x89, 0x67, 0x23, 0x94, 0x4b, 0x22, 0x75, 0x0e, 0x58, 0xf9, 0x7d, 0x0c, 0xb2, 0x7b, 0xf8, 0x42,
+	0x35, 0x6c, 0xcd, 0x26, 0xa5, 0xcf, 0xb7, 0x61, 0x89, 0x90, 0x0c, 0x9b, 0x8d, 0xf7, 0x86, 0xde,
+	0x6d, 0xd8, 0x46, 0x1b, 0x77, 0x69, 0x68, 0x69, 0x75, 0x81, 0xbd, 0x78, 0x69, 0xe8, 0xdd, 0x43,
+	0x32, 0x8c, 0xb6, 0x00, 0x9d, 0x69, 0x5d, 0xed, 0x74, 0x18, 0xcc, 0x8a, 0xc5, 0x45, 0xfe, 0x46,
+	0x8a, 0xee, 0x77, 0x3b, 0x46, 0xb3, 0xdd, 0x20, 0xab, 0x4e, 0x0c, 0xa1, 0x8f, 0xe8, 0x8b, 0x3d,
+	0x7c, 0xa1, 0xfc, 0xd6, 0xa9, 0x07, 0xaf, 0xc3, 0x73, 0x52, 0x0f, 0x0a, 0xf4, 0x24, 0xf5, 0x20,
+	0xb7, 0x99, 0xa0, 0x1e, 0xe4, 0xde, 0x3d, 0xf5, 0xe0, 0x53, 0x52, 0x0f, 0xb2, 0x5d, 0xa5, 0xf5,
+	0x60, 0x80, 0xa1, 0x67, 0xf3, 0x77, 0x92, 0x5f, 0x2e, 0x57, 0x67, 0x54, 0xc7, 0xcc, 0xad, 0xef,
+	0xa6, 0x74, 0x50, 0x7f, 0x04, 0x8b, 0xb4, 0x62, 0x6f, 0x9a, 0xd8, 0x16, 0xfb, 0xb9, 0x09, 0x19,
+	0x8b, 0x0e, 0xb8, 0xdb, 0x39, 0x3f, 0xb8, 0x5c, 0x4d, 0x33, 0x54, 0xbd, 0x46, 0xbe, 0xf3, 0xf4,
+	0x57, 0x4b, 0x79, 0xc1, 0x2f, 0x17, 0xcc, 0x9c, 0x87, 0x52, 0x85, 0x39, 0x06, 0xe0, 0x91, 0x94,
+	0xe4, 0x35, 0x03, 0xb5, 0xe1, 0x48, 0xe5, 0x73, 0x0c, 0x96, 0x45, 0xe1, 0x7a, 0xb5, 0x58, 0xd0,
+	0x0e, 0xe4, 0x39, 0x74, 0x82, 0xbc, 0xe6, 0x98, 0x89, 0x48, 0x6b, 0x75, 0x28, 0xad, 0x2b, 0xc1,
+	0x81, 0x7b, 0xca, 0x93, 0x97, 0xee, 0x35, 0xe5, 0xda, 0xdb, 0xf0, 0xef, 0x38, 0x20, 0x56, 0x89,
+	0x91, 0x47, 0x47, 0x36, 0x7f, 0xe6, 0x97, 0xcd, 0x4a, 0x70, 0xc5, 0xe9, 0x35, 0x1c, 0x55, 0xcd,
+	0x4f, 0xd3, 0x57, 0x4d, 0xd5, 0xa7, 0x9a, 0x4f, 0x26, 0x8b, 0xed, 0x46, 0x44, 0x73, 0x4f, 0x5c,
+	0x3b, 0x78, 0x44, 0x3c, 0x65, 0xdf, 0x23, 0x97, 0x24, 0x3a, 0xc4, 0x25, 0x33, 0x2c, 0x67, 0x02,
+	0xaa, 0xd4, 0x61, 0x59, 0xdc, 0xd8, 0xbd, 0xd4, 0xad, 0x0e, 0xd5, 0xba, 0x63, 0x73, 0x69, 0x78,
+	0xaa, 0x6b, 0x70, 0xe9, 0xa7, 0xb0, 0x2c, 0x2e, 0x5d, 0x57, 0x3c, 0xdd, 0xb7, 0xdd, 0xcb, 0x9f,
+	0x37, 0x9a, 0xea, 0x9f, 0x6f, 0x43, 0x6a, 0x97, 0xfd, 0x99, 0x02, 0xe9, 0x90, 0xe2, 0x7f, 0x01,
+	0x40, 0x8a, 0x2c, 0xa8, 0xe1, 0xbf, 0x2a, 0x94, 0xee, 0x85, 0x62, 0x78, 0x25, 0x7a, 0xeb, 0x6f,
+	0x7f, 0xf9, 0xef, 0x1f, 0xe2, 0x0b, 0x90, 0xa3, 0xa0, 0xef, 0xf0, 0x2f, 0x01, 0x32, 0x20, 0xe3,
+	0xb4, 0x92, 0xd1, 0xb7, 0xc6, 0x69, 0xbc, 0x97, 0xee, 0x47, 0xa0, 0xc2, 0x1d, 0x9a, 0x00, 0x6e,
+	0x27, 0x17, 0xdd, 0x0f, 0xbe, 0xbb, 0x7b, 0x57, 0xb8, 0x1e, 0x05, 0x8b, 0xf4, 0xe9, 0x76, 0x6a,
+	0xe5, 0x3e, 0x47, 0x3a, 0xc3, 0x72, 0x9f, 0x92, 0x86, 0x6f, 0x80, 0x4f, 0x96, 0xc3, 0x43, 0xcd,
+	0x6a, 0x07, 0xe6, 0xd0, 0xd3, 0xa9, 0x0d, 0xcc, 0xe1, 0x50, 0x4f, 0x36, 0x3c, 0x87, 0xb4, 0xdf,
+	0x16, 0x9c, 0x43, 0x6f, 0xdf, 0x33, 0x38, 0x87, 0x43, 0x4d, 0xbb, 0xc8, 0xfd, 0xa4, 0xcb, 0x0b,
+	0xd9, 0x4f, 0xef, 0x0a, 0xd7, 0xa3, 0x60, 0x91, 0x3e, 0xdd, 0x36, 0x98, 0xdc, 0xe7, 0x48, 0x4b,
+	0x4e, 0xee, 0x73, 0xb4, 0x9b, 0x16, 0xe4, 0xf3, 0x23, 0xcc, 0x7b, 0xaf, 0xf0, 0x68, 0x63, 0xcc,
+	0x9e, 0x44, 0xa9, 0x1c, 0x0d, 0x0c, 0xf7, 0xfc, 0x2b, 0xc8, 0x0d, 0x35, 0x2c, 0x91, 0x74, 0x46,
+	0x59, 0x83, 0xb4, 0xb4, 0x39, 0x06, 0x32, 0xd2, 0xf9, 0x50, 0xbf, 0x4b, 0xee, 0x5c, 0xd6, 0x61,
+	0x93, 0x3b, 0x97, 0x36, 0xcf, 0x42, 0x9c, 0x0f, 0xb5, 0xb5, 0xe4, 0xce, 0x65, 0xfd, 0x33, 0xb9,
+	0x73, 0x79, 0x8f, 0x2c, 0x94, 0x64, 0xfc, 0x2a, 0x18, 0x48, 0xb2, 0xe1, 0xf6, 0x41, 0x20, 0xc9,
+	0xfc, 0xbd, 0x80, 0x70, 0x92, 0x89, 0x7b, 0x6b, 0x30, 0xc9, 0x7c, 0x97, 0xed, 0x60, 0x92, 0xf9,
+	0xaf, 0xc0, 0x91, 0x24, 0x13, 0x0b, 0x0e, 0x21, 0x99, 0x6f, 0xcd, 0x9b, 0x63, 0x20, 0xc7, 0xcc,
+	0x73, 0xa8, 0x73, 0x59, 0xbf, 0x26, 0x2c, 0xcf, 0x63, 0x3a, 0x67, 0x79, 0xe6, 0x85, 0x7b, 0x60,
+	0x9e, 0x87, 0xaf, 0x44, 0x81, 0x79, 0xf6, 0xdd, 0x1a, 0x22, 0xf2, 0x2c, 0xee, 0x94, 0xc1, 0x79,
+	0xf6, 0x5d, 0x84, 0x83, 0xf3, 0xec, 0xbf, 0x9e, 0x46, 0x9e, 0x67, 0xb1, 0xe0, 0x90, 0xf3, 0xec,
+	0x5b, 0xf3, 0xe6, 0x18, 0xc8, 0xc8, 0x8f, 0x93, 0x73, 0x9b, 0x91, 0x7f, 0x9c, 0xfc, 0x77, 0xa5,
+	0xd2, 0xfd, 0x08, 0x54, 0xe4, 0x3e, 0x7b, 0xaf, 0x0e, 0xf2, 0x7d, 0x96, 0x5c, 0x8b, 0x4a, 0xe5,
+	0x68, 0x60, 0xb8, 0xe7, 0x3e, 0x64, 0x3d, 0x05, 0x30, 0x5a, 0x1f, 0xaf, 0x66, 0x2f, 0x6d, 0x44,
+	0xe2, 0x22, 0x17, 0xec, 0xad, 0x6f, 0xe5, 0x0b, 0x96, 0x14, 0xd3, 0xa5, 0x72, 0x34, 0x30, 0xd2,
+	0xb3, 0xb7, 0x96, 0x95, 0x7b, 0x96, 0xd4, 0xcb, 0xa5, 0x72, 0x34, 0x30, 0xd4, 0xf3, 0x4e, 0xf1,
+	0xcb, 0xd7, 0x95, 0x99, 0x7f, 0x7c, 0x5d, 0x99, 0xf9, 0xf5, 0x60, 0x25, 0xf6, 0x65, 0xb0, 0x12,
+	0xfb, 0xfb, 0x60, 0x25, 0xf6, 0xaf, 0xc1, 0x4a, 0xec, 0x78, 0x8e, 0xfe, 0xdf, 0x9b, 0x87, 0xff,
+	0x0b, 0x00, 0x00, 0xff, 0xff, 0x3b, 0x09, 0x33, 0xa6, 0xf4, 0x23, 0x00, 0x00,
 }

vendor/github.com/docker/swarmkit/api/control.proto

@@ -217,6 +217,7 @@ message CreateServiceResponse {
 
 message GetServiceRequest {
 	string service_id = 1;
+	bool insert_defaults = 2;
 }
 
 message GetServiceResponse {

vendor/github.com/docker/swarmkit/api/defaults/service.go

@@ -0,0 +1,83 @@
+package defaults
+
+import (
+	"time"
+
+	"github.com/docker/swarmkit/api"
+	"github.com/docker/swarmkit/api/deepcopy"
+	gogotypes "github.com/gogo/protobuf/types"
+)
+
+// Service is a ServiceSpec object with all fields filled in using default
+// values.
+var Service = api.ServiceSpec{
+	Task: api.TaskSpec{
+		Runtime: &api.TaskSpec_Container{
+			Container: &api.ContainerSpec{
+				StopGracePeriod: gogotypes.DurationProto(10 * time.Second),
+				PullOptions:     &api.ContainerSpec_PullOptions{},
+				DNSConfig:       &api.ContainerSpec_DNSConfig{},
+			},
+		},
+		Resources: &api.ResourceRequirements{},
+		Restart: &api.RestartPolicy{
+			Delay: gogotypes.DurationProto(5 * time.Second),
+		},
+		Placement: &api.Placement{},
+	},
+	Update: &api.UpdateConfig{
+		FailureAction: api.UpdateConfig_PAUSE,
+		Monitor:       gogotypes.DurationProto(5 * time.Second),
+		Parallelism:   1,
+		Order:         api.UpdateConfig_STOP_FIRST,
+	},
+}
+
+// InterpolateService returns a ServiceSpec based on the provided spec, which
+// has all unspecified values filled in with default values.
+func InterpolateService(origSpec *api.ServiceSpec) *api.ServiceSpec {
+	spec := origSpec.Copy()
+
+	container := spec.Task.GetContainer()
+	defaultContainer := Service.Task.GetContainer()
+	if container != nil {
+		if container.StopGracePeriod == nil {
+			container.StopGracePeriod = &gogotypes.Duration{}
+			deepcopy.Copy(container.StopGracePeriod, defaultContainer.StopGracePeriod)
+		}
+		if container.PullOptions == nil {
+			container.PullOptions = defaultContainer.PullOptions.Copy()
+		}
+		if container.DNSConfig == nil {
+			container.DNSConfig = defaultContainer.DNSConfig.Copy()
+		}
+	}
+
+	if spec.Task.Resources == nil {
+		spec.Task.Resources = Service.Task.Resources.Copy()
+	}
+
+	if spec.Task.Restart == nil {
+		spec.Task.Restart = Service.Task.Restart.Copy()
+	} else {
+		if spec.Task.Restart.Delay == nil {
+			spec.Task.Restart.Delay = &gogotypes.Duration{}
+			deepcopy.Copy(spec.Task.Restart.Delay, Service.Task.Restart.Delay)
+		}
+	}
+
+	if spec.Task.Placement == nil {
+		spec.Task.Placement = Service.Task.Placement.Copy()
+	}
+
+	if spec.Update == nil {
+		spec.Update = Service.Update.Copy()
+	} else {
+		if spec.Update.Monitor == nil {
+			spec.Update.Monitor = &gogotypes.Duration{}
+			deepcopy.Copy(spec.Update.Monitor, Service.Update.Monitor)
+		}
+	}
+
+	return spec
+}

vendor/github.com/docker/swarmkit/api/gen.go

@@ -1,3 +1,3 @@
 package api
 
-//go:generate protoc -I.:../protobuf:../vendor:../vendor/github.com/gogo/protobuf --gogoswarm_out=plugins=grpc+deepcopy+storeobject+raftproxy+authenticatedwrapper,import_path=github.com/docker/swarmkit/api,Mgogoproto/gogo.proto=github.com/gogo/protobuf/gogoproto,Mgoogle/protobuf/descriptor.proto=github.com/gogo/protobuf/protoc-gen-gogo/descriptor,Mplugin/plugin.proto=github.com/docker/swarmkit/protobuf/plugin,Mgoogle/protobuf/duration.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/timestamp.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/any.proto=github.com/gogo/protobuf/types:. types.proto specs.proto objects.proto control.proto dispatcher.proto ca.proto snapshot.proto raft.proto health.proto resource.proto logbroker.proto
+//go:generate protoc -I.:../protobuf:../vendor:../vendor/github.com/gogo/protobuf --gogoswarm_out=plugins=grpc+deepcopy+storeobject+raftproxy+authenticatedwrapper,import_path=github.com/docker/swarmkit/api,Mgogoproto/gogo.proto=github.com/gogo/protobuf/gogoproto,Mgoogle/protobuf/descriptor.proto=github.com/gogo/protobuf/protoc-gen-gogo/descriptor,Mplugin/plugin.proto=github.com/docker/swarmkit/protobuf/plugin,Mgoogle/protobuf/duration.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/timestamp.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/any.proto=github.com/gogo/protobuf/types:. types.proto specs.proto objects.proto control.proto dispatcher.proto ca.proto snapshot.proto raft.proto health.proto resource.proto logbroker.proto store.proto

vendor/github.com/docker/swarmkit/api/logbroker.pb.go

@@ -357,6 +357,10 @@ func (m *LogMessage) CopyFrom(src interface{}) {
 		m.Timestamp = &google_protobuf.Timestamp{}
 		github_com_docker_swarmkit_api_deepcopy.Copy(m.Timestamp, o.Timestamp)
 	}
+	if o.Data != nil {
+		m.Data = make([]byte, len(o.Data))
+		copy(m.Data, o.Data)
+	}
 }
 
 func (m *SubscribeLogsRequest) Copy() *SubscribeLogsRequest {

vendor/github.com/docker/swarmkit/api/objects.proto

@@ -26,7 +26,18 @@ message Meta {
 
 // Node provides the internal node state as seen by the cluster.
 message Node {
-	option (docker.protobuf.plugin.store_object) = { };
+	option (docker.protobuf.plugin.store_object) = {
+		watch_selectors: {
+			id: true
+			id_prefix: true
+			name: true
+			name_prefix: true
+			custom: true
+			custom_prefix: true
+			role: true
+			membership: true
+		}
+	};
 
 	// ID specifies the identity of the node.
 	string id = 1;
@@ -67,7 +78,16 @@ message Node {
 }
 
 message Service {
-	option (docker.protobuf.plugin.store_object) = { };
+	option (docker.protobuf.plugin.store_object) = {
+		watch_selectors: {
+			id: true
+			id_prefix: true
+			name: true
+			name_prefix: true
+			custom: true
+			custom_prefix: true
+		}
+	};
 
 	string id = 1;
 
@@ -137,7 +157,20 @@ message Endpoint {
 // immutable and idempotent. Once it is dispatched to a node, it will not be
 // dispatched to another node.
 message Task {
-	option (docker.protobuf.plugin.store_object) = { };
+	option (docker.protobuf.plugin.store_object) = {
+		watch_selectors: {
+			id: true
+			id_prefix: true
+			name: true
+			name_prefix: true
+			custom: true
+			custom_prefix: true
+			service_id: true
+			node_id: true
+			slot: true
+			desired_state: true
+		}
+	};
 
 	string id = 1;
 
@@ -225,7 +258,16 @@ message NetworkAttachment {
 }
 
 message Network {
-	option (docker.protobuf.plugin.store_object) = { };
+	option (docker.protobuf.plugin.store_object) = {
+		watch_selectors: {
+			id: true
+			id_prefix: true
+			name: true
+			name_prefix: true
+			custom: true
+			custom_prefix: true
+		}
+	};
 
 	string id = 1;
 
@@ -243,7 +285,16 @@ message Network {
 
 // Cluster provides global cluster settings.
 message Cluster {
-	option (docker.protobuf.plugin.store_object) = { };
+	option (docker.protobuf.plugin.store_object) = {
+		watch_selectors: {
+			id: true
+			id_prefix: true
+			name: true
+			name_prefix: true
+			custom: true
+			custom_prefix: true
+		}
+	};
 
 	string id = 1;
 
@@ -281,7 +332,16 @@ message Cluster {
 // information that is generated from the secret data in the `spec`, such as
 // the digest and size of the secret data.
 message Secret {
-	option (docker.protobuf.plugin.store_object) = { };
+	option (docker.protobuf.plugin.store_object) = {
+		watch_selectors: {
+			id: true
+			id_prefix: true
+			name: true
+			name_prefix: true
+			custom: true
+			custom_prefix: true
+		}
+	};
 
 	string id = 1;
 
@@ -299,7 +359,17 @@ message Secret {
 // SwarmKit can serve as a store for these objects without understanding their
 // meanings.
 message Resource {
-	option (docker.protobuf.plugin.store_object) = { };
+	option (docker.protobuf.plugin.store_object) = {
+		watch_selectors: {
+			id: true
+			id_prefix: true
+			name: true
+			name_prefix: true
+			custom: true
+			custom_prefix: true
+			kind: true
+		}
+	};
 
 	string id = 1 [(gogoproto.customname) = "ID"];
 
@@ -320,7 +390,16 @@ message Resource {
 // Extension declares a type of "resource" object. This message provides some
 // metadata about the objects.
 message Extension {
-	option (docker.protobuf.plugin.store_object) = { };
+	option (docker.protobuf.plugin.store_object) = {
+		watch_selectors: {
+			id: true
+			id_prefix: true
+			name: true
+			name_prefix: true
+			custom: true
+			custom_prefix: true
+		}
+	};
 
 	string id = 1 [(gogoproto.customname) = "ID"];
 

vendor/github.com/docker/swarmkit/api/specs.pb.go

@@ -1097,6 +1097,10 @@ func (m *SecretSpec) CopyFrom(src interface{}) {
 	o := src.(*SecretSpec)
 	*m = *o
 	github_com_docker_swarmkit_api_deepcopy.Copy(&m.Annotations, &o.Annotations)
+	if o.Data != nil {
+		m.Data = make([]byte, len(o.Data))
+		copy(m.Data, o.Data)
+	}
 }
 
 func (m *NodeSpec) Marshal() (dAtA []byte, err error) {

vendor/github.com/docker/swarmkit/api/store.pb.go

@@ -0,0 +1,4407 @@
+// Code generated by protoc-gen-gogo.
+// source: store.proto
+// DO NOT EDIT!
+
+package api
+
+import proto "github.com/gogo/protobuf/proto"
+import fmt "fmt"
+import math "math"
+import _ "github.com/gogo/protobuf/gogoproto"
+import _ "github.com/docker/swarmkit/protobuf/plugin"
+
+import github_com_docker_swarmkit_api_deepcopy "github.com/docker/swarmkit/api/deepcopy"
+
+import (
+	context "golang.org/x/net/context"
+	grpc "google.golang.org/grpc"
+)
+
+import raftselector "github.com/docker/swarmkit/manager/raftselector"
+import codes "google.golang.org/grpc/codes"
+import metadata "google.golang.org/grpc/metadata"
+import transport "google.golang.org/grpc/transport"
+import rafttime "time"
+
+import strings "strings"
+import reflect "reflect"
+
+import io "io"
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// WatchActionKind distinguishes between creations, updates, and removals. It
+// is structured as a bitmap so multiple kinds of events can be requested with
+// a mask.
+type WatchActionKind int32
+
+const (
+	WatchActionKindUnknown WatchActionKind = 0
+	WatchActionKindCreate  WatchActionKind = 1
+	WatchActionKindUpdate  WatchActionKind = 2
+	WatchActionKindRemove  WatchActionKind = 4
+)
+
+var WatchActionKind_name = map[int32]string{
+	0: "WATCH_ACTION_UNKNOWN",
+	1: "WATCH_ACTION_CREATE",
+	2: "WATCH_ACTION_UPDATE",
+	4: "WATCH_ACTION_REMOVE",
+}
+var WatchActionKind_value = map[string]int32{
+	"WATCH_ACTION_UNKNOWN": 0,
+	"WATCH_ACTION_CREATE":  1,
+	"WATCH_ACTION_UPDATE":  2,
+	"WATCH_ACTION_REMOVE":  4,
+}
+
+func (x WatchActionKind) String() string {
+	return proto.EnumName(WatchActionKind_name, int32(x))
+}
+func (WatchActionKind) EnumDescriptor() ([]byte, []int) { return fileDescriptorStore, []int{0} }
+
+type Object struct {
+	// Types that are valid to be assigned to Object:
+	//	*Object_Node
+	//	*Object_Service
+	//	*Object_Network
+	//	*Object_Task
+	//	*Object_Cluster
+	//	*Object_Secret
+	//	*Object_Resource
+	//	*Object_Extension
+	Object isObject_Object `protobuf_oneof:"Object"`
+}
+
+func (m *Object) Reset()                    { *m = Object{} }
+func (*Object) ProtoMessage()               {}
+func (*Object) Descriptor() ([]byte, []int) { return fileDescriptorStore, []int{0} }
+
+type isObject_Object interface {
+	isObject_Object()
+	MarshalTo([]byte) (int, error)
+	Size() int
+}
+
+type Object_Node struct {
+	Node *Node `protobuf:"bytes,1,opt,name=node,oneof"`
+}
+type Object_Service struct {
+	Service *Service `protobuf:"bytes,2,opt,name=service,oneof"`
+}
+type Object_Network struct {
+	Network *Network `protobuf:"bytes,3,opt,name=network,oneof"`
+}
+type Object_Task struct {
+	Task *Task `protobuf:"bytes,4,opt,name=task,oneof"`
+}
+type Object_Cluster struct {
+	Cluster *Cluster `protobuf:"bytes,5,opt,name=cluster,oneof"`
+}
+type Object_Secret struct {
+	Secret *Secret `protobuf:"bytes,6,opt,name=secret,oneof"`
+}
+type Object_Resource struct {
+	Resource *Resource `protobuf:"bytes,7,opt,name=resource,oneof"`
+}
+type Object_Extension struct {
+	Extension *Extension `protobuf:"bytes,8,opt,name=extension,oneof"`
+}
+
+func (*Object_Node) isObject_Object()      {}
+func (*Object_Service) isObject_Object()   {}
+func (*Object_Network) isObject_Object()   {}
+func (*Object_Task) isObject_Object()      {}
+func (*Object_Cluster) isObject_Object()   {}
+func (*Object_Secret) isObject_Object()    {}
+func (*Object_Resource) isObject_Object()  {}
+func (*Object_Extension) isObject_Object() {}
+
+func (m *Object) GetObject() isObject_Object {
+	if m != nil {
+		return m.Object
+	}
+	return nil
+}
+
+func (m *Object) GetNode() *Node {
+	if x, ok := m.GetObject().(*Object_Node); ok {
+		return x.Node
+	}
+	return nil
+}
+
+func (m *Object) GetService() *Service {
+	if x, ok := m.GetObject().(*Object_Service); ok {
+		return x.Service
+	}
+	return nil
+}
+
+func (m *Object) GetNetwork() *Network {
+	if x, ok := m.GetObject().(*Object_Network); ok {
+		return x.Network
+	}
+	return nil
+}
+
+func (m *Object) GetTask() *Task {
+	if x, ok := m.GetObject().(*Object_Task); ok {
+		return x.Task
+	}
+	return nil
+}
+
+func (m *Object) GetCluster() *Cluster {
+	if x, ok := m.GetObject().(*Object_Cluster); ok {
+		return x.Cluster
+	}
+	return nil
+}
+
+func (m *Object) GetSecret() *Secret {
+	if x, ok := m.GetObject().(*Object_Secret); ok {
+		return x.Secret
+	}
+	return nil
+}
+
+func (m *Object) GetResource() *Resource {
+	if x, ok := m.GetObject().(*Object_Resource); ok {
+		return x.Resource
+	}
+	return nil
+}
+
+func (m *Object) GetExtension() *Extension {
+	if x, ok := m.GetObject().(*Object_Extension); ok {
+		return x.Extension
+	}
+	return nil
+}
+
+// XXX_OneofFuncs is for the internal use of the proto package.
+func (*Object) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
+	return _Object_OneofMarshaler, _Object_OneofUnmarshaler, _Object_OneofSizer, []interface{}{
+		(*Object_Node)(nil),
+		(*Object_Service)(nil),
+		(*Object_Network)(nil),
+		(*Object_Task)(nil),
+		(*Object_Cluster)(nil),
+		(*Object_Secret)(nil),
+		(*Object_Resource)(nil),
+		(*Object_Extension)(nil),
+	}
+}
+
+func _Object_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
+	m := msg.(*Object)
+	// Object
+	switch x := m.Object.(type) {
+	case *Object_Node:
+		_ = b.EncodeVarint(1<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.Node); err != nil {
+			return err
+		}
+	case *Object_Service:
+		_ = b.EncodeVarint(2<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.Service); err != nil {
+			return err
+		}
+	case *Object_Network:
+		_ = b.EncodeVarint(3<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.Network); err != nil {
+			return err
+		}
+	case *Object_Task:
+		_ = b.EncodeVarint(4<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.Task); err != nil {
+			return err
+		}
+	case *Object_Cluster:
+		_ = b.EncodeVarint(5<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.Cluster); err != nil {
+			return err
+		}
+	case *Object_Secret:
+		_ = b.EncodeVarint(6<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.Secret); err != nil {
+			return err
+		}
+	case *Object_Resource:
+		_ = b.EncodeVarint(7<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.Resource); err != nil {
+			return err
+		}
+	case *Object_Extension:
+		_ = b.EncodeVarint(8<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.Extension); err != nil {
+			return err
+		}
+	case nil:
+	default:
+		return fmt.Errorf("Object.Object has unexpected type %T", x)
+	}
+	return nil
+}
+
+func _Object_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
+	m := msg.(*Object)
+	switch tag {
+	case 1: // Object.node
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(Node)
+		err := b.DecodeMessage(msg)
+		m.Object = &Object_Node{msg}
+		return true, err
+	case 2: // Object.service
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(Service)
+		err := b.DecodeMessage(msg)
+		m.Object = &Object_Service{msg}
+		return true, err
+	case 3: // Object.network
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(Network)
+		err := b.DecodeMessage(msg)
+		m.Object = &Object_Network{msg}
+		return true, err
+	case 4: // Object.task
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(Task)
+		err := b.DecodeMessage(msg)
+		m.Object = &Object_Task{msg}
+		return true, err
+	case 5: // Object.cluster
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(Cluster)
+		err := b.DecodeMessage(msg)
+		m.Object = &Object_Cluster{msg}
+		return true, err
+	case 6: // Object.secret
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(Secret)
+		err := b.DecodeMessage(msg)
+		m.Object = &Object_Secret{msg}
+		return true, err
+	case 7: // Object.resource
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(Resource)
+		err := b.DecodeMessage(msg)
+		m.Object = &Object_Resource{msg}
+		return true, err
+	case 8: // Object.extension
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(Extension)
+		err := b.DecodeMessage(msg)
+		m.Object = &Object_Extension{msg}
+		return true, err
+	default:
+		return false, nil
+	}
+}
+
+func _Object_OneofSizer(msg proto.Message) (n int) {
+	m := msg.(*Object)
+	// Object
+	switch x := m.Object.(type) {
+	case *Object_Node:
+		s := proto.Size(x.Node)
+		n += proto.SizeVarint(1<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case *Object_Service:
+		s := proto.Size(x.Service)
+		n += proto.SizeVarint(2<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case *Object_Network:
+		s := proto.Size(x.Network)
+		n += proto.SizeVarint(3<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case *Object_Task:
+		s := proto.Size(x.Task)
+		n += proto.SizeVarint(4<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case *Object_Cluster:
+		s := proto.Size(x.Cluster)
+		n += proto.SizeVarint(5<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case *Object_Secret:
+		s := proto.Size(x.Secret)
+		n += proto.SizeVarint(6<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case *Object_Resource:
+		s := proto.Size(x.Resource)
+		n += proto.SizeVarint(7<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case *Object_Extension:
+		s := proto.Size(x.Extension)
+		n += proto.SizeVarint(8<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case nil:
+	default:
+		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
+	}
+	return n
+}
+
+// FIXME(aaronl): These messages should ideally be embedded in SelectBy, but
+// protoc generates bad code for that.
+type SelectBySlot struct {
+	ServiceID string `protobuf:"bytes,1,opt,name=service_id,json=serviceId,proto3" json:"service_id,omitempty"`
+	Slot      uint64 `protobuf:"varint,2,opt,name=slot,proto3" json:"slot,omitempty"`
+}
+
+func (m *SelectBySlot) Reset()                    { *m = SelectBySlot{} }
+func (*SelectBySlot) ProtoMessage()               {}
+func (*SelectBySlot) Descriptor() ([]byte, []int) { return fileDescriptorStore, []int{1} }
+
+type SelectByCustom struct {
+	Kind  string `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
+	Index string `protobuf:"bytes,2,opt,name=index,proto3" json:"index,omitempty"`
+	Value string `protobuf:"bytes,3,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+func (m *SelectByCustom) Reset()                    { *m = SelectByCustom{} }
+func (*SelectByCustom) ProtoMessage()               {}
+func (*SelectByCustom) Descriptor() ([]byte, []int) { return fileDescriptorStore, []int{2} }
+
+type SelectBy struct {
+	// TODO(aaronl): Are all of these things we want to expose in
+	// the API? Exposing them may commit us to maintaining those
+	// internal indices going forward.
+	//
+	// Types that are valid to be assigned to By:
+	//	*SelectBy_ID
+	//	*SelectBy_IDPrefix
+	//	*SelectBy_Name
+	//	*SelectBy_NamePrefix
+	//	*SelectBy_Custom
+	//	*SelectBy_CustomPrefix
+	//	*SelectBy_ServiceID
+	//	*SelectBy_NodeID
+	//	*SelectBy_Slot
+	//	*SelectBy_DesiredState
+	//	*SelectBy_Role
+	//	*SelectBy_Membership
+	//	*SelectBy_ReferencedNetworkID
+	//	*SelectBy_ReferencedSecretID
+	//	*SelectBy_Kind
+	By isSelectBy_By `protobuf_oneof:"By"`
+}
+
+func (m *SelectBy) Reset()                    { *m = SelectBy{} }
+func (*SelectBy) ProtoMessage()               {}
+func (*SelectBy) Descriptor() ([]byte, []int) { return fileDescriptorStore, []int{3} }
+
+type isSelectBy_By interface {
+	isSelectBy_By()
+	MarshalTo([]byte) (int, error)
+	Size() int
+}
+
+type SelectBy_ID struct {
+	ID string `protobuf:"bytes,1,opt,name=id,proto3,oneof"`
+}
+type SelectBy_IDPrefix struct {
+	IDPrefix string `protobuf:"bytes,2,opt,name=id_prefix,json=idPrefix,proto3,oneof"`
+}
+type SelectBy_Name struct {
+	Name string `protobuf:"bytes,3,opt,name=name,proto3,oneof"`
+}
+type SelectBy_NamePrefix struct {
+	NamePrefix string `protobuf:"bytes,4,opt,name=name_prefix,json=namePrefix,proto3,oneof"`
+}
+type SelectBy_Custom struct {
+	Custom *SelectByCustom `protobuf:"bytes,5,opt,name=custom,oneof"`
+}
+type SelectBy_CustomPrefix struct {
+	CustomPrefix *SelectByCustom `protobuf:"bytes,6,opt,name=custom_prefix,json=customPrefix,oneof"`
+}
+type SelectBy_ServiceID struct {
+	ServiceID string `protobuf:"bytes,7,opt,name=service_id,json=serviceId,proto3,oneof"`
+}
+type SelectBy_NodeID struct {
+	NodeID string `protobuf:"bytes,8,opt,name=node_id,json=nodeId,proto3,oneof"`
+}
+type SelectBy_Slot struct {
+	Slot *SelectBySlot `protobuf:"bytes,9,opt,name=slot,oneof"`
+}
+type SelectBy_DesiredState struct {
+	DesiredState TaskState `protobuf:"varint,10,opt,name=desired_state,json=desiredState,proto3,enum=docker.swarmkit.v1.TaskState,oneof"`
+}
+type SelectBy_Role struct {
+	Role NodeRole `protobuf:"varint,11,opt,name=role,proto3,enum=docker.swarmkit.v1.NodeRole,oneof"`
+}
+type SelectBy_Membership struct {
+	Membership NodeSpec_Membership `protobuf:"varint,12,opt,name=membership,proto3,enum=docker.swarmkit.v1.NodeSpec_Membership,oneof"`
+}
+type SelectBy_ReferencedNetworkID struct {
+	ReferencedNetworkID string `protobuf:"bytes,13,opt,name=referenced_network_id,json=referencedNetworkId,proto3,oneof"`
+}
+type SelectBy_ReferencedSecretID struct {
+	ReferencedSecretID string `protobuf:"bytes,14,opt,name=referenced_secret_id,json=referencedSecretId,proto3,oneof"`
+}
+type SelectBy_Kind struct {
+	Kind string `protobuf:"bytes,15,opt,name=kind,proto3,oneof"`
+}
+
+func (*SelectBy_ID) isSelectBy_By()                  {}
+func (*SelectBy_IDPrefix) isSelectBy_By()            {}
+func (*SelectBy_Name) isSelectBy_By()                {}
+func (*SelectBy_NamePrefix) isSelectBy_By()          {}
+func (*SelectBy_Custom) isSelectBy_By()              {}
+func (*SelectBy_CustomPrefix) isSelectBy_By()        {}
+func (*SelectBy_ServiceID) isSelectBy_By()           {}
+func (*SelectBy_NodeID) isSelectBy_By()              {}
+func (*SelectBy_Slot) isSelectBy_By()                {}
+func (*SelectBy_DesiredState) isSelectBy_By()        {}
+func (*SelectBy_Role) isSelectBy_By()                {}
+func (*SelectBy_Membership) isSelectBy_By()          {}
+func (*SelectBy_ReferencedNetworkID) isSelectBy_By() {}
+func (*SelectBy_ReferencedSecretID) isSelectBy_By()  {}
+func (*SelectBy_Kind) isSelectBy_By()                {}
+
+func (m *SelectBy) GetBy() isSelectBy_By {
+	if m != nil {
+		return m.By
+	}
+	return nil
+}
+
+func (m *SelectBy) GetID() string {
+	if x, ok := m.GetBy().(*SelectBy_ID); ok {
+		return x.ID
+	}
+	return ""
+}
+
+func (m *SelectBy) GetIDPrefix() string {
+	if x, ok := m.GetBy().(*SelectBy_IDPrefix); ok {
+		return x.IDPrefix
+	}
+	return ""
+}
+
+func (m *SelectBy) GetName() string {
+	if x, ok := m.GetBy().(*SelectBy_Name); ok {
+		return x.Name
+	}
+	return ""
+}
+
+func (m *SelectBy) GetNamePrefix() string {
+	if x, ok := m.GetBy().(*SelectBy_NamePrefix); ok {
+		return x.NamePrefix
+	}
+	return ""
+}
+
+func (m *SelectBy) GetCustom() *SelectByCustom {
+	if x, ok := m.GetBy().(*SelectBy_Custom); ok {
+		return x.Custom
+	}
+	return nil
+}
+
+func (m *SelectBy) GetCustomPrefix() *SelectByCustom {
+	if x, ok := m.GetBy().(*SelectBy_CustomPrefix); ok {
+		return x.CustomPrefix
+	}
+	return nil
+}
+
+func (m *SelectBy) GetServiceID() string {
+	if x, ok := m.GetBy().(*SelectBy_ServiceID); ok {
+		return x.ServiceID
+	}
+	return ""
+}
+
+func (m *SelectBy) GetNodeID() string {
+	if x, ok := m.GetBy().(*SelectBy_NodeID); ok {
+		return x.NodeID
+	}
+	return ""
+}
+
+func (m *SelectBy) GetSlot() *SelectBySlot {
+	if x, ok := m.GetBy().(*SelectBy_Slot); ok {
+		return x.Slot
+	}
+	return nil
+}
+
+func (m *SelectBy) GetDesiredState() TaskState {
+	if x, ok := m.GetBy().(*SelectBy_DesiredState); ok {
+		return x.DesiredState
+	}
+	return TaskStateNew
+}
+
+func (m *SelectBy) GetRole() NodeRole {
+	if x, ok := m.GetBy().(*SelectBy_Role); ok {
+		return x.Role
+	}
+	return NodeRoleWorker
+}
+
+func (m *SelectBy) GetMembership() NodeSpec_Membership {
+	if x, ok := m.GetBy().(*SelectBy_Membership); ok {
+		return x.Membership
+	}
+	return NodeMembershipPending
+}
+
+func (m *SelectBy) GetReferencedNetworkID() string {
+	if x, ok := m.GetBy().(*SelectBy_ReferencedNetworkID); ok {
+		return x.ReferencedNetworkID
+	}
+	return ""
+}
+
+func (m *SelectBy) GetReferencedSecretID() string {
+	if x, ok := m.GetBy().(*SelectBy_ReferencedSecretID); ok {
+		return x.ReferencedSecretID
+	}
+	return ""
+}
+
+func (m *SelectBy) GetKind() string {
+	if x, ok := m.GetBy().(*SelectBy_Kind); ok {
+		return x.Kind
+	}
+	return ""
+}
+
+// XXX_OneofFuncs is for the internal use of the proto package.
+func (*SelectBy) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
+	return _SelectBy_OneofMarshaler, _SelectBy_OneofUnmarshaler, _SelectBy_OneofSizer, []interface{}{
+		(*SelectBy_ID)(nil),
+		(*SelectBy_IDPrefix)(nil),
+		(*SelectBy_Name)(nil),
+		(*SelectBy_NamePrefix)(nil),
+		(*SelectBy_Custom)(nil),
+		(*SelectBy_CustomPrefix)(nil),
+		(*SelectBy_ServiceID)(nil),
+		(*SelectBy_NodeID)(nil),
+		(*SelectBy_Slot)(nil),
+		(*SelectBy_DesiredState)(nil),
+		(*SelectBy_Role)(nil),
+		(*SelectBy_Membership)(nil),
+		(*SelectBy_ReferencedNetworkID)(nil),
+		(*SelectBy_ReferencedSecretID)(nil),
+		(*SelectBy_Kind)(nil),
+	}
+}
+
+func _SelectBy_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
+	m := msg.(*SelectBy)
+	// By
+	switch x := m.By.(type) {
+	case *SelectBy_ID:
+		_ = b.EncodeVarint(1<<3 | proto.WireBytes)
+		_ = b.EncodeStringBytes(x.ID)
+	case *SelectBy_IDPrefix:
+		_ = b.EncodeVarint(2<<3 | proto.WireBytes)
+		_ = b.EncodeStringBytes(x.IDPrefix)
+	case *SelectBy_Name:
+		_ = b.EncodeVarint(3<<3 | proto.WireBytes)
+		_ = b.EncodeStringBytes(x.Name)
+	case *SelectBy_NamePrefix:
+		_ = b.EncodeVarint(4<<3 | proto.WireBytes)
+		_ = b.EncodeStringBytes(x.NamePrefix)
+	case *SelectBy_Custom:
+		_ = b.EncodeVarint(5<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.Custom); err != nil {
+			return err
+		}
+	case *SelectBy_CustomPrefix:
+		_ = b.EncodeVarint(6<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.CustomPrefix); err != nil {
+			return err
+		}
+	case *SelectBy_ServiceID:
+		_ = b.EncodeVarint(7<<3 | proto.WireBytes)
+		_ = b.EncodeStringBytes(x.ServiceID)
+	case *SelectBy_NodeID:
+		_ = b.EncodeVarint(8<<3 | proto.WireBytes)
+		_ = b.EncodeStringBytes(x.NodeID)
+	case *SelectBy_Slot:
+		_ = b.EncodeVarint(9<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.Slot); err != nil {
+			return err
+		}
+	case *SelectBy_DesiredState:
+		_ = b.EncodeVarint(10<<3 | proto.WireVarint)
+		_ = b.EncodeVarint(uint64(x.DesiredState))
+	case *SelectBy_Role:
+		_ = b.EncodeVarint(11<<3 | proto.WireVarint)
+		_ = b.EncodeVarint(uint64(x.Role))
+	case *SelectBy_Membership:
+		_ = b.EncodeVarint(12<<3 | proto.WireVarint)
+		_ = b.EncodeVarint(uint64(x.Membership))
+	case *SelectBy_ReferencedNetworkID:
+		_ = b.EncodeVarint(13<<3 | proto.WireBytes)
+		_ = b.EncodeStringBytes(x.ReferencedNetworkID)
+	case *SelectBy_ReferencedSecretID:
+		_ = b.EncodeVarint(14<<3 | proto.WireBytes)
+		_ = b.EncodeStringBytes(x.ReferencedSecretID)
+	case *SelectBy_Kind:
+		_ = b.EncodeVarint(15<<3 | proto.WireBytes)
+		_ = b.EncodeStringBytes(x.Kind)
+	case nil:
+	default:
+		return fmt.Errorf("SelectBy.By has unexpected type %T", x)
+	}
+	return nil
+}
+
+func _SelectBy_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
+	m := msg.(*SelectBy)
+	switch tag {
+	case 1: // By.id
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		x, err := b.DecodeStringBytes()
+		m.By = &SelectBy_ID{x}
+		return true, err
+	case 2: // By.id_prefix
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		x, err := b.DecodeStringBytes()
+		m.By = &SelectBy_IDPrefix{x}
+		return true, err
+	case 3: // By.name
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		x, err := b.DecodeStringBytes()
+		m.By = &SelectBy_Name{x}
+		return true, err
+	case 4: // By.name_prefix
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		x, err := b.DecodeStringBytes()
+		m.By = &SelectBy_NamePrefix{x}
+		return true, err
+	case 5: // By.custom
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(SelectByCustom)
+		err := b.DecodeMessage(msg)
+		m.By = &SelectBy_Custom{msg}
+		return true, err
+	case 6: // By.custom_prefix
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(SelectByCustom)
+		err := b.DecodeMessage(msg)
+		m.By = &SelectBy_CustomPrefix{msg}
+		return true, err
+	case 7: // By.service_id
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		x, err := b.DecodeStringBytes()
+		m.By = &SelectBy_ServiceID{x}
+		return true, err
+	case 8: // By.node_id
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		x, err := b.DecodeStringBytes()
+		m.By = &SelectBy_NodeID{x}
+		return true, err
+	case 9: // By.slot
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(SelectBySlot)
+		err := b.DecodeMessage(msg)
+		m.By = &SelectBy_Slot{msg}
+		return true, err
+	case 10: // By.desired_state
+		if wire != proto.WireVarint {
+			return true, proto.ErrInternalBadWireType
+		}
+		x, err := b.DecodeVarint()
+		m.By = &SelectBy_DesiredState{TaskState(x)}
+		return true, err
+	case 11: // By.role
+		if wire != proto.WireVarint {
+			return true, proto.ErrInternalBadWireType
+		}
+		x, err := b.DecodeVarint()
+		m.By = &SelectBy_Role{NodeRole(x)}
+		return true, err
+	case 12: // By.membership
+		if wire != proto.WireVarint {
+			return true, proto.ErrInternalBadWireType
+		}
+		x, err := b.DecodeVarint()
+		m.By = &SelectBy_Membership{NodeSpec_Membership(x)}
+		return true, err
+	case 13: // By.referenced_network_id
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		x, err := b.DecodeStringBytes()
+		m.By = &SelectBy_ReferencedNetworkID{x}
+		return true, err
+	case 14: // By.referenced_secret_id
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		x, err := b.DecodeStringBytes()
+		m.By = &SelectBy_ReferencedSecretID{x}
+		return true, err
+	case 15: // By.kind
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		x, err := b.DecodeStringBytes()
+		m.By = &SelectBy_Kind{x}
+		return true, err
+	default:
+		return false, nil
+	}
+}
+
+func _SelectBy_OneofSizer(msg proto.Message) (n int) {
+	m := msg.(*SelectBy)
+	// By
+	switch x := m.By.(type) {
+	case *SelectBy_ID:
+		n += proto.SizeVarint(1<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(len(x.ID)))
+		n += len(x.ID)
+	case *SelectBy_IDPrefix:
+		n += proto.SizeVarint(2<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(len(x.IDPrefix)))
+		n += len(x.IDPrefix)
+	case *SelectBy_Name:
+		n += proto.SizeVarint(3<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(len(x.Name)))
+		n += len(x.Name)
+	case *SelectBy_NamePrefix:
+		n += proto.SizeVarint(4<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(len(x.NamePrefix)))
+		n += len(x.NamePrefix)
+	case *SelectBy_Custom:
+		s := proto.Size(x.Custom)
+		n += proto.SizeVarint(5<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case *SelectBy_CustomPrefix:
+		s := proto.Size(x.CustomPrefix)
+		n += proto.SizeVarint(6<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case *SelectBy_ServiceID:
+		n += proto.SizeVarint(7<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(len(x.ServiceID)))
+		n += len(x.ServiceID)
+	case *SelectBy_NodeID:
+		n += proto.SizeVarint(8<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(len(x.NodeID)))
+		n += len(x.NodeID)
+	case *SelectBy_Slot:
+		s := proto.Size(x.Slot)
+		n += proto.SizeVarint(9<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case *SelectBy_DesiredState:
+		n += proto.SizeVarint(10<<3 | proto.WireVarint)
+		n += proto.SizeVarint(uint64(x.DesiredState))
+	case *SelectBy_Role:
+		n += proto.SizeVarint(11<<3 | proto.WireVarint)
+		n += proto.SizeVarint(uint64(x.Role))
+	case *SelectBy_Membership:
+		n += proto.SizeVarint(12<<3 | proto.WireVarint)
+		n += proto.SizeVarint(uint64(x.Membership))
+	case *SelectBy_ReferencedNetworkID:
+		n += proto.SizeVarint(13<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(len(x.ReferencedNetworkID)))
+		n += len(x.ReferencedNetworkID)
+	case *SelectBy_ReferencedSecretID:
+		n += proto.SizeVarint(14<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(len(x.ReferencedSecretID)))
+		n += len(x.ReferencedSecretID)
+	case *SelectBy_Kind:
+		n += proto.SizeVarint(15<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(len(x.Kind)))
+		n += len(x.Kind)
+	case nil:
+	default:
+		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
+	}
+	return n
+}
+
+type WatchRequest struct {
+	// Multiple entries are combined using OR logic - i.e. if an event
+	// matches all of the selectors specified in any single watch entry,
+	// the event will be sent to the client.
+	Entries []*WatchRequest_WatchEntry `protobuf:"bytes,1,rep,name=entries" json:"entries,omitempty"`
+	// ResumeFrom provides an version to resume the watch from, if non-nil.
+	// The watch will return changes since this version, and continue to
+	// return new changes afterwards. Watch will return an error if the
+	// server has compacted its log and no longer has complete history to
+	// this point.
+	ResumeFrom *Version `protobuf:"bytes,2,opt,name=resume_from,json=resumeFrom" json:"resume_from,omitempty"`
+	// IncludeOldObject causes WatchMessages to include a copy of the
+	// previous version of the object on updates. Note that only live
+	// changes will include the old object (not historical changes
+	// retrieved using ResumeFrom).
+	IncludeOldObject bool `protobuf:"varint,3,opt,name=include_old_object,json=includeOldObject,proto3" json:"include_old_object,omitempty"`
+}
+
+func (m *WatchRequest) Reset()                    { *m = WatchRequest{} }
+func (*WatchRequest) ProtoMessage()               {}
+func (*WatchRequest) Descriptor() ([]byte, []int) { return fileDescriptorStore, []int{4} }
+
+type WatchRequest_WatchEntry struct {
+	// Kind can contain a builtin type such as "node", "secret", etc. or
+	// the kind specified by a custom-defined object.
+	Kind string `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
+	// Action (create/update/delete)
+	// This is a bitmask, so multiple actions may be OR'd together
+	Action WatchActionKind `protobuf:"varint,2,opt,name=action,proto3,enum=docker.swarmkit.v1.WatchActionKind" json:"action,omitempty"`
+	// Filters are combined using AND logic - an event must match
+	// all of them to pass the filter.
+	Filters []*SelectBy `protobuf:"bytes,3,rep,name=filters" json:"filters,omitempty"`
+}
+
+func (m *WatchRequest_WatchEntry) Reset()                    { *m = WatchRequest_WatchEntry{} }
+func (*WatchRequest_WatchEntry) ProtoMessage()               {}
+func (*WatchRequest_WatchEntry) Descriptor() ([]byte, []int) { return fileDescriptorStore, []int{4, 0} }
+
+// WatchMessage is the type of the stream that's returned to the client by
+// Watch. Note that the first item of this stream will always be a WatchMessage
+// with a nil Object, to signal that the stream has started.
+type WatchMessage struct {
+	Events []*WatchMessage_Event `protobuf:"bytes,1,rep,name=events" json:"events,omitempty"`
+	// Index versions this change to the data store. It can be used to
+	// resume the watch from this point.
+	Version *Version `protobuf:"bytes,2,opt,name=version" json:"version,omitempty"`
+}
+
+func (m *WatchMessage) Reset()                    { *m = WatchMessage{} }
+func (*WatchMessage) ProtoMessage()               {}
+func (*WatchMessage) Descriptor() ([]byte, []int) { return fileDescriptorStore, []int{5} }
+
+type WatchMessage_Event struct {
+	// Action (create/update/delete)
+	// Note that WatchMessage does not expose "commit" events that
+	// mark transaction boundaries.
+	Action WatchActionKind `protobuf:"varint,1,opt,name=action,proto3,enum=docker.swarmkit.v1.WatchActionKind" json:"action,omitempty"`
+	// Matched object
+	Object *Object `protobuf:"bytes,2,opt,name=object" json:"object,omitempty"`
+	// For updates, OldObject will optionally be included in the
+	// watch message, containing the previous version of the
+	// object, if IncludeOldObject was set in WatchRequest.
+	OldObject *Object `protobuf:"bytes,3,opt,name=old_object,json=oldObject" json:"old_object,omitempty"`
+}
+
+func (m *WatchMessage_Event) Reset()                    { *m = WatchMessage_Event{} }
+func (*WatchMessage_Event) ProtoMessage()               {}
+func (*WatchMessage_Event) Descriptor() ([]byte, []int) { return fileDescriptorStore, []int{5, 0} }
+
+func init() {
+	proto.RegisterType((*Object)(nil), "docker.swarmkit.v1.Object")
+	proto.RegisterType((*SelectBySlot)(nil), "docker.swarmkit.v1.SelectBySlot")
+	proto.RegisterType((*SelectByCustom)(nil), "docker.swarmkit.v1.SelectByCustom")
+	proto.RegisterType((*SelectBy)(nil), "docker.swarmkit.v1.SelectBy")
+	proto.RegisterType((*WatchRequest)(nil), "docker.swarmkit.v1.WatchRequest")
+	proto.RegisterType((*WatchRequest_WatchEntry)(nil), "docker.swarmkit.v1.WatchRequest.WatchEntry")
+	proto.RegisterType((*WatchMessage)(nil), "docker.swarmkit.v1.WatchMessage")
+	proto.RegisterType((*WatchMessage_Event)(nil), "docker.swarmkit.v1.WatchMessage.Event")
+	proto.RegisterEnum("docker.swarmkit.v1.WatchActionKind", WatchActionKind_name, WatchActionKind_value)
+}
+
+type authenticatedWrapperStoreServer struct {
+	local     StoreServer
+	authorize func(context.Context, []string) error
+}
+
+func NewAuthenticatedWrapperStoreServer(local StoreServer, authorize func(context.Context, []string) error) StoreServer {
+	return &authenticatedWrapperStoreServer{
+		local:     local,
+		authorize: authorize,
+	}
+}
+
+func (p *authenticatedWrapperStoreServer) Watch(r *WatchRequest, stream Store_WatchServer) error {
+
+	if err := p.authorize(stream.Context(), []string{"swarm-manager"}); err != nil {
+		return err
+	}
+	return p.local.Watch(r, stream)
+}
+
+func (m *Object) Copy() *Object {
+	if m == nil {
+		return nil
+	}
+	o := &Object{}
+	o.CopyFrom(m)
+	return o
+}
+
+func (m *Object) CopyFrom(src interface{}) {
+
+	o := src.(*Object)
+	*m = *o
+	if o.Object != nil {
+		switch o.Object.(type) {
+		case *Object_Node:
+			v := Object_Node{
+				Node: &Node{},
+			}
+			github_com_docker_swarmkit_api_deepcopy.Copy(v.Node, o.GetNode())
+			m.Object = &v
+		case *Object_Service:
+			v := Object_Service{
+				Service: &Service{},
+			}
+			github_com_docker_swarmkit_api_deepcopy.Copy(v.Service, o.GetService())
+			m.Object = &v
+		case *Object_Network:
+			v := Object_Network{
+				Network: &Network{},
+			}
+			github_com_docker_swarmkit_api_deepcopy.Copy(v.Network, o.GetNetwork())
+			m.Object = &v
+		case *Object_Task:
+			v := Object_Task{
+				Task: &Task{},
+			}
+			github_com_docker_swarmkit_api_deepcopy.Copy(v.Task, o.GetTask())
+			m.Object = &v
+		case *Object_Cluster:
+			v := Object_Cluster{
+				Cluster: &Cluster{},
+			}
+			github_com_docker_swarmkit_api_deepcopy.Copy(v.Cluster, o.GetCluster())
+			m.Object = &v
+		case *Object_Secret:
+			v := Object_Secret{
+				Secret: &Secret{},
+			}
+			github_com_docker_swarmkit_api_deepcopy.Copy(v.Secret, o.GetSecret())
+			m.Object = &v
+		case *Object_Resource:
+			v := Object_Resource{
+				Resource: &Resource{},
+			}
+			github_com_docker_swarmkit_api_deepcopy.Copy(v.Resource, o.GetResource())
+			m.Object = &v
+		case *Object_Extension:
+			v := Object_Extension{
+				Extension: &Extension{},
+			}
+			github_com_docker_swarmkit_api_deepcopy.Copy(v.Extension, o.GetExtension())
+			m.Object = &v
+		}
+	}
+
+}
+
+func (m *SelectBySlot) Copy() *SelectBySlot {
+	if m == nil {
+		return nil
+	}
+	o := &SelectBySlot{}
+	o.CopyFrom(m)
+	return o
+}
+
+func (m *SelectBySlot) CopyFrom(src interface{}) {
+
+	o := src.(*SelectBySlot)
+	*m = *o
+}
+
+func (m *SelectByCustom) Copy() *SelectByCustom {
+	if m == nil {
+		return nil
+	}
+	o := &SelectByCustom{}
+	o.CopyFrom(m)
+	return o
+}
+
+func (m *SelectByCustom) CopyFrom(src interface{}) {
+
+	o := src.(*SelectByCustom)
+	*m = *o
+}
+
+func (m *SelectBy) Copy() *SelectBy {
+	if m == nil {
+		return nil
+	}
+	o := &SelectBy{}
+	o.CopyFrom(m)
+	return o
+}
+
+func (m *SelectBy) CopyFrom(src interface{}) {
+
+	o := src.(*SelectBy)
+	*m = *o
+	if o.By != nil {
+		switch o.By.(type) {
+		case *SelectBy_ID:
+			v := SelectBy_ID{
+				ID: o.GetID(),
+			}
+			m.By = &v
+		case *SelectBy_IDPrefix:
+			v := SelectBy_IDPrefix{
+				IDPrefix: o.GetIDPrefix(),
+			}
+			m.By = &v
+		case *SelectBy_Name:
+			v := SelectBy_Name{
+				Name: o.GetName(),
+			}
+			m.By = &v
+		case *SelectBy_NamePrefix:
+			v := SelectBy_NamePrefix{
+				NamePrefix: o.GetNamePrefix(),
+			}
+			m.By = &v
+		case *SelectBy_Custom:
+			v := SelectBy_Custom{
+				Custom: &SelectByCustom{},
+			}
+			github_com_docker_swarmkit_api_deepcopy.Copy(v.Custom, o.GetCustom())
+			m.By = &v
+		case *SelectBy_CustomPrefix:
+			v := SelectBy_CustomPrefix{
+				CustomPrefix: &SelectByCustom{},
+			}
+			github_com_docker_swarmkit_api_deepcopy.Copy(v.CustomPrefix, o.GetCustomPrefix())
+			m.By = &v
+		case *SelectBy_ServiceID:
+			v := SelectBy_ServiceID{
+				ServiceID: o.GetServiceID(),
+			}
+			m.By = &v
+		case *SelectBy_NodeID:
+			v := SelectBy_NodeID{
+				NodeID: o.GetNodeID(),
+			}
+			m.By = &v
+		case *SelectBy_Slot:
+			v := SelectBy_Slot{
+				Slot: &SelectBySlot{},
+			}
+			github_com_docker_swarmkit_api_deepcopy.Copy(v.Slot, o.GetSlot())
+			m.By = &v
+		case *SelectBy_DesiredState:
+			v := SelectBy_DesiredState{
+				DesiredState: o.GetDesiredState(),
+			}
+			m.By = &v
+		case *SelectBy_Role:
+			v := SelectBy_Role{
+				Role: o.GetRole(),
+			}
+			m.By = &v
+		case *SelectBy_Membership:
+			v := SelectBy_Membership{
+				Membership: o.GetMembership(),
+			}
+			m.By = &v
+		case *SelectBy_ReferencedNetworkID:
+			v := SelectBy_ReferencedNetworkID{
+				ReferencedNetworkID: o.GetReferencedNetworkID(),
+			}
+			m.By = &v
+		case *SelectBy_ReferencedSecretID:
+			v := SelectBy_ReferencedSecretID{
+				ReferencedSecretID: o.GetReferencedSecretID(),
+			}
+			m.By = &v
+		case *SelectBy_Kind:
+			v := SelectBy_Kind{
+				Kind: o.GetKind(),
+			}
+			m.By = &v
+		}
+	}
+
+}
+
+func (m *WatchRequest) Copy() *WatchRequest {
+	if m == nil {
+		return nil
+	}
+	o := &WatchRequest{}
+	o.CopyFrom(m)
+	return o
+}
+
+func (m *WatchRequest) CopyFrom(src interface{}) {
+
+	o := src.(*WatchRequest)
+	*m = *o
+	if o.Entries != nil {
+		m.Entries = make([]*WatchRequest_WatchEntry, len(o.Entries))
+		for i := range m.Entries {
+			m.Entries[i] = &WatchRequest_WatchEntry{}
+			github_com_docker_swarmkit_api_deepcopy.Copy(m.Entries[i], o.Entries[i])
+		}
+	}
+
+	if o.ResumeFrom != nil {
+		m.ResumeFrom = &Version{}
+		github_com_docker_swarmkit_api_deepcopy.Copy(m.ResumeFrom, o.ResumeFrom)
+	}
+}
+
+func (m *WatchRequest_WatchEntry) Copy() *WatchRequest_WatchEntry {
+	if m == nil {
+		return nil
+	}
+	o := &WatchRequest_WatchEntry{}
+	o.CopyFrom(m)
+	return o
+}
+
+func (m *WatchRequest_WatchEntry) CopyFrom(src interface{}) {
+
+	o := src.(*WatchRequest_WatchEntry)
+	*m = *o
+	if o.Filters != nil {
+		m.Filters = make([]*SelectBy, len(o.Filters))
+		for i := range m.Filters {
+			m.Filters[i] = &SelectBy{}
+			github_com_docker_swarmkit_api_deepcopy.Copy(m.Filters[i], o.Filters[i])
+		}
+	}
+
+}
+
+func (m *WatchMessage) Copy() *WatchMessage {
+	if m == nil {
+		return nil
+	}
+	o := &WatchMessage{}
+	o.CopyFrom(m)
+	return o
+}
+
+func (m *WatchMessage) CopyFrom(src interface{}) {
+
+	o := src.(*WatchMessage)
+	*m = *o
+	if o.Events != nil {
+		m.Events = make([]*WatchMessage_Event, len(o.Events))
+		for i := range m.Events {
+			m.Events[i] = &WatchMessage_Event{}
+			github_com_docker_swarmkit_api_deepcopy.Copy(m.Events[i], o.Events[i])
+		}
+	}
+
+	if o.Version != nil {
+		m.Version = &Version{}
+		github_com_docker_swarmkit_api_deepcopy.Copy(m.Version, o.Version)
+	}
+}
+
+func (m *WatchMessage_Event) Copy() *WatchMessage_Event {
+	if m == nil {
+		return nil
+	}
+	o := &WatchMessage_Event{}
+	o.CopyFrom(m)
+	return o
+}
+
+func (m *WatchMessage_Event) CopyFrom(src interface{}) {
+
+	o := src.(*WatchMessage_Event)
+	*m = *o
+	if o.Object != nil {
+		m.Object = &Object{}
+		github_com_docker_swarmkit_api_deepcopy.Copy(m.Object, o.Object)
+	}
+	if o.OldObject != nil {
+		m.OldObject = &Object{}
+		github_com_docker_swarmkit_api_deepcopy.Copy(m.OldObject, o.OldObject)
+	}
+}
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ context.Context
+var _ grpc.ClientConn
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+const _ = grpc.SupportPackageIsVersion4
+
+// Client API for Store service
+
+type StoreClient interface {
+	// Watch starts a stream that returns any changes to objects that match
+	// the specified selectors. When the stream begins, it immediately sends
+	// an empty message back to the client. It is important to wait for
+	// this message before taking any actions that depend on an established
+	// stream of changes for consistency.
+	Watch(ctx context.Context, in *WatchRequest, opts ...grpc.CallOption) (Store_WatchClient, error)
+}
+
+type storeClient struct {
+	cc *grpc.ClientConn
+}
+
+func NewStoreClient(cc *grpc.ClientConn) StoreClient {
+	return &storeClient{cc}
+}
+
+func (c *storeClient) Watch(ctx context.Context, in *WatchRequest, opts ...grpc.CallOption) (Store_WatchClient, error) {
+	stream, err := grpc.NewClientStream(ctx, &_Store_serviceDesc.Streams[0], c.cc, "/docker.swarmkit.v1.Store/Watch", opts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &storeWatchClient{stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+type Store_WatchClient interface {
+	Recv() (*WatchMessage, error)
+	grpc.ClientStream
+}
+
+type storeWatchClient struct {
+	grpc.ClientStream
+}
+
+func (x *storeWatchClient) Recv() (*WatchMessage, error) {
+	m := new(WatchMessage)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// Server API for Store service
+
+type StoreServer interface {
+	// Watch starts a stream that returns any changes to objects that match
+	// the specified selectors. When the stream begins, it immediately sends
+	// an empty message back to the client. It is important to wait for
+	// this message before taking any actions that depend on an established
+	// stream of changes for consistency.
+	Watch(*WatchRequest, Store_WatchServer) error
+}
+
+func RegisterStoreServer(s *grpc.Server, srv StoreServer) {
+	s.RegisterService(&_Store_serviceDesc, srv)
+}
+
+func _Store_Watch_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(WatchRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(StoreServer).Watch(m, &storeWatchServer{stream})
+}
+
+type Store_WatchServer interface {
+	Send(*WatchMessage) error
+	grpc.ServerStream
+}
+
+type storeWatchServer struct {
+	grpc.ServerStream
+}
+
+func (x *storeWatchServer) Send(m *WatchMessage) error {
+	return x.ServerStream.SendMsg(m)
+}
+
+var _Store_serviceDesc = grpc.ServiceDesc{
+	ServiceName: "docker.swarmkit.v1.Store",
+	HandlerType: (*StoreServer)(nil),
+	Methods:     []grpc.MethodDesc{},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "Watch",
+			Handler:       _Store_Watch_Handler,
+			ServerStreams: true,
+		},
+	},
+	Metadata: "store.proto",
+}
+
+func (m *Object) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Object) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if m.Object != nil {
+		nn1, err := m.Object.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += nn1
+	}
+	return i, nil
+}
+
+func (m *Object_Node) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	if m.Node != nil {
+		dAtA[i] = 0xa
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(m.Node.Size()))
+		n2, err := m.Node.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n2
+	}
+	return i, nil
+}
+func (m *Object_Service) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	if m.Service != nil {
+		dAtA[i] = 0x12
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(m.Service.Size()))
+		n3, err := m.Service.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n3
+	}
+	return i, nil
+}
+func (m *Object_Network) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	if m.Network != nil {
+		dAtA[i] = 0x1a
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(m.Network.Size()))
+		n4, err := m.Network.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n4
+	}
+	return i, nil
+}
+func (m *Object_Task) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	if m.Task != nil {
+		dAtA[i] = 0x22
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(m.Task.Size()))
+		n5, err := m.Task.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n5
+	}
+	return i, nil
+}
+func (m *Object_Cluster) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	if m.Cluster != nil {
+		dAtA[i] = 0x2a
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(m.Cluster.Size()))
+		n6, err := m.Cluster.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n6
+	}
+	return i, nil
+}
+func (m *Object_Secret) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	if m.Secret != nil {
+		dAtA[i] = 0x32
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(m.Secret.Size()))
+		n7, err := m.Secret.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n7
+	}
+	return i, nil
+}
+func (m *Object_Resource) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	if m.Resource != nil {
+		dAtA[i] = 0x3a
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(m.Resource.Size()))
+		n8, err := m.Resource.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n8
+	}
+	return i, nil
+}
+func (m *Object_Extension) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	if m.Extension != nil {
+		dAtA[i] = 0x42
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(m.Extension.Size()))
+		n9, err := m.Extension.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n9
+	}
+	return i, nil
+}
+func (m *SelectBySlot) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SelectBySlot) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if len(m.ServiceID) > 0 {
+		dAtA[i] = 0xa
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(len(m.ServiceID)))
+		i += copy(dAtA[i:], m.ServiceID)
+	}
+	if m.Slot != 0 {
+		dAtA[i] = 0x10
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(m.Slot))
+	}
+	return i, nil
+}
+
+func (m *SelectByCustom) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SelectByCustom) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if len(m.Kind) > 0 {
+		dAtA[i] = 0xa
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(len(m.Kind)))
+		i += copy(dAtA[i:], m.Kind)
+	}
+	if len(m.Index) > 0 {
+		dAtA[i] = 0x12
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(len(m.Index)))
+		i += copy(dAtA[i:], m.Index)
+	}
+	if len(m.Value) > 0 {
+		dAtA[i] = 0x1a
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(len(m.Value)))
+		i += copy(dAtA[i:], m.Value)
+	}
+	return i, nil
+}
+
+func (m *SelectBy) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SelectBy) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if m.By != nil {
+		nn10, err := m.By.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += nn10
+	}
+	return i, nil
+}
+
+func (m *SelectBy_ID) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	dAtA[i] = 0xa
+	i++
+	i = encodeVarintStore(dAtA, i, uint64(len(m.ID)))
+	i += copy(dAtA[i:], m.ID)
+	return i, nil
+}
+func (m *SelectBy_IDPrefix) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	dAtA[i] = 0x12
+	i++
+	i = encodeVarintStore(dAtA, i, uint64(len(m.IDPrefix)))
+	i += copy(dAtA[i:], m.IDPrefix)
+	return i, nil
+}
+func (m *SelectBy_Name) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	dAtA[i] = 0x1a
+	i++
+	i = encodeVarintStore(dAtA, i, uint64(len(m.Name)))
+	i += copy(dAtA[i:], m.Name)
+	return i, nil
+}
+func (m *SelectBy_NamePrefix) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	dAtA[i] = 0x22
+	i++
+	i = encodeVarintStore(dAtA, i, uint64(len(m.NamePrefix)))
+	i += copy(dAtA[i:], m.NamePrefix)
+	return i, nil
+}
+func (m *SelectBy_Custom) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	if m.Custom != nil {
+		dAtA[i] = 0x2a
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(m.Custom.Size()))
+		n11, err := m.Custom.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n11
+	}
+	return i, nil
+}
+func (m *SelectBy_CustomPrefix) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	if m.CustomPrefix != nil {
+		dAtA[i] = 0x32
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(m.CustomPrefix.Size()))
+		n12, err := m.CustomPrefix.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n12
+	}
+	return i, nil
+}
+func (m *SelectBy_ServiceID) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	dAtA[i] = 0x3a
+	i++
+	i = encodeVarintStore(dAtA, i, uint64(len(m.ServiceID)))
+	i += copy(dAtA[i:], m.ServiceID)
+	return i, nil
+}
+func (m *SelectBy_NodeID) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	dAtA[i] = 0x42
+	i++
+	i = encodeVarintStore(dAtA, i, uint64(len(m.NodeID)))
+	i += copy(dAtA[i:], m.NodeID)
+	return i, nil
+}
+func (m *SelectBy_Slot) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	if m.Slot != nil {
+		dAtA[i] = 0x4a
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(m.Slot.Size()))
+		n13, err := m.Slot.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n13
+	}
+	return i, nil
+}
+func (m *SelectBy_DesiredState) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	dAtA[i] = 0x50
+	i++
+	i = encodeVarintStore(dAtA, i, uint64(m.DesiredState))
+	return i, nil
+}
+func (m *SelectBy_Role) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	dAtA[i] = 0x58
+	i++
+	i = encodeVarintStore(dAtA, i, uint64(m.Role))
+	return i, nil
+}
+func (m *SelectBy_Membership) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	dAtA[i] = 0x60
+	i++
+	i = encodeVarintStore(dAtA, i, uint64(m.Membership))
+	return i, nil
+}
+func (m *SelectBy_ReferencedNetworkID) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	dAtA[i] = 0x6a
+	i++
+	i = encodeVarintStore(dAtA, i, uint64(len(m.ReferencedNetworkID)))
+	i += copy(dAtA[i:], m.ReferencedNetworkID)
+	return i, nil
+}
+func (m *SelectBy_ReferencedSecretID) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	dAtA[i] = 0x72
+	i++
+	i = encodeVarintStore(dAtA, i, uint64(len(m.ReferencedSecretID)))
+	i += copy(dAtA[i:], m.ReferencedSecretID)
+	return i, nil
+}
+func (m *SelectBy_Kind) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	dAtA[i] = 0x7a
+	i++
+	i = encodeVarintStore(dAtA, i, uint64(len(m.Kind)))
+	i += copy(dAtA[i:], m.Kind)
+	return i, nil
+}
+func (m *WatchRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WatchRequest) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if len(m.Entries) > 0 {
+		for _, msg := range m.Entries {
+			dAtA[i] = 0xa
+			i++
+			i = encodeVarintStore(dAtA, i, uint64(msg.Size()))
+			n, err := msg.MarshalTo(dAtA[i:])
+			if err != nil {
+				return 0, err
+			}
+			i += n
+		}
+	}
+	if m.ResumeFrom != nil {
+		dAtA[i] = 0x12
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(m.ResumeFrom.Size()))
+		n14, err := m.ResumeFrom.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n14
+	}
+	if m.IncludeOldObject {
+		dAtA[i] = 0x18
+		i++
+		if m.IncludeOldObject {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i++
+	}
+	return i, nil
+}
+
+func (m *WatchRequest_WatchEntry) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WatchRequest_WatchEntry) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if len(m.Kind) > 0 {
+		dAtA[i] = 0xa
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(len(m.Kind)))
+		i += copy(dAtA[i:], m.Kind)
+	}
+	if m.Action != 0 {
+		dAtA[i] = 0x10
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(m.Action))
+	}
+	if len(m.Filters) > 0 {
+		for _, msg := range m.Filters {
+			dAtA[i] = 0x1a
+			i++
+			i = encodeVarintStore(dAtA, i, uint64(msg.Size()))
+			n, err := msg.MarshalTo(dAtA[i:])
+			if err != nil {
+				return 0, err
+			}
+			i += n
+		}
+	}
+	return i, nil
+}
+
+func (m *WatchMessage) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WatchMessage) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if len(m.Events) > 0 {
+		for _, msg := range m.Events {
+			dAtA[i] = 0xa
+			i++
+			i = encodeVarintStore(dAtA, i, uint64(msg.Size()))
+			n, err := msg.MarshalTo(dAtA[i:])
+			if err != nil {
+				return 0, err
+			}
+			i += n
+		}
+	}
+	if m.Version != nil {
+		dAtA[i] = 0x12
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(m.Version.Size()))
+		n15, err := m.Version.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n15
+	}
+	return i, nil
+}
+
+func (m *WatchMessage_Event) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WatchMessage_Event) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if m.Action != 0 {
+		dAtA[i] = 0x8
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(m.Action))
+	}
+	if m.Object != nil {
+		dAtA[i] = 0x12
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(m.Object.Size()))
+		n16, err := m.Object.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n16
+	}
+	if m.OldObject != nil {
+		dAtA[i] = 0x1a
+		i++
+		i = encodeVarintStore(dAtA, i, uint64(m.OldObject.Size()))
+		n17, err := m.OldObject.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n17
+	}
+	return i, nil
+}
+
+func encodeFixed64Store(dAtA []byte, offset int, v uint64) int {
+	dAtA[offset] = uint8(v)
+	dAtA[offset+1] = uint8(v >> 8)
+	dAtA[offset+2] = uint8(v >> 16)
+	dAtA[offset+3] = uint8(v >> 24)
+	dAtA[offset+4] = uint8(v >> 32)
+	dAtA[offset+5] = uint8(v >> 40)
+	dAtA[offset+6] = uint8(v >> 48)
+	dAtA[offset+7] = uint8(v >> 56)
+	return offset + 8
+}
+func encodeFixed32Store(dAtA []byte, offset int, v uint32) int {
+	dAtA[offset] = uint8(v)
+	dAtA[offset+1] = uint8(v >> 8)
+	dAtA[offset+2] = uint8(v >> 16)
+	dAtA[offset+3] = uint8(v >> 24)
+	return offset + 4
+}
+func encodeVarintStore(dAtA []byte, offset int, v uint64) int {
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return offset + 1
+}
+
+type raftProxyStoreServer struct {
+	local                       StoreServer
+	connSelector                raftselector.ConnProvider
+	localCtxMods, remoteCtxMods []func(context.Context) (context.Context, error)
+}
+
+func NewRaftProxyStoreServer(local StoreServer, connSelector raftselector.ConnProvider, localCtxMod, remoteCtxMod func(context.Context) (context.Context, error)) StoreServer {
+	redirectChecker := func(ctx context.Context) (context.Context, error) {
+		s, ok := transport.StreamFromContext(ctx)
+		if !ok {
+			return ctx, grpc.Errorf(codes.InvalidArgument, "remote addr is not found in context")
+		}
+		addr := s.ServerTransport().RemoteAddr().String()
+		md, ok := metadata.FromContext(ctx)
+		if ok && len(md["redirect"]) != 0 {
+			return ctx, grpc.Errorf(codes.ResourceExhausted, "more than one redirect to leader from: %s", md["redirect"])
+		}
+		if !ok {
+			md = metadata.New(map[string]string{})
+		}
+		md["redirect"] = append(md["redirect"], addr)
+		return metadata.NewContext(ctx, md), nil
+	}
+	remoteMods := []func(context.Context) (context.Context, error){redirectChecker}
+	remoteMods = append(remoteMods, remoteCtxMod)
+
+	var localMods []func(context.Context) (context.Context, error)
+	if localCtxMod != nil {
+		localMods = []func(context.Context) (context.Context, error){localCtxMod}
+	}
+
+	return &raftProxyStoreServer{
+		local:         local,
+		connSelector:  connSelector,
+		localCtxMods:  localMods,
+		remoteCtxMods: remoteMods,
+	}
+}
+func (p *raftProxyStoreServer) runCtxMods(ctx context.Context, ctxMods []func(context.Context) (context.Context, error)) (context.Context, error) {
+	var err error
+	for _, mod := range ctxMods {
+		ctx, err = mod(ctx)
+		if err != nil {
+			return ctx, err
+		}
+	}
+	return ctx, nil
+}
+func (p *raftProxyStoreServer) pollNewLeaderConn(ctx context.Context) (*grpc.ClientConn, error) {
+	ticker := rafttime.NewTicker(500 * rafttime.Millisecond)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ticker.C:
+			conn, err := p.connSelector.LeaderConn(ctx)
+			if err != nil {
+				return nil, err
+			}
+
+			client := NewHealthClient(conn)
+
+			resp, err := client.Check(ctx, &HealthCheckRequest{Service: "Raft"})
+			if err != nil || resp.Status != HealthCheckResponse_SERVING {
+				continue
+			}
+			return conn, nil
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		}
+	}
+}
+
+type Store_WatchServerWrapper struct {
+	Store_WatchServer
+	ctx context.Context
+}
+
+func (s Store_WatchServerWrapper) Context() context.Context {
+	return s.ctx
+}
+
+func (p *raftProxyStoreServer) Watch(r *WatchRequest, stream Store_WatchServer) error {
+	ctx := stream.Context()
+	conn, err := p.connSelector.LeaderConn(ctx)
+	if err != nil {
+		if err == raftselector.ErrIsLeader {
+			ctx, err = p.runCtxMods(ctx, p.localCtxMods)
+			if err != nil {
+				return err
+			}
+			streamWrapper := Store_WatchServerWrapper{
+				Store_WatchServer: stream,
+				ctx:               ctx,
+			}
+			return p.local.Watch(r, streamWrapper)
+		}
+		return err
+	}
+	ctx, err = p.runCtxMods(ctx, p.remoteCtxMods)
+	if err != nil {
+		return err
+	}
+	clientStream, err := NewStoreClient(conn).Watch(ctx, r)
+
+	if err != nil {
+		return err
+	}
+
+	for {
+		msg, err := clientStream.Recv()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return err
+		}
+		if err := stream.Send(msg); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (m *Object) Size() (n int) {
+	var l int
+	_ = l
+	if m.Object != nil {
+		n += m.Object.Size()
+	}
+	return n
+}
+
+func (m *Object_Node) Size() (n int) {
+	var l int
+	_ = l
+	if m.Node != nil {
+		l = m.Node.Size()
+		n += 1 + l + sovStore(uint64(l))
+	}
+	return n
+}
+func (m *Object_Service) Size() (n int) {
+	var l int
+	_ = l
+	if m.Service != nil {
+		l = m.Service.Size()
+		n += 1 + l + sovStore(uint64(l))
+	}
+	return n
+}
+func (m *Object_Network) Size() (n int) {
+	var l int
+	_ = l
+	if m.Network != nil {
+		l = m.Network.Size()
+		n += 1 + l + sovStore(uint64(l))
+	}
+	return n
+}
+func (m *Object_Task) Size() (n int) {
+	var l int
+	_ = l
+	if m.Task != nil {
+		l = m.Task.Size()
+		n += 1 + l + sovStore(uint64(l))
+	}
+	return n
+}
+func (m *Object_Cluster) Size() (n int) {
+	var l int
+	_ = l
+	if m.Cluster != nil {
+		l = m.Cluster.Size()
+		n += 1 + l + sovStore(uint64(l))
+	}
+	return n
+}
+func (m *Object_Secret) Size() (n int) {
+	var l int
+	_ = l
+	if m.Secret != nil {
+		l = m.Secret.Size()
+		n += 1 + l + sovStore(uint64(l))
+	}
+	return n
+}
+func (m *Object_Resource) Size() (n int) {
+	var l int
+	_ = l
+	if m.Resource != nil {
+		l = m.Resource.Size()
+		n += 1 + l + sovStore(uint64(l))
+	}
+	return n
+}
+func (m *Object_Extension) Size() (n int) {
+	var l int
+	_ = l
+	if m.Extension != nil {
+		l = m.Extension.Size()
+		n += 1 + l + sovStore(uint64(l))
+	}
+	return n
+}
+func (m *SelectBySlot) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.ServiceID)
+	if l > 0 {
+		n += 1 + l + sovStore(uint64(l))
+	}
+	if m.Slot != 0 {
+		n += 1 + sovStore(uint64(m.Slot))
+	}
+	return n
+}
+
+func (m *SelectByCustom) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.Kind)
+	if l > 0 {
+		n += 1 + l + sovStore(uint64(l))
+	}
+	l = len(m.Index)
+	if l > 0 {
+		n += 1 + l + sovStore(uint64(l))
+	}
+	l = len(m.Value)
+	if l > 0 {
+		n += 1 + l + sovStore(uint64(l))
+	}
+	return n
+}
+
+func (m *SelectBy) Size() (n int) {
+	var l int
+	_ = l
+	if m.By != nil {
+		n += m.By.Size()
+	}
+	return n
+}
+
+func (m *SelectBy_ID) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.ID)
+	n += 1 + l + sovStore(uint64(l))
+	return n
+}
+func (m *SelectBy_IDPrefix) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.IDPrefix)
+	n += 1 + l + sovStore(uint64(l))
+	return n
+}
+func (m *SelectBy_Name) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovStore(uint64(l))
+	return n
+}
+func (m *SelectBy_NamePrefix) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.NamePrefix)
+	n += 1 + l + sovStore(uint64(l))
+	return n
+}
+func (m *SelectBy_Custom) Size() (n int) {
+	var l int
+	_ = l
+	if m.Custom != nil {
+		l = m.Custom.Size()
+		n += 1 + l + sovStore(uint64(l))
+	}
+	return n
+}
+func (m *SelectBy_CustomPrefix) Size() (n int) {
+	var l int
+	_ = l
+	if m.CustomPrefix != nil {
+		l = m.CustomPrefix.Size()
+		n += 1 + l + sovStore(uint64(l))
+	}
+	return n
+}
+func (m *SelectBy_ServiceID) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.ServiceID)
+	n += 1 + l + sovStore(uint64(l))
+	return n
+}
+func (m *SelectBy_NodeID) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.NodeID)
+	n += 1 + l + sovStore(uint64(l))
+	return n
+}
+func (m *SelectBy_Slot) Size() (n int) {
+	var l int
+	_ = l
+	if m.Slot != nil {
+		l = m.Slot.Size()
+		n += 1 + l + sovStore(uint64(l))
+	}
+	return n
+}
+func (m *SelectBy_DesiredState) Size() (n int) {
+	var l int
+	_ = l
+	n += 1 + sovStore(uint64(m.DesiredState))
+	return n
+}
+func (m *SelectBy_Role) Size() (n int) {
+	var l int
+	_ = l
+	n += 1 + sovStore(uint64(m.Role))
+	return n
+}
+func (m *SelectBy_Membership) Size() (n int) {
+	var l int
+	_ = l
+	n += 1 + sovStore(uint64(m.Membership))
+	return n
+}
+func (m *SelectBy_ReferencedNetworkID) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.ReferencedNetworkID)
+	n += 1 + l + sovStore(uint64(l))
+	return n
+}
+func (m *SelectBy_ReferencedSecretID) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.ReferencedSecretID)
+	n += 1 + l + sovStore(uint64(l))
+	return n
+}
+func (m *SelectBy_Kind) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.Kind)
+	n += 1 + l + sovStore(uint64(l))
+	return n
+}
+func (m *WatchRequest) Size() (n int) {
+	var l int
+	_ = l
+	if len(m.Entries) > 0 {
+		for _, e := range m.Entries {
+			l = e.Size()
+			n += 1 + l + sovStore(uint64(l))
+		}
+	}
+	if m.ResumeFrom != nil {
+		l = m.ResumeFrom.Size()
+		n += 1 + l + sovStore(uint64(l))
+	}
+	if m.IncludeOldObject {
+		n += 2
+	}
+	return n
+}
+
+func (m *WatchRequest_WatchEntry) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.Kind)
+	if l > 0 {
+		n += 1 + l + sovStore(uint64(l))
+	}
+	if m.Action != 0 {
+		n += 1 + sovStore(uint64(m.Action))
+	}
+	if len(m.Filters) > 0 {
+		for _, e := range m.Filters {
+			l = e.Size()
+			n += 1 + l + sovStore(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *WatchMessage) Size() (n int) {
+	var l int
+	_ = l
+	if len(m.Events) > 0 {
+		for _, e := range m.Events {
+			l = e.Size()
+			n += 1 + l + sovStore(uint64(l))
+		}
+	}
+	if m.Version != nil {
+		l = m.Version.Size()
+		n += 1 + l + sovStore(uint64(l))
+	}
+	return n
+}
+
+func (m *WatchMessage_Event) Size() (n int) {
+	var l int
+	_ = l
+	if m.Action != 0 {
+		n += 1 + sovStore(uint64(m.Action))
+	}
+	if m.Object != nil {
+		l = m.Object.Size()
+		n += 1 + l + sovStore(uint64(l))
+	}
+	if m.OldObject != nil {
+		l = m.OldObject.Size()
+		n += 1 + l + sovStore(uint64(l))
+	}
+	return n
+}
+
+func sovStore(x uint64) (n int) {
+	for {
+		n++
+		x >>= 7
+		if x == 0 {
+			break
+		}
+	}
+	return n
+}
+func sozStore(x uint64) (n int) {
+	return sovStore(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (this *Object) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Object{`,
+		`Object:` + fmt.Sprintf("%v", this.Object) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Object_Node) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Object_Node{`,
+		`Node:` + strings.Replace(fmt.Sprintf("%v", this.Node), "Node", "Node", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Object_Service) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Object_Service{`,
+		`Service:` + strings.Replace(fmt.Sprintf("%v", this.Service), "Service", "Service", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Object_Network) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Object_Network{`,
+		`Network:` + strings.Replace(fmt.Sprintf("%v", this.Network), "Network", "Network", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Object_Task) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Object_Task{`,
+		`Task:` + strings.Replace(fmt.Sprintf("%v", this.Task), "Task", "Task", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Object_Cluster) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Object_Cluster{`,
+		`Cluster:` + strings.Replace(fmt.Sprintf("%v", this.Cluster), "Cluster", "Cluster", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Object_Secret) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Object_Secret{`,
+		`Secret:` + strings.Replace(fmt.Sprintf("%v", this.Secret), "Secret", "Secret", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Object_Resource) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Object_Resource{`,
+		`Resource:` + strings.Replace(fmt.Sprintf("%v", this.Resource), "Resource", "Resource", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Object_Extension) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Object_Extension{`,
+		`Extension:` + strings.Replace(fmt.Sprintf("%v", this.Extension), "Extension", "Extension", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SelectBySlot) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SelectBySlot{`,
+		`ServiceID:` + fmt.Sprintf("%v", this.ServiceID) + `,`,
+		`Slot:` + fmt.Sprintf("%v", this.Slot) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SelectByCustom) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SelectByCustom{`,
+		`Kind:` + fmt.Sprintf("%v", this.Kind) + `,`,
+		`Index:` + fmt.Sprintf("%v", this.Index) + `,`,
+		`Value:` + fmt.Sprintf("%v", this.Value) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SelectBy) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SelectBy{`,
+		`By:` + fmt.Sprintf("%v", this.By) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SelectBy_ID) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SelectBy_ID{`,
+		`ID:` + fmt.Sprintf("%v", this.ID) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SelectBy_IDPrefix) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SelectBy_IDPrefix{`,
+		`IDPrefix:` + fmt.Sprintf("%v", this.IDPrefix) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SelectBy_Name) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SelectBy_Name{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SelectBy_NamePrefix) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SelectBy_NamePrefix{`,
+		`NamePrefix:` + fmt.Sprintf("%v", this.NamePrefix) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SelectBy_Custom) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SelectBy_Custom{`,
+		`Custom:` + strings.Replace(fmt.Sprintf("%v", this.Custom), "SelectByCustom", "SelectByCustom", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SelectBy_CustomPrefix) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SelectBy_CustomPrefix{`,
+		`CustomPrefix:` + strings.Replace(fmt.Sprintf("%v", this.CustomPrefix), "SelectByCustom", "SelectByCustom", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SelectBy_ServiceID) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SelectBy_ServiceID{`,
+		`ServiceID:` + fmt.Sprintf("%v", this.ServiceID) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SelectBy_NodeID) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SelectBy_NodeID{`,
+		`NodeID:` + fmt.Sprintf("%v", this.NodeID) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SelectBy_Slot) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SelectBy_Slot{`,
+		`Slot:` + strings.Replace(fmt.Sprintf("%v", this.Slot), "SelectBySlot", "SelectBySlot", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SelectBy_DesiredState) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SelectBy_DesiredState{`,
+		`DesiredState:` + fmt.Sprintf("%v", this.DesiredState) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SelectBy_Role) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SelectBy_Role{`,
+		`Role:` + fmt.Sprintf("%v", this.Role) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SelectBy_Membership) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SelectBy_Membership{`,
+		`Membership:` + fmt.Sprintf("%v", this.Membership) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SelectBy_ReferencedNetworkID) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SelectBy_ReferencedNetworkID{`,
+		`ReferencedNetworkID:` + fmt.Sprintf("%v", this.ReferencedNetworkID) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SelectBy_ReferencedSecretID) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SelectBy_ReferencedSecretID{`,
+		`ReferencedSecretID:` + fmt.Sprintf("%v", this.ReferencedSecretID) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SelectBy_Kind) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SelectBy_Kind{`,
+		`Kind:` + fmt.Sprintf("%v", this.Kind) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WatchRequest) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WatchRequest{`,
+		`Entries:` + strings.Replace(fmt.Sprintf("%v", this.Entries), "WatchRequest_WatchEntry", "WatchRequest_WatchEntry", 1) + `,`,
+		`ResumeFrom:` + strings.Replace(fmt.Sprintf("%v", this.ResumeFrom), "Version", "Version", 1) + `,`,
+		`IncludeOldObject:` + fmt.Sprintf("%v", this.IncludeOldObject) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WatchRequest_WatchEntry) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WatchRequest_WatchEntry{`,
+		`Kind:` + fmt.Sprintf("%v", this.Kind) + `,`,
+		`Action:` + fmt.Sprintf("%v", this.Action) + `,`,
+		`Filters:` + strings.Replace(fmt.Sprintf("%v", this.Filters), "SelectBy", "SelectBy", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WatchMessage) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WatchMessage{`,
+		`Events:` + strings.Replace(fmt.Sprintf("%v", this.Events), "WatchMessage_Event", "WatchMessage_Event", 1) + `,`,
+		`Version:` + strings.Replace(fmt.Sprintf("%v", this.Version), "Version", "Version", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WatchMessage_Event) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WatchMessage_Event{`,
+		`Action:` + fmt.Sprintf("%v", this.Action) + `,`,
+		`Object:` + strings.Replace(fmt.Sprintf("%v", this.Object), "Object", "Object", 1) + `,`,
+		`OldObject:` + strings.Replace(fmt.Sprintf("%v", this.OldObject), "Object", "Object", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func valueToStringStore(v interface{}) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("*%v", pv)
+}
+func (m *Object) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowStore
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Object: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Object: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Node", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &Node{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Object = &Object_Node{v}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Service", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &Service{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Object = &Object_Service{v}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Network", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &Network{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Object = &Object_Network{v}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Task", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &Task{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Object = &Object_Task{v}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Cluster", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &Cluster{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Object = &Object_Cluster{v}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Secret", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &Secret{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Object = &Object_Secret{v}
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Resource", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &Resource{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Object = &Object_Resource{v}
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Extension", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &Extension{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Object = &Object_Extension{v}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipStore(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthStore
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SelectBySlot) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowStore
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SelectBySlot: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SelectBySlot: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServiceID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServiceID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Slot", wireType)
+			}
+			m.Slot = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Slot |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipStore(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthStore
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SelectByCustom) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowStore
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SelectByCustom: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SelectByCustom: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Index", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Index = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Value = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipStore(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthStore
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SelectBy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowStore
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SelectBy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SelectBy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.By = &SelectBy_ID{string(dAtA[iNdEx:postIndex])}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IDPrefix", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.By = &SelectBy_IDPrefix{string(dAtA[iNdEx:postIndex])}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.By = &SelectBy_Name{string(dAtA[iNdEx:postIndex])}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NamePrefix", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.By = &SelectBy_NamePrefix{string(dAtA[iNdEx:postIndex])}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Custom", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &SelectByCustom{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.By = &SelectBy_Custom{v}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CustomPrefix", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &SelectByCustom{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.By = &SelectBy_CustomPrefix{v}
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServiceID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.By = &SelectBy_ServiceID{string(dAtA[iNdEx:postIndex])}
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.By = &SelectBy_NodeID{string(dAtA[iNdEx:postIndex])}
+			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Slot", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &SelectBySlot{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.By = &SelectBy_Slot{v}
+			iNdEx = postIndex
+		case 10:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DesiredState", wireType)
+			}
+			var v TaskState
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (TaskState(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.By = &SelectBy_DesiredState{v}
+		case 11:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Role", wireType)
+			}
+			var v NodeRole
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (NodeRole(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.By = &SelectBy_Role{v}
+		case 12:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Membership", wireType)
+			}
+			var v NodeSpec_Membership
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (NodeSpec_Membership(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.By = &SelectBy_Membership{v}
+		case 13:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ReferencedNetworkID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.By = &SelectBy_ReferencedNetworkID{string(dAtA[iNdEx:postIndex])}
+			iNdEx = postIndex
+		case 14:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ReferencedSecretID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.By = &SelectBy_ReferencedSecretID{string(dAtA[iNdEx:postIndex])}
+			iNdEx = postIndex
+		case 15:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.By = &SelectBy_Kind{string(dAtA[iNdEx:postIndex])}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipStore(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthStore
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WatchRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowStore
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WatchRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WatchRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Entries", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Entries = append(m.Entries, &WatchRequest_WatchEntry{})
+			if err := m.Entries[len(m.Entries)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResumeFrom", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.ResumeFrom == nil {
+				m.ResumeFrom = &Version{}
+			}
+			if err := m.ResumeFrom.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IncludeOldObject", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.IncludeOldObject = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := skipStore(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthStore
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WatchRequest_WatchEntry) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowStore
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WatchEntry: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WatchEntry: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Action", wireType)
+			}
+			m.Action = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Action |= (WatchActionKind(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Filters", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Filters = append(m.Filters, &SelectBy{})
+			if err := m.Filters[len(m.Filters)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipStore(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthStore
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WatchMessage) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowStore
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WatchMessage: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WatchMessage: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Events", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Events = append(m.Events, &WatchMessage_Event{})
+			if err := m.Events[len(m.Events)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Version == nil {
+				m.Version = &Version{}
+			}
+			if err := m.Version.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipStore(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthStore
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WatchMessage_Event) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowStore
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Event: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Event: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Action", wireType)
+			}
+			m.Action = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Action |= (WatchActionKind(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Object", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Object == nil {
+				m.Object = &Object{}
+			}
+			if err := m.Object.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OldObject", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthStore
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.OldObject == nil {
+				m.OldObject = &Object{}
+			}
+			if err := m.OldObject.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipStore(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthStore
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipStore(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowStore
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+			return iNdEx, nil
+		case 1:
+			iNdEx += 8
+			return iNdEx, nil
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowStore
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			iNdEx += length
+			if length < 0 {
+				return 0, ErrInvalidLengthStore
+			}
+			return iNdEx, nil
+		case 3:
+			for {
+				var innerWire uint64
+				var start int = iNdEx
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return 0, ErrIntOverflowStore
+					}
+					if iNdEx >= l {
+						return 0, io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					innerWire |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				innerWireType := int(innerWire & 0x7)
+				if innerWireType == 4 {
+					break
+				}
+				next, err := skipStore(dAtA[start:])
+				if err != nil {
+					return 0, err
+				}
+				iNdEx = start + next
+			}
+			return iNdEx, nil
+		case 4:
+			return iNdEx, nil
+		case 5:
+			iNdEx += 4
+			return iNdEx, nil
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+	}
+	panic("unreachable")
+}
+
+var (
+	ErrInvalidLengthStore = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowStore   = fmt.Errorf("proto: integer overflow")
+)
+
+func init() { proto.RegisterFile("store.proto", fileDescriptorStore) }
+
+var fileDescriptorStore = []byte{
+	// 1127 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x94, 0x96, 0x4f, 0x6f, 0x1b, 0xc5,
+	0x1b, 0xc7, 0xbd, 0x8e, 0xb3, 0xb6, 0x1f, 0xc7, 0x6d, 0x34, 0x49, 0xdb, 0xfd, 0xf9, 0x57, 0x6c,
+	0x63, 0x04, 0x54, 0xb4, 0xb8, 0x10, 0x4a, 0x11, 0x50, 0x90, 0x62, 0xc7, 0xc8, 0xa6, 0x8a, 0x13,
+	0x8d, 0x93, 0xe6, 0x68, 0x6d, 0x76, 0x9f, 0xa4, 0x8b, 0xf7, 0x8f, 0x99, 0x1d, 0x3b, 0xcd, 0x8d,
+	0x23, 0xea, 0x1d, 0x89, 0x4b, 0xb9, 0xc0, 0x99, 0x0b, 0x37, 0x78, 0x03, 0x15, 0x07, 0xc4, 0x11,
+	0x2e, 0x16, 0xf5, 0x0b, 0xe0, 0x15, 0x70, 0x40, 0x33, 0x3b, 0x9b, 0x3f, 0xee, 0x3a, 0xa5, 0x27,
+	0xcf, 0xcc, 0x7e, 0x3f, 0xcf, 0x3e, 0xf3, 0x7c, 0x67, 0x1e, 0x2f, 0x14, 0x42, 0x1e, 0x30, 0xac,
+	0x0f, 0x59, 0xc0, 0x03, 0x42, 0xec, 0xc0, 0x1a, 0x20, 0xab, 0x87, 0x47, 0x26, 0xf3, 0x06, 0x0e,
+	0xaf, 0x8f, 0xdf, 0x2d, 0x15, 0xc2, 0x21, 0x5a, 0x61, 0x24, 0x28, 0x15, 0x83, 0xfd, 0x2f, 0xd0,
+	0xe2, 0xf1, 0xb4, 0xc0, 0x8f, 0x87, 0x18, 0x4f, 0x56, 0x0f, 0x83, 0xc3, 0x40, 0x0e, 0x6f, 0x8b,
+	0x91, 0x5a, 0x5d, 0x19, 0xba, 0xa3, 0x43, 0xc7, 0xbf, 0x1d, 0xfd, 0x44, 0x8b, 0xb5, 0xdf, 0x16,
+	0x40, 0xdf, 0x92, 0x91, 0x48, 0x1d, 0x32, 0x7e, 0x60, 0xa3, 0xa1, 0x55, 0xb5, 0x1b, 0x85, 0x35,
+	0xa3, 0xfe, 0x7c, 0x06, 0xf5, 0x6e, 0x60, 0x63, 0x3b, 0x45, 0xa5, 0x8e, 0x7c, 0x00, 0xd9, 0x10,
+	0xd9, 0xd8, 0xb1, 0xd0, 0x48, 0x4b, 0xe4, 0xff, 0x49, 0x48, 0x2f, 0x92, 0xb4, 0x53, 0x34, 0x56,
+	0x0b, 0xd0, 0x47, 0x7e, 0x14, 0xb0, 0x81, 0xb1, 0x30, 0x1f, 0xec, 0x46, 0x12, 0x01, 0x2a, 0xb5,
+	0xc8, 0x90, 0x9b, 0xe1, 0xc0, 0xc8, 0xcc, 0xcf, 0x70, 0xc7, 0x0c, 0x05, 0x22, 0x75, 0xe2, 0x45,
+	0x96, 0x3b, 0x0a, 0x39, 0x32, 0x63, 0x71, 0xfe, 0x8b, 0x9a, 0x91, 0x44, 0xbc, 0x48, 0xa9, 0xc9,
+	0x1d, 0xd0, 0x43, 0xb4, 0x18, 0x72, 0x43, 0x97, 0x5c, 0x29, 0x79, 0x67, 0x42, 0xd1, 0x4e, 0x51,
+	0xa5, 0x25, 0x1f, 0x41, 0x8e, 0x61, 0x18, 0x8c, 0x98, 0x85, 0x46, 0x56, 0x72, 0xd7, 0x93, 0x38,
+	0xaa, 0x34, 0xed, 0x14, 0x3d, 0xd1, 0x93, 0x4f, 0x20, 0x8f, 0x8f, 0x38, 0xfa, 0xa1, 0x13, 0xf8,
+	0x46, 0x4e, 0xc2, 0xaf, 0x24, 0xc1, 0xad, 0x58, 0xd4, 0x4e, 0xd1, 0x53, 0xa2, 0x91, 0x8b, 0x5d,
+	0xac, 0x6d, 0xc3, 0x52, 0x0f, 0x5d, 0xb4, 0x78, 0xe3, 0xb8, 0xe7, 0x06, 0x9c, 0xdc, 0x02, 0x50,
+	0x75, 0xef, 0x3b, 0xb6, 0xf4, 0x36, 0xdf, 0x28, 0x4e, 0x27, 0x95, 0xbc, 0x32, 0xa6, 0xb3, 0x41,
+	0xf3, 0x4a, 0xd0, 0xb1, 0x09, 0x81, 0x4c, 0xe8, 0x06, 0x5c, 0x1a, 0x9a, 0xa1, 0x72, 0x5c, 0xdb,
+	0x86, 0x4b, 0x71, 0xc4, 0xe6, 0x28, 0xe4, 0x81, 0x27, 0x54, 0x03, 0xc7, 0x57, 0xd1, 0xa8, 0x1c,
+	0x93, 0x55, 0x58, 0x74, 0x7c, 0x1b, 0x1f, 0x49, 0x34, 0x4f, 0xa3, 0x89, 0x58, 0x1d, 0x9b, 0xee,
+	0x08, 0xa5, 0xd1, 0x79, 0x1a, 0x4d, 0x6a, 0xdf, 0xe9, 0x90, 0x8b, 0x43, 0x12, 0x03, 0xd2, 0x27,
+	0x89, 0xe9, 0xd3, 0x49, 0x25, 0xdd, 0xd9, 0x68, 0xa7, 0x68, 0xda, 0xb1, 0xc9, 0x4d, 0xc8, 0x3b,
+	0x76, 0x7f, 0xc8, 0xf0, 0xc0, 0x51, 0x61, 0x1b, 0x4b, 0xd3, 0x49, 0x25, 0xd7, 0xd9, 0xd8, 0x96,
+	0x6b, 0xa2, 0x80, 0x8e, 0x1d, 0x8d, 0xc9, 0x2a, 0x64, 0x7c, 0xd3, 0x53, 0x2f, 0x92, 0x67, 0xd4,
+	0xf4, 0x90, 0xbc, 0x0a, 0x05, 0xf1, 0x1b, 0x07, 0xc9, 0xa8, 0x87, 0x20, 0x16, 0x15, 0x78, 0x0f,
+	0x74, 0x4b, 0x6e, 0x4b, 0x9d, 0x91, 0x5a, 0xb2, 0xd7, 0x67, 0x0b, 0x20, 0x3c, 0x8f, 0x18, 0xd2,
+	0x81, 0x62, 0x34, 0x8a, 0x5f, 0xa1, 0xbf, 0x44, 0x90, 0xa5, 0x08, 0x55, 0x89, 0xd4, 0xcf, 0x39,
+	0x95, 0x4d, 0x70, 0x4a, 0x78, 0x7e, 0xea, 0xd5, 0xeb, 0x90, 0x15, 0xf7, 0x50, 0x88, 0x73, 0x52,
+	0x0c, 0xd3, 0x49, 0x45, 0x17, 0x57, 0x54, 0x2a, 0x75, 0xf1, 0xb0, 0x63, 0x93, 0xbb, 0xca, 0xd2,
+	0xbc, 0x4c, 0xac, 0x7a, 0x51, 0x62, 0xe2, 0xc0, 0x88, 0xd2, 0x09, 0x3d, 0xd9, 0x80, 0xa2, 0x8d,
+	0xa1, 0xc3, 0xd0, 0xee, 0x87, 0xdc, 0xe4, 0x68, 0x40, 0x55, 0xbb, 0x71, 0x29, 0xf9, 0x54, 0x8a,
+	0x5b, 0xd7, 0x13, 0x22, 0xb1, 0x29, 0x45, 0xc9, 0x39, 0x59, 0x83, 0x0c, 0x0b, 0x5c, 0x34, 0x0a,
+	0x12, 0xbe, 0x3e, 0xaf, 0xa9, 0xd0, 0xc0, 0x95, 0x8d, 0x45, 0x68, 0x49, 0x07, 0xc0, 0x43, 0x6f,
+	0x1f, 0x59, 0xf8, 0xd0, 0x19, 0x1a, 0x4b, 0x92, 0x7c, 0x73, 0x1e, 0xd9, 0x1b, 0xa2, 0x55, 0xdf,
+	0x3c, 0x91, 0x0b, 0x73, 0x4f, 0x61, 0xb2, 0x09, 0x57, 0x18, 0x1e, 0x20, 0x43, 0xdf, 0x42, 0xbb,
+	0xaf, 0xfa, 0x88, 0xa8, 0x58, 0x51, 0x56, 0xec, 0xda, 0x74, 0x52, 0x59, 0xa1, 0x27, 0x02, 0xd5,
+	0x72, 0x64, 0xf9, 0x56, 0xd8, 0x73, 0xcb, 0x36, 0xf9, 0x1c, 0x56, 0xcf, 0x84, 0x8b, 0xae, 0xbd,
+	0x88, 0x76, 0x49, 0x46, 0xbb, 0x3a, 0x9d, 0x54, 0xc8, 0x69, 0xb4, 0xa8, 0x3f, 0xc8, 0x60, 0x84,
+	0xcd, 0xae, 0x8a, 0x0b, 0x13, 0x5d, 0xa2, 0xcb, 0xf1, 0x81, 0x15, 0xb3, 0x46, 0x06, 0xd2, 0x8d,
+	0xe3, 0xda, 0x9f, 0x69, 0x58, 0xda, 0x33, 0xb9, 0xf5, 0x90, 0xe2, 0x97, 0x23, 0x0c, 0x39, 0x69,
+	0x41, 0x16, 0x7d, 0xce, 0x1c, 0x0c, 0x0d, 0xad, 0xba, 0x70, 0xa3, 0xb0, 0x76, 0x33, 0xa9, 0x1e,
+	0x67, 0x91, 0x68, 0xd2, 0xf2, 0x39, 0x3b, 0xa6, 0x31, 0x4b, 0xee, 0x41, 0x81, 0x61, 0x38, 0xf2,
+	0xb0, 0x7f, 0xc0, 0x02, 0xef, 0xa2, 0xb6, 0xfd, 0x00, 0x99, 0x68, 0x2c, 0x14, 0x22, 0xfd, 0x67,
+	0x2c, 0xf0, 0xc8, 0x2d, 0x20, 0x8e, 0x6f, 0xb9, 0x23, 0x1b, 0xfb, 0x81, 0x6b, 0xf7, 0xa3, 0x3f,
+	0x20, 0x79, 0xe1, 0x72, 0x74, 0x59, 0x3d, 0xd9, 0x72, 0xed, 0xa8, 0x11, 0x95, 0xbe, 0xd1, 0x00,
+	0x4e, 0x73, 0x48, 0xec, 0x19, 0x1f, 0x83, 0x6e, 0x5a, 0x5c, 0x74, 0xbc, 0xb4, 0x34, 0xf9, 0xb5,
+	0xb9, 0x9b, 0x5a, 0x97, 0xb2, 0xfb, 0x8e, 0x6f, 0x53, 0x85, 0x90, 0xbb, 0x90, 0x3d, 0x70, 0x5c,
+	0x8e, 0x2c, 0x34, 0x16, 0x64, 0x49, 0xae, 0x5f, 0x74, 0xb4, 0x69, 0x2c, 0xae, 0xfd, 0x12, 0xd7,
+	0x76, 0x13, 0xc3, 0xd0, 0x3c, 0x44, 0xf2, 0x29, 0xe8, 0x38, 0x46, 0x9f, 0xc7, 0xa5, 0x7d, 0x63,
+	0x6e, 0x16, 0x8a, 0xa8, 0xb7, 0x84, 0x9c, 0x2a, 0x8a, 0xbc, 0x0f, 0xd9, 0x71, 0x54, 0xad, 0xff,
+	0x52, 0xd0, 0x58, 0x5b, 0xfa, 0x49, 0x83, 0x45, 0x19, 0xe8, 0x4c, 0x19, 0xb4, 0x97, 0x2f, 0xc3,
+	0x1a, 0xe8, 0xca, 0x88, 0xf4, 0xfc, 0xbf, 0xaa, 0xc8, 0x12, 0xaa, 0x94, 0xe4, 0x43, 0x80, 0x19,
+	0x03, 0x2f, 0xe6, 0xf2, 0x41, 0xec, 0xea, 0x5b, 0xff, 0x68, 0x70, 0x79, 0x26, 0x15, 0x72, 0x07,
+	0x56, 0xf7, 0xd6, 0x77, 0x9a, 0xed, 0xfe, 0x7a, 0x73, 0xa7, 0xb3, 0xd5, 0xed, 0xef, 0x76, 0xef,
+	0x77, 0xb7, 0xf6, 0xba, 0xcb, 0xa9, 0x52, 0xe9, 0xf1, 0x93, 0xea, 0xd5, 0x19, 0xf9, 0xae, 0x3f,
+	0xf0, 0x83, 0x23, 0x91, 0xf8, 0xca, 0x39, 0xaa, 0x49, 0x5b, 0xeb, 0x3b, 0xad, 0x65, 0xad, 0xf4,
+	0xbf, 0xc7, 0x4f, 0xaa, 0x57, 0x66, 0xa0, 0x26, 0xc3, 0xa8, 0x9b, 0x9c, 0x67, 0x76, 0xb7, 0x37,
+	0x04, 0x93, 0x4e, 0x64, 0x76, 0x87, 0x76, 0x12, 0x43, 0x5b, 0x9b, 0x5b, 0x0f, 0x5a, 0xcb, 0x99,
+	0x44, 0x86, 0xa2, 0x17, 0x8c, 0xb1, 0x74, 0xed, 0xeb, 0xef, 0xcb, 0xa9, 0x9f, 0x7f, 0x28, 0xcf,
+	0x6e, 0x75, 0xcd, 0x83, 0xc5, 0x9e, 0xf8, 0x4a, 0x23, 0x36, 0x2c, 0xca, 0x67, 0xa4, 0xfa, 0xa2,
+	0x8b, 0x58, 0xaa, 0xbe, 0xe8, 0x3c, 0xd5, 0xae, 0xfc, 0xfa, 0xe3, 0xdf, 0xdf, 0xa6, 0x2f, 0x43,
+	0x51, 0x2a, 0xde, 0xf6, 0x4c, 0xdf, 0x3c, 0x44, 0xf6, 0x8e, 0xd6, 0x30, 0x9e, 0x3e, 0x2b, 0xa7,
+	0xfe, 0x78, 0x56, 0x4e, 0x7d, 0x35, 0x2d, 0x6b, 0x4f, 0xa7, 0x65, 0xed, 0xf7, 0x69, 0x59, 0xfb,
+	0x6b, 0x5a, 0xd6, 0xf6, 0x75, 0xf9, 0xf9, 0xf6, 0xde, 0xbf, 0x01, 0x00, 0x00, 0xff, 0xff, 0xa9,
+	0xa5, 0x8e, 0xe6, 0x35, 0x0a, 0x00, 0x00,
+}

vendor/github.com/docker/swarmkit/api/store.proto

@@ -0,0 +1,152 @@
+syntax = "proto3";
+
+package docker.swarmkit.v1;
+
+import "specs.proto";
+import "objects.proto";
+import "types.proto";
+import "gogoproto/gogo.proto";
+import "plugin/plugin.proto";
+
+message Object {
+	oneof Object {
+		Node node = 1;
+		Service service = 2;
+		Network network = 3;
+		Task task = 4;
+		Cluster cluster = 5;
+		Secret secret = 6;
+		Resource resource = 7;
+		Extension extension = 8;
+	}
+}
+
+// FIXME(aaronl): These messages should ideally be embedded in SelectBy, but
+// protoc generates bad code for that.
+message SelectBySlot {
+	string service_id = 1 [(gogoproto.customname) = "ServiceID"];
+	uint64 slot = 2;
+}
+
+message SelectByCustom {
+	string kind = 1;
+	string index = 2;
+	string value = 3;
+}
+
+message SelectBy {
+	// TODO(aaronl): Are all of these things we want to expose in
+	// the API? Exposing them may commit us to maintaining those
+	// internal indices going forward.
+	oneof By {
+		// supported by all object types
+		string id = 1 [(gogoproto.customname) = "ID"]; // not applicable for FindObjects - use GetObject instead
+		string id_prefix = 2 [(gogoproto.customname) = "IDPrefix"];
+		string name = 3;
+		string name_prefix = 4;
+		SelectByCustom custom = 5;
+		SelectByCustom custom_prefix = 6;
+
+		// supported by tasks only
+		string service_id = 7 [(gogoproto.customname) = "ServiceID"];
+		string node_id = 8 [(gogoproto.customname) = "NodeID"];
+		SelectBySlot slot = 9;
+		TaskState desired_state = 10;
+
+		// supported by nodes only
+		NodeRole role = 11;
+		NodeSpec.Membership membership = 12;
+
+		// supported by: service, task
+		string referenced_network_id = 13 [(gogoproto.customname) = "ReferencedNetworkID"];
+		string referenced_secret_id = 14 [(gogoproto.customname) = "ReferencedSecretID"];
+
+		// supported by: resource
+		string kind = 15;
+	}
+}
+
+
+// Store defines the RPC methods for interacting with the data store.
+service Store {
+	// Watch starts a stream that returns any changes to objects that match
+	// the specified selectors. When the stream begins, it immediately sends
+	// an empty message back to the client. It is important to wait for
+	// this message before taking any actions that depend on an established
+	// stream of changes for consistency.
+	rpc Watch(WatchRequest) returns (stream WatchMessage) {
+		option (docker.protobuf.plugin.tls_authorization) = { roles: "swarm-manager" };
+	};
+}
+
+message WatchRequest {
+	message WatchEntry {
+		// Kind can contain a builtin type such as "node", "secret", etc. or
+		// the kind specified by a custom-defined object.
+		string kind = 1;
+
+		// Action (create/update/delete)
+		// This is a bitmask, so multiple actions may be OR'd together
+		WatchActionKind action = 2;
+
+		// Filters are combined using AND logic - an event must match
+		// all of them to pass the filter.
+		repeated SelectBy filters = 3;
+	}
+
+	// Multiple entries are combined using OR logic - i.e. if an event
+	// matches all of the selectors specified in any single watch entry,
+	// the event will be sent to the client.
+	repeated WatchEntry entries = 1;
+
+	// ResumeFrom provides an version to resume the watch from, if non-nil.
+	// The watch will return changes since this version, and continue to
+	// return new changes afterwards. Watch will return an error if the
+	// server has compacted its log and no longer has complete history to
+	// this point.
+	Version resume_from = 2;
+
+	// IncludeOldObject causes WatchMessages to include a copy of the
+	// previous version of the object on updates. Note that only live
+	// changes will include the old object (not historical changes
+	// retrieved using ResumeFrom).
+	bool include_old_object = 3;
+}
+
+// WatchMessage is the type of the stream that's returned to the client by
+// Watch. Note that the first item of this stream will always be a WatchMessage
+// with a nil Object, to signal that the stream has started.
+message WatchMessage {
+	message Event {
+		// Action (create/update/delete)
+		// Note that WatchMessage does not expose "commit" events that
+		// mark transaction boundaries.
+		WatchActionKind action = 1;
+
+		// Matched object
+		Object object = 2;
+
+		// For updates, OldObject will optionally be included in the
+		// watch message, containing the previous version of the
+		// object, if IncludeOldObject was set in WatchRequest.
+		Object old_object = 3;
+	}
+
+	repeated Event events = 1;
+
+	// Index versions this change to the data store. It can be used to
+	// resume the watch from this point.
+	Version version = 2;
+}
+
+// WatchActionKind distinguishes between creations, updates, and removals. It
+// is structured as a bitmap so multiple kinds of events can be requested with
+// a mask.
+enum WatchActionKind {
+	option (gogoproto.goproto_enum_prefix) = false;
+	option (gogoproto.enum_customname) = "WatchActionKind";
+	WATCH_ACTION_UNKNOWN = 0 [(gogoproto.enumvalue_customname) = "WatchActionKindUnknown"]; // default value, invalid
+	WATCH_ACTION_CREATE = 1 [(gogoproto.enumvalue_customname) = "WatchActionKindCreate"];
+	WATCH_ACTION_UPDATE = 2 [(gogoproto.enumvalue_customname) = "WatchActionKindUpdate"];
+	WATCH_ACTION_REMOVE = 4 [(gogoproto.enumvalue_customname) = "WatchActionKindRemove"];
+}

vendor/github.com/docker/swarmkit/api/storeobject.go

@@ -3,21 +3,27 @@ package api
 import (
 	"errors"
 	"fmt"
+	"strings"
 
 	"github.com/docker/go-events"
 )
 
-var errUnknownStoreAction = errors.New("unrecognized action type")
+var (
+	errUnknownStoreAction = errors.New("unrecognized action type")
+	errConflictingFilters = errors.New("conflicting filters specified")
+	errNoKindSpecified    = errors.New("no kind of object specified")
+	errUnrecognizedAction = errors.New("unrecognized action")
+)
 
 // StoreObject is an abstract object that can be handled by the store.
 type StoreObject interface {
-	GetID() string                // Get ID
-	GetMeta() Meta                // Retrieve metadata
-	SetMeta(Meta)                 // Set metadata
-	CopyStoreObject() StoreObject // Return a copy of this object
-	EventCreate() Event           // Return a creation event
-	EventUpdate() Event           // Return an update event
-	EventDelete() Event           // Return a deletion event
+	GetID() string                           // Get ID
+	GetMeta() Meta                           // Retrieve metadata
+	SetMeta(Meta)                            // Set metadata
+	CopyStoreObject() StoreObject            // Return a copy of this object
+	EventCreate() Event                      // Return a creation event
+	EventUpdate(oldObject StoreObject) Event // Return an update event
+	EventDelete() Event                      // Return a deletion event
 }
 
 // Event is the type used for events passed over watcher channels, and also
@@ -78,3 +84,25 @@ func prefixFromArgs(args ...interface{}) ([]byte, error) {
 	}
 	return val, nil
 }
+
+func checkCustom(a1, a2 Annotations) bool {
+	if len(a1.Indices) == 1 {
+		for _, ind := range a2.Indices {
+			if ind.Key == a1.Indices[0].Key && ind.Val == a1.Indices[0].Val {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func checkCustomPrefix(a1, a2 Annotations) bool {
+	if len(a1.Indices) == 1 {
+		for _, ind := range a2.Indices {
+			if ind.Key == a1.Indices[0].Key && strings.HasPrefix(ind.Val, a1.Indices[0].Val) {
+				return true
+			}
+		}
+	}
+	return false
+}

vendor/github.com/docker/swarmkit/api/types.pb.go

@@ -17,6 +17,7 @@
 		health.proto
 		resource.proto
 		logbroker.proto
+		store.proto
 
 	It has these top-level messages:
 		Version
@@ -189,6 +190,12 @@
 		SubscriptionMessage
 		PublishLogsMessage
 		PublishLogsResponse
+		Object
+		SelectBySlot
+		SelectByCustom
+		SelectBy
+		WatchRequest
+		WatchMessage
 */
 package api
 
@@ -1345,6 +1352,18 @@ type CAConfig struct {
 	// ExternalCAs is a list of CAs to which a manager node will make
 	// certificate signing requests for node certificates.
 	ExternalCAs []*ExternalCA `protobuf:"bytes,2,rep,name=external_cas,json=externalCas" json:"external_cas,omitempty"`
+	// SigningCACert is the desired CA certificate to be used as the root and
+	// signing CA for the swarm.  If not provided, indicates that we are either happy
+	// with the current configuration, or (together with a bump in the ForceRotate value)
+	// that we want a certificate and key generated for us.
+	SigningCACert []byte `protobuf:"bytes,3,opt,name=signing_ca_cert,json=signingCaCert,proto3" json:"signing_ca_cert,omitempty"`
+	// SigningCAKey is the desired private key, matching the signing CA cert, to be used
+	// to sign certificates for the swarm
+	SigningCAKey []byte `protobuf:"bytes,4,opt,name=signing_ca_key,json=signingCaKey,proto3" json:"signing_ca_key,omitempty"`
+	// ForceRotate is a counter that triggers a root CA rotation even if no relevant
+	// parameters have been in the spec. This will force the manager to generate a new
+	// certificate and key, if none have been provided.
+	ForceRotate uint64 `protobuf:"varint,5,opt,name=force_rotate,json=forceRotate,proto3" json:"force_rotate,omitempty"`
 }
 
 func (m *CAConfig) Reset()                    { *m = CAConfig{} }
@@ -1558,6 +1577,9 @@ type RootCA struct {
 	// RootRotation contains the new root cert and key we want to rotate to - if this is nil, we are not in the
 	// middle of a root rotation
 	RootRotation *RootRotation `protobuf:"bytes,5,opt,name=root_rotation,json=rootRotation" json:"root_rotation,omitempty"`
+	// LastForcedRotation matches the Cluster Spec's CAConfig's ForceRotation counter.
+	// It indicates when the current CA cert and key were generated (or updated).
+	LastForcedRotation uint64 `protobuf:"varint,6,opt,name=last_forced_rotation,json=lastForcedRotation,proto3" json:"last_forced_rotation,omitempty"`
 }
 
 func (m *RootCA) Reset()                    { *m = RootCA{} }
@@ -2531,6 +2553,10 @@ func (m *AcceptancePolicy_RoleAdmissionPolicy_Secret) CopyFrom(src interface{})
 
 	o := src.(*AcceptancePolicy_RoleAdmissionPolicy_Secret)
 	*m = *o
+	if o.Data != nil {
+		m.Data = make([]byte, len(o.Data))
+		copy(m.Data, o.Data)
+	}
 }
 
 func (m *ExternalCA) Copy() *ExternalCA {
@@ -2553,6 +2579,10 @@ func (m *ExternalCA) CopyFrom(src interface{}) {
 		}
 	}
 
+	if o.CACert != nil {
+		m.CACert = make([]byte, len(o.CACert))
+		copy(m.CACert, o.CACert)
+	}
 }
 
 func (m *CAConfig) Copy() *CAConfig {
@@ -2580,6 +2610,14 @@ func (m *CAConfig) CopyFrom(src interface{}) {
 		}
 	}
 
+	if o.SigningCACert != nil {
+		m.SigningCACert = make([]byte, len(o.SigningCACert))
+		copy(m.SigningCACert, o.SigningCACert)
+	}
+	if o.SigningCAKey != nil {
+		m.SigningCAKey = make([]byte, len(o.SigningCAKey))
+		copy(m.SigningCAKey, o.SigningCAKey)
+	}
 }
 
 func (m *OrchestrationConfig) Copy() *OrchestrationConfig {
@@ -2762,6 +2800,14 @@ func (m *RootCA) CopyFrom(src interface{}) {
 
 	o := src.(*RootCA)
 	*m = *o
+	if o.CAKey != nil {
+		m.CAKey = make([]byte, len(o.CAKey))
+		copy(m.CAKey, o.CAKey)
+	}
+	if o.CACert != nil {
+		m.CACert = make([]byte, len(o.CACert))
+		copy(m.CACert, o.CACert)
+	}
 	github_com_docker_swarmkit_api_deepcopy.Copy(&m.JoinTokens, &o.JoinTokens)
 	if o.RootRotation != nil {
 		m.RootRotation = &RootRotation{}
@@ -2782,7 +2828,15 @@ func (m *Certificate) CopyFrom(src interface{}) {
 
 	o := src.(*Certificate)
 	*m = *o
+	if o.CSR != nil {
+		m.CSR = make([]byte, len(o.CSR))
+		copy(m.CSR, o.CSR)
+	}
 	github_com_docker_swarmkit_api_deepcopy.Copy(&m.Status, &o.Status)
+	if o.Certificate != nil {
+		m.Certificate = make([]byte, len(o.Certificate))
+		copy(m.Certificate, o.Certificate)
+	}
 }
 
 func (m *EncryptionKey) Copy() *EncryptionKey {
@@ -2798,6 +2852,10 @@ func (m *EncryptionKey) CopyFrom(src interface{}) {
 
 	o := src.(*EncryptionKey)
 	*m = *o
+	if o.Key != nil {
+		m.Key = make([]byte, len(o.Key))
+		copy(m.Key, o.Key)
+	}
 }
 
 func (m *ManagerStatus) Copy() *ManagerStatus {
@@ -2920,6 +2978,14 @@ func (m *MaybeEncryptedRecord) CopyFrom(src interface{}) {
 
 	o := src.(*MaybeEncryptedRecord)
 	*m = *o
+	if o.Data != nil {
+		m.Data = make([]byte, len(o.Data))
+		copy(m.Data, o.Data)
+	}
+	if o.Nonce != nil {
+		m.Nonce = make([]byte, len(o.Nonce))
+		copy(m.Nonce, o.Nonce)
+	}
 }
 
 func (m *RootRotation) Copy() *RootRotation {
@@ -2935,6 +3001,18 @@ func (m *RootRotation) CopyFrom(src interface{}) {
 
 	o := src.(*RootRotation)
 	*m = *o
+	if o.CACert != nil {
+		m.CACert = make([]byte, len(o.CACert))
+		copy(m.CACert, o.CACert)
+	}
+	if o.CAKey != nil {
+		m.CAKey = make([]byte, len(o.CAKey))
+		copy(m.CAKey, o.CAKey)
+	}
+	if o.CrossSignedCACert != nil {
+		m.CrossSignedCACert = make([]byte, len(o.CrossSignedCACert))
+		copy(m.CrossSignedCACert, o.CrossSignedCACert)
+	}
 }
 
 func (m *Version) Marshal() (dAtA []byte, err error) {
@@ -4369,6 +4447,23 @@ func (m *CAConfig) MarshalTo(dAtA []byte) (int, error) {
 			i += n
 		}
 	}
+	if len(m.SigningCACert) > 0 {
+		dAtA[i] = 0x1a
+		i++
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.SigningCACert)))
+		i += copy(dAtA[i:], m.SigningCACert)
+	}
+	if len(m.SigningCAKey) > 0 {
+		dAtA[i] = 0x22
+		i++
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.SigningCAKey)))
+		i += copy(dAtA[i:], m.SigningCAKey)
+	}
+	if m.ForceRotate != 0 {
+		dAtA[i] = 0x28
+		i++
+		i = encodeVarintTypes(dAtA, i, uint64(m.ForceRotate))
+	}
 	return i, nil
 }
 
@@ -4711,6 +4806,11 @@ func (m *RootCA) MarshalTo(dAtA []byte) (int, error) {
 		}
 		i += n29
 	}
+	if m.LastForcedRotation != 0 {
+		dAtA[i] = 0x30
+		i++
+		i = encodeVarintTypes(dAtA, i, uint64(m.LastForcedRotation))
+	}
 	return i, nil
 }
 
@@ -5755,6 +5855,17 @@ func (m *CAConfig) Size() (n int) {
 			n += 1 + l + sovTypes(uint64(l))
 		}
 	}
+	l = len(m.SigningCACert)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.SigningCAKey)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.ForceRotate != 0 {
+		n += 1 + sovTypes(uint64(m.ForceRotate))
+	}
 	return n
 }
 
@@ -5898,6 +6009,9 @@ func (m *RootCA) Size() (n int) {
 		l = m.RootRotation.Size()
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	if m.LastForcedRotation != 0 {
+		n += 1 + sovTypes(uint64(m.LastForcedRotation))
+	}
 	return n
 }
 
@@ -6576,6 +6690,9 @@ func (this *CAConfig) String() string {
 	s := strings.Join([]string{`&CAConfig{`,
 		`NodeCertExpiry:` + strings.Replace(fmt.Sprintf("%v", this.NodeCertExpiry), "Duration", "google_protobuf1.Duration", 1) + `,`,
 		`ExternalCAs:` + strings.Replace(fmt.Sprintf("%v", this.ExternalCAs), "ExternalCA", "ExternalCA", 1) + `,`,
+		`SigningCACert:` + fmt.Sprintf("%v", this.SigningCACert) + `,`,
+		`SigningCAKey:` + fmt.Sprintf("%v", this.SigningCAKey) + `,`,
+		`ForceRotate:` + fmt.Sprintf("%v", this.ForceRotate) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -6696,6 +6813,7 @@ func (this *RootCA) String() string {
 		`CACertHash:` + fmt.Sprintf("%v", this.CACertHash) + `,`,
 		`JoinTokens:` + strings.Replace(strings.Replace(this.JoinTokens.String(), "JoinTokens", "JoinTokens", 1), `&`, ``, 1) + `,`,
 		`RootRotation:` + strings.Replace(fmt.Sprintf("%v", this.RootRotation), "RootRotation", "RootRotation", 1) + `,`,
+		`LastForcedRotation:` + fmt.Sprintf("%v", this.LastForcedRotation) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -11761,6 +11879,87 @@ func (m *CAConfig) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SigningCACert", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SigningCACert = append(m.SigningCACert[:0], dAtA[iNdEx:postIndex]...)
+			if m.SigningCACert == nil {
+				m.SigningCACert = []byte{}
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SigningCAKey", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SigningCAKey = append(m.SigningCAKey[:0], dAtA[iNdEx:postIndex]...)
+			if m.SigningCAKey == nil {
+				m.SigningCAKey = []byte{}
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ForceRotate", wireType)
+			}
+			m.ForceRotate = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.ForceRotate |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -12794,6 +12993,25 @@ func (m *RootCA) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastForcedRotation", wireType)
+			}
+			m.LastForcedRotation = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.LastForcedRotation |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -14248,271 +14466,276 @@ var (
 func init() { proto.RegisterFile("types.proto", fileDescriptorTypes) }
 
 var fileDescriptorTypes = []byte{
-	// 4248 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xac, 0x5a, 0x4d, 0x6c, 0x24, 0x49,
-	0x56, 0x76, 0xfd, 0xba, 0xea, 0x55, 0xd9, 0x9d, 0x1d, 0xdd, 0xdb, 0xeb, 0xae, 0xed, 0xb1, 0x6b,
-	0x72, 0xa6, 0x77, 0x7e, 0x76, 0x54, 0xd3, 0xed, 0xde, 0x59, 0xf5, 0xcc, 0xb0, 0x33, 0x93, 0xf5,
-	0xe3, 0x76, 0x6d, 0xdb, 0x55, 0xa5, 0xa8, 0x72, 0xf7, 0xce, 0x01, 0x52, 0xe1, 0xcc, 0x70, 0x39,
-	0xc7, 0x59, 0x19, 0x45, 0x66, 0x96, 0xdd, 0x05, 0x42, 0xb4, 0x38, 0x00, 0xf2, 0x05, 0x8e, 0x48,
-	0xc8, 0xa7, 0xe5, 0xc4, 0x81, 0x0b, 0x07, 0x24, 0x2e, 0xcc, 0x81, 0xc3, 0xdc, 0x58, 0x40, 0x42,
-	0x2b, 0x90, 0x1a, 0xc6, 0x48, 0xdc, 0x10, 0x5c, 0x56, 0x5c, 0x40, 0x42, 0xf1, 0x93, 0x59, 0x69,
-	0x77, 0xd9, 0xee, 0x61, 0xb8, 0xd8, 0x19, 0x2f, 0xbe, 0xf7, 0xe2, 0x45, 0xc4, 0x8b, 0x88, 0xef,
-	0x45, 0x14, 0x94, 0xc2, 0xe9, 0x98, 0x06, 0xb5, 0xb1, 0xcf, 0x42, 0x86, 0x90, 0xcd, 0xac, 0x03,
-	0xea, 0xd7, 0x82, 0x23, 0xe2, 0x8f, 0x0e, 0x9c, 0xb0, 0x76, 0x78, 0xbf, 0xb2, 0x36, 0x64, 0x6c,
-	0xe8, 0xd2, 0xf7, 0x05, 0x62, 0x77, 0xb2, 0xf7, 0x7e, 0xe8, 0x8c, 0x68, 0x10, 0x92, 0xd1, 0x58,
-	0x2a, 0x55, 0x56, 0xcf, 0x03, 0xec, 0x89, 0x4f, 0x42, 0x87, 0x79, 0xaa, 0xfe, 0xe6, 0x90, 0x0d,
-	0x99, 0xf8, 0x7c, 0x9f, 0x7f, 0x49, 0xa9, 0xbe, 0x06, 0x8b, 0x4f, 0xa8, 0x1f, 0x38, 0xcc, 0x43,
-	0x37, 0x21, 0xe7, 0x78, 0x36, 0x7d, 0xb6, 0x92, 0xaa, 0xa6, 0xde, 0xce, 0x62, 0x59, 0xd0, 0xef,
-	0x01, 0xb4, 0xf9, 0x47, 0xcb, 0x0b, 0xfd, 0x29, 0xd2, 0x20, 0x73, 0x40, 0xa7, 0x02, 0x51, 0xc4,
-	0xfc, 0x93, 0x4b, 0x0e, 0x89, 0xbb, 0x92, 0x96, 0x92, 0x43, 0xe2, 0xea, 0x5f, 0xa7, 0xa0, 0x64,
-	0x78, 0x1e, 0x0b, 0x45, 0xeb, 0x01, 0x42, 0x90, 0xf5, 0xc8, 0x88, 0x2a, 0x25, 0xf1, 0x8d, 0x1a,
-	0x90, 0x77, 0xc9, 0x2e, 0x75, 0x83, 0x95, 0x74, 0x35, 0xf3, 0x76, 0x69, 0xfd, 0x07, 0xb5, 0x97,
-	0xbb, 0x5c, 0x4b, 0x18, 0xa9, 0x6d, 0x09, 0xb4, 0x70, 0x02, 0x2b, 0x55, 0xf4, 0x09, 0x2c, 0x3a,
-	0x9e, 0xed, 0x58, 0x34, 0x58, 0xc9, 0x0a, 0x2b, 0xab, 0xf3, 0xac, 0xcc, 0xbc, 0xaf, 0x67, 0xbf,
-	0x7a, 0xb1, 0xb6, 0x80, 0x23, 0xa5, 0xca, 0x87, 0x50, 0x4a, 0x98, 0x9d, 0xd3, 0xb7, 0x9b, 0x90,
-	0x3b, 0x24, 0xee, 0x84, 0xaa, 0xde, 0xc9, 0xc2, 0x47, 0xe9, 0x87, 0x29, 0xfd, 0x73, 0x28, 0x62,
-	0x1a, 0xb0, 0x89, 0x6f, 0xd1, 0x00, 0xbd, 0x03, 0x45, 0x8f, 0x78, 0xcc, 0xb4, 0xc6, 0x93, 0x40,
-	0xa8, 0x67, 0xea, 0xe5, 0xd3, 0x17, 0x6b, 0x85, 0x0e, 0xf1, 0x58, 0xa3, 0xb7, 0x13, 0xe0, 0x02,
-	0xaf, 0x6e, 0x8c, 0x27, 0x01, 0x7a, 0x1d, 0xca, 0x23, 0x3a, 0x62, 0xfe, 0xd4, 0xdc, 0x9d, 0x86,
-	0x34, 0x10, 0x86, 0x33, 0xb8, 0x24, 0x65, 0x75, 0x2e, 0xd2, 0xff, 0x30, 0x05, 0x37, 0x23, 0xdb,
-	0x98, 0xfe, 0xfa, 0xc4, 0xf1, 0xe9, 0x88, 0x7a, 0x61, 0x80, 0x3e, 0x80, 0xbc, 0xeb, 0x8c, 0x9c,
-	0x50, 0xb6, 0x51, 0x5a, 0x7f, 0x6d, 0x5e, 0x6f, 0x63, 0xaf, 0xb0, 0x02, 0x23, 0x03, 0xca, 0x3e,
-	0x0d, 0xa8, 0x7f, 0x28, 0x47, 0x52, 0x34, 0x79, 0xa5, 0xf2, 0x19, 0x15, 0x7d, 0x03, 0x0a, 0x3d,
-	0x97, 0x84, 0x7b, 0xcc, 0x1f, 0x21, 0x1d, 0xca, 0xc4, 0xb7, 0xf6, 0x9d, 0x90, 0x5a, 0xe1, 0xc4,
-	0x8f, 0x66, 0xf5, 0x8c, 0x0c, 0xdd, 0x82, 0x34, 0x93, 0x0d, 0x15, 0xeb, 0xf9, 0xd3, 0x17, 0x6b,
-	0xe9, 0x6e, 0x1f, 0xa7, 0x59, 0xa0, 0x7f, 0x0c, 0xd7, 0x7b, 0xee, 0x64, 0xe8, 0x78, 0x4d, 0x1a,
-	0x58, 0xbe, 0x33, 0xe6, 0xd6, 0x79, 0x78, 0xf0, 0xd8, 0x8f, 0xc2, 0x83, 0x7f, 0xc7, 0x21, 0x93,
-	0x9e, 0x85, 0x8c, 0xfe, 0x7b, 0x69, 0xb8, 0xde, 0xf2, 0x86, 0x8e, 0x47, 0x93, 0xda, 0x77, 0x61,
-	0x99, 0x0a, 0xa1, 0x79, 0x28, 0xc3, 0x58, 0xd9, 0x59, 0x92, 0xd2, 0x28, 0xb6, 0xdb, 0xe7, 0xe2,
-	0xed, 0xfe, 0xbc, 0xee, 0xbf, 0x64, 0x7d, 0x6e, 0xd4, 0xb5, 0x60, 0x71, 0x2c, 0x3a, 0x11, 0xac,
-	0x64, 0x84, 0xad, 0xbb, 0xf3, 0x6c, 0xbd, 0xd4, 0xcf, 0x28, 0xf8, 0x94, 0xee, 0xb7, 0x09, 0xbe,
-	0x7f, 0x4d, 0xc1, 0xb5, 0x0e, 0xb3, 0xcf, 0x8c, 0x43, 0x05, 0x0a, 0xfb, 0x2c, 0x08, 0x13, 0x0b,
-	0x2d, 0x2e, 0xa3, 0x87, 0x50, 0x18, 0xab, 0xe9, 0x53, 0xb3, 0x7f, 0x67, 0xbe, 0xcb, 0x12, 0x83,
-	0x63, 0x34, 0xfa, 0x18, 0x8a, 0x7e, 0x14, 0x13, 0x2b, 0x99, 0x57, 0x09, 0x9c, 0x19, 0x1e, 0xfd,
-	0x18, 0xf2, 0x72, 0x12, 0x56, 0xb2, 0x42, 0xf3, 0xee, 0x2b, 0x8d, 0x39, 0x56, 0x4a, 0xfa, 0x2f,
-	0x52, 0xa0, 0x61, 0xb2, 0x17, 0x6e, 0xd3, 0xd1, 0x2e, 0xf5, 0xfb, 0x21, 0x09, 0x27, 0x01, 0xba,
-	0x05, 0x79, 0x97, 0x12, 0x9b, 0xfa, 0xa2, 0x93, 0x05, 0xac, 0x4a, 0x68, 0x87, 0x07, 0x39, 0xb1,
-	0xf6, 0xc9, 0xae, 0xe3, 0x3a, 0xe1, 0x54, 0x74, 0x73, 0x79, 0xfe, 0x2c, 0x9f, 0xb7, 0x59, 0xc3,
-	0x09, 0x45, 0x7c, 0xc6, 0x0c, 0x5a, 0x81, 0xc5, 0x11, 0x0d, 0x02, 0x32, 0xa4, 0xa2, 0xf7, 0x45,
-	0x1c, 0x15, 0xf5, 0x8f, 0xa1, 0x9c, 0xd4, 0x43, 0x25, 0x58, 0xdc, 0xe9, 0x3c, 0xee, 0x74, 0x9f,
-	0x76, 0xb4, 0x05, 0x74, 0x0d, 0x4a, 0x3b, 0x1d, 0xdc, 0x32, 0x1a, 0x9b, 0x46, 0x7d, 0xab, 0xa5,
-	0xa5, 0xd0, 0x12, 0x14, 0x67, 0xc5, 0xb4, 0xfe, 0xe7, 0x29, 0x00, 0x3e, 0x81, 0xaa, 0x53, 0x1f,
-	0x41, 0x2e, 0x08, 0x49, 0x28, 0x27, 0x6e, 0x79, 0xfd, 0xcd, 0x79, 0x5e, 0xcf, 0xe0, 0x35, 0xfe,
-	0x8f, 0x62, 0xa9, 0x92, 0xf4, 0x30, 0x7d, 0xc6, 0x43, 0xbe, 0x86, 0x88, 0x6d, 0xfb, 0xca, 0x71,
-	0xf1, 0xad, 0x7f, 0x0c, 0x39, 0xa1, 0x7d, 0xd6, 0xdd, 0x02, 0x64, 0x9b, 0xfc, 0x2b, 0x85, 0x8a,
-	0x90, 0xc3, 0x2d, 0xa3, 0xf9, 0xb9, 0x96, 0x46, 0x1a, 0x94, 0x9b, 0xed, 0x7e, 0xa3, 0xdb, 0xe9,
-	0xb4, 0x1a, 0x83, 0x56, 0x53, 0xcb, 0xe8, 0x77, 0x21, 0xd7, 0x1e, 0x71, 0xcb, 0x77, 0x78, 0x54,
-	0xec, 0x51, 0x9f, 0x7a, 0x56, 0x14, 0x6c, 0x33, 0x81, 0xfe, 0xf3, 0x22, 0xe4, 0xb6, 0xd9, 0xc4,
-	0x0b, 0xd1, 0x7a, 0x62, 0x65, 0x2f, 0xcf, 0xdf, 0x9c, 0x05, 0xb0, 0x36, 0x98, 0x8e, 0xa9, 0x5a,
-	0xf9, 0xb7, 0x20, 0x2f, 0xe3, 0x47, 0x75, 0x47, 0x95, 0xb8, 0x3c, 0x24, 0xfe, 0x90, 0x86, 0xaa,
-	0x3f, 0xaa, 0x84, 0xde, 0x86, 0x82, 0x4f, 0x89, 0xcd, 0x3c, 0x77, 0x2a, 0xc2, 0xac, 0x20, 0xb7,
-	0x5e, 0x4c, 0x89, 0xdd, 0xf5, 0xdc, 0x29, 0x8e, 0x6b, 0xd1, 0x26, 0x94, 0x77, 0x1d, 0xcf, 0x36,
-	0xd9, 0x58, 0xee, 0x83, 0xb9, 0x8b, 0x83, 0x52, 0x7a, 0x55, 0x77, 0x3c, 0xbb, 0x2b, 0xc1, 0xb8,
-	0xb4, 0x3b, 0x2b, 0xa0, 0x0e, 0x2c, 0x1f, 0x32, 0x77, 0x32, 0xa2, 0xb1, 0xad, 0xbc, 0xb0, 0xf5,
-	0xd6, 0xc5, 0xb6, 0x9e, 0x08, 0x7c, 0x64, 0x6d, 0xe9, 0x30, 0x59, 0x44, 0x8f, 0x61, 0x29, 0x1c,
-	0x8d, 0xf7, 0x82, 0xd8, 0xdc, 0xa2, 0x30, 0xf7, 0xfd, 0x4b, 0x06, 0x8c, 0xc3, 0x23, 0x6b, 0xe5,
-	0x30, 0x51, 0xaa, 0xfc, 0x4e, 0x06, 0x4a, 0x09, 0xcf, 0x51, 0x1f, 0x4a, 0x63, 0x9f, 0x8d, 0xc9,
-	0x50, 0xec, 0xe5, 0x6a, 0x2e, 0xee, 0xbf, 0x52, 0xaf, 0x6b, 0xbd, 0x99, 0x22, 0x4e, 0x5a, 0xd1,
-	0x4f, 0xd2, 0x50, 0x4a, 0x54, 0xa2, 0x77, 0xa1, 0x80, 0x7b, 0xb8, 0xfd, 0xc4, 0x18, 0xb4, 0xb4,
-	0x85, 0xca, 0x9d, 0xe3, 0x93, 0xea, 0x8a, 0xb0, 0x96, 0x34, 0xd0, 0xf3, 0x9d, 0x43, 0x1e, 0x7a,
-	0x6f, 0xc3, 0x62, 0x04, 0x4d, 0x55, 0xbe, 0x77, 0x7c, 0x52, 0xfd, 0xee, 0x79, 0x68, 0x02, 0x89,
-	0xfb, 0x9b, 0x06, 0x6e, 0x35, 0xb5, 0xf4, 0x7c, 0x24, 0xee, 0xef, 0x13, 0x9f, 0xda, 0xe8, 0xfb,
-	0x90, 0x57, 0xc0, 0x4c, 0xa5, 0x72, 0x7c, 0x52, 0xbd, 0x75, 0x1e, 0x38, 0xc3, 0xe1, 0xfe, 0x96,
-	0xf1, 0xa4, 0xa5, 0x65, 0xe7, 0xe3, 0x70, 0xdf, 0x25, 0x87, 0x14, 0xbd, 0x09, 0x39, 0x09, 0xcb,
-	0x55, 0x6e, 0x1f, 0x9f, 0x54, 0xbf, 0xf3, 0x92, 0x39, 0x8e, 0xaa, 0xac, 0xfc, 0xfe, 0xcf, 0x56,
-	0x17, 0xfe, 0xf2, 0x4f, 0x56, 0xb5, 0xf3, 0xd5, 0x95, 0xff, 0x4e, 0xc1, 0xd2, 0x99, 0x29, 0x47,
-	0x3a, 0xe4, 0x3d, 0x66, 0xb1, 0xb1, 0xdc, 0xe2, 0x0b, 0x75, 0x38, 0x7d, 0xb1, 0x96, 0xef, 0xb0,
-	0x06, 0x1b, 0x4f, 0xb1, 0xaa, 0x41, 0x8f, 0xcf, 0x1d, 0x52, 0x0f, 0x5e, 0x31, 0x9e, 0xe6, 0x1e,
-	0x53, 0x9f, 0xc2, 0x92, 0xed, 0x3b, 0x87, 0xd4, 0x37, 0x2d, 0xe6, 0xed, 0x39, 0x43, 0xb5, 0x7d,
-	0x57, 0xe6, 0xd9, 0x6c, 0x0a, 0x20, 0x2e, 0x4b, 0x85, 0x86, 0xc0, 0x7f, 0x8b, 0x03, 0xaa, 0xf2,
-	0x04, 0xca, 0xc9, 0x08, 0x45, 0xaf, 0x01, 0x04, 0xce, 0x6f, 0x50, 0xc5, 0x79, 0x04, 0x43, 0xc2,
-	0x45, 0x2e, 0x11, 0x8c, 0x07, 0xbd, 0x05, 0xd9, 0x11, 0xb3, 0xa5, 0x9d, 0xa5, 0xfa, 0x0d, 0x7e,
-	0x4e, 0xfe, 0xe3, 0x8b, 0xb5, 0x12, 0x0b, 0x6a, 0x1b, 0x8e, 0x4b, 0xb7, 0x99, 0x4d, 0xb1, 0x00,
-	0xe8, 0x87, 0x90, 0xe5, 0x5b, 0x05, 0xfa, 0x1e, 0x64, 0xeb, 0xed, 0x4e, 0x53, 0x5b, 0xa8, 0x5c,
-	0x3f, 0x3e, 0xa9, 0x2e, 0x89, 0x21, 0xe1, 0x15, 0x3c, 0x76, 0xd1, 0x1a, 0xe4, 0x9f, 0x74, 0xb7,
-	0x76, 0xb6, 0x79, 0x78, 0xdd, 0x38, 0x3e, 0xa9, 0x5e, 0x8b, 0xab, 0xe5, 0xa0, 0xa1, 0xd7, 0x20,
-	0x37, 0xd8, 0xee, 0x6d, 0xf4, 0xb5, 0x74, 0x05, 0x1d, 0x9f, 0x54, 0x97, 0xe3, 0x7a, 0xe1, 0x73,
-	0xe5, 0xba, 0x9a, 0xd5, 0x62, 0x2c, 0xd7, 0x7f, 0x99, 0x86, 0x25, 0xcc, 0xc9, 0xb6, 0x1f, 0xf6,
-	0x98, 0xeb, 0x58, 0x53, 0xd4, 0x83, 0xa2, 0xc5, 0x3c, 0xdb, 0x49, 0xac, 0xa9, 0xf5, 0x0b, 0x0e,
-	0xc6, 0x99, 0x56, 0x54, 0x6a, 0x44, 0x9a, 0x78, 0x66, 0x04, 0xbd, 0x0f, 0x39, 0x9b, 0xba, 0x64,
-	0xaa, 0x4e, 0xe8, 0xdb, 0x35, 0x49, 0xe7, 0x6b, 0x11, 0x9d, 0xaf, 0x35, 0x15, 0x9d, 0xc7, 0x12,
-	0x27, 0xa8, 0x24, 0x79, 0x66, 0x92, 0x30, 0xa4, 0xa3, 0x71, 0x28, 0x8f, 0xe7, 0x2c, 0x2e, 0x8d,
-	0xc8, 0x33, 0x43, 0x89, 0xd0, 0x7d, 0xc8, 0x1f, 0x39, 0x9e, 0xcd, 0x8e, 0xd4, 0x09, 0x7c, 0x89,
-	0x51, 0x05, 0xd4, 0x8f, 0xf9, 0xa9, 0x7b, 0xce, 0x4d, 0x3e, 0xde, 0x9d, 0x6e, 0xa7, 0x15, 0x8d,
-	0xb7, 0xaa, 0xef, 0x7a, 0x1d, 0xe6, 0xf1, 0xb5, 0x02, 0xdd, 0x8e, 0xb9, 0x61, 0xb4, 0xb7, 0x76,
-	0x30, 0x1f, 0xf3, 0x9b, 0xc7, 0x27, 0x55, 0x2d, 0x86, 0x6c, 0x10, 0xc7, 0xe5, 0x94, 0xf0, 0x36,
-	0x64, 0x8c, 0xce, 0xe7, 0x5a, 0xba, 0xa2, 0x1d, 0x9f, 0x54, 0xcb, 0x71, 0xb5, 0xe1, 0x4d, 0x67,
-	0xcb, 0xe8, 0x7c, 0xbb, 0xfa, 0xdf, 0x64, 0xa0, 0xbc, 0x33, 0xb6, 0x49, 0x48, 0x65, 0x4c, 0xa2,
-	0x2a, 0x94, 0xc6, 0xc4, 0x27, 0xae, 0x4b, 0x5d, 0x27, 0x18, 0xa9, 0x44, 0x25, 0x29, 0x42, 0x1f,
-	0xbe, 0xea, 0x30, 0xd6, 0x0b, 0x3c, 0xce, 0xfe, 0xe8, 0x9f, 0xd7, 0x52, 0xd1, 0x80, 0xee, 0xc0,
-	0xf2, 0x9e, 0xf4, 0xd6, 0x24, 0x96, 0x98, 0xd8, 0x8c, 0x98, 0xd8, 0xda, 0xbc, 0x89, 0x4d, 0xba,
-	0x55, 0x53, 0x9d, 0x34, 0x84, 0x16, 0x5e, 0xda, 0x4b, 0x16, 0xd1, 0x03, 0x58, 0x1c, 0x31, 0xcf,
-	0x09, 0x99, 0x7f, 0xf5, 0x2c, 0x44, 0x48, 0xf4, 0x2e, 0x5c, 0xe7, 0x93, 0x1b, 0xf9, 0x23, 0xaa,
-	0xc5, 0x89, 0x95, 0xc6, 0xd7, 0x46, 0xe4, 0x99, 0x6a, 0x10, 0x73, 0x31, 0xaa, 0x43, 0x8e, 0xf9,
-	0x9c, 0x12, 0xe5, 0x85, 0xbb, 0xef, 0x5d, 0xe9, 0xae, 0x2c, 0x74, 0xb9, 0x0e, 0x96, 0xaa, 0xfa,
-	0x8f, 0x60, 0xe9, 0x4c, 0x27, 0x38, 0x13, 0xe8, 0x19, 0x3b, 0xfd, 0x96, 0xb6, 0x80, 0xca, 0x50,
-	0x68, 0x74, 0x3b, 0x83, 0x76, 0x67, 0x87, 0x53, 0x99, 0x32, 0x14, 0x70, 0x77, 0x6b, 0xab, 0x6e,
-	0x34, 0x1e, 0x6b, 0x69, 0xbd, 0x06, 0xa5, 0x84, 0x35, 0xb4, 0x0c, 0xd0, 0x1f, 0x74, 0x7b, 0xe6,
-	0x46, 0x1b, 0xf7, 0x07, 0x92, 0x08, 0xf5, 0x07, 0x06, 0x1e, 0x28, 0x41, 0x4a, 0xff, 0x8f, 0x74,
-	0x34, 0xa3, 0x8a, 0xfb, 0xd4, 0xcf, 0x72, 0x9f, 0x4b, 0x9c, 0x57, 0xec, 0x67, 0x56, 0x88, 0x39,
-	0xd0, 0x87, 0x00, 0x22, 0x70, 0xa8, 0x6d, 0x92, 0x50, 0x4d, 0x7c, 0xe5, 0xa5, 0x41, 0x1e, 0x44,
-	0xf9, 0x32, 0x2e, 0x2a, 0xb4, 0x11, 0xa2, 0x1f, 0x43, 0xd9, 0x62, 0xa3, 0xb1, 0x4b, 0x95, 0x72,
-	0xe6, 0x4a, 0xe5, 0x52, 0x8c, 0x37, 0xc2, 0x24, 0xfb, 0xca, 0x9e, 0xe5, 0x87, 0xbf, 0x9b, 0x8a,
-	0x46, 0x66, 0x0e, 0xe1, 0x2a, 0x43, 0x61, 0xa7, 0xd7, 0x34, 0x06, 0xed, 0xce, 0x23, 0x2d, 0x85,
-	0x00, 0xf2, 0x62, 0xa8, 0x9b, 0x5a, 0x9a, 0x13, 0xc5, 0x46, 0x77, 0xbb, 0xb7, 0xd5, 0x12, 0x94,
-	0x0b, 0xdd, 0x04, 0x2d, 0x1a, 0x6c, 0x53, 0x0c, 0x64, 0xab, 0xa9, 0x65, 0xd1, 0x0d, 0xb8, 0x16,
-	0x4b, 0x95, 0x66, 0x0e, 0xdd, 0x02, 0x14, 0x0b, 0x67, 0x26, 0xf2, 0xfa, 0x6f, 0xc1, 0xb5, 0x06,
-	0xf3, 0x42, 0xe2, 0x78, 0x31, 0x89, 0x5e, 0xe7, 0x9d, 0x56, 0x22, 0xd3, 0xb1, 0xe5, 0x9e, 0x5e,
-	0xbf, 0x76, 0xfa, 0x62, 0xad, 0x14, 0x43, 0xdb, 0x4d, 0xde, 0xd3, 0xa8, 0x60, 0xf3, 0xf5, 0x3b,
-	0x76, 0x6c, 0x31, 0xb8, 0xb9, 0xfa, 0xe2, 0xe9, 0x8b, 0xb5, 0x4c, 0xaf, 0xdd, 0xc4, 0x5c, 0x86,
-	0xbe, 0x07, 0x45, 0xfa, 0xcc, 0x09, 0x4d, 0x8b, 0xef, 0xe1, 0x7c, 0x00, 0x73, 0xb8, 0xc0, 0x05,
-	0x0d, 0xbe, 0x65, 0xd7, 0x01, 0x7a, 0xcc, 0x0f, 0x55, 0xcb, 0x3f, 0x84, 0xdc, 0x98, 0xf9, 0x22,
-	0x83, 0xbd, 0x30, 0x5f, 0xe7, 0x70, 0x19, 0xa8, 0x58, 0x82, 0xf5, 0xbf, 0x4a, 0x03, 0x0c, 0x48,
-	0x70, 0xa0, 0x8c, 0x3c, 0x84, 0x62, 0x7c, 0xf7, 0xa1, 0x52, 0xe1, 0x4b, 0x67, 0x3b, 0x06, 0xa3,
-	0x07, 0x51, 0xb0, 0xc9, 0xf4, 0x60, 0x6e, 0x2a, 0x13, 0x35, 0x34, 0x8f, 0x61, 0x9f, 0xcd, 0x01,
-	0xf8, 0x91, 0x48, 0x7d, 0x5f, 0xcd, 0x3c, 0xff, 0x44, 0x0d, 0x71, 0x2c, 0xc8, 0x41, 0x53, 0x04,
-	0xf3, 0x8d, 0x79, 0x8d, 0x9c, 0x9b, 0x91, 0xcd, 0x05, 0x3c, 0xd3, 0x43, 0x9f, 0x42, 0x89, 0xf7,
-	0xdb, 0x0c, 0x44, 0x9d, 0xe2, 0x96, 0x17, 0x0e, 0x95, 0xb4, 0x80, 0x61, 0x1c, 0x7f, 0xd7, 0x35,
-	0x58, 0xf6, 0x27, 0x1e, 0xef, 0xb6, 0xb2, 0xa1, 0x3b, 0xf0, 0xdd, 0x0e, 0x0d, 0x8f, 0x98, 0x7f,
-	0x60, 0x84, 0x21, 0xb1, 0xf6, 0x47, 0xd4, 0x53, 0x63, 0x9c, 0x20, 0xd6, 0xa9, 0x33, 0xc4, 0x7a,
-	0x05, 0x16, 0x89, 0xeb, 0x90, 0x80, 0x4a, 0x36, 0x52, 0xc4, 0x51, 0x91, 0xd3, 0x7f, 0x9e, 0x4c,
-	0xd0, 0x20, 0xa0, 0x32, 0x05, 0x2e, 0xe2, 0x99, 0x40, 0xff, 0xfb, 0x34, 0x40, 0xbb, 0x67, 0x6c,
-	0x2b, 0xf3, 0x4d, 0xc8, 0xef, 0x91, 0x91, 0xe3, 0x4e, 0x2f, 0x5b, 0xe0, 0x33, 0x7c, 0xcd, 0x90,
-	0x86, 0x36, 0x84, 0x0e, 0x56, 0xba, 0x22, 0x2b, 0x98, 0xec, 0x7a, 0x34, 0x8c, 0xb3, 0x02, 0x51,
-	0xe2, 0x14, 0xc4, 0x27, 0x5e, 0x3c, 0x33, 0xb2, 0xc0, 0x5d, 0x1f, 0x92, 0x90, 0x1e, 0x91, 0x69,
-	0xb4, 0x2a, 0x55, 0x11, 0x6d, 0xf2, 0x6c, 0x21, 0xa0, 0xfe, 0x21, 0xb5, 0x57, 0x72, 0x22, 0x04,
-	0xaf, 0xf2, 0x07, 0x2b, 0xb8, 0x24, 0x57, 0xb1, 0x76, 0xe5, 0x63, 0xc1, 0x08, 0x66, 0x55, 0xdf,
-	0x28, 0x81, 0xbf, 0x07, 0x4b, 0x67, 0xfa, 0xf9, 0x52, 0x3a, 0xd6, 0xee, 0x3d, 0xf9, 0xa1, 0x96,
-	0x55, 0x5f, 0x3f, 0xd2, 0xf2, 0xfa, 0x9f, 0x66, 0xe4, 0x3a, 0x52, 0xa3, 0x3a, 0xff, 0x4a, 0xad,
-	0x20, 0xa2, 0xdf, 0x62, 0xae, 0x8a, 0xef, 0xb7, 0x2e, 0x5f, 0x5e, 0x9c, 0xde, 0x0b, 0x38, 0x8e,
-	0x15, 0xd1, 0x1a, 0x94, 0xe4, 0xfc, 0x9b, 0x3c, 0x9e, 0xc4, 0xb0, 0x2e, 0x61, 0x90, 0x22, 0xae,
-	0x89, 0xee, 0xc2, 0xf2, 0x78, 0xb2, 0xeb, 0x3a, 0xc1, 0x3e, 0xb5, 0x25, 0x26, 0x2b, 0x30, 0x4b,
-	0xb1, 0x54, 0xc0, 0xb6, 0xa1, 0xac, 0x04, 0xa6, 0xa0, 0x76, 0x39, 0xe1, 0xd0, 0xbb, 0x57, 0x39,
-	0x24, 0x55, 0x04, 0xe3, 0x2b, 0x8d, 0x67, 0x05, 0xbd, 0x09, 0x85, 0xc8, 0x59, 0xb4, 0x02, 0x99,
-	0x41, 0xa3, 0xa7, 0x2d, 0x54, 0xae, 0x1d, 0x9f, 0x54, 0x4b, 0x91, 0x78, 0xd0, 0xe8, 0xf1, 0x9a,
-	0x9d, 0x66, 0x4f, 0x4b, 0x9d, 0xad, 0xd9, 0x69, 0xf6, 0x2a, 0x59, 0x4e, 0x31, 0xf4, 0x3d, 0x28,
-	0x25, 0x5a, 0x40, 0x6f, 0xc0, 0x62, 0xbb, 0xf3, 0x08, 0xb7, 0xfa, 0x7d, 0x6d, 0xa1, 0x72, 0xeb,
-	0xf8, 0xa4, 0x8a, 0x12, 0xb5, 0x6d, 0x6f, 0xc8, 0xe7, 0x07, 0xbd, 0x06, 0xd9, 0xcd, 0x2e, 0x3f,
-	0xba, 0x24, 0x97, 0x4c, 0x20, 0x36, 0x59, 0x10, 0x56, 0x6e, 0x28, 0xee, 0x92, 0x34, 0xac, 0xff,
-	0x71, 0x0a, 0xf2, 0x92, 0x52, 0xcf, 0x9d, 0x28, 0x03, 0x16, 0xa3, 0x44, 0x4f, 0xf2, 0xfc, 0xb7,
-	0x2e, 0xe6, 0xe4, 0x35, 0x45, 0xa1, 0x65, 0xf8, 0x45, 0x7a, 0x95, 0x8f, 0xa0, 0x9c, 0xac, 0xf8,
-	0x46, 0xc1, 0xf7, 0x9b, 0x50, 0xe2, 0xf1, 0x1d, 0x71, 0xf3, 0x75, 0xc8, 0x4b, 0xda, 0x1f, 0x6f,
-	0xa5, 0x17, 0x27, 0x08, 0x0a, 0x89, 0x1e, 0xc2, 0xa2, 0x4c, 0x2a, 0xa2, 0x2b, 0xb0, 0xd5, 0xcb,
-	0x57, 0x11, 0x8e, 0xe0, 0xfa, 0xa7, 0x90, 0xed, 0x51, 0xea, 0xf3, 0xb1, 0xf7, 0x98, 0x4d, 0x67,
-	0xa7, 0x8f, 0xca, 0x87, 0x6c, 0xda, 0x6e, 0xf2, 0x7c, 0xc8, 0xa6, 0x6d, 0x3b, 0xbe, 0xc1, 0x48,
-	0x27, 0x6e, 0x30, 0x06, 0x50, 0x7e, 0x4a, 0x9d, 0xe1, 0x7e, 0x48, 0x6d, 0x61, 0xe8, 0x3d, 0xc8,
-	0x8e, 0x69, 0xec, 0xfc, 0xca, 0xdc, 0x00, 0xa3, 0xd4, 0xc7, 0x02, 0xc5, 0xf7, 0x91, 0x23, 0xa1,
-	0xad, 0x2e, 0x5e, 0x55, 0x49, 0xff, 0xbb, 0x34, 0x2c, 0xb7, 0x83, 0x60, 0x42, 0x3c, 0x2b, 0x22,
-	0x26, 0x9f, 0x9c, 0x25, 0x26, 0x6f, 0xcf, 0xed, 0xe1, 0x19, 0x95, 0xb3, 0x17, 0x33, 0xea, 0x70,
-	0x48, 0xc7, 0x87, 0x83, 0xfe, 0xef, 0xa9, 0xe8, 0xf6, 0xe5, 0x6e, 0x62, 0xb9, 0x57, 0x56, 0x8e,
-	0x4f, 0xaa, 0x37, 0x93, 0x96, 0xe8, 0x8e, 0x77, 0xe0, 0xb1, 0x23, 0x0f, 0xbd, 0x0e, 0x39, 0xdc,
-	0xea, 0xb4, 0x9e, 0x6a, 0x29, 0x19, 0x9e, 0x67, 0x40, 0x98, 0x7a, 0xf4, 0x88, 0x5b, 0xea, 0xb5,
-	0x3a, 0x4d, 0x4e, 0x24, 0xd2, 0x73, 0x2c, 0xf5, 0xa8, 0x67, 0x3b, 0xde, 0x10, 0xbd, 0x01, 0xf9,
-	0x76, 0xbf, 0xbf, 0x23, 0xf2, 0xe3, 0xef, 0x1e, 0x9f, 0x54, 0x6f, 0x9c, 0x41, 0xf1, 0x02, 0xb5,
-	0x39, 0x88, 0xb3, 0x78, 0x4e, 0x31, 0xe6, 0x80, 0x38, 0x3d, 0x94, 0x20, 0xdc, 0x1d, 0xf0, 0xe4,
-	0x3d, 0x37, 0x07, 0x84, 0x19, 0xff, 0xab, 0x96, 0xdb, 0x3f, 0xa5, 0x41, 0x33, 0x2c, 0x8b, 0x8e,
-	0x43, 0x5e, 0xaf, 0x12, 0xa7, 0x01, 0x14, 0xc6, 0xfc, 0xcb, 0xa1, 0x11, 0x09, 0x78, 0x38, 0xf7,
-	0xea, 0xff, 0x9c, 0x5e, 0x0d, 0x33, 0x97, 0x1a, 0xf6, 0xc8, 0x09, 0x02, 0x87, 0x79, 0x52, 0x86,
-	0x63, 0x4b, 0x95, 0xff, 0x4c, 0xc1, 0x8d, 0x39, 0x08, 0x74, 0x0f, 0xb2, 0x3e, 0x73, 0xa3, 0x39,
-	0xbc, 0x73, 0xd1, 0xc5, 0x1a, 0x57, 0xc5, 0x02, 0x89, 0x56, 0x01, 0xc8, 0x24, 0x64, 0x44, 0xb4,
-	0x2f, 0x66, 0xaf, 0x80, 0x13, 0x12, 0xf4, 0x14, 0xf2, 0x01, 0xb5, 0x7c, 0x1a, 0x51, 0xc5, 0x4f,
-	0xff, 0xaf, 0xde, 0xd7, 0xfa, 0xc2, 0x0c, 0x56, 0xe6, 0x2a, 0x35, 0xc8, 0x4b, 0x09, 0x0f, 0x7b,
-	0x9b, 0x84, 0x44, 0x38, 0x5d, 0xc6, 0xe2, 0x9b, 0x47, 0x13, 0x71, 0x87, 0x51, 0x34, 0x11, 0x77,
-	0xa8, 0xff, 0x75, 0x1a, 0xa0, 0xf5, 0x2c, 0xa4, 0xbe, 0x47, 0xdc, 0x86, 0x81, 0x5a, 0x89, 0xdd,
-	0x5f, 0xf6, 0xf6, 0x9d, 0xb9, 0xd7, 0xad, 0xb1, 0x46, 0xad, 0x61, 0xcc, 0xd9, 0xff, 0x6f, 0x43,
-	0x66, 0xe2, 0xab, 0xd7, 0x1c, 0x49, 0xf3, 0x76, 0xf0, 0x16, 0xe6, 0x32, 0xd4, 0x9a, 0x6d, 0x5b,
-	0x99, 0x8b, 0xdf, 0x6c, 0x12, 0x0d, 0xcc, 0xdd, 0xba, 0xf8, 0xca, 0xb7, 0x88, 0x69, 0x51, 0x75,
-	0x72, 0x94, 0xe5, 0xca, 0x6f, 0x18, 0x0d, 0xea, 0x87, 0x38, 0x6f, 0x11, 0xfe, 0xff, 0x5b, 0xed,
-	0x6f, 0xef, 0x01, 0xcc, 0xba, 0x86, 0x56, 0x21, 0xd7, 0xd8, 0xe8, 0xf7, 0xb7, 0xb4, 0x05, 0xb9,
-	0x81, 0xcf, 0xaa, 0x84, 0x58, 0xff, 0x59, 0x0a, 0x0a, 0x0d, 0x43, 0x1d, 0xab, 0x0d, 0xd0, 0xc4,
-	0xae, 0xc4, 0xbd, 0x33, 0xe9, 0xb3, 0xb1, 0xe3, 0x4f, 0xd5, 0xc6, 0x72, 0x49, 0xce, 0xb6, 0xcc,
-	0x55, 0xb8, 0xd7, 0x2d, 0xa1, 0x80, 0x30, 0x94, 0xa9, 0x1a, 0x04, 0xd3, 0x22, 0xd1, 0x1e, 0xbf,
-	0x7a, 0xf9, 0x60, 0x49, 0xf6, 0x3d, 0x2b, 0x07, 0xb8, 0x14, 0x19, 0x69, 0x90, 0x40, 0x7f, 0x02,
-	0x37, 0xba, 0xbe, 0xb5, 0x4f, 0x83, 0x50, 0x36, 0xaa, 0xfc, 0xfd, 0x14, 0xee, 0x84, 0x24, 0x38,
-	0x30, 0xf7, 0x9d, 0x20, 0x64, 0xfe, 0xd4, 0xf4, 0x69, 0x48, 0x3d, 0x5e, 0x6f, 0x8a, 0xb7, 0x1f,
-	0x75, 0xd3, 0x72, 0x9b, 0x63, 0x36, 0x25, 0x04, 0x47, 0x88, 0x2d, 0x0e, 0xd0, 0xdb, 0x50, 0xe6,
-	0x7c, 0xb7, 0x49, 0xf7, 0xc8, 0xc4, 0x0d, 0x03, 0x9e, 0x49, 0xb9, 0x6c, 0x68, 0xbe, 0xf2, 0x81,
-	0x50, 0x74, 0xd9, 0x50, 0x7e, 0xea, 0x3f, 0x05, 0xad, 0xe9, 0x04, 0x63, 0x12, 0x5a, 0xfb, 0xd1,
-	0x15, 0x12, 0x6a, 0x82, 0xb6, 0x4f, 0x89, 0x1f, 0xee, 0x52, 0x12, 0x9a, 0x63, 0xea, 0x3b, 0xcc,
-	0xbe, 0x7a, 0x3c, 0xaf, 0xc5, 0x2a, 0x3d, 0xa1, 0xa1, 0xff, 0x57, 0x0a, 0x00, 0x93, 0xbd, 0x88,
-	0xfb, 0xfc, 0x00, 0xae, 0x07, 0x1e, 0x19, 0x07, 0xfb, 0x2c, 0x34, 0x1d, 0x2f, 0xa4, 0xfe, 0x21,
-	0x71, 0xd5, 0x4d, 0x80, 0x16, 0x55, 0xb4, 0x95, 0x1c, 0xbd, 0x07, 0xe8, 0x80, 0xd2, 0xb1, 0xc9,
-	0x5c, 0xdb, 0x8c, 0x2a, 0xe5, 0xcb, 0x54, 0x16, 0x6b, 0xbc, 0xa6, 0xeb, 0xda, 0xfd, 0x48, 0x8e,
-	0xea, 0xb0, 0xca, 0xbb, 0x4f, 0xbd, 0xd0, 0x77, 0x68, 0x60, 0xee, 0x31, 0xdf, 0x0c, 0x5c, 0x76,
-	0x64, 0xee, 0x31, 0xd7, 0x65, 0x47, 0xd4, 0x8f, 0x2e, 0x59, 0x2a, 0x2e, 0x1b, 0xb6, 0x24, 0x68,
-	0x83, 0xf9, 0x7d, 0x97, 0x1d, 0x6d, 0x44, 0x08, 0x4e, 0x90, 0x66, 0x7d, 0x0e, 0x1d, 0xeb, 0x20,
-	0x22, 0x48, 0xb1, 0x74, 0xe0, 0x58, 0x07, 0xe8, 0x0d, 0x58, 0xa2, 0x2e, 0x15, 0xb9, 0xb6, 0x44,
-	0xe5, 0x04, 0xaa, 0x1c, 0x09, 0x39, 0x48, 0xff, 0x0c, 0xb4, 0x96, 0x67, 0xf9, 0xd3, 0x71, 0x62,
-	0xce, 0xdf, 0x03, 0xc4, 0xb7, 0x23, 0xd3, 0x65, 0xd6, 0x81, 0x39, 0x22, 0x1e, 0x19, 0x72, 0xbf,
-	0xe4, 0x6b, 0x88, 0xc6, 0x6b, 0xb6, 0x98, 0x75, 0xb0, 0xad, 0xe4, 0xfa, 0x87, 0x00, 0xfd, 0xb1,
-	0x4f, 0x89, 0xdd, 0xe5, 0xe7, 0x36, 0x1f, 0x3a, 0x51, 0x32, 0x6d, 0xf5, 0xe0, 0xc2, 0x7c, 0xb5,
-	0xa8, 0x34, 0x59, 0xd1, 0x8c, 0xe5, 0xfa, 0xaf, 0xc2, 0x8d, 0x9e, 0x4b, 0x2c, 0xf1, 0xf8, 0xd8,
-	0x8b, 0xaf, 0xf7, 0xd1, 0x43, 0xc8, 0x4b, 0xa8, 0x9a, 0xc9, 0xb9, 0x81, 0x3d, 0x6b, 0x73, 0x73,
-	0x01, 0x2b, 0x7c, 0xbd, 0x0c, 0x30, 0xb3, 0xa3, 0x3f, 0x83, 0x62, 0x6c, 0x1e, 0x55, 0x81, 0x27,
-	0x9b, 0x3c, 0xba, 0x1d, 0x4f, 0x65, 0x87, 0x45, 0x9c, 0x14, 0xa1, 0x36, 0x94, 0xc6, 0xb1, 0xf2,
-	0xa5, 0xc4, 0x69, 0x8e, 0xd3, 0x38, 0xa9, 0xab, 0x7f, 0x02, 0xf0, 0x13, 0xe6, 0x78, 0x03, 0x76,
-	0x40, 0x3d, 0xf1, 0xa2, 0xc4, 0xf3, 0x22, 0x1a, 0x0d, 0x84, 0x2a, 0x89, 0xb4, 0x4f, 0x8e, 0x62,
-	0xfc, 0xb0, 0x22, 0x8b, 0xfa, 0x1f, 0xa4, 0x21, 0x8f, 0x19, 0x0b, 0x1b, 0x06, 0xaa, 0x42, 0xde,
-	0x22, 0x66, 0xb4, 0x35, 0x95, 0xeb, 0xc5, 0xd3, 0x17, 0x6b, 0xb9, 0x86, 0xf1, 0x98, 0x4e, 0x71,
-	0xce, 0x22, 0x8f, 0xe9, 0x34, 0xb9, 0xdd, 0xa5, 0x2f, 0xda, 0xee, 0xd0, 0x3d, 0x28, 0x2b, 0x90,
-	0xb9, 0x4f, 0x82, 0x7d, 0x99, 0xcd, 0xd4, 0x97, 0x4f, 0x5f, 0xac, 0x81, 0x44, 0x6e, 0x92, 0x60,
-	0x1f, 0x83, 0x44, 0xf3, 0x6f, 0xd4, 0x82, 0xd2, 0x17, 0xcc, 0xf1, 0xcc, 0x50, 0x74, 0x42, 0x5d,
-	0x2c, 0xcd, 0x9d, 0x8a, 0x59, 0x57, 0xd5, 0x0b, 0x24, 0x7c, 0x31, 0xeb, 0x7c, 0x0b, 0x96, 0x7c,
-	0xc6, 0x42, 0xd3, 0x57, 0xef, 0xec, 0x2a, 0x67, 0xad, 0xce, 0xbd, 0xca, 0x64, 0x2c, 0xc4, 0x0a,
-	0x87, 0xcb, 0x7e, 0xa2, 0xa4, 0xff, 0x43, 0x0a, 0x4a, 0xdc, 0x35, 0x67, 0xcf, 0xb1, 0x38, 0xbf,
-	0xf9, 0xe6, 0xc7, 0xee, 0x6d, 0xc8, 0x58, 0x81, 0xaf, 0x86, 0x48, 0x9c, 0x3b, 0x8d, 0x3e, 0xc6,
-	0x5c, 0x86, 0x3e, 0x83, 0xbc, 0xca, 0x84, 0xe5, 0x89, 0xab, 0x5f, 0xcd, 0xc4, 0x54, 0x4f, 0x95,
-	0x9e, 0x88, 0xae, 0x99, 0x77, 0xf2, 0xd8, 0xc1, 0x49, 0x11, 0xba, 0x05, 0x69, 0x4b, 0x76, 0x5e,
-	0x3d, 0x58, 0x37, 0x3a, 0x38, 0x6d, 0x79, 0xfa, 0xdf, 0xa6, 0x60, 0x69, 0xb6, 0x02, 0xf9, 0x7c,
-	0xde, 0x81, 0x62, 0x30, 0xd9, 0x0d, 0xa6, 0x41, 0x48, 0x47, 0xd1, 0xdb, 0x57, 0x2c, 0x40, 0x6d,
-	0x28, 0x12, 0x77, 0xc8, 0x7c, 0x27, 0xdc, 0x1f, 0xa9, 0x24, 0x6c, 0xfe, 0x29, 0x99, 0xb4, 0x59,
-	0x33, 0x22, 0x15, 0x3c, 0xd3, 0x8e, 0x8e, 0xbc, 0x8c, 0x70, 0x56, 0x1c, 0x79, 0xaf, 0x43, 0xd9,
-	0x25, 0x23, 0x71, 0x35, 0xc0, 0x73, 0x7b, 0xd1, 0x8f, 0x2c, 0x2e, 0x29, 0xd9, 0xc0, 0x19, 0x51,
-	0x5d, 0x87, 0x62, 0x6c, 0x0c, 0x5d, 0x83, 0x92, 0xd1, 0xea, 0x9b, 0xf7, 0xd7, 0x1f, 0x9a, 0x8f,
-	0x1a, 0xdb, 0xda, 0x82, 0xa2, 0x65, 0x7f, 0x91, 0x82, 0x25, 0xb5, 0x3f, 0x28, 0xaa, 0xfb, 0x06,
-	0x2c, 0xfa, 0x64, 0x2f, 0x8c, 0xc8, 0x78, 0x56, 0xc6, 0x28, 0xdf, 0x72, 0x39, 0x19, 0xe7, 0x55,
-	0xf3, 0xc9, 0x78, 0xe2, 0x35, 0x36, 0x73, 0xe9, 0x6b, 0x6c, 0xf6, 0xff, 0xe5, 0x35, 0x56, 0xff,
-	0xb3, 0x34, 0x5c, 0x53, 0xac, 0x29, 0xde, 0x8e, 0xde, 0x81, 0xa2, 0x24, 0x50, 0xb3, 0x54, 0x42,
-	0x3c, 0x00, 0x4a, 0x5c, 0xbb, 0x89, 0x0b, 0xb2, 0xba, 0x6d, 0xf3, 0xdc, 0x56, 0x41, 0x13, 0xbf,
-	0x2d, 0x00, 0x29, 0xea, 0xf0, 0xc4, 0xac, 0x09, 0xd9, 0x3d, 0xc7, 0xa5, 0x2a, 0xce, 0xe6, 0x5e,
-	0xfb, 0x9e, 0x6b, 0x5e, 0x3c, 0x50, 0x0c, 0x44, 0x76, 0xbc, 0xb9, 0x80, 0x85, 0x76, 0xe5, 0xb7,
-	0x01, 0x66, 0xd2, 0xb9, 0x09, 0x20, 0x27, 0x59, 0xea, 0x2e, 0x2d, 0x22, 0x59, 0xed, 0x26, 0xe6,
-	0x32, 0x5e, 0x35, 0x74, 0x6c, 0xb5, 0x01, 0x88, 0xaa, 0x47, 0xbc, 0x6a, 0xe8, 0xd8, 0xf1, 0x2b,
-	0x49, 0xf6, 0x8a, 0x57, 0x92, 0x7a, 0x21, 0xba, 0xd1, 0xd1, 0xb7, 0xe0, 0x56, 0xdd, 0x25, 0xd6,
-	0x81, 0xeb, 0x04, 0x21, 0xb5, 0x93, 0x2b, 0x74, 0x1d, 0xf2, 0x67, 0xf8, 0xcd, 0x65, 0x17, 0x68,
-	0x0a, 0xa9, 0xff, 0x5b, 0x0a, 0xca, 0x9b, 0x94, 0xb8, 0xe1, 0xfe, 0xec, 0x16, 0x22, 0xa4, 0x41,
-	0xa8, 0xb6, 0x6b, 0xf1, 0x8d, 0x3e, 0x80, 0x42, 0x7c, 0x28, 0x5f, 0xf9, 0x92, 0x11, 0x43, 0xd1,
-	0x03, 0x58, 0xe4, 0x31, 0xcd, 0x26, 0x11, 0xaf, 0xbe, 0xec, 0x92, 0x5c, 0x21, 0xf9, 0x16, 0xed,
-	0x53, 0x71, 0x0a, 0x8b, 0x41, 0xc9, 0xe1, 0xa8, 0x88, 0x7e, 0x05, 0xca, 0xe2, 0x8e, 0x37, 0x22,
-	0x1d, 0xb9, 0xab, 0x6c, 0x96, 0xe4, 0x33, 0x8d, 0x24, 0x1c, 0xff, 0x93, 0x82, 0x9b, 0xdb, 0x64,
-	0xba, 0x4b, 0xd5, 0x32, 0xa5, 0x36, 0xa6, 0x16, 0xf3, 0x6d, 0xd4, 0x4b, 0x2e, 0xef, 0x4b, 0x5e,
-	0x7d, 0xe6, 0x29, 0xcf, 0x5f, 0xe5, 0x11, 0xd7, 0x4f, 0x27, 0xb8, 0xfe, 0x4d, 0xc8, 0x79, 0xcc,
-	0xb3, 0xa8, 0x5a, 0xfb, 0xb2, 0xa0, 0x3b, 0xc9, 0xa5, 0x5d, 0x89, 0x1f, 0x64, 0xc4, 0x73, 0x4a,
-	0x87, 0x85, 0x71, 0x6b, 0xe8, 0x33, 0xa8, 0xf4, 0x5b, 0x0d, 0xdc, 0x1a, 0xd4, 0xbb, 0x3f, 0x35,
-	0xfb, 0xc6, 0x56, 0xdf, 0x58, 0xbf, 0x67, 0xf6, 0xba, 0x5b, 0x9f, 0xdf, 0x7f, 0x70, 0xef, 0x03,
-	0x2d, 0x55, 0xa9, 0x1e, 0x9f, 0x54, 0xef, 0x74, 0x8c, 0xc6, 0x96, 0x8c, 0xe5, 0x5d, 0xf6, 0xac,
-	0x4f, 0xdc, 0x80, 0xac, 0xdf, 0xeb, 0x31, 0x77, 0xca, 0x31, 0xfa, 0x49, 0x0a, 0xca, 0xc9, 0xdd,
-	0x3e, 0x79, 0x88, 0xa5, 0x2e, 0x3c, 0xc4, 0x66, 0x67, 0x61, 0xfa, 0x82, 0xb3, 0x70, 0x03, 0x6e,
-	0x5a, 0x3e, 0x0b, 0x02, 0x33, 0x70, 0x86, 0x1e, 0xb5, 0xcd, 0xc8, 0xa6, 0xe8, 0x67, 0xfd, 0x3b,
-	0xa7, 0x2f, 0xd6, 0xae, 0x37, 0x78, 0x7d, 0x5f, 0x54, 0x2b, 0xf3, 0xd7, 0xad, 0x84, 0x48, 0xb4,
-	0xf4, 0xee, 0x2f, 0x33, 0x50, 0x8c, 0xaf, 0x69, 0xf9, 0x92, 0xe1, 0x39, 0xb2, 0x1a, 0x8a, 0x58,
-	0xde, 0xa1, 0x47, 0xe8, 0xf5, 0x59, 0x76, 0xfc, 0x99, 0x7c, 0x97, 0x8a, 0xab, 0xa3, 0xcc, 0xf8,
-	0x4d, 0x28, 0x18, 0xfd, 0x7e, 0xfb, 0x51, 0xa7, 0xd5, 0xd4, 0xbe, 0x4c, 0x55, 0xbe, 0x73, 0x7c,
-	0x52, 0xbd, 0x1e, 0x83, 0x8c, 0x40, 0x7a, 0x2a, 0x50, 0x8d, 0x46, 0xab, 0x37, 0x68, 0x35, 0xb5,
-	0xe7, 0xe9, 0xf3, 0x28, 0x91, 0xed, 0x89, 0xd7, 0xe5, 0x62, 0x0f, 0xb7, 0x7a, 0x06, 0xe6, 0x0d,
-	0x7e, 0x99, 0x96, 0x49, 0xfb, 0xac, 0x45, 0x9f, 0x8e, 0x89, 0xcf, 0xdb, 0x5c, 0x8d, 0x7e, 0x65,
-	0xf1, 0x3c, 0x23, 0x5f, 0x20, 0x67, 0x77, 0xce, 0x94, 0xd8, 0x53, 0xde, 0x9a, 0xb8, 0xec, 0x17,
-	0x66, 0x32, 0xe7, 0x5a, 0xeb, 0xf3, 0x40, 0xe5, 0x56, 0x74, 0x58, 0xc4, 0x3b, 0x9d, 0x0e, 0x07,
-	0x3d, 0xcf, 0x9e, 0xeb, 0x1d, 0x9e, 0x78, 0x1e, 0xc7, 0xdc, 0x85, 0x42, 0xf4, 0x16, 0xa0, 0x7d,
-	0x99, 0x3d, 0xe7, 0x50, 0x23, 0x7a, 0xc8, 0x10, 0x0d, 0x6e, 0xee, 0x0c, 0xc4, 0x8f, 0x40, 0x9e,
-	0xe7, 0xce, 0x37, 0xb8, 0x3f, 0x09, 0x6d, 0x76, 0xe4, 0xf1, 0x09, 0x56, 0xf7, 0x03, 0x5f, 0xe6,
-	0x64, 0x32, 0x15, 0x63, 0xd4, 0xe5, 0xc0, 0x9b, 0x50, 0xc0, 0xad, 0x9f, 0xc8, 0xdf, 0x8b, 0x3c,
-	0xcf, 0x9f, 0xb3, 0x83, 0xe9, 0x17, 0xd4, 0x52, 0xad, 0x75, 0x71, 0x6f, 0xd3, 0x10, 0x43, 0x7e,
-	0x1e, 0xd5, 0xf5, 0xc7, 0xfb, 0xc4, 0xa3, 0xf6, 0xec, 0x19, 0x36, 0xae, 0x7a, 0xf7, 0xd7, 0xa0,
-	0x10, 0xd1, 0x06, 0xb4, 0x0a, 0xf9, 0xa7, 0x5d, 0xfc, 0xb8, 0x85, 0xb5, 0x05, 0x39, 0x86, 0x51,
-	0xcd, 0x53, 0x49, 0xdf, 0xaa, 0xb0, 0xb8, 0x6d, 0x74, 0x8c, 0x47, 0x2d, 0x1c, 0x5d, 0xdd, 0x45,
-	0x00, 0x75, 0xf6, 0x55, 0x34, 0xd5, 0x40, 0x6c, 0xb3, 0xbe, 0xf2, 0xd5, 0xd7, 0xab, 0x0b, 0xbf,
-	0xf8, 0x7a, 0x75, 0xe1, 0xf9, 0xe9, 0x6a, 0xea, 0xab, 0xd3, 0xd5, 0xd4, 0xcf, 0x4f, 0x57, 0x53,
-	0xff, 0x72, 0xba, 0x9a, 0xda, 0xcd, 0x8b, 0x1d, 0xe3, 0xc1, 0xff, 0x06, 0x00, 0x00, 0xff, 0xff,
-	0x55, 0x06, 0x85, 0xd6, 0xa6, 0x29, 0x00, 0x00,
+	// 4333 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xac, 0x5a, 0x4f, 0x6c, 0x24, 0xc7,
+	0x5a, 0xf7, 0xfc, 0xf5, 0xcc, 0x37, 0x63, 0xbb, 0xb7, 0xd6, 0xd9, 0x78, 0x27, 0x1b, 0x7b, 0xd2,
+	0xc9, 0xbe, 0xfc, 0x79, 0xd1, 0x64, 0xd7, 0xfb, 0x12, 0x6d, 0x12, 0x5e, 0x92, 0xf9, 0xe7, 0xf5,
+	0xbc, 0xb5, 0x67, 0x46, 0x35, 0xe3, 0xdd, 0x97, 0x03, 0xb4, 0xca, 0xdd, 0xe5, 0x71, 0xc7, 0x3d,
+	0x5d, 0x43, 0x77, 0x8f, 0xbd, 0x03, 0x42, 0xac, 0x38, 0x00, 0xf2, 0x89, 0x23, 0x12, 0xf2, 0x09,
+	0x4e, 0x1c, 0xb8, 0x70, 0x40, 0x70, 0x21, 0x48, 0x1c, 0x72, 0xe3, 0x01, 0x12, 0x7a, 0x02, 0xc9,
+	0x10, 0x23, 0x71, 0x43, 0x70, 0x79, 0xe2, 0x02, 0x12, 0xaa, 0x3f, 0xdd, 0xd3, 0xf6, 0x8e, 0xed,
+	0x0d, 0xe1, 0x62, 0x77, 0x7d, 0xf5, 0xfb, 0xbe, 0xaa, 0xfa, 0xea, 0xab, 0xaa, 0xdf, 0x57, 0x35,
+	0x50, 0x08, 0x26, 0x23, 0xea, 0x57, 0x46, 0x1e, 0x0b, 0x18, 0x42, 0x16, 0x33, 0x0f, 0xa8, 0x57,
+	0xf1, 0x8f, 0x88, 0x37, 0x3c, 0xb0, 0x83, 0xca, 0xe1, 0xfd, 0xd2, 0xda, 0x80, 0xb1, 0x81, 0x43,
+	0x3f, 0x10, 0x88, 0xdd, 0xf1, 0xde, 0x07, 0x81, 0x3d, 0xa4, 0x7e, 0x40, 0x86, 0x23, 0xa9, 0x54,
+	0x5a, 0xbd, 0x08, 0xb0, 0xc6, 0x1e, 0x09, 0x6c, 0xe6, 0xaa, 0xfa, 0xe5, 0x01, 0x1b, 0x30, 0xf1,
+	0xf9, 0x01, 0xff, 0x92, 0x52, 0x7d, 0x0d, 0xe6, 0x9f, 0x50, 0xcf, 0xb7, 0x99, 0x8b, 0x96, 0x21,
+	0x63, 0xbb, 0x16, 0x7d, 0xb6, 0x92, 0x28, 0x27, 0xde, 0x49, 0x63, 0x59, 0xd0, 0xef, 0x01, 0xb4,
+	0xf8, 0x47, 0xd3, 0x0d, 0xbc, 0x09, 0xd2, 0x20, 0x75, 0x40, 0x27, 0x02, 0x91, 0xc7, 0xfc, 0x93,
+	0x4b, 0x0e, 0x89, 0xb3, 0x92, 0x94, 0x92, 0x43, 0xe2, 0xe8, 0xdf, 0x26, 0xa0, 0x50, 0x75, 0x5d,
+	0x16, 0x88, 0xd6, 0x7d, 0x84, 0x20, 0xed, 0x92, 0x21, 0x55, 0x4a, 0xe2, 0x1b, 0xd5, 0x21, 0xeb,
+	0x90, 0x5d, 0xea, 0xf8, 0x2b, 0xc9, 0x72, 0xea, 0x9d, 0xc2, 0xfa, 0x0f, 0x2b, 0x2f, 0x0e, 0xb9,
+	0x12, 0x33, 0x52, 0xd9, 0x12, 0x68, 0xd1, 0x09, 0xac, 0x54, 0xd1, 0x67, 0x30, 0x6f, 0xbb, 0x96,
+	0x6d, 0x52, 0x7f, 0x25, 0x2d, 0xac, 0xac, 0xce, 0xb2, 0x32, 0xed, 0x7d, 0x2d, 0xfd, 0xcd, 0xe9,
+	0xda, 0x1c, 0x0e, 0x95, 0x4a, 0x1f, 0x43, 0x21, 0x66, 0x76, 0xc6, 0xd8, 0x96, 0x21, 0x73, 0x48,
+	0x9c, 0x31, 0x55, 0xa3, 0x93, 0x85, 0x4f, 0x92, 0x0f, 0x13, 0xfa, 0x97, 0x90, 0xc7, 0xd4, 0x67,
+	0x63, 0xcf, 0xa4, 0x3e, 0x7a, 0x17, 0xf2, 0x2e, 0x71, 0x99, 0x61, 0x8e, 0xc6, 0xbe, 0x50, 0x4f,
+	0xd5, 0x8a, 0x67, 0xa7, 0x6b, 0xb9, 0x36, 0x71, 0x59, 0xbd, 0xbb, 0xe3, 0xe3, 0x1c, 0xaf, 0xae,
+	0x8f, 0xc6, 0x3e, 0x7a, 0x03, 0x8a, 0x43, 0x3a, 0x64, 0xde, 0xc4, 0xd8, 0x9d, 0x04, 0xd4, 0x17,
+	0x86, 0x53, 0xb8, 0x20, 0x65, 0x35, 0x2e, 0xd2, 0x7f, 0x2f, 0x01, 0xcb, 0xa1, 0x6d, 0x4c, 0x7f,
+	0x75, 0x6c, 0x7b, 0x74, 0x48, 0xdd, 0xc0, 0x47, 0x1f, 0x42, 0xd6, 0xb1, 0x87, 0x76, 0x20, 0xdb,
+	0x28, 0xac, 0xbf, 0x3e, 0x6b, 0xb4, 0x51, 0xaf, 0xb0, 0x02, 0xa3, 0x2a, 0x14, 0x3d, 0xea, 0x53,
+	0xef, 0x50, 0x7a, 0x52, 0x34, 0x79, 0xad, 0xf2, 0x39, 0x15, 0x7d, 0x03, 0x72, 0x5d, 0x87, 0x04,
+	0x7b, 0xcc, 0x1b, 0x22, 0x1d, 0x8a, 0xc4, 0x33, 0xf7, 0xed, 0x80, 0x9a, 0xc1, 0xd8, 0x0b, 0x67,
+	0xf5, 0x9c, 0x0c, 0xdd, 0x82, 0x24, 0x93, 0x0d, 0xe5, 0x6b, 0xd9, 0xb3, 0xd3, 0xb5, 0x64, 0xa7,
+	0x87, 0x93, 0xcc, 0xd7, 0x3f, 0x85, 0x1b, 0x5d, 0x67, 0x3c, 0xb0, 0xdd, 0x06, 0xf5, 0x4d, 0xcf,
+	0x1e, 0x71, 0xeb, 0x3c, 0x3c, 0x78, 0xec, 0x87, 0xe1, 0xc1, 0xbf, 0xa3, 0x90, 0x49, 0x4e, 0x43,
+	0x46, 0xff, 0x9d, 0x24, 0xdc, 0x68, 0xba, 0x03, 0xdb, 0xa5, 0x71, 0xed, 0xbb, 0xb0, 0x48, 0x85,
+	0xd0, 0x38, 0x94, 0x61, 0xac, 0xec, 0x2c, 0x48, 0x69, 0x18, 0xdb, 0xad, 0x0b, 0xf1, 0x76, 0x7f,
+	0xd6, 0xf0, 0x5f, 0xb0, 0x3e, 0x33, 0xea, 0x9a, 0x30, 0x3f, 0x12, 0x83, 0xf0, 0x57, 0x52, 0xc2,
+	0xd6, 0xdd, 0x59, 0xb6, 0x5e, 0x18, 0x67, 0x18, 0x7c, 0x4a, 0xf7, 0xfb, 0x04, 0xdf, 0xbf, 0x26,
+	0x60, 0xa9, 0xcd, 0xac, 0x73, 0x7e, 0x28, 0x41, 0x6e, 0x9f, 0xf9, 0x41, 0x6c, 0xa1, 0x45, 0x65,
+	0xf4, 0x10, 0x72, 0x23, 0x35, 0x7d, 0x6a, 0xf6, 0xef, 0xcc, 0xee, 0xb2, 0xc4, 0xe0, 0x08, 0x8d,
+	0x3e, 0x85, 0xbc, 0x17, 0xc6, 0xc4, 0x4a, 0xea, 0x65, 0x02, 0x67, 0x8a, 0x47, 0x3f, 0x86, 0xac,
+	0x9c, 0x84, 0x95, 0xb4, 0xd0, 0xbc, 0xfb, 0x52, 0x3e, 0xc7, 0x4a, 0x49, 0xff, 0x79, 0x02, 0x34,
+	0x4c, 0xf6, 0x82, 0x6d, 0x3a, 0xdc, 0xa5, 0x5e, 0x2f, 0x20, 0xc1, 0xd8, 0x47, 0xb7, 0x20, 0xeb,
+	0x50, 0x62, 0x51, 0x4f, 0x0c, 0x32, 0x87, 0x55, 0x09, 0xed, 0xf0, 0x20, 0x27, 0xe6, 0x3e, 0xd9,
+	0xb5, 0x1d, 0x3b, 0x98, 0x88, 0x61, 0x2e, 0xce, 0x9e, 0xe5, 0x8b, 0x36, 0x2b, 0x38, 0xa6, 0x88,
+	0xcf, 0x99, 0x41, 0x2b, 0x30, 0x3f, 0xa4, 0xbe, 0x4f, 0x06, 0x54, 0x8c, 0x3e, 0x8f, 0xc3, 0xa2,
+	0xfe, 0x29, 0x14, 0xe3, 0x7a, 0xa8, 0x00, 0xf3, 0x3b, 0xed, 0xc7, 0xed, 0xce, 0xd3, 0xb6, 0x36,
+	0x87, 0x96, 0xa0, 0xb0, 0xd3, 0xc6, 0xcd, 0x6a, 0x7d, 0xb3, 0x5a, 0xdb, 0x6a, 0x6a, 0x09, 0xb4,
+	0x00, 0xf9, 0x69, 0x31, 0xa9, 0xff, 0x69, 0x02, 0x80, 0x4f, 0xa0, 0x1a, 0xd4, 0x27, 0x90, 0xf1,
+	0x03, 0x12, 0xc8, 0x89, 0x5b, 0x5c, 0x7f, 0x6b, 0x56, 0xaf, 0xa7, 0xf0, 0x0a, 0xff, 0x47, 0xb1,
+	0x54, 0x89, 0xf7, 0x30, 0x79, 0xae, 0x87, 0x7c, 0x0d, 0x11, 0xcb, 0xf2, 0x54, 0xc7, 0xc5, 0xb7,
+	0xfe, 0x29, 0x64, 0x84, 0xf6, 0xf9, 0xee, 0xe6, 0x20, 0xdd, 0xe0, 0x5f, 0x09, 0x94, 0x87, 0x0c,
+	0x6e, 0x56, 0x1b, 0x5f, 0x6a, 0x49, 0xa4, 0x41, 0xb1, 0xd1, 0xea, 0xd5, 0x3b, 0xed, 0x76, 0xb3,
+	0xde, 0x6f, 0x36, 0xb4, 0x94, 0x7e, 0x17, 0x32, 0xad, 0x21, 0xb7, 0x7c, 0x87, 0x47, 0xc5, 0x1e,
+	0xf5, 0xa8, 0x6b, 0x86, 0xc1, 0x36, 0x15, 0xe8, 0x3f, 0xcb, 0x43, 0x66, 0x9b, 0x8d, 0xdd, 0x00,
+	0xad, 0xc7, 0x56, 0xf6, 0xe2, 0xec, 0xcd, 0x59, 0x00, 0x2b, 0xfd, 0xc9, 0x88, 0xaa, 0x95, 0x7f,
+	0x0b, 0xb2, 0x32, 0x7e, 0xd4, 0x70, 0x54, 0x89, 0xcb, 0x03, 0xe2, 0x0d, 0x68, 0xa0, 0xc6, 0xa3,
+	0x4a, 0xe8, 0x1d, 0xc8, 0x79, 0x94, 0x58, 0xcc, 0x75, 0x26, 0x22, 0xcc, 0x72, 0x72, 0xeb, 0xc5,
+	0x94, 0x58, 0x1d, 0xd7, 0x99, 0xe0, 0xa8, 0x16, 0x6d, 0x42, 0x71, 0xd7, 0x76, 0x2d, 0x83, 0x8d,
+	0xe4, 0x3e, 0x98, 0xb9, 0x3c, 0x28, 0x65, 0xaf, 0x6a, 0xb6, 0x6b, 0x75, 0x24, 0x18, 0x17, 0x76,
+	0xa7, 0x05, 0xd4, 0x86, 0xc5, 0x43, 0xe6, 0x8c, 0x87, 0x34, 0xb2, 0x95, 0x15, 0xb6, 0xde, 0xbe,
+	0xdc, 0xd6, 0x13, 0x81, 0x0f, 0xad, 0x2d, 0x1c, 0xc6, 0x8b, 0xe8, 0x31, 0x2c, 0x04, 0xc3, 0xd1,
+	0x9e, 0x1f, 0x99, 0x9b, 0x17, 0xe6, 0x7e, 0x70, 0x85, 0xc3, 0x38, 0x3c, 0xb4, 0x56, 0x0c, 0x62,
+	0xa5, 0xd2, 0x6f, 0xa5, 0xa0, 0x10, 0xeb, 0x39, 0xea, 0x41, 0x61, 0xe4, 0xb1, 0x11, 0x19, 0x88,
+	0xbd, 0x5c, 0xcd, 0xc5, 0xfd, 0x97, 0x1a, 0x75, 0xa5, 0x3b, 0x55, 0xc4, 0x71, 0x2b, 0xfa, 0x49,
+	0x12, 0x0a, 0xb1, 0x4a, 0xf4, 0x1e, 0xe4, 0x70, 0x17, 0xb7, 0x9e, 0x54, 0xfb, 0x4d, 0x6d, 0xae,
+	0x74, 0xe7, 0xf8, 0xa4, 0xbc, 0x22, 0xac, 0xc5, 0x0d, 0x74, 0x3d, 0xfb, 0x90, 0x87, 0xde, 0x3b,
+	0x30, 0x1f, 0x42, 0x13, 0xa5, 0xd7, 0x8e, 0x4f, 0xca, 0xaf, 0x5e, 0x84, 0xc6, 0x90, 0xb8, 0xb7,
+	0x59, 0xc5, 0xcd, 0x86, 0x96, 0x9c, 0x8d, 0xc4, 0xbd, 0x7d, 0xe2, 0x51, 0x0b, 0xfd, 0x00, 0xb2,
+	0x0a, 0x98, 0x2a, 0x95, 0x8e, 0x4f, 0xca, 0xb7, 0x2e, 0x02, 0xa7, 0x38, 0xdc, 0xdb, 0xaa, 0x3e,
+	0x69, 0x6a, 0xe9, 0xd9, 0x38, 0xdc, 0x73, 0xc8, 0x21, 0x45, 0x6f, 0x41, 0x46, 0xc2, 0x32, 0xa5,
+	0xdb, 0xc7, 0x27, 0xe5, 0x57, 0x5e, 0x30, 0xc7, 0x51, 0xa5, 0x95, 0xdf, 0xfd, 0xc3, 0xd5, 0xb9,
+	0xbf, 0xf8, 0xa3, 0x55, 0xed, 0x62, 0x75, 0xe9, 0xbf, 0x13, 0xb0, 0x70, 0x6e, 0xca, 0x91, 0x0e,
+	0x59, 0x97, 0x99, 0x6c, 0x24, 0xb7, 0xf8, 0x5c, 0x0d, 0xce, 0x4e, 0xd7, 0xb2, 0x6d, 0x56, 0x67,
+	0xa3, 0x09, 0x56, 0x35, 0xe8, 0xf1, 0x85, 0x43, 0xea, 0xc1, 0x4b, 0xc6, 0xd3, 0xcc, 0x63, 0xea,
+	0x73, 0x58, 0xb0, 0x3c, 0xfb, 0x90, 0x7a, 0x86, 0xc9, 0xdc, 0x3d, 0x7b, 0xa0, 0xb6, 0xef, 0xd2,
+	0x2c, 0x9b, 0x0d, 0x01, 0xc4, 0x45, 0xa9, 0x50, 0x17, 0xf8, 0xef, 0x71, 0x40, 0x95, 0x9e, 0x40,
+	0x31, 0x1e, 0xa1, 0xe8, 0x75, 0x00, 0xdf, 0xfe, 0x35, 0xaa, 0x38, 0x8f, 0x60, 0x48, 0x38, 0xcf,
+	0x25, 0x82, 0xf1, 0xa0, 0xb7, 0x21, 0x3d, 0x64, 0x96, 0xb4, 0xb3, 0x50, 0xbb, 0xc9, 0xcf, 0xc9,
+	0x7f, 0x3c, 0x5d, 0x2b, 0x30, 0xbf, 0xb2, 0x61, 0x3b, 0x74, 0x9b, 0x59, 0x14, 0x0b, 0x80, 0x7e,
+	0x08, 0x69, 0xbe, 0x55, 0xa0, 0xd7, 0x20, 0x5d, 0x6b, 0xb5, 0x1b, 0xda, 0x5c, 0xe9, 0xc6, 0xf1,
+	0x49, 0x79, 0x41, 0xb8, 0x84, 0x57, 0xf0, 0xd8, 0x45, 0x6b, 0x90, 0x7d, 0xd2, 0xd9, 0xda, 0xd9,
+	0xe6, 0xe1, 0x75, 0xf3, 0xf8, 0xa4, 0xbc, 0x14, 0x55, 0x4b, 0xa7, 0xa1, 0xd7, 0x21, 0xd3, 0xdf,
+	0xee, 0x6e, 0xf4, 0xb4, 0x64, 0x09, 0x1d, 0x9f, 0x94, 0x17, 0xa3, 0x7a, 0xd1, 0xe7, 0xd2, 0x0d,
+	0x35, 0xab, 0xf9, 0x48, 0xae, 0xff, 0x22, 0x09, 0x0b, 0x98, 0x93, 0x6d, 0x2f, 0xe8, 0x32, 0xc7,
+	0x36, 0x27, 0xa8, 0x0b, 0x79, 0x93, 0xb9, 0x96, 0x1d, 0x5b, 0x53, 0xeb, 0x97, 0x1c, 0x8c, 0x53,
+	0xad, 0xb0, 0x54, 0x0f, 0x35, 0xf1, 0xd4, 0x08, 0xfa, 0x00, 0x32, 0x16, 0x75, 0xc8, 0x44, 0x9d,
+	0xd0, 0xb7, 0x2b, 0x92, 0xce, 0x57, 0x42, 0x3a, 0x5f, 0x69, 0x28, 0x3a, 0x8f, 0x25, 0x4e, 0x50,
+	0x49, 0xf2, 0xcc, 0x20, 0x41, 0x40, 0x87, 0xa3, 0x40, 0x1e, 0xcf, 0x69, 0x5c, 0x18, 0x92, 0x67,
+	0x55, 0x25, 0x42, 0xf7, 0x21, 0x7b, 0x64, 0xbb, 0x16, 0x3b, 0x52, 0x27, 0xf0, 0x15, 0x46, 0x15,
+	0x50, 0x3f, 0xe6, 0xa7, 0xee, 0x85, 0x6e, 0x72, 0x7f, 0xb7, 0x3b, 0xed, 0x66, 0xe8, 0x6f, 0x55,
+	0xdf, 0x71, 0xdb, 0xcc, 0xe5, 0x6b, 0x05, 0x3a, 0x6d, 0x63, 0xa3, 0xda, 0xda, 0xda, 0xc1, 0xdc,
+	0xe7, 0xcb, 0xc7, 0x27, 0x65, 0x2d, 0x82, 0x6c, 0x10, 0xdb, 0xe1, 0x94, 0xf0, 0x36, 0xa4, 0xaa,
+	0xed, 0x2f, 0xb5, 0x64, 0x49, 0x3b, 0x3e, 0x29, 0x17, 0xa3, 0xea, 0xaa, 0x3b, 0x99, 0x2e, 0xa3,
+	0x8b, 0xed, 0xea, 0x7f, 0x93, 0x82, 0xe2, 0xce, 0xc8, 0x22, 0x01, 0x95, 0x31, 0x89, 0xca, 0x50,
+	0x18, 0x11, 0x8f, 0x38, 0x0e, 0x75, 0x6c, 0x7f, 0xa8, 0x12, 0x95, 0xb8, 0x08, 0x7d, 0xfc, 0xb2,
+	0x6e, 0xac, 0xe5, 0x78, 0x9c, 0xfd, 0xfe, 0x3f, 0xaf, 0x25, 0x42, 0x87, 0xee, 0xc0, 0xe2, 0x9e,
+	0xec, 0xad, 0x41, 0x4c, 0x31, 0xb1, 0x29, 0x31, 0xb1, 0x95, 0x59, 0x13, 0x1b, 0xef, 0x56, 0x45,
+	0x0d, 0xb2, 0x2a, 0xb4, 0xf0, 0xc2, 0x5e, 0xbc, 0x88, 0x1e, 0xc0, 0xfc, 0x90, 0xb9, 0x76, 0xc0,
+	0xbc, 0xeb, 0x67, 0x21, 0x44, 0xa2, 0xf7, 0xe0, 0x06, 0x9f, 0xdc, 0xb0, 0x3f, 0xa2, 0x5a, 0x9c,
+	0x58, 0x49, 0xbc, 0x34, 0x24, 0xcf, 0x54, 0x83, 0x98, 0x8b, 0x51, 0x0d, 0x32, 0xcc, 0xe3, 0x94,
+	0x28, 0x2b, 0xba, 0xfb, 0xfe, 0xb5, 0xdd, 0x95, 0x85, 0x0e, 0xd7, 0xc1, 0x52, 0x55, 0xff, 0x08,
+	0x16, 0xce, 0x0d, 0x82, 0x33, 0x81, 0x6e, 0x75, 0xa7, 0xd7, 0xd4, 0xe6, 0x50, 0x11, 0x72, 0xf5,
+	0x4e, 0xbb, 0xdf, 0x6a, 0xef, 0x70, 0x2a, 0x53, 0x84, 0x1c, 0xee, 0x6c, 0x6d, 0xd5, 0xaa, 0xf5,
+	0xc7, 0x5a, 0x52, 0xaf, 0x40, 0x21, 0x66, 0x0d, 0x2d, 0x02, 0xf4, 0xfa, 0x9d, 0xae, 0xb1, 0xd1,
+	0xc2, 0xbd, 0xbe, 0x24, 0x42, 0xbd, 0x7e, 0x15, 0xf7, 0x95, 0x20, 0xa1, 0xff, 0x47, 0x32, 0x9c,
+	0x51, 0xc5, 0x7d, 0x6a, 0xe7, 0xb9, 0xcf, 0x15, 0x9d, 0x57, 0xec, 0x67, 0x5a, 0x88, 0x38, 0xd0,
+	0xc7, 0x00, 0x22, 0x70, 0xa8, 0x65, 0x90, 0x40, 0x4d, 0x7c, 0xe9, 0x05, 0x27, 0xf7, 0xc3, 0x7c,
+	0x19, 0xe7, 0x15, 0xba, 0x1a, 0xa0, 0x1f, 0x43, 0xd1, 0x64, 0xc3, 0x91, 0x43, 0x95, 0x72, 0xea,
+	0x5a, 0xe5, 0x42, 0x84, 0xaf, 0x06, 0x71, 0xf6, 0x95, 0x3e, 0xcf, 0x0f, 0x7f, 0x3b, 0x11, 0x7a,
+	0x66, 0x06, 0xe1, 0x2a, 0x42, 0x6e, 0xa7, 0xdb, 0xa8, 0xf6, 0x5b, 0xed, 0x47, 0x5a, 0x02, 0x01,
+	0x64, 0x85, 0xab, 0x1b, 0x5a, 0x92, 0x13, 0xc5, 0x7a, 0x67, 0xbb, 0xbb, 0xd5, 0x14, 0x94, 0x0b,
+	0x2d, 0x83, 0x16, 0x3a, 0xdb, 0x10, 0x8e, 0x6c, 0x36, 0xb4, 0x34, 0xba, 0x09, 0x4b, 0x91, 0x54,
+	0x69, 0x66, 0xd0, 0x2d, 0x40, 0x91, 0x70, 0x6a, 0x22, 0xab, 0xff, 0x06, 0x2c, 0xd5, 0x99, 0x1b,
+	0x10, 0xdb, 0x8d, 0x48, 0xf4, 0x3a, 0x1f, 0xb4, 0x12, 0x19, 0xb6, 0x25, 0xf7, 0xf4, 0xda, 0xd2,
+	0xd9, 0xe9, 0x5a, 0x21, 0x82, 0xb6, 0x1a, 0x7c, 0xa4, 0x61, 0xc1, 0xe2, 0xeb, 0x77, 0x64, 0x5b,
+	0xc2, 0xb9, 0x99, 0xda, 0xfc, 0xd9, 0xe9, 0x5a, 0xaa, 0xdb, 0x6a, 0x60, 0x2e, 0x43, 0xaf, 0x41,
+	0x9e, 0x3e, 0xb3, 0x03, 0xc3, 0xe4, 0x7b, 0x38, 0x77, 0x60, 0x06, 0xe7, 0xb8, 0xa0, 0xce, 0xb7,
+	0xec, 0x1a, 0x40, 0x97, 0x79, 0x81, 0x6a, 0xf9, 0x47, 0x90, 0x19, 0x31, 0x4f, 0x64, 0xb0, 0x97,
+	0xe6, 0xeb, 0x1c, 0x2e, 0x03, 0x15, 0x4b, 0xb0, 0xfe, 0x97, 0x49, 0x80, 0x3e, 0xf1, 0x0f, 0x94,
+	0x91, 0x87, 0x90, 0x8f, 0xee, 0x3e, 0x54, 0x2a, 0x7c, 0xe5, 0x6c, 0x47, 0x60, 0xf4, 0x20, 0x0c,
+	0x36, 0x99, 0x1e, 0xcc, 0x4c, 0x65, 0xc2, 0x86, 0x66, 0x31, 0xec, 0xf3, 0x39, 0x00, 0x3f, 0x12,
+	0xa9, 0xe7, 0xa9, 0x99, 0xe7, 0x9f, 0xa8, 0x2e, 0x8e, 0x05, 0xe9, 0x34, 0x45, 0x30, 0xdf, 0x9c,
+	0xd5, 0xc8, 0x85, 0x19, 0xd9, 0x9c, 0xc3, 0x53, 0x3d, 0xf4, 0x39, 0x14, 0xf8, 0xb8, 0x0d, 0x5f,
+	0xd4, 0x29, 0x6e, 0x79, 0xa9, 0xab, 0xa4, 0x05, 0x0c, 0xa3, 0xe8, 0xbb, 0xa6, 0xc1, 0xa2, 0x37,
+	0x76, 0xf9, 0xb0, 0x95, 0x0d, 0xdd, 0x86, 0x57, 0xdb, 0x34, 0x38, 0x62, 0xde, 0x41, 0x35, 0x08,
+	0x88, 0xb9, 0x3f, 0xa4, 0xae, 0xf2, 0x71, 0x8c, 0x58, 0x27, 0xce, 0x11, 0xeb, 0x15, 0x98, 0x27,
+	0x8e, 0x4d, 0x7c, 0x2a, 0xd9, 0x48, 0x1e, 0x87, 0x45, 0x4e, 0xff, 0x79, 0x32, 0x41, 0x7d, 0x9f,
+	0xca, 0x14, 0x38, 0x8f, 0xa7, 0x02, 0xfd, 0xef, 0x93, 0x00, 0xad, 0x6e, 0x75, 0x5b, 0x99, 0x6f,
+	0x40, 0x76, 0x8f, 0x0c, 0x6d, 0x67, 0x72, 0xd5, 0x02, 0x9f, 0xe2, 0x2b, 0x55, 0x69, 0x68, 0x43,
+	0xe8, 0x60, 0xa5, 0x2b, 0xb2, 0x82, 0xf1, 0xae, 0x4b, 0x83, 0x28, 0x2b, 0x10, 0x25, 0x4e, 0x41,
+	0x3c, 0xe2, 0x46, 0x33, 0x23, 0x0b, 0xbc, 0xeb, 0x03, 0x12, 0xd0, 0x23, 0x32, 0x09, 0x57, 0xa5,
+	0x2a, 0xa2, 0x4d, 0x9e, 0x2d, 0xf8, 0xd4, 0x3b, 0xa4, 0xd6, 0x4a, 0x46, 0x84, 0xe0, 0x75, 0xfd,
+	0xc1, 0x0a, 0x2e, 0xc9, 0x55, 0xa4, 0x5d, 0xfa, 0x54, 0x30, 0x82, 0x69, 0xd5, 0x77, 0x4a, 0xe0,
+	0xef, 0xc1, 0xc2, 0xb9, 0x71, 0xbe, 0x90, 0x8e, 0xb5, 0xba, 0x4f, 0x7e, 0xa4, 0xa5, 0xd5, 0xd7,
+	0x47, 0x5a, 0x56, 0xff, 0xe3, 0x94, 0x5c, 0x47, 0xca, 0xab, 0xb3, 0xaf, 0xd4, 0x72, 0x22, 0xfa,
+	0x4d, 0xe6, 0xa8, 0xf8, 0x7e, 0xfb, 0xea, 0xe5, 0xc5, 0xe9, 0xbd, 0x80, 0xe3, 0x48, 0x11, 0xad,
+	0x41, 0x41, 0xce, 0xbf, 0xc1, 0xe3, 0x49, 0xb8, 0x75, 0x01, 0x83, 0x14, 0x71, 0x4d, 0x74, 0x17,
+	0x16, 0x47, 0xe3, 0x5d, 0xc7, 0xf6, 0xf7, 0xa9, 0x25, 0x31, 0x69, 0x81, 0x59, 0x88, 0xa4, 0x02,
+	0xb6, 0x0d, 0x45, 0x25, 0x30, 0x04, 0xb5, 0xcb, 0x88, 0x0e, 0xbd, 0x77, 0x5d, 0x87, 0xa4, 0x8a,
+	0x60, 0x7c, 0x85, 0xd1, 0xb4, 0xa0, 0x37, 0x20, 0x17, 0x76, 0x16, 0xad, 0x40, 0xaa, 0x5f, 0xef,
+	0x6a, 0x73, 0xa5, 0xa5, 0xe3, 0x93, 0x72, 0x21, 0x14, 0xf7, 0xeb, 0x5d, 0x5e, 0xb3, 0xd3, 0xe8,
+	0x6a, 0x89, 0xf3, 0x35, 0x3b, 0x8d, 0x6e, 0x29, 0xcd, 0x29, 0x86, 0xbe, 0x07, 0x85, 0x58, 0x0b,
+	0xe8, 0x4d, 0x98, 0x6f, 0xb5, 0x1f, 0xe1, 0x66, 0xaf, 0xa7, 0xcd, 0x95, 0x6e, 0x1d, 0x9f, 0x94,
+	0x51, 0xac, 0xb6, 0xe5, 0x0e, 0xf8, 0xfc, 0xa0, 0xd7, 0x21, 0xbd, 0xd9, 0xe1, 0x47, 0x97, 0xe4,
+	0x92, 0x31, 0xc4, 0x26, 0xf3, 0x83, 0xd2, 0x4d, 0xc5, 0x5d, 0xe2, 0x86, 0xf5, 0x3f, 0x48, 0x40,
+	0x56, 0x52, 0xea, 0x99, 0x13, 0x55, 0x85, 0xf9, 0x30, 0xd1, 0x93, 0x3c, 0xff, 0xed, 0xcb, 0x39,
+	0x79, 0x45, 0x51, 0x68, 0x19, 0x7e, 0xa1, 0x5e, 0xe9, 0x13, 0x28, 0xc6, 0x2b, 0xbe, 0x53, 0xf0,
+	0xfd, 0x3a, 0x14, 0x78, 0x7c, 0x87, 0xdc, 0x7c, 0x1d, 0xb2, 0x92, 0xf6, 0x47, 0x5b, 0xe9, 0xe5,
+	0x09, 0x82, 0x42, 0xa2, 0x87, 0x30, 0x2f, 0x93, 0x8a, 0xf0, 0x0a, 0x6c, 0xf5, 0xea, 0x55, 0x84,
+	0x43, 0xb8, 0xfe, 0x39, 0xa4, 0xbb, 0x94, 0x7a, 0xdc, 0xf7, 0x2e, 0xb3, 0xe8, 0xf4, 0xf4, 0x51,
+	0xf9, 0x90, 0x45, 0x5b, 0x0d, 0x9e, 0x0f, 0x59, 0xb4, 0x65, 0x45, 0x37, 0x18, 0xc9, 0xd8, 0x0d,
+	0x46, 0x1f, 0x8a, 0x4f, 0xa9, 0x3d, 0xd8, 0x0f, 0xa8, 0x25, 0x0c, 0xbd, 0x0f, 0xe9, 0x11, 0x8d,
+	0x3a, 0xbf, 0x32, 0x33, 0xc0, 0x28, 0xf5, 0xb0, 0x40, 0xf1, 0x7d, 0xe4, 0x48, 0x68, 0xab, 0x8b,
+	0x57, 0x55, 0xd2, 0xff, 0x2e, 0x09, 0x8b, 0x2d, 0xdf, 0x1f, 0x13, 0xd7, 0x0c, 0x89, 0xc9, 0x67,
+	0xe7, 0x89, 0xc9, 0x3b, 0x33, 0x47, 0x78, 0x4e, 0xe5, 0xfc, 0xc5, 0x8c, 0x3a, 0x1c, 0x92, 0xd1,
+	0xe1, 0xa0, 0xff, 0x7b, 0x22, 0xbc, 0x7d, 0xb9, 0x1b, 0x5b, 0xee, 0xa5, 0x95, 0xe3, 0x93, 0xf2,
+	0x72, 0xdc, 0x12, 0xdd, 0x71, 0x0f, 0x5c, 0x76, 0xe4, 0xa2, 0x37, 0x20, 0x83, 0x9b, 0xed, 0xe6,
+	0x53, 0x2d, 0x21, 0xc3, 0xf3, 0x1c, 0x08, 0x53, 0x97, 0x1e, 0x71, 0x4b, 0xdd, 0x66, 0xbb, 0xc1,
+	0x89, 0x44, 0x72, 0x86, 0xa5, 0x2e, 0x75, 0x2d, 0xdb, 0x1d, 0xa0, 0x37, 0x21, 0xdb, 0xea, 0xf5,
+	0x76, 0x44, 0x7e, 0xfc, 0xea, 0xf1, 0x49, 0xf9, 0xe6, 0x39, 0x14, 0x2f, 0x50, 0x8b, 0x83, 0x38,
+	0x8b, 0xe7, 0x14, 0x63, 0x06, 0x88, 0xd3, 0x43, 0x09, 0xc2, 0x9d, 0x3e, 0x4f, 0xde, 0x33, 0x33,
+	0x40, 0x98, 0xf1, 0xbf, 0x6a, 0xb9, 0xfd, 0x53, 0x12, 0xb4, 0xaa, 0x69, 0xd2, 0x51, 0xc0, 0xeb,
+	0x55, 0xe2, 0xd4, 0x87, 0xdc, 0x88, 0x7f, 0xd9, 0x34, 0x24, 0x01, 0x0f, 0x67, 0x5e, 0xfd, 0x5f,
+	0xd0, 0xab, 0x60, 0xe6, 0xd0, 0xaa, 0x35, 0xb4, 0x7d, 0xdf, 0x66, 0xae, 0x94, 0xe1, 0xc8, 0x52,
+	0xe9, 0x3f, 0x13, 0x70, 0x73, 0x06, 0x02, 0xdd, 0x83, 0xb4, 0xc7, 0x9c, 0x70, 0x0e, 0xef, 0x5c,
+	0x76, 0xb1, 0xc6, 0x55, 0xb1, 0x40, 0xa2, 0x55, 0x00, 0x32, 0x0e, 0x18, 0x11, 0xed, 0x8b, 0xd9,
+	0xcb, 0xe1, 0x98, 0x04, 0x3d, 0x85, 0xac, 0x4f, 0x4d, 0x8f, 0x86, 0x54, 0xf1, 0xf3, 0xff, 0x6b,
+	0xef, 0x2b, 0x3d, 0x61, 0x06, 0x2b, 0x73, 0xa5, 0x0a, 0x64, 0xa5, 0x84, 0x87, 0xbd, 0x45, 0x02,
+	0x22, 0x3a, 0x5d, 0xc4, 0xe2, 0x9b, 0x47, 0x13, 0x71, 0x06, 0x61, 0x34, 0x11, 0x67, 0xa0, 0xff,
+	0x75, 0x12, 0xa0, 0xf9, 0x2c, 0xa0, 0x9e, 0x4b, 0x9c, 0x7a, 0x15, 0x35, 0x63, 0xbb, 0xbf, 0x1c,
+	0xed, 0xbb, 0x33, 0xaf, 0x5b, 0x23, 0x8d, 0x4a, 0xbd, 0x3a, 0x63, 0xff, 0xbf, 0x0d, 0xa9, 0xb1,
+	0xa7, 0x5e, 0x73, 0x24, 0xcd, 0xdb, 0xc1, 0x5b, 0x98, 0xcb, 0x50, 0x73, 0xba, 0x6d, 0xa5, 0x2e,
+	0x7f, 0xb3, 0x89, 0x35, 0x30, 0x73, 0xeb, 0xe2, 0x2b, 0xdf, 0x24, 0x86, 0x49, 0xd5, 0xc9, 0x51,
+	0x94, 0x2b, 0xbf, 0x5e, 0xad, 0x53, 0x2f, 0xc0, 0x59, 0x93, 0xf0, 0xff, 0xdf, 0x6b, 0x7f, 0x7b,
+	0x1f, 0x60, 0x3a, 0x34, 0xb4, 0x0a, 0x99, 0xfa, 0x46, 0xaf, 0xb7, 0xa5, 0xcd, 0xc9, 0x0d, 0x7c,
+	0x5a, 0x25, 0xc4, 0xfa, 0x9f, 0x27, 0x21, 0x57, 0xaf, 0xaa, 0x63, 0xb5, 0x0e, 0x9a, 0xd8, 0x95,
+	0x78, 0xef, 0x0c, 0xfa, 0x6c, 0x64, 0x7b, 0x13, 0xb5, 0xb1, 0x5c, 0x91, 0xb3, 0x2d, 0x72, 0x15,
+	0xde, 0xeb, 0xa6, 0x50, 0x40, 0x18, 0x8a, 0x54, 0x39, 0xc1, 0x30, 0x49, 0xb8, 0xc7, 0xaf, 0x5e,
+	0xed, 0x2c, 0xc9, 0xbe, 0xa7, 0x65, 0x1f, 0x17, 0x42, 0x23, 0x75, 0xe2, 0xa3, 0x8f, 0x61, 0xc9,
+	0xb7, 0x07, 0xae, 0xed, 0x0e, 0x8c, 0xd0, 0x79, 0x29, 0xe1, 0xbc, 0x1b, 0x67, 0xa7, 0x6b, 0x0b,
+	0x3d, 0x59, 0xa5, 0x7c, 0xb8, 0xa0, 0x90, 0x75, 0xe1, 0x4a, 0xf4, 0x11, 0x2c, 0xc6, 0x54, 0xb9,
+	0x17, 0xa5, 0xdb, 0xb5, 0xb3, 0xd3, 0xb5, 0x62, 0xa4, 0xf9, 0x98, 0x4e, 0x70, 0x31, 0x52, 0x7c,
+	0x4c, 0xc5, 0xf5, 0xc2, 0x1e, 0xf3, 0x4c, 0x6a, 0x78, 0x62, 0x4d, 0x8b, 0x13, 0x3c, 0x8d, 0x0b,
+	0x42, 0x26, 0x97, 0xb9, 0xfe, 0x04, 0x6e, 0x76, 0x3c, 0x73, 0x9f, 0xfa, 0x81, 0x74, 0x85, 0xf2,
+	0xe2, 0xe7, 0x70, 0x27, 0x20, 0xfe, 0x81, 0xb1, 0x6f, 0xfb, 0x01, 0xf3, 0x26, 0x86, 0x47, 0x03,
+	0xea, 0xf2, 0x7a, 0x43, 0xbc, 0x48, 0xa9, 0xfb, 0x9f, 0xdb, 0x1c, 0xb3, 0x29, 0x21, 0x38, 0x44,
+	0x6c, 0x71, 0x80, 0xde, 0x82, 0x22, 0x67, 0xe1, 0x0d, 0xba, 0x47, 0xc6, 0x4e, 0xc0, 0x47, 0x0f,
+	0x0e, 0x1b, 0x18, 0x2f, 0x7d, 0x4c, 0xe5, 0x1d, 0x36, 0x90, 0x9f, 0xfa, 0x4f, 0x41, 0x6b, 0xd8,
+	0xfe, 0x88, 0x04, 0xe6, 0x7e, 0x78, 0xb1, 0x85, 0x1a, 0xa0, 0xed, 0x53, 0xe2, 0x05, 0xbb, 0x94,
+	0x04, 0xc6, 0x88, 0x7a, 0x36, 0xb3, 0xae, 0x9f, 0xe5, 0xa5, 0x48, 0xa5, 0x2b, 0x34, 0xf4, 0xff,
+	0x4a, 0x00, 0x60, 0xb2, 0x17, 0x32, 0xb2, 0x1f, 0xc2, 0x0d, 0xdf, 0x25, 0x23, 0x7f, 0x9f, 0x05,
+	0x86, 0xed, 0x06, 0xd4, 0x3b, 0x24, 0x8e, 0xba, 0x9f, 0xd0, 0xc2, 0x8a, 0x96, 0x92, 0xa3, 0xf7,
+	0x01, 0x1d, 0x50, 0x3a, 0x32, 0x98, 0x63, 0x19, 0x61, 0xa5, 0x7c, 0x2f, 0x4b, 0x63, 0x8d, 0xd7,
+	0x74, 0x1c, 0xab, 0x17, 0xca, 0x51, 0x0d, 0x56, 0xf9, 0xf0, 0xa9, 0x1b, 0x78, 0x36, 0xf5, 0x8d,
+	0x3d, 0xe6, 0x19, 0xbe, 0xc3, 0x8e, 0x8c, 0x3d, 0xe6, 0x38, 0xec, 0x88, 0x7a, 0xe1, 0xd5, 0x4f,
+	0xc9, 0x61, 0x83, 0xa6, 0x04, 0x6d, 0x30, 0xaf, 0xe7, 0xb0, 0xa3, 0x8d, 0x10, 0xc1, 0x69, 0xdb,
+	0x74, 0xcc, 0x81, 0x6d, 0x1e, 0x84, 0xb4, 0x2d, 0x92, 0xf6, 0x6d, 0xf3, 0x00, 0xbd, 0x09, 0x0b,
+	0xd4, 0xa1, 0xe2, 0x06, 0x40, 0xa2, 0x32, 0x02, 0x55, 0x0c, 0x85, 0x1c, 0xa4, 0x7f, 0x01, 0x5a,
+	0xd3, 0x35, 0xbd, 0xc9, 0x28, 0x36, 0xe7, 0xef, 0x03, 0xe2, 0x9b, 0xa4, 0xe1, 0x30, 0xf3, 0xc0,
+	0x18, 0x12, 0x97, 0x0c, 0x78, 0xbf, 0xe4, 0x1b, 0x8d, 0xc6, 0x6b, 0xb6, 0x98, 0x79, 0xb0, 0xad,
+	0xe4, 0xfa, 0xc7, 0x00, 0xbd, 0x91, 0x47, 0x89, 0xd5, 0xe1, 0x6c, 0x82, 0xbb, 0x4e, 0x94, 0x0c,
+	0x4b, 0x3d, 0x03, 0x31, 0x4f, 0x2d, 0x75, 0x4d, 0x56, 0x34, 0x22, 0xb9, 0xfe, 0xcb, 0x70, 0xb3,
+	0xeb, 0x10, 0x53, 0x3c, 0x89, 0x76, 0xa3, 0x47, 0x07, 0xf4, 0x10, 0xb2, 0x12, 0xaa, 0x66, 0x72,
+	0xe6, 0x72, 0x9b, 0xb6, 0xb9, 0x39, 0x87, 0x15, 0xbe, 0x56, 0x04, 0x98, 0xda, 0xd1, 0x9f, 0x41,
+	0x3e, 0x32, 0x8f, 0xca, 0xc0, 0x53, 0x60, 0x1e, 0xdd, 0xb6, 0xab, 0x72, 0xd6, 0x3c, 0x8e, 0x8b,
+	0x50, 0x0b, 0x0a, 0xa3, 0x48, 0xf9, 0x4a, 0x3a, 0x37, 0xa3, 0xd3, 0x38, 0xae, 0xab, 0x7f, 0x06,
+	0xf0, 0x13, 0x66, 0xbb, 0x7d, 0x76, 0x40, 0x5d, 0xf1, 0xce, 0xc5, 0xb3, 0x35, 0x1a, 0x3a, 0x42,
+	0x95, 0x44, 0x32, 0x2a, 0xbd, 0x18, 0x3d, 0xf7, 0xc8, 0xa2, 0xfe, 0x57, 0x49, 0xc8, 0x62, 0xc6,
+	0x82, 0x7a, 0x15, 0x95, 0x21, 0xab, 0x96, 0xba, 0x38, 0x42, 0x6a, 0xf9, 0xb3, 0xd3, 0xb5, 0x8c,
+	0x5c, 0xe3, 0x19, 0x53, 0x2c, 0xee, 0xd8, 0x26, 0x9c, 0xbc, 0x6c, 0x13, 0x46, 0xf7, 0xa0, 0xa8,
+	0x40, 0xc6, 0x3e, 0xf1, 0xf7, 0x65, 0x8e, 0x55, 0x5b, 0x3c, 0x3b, 0x5d, 0x03, 0x89, 0xdc, 0x24,
+	0xfe, 0x3e, 0x06, 0x89, 0xe6, 0xdf, 0xa8, 0x09, 0x85, 0xaf, 0x98, 0xed, 0x1a, 0x81, 0x18, 0x84,
+	0xba, 0xee, 0x9a, 0x39, 0x15, 0xd3, 0xa1, 0xaa, 0x77, 0x51, 0xf8, 0x6a, 0x3a, 0xf8, 0x26, 0x2c,
+	0x78, 0x8c, 0x05, 0x72, 0xe7, 0xb1, 0x99, 0xab, 0x32, 0xe9, 0xf2, 0xcc, 0x0b, 0x56, 0xc6, 0x02,
+	0xac, 0x70, 0xb8, 0xe8, 0xc5, 0x4a, 0xe8, 0x1e, 0x2c, 0x3b, 0xc4, 0x0f, 0x0c, 0xb1, 0x65, 0x59,
+	0x53, 0x6b, 0x59, 0xb1, 0x5a, 0x10, 0xaf, 0xdb, 0x10, 0x55, 0xa1, 0x86, 0xfe, 0x0f, 0x09, 0x28,
+	0xf0, 0xc1, 0xd8, 0x7b, 0xb6, 0xc9, 0x79, 0xda, 0x77, 0xa7, 0x0f, 0xb7, 0x21, 0x65, 0xfa, 0x9e,
+	0x72, 0xaa, 0x38, 0x3f, 0xeb, 0x3d, 0x8c, 0xb9, 0x0c, 0x7d, 0x01, 0x59, 0x95, 0xd1, 0x4b, 0xe6,
+	0xa0, 0x5f, 0xcf, 0x28, 0x95, 0x6f, 0x94, 0x9e, 0x88, 0xc7, 0x69, 0xef, 0xe4, 0x3e, 0x8e, 0xe3,
+	0x22, 0x74, 0x0b, 0x92, 0xa6, 0x74, 0x97, 0x7a, 0x78, 0xaf, 0xb7, 0x71, 0xd2, 0x74, 0xf5, 0xbf,
+	0x4d, 0xc0, 0xc2, 0x74, 0xcd, 0xf2, 0x08, 0xb8, 0x03, 0x79, 0x7f, 0xbc, 0xeb, 0x4f, 0xfc, 0x80,
+	0x0e, 0xc3, 0x37, 0xbc, 0x48, 0x80, 0x5a, 0x90, 0x27, 0xce, 0x80, 0x79, 0x76, 0xb0, 0x3f, 0x54,
+	0xc9, 0xe4, 0xec, 0xd3, 0x3e, 0x6e, 0xb3, 0x52, 0x0d, 0x55, 0xf0, 0x54, 0x3b, 0x3c, 0xba, 0xc5,
+	0x71, 0x25, 0x8f, 0xee, 0x37, 0xa0, 0xe8, 0x90, 0xa1, 0xb8, 0xe2, 0x08, 0xec, 0xa1, 0x1c, 0x47,
+	0x1a, 0x17, 0x94, 0xac, 0x6f, 0x0f, 0xa9, 0xae, 0x43, 0x3e, 0x32, 0x86, 0x96, 0xa0, 0x50, 0x6d,
+	0xf6, 0x8c, 0xfb, 0xeb, 0x0f, 0x8d, 0x47, 0xf5, 0x6d, 0x6d, 0x4e, 0xd1, 0xcb, 0x3f, 0x4b, 0xc0,
+	0x82, 0xda, 0x51, 0x14, 0x65, 0x7f, 0x13, 0xe6, 0x3d, 0xb2, 0x17, 0x84, 0x49, 0x45, 0x5a, 0x46,
+	0x35, 0xdf, 0xa4, 0x79, 0x52, 0xc1, 0xab, 0x66, 0x27, 0x15, 0xb1, 0x57, 0xe5, 0xd4, 0x95, 0xaf,
+	0xca, 0xe9, 0xff, 0x97, 0x57, 0x65, 0xfd, 0x4f, 0x92, 0xb0, 0xa4, 0xd8, 0x5f, 0xb4, 0x81, 0xbd,
+	0x0b, 0x79, 0x49, 0x04, 0xa7, 0x29, 0x91, 0x78, 0xc8, 0x94, 0xb8, 0x56, 0x03, 0xe7, 0x64, 0x75,
+	0xcb, 0xe2, 0x39, 0xba, 0x82, 0xc6, 0x7e, 0x23, 0x01, 0x52, 0xd4, 0xe6, 0x09, 0x66, 0x03, 0xd2,
+	0x7b, 0xb6, 0x43, 0x55, 0x9c, 0xcd, 0xbc, 0xbe, 0xbe, 0xd0, 0xbc, 0x78, 0x68, 0xe9, 0x8b, 0x2c,
+	0x7f, 0x73, 0x0e, 0x0b, 0xed, 0xd2, 0x6f, 0x02, 0x4c, 0xa5, 0x33, 0x13, 0x59, 0x4e, 0x16, 0xd5,
+	0x9d, 0x60, 0x48, 0x16, 0x5b, 0x0d, 0xcc, 0x65, 0xbc, 0x6a, 0x60, 0x5b, 0x6a, 0xcb, 0x10, 0x55,
+	0x8f, 0x78, 0xd5, 0xc0, 0xb6, 0xa2, 0xd7, 0x9e, 0xf4, 0x35, 0xaf, 0x3d, 0xb5, 0x5c, 0x78, 0x33,
+	0xa5, 0x6f, 0xc1, 0xad, 0x9a, 0x43, 0xcc, 0x03, 0xc7, 0xf6, 0x03, 0x6a, 0xc5, 0x57, 0xe8, 0x3a,
+	0x64, 0xcf, 0xf1, 0xb4, 0xab, 0x2e, 0x02, 0x15, 0x52, 0xff, 0xb7, 0x04, 0x14, 0x37, 0x29, 0x71,
+	0x82, 0xfd, 0xe9, 0x6d, 0x4a, 0x40, 0xfd, 0x40, 0x6d, 0xf0, 0xe2, 0x1b, 0x7d, 0x08, 0xb9, 0xe8,
+	0x18, 0xbf, 0xf6, 0x45, 0x26, 0x82, 0xa2, 0x07, 0x30, 0xcf, 0x63, 0x9a, 0x8d, 0xc3, 0xfc, 0xe0,
+	0xaa, 0xcb, 0x7e, 0x85, 0xe4, 0x9b, 0xba, 0x47, 0xc5, 0xb9, 0x2d, 0x9c, 0x92, 0xc1, 0x61, 0x11,
+	0xfd, 0x12, 0x14, 0xc5, 0x5d, 0x75, 0x48, 0x53, 0x32, 0xd7, 0xd9, 0x2c, 0xc8, 0xe7, 0x26, 0x49,
+	0x51, 0xfe, 0x27, 0x01, 0xcb, 0xdb, 0x64, 0xb2, 0x4b, 0xd5, 0x32, 0xa5, 0x16, 0xa6, 0x26, 0xf3,
+	0x2c, 0xd4, 0x8d, 0x2f, 0xef, 0x2b, 0x5e, 0xaf, 0x66, 0x29, 0xcf, 0x5e, 0xe5, 0x61, 0xce, 0x92,
+	0x8c, 0xe5, 0x2c, 0xcb, 0x90, 0x71, 0x99, 0x6b, 0x52, 0xb5, 0xf6, 0x65, 0x41, 0xb7, 0xe3, 0x4b,
+	0xbb, 0x14, 0x3d, 0x2c, 0x89, 0x67, 0xa1, 0x36, 0x0b, 0xa2, 0xd6, 0xd0, 0x17, 0x50, 0xea, 0x35,
+	0xeb, 0xb8, 0xd9, 0xaf, 0x75, 0x7e, 0x6a, 0xf4, 0xaa, 0x5b, 0xbd, 0xea, 0xfa, 0x3d, 0xa3, 0xdb,
+	0xd9, 0xfa, 0xf2, 0xfe, 0x83, 0x7b, 0x1f, 0x6a, 0x89, 0x52, 0xf9, 0xf8, 0xa4, 0x7c, 0xa7, 0x5d,
+	0xad, 0x6f, 0xc9, 0x58, 0xde, 0x65, 0xcf, 0x7a, 0xc4, 0xf1, 0xc9, 0xfa, 0xbd, 0x2e, 0x73, 0x26,
+	0x1c, 0xa3, 0x9f, 0x24, 0xa0, 0x18, 0x3f, 0x1f, 0xe2, 0xc7, 0x5e, 0xe2, 0xd2, 0x63, 0x6f, 0x7a,
+	0x7a, 0x26, 0x2f, 0x39, 0x3d, 0x37, 0x60, 0xd9, 0xf4, 0x98, 0xef, 0x1b, 0x9c, 0x30, 0x53, 0xeb,
+	0x02, 0x25, 0x7f, 0xe5, 0xec, 0x74, 0xed, 0x46, 0x9d, 0xd7, 0xf7, 0x44, 0xb5, 0x32, 0x7f, 0xc3,
+	0x8c, 0x89, 0x44, 0x4b, 0xef, 0xfd, 0x22, 0x05, 0xf9, 0xe8, 0xba, 0x99, 0x2f, 0x19, 0x9e, 0xeb,
+	0x2b, 0x57, 0x44, 0xf2, 0x36, 0x3d, 0x42, 0x6f, 0x4c, 0xb3, 0xfc, 0x2f, 0xe4, 0xfb, 0x5a, 0x54,
+	0x1d, 0x66, 0xf8, 0x6f, 0x41, 0xae, 0xda, 0xeb, 0xb5, 0x1e, 0xb5, 0x9b, 0x0d, 0xed, 0xeb, 0x44,
+	0xe9, 0x95, 0xe3, 0x93, 0xf2, 0x8d, 0x08, 0x54, 0xf5, 0x65, 0x4f, 0x05, 0xaa, 0x5e, 0x6f, 0x76,
+	0xfb, 0xcd, 0x86, 0xf6, 0x3c, 0x79, 0x11, 0x25, 0xb2, 0x56, 0xf1, 0x4a, 0x9e, 0xef, 0xe2, 0x66,
+	0xb7, 0x8a, 0x79, 0x83, 0x5f, 0x27, 0xe5, 0xe5, 0xc3, 0xb4, 0x45, 0x8f, 0x8e, 0x88, 0xc7, 0xdb,
+	0x5c, 0x0d, 0x7f, 0x2d, 0xf2, 0x3c, 0x25, 0x5f, 0x52, 0xa7, 0x77, 0xe7, 0x94, 0x58, 0x13, 0xde,
+	0x9a, 0x78, 0xb4, 0x10, 0x66, 0x52, 0x17, 0x5a, 0xeb, 0xf1, 0x40, 0xe5, 0x56, 0x74, 0x98, 0xc7,
+	0x3b, 0xed, 0x36, 0x07, 0x3d, 0x4f, 0x5f, 0x18, 0x1d, 0x1e, 0xbb, 0x3c, 0x23, 0x41, 0x77, 0x21,
+	0x17, 0xbe, 0x69, 0x68, 0x5f, 0xa7, 0x2f, 0x74, 0xa8, 0x1e, 0x3e, 0xc8, 0x88, 0x06, 0x37, 0x77,
+	0xfa, 0xe2, 0xc7, 0x2c, 0xcf, 0x33, 0x17, 0x1b, 0xdc, 0x1f, 0x07, 0x16, 0x3b, 0x72, 0xf9, 0x04,
+	0xab, 0x7b, 0x8e, 0xaf, 0x33, 0x32, 0x29, 0x8c, 0x30, 0xea, 0x92, 0xe3, 0x2d, 0xc8, 0xe1, 0xe6,
+	0x4f, 0xe4, 0xef, 0x5e, 0x9e, 0x67, 0x2f, 0xd8, 0xc1, 0xf4, 0x2b, 0x6a, 0xaa, 0xd6, 0x3a, 0xb8,
+	0xbb, 0x59, 0x15, 0x2e, 0xbf, 0x88, 0xea, 0x78, 0xa3, 0x7d, 0xe2, 0x52, 0x6b, 0xfa, 0x9c, 0x1c,
+	0x55, 0xbd, 0xf7, 0x2b, 0x90, 0x0b, 0x69, 0x03, 0x5a, 0x85, 0xec, 0xd3, 0x0e, 0x7e, 0xdc, 0xc4,
+	0xda, 0x9c, 0xf4, 0x61, 0x58, 0xf3, 0x54, 0x12, 0xbe, 0x32, 0xcc, 0x6f, 0x57, 0xdb, 0xd5, 0x47,
+	0x4d, 0x1c, 0x5e, 0x41, 0x86, 0x00, 0x75, 0xf6, 0x95, 0x34, 0xd5, 0x40, 0x64, 0xb3, 0xb6, 0xf2,
+	0xcd, 0xb7, 0xab, 0x73, 0x3f, 0xff, 0x76, 0x75, 0xee, 0xf9, 0xd9, 0x6a, 0xe2, 0x9b, 0xb3, 0xd5,
+	0xc4, 0xcf, 0xce, 0x56, 0x13, 0xff, 0x72, 0xb6, 0x9a, 0xd8, 0xcd, 0x8a, 0x1d, 0xe3, 0xc1, 0xff,
+	0x06, 0x00, 0x00, 0xff, 0xff, 0x45, 0x07, 0xa3, 0xee, 0x6e, 0x2a, 0x00, 0x00,
 }

vendor/github.com/docker/swarmkit/api/types.proto

@@ -668,6 +668,21 @@ message CAConfig {
 	// ExternalCAs is a list of CAs to which a manager node will make
 	// certificate signing requests for node certificates.
 	repeated ExternalCA external_cas = 2 [(gogoproto.customname) = "ExternalCAs"];
+
+	// SigningCACert is the desired CA certificate to be used as the root and
+	// signing CA for the swarm.  If not provided, indicates that we are either happy
+	// with the current configuration, or (together with a bump in the ForceRotate value)
+	// that we want a certificate and key generated for us.
+	bytes signing_ca_cert = 3 [(gogoproto.customname) = "SigningCACert"];
+
+	// SigningCAKey is the desired private key, matching the signing CA cert, to be used
+	// to sign certificates for the swarm
+	bytes signing_ca_key = 4 [(gogoproto.customname) = "SigningCAKey"];
+
+	// ForceRotate is a counter that triggers a root CA rotation even if no relevant
+	// parameters have been in the spec. This will force the manager to generate a new
+	// certificate and key, if none have been provided.
+	uint64 force_rotate = 5;
 }
 
 // OrchestrationConfig defines cluster-level orchestration settings.
@@ -771,6 +786,10 @@ message RootCA {
 	// RootRotation contains the new root cert and key we want to rotate to - if this is nil, we are not in the
 	// middle of a root rotation
 	RootRotation root_rotation = 5;
+
+	// LastForcedRotation matches the Cluster Spec's CAConfig's ForceRotation counter.
+	// It indicates when the current CA cert and key were generated (or updated).
+	uint64 last_forced_rotation = 6;
 }
 
 
@@ -922,5 +941,5 @@ message RootRotation {
 	bytes ca_cert = 1 [(gogoproto.customname) = "CACert"];
 	bytes ca_key = 2 [(gogoproto.customname) = "CAKey"];
 	// cross-signed CA cert is the CACert that has been cross-signed by the previous root
-	bytes cross_signed_ca_cert = 3 [(gogoproto.customname) = "CrossSignedCACert"];;
+	bytes cross_signed_ca_cert = 3 [(gogoproto.customname) = "CrossSignedCACert"];
 }

vendor/github.com/docker/swarmkit/ca/certificates.go

@@ -244,7 +244,6 @@ func (rca *RootCA) RequestAndSaveNewCertificates(ctx context.Context, kw KeyWrit
 		// the local connection will not be returned by the connection
 		// broker anymore.
 		config.ForceRemote = true
-
 	}
 	if err != nil {
 		return nil, err
@@ -284,9 +283,9 @@ func (rca *RootCA) RequestAndSaveNewCertificates(ctx context.Context, kw KeyWrit
 	return &tlsKeyPair, nil
 }
 
-func (rca *RootCA) getKEKUpdate(ctx context.Context, cert *x509.Certificate, keypair tls.Certificate, connBroker *connectionbroker.Broker) (*KEKData, error) {
+func (rca *RootCA) getKEKUpdate(ctx context.Context, leafCert *x509.Certificate, keypair tls.Certificate, connBroker *connectionbroker.Broker) (*KEKData, error) {
 	var managerRole bool
-	for _, ou := range cert.Subject.OrganizationalUnit {
+	for _, ou := range leafCert.Subject.OrganizationalUnit {
 		if ou == ManagerRole {
 			managerRole = true
 			break
@@ -773,7 +772,6 @@ func GetRemoteSignedCertificate(ctx context.Context, csr []byte, rootCAPool *x50
 	if rootCAPool == nil {
 		return nil, errors.New("valid root CA pool required")
 	}
-
 	creds := config.Credentials
 
 	if creds == nil {
@@ -810,17 +808,29 @@ func GetRemoteSignedCertificate(ctx context.Context, csr []byte, rootCAPool *x50
 
 	// Exponential backoff with Max of 30 seconds to wait for a new retry
 	for {
+		timeout := 5 * time.Second
+		if config.NodeCertificateStatusRequestTimeout > 0 {
+			timeout = config.NodeCertificateStatusRequestTimeout
+		}
 		// Send the Request and retrieve the certificate
-		ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+		stateCtx, cancel := context.WithTimeout(ctx, timeout)
 		defer cancel()
-		statusResponse, err := caClient.NodeCertificateStatus(ctx, statusRequest)
-		if err != nil {
+		statusResponse, err := caClient.NodeCertificateStatus(stateCtx, statusRequest)
+		switch {
+		case err != nil && grpc.Code(err) != codes.DeadlineExceeded:
 			conn.Close(false)
-			return nil, err
-		}
+			// Because IssueNodeCertificate succeeded, if this call failed likely it is due to an issue with this
+			// particular connection, so we need to get another.  We should try a remote connection - the local node
+			// may be a manager that was demoted, so the local connection (which is preferred) may not work.
+			config.ForceRemote = true
+			conn, err = getGRPCConnection(creds, config.ConnBroker, config.ForceRemote)
+			if err != nil {
+				return nil, err
+			}
+			caClient = api.NewNodeCAClient(conn.ClientConn)
 
-		// If the certificate was issued, return
-		if statusResponse.Status.State == api.IssuanceStateIssued {
+		// If there was no deadline exceeded error, and the certificate was issued, return
+		case err == nil && statusResponse.Status.State == api.IssuanceStateIssued:
 			if statusResponse.Certificate == nil {
 				conn.Close(false)
 				return nil, errors.New("no certificate in CertificateStatus response")
@@ -837,10 +847,15 @@ func GetRemoteSignedCertificate(ctx context.Context, csr []byte, rootCAPool *x50
 			}
 		}
 
-		// If we're still pending, the issuance failed, or the state is unknown
-		// let's continue trying.
+		// If NodeCertificateStatus timed out, we're still pending, the issuance failed, or
+		// the state is unknown let's continue trying after an exponential backoff
 		expBackoff.Failure(nil, nil)
-		time.Sleep(expBackoff.Proceed(nil))
+		select {
+		case <-ctx.Done():
+			conn.Close(true)
+			return nil, err
+		case <-time.After(expBackoff.Proceed(nil)):
+		}
 	}
 }
 

vendor/github.com/docker/swarmkit/ca/config.go

@@ -350,6 +350,9 @@ type CertificateRequestConfig struct {
 	// where the local node is running a manager, but is in the process of
 	// being demoted.
 	ForceRemote bool
+	// NodeCertificateStatusRequestTimeout determines how long to wait for a node
+	// status RPC result.  If not provided (zero value), will default to 5 seconds.
+	NodeCertificateStatusRequestTimeout time.Duration
 }
 
 // CreateSecurityConfig creates a new key and cert for this node, either locally

vendor/github.com/docker/swarmkit/ca/external.go

@@ -11,6 +11,7 @@ import (
 	"io/ioutil"
 	"net/http"
 	"sync"
+	"time"
 
 	"github.com/Sirupsen/logrus"
 	"github.com/cloudflare/cfssl/api"
@@ -29,6 +30,8 @@ var ErrNoExternalCAURLs = errors.New("no external CA URLs")
 // ExternalCA is able to make certificate signing requests to one of a list
 // remote CFSSL API endpoints.
 type ExternalCA struct {
+	ExternalRequestTimeout time.Duration
+
 	mu     sync.Mutex
 	rootCA *RootCA
 	urls   []string
@@ -39,8 +42,9 @@ type ExternalCA struct {
 // authenticate to any of the given URLS of CFSSL API endpoints.
 func NewExternalCA(rootCA *RootCA, tlsConfig *tls.Config, urls ...string) *ExternalCA {
 	return &ExternalCA{
-		rootCA: rootCA,
-		urls:   urls,
+		ExternalRequestTimeout: 5 * time.Second,
+		rootCA:                 rootCA,
+		urls:                   urls,
 		client: &http.Client{
 			Transport: &http.Transport{
 				TLSClientConfig: tlsConfig,
@@ -49,6 +53,19 @@ func NewExternalCA(rootCA *RootCA, tlsConfig *tls.Config, urls ...string) *Exter
 	}
 }
 
+// Copy returns a copy of the external CA that can be updated independently
+func (eca *ExternalCA) Copy() *ExternalCA {
+	eca.mu.Lock()
+	defer eca.mu.Unlock()
+
+	return &ExternalCA{
+		ExternalRequestTimeout: eca.ExternalRequestTimeout,
+		rootCA:                 eca.rootCA,
+		urls:                   eca.urls,
+		client:                 eca.client,
+	}
+}
+
 // UpdateTLSConfig updates the HTTP Client for this ExternalCA by creating
 // a new client which uses the given tlsConfig.
 func (eca *ExternalCA) UpdateTLSConfig(tlsConfig *tls.Config) {
@@ -93,7 +110,9 @@ func (eca *ExternalCA) Sign(ctx context.Context, req signer.SignRequest) (cert [
 	// Try each configured proxy URL. Return after the first success. If
 	// all fail then the last error will be returned.
 	for _, url := range urls {
-		cert, err = makeExternalSignRequest(ctx, client, url, csrJSON)
+		requestCtx, cancel := context.WithTimeout(ctx, eca.ExternalRequestTimeout)
+		cert, err = makeExternalSignRequest(requestCtx, client, url, csrJSON)
+		cancel()
 		if err == nil {
 			return append(cert, eca.rootCA.Intermediates...), err
 		}

vendor/github.com/docker/swarmkit/ca/server.go

@@ -12,7 +12,6 @@ import (
 	"github.com/docker/swarmkit/api/equality"
 	"github.com/docker/swarmkit/identity"
 	"github.com/docker/swarmkit/log"
-	"github.com/docker/swarmkit/manager/state"
 	"github.com/docker/swarmkit/manager/state/store"
 	gogotypes "github.com/gogo/protobuf/types"
 	"github.com/pkg/errors"
@@ -129,7 +128,7 @@ func (s *Server) NodeCertificateStatus(ctx context.Context, request *api.NodeCer
 
 	event := api.EventUpdateNode{
 		Node:   &api.Node{ID: request.NodeID},
-		Checks: []api.NodeCheckFunc{state.NodeCheckID},
+		Checks: []api.NodeCheckFunc{api.NodeCheckID},
 	}
 
 	// Retrieve the current value of the certificate with this token, and create a watcher
@@ -542,7 +541,6 @@ func (s *Server) UpdateRootCA(ctx context.Context, cluster *api.Cluster) error {
 
 	s.secConfigMu.Lock()
 	defer s.secConfigMu.Unlock()
-	var err error
 	rCA := cluster.RootCA
 	rootCAChanged := len(rCA.CACert) != 0 && !equality.RootCAEqualStable(s.lastSeenClusterRootCA, &cluster.RootCA)
 	externalCAChanged := !equality.ExternalCAsEqualStable(s.lastSeenExternalCAs, cluster.Spec.CAConfig.ExternalCAs)
@@ -565,7 +563,7 @@ func (s *Server) UpdateRootCA(ctx context.Context, cluster *api.Cluster) error {
 			}
 		} else {
 			// NodeCertExpiry seems to be nil
-			logger.WithError(err).Warn("failed to parse certificate expiration, using default")
+			logger.Warn("no certificate expiration specified, using default")
 		}
 		// Attempt to update our local RootCA with the new parameters
 		var intermediates []byte

vendor/github.com/docker/swarmkit/manager/allocator/network.go

@@ -291,7 +291,7 @@ func (a *Allocator) doNetworkAlloc(ctx context.Context, ev events.Event) {
 	case api.EventDeleteNetwork:
 		n := v.Network.Copy()
 
-		if IsIngressNetwork(n) && nc.ingressNetwork.ID == n.ID {
+		if IsIngressNetwork(n) && nc.ingressNetwork != nil && nc.ingressNetwork.ID == n.ID {
 			nc.ingressNetwork = nil
 			if err := a.deallocateNodes(ctx); err != nil {
 				log.G(ctx).WithError(err).Error(err)
@@ -591,7 +591,7 @@ func (a *Allocator) taskCreateNetworkAttachments(t *api.Task, s *api.Service) {
 	}
 
 	var networks []*api.NetworkAttachment
-	if IsIngressNetworkNeeded(s) {
+	if IsIngressNetworkNeeded(s) && a.netCtx.ingressNetwork != nil {
 		networks = append(networks, &api.NetworkAttachment{Network: a.netCtx.ingressNetwork})
 	}
 
@@ -804,7 +804,7 @@ func (a *Allocator) allocateService(ctx context.Context, s *api.Service) error {
 	// If the service doesn't expose ports any more and if we have
 	// any lingering virtual IP references for ingress network
 	// clean them up here.
-	if !IsIngressNetworkNeeded(s) {
+	if !IsIngressNetworkNeeded(s) && nc.ingressNetwork != nil {
 		if s.Endpoint != nil {
 			for i, vip := range s.Endpoint.VirtualIPs {
 				if vip.NetworkID == nc.ingressNetwork.ID {

vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/networkallocator.go

@@ -9,6 +9,7 @@ import (
 	"github.com/docker/libnetwork/driverapi"
 	"github.com/docker/libnetwork/drvregistry"
 	"github.com/docker/libnetwork/ipamapi"
+	"github.com/docker/libnetwork/netlabel"
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/log"
 	"github.com/pkg/errors"
@@ -773,7 +774,7 @@ func (na *NetworkAllocator) allocatePools(n *api.Network) (map[string]string, er
 	}
 
 	for i, ic := range ipamConfigs {
-		poolID, poolIP, _, err := ipam.RequestPool(asName, ic.Subnet, ic.Range, dOptions, false)
+		poolID, poolIP, meta, err := ipam.RequestPool(asName, ic.Subnet, ic.Range, dOptions, false)
 		if err != nil {
 			// Rollback by releasing all the resources allocated so far.
 			releasePools(ipam, ipamConfigs[:i], pools)
@@ -781,11 +782,29 @@ func (na *NetworkAllocator) allocatePools(n *api.Network) (map[string]string, er
 		}
 		pools[poolIP.String()] = poolID
 
-		gwIP, _, err := ipam.RequestAddress(poolID, net.ParseIP(ic.Gateway), nil)
-		if err != nil {
-			// Rollback by releasing all the resources allocated so far.
-			releasePools(ipam, ipamConfigs[:i], pools)
-			return nil, err
+		// The IPAM contract allows the IPAM driver to autonomously
+		// provide a network gateway in response to the pool request.
+		// But if the network spec contains a gateway, we will allocate
+		// it irrespective of whether the ipam driver returned one already.
+		// If none of the above is true, we need to allocate one now, and
+		// let the driver know this request is for the network gateway.
+		var (
+			gwIP *net.IPNet
+			ip   net.IP
+		)
+		if gws, ok := meta[netlabel.Gateway]; ok {
+			if ip, gwIP, err = net.ParseCIDR(gws); err != nil {
+				return nil, fmt.Errorf("failed to parse gateway address (%v) returned by ipam driver: %v", gws, err)
+			}
+			gwIP.IP = ip
+		}
+		if ic.Gateway != "" || gwIP == nil {
+			gwIP, _, err = ipam.RequestAddress(poolID, net.ParseIP(ic.Gateway), map[string]string{ipamapi.RequestAddressType: netlabel.Gateway})
+			if err != nil {
+				// Rollback by releasing all the resources allocated so far.
+				releasePools(ipam, ipamConfigs[:i], pools)
+				return nil, err
+			}
 		}
 
 		if ic.Subnet == "" {

vendor/github.com/docker/swarmkit/manager/controlapi/ca_rotation.go

@@ -0,0 +1,265 @@
+package controlapi
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"net"
+	"net/url"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+
+	"github.com/cloudflare/cfssl/helpers"
+	"github.com/docker/swarmkit/api"
+	"github.com/docker/swarmkit/ca"
+	"github.com/docker/swarmkit/log"
+)
+
+var minRootExpiration = 1 * helpers.OneYear
+
+// determines whether an api.RootCA, api.RootRotation, or api.CAConfig has a signing key (local signer)
+func hasSigningKey(a interface{}) bool {
+	switch b := a.(type) {
+	case api.RootCA:
+		return len(b.CAKey) > 0
+	case *api.RootRotation:
+		return b != nil && len(b.CAKey) > 0
+	case api.CAConfig:
+		return len(b.SigningCACert) > 0 && len(b.SigningCAKey) > 0
+	default:
+		panic("needsExternalCAs should be called something of type api.RootCA, *api.RootRotation, or api.CAConfig")
+	}
+}
+
+// Creates a cross-signed intermediate and new api.RootRotation object.
+// This function assumes that the root cert and key and the external CAs have already been validated.
+func newRootRotationObject(ctx context.Context, securityConfig *ca.SecurityConfig, cluster *api.Cluster, newRootCA ca.RootCA, version uint64) (*api.RootCA, error) {
+	var (
+		rootCert, rootKey, crossSignedCert []byte
+		newRootHasSigner                   bool
+		err                                error
+	)
+
+	rootCert = newRootCA.Certs
+	if s, err := newRootCA.Signer(); err == nil {
+		rootCert, rootKey = s.Cert, s.Key
+		newRootHasSigner = true
+	}
+
+	// we have to sign with the original signer, not whatever is in the SecurityConfig's RootCA (which may have an intermediate signer, if
+	// a root rotation is already in progress)
+	switch {
+	case hasSigningKey(cluster.RootCA):
+		var oldRootCA ca.RootCA
+		oldRootCA, err = ca.NewRootCA(cluster.RootCA.CACert, cluster.RootCA.CACert, cluster.RootCA.CAKey, ca.DefaultNodeCertExpiration, nil)
+		if err == nil {
+			crossSignedCert, err = oldRootCA.CrossSignCACertificate(rootCert)
+		}
+	case !newRootHasSigner: // the original CA and the new CA both require external CAs
+		return nil, grpc.Errorf(codes.InvalidArgument, "rotating from one external CA to a different external CA is not supported")
+	default:
+		// We need the same credentials but to connect to the original URLs (in case we are in the middle of a root rotation already)
+		externalCA := securityConfig.ExternalCA().Copy()
+		var urls []string
+		for _, c := range cluster.Spec.CAConfig.ExternalCAs {
+			if c.Protocol == api.ExternalCA_CAProtocolCFSSL && bytes.Equal(c.CACert, cluster.RootCA.CACert) {
+				urls = append(urls, c.URL)
+			}
+		}
+		if len(urls) == 0 {
+			return nil, grpc.Errorf(codes.InvalidArgument,
+				"must provide an external CA for the current external root CA to generate a cross-signed certificate")
+		}
+		externalCA.UpdateURLs(urls...)
+		crossSignedCert, err = externalCA.CrossSignRootCA(ctx, newRootCA)
+	}
+
+	if err != nil {
+		log.G(ctx).WithError(err).Error("unable to generate a cross-signed certificate for root rotation")
+		return nil, grpc.Errorf(codes.Internal, "unable to generate a cross-signed certificate for root rotation")
+	}
+
+	copied := cluster.RootCA.Copy()
+	copied.RootRotation = &api.RootRotation{
+		CACert:            rootCert,
+		CAKey:             rootKey,
+		CrossSignedCACert: crossSignedCert,
+	}
+	copied.LastForcedRotation = version
+	return copied, nil
+}
+
+// Checks that a CA URL is connectable using the credentials we have and that its server certificate is signed by the
+// root CA that we expect.  This uses a TCP dialer rather than an HTTP client; because we have custom TLS configuration,
+// if we wanted to use an HTTP client we'd have to create a new transport for every connection.  The docs specify that
+// Transports cache connections for future re-use, which could cause many open connections.
+func validateExternalCAURL(dialer *net.Dialer, tlsOpts *tls.Config, caURL string) error {
+	parsed, err := url.Parse(caURL)
+	if err != nil {
+		return err
+	}
+	if parsed.Scheme != "https" {
+		return errors.New("invalid HTTP scheme")
+	}
+	host, port, err := net.SplitHostPort(parsed.Host)
+	if err != nil {
+		// It either has no port or is otherwise invalid (e.g. too many colons).  If it's otherwise invalid the dialer
+		// will error later, so just assume it's no port and set the port to the default HTTPS port.
+		host = parsed.Host
+		port = "443"
+	}
+
+	conn, err := tls.DialWithDialer(dialer, "tcp", net.JoinHostPort(host, port), tlsOpts)
+	if conn != nil {
+		conn.Close()
+	}
+	return err
+}
+
+// Iterates over all the external CAs, and validates that there is at least 1 reachable, valid external CA for the
+// given CA certificate.  Returns true if there is, false otherwise.
+func hasAtLeastOneExternalCA(ctx context.Context, externalCAs []*api.ExternalCA, securityConfig *ca.SecurityConfig, wantedCert []byte) bool {
+	pool := x509.NewCertPool()
+	pool.AppendCertsFromPEM(wantedCert)
+	dialer := net.Dialer{Timeout: 5 * time.Second}
+	opts := tls.Config{
+		RootCAs:      pool,
+		Certificates: securityConfig.ClientTLSCreds.Config().Certificates,
+	}
+	for i, ca := range externalCAs {
+		if ca.Protocol == api.ExternalCA_CAProtocolCFSSL && bytes.Equal(wantedCert, ca.CACert) {
+			err := validateExternalCAURL(&dialer, &opts, ca.URL)
+			if err == nil {
+				return true
+			}
+			log.G(ctx).WithError(err).Warnf("external CA # %d is unreachable or invalid", i+1)
+		}
+	}
+	return false
+}
+
+// All new external CA definitions must include the CA cert associated with the external CA.
+// If the current root CA requires an external CA, then at least one, reachable valid external CA must be provided that
+// corresponds with the current RootCA's certificate.
+//
+// Similarly for the desired CA certificate, if one is specified.  Similarly for the current outstanding root CA rotation,
+// if one is specified and will not be replaced with the desired CA.
+func validateHasRequiredExternalCAs(ctx context.Context, securityConfig *ca.SecurityConfig, cluster *api.Cluster) error {
+	config := cluster.Spec.CAConfig
+	for _, ca := range config.ExternalCAs {
+		if len(ca.CACert) == 0 {
+			return grpc.Errorf(codes.InvalidArgument, "must specify CA certificate for each external CA")
+		}
+	}
+
+	if !hasSigningKey(cluster.RootCA) && !hasAtLeastOneExternalCA(ctx, config.ExternalCAs, securityConfig, cluster.RootCA.CACert) {
+		return grpc.Errorf(codes.InvalidArgument, "there must be at least one valid, reachable external CA corresponding to the current CA certificate")
+	}
+
+	if len(config.SigningCACert) > 0 { // a signing cert is specified
+		if !hasSigningKey(config) && !hasAtLeastOneExternalCA(ctx, config.ExternalCAs, securityConfig, config.SigningCACert) {
+			return grpc.Errorf(codes.InvalidArgument, "there must be at least one valid, reachable external CA corresponding to the desired CA certificate")
+		}
+	} else if config.ForceRotate == cluster.RootCA.LastForcedRotation && cluster.RootCA.RootRotation != nil {
+		// no cert is specified but force rotation hasn't changed (so we are happy with the current configuration) and there's an outstanding root rotation
+		if !hasSigningKey(cluster.RootCA.RootRotation) && !hasAtLeastOneExternalCA(ctx, config.ExternalCAs, securityConfig, cluster.RootCA.RootRotation.CACert) {
+			return grpc.Errorf(codes.InvalidArgument, "there must be at least one valid, reachable external CA corresponding to the next CA certificate")
+		}
+	}
+
+	return nil
+}
+
+// validateAndUpdateCA validates a cluster's desired CA configuration spec, and returns a RootCA value on success representing
+// current RootCA as it should be.  Validation logic and return values are as follows:
+// 1. Validates that the contents are complete - e.g. a signing key is not provided without a signing cert, and that external
+//    CAs are not removed if they are needed.  Otherwise, returns an error.
+// 2. If no desired signing cert or key are provided, then either:
+//    - we are happy with the current CA configuration (force rotation value has not changed), and we return the current RootCA
+//      object as is
+//    - we want to generate a new internal CA cert and key (force rotation value has changed), and we return the updated RootCA
+//      object
+// 3. Signing cert and key have been provided: validate that these match (the cert and key match). Otherwise, return an error.
+// 4. Return the updated RootCA object according to the following criteria:
+//    - If the desired cert is the same as the current CA cert then abort any outstanding rotations. The current signing key
+//      is replaced with the desired signing key (this could lets us switch between external->internal or internal->external
+//      without an actual CA rotation, which is not needed because any leaf cert issued with one CA cert can be validated using
+//       the second CA certificate).
+//    - If the desired cert is the same as the current to-be-rotated-to CA cert then a new root rotation is not needed. The
+//      current to-be-rotated-to signing key is replaced with the desired signing key (this could lets us switch between
+//      external->internal or internal->external without an actual CA rotation, which is not needed because any leaf cert
+//      issued with one CA cert can be validated using the second CA certificate).
+//    - Otherwise, start a new root rotation using the desired signing cert and desired signing key as the root rotation
+//      signing cert and key.  If a root rotation is already in progress, just replace it and start over.
+func validateCAConfig(ctx context.Context, securityConfig *ca.SecurityConfig, cluster *api.Cluster) (*api.RootCA, error) {
+	newConfig := cluster.Spec.CAConfig
+
+	if len(newConfig.SigningCAKey) > 0 && len(newConfig.SigningCACert) == 0 {
+		return nil, grpc.Errorf(codes.InvalidArgument, "if a signing CA key is provided, the signing CA cert must also be provided")
+	}
+
+	if err := validateHasRequiredExternalCAs(ctx, securityConfig, cluster); err != nil {
+		return nil, err
+	}
+
+	// if the desired CA cert and key are not set, then we are happy with the current root CA configuration, unless
+	// the ForceRotate version has changed
+	if len(newConfig.SigningCACert) == 0 {
+		if cluster.RootCA.LastForcedRotation != newConfig.ForceRotate {
+			newRootCA, err := ca.CreateRootCA(ca.DefaultRootCN)
+			if err != nil {
+				return nil, grpc.Errorf(codes.Internal, err.Error())
+			}
+			return newRootRotationObject(ctx, securityConfig, cluster, newRootCA, newConfig.ForceRotate)
+		}
+		return &cluster.RootCA, nil // no change, return as is
+	}
+
+	// A desired cert and maybe key were provided - we need to make sure the cert and key (if provided) match.
+	var signingCert []byte
+	if hasSigningKey(newConfig) {
+		signingCert = newConfig.SigningCACert
+	}
+	newRootCA, err := ca.NewRootCA(newConfig.SigningCACert, signingCert, newConfig.SigningCAKey, ca.DefaultNodeCertExpiration, nil)
+	if err != nil {
+		return nil, grpc.Errorf(codes.InvalidArgument, err.Error())
+	}
+
+	if len(newRootCA.Pool.Subjects()) != 1 {
+		return nil, grpc.Errorf(codes.InvalidArgument, "the desired CA certificate cannot contain multiple certificates")
+	}
+
+	parsedCert, err := helpers.ParseCertificatePEM(newConfig.SigningCACert)
+	if err != nil {
+		return nil, grpc.Errorf(codes.InvalidArgument, "could not parse the desired CA certificate")
+	}
+
+	// The new certificate's expiry must be at least one year away
+	if parsedCert.NotAfter.Before(time.Now().Add(minRootExpiration)) {
+		return nil, grpc.Errorf(codes.InvalidArgument, "CA certificate expires too soon")
+	}
+
+	// check if we can abort any existing root rotations
+	if bytes.Equal(cluster.RootCA.CACert, cluster.Spec.CAConfig.SigningCACert) {
+		copied := cluster.RootCA.Copy()
+		copied.CAKey = newConfig.SigningCAKey
+		copied.RootRotation = nil
+		copied.LastForcedRotation = newConfig.ForceRotate
+		return copied, nil
+	}
+
+	// check if this is the same desired cert as an existing root rotation
+	if r := cluster.RootCA.RootRotation; r != nil && bytes.Equal(r.CACert, cluster.Spec.CAConfig.SigningCACert) {
+		copied := cluster.RootCA.Copy()
+		copied.RootRotation.CAKey = newConfig.SigningCAKey
+		copied.LastForcedRotation = newConfig.ForceRotate
+		return copied, nil
+	}
+
+	// ok, everything's different; we have to begin a new root rotation which means generating a new cross-signed cert
+	return newRootRotationObject(ctx, securityConfig, cluster, newRootCA, newConfig.ForceRotate)
+}

vendor/github.com/docker/swarmkit/manager/controlapi/cluster.go

@@ -103,7 +103,6 @@ func (s *Server) UpdateCluster(ctx context.Context, request *api.UpdateClusterRe
 		cluster = store.GetCluster(tx, request.ClusterID)
 		if cluster == nil {
 			return grpc.Errorf(codes.NotFound, "cluster %s not found", request.ClusterID)
-
 		}
 		// This ensures that we always have the latest security config, so our ca.SecurityConfig.RootCA and
 		// ca.SecurityConfig.externalCA objects are up-to-date with the current api.Cluster.RootCA and
@@ -129,6 +128,12 @@ func (s *Server) UpdateCluster(ctx context.Context, request *api.UpdateClusterRe
 			cluster.RootCA.JoinTokens.Manager = ca.GenerateJoinToken(rootCA)
 		}
 
+		updatedRootCA, err := validateCAConfig(ctx, s.securityConfig, cluster)
+		if err != nil {
+			return err
+		}
+		cluster.RootCA = *updatedRootCA
+
 		var unlockKeys []*api.EncryptionKey
 		var managerKey *api.EncryptionKey
 		for _, eKey := range cluster.UnlockKeys {
@@ -239,19 +244,22 @@ func redactClusters(clusters []*api.Cluster) []*api.Cluster {
 	// Only add public fields to the new clusters
 	for _, cluster := range clusters {
 		// Copy all the mandatory fields
-		// Do not copy secret key
+		// Do not copy secret keys
+		redactedSpec := cluster.Spec.Copy()
+		redactedSpec.CAConfig.SigningCAKey = nil
+
+		redactedRootCA := cluster.RootCA.Copy()
+		redactedRootCA.CAKey = nil
+		if r := redactedRootCA.RootRotation; r != nil {
+			r.CAKey = nil
+		}
 		newCluster := &api.Cluster{
-			ID:   cluster.ID,
-			Meta: cluster.Meta,
-			Spec: cluster.Spec,
-			RootCA: api.RootCA{
-				CACert:     cluster.RootCA.CACert,
-				CACertHash: cluster.RootCA.CACertHash,
-				JoinTokens: cluster.RootCA.JoinTokens,
-			},
+			ID:                      cluster.ID,
+			Meta:                    cluster.Meta,
+			Spec:                    *redactedSpec,
+			RootCA:                  *redactedRootCA,
 			BlacklistedCertificates: cluster.BlacklistedCertificates,
 		}
-
 		redactedClusters = append(redactedClusters, newCluster)
 	}
 

vendor/github.com/docker/swarmkit/manager/controlapi/service.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/docker/distribution/reference"
 	"github.com/docker/swarmkit/api"
+	"github.com/docker/swarmkit/api/defaults"
 	"github.com/docker/swarmkit/api/naming"
 	"github.com/docker/swarmkit/identity"
 	"github.com/docker/swarmkit/manager/allocator"
@@ -525,6 +526,10 @@ func (s *Server) GetService(ctx context.Context, request *api.GetServiceRequest)
 		return nil, grpc.Errorf(codes.NotFound, "service %s not found", request.ServiceID)
 	}
 
+	if request.InsertDefaults {
+		service.Spec = *defaults.InterpolateService(&service.Spec)
+	}
+
 	return &api.GetServiceResponse{
 		Service: service,
 	}, nil

vendor/github.com/docker/swarmkit/manager/dispatcher/dispatcher.go

@@ -17,7 +17,6 @@ import (
 	"github.com/docker/swarmkit/api/equality"
 	"github.com/docker/swarmkit/ca"
 	"github.com/docker/swarmkit/log"
-	"github.com/docker/swarmkit/manager/state"
 	"github.com/docker/swarmkit/manager/state/store"
 	"github.com/docker/swarmkit/remotes"
 	"github.com/docker/swarmkit/watch"
@@ -702,11 +701,11 @@ func (d *Dispatcher) Tasks(r *api.TasksRequest, stream api.Dispatcher_TasksServe
 			return nil
 		},
 		api.EventCreateTask{Task: &api.Task{NodeID: nodeID},
-			Checks: []api.TaskCheckFunc{state.TaskCheckNodeID}},
+			Checks: []api.TaskCheckFunc{api.TaskCheckNodeID}},
 		api.EventUpdateTask{Task: &api.Task{NodeID: nodeID},
-			Checks: []api.TaskCheckFunc{state.TaskCheckNodeID}},
+			Checks: []api.TaskCheckFunc{api.TaskCheckNodeID}},
 		api.EventDeleteTask{Task: &api.Task{NodeID: nodeID},
-			Checks: []api.TaskCheckFunc{state.TaskCheckNodeID}},
+			Checks: []api.TaskCheckFunc{api.TaskCheckNodeID}},
 	)
 	if err != nil {
 		return err
@@ -916,9 +915,9 @@ func (d *Dispatcher) Assignments(r *api.AssignmentsRequest, stream api.Dispatche
 			return nil
 		},
 		api.EventUpdateTask{Task: &api.Task{NodeID: nodeID},
-			Checks: []api.TaskCheckFunc{state.TaskCheckNodeID}},
+			Checks: []api.TaskCheckFunc{api.TaskCheckNodeID}},
 		api.EventDeleteTask{Task: &api.Task{NodeID: nodeID},
-			Checks: []api.TaskCheckFunc{state.TaskCheckNodeID}},
+			Checks: []api.TaskCheckFunc{api.TaskCheckNodeID}},
 		api.EventUpdateSecret{},
 		api.EventDeleteSecret{},
 	)
@@ -1337,7 +1336,7 @@ func (d *Dispatcher) Session(r *api.SessionRequest, stream api.Dispatcher_Sessio
 		nodeObj = store.GetNode(readTx, nodeID)
 		return nil
 	}, api.EventUpdateNode{Node: &api.Node{ID: nodeID},
-		Checks: []api.NodeCheckFunc{state.NodeCheckID}},
+		Checks: []api.NodeCheckFunc{api.NodeCheckID}},
 	)
 	if cancel != nil {
 		defer cancel()

vendor/github.com/docker/swarmkit/manager/manager.go

@@ -33,9 +33,9 @@ import (
 	"github.com/docker/swarmkit/manager/orchestrator/taskreaper"
 	"github.com/docker/swarmkit/manager/resourceapi"
 	"github.com/docker/swarmkit/manager/scheduler"
-	"github.com/docker/swarmkit/manager/state"
 	"github.com/docker/swarmkit/manager/state/raft"
 	"github.com/docker/swarmkit/manager/state/store"
+	"github.com/docker/swarmkit/manager/storeapi"
 	"github.com/docker/swarmkit/remotes"
 	"github.com/docker/swarmkit/xnet"
 	gogotypes "github.com/gogo/protobuf/types"
@@ -390,11 +390,13 @@ func (m *Manager) Run(parent context.Context) error {
 	}
 
 	baseControlAPI := controlapi.NewServer(m.raftNode.MemoryStore(), m.raftNode, m.config.SecurityConfig, m.caserver, m.config.PluginGetter)
+	baseStoreAPI := storeapi.NewServer(m.raftNode.MemoryStore())
 	baseResourceAPI := resourceapi.New(m.raftNode.MemoryStore())
 	healthServer := health.NewHealthServer()
 	localHealthServer := health.NewHealthServer()
 
 	authenticatedControlAPI := api.NewAuthenticatedWrapperControlServer(baseControlAPI, authorize)
+	authenticatedStoreAPI := api.NewAuthenticatedWrapperStoreServer(baseStoreAPI, authorize)
 	authenticatedResourceAPI := api.NewAuthenticatedWrapperResourceAllocatorServer(baseResourceAPI, authorize)
 	authenticatedLogsServerAPI := api.NewAuthenticatedWrapperLogsServer(m.logbroker, authorize)
 	authenticatedLogBrokerAPI := api.NewAuthenticatedWrapperLogBrokerServer(m.logbroker, authorize)
@@ -444,6 +446,7 @@ func (m *Manager) Run(parent context.Context) error {
 		return context.WithValue(ctx, ca.LocalRequestKey, nodeInfo), nil
 	}
 	localProxyControlAPI := api.NewRaftProxyControlServer(baseControlAPI, m.raftNode, handleRequestLocally, forwardAsOwnRequest)
+	localProxyStoreAPI := api.NewRaftProxyStoreServer(baseStoreAPI, m.raftNode, handleRequestLocally, forwardAsOwnRequest)
 	localProxyLogsAPI := api.NewRaftProxyLogsServer(m.logbroker, m.raftNode, handleRequestLocally, forwardAsOwnRequest)
 	localProxyDispatcherAPI := api.NewRaftProxyDispatcherServer(m.dispatcher, m.raftNode, handleRequestLocally, forwardAsOwnRequest)
 	localProxyCAAPI := api.NewRaftProxyCAServer(m.caserver, m.raftNode, handleRequestLocally, forwardAsOwnRequest)
@@ -459,6 +462,7 @@ func (m *Manager) Run(parent context.Context) error {
 	api.RegisterHealthServer(m.server, authenticatedHealthAPI)
 	api.RegisterRaftMembershipServer(m.server, proxyRaftMembershipAPI)
 	api.RegisterControlServer(m.server, authenticatedControlAPI)
+	api.RegisterStoreServer(m.server, authenticatedStoreAPI)
 	api.RegisterLogsServer(m.server, authenticatedLogsServerAPI)
 	api.RegisterLogBrokerServer(m.server, proxyLogBrokerAPI)
 	api.RegisterResourceAllocatorServer(m.server, proxyResourceAPI)
@@ -466,6 +470,7 @@ func (m *Manager) Run(parent context.Context) error {
 	grpc_prometheus.Register(m.server)
 
 	api.RegisterControlServer(m.localserver, localProxyControlAPI)
+	api.RegisterStoreServer(m.localserver, localProxyStoreAPI)
 	api.RegisterLogsServer(m.localserver, localProxyLogsAPI)
 	api.RegisterHealthServer(m.localserver, localHealthServer)
 	api.RegisterDispatcherServer(m.localserver, localProxyDispatcherAPI)
@@ -695,7 +700,7 @@ func (m *Manager) watchForClusterChanges(ctx context.Context) error {
 		},
 		api.EventUpdateCluster{
 			Cluster: &api.Cluster{ID: clusterID},
-			Checks:  []api.ClusterCheckFunc{state.ClusterCheckID},
+			Checks:  []api.ClusterCheckFunc{api.ClusterCheckID},
 		},
 	)
 	if err != nil {

vendor/github.com/docker/swarmkit/manager/orchestrator/restart/restart.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/docker/go-events"
 	"github.com/docker/swarmkit/api"
+	"github.com/docker/swarmkit/api/defaults"
 	"github.com/docker/swarmkit/log"
 	"github.com/docker/swarmkit/manager/orchestrator"
 	"github.com/docker/swarmkit/manager/state"
@@ -159,10 +160,10 @@ func (r *Supervisor) Restart(ctx context.Context, tx store.Tx, cluster *api.Clus
 			restartDelay, err = gogotypes.DurationFromProto(t.Spec.Restart.Delay)
 			if err != nil {
 				log.G(ctx).WithError(err).Error("invalid restart delay; using default")
-				restartDelay = orchestrator.DefaultRestartDelay
+				restartDelay, _ = gogotypes.DurationFromProto(defaults.Service.Task.Restart.Delay)
 			}
 		} else {
-			restartDelay = orchestrator.DefaultRestartDelay
+			restartDelay, _ = gogotypes.DurationFromProto(defaults.Service.Task.Restart.Delay)
 		}
 	}
 
@@ -329,15 +330,15 @@ func (r *Supervisor) DelayStart(ctx context.Context, _ store.Tx, oldTask *api.Ta
 			r.store.WatchQueue(),
 			api.EventUpdateTask{
 				Task:   &api.Task{ID: oldTask.ID, Status: api.TaskStatus{State: api.TaskStateRunning}},
-				Checks: []api.TaskCheckFunc{state.TaskCheckID, state.TaskCheckStateGreaterThan},
+				Checks: []api.TaskCheckFunc{api.TaskCheckID, state.TaskCheckStateGreaterThan},
 			},
 			api.EventUpdateNode{
 				Node:   &api.Node{ID: oldTask.NodeID, Status: api.NodeStatus{State: api.NodeStatus_DOWN}},
-				Checks: []api.NodeCheckFunc{state.NodeCheckID, state.NodeCheckState},
+				Checks: []api.NodeCheckFunc{api.NodeCheckID, state.NodeCheckState},
 			},
 			api.EventDeleteNode{
 				Node:   &api.Node{ID: oldTask.NodeID},
-				Checks: []api.NodeCheckFunc{state.NodeCheckID},
+				Checks: []api.NodeCheckFunc{api.NodeCheckID},
 			},
 		)
 	}

vendor/github.com/docker/swarmkit/manager/orchestrator/task.go

@@ -9,10 +9,6 @@ import (
 	"github.com/docker/swarmkit/protobuf/ptypes"
 )
 
-// DefaultRestartDelay is the restart delay value to use when none is
-// specified.
-const DefaultRestartDelay = 5 * time.Second
-
 // NewTask creates a new task.
 func NewTask(cluster *api.Cluster, service *api.Service, slot uint64, nodeID string) *api.Task {
 	var logDriver *api.Driver

vendor/github.com/docker/swarmkit/manager/orchestrator/taskinit/init.go

@@ -4,8 +4,8 @@ import (
 	"time"
 
 	"github.com/docker/swarmkit/api"
+	"github.com/docker/swarmkit/api/defaults"
 	"github.com/docker/swarmkit/log"
-	"github.com/docker/swarmkit/manager/orchestrator"
 	"github.com/docker/swarmkit/manager/orchestrator/restart"
 	"github.com/docker/swarmkit/manager/state/store"
 	gogotypes "github.com/gogo/protobuf/types"
@@ -55,13 +55,13 @@ func CheckTasks(ctx context.Context, s *store.MemoryStore, readTx store.ReadTx,
 			if t.DesiredState != api.TaskStateReady || t.Status.State > api.TaskStateRunning {
 				continue
 			}
-			restartDelay := orchestrator.DefaultRestartDelay
+			restartDelay, _ := gogotypes.DurationFromProto(defaults.Service.Task.Restart.Delay)
 			if t.Spec.Restart != nil && t.Spec.Restart.Delay != nil {
 				var err error
 				restartDelay, err = gogotypes.DurationFromProto(t.Spec.Restart.Delay)
 				if err != nil {
 					log.G(ctx).WithError(err).Error("invalid restart delay")
-					restartDelay = orchestrator.DefaultRestartDelay
+					restartDelay, _ = gogotypes.DurationFromProto(defaults.Service.Task.Restart.Delay)
 				}
 			}
 			if restartDelay != 0 {

vendor/github.com/docker/swarmkit/manager/orchestrator/update/updater.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/docker/go-events"
 	"github.com/docker/swarmkit/api"
+	"github.com/docker/swarmkit/api/defaults"
 	"github.com/docker/swarmkit/log"
 	"github.com/docker/swarmkit/manager/orchestrator"
 	"github.com/docker/swarmkit/manager/orchestrator/restart"
@@ -21,8 +22,6 @@ import (
 	gogotypes "github.com/gogo/protobuf/types"
 )
 
-const defaultMonitor = 5 * time.Second
-
 // Supervisor supervises a set of updates. It's responsible for keeping track of updates,
 // shutting them down and replacing them.
 type Supervisor struct {
@@ -156,14 +155,12 @@ func (u *Updater) Run(ctx context.Context, slots []orchestrator.Slot) {
 		u.startUpdate(ctx, service.ID)
 	}
 
-	var (
-		parallelism            = 1
-		delay                  time.Duration
-		failureAction          = api.UpdateConfig_PAUSE
-		allowedFailureFraction = float32(0)
-		monitoringPeriod       = defaultMonitor
-		order                  = api.UpdateConfig_STOP_FIRST
-	)
+	delay := defaults.Service.Update.Delay
+	parallelism := int(defaults.Service.Update.Parallelism)
+	failureAction := defaults.Service.Update.FailureAction
+	allowedFailureFraction := defaults.Service.Update.MaxFailureRatio
+	monitoringPeriod, _ := gogotypes.DurationFromProto(defaults.Service.Update.Monitor)
+	order := defaults.Service.Update.Order
 
 	updateConfig := service.Spec.Update
 	if service.UpdateStatus != nil && service.UpdateStatus.State == api.UpdateStatus_ROLLBACK_STARTED {
@@ -181,7 +178,7 @@ func (u *Updater) Run(ctx context.Context, slots []orchestrator.Slot) {
 		if updateConfig.Monitor != nil {
 			monitoringPeriod, err = gogotypes.DurationFromProto(updateConfig.Monitor)
 			if err != nil {
-				monitoringPeriod = defaultMonitor
+				monitoringPeriod, _ = gogotypes.DurationFromProto(defaults.Service.Update.Monitor)
 			}
 		}
 	}
@@ -211,7 +208,7 @@ func (u *Updater) Run(ctx context.Context, slots []orchestrator.Slot) {
 			u.store.WatchQueue(),
 			api.EventUpdateTask{
 				Task:   &api.Task{ServiceID: service.ID, Status: api.TaskStatus{State: api.TaskStateRunning}},
-				Checks: []api.TaskCheckFunc{state.TaskCheckServiceID, state.TaskCheckStateGreaterThan},
+				Checks: []api.TaskCheckFunc{api.TaskCheckServiceID, state.TaskCheckStateGreaterThan},
 			},
 		)
 		defer cancelWatch()
@@ -368,7 +365,7 @@ func (u *Updater) updateTask(ctx context.Context, slot orchestrator.Slot, update
 	// Kick off the watch before even creating the updated task. This is in order to avoid missing any event.
 	taskUpdates, cancel := state.Watch(u.watchQueue, api.EventUpdateTask{
 		Task:   &api.Task{ID: updated.ID},
-		Checks: []api.TaskCheckFunc{state.TaskCheckID},
+		Checks: []api.TaskCheckFunc{api.TaskCheckID},
 	})
 	defer cancel()
 

vendor/github.com/docker/swarmkit/manager/state/proposer.go

@@ -5,6 +5,13 @@ import (
 	"golang.org/x/net/context"
 )
 
+// A Change includes a version number and a set of store actions from a
+// particular log entry.
+type Change struct {
+	StoreActions []api.StoreAction
+	Version      api.Version
+}
+
 // A Proposer can propose actions to a cluster.
 type Proposer interface {
 	// ProposeValue adds storeAction to the distributed log. If this
@@ -13,5 +20,11 @@ type Proposer interface {
 	// sure that the changes are committed before it interacts further
 	// with the store.
 	ProposeValue(ctx context.Context, storeAction []api.StoreAction, cb func()) error
+	// GetVersion returns the monotonic index of the most recent item in
+	// the distributed log.
 	GetVersion() *api.Version
+	// ChangesBetween returns the changes starting after "from", up to and
+	// including "to". If these changes are not available because the log
+	// has been compacted, an error will be returned.
+	ChangesBetween(from, to api.Version) ([]Change, error)
 }

vendor/github.com/docker/swarmkit/manager/state/raft/raft.go

@@ -9,22 +9,17 @@ import (
 	"sync/atomic"
 	"time"
 
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/credentials"
-	"google.golang.org/grpc/peer"
-
-	"golang.org/x/net/context"
-
 	"github.com/Sirupsen/logrus"
 	"github.com/coreos/etcd/pkg/idutil"
 	"github.com/coreos/etcd/raft"
 	"github.com/coreos/etcd/raft/raftpb"
+	"github.com/docker/docker/pkg/signal"
 	"github.com/docker/go-events"
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/ca"
 	"github.com/docker/swarmkit/log"
 	"github.com/docker/swarmkit/manager/raftselector"
+	"github.com/docker/swarmkit/manager/state"
 	"github.com/docker/swarmkit/manager/state/raft/membership"
 	"github.com/docker/swarmkit/manager/state/raft/storage"
 	"github.com/docker/swarmkit/manager/state/raft/transport"
@@ -33,6 +28,12 @@ import (
 	"github.com/gogo/protobuf/proto"
 	"github.com/pivotal-golang/clock"
 	"github.com/pkg/errors"
+	"golang.org/x/net/context"
+	"golang.org/x/time/rate"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/peer"
 )
 
 var (
@@ -170,8 +171,10 @@ type NodeOptions struct {
 	// nodes. Leave this as 0 to get the default value.
 	SendTimeout    time.Duration
 	TLSCredentials credentials.TransportCredentials
-
-	KeyRotator EncryptionKeyRotator
+	KeyRotator     EncryptionKeyRotator
+	// DisableStackDump prevents Run from dumping goroutine stacks when the
+	// store becomes stuck.
+	DisableStackDump bool
 }
 
 func init() {
@@ -519,6 +522,7 @@ func (n *Node) Run(ctx context.Context) error {
 	}()
 
 	wasLeader := false
+	transferLeadershipLimit := rate.NewLimiter(rate.Every(time.Minute), 1)
 
 	for {
 		select {
@@ -532,6 +536,22 @@ func (n *Node) Run(ctx context.Context) error {
 				return errors.Wrap(err, "failed to save entries to storage")
 			}
 
+			if wasLeader &&
+				(rd.SoftState == nil || rd.SoftState.RaftState == raft.StateLeader) &&
+				n.memoryStore.Wedged() &&
+				transferLeadershipLimit.Allow() {
+				if !n.opts.DisableStackDump {
+					signal.DumpStacks("")
+				}
+				transferee, err := n.transport.LongestActive()
+				if err != nil {
+					log.G(ctx).WithError(err).Error("failed to get longest-active member")
+				} else {
+					log.G(ctx).Error("data store lock held too long - transferring leadership")
+					n.raftNode.TransferLeadership(ctx, n.Config.ID, transferee)
+				}
+			}
+
 			for _, msg := range rd.Messages {
 				// Send raft messages to peers
 				if err := n.transport.Send(msg); err != nil {
@@ -1434,6 +1454,52 @@ func (n *Node) GetVersion() *api.Version {
 	return &api.Version{Index: status.Commit}
 }
 
+// ChangesBetween returns the changes starting after "from", up to and
+// including "to". If these changes are not available because the log
+// has been compacted, an error will be returned.
+func (n *Node) ChangesBetween(from, to api.Version) ([]state.Change, error) {
+	n.stopMu.RLock()
+	defer n.stopMu.RUnlock()
+
+	if from.Index > to.Index {
+		return nil, errors.New("versions are out of order")
+	}
+
+	if !n.IsMember() {
+		return nil, ErrNoRaftMember
+	}
+
+	// never returns error
+	last, _ := n.raftStore.LastIndex()
+
+	if to.Index > last {
+		return nil, errors.New("last version is out of bounds")
+	}
+
+	pbs, err := n.raftStore.Entries(from.Index+1, to.Index+1, math.MaxUint64)
+	if err != nil {
+		return nil, err
+	}
+
+	var changes []state.Change
+	for _, pb := range pbs {
+		if pb.Type != raftpb.EntryNormal || pb.Data == nil {
+			continue
+		}
+		r := &api.InternalRaftRequest{}
+		err := proto.Unmarshal(pb.Data, r)
+		if err != nil {
+			return nil, errors.Wrap(err, "error umarshalling internal raft request")
+		}
+
+		if r.Action != nil {
+			changes = append(changes, state.Change{StoreActions: r.Action, Version: api.Version{Index: pb.Index}})
+		}
+	}
+
+	return changes, nil
+}
+
 // SubscribePeers subscribes to peer updates in cluster. It sends always full
 // list of peers.
 func (n *Node) SubscribePeers() (q chan events.Event, cancel func()) {

vendor/github.com/docker/swarmkit/manager/state/store/extensions.go

@@ -18,16 +18,16 @@ func init() {
 				indexID: {
 					Name:    indexID,
 					Unique:  true,
-					Indexer: api.ExtensionIndexerByID{},
+					Indexer: extensionIndexerByID{},
 				},
 				indexName: {
 					Name:    indexName,
 					Unique:  true,
-					Indexer: api.ExtensionIndexerByName{},
+					Indexer: extensionIndexerByName{},
 				},
 				indexCustom: {
 					Name:         indexCustom,
-					Indexer:      api.ExtensionCustomIndexer{},
+					Indexer:      extensionCustomIndexer{},
 					AllowMissing: true,
 				},
 			},
@@ -76,6 +76,10 @@ type extensionEntry struct {
 	*api.Extension
 }
 
+func (e extensionEntry) CopyStoreObject() api.StoreObject {
+	return extensionEntry{Extension: e.Extension.Copy()}
+}
+
 // CreateExtension adds a new extension to the store.
 // Returns ErrExist if the ID is already taken.
 func CreateExtension(tx Tx, e *api.Extension) error {
@@ -148,3 +152,39 @@ func FindExtensions(tx ReadTx, by By) ([]*api.Extension, error) {
 	err := tx.find(tableExtension, by, checkType, appendResult)
 	return extensionList, err
 }
+
+type extensionIndexerByID struct{}
+
+func (indexer extensionIndexerByID) FromArgs(args ...interface{}) ([]byte, error) {
+	return api.ExtensionIndexerByID{}.FromArgs(args...)
+}
+func (indexer extensionIndexerByID) PrefixFromArgs(args ...interface{}) ([]byte, error) {
+	return api.ExtensionIndexerByID{}.PrefixFromArgs(args...)
+}
+func (indexer extensionIndexerByID) FromObject(obj interface{}) (bool, []byte, error) {
+	return api.ExtensionIndexerByID{}.FromObject(obj.(extensionEntry).Extension)
+}
+
+type extensionIndexerByName struct{}
+
+func (indexer extensionIndexerByName) FromArgs(args ...interface{}) ([]byte, error) {
+	return api.ExtensionIndexerByName{}.FromArgs(args...)
+}
+func (indexer extensionIndexerByName) PrefixFromArgs(args ...interface{}) ([]byte, error) {
+	return api.ExtensionIndexerByName{}.PrefixFromArgs(args...)
+}
+func (indexer extensionIndexerByName) FromObject(obj interface{}) (bool, []byte, error) {
+	return api.ExtensionIndexerByName{}.FromObject(obj.(extensionEntry).Extension)
+}
+
+type extensionCustomIndexer struct{}
+
+func (indexer extensionCustomIndexer) FromArgs(args ...interface{}) ([]byte, error) {
+	return api.ExtensionCustomIndexer{}.FromArgs(args...)
+}
+func (indexer extensionCustomIndexer) PrefixFromArgs(args ...interface{}) ([]byte, error) {
+	return api.ExtensionCustomIndexer{}.PrefixFromArgs(args...)
+}
+func (indexer extensionCustomIndexer) FromObject(obj interface{}) (bool, [][]byte, error) {
+	return api.ExtensionCustomIndexer{}.FromObject(obj.(extensionEntry).Extension)
+}

vendor/github.com/docker/swarmkit/manager/state/store/memory.go

@@ -7,6 +7,7 @@ import (
 	"strconv"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/docker/go-events"
@@ -70,6 +71,10 @@ var (
 		Tables: map[string]*memdb.TableSchema{},
 	}
 	errUnknownStoreAction = errors.New("unknown store action")
+
+	// WedgeTimeout is the maximum amount of time the store lock may be
+	// held before declaring a suspected deadlock.
+	WedgeTimeout = 30 * time.Second
 )
 
 func register(os ObjectStoreConfig) {
@@ -77,11 +82,36 @@ func register(os ObjectStoreConfig) {
 	schema.Tables[os.Table.Name] = os.Table
 }
 
+// timedMutex wraps a sync.Mutex, and keeps track of how long it has been
+// locked.
+type timedMutex struct {
+	sync.Mutex
+	lockedAt atomic.Value
+}
+
+func (m *timedMutex) Lock() {
+	m.Mutex.Lock()
+	m.lockedAt.Store(time.Now())
+}
+
+func (m *timedMutex) Unlock() {
+	m.Mutex.Unlock()
+	m.lockedAt.Store(time.Time{})
+}
+
+func (m *timedMutex) LockedAt() time.Time {
+	lockedTimestamp := m.lockedAt.Load()
+	if lockedTimestamp == nil {
+		return time.Time{}
+	}
+	return lockedTimestamp.(time.Time)
+}
+
 // MemoryStore is a concurrency-safe, in-memory implementation of the Store
 // interface.
 type MemoryStore struct {
 	// updateLock must be held during an update transaction.
-	updateLock sync.Mutex
+	updateLock timedMutex
 
 	memDB *memdb.MemDB
 	queue *watch.Queue
@@ -180,6 +210,33 @@ type tx struct {
 	changelist []api.Event
 }
 
+// changelistBetweenVersions returns the changes after "from" up to and
+// including "to".
+func (s *MemoryStore) changelistBetweenVersions(from, to api.Version) ([]api.Event, error) {
+	if s.proposer == nil {
+		return nil, errors.New("store does not support versioning")
+	}
+	changes, err := s.proposer.ChangesBetween(from, to)
+	if err != nil {
+		return nil, err
+	}
+
+	var changelist []api.Event
+
+	for _, change := range changes {
+		for _, sa := range change.StoreActions {
+			event, err := api.EventFromStoreAction(sa, nil)
+			if err != nil {
+				return nil, err
+			}
+			changelist = append(changelist, event)
+		}
+		changelist = append(changelist, state.EventCommit{Version: change.Version.Copy()})
+	}
+
+	return changelist, nil
+}
+
 // ApplyStoreActions updates a store based on StoreAction messages.
 func (s *MemoryStore) ApplyStoreActions(actions []api.StoreAction) error {
 	s.updateLock.Lock()
@@ -261,7 +318,11 @@ func (s *MemoryStore) update(proposer state.Proposer, cb func(Tx) error) error {
 			s.queue.Publish(c)
 		}
 		if len(tx.changelist) != 0 {
-			s.queue.Publish(state.EventCommit{})
+			if proposer != nil {
+				curVersion = proposer.GetVersion()
+			}
+
+			s.queue.Publish(state.EventCommit{Version: curVersion})
 		}
 	} else {
 		memDBTx.Abort()
@@ -498,7 +559,7 @@ func (tx *tx) update(table string, o api.StoreObject) error {
 
 	err := tx.memDBTx.Insert(table, copy)
 	if err == nil {
-		tx.changelist = append(tx.changelist, copy.EventUpdate())
+		tx.changelist = append(tx.changelist, copy.EventUpdate(oldN))
 		o.SetMeta(meta)
 	}
 	return err
@@ -755,6 +816,91 @@ func ViewAndWatch(store *MemoryStore, cb func(ReadTx) error, specifiers ...api.E
 	return
 }
 
+// WatchFrom returns a channel that will return past events from starting
+// from "version", and new events until the channel is closed. If "version"
+// is nil, this function is equivalent to
+//
+//     state.Watch(store.WatchQueue(), specifiers...).
+//
+// If the log has been compacted and it's not possible to produce the exact
+// set of events leading from "version" to the current state, this function
+// will return an error, and the caller should re-sync.
+//
+// The watch channel must be released with watch.StopWatch when it is no
+// longer needed.
+func WatchFrom(store *MemoryStore, version *api.Version, specifiers ...api.Event) (chan events.Event, func(), error) {
+	if version == nil {
+		ch, cancel := state.Watch(store.WatchQueue(), specifiers...)
+		return ch, cancel, nil
+	}
+
+	if store.proposer == nil {
+		return nil, nil, errors.New("store does not support versioning")
+	}
+
+	var (
+		curVersion  *api.Version
+		watch       chan events.Event
+		cancelWatch func()
+	)
+	// Using Update to lock the store
+	err := store.Update(func(tx Tx) error {
+		// Get current version
+		curVersion = store.proposer.GetVersion()
+		// Start the watch with the store locked so events cannot be
+		// missed
+		watch, cancelWatch = state.Watch(store.WatchQueue(), specifiers...)
+		return nil
+	})
+	if watch != nil && err != nil {
+		cancelWatch()
+		return nil, nil, err
+	}
+
+	if curVersion == nil {
+		cancelWatch()
+		return nil, nil, errors.New("could not get current version from store")
+	}
+
+	changelist, err := store.changelistBetweenVersions(*version, *curVersion)
+	if err != nil {
+		cancelWatch()
+		return nil, nil, err
+	}
+
+	ch := make(chan events.Event)
+	stop := make(chan struct{})
+	cancel := func() {
+		close(stop)
+	}
+
+	go func() {
+		defer cancelWatch()
+
+		matcher := state.Matcher(specifiers...)
+		for _, change := range changelist {
+			if matcher(change) {
+				select {
+				case ch <- change:
+				case <-stop:
+					return
+				}
+			}
+		}
+
+		for {
+			select {
+			case <-stop:
+				return
+			case e := <-watch:
+				ch <- e
+			}
+		}
+	}()
+
+	return ch, cancel, nil
+}
+
 // touchMeta updates an object's timestamps when necessary and bumps the version
 // if provided.
 func touchMeta(meta *api.Meta, version *api.Version) error {
@@ -780,3 +926,14 @@ func touchMeta(meta *api.Meta, version *api.Version) error {
 
 	return nil
 }
+
+// Wedged returns true if the store lock has been held for a long time,
+// possibly indicating a deadlock.
+func (s *MemoryStore) Wedged() bool {
+	lockedAt := s.updateLock.LockedAt()
+	if lockedAt.IsZero() {
+		return false
+	}
+
+	return time.Since(lockedAt) > WedgeTimeout
+}

vendor/github.com/docker/swarmkit/manager/state/store/resources.go

@@ -16,12 +16,12 @@ func init() {
 				indexID: {
 					Name:    indexID,
 					Unique:  true,
-					Indexer: api.ResourceIndexerByID{},
+					Indexer: resourceIndexerByID{},
 				},
 				indexName: {
 					Name:    indexName,
 					Unique:  true,
-					Indexer: api.ResourceIndexerByName{},
+					Indexer: resourceIndexerByName{},
 				},
 				indexKind: {
 					Name:    indexKind,
@@ -29,7 +29,7 @@ func init() {
 				},
 				indexCustom: {
 					Name:         indexCustom,
-					Indexer:      api.ResourceCustomIndexer{},
+					Indexer:      resourceCustomIndexer{},
 					AllowMissing: true,
 				},
 			},
@@ -78,6 +78,10 @@ type resourceEntry struct {
 	*api.Resource
 }
 
+func (r resourceEntry) CopyStoreObject() api.StoreObject {
+	return resourceEntry{Resource: r.Resource.Copy()}
+}
+
 func confirmExtension(tx Tx, r *api.Resource) error {
 	// There must be an extension corresponding to the Kind field.
 	extensions, err := FindExtensions(tx, ByName(r.Kind))
@@ -157,3 +161,39 @@ func (ri resourceIndexerByKind) FromObject(obj interface{}) (bool, []byte, error
 	val := r.Resource.Kind + "\x00"
 	return true, []byte(val), nil
 }
+
+type resourceIndexerByID struct{}
+
+func (indexer resourceIndexerByID) FromArgs(args ...interface{}) ([]byte, error) {
+	return api.ResourceIndexerByID{}.FromArgs(args...)
+}
+func (indexer resourceIndexerByID) PrefixFromArgs(args ...interface{}) ([]byte, error) {
+	return api.ResourceIndexerByID{}.PrefixFromArgs(args...)
+}
+func (indexer resourceIndexerByID) FromObject(obj interface{}) (bool, []byte, error) {
+	return api.ResourceIndexerByID{}.FromObject(obj.(resourceEntry).Resource)
+}
+
+type resourceIndexerByName struct{}
+
+func (indexer resourceIndexerByName) FromArgs(args ...interface{}) ([]byte, error) {
+	return api.ResourceIndexerByName{}.FromArgs(args...)
+}
+func (indexer resourceIndexerByName) PrefixFromArgs(args ...interface{}) ([]byte, error) {
+	return api.ResourceIndexerByName{}.PrefixFromArgs(args...)
+}
+func (indexer resourceIndexerByName) FromObject(obj interface{}) (bool, []byte, error) {
+	return api.ResourceIndexerByName{}.FromObject(obj.(resourceEntry).Resource)
+}
+
+type resourceCustomIndexer struct{}
+
+func (indexer resourceCustomIndexer) FromArgs(args ...interface{}) ([]byte, error) {
+	return api.ResourceCustomIndexer{}.FromArgs(args...)
+}
+func (indexer resourceCustomIndexer) PrefixFromArgs(args ...interface{}) ([]byte, error) {
+	return api.ResourceCustomIndexer{}.PrefixFromArgs(args...)
+}
+func (indexer resourceCustomIndexer) FromObject(obj interface{}) (bool, [][]byte, error) {
+	return api.ResourceCustomIndexer{}.FromObject(obj.(resourceEntry).Resource)
+}

vendor/github.com/docker/swarmkit/manager/state/watch.go

@@ -7,7 +7,9 @@ import (
 )
 
 // EventCommit delineates a transaction boundary.
-type EventCommit struct{}
+type EventCommit struct {
+	Version *api.Version
+}
 
 // Matches returns true if this event is a commit event.
 func (e EventCommit) Matches(watchEvent events.Event) bool {
@@ -15,76 +17,16 @@ func (e EventCommit) Matches(watchEvent events.Event) bool {
 	return ok
 }
 
-// TaskCheckID is a TaskCheckFunc for matching task IDs.
-func TaskCheckID(t1, t2 *api.Task) bool {
-	return t1.ID == t2.ID
-}
-
-// TaskCheckNodeID is a TaskCheckFunc for matching node IDs.
-func TaskCheckNodeID(t1, t2 *api.Task) bool {
-	return t1.NodeID == t2.NodeID
-}
-
-// TaskCheckServiceID is a TaskCheckFunc for matching service IDs.
-func TaskCheckServiceID(t1, t2 *api.Task) bool {
-	return t1.ServiceID == t2.ServiceID
-}
-
 // TaskCheckStateGreaterThan is a TaskCheckFunc for checking task state.
 func TaskCheckStateGreaterThan(t1, t2 *api.Task) bool {
 	return t2.Status.State > t1.Status.State
 }
 
-// ServiceCheckID is a ServiceCheckFunc for matching service IDs.
-func ServiceCheckID(j1, j2 *api.Service) bool {
-	return j1.ID == j2.ID
-}
-
-// NetworkCheckID is a NetworkCheckFunc for matching network IDs.
-func NetworkCheckID(n1, n2 *api.Network) bool {
-	return n1.ID == n2.ID
-}
-
-// NodeCheckID is a NodeCheckFunc for matching node IDs.
-func NodeCheckID(n1, n2 *api.Node) bool {
-	return n1.ID == n2.ID
-}
-
 // NodeCheckState is a NodeCheckFunc for matching node state.
 func NodeCheckState(n1, n2 *api.Node) bool {
 	return n1.Status.State == n2.Status.State
 }
 
-// ClusterCheckID is a ClusterCheckFunc for matching volume IDs.
-func ClusterCheckID(v1, v2 *api.Cluster) bool {
-	return v1.ID == v2.ID
-}
-
-// SecretCheckID is a SecretCheckFunc for matching secret IDs.
-func SecretCheckID(v1, v2 *api.Secret) bool {
-	return v1.ID == v2.ID
-}
-
-// ResourceCheckID is a ResourceCheckFunc for matching resource IDs.
-func ResourceCheckID(v1, v2 *api.Resource) bool {
-	return v1.ID == v2.ID
-}
-
-// ResourceCheckKind is a ResourceCheckFunc for matching resource kinds.
-func ResourceCheckKind(v1, v2 *api.Resource) bool {
-	return v1.Kind == v2.Kind
-}
-
-// ExtensionCheckID is a ExtensionCheckFunc for matching extension IDs.
-func ExtensionCheckID(v1, v2 *api.Extension) bool {
-	return v1.ID == v2.ID
-}
-
-// ExtensionCheckName is a ExtensionCheckFunc for matching extension names names.
-func ExtensionCheckName(v1, v2 *api.Extension) bool {
-	return v1.Annotations.Name == v2.Annotations.Name
-}
-
 // Watch takes a variable number of events to match against. The subscriber
 // will receive events that match any of the arguments passed to Watch.
 //

vendor/github.com/docker/swarmkit/manager/storeapi/server.go

@@ -0,0 +1,17 @@
+package storeapi
+
+import (
+	"github.com/docker/swarmkit/manager/state/store"
+)
+
+// Server is the store API gRPC server.
+type Server struct {
+	store *store.MemoryStore
+}
+
+// NewServer creates a store API server.
+func NewServer(store *store.MemoryStore) *Server {
+	return &Server{
+		store: store,
+	}
+}

vendor/github.com/docker/swarmkit/manager/storeapi/watch.go

@@ -0,0 +1,56 @@
+package storeapi
+
+import (
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+
+	"github.com/docker/swarmkit/api"
+	"github.com/docker/swarmkit/manager/state"
+	"github.com/docker/swarmkit/manager/state/store"
+)
+
+// Watch starts a stream that returns any changes to objects that match
+// the specified selectors. When the stream begins, it immediately sends
+// an empty message back to the client. It is important to wait for
+// this message before taking any actions that depend on an established
+// stream of changes for consistency.
+func (s *Server) Watch(request *api.WatchRequest, stream api.Store_WatchServer) error {
+	ctx := stream.Context()
+
+	watchArgs, err := api.ConvertWatchArgs(request.Entries)
+	if err != nil {
+		return grpc.Errorf(codes.InvalidArgument, "%s", err.Error())
+	}
+
+	watchArgs = append(watchArgs, state.EventCommit{})
+	watch, cancel, err := store.WatchFrom(s.store, request.ResumeFrom, watchArgs...)
+	if err != nil {
+		return err
+	}
+	defer cancel()
+
+	// TODO(aaronl): Send current version in this WatchMessage?
+	if err := stream.Send(&api.WatchMessage{}); err != nil {
+		return err
+	}
+
+	var events []*api.WatchMessage_Event
+	for {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case event := <-watch:
+			if commitEvent, ok := event.(state.EventCommit); ok && len(events) > 0 {
+				if err := stream.Send(&api.WatchMessage{Events: events, Version: commitEvent.Version}); err != nil {
+					return err
+				}
+				events = nil
+			} else if eventMessage := api.WatchMessageEvent(event.(api.Event)); eventMessage != nil {
+				if !request.IncludeOldObject {
+					eventMessage.OldObject = nil
+				}
+				events = append(events, eventMessage)
+			}
+		}
+	}
+}

vendor/github.com/docker/swarmkit/protobuf/plugin/plugin.pb.go

@@ -9,6 +9,7 @@
 		plugin.proto
 
 	It has these top-level messages:
+		WatchSelectors
 		StoreObject
 		TLSAuthorization
 */
@@ -19,6 +20,8 @@ import fmt "fmt"
 import math "math"
 import google_protobuf "github.com/gogo/protobuf/protoc-gen-gogo/descriptor"
 
+import github_com_gogo_protobuf_proto "github.com/gogo/protobuf/proto"
+
 import strings "strings"
 import reflect "reflect"
 
@@ -35,13 +38,39 @@ var _ = math.Inf
 // proto package needs to be updated.
 const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
 
-type StoreObject struct {
+type WatchSelectors struct {
+	// supported by all object types
+	ID           *bool `protobuf:"varint,1,opt,name=id" json:"id,omitempty"`
+	IDPrefix     *bool `protobuf:"varint,2,opt,name=id_prefix,json=idPrefix" json:"id_prefix,omitempty"`
+	Name         *bool `protobuf:"varint,3,opt,name=name" json:"name,omitempty"`
+	NamePrefix   *bool `protobuf:"varint,4,opt,name=name_prefix,json=namePrefix" json:"name_prefix,omitempty"`
+	Custom       *bool `protobuf:"varint,5,opt,name=custom" json:"custom,omitempty"`
+	CustomPrefix *bool `protobuf:"varint,6,opt,name=custom_prefix,json=customPrefix" json:"custom_prefix,omitempty"`
+	// supported by tasks only
+	ServiceID    *bool `protobuf:"varint,7,opt,name=service_id,json=serviceId" json:"service_id,omitempty"`
+	NodeID       *bool `protobuf:"varint,8,opt,name=node_id,json=nodeId" json:"node_id,omitempty"`
+	Slot         *bool `protobuf:"varint,9,opt,name=slot" json:"slot,omitempty"`
+	DesiredState *bool `protobuf:"varint,10,opt,name=desired_state,json=desiredState" json:"desired_state,omitempty"`
+	// supported by nodes only
+	Role       *bool `protobuf:"varint,11,opt,name=role" json:"role,omitempty"`
+	Membership *bool `protobuf:"varint,12,opt,name=membership" json:"membership,omitempty"`
+	// supported by: resource
+	Kind             *bool  `protobuf:"varint,13,opt,name=kind" json:"kind,omitempty"`
 	XXX_unrecognized []byte `json:"-"`
 }
 
+func (m *WatchSelectors) Reset()                    { *m = WatchSelectors{} }
+func (*WatchSelectors) ProtoMessage()               {}
+func (*WatchSelectors) Descriptor() ([]byte, []int) { return fileDescriptorPlugin, []int{0} }
+
+type StoreObject struct {
+	WatchSelectors   *WatchSelectors `protobuf:"bytes,1,req,name=watch_selectors,json=watchSelectors" json:"watch_selectors,omitempty"`
+	XXX_unrecognized []byte          `json:"-"`
+}
+
 func (m *StoreObject) Reset()                    { *m = StoreObject{} }
 func (*StoreObject) ProtoMessage()               {}
-func (*StoreObject) Descriptor() ([]byte, []int) { return fileDescriptorPlugin, []int{0} }
+func (*StoreObject) Descriptor() ([]byte, []int) { return fileDescriptorPlugin, []int{1} }
 
 type TLSAuthorization struct {
 	// Roles contains the acceptable TLS OU roles for the handler.
@@ -55,7 +84,7 @@ type TLSAuthorization struct {
 
 func (m *TLSAuthorization) Reset()                    { *m = TLSAuthorization{} }
 func (*TLSAuthorization) ProtoMessage()               {}
-func (*TLSAuthorization) Descriptor() ([]byte, []int) { return fileDescriptorPlugin, []int{1} }
+func (*TLSAuthorization) Descriptor() ([]byte, []int) { return fileDescriptorPlugin, []int{2} }
 
 var E_Deepcopy = &proto.ExtensionDesc{
 	ExtendedType:  (*google_protobuf.MessageOptions)(nil),
@@ -82,12 +111,164 @@ var E_TlsAuthorization = &proto.ExtensionDesc{
 }
 
 func init() {
+	proto.RegisterType((*WatchSelectors)(nil), "docker.protobuf.plugin.WatchSelectors")
 	proto.RegisterType((*StoreObject)(nil), "docker.protobuf.plugin.StoreObject")
 	proto.RegisterType((*TLSAuthorization)(nil), "docker.protobuf.plugin.TLSAuthorization")
 	proto.RegisterExtension(E_Deepcopy)
 	proto.RegisterExtension(E_StoreObject)
 	proto.RegisterExtension(E_TlsAuthorization)
 }
+func (m *WatchSelectors) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WatchSelectors) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if m.ID != nil {
+		dAtA[i] = 0x8
+		i++
+		if *m.ID {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i++
+	}
+	if m.IDPrefix != nil {
+		dAtA[i] = 0x10
+		i++
+		if *m.IDPrefix {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i++
+	}
+	if m.Name != nil {
+		dAtA[i] = 0x18
+		i++
+		if *m.Name {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i++
+	}
+	if m.NamePrefix != nil {
+		dAtA[i] = 0x20
+		i++
+		if *m.NamePrefix {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i++
+	}
+	if m.Custom != nil {
+		dAtA[i] = 0x28
+		i++
+		if *m.Custom {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i++
+	}
+	if m.CustomPrefix != nil {
+		dAtA[i] = 0x30
+		i++
+		if *m.CustomPrefix {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i++
+	}
+	if m.ServiceID != nil {
+		dAtA[i] = 0x38
+		i++
+		if *m.ServiceID {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i++
+	}
+	if m.NodeID != nil {
+		dAtA[i] = 0x40
+		i++
+		if *m.NodeID {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i++
+	}
+	if m.Slot != nil {
+		dAtA[i] = 0x48
+		i++
+		if *m.Slot {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i++
+	}
+	if m.DesiredState != nil {
+		dAtA[i] = 0x50
+		i++
+		if *m.DesiredState {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i++
+	}
+	if m.Role != nil {
+		dAtA[i] = 0x58
+		i++
+		if *m.Role {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i++
+	}
+	if m.Membership != nil {
+		dAtA[i] = 0x60
+		i++
+		if *m.Membership {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i++
+	}
+	if m.Kind != nil {
+		dAtA[i] = 0x68
+		i++
+		if *m.Kind {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i++
+	}
+	if m.XXX_unrecognized != nil {
+		i += copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	return i, nil
+}
+
 func (m *StoreObject) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -103,6 +284,18 @@ func (m *StoreObject) MarshalTo(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if m.WatchSelectors == nil {
+		return 0, github_com_gogo_protobuf_proto.NewRequiredNotSetError("watch_selectors")
+	} else {
+		dAtA[i] = 0xa
+		i++
+		i = encodeVarintPlugin(dAtA, i, uint64(m.WatchSelectors.Size()))
+		n1, err := m.WatchSelectors.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n1
+	}
 	if m.XXX_unrecognized != nil {
 		i += copy(dAtA[i:], m.XXX_unrecognized)
 	}
@@ -182,9 +375,61 @@ func encodeVarintPlugin(dAtA []byte, offset int, v uint64) int {
 	dAtA[offset] = uint8(v)
 	return offset + 1
 }
+func (m *WatchSelectors) Size() (n int) {
+	var l int
+	_ = l
+	if m.ID != nil {
+		n += 2
+	}
+	if m.IDPrefix != nil {
+		n += 2
+	}
+	if m.Name != nil {
+		n += 2
+	}
+	if m.NamePrefix != nil {
+		n += 2
+	}
+	if m.Custom != nil {
+		n += 2
+	}
+	if m.CustomPrefix != nil {
+		n += 2
+	}
+	if m.ServiceID != nil {
+		n += 2
+	}
+	if m.NodeID != nil {
+		n += 2
+	}
+	if m.Slot != nil {
+		n += 2
+	}
+	if m.DesiredState != nil {
+		n += 2
+	}
+	if m.Role != nil {
+		n += 2
+	}
+	if m.Membership != nil {
+		n += 2
+	}
+	if m.Kind != nil {
+		n += 2
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *StoreObject) Size() (n int) {
 	var l int
 	_ = l
+	if m.WatchSelectors != nil {
+		l = m.WatchSelectors.Size()
+		n += 1 + l + sovPlugin(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -222,11 +467,35 @@ func sovPlugin(x uint64) (n int) {
 func sozPlugin(x uint64) (n int) {
 	return sovPlugin(uint64((x << 1) ^ uint64((int64(x) >> 63))))
 }
+func (this *WatchSelectors) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WatchSelectors{`,
+		`ID:` + valueToStringPlugin(this.ID) + `,`,
+		`IDPrefix:` + valueToStringPlugin(this.IDPrefix) + `,`,
+		`Name:` + valueToStringPlugin(this.Name) + `,`,
+		`NamePrefix:` + valueToStringPlugin(this.NamePrefix) + `,`,
+		`Custom:` + valueToStringPlugin(this.Custom) + `,`,
+		`CustomPrefix:` + valueToStringPlugin(this.CustomPrefix) + `,`,
+		`ServiceID:` + valueToStringPlugin(this.ServiceID) + `,`,
+		`NodeID:` + valueToStringPlugin(this.NodeID) + `,`,
+		`Slot:` + valueToStringPlugin(this.Slot) + `,`,
+		`DesiredState:` + valueToStringPlugin(this.DesiredState) + `,`,
+		`Role:` + valueToStringPlugin(this.Role) + `,`,
+		`Membership:` + valueToStringPlugin(this.Membership) + `,`,
+		`Kind:` + valueToStringPlugin(this.Kind) + `,`,
+		`XXX_unrecognized:` + fmt.Sprintf("%v", this.XXX_unrecognized) + `,`,
+		`}`,
+	}, "")
+	return s
+}
 func (this *StoreObject) String() string {
 	if this == nil {
 		return "nil"
 	}
 	s := strings.Join([]string{`&StoreObject{`,
+		`WatchSelectors:` + strings.Replace(fmt.Sprintf("%v", this.WatchSelectors), "WatchSelectors", "WatchSelectors", 1) + `,`,
 		`XXX_unrecognized:` + fmt.Sprintf("%v", this.XXX_unrecognized) + `,`,
 		`}`,
 	}, "")
@@ -252,7 +521,332 @@ func valueToStringPlugin(v interface{}) string {
 	pv := reflect.Indirect(rv).Interface()
 	return fmt.Sprintf("*%v", pv)
 }
+func (m *WatchSelectors) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowPlugin
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WatchSelectors: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WatchSelectors: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowPlugin
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.ID = &b
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IDPrefix", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowPlugin
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.IDPrefix = &b
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowPlugin
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.Name = &b
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NamePrefix", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowPlugin
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.NamePrefix = &b
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Custom", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowPlugin
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.Custom = &b
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CustomPrefix", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowPlugin
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.CustomPrefix = &b
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServiceID", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowPlugin
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.ServiceID = &b
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeID", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowPlugin
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.NodeID = &b
+		case 9:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Slot", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowPlugin
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.Slot = &b
+		case 10:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DesiredState", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowPlugin
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.DesiredState = &b
+		case 11:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Role", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowPlugin
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.Role = &b
+		case 12:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Membership", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowPlugin
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.Membership = &b
+		case 13:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowPlugin
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.Kind = &b
+		default:
+			iNdEx = preIndex
+			skippy, err := skipPlugin(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthPlugin
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *StoreObject) Unmarshal(dAtA []byte) error {
+	var hasFields [1]uint64
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -281,6 +875,40 @@ func (m *StoreObject) Unmarshal(dAtA []byte) error {
 			return fmt.Errorf("proto: StoreObject: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WatchSelectors", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowPlugin
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthPlugin
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.WatchSelectors == nil {
+				m.WatchSelectors = &WatchSelectors{}
+			}
+			if err := m.WatchSelectors.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+			hasFields[0] |= uint64(0x00000001)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipPlugin(dAtA[iNdEx:])
@@ -297,6 +925,9 @@ func (m *StoreObject) Unmarshal(dAtA []byte) error {
 			iNdEx += skippy
 		}
 	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return github_com_gogo_protobuf_proto.NewRequiredNotSetError("watch_selectors")
+	}
 
 	if iNdEx > l {
 		return io.ErrUnexpectedEOF
@@ -512,24 +1143,40 @@ var (
 func init() { proto.RegisterFile("plugin.proto", fileDescriptorPlugin) }
 
 var fileDescriptorPlugin = []byte{
-	// 296 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xe2, 0xe2, 0x29, 0xc8, 0x29, 0x4d,
-	0xcf, 0xcc, 0xd3, 0x2b, 0x28, 0xca, 0x2f, 0xc9, 0x17, 0x12, 0x4b, 0xc9, 0x4f, 0xce, 0x4e, 0x2d,
-	0x82, 0xf0, 0x92, 0x4a, 0xd3, 0xf4, 0x20, 0xb2, 0x52, 0x0a, 0xe9, 0xf9, 0xf9, 0xe9, 0x39, 0xa9,
-	0xfa, 0x30, 0x71, 0xfd, 0x94, 0xd4, 0xe2, 0xe4, 0xa2, 0xcc, 0x82, 0x92, 0x7c, 0xa8, 0x5a, 0x25,
-	0x5e, 0x2e, 0xee, 0xe0, 0x92, 0xfc, 0xa2, 0x54, 0xff, 0xa4, 0xac, 0xd4, 0xe4, 0x12, 0x25, 0x17,
-	0x2e, 0x81, 0x10, 0x9f, 0x60, 0xc7, 0xd2, 0x92, 0x8c, 0xfc, 0xa2, 0xcc, 0xaa, 0xc4, 0x92, 0xcc,
-	0xfc, 0x3c, 0x21, 0x11, 0x2e, 0xd6, 0xa2, 0xfc, 0x9c, 0xd4, 0x62, 0x09, 0x46, 0x05, 0x66, 0x0d,
-	0xce, 0x20, 0x08, 0x47, 0x48, 0x8a, 0x8b, 0x23, 0x33, 0xaf, 0x38, 0x35, 0xb9, 0xb4, 0x28, 0x55,
-	0x82, 0x49, 0x81, 0x51, 0x83, 0x23, 0x08, 0xce, 0xb7, 0x72, 0xe6, 0xe2, 0x48, 0x49, 0x4d, 0x2d,
-	0x48, 0xce, 0x2f, 0xa8, 0x14, 0x92, 0xd7, 0x83, 0xb8, 0x01, 0xe1, 0x36, 0xdf, 0xd4, 0xe2, 0xe2,
-	0xc4, 0xf4, 0x54, 0xff, 0x02, 0x90, 0xe9, 0xc5, 0x12, 0x1f, 0x16, 0xb1, 0x80, 0xb4, 0x5b, 0xb1,
-	0x94, 0x14, 0x95, 0xa6, 0x06, 0xc1, 0x35, 0x5a, 0x65, 0x72, 0xf1, 0x14, 0x83, 0x5c, 0x16, 0x9f,
-	0x0f, 0x76, 0x1a, 0x61, 0x83, 0x3e, 0x82, 0x0d, 0xe2, 0x36, 0x52, 0xd6, 0xc3, 0x1e, 0x1a, 0x7a,
-	0x48, 0x1e, 0x0d, 0xe2, 0x2e, 0x46, 0x70, 0xac, 0x2a, 0xb8, 0x04, 0x4b, 0x72, 0x8a, 0xe3, 0x13,
-	0x51, 0xbc, 0x2d, 0x87, 0xc5, 0xbe, 0x92, 0x8c, 0xfc, 0x14, 0x98, 0x75, 0x2f, 0x9f, 0xf6, 0x2a,
-	0x83, 0xed, 0xd3, 0xc0, 0x65, 0x1f, 0x7a, 0x48, 0x06, 0x09, 0x94, 0xe4, 0x14, 0xa3, 0x88, 0x38,
-	0x49, 0x9c, 0x78, 0x28, 0xc7, 0x70, 0xe3, 0xa1, 0x1c, 0x43, 0xc3, 0x23, 0x39, 0xc6, 0x13, 0x8f,
-	0xe4, 0x18, 0x2f, 0x3c, 0x92, 0x63, 0x7c, 0xf0, 0x48, 0x8e, 0x11, 0x10, 0x00, 0x00, 0xff, 0xff,
-	0xc2, 0x49, 0xd6, 0x3b, 0xe1, 0x01, 0x00, 0x00,
+	// 551 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x84, 0x52, 0xc1, 0x6e, 0xd3, 0x40,
+	0x10, 0xad, 0xd3, 0x36, 0x4d, 0xc6, 0x69, 0x29, 0x2b, 0x54, 0xad, 0x7a, 0xb0, 0xab, 0x46, 0x42,
+	0x41, 0x42, 0xa9, 0xd4, 0x63, 0x6e, 0x94, 0x5c, 0x22, 0x01, 0x45, 0x0e, 0x12, 0x37, 0x2c, 0xd7,
+	0x3b, 0x4d, 0x96, 0x3a, 0x5e, 0x6b, 0x77, 0x4d, 0x0b, 0x27, 0x7e, 0x80, 0x0f, 0xe0, 0xca, 0xd7,
+	0xf4, 0xc8, 0x91, 0x53, 0x44, 0x2d, 0x71, 0xe0, 0x06, 0x7f, 0x80, 0x76, 0xd7, 0x69, 0x09, 0x6a,
+	0xc5, 0xc9, 0x33, 0x6f, 0xe6, 0xcd, 0xcc, 0xdb, 0x67, 0xe8, 0x14, 0x59, 0x39, 0xe1, 0x79, 0xbf,
+	0x90, 0x42, 0x0b, 0xb2, 0xc3, 0x44, 0x7a, 0x86, 0xd2, 0x65, 0x27, 0xe5, 0x69, 0xdf, 0x55, 0x77,
+	0xf7, 0x26, 0x42, 0x4c, 0x32, 0x3c, 0x58, 0xe0, 0x07, 0x0c, 0x55, 0x2a, 0x79, 0xa1, 0x45, 0xdd,
+	0xbb, 0xff, 0x79, 0x15, 0xb6, 0x5e, 0x27, 0x3a, 0x9d, 0x8e, 0x31, 0xc3, 0x54, 0x0b, 0xa9, 0xc8,
+	0x0e, 0x34, 0x38, 0xa3, 0xde, 0x9e, 0xd7, 0x6b, 0x1d, 0x35, 0xab, 0x79, 0xd8, 0x18, 0x0d, 0xa3,
+	0x06, 0x67, 0xe4, 0x11, 0xb4, 0x39, 0x8b, 0x0b, 0x89, 0xa7, 0xfc, 0x82, 0x36, 0x6c, 0xb9, 0x53,
+	0xcd, 0xc3, 0xd6, 0x68, 0xf8, 0xd2, 0x62, 0x51, 0x8b, 0x33, 0x17, 0x11, 0x02, 0x6b, 0x79, 0x32,
+	0x43, 0xba, 0x6a, 0xba, 0x22, 0x1b, 0x93, 0x10, 0x7c, 0xf3, 0x5d, 0x0c, 0x58, 0xb3, 0x25, 0x30,
+	0x50, 0x4d, 0xda, 0x81, 0x66, 0x5a, 0x2a, 0x2d, 0x66, 0x74, 0xdd, 0xd6, 0xea, 0x8c, 0x74, 0x61,
+	0xd3, 0x45, 0x0b, 0x6a, 0xd3, 0x96, 0x3b, 0x0e, 0xac, 0xc9, 0x8f, 0x01, 0x14, 0xca, 0x77, 0x3c,
+	0xc5, 0x98, 0x33, 0xba, 0x61, 0xaf, 0xdb, 0xac, 0xe6, 0x61, 0x7b, 0xec, 0xd0, 0xd1, 0x30, 0x6a,
+	0xd7, 0x0d, 0x23, 0x46, 0xba, 0xb0, 0x91, 0x0b, 0x66, 0x5b, 0x5b, 0xb6, 0x15, 0xaa, 0x79, 0xd8,
+	0x7c, 0x21, 0x98, 0xe9, 0x6b, 0x9a, 0xd2, 0x88, 0x19, 0x11, 0x2a, 0x13, 0x9a, 0xb6, 0x9d, 0x08,
+	0x13, 0x9b, 0x5b, 0x18, 0x2a, 0x2e, 0x91, 0xc5, 0x4a, 0x27, 0x1a, 0x29, 0xb8, 0x5b, 0x6a, 0x70,
+	0x6c, 0x30, 0x43, 0x94, 0x22, 0x43, 0xea, 0x3b, 0xa2, 0x89, 0x49, 0x00, 0x30, 0xc3, 0xd9, 0x09,
+	0x4a, 0x35, 0xe5, 0x05, 0xed, 0x38, 0xf1, 0x37, 0x88, 0xe1, 0x9c, 0xf1, 0x9c, 0xd1, 0x4d, 0xc7,
+	0x31, 0xf1, 0xfe, 0x1b, 0xf0, 0xc7, 0x5a, 0x48, 0x3c, 0x3e, 0x79, 0x8b, 0xa9, 0x26, 0xc7, 0x70,
+	0xef, 0xdc, 0x38, 0x15, 0xab, 0x85, 0x55, 0xd4, 0xdb, 0x6b, 0xf4, 0xfc, 0xc3, 0x87, 0xfd, 0xdb,
+	0xed, 0xef, 0x2f, 0x1b, 0x1b, 0x6d, 0x9d, 0x2f, 0xe5, 0xfb, 0x43, 0xd8, 0x7e, 0xf5, 0x6c, 0xfc,
+	0xa4, 0xd4, 0x53, 0x21, 0xf9, 0x87, 0x44, 0x73, 0x91, 0x93, 0x07, 0xb0, 0x6e, 0xee, 0x35, 0xa3,
+	0x57, 0x7b, 0xed, 0xc8, 0x25, 0x64, 0x17, 0x5a, 0x3c, 0x57, 0x98, 0x96, 0x12, 0x9d, 0xf3, 0xd1,
+	0x75, 0x3e, 0x78, 0x0a, 0x2d, 0x86, 0x58, 0xa4, 0xa2, 0x78, 0x4f, 0xc2, 0xbe, 0xfb, 0xe1, 0x6e,
+	0x2e, 0x79, 0x8e, 0x4a, 0x25, 0x13, 0x3c, 0x2e, 0xcc, 0x74, 0x45, 0x7f, 0x7d, 0xb1, 0xbe, 0x0f,
+	0xd6, 0xb4, 0x2c, 0x31, 0xba, 0x26, 0x0e, 0x38, 0x74, 0x94, 0x91, 0x1a, 0x0b, 0xa7, 0xf5, 0xbf,
+	0x83, 0x7e, 0xdb, 0x41, 0xfe, 0x61, 0xf7, 0x2e, 0xed, 0x7f, 0xbd, 0x5c, 0xe4, 0xab, 0x9b, 0x64,
+	0x70, 0x01, 0xf7, 0x75, 0xa6, 0xe2, 0x64, 0x49, 0x76, 0x70, 0xcb, 0x3e, 0x3d, 0x15, 0x6c, 0xb1,
+	0xee, 0xe7, 0x8f, 0x4f, 0x5d, 0xbb, 0xaf, 0x77, 0xd7, 0xbe, 0x7f, 0x5f, 0x32, 0xda, 0xd6, 0x99,
+	0x5a, 0x42, 0x8e, 0xe8, 0xe5, 0x55, 0xb0, 0xf2, 0xed, 0x2a, 0x58, 0xf9, 0x58, 0x05, 0xde, 0x65,
+	0x15, 0x78, 0x5f, 0xab, 0xc0, 0xfb, 0x5e, 0x05, 0xde, 0x9f, 0x00, 0x00, 0x00, 0xff, 0xff, 0x94,
+	0xd6, 0x21, 0x73, 0xce, 0x03, 0x00, 0x00,
 }

vendor/github.com/docker/swarmkit/protobuf/plugin/plugin.proto

@@ -4,7 +4,31 @@ package docker.protobuf.plugin;
 
 import "google/protobuf/descriptor.proto";
 
+message WatchSelectors {
+	// supported by all object types
+	optional bool id = 1;
+	optional bool id_prefix = 2;
+	optional bool name = 3;
+	optional bool name_prefix = 4;
+	optional bool custom = 5;
+	optional bool custom_prefix = 6;
+
+	// supported by tasks only
+	optional bool service_id = 7;
+	optional bool node_id = 8;
+	optional bool slot = 9;
+	optional bool desired_state = 10;
+
+	// supported by nodes only
+	optional bool role = 11;
+	optional bool membership = 12;
+
+	// supported by: resource
+	optional bool kind = 13;
+}
+
 message StoreObject {
+	required WatchSelectors watch_selectors = 1;
 }
 
 extend google.protobuf.MessageOptions {