diff --git a/encoding/protobuf/examples_test.go b/encoding/protobuf/examples_test.go
index 8d12d4d..08b3e68 100644
--- a/encoding/protobuf/examples_test.go
+++ b/encoding/protobuf/examples_test.go
@@ -42,14 +42,14 @@
 	fmt.Println(string(b))
 
 	// Output:
-	// //  Package basic is just that: basic.
+	// // Package basic is just that: basic.
 	// package basic
 	//
-	// //  This is my type.
+	// // This is my type.
 	// MyType: {
-	// 	stringValue?: string @protobuf(1,name=string_value) //  just any 'ole string
+	// 	stringValue?: string @protobuf(1,name=string_value) // just any 'ole string
 	//
-	// 	//  A method must start with a capital letter.
+	// 	// A method must start with a capital letter.
 	// 	method?: [...string] @protobuf(2)
 	// 	method?: [...=~"^[A-Z]"]
 	// }
diff --git a/encoding/protobuf/protobuf.go b/encoding/protobuf/protobuf.go
index 0baed41..ee3cde3 100644
--- a/encoding/protobuf/protobuf.go
+++ b/encoding/protobuf/protobuf.go
@@ -61,7 +61,7 @@
 //   StringValue    string           See struct.proto.
 //   NumberValue    number           See struct.proto.
 //   StringValue    string           See struct.proto.
-//   Empty          struct.MaxFields(0)
+//   Empty          close({})
 //   Timestamp      time.Time        See struct.proto.
 //   Duration       time.Duration    See struct.proto.
 //
diff --git a/encoding/protobuf/testdata/attributes.proto.out.cue b/encoding/protobuf/testdata/attributes.proto.out.cue
index 4911be4..e75dd01 100644
--- a/encoding/protobuf/testdata/attributes.proto.out.cue
+++ b/encoding/protobuf/testdata/attributes.proto.out.cue
@@ -1,17 +1,17 @@
 
-//  Copyright 2016 Istio Authors
-// 
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-// 
-//      http://www.apache.org/licenses/LICENSE-2.0
-// 
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
+// Copyright 2016 Istio Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 package v1
 
 import (
@@ -29,57 +29,57 @@
 	numberVal?: number @protobuf(6,type=google.protobuf.NumberValue)
 }
 
-//  Attributes represents a set of typed name/value pairs. Many of Mixer's
-//  API either consume and/or return attributes.
-// 
-//  Istio uses attributes to control the runtime behavior of services running in the service mesh.
-//  Attributes are named and typed pieces of metadata describing ingress and egress traffic and the
-//  environment this traffic occurs in. An Istio attribute carries a specific piece
-//  of information such as the error code of an API request, the latency of an API request, or the
-//  original IP address of a TCP connection. For example:
-// 
-//  ```yaml
-//  request.path: xyz/abc
-//  request.size: 234
-//  request.time: 12:34:56.789 04/17/2017
-//  source.ip: 192.168.0.1
-//  target.service: example
-//  ```
-// 
+// Attributes represents a set of typed name/value pairs. Many of Mixer's
+// API either consume and/or return attributes.
+//
+// Istio uses attributes to control the runtime behavior of services running in the service mesh.
+// Attributes are named and typed pieces of metadata describing ingress and egress traffic and the
+// environment this traffic occurs in. An Istio attribute carries a specific piece
+// of information such as the error code of an API request, the latency of an API request, or the
+// original IP address of a TCP connection. For example:
+//
+// ```yaml
+// request.path: xyz/abc
+// request.size: 234
+// request.time: 12:34:56.789 04/17/2017
+// source.ip: 192.168.0.1
+// target.service: example
+// ```
+//
 Attributes: {
-	//  A map of attribute name to its value.
+	// A map of attribute name to its value.
 	attributes: {
 		<_>: Attributes_AttributeValue
 	} @protobuf(1,type=map<string,AttributeValue>)
 }
 
-//  Specifies one attribute value with different type.
+// Specifies one attribute value with different type.
 Attributes_AttributeValue: {
 }
-//  The attribute value.
+// The attribute value.
 Attributes_AttributeValue: {
-	//  Used for values of type STRING, DNS_NAME, EMAIL_ADDRESS, and URI
+	// Used for values of type STRING, DNS_NAME, EMAIL_ADDRESS, and URI
 	stringValue: string @protobuf(2,name=string_value)
 } | {
-	//  Used for values of type INT64
+	// Used for values of type INT64
 	int64Value: int64 @protobuf(3,name=int64_value)
 } | {
-	//  Used for values of type DOUBLE
+	// Used for values of type DOUBLE
 	doubleValue: float64 @protobuf(4,type=double,name=double_value)
 } | {
-	//  Used for values of type BOOL
+	// Used for values of type BOOL
 	boolValue: bool @protobuf(5,name=bool_value)
 } | {
-	//  Used for values of type BYTES
+	// Used for values of type BYTES
 	bytesValue: bytes @protobuf(6,name=bytes_value)
 } | {
-	//  Used for values of type TIMESTAMP
+	// Used for values of type TIMESTAMP
 	timestampValue: time.Time @protobuf(7,type=google.protobuf.Timestamp,name=timestamp_value)
 } | {
-	//  Used for values of type DURATION
+	// Used for values of type DURATION
 	durationValue: time.Duration @protobuf(8,type=google.protobuf.Duration,name=duration_value)
 } | {
-	//  Used for values of type STRING_MAP
+	// Used for values of type STRING_MAP
 	stringMapValue: Attributes_StringMap @protobuf(9,type=StringMap,name=string_map_value)
 } | {
 	testValue: test.Test @protobuf(10,type=acme.test.Test,name=test_value)
@@ -87,61 +87,61 @@
 	testValue: test_test.AnotherTest @protobuf(11,type=acme.test.test.AnotherTest,name=test_value)
 }
 
-//  Defines a string map.
+// Defines a string map.
 Attributes_StringMap: {
-	//  Holds a set of name/value pairs.
+	// Holds a set of name/value pairs.
 	entries: {
 		<_>: string
 	} @protobuf(1,type=map<string,string>)
 }
 
-//  Defines a list of attributes in compressed format optimized for transport.
-//  Within this message, strings are referenced using integer indices into
-//  one of two string dictionaries. Positive integers index into the global
-//  deployment-wide dictionary, whereas negative integers index into the message-level
-//  dictionary instead. The message-level dictionary is carried by the
-//  `words` field of this message, the deployment-wide dictionary is determined via
-//  configuration.
+// Defines a list of attributes in compressed format optimized for transport.
+// Within this message, strings are referenced using integer indices into
+// one of two string dictionaries. Positive integers index into the global
+// deployment-wide dictionary, whereas negative integers index into the message-level
+// dictionary instead. The message-level dictionary is carried by the
+// `words` field of this message, the deployment-wide dictionary is determined via
+// configuration.
 CompressedAttributes: {
-	//  The message-level dictionary.
+	// The message-level dictionary.
 	words?: [...string] @protobuf(1)
 
-	//  Holds attributes of type STRING, DNS_NAME, EMAIL_ADDRESS, URI
+	// Holds attributes of type STRING, DNS_NAME, EMAIL_ADDRESS, URI
 	strings: {
 		<_>: int32
 	} @protobuf(2,type=map<sint32,sint32>)
 
-	//  Holds attributes of type INT64
+	// Holds attributes of type INT64
 	int64s: {
 		<_>: int64
 	} @protobuf(3,type=map<sint32,int64>)
 
-	//  Holds attributes of type DOUBLE
+	// Holds attributes of type DOUBLE
 	doubles: {
 		<_>: float64
 	} @protobuf(4,type=map<sint32,double>)
 
-	//  Holds attributes of type BOOL
+	// Holds attributes of type BOOL
 	bools: {
 		<_>: bool
 	} @protobuf(5,type=map<sint32,bool>)
 
-	//  Holds attributes of type TIMESTAMP
+	// Holds attributes of type TIMESTAMP
 	time: {
 		<_>: __time.Time
 	} @protobuf(6,type=map<sint32,google.protobuf.Timestamp>,"(gogoproto.nullable)=false","(gogoproto.stdtime)")
 
-	//  Holds attributes of type DURATION
+	// Holds attributes of type DURATION
 	durations: {
 		<_>: __time.Duration
 	} @protobuf(7,type=map<sint32,google.protobuf.Duration>,"(gogoproto.nullable)=false","(gogoproto.stdduration)")
 
-	//  Holds attributes of type BYTES
+	// Holds attributes of type BYTES
 	bytes: {
 		<_>: __bytes
 	} @protobuf(8,type=map<sint32,bytes>)
 
-	//  Holds attributes of type STRING_MAP
+	// Holds attributes of type STRING_MAP
 	stringMaps: {
 		<_>: StringMap
 	} @protobuf(9,type=map<sint32,StringMap>,string_maps,"(gogoproto.nullable)=false")
@@ -149,10 +149,10 @@
 __time = time
 __bytes = bytes
 
-//  A map of string to string. The keys and values in this map are dictionary
-//  indices (see the [Attributes][istio.mixer.v1.CompressedAttributes] message for an explanation)
+// A map of string to string. The keys and values in this map are dictionary
+// indices (see the [Attributes][istio.mixer.v1.CompressedAttributes] message for an explanation)
 StringMap: {
-	//  Holds a set of name/value pairs.
+	// Holds a set of name/value pairs.
 	entries: {
 		<_>: int32
 	} @protobuf(1,type=map<sint32,sint32>)
diff --git a/encoding/protobuf/testdata/client_config.proto.out.cue b/encoding/protobuf/testdata/client_config.proto.out.cue
index f8535a7..527eead 100644
--- a/encoding/protobuf/testdata/client_config.proto.out.cue
+++ b/encoding/protobuf/testdata/client_config.proto.out.cue
@@ -1,23 +1,23 @@
 
-//  Copyright 2017 Istio Authors
-// 
-//    Licensed under the Apache License, Version 2.0 (the "License");
-//    you may not use this file except in compliance with the License.
-//    You may obtain a copy of the License at
-// 
-//        http://www.apache.org/licenses/LICENSE-2.0
-// 
-//    Unless required by applicable law or agreed to in writing, software
-//    distributed under the License is distributed on an "AS IS" BASIS,
-//    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//    See the License for the specific language governing permissions and
-//    limitations under the License.
+// Copyright 2017 Istio Authors
+//
+//   Licensed under the Apache License, Version 2.0 (the "License");
+//   you may not use this file except in compliance with the License.
+//   You may obtain a copy of the License at
+//
+//       http://www.apache.org/licenses/LICENSE-2.0
+//
+//   Unless required by applicable law or agreed to in writing, software
+//   distributed under the License is distributed on an "AS IS" BASIS,
+//   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//   See the License for the specific language governing permissions and
+//   limitations under the License.
 
-//  $title: Mixer Client
-//  $description: Configuration state for the Mixer client library.
-//  $location: https://istio.io/docs/reference/config/policy-and-telemetry/istio.mixer.v1.config.client
+// $title: Mixer Client
+// $description: Configuration state for the Mixer client library.
+// $location: https://istio.io/docs/reference/config/policy-and-telemetry/istio.mixer.v1.config.client
 
-//  Describes the configuration state for the Mixer client library that's built into Envoy.
+// Describes the configuration state for the Mixer client library that's built into Envoy.
 package client
 
 import (
@@ -25,165 +25,165 @@
 	"time"
 )
 
-//  Specifies the behavior when the client is unable to connect to Mixer.
+// Specifies the behavior when the client is unable to connect to Mixer.
 NetworkFailPolicy: {
 
-	//  Specifies the behavior when the client is unable to connect to Mixer.
+	// Specifies the behavior when the client is unable to connect to Mixer.
 	policy?: NetworkFailPolicy_FailPolicy @protobuf(1,type=FailPolicy)
 
-	//  Max retries on transport error.
+	// Max retries on transport error.
 	maxRetry?: uint32 @protobuf(2,name=max_retry)
 
-	//  Base time to wait between retries.  Will be adjusted by exponential
-	//  backoff and jitter.
+	// Base time to wait between retries.  Will be adjusted by exponential
+	// backoff and jitter.
 	baseRetryWait?: time.Duration @protobuf(3,type=google.protobuf.Duration,name=base_retry_wait)
 
-	//  Max time to wait between retries.
+	// Max time to wait between retries.
 	maxRetryWait?: time.Duration @protobuf(4,type=google.protobuf.Duration,name=max_retry_wait)
 }
 
-//  Example of single-value enum.
+// Example of single-value enum.
 NetworkFailPolicy_FailPolicy:
-	//  If network connection fails, request is allowed and delivered to the
-	//  service.
+	// If network connection fails, request is allowed and delivered to the
+	// service.
 	"FAIL_OPEN"
 
 NetworkFailPolicy_FailPolicy_value FAIL_OPEN: 0
 
-//  Defines the per-service client configuration.
+// Defines the per-service client configuration.
 ServiceConfig: {
-	//  If true, do not call Mixer Check.
+	// If true, do not call Mixer Check.
 	disableCheckCalls?: bool @protobuf(1,name=disable_check_calls)
 
-	//  If true, do not call Mixer Report.
+	// If true, do not call Mixer Report.
 	disableReportCalls?: bool @protobuf(2,name=disable_report_calls)
 
-	//  Send these attributes to Mixer in both Check and Report. This
-	//  typically includes the "destination.service" attribute.
-	//  In case of a per-route override, per-route attributes take precedence
-	//  over the attributes supplied in the client configuration.
+	// Send these attributes to Mixer in both Check and Report. This
+	// typically includes the "destination.service" attribute.
+	// In case of a per-route override, per-route attributes take precedence
+	// over the attributes supplied in the client configuration.
 	mixerAttributes?: v1.Attributes @protobuf(3,type=Attributes,name=mixer_attributes)
 
-	//  HTTP API specifications to generate API attributes.
+	// HTTP API specifications to generate API attributes.
 	httpApiSpec?: [...HTTPAPISpec] @protobuf(4,name=http_api_spec)
 
-	//  Quota specifications to generate quota requirements.
+	// Quota specifications to generate quota requirements.
 	quotaSpec?: [...QuotaSpec] @protobuf(5,name=quota_spec)
 
-	//  Specifies the behavior when the client is unable to connect to Mixer.
-	//  This is the service-level policy. It overrides
-	//  [mesh-level
-	//  policy][istio.mixer.v1.config.client.TransportConfig.network_fail_policy].
+	// Specifies the behavior when the client is unable to connect to Mixer.
+	// This is the service-level policy. It overrides
+	// [mesh-level
+	// policy][istio.mixer.v1.config.client.TransportConfig.network_fail_policy].
 	networkFailPolicy?: NetworkFailPolicy @protobuf(7,name=network_fail_policy)
 
-	//  Default attributes to forward to upstream. This typically
-	//  includes the "source.ip" and "source.uid" attributes.
-	//  In case of a per-route override, per-route attributes take precedence
-	//  over the attributes supplied in the client configuration.
-	// 
-	//  Forwarded attributes take precedence over the static Mixer attributes.
-	//  The full order of application is as follows:
-	//  1. static Mixer attributes from the filter config;
-	//  2. static Mixer attributes from the route config;
-	//  3. forwarded attributes from the source filter config (if any);
-	//  4. forwarded attributes from the source route config (if any);
-	//  5. derived attributes from the request metadata.
+	// Default attributes to forward to upstream. This typically
+	// includes the "source.ip" and "source.uid" attributes.
+	// In case of a per-route override, per-route attributes take precedence
+	// over the attributes supplied in the client configuration.
+	//
+	// Forwarded attributes take precedence over the static Mixer attributes.
+	// The full order of application is as follows:
+	// 1. static Mixer attributes from the filter config;
+	// 2. static Mixer attributes from the route config;
+	// 3. forwarded attributes from the source filter config (if any);
+	// 4. forwarded attributes from the source route config (if any);
+	// 5. derived attributes from the request metadata.
 	forwardAttributes?: v1.Attributes @protobuf(8,type=Attributes,name=forward_attributes)
 }
 
-//  Defines the transport config on how to call Mixer.
+// Defines the transport config on how to call Mixer.
 TransportConfig: {
-	//  The flag to disable check cache.
+	// The flag to disable check cache.
 	disableCheckCache?: bool @protobuf(1,name=disable_check_cache)
 
-	//  The flag to disable quota cache.
+	// The flag to disable quota cache.
 	disableQuotaCache?: bool @protobuf(2,name=disable_quota_cache)
 
-	//  The flag to disable report batch.
+	// The flag to disable report batch.
 	disableReportBatch?: bool @protobuf(3,name=disable_report_batch)
 
-	//  Specifies the behavior when the client is unable to connect to Mixer.
-	//  This is the mesh level policy. The default value for policy is FAIL_OPEN.
+	// Specifies the behavior when the client is unable to connect to Mixer.
+	// This is the mesh level policy. The default value for policy is FAIL_OPEN.
 	networkFailPolicy?: NetworkFailPolicy @protobuf(4,name=network_fail_policy)
 
-	//  Specify refresh interval to write Mixer client statistics to Envoy share
-	//  memory. If not specified, the interval is 10 seconds.
+	// Specify refresh interval to write Mixer client statistics to Envoy share
+	// memory. If not specified, the interval is 10 seconds.
 	statsUpdateInterval?: time.Duration @protobuf(5,type=google.protobuf.Duration,name=stats_update_interval)
 
-	//  Name of the cluster that will forward check calls to a pool of mixer
-	//  servers. Defaults to "mixer_server". By using different names for
-	//  checkCluster and reportCluster, it is possible to have one set of
-	//  Mixer servers handle check calls, while another set of Mixer servers
-	//  handle report calls.
-	// 
-	//  NOTE: Any value other than the default "mixer_server" will require the
-	//  Istio Grafana dashboards to be reconfigured to use the new name.
+	// Name of the cluster that will forward check calls to a pool of mixer
+	// servers. Defaults to "mixer_server". By using different names for
+	// checkCluster and reportCluster, it is possible to have one set of
+	// Mixer servers handle check calls, while another set of Mixer servers
+	// handle report calls.
+	//
+	// NOTE: Any value other than the default "mixer_server" will require the
+	// Istio Grafana dashboards to be reconfigured to use the new name.
 	checkCluster?: string @protobuf(6,name=check_cluster)
 
-	//  Name of the cluster that will forward report calls to a pool of mixer
-	//  servers. Defaults to "mixer_server". By using different names for
-	//  checkCluster and reportCluster, it is possible to have one set of
-	//  Mixer servers handle check calls, while another set of Mixer servers
-	//  handle report calls.
-	// 
-	//  NOTE: Any value other than the default "mixer_server" will require the
-	//  Istio Grafana dashboards to be reconfigured to use the new name.
+	// Name of the cluster that will forward report calls to a pool of mixer
+	// servers. Defaults to "mixer_server". By using different names for
+	// checkCluster and reportCluster, it is possible to have one set of
+	// Mixer servers handle check calls, while another set of Mixer servers
+	// handle report calls.
+	//
+	// NOTE: Any value other than the default "mixer_server" will require the
+	// Istio Grafana dashboards to be reconfigured to use the new name.
 	reportCluster?: string @protobuf(7,name=report_cluster)
 
-	//  Default attributes to forward to Mixer upstream. This typically
-	//  includes the "source.ip" and "source.uid" attributes. These
-	//  attributes are consumed by the proxy in front of mixer.
+	// Default attributes to forward to Mixer upstream. This typically
+	// includes the "source.ip" and "source.uid" attributes. These
+	// attributes are consumed by the proxy in front of mixer.
 	attributesForMixerProxy?: v1.Attributes @protobuf(8,type=Attributes,name=attributes_for_mixer_proxy)
 }
 
-//  Defines the client config for HTTP.
+// Defines the client config for HTTP.
 HttpClientConfig: {
-	//  The transport config.
+	// The transport config.
 	transport?: TransportConfig @protobuf(1)
 
-	//  Map of control configuration indexed by destination.service. This
-	//  is used to support per-service configuration for cases where a
-	//  mixerclient serves multiple services.
+	// Map of control configuration indexed by destination.service. This
+	// is used to support per-service configuration for cases where a
+	// mixerclient serves multiple services.
 	serviceConfigs: {
 		<_>: ServiceConfig
 	} @protobuf(2,type=map<string,ServiceConfig>,service_configs)
 
-	//  Default destination service name if none was specified in the
-	//  client request.
+	// Default destination service name if none was specified in the
+	// client request.
 	defaultDestinationService?: string @protobuf(3,name=default_destination_service)
 
-	//  Default attributes to send to Mixer in both Check and
-	//  Report. This typically includes "destination.ip" and
-	//  "destination.uid" attributes.
+	// Default attributes to send to Mixer in both Check and
+	// Report. This typically includes "destination.ip" and
+	// "destination.uid" attributes.
 	mixerAttributes?: v1.Attributes @protobuf(4,type=Attributes,name=mixer_attributes)
 
-	//  Default attributes to forward to upstream. This typically
-	//  includes the "source.ip" and "source.uid" attributes.
+	// Default attributes to forward to upstream. This typically
+	// includes the "source.ip" and "source.uid" attributes.
 	forwardAttributes?: v1.Attributes @protobuf(5,type=Attributes,name=forward_attributes)
 }
 
-//  Defines the client config for TCP.
+// Defines the client config for TCP.
 TcpClientConfig: {
-	//  The transport config.
+	// The transport config.
 	transport?: TransportConfig @protobuf(1)
 
-	//  Default attributes to send to Mixer in both Check and
-	//  Report. This typically includes "destination.ip" and
-	//  "destination.uid" attributes.
+	// Default attributes to send to Mixer in both Check and
+	// Report. This typically includes "destination.ip" and
+	// "destination.uid" attributes.
 	mixerAttributes?: v1.Attributes @protobuf(2,type=Attributes,name=mixer_attributes)
 
-	//  If set to true, disables Mixer check calls.
+	// If set to true, disables Mixer check calls.
 	disableCheckCalls?: bool @protobuf(3,name=disable_check_calls)
 
-	//  If set to true, disables Mixer check calls.
+	// If set to true, disables Mixer check calls.
 	disableReportCalls?: bool @protobuf(4,name=disable_report_calls)
 
-	//  Quota specifications to generate quota requirements.
-	//  It applies on the new TCP connections.
+	// Quota specifications to generate quota requirements.
+	// It applies on the new TCP connections.
 	connectionQuotaSpec?: QuotaSpec @protobuf(5,name=connection_quota_spec)
 
-	//  Specify report interval to send periodical reports for long TCP
-	//  connections. If not specified, the interval is 10 seconds. This interval
-	//  should not be less than 1 second, otherwise it will be reset to 1 second.
+	// Specify report interval to send periodical reports for long TCP
+	// connections. If not specified, the interval is 10 seconds. This interval
+	// should not be less than 1 second, otherwise it will be reset to 1 second.
 	reportInterval?: time.Duration @protobuf(6,type=google.protobuf.Duration,name=report_interval)
 }
diff --git a/encoding/protobuf/testdata/gateway.proto.out.cue b/encoding/protobuf/testdata/gateway.proto.out.cue
index ac72914..b8061e5 100644
--- a/encoding/protobuf/testdata/gateway.proto.out.cue
+++ b/encoding/protobuf/testdata/gateway.proto.out.cue
@@ -1,417 +1,417 @@
 
-//  Copyright 2019 CUE Authors
-// 
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-//  
-//      http://www.apache.org/licenses/LICENSE-2.0
-//  
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
+// Copyright 2019 CUE Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
-//  Copyright 2017 Istio Authors
-// 
-//    Licensed under the Apache License, Version 2.0 (the "License");
-//    you may not use this file except in compliance with the License.
-//    You may obtain a copy of the License at
-// 
-//        http://www.apache.org/licenses/LICENSE-2.0
-// 
-//    Unless required by applicable law or agreed to in writing, software
-//    distributed under the License is distributed on an "AS IS" BASIS,
-//    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//    See the License for the specific language governing permissions and
-//    limitations under the License.
+// Copyright 2017 Istio Authors
+//
+//   Licensed under the Apache License, Version 2.0 (the "License");
+//   you may not use this file except in compliance with the License.
+//   You may obtain a copy of the License at
+//
+//       http://www.apache.org/licenses/LICENSE-2.0
+//
+//   Unless required by applicable law or agreed to in writing, software
+//   distributed under the License is distributed on an "AS IS" BASIS,
+//   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//   See the License for the specific language governing permissions and
+//   limitations under the License.
 
-//  $title: Gateway
-//  $description: Configuration affecting edge load balancer.
-//  $location: https://istio.io/docs/reference/config/networking/v1alpha3/gateway.html
+// $title: Gateway
+// $description: Configuration affecting edge load balancer.
+// $location: https://istio.io/docs/reference/config/networking/v1alpha3/gateway.html
 
-//  `Gateway` describes a load balancer operating at the edge of the mesh
-//  receiving incoming or outgoing HTTP/TCP connections. The specification
-//  describes a set of ports that should be exposed, the type of protocol to
-//  use, SNI configuration for the load balancer, etc.
-// 
-//  For example, the following Gateway configuration sets up a proxy to act
-//  as a load balancer exposing port 80 and 9080 (http), 443 (https),
-//  9443(https) and port 2379 (TCP) for ingress.  The gateway will be
-//  applied to the proxy running on a pod with labels `app:
-//  my-gateway-controller`. While Istio will configure the proxy to listen
-//  on these ports, it is the responsibility of the user to ensure that
-//  external traffic to these ports are allowed into the mesh.
-// 
-//  ```yaml
-//  apiVersion: networking.istio.io/v1alpha3
-//  kind: Gateway
-//  metadata:
-//    name: my-gateway
-//    namespace: some-config-namespace
-//  spec:
-//    selector:
-//      app: my-gateway-controller
-//    servers:
-//    - port:
-//        number: 80
-//        name: http
-//        protocol: HTTP
-//      hosts:
-//      - uk.bookinfo.com
-//      - eu.bookinfo.com
-//      tls:
-//        httpsRedirect: true # sends 301 redirect for http requests
-//    - port:
-//        number: 443
-//        name: https-443
-//        protocol: HTTPS
-//      hosts:
-//      - uk.bookinfo.com
-//      - eu.bookinfo.com
-//      tls:
-//        mode: SIMPLE # enables HTTPS on this port
-//        serverCertificate: /etc/certs/servercert.pem
-//        privateKey: /etc/certs/privatekey.pem
-//    - port:
-//        number: 9443
-//        name: https-9443
-//        protocol: HTTPS
-//      hosts:
-//      - "bookinfo-namespace/*.bookinfo.com"
-//      tls:
-//        mode: SIMPLE # enables HTTPS on this port
-//        credentialName: bookinfo-secret # fetches certs from Kubernetes secret
-//    - port:
-//        number: 9080
-//        name: http-wildcard
-//        protocol: HTTP
-//      hosts:
-//      - "*"
-//    - port:
-//        number: 2379 # to expose internal service via external port 2379
-//        name: mongo
-//        protocol: MONGO
-//      hosts:
-//      - "*"
-//  ```
-// 
-//  The Gateway specification above describes the L4-L6 properties of a load
-//  balancer. A `VirtualService` can then be bound to a gateway to control
-//  the forwarding of traffic arriving at a particular host or gateway port.
-// 
-//  For example, the following VirtualService splits traffic for
-//  `https://uk.bookinfo.com/reviews`, `https://eu.bookinfo.com/reviews`,
-//  `http://uk.bookinfo.com:9080/reviews`,
-//  `http://eu.bookinfo.com:9080/reviews` into two versions (prod and qa) of
-//  an internal reviews service on port 9080. In addition, requests
-//  containing the cookie "user: dev-123" will be sent to special port 7777
-//  in the qa version. The same rule is also applicable inside the mesh for
-//  requests to the "reviews.prod.svc.cluster.local" service. This rule is
-//  applicable across ports 443, 9080. Note that `http://uk.bookinfo.com`
-//  gets redirected to `https://uk.bookinfo.com` (i.e. 80 redirects to 443).
-// 
-//  ```yaml
-//  apiVersion: networking.istio.io/v1alpha3
-//  kind: VirtualService
-//  metadata:
-//    name: bookinfo-rule
-//    namespace: bookinfo-namespace
-//  spec:
-//    hosts:
-//    - reviews.prod.svc.cluster.local
-//    - uk.bookinfo.com
-//    - eu.bookinfo.com
-//    gateways:
-//    - some-config-namespace/my-gateway
-//    - mesh # applies to all the sidecars in the mesh
-//    http:
-//    - match:
-//      - headers:
-//          cookie:
-//            exact: "user=dev-123"
-//      route:
-//      - destination:
-//          port:
-//            number: 7777
-//          host: reviews.qa.svc.cluster.local
-//    - match:
-//      - uri:
-//          prefix: /reviews/
-//      route:
-//      - destination:
-//          port:
-//            number: 9080 # can be omitted if it's the only port for reviews
-//          host: reviews.prod.svc.cluster.local
-//        weight: 80
-//      - destination:
-//          host: reviews.qa.svc.cluster.local
-//        weight: 20
-//  ```
-// 
-//  The following VirtualService forwards traffic arriving at (external)
-//  port 27017 to internal Mongo server on port 5555. This rule is not
-//  applicable internally in the mesh as the gateway list omits the
-//  reserved name `mesh`.
-// 
-//  ```yaml
-//  apiVersion: networking.istio.io/v1alpha3
-//  kind: VirtualService
-//  metadata:
-//    name: bookinfo-Mongo
-//    namespace: bookinfo-namespace
-//  spec:
-//    hosts:
-//    - mongosvr.prod.svc.cluster.local # name of internal Mongo service
-//    gateways:
-//    - some-config-namespace/my-gateway # can omit the namespace if gateway is in same
-//                                         namespace as virtual service.
-//    tcp:
-//    - match:
-//      - port: 27017
-//      route:
-//      - destination:
-//          host: mongo.prod.svc.cluster.local
-//          port:
-//            number: 5555
-//  ```
-// 
-//  It is possible to restrict the set of virtual services that can bind to
-//  a gateway server using the namespace/hostname syntax in the hosts field.
-//  For example, the following Gateway allows any virtual service in the ns1
-//  namespace to bind to it, while restricting only the virtual service with
-//  foo.bar.com host in the ns2 namespace to bind to it.
-// 
-//  ```yaml
-//  apiVersion: networking.istio.io/v1alpha3
-//  kind: Gateway
-//  metadata:
-//    name: my-gateway
-//    namespace: some-config-namespace
-//  spec:
-//    selector:
-//      app: my-gateway-controller
-//    servers:
-//    - port:
-//        number: 80
-//        name: http
-//        protocol: HTTP
-//      hosts:
-//      - "ns1/*"
-//      - "ns2/foo.bar.com"
-//  ```
-// 
+// `Gateway` describes a load balancer operating at the edge of the mesh
+// receiving incoming or outgoing HTTP/TCP connections. The specification
+// describes a set of ports that should be exposed, the type of protocol to
+// use, SNI configuration for the load balancer, etc.
+//
+// For example, the following Gateway configuration sets up a proxy to act
+// as a load balancer exposing port 80 and 9080 (http), 443 (https),
+// 9443(https) and port 2379 (TCP) for ingress.  The gateway will be
+// applied to the proxy running on a pod with labels `app:
+// my-gateway-controller`. While Istio will configure the proxy to listen
+// on these ports, it is the responsibility of the user to ensure that
+// external traffic to these ports are allowed into the mesh.
+//
+// ```yaml
+// apiVersion: networking.istio.io/v1alpha3
+// kind: Gateway
+// metadata:
+//   name: my-gateway
+//   namespace: some-config-namespace
+// spec:
+//   selector:
+//     app: my-gateway-controller
+//   servers:
+//   - port:
+//       number: 80
+//       name: http
+//       protocol: HTTP
+//     hosts:
+//     - uk.bookinfo.com
+//     - eu.bookinfo.com
+//     tls:
+//       httpsRedirect: true # sends 301 redirect for http requests
+//   - port:
+//       number: 443
+//       name: https-443
+//       protocol: HTTPS
+//     hosts:
+//     - uk.bookinfo.com
+//     - eu.bookinfo.com
+//     tls:
+//       mode: SIMPLE # enables HTTPS on this port
+//       serverCertificate: /etc/certs/servercert.pem
+//       privateKey: /etc/certs/privatekey.pem
+//   - port:
+//       number: 9443
+//       name: https-9443
+//       protocol: HTTPS
+//     hosts:
+//     - "bookinfo-namespace/*.bookinfo.com"
+//     tls:
+//       mode: SIMPLE # enables HTTPS on this port
+//       credentialName: bookinfo-secret # fetches certs from Kubernetes secret
+//   - port:
+//       number: 9080
+//       name: http-wildcard
+//       protocol: HTTP
+//     hosts:
+//     - "*"
+//   - port:
+//       number: 2379 # to expose internal service via external port 2379
+//       name: mongo
+//       protocol: MONGO
+//     hosts:
+//     - "*"
+// ```
+//
+// The Gateway specification above describes the L4-L6 properties of a load
+// balancer. A `VirtualService` can then be bound to a gateway to control
+// the forwarding of traffic arriving at a particular host or gateway port.
+//
+// For example, the following VirtualService splits traffic for
+// `https://uk.bookinfo.com/reviews`, `https://eu.bookinfo.com/reviews`,
+// `http://uk.bookinfo.com:9080/reviews`,
+// `http://eu.bookinfo.com:9080/reviews` into two versions (prod and qa) of
+// an internal reviews service on port 9080. In addition, requests
+// containing the cookie "user: dev-123" will be sent to special port 7777
+// in the qa version. The same rule is also applicable inside the mesh for
+// requests to the "reviews.prod.svc.cluster.local" service. This rule is
+// applicable across ports 443, 9080. Note that `http://uk.bookinfo.com`
+// gets redirected to `https://uk.bookinfo.com` (i.e. 80 redirects to 443).
+//
+// ```yaml
+// apiVersion: networking.istio.io/v1alpha3
+// kind: VirtualService
+// metadata:
+//   name: bookinfo-rule
+//   namespace: bookinfo-namespace
+// spec:
+//   hosts:
+//   - reviews.prod.svc.cluster.local
+//   - uk.bookinfo.com
+//   - eu.bookinfo.com
+//   gateways:
+//   - some-config-namespace/my-gateway
+//   - mesh # applies to all the sidecars in the mesh
+//   http:
+//   - match:
+//     - headers:
+//         cookie:
+//           exact: "user=dev-123"
+//     route:
+//     - destination:
+//         port:
+//           number: 7777
+//         host: reviews.qa.svc.cluster.local
+//   - match:
+//     - uri:
+//         prefix: /reviews/
+//     route:
+//     - destination:
+//         port:
+//           number: 9080 # can be omitted if it's the only port for reviews
+//         host: reviews.prod.svc.cluster.local
+//       weight: 80
+//     - destination:
+//         host: reviews.qa.svc.cluster.local
+//       weight: 20
+// ```
+//
+// The following VirtualService forwards traffic arriving at (external)
+// port 27017 to internal Mongo server on port 5555. This rule is not
+// applicable internally in the mesh as the gateway list omits the
+// reserved name `mesh`.
+//
+// ```yaml
+// apiVersion: networking.istio.io/v1alpha3
+// kind: VirtualService
+// metadata:
+//   name: bookinfo-Mongo
+//   namespace: bookinfo-namespace
+// spec:
+//   hosts:
+//   - mongosvr.prod.svc.cluster.local # name of internal Mongo service
+//   gateways:
+//   - some-config-namespace/my-gateway # can omit the namespace if gateway is in same
+//                                        namespace as virtual service.
+//   tcp:
+//   - match:
+//     - port: 27017
+//     route:
+//     - destination:
+//         host: mongo.prod.svc.cluster.local
+//         port:
+//           number: 5555
+// ```
+//
+// It is possible to restrict the set of virtual services that can bind to
+// a gateway server using the namespace/hostname syntax in the hosts field.
+// For example, the following Gateway allows any virtual service in the ns1
+// namespace to bind to it, while restricting only the virtual service with
+// foo.bar.com host in the ns2 namespace to bind to it.
+//
+// ```yaml
+// apiVersion: networking.istio.io/v1alpha3
+// kind: Gateway
+// metadata:
+//   name: my-gateway
+//   namespace: some-config-namespace
+// spec:
+//   selector:
+//     app: my-gateway-controller
+//   servers:
+//   - port:
+//       number: 80
+//       name: http
+//       protocol: HTTP
+//     hosts:
+//     - "ns1/*"
+//     - "ns2/foo.bar.com"
+// ```
+//
 package v1alpha3
 
 Gateway: {
-	//  REQUIRED: A list of server specifications.
+	// REQUIRED: A list of server specifications.
 	servers?: [...Server] @protobuf(1)
 
-	//  REQUIRED: One or more labels that indicate a specific set of pods/VMs
-	//  on which this gateway configuration should be applied. The scope of
-	//  label search is restricted to the configuration namespace in which the
-	//  the resource is present. In other words, the Gateway resource must
-	//  reside in the same namespace as the gateway workload instance.
+	// REQUIRED: One or more labels that indicate a specific set of pods/VMs
+	// on which this gateway configuration should be applied. The scope of
+	// label search is restricted to the configuration namespace in which the
+	// the resource is present. In other words, the Gateway resource must
+	// reside in the same namespace as the gateway workload instance.
 	selector: {
 		<_>: string
 	} @protobuf(2,type=map<string,string>)
 	selector? <name>: name
 }
 
-//  `Server` describes the properties of the proxy on a given load balancer
-//  port. For example,
-// 
-//  ```yaml
-//  apiVersion: networking.istio.io/v1alpha3
-//  kind: Gateway
-//  metadata:
-//    name: my-ingress
-//  spec:
-//    selector:
-//      app: my-ingress-gateway
-//    servers:
-//    - port:
-//        number: 80
-//        name: http2
-//        protocol: HTTP2
-//      hosts:
-//      - "*"
-//  ```
-// 
-//  Another example
-// 
-//  ```yaml
-//  apiVersion: networking.istio.io/v1alpha3
-//  kind: Gateway
-//  metadata:
-//    name: my-tcp-ingress
-//  spec:
-//    selector:
-//      app: my-tcp-ingress-gateway
-//    servers:
-//    - port:
-//        number: 27018
-//        name: mongo
-//        protocol: MONGO
-//      hosts:
-//      - "*"
-//  ```
-// 
-//  The following is an example of TLS configuration for port 443
-// 
-//  ```yaml
-//  apiVersion: networking.istio.io/v1alpha3
-//  kind: Gateway
-//  metadata:
-//    name: my-tls-ingress
-//  spec:
-//    selector:
-//      app: my-tls-ingress-gateway
-//    servers:
-//    - port:
-//        number: 443
-//        name: https
-//        protocol: HTTPS
-//      hosts:
-//      - "*"
-//      tls:
-//        mode: SIMPLE
-//        serverCertificate: /etc/certs/server.pem
-//        privateKey: /etc/certs/privatekey.pem
-//  ```
+// `Server` describes the properties of the proxy on a given load balancer
+// port. For example,
+//
+// ```yaml
+// apiVersion: networking.istio.io/v1alpha3
+// kind: Gateway
+// metadata:
+//   name: my-ingress
+// spec:
+//   selector:
+//     app: my-ingress-gateway
+//   servers:
+//   - port:
+//       number: 80
+//       name: http2
+//       protocol: HTTP2
+//     hosts:
+//     - "*"
+// ```
+//
+// Another example
+//
+// ```yaml
+// apiVersion: networking.istio.io/v1alpha3
+// kind: Gateway
+// metadata:
+//   name: my-tcp-ingress
+// spec:
+//   selector:
+//     app: my-tcp-ingress-gateway
+//   servers:
+//   - port:
+//       number: 27018
+//       name: mongo
+//       protocol: MONGO
+//     hosts:
+//     - "*"
+// ```
+//
+// The following is an example of TLS configuration for port 443
+//
+// ```yaml
+// apiVersion: networking.istio.io/v1alpha3
+// kind: Gateway
+// metadata:
+//   name: my-tls-ingress
+// spec:
+//   selector:
+//     app: my-tls-ingress-gateway
+//   servers:
+//   - port:
+//       number: 443
+//       name: https
+//       protocol: HTTPS
+//     hosts:
+//     - "*"
+//     tls:
+//       mode: SIMPLE
+//       serverCertificate: /etc/certs/server.pem
+//       privateKey: /etc/certs/privatekey.pem
+// ```
 Server: {
-	//  REQUIRED: The Port on which the proxy should listen for incoming
-	//  connections.
+	// REQUIRED: The Port on which the proxy should listen for incoming
+	// connections.
 	port?: Port @protobuf(1)
 	port?: >10 & <100
 
-	//  $hide_from_docs
-	//  The ip or the Unix domain socket to which the listener should be bound
-	//  to. Format: `x.x.x.x` or `unix:///path/to/uds` or `unix://@foobar`
-	//  (Linux abstract namespace). When using Unix domain sockets, the port
-	//  number should be 0.
+	// $hide_from_docs
+	// The ip or the Unix domain socket to which the listener should be bound
+	// to. Format: `x.x.x.x` or `unix:///path/to/uds` or `unix://@foobar`
+	// (Linux abstract namespace). When using Unix domain sockets, the port
+	// number should be 0.
 	bind?: string @protobuf(4)
 
-	//  REQUIRED. One or more hosts exposed by this gateway.
-	//  While typically applicable to
-	//  HTTP services, it can also be used for TCP services using TLS with SNI.
-	//  A host is specified as a `dnsName` with an optional `namespace/` prefix.
-	//  The `dnsName` should be specified using FQDN format, optionally including
-	//  a wildcard character in the left-most component (e.g., `prod/*.example.com`).
-	//  Set the `dnsName` to `*` to select all `VirtualService` hosts from the
-	//  specified namespace (e.g.,`prod/*`). If no `namespace/` is specified,
-	//  the `VirtualService` hosts will be selected from any available namespace.
-	//  Any associated `DestinationRule` in the same namespace will also be used.
-	// 
-	//  A `VirtualService` must be bound to the gateway and must have one or
-	//  more hosts that match the hosts specified in a server. The match
-	//  could be an exact match or a suffix match with the server's hosts. For
-	//  example, if the server's hosts specifies `*.example.com`, a
-	//  `VirtualService` with hosts `dev.example.com` or `prod.example.com` will
-	//  match. However, a `VirtualService` with host `example.com` or
-	//  `newexample.com` will not match.
-	// 
-	//  NOTE: Only virtual services exported to the gateway's namespace
-	//  (e.g., `exportTo` value of `*`) can be referenced.
-	//  Private configurations (e.g., `exportTo` set to `.`) will not be
-	//  available. Refer to the `exportTo` setting in `VirtualService`,
-	//  `DestinationRule`, and `ServiceEntry` configurations for details.
+	// REQUIRED. One or more hosts exposed by this gateway.
+	// While typically applicable to
+	// HTTP services, it can also be used for TCP services using TLS with SNI.
+	// A host is specified as a `dnsName` with an optional `namespace/` prefix.
+	// The `dnsName` should be specified using FQDN format, optionally including
+	// a wildcard character in the left-most component (e.g., `prod/*.example.com`).
+	// Set the `dnsName` to `*` to select all `VirtualService` hosts from the
+	// specified namespace (e.g.,`prod/*`). If no `namespace/` is specified,
+	// the `VirtualService` hosts will be selected from any available namespace.
+	// Any associated `DestinationRule` in the same namespace will also be used.
+	//
+	// A `VirtualService` must be bound to the gateway and must have one or
+	// more hosts that match the hosts specified in a server. The match
+	// could be an exact match or a suffix match with the server's hosts. For
+	// example, if the server's hosts specifies `*.example.com`, a
+	// `VirtualService` with hosts `dev.example.com` or `prod.example.com` will
+	// match. However, a `VirtualService` with host `example.com` or
+	// `newexample.com` will not match.
+	//
+	// NOTE: Only virtual services exported to the gateway's namespace
+	// (e.g., `exportTo` value of `*`) can be referenced.
+	// Private configurations (e.g., `exportTo` set to `.`) will not be
+	// available. Refer to the `exportTo` setting in `VirtualService`,
+	// `DestinationRule`, and `ServiceEntry` configurations for details.
 	hosts?: [...string] @protobuf(2)
 
-	//  Set of TLS related options that govern the server's behavior. Use
-	//  these options to control if all http requests should be redirected to
-	//  https, and the TLS modes to use.
+	// Set of TLS related options that govern the server's behavior. Use
+	// these options to control if all http requests should be redirected to
+	// https, and the TLS modes to use.
 	tls?: Server_TLSOptions @protobuf(3,type=TLSOptions)
 
-	//  The loopback IP endpoint or Unix domain socket to which traffic should
-	//  be forwarded to by default. Format should be `127.0.0.1:PORT` or
-	//  `unix:///path/to/socket` or `unix://@foobar` (Linux abstract namespace).
+	// The loopback IP endpoint or Unix domain socket to which traffic should
+	// be forwarded to by default. Format should be `127.0.0.1:PORT` or
+	// `unix:///path/to/socket` or `unix://@foobar` (Linux abstract namespace).
 	defaultEndpoint?: string @protobuf(5,name=default_endpoint)
 }
 
 Server_TLSOptions: {
-	//  If set to true, the load balancer will send a 301 redirect for all
-	//  http connections, asking the clients to use HTTPS.
+	// If set to true, the load balancer will send a 301 redirect for all
+	// http connections, asking the clients to use HTTPS.
 	httpsRedirect?: bool @protobuf(1,name=https_redirect)
 
-	//  Optional: Indicates whether connections to this port should be
-	//  secured using TLS. The value of this field determines how TLS is
-	//  enforced.
+	// Optional: Indicates whether connections to this port should be
+	// secured using TLS. The value of this field determines how TLS is
+	// enforced.
 	mode?: Server_TLSOptions_TLSmode @protobuf(2,type=TLSmode)
 
-	//  Extra comment.
+	// Extra comment.
 
-	//  REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file
-	//  holding the server-side TLS certificate to use.
+	// REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file
+	// holding the server-side TLS certificate to use.
 	serverCertificate?: string @protobuf(3,name=server_certificate)
 
-	//  REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file
-	//  holding the server's private key.
+	// REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file
+	// holding the server's private key.
 	privateKey?: string @protobuf(4,name=private_key)
 
-	//  REQUIRED if mode is `MUTUAL`. The path to a file containing
-	//  certificate authority certificates to use in verifying a presented
-	//  client side certificate.
+	// REQUIRED if mode is `MUTUAL`. The path to a file containing
+	// certificate authority certificates to use in verifying a presented
+	// client side certificate.
 	caCertificates?: string @protobuf(5,name=ca_certificates)
 
-	//  The credentialName stands for a unique identifier that can be used
-	//  to identify the serverCertificate and the privateKey. The
-	//  credentialName appended with suffix "-cacert" is used to identify
-	//  the CaCertificates associated with this server. Gateway workloads
-	//  capable of fetching credentials from a remote credential store such
-	//  as Kubernetes secrets, will be configured to retrieve the
-	//  serverCertificate and the privateKey using credentialName, instead
-	//  of using the file system paths specified above. If using mutual TLS,
-	//  gateway workload instances will retrieve the CaCertificates using
-	//  credentialName-cacert. The semantics of the name are platform
-	//  dependent.  In Kubernetes, the default Istio supplied credential
-	//  server expects the credentialName to match the name of the
-	//  Kubernetes secret that holds the server certificate, the private
-	//  key, and the CA certificate (if using mutual TLS). Set the
-	//  `ISTIO_META_USER_SDS` metadata variable in the gateway's proxy to
-	//  enable the dynamic credential fetching feature.
+	// The credentialName stands for a unique identifier that can be used
+	// to identify the serverCertificate and the privateKey. The
+	// credentialName appended with suffix "-cacert" is used to identify
+	// the CaCertificates associated with this server. Gateway workloads
+	// capable of fetching credentials from a remote credential store such
+	// as Kubernetes secrets, will be configured to retrieve the
+	// serverCertificate and the privateKey using credentialName, instead
+	// of using the file system paths specified above. If using mutual TLS,
+	// gateway workload instances will retrieve the CaCertificates using
+	// credentialName-cacert. The semantics of the name are platform
+	// dependent.  In Kubernetes, the default Istio supplied credential
+	// server expects the credentialName to match the name of the
+	// Kubernetes secret that holds the server certificate, the private
+	// key, and the CA certificate (if using mutual TLS). Set the
+	// `ISTIO_META_USER_SDS` metadata variable in the gateway's proxy to
+	// enable the dynamic credential fetching feature.
 	credentialName?: string @protobuf(10,name=credential_name)
 
-	//  A list of alternate names to verify the subject identity in the
-	//  certificate presented by the client.
+	// A list of alternate names to verify the subject identity in the
+	// certificate presented by the client.
 	subjectAltNames?: [...string] @protobuf(6,name=subject_alt_names)
 
-	//  Optional: Minimum TLS protocol version.
+	// Optional: Minimum TLS protocol version.
 	minProtocolVersion?: Server_TLSOptions_TLSProtocol @protobuf(7,type=TLSProtocol,name=min_protocol_version)
 
-	//  Optional: Maximum TLS protocol version.
+	// Optional: Maximum TLS protocol version.
 	maxProtocolVersion?: Server_TLSOptions_TLSProtocol @protobuf(8,type=TLSProtocol,name=max_protocol_version)
 
-	//  Optional: If specified, only support the specified cipher list.
-	//  Otherwise default to the default cipher list supported by Envoy.
+	// Optional: If specified, only support the specified cipher list.
+	// Otherwise default to the default cipher list supported by Envoy.
 	cipherSuites?: [...string] @protobuf(9,name=cipher_suites)
 }
 
-//  TLS modes enforced by the proxy
+// TLS modes enforced by the proxy
 Server_TLSOptions_TLSmode:
-	//  The SNI string presented by the client will be used as the match
-	//  criterion in a VirtualService TLS route to determine the
-	//  destination service from the service registry.
+	// The SNI string presented by the client will be used as the match
+	// criterion in a VirtualService TLS route to determine the
+	// destination service from the service registry.
 	*"PASSTHROUGH" |
 
-	//  Secure connections with standard TLS semantics.
+	// Secure connections with standard TLS semantics.
 	"SIMPLE" |
 
-	//  Secure connections to the upstream using mutual TLS by presenting
-	//  client certificates for authentication.
+	// Secure connections to the upstream using mutual TLS by presenting
+	// client certificates for authentication.
 	"MUTUAL" |
 
-	//  Similar to the passthrough mode, except servers with this TLS mode
-	//  do not require an associated VirtualService to map from the SNI
-	//  value to service in the registry. The destination details such as
-	//  the service/subset/port are encoded in the SNI value. The proxy
-	//  will forward to the upstream (Envoy) cluster (a group of
-	//  endpoints) specified by the SNI value. This server is typically
-	//  used to provide connectivity between services in disparate L3
-	//  networks that otherwise do not have direct connectivity between
-	//  their respective endpoints. Use of this mode assumes that both the
-	//  source and the destination are using Istio mTLS to secure traffic.
+	// Similar to the passthrough mode, except servers with this TLS mode
+	// do not require an associated VirtualService to map from the SNI
+	// value to service in the registry. The destination details such as
+	// the service/subset/port are encoded in the SNI value. The proxy
+	// will forward to the upstream (Envoy) cluster (a group of
+	// endpoints) specified by the SNI value. This server is typically
+	// used to provide connectivity between services in disparate L3
+	// networks that otherwise do not have direct connectivity between
+	// their respective endpoints. Use of this mode assumes that both the
+	// source and the destination are using Istio mTLS to secure traffic.
 	"AUTO_PASSTHROUGH"
 
 Server_TLSOptions_TLSmode_value: {
@@ -421,13 +421,13 @@
 	AUTO_PASSTHROUGH: 3
 }
 
-//  TLS protocol versions.
+// TLS protocol versions.
 Server_TLSOptions_TLSProtocol:
-	*"TLS_AUTO" | //  Automatically choose the optimal TLS version.
-	"TLSV1_0" | //  TLS version 1.0
-	"TLSV1_1" | //  TLS version 1.1
-	"TLSV1_2" | //  TLS version 1.2
-	"TLSV1_3" //  TLS version 1.3
+	*"TLS_AUTO" | // Automatically choose the optimal TLS version.
+	"TLSV1_0" | // TLS version 1.0
+	"TLSV1_1" | // TLS version 1.1
+	"TLSV1_2" | // TLS version 1.2
+	"TLSV1_3" // TLS version 1.3
 
 Server_TLSOptions_TLSProtocol_value: {
 	TLS_AUTO: 0
@@ -437,17 +437,17 @@
 	TLSV1_3:  4
 }
 
-//  Port describes the properties of a specific port of a service.
+// Port describes the properties of a specific port of a service.
 Port: {
-	//  REQUIRED: A valid non-negative integer port number.
+	// REQUIRED: A valid non-negative integer port number.
 	number?: uint32 @protobuf(1)
 
-	//  REQUIRED: The protocol exposed on the port.
-	//  MUST BE one of HTTP|HTTPS|GRPC|HTTP2|MONGO|TCP|TLS.
-	//  TLS implies the connection will be routed based on the SNI header to
-	//  the destination without terminating the TLS connection.
+	// REQUIRED: The protocol exposed on the port.
+	// MUST BE one of HTTP|HTTPS|GRPC|HTTP2|MONGO|TCP|TLS.
+	// TLS implies the connection will be routed based on the SNI header to
+	// the destination without terminating the TLS connection.
 	protocol?: string @protobuf(2)
 
-	//  Label assigned to the port.
+	// Label assigned to the port.
 	name?: string @protobuf(3)
 }
diff --git a/encoding/protobuf/testdata/istio.io/api/mixer/v1/attributes_proto_gen.cue b/encoding/protobuf/testdata/istio.io/api/mixer/v1/attributes_proto_gen.cue
index cf13972..3211820 100644
--- a/encoding/protobuf/testdata/istio.io/api/mixer/v1/attributes_proto_gen.cue
+++ b/encoding/protobuf/testdata/istio.io/api/mixer/v1/attributes_proto_gen.cue
@@ -1,17 +1,17 @@
 
-//  Copyright 2016 Istio Authors
-// 
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-// 
-//      http://www.apache.org/licenses/LICENSE-2.0
-// 
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
+// Copyright 2016 Istio Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 package v1
 
 import (
@@ -29,57 +29,57 @@
 	numberVal?: number @protobuf(6,type=google.protobuf.NumberValue)
 }
 
-//  Attributes represents a set of typed name/value pairs. Many of Mixer's
-//  API either consume and/or return attributes.
-// 
-//  Istio uses attributes to control the runtime behavior of services running in the service mesh.
-//  Attributes are named and typed pieces of metadata describing ingress and egress traffic and the
-//  environment this traffic occurs in. An Istio attribute carries a specific piece
-//  of information such as the error code of an API request, the latency of an API request, or the
-//  original IP address of a TCP connection. For example:
-// 
-//  ```yaml
-//  request.path: xyz/abc
-//  request.size: 234
-//  request.time: 12:34:56.789 04/17/2017
-//  source.ip: 192.168.0.1
-//  target.service: example
-//  ```
-// 
+// Attributes represents a set of typed name/value pairs. Many of Mixer's
+// API either consume and/or return attributes.
+//
+// Istio uses attributes to control the runtime behavior of services running in the service mesh.
+// Attributes are named and typed pieces of metadata describing ingress and egress traffic and the
+// environment this traffic occurs in. An Istio attribute carries a specific piece
+// of information such as the error code of an API request, the latency of an API request, or the
+// original IP address of a TCP connection. For example:
+//
+// ```yaml
+// request.path: xyz/abc
+// request.size: 234
+// request.time: 12:34:56.789 04/17/2017
+// source.ip: 192.168.0.1
+// target.service: example
+// ```
+//
 Attributes: {
-	//  A map of attribute name to its value.
+	// A map of attribute name to its value.
 	attributes: {
 		<_>: Attributes_AttributeValue
 	} @protobuf(1,type=map<string,AttributeValue>)
 }
 
-//  Specifies one attribute value with different type.
+// Specifies one attribute value with different type.
 Attributes_AttributeValue: {
 }
-//  The attribute value.
+// The attribute value.
 Attributes_AttributeValue: {
-	//  Used for values of type STRING, DNS_NAME, EMAIL_ADDRESS, and URI
+	// Used for values of type STRING, DNS_NAME, EMAIL_ADDRESS, and URI
 	stringValue: string @protobuf(2,name=string_value)
 } | {
-	//  Used for values of type INT64
+	// Used for values of type INT64
 	int64Value: int64 @protobuf(3,name=int64_value)
 } | {
-	//  Used for values of type DOUBLE
+	// Used for values of type DOUBLE
 	doubleValue: float64 @protobuf(4,type=double,name=double_value)
 } | {
-	//  Used for values of type BOOL
+	// Used for values of type BOOL
 	boolValue: bool @protobuf(5,name=bool_value)
 } | {
-	//  Used for values of type BYTES
+	// Used for values of type BYTES
 	bytesValue: bytes @protobuf(6,name=bytes_value)
 } | {
-	//  Used for values of type TIMESTAMP
+	// Used for values of type TIMESTAMP
 	timestampValue: time.Time @protobuf(7,type=google.protobuf.Timestamp,name=timestamp_value)
 } | {
-	//  Used for values of type DURATION
+	// Used for values of type DURATION
 	durationValue: time.Duration @protobuf(8,type=google.protobuf.Duration,name=duration_value)
 } | {
-	//  Used for values of type STRING_MAP
+	// Used for values of type STRING_MAP
 	stringMapValue: Attributes_StringMap @protobuf(9,type=StringMap,name=string_map_value)
 } | {
 	testValue: test.Test @protobuf(10,type=acme.test.Test,name=test_value)
@@ -87,61 +87,61 @@
 	testValue: test_test.AnotherTest @protobuf(11,type=acme.test.test.AnotherTest,name=test_value)
 }
 
-//  Defines a string map.
+// Defines a string map.
 Attributes_StringMap: {
-	//  Holds a set of name/value pairs.
+	// Holds a set of name/value pairs.
 	entries: {
 		<_>: string
 	} @protobuf(1,type=map<string,string>)
 }
 
-//  Defines a list of attributes in compressed format optimized for transport.
-//  Within this message, strings are referenced using integer indices into
-//  one of two string dictionaries. Positive integers index into the global
-//  deployment-wide dictionary, whereas negative integers index into the message-level
-//  dictionary instead. The message-level dictionary is carried by the
-//  `words` field of this message, the deployment-wide dictionary is determined via
-//  configuration.
+// Defines a list of attributes in compressed format optimized for transport.
+// Within this message, strings are referenced using integer indices into
+// one of two string dictionaries. Positive integers index into the global
+// deployment-wide dictionary, whereas negative integers index into the message-level
+// dictionary instead. The message-level dictionary is carried by the
+// `words` field of this message, the deployment-wide dictionary is determined via
+// configuration.
 CompressedAttributes: {
-	//  The message-level dictionary.
+	// The message-level dictionary.
 	words?: [...string] @protobuf(1)
 
-	//  Holds attributes of type STRING, DNS_NAME, EMAIL_ADDRESS, URI
+	// Holds attributes of type STRING, DNS_NAME, EMAIL_ADDRESS, URI
 	strings: {
 		<_>: int32
 	} @protobuf(2,type=map<sint32,sint32>)
 
-	//  Holds attributes of type INT64
+	// Holds attributes of type INT64
 	int64s: {
 		<_>: int64
 	} @protobuf(3,type=map<sint32,int64>)
 
-	//  Holds attributes of type DOUBLE
+	// Holds attributes of type DOUBLE
 	doubles: {
 		<_>: float64
 	} @protobuf(4,type=map<sint32,double>)
 
-	//  Holds attributes of type BOOL
+	// Holds attributes of type BOOL
 	bools: {
 		<_>: bool
 	} @protobuf(5,type=map<sint32,bool>)
 
-	//  Holds attributes of type TIMESTAMP
+	// Holds attributes of type TIMESTAMP
 	time: {
 		<_>: __time.Time
 	} @protobuf(6,type=map<sint32,google.protobuf.Timestamp>,"(gogoproto.nullable)=false","(gogoproto.stdtime)")
 
-	//  Holds attributes of type DURATION
+	// Holds attributes of type DURATION
 	durations: {
 		<_>: __time.Duration
 	} @protobuf(7,type=map<sint32,google.protobuf.Duration>,"(gogoproto.nullable)=false","(gogoproto.stdduration)")
 
-	//  Holds attributes of type BYTES
+	// Holds attributes of type BYTES
 	bytes: {
 		<_>: __bytes
 	} @protobuf(8,type=map<sint32,bytes>)
 
-	//  Holds attributes of type STRING_MAP
+	// Holds attributes of type STRING_MAP
 	stringMaps: {
 		<_>: StringMap
 	} @protobuf(9,type=map<sint32,StringMap>,string_maps,"(gogoproto.nullable)=false")
@@ -149,10 +149,10 @@
 __time = time
 __bytes = bytes
 
-//  A map of string to string. The keys and values in this map are dictionary
-//  indices (see the [Attributes][istio.mixer.v1.CompressedAttributes] message for an explanation)
+// A map of string to string. The keys and values in this map are dictionary
+// indices (see the [Attributes][istio.mixer.v1.CompressedAttributes] message for an explanation)
 StringMap: {
-	//  Holds a set of name/value pairs.
+	// Holds a set of name/value pairs.
 	entries: {
 		<_>: int32
 	} @protobuf(1,type=map<sint32,sint32>)
diff --git a/encoding/protobuf/testdata/istio.io/api/mixer/v1/config/client/api_spec_proto_gen.cue b/encoding/protobuf/testdata/istio.io/api/mixer/v1/config/client/api_spec_proto_gen.cue
index 3650de8..6594c92 100644
--- a/encoding/protobuf/testdata/istio.io/api/mixer/v1/config/client/api_spec_proto_gen.cue
+++ b/encoding/protobuf/testdata/istio.io/api/mixer/v1/config/client/api_spec_proto_gen.cue
@@ -1,228 +1,228 @@
 
-//  Copyright 2017 Istio Authors
-// 
-//    Licensed under the Apache License, Version 2.0 (the "License");
-//    you may not use this file except in compliance with the License.
-//    You may obtain a copy of the License at
-// 
-//        http://www.apache.org/licenses/LICENSE-2.0
-// 
-//    Unless required by applicable law or agreed to in writing, software
-//    distributed under the License is distributed on an "AS IS" BASIS,
-//    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//    See the License for the specific language governing permissions and
-//    limitations under the License.
+// Copyright 2017 Istio Authors
+//
+//   Licensed under the Apache License, Version 2.0 (the "License");
+//   you may not use this file except in compliance with the License.
+//   You may obtain a copy of the License at
+//
+//       http://www.apache.org/licenses/LICENSE-2.0
+//
+//   Unless required by applicable law or agreed to in writing, software
+//   distributed under the License is distributed on an "AS IS" BASIS,
+//   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//   See the License for the specific language governing permissions and
+//   limitations under the License.
 package client
 
 import "istio.io/api/mixer/v1"
 
-//  HTTPAPISpec defines the canonical configuration for generating
-//  API-related attributes from HTTP requests based on the method and
-//  uri templated path matches. It is sufficient for defining the API
-//  surface of a service for the purposes of API attribute
-//  generation. It is not intended to represent auth, quota,
-//  documentation, or other information commonly found in other API
-//  specifications, e.g. OpenAPI.
-// 
-//  Existing standards that define operations (or methods) in terms of
-//  HTTP methods and paths can be normalized to this format for use in
-//  Istio. For example, a simple petstore API described by OpenAPIv2
-//  [here](https://github.com/googleapis/gnostic/blob/master/examples/v2.0/yaml/petstore-simple.yaml)
-//  can be represented with the following HTTPAPISpec.
-// 
-//  ```yaml
-//  apiVersion: config.istio.io/v1alpha2
-//  kind: HTTPAPISpec
-//  metadata:
-//    name: petstore
-//    namespace: default
-//  spec:
-//    attributes:
-//      attributes:
-//        api.service:
-//          stringValue: petstore.swagger.io
-//        api.version:
-//          stringValue: 1.0.0
-//    patterns:
-//    - attributes:
-//        attributes:
-//          api.operation:
-//            stringValue: findPets
-//      httpMethod: GET
-//      uriTemplate: /api/pets
-//    - attributes:
-//        attributes:
-//          api.operation:
-//            stringValue: addPet
-//      httpMethod: POST
-//      uriTemplate: /api/pets
-//    - attributes:
-//        attributes:
-//          api.operation:
-//            stringValue: findPetById
-//      httpMethod: GET
-//      uriTemplate: /api/pets/{id}
-//    - attributes:
-//        attributes:
-//          api.operation:
-//            stringValue: deletePet
-//      httpMethod: DELETE
-//      uriTemplate: /api/pets/{id}
-//    api_keys:
-//    - query: api-key
-//  ```
+// HTTPAPISpec defines the canonical configuration for generating
+// API-related attributes from HTTP requests based on the method and
+// uri templated path matches. It is sufficient for defining the API
+// surface of a service for the purposes of API attribute
+// generation. It is not intended to represent auth, quota,
+// documentation, or other information commonly found in other API
+// specifications, e.g. OpenAPI.
+//
+// Existing standards that define operations (or methods) in terms of
+// HTTP methods and paths can be normalized to this format for use in
+// Istio. For example, a simple petstore API described by OpenAPIv2
+// [here](https://github.com/googleapis/gnostic/blob/master/examples/v2.0/yaml/petstore-simple.yaml)
+// can be represented with the following HTTPAPISpec.
+//
+// ```yaml
+// apiVersion: config.istio.io/v1alpha2
+// kind: HTTPAPISpec
+// metadata:
+//   name: petstore
+//   namespace: default
+// spec:
+//   attributes:
+//     attributes:
+//       api.service:
+//         stringValue: petstore.swagger.io
+//       api.version:
+//         stringValue: 1.0.0
+//   patterns:
+//   - attributes:
+//       attributes:
+//         api.operation:
+//           stringValue: findPets
+//     httpMethod: GET
+//     uriTemplate: /api/pets
+//   - attributes:
+//       attributes:
+//         api.operation:
+//           stringValue: addPet
+//     httpMethod: POST
+//     uriTemplate: /api/pets
+//   - attributes:
+//       attributes:
+//         api.operation:
+//           stringValue: findPetById
+//     httpMethod: GET
+//     uriTemplate: /api/pets/{id}
+//   - attributes:
+//       attributes:
+//         api.operation:
+//           stringValue: deletePet
+//     httpMethod: DELETE
+//     uriTemplate: /api/pets/{id}
+//   api_keys:
+//   - query: api-key
+// ```
 HTTPAPISpec: {
-	//  List of attributes that are generated when *any* of the HTTP
-	//  patterns match. This list typically includes the "api.service"
-	//  and "api.version" attributes.
+	// List of attributes that are generated when *any* of the HTTP
+	// patterns match. This list typically includes the "api.service"
+	// and "api.version" attributes.
 	attributes?: v1.Attributes @protobuf(1,type=Attributes)
 
-	//  List of HTTP patterns to match.
+	// List of HTTP patterns to match.
 	patterns?: [...HTTPAPISpecPattern] @protobuf(2)
 
-	//  List of APIKey that describes how to extract an API-KEY from an
-	//  HTTP request. The first API-Key match found in the list is used,
-	//  i.e. 'OR' semantics.
-	// 
-	//  The following default policies are used to generate the
-	//  `request.api_key` attribute if no explicit APIKey is defined.
-	// 
-	//      `query: key, `query: api_key`, and then `header: x-api-key`
-	// 
+	// List of APIKey that describes how to extract an API-KEY from an
+	// HTTP request. The first API-Key match found in the list is used,
+	// i.e. 'OR' semantics.
+	//
+	// The following default policies are used to generate the
+	// `request.api_key` attribute if no explicit APIKey is defined.
+	//
+	//     `query: key, `query: api_key`, and then `header: x-api-key`
+	//
 	apiKeys?: [...APIKey] @protobuf(3,name=api_keys)
 }
 
-//  HTTPAPISpecPattern defines a single pattern to match against
-//  incoming HTTP requests. The per-pattern list of attributes is
-//  generated if both the http_method and uri_template match. In
-//  addition, the top-level list of attributes in the HTTPAPISpec is also
-//  generated.
-// 
-//  ```yaml
-//  pattern:
-//  - attributes
-//      api.operation: doFooBar
-//    httpMethod: GET
-//    uriTemplate: /foo/bar
-//  ```
+// HTTPAPISpecPattern defines a single pattern to match against
+// incoming HTTP requests. The per-pattern list of attributes is
+// generated if both the http_method and uri_template match. In
+// addition, the top-level list of attributes in the HTTPAPISpec is also
+// generated.
+//
+// ```yaml
+// pattern:
+// - attributes
+//     api.operation: doFooBar
+//   httpMethod: GET
+//   uriTemplate: /foo/bar
+// ```
 HTTPAPISpecPattern: {
-	//  List of attributes that are generated if the HTTP request matches
-	//  the specified http_method and uri_template. This typically
-	//  includes the "api.operation" attribute.
+	// List of attributes that are generated if the HTTP request matches
+	// the specified http_method and uri_template. This typically
+	// includes the "api.operation" attribute.
 	attributes?: v1.Attributes @protobuf(1,type=Attributes)
 
-	//  HTTP request method to match against as defined by
-	//  [rfc7231](https://tools.ietf.org/html/rfc7231#page-21). For
-	//  example: GET, HEAD, POST, PUT, DELETE.
+	// HTTP request method to match against as defined by
+	// [rfc7231](https://tools.ietf.org/html/rfc7231#page-21). For
+	// example: GET, HEAD, POST, PUT, DELETE.
 	httpMethod?: string @protobuf(2,name=http_method)
 }
 HTTPAPISpecPattern: {
-	//  URI template to match against as defined by
-	//  [rfc6570](https://tools.ietf.org/html/rfc6570). For example, the
-	//  following are valid URI templates:
-	// 
-	//      /pets
-	//      /pets/{id}
-	//      /dictionary/{term:1}/{term}
-	//      /search{?q*,lang}
-	// 
+	// URI template to match against as defined by
+	// [rfc6570](https://tools.ietf.org/html/rfc6570). For example, the
+	// following are valid URI templates:
+	//
+	//     /pets
+	//     /pets/{id}
+	//     /dictionary/{term:1}/{term}
+	//     /search{?q*,lang}
+	//
 	uriTemplate: string @protobuf(3,name=uri_template)
 } | {
-	//  EXPERIMENTAL:
-	// 
-	//  ecmascript style regex-based match as defined by
-	//  [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript). For
-	//  example,
-	// 
-	//      "^/pets/(.*?)?"
-	// 
+	// EXPERIMENTAL:
+	//
+	// ecmascript style regex-based match as defined by
+	// [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript). For
+	// example,
+	//
+	//     "^/pets/(.*?)?"
+	//
 	regex: string @protobuf(4)
 }
 
-//  APIKey defines the explicit configuration for generating the
-//  `request.api_key` attribute from HTTP requests.
-// 
-//  See [API Keys](https://swagger.io/docs/specification/authentication/api-keys)
-//  for a general overview of API keys as defined by OpenAPI.
+// APIKey defines the explicit configuration for generating the
+// `request.api_key` attribute from HTTP requests.
+//
+// See [API Keys](https://swagger.io/docs/specification/authentication/api-keys)
+// for a general overview of API keys as defined by OpenAPI.
 APIKey: {
 }
 APIKey: {
-	//  API Key is sent as a query parameter. `query` represents the
-	//  query string parameter name.
-	// 
-	//  For example, `query=api_key` should be used with the
-	//  following request:
-	// 
-	//      GET /something?api_key=abcdef12345
-	// 
+	// API Key is sent as a query parameter. `query` represents the
+	// query string parameter name.
+	//
+	// For example, `query=api_key` should be used with the
+	// following request:
+	//
+	//     GET /something?api_key=abcdef12345
+	//
 	query: string @protobuf(1)
 } | {
-	//  API key is sent in a request header. `header` represents the
-	//  header name.
-	// 
-	//  For example, `header=X-API-KEY` should be used with the
-	//  following request:
-	// 
-	//      GET /something HTTP/1.1
-	//      X-API-Key: abcdef12345
-	// 
+	// API key is sent in a request header. `header` represents the
+	// header name.
+	//
+	// For example, `header=X-API-KEY` should be used with the
+	// following request:
+	//
+	//     GET /something HTTP/1.1
+	//     X-API-Key: abcdef12345
+	//
 	header: string @protobuf(2)
 } | {
-	//  API key is sent in a
-	//  [cookie](https://swagger.io/docs/specification/authentication/cookie-authentication),
-	// 
-	//  For example, `cookie=X-API-KEY` should be used for the
-	//  following request:
-	// 
-	//      GET /something HTTP/1.1
-	//      Cookie: X-API-KEY=abcdef12345
-	// 
+	// API key is sent in a
+	// [cookie](https://swagger.io/docs/specification/authentication/cookie-authentication),
+	//
+	// For example, `cookie=X-API-KEY` should be used for the
+	// following request:
+	//
+	//     GET /something HTTP/1.1
+	//     Cookie: X-API-KEY=abcdef12345
+	//
 	cookie: string @protobuf(3)
 }
 
-//  HTTPAPISpecReference defines a reference to an HTTPAPISpec. This is
-//  typically used for establishing bindings between an HTTPAPISpec and an
-//  IstioService. For example, the following defines an
-//  HTTPAPISpecReference for service `foo` in namespace `bar`.
-// 
-//  ```yaml
-//  - name: foo
-//    namespace: bar
-//  ```
+// HTTPAPISpecReference defines a reference to an HTTPAPISpec. This is
+// typically used for establishing bindings between an HTTPAPISpec and an
+// IstioService. For example, the following defines an
+// HTTPAPISpecReference for service `foo` in namespace `bar`.
+//
+// ```yaml
+// - name: foo
+//   namespace: bar
+// ```
 HTTPAPISpecReference: {
-	//  REQUIRED. The short name of the HTTPAPISpec. This is the resource
-	//  name defined by the metadata name field.
+	// REQUIRED. The short name of the HTTPAPISpec. This is the resource
+	// name defined by the metadata name field.
 	name?: string @protobuf(1)
 
-	//  Optional namespace of the HTTPAPISpec. Defaults to the encompassing
-	//  HTTPAPISpecBinding's metadata namespace field.
+	// Optional namespace of the HTTPAPISpec. Defaults to the encompassing
+	// HTTPAPISpecBinding's metadata namespace field.
 	namespace?: string @protobuf(2)
 }
 
-//  HTTPAPISpecBinding defines the binding between HTTPAPISpecs and one or more
-//  IstioService. For example, the following establishes a binding
-//  between the HTTPAPISpec `petstore` and service `foo` in namespace `bar`.
-// 
-//  ```yaml
-//  apiVersion: config.istio.io/v1alpha2
-//  kind: HTTPAPISpecBinding
-//  metadata:
-//    name: my-binding
-//    namespace: default
-//  spec:
-//    services:
-//    - name: foo
-//      namespace: bar
-//    api_specs:
-//    - name: petstore
-//      namespace: default
-//  ```
+// HTTPAPISpecBinding defines the binding between HTTPAPISpecs and one or more
+// IstioService. For example, the following establishes a binding
+// between the HTTPAPISpec `petstore` and service `foo` in namespace `bar`.
+//
+// ```yaml
+// apiVersion: config.istio.io/v1alpha2
+// kind: HTTPAPISpecBinding
+// metadata:
+//   name: my-binding
+//   namespace: default
+// spec:
+//   services:
+//   - name: foo
+//     namespace: bar
+//   api_specs:
+//   - name: petstore
+//     namespace: default
+// ```
 HTTPAPISpecBinding: {
-	//  REQUIRED. One or more services to map the listed HTTPAPISpec onto.
+	// REQUIRED. One or more services to map the listed HTTPAPISpec onto.
 	services?: [...IstioService] @protobuf(1)
 
-	//  REQUIRED. One or more HTTPAPISpec references that should be mapped to
-	//  the specified service(s). The aggregate collection of match
-	//  conditions defined in the HTTPAPISpecs should not overlap.
+	// REQUIRED. One or more HTTPAPISpec references that should be mapped to
+	// the specified service(s). The aggregate collection of match
+	// conditions defined in the HTTPAPISpecs should not overlap.
 	apiSpecs?: [...HTTPAPISpecReference] @protobuf(2,name=api_specs)
 }
diff --git a/encoding/protobuf/testdata/istio.io/api/mixer/v1/config/client/client_config_proto_gen.cue b/encoding/protobuf/testdata/istio.io/api/mixer/v1/config/client/client_config_proto_gen.cue
index dd44e5c..03a0025 100644
--- a/encoding/protobuf/testdata/istio.io/api/mixer/v1/config/client/client_config_proto_gen.cue
+++ b/encoding/protobuf/testdata/istio.io/api/mixer/v1/config/client/client_config_proto_gen.cue
@@ -1,22 +1,22 @@
-//  Copyright 2017 Istio Authors
-// 
-//    Licensed under the Apache License, Version 2.0 (the "License");
-//    you may not use this file except in compliance with the License.
-//    You may obtain a copy of the License at
-// 
-//        http://www.apache.org/licenses/LICENSE-2.0
-// 
-//    Unless required by applicable law or agreed to in writing, software
-//    distributed under the License is distributed on an "AS IS" BASIS,
-//    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//    See the License for the specific language governing permissions and
-//    limitations under the License.
+// Copyright 2017 Istio Authors
+//
+//   Licensed under the Apache License, Version 2.0 (the "License");
+//   you may not use this file except in compliance with the License.
+//   You may obtain a copy of the License at
+//
+//       http://www.apache.org/licenses/LICENSE-2.0
+//
+//   Unless required by applicable law or agreed to in writing, software
+//   distributed under the License is distributed on an "AS IS" BASIS,
+//   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//   See the License for the specific language governing permissions and
+//   limitations under the License.
 
-//  $title: Mixer Client
-//  $description: Configuration state for the Mixer client library.
-//  $location: https://istio.io/docs/reference/config/policy-and-telemetry/istio.mixer.v1.config.client
+// $title: Mixer Client
+// $description: Configuration state for the Mixer client library.
+// $location: https://istio.io/docs/reference/config/policy-and-telemetry/istio.mixer.v1.config.client
 
-//  Describes the configuration state for the Mixer client library that's built into Envoy.
+// Describes the configuration state for the Mixer client library that's built into Envoy.
 package client
 
 import (
@@ -24,165 +24,165 @@
 	"time"
 )
 
-//  Specifies the behavior when the client is unable to connect to Mixer.
+// Specifies the behavior when the client is unable to connect to Mixer.
 NetworkFailPolicy: {
 
-	//  Specifies the behavior when the client is unable to connect to Mixer.
+	// Specifies the behavior when the client is unable to connect to Mixer.
 	policy?: NetworkFailPolicy_FailPolicy @protobuf(1,type=FailPolicy)
 
-	//  Max retries on transport error.
+	// Max retries on transport error.
 	maxRetry?: uint32 @protobuf(2,name=max_retry)
 
-	//  Base time to wait between retries.  Will be adjusted by exponential
-	//  backoff and jitter.
+	// Base time to wait between retries.  Will be adjusted by exponential
+	// backoff and jitter.
 	baseRetryWait?: time.Duration @protobuf(3,type=google.protobuf.Duration,name=base_retry_wait)
 
-	//  Max time to wait between retries.
+	// Max time to wait between retries.
 	maxRetryWait?: time.Duration @protobuf(4,type=google.protobuf.Duration,name=max_retry_wait)
 }
 
-//  Example of single-value enum.
+// Example of single-value enum.
 NetworkFailPolicy_FailPolicy:
-	//  If network connection fails, request is allowed and delivered to the
-	//  service.
+	// If network connection fails, request is allowed and delivered to the
+	// service.
 	"FAIL_OPEN"
 
 NetworkFailPolicy_FailPolicy_value "FAIL_OPEN": 0
 
-//  Defines the per-service client configuration.
+// Defines the per-service client configuration.
 ServiceConfig: {
-	//  If true, do not call Mixer Check.
+	// If true, do not call Mixer Check.
 	disableCheckCalls?: bool @protobuf(1,name=disable_check_calls)
 
-	//  If true, do not call Mixer Report.
+	// If true, do not call Mixer Report.
 	disableReportCalls?: bool @protobuf(2,name=disable_report_calls)
 
-	//  Send these attributes to Mixer in both Check and Report. This
-	//  typically includes the "destination.service" attribute.
-	//  In case of a per-route override, per-route attributes take precedence
-	//  over the attributes supplied in the client configuration.
+	// Send these attributes to Mixer in both Check and Report. This
+	// typically includes the "destination.service" attribute.
+	// In case of a per-route override, per-route attributes take precedence
+	// over the attributes supplied in the client configuration.
 	mixerAttributes?: v1.Attributes @protobuf(3,type=Attributes,name=mixer_attributes)
 
-	//  HTTP API specifications to generate API attributes.
+	// HTTP API specifications to generate API attributes.
 	httpApiSpec?: [...HTTPAPISpec] @protobuf(4,name=http_api_spec)
 
-	//  Quota specifications to generate quota requirements.
+	// Quota specifications to generate quota requirements.
 	quotaSpec?: [...QuotaSpec] @protobuf(5,name=quota_spec)
 
-	//  Specifies the behavior when the client is unable to connect to Mixer.
-	//  This is the service-level policy. It overrides
-	//  [mesh-level
-	//  policy][istio.mixer.v1.config.client.TransportConfig.network_fail_policy].
+	// Specifies the behavior when the client is unable to connect to Mixer.
+	// This is the service-level policy. It overrides
+	// [mesh-level
+	// policy][istio.mixer.v1.config.client.TransportConfig.network_fail_policy].
 	networkFailPolicy?: NetworkFailPolicy @protobuf(7,name=network_fail_policy)
 
-	//  Default attributes to forward to upstream. This typically
-	//  includes the "source.ip" and "source.uid" attributes.
-	//  In case of a per-route override, per-route attributes take precedence
-	//  over the attributes supplied in the client configuration.
-	// 
-	//  Forwarded attributes take precedence over the static Mixer attributes.
-	//  The full order of application is as follows:
-	//  1. static Mixer attributes from the filter config;
-	//  2. static Mixer attributes from the route config;
-	//  3. forwarded attributes from the source filter config (if any);
-	//  4. forwarded attributes from the source route config (if any);
-	//  5. derived attributes from the request metadata.
+	// Default attributes to forward to upstream. This typically
+	// includes the "source.ip" and "source.uid" attributes.
+	// In case of a per-route override, per-route attributes take precedence
+	// over the attributes supplied in the client configuration.
+	//
+	// Forwarded attributes take precedence over the static Mixer attributes.
+	// The full order of application is as follows:
+	// 1. static Mixer attributes from the filter config;
+	// 2. static Mixer attributes from the route config;
+	// 3. forwarded attributes from the source filter config (if any);
+	// 4. forwarded attributes from the source route config (if any);
+	// 5. derived attributes from the request metadata.
 	forwardAttributes?: v1.Attributes @protobuf(8,type=Attributes,name=forward_attributes)
 }
 
-//  Defines the transport config on how to call Mixer.
+// Defines the transport config on how to call Mixer.
 TransportConfig: {
-	//  The flag to disable check cache.
+	// The flag to disable check cache.
 	disableCheckCache?: bool @protobuf(1,name=disable_check_cache)
 
-	//  The flag to disable quota cache.
+	// The flag to disable quota cache.
 	disableQuotaCache?: bool @protobuf(2,name=disable_quota_cache)
 
-	//  The flag to disable report batch.
+	// The flag to disable report batch.
 	disableReportBatch?: bool @protobuf(3,name=disable_report_batch)
 
-	//  Specifies the behavior when the client is unable to connect to Mixer.
-	//  This is the mesh level policy. The default value for policy is FAIL_OPEN.
+	// Specifies the behavior when the client is unable to connect to Mixer.
+	// This is the mesh level policy. The default value for policy is FAIL_OPEN.
 	networkFailPolicy?: NetworkFailPolicy @protobuf(4,name=network_fail_policy)
 
-	//  Specify refresh interval to write Mixer client statistics to Envoy share
-	//  memory. If not specified, the interval is 10 seconds.
+	// Specify refresh interval to write Mixer client statistics to Envoy share
+	// memory. If not specified, the interval is 10 seconds.
 	statsUpdateInterval?: time.Duration @protobuf(5,type=google.protobuf.Duration,name=stats_update_interval)
 
-	//  Name of the cluster that will forward check calls to a pool of mixer
-	//  servers. Defaults to "mixer_server". By using different names for
-	//  checkCluster and reportCluster, it is possible to have one set of
-	//  Mixer servers handle check calls, while another set of Mixer servers
-	//  handle report calls.
-	// 
-	//  NOTE: Any value other than the default "mixer_server" will require the
-	//  Istio Grafana dashboards to be reconfigured to use the new name.
+	// Name of the cluster that will forward check calls to a pool of mixer
+	// servers. Defaults to "mixer_server". By using different names for
+	// checkCluster and reportCluster, it is possible to have one set of
+	// Mixer servers handle check calls, while another set of Mixer servers
+	// handle report calls.
+	//
+	// NOTE: Any value other than the default "mixer_server" will require the
+	// Istio Grafana dashboards to be reconfigured to use the new name.
 	checkCluster?: string @protobuf(6,name=check_cluster)
 
-	//  Name of the cluster that will forward report calls to a pool of mixer
-	//  servers. Defaults to "mixer_server". By using different names for
-	//  checkCluster and reportCluster, it is possible to have one set of
-	//  Mixer servers handle check calls, while another set of Mixer servers
-	//  handle report calls.
-	// 
-	//  NOTE: Any value other than the default "mixer_server" will require the
-	//  Istio Grafana dashboards to be reconfigured to use the new name.
+	// Name of the cluster that will forward report calls to a pool of mixer
+	// servers. Defaults to "mixer_server". By using different names for
+	// checkCluster and reportCluster, it is possible to have one set of
+	// Mixer servers handle check calls, while another set of Mixer servers
+	// handle report calls.
+	//
+	// NOTE: Any value other than the default "mixer_server" will require the
+	// Istio Grafana dashboards to be reconfigured to use the new name.
 	reportCluster?: string @protobuf(7,name=report_cluster)
 
-	//  Default attributes to forward to Mixer upstream. This typically
-	//  includes the "source.ip" and "source.uid" attributes. These
-	//  attributes are consumed by the proxy in front of mixer.
+	// Default attributes to forward to Mixer upstream. This typically
+	// includes the "source.ip" and "source.uid" attributes. These
+	// attributes are consumed by the proxy in front of mixer.
 	attributesForMixerProxy?: v1.Attributes @protobuf(8,type=Attributes,name=attributes_for_mixer_proxy)
 }
 
-//  Defines the client config for HTTP.
+// Defines the client config for HTTP.
 HttpClientConfig: {
-	//  The transport config.
+	// The transport config.
 	transport?: TransportConfig @protobuf(1)
 
-	//  Map of control configuration indexed by destination.service. This
-	//  is used to support per-service configuration for cases where a
-	//  mixerclient serves multiple services.
+	// Map of control configuration indexed by destination.service. This
+	// is used to support per-service configuration for cases where a
+	// mixerclient serves multiple services.
 	serviceConfigs: {
 		<_>: ServiceConfig
 	} @protobuf(2,type=map<string,ServiceConfig>,service_configs)
 
-	//  Default destination service name if none was specified in the
-	//  client request.
+	// Default destination service name if none was specified in the
+	// client request.
 	defaultDestinationService?: string @protobuf(3,name=default_destination_service)
 
-	//  Default attributes to send to Mixer in both Check and
-	//  Report. This typically includes "destination.ip" and
-	//  "destination.uid" attributes.
+	// Default attributes to send to Mixer in both Check and
+	// Report. This typically includes "destination.ip" and
+	// "destination.uid" attributes.
 	mixerAttributes?: v1.Attributes @protobuf(4,type=Attributes,name=mixer_attributes)
 
-	//  Default attributes to forward to upstream. This typically
-	//  includes the "source.ip" and "source.uid" attributes.
+	// Default attributes to forward to upstream. This typically
+	// includes the "source.ip" and "source.uid" attributes.
 	forwardAttributes?: v1.Attributes @protobuf(5,type=Attributes,name=forward_attributes)
 }
 
-//  Defines the client config for TCP.
+// Defines the client config for TCP.
 TcpClientConfig: {
-	//  The transport config.
+	// The transport config.
 	transport?: TransportConfig @protobuf(1)
 
-	//  Default attributes to send to Mixer in both Check and
-	//  Report. This typically includes "destination.ip" and
-	//  "destination.uid" attributes.
+	// Default attributes to send to Mixer in both Check and
+	// Report. This typically includes "destination.ip" and
+	// "destination.uid" attributes.
 	mixerAttributes?: v1.Attributes @protobuf(2,type=Attributes,name=mixer_attributes)
 
-	//  If set to true, disables Mixer check calls.
+	// If set to true, disables Mixer check calls.
 	disableCheckCalls?: bool @protobuf(3,name=disable_check_calls)
 
-	//  If set to true, disables Mixer check calls.
+	// If set to true, disables Mixer check calls.
 	disableReportCalls?: bool @protobuf(4,name=disable_report_calls)
 
-	//  Quota specifications to generate quota requirements.
-	//  It applies on the new TCP connections.
+	// Quota specifications to generate quota requirements.
+	// It applies on the new TCP connections.
 	connectionQuotaSpec?: QuotaSpec @protobuf(5,name=connection_quota_spec)
 
-	//  Specify report interval to send periodical reports for long TCP
-	//  connections. If not specified, the interval is 10 seconds. This interval
-	//  should not be less than 1 second, otherwise it will be reset to 1 second.
+	// Specify report interval to send periodical reports for long TCP
+	// connections. If not specified, the interval is 10 seconds. This interval
+	// should not be less than 1 second, otherwise it will be reset to 1 second.
 	reportInterval?: time.Duration @protobuf(6,type=google.protobuf.Duration,name=report_interval)
 }
diff --git a/encoding/protobuf/testdata/istio.io/api/mixer/v1/config/client/quota_proto_gen.cue b/encoding/protobuf/testdata/istio.io/api/mixer/v1/config/client/quota_proto_gen.cue
index e729d01..394d5e3 100644
--- a/encoding/protobuf/testdata/istio.io/api/mixer/v1/config/client/quota_proto_gen.cue
+++ b/encoding/protobuf/testdata/istio.io/api/mixer/v1/config/client/quota_proto_gen.cue
@@ -1,136 +1,136 @@
-//  Copyright 2017 Istio Authors
-// 
-//    Licensed under the Apache License, Version 2.0 (the "License");
-//    you may not use this file except in compliance with the License.
-//    You may obtain a copy of the License at
-// 
-//        http://www.apache.org/licenses/LICENSE-2.0
-// 
-//    Unless required by applicable law or agreed to in writing, software
-//    distributed under the License is distributed on an "AS IS" BASIS,
-//    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//    See the License for the specific language governing permissions and
-//    limitations under the License.
+// Copyright 2017 Istio Authors
+//
+//   Licensed under the Apache License, Version 2.0 (the "License");
+//   you may not use this file except in compliance with the License.
+//   You may obtain a copy of the License at
+//
+//       http://www.apache.org/licenses/LICENSE-2.0
+//
+//   Unless required by applicable law or agreed to in writing, software
+//   distributed under the License is distributed on an "AS IS" BASIS,
+//   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//   See the License for the specific language governing permissions and
+//   limitations under the License.
 
-//  Specifies runtime quota rules.
-//   * Uses Istio attributes to match individual requests
-//   * Specifies list of quotas to use for matched requests.
-// 
-//  Example1:
-//  Charge "request_count" quota with 1 amount for all requests.
-// 
-//    QuotaSpec:
-//      - rules
-//        - quotas:
-//            quota: request_count
-//            charge: 1
-// 
-//  Example2:
-//  For HTTP POST requests with path are prefixed with /books or
-//  api.operation is create_books, charge two quotas:
-//  * write_count of 1 amount
-//  * request_count of 5 amount.
-// 
-//  ```yaml
-//  QuotaSpec:
-//    - rules:
-//      - match:
-//          clause:
-//            request.path:
-//              string_prefix: /books
-//            request.http_method:
-//              string_exact: POST
-//      - match:
-//          clause:
-//            api.operation:
-//              string_exact: create_books
-//      - quotas:
-//          quota: write_count
-//          charge: 1
-//      - quotas:
-//          quota: request_count
-//          charge: 5
-//  ```
+// Specifies runtime quota rules.
+//  * Uses Istio attributes to match individual requests
+//  * Specifies list of quotas to use for matched requests.
+//
+// Example1:
+// Charge "request_count" quota with 1 amount for all requests.
+//
+//   QuotaSpec:
+//     - rules
+//       - quotas:
+//           quota: request_count
+//           charge: 1
+//
+// Example2:
+// For HTTP POST requests with path are prefixed with /books or
+// api.operation is create_books, charge two quotas:
+// * write_count of 1 amount
+// * request_count of 5 amount.
+//
+// ```yaml
+// QuotaSpec:
+//   - rules:
+//     - match:
+//         clause:
+//           request.path:
+//             string_prefix: /books
+//           request.http_method:
+//             string_exact: POST
+//     - match:
+//         clause:
+//           api.operation:
+//             string_exact: create_books
+//     - quotas:
+//         quota: write_count
+//         charge: 1
+//     - quotas:
+//         quota: request_count
+//         charge: 5
+// ```
 package client
 
-//  Determines the quotas used for individual requests.
+// Determines the quotas used for individual requests.
 QuotaSpec: {
-	//  A list of Quota rules.
+	// A list of Quota rules.
 	rules?: [...QuotaRule] @protobuf(1)
 }
 
-//  Specifies a rule with list of matches and list of quotas.
-//  If any clause matched, the list of quotas will be used.
+// Specifies a rule with list of matches and list of quotas.
+// If any clause matched, the list of quotas will be used.
 QuotaRule: {
-	//  If empty, match all request.
-	//  If any of match is true, it is matched.
+	// If empty, match all request.
+	// If any of match is true, it is matched.
 	match?: [...AttributeMatch] @protobuf(1)
 
-	//  The list of quotas to charge.
+	// The list of quotas to charge.
 	quotas?: [...Quota] @protobuf(2)
 }
 
-//  Describes how to match a given string in HTTP headers. Match is
-//  case-sensitive.
+// Describes how to match a given string in HTTP headers. Match is
+// case-sensitive.
 StringMatch: {
 }
 StringMatch: {
-	//  exact string match
+	// exact string match
 	exact: string @protobuf(1)
 } | {
-	//  prefix-based match
+	// prefix-based match
 	prefix: string @protobuf(2)
 } | {
-	//  ECMAscript style regex-based match
+	// ECMAscript style regex-based match
 	regex: string @protobuf(3)
 }
 
-//  Specifies a match clause to match Istio attributes
+// Specifies a match clause to match Istio attributes
 AttributeMatch: {
-	//  Map of attribute names to StringMatch type.
-	//  Each map element specifies one condition to match.
-	// 
-	//  Example:
-	// 
-	//    clause:
-	//      source.uid:
-	//        exact: SOURCE_UID
-	//      request.http_method:
-	//        exact: POST
+	// Map of attribute names to StringMatch type.
+	// Each map element specifies one condition to match.
+	//
+	// Example:
+	//
+	//   clause:
+	//     source.uid:
+	//       exact: SOURCE_UID
+	//     request.http_method:
+	//       exact: POST
 	clause: {
 		<_>: StringMatch
 	} @protobuf(1,type=map<string,StringMatch>)
 }
 
-//  Specifies a quota to use with quota name and amount.
+// Specifies a quota to use with quota name and amount.
 Quota: {
-	//  The quota name to charge
+	// The quota name to charge
 	quota?: string @protobuf(1)
 
-	//  The quota amount to charge
+	// The quota amount to charge
 	charge?: int64 @protobuf(2)
 }
 
-//  QuotaSpecBinding defines the binding between QuotaSpecs and one or more
-//  IstioService.
+// QuotaSpecBinding defines the binding between QuotaSpecs and one or more
+// IstioService.
 QuotaSpecBinding: {
-	//  REQUIRED. One or more services to map the listed QuotaSpec onto.
+	// REQUIRED. One or more services to map the listed QuotaSpec onto.
 	services?: [...IstioService] @protobuf(1)
 
-	//  REQUIRED. One or more QuotaSpec references that should be mapped to
-	//  the specified service(s). The aggregate collection of match
-	//  conditions defined in the QuotaSpecs should not overlap.
+	// REQUIRED. One or more QuotaSpec references that should be mapped to
+	// the specified service(s). The aggregate collection of match
+	// conditions defined in the QuotaSpecs should not overlap.
 	quotaSpecs?: [...QuotaSpecBinding_QuotaSpecReference] @protobuf(2,type=QuotaSpecReference,name=quota_specs)
 }
 
-//  QuotaSpecReference uniquely identifies the QuotaSpec used in the
-//  Binding.
+// QuotaSpecReference uniquely identifies the QuotaSpec used in the
+// Binding.
 QuotaSpecBinding_QuotaSpecReference: {
-	//  REQUIRED. The short name of the QuotaSpec. This is the resource
-	//  name defined by the metadata name field.
+	// REQUIRED. The short name of the QuotaSpec. This is the resource
+	// name defined by the metadata name field.
 	name?: string @protobuf(1)
 
-	//  Optional namespace of the QuotaSpec. Defaults to the value of the
-	//  metadata namespace field.
+	// Optional namespace of the QuotaSpec. Defaults to the value of the
+	// metadata namespace field.
 	namespace?: string @protobuf(2)
 }
diff --git a/encoding/protobuf/testdata/istio.io/api/mixer/v1/config/client/service_proto_gen.cue b/encoding/protobuf/testdata/istio.io/api/mixer/v1/config/client/service_proto_gen.cue
index 46b03df..03e034e 100644
--- a/encoding/protobuf/testdata/istio.io/api/mixer/v1/config/client/service_proto_gen.cue
+++ b/encoding/protobuf/testdata/istio.io/api/mixer/v1/config/client/service_proto_gen.cue
@@ -1,47 +1,47 @@
-//  Copyright 2017 Istio Authors
-// 
-//    Licensed under the Apache License, Version 2.0 (the "License");
-//    you may not use this file except in compliance with the License.
-//    You may obtain a copy of the License at
-// 
-//        http://www.apache.org/licenses/LICENSE-2.0
-// 
-//    Unless required by applicable law or agreed to in writing, software
-//    distributed under the License is distributed on an "AS IS" BASIS,
-//    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//    See the License for the specific language governing permissions and
-//    limitations under the License.
+// Copyright 2017 Istio Authors
+//
+//   Licensed under the Apache License, Version 2.0 (the "License");
+//   you may not use this file except in compliance with the License.
+//   You may obtain a copy of the License at
+//
+//       http://www.apache.org/licenses/LICENSE-2.0
+//
+//   Unless required by applicable law or agreed to in writing, software
+//   distributed under the License is distributed on an "AS IS" BASIS,
+//   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//   See the License for the specific language governing permissions and
+//   limitations under the License.
 
-//  NOTE: this is a duplicate of proxy.v1.config.IstioService from
-//  proxy/v1alpha1/config/route_rules.proto.
-// 
-//  Mixer protobufs have gogoproto specific options which are not
-//  compatiable with the proxy's vanilla protobufs. Ideally, these
-//  protobuf options be reconciled so fundamental Istio concepts and
-//  types can be shared by components. Until then, make a copy of
-//  IstioService for mixerclient to use.
+// NOTE: this is a duplicate of proxy.v1.config.IstioService from
+// proxy/v1alpha1/config/route_rules.proto.
+//
+// Mixer protobufs have gogoproto specific options which are not
+// compatiable with the proxy's vanilla protobufs. Ideally, these
+// protobuf options be reconciled so fundamental Istio concepts and
+// types can be shared by components. Until then, make a copy of
+// IstioService for mixerclient to use.
 package client
 
-//  IstioService identifies a service and optionally service version.
-//  The FQDN of the service is composed from the name, namespace, and implementation-specific domain suffix
-//  (e.g. on Kubernetes, "reviews" + "default" + "svc.cluster.local" -> "reviews.default.svc.cluster.local").
+// IstioService identifies a service and optionally service version.
+// The FQDN of the service is composed from the name, namespace, and implementation-specific domain suffix
+// (e.g. on Kubernetes, "reviews" + "default" + "svc.cluster.local" -> "reviews.default.svc.cluster.local").
 IstioService: {
-	//  The short name of the service such as "foo".
+	// The short name of the service such as "foo".
 	name?: string @protobuf(1)
 
-	//  Optional namespace of the service. Defaults to value of metadata namespace field.
+	// Optional namespace of the service. Defaults to value of metadata namespace field.
 	namespace?: string @protobuf(2)
 
-	//  Domain suffix used to construct the service FQDN in implementations that support such specification.
+	// Domain suffix used to construct the service FQDN in implementations that support such specification.
 	domain?: string @protobuf(3)
 
-	//  The service FQDN.
+	// The service FQDN.
 	service?: string @protobuf(4)
 
-	//  Optional one or more labels that uniquely identify the service version.
-	// 
-	//  *Note:* When used for a VirtualService destination, labels MUST be empty.
-	// 
+	// Optional one or more labels that uniquely identify the service version.
+	//
+	// *Note:* When used for a VirtualService destination, labels MUST be empty.
+	//
 	labels: {
 		<_>: string
 	} @protobuf(5,type=map<string,string>)
diff --git a/encoding/protobuf/testdata/istio.io/api/mixer/v1/mixer_proto_gen.cue b/encoding/protobuf/testdata/istio.io/api/mixer/v1/mixer_proto_gen.cue
index c369365..ded5e39 100644
--- a/encoding/protobuf/testdata/istio.io/api/mixer/v1/mixer_proto_gen.cue
+++ b/encoding/protobuf/testdata/istio.io/api/mixer/v1/mixer_proto_gen.cue
@@ -1,19 +1,19 @@
-//  Copyright 2016 Istio Authors
-// 
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-// 
-//      http://www.apache.org/licenses/LICENSE-2.0
-// 
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
+// Copyright 2016 Istio Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
-//  This package defines the Mixer API that the sidecar proxy uses to perform
-//  precondition checks, manage quotas, and report telemetry.
+// This package defines the Mixer API that the sidecar proxy uses to perform
+// precondition checks, manage quotas, and report telemetry.
 package v1
 
 import (
@@ -21,106 +21,106 @@
 	"time"
 )
 
-//  Used to get a thumbs-up/thumbs-down before performing an action.
+// Used to get a thumbs-up/thumbs-down before performing an action.
 CheckRequest: {
 
-	//  The attributes to use for this request.
-	// 
-	//  Mixer's configuration determines how these attributes are used to
-	//  establish the result returned in the response.
+	// The attributes to use for this request.
+	//
+	// Mixer's configuration determines how these attributes are used to
+	// establish the result returned in the response.
 	attributes?: CompressedAttributes @protobuf(1,"(gogoproto.nullable)=false")
 
-	//  The number of words in the global dictionary, used with to populate the attributes.
-	//  This value is used as a quick way to determine whether the client is using a dictionary that
-	//  the server understands.
+	// The number of words in the global dictionary, used with to populate the attributes.
+	// This value is used as a quick way to determine whether the client is using a dictionary that
+	// the server understands.
 	globalWordCount?: uint32 @protobuf(2,name=global_word_count)
 
-	//  Used for deduplicating `Check` calls in the case of failed RPCs and retries. This should be a UUID
-	//  per call, where the same UUID is used for retries of the same call.
+	// Used for deduplicating `Check` calls in the case of failed RPCs and retries. This should be a UUID
+	// per call, where the same UUID is used for retries of the same call.
 	deduplicationId?: string @protobuf(3,name=deduplication_id)
 
-	//  The individual quotas to allocate
+	// The individual quotas to allocate
 	quotas: {
 		<_>: CheckRequest_QuotaParams
 	} @protobuf(4,type=map<string,QuotaParams>,"(gogoproto.nullable)=false")
 }
 
-//  parameters for a quota allocation
+// parameters for a quota allocation
 CheckRequest_QuotaParams: {
-	//  Amount of quota to allocate
+	// Amount of quota to allocate
 	amount?: int64 @protobuf(1)
 
-	//  When true, supports returning less quota than what was requested.
+	// When true, supports returning less quota than what was requested.
 	bestEffort?: bool @protobuf(2,name=best_effort)
 }
 
-//  The response generated by the Check method.
+// The response generated by the Check method.
 CheckResponse: {
 
-	//  The precondition check results.
+	// The precondition check results.
 	precondition?: CheckResponse_PreconditionResult @protobuf(2,type=PreconditionResult,"(gogoproto.nullable)=false")
 
-	//  The resulting quota, one entry per requested quota.
+	// The resulting quota, one entry per requested quota.
 	quotas: {
 		<_>: CheckResponse_QuotaResult
 	} @protobuf(3,type=map<string,QuotaResult>,"(gogoproto.nullable)=false")
 }
 
-//  Expresses the result of a precondition check.
+// Expresses the result of a precondition check.
 CheckResponse_PreconditionResult: {
 
-	//  A status code of OK indicates all preconditions were satisfied. Any other code indicates not
-	//  all preconditions were satisfied and details describe why.
+	// A status code of OK indicates all preconditions were satisfied. Any other code indicates not
+	// all preconditions were satisfied and details describe why.
 	status?: __status.Status @protobuf(1,type=google.rpc.Status,"(gogoproto.nullable)=false")
 
-	//  The amount of time for which this result can be considered valid.
+	// The amount of time for which this result can be considered valid.
 	validDuration?: time.Duration @protobuf(2,type=google.protobuf.Duration,name=valid_duration,"(gogoproto.nullable)=false","(gogoproto.stdduration)")
 
-	//  The number of uses for which this result can be considered valid.
+	// The number of uses for which this result can be considered valid.
 	validUseCount?: int32 @protobuf(3,name=valid_use_count)
 
-	//  The total set of attributes that were used in producing the result
-	//  along with matching conditions.
+	// The total set of attributes that were used in producing the result
+	// along with matching conditions.
 	referencedAttributes?: ReferencedAttributes @protobuf(5,name=referenced_attributes)
 
-	//  An optional routing directive, used to manipulate the traffic metadata
-	//  whenever all preconditions are satisfied.
+	// An optional routing directive, used to manipulate the traffic metadata
+	// whenever all preconditions are satisfied.
 	routeDirective?: RouteDirective @protobuf(6,name=route_directive)
 }
 __status = status
 
-//  Expresses the result of a quota allocation.
+// Expresses the result of a quota allocation.
 CheckResponse_QuotaResult: {
-	//  The amount of time for which this result can be considered valid.
+	// The amount of time for which this result can be considered valid.
 	validDuration?: time.Duration @protobuf(1,type=google.protobuf.Duration,name=valid_duration,"(gogoproto.nullable)=false","(gogoproto.stdduration)")
 
-	//  The amount of granted quota. When `QuotaParams.best_effort` is true, this will be >= 0.
-	//  If `QuotaParams.best_effort` is false, this will be either 0 or >= `QuotaParams.amount`.
+	// The amount of granted quota. When `QuotaParams.best_effort` is true, this will be >= 0.
+	// If `QuotaParams.best_effort` is false, this will be either 0 or >= `QuotaParams.amount`.
 	grantedAmount?: int64 @protobuf(2,name=granted_amount)
 
-	//  The total set of attributes that were used in producing the result
-	//  along with matching conditions.
+	// The total set of attributes that were used in producing the result
+	// along with matching conditions.
 	referencedAttributes?: ReferencedAttributes @protobuf(5,name=referenced_attributes,"(gogoproto.nullable)=false")
 }
 
-//  Describes the attributes that were used to determine the response.
-//  This can be used to construct a response cache.
+// Describes the attributes that were used to determine the response.
+// This can be used to construct a response cache.
 ReferencedAttributes: {
 
-	//  The message-level dictionary. Refer to [CompressedAttributes][istio.mixer.v1.CompressedAttributes] for information
-	//  on using dictionaries.
+	// The message-level dictionary. Refer to [CompressedAttributes][istio.mixer.v1.CompressedAttributes] for information
+	// on using dictionaries.
 	words?: [...string] @protobuf(1)
 
-	//  Describes a set of attributes.
+	// Describes a set of attributes.
 	attributeMatches?: [...ReferencedAttributes_AttributeMatch] @protobuf(2,type=AttributeMatch,name=attribute_matches,"(gogoproto.nullable)=false")
 }
 
-//  How an attribute's value was matched
+// How an attribute's value was matched
 ReferencedAttributes_Condition:
-	*"CONDITION_UNSPECIFIED" | //  should not occur
-	"ABSENCE" | //  match when attribute doesn't exist
-	"EXACT" | //  match when attribute value is an exact byte-for-byte match
-	"REGEX" //  match when attribute value matches the included regex
+	*"CONDITION_UNSPECIFIED" | // should not occur
+	"ABSENCE" | // match when attribute doesn't exist
+	"EXACT" | // match when attribute value is an exact byte-for-byte match
+	"REGEX" // match when attribute value matches the included regex
 
 ReferencedAttributes_Condition_value: {
 	"CONDITION_UNSPECIFIED": 0
@@ -129,53 +129,53 @@
 	"REGEX":                 3
 }
 
-//  Describes a single attribute match.
+// Describes a single attribute match.
 ReferencedAttributes_AttributeMatch: {
-	//  The name of the attribute. This is a dictionary index encoded in a manner identical
-	//  to all strings in the [CompressedAttributes][istio.mixer.v1.CompressedAttributes] message.
+	// The name of the attribute. This is a dictionary index encoded in a manner identical
+	// to all strings in the [CompressedAttributes][istio.mixer.v1.CompressedAttributes] message.
 	name?: int32 @protobuf(1,type=sint32)
 
-	//  The kind of match against the attribute value.
+	// The kind of match against the attribute value.
 	condition?: ReferencedAttributes_Condition @protobuf(2,type=Condition)
 
-	//  If a REGEX condition is provided for a STRING_MAP attribute,
-	//  clients should use the regex value to match against map keys.
+	// If a REGEX condition is provided for a STRING_MAP attribute,
+	// clients should use the regex value to match against map keys.
 	regex?: string @protobuf(3)
 
-	//  A key in a STRING_MAP. When multiple keys from a STRING_MAP
-	//  attribute were referenced, there will be multiple AttributeMatch
-	//  messages with different map_key values. Values for map_key SHOULD
-	//  be ignored for attributes that are not STRING_MAP.
-	// 
-	//  Indices for the keys are used (taken either from the
-	//  message dictionary from the `words` field or the global dictionary).
-	// 
-	//  If no map_key value is provided for a STRING_MAP attribute, the
-	//  entire STRING_MAP will be used.
+	// A key in a STRING_MAP. When multiple keys from a STRING_MAP
+	// attribute were referenced, there will be multiple AttributeMatch
+	// messages with different map_key values. Values for map_key SHOULD
+	// be ignored for attributes that are not STRING_MAP.
+	//
+	// Indices for the keys are used (taken either from the
+	// message dictionary from the `words` field or the global dictionary).
+	//
+	// If no map_key value is provided for a STRING_MAP attribute, the
+	// entire STRING_MAP will be used.
 	mapKey?: int32 @protobuf(4,type=sint32,name=map_key)
 }
 
-//  Operation on HTTP headers to replace, append, or remove a header. Header
-//  names are normalized to lower-case with dashes, e.g.  "x-request-id".
-//  Pseudo-headers ":path", ":authority", and ":method" are supported to modify
-//  the request headers.
+// Operation on HTTP headers to replace, append, or remove a header. Header
+// names are normalized to lower-case with dashes, e.g.  "x-request-id".
+// Pseudo-headers ":path", ":authority", and ":method" are supported to modify
+// the request headers.
 HeaderOperation: {
 
-	//  Header name.
+	// Header name.
 	name?: string @protobuf(1)
 
-	//  Header value.
+	// Header value.
 	value?: string @protobuf(2)
 
-	//  Header operation.
+	// Header operation.
 	operation?: HeaderOperation_Operation @protobuf(3,type=Operation)
 }
 
-//  Operation type.
+// Operation type.
 HeaderOperation_Operation:
-	*"REPLACE" | //  replaces the header with the given name
-	"REMOVE" | //  removes the header with the given name (the value is ignored)
-	"APPEND" //  appends the value to the header value, or sets it if not present
+	*"REPLACE" | // replaces the header with the given name
+	"REMOVE" | // removes the header with the given name (the value is ignored)
+	"APPEND" // appends the value to the header value, or sets it if not present
 
 HeaderOperation_Operation_value: {
 	"REPLACE": 0
@@ -183,63 +183,63 @@
 	"APPEND":  2
 }
 
-//  Expresses the routing manipulation actions to be performed on behalf of
-//  Mixer in response to a precondition check.
+// Expresses the routing manipulation actions to be performed on behalf of
+// Mixer in response to a precondition check.
 RouteDirective: {
-	//  Operations on the request headers.
+	// Operations on the request headers.
 	requestHeaderOperations?: [...HeaderOperation] @protobuf(1,name=request_header_operations,"(gogoproto.nullable)=false")
 
-	//  Operations on the response headers.
+	// Operations on the response headers.
 	responseHeaderOperations?: [...HeaderOperation] @protobuf(2,name=response_header_operations,"(gogoproto.nullable)=false")
 
-	//  If set, enables a direct response without proxying the request to the routing
-	//  destination. Required to be a value in the 2xx or 3xx range.
+	// If set, enables a direct response without proxying the request to the routing
+	// destination. Required to be a value in the 2xx or 3xx range.
 	directResponseCode?: uint32 @protobuf(3,name=direct_response_code)
 
-	//  Supplies the response body for the direct response.
-	//  If this setting is omitted, no body is included in the generated response.
+	// Supplies the response body for the direct response.
+	// If this setting is omitted, no body is included in the generated response.
 	directResponseBody?: string @protobuf(4,name=direct_response_body)
 }
 
-//  Used to report telemetry after performing one or more actions.
+// Used to report telemetry after performing one or more actions.
 ReportRequest: {
 
-	//  next value: 5
+	// next value: 5
 
-	//  The attributes to use for this request.
-	// 
-	//  Each `Attributes` element represents the state of a single action. Multiple actions
-	//  can be provided in a single message in order to improve communication efficiency. The
-	//  client can accumulate a set of actions and send them all in one single message.
+	// The attributes to use for this request.
+	//
+	// Each `Attributes` element represents the state of a single action. Multiple actions
+	// can be provided in a single message in order to improve communication efficiency. The
+	// client can accumulate a set of actions and send them all in one single message.
 	attributes?: [...CompressedAttributes] @protobuf(1,"(gogoproto.nullable)=false")
 
-	//  Indicates how to decode the attributes sets in this request.
+	// Indicates how to decode the attributes sets in this request.
 	repeatedAttributesSemantics?: ReportRequest_RepeatedAttributesSemantics @protobuf(4,type=RepeatedAttributesSemantics,name=repeated_attributes_semantics)
 
-	//  The default message-level dictionary for all the attributes.
-	//  Individual attribute messages can have their own dictionaries, but if they don't
-	//  then this set of words, if it is provided, is used instead.
-	// 
-	//  This makes it possible to share the same dictionary for all attributes in this
-	//  request, which can substantially reduce the overall request size.
+	// The default message-level dictionary for all the attributes.
+	// Individual attribute messages can have their own dictionaries, but if they don't
+	// then this set of words, if it is provided, is used instead.
+	//
+	// This makes it possible to share the same dictionary for all attributes in this
+	// request, which can substantially reduce the overall request size.
 	defaultWords?: [...string] @protobuf(2,name=default_words)
 
-	//  The number of words in the global dictionary.
-	//  To detect global dictionary out of sync between client and server.
+	// The number of words in the global dictionary.
+	// To detect global dictionary out of sync between client and server.
 	globalWordCount?: uint32 @protobuf(3,name=global_word_count)
 }
 
-//  Used to signal how the sets of compressed attributes should be reconstitued server-side.
+// Used to signal how the sets of compressed attributes should be reconstitued server-side.
 ReportRequest_RepeatedAttributesSemantics:
-	//  Use delta encoding between sets of compressed attributes to reduce the overall on-wire
-	//  request size. Each individual set of attributes is used to modify the previous set.
-	//  NOTE: There is no way with this encoding to specify attribute value deletion. This 
-	//  option should be used with extreme caution.
+	// Use delta encoding between sets of compressed attributes to reduce the overall on-wire
+	// request size. Each individual set of attributes is used to modify the previous set.
+	// NOTE: There is no way with this encoding to specify attribute value deletion. This
+	// option should be used with extreme caution.
 	*"DELTA_ENCODING" |
 
-	//  Treat each set of compressed attributes as complete - independent from other sets
-	//  in this request. This will result in on-wire duplication of attributes and values, but
-	//  will allow for proper accounting of absent values in overall encoding.
+	// Treat each set of compressed attributes as complete - independent from other sets
+	// in this request. This will result in on-wire duplication of attributes and values, but
+	// will allow for proper accounting of absent values in overall encoding.
 	"INDEPENDENT_ENCODING"
 
 ReportRequest_RepeatedAttributesSemantics_value: {
@@ -247,6 +247,6 @@
 	"INDEPENDENT_ENCODING": 1
 }
 
-//  Used to carry responses to telemetry reports
+// Used to carry responses to telemetry reports
 ReportResponse: {
 }
diff --git a/encoding/protobuf/testdata/istio.io/api/networking/v1alpha3/gateway_proto_gen.cue b/encoding/protobuf/testdata/istio.io/api/networking/v1alpha3/gateway_proto_gen.cue
index 26f4a97..024937e 100644
--- a/encoding/protobuf/testdata/istio.io/api/networking/v1alpha3/gateway_proto_gen.cue
+++ b/encoding/protobuf/testdata/istio.io/api/networking/v1alpha3/gateway_proto_gen.cue
@@ -1,416 +1,416 @@
-//  Copyright 2019 CUE Authors
-// 
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-//  
-//      http://www.apache.org/licenses/LICENSE-2.0
-//  
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
+// Copyright 2019 CUE Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
-//  Copyright 2017 Istio Authors
-// 
-//    Licensed under the Apache License, Version 2.0 (the "License");
-//    you may not use this file except in compliance with the License.
-//    You may obtain a copy of the License at
-// 
-//        http://www.apache.org/licenses/LICENSE-2.0
-// 
-//    Unless required by applicable law or agreed to in writing, software
-//    distributed under the License is distributed on an "AS IS" BASIS,
-//    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//    See the License for the specific language governing permissions and
-//    limitations under the License.
+// Copyright 2017 Istio Authors
+//
+//   Licensed under the Apache License, Version 2.0 (the "License");
+//   you may not use this file except in compliance with the License.
+//   You may obtain a copy of the License at
+//
+//       http://www.apache.org/licenses/LICENSE-2.0
+//
+//   Unless required by applicable law or agreed to in writing, software
+//   distributed under the License is distributed on an "AS IS" BASIS,
+//   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//   See the License for the specific language governing permissions and
+//   limitations under the License.
 
-//  $title: Gateway
-//  $description: Configuration affecting edge load balancer.
-//  $location: https://istio.io/docs/reference/config/networking/v1alpha3/gateway.html
+// $title: Gateway
+// $description: Configuration affecting edge load balancer.
+// $location: https://istio.io/docs/reference/config/networking/v1alpha3/gateway.html
 
-//  `Gateway` describes a load balancer operating at the edge of the mesh
-//  receiving incoming or outgoing HTTP/TCP connections. The specification
-//  describes a set of ports that should be exposed, the type of protocol to
-//  use, SNI configuration for the load balancer, etc.
-// 
-//  For example, the following Gateway configuration sets up a proxy to act
-//  as a load balancer exposing port 80 and 9080 (http), 443 (https),
-//  9443(https) and port 2379 (TCP) for ingress.  The gateway will be
-//  applied to the proxy running on a pod with labels `app:
-//  my-gateway-controller`. While Istio will configure the proxy to listen
-//  on these ports, it is the responsibility of the user to ensure that
-//  external traffic to these ports are allowed into the mesh.
-// 
-//  ```yaml
-//  apiVersion: networking.istio.io/v1alpha3
-//  kind: Gateway
-//  metadata:
-//    name: my-gateway
-//    namespace: some-config-namespace
-//  spec:
-//    selector:
-//      app: my-gateway-controller
-//    servers:
-//    - port:
-//        number: 80
-//        name: http
-//        protocol: HTTP
-//      hosts:
-//      - uk.bookinfo.com
-//      - eu.bookinfo.com
-//      tls:
-//        httpsRedirect: true # sends 301 redirect for http requests
-//    - port:
-//        number: 443
-//        name: https-443
-//        protocol: HTTPS
-//      hosts:
-//      - uk.bookinfo.com
-//      - eu.bookinfo.com
-//      tls:
-//        mode: SIMPLE # enables HTTPS on this port
-//        serverCertificate: /etc/certs/servercert.pem
-//        privateKey: /etc/certs/privatekey.pem
-//    - port:
-//        number: 9443
-//        name: https-9443
-//        protocol: HTTPS
-//      hosts:
-//      - "bookinfo-namespace/*.bookinfo.com"
-//      tls:
-//        mode: SIMPLE # enables HTTPS on this port
-//        credentialName: bookinfo-secret # fetches certs from Kubernetes secret
-//    - port:
-//        number: 9080
-//        name: http-wildcard
-//        protocol: HTTP
-//      hosts:
-//      - "*"
-//    - port:
-//        number: 2379 # to expose internal service via external port 2379
-//        name: mongo
-//        protocol: MONGO
-//      hosts:
-//      - "*"
-//  ```
-// 
-//  The Gateway specification above describes the L4-L6 properties of a load
-//  balancer. A `VirtualService` can then be bound to a gateway to control
-//  the forwarding of traffic arriving at a particular host or gateway port.
-// 
-//  For example, the following VirtualService splits traffic for
-//  `https://uk.bookinfo.com/reviews`, `https://eu.bookinfo.com/reviews`,
-//  `http://uk.bookinfo.com:9080/reviews`,
-//  `http://eu.bookinfo.com:9080/reviews` into two versions (prod and qa) of
-//  an internal reviews service on port 9080. In addition, requests
-//  containing the cookie "user: dev-123" will be sent to special port 7777
-//  in the qa version. The same rule is also applicable inside the mesh for
-//  requests to the "reviews.prod.svc.cluster.local" service. This rule is
-//  applicable across ports 443, 9080. Note that `http://uk.bookinfo.com`
-//  gets redirected to `https://uk.bookinfo.com` (i.e. 80 redirects to 443).
-// 
-//  ```yaml
-//  apiVersion: networking.istio.io/v1alpha3
-//  kind: VirtualService
-//  metadata:
-//    name: bookinfo-rule
-//    namespace: bookinfo-namespace
-//  spec:
-//    hosts:
-//    - reviews.prod.svc.cluster.local
-//    - uk.bookinfo.com
-//    - eu.bookinfo.com
-//    gateways:
-//    - some-config-namespace/my-gateway
-//    - mesh # applies to all the sidecars in the mesh
-//    http:
-//    - match:
-//      - headers:
-//          cookie:
-//            exact: "user=dev-123"
-//      route:
-//      - destination:
-//          port:
-//            number: 7777
-//          host: reviews.qa.svc.cluster.local
-//    - match:
-//      - uri:
-//          prefix: /reviews/
-//      route:
-//      - destination:
-//          port:
-//            number: 9080 # can be omitted if it's the only port for reviews
-//          host: reviews.prod.svc.cluster.local
-//        weight: 80
-//      - destination:
-//          host: reviews.qa.svc.cluster.local
-//        weight: 20
-//  ```
-// 
-//  The following VirtualService forwards traffic arriving at (external)
-//  port 27017 to internal Mongo server on port 5555. This rule is not
-//  applicable internally in the mesh as the gateway list omits the
-//  reserved name `mesh`.
-// 
-//  ```yaml
-//  apiVersion: networking.istio.io/v1alpha3
-//  kind: VirtualService
-//  metadata:
-//    name: bookinfo-Mongo
-//    namespace: bookinfo-namespace
-//  spec:
-//    hosts:
-//    - mongosvr.prod.svc.cluster.local # name of internal Mongo service
-//    gateways:
-//    - some-config-namespace/my-gateway # can omit the namespace if gateway is in same
-//                                         namespace as virtual service.
-//    tcp:
-//    - match:
-//      - port: 27017
-//      route:
-//      - destination:
-//          host: mongo.prod.svc.cluster.local
-//          port:
-//            number: 5555
-//  ```
-// 
-//  It is possible to restrict the set of virtual services that can bind to
-//  a gateway server using the namespace/hostname syntax in the hosts field.
-//  For example, the following Gateway allows any virtual service in the ns1
-//  namespace to bind to it, while restricting only the virtual service with
-//  foo.bar.com host in the ns2 namespace to bind to it.
-// 
-//  ```yaml
-//  apiVersion: networking.istio.io/v1alpha3
-//  kind: Gateway
-//  metadata:
-//    name: my-gateway
-//    namespace: some-config-namespace
-//  spec:
-//    selector:
-//      app: my-gateway-controller
-//    servers:
-//    - port:
-//        number: 80
-//        name: http
-//        protocol: HTTP
-//      hosts:
-//      - "ns1/*"
-//      - "ns2/foo.bar.com"
-//  ```
-// 
+// `Gateway` describes a load balancer operating at the edge of the mesh
+// receiving incoming or outgoing HTTP/TCP connections. The specification
+// describes a set of ports that should be exposed, the type of protocol to
+// use, SNI configuration for the load balancer, etc.
+//
+// For example, the following Gateway configuration sets up a proxy to act
+// as a load balancer exposing port 80 and 9080 (http), 443 (https),
+// 9443(https) and port 2379 (TCP) for ingress.  The gateway will be
+// applied to the proxy running on a pod with labels `app:
+// my-gateway-controller`. While Istio will configure the proxy to listen
+// on these ports, it is the responsibility of the user to ensure that
+// external traffic to these ports are allowed into the mesh.
+//
+// ```yaml
+// apiVersion: networking.istio.io/v1alpha3
+// kind: Gateway
+// metadata:
+//   name: my-gateway
+//   namespace: some-config-namespace
+// spec:
+//   selector:
+//     app: my-gateway-controller
+//   servers:
+//   - port:
+//       number: 80
+//       name: http
+//       protocol: HTTP
+//     hosts:
+//     - uk.bookinfo.com
+//     - eu.bookinfo.com
+//     tls:
+//       httpsRedirect: true # sends 301 redirect for http requests
+//   - port:
+//       number: 443
+//       name: https-443
+//       protocol: HTTPS
+//     hosts:
+//     - uk.bookinfo.com
+//     - eu.bookinfo.com
+//     tls:
+//       mode: SIMPLE # enables HTTPS on this port
+//       serverCertificate: /etc/certs/servercert.pem
+//       privateKey: /etc/certs/privatekey.pem
+//   - port:
+//       number: 9443
+//       name: https-9443
+//       protocol: HTTPS
+//     hosts:
+//     - "bookinfo-namespace/*.bookinfo.com"
+//     tls:
+//       mode: SIMPLE # enables HTTPS on this port
+//       credentialName: bookinfo-secret # fetches certs from Kubernetes secret
+//   - port:
+//       number: 9080
+//       name: http-wildcard
+//       protocol: HTTP
+//     hosts:
+//     - "*"
+//   - port:
+//       number: 2379 # to expose internal service via external port 2379
+//       name: mongo
+//       protocol: MONGO
+//     hosts:
+//     - "*"
+// ```
+//
+// The Gateway specification above describes the L4-L6 properties of a load
+// balancer. A `VirtualService` can then be bound to a gateway to control
+// the forwarding of traffic arriving at a particular host or gateway port.
+//
+// For example, the following VirtualService splits traffic for
+// `https://uk.bookinfo.com/reviews`, `https://eu.bookinfo.com/reviews`,
+// `http://uk.bookinfo.com:9080/reviews`,
+// `http://eu.bookinfo.com:9080/reviews` into two versions (prod and qa) of
+// an internal reviews service on port 9080. In addition, requests
+// containing the cookie "user: dev-123" will be sent to special port 7777
+// in the qa version. The same rule is also applicable inside the mesh for
+// requests to the "reviews.prod.svc.cluster.local" service. This rule is
+// applicable across ports 443, 9080. Note that `http://uk.bookinfo.com`
+// gets redirected to `https://uk.bookinfo.com` (i.e. 80 redirects to 443).
+//
+// ```yaml
+// apiVersion: networking.istio.io/v1alpha3
+// kind: VirtualService
+// metadata:
+//   name: bookinfo-rule
+//   namespace: bookinfo-namespace
+// spec:
+//   hosts:
+//   - reviews.prod.svc.cluster.local
+//   - uk.bookinfo.com
+//   - eu.bookinfo.com
+//   gateways:
+//   - some-config-namespace/my-gateway
+//   - mesh # applies to all the sidecars in the mesh
+//   http:
+//   - match:
+//     - headers:
+//         cookie:
+//           exact: "user=dev-123"
+//     route:
+//     - destination:
+//         port:
+//           number: 7777
+//         host: reviews.qa.svc.cluster.local
+//   - match:
+//     - uri:
+//         prefix: /reviews/
+//     route:
+//     - destination:
+//         port:
+//           number: 9080 # can be omitted if it's the only port for reviews
+//         host: reviews.prod.svc.cluster.local
+//       weight: 80
+//     - destination:
+//         host: reviews.qa.svc.cluster.local
+//       weight: 20
+// ```
+//
+// The following VirtualService forwards traffic arriving at (external)
+// port 27017 to internal Mongo server on port 5555. This rule is not
+// applicable internally in the mesh as the gateway list omits the
+// reserved name `mesh`.
+//
+// ```yaml
+// apiVersion: networking.istio.io/v1alpha3
+// kind: VirtualService
+// metadata:
+//   name: bookinfo-Mongo
+//   namespace: bookinfo-namespace
+// spec:
+//   hosts:
+//   - mongosvr.prod.svc.cluster.local # name of internal Mongo service
+//   gateways:
+//   - some-config-namespace/my-gateway # can omit the namespace if gateway is in same
+//                                        namespace as virtual service.
+//   tcp:
+//   - match:
+//     - port: 27017
+//     route:
+//     - destination:
+//         host: mongo.prod.svc.cluster.local
+//         port:
+//           number: 5555
+// ```
+//
+// It is possible to restrict the set of virtual services that can bind to
+// a gateway server using the namespace/hostname syntax in the hosts field.
+// For example, the following Gateway allows any virtual service in the ns1
+// namespace to bind to it, while restricting only the virtual service with
+// foo.bar.com host in the ns2 namespace to bind to it.
+//
+// ```yaml
+// apiVersion: networking.istio.io/v1alpha3
+// kind: Gateway
+// metadata:
+//   name: my-gateway
+//   namespace: some-config-namespace
+// spec:
+//   selector:
+//     app: my-gateway-controller
+//   servers:
+//   - port:
+//       number: 80
+//       name: http
+//       protocol: HTTP
+//     hosts:
+//     - "ns1/*"
+//     - "ns2/foo.bar.com"
+// ```
+//
 package v1alpha3
 
 Gateway: {
-	//  REQUIRED: A list of server specifications.
+	// REQUIRED: A list of server specifications.
 	servers?: [...Server] @protobuf(1)
 
-	//  REQUIRED: One or more labels that indicate a specific set of pods/VMs
-	//  on which this gateway configuration should be applied. The scope of
-	//  label search is restricted to the configuration namespace in which the
-	//  the resource is present. In other words, the Gateway resource must
-	//  reside in the same namespace as the gateway workload instance.
+	// REQUIRED: One or more labels that indicate a specific set of pods/VMs
+	// on which this gateway configuration should be applied. The scope of
+	// label search is restricted to the configuration namespace in which the
+	// the resource is present. In other words, the Gateway resource must
+	// reside in the same namespace as the gateway workload instance.
 	selector: {
 		<_>: string
 	} @protobuf(2,type=map<string,string>)
 	selector?: {<name>: name}
 }
 
-//  `Server` describes the properties of the proxy on a given load balancer
-//  port. For example,
-// 
-//  ```yaml
-//  apiVersion: networking.istio.io/v1alpha3
-//  kind: Gateway
-//  metadata:
-//    name: my-ingress
-//  spec:
-//    selector:
-//      app: my-ingress-gateway
-//    servers:
-//    - port:
-//        number: 80
-//        name: http2
-//        protocol: HTTP2
-//      hosts:
-//      - "*"
-//  ```
-// 
-//  Another example
-// 
-//  ```yaml
-//  apiVersion: networking.istio.io/v1alpha3
-//  kind: Gateway
-//  metadata:
-//    name: my-tcp-ingress
-//  spec:
-//    selector:
-//      app: my-tcp-ingress-gateway
-//    servers:
-//    - port:
-//        number: 27018
-//        name: mongo
-//        protocol: MONGO
-//      hosts:
-//      - "*"
-//  ```
-// 
-//  The following is an example of TLS configuration for port 443
-// 
-//  ```yaml
-//  apiVersion: networking.istio.io/v1alpha3
-//  kind: Gateway
-//  metadata:
-//    name: my-tls-ingress
-//  spec:
-//    selector:
-//      app: my-tls-ingress-gateway
-//    servers:
-//    - port:
-//        number: 443
-//        name: https
-//        protocol: HTTPS
-//      hosts:
-//      - "*"
-//      tls:
-//        mode: SIMPLE
-//        serverCertificate: /etc/certs/server.pem
-//        privateKey: /etc/certs/privatekey.pem
-//  ```
+// `Server` describes the properties of the proxy on a given load balancer
+// port. For example,
+//
+// ```yaml
+// apiVersion: networking.istio.io/v1alpha3
+// kind: Gateway
+// metadata:
+//   name: my-ingress
+// spec:
+//   selector:
+//     app: my-ingress-gateway
+//   servers:
+//   - port:
+//       number: 80
+//       name: http2
+//       protocol: HTTP2
+//     hosts:
+//     - "*"
+// ```
+//
+// Another example
+//
+// ```yaml
+// apiVersion: networking.istio.io/v1alpha3
+// kind: Gateway
+// metadata:
+//   name: my-tcp-ingress
+// spec:
+//   selector:
+//     app: my-tcp-ingress-gateway
+//   servers:
+//   - port:
+//       number: 27018
+//       name: mongo
+//       protocol: MONGO
+//     hosts:
+//     - "*"
+// ```
+//
+// The following is an example of TLS configuration for port 443
+//
+// ```yaml
+// apiVersion: networking.istio.io/v1alpha3
+// kind: Gateway
+// metadata:
+//   name: my-tls-ingress
+// spec:
+//   selector:
+//     app: my-tls-ingress-gateway
+//   servers:
+//   - port:
+//       number: 443
+//       name: https
+//       protocol: HTTPS
+//     hosts:
+//     - "*"
+//     tls:
+//       mode: SIMPLE
+//       serverCertificate: /etc/certs/server.pem
+//       privateKey: /etc/certs/privatekey.pem
+// ```
 Server: {
-	//  REQUIRED: The Port on which the proxy should listen for incoming
-	//  connections.
+	// REQUIRED: The Port on which the proxy should listen for incoming
+	// connections.
 	port?: Port @protobuf(1)
 	port?: >10 & <100
 
-	//  $hide_from_docs
-	//  The ip or the Unix domain socket to which the listener should be bound
-	//  to. Format: `x.x.x.x` or `unix:///path/to/uds` or `unix://@foobar`
-	//  (Linux abstract namespace). When using Unix domain sockets, the port
-	//  number should be 0.
+	// $hide_from_docs
+	// The ip or the Unix domain socket to which the listener should be bound
+	// to. Format: `x.x.x.x` or `unix:///path/to/uds` or `unix://@foobar`
+	// (Linux abstract namespace). When using Unix domain sockets, the port
+	// number should be 0.
 	bind?: string @protobuf(4)
 
-	//  REQUIRED. One or more hosts exposed by this gateway.
-	//  While typically applicable to
-	//  HTTP services, it can also be used for TCP services using TLS with SNI.
-	//  A host is specified as a `dnsName` with an optional `namespace/` prefix.
-	//  The `dnsName` should be specified using FQDN format, optionally including
-	//  a wildcard character in the left-most component (e.g., `prod/*.example.com`).
-	//  Set the `dnsName` to `*` to select all `VirtualService` hosts from the
-	//  specified namespace (e.g.,`prod/*`). If no `namespace/` is specified,
-	//  the `VirtualService` hosts will be selected from any available namespace.
-	//  Any associated `DestinationRule` in the same namespace will also be used.
-	// 
-	//  A `VirtualService` must be bound to the gateway and must have one or
-	//  more hosts that match the hosts specified in a server. The match
-	//  could be an exact match or a suffix match with the server's hosts. For
-	//  example, if the server's hosts specifies `*.example.com`, a
-	//  `VirtualService` with hosts `dev.example.com` or `prod.example.com` will
-	//  match. However, a `VirtualService` with host `example.com` or
-	//  `newexample.com` will not match.
-	// 
-	//  NOTE: Only virtual services exported to the gateway's namespace
-	//  (e.g., `exportTo` value of `*`) can be referenced.
-	//  Private configurations (e.g., `exportTo` set to `.`) will not be
-	//  available. Refer to the `exportTo` setting in `VirtualService`,
-	//  `DestinationRule`, and `ServiceEntry` configurations for details.
+	// REQUIRED. One or more hosts exposed by this gateway.
+	// While typically applicable to
+	// HTTP services, it can also be used for TCP services using TLS with SNI.
+	// A host is specified as a `dnsName` with an optional `namespace/` prefix.
+	// The `dnsName` should be specified using FQDN format, optionally including
+	// a wildcard character in the left-most component (e.g., `prod/*.example.com`).
+	// Set the `dnsName` to `*` to select all `VirtualService` hosts from the
+	// specified namespace (e.g.,`prod/*`). If no `namespace/` is specified,
+	// the `VirtualService` hosts will be selected from any available namespace.
+	// Any associated `DestinationRule` in the same namespace will also be used.
+	//
+	// A `VirtualService` must be bound to the gateway and must have one or
+	// more hosts that match the hosts specified in a server. The match
+	// could be an exact match or a suffix match with the server's hosts. For
+	// example, if the server's hosts specifies `*.example.com`, a
+	// `VirtualService` with hosts `dev.example.com` or `prod.example.com` will
+	// match. However, a `VirtualService` with host `example.com` or
+	// `newexample.com` will not match.
+	//
+	// NOTE: Only virtual services exported to the gateway's namespace
+	// (e.g., `exportTo` value of `*`) can be referenced.
+	// Private configurations (e.g., `exportTo` set to `.`) will not be
+	// available. Refer to the `exportTo` setting in `VirtualService`,
+	// `DestinationRule`, and `ServiceEntry` configurations for details.
 	hosts?: [...string] @protobuf(2)
 
-	//  Set of TLS related options that govern the server's behavior. Use
-	//  these options to control if all http requests should be redirected to
-	//  https, and the TLS modes to use.
+	// Set of TLS related options that govern the server's behavior. Use
+	// these options to control if all http requests should be redirected to
+	// https, and the TLS modes to use.
 	tls?: Server_TLSOptions @protobuf(3,type=TLSOptions)
 
-	//  The loopback IP endpoint or Unix domain socket to which traffic should
-	//  be forwarded to by default. Format should be `127.0.0.1:PORT` or
-	//  `unix:///path/to/socket` or `unix://@foobar` (Linux abstract namespace).
+	// The loopback IP endpoint or Unix domain socket to which traffic should
+	// be forwarded to by default. Format should be `127.0.0.1:PORT` or
+	// `unix:///path/to/socket` or `unix://@foobar` (Linux abstract namespace).
 	defaultEndpoint?: string @protobuf(5,name=default_endpoint)
 }
 
 Server_TLSOptions: {
-	//  If set to true, the load balancer will send a 301 redirect for all
-	//  http connections, asking the clients to use HTTPS.
+	// If set to true, the load balancer will send a 301 redirect for all
+	// http connections, asking the clients to use HTTPS.
 	httpsRedirect?: bool @protobuf(1,name=https_redirect)
 
-	//  Optional: Indicates whether connections to this port should be
-	//  secured using TLS. The value of this field determines how TLS is
-	//  enforced.
+	// Optional: Indicates whether connections to this port should be
+	// secured using TLS. The value of this field determines how TLS is
+	// enforced.
 	mode?: Server_TLSOptions_TLSmode @protobuf(2,type=TLSmode)
 
-	//  Extra comment.
+	// Extra comment.
 
-	//  REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file
-	//  holding the server-side TLS certificate to use.
+	// REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file
+	// holding the server-side TLS certificate to use.
 	serverCertificate?: string @protobuf(3,name=server_certificate)
 
-	//  REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file
-	//  holding the server's private key.
+	// REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file
+	// holding the server's private key.
 	privateKey?: string @protobuf(4,name=private_key)
 
-	//  REQUIRED if mode is `MUTUAL`. The path to a file containing
-	//  certificate authority certificates to use in verifying a presented
-	//  client side certificate.
+	// REQUIRED if mode is `MUTUAL`. The path to a file containing
+	// certificate authority certificates to use in verifying a presented
+	// client side certificate.
 	caCertificates?: string @protobuf(5,name=ca_certificates)
 
-	//  The credentialName stands for a unique identifier that can be used
-	//  to identify the serverCertificate and the privateKey. The
-	//  credentialName appended with suffix "-cacert" is used to identify
-	//  the CaCertificates associated with this server. Gateway workloads
-	//  capable of fetching credentials from a remote credential store such
-	//  as Kubernetes secrets, will be configured to retrieve the
-	//  serverCertificate and the privateKey using credentialName, instead
-	//  of using the file system paths specified above. If using mutual TLS,
-	//  gateway workload instances will retrieve the CaCertificates using
-	//  credentialName-cacert. The semantics of the name are platform
-	//  dependent.  In Kubernetes, the default Istio supplied credential
-	//  server expects the credentialName to match the name of the
-	//  Kubernetes secret that holds the server certificate, the private
-	//  key, and the CA certificate (if using mutual TLS). Set the
-	//  `ISTIO_META_USER_SDS` metadata variable in the gateway's proxy to
-	//  enable the dynamic credential fetching feature.
+	// The credentialName stands for a unique identifier that can be used
+	// to identify the serverCertificate and the privateKey. The
+	// credentialName appended with suffix "-cacert" is used to identify
+	// the CaCertificates associated with this server. Gateway workloads
+	// capable of fetching credentials from a remote credential store such
+	// as Kubernetes secrets, will be configured to retrieve the
+	// serverCertificate and the privateKey using credentialName, instead
+	// of using the file system paths specified above. If using mutual TLS,
+	// gateway workload instances will retrieve the CaCertificates using
+	// credentialName-cacert. The semantics of the name are platform
+	// dependent.  In Kubernetes, the default Istio supplied credential
+	// server expects the credentialName to match the name of the
+	// Kubernetes secret that holds the server certificate, the private
+	// key, and the CA certificate (if using mutual TLS). Set the
+	// `ISTIO_META_USER_SDS` metadata variable in the gateway's proxy to
+	// enable the dynamic credential fetching feature.
 	credentialName?: string @protobuf(10,name=credential_name)
 
-	//  A list of alternate names to verify the subject identity in the
-	//  certificate presented by the client.
+	// A list of alternate names to verify the subject identity in the
+	// certificate presented by the client.
 	subjectAltNames?: [...string] @protobuf(6,name=subject_alt_names)
 
-	//  Optional: Minimum TLS protocol version.
+	// Optional: Minimum TLS protocol version.
 	minProtocolVersion?: Server_TLSOptions_TLSProtocol @protobuf(7,type=TLSProtocol,name=min_protocol_version)
 
-	//  Optional: Maximum TLS protocol version.
+	// Optional: Maximum TLS protocol version.
 	maxProtocolVersion?: Server_TLSOptions_TLSProtocol @protobuf(8,type=TLSProtocol,name=max_protocol_version)
 
-	//  Optional: If specified, only support the specified cipher list.
-	//  Otherwise default to the default cipher list supported by Envoy.
+	// Optional: If specified, only support the specified cipher list.
+	// Otherwise default to the default cipher list supported by Envoy.
 	cipherSuites?: [...string] @protobuf(9,name=cipher_suites)
 }
 
-//  TLS modes enforced by the proxy
+// TLS modes enforced by the proxy
 Server_TLSOptions_TLSmode:
-	//  The SNI string presented by the client will be used as the match
-	//  criterion in a VirtualService TLS route to determine the
-	//  destination service from the service registry.
+	// The SNI string presented by the client will be used as the match
+	// criterion in a VirtualService TLS route to determine the
+	// destination service from the service registry.
 	*"PASSTHROUGH" |
 
-	//  Secure connections with standard TLS semantics.
+	// Secure connections with standard TLS semantics.
 	"SIMPLE" |
 
-	//  Secure connections to the upstream using mutual TLS by presenting
-	//  client certificates for authentication.
+	// Secure connections to the upstream using mutual TLS by presenting
+	// client certificates for authentication.
 	"MUTUAL" |
 
-	//  Similar to the passthrough mode, except servers with this TLS mode
-	//  do not require an associated VirtualService to map from the SNI
-	//  value to service in the registry. The destination details such as
-	//  the service/subset/port are encoded in the SNI value. The proxy
-	//  will forward to the upstream (Envoy) cluster (a group of
-	//  endpoints) specified by the SNI value. This server is typically
-	//  used to provide connectivity between services in disparate L3
-	//  networks that otherwise do not have direct connectivity between
-	//  their respective endpoints. Use of this mode assumes that both the
-	//  source and the destination are using Istio mTLS to secure traffic.
+	// Similar to the passthrough mode, except servers with this TLS mode
+	// do not require an associated VirtualService to map from the SNI
+	// value to service in the registry. The destination details such as
+	// the service/subset/port are encoded in the SNI value. The proxy
+	// will forward to the upstream (Envoy) cluster (a group of
+	// endpoints) specified by the SNI value. This server is typically
+	// used to provide connectivity between services in disparate L3
+	// networks that otherwise do not have direct connectivity between
+	// their respective endpoints. Use of this mode assumes that both the
+	// source and the destination are using Istio mTLS to secure traffic.
 	"AUTO_PASSTHROUGH"
 
 Server_TLSOptions_TLSmode_value: {
@@ -420,13 +420,13 @@
 	"AUTO_PASSTHROUGH": 3
 }
 
-//  TLS protocol versions.
+// TLS protocol versions.
 Server_TLSOptions_TLSProtocol:
-	*"TLS_AUTO" | //  Automatically choose the optimal TLS version.
-	"TLSV1_0" | //  TLS version 1.0
-	"TLSV1_1" | //  TLS version 1.1
-	"TLSV1_2" | //  TLS version 1.2
-	"TLSV1_3" //  TLS version 1.3
+	*"TLS_AUTO" | // Automatically choose the optimal TLS version.
+	"TLSV1_0" | // TLS version 1.0
+	"TLSV1_1" | // TLS version 1.1
+	"TLSV1_2" | // TLS version 1.2
+	"TLSV1_3" // TLS version 1.3
 
 Server_TLSOptions_TLSProtocol_value: {
 	"TLS_AUTO": 0
@@ -436,17 +436,17 @@
 	"TLSV1_3":  4
 }
 
-//  Port describes the properties of a specific port of a service.
+// Port describes the properties of a specific port of a service.
 Port: {
-	//  REQUIRED: A valid non-negative integer port number.
+	// REQUIRED: A valid non-negative integer port number.
 	number?: uint32 @protobuf(1)
 
-	//  REQUIRED: The protocol exposed on the port.
-	//  MUST BE one of HTTP|HTTPS|GRPC|HTTP2|MONGO|TCP|TLS.
-	//  TLS implies the connection will be routed based on the SNI header to
-	//  the destination without terminating the TLS connection.
+	// REQUIRED: The protocol exposed on the port.
+	// MUST BE one of HTTP|HTTPS|GRPC|HTTP2|MONGO|TCP|TLS.
+	// TLS implies the connection will be routed based on the SNI header to
+	// the destination without terminating the TLS connection.
 	protocol?: string @protobuf(2)
 
-	//  Label assigned to the port.
+	// Label assigned to the port.
 	name?: string @protobuf(3)
 }
diff --git a/encoding/protobuf/testdata/istio.io/api/pkg/github.com/gogo/protobuf/gogoproto/gogo_proto_gen.cue b/encoding/protobuf/testdata/istio.io/api/pkg/github.com/gogo/protobuf/gogoproto/gogo_proto_gen.cue
index 044eabf..1896f90 100644
--- a/encoding/protobuf/testdata/istio.io/api/pkg/github.com/gogo/protobuf/gogoproto/gogo_proto_gen.cue
+++ b/encoding/protobuf/testdata/istio.io/api/pkg/github.com/gogo/protobuf/gogoproto/gogo_proto_gen.cue
@@ -1,29 +1,29 @@
 
-//  Protocol Buffers for Go with Gadgets
-// 
-//  Copyright (c) 2013, The GoGo Authors. All rights reserved.
-//  http://github.com/gogo/protobuf
-// 
-//  Redistribution and use in source and binary forms, with or without
-//  modification, are permitted provided that the following conditions are
-//  met:
-// 
-//      * Redistributions of source code must retain the above copyright
-//  notice, this list of conditions and the following disclaimer.
-//      * Redistributions in binary form must reproduce the above
-//  copyright notice, this list of conditions and the following disclaimer
-//  in the documentation and/or other materials provided with the
-//  distribution.
-// 
-//  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-//  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-//  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-//  A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-//  OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-//  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-//  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-//  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-//  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-//  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-//  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Protocol Buffers for Go with Gadgets
+//
+// Copyright (c) 2013, The GoGo Authors. All rights reserved.
+// http://github.com/gogo/protobuf
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 package gogoproto
diff --git a/encoding/protobuf/testdata/istio.io/api/pkg/github.com/golang/protobuf/protoc-gen-go/descriptor/descriptor_proto_gen.cue b/encoding/protobuf/testdata/istio.io/api/pkg/github.com/golang/protobuf/protoc-gen-go/descriptor/descriptor_proto_gen.cue
index 7ceb8fc..a897906 100644
--- a/encoding/protobuf/testdata/istio.io/api/pkg/github.com/golang/protobuf/protoc-gen-go/descriptor/descriptor_proto_gen.cue
+++ b/encoding/protobuf/testdata/istio.io/api/pkg/github.com/golang/protobuf/protoc-gen-go/descriptor/descriptor_proto_gen.cue
@@ -1,117 +1,117 @@
-//  Protocol Buffers - Google's data interchange format
-//  Copyright 2008 Google Inc.  All rights reserved.
-//  https://developers.google.com/protocol-buffers/
-// 
-//  Redistribution and use in source and binary forms, with or without
-//  modification, are permitted provided that the following conditions are
-//  met:
-// 
-//      * Redistributions of source code must retain the above copyright
-//  notice, this list of conditions and the following disclaimer.
-//      * Redistributions in binary form must reproduce the above
-//  copyright notice, this list of conditions and the following disclaimer
-//  in the documentation and/or other materials provided with the
-//  distribution.
-//      * Neither the name of Google Inc. nor the names of its
-//  contributors may be used to endorse or promote products derived from
-//  this software without specific prior written permission.
-// 
-//  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-//  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-//  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-//  A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-//  OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-//  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-//  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-//  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-//  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-//  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-//  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Protocol Buffers - Google's data interchange format
+// Copyright 2008 Google Inc.  All rights reserved.
+// https://developers.google.com/protocol-buffers/
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-//  Author: kenton@google.com (Kenton Varda)
-//   Based on original Protocol Buffers design by
-//   Sanjay Ghemawat, Jeff Dean, and others.
-// 
-//  The messages in this file describe the definitions found in .proto files.
-//  A valid .proto file can be translated directly to a FileDescriptorProto
-//  without any other information (e.g. without reading its imports).
+// Author: kenton@google.com (Kenton Varda)
+//  Based on original Protocol Buffers design by
+//  Sanjay Ghemawat, Jeff Dean, and others.
+//
+// The messages in this file describe the definitions found in .proto files.
+// A valid .proto file can be translated directly to a FileDescriptorProto
+// without any other information (e.g. without reading its imports).
 
-//  ===================================================================
-//  Options
+// ===================================================================
+// Options
 
-//  Each of the definitions above may have "options" attached.  These are
-//  just annotations which may cause code to be generated slightly differently
-//  or may contain hints for code that manipulates protocol messages.
-// 
-//  Clients may define custom options as extensions of the *Options messages.
-//  These extensions may not yet be known at parsing time, so the parser cannot
-//  store the values in them.  Instead it stores them in a field in the *Options
-//  message called uninterpreted_option. This field must have the same name
-//  across all *Options messages. We then use this field to populate the
-//  extensions when we build a descriptor, at which point all protos have been
-//  parsed and so all extensions are known.
-// 
-//  Extension numbers for custom options may be chosen as follows:
-//  * For options which will only be used within a single application or
-//    organization, or for experimental options, use field numbers 50000
-//    through 99999.  It is up to you to ensure that you do not use the
-//    same number for multiple options.
-//  * For options which will be published and used publicly by multiple
-//    independent entities, e-mail protobuf-global-extension-registry@google.com
-//    to reserve extension numbers. Simply provide your project name (e.g.
-//    Objective-C plugin) and your project website (if available) -- there's no
-//    need to explain how you intend to use them. Usually you only need one
-//    extension number. You can declare multiple options with only one extension
-//    number by putting them in a sub-message. See the Custom Options section of
-//    the docs for examples:
-//    https://developers.google.com/protocol-buffers/docs/proto#options
-//    If this turns out to be popular, a web service will be set up
-//    to automatically assign option numbers.
+// Each of the definitions above may have "options" attached.  These are
+// just annotations which may cause code to be generated slightly differently
+// or may contain hints for code that manipulates protocol messages.
+//
+// Clients may define custom options as extensions of the *Options messages.
+// These extensions may not yet be known at parsing time, so the parser cannot
+// store the values in them.  Instead it stores them in a field in the *Options
+// message called uninterpreted_option. This field must have the same name
+// across all *Options messages. We then use this field to populate the
+// extensions when we build a descriptor, at which point all protos have been
+// parsed and so all extensions are known.
+//
+// Extension numbers for custom options may be chosen as follows:
+// * For options which will only be used within a single application or
+//   organization, or for experimental options, use field numbers 50000
+//   through 99999.  It is up to you to ensure that you do not use the
+//   same number for multiple options.
+// * For options which will be published and used publicly by multiple
+//   independent entities, e-mail protobuf-global-extension-registry@google.com
+//   to reserve extension numbers. Simply provide your project name (e.g.
+//   Objective-C plugin) and your project website (if available) -- there's no
+//   need to explain how you intend to use them. Usually you only need one
+//   extension number. You can declare multiple options with only one extension
+//   number by putting them in a sub-message. See the Custom Options section of
+//   the docs for examples:
+//   https://developers.google.com/protocol-buffers/docs/proto#options
+//   If this turns out to be popular, a web service will be set up
+//   to automatically assign option numbers.
 
-//  ===================================================================
-//  Optional source code info
+// ===================================================================
+// Optional source code info
 package descriptor
 
-//  The protocol compiler can output a FileDescriptorSet containing the .proto
-//  files it parses.
+// The protocol compiler can output a FileDescriptorSet containing the .proto
+// files it parses.
 FileDescriptorSet: {
 	file?: [...FileDescriptorProto] @protobuf(1)
 }
 
-//  Describes a complete .proto file.
+// Describes a complete .proto file.
 FileDescriptorProto: {
-	name?:    string @protobuf(1) //  file name, relative to root of source tree
-	package?: string @protobuf(2) //  e.g. "foo", "foo.bar", etc.
+	name?:    string @protobuf(1) // file name, relative to root of source tree
+	package?: string @protobuf(2) // e.g. "foo", "foo.bar", etc.
 
-	//  Names of files imported by this file.
+	// Names of files imported by this file.
 	dependency?: [...string] @protobuf(3)
 
-	//  Indexes of the public imported files in the dependency list above.
+	// Indexes of the public imported files in the dependency list above.
 	publicDependency?: [...int32] @protobuf(10,name=public_dependency)
 
-	//  Indexes of the weak imported files in the dependency list.
-	//  For Google-internal migration only. Do not use.
+	// Indexes of the weak imported files in the dependency list.
+	// For Google-internal migration only. Do not use.
 	weakDependency?: [...int32] @protobuf(11,name=weak_dependency)
 
-	//  All top-level definitions in this file.
+	// All top-level definitions in this file.
 	messageType?: [...DescriptorProto] @protobuf(4,name=message_type)
 	enumType?: [...EnumDescriptorProto] @protobuf(5,name=enum_type)
 	service?: [...ServiceDescriptorProto] @protobuf(6)
 	extension?: [...FieldDescriptorProto] @protobuf(7)
 	options?: FileOptions @protobuf(8)
 
-	//  This field contains optional information about the original source code.
-	//  You may safely remove this entire field without harming runtime
-	//  functionality of the descriptors -- the information is needed only by
-	//  development tools.
+	// This field contains optional information about the original source code.
+	// You may safely remove this entire field without harming runtime
+	// functionality of the descriptors -- the information is needed only by
+	// development tools.
 	sourceCodeInfo?: SourceCodeInfo @protobuf(9,name=source_code_info)
 
-	//  The syntax of the proto file.
-	//  The supported values are "proto2" and "proto3".
+	// The syntax of the proto file.
+	// The supported values are "proto2" and "proto3".
 	syntax?: string @protobuf(12)
 }
 
-//  Describes a message type.
+// Describes a message type.
 DescriptorProto: {
 	name?: string @protobuf(1)
 	field?: [...FieldDescriptorProto] @protobuf(2)
@@ -123,103 +123,103 @@
 	options?: MessageOptions @protobuf(7)
 	reservedRange?: [...DescriptorProto_ReservedRange] @protobuf(9,type=ReservedRange,name=reserved_range)
 
-	//  Reserved field names, which may not be used by fields in the same message.
-	//  A given name may only be reserved once.
+	// Reserved field names, which may not be used by fields in the same message.
+	// A given name may only be reserved once.
 	reservedName?: [...string] @protobuf(10,name=reserved_name)
 }
 
 DescriptorProto_ExtensionRange: {
-	start?:   int32                 @protobuf(1) //  Inclusive.
-	end?:     int32                 @protobuf(2) //  Exclusive.
+	start?:   int32                 @protobuf(1) // Inclusive.
+	end?:     int32                 @protobuf(2) // Exclusive.
 	options?: ExtensionRangeOptions @protobuf(3)
 }
 
-//  Range of reserved tag numbers. Reserved tag numbers may not be used by
-//  fields or extension ranges in the same message. Reserved ranges may
-//  not overlap.
+// Range of reserved tag numbers. Reserved tag numbers may not be used by
+// fields or extension ranges in the same message. Reserved ranges may
+// not overlap.
 DescriptorProto_ReservedRange: {
-	start?: int32 @protobuf(1) //  Inclusive.
-	end?:   int32 @protobuf(2) //  Exclusive.
+	start?: int32 @protobuf(1) // Inclusive.
+	end?:   int32 @protobuf(2) // Exclusive.
 }
 
 ExtensionRangeOptions: {
-	//  The parser stores options it doesn't recognize here. See above.
+	// The parser stores options it doesn't recognize here. See above.
 	uninterpretedOption?: [...UninterpretedOption] @protobuf(999,name=uninterpreted_option)
 }
 
-//  Describes a field within a message.
+// Describes a field within a message.
 FieldDescriptorProto: {
 	name?:   string                     @protobuf(1)
 	number?: int32                      @protobuf(3)
 	label?:  FieldDescriptorProto_Label @protobuf(4,type=Label)
 
-	//  If type_name is set, this need not be set.  If both this and type_name
-	//  are set, this must be one of TYPE_ENUM, TYPE_MESSAGE or TYPE_GROUP.
+	// If type_name is set, this need not be set.  If both this and type_name
+	// are set, this must be one of TYPE_ENUM, TYPE_MESSAGE or TYPE_GROUP.
 	type?: FieldDescriptorProto_Type @protobuf(5,type=Type)
 
-	//  For message and enum types, this is the name of the type.  If the name
-	//  starts with a '.', it is fully-qualified.  Otherwise, C++-like scoping
-	//  rules are used to find the type (i.e. first the nested types within this
-	//  message are searched, then within the parent, on up to the root
-	//  namespace).
+	// For message and enum types, this is the name of the type.  If the name
+	// starts with a '.', it is fully-qualified.  Otherwise, C++-like scoping
+	// rules are used to find the type (i.e. first the nested types within this
+	// message are searched, then within the parent, on up to the root
+	// namespace).
 	typeName?: string @protobuf(6,name=type_name)
 
-	//  For extensions, this is the name of the type being extended.  It is
-	//  resolved in the same manner as type_name.
+	// For extensions, this is the name of the type being extended.  It is
+	// resolved in the same manner as type_name.
 	extendee?: string @protobuf(2)
 
-	//  For numeric types, contains the original text representation of the value.
-	//  For booleans, "true" or "false".
-	//  For strings, contains the default text contents (not escaped in any way).
-	//  For bytes, contains the C escaped value.  All bytes >= 128 are escaped.
-	//  TODO(kenton):  Base-64 encode?
+	// For numeric types, contains the original text representation of the value.
+	// For booleans, "true" or "false".
+	// For strings, contains the default text contents (not escaped in any way).
+	// For bytes, contains the C escaped value.  All bytes >= 128 are escaped.
+	// TODO(kenton):  Base-64 encode?
 	defaultValue?: string @protobuf(7,name=default_value)
 
-	//  If set, gives the index of a oneof in the containing type's oneof_decl
-	//  list.  This field is a member of that oneof.
+	// If set, gives the index of a oneof in the containing type's oneof_decl
+	// list.  This field is a member of that oneof.
 	oneofIndex?: int32 @protobuf(9,name=oneof_index)
 
-	//  JSON name of this field. The value is set by protocol compiler. If the
-	//  user has set a "json_name" option on this field, that option's value
-	//  will be used. Otherwise, it's deduced from the field's name by converting
-	//  it to camelCase.
+	// JSON name of this field. The value is set by protocol compiler. If the
+	// user has set a "json_name" option on this field, that option's value
+	// will be used. Otherwise, it's deduced from the field's name by converting
+	// it to camelCase.
 	jsonName?: string       @protobuf(10,name=json_name)
 	options?:  FieldOptions @protobuf(8)
 }
 FieldDescriptorProto_Type:
-	//  0 is reserved for errors.
-	//  Order is weird for historical reasons.
+	// 0 is reserved for errors.
+	// Order is weird for historical reasons.
 	*"TYPE_DOUBLE" |
 	"TYPE_FLOAT" |
 
-	//  Not ZigZag encoded.  Negative numbers take 10 bytes.  Use TYPE_SINT64 if
-	//  negative values are likely.
+	// Not ZigZag encoded.  Negative numbers take 10 bytes.  Use TYPE_SINT64 if
+	// negative values are likely.
 	"TYPE_INT64" |
 	"TYPE_UINT64" |
 
-	//  Not ZigZag encoded.  Negative numbers take 10 bytes.  Use TYPE_SINT32 if
-	//  negative values are likely.
+	// Not ZigZag encoded.  Negative numbers take 10 bytes.  Use TYPE_SINT32 if
+	// negative values are likely.
 	"TYPE_INT32" |
 	"TYPE_FIXED64" |
 	"TYPE_FIXED32" |
 	"TYPE_BOOL" |
 	"TYPE_STRING" |
 
-	//  Tag-delimited aggregate.
-	//  Group type is deprecated and not supported in proto3. However, Proto3
-	//  implementations should still be able to parse the group wire format and
-	//  treat group fields as unknown fields.
+	// Tag-delimited aggregate.
+	// Group type is deprecated and not supported in proto3. However, Proto3
+	// implementations should still be able to parse the group wire format and
+	// treat group fields as unknown fields.
 	"TYPE_GROUP" |
-	"TYPE_MESSAGE" | //  Length-delimited aggregate.
+	"TYPE_MESSAGE" | // Length-delimited aggregate.
 
-	//  New in version 2.
+	// New in version 2.
 	"TYPE_BYTES" |
 	"TYPE_UINT32" |
 	"TYPE_ENUM" |
 	"TYPE_SFIXED32" |
 	"TYPE_SFIXED64" |
-	"TYPE_SINT32" | //  Uses ZigZag encoding.
-	"TYPE_SINT64" //  Uses ZigZag encoding.
+	"TYPE_SINT32" | // Uses ZigZag encoding.
+	"TYPE_SINT64" // Uses ZigZag encoding.
 
 FieldDescriptorProto_Type_value: {
 	"TYPE_DOUBLE":   1
@@ -242,7 +242,7 @@
 	"TYPE_SINT64":   18
 }
 FieldDescriptorProto_Label:
-	//  0 is reserved for errors
+	// 0 is reserved for errors
 	*"LABEL_OPTIONAL" |
 	"LABEL_REQUIRED" |
 	"LABEL_REPEATED"
@@ -253,317 +253,317 @@
 	"LABEL_REPEATED": 3
 }
 
-//  Describes a oneof.
+// Describes a oneof.
 OneofDescriptorProto: {
 	name?:    string       @protobuf(1)
 	options?: OneofOptions @protobuf(2)
 }
 
-//  Describes an enum type.
+// Describes an enum type.
 EnumDescriptorProto: {
 	name?: string @protobuf(1)
 	value?: [...EnumValueDescriptorProto] @protobuf(2)
 	options?: EnumOptions @protobuf(3)
 
-	//  Range of reserved numeric values. Reserved numeric values may not be used
-	//  by enum values in the same enum declaration. Reserved ranges may not
-	//  overlap.
+	// Range of reserved numeric values. Reserved numeric values may not be used
+	// by enum values in the same enum declaration. Reserved ranges may not
+	// overlap.
 	reservedRange?: [...EnumDescriptorProto_EnumReservedRange] @protobuf(4,type=EnumReservedRange,name=reserved_range)
 
-	//  Reserved enum value names, which may not be reused. A given name may only
-	//  be reserved once.
+	// Reserved enum value names, which may not be reused. A given name may only
+	// be reserved once.
 	reservedName?: [...string] @protobuf(5,name=reserved_name)
 }
 
-//  Range of reserved numeric values. Reserved values may not be used by
-//  entries in the same enum. Reserved ranges may not overlap.
-// 
-//  Note that this is distinct from DescriptorProto.ReservedRange in that it
-//  is inclusive such that it can appropriately represent the entire int32
-//  domain.
+// Range of reserved numeric values. Reserved values may not be used by
+// entries in the same enum. Reserved ranges may not overlap.
+//
+// Note that this is distinct from DescriptorProto.ReservedRange in that it
+// is inclusive such that it can appropriately represent the entire int32
+// domain.
 EnumDescriptorProto_EnumReservedRange: {
-	start?: int32 @protobuf(1) //  Inclusive.
-	end?:   int32 @protobuf(2) //  Inclusive.
+	start?: int32 @protobuf(1) // Inclusive.
+	end?:   int32 @protobuf(2) // Inclusive.
 }
 
-//  Describes a value within an enum.
+// Describes a value within an enum.
 EnumValueDescriptorProto: {
 	name?:    string           @protobuf(1)
 	number?:  int32            @protobuf(2)
 	options?: EnumValueOptions @protobuf(3)
 }
 
-//  Describes a service.
+// Describes a service.
 ServiceDescriptorProto: {
 	name?: string @protobuf(1)
 	method?: [...MethodDescriptorProto] @protobuf(2)
 	options?: ServiceOptions @protobuf(3)
 }
 
-//  Describes a method of a service.
+// Describes a method of a service.
 MethodDescriptorProto: {
 	name?: string @protobuf(1)
 
-	//  Input and output type names.  These are resolved in the same way as
-	//  FieldDescriptorProto.type_name, but must refer to a message type.
+	// Input and output type names.  These are resolved in the same way as
+	// FieldDescriptorProto.type_name, but must refer to a message type.
 	inputType?:  string        @protobuf(2,name=input_type)
 	outputType?: string        @protobuf(3,name=output_type)
 	options?:    MethodOptions @protobuf(4)
 
-	//  Identifies if client streams multiple client messages
+	// Identifies if client streams multiple client messages
 	clientStreaming?: bool @protobuf(5,name=client_streaming,"default=false")
 
-	//  Identifies if server streams multiple server messages
+	// Identifies if server streams multiple server messages
 	serverStreaming?: bool @protobuf(6,name=server_streaming,"default=false")
 }
 
 FileOptions: {
-	//  Sets the Java package where classes generated from this .proto will be
-	//  placed.  By default, the proto package is used, but this is often
-	//  inappropriate because proto packages do not normally start with backwards
-	//  domain names.
+	// Sets the Java package where classes generated from this .proto will be
+	// placed.  By default, the proto package is used, but this is often
+	// inappropriate because proto packages do not normally start with backwards
+	// domain names.
 	javaPackage?: string @protobuf(1,name=java_package)
 
-	//  If set, all the classes from the .proto file are wrapped in a single
-	//  outer class with the given name.  This applies to both Proto1
-	//  (equivalent to the old "--one_java_file" option) and Proto2 (where
-	//  a .proto always translates to a single class, but you may want to
-	//  explicitly choose the class name).
+	// If set, all the classes from the .proto file are wrapped in a single
+	// outer class with the given name.  This applies to both Proto1
+	// (equivalent to the old "--one_java_file" option) and Proto2 (where
+	// a .proto always translates to a single class, but you may want to
+	// explicitly choose the class name).
 	javaOuterClassname?: string @protobuf(8,name=java_outer_classname)
 
-	//  If set true, then the Java code generator will generate a separate .java
-	//  file for each top-level message, enum, and service defined in the .proto
-	//  file.  Thus, these types will *not* be nested inside the outer class
-	//  named by java_outer_classname.  However, the outer class will still be
-	//  generated to contain the file's getDescriptor() method as well as any
-	//  top-level extensions defined in the file.
+	// If set true, then the Java code generator will generate a separate .java
+	// file for each top-level message, enum, and service defined in the .proto
+	// file.  Thus, these types will *not* be nested inside the outer class
+	// named by java_outer_classname.  However, the outer class will still be
+	// generated to contain the file's getDescriptor() method as well as any
+	// top-level extensions defined in the file.
 	javaMultipleFiles?: bool @protobuf(10,name=java_multiple_files,"default=false")
 
-	//  This option does nothing.
+	// This option does nothing.
 	javaGenerateEqualsAndHash?: bool @protobuf(20,name=java_generate_equals_and_hash,deprecated)
 
-	//  If set true, then the Java2 code generator will generate code that
-	//  throws an exception whenever an attempt is made to assign a non-UTF-8
-	//  byte sequence to a string field.
-	//  Message reflection will do the same.
-	//  However, an extension field still accepts non-UTF-8 byte sequences.
-	//  This option has no effect on when used with the lite runtime.
+	// If set true, then the Java2 code generator will generate code that
+	// throws an exception whenever an attempt is made to assign a non-UTF-8
+	// byte sequence to a string field.
+	// Message reflection will do the same.
+	// However, an extension field still accepts non-UTF-8 byte sequences.
+	// This option has no effect on when used with the lite runtime.
 	javaStringCheckUtf8?: bool                     @protobuf(27,name=java_string_check_utf8,"default=false")
 	optimizeFor?:         FileOptions_OptimizeMode @protobuf(9,type=OptimizeMode,name=optimize_for,"default=SPEED")
 
-	//  Sets the Go package where structs generated from this .proto will be
-	//  placed. If omitted, the Go package will be derived from the following:
-	//    - The basename of the package import path, if provided.
-	//    - Otherwise, the package statement in the .proto file, if present.
-	//    - Otherwise, the basename of the .proto file, without extension.
+	// Sets the Go package where structs generated from this .proto will be
+	// placed. If omitted, the Go package will be derived from the following:
+	//   - The basename of the package import path, if provided.
+	//   - Otherwise, the package statement in the .proto file, if present.
+	//   - Otherwise, the basename of the .proto file, without extension.
 	goPackage?: string @protobuf(11,name=go_package)
 
-	//  Should generic services be generated in each language?  "Generic" services
-	//  are not specific to any particular RPC system.  They are generated by the
-	//  main code generators in each language (without additional plugins).
-	//  Generic services were the only kind of service generation supported by
-	//  early versions of google.protobuf.
-	// 
-	//  Generic services are now considered deprecated in favor of using plugins
-	//  that generate code specific to your particular RPC system.  Therefore,
-	//  these default to false.  Old code which depends on generic services should
-	//  explicitly set them to true.
+	// Should generic services be generated in each language?  "Generic" services
+	// are not specific to any particular RPC system.  They are generated by the
+	// main code generators in each language (without additional plugins).
+	// Generic services were the only kind of service generation supported by
+	// early versions of google.protobuf.
+	//
+	// Generic services are now considered deprecated in favor of using plugins
+	// that generate code specific to your particular RPC system.  Therefore,
+	// these default to false.  Old code which depends on generic services should
+	// explicitly set them to true.
 	ccGenericServices?:   bool @protobuf(16,name=cc_generic_services,"default=false")
 	javaGenericServices?: bool @protobuf(17,name=java_generic_services,"default=false")
 	pyGenericServices?:   bool @protobuf(18,name=py_generic_services,"default=false")
 	phpGenericServices?:  bool @protobuf(42,name=php_generic_services,"default=false")
 
-	//  Is this file deprecated?
-	//  Depending on the target platform, this can emit Deprecated annotations
-	//  for everything in the file, or it will be completely ignored; in the very
-	//  least, this is a formalization for deprecating files.
+	// Is this file deprecated?
+	// Depending on the target platform, this can emit Deprecated annotations
+	// for everything in the file, or it will be completely ignored; in the very
+	// least, this is a formalization for deprecating files.
 	deprecated?: bool @protobuf(23,"default=false")
 
-	//  Enables the use of arenas for the proto messages in this file. This applies
-	//  only to generated classes for C++.
+	// Enables the use of arenas for the proto messages in this file. This applies
+	// only to generated classes for C++.
 	ccEnableArenas?: bool @protobuf(31,name=cc_enable_arenas,"default=false")
 
-	//  Sets the objective c class prefix which is prepended to all objective c
-	//  generated classes from this .proto. There is no default.
+	// Sets the objective c class prefix which is prepended to all objective c
+	// generated classes from this .proto. There is no default.
 	objcClassPrefix?: string @protobuf(36,name=objc_class_prefix)
 
-	//  Namespace for generated classes; defaults to the package.
+	// Namespace for generated classes; defaults to the package.
 	csharpNamespace?: string @protobuf(37,name=csharp_namespace)
 
-	//  By default Swift generators will take the proto package and CamelCase it
-	//  replacing '.' with underscore and use that to prefix the types/symbols
-	//  defined. When this options is provided, they will use this value instead
-	//  to prefix the types/symbols defined.
+	// By default Swift generators will take the proto package and CamelCase it
+	// replacing '.' with underscore and use that to prefix the types/symbols
+	// defined. When this options is provided, they will use this value instead
+	// to prefix the types/symbols defined.
 	swiftPrefix?: string @protobuf(39,name=swift_prefix)
 
-	//  Sets the php class prefix which is prepended to all php generated classes
-	//  from this .proto. Default is empty.
+	// Sets the php class prefix which is prepended to all php generated classes
+	// from this .proto. Default is empty.
 	phpClassPrefix?: string @protobuf(40,name=php_class_prefix)
 
-	//  Use this option to change the namespace of php generated classes. Default
-	//  is empty. When this option is empty, the package name will be used for
-	//  determining the namespace.
+	// Use this option to change the namespace of php generated classes. Default
+	// is empty. When this option is empty, the package name will be used for
+	// determining the namespace.
 	phpNamespace?: string @protobuf(41,name=php_namespace)
 
-	//  Use this option to change the namespace of php generated metadata classes.
-	//  Default is empty. When this option is empty, the proto file name will be
-	//  used for determining the namespace.
+	// Use this option to change the namespace of php generated metadata classes.
+	// Default is empty. When this option is empty, the proto file name will be
+	// used for determining the namespace.
 	phpMetadataNamespace?: string @protobuf(44,name=php_metadata_namespace)
 
-	//  Use this option to change the package of ruby generated classes. Default
-	//  is empty. When this option is not set, the package name will be used for
-	//  determining the ruby package.
+	// Use this option to change the package of ruby generated classes. Default
+	// is empty. When this option is not set, the package name will be used for
+	// determining the ruby package.
 	rubyPackage?: string @protobuf(45,name=ruby_package)
 
-	//  The parser stores options it doesn't recognize here.
-	//  See the documentation for the "Options" section above.
+	// The parser stores options it doesn't recognize here.
+	// See the documentation for the "Options" section above.
 	uninterpretedOption?: [...UninterpretedOption] @protobuf(999,name=uninterpreted_option)
 }
 
-//  Generated classes can be optimized for speed or code size.
+// Generated classes can be optimized for speed or code size.
 FileOptions_OptimizeMode:
-	*"SPEED" | //  Generate complete code for parsing, serialization,
+	*"SPEED" | // Generate complete code for parsing, serialization,
 
-	//  etc.
+	// etc.
 	"CODE_SIZE" |
-	"LITE_RUNTIME" //  Generate code using MessageLite and the lite runtime.
+	"LITE_RUNTIME" // Generate code using MessageLite and the lite runtime.
 
 FileOptions_OptimizeMode_value: {
 	"SPEED":        1
-	"CODE_SIZE":    2 //  Use ReflectionOps to implement these methods.
+	"CODE_SIZE":    2 // Use ReflectionOps to implement these methods.
 	"LITE_RUNTIME": 3
 }
 
 MessageOptions: {
-	//  Set true to use the old proto1 MessageSet wire format for extensions.
-	//  This is provided for backwards-compatibility with the MessageSet wire
-	//  format.  You should not use this for any other reason:  It's less
-	//  efficient, has fewer features, and is more complicated.
-	// 
-	//  The message must be defined exactly as follows:
-	//    message Foo {
-	//      option message_set_wire_format = true;
-	//      extensions 4 to max;
-	//    }
-	//  Note that the message cannot have any defined fields; MessageSets only
-	//  have extensions.
-	// 
-	//  All extensions of your type must be singular messages; e.g. they cannot
-	//  be int32s, enums, or repeated messages.
-	// 
-	//  Because this is an option, the above two restrictions are not enforced by
-	//  the protocol compiler.
+	// Set true to use the old proto1 MessageSet wire format for extensions.
+	// This is provided for backwards-compatibility with the MessageSet wire
+	// format.  You should not use this for any other reason:  It's less
+	// efficient, has fewer features, and is more complicated.
+	//
+	// The message must be defined exactly as follows:
+	//   message Foo {
+	//     option message_set_wire_format = true;
+	//     extensions 4 to max;
+	//   }
+	// Note that the message cannot have any defined fields; MessageSets only
+	// have extensions.
+	//
+	// All extensions of your type must be singular messages; e.g. they cannot
+	// be int32s, enums, or repeated messages.
+	//
+	// Because this is an option, the above two restrictions are not enforced by
+	// the protocol compiler.
 	messageSetWireFormat?: bool @protobuf(1,name=message_set_wire_format,"default=false")
 
-	//  Disables the generation of the standard "descriptor()" accessor, which can
-	//  conflict with a field of the same name.  This is meant to make migration
-	//  from proto1 easier; new code should avoid fields named "descriptor".
+	// Disables the generation of the standard "descriptor()" accessor, which can
+	// conflict with a field of the same name.  This is meant to make migration
+	// from proto1 easier; new code should avoid fields named "descriptor".
 	noStandardDescriptorAccessor?: bool @protobuf(2,name=no_standard_descriptor_accessor,"default=false")
 
-	//  Is this message deprecated?
-	//  Depending on the target platform, this can emit Deprecated annotations
-	//  for the message, or it will be completely ignored; in the very least,
-	//  this is a formalization for deprecating messages.
+	// Is this message deprecated?
+	// Depending on the target platform, this can emit Deprecated annotations
+	// for the message, or it will be completely ignored; in the very least,
+	// this is a formalization for deprecating messages.
 	deprecated?: bool @protobuf(3,"default=false")
 
-	//  Whether the message is an automatically generated map entry type for the
-	//  maps field.
-	// 
-	//  For maps fields:
-	//      map<KeyType, ValueType> map_field = 1;
-	//  The parsed descriptor looks like:
-	//      message MapFieldEntry {
-	//          option map_entry = true;
-	//          optional KeyType key = 1;
-	//          optional ValueType value = 2;
-	//      }
-	//      repeated MapFieldEntry map_field = 1;
-	// 
-	//  Implementations may choose not to generate the map_entry=true message, but
-	//  use a native map in the target language to hold the keys and values.
-	//  The reflection APIs in such implementations still need to work as
-	//  if the field is a repeated message field.
-	// 
-	//  NOTE: Do not set the option in .proto files. Always use the maps syntax
-	//  instead. The option should only be implicitly set by the proto compiler
-	//  parser.
+	// Whether the message is an automatically generated map entry type for the
+	// maps field.
+	//
+	// For maps fields:
+	//     map<KeyType, ValueType> map_field = 1;
+	// The parsed descriptor looks like:
+	//     message MapFieldEntry {
+	//         option map_entry = true;
+	//         optional KeyType key = 1;
+	//         optional ValueType value = 2;
+	//     }
+	//     repeated MapFieldEntry map_field = 1;
+	//
+	// Implementations may choose not to generate the map_entry=true message, but
+	// use a native map in the target language to hold the keys and values.
+	// The reflection APIs in such implementations still need to work as
+	// if the field is a repeated message field.
+	//
+	// NOTE: Do not set the option in .proto files. Always use the maps syntax
+	// instead. The option should only be implicitly set by the proto compiler
+	// parser.
 	mapEntry?: bool @protobuf(7,name=map_entry)
 
-	//  The parser stores options it doesn't recognize here. See above.
+	// The parser stores options it doesn't recognize here. See above.
 	uninterpretedOption?: [...UninterpretedOption] @protobuf(999,name=uninterpreted_option)
 }
 
 FieldOptions: {
-	//  The ctype option instructs the C++ code generator to use a different
-	//  representation of the field than it normally would.  See the specific
-	//  options below.  This option is not yet implemented in the open source
-	//  release -- sorry, we'll try to include it in a future version!
+	// The ctype option instructs the C++ code generator to use a different
+	// representation of the field than it normally would.  See the specific
+	// options below.  This option is not yet implemented in the open source
+	// release -- sorry, we'll try to include it in a future version!
 	ctype?: FieldOptions_CType @protobuf(1,type=CType,"default=STRING")
 
-	//  The packed option can be enabled for repeated primitive fields to enable
-	//  a more efficient representation on the wire. Rather than repeatedly
-	//  writing the tag and type for each element, the entire array is encoded as
-	//  a single length-delimited blob. In proto3, only explicit setting it to
-	//  false will avoid using packed encoding.
+	// The packed option can be enabled for repeated primitive fields to enable
+	// a more efficient representation on the wire. Rather than repeatedly
+	// writing the tag and type for each element, the entire array is encoded as
+	// a single length-delimited blob. In proto3, only explicit setting it to
+	// false will avoid using packed encoding.
 	packed?: bool @protobuf(2)
 
-	//  The jstype option determines the JavaScript type used for values of the
-	//  field.  The option is permitted only for 64 bit integral and fixed types
-	//  (int64, uint64, sint64, fixed64, sfixed64).  A field with jstype JS_STRING
-	//  is represented as JavaScript string, which avoids loss of precision that
-	//  can happen when a large value is converted to a floating point JavaScript.
-	//  Specifying JS_NUMBER for the jstype causes the generated JavaScript code to
-	//  use the JavaScript "number" type.  The behavior of the default option
-	//  JS_NORMAL is implementation dependent.
-	// 
-	//  This option is an enum to permit additional types to be added, e.g.
-	//  goog.math.Integer.
+	// The jstype option determines the JavaScript type used for values of the
+	// field.  The option is permitted only for 64 bit integral and fixed types
+	// (int64, uint64, sint64, fixed64, sfixed64).  A field with jstype JS_STRING
+	// is represented as JavaScript string, which avoids loss of precision that
+	// can happen when a large value is converted to a floating point JavaScript.
+	// Specifying JS_NUMBER for the jstype causes the generated JavaScript code to
+	// use the JavaScript "number" type.  The behavior of the default option
+	// JS_NORMAL is implementation dependent.
+	//
+	// This option is an enum to permit additional types to be added, e.g.
+	// goog.math.Integer.
 	jstype?: FieldOptions_JSType @protobuf(6,type=JSType,"default=JS_NORMAL")
 
-	//  Should this field be parsed lazily?  Lazy applies only to message-type
-	//  fields.  It means that when the outer message is initially parsed, the
-	//  inner message's contents will not be parsed but instead stored in encoded
-	//  form.  The inner message will actually be parsed when it is first accessed.
-	// 
-	//  This is only a hint.  Implementations are free to choose whether to use
-	//  eager or lazy parsing regardless of the value of this option.  However,
-	//  setting this option true suggests that the protocol author believes that
-	//  using lazy parsing on this field is worth the additional bookkeeping
-	//  overhead typically needed to implement it.
-	// 
-	//  This option does not affect the public interface of any generated code;
-	//  all method signatures remain the same.  Furthermore, thread-safety of the
-	//  interface is not affected by this option; const methods remain safe to
-	//  call from multiple threads concurrently, while non-const methods continue
-	//  to require exclusive access.
-	// 
-	// 
-	//  Note that implementations may choose not to check required fields within
-	//  a lazy sub-message.  That is, calling IsInitialized() on the outer message
-	//  may return true even if the inner message has missing required fields.
-	//  This is necessary because otherwise the inner message would have to be
-	//  parsed in order to perform the check, defeating the purpose of lazy
-	//  parsing.  An implementation which chooses not to check required fields
-	//  must be consistent about it.  That is, for any particular sub-message, the
-	//  implementation must either *always* check its required fields, or *never*
-	//  check its required fields, regardless of whether or not the message has
-	//  been parsed.
+	// Should this field be parsed lazily?  Lazy applies only to message-type
+	// fields.  It means that when the outer message is initially parsed, the
+	// inner message's contents will not be parsed but instead stored in encoded
+	// form.  The inner message will actually be parsed when it is first accessed.
+	//
+	// This is only a hint.  Implementations are free to choose whether to use
+	// eager or lazy parsing regardless of the value of this option.  However,
+	// setting this option true suggests that the protocol author believes that
+	// using lazy parsing on this field is worth the additional bookkeeping
+	// overhead typically needed to implement it.
+	//
+	// This option does not affect the public interface of any generated code;
+	// all method signatures remain the same.  Furthermore, thread-safety of the
+	// interface is not affected by this option; const methods remain safe to
+	// call from multiple threads concurrently, while non-const methods continue
+	// to require exclusive access.
+	//
+	//
+	// Note that implementations may choose not to check required fields within
+	// a lazy sub-message.  That is, calling IsInitialized() on the outer message
+	// may return true even if the inner message has missing required fields.
+	// This is necessary because otherwise the inner message would have to be
+	// parsed in order to perform the check, defeating the purpose of lazy
+	// parsing.  An implementation which chooses not to check required fields
+	// must be consistent about it.  That is, for any particular sub-message, the
+	// implementation must either *always* check its required fields, or *never*
+	// check its required fields, regardless of whether or not the message has
+	// been parsed.
 	lazy?: bool @protobuf(5,"default=false")
 
-	//  Is this field deprecated?
-	//  Depending on the target platform, this can emit Deprecated annotations
-	//  for accessors, or it will be completely ignored; in the very least, this
-	//  is a formalization for deprecating fields.
+	// Is this field deprecated?
+	// Depending on the target platform, this can emit Deprecated annotations
+	// for accessors, or it will be completely ignored; in the very least, this
+	// is a formalization for deprecating fields.
 	deprecated?: bool @protobuf(3,"default=false")
 
-	//  For Google-internal migration only. Do not use.
+	// For Google-internal migration only. Do not use.
 	weak?: bool @protobuf(10,"default=false")
 
-	//  The parser stores options it doesn't recognize here. See above.
+	// The parser stores options it doesn't recognize here. See above.
 	uninterpretedOption?: [...UninterpretedOption] @protobuf(999,name=uninterpreted_option)
 }
 FieldOptions_CType:
-	//  Default mode.
+	// Default mode.
 	*"STRING" |
 	"CORD" |
 	"STRING_PIECE"
@@ -574,13 +574,13 @@
 	"STRING_PIECE": 2
 }
 FieldOptions_JSType:
-	//  Use the default type.
+	// Use the default type.
 	*"JS_NORMAL" |
 
-	//  Use JavaScript strings.
+	// Use JavaScript strings.
 	"JS_STRING" |
 
-	//  Use JavaScript numbers.
+	// Use JavaScript numbers.
 	"JS_NUMBER"
 
 FieldOptions_JSType_value: {
@@ -590,78 +590,78 @@
 }
 
 OneofOptions: {
-	//  The parser stores options it doesn't recognize here. See above.
+	// The parser stores options it doesn't recognize here. See above.
 	uninterpretedOption?: [...UninterpretedOption] @protobuf(999,name=uninterpreted_option)
 }
 
 EnumOptions: {
-	//  Set this option to true to allow mapping different tag names to the same
-	//  value.
+	// Set this option to true to allow mapping different tag names to the same
+	// value.
 	allowAlias?: bool @protobuf(2,name=allow_alias)
 
-	//  Is this enum deprecated?
-	//  Depending on the target platform, this can emit Deprecated annotations
-	//  for the enum, or it will be completely ignored; in the very least, this
-	//  is a formalization for deprecating enums.
+	// Is this enum deprecated?
+	// Depending on the target platform, this can emit Deprecated annotations
+	// for the enum, or it will be completely ignored; in the very least, this
+	// is a formalization for deprecating enums.
 	deprecated?: bool @protobuf(3,"default=false")
 
-	//  The parser stores options it doesn't recognize here. See above.
+	// The parser stores options it doesn't recognize here. See above.
 	uninterpretedOption?: [...UninterpretedOption] @protobuf(999,name=uninterpreted_option)
 }
 
 EnumValueOptions: {
-	//  Is this enum value deprecated?
-	//  Depending on the target platform, this can emit Deprecated annotations
-	//  for the enum value, or it will be completely ignored; in the very least,
-	//  this is a formalization for deprecating enum values.
+	// Is this enum value deprecated?
+	// Depending on the target platform, this can emit Deprecated annotations
+	// for the enum value, or it will be completely ignored; in the very least,
+	// this is a formalization for deprecating enum values.
 	deprecated?: bool @protobuf(1,"default=false")
 
-	//  The parser stores options it doesn't recognize here. See above.
+	// The parser stores options it doesn't recognize here. See above.
 	uninterpretedOption?: [...UninterpretedOption] @protobuf(999,name=uninterpreted_option)
 }
 
 ServiceOptions: {
 
-	//  Note:  Field numbers 1 through 32 are reserved for Google's internal RPC
-	//    framework.  We apologize for hoarding these numbers to ourselves, but
-	//    we were already using them long before we decided to release Protocol
-	//    Buffers.
+	// Note:  Field numbers 1 through 32 are reserved for Google's internal RPC
+	//   framework.  We apologize for hoarding these numbers to ourselves, but
+	//   we were already using them long before we decided to release Protocol
+	//   Buffers.
 
-	//  Is this service deprecated?
-	//  Depending on the target platform, this can emit Deprecated annotations
-	//  for the service, or it will be completely ignored; in the very least,
-	//  this is a formalization for deprecating services.
+	// Is this service deprecated?
+	// Depending on the target platform, this can emit Deprecated annotations
+	// for the service, or it will be completely ignored; in the very least,
+	// this is a formalization for deprecating services.
 	deprecated?: bool @protobuf(33,"default=false")
 
-	//  The parser stores options it doesn't recognize here. See above.
+	// The parser stores options it doesn't recognize here. See above.
 	uninterpretedOption?: [...UninterpretedOption] @protobuf(999,name=uninterpreted_option)
 }
 
 MethodOptions: {
 
-	//  Note:  Field numbers 1 through 32 are reserved for Google's internal RPC
-	//    framework.  We apologize for hoarding these numbers to ourselves, but
-	//    we were already using them long before we decided to release Protocol
-	//    Buffers.
+	// Note:  Field numbers 1 through 32 are reserved for Google's internal RPC
+	//   framework.  We apologize for hoarding these numbers to ourselves, but
+	//   we were already using them long before we decided to release Protocol
+	//   Buffers.
 
-	//  Is this method deprecated?
-	//  Depending on the target platform, this can emit Deprecated annotations
-	//  for the method, or it will be completely ignored; in the very least,
-	//  this is a formalization for deprecating methods.
+	// Is this method deprecated?
+	// Depending on the target platform, this can emit Deprecated annotations
+	// for the method, or it will be completely ignored; in the very least,
+	// this is a formalization for deprecating methods.
 	deprecated?:       bool                           @protobuf(33,"default=false")
 	idempotencyLevel?: MethodOptions_IdempotencyLevel @protobuf(34,type=IdempotencyLevel,name=idempotency_level,"default=IDEMPOTENCY_UNKNOWN")
 
-	//  The parser stores options it doesn't recognize here. See above.
+	// The parser stores options it doesn't recognize here. See above.
 	uninterpretedOption?: [...UninterpretedOption] @protobuf(999,name=uninterpreted_option)
 }
 
-//  Is this method side-effect-free (or safe in HTTP parlance), or idempotent,
-//  or neither? HTTP based RPC implementation may choose GET verb for safe
-//  methods, and PUT verb for idempotent methods instead of the default POST.
+// Is this method side-effect-free (or safe in HTTP parlance), or idempotent,
+// or neither? HTTP based RPC implementation may choose GET verb for safe
+// methods, and PUT verb for idempotent methods instead of the default POST.
 MethodOptions_IdempotencyLevel:
 	*"IDEMPOTENCY_UNKNOWN" |
-	"NO_SIDE_EFFECTS" | //  implies idempotent
-	"IDEMPOTENT" //  idempotent, but may have side effects
+	"NO_SIDE_EFFECTS" | // implies idempotent
+	"IDEMPOTENT" // idempotent, but may have side effects
 
 MethodOptions_IdempotencyLevel_value: {
 	"IDEMPOTENCY_UNKNOWN": 0
@@ -669,17 +669,17 @@
 	"IDEMPOTENT":          2
 }
 
-//  A message representing a option the parser does not recognize. This only
-//  appears in options protos created by the compiler::Parser class.
-//  DescriptorPool resolves these when building Descriptor objects. Therefore,
-//  options protos in descriptor objects (e.g. returned by Descriptor::options(),
-//  or produced by Descriptor::CopyTo()) will never have UninterpretedOptions
-//  in them.
+// A message representing a option the parser does not recognize. This only
+// appears in options protos created by the compiler::Parser class.
+// DescriptorPool resolves these when building Descriptor objects. Therefore,
+// options protos in descriptor objects (e.g. returned by Descriptor::options(),
+// or produced by Descriptor::CopyTo()) will never have UninterpretedOptions
+// in them.
 UninterpretedOption: {
 	name?: [...UninterpretedOption_NamePart] @protobuf(2,type=NamePart)
 
-	//  The value of the uninterpreted option, in whatever type the tokenizer
-	//  identified it as during parsing. Exactly one of these should be set.
+	// The value of the uninterpreted option, in whatever type the tokenizer
+	// identified it as during parsing. Exactly one of these should be set.
 	identifierValue?:  string  @protobuf(3,name=identifier_value)
 	positiveIntValue?: uint64  @protobuf(4,name=positive_int_value)
 	negativeIntValue?: int64   @protobuf(5,name=negative_int_value)
@@ -688,173 +688,173 @@
 	aggregateValue?:   string  @protobuf(8,name=aggregate_value)
 }
 
-//  The name of the uninterpreted option.  Each string represents a segment in
-//  a dot-separated name.  is_extension is true iff a segment represents an
-//  extension (denoted with parentheses in options specs in .proto files).
-//  E.g.,{ ["foo", false], ["bar.baz", true], ["qux", false] } represents
-//  "foo.(bar.baz).qux".
+// The name of the uninterpreted option.  Each string represents a segment in
+// a dot-separated name.  is_extension is true iff a segment represents an
+// extension (denoted with parentheses in options specs in .proto files).
+// E.g.,{ ["foo", false], ["bar.baz", true], ["qux", false] } represents
+// "foo.(bar.baz).qux".
 UninterpretedOption_NamePart: {
 	namePart?:    string @protobuf(1,name=name_part)
 	isExtension?: bool   @protobuf(2,name=is_extension)
 }
 
-//  Encapsulates information about the original source file from which a
-//  FileDescriptorProto was generated.
+// Encapsulates information about the original source file from which a
+// FileDescriptorProto was generated.
 SourceCodeInfo: {
-	//  A Location identifies a piece of source code in a .proto file which
-	//  corresponds to a particular definition.  This information is intended
-	//  to be useful to IDEs, code indexers, documentation generators, and similar
-	//  tools.
-	// 
-	//  For example, say we have a file like:
-	//    message Foo {
-	//      optional string foo = 1;
-	//    }
-	//  Let's look at just the field definition:
-	//    optional string foo = 1;
-	//    ^       ^^     ^^  ^  ^^^
-	//    a       bc     de  f  ghi
-	//  We have the following locations:
-	//    span   path               represents
-	//    [a,i)  [ 4, 0, 2, 0 ]     The whole field definition.
-	//    [a,b)  [ 4, 0, 2, 0, 4 ]  The label (optional).
-	//    [c,d)  [ 4, 0, 2, 0, 5 ]  The type (string).
-	//    [e,f)  [ 4, 0, 2, 0, 1 ]  The name (foo).
-	//    [g,h)  [ 4, 0, 2, 0, 3 ]  The number (1).
-	// 
-	//  Notes:
-	//  - A location may refer to a repeated field itself (i.e. not to any
-	//    particular index within it).  This is used whenever a set of elements are
-	//    logically enclosed in a single code segment.  For example, an entire
-	//    extend block (possibly containing multiple extension definitions) will
-	//    have an outer location whose path refers to the "extensions" repeated
-	//    field without an index.
-	//  - Multiple locations may have the same path.  This happens when a single
-	//    logical declaration is spread out across multiple places.  The most
-	//    obvious example is the "extend" block again -- there may be multiple
-	//    extend blocks in the same scope, each of which will have the same path.
-	//  - A location's span is not always a subset of its parent's span.  For
-	//    example, the "extendee" of an extension declaration appears at the
-	//    beginning of the "extend" block and is shared by all extensions within
-	//    the block.
-	//  - Just because a location's span is a subset of some other location's span
-	//    does not mean that it is a descendant.  For example, a "group" defines
-	//    both a type and a field in a single declaration.  Thus, the locations
-	//    corresponding to the type and field and their components will overlap.
-	//  - Code which tries to interpret locations should probably be designed to
-	//    ignore those that it doesn't understand, as more types of locations could
-	//    be recorded in the future.
+	// A Location identifies a piece of source code in a .proto file which
+	// corresponds to a particular definition.  This information is intended
+	// to be useful to IDEs, code indexers, documentation generators, and similar
+	// tools.
+	//
+	// For example, say we have a file like:
+	//   message Foo {
+	//     optional string foo = 1;
+	//   }
+	// Let's look at just the field definition:
+	//   optional string foo = 1;
+	//   ^       ^^     ^^  ^  ^^^
+	//   a       bc     de  f  ghi
+	// We have the following locations:
+	//   span   path               represents
+	//   [a,i)  [ 4, 0, 2, 0 ]     The whole field definition.
+	//   [a,b)  [ 4, 0, 2, 0, 4 ]  The label (optional).
+	//   [c,d)  [ 4, 0, 2, 0, 5 ]  The type (string).
+	//   [e,f)  [ 4, 0, 2, 0, 1 ]  The name (foo).
+	//   [g,h)  [ 4, 0, 2, 0, 3 ]  The number (1).
+	//
+	// Notes:
+	// - A location may refer to a repeated field itself (i.e. not to any
+	//   particular index within it).  This is used whenever a set of elements are
+	//   logically enclosed in a single code segment.  For example, an entire
+	//   extend block (possibly containing multiple extension definitions) will
+	//   have an outer location whose path refers to the "extensions" repeated
+	//   field without an index.
+	// - Multiple locations may have the same path.  This happens when a single
+	//   logical declaration is spread out across multiple places.  The most
+	//   obvious example is the "extend" block again -- there may be multiple
+	//   extend blocks in the same scope, each of which will have the same path.
+	// - A location's span is not always a subset of its parent's span.  For
+	//   example, the "extendee" of an extension declaration appears at the
+	//   beginning of the "extend" block and is shared by all extensions within
+	//   the block.
+	// - Just because a location's span is a subset of some other location's span
+	//   does not mean that it is a descendant.  For example, a "group" defines
+	//   both a type and a field in a single declaration.  Thus, the locations
+	//   corresponding to the type and field and their components will overlap.
+	// - Code which tries to interpret locations should probably be designed to
+	//   ignore those that it doesn't understand, as more types of locations could
+	//   be recorded in the future.
 	location?: [...SourceCodeInfo_Location] @protobuf(1,type=Location)
 }
 
 SourceCodeInfo_Location: {
-	//  Identifies which part of the FileDescriptorProto was defined at this
-	//  location.
-	// 
-	//  Each element is a field number or an index.  They form a path from
-	//  the root FileDescriptorProto to the place where the definition.  For
-	//  example, this path:
-	//    [ 4, 3, 2, 7, 1 ]
-	//  refers to:
-	//    file.message_type(3)  // 4, 3
-	//        .field(7)         // 2, 7
-	//        .name()           // 1
-	//  This is because FileDescriptorProto.message_type has field number 4:
-	//    repeated DescriptorProto message_type = 4;
-	//  and DescriptorProto.field has field number 2:
-	//    repeated FieldDescriptorProto field = 2;
-	//  and FieldDescriptorProto.name has field number 1:
-	//    optional string name = 1;
-	// 
-	//  Thus, the above path gives the location of a field name.  If we removed
-	//  the last element:
-	//    [ 4, 3, 2, 7 ]
-	//  this path refers to the whole field declaration (from the beginning
-	//  of the label to the terminating semicolon).
+	// Identifies which part of the FileDescriptorProto was defined at this
+	// location.
+	//
+	// Each element is a field number or an index.  They form a path from
+	// the root FileDescriptorProto to the place where the definition.  For
+	// example, this path:
+	//   [ 4, 3, 2, 7, 1 ]
+	// refers to:
+	//   file.message_type(3)  // 4, 3
+	//       .field(7)         // 2, 7
+	//       .name()           // 1
+	// This is because FileDescriptorProto.message_type has field number 4:
+	//   repeated DescriptorProto message_type = 4;
+	// and DescriptorProto.field has field number 2:
+	//   repeated FieldDescriptorProto field = 2;
+	// and FieldDescriptorProto.name has field number 1:
+	//   optional string name = 1;
+	//
+	// Thus, the above path gives the location of a field name.  If we removed
+	// the last element:
+	//   [ 4, 3, 2, 7 ]
+	// this path refers to the whole field declaration (from the beginning
+	// of the label to the terminating semicolon).
 	path?: [...int32] @protobuf(1,packed)
 
-	//  Always has exactly three or four elements: start line, start column,
-	//  end line (optional, otherwise assumed same as start line), end column.
-	//  These are packed into a single field for efficiency.  Note that line
-	//  and column numbers are zero-based -- typically you will want to add
-	//  1 to each before displaying to a user.
+	// Always has exactly three or four elements: start line, start column,
+	// end line (optional, otherwise assumed same as start line), end column.
+	// These are packed into a single field for efficiency.  Note that line
+	// and column numbers are zero-based -- typically you will want to add
+	// 1 to each before displaying to a user.
 	span?: [...int32] @protobuf(2,packed)
 
-	//  If this SourceCodeInfo represents a complete declaration, these are any
-	//  comments appearing before and after the declaration which appear to be
-	//  attached to the declaration.
-	// 
-	//  A series of line comments appearing on consecutive lines, with no other
-	//  tokens appearing on those lines, will be treated as a single comment.
-	// 
-	//  leading_detached_comments will keep paragraphs of comments that appear
-	//  before (but not connected to) the current element. Each paragraph,
-	//  separated by empty lines, will be one comment element in the repeated
-	//  field.
-	// 
-	//  Only the comment content is provided; comment markers (e.g. //) are
-	//  stripped out.  For block comments, leading whitespace and an asterisk
-	//  will be stripped from the beginning of each line other than the first.
-	//  Newlines are included in the output.
-	// 
-	//  Examples:
-	// 
-	//    optional int32 foo = 1;  // Comment attached to foo.
-	//    // Comment attached to bar.
-	//    optional int32 bar = 2;
-	// 
-	//    optional string baz = 3;
-	//    // Comment attached to baz.
-	//    // Another line attached to baz.
-	// 
-	//    // Comment attached to qux.
-	//    //
-	//    // Another line attached to qux.
-	//    optional double qux = 4;
-	// 
-	//    // Detached comment for corge. This is not leading or trailing comments
-	//    // to qux or corge because there are blank lines separating it from
-	//    // both.
-	// 
-	//    // Detached comment for corge paragraph 2.
-	// 
-	//    optional string corge = 5;
-	//    /* Block comment attached
-	//     * to corge.  Leading asterisks
-	//     * will be removed. */
-	//    /* Block comment attached to
-	//     * grault. */
-	//    optional int32 grault = 6;
-	// 
-	//    // ignored detached comments.
+	// If this SourceCodeInfo represents a complete declaration, these are any
+	// comments appearing before and after the declaration which appear to be
+	// attached to the declaration.
+	//
+	// A series of line comments appearing on consecutive lines, with no other
+	// tokens appearing on those lines, will be treated as a single comment.
+	//
+	// leading_detached_comments will keep paragraphs of comments that appear
+	// before (but not connected to) the current element. Each paragraph,
+	// separated by empty lines, will be one comment element in the repeated
+	// field.
+	//
+	// Only the comment content is provided; comment markers (e.g. //) are
+	// stripped out.  For block comments, leading whitespace and an asterisk
+	// will be stripped from the beginning of each line other than the first.
+	// Newlines are included in the output.
+	//
+	// Examples:
+	//
+	//   optional int32 foo = 1;  // Comment attached to foo.
+	//   // Comment attached to bar.
+	//   optional int32 bar = 2;
+	//
+	//   optional string baz = 3;
+	//   // Comment attached to baz.
+	//   // Another line attached to baz.
+	//
+	//   // Comment attached to qux.
+	//   //
+	//   // Another line attached to qux.
+	//   optional double qux = 4;
+	//
+	//   // Detached comment for corge. This is not leading or trailing comments
+	//   // to qux or corge because there are blank lines separating it from
+	//   // both.
+	//
+	//   // Detached comment for corge paragraph 2.
+	//
+	//   optional string corge = 5;
+	//   /* Block comment attached
+	//    * to corge.  Leading asterisks
+	//    * will be removed. */
+	//   /* Block comment attached to
+	//    * grault. */
+	//   optional int32 grault = 6;
+	//
+	//   // ignored detached comments.
 	leadingComments?:  string @protobuf(3,name=leading_comments)
 	trailingComments?: string @protobuf(4,name=trailing_comments)
 	leadingDetachedComments?: [...string] @protobuf(6,name=leading_detached_comments)
 }
 
-//  Describes the relationship between generated code and its original source
-//  file. A GeneratedCodeInfo message is associated with only one generated
-//  source file, but may contain references to different source .proto files.
+// Describes the relationship between generated code and its original source
+// file. A GeneratedCodeInfo message is associated with only one generated
+// source file, but may contain references to different source .proto files.
 GeneratedCodeInfo: {
-	//  An Annotation connects some span of text in generated code to an element
-	//  of its generating .proto file.
+	// An Annotation connects some span of text in generated code to an element
+	// of its generating .proto file.
 	annotation?: [...GeneratedCodeInfo_Annotation] @protobuf(1,type=Annotation)
 }
 
 GeneratedCodeInfo_Annotation: {
-	//  Identifies the element in the original source .proto file. This field
-	//  is formatted the same as SourceCodeInfo.Location.path.
+	// Identifies the element in the original source .proto file. This field
+	// is formatted the same as SourceCodeInfo.Location.path.
 	path?: [...int32] @protobuf(1,packed)
 
-	//  Identifies the filesystem path to the original source .proto.
+	// Identifies the filesystem path to the original source .proto.
 	sourceFile?: string @protobuf(2,name=source_file)
 
-	//  Identifies the starting offset in bytes in the generated code
-	//  that relates to the identified object.
+	// Identifies the starting offset in bytes in the generated code
+	// that relates to the identified object.
 	begin?: int32 @protobuf(3)
 
-	//  Identifies the ending offset in bytes in the generated code that
-	//  relates to the identified offset. The end offset should be one past
-	//  the last relevant byte (so the length of the text = end - begin).
+	// Identifies the ending offset in bytes in the generated code that
+	// relates to the identified offset. The end offset should be one past
+	// the last relevant byte (so the length of the text = end - begin).
 	end?: int32 @protobuf(4)
 }
diff --git a/encoding/protobuf/testdata/istio.io/api/pkg/google.golang.org/genproto/googleapis/rpc/status/status_proto_gen.cue b/encoding/protobuf/testdata/istio.io/api/pkg/google.golang.org/genproto/googleapis/rpc/status/status_proto_gen.cue
index fe83de2..ab7356e 100644
--- a/encoding/protobuf/testdata/istio.io/api/pkg/google.golang.org/genproto/googleapis/rpc/status/status_proto_gen.cue
+++ b/encoding/protobuf/testdata/istio.io/api/pkg/google.golang.org/genproto/googleapis/rpc/status/status_proto_gen.cue
@@ -1,85 +1,85 @@
 
-//  Copyright 2017 Google Inc.
-// 
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-// 
-//      http://www.apache.org/licenses/LICENSE-2.0
-// 
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
+// Copyright 2017 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 package status
 
-//  The `Status` type defines a logical error model that is suitable for
-//  different programming environments, including REST APIs and RPC APIs. It is
-//  used by [gRPC](https://github.com/grpc). The error model is designed to be:
-// 
-//  - Simple to use and understand for most users
-//  - Flexible enough to meet unexpected needs
-// 
-//  # Overview
-// 
-//  The `Status` message contains three pieces of data: error code, error
-//  message, and error details. The error code should be an enum value of
-//  [google.rpc.Code][google.rpc.Code], but it may accept additional error codes
-//  if needed.  The error message should be a developer-facing English message
-//  that helps developers *understand* and *resolve* the error. If a localized
-//  user-facing error message is needed, put the localized message in the error
-//  details or localize it in the client. The optional error details may contain
-//  arbitrary information about the error. There is a predefined set of error
-//  detail types in the package `google.rpc` that can be used for common error
-//  conditions.
-// 
-//  # Language mapping
-// 
-//  The `Status` message is the logical representation of the error model, but it
-//  is not necessarily the actual wire format. When the `Status` message is
-//  exposed in different client libraries and different wire protocols, it can be
-//  mapped differently. For example, it will likely be mapped to some exceptions
-//  in Java, but more likely mapped to some error codes in C.
-// 
-//  # Other uses
-// 
-//  The error model and the `Status` message can be used in a variety of
-//  environments, either with or without APIs, to provide a
-//  consistent developer experience across different environments.
-// 
-//  Example uses of this error model include:
-// 
-//  - Partial errors. If a service needs to return partial errors to the client,
-//      it may embed the `Status` in the normal response to indicate the partial
-//      errors.
-// 
-//  - Workflow errors. A typical workflow has multiple steps. Each step may
-//      have a `Status` message for error reporting.
-// 
-//  - Batch operations. If a client uses batch request and batch response, the
-//      `Status` message should be used directly inside batch response, one for
-//      each error sub-response.
-// 
-//  - Asynchronous operations. If an API call embeds asynchronous operation
-//      results in its response, the status of those operations should be
-//      represented directly using the `Status` message.
-// 
-//  - Logging. If some API errors are stored in logs, the message `Status` could
-//      be used directly after any stripping needed for security/privacy reasons.
+// The `Status` type defines a logical error model that is suitable for
+// different programming environments, including REST APIs and RPC APIs. It is
+// used by [gRPC](https://github.com/grpc). The error model is designed to be:
+//
+// - Simple to use and understand for most users
+// - Flexible enough to meet unexpected needs
+//
+// # Overview
+//
+// The `Status` message contains three pieces of data: error code, error
+// message, and error details. The error code should be an enum value of
+// [google.rpc.Code][google.rpc.Code], but it may accept additional error codes
+// if needed.  The error message should be a developer-facing English message
+// that helps developers *understand* and *resolve* the error. If a localized
+// user-facing error message is needed, put the localized message in the error
+// details or localize it in the client. The optional error details may contain
+// arbitrary information about the error. There is a predefined set of error
+// detail types in the package `google.rpc` that can be used for common error
+// conditions.
+//
+// # Language mapping
+//
+// The `Status` message is the logical representation of the error model, but it
+// is not necessarily the actual wire format. When the `Status` message is
+// exposed in different client libraries and different wire protocols, it can be
+// mapped differently. For example, it will likely be mapped to some exceptions
+// in Java, but more likely mapped to some error codes in C.
+//
+// # Other uses
+//
+// The error model and the `Status` message can be used in a variety of
+// environments, either with or without APIs, to provide a
+// consistent developer experience across different environments.
+//
+// Example uses of this error model include:
+//
+// - Partial errors. If a service needs to return partial errors to the client,
+//     it may embed the `Status` in the normal response to indicate the partial
+//     errors.
+//
+// - Workflow errors. A typical workflow has multiple steps. Each step may
+//     have a `Status` message for error reporting.
+//
+// - Batch operations. If a client uses batch request and batch response, the
+//     `Status` message should be used directly inside batch response, one for
+//     each error sub-response.
+//
+// - Asynchronous operations. If an API call embeds asynchronous operation
+//     results in its response, the status of those operations should be
+//     represented directly using the `Status` message.
+//
+// - Logging. If some API errors are stored in logs, the message `Status` could
+//     be used directly after any stripping needed for security/privacy reasons.
 Status: {
-	//  The status code, which should be an enum value of
-	//  [google.rpc.Code][google.rpc.Code].
+	// The status code, which should be an enum value of
+	// [google.rpc.Code][google.rpc.Code].
 	code?: int32 @protobuf(1)
 
-	//  A developer-facing error message, which should be in English. Any
-	//  user-facing error message should be localized and sent in the
-	//  [google.rpc.Status.details][google.rpc.Status.details] field, or localized
-	//  by the client.
+	// A developer-facing error message, which should be in English. Any
+	// user-facing error message should be localized and sent in the
+	// [google.rpc.Status.details][google.rpc.Status.details] field, or localized
+	// by the client.
 	message?: string @protobuf(2)
 
-	//  A list of messages that carry the error details.  There is a common set of
-	//  message types for APIs to use.
+	// A list of messages that carry the error details.  There is a common set of
+	// message types for APIs to use.
 	details?: [...{
 		// A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one "/" character. The last segment of the URL's path must represent the fully qualified name of the type (as in `type.googleapis.com/google.protobuf.Duration`). The name should be in a canonical form (e.g., leading "." is not accepted).
 		// The remaining fields of this object correspond to fields of the proto messsage. If the embedded message is well-known and has a custom JSON representation, that representation is assigned to the 'value' field.
diff --git a/encoding/protobuf/util.go b/encoding/protobuf/util.go
index 38521ab..53b3b43 100644
--- a/encoding/protobuf/util.go
+++ b/encoding/protobuf/util.go
@@ -66,7 +66,8 @@
 		cg.Position = 10
 	}
 	for _, s := range c.Lines {
-		cg.List = append(cg.List, &ast.Comment{Text: "// " + s})
+		s = strings.TrimRight(s, " ")
+		cg.List = append(cg.List, &ast.Comment{Text: "//" + s})
 	}
 	return cg
 }